merge from froyo-plus-aosp

Change-Id: I42dc1a2946b44b870f4fbf21522c20974e8dfd39
diff --git a/dexopt/Android.mk b/dexopt/Android.mk
index 8637073..eb486c8 100644
--- a/dexopt/Android.mk
+++ b/dexopt/Android.mk
@@ -35,6 +35,12 @@
 		libssl \
 		libdvm
 
+ifeq ($(TARGET_CPU_SMP),true)
+    LOCAL_CFLAGS += -DANDROID_SMP=1
+else
+    LOCAL_CFLAGS += -DANDROID_SMP=0
+endif
+
 LOCAL_MODULE := dexopt
 
 include $(BUILD_EXECUTABLE)
diff --git a/dexopt/OptMain.c b/dexopt/OptMain.c
index 953db0b..d897789 100644
--- a/dexopt/OptMain.c
+++ b/dexopt/OptMain.c
@@ -56,7 +56,8 @@
 {
     ZipArchive zippy;
     ZipEntry zipEntry;
-    long uncompLen, modWhen, crc32;
+    size_t uncompLen;
+    long modWhen, crc32;
     off_t dexOffset;
     int err;
     int result = -1;
@@ -100,8 +101,8 @@
     /*
      * Extract some info about the zip entry.
      */
-    if (!dexZipGetEntryInfo(&zippy, zipEntry, NULL, &uncompLen, NULL, NULL,
-            &modWhen, &crc32))
+    if (dexZipGetEntryInfo(&zippy, zipEntry, NULL, &uncompLen, NULL, NULL,
+            &modWhen, &crc32) != 0)
     {
         LOGW("DexOptZ: zip archive GetEntryInfo failed on %s\n", debugFileName);
         goto bail;
@@ -114,7 +115,7 @@
     /*
      * Extract the DEX data into the cache file at the current offset.
      */
-    if (!dexZipExtractEntryToFile(&zippy, zipEntry, cacheFd)) {
+    if (dexZipExtractEntryToFile(&zippy, zipEntry, cacheFd) != 0) {
         LOGW("DexOptZ: extraction of %s from %s failed\n",
             kClassesDex, debugFileName);
         goto bail;
diff --git a/libdex/CmdUtils.c b/libdex/CmdUtils.c
index 102664c..109d3e5 100644
--- a/libdex/CmdUtils.c
+++ b/libdex/CmdUtils.c
@@ -70,7 +70,7 @@
         goto bail;
     }
 
-    if (!dexZipExtractEntryToFile(&archive, entry, fd)) {
+    if (dexZipExtractEntryToFile(&archive, entry, fd) != 0) {
         fprintf(stderr, "Extract of '%s' from '%s' failed\n",
             kFileToExtract, zipFileName);
         result = kUTFRBadZip;
diff --git a/libdex/SysUtil.c b/libdex/SysUtil.c
index 7c6aaef..bcba489 100644
--- a/libdex/SysUtil.c
+++ b/libdex/SysUtil.c
@@ -266,33 +266,23 @@
 }
 
 /*
- * Map part of a file (from fd's current offset) into a shared, read-only
- * memory segment.
+ * Map part of a file into a shared, read-only memory segment.  The "start"
+ * offset is absolute, not relative.
  *
  * On success, returns 0 and fills out "pMap".  On failure, returns a nonzero
  * value and does not disturb "pMap".
  */
-int sysMapFileSegmentInShmem(int fd, off_t start, long length,
+int sysMapFileSegmentInShmem(int fd, off_t start, size_t length,
     MemMapping* pMap)
 {
 #ifdef HAVE_POSIX_FILEMAP
-    off_t dummy;
-    size_t fileLength, actualLength;
+    size_t actualLength;
     off_t actualStart;
     int adjust;
     void* memPtr;
 
     assert(pMap != NULL);
 
-    if (getFileStartAndLength(fd, &dummy, &fileLength) < 0)
-        return -1;
-
-    if (start + length > (long)fileLength) {
-        LOGW("bad segment: st=%d len=%ld flen=%d\n",
-            (int) start, length, (int) fileLength);
-        return -1;
-    }
-
     /* adjust to be page-aligned */
     adjust = start % DEFAULT_PAGE_SIZE;
     actualStart = start - adjust;
diff --git a/libdex/SysUtil.h b/libdex/SysUtil.h
index b300a7b..95e5be2 100644
--- a/libdex/SysUtil.h
+++ b/libdex/SysUtil.h
@@ -80,7 +80,7 @@
 /*
  * Like sysMapFileInShmemReadOnly, but on only part of a file.
  */
-int sysMapFileSegmentInShmem(int fd, off_t start, long length,
+int sysMapFileSegmentInShmem(int fd, off_t start, size_t length,
     MemMapping* pMap);
 
 /*
diff --git a/libdex/ZipArchive.c b/libdex/ZipArchive.c
index 7c7e18e..c935f11 100644
--- a/libdex/ZipArchive.c
+++ b/libdex/ZipArchive.c
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 /*
  * Read-only access to Zip archives, with minimal heap allocation.
  */
@@ -21,10 +22,13 @@
 #include <zlib.h>
 
 #include <stdlib.h>
+#include <unistd.h>
 #include <string.h>
 #include <fcntl.h>
 #include <errno.h>
 
+#include <JNIHelp.h>        // TEMP_FAILURE_RETRY may or may not be in unistd
+
 
 /*
  * Zip file constants.
@@ -32,6 +36,7 @@
 #define kEOCDSignature      0x06054b50
 #define kEOCDLen            22
 #define kEOCDNumEntries     8               // offset to #of entries in file
+#define kEOCDSize           12              // size of the central directory
 #define kEOCDFileOffset     16              // offset to central directory
 
 #define kMaxCommentLen      65535           // longest possible in ushort
@@ -72,7 +77,7 @@
     if (ent < 0 || ent >= pArchive->mHashTableSize ||
         pArchive->mHashTable[ent].name == NULL)
     {
-        LOGW("Invalid ZipEntry %p (%ld)\n", entry, ent);
+        LOGW("Zip: invalid ZipEntry %p (%ld)\n", entry, ent);
         return -1;
     }
     return ent;
@@ -134,156 +139,205 @@
 }
 
 /*
- * Parse the Zip archive, verifying its contents and initializing internal
- * data structures.
+ * Find the zip Central Directory and memory-map it.
+ *
+ * On success, returns 0 after populating fields from the EOCD area:
+ *   mDirectoryOffset
+ *   mDirectoryMap
+ *   mNumEntries
  */
-static bool parseZipArchive(ZipArchive* pArchive, const MemMapping* pMap)
+static int mapCentralDirectory(int fd, const char* debugFileName,
+    ZipArchive* pArchive)
 {
-#define CHECK_OFFSET(_off) {                                                \
-        if ((unsigned int) (_off) >= maxOffset) {                           \
-            LOGE("ERROR: bad offset %u (max %d): %s\n",                     \
-                (unsigned int) (_off), maxOffset, #_off);                   \
-            goto bail;                                                      \
-        }                                                                   \
-    }
-    bool result = false;
-    const unsigned char* basePtr = (const unsigned char*)pMap->addr;
-    const unsigned char* ptr;
-    size_t length = pMap->length;
-    unsigned int i, numEntries, cdOffset;
-    unsigned int val;
+    u1* scanBuf = NULL;
+    int result = -1;
 
     /*
-     * The first 4 bytes of the file will either be the local header
-     * signature for the first file (kLFHSignature) or, if the archive doesn't
-     * have any files in it, the end-of-central-directory signature
-     * (kEOCDSignature).
+     * Get and test file length.
      */
-    val = get4LE(basePtr);
-    if (val == kEOCDSignature) {
-        LOGI("Found Zip archive, but it looks empty\n");
-        goto bail;
-    } else if (val != kLFHSignature) {
-        LOGV("Not a Zip archive (found 0x%08x)\n", val);
+    off_t fileLength = lseek(fd, 0, SEEK_END);
+    if (fileLength < kEOCDLen) {
+        LOGV("Zip: length %ld is too small to be zip\n", (long) fileLength);
         goto bail;
     }
 
     /*
-     * Find the EOCD.  We'll find it immediately unless they have a file
-     * comment.
-     */
-    ptr = basePtr + length - kEOCDLen;
-
-    while (ptr >= basePtr) {
-        if (*ptr == (kEOCDSignature & 0xff) && get4LE(ptr) == kEOCDSignature)
-            break;
-        ptr--;
-    }
-    if (ptr < basePtr) {
-        LOGI("Could not find end-of-central-directory in Zip\n");
-        goto bail;
-    }
-
-    /*
-     * There are two interesting items in the EOCD block: the number of
-     * entries in the file, and the file offset of the start of the
-     * central directory.
+     * Perform the traditional EOCD snipe hunt.
      *
-     * (There's actually a count of the #of entries in this file, and for
-     * all files which comprise a spanned archive, but for our purposes
-     * we're only interested in the current file.  Besides, we expect the
-     * two to be equivalent for our stuff.)
+     * We're searching for the End of Central Directory magic number,
+     * which appears at the start of the EOCD block.  It's followed by
+     * 18 bytes of EOCD stuff and up to 64KB of archive comment.  We
+     * need to read the last part of the file into a buffer, dig through
+     * it to find the magic number, parse some values out, and use those
+     * to determine the extent of the CD.
+     *
+     * We start by pulling in the last part of the file.
      */
-    numEntries = get2LE(ptr + kEOCDNumEntries);
-    cdOffset = get4LE(ptr + kEOCDFileOffset);
+    size_t readAmount = kMaxEOCDSearch;
+    if (readAmount > (size_t) fileLength)
+        readAmount = fileLength;
+    off_t searchStart = fileLength - readAmount;
 
-    /* valid offsets are [0,EOCD] */
-    unsigned int maxOffset;
-    maxOffset = (ptr - basePtr) +1;
-
-    LOGV("+++ numEntries=%d cdOffset=%d\n", numEntries, cdOffset);
-    if (numEntries == 0 || cdOffset >= length) {
-        LOGW("Invalid entries=%d offset=%d (len=%zd)\n",
-            numEntries, cdOffset, length);
+    scanBuf = (u1*) malloc(readAmount);
+    if (lseek(fd, searchStart, SEEK_SET) != searchStart) {
+        LOGW("Zip: seek %ld failed: %s\n", (long) searchStart, strerror(errno));
         goto bail;
     }
+    ssize_t actual = TEMP_FAILURE_RETRY(read(fd, scanBuf, readAmount));
+    if (actual != (ssize_t) readAmount) {
+        LOGW("Zip: read %zd failed: %s\n", readAmount, strerror(errno));
+        goto bail;
+    }
+
+    /*
+     * Scan backward for the EOCD magic.  In an archive without a trailing
+     * comment, we'll find it on the first try.  (We may want to consider
+     * doing an initial minimal read; if we don't find it, retry with a
+     * second read as above.)
+     */
+    int i;
+    for (i = readAmount - kEOCDLen; i >= 0; i--) {
+        if (scanBuf[i] == 0x50 && get4LE(&scanBuf[i]) == kEOCDSignature) {
+            LOGV("+++ Found EOCD at buf+%d\n", i);
+            break;
+        }
+    }
+    if (i < 0) {
+        LOGD("Zip: EOCD not found, %s is not zip\n", debugFileName);
+        goto bail;
+    }
+
+    off_t eocdOffset = searchStart + i;
+    const u1* eocdPtr = scanBuf + i;
+
+    assert(eocdOffset < fileLength);
+
+    /*
+     * Grab the CD offset and size, and the number of entries in the
+     * archive.  Verify that they look reasonable.
+     */
+    u4 numEntries = get2LE(eocdPtr + kEOCDNumEntries);
+    u4 dirSize = get4LE(eocdPtr + kEOCDSize);
+    u4 dirOffset = get4LE(eocdPtr + kEOCDFileOffset);
+
+    if ((long long) dirOffset + (long long) dirSize > (long long) eocdOffset) {
+        LOGW("Zip: bad offsets (dir %ld, size %u, eocd %ld)\n",
+            (long) dirOffset, dirSize, (long) eocdOffset);
+        goto bail;
+    }
+    if (numEntries == 0) {
+        LOGW("Zip: empty archive?\n");
+        goto bail;
+    }
+
+    LOGV("+++ numEntries=%d dirSize=%d dirOffset=%d\n",
+        numEntries, dirSize, dirOffset);
+
+    /*
+     * It all looks good.  Create a mapping for the CD, and set the fields
+     * in pArchive.
+     */
+    if (sysMapFileSegmentInShmem(fd, dirOffset, dirSize,
+            &pArchive->mDirectoryMap) != 0)
+    {
+        LOGW("Zip: cd map failed\n");
+        goto bail;
+    }
+
+    pArchive->mNumEntries = numEntries;
+    pArchive->mDirectoryOffset = dirOffset;
+
+    result = 0;
+
+bail:
+    free(scanBuf);
+    return result;
+}
+
+/*
+ * Parses the Zip archive's Central Directory.  Allocates and populates the
+ * hash table.
+ *
+ * Returns 0 on success.
+ */
+static int parseZipArchive(ZipArchive* pArchive)
+{
+    int result = -1;
+    const u1* cdPtr = (const u1*)pArchive->mDirectoryMap.addr;
+    size_t cdLength = pArchive->mDirectoryMap.length;
+    int numEntries = pArchive->mNumEntries;
 
     /*
      * Create hash table.  We have a minimum 75% load factor, possibly as
      * low as 50% after we round off to a power of 2.  There must be at
      * least one unused entry to avoid an infinite loop during creation.
      */
-    pArchive->mNumEntries = numEntries;
     pArchive->mHashTableSize = dexRoundUpPower2(1 + (numEntries * 4) / 3);
     pArchive->mHashTable = (ZipHashEntry*)
             calloc(pArchive->mHashTableSize, sizeof(ZipHashEntry));
 
     /*
      * Walk through the central directory, adding entries to the hash
-     * table.
+     * table and verifying values.
      */
-    ptr = basePtr + cdOffset;
+    const u1* ptr = cdPtr;
+    int i;
     for (i = 0; i < numEntries; i++) {
-        unsigned int fileNameLen, extraLen, commentLen, localHdrOffset;
-        const unsigned char* localHdr;
-        unsigned int hash;
-
         if (get4LE(ptr) != kCDESignature) {
-            LOGW("Missed a central dir sig (at %d)\n", i);
+            LOGW("Zip: missed a central dir sig (at %d)\n", i);
             goto bail;
         }
-        if (ptr + kCDELen > basePtr + length) {
-            LOGW("Ran off the end (at %d)\n", i);
+        if (ptr + kCDELen > cdPtr + cdLength) {
+            LOGW("Zip: ran off the end (at %d)\n", i);
             goto bail;
         }
 
-        localHdrOffset = get4LE(ptr + kCDELocalOffset);
-        CHECK_OFFSET(localHdrOffset);
+        long localHdrOffset = (long) get4LE(ptr + kCDELocalOffset);
+        if (localHdrOffset >= pArchive->mDirectoryOffset) {
+            LOGW("Zip: bad LFH offset %ld at entry %d\n", localHdrOffset, i);
+            goto bail;
+        }
+
+        unsigned int fileNameLen, extraLen, commentLen, hash;
         fileNameLen = get2LE(ptr + kCDENameLen);
         extraLen = get2LE(ptr + kCDEExtraLen);
         commentLen = get2LE(ptr + kCDECommentLen);
 
-        //LOGV("+++ %d: localHdr=%d fnl=%d el=%d cl=%d\n",
-        //    i, localHdrOffset, fileNameLen, extraLen, commentLen);
-        //LOGV(" '%.*s'\n", fileNameLen, ptr + kCDELen);
-
         /* add the CDE filename to the hash table */
         hash = computeHash((const char*)ptr + kCDELen, fileNameLen);
         addToHash(pArchive, (const char*)ptr + kCDELen, fileNameLen, hash);
 
-        localHdr = basePtr + localHdrOffset;
-        if (get4LE(localHdr) != kLFHSignature) {
-            LOGW("Bad offset to local header: %d (at %d)\n",
-                localHdrOffset, i);
+        ptr += kCDELen + fileNameLen + extraLen + commentLen;
+        if ((size_t)(ptr - cdPtr) > cdLength) {
+            LOGW("Zip: bad CD advance (%d vs %zd) at entry %d\n",
+                (int) (ptr - cdPtr), cdLength, i);
             goto bail;
         }
-
-        ptr += kCDELen + fileNameLen + extraLen + commentLen;
-        CHECK_OFFSET(ptr - basePtr);
     }
+    LOGV("+++ zip good scan %d entries\n", numEntries);
 
-    result = true;
+    result = 0;
 
 bail:
     return result;
-#undef CHECK_OFFSET
 }
 
 /*
- * Open the specified file read-only.  We memory-map the entire thing and
- * parse the contents.
+ * Open the specified file read-only.  We examine the contents and verify
+ * that it appears to be a valid zip file.
  *
  * This will be called on non-Zip files, especially during VM startup, so
  * we don't want to be too noisy about certain types of failure.  (Do
  * we want a "quiet" flag?)
  *
- * On success, we fill out the contents of "pArchive" and return 0.
+ * On success, we fill out the contents of "pArchive" and return 0.  On
+ * failure we return the errno value.
  */
 int dexZipOpenArchive(const char* fileName, ZipArchive* pArchive)
 {
     int fd, err;
 
-    LOGV("Opening archive '%s' %p\n", fileName, pArchive);
+    LOGV("Opening as zip '%s' %p\n", fileName, pArchive);
 
     memset(pArchive, 0, sizeof(ZipArchive));
 
@@ -298,47 +352,32 @@
 }
 
 /*
- * Prepare to access a ZipArchive in an open file descriptor.
+ * Prepare to access a ZipArchive through an open file descriptor.
+ *
+ * On success, we fill out the contents of "pArchive" and return 0.
  */
 int dexZipPrepArchive(int fd, const char* debugFileName, ZipArchive* pArchive)
 {
-    MemMapping map;
-    int err;
+    int result = -1;
 
-    map.addr = NULL;
     memset(pArchive, 0, sizeof(*pArchive));
-
     pArchive->mFd = fd;
 
-    if (sysMapFileInShmemReadOnly(pArchive->mFd, &map) != 0) {
-        err = -1;
-        LOGW("Map of '%s' failed\n", debugFileName);
+    if (mapCentralDirectory(fd, debugFileName, pArchive) != 0)
         goto bail;
-    }
 
-    if (map.length < kEOCDLen) {
-        err = -1;
-        LOGV("File '%s' too small to be zip (%zd)\n", debugFileName,map.length);
-        goto bail;
-    }
-
-    if (!parseZipArchive(pArchive, &map)) {
-        err = -1;
-        LOGV("Parsing '%s' failed\n", debugFileName);
+    if (parseZipArchive(pArchive) != 0) {
+        LOGV("Zip: parsing '%s' failed\n", debugFileName);
         goto bail;
     }
 
     /* success */
-    err = 0;
-    sysCopyMap(&pArchive->mMap, &map);
-    map.addr = NULL;
+    result = 0;
 
 bail:
-    if (err != 0)
+    if (result != 0)
         dexZipCloseArchive(pArchive);
-    if (map.addr != NULL)
-        sysReleaseShmem(&map);
-    return err;
+    return result;
 }
 
 
@@ -354,10 +393,12 @@
     if (pArchive->mFd >= 0)
         close(pArchive->mFd);
 
-    sysReleaseShmem(&pArchive->mMap);
+    sysReleaseShmem(&pArchive->mDirectoryMap);
 
     free(pArchive->mHashTable);
 
+    /* ensure nobody tries to use the ZipArchive after it's closed */
+    pArchive->mDirectoryOffset = -1;
     pArchive->mFd = -1;
     pArchive->mNumEntries = -1;
     pArchive->mHashTableSize = -1;
@@ -382,7 +423,7 @@
             memcmp(pArchive->mHashTable[ent].name, entryName, nameLen) == 0)
         {
             /* match */
-            return (ZipEntry) (ent + kZipEntryAdj);
+            return (ZipEntry)(long)(ent + kZipEntryAdj);
         }
 
         ent = (ent + 1) & (hashTableSize-1);
@@ -421,27 +462,27 @@
 /*
  * Get the useful fields from the zip entry.
  *
- * Returns "false" if the offsets to the fields or the contents of the fields
- * appear to be bogus.
+ * Returns non-zero if the contents of the fields (particularly the data
+ * offset) appear to be bogus.
  */
-bool dexZipGetEntryInfo(const ZipArchive* pArchive, ZipEntry entry,
-    int* pMethod, long* pUncompLen, long* pCompLen, off_t* pOffset,
+int dexZipGetEntryInfo(const ZipArchive* pArchive, ZipEntry entry,
+    int* pMethod, size_t* pUncompLen, size_t* pCompLen, off_t* pOffset,
     long* pModWhen, long* pCrc32)
 {
     int ent = entryToIndex(pArchive, entry);
     if (ent < 0)
-        return false;
+        return -1;
 
     /*
      * Recover the start of the central directory entry from the filename
-     * pointer.
+     * pointer.  The filename is the first entry past the fixed-size data,
+     * so we can just subtract back from that.
      */
     const unsigned char* basePtr = (const unsigned char*)
-        pArchive->mMap.addr;
+        pArchive->mDirectoryMap.addr;
     const unsigned char* ptr = (const unsigned char*)
         pArchive->mHashTable[ent].name;
-    size_t zipLength =
-        pArchive->mMap.length;
+    off_t cdOffset = pArchive->mDirectoryOffset;
 
     ptr -= kCDELen;
 
@@ -454,87 +495,120 @@
     if (pCrc32 != NULL)
         *pCrc32 = get4LE(ptr + kCDECRC);
 
+    size_t compLen = get4LE(ptr + kCDECompLen);
+    if (pCompLen != NULL)
+        *pCompLen = compLen;
+    size_t uncompLen = get4LE(ptr + kCDEUncompLen);
+    if (pUncompLen != NULL)
+        *pUncompLen = uncompLen;
+
     /*
-     * We need to make sure that the lengths are not so large that somebody
-     * trying to map the compressed or uncompressed data runs off the end
-     * of the mapped region.
+     * If requested, determine the offset of the start of the data.  All we
+     * have is the offset to the Local File Header, which is variable size,
+     * so we have to read the contents of the struct to figure out where
+     * the actual data starts.
+     *
+     * We also need to make sure that the lengths are not so large that
+     * somebody trying to map the compressed or uncompressed data runs
+     * off the end of the mapped region.
+     *
+     * Note we don't verify compLen/uncompLen if they don't request the
+     * dataOffset, because dataOffset is expensive to determine.  However,
+     * if they don't have the file offset, they're not likely to be doing
+     * anything with the contents.
      */
-    unsigned long localHdrOffset = get4LE(ptr + kCDELocalOffset);
-    if (localHdrOffset + kLFHLen >= zipLength) {
-        LOGE("ERROR: bad local hdr offset in zip\n");
-        return false;
-    }
-    const unsigned char* localHdr = basePtr + localHdrOffset;
-    off_t dataOffset = localHdrOffset + kLFHLen
-        + get2LE(localHdr + kLFHNameLen) + get2LE(localHdr + kLFHExtraLen);
-    if ((unsigned long) dataOffset >= zipLength) {
-        LOGE("ERROR: bad data offset in zip\n");
-        return false;
-    }
-
-    if (pCompLen != NULL) {
-        *pCompLen = get4LE(ptr + kCDECompLen);
-        if (*pCompLen < 0 || (size_t)(dataOffset + *pCompLen) >= zipLength) {
-            LOGE("ERROR: bad compressed length in zip\n");
-            return false;
-        }
-    }
-    if (pUncompLen != NULL) {
-        *pUncompLen = get4LE(ptr + kCDEUncompLen);
-        if (*pUncompLen < 0) {
-            LOGE("ERROR: negative uncompressed length in zip\n");
-            return false;
-        }
-        if (method == kCompressStored &&
-            (size_t)(dataOffset + *pUncompLen) >= zipLength)
-        {
-            LOGE("ERROR: bad uncompressed length in zip\n");
-            return false;
-        }
-    }
-
     if (pOffset != NULL) {
+        long localHdrOffset = (long) get4LE(ptr + kCDELocalOffset);
+        if (localHdrOffset + kLFHLen >= cdOffset) {
+            LOGW("Zip: bad local hdr offset in zip\n");
+            return -1;
+        }
+
+        u1 lfhBuf[kLFHLen];
+        if (lseek(pArchive->mFd, localHdrOffset, SEEK_SET) != localHdrOffset) {
+            LOGW("Zip: failed seeking to lfh at offset %ld\n", localHdrOffset);
+            return -1;
+        }
+        ssize_t actual =
+            TEMP_FAILURE_RETRY(read(pArchive->mFd, lfhBuf, sizeof(lfhBuf)));
+        if (actual != sizeof(lfhBuf)) {
+            LOGW("Zip: failed reading lfh from offset %ld\n", localHdrOffset);
+            return -1;
+        }
+
+        if (get4LE(lfhBuf) != kLFHSignature) {
+            LOGW("Zip: didn't find signature at start of lfh, offset=%ld\n",
+                localHdrOffset);
+            return -1;
+        }
+
+        off_t dataOffset = localHdrOffset + kLFHLen
+            + get2LE(lfhBuf + kLFHNameLen) + get2LE(lfhBuf + kLFHExtraLen);
+        if (dataOffset >= cdOffset) {
+            LOGW("Zip: bad data offset %ld in zip\n", (long) dataOffset);
+            return -1;
+        }
+
+        /* check lengths */
+        if ((off_t)(dataOffset + compLen) > cdOffset) {
+            LOGW("Zip: bad compressed length in zip (%ld + %zd > %ld)\n",
+                (long) dataOffset, compLen, (long) cdOffset);
+            return -1;
+        }
+
+        if (method == kCompressStored &&
+            (off_t)(dataOffset + uncompLen) > cdOffset)
+        {
+            LOGW("Zip: bad uncompressed length in zip (%ld + %zd > %ld)\n",
+                (long) dataOffset, uncompLen, (long) cdOffset);
+            return -1;
+        }
+
         *pOffset = dataOffset;
     }
-    return true;
+    return 0;
 }
 
 /*
- * Uncompress "deflate" data from one buffer to an open file descriptor.
+ * Uncompress "deflate" data from the archive's file to an open file
+ * descriptor.
  */
-static bool inflateToFile(int fd, const void* inBuf, long uncompLen,
-    long compLen)
+static int inflateToFile(int inFd, int outFd, size_t uncompLen, size_t compLen)
 {
-    bool result = false;
-    const int kWriteBufSize = 32768;
-    unsigned char writeBuf[kWriteBufSize];
+    int result = -1;
+    const size_t kBufSize = 32768;
+    unsigned char* readBuf = (unsigned char*) malloc(kBufSize);
+    unsigned char* writeBuf = (unsigned char*) malloc(kBufSize);
     z_stream zstream;
     int zerr;
 
+    if (readBuf == NULL || writeBuf == NULL)
+        goto bail;
+
     /*
      * Initialize the zlib stream struct.
      */
-	memset(&zstream, 0, sizeof(zstream));
+    memset(&zstream, 0, sizeof(zstream));
     zstream.zalloc = Z_NULL;
     zstream.zfree = Z_NULL;
     zstream.opaque = Z_NULL;
-    zstream.next_in = (Bytef*)inBuf;
-    zstream.avail_in = compLen;
+    zstream.next_in = NULL;
+    zstream.avail_in = 0;
     zstream.next_out = (Bytef*) writeBuf;
-    zstream.avail_out = sizeof(writeBuf);
+    zstream.avail_out = kBufSize;
     zstream.data_type = Z_UNKNOWN;
 
-	/*
-	 * Use the undocumented "negative window bits" feature to tell zlib
-	 * that there's no zlib header waiting for it.
-	 */
+    /*
+     * Use the undocumented "negative window bits" feature to tell zlib
+     * that there's no zlib header waiting for it.
+     */
     zerr = inflateInit2(&zstream, -MAX_WBITS);
     if (zerr != Z_OK) {
         if (zerr == Z_VERSION_ERROR) {
             LOGE("Installed zlib is not compatible with linked version (%s)\n",
                 ZLIB_VERSION);
         } else {
-            LOGE("Call to inflateInit2 failed (zerr=%d)\n", zerr);
+            LOGW("Call to inflateInit2 failed (zerr=%d)\n", zerr);
         }
         goto bail;
     }
@@ -543,12 +617,27 @@
      * Loop while we have more to do.
      */
     do {
-        /*
-         * Expand data.
-         */
+        /* read as much as we can */
+        if (zstream.avail_in == 0) {
+            size_t getSize = (compLen > kBufSize) ? kBufSize : compLen;
+
+            ssize_t actual = TEMP_FAILURE_RETRY(read(inFd, readBuf, getSize));
+            if (actual != (ssize_t) getSize) {
+                LOGW("Zip: inflate read failed (%d vs %zd)\n",
+                    (int)actual, getSize);
+                goto z_bail;
+            }
+
+            compLen -= getSize;
+
+            zstream.next_in = readBuf;
+            zstream.avail_in = getSize;
+        }
+
+        /* uncompress the data */
         zerr = inflate(&zstream, Z_NO_FLUSH);
         if (zerr != Z_OK && zerr != Z_STREAM_END) {
-            LOGW("zlib inflate: zerr=%d (nIn=%p aIn=%u nOut=%p aOut=%u)\n",
+            LOGW("Zip: inflate zerr=%d (nIn=%p aIn=%u nOut=%p aOut=%u)\n",
                 zerr, zstream.next_in, zstream.avail_in,
                 zstream.next_out, zstream.avail_out);
             goto z_bail;
@@ -556,88 +645,116 @@
 
         /* write when we're full or when we're done */
         if (zstream.avail_out == 0 ||
-            (zerr == Z_STREAM_END && zstream.avail_out != sizeof(writeBuf)))
+            (zerr == Z_STREAM_END && zstream.avail_out != kBufSize))
         {
-            long writeSize = zstream.next_out - writeBuf;
-            int cc = write(fd, writeBuf, writeSize);
-            if (cc != (int) writeSize) {
-                if (cc < 0) {
-                    LOGW("write failed in inflate: %s\n", strerror(errno));
+            size_t writeSize = zstream.next_out - writeBuf;
+            ssize_t actual =
+                TEMP_FAILURE_RETRY(write(outFd, writeBuf, writeSize));
+            if (actual != (ssize_t) writeSize) {
+                if (actual < 0) {
+                    LOGW("Zip: write failed in inflate: %s\n", strerror(errno));
                 } else {
-                    LOGW("partial write in inflate (%d vs %ld)\n",
-                        cc, writeSize);
+                    LOGW("Zip: partial write in inflate (%d vs %zd)\n",
+                        (int) actual, writeSize);
                 }
                 goto z_bail;
             }
 
             zstream.next_out = writeBuf;
-            zstream.avail_out = sizeof(writeBuf);
+            zstream.avail_out = kBufSize;
         }
     } while (zerr == Z_OK);
 
     assert(zerr == Z_STREAM_END);       /* other errors should've been caught */
 
     /* paranoia */
-    if ((long) zstream.total_out != uncompLen) {
-        LOGW("Size mismatch on inflated file (%ld vs %ld)\n",
+    if (zstream.total_out != uncompLen) {
+        LOGW("Zip: size mismatch on inflated file (%ld vs %zd)\n",
             zstream.total_out, uncompLen);
         goto z_bail;
     }
 
-    result = true;
+    result = 0;
 
 z_bail:
     inflateEnd(&zstream);        /* free up any allocated structures */
 
 bail:
+    free(readBuf);
+    free(writeBuf);
     return result;
 }
 
 /*
+ * Copy bytes from input to output.
+ */
+static int copyFileToFile(int inFd, int outFd, size_t uncompLen)
+{
+    const size_t kBufSize = 32768;
+    unsigned char buf[kBufSize];
+
+    while (uncompLen != 0) {
+        size_t getSize = (uncompLen > kBufSize) ? kBufSize : uncompLen;
+
+        ssize_t actual = TEMP_FAILURE_RETRY(read(inFd, buf, getSize));
+        if (actual != (ssize_t) getSize) {
+            LOGW("Zip: copy read failed (%d vs %zd)\n", (int)actual, getSize);
+            return -1;
+        }
+
+        actual = TEMP_FAILURE_RETRY(write(outFd, buf, getSize));
+        if (actual != (ssize_t) getSize) {
+            /* could be disk out of space, so show errno in message */
+            LOGW("Zip: copy write failed (%d vs %zd): %s\n",
+                (int) actual, getSize, strerror(errno));
+            return -1;
+        }
+
+        uncompLen -= getSize;
+    }
+
+    return 0;
+}
+
+/*
  * Uncompress an entry, in its entirety, to an open file descriptor.
  *
  * TODO: this doesn't verify the data's CRC, but probably should (especially
  * for uncompressed data).
  */
-bool dexZipExtractEntryToFile(const ZipArchive* pArchive,
+int dexZipExtractEntryToFile(const ZipArchive* pArchive,
     const ZipEntry entry, int fd)
 {
-    bool result = false;
+    int result = -1;
     int ent = entryToIndex(pArchive, entry);
-    if (ent < 0)
-        return -1;
+    if (ent < 0) {
+        LOGW("Zip: extract can't find entry %p\n", entry);
+        goto bail;
+    }
 
-    const unsigned char* basePtr = (const unsigned char*)pArchive->mMap.addr;
     int method;
-    long uncompLen, compLen;
-    off_t offset;
+    size_t uncompLen, compLen;
+    off_t dataOffset;
 
-    if (!dexZipGetEntryInfo(pArchive, entry, &method, &uncompLen, &compLen,
-            &offset, NULL, NULL))
+    if (dexZipGetEntryInfo(pArchive, entry, &method, &uncompLen, &compLen,
+            &dataOffset, NULL, NULL) != 0)
     {
         goto bail;
     }
+    if (lseek(pArchive->mFd, dataOffset, SEEK_SET) != dataOffset) {
+        LOGW("Zip: lseek to data at %ld failed\n", (long) dataOffset);
+        goto bail;
+    }
 
     if (method == kCompressStored) {
-        ssize_t actual;
-
-        actual = write(fd, basePtr + offset, uncompLen);
-        if (actual < 0) {
-            LOGE("Write failed: %s\n", strerror(errno));
+        if (copyFileToFile(pArchive->mFd, fd, uncompLen) != 0)
             goto bail;
-        } else if (actual != uncompLen) {
-            LOGE("Partial write during uncompress (%d of %ld)\n",
-                (int) actual, uncompLen);
-            goto bail;
-        } else {
-            LOGI("+++ successful write\n");
-        }
     } else {
-        if (!inflateToFile(fd, basePtr+offset, uncompLen, compLen))
+        if (inflateToFile(pArchive->mFd, fd, uncompLen, compLen) != 0)
             goto bail;
     }
 
-    result = true;
+    result = 0;
 
 bail:
     return result;
diff --git a/libdex/ZipArchive.h b/libdex/ZipArchive.h
index 0cd98b2..bf4edf9 100644
--- a/libdex/ZipArchive.h
+++ b/libdex/ZipArchive.h
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 /*
  * Read-only access to Zip archives, with minimal heap allocation.
  */
@@ -41,12 +42,15 @@
 /*
  * Read-only Zip archive.
  *
- * We want "open" and "find entry by name" to be fast operations, and we
- * want to use as little memory as possible.  We memory-map the file,
- * and load a hash table with pointers to the filenames (which aren't
- * null-terminated).  The other fields are at a fixed offset from the
- * filename, so we don't need to extract those (but we do need to byte-read
- * and endian-swap them every time we want them).
+ * We want "open" and "find entry by name" to be fast operations, and
+ * we want to use as little memory as possible.  We memory-map the zip
+ * central directory, and load a hash table with pointers to the filenames
+ * (which aren't null-terminated).  The other fields are at a fixed offset
+ * from the filename, so we don't need to extract those (but we do need
+ * to byte-read and endian-swap them every time we want them).
+ *
+ * It's possible that somebody has handed us a massive (~1GB) zip archive,
+ * so we can't expect to mmap the entire file.
  *
  * To speed comparisons when doing a lookup by name, we could make the mapping
  * "private" (copy-on-write) and null-terminate the filenames after verifying
@@ -58,8 +62,9 @@
     /* open Zip archive */
     int         mFd;
 
-    /* mapped file */
-    MemMapping  mMap;
+    /* mapped central directory area */
+    off_t       mDirectoryOffset;
+    MemMapping  mDirectoryMap;
 
     /* number of entries in the Zip archive */
     int         mNumEntries;
@@ -121,9 +126,11 @@
 /*
  * Retrieve one or more of the "interesting" fields.  Non-NULL pointers
  * are filled in.
+ *
+ * Returns 0 on success.
  */
-bool dexZipGetEntryInfo(const ZipArchive* pArchive, ZipEntry entry,
-    int* pMethod, long* pUncompLen, long* pCompLen, off_t* pOffset,
+int dexZipGetEntryInfo(const ZipArchive* pArchive, ZipEntry entry,
+    int* pMethod, size_t* pUncompLen, size_t* pCompLen, off_t* pOffset,
     long* pModWhen, long* pCrc32);
 
 /*
@@ -136,10 +143,10 @@
     dexZipGetEntryInfo(pArchive, entry, NULL, NULL, NULL, &val, NULL, NULL);
     return (long) val;
 }
-DEX_INLINE long dexGetZipEntryUncompLen(const ZipArchive* pArchive,
+DEX_INLINE size_t dexGetZipEntryUncompLen(const ZipArchive* pArchive,
     const ZipEntry entry)
 {
-    long val = 0;
+    size_t val = 0;
     dexZipGetEntryInfo(pArchive, entry, NULL, &val, NULL, NULL, NULL, NULL);
     return val;
 }
@@ -160,8 +167,10 @@
 
 /*
  * Uncompress and write an entry to a file descriptor.
+ *
+ * Returns 0 on success.
  */
-bool dexZipExtractEntryToFile(const ZipArchive* pArchive,
+int dexZipExtractEntryToFile(const ZipArchive* pArchive,
     const ZipEntry entry, int fd);
 
 /*
diff --git a/libnativehelper/JNIHelp.c b/libnativehelper/JNIHelp.c
index a75b837..1dff85d 100644
--- a/libnativehelper/JNIHelp.c
+++ b/libnativehelper/JNIHelp.c
@@ -40,11 +40,15 @@
         LOGE("Native registration unable to find class '%s'\n", className);
         return -1;
     }
+
+    int result = 0;
     if ((*env)->RegisterNatives(env, clazz, gMethods, numMethods) < 0) {
         LOGE("RegisterNatives failed for '%s'\n", className);
-        return -1;
+        result = -1;
     }
-    return 0;
+
+    (*env)->DeleteLocalRef(env, clazz);
+    return result;
 }
 
 /*
@@ -52,45 +56,113 @@
  * be populated with the "binary" class name and, if present, the
  * exception message.
  */
-static void getExceptionSummary(JNIEnv* env, jthrowable excep, char* buf,
-    size_t bufLen)
+static void getExceptionSummary(JNIEnv* env, jthrowable exception, char* buf, size_t bufLen)
 {
-    if (excep == NULL)
-        return;
+    int success = 0;
 
-    /* get the name of the exception's class; none of these should fail */
-    jclass clazz = (*env)->GetObjectClass(env, excep); // exception's class
-    jclass jlc = (*env)->GetObjectClass(env, clazz);   // java.lang.Class
-    jmethodID getNameMethod =
-        (*env)->GetMethodID(env, jlc, "getName", "()Ljava/lang/String;");
-    jstring className = (*env)->CallObjectMethod(env, clazz, getNameMethod);
+    /* get the name of the exception's class */
+    jclass exceptionClazz = (*env)->GetObjectClass(env, exception); // can't fail
+    jclass classClazz = (*env)->GetObjectClass(env, exceptionClazz); // java.lang.Class, can't fail
+    jmethodID classGetNameMethod = (*env)->GetMethodID(
+            env, classClazz, "getName", "()Ljava/lang/String;");
+    jstring classNameStr = (*env)->CallObjectMethod(env, exceptionClazz, classGetNameMethod);
+    if (classNameStr != NULL) {
+        /* get printable string */
+        const char* classNameChars = (*env)->GetStringUTFChars(env, classNameStr, NULL);
+        if (classNameChars != NULL) {
+            /* if the exception has a message string, get that */
+            jmethodID throwableGetMessageMethod = (*env)->GetMethodID(
+                    env, exceptionClazz, "getMessage", "()Ljava/lang/String;");
+            jstring messageStr = (*env)->CallObjectMethod(
+                    env, exception, throwableGetMessageMethod);
 
-    /* get printable string */
-    const char* nameStr = (*env)->GetStringUTFChars(env, className, NULL);
-    if (nameStr == NULL) {
-        snprintf(buf, bufLen, "%s", "out of memory generating summary");
-        (*env)->ExceptionClear(env);            // clear OOM
-        return;
+            if (messageStr != NULL) {
+                const char* messageChars = (*env)->GetStringUTFChars(env, messageStr, NULL);
+                if (messageChars != NULL) {
+                    snprintf(buf, bufLen, "%s: %s", classNameChars, messageChars);
+                    (*env)->ReleaseStringUTFChars(env, messageStr, messageChars);
+                } else {
+                    (*env)->ExceptionClear(env); // clear OOM
+                    snprintf(buf, bufLen, "%s: <error getting message>", classNameChars);
+                }
+                (*env)->DeleteLocalRef(env, messageStr);
+            } else {
+                strncpy(buf, classNameChars, bufLen);
+                buf[bufLen - 1] = '\0';
+            }
+
+            (*env)->ReleaseStringUTFChars(env, classNameStr, classNameChars);
+            success = 1;
+        }
+        (*env)->DeleteLocalRef(env, classNameStr);
+    }
+    (*env)->DeleteLocalRef(env, classClazz);
+    (*env)->DeleteLocalRef(env, exceptionClazz);
+
+    if (! success) {
+        (*env)->ExceptionClear(env);
+        snprintf(buf, bufLen, "%s", "<error getting class name>");
+    }
+}
+
+/*
+ * Formats an exception as a string with its stack trace.
+ */
+static void printStackTrace(JNIEnv* env, jthrowable exception, char* buf, size_t bufLen)
+{
+    int success = 0;
+
+    jclass stringWriterClazz = (*env)->FindClass(env, "java/io/StringWriter");
+    if (stringWriterClazz != NULL) {
+        jmethodID stringWriterCtor = (*env)->GetMethodID(env, stringWriterClazz,
+                "<init>", "()V");
+        jmethodID stringWriterToStringMethod = (*env)->GetMethodID(env, stringWriterClazz,
+                "toString", "()Ljava/lang/String;");
+
+        jclass printWriterClazz = (*env)->FindClass(env, "java/io/PrintWriter");
+        if (printWriterClazz != NULL) {
+            jmethodID printWriterCtor = (*env)->GetMethodID(env, printWriterClazz,
+                    "<init>", "(Ljava/io/Writer;)V");
+
+            jobject stringWriterObj = (*env)->NewObject(env, stringWriterClazz, stringWriterCtor);
+            if (stringWriterObj != NULL) {
+                jobject printWriterObj = (*env)->NewObject(env, printWriterClazz, printWriterCtor,
+                        stringWriterObj);
+                if (printWriterObj != NULL) {
+                    jclass exceptionClazz = (*env)->GetObjectClass(env, exception); // can't fail
+                    jmethodID printStackTraceMethod = (*env)->GetMethodID(
+                            env, exceptionClazz, "printStackTrace", "(Ljava/io/PrintWriter;)V");
+
+                    (*env)->CallVoidMethod(
+                            env, exception, printStackTraceMethod, printWriterObj);
+                    if (! (*env)->ExceptionCheck(env)) {
+                        jstring messageStr = (*env)->CallObjectMethod(
+                                env, stringWriterObj, stringWriterToStringMethod);
+                        if (messageStr != NULL) {
+                            jsize messageStrLength = (*env)->GetStringLength(env, messageStr);
+                            if (messageStrLength >= (jsize) bufLen) {
+                                messageStrLength = bufLen - 1;
+                            }
+                            (*env)->GetStringUTFRegion(env, messageStr, 0, messageStrLength, buf);
+                            (*env)->DeleteLocalRef(env, messageStr);
+                            buf[messageStrLength] = '\0';
+                            success = 1;
+                        }
+                    }
+                    (*env)->DeleteLocalRef(env, exceptionClazz);
+                    (*env)->DeleteLocalRef(env, printWriterObj);
+                }
+                (*env)->DeleteLocalRef(env, stringWriterObj);
+            }
+            (*env)->DeleteLocalRef(env, printWriterClazz);
+        }
+        (*env)->DeleteLocalRef(env, stringWriterClazz);
     }
 
-    /* if the exception has a message string, get that */
-    jmethodID getThrowableMessage =
-        (*env)->GetMethodID(env, clazz, "getMessage", "()Ljava/lang/String;");
-    jstring message = (*env)->CallObjectMethod(env, excep, getThrowableMessage);
-
-    if (message != NULL) {
-        const char* messageStr = (*env)->GetStringUTFChars(env, message, NULL);
-        snprintf(buf, bufLen, "%s: %s", nameStr, messageStr);
-        if (messageStr != NULL)
-            (*env)->ReleaseStringUTFChars(env, message, messageStr);
-        else
-            (*env)->ExceptionClear(env);        // clear OOM
-    } else {
-        strncpy(buf, nameStr, bufLen);
-        buf[bufLen-1] = '\0';
+    if (! success) {
+        (*env)->ExceptionClear(env);
+        getExceptionSummary(env, exception, buf, bufLen);
     }
-
-    (*env)->ReleaseStringUTFChars(env, className, nameStr);
 }
 
 /*
@@ -110,11 +182,14 @@
         /* TODO: consider creating the new exception with this as "cause" */
         char buf[256];
 
-        jthrowable excep = (*env)->ExceptionOccurred(env);
+        jthrowable exception = (*env)->ExceptionOccurred(env);
         (*env)->ExceptionClear(env);
-        getExceptionSummary(env, excep, buf, sizeof(buf));
-        LOGW("Discarding pending exception (%s) to throw %s\n",
-            buf, className);
+
+        if (exception != NULL) {
+            getExceptionSummary(env, exception, buf, sizeof(buf));
+            LOGW("Discarding pending exception (%s) to throw %s\n", buf, className);
+            (*env)->DeleteLocalRef(env, exception);
+        }
     }
 
     exceptionClass = (*env)->FindClass(env, className);
@@ -124,12 +199,15 @@
         return -1;
     }
 
+    int result = 0;
     if ((*env)->ThrowNew(env, exceptionClass, msg) != JNI_OK) {
         LOGE("Failed throwing '%s' '%s'\n", className, msg);
         /* an exception, most likely OOM, will now be pending */
-        return -1;
+        result = -1;
     }
-    return 0;
+
+    (*env)->DeleteLocalRef(env, exceptionClass);
+    return result;
 }
 
 /*
@@ -158,6 +236,33 @@
     return jniThrowException(env, "java/io/IOException", message);
 }
 
+/*
+ * Log an exception.
+ * If exception is NULL, logs the current exception in the JNI environment, if any.
+ */
+void jniLogException(JNIEnv* env, int priority, const char* tag, jthrowable exception)
+{
+    int currentException = 0;
+    if (exception == NULL) {
+        exception = (*env)->ExceptionOccurred(env);
+        if (exception == NULL) {
+            return;
+        }
+
+        (*env)->ExceptionClear(env);
+        currentException = 1;
+    }
+
+    char buffer[1024];
+    printStackTrace(env, exception, buffer, sizeof(buffer));
+    __android_log_write(priority, tag, buffer);
+
+    if (currentException) {
+        (*env)->Throw(env, exception); // rethrow
+        (*env)->DeleteLocalRef(env, exception);
+    }
+}
+
 const char* jniStrError(int errnum, char* buf, size_t buflen)
 {
     // note: glibc has a nonstandard strerror_r that returns char* rather
diff --git a/libnativehelper/include/nativehelper/JNIHelp.h b/libnativehelper/include/nativehelper/JNIHelp.h
index 59c2620..585d1c7 100644
--- a/libnativehelper/include/nativehelper/JNIHelp.h
+++ b/libnativehelper/include/nativehelper/JNIHelp.h
@@ -91,6 +91,12 @@
  */
 void jniSetFileDescriptorOfFD(C_JNIEnv* env, jobject fileDescriptor, int value);
 
+/*
+ * Log a message and an exception.
+ * If exception is NULL, logs the current exception in the JNI environment.
+ */
+void jniLogException(C_JNIEnv* env, int priority, const char* tag, jthrowable exception);
+
 #ifdef __cplusplus
 }
 #endif
@@ -135,10 +141,28 @@
 inline void jniSetFileDescriptorOfFD(JNIEnv* env, jobject fileDescriptor,
     int value)
 {
-    return jniSetFileDescriptorOfFD(&env->functions, fileDescriptor, value);
+    jniSetFileDescriptorOfFD(&env->functions, fileDescriptor, value);
+}
+inline void jniLogException(JNIEnv* env, int priority, const char* tag,
+        jthrowable exception = NULL)
+{
+    jniLogException(&env->functions, priority, tag, exception);
 }
 #endif
 
+/* Logging macros.
+ *
+ * Logs an exception.  If the exception is omitted or NULL, logs the current exception
+ * from the JNI environment, if any.
+ */
+#define LOG_EX(env, priority, tag, ...) \
+    IF_LOG(priority, tag) jniLogException(env, ANDROID_##priority, tag, ##__VA_ARGS__)
+#define LOGV_EX(env, ...) LOG_EX(env, LOG_VERBOSE, LOG_TAG, ##__VA_ARGS__)
+#define LOGD_EX(env, ...) LOG_EX(env, LOG_DEBUG, LOG_TAG, ##__VA_ARGS__)
+#define LOGI_EX(env, ...) LOG_EX(env, LOG_INFO, LOG_TAG, ##__VA_ARGS__)
+#define LOGW_EX(env, ...) LOG_EX(env, LOG_WARN, LOG_TAG, ##__VA_ARGS__)
+#define LOGE_EX(env, ...) LOG_EX(env, LOG_ERROR, LOG_TAG, ##__VA_ARGS__)
+
 /*
  * TEMP_FAILURE_RETRY is defined by some, but not all, versions of
  * <unistd.h>. (Alas, it is not as standard as we'd hoped!) So, if it's
diff --git a/vm/Android.mk b/vm/Android.mk
index 0ef00f5..45f15e5 100644
--- a/vm/Android.mk
+++ b/vm/Android.mk
@@ -36,6 +36,13 @@
     WITH_JIT := false
 endif
 
+ifeq ($(TARGET_CPU_SMP),true)
+    target_smp_flag := -DANDROID_SMP=1
+else
+    target_smp_flag := -DANDROID_SMP=0
+endif
+host_smp_flag := -DANDROID_SMP=1
+
 # Build the installed version (libdvm.so) first
 include $(LOCAL_PATH)/ReconfigureDvm.mk
 
@@ -45,6 +52,7 @@
 endif
 LOCAL_MODULE_TAGS := user
 LOCAL_MODULE := libdvm
+LOCAL_CFLAGS += $(target_smp_flag)
 include $(BUILD_SHARED_LIBRARY)
 
 # If WITH_JIT is configured, build multiple versions of libdvm.so to facilitate
@@ -57,7 +65,7 @@
 
     # Enable assertions and JIT-tuning
     LOCAL_CFLAGS += -UNDEBUG -DDEBUG=1 -DLOG_NDEBUG=1 -DWITH_DALVIK_ASSERT \
-				    -DWITH_JIT_TUNING -DJIT_STATS
+                    -DWITH_JIT_TUNING -DJIT_STATS $(target_smp_flag)
     LOCAL_MODULE := libdvm_assert
     include $(BUILD_SHARED_LIBRARY)
 
@@ -67,7 +75,7 @@
 
     # Enable assertions and JIT self-verification
     LOCAL_CFLAGS += -UNDEBUG -DDEBUG=1 -DLOG_NDEBUG=1 -DWITH_DALVIK_ASSERT \
-					-DWITH_SELF_VERIFICATION
+                    -DWITH_SELF_VERIFICATION $(target_smp_flag)
     LOCAL_MODULE := libdvm_sv
     include $(BUILD_SHARED_LIBRARY)
 
@@ -76,6 +84,7 @@
     WITH_JIT := false
     include $(LOCAL_PATH)/ReconfigureDvm.mk
 
+    LOCAL_CFLAGS += $(target_smp_flag)
     LOCAL_MODULE := libdvm_interp
     include $(BUILD_SHARED_LIBRARY)
 
@@ -117,6 +126,7 @@
             $(patsubst libffi, ,$(LOCAL_SHARED_LIBRARIES))
     endif
 
+    LOCAL_CFLAGS += $(host_smp_flag)
     LOCAL_MODULE := libdvm-host
 
     include $(BUILD_HOST_STATIC_LIBRARY)
diff --git a/vm/Atomic.c b/vm/Atomic.c
new file mode 100644
index 0000000..55b4cc9
--- /dev/null
+++ b/vm/Atomic.c
@@ -0,0 +1,225 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "Dalvik.h"
+
+#include <cutils/atomic.h>
+
+/*
+ * Quasi-atomic 64-bit operations, for platforms that lack the real thing.
+ *
+ * TODO: unify ARM/x86/sh implementations using the to-be-written
+ * spin lock implementation.  We don't want to rely on mutex innards,
+ * and it would be great if all platforms were running the same code.
+ */
+
+#if defined(HAVE_MACOSX_IPC)
+
+#include <libkern/OSAtomic.h>
+
+#if defined(__ppc__)        \
+    || defined(__PPC__)     \
+    || defined(__powerpc__) \
+    || defined(__powerpc)   \
+    || defined(__POWERPC__) \
+    || defined(_M_PPC)      \
+    || defined(__PPC)
+#define NEED_QUASIATOMICS 1
+#else
+
+int android_quasiatomic_cmpxchg_64(int64_t oldvalue, int64_t newvalue,
+        volatile int64_t* addr) {
+    return OSAtomicCompareAndSwap64Barrier(oldvalue, newvalue,
+            (int64_t*)addr) == 0;
+}
+
+int64_t android_quasiatomic_swap_64(int64_t value, volatile int64_t* addr) {
+    int64_t oldValue;
+    do {
+        oldValue = *addr;
+    } while (android_quasiatomic_cmpxchg_64(oldValue, value, addr));
+    return oldValue;
+}
+
+int64_t android_quasiatomic_read_64(volatile int64_t* addr) {
+    return OSAtomicAdd64Barrier(0, addr);
+}
+#endif
+
+#elif defined(__i386__) || defined(__x86_64__)
+#define NEED_QUASIATOMICS 1
+
+#elif __arm__
+// Most of the implementation is in atomic-android-arm.s.
+
+// on the device, we implement the 64-bit atomic operations through
+// mutex locking. normally, this is bad because we must initialize
+// a pthread_mutex_t before being able to use it, and this means
+// having to do an initialization check on each function call, and
+// that's where really ugly things begin...
+//
+// BUT, as a special twist, we take advantage of the fact that in our
+// pthread library, a mutex is simply a volatile word whose value is always
+// initialized to 0. In other words, simply declaring a static mutex
+// object initializes it !
+//
+// another twist is that we use a small array of mutexes to dispatch
+// the contention locks from different memory addresses
+//
+
+#include <pthread.h>
+
+#define  SWAP_LOCK_COUNT  32U
+static pthread_mutex_t  _swap_locks[SWAP_LOCK_COUNT];
+
+#define  SWAP_LOCK(addr)   \
+   &_swap_locks[((unsigned)(void*)(addr) >> 3U) % SWAP_LOCK_COUNT]
+
+
+int64_t android_quasiatomic_swap_64(int64_t value, volatile int64_t* addr) {
+    int64_t oldValue;
+    pthread_mutex_t*  lock = SWAP_LOCK(addr);
+
+    pthread_mutex_lock(lock);
+
+    oldValue = *addr;
+    *addr    = value;
+
+    pthread_mutex_unlock(lock);
+    return oldValue;
+}
+
+int android_quasiatomic_cmpxchg_64(int64_t oldvalue, int64_t newvalue,
+        volatile int64_t* addr) {
+    int result;
+    pthread_mutex_t*  lock = SWAP_LOCK(addr);
+
+    pthread_mutex_lock(lock);
+
+    if (*addr == oldvalue) {
+        *addr  = newvalue;
+        result = 0;
+    } else {
+        result = 1;
+    }
+    pthread_mutex_unlock(lock);
+    return result;
+}
+
+int64_t android_quasiatomic_read_64(volatile int64_t* addr) {
+    int64_t result;
+    pthread_mutex_t*  lock = SWAP_LOCK(addr);
+
+    pthread_mutex_lock(lock);
+    result = *addr;
+    pthread_mutex_unlock(lock);
+    return result;
+}
+
+/*****************************************************************************/
+#elif __sh__
+#define NEED_QUASIATOMICS 1
+
+#else
+#error "Unsupported atomic operations for this platform"
+#endif
+
+
+#if NEED_QUASIATOMICS
+
+/* Note that a spinlock is *not* a good idea in general
+ * since they can introduce subtle issues. For example,
+ * a real-time thread trying to acquire a spinlock already
+ * acquired by another thread will never yeld, making the
+ * CPU loop endlessly!
+ *
+ * However, this code is only used on the Linux simulator
+ * so it's probably ok for us.
+ *
+ * The alternative is to use a pthread mutex, but
+ * these must be initialized before being used, and
+ * then you have the problem of lazily initializing
+ * a mutex without any other synchronization primitive.
+ *
+ * TODO: these currently use sched_yield(), which is not guaranteed to
+ * do anything at all.  We need to use dvmIterativeSleep or a wait /
+ * notify mechanism if the initial attempt fails.
+ */
+
+/* global spinlock for all 64-bit quasiatomic operations */
+static int32_t quasiatomic_spinlock = 0;
+
+int android_quasiatomic_cmpxchg_64(int64_t oldvalue, int64_t newvalue,
+        volatile int64_t* addr) {
+    int result;
+
+    while (android_atomic_acquire_cas(0, 1, &quasiatomic_spinlock)) {
+#ifdef HAVE_WIN32_THREADS
+        Sleep(0);
+#else
+        sched_yield();
+#endif
+    }
+
+    if (*addr == oldvalue) {
+        *addr = newvalue;
+        result = 0;
+    } else {
+        result = 1;
+    }
+
+    android_atomic_release_store(0, &quasiatomic_spinlock);
+
+    return result;
+}
+
+int64_t android_quasiatomic_read_64(volatile int64_t* addr) {
+    int64_t result;
+
+    while (android_atomic_acquire_cas(0, 1, &quasiatomic_spinlock)) {
+#ifdef HAVE_WIN32_THREADS
+        Sleep(0);
+#else
+        sched_yield();
+#endif
+    }
+
+    result = *addr;
+    android_atomic_release_store(0, &quasiatomic_spinlock);
+
+    return result;
+}
+
+int64_t android_quasiatomic_swap_64(int64_t value, volatile int64_t* addr) {
+    int64_t result;
+
+    while (android_atomic_acquire_cas(0, 1, &quasiatomic_spinlock)) {
+#ifdef HAVE_WIN32_THREADS
+        Sleep(0);
+#else
+        sched_yield();
+#endif
+    }
+
+    result = *addr;
+    *addr = value;
+    android_atomic_release_store(0, &quasiatomic_spinlock);
+
+    return result;
+}
+
+#endif
+
diff --git a/vm/Atomic.h b/vm/Atomic.h
index bc0203c..27a5ea0 100644
--- a/vm/Atomic.h
+++ b/vm/Atomic.h
@@ -13,36 +13,53 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+
 /*
  * Atomic operations
  */
 #ifndef _DALVIK_ATOMIC
 #define _DALVIK_ATOMIC
 
-#include <utils/Atomic.h>       /* use common Android atomic ops */
+#include <cutils/atomic.h>          /* use common Android atomic ops */
+#include <cutils/atomic-inline.h>   /* and some uncommon ones */
 
 /*
- * Memory barrier.  Guarantee that register-resident variables
- * are flushed to memory, and guarantee that instructions before
- * the barrier do not get reordered to appear past it.
- *
- * 'asm volatile ("":::"memory")' is probably overkill, but it's correct.
- * There may be a way to do it that doesn't flush every single register.
- *
- * TODO: look into the wmb() family on Linux and equivalents on other systems.
+ * Full memory barrier.  Ensures compiler ordering and SMP behavior.
  */
-#define MEM_BARRIER()   do { asm volatile ("":::"memory"); } while (0)
+#define MEM_BARRIER()   ANDROID_MEMBAR_FULL()
 
 /*
- * Atomic compare-and-swap macro.
+ * 32-bit atomic compare-and-swap macro.  Performs a memory barrier
+ * before the swap (store-release).
  *
- * If *_addr equals "_old", replace it with "_new" and return 1.  Otherwise
- * return 0.  (e.g. x86 "cmpxchgl" instruction.)
+ * If *_addr equals "_old", replace it with "_new" and return nonzero
+ * (i.e. returns "false" if the operation fails).
  *
  * Underlying function is currently declared:
- * int android_atomic_cmpxchg(int32_t old, int32_t new, volatile int32_t* addr)
+ *   int release_cas(int32_t old, int32_t new, volatile int32_t* addr)
+ *
+ * TODO: rename macro to ATOMIC_RELEASE_CAS
  */
 #define ATOMIC_CMP_SWAP(_addr, _old, _new) \
-            (android_atomic_cmpxchg((_old), (_new), (_addr)) == 0)
+            (android_atomic_release_cas((_old), (_new), (_addr)) == 0)
+
+
+/*
+ * NOTE: Two "quasiatomic" operations on the exact same memory address
+ * are guaranteed to operate atomically with respect to each other,
+ * but no guarantees are made about quasiatomic operations mixed with
+ * non-quasiatomic operations on the same address, nor about
+ * quasiatomic operations that are performed on partially-overlapping
+ * memory.
+ */
+
+/*
+ * TODO: rename android_quasiatomic_* to dvmQuasiatomic*.  Don't want to do
+ * that yet due to branch merge issues.
+ */
+int64_t android_quasiatomic_swap_64(int64_t value, volatile int64_t* addr);
+int64_t android_quasiatomic_read_64(volatile int64_t* addr);
+int android_quasiatomic_cmpxchg_64(int64_t oldvalue, int64_t newvalue,
+        volatile int64_t* addr);
 
 #endif /*_DALVIK_ATOMIC*/
diff --git a/vm/DalvikVersion.h b/vm/DalvikVersion.h
index 2e00ac4..8bb797f 100644
--- a/vm/DalvikVersion.h
+++ b/vm/DalvikVersion.h
@@ -24,7 +24,7 @@
  * The version we show to tourists.
  */
 #define DALVIK_MAJOR_VERSION    1
-#define DALVIK_MINOR_VERSION    2
+#define DALVIK_MINOR_VERSION    3
 #define DALVIK_BUG_VERSION      0
 
 /*
diff --git a/vm/Dvm.mk b/vm/Dvm.mk
index baf41c6..0a5a4fb 100644
--- a/vm/Dvm.mk
+++ b/vm/Dvm.mk
@@ -98,6 +98,7 @@
 
 LOCAL_SRC_FILES := \
 	AllocTracker.c \
+	Atomic.c \
 	AtomicCache.c \
 	CheckJni.c \
 	Ddm.c \
diff --git a/vm/Init.c b/vm/Init.c
index 6630395..e7052fc 100644
--- a/vm/Init.c
+++ b/vm/Init.c
@@ -192,6 +192,9 @@
 #if defined(WITH_SELF_VERIFICATION)
         " self_verification"
 #endif
+#if ANDROID_SMP != 0
+        " smp"
+#endif
     );
 #ifdef DVM_SHOW_EXCEPTION
     dvmFprintf(stderr, " show_exception=%d", DVM_SHOW_EXCEPTION);
diff --git a/vm/JarFile.c b/vm/JarFile.c
index 0a58390..fbadf9c 100644
--- a/vm/JarFile.c
+++ b/vm/JarFile.c
@@ -283,7 +283,7 @@
 
                 if (result) {
                     startWhen = dvmGetRelativeTimeUsec();
-                    result = dexZipExtractEntryToFile(&archive, entry, fd);
+                    result = dexZipExtractEntryToFile(&archive, entry, fd) == 0;
                     extractWhen = dvmGetRelativeTimeUsec();
                 }
                 if (result) {
diff --git a/vm/analysis/CodeVerify.c b/vm/analysis/CodeVerify.c
index 942ac60..7157e6e 100644
--- a/vm/analysis/CodeVerify.c
+++ b/vm/analysis/CodeVerify.c
@@ -3092,7 +3092,7 @@
         gDvm.classJavaLangObject =
             dvmFindSystemClassNoInit("Ljava/lang/Object;");
 
-    if (meth->registersSize * insnsSize > 2*1024*1024) {
+    if (meth->registersSize * insnsSize > 4*1024*1024) {
         /* should probably base this on actual memory requirements */
         LOG_VFY_METH(meth,
             "VFY: arbitrarily rejecting large method (regs=%d count=%d)\n",
diff --git a/vm/mterp/out/InterpAsm-armv7-a-neon.S b/vm/mterp/out/InterpAsm-armv7-a-neon.S
index 45013af..9441006 100644
--- a/vm/mterp/out/InterpAsm-armv7-a-neon.S
+++ b/vm/mterp/out/InterpAsm-armv7-a-neon.S
@@ -7362,12 +7362,12 @@
 /* File: armv6t2/OP_IGET_WIDE_QUICK.S */
     /* iget-wide-quick vA, vB, offset@CCCC */
     mov     r2, rINST, lsr #12          @ r2<- B
-    FETCH(r1, 1)                        @ r1<- field byte offset
+    FETCH(ip, 1)                        @ ip<- field byte offset
     GET_VREG(r3, r2)                    @ r3<- object we're operating on
     ubfx    r2, rINST, #8, #4           @ r2<- A
     cmp     r3, #0                      @ check object for null
     beq     common_errNullObject        @ object was null
-    ldrd    r0, [r3, r1]                @ r0<- obj.field (64 bits, aligned)
+    ldrd    r0, [r3, ip]                @ r0<- obj.field (64 bits, aligned)
     FETCH_ADVANCE_INST(2)               @ advance rPC, load rINST
     add     r3, rFP, r2, lsl #2         @ r3<- &fp[A]
     GET_INST_OPCODE(ip)                 @ extract opcode from rINST