diff --git a/Android.mk b/Android.mk
index 8783934..8f968d8 100644
--- a/Android.mk
+++ b/Android.mk
@@ -293,7 +293,7 @@
 # as "final" in the official SDK APIs.
 fwbase_dirs_to_document += core/config/sdk
 
-# These are relative to dalvik/libcore
+# These are relative to libcore
 # Intentionally not included from libcore:
 #     icu openssl suncompat support
 libcore_to_document := \
@@ -333,7 +333,7 @@
 dirs_to_document := \
 	$(fwbase_dirs_to_document) \
 	$(non_base_dirs) \
-	$(addprefix ../../dalvik/libcore/, $(libcore_to_document))
+	$(addprefix ../../libcore/, $(libcore_to_document))
 
 html_dirs := \
 	$(FRAMEWORKS_BASE_SUBDIRS) \
diff --git a/api/current.xml b/api/current.xml
index e757db2..a0042d1 100644
--- a/api/current.xml
+++ b/api/current.xml
@@ -169663,6 +169663,28 @@
  visibility="public"
 >
 </field>
+<field name="KEYCODE_PAGE_DOWN"
+ type="int"
+ transient="false"
+ volatile="false"
+ value="93"
+ static="true"
+ final="true"
+ deprecated="not deprecated"
+ visibility="public"
+>
+</field>
+<field name="KEYCODE_PAGE_UP"
+ type="int"
+ transient="false"
+ volatile="false"
+ value="92"
+ static="true"
+ final="true"
+ deprecated="not deprecated"
+ visibility="public"
+>
+</field>
 <field name="KEYCODE_PERIOD"
  type="int"
  transient="false"
@@ -169674,6 +169696,17 @@
  visibility="public"
 >
 </field>
+<field name="KEYCODE_PICTSYMBOLS"
+ type="int"
+ transient="false"
+ volatile="false"
+ value="94"
+ static="true"
+ final="true"
+ deprecated="not deprecated"
+ visibility="public"
+>
+</field>
 <field name="KEYCODE_PLUS"
  type="int"
  transient="false"
@@ -169850,6 +169883,17 @@
  visibility="public"
 >
 </field>
+<field name="KEYCODE_SWITCH_CHARSET"
+ type="int"
+ transient="false"
+ volatile="false"
+ value="95"
+ static="true"
+ final="true"
+ deprecated="not deprecated"
+ visibility="public"
+>
+</field>
 <field name="KEYCODE_SYM"
  type="int"
  transient="false"
diff --git a/core/java/android/inputmethodservice/IInputMethodSessionWrapper.java b/core/java/android/inputmethodservice/IInputMethodSessionWrapper.java
index 80e9865..44f30f7 100644
--- a/core/java/android/inputmethodservice/IInputMethodSessionWrapper.java
+++ b/core/java/android/inputmethodservice/IInputMethodSessionWrapper.java
@@ -47,9 +47,10 @@
     private static final int DO_UPDATE_CURSOR = 95;
     private static final int DO_APP_PRIVATE_COMMAND = 100;
     private static final int DO_TOGGLE_SOFT_INPUT = 105;
-   
-    final HandlerCaller mCaller;
-    final InputMethodSession mInputMethodSession;
+    private static final int DO_FINISH_SESSION = 110;
+
+    HandlerCaller mCaller;
+    InputMethodSession mInputMethodSession;
     
     // NOTE: we should have a cache of these.
     static class InputMethodEventCallbackWrapper implements InputMethodSession.EventCallback {
@@ -127,6 +128,10 @@
                 mInputMethodSession.toggleSoftInput(msg.arg1, msg.arg2);
                 return;
             }
+            case DO_FINISH_SESSION: {
+                mInputMethodSession = null;
+                return;
+            }
         }
         Log.w(TAG, "Unhandled message code: " + msg.what);
     }
@@ -174,4 +179,8 @@
     public void toggleSoftInput(int showFlags, int hideFlags) {
         mCaller.executeOrSendMessage(mCaller.obtainMessageII(DO_TOGGLE_SOFT_INPUT, showFlags, hideFlags));
     }
+
+    public void finishSession() {
+        mCaller.executeOrSendMessage(mCaller.obtainMessage(DO_FINISH_SESSION));
+    }
 }
diff --git a/core/java/android/inputmethodservice/IInputMethodWrapper.java b/core/java/android/inputmethodservice/IInputMethodWrapper.java
index bfa82ee..35fd46f 100644
--- a/core/java/android/inputmethodservice/IInputMethodWrapper.java
+++ b/core/java/android/inputmethodservice/IInputMethodWrapper.java
@@ -39,6 +39,7 @@
 
 import java.io.FileDescriptor;
 import java.io.PrintWriter;
+import java.lang.ref.WeakReference;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
 
@@ -64,9 +65,9 @@
     private static final int DO_SHOW_SOFT_INPUT = 60;
     private static final int DO_HIDE_SOFT_INPUT = 70;
    
-    final AbstractInputMethodService mTarget;
+    final WeakReference<AbstractInputMethodService> mTarget;
     final HandlerCaller mCaller;
-    final InputMethod mInputMethod;
+    final WeakReference<InputMethod> mInputMethod;
     
     static class Notifier {
         boolean notified;
@@ -96,21 +97,32 @@
     
     public IInputMethodWrapper(AbstractInputMethodService context,
             InputMethod inputMethod) {
-        mTarget = context;
-        mCaller = new HandlerCaller(context, this);
-        mInputMethod = inputMethod;
+        mTarget = new WeakReference<AbstractInputMethodService>(context);
+        mCaller = new HandlerCaller(context.getApplicationContext(), this);
+        mInputMethod = new WeakReference<InputMethod>(inputMethod);
     }
 
     public InputMethod getInternalInputMethod() {
-        return mInputMethod;
+        return mInputMethod.get();
     }
 
     public void executeMessage(Message msg) {
+        InputMethod inputMethod = mInputMethod.get();
+        // Need a valid reference to the inputMethod for everything except a dump.
+        if (inputMethod == null && msg.what != DO_DUMP) {
+            Log.w(TAG, "Input method reference was null, ignoring message: " + msg.what);
+            return;
+        }
+
         switch (msg.what) {
             case DO_DUMP: {
+                AbstractInputMethodService target = mTarget.get();
+                if (target == null) {
+                    return;
+                }
                 HandlerCaller.SomeArgs args = (HandlerCaller.SomeArgs)msg.obj;
                 try {
-                    mTarget.dump((FileDescriptor)args.arg1,
+                    target.dump((FileDescriptor)args.arg1,
                             (PrintWriter)args.arg2, (String[])args.arg3);
                 } catch (RuntimeException e) {
                     ((PrintWriter)args.arg2).println("Exception: " + e);
@@ -122,22 +134,22 @@
             }
             
             case DO_ATTACH_TOKEN: {
-                mInputMethod.attachToken((IBinder)msg.obj);
+                inputMethod.attachToken((IBinder)msg.obj);
                 return;
             }
             case DO_SET_INPUT_CONTEXT: {
-                mInputMethod.bindInput((InputBinding)msg.obj);
+                inputMethod.bindInput((InputBinding)msg.obj);
                 return;
             }
             case DO_UNSET_INPUT_CONTEXT:
-                mInputMethod.unbindInput();
+                inputMethod.unbindInput();
                 return;
             case DO_START_INPUT: {
                 HandlerCaller.SomeArgs args = (HandlerCaller.SomeArgs)msg.obj;
                 IInputContext inputContext = (IInputContext)args.arg1;
                 InputConnection ic = inputContext != null
                         ? new InputConnectionWrapper(inputContext) : null;
-                mInputMethod.startInput(ic, (EditorInfo)args.arg2);
+                inputMethod.startInput(ic, (EditorInfo)args.arg2);
                 return;
             }
             case DO_RESTART_INPUT: {
@@ -145,33 +157,37 @@
                 IInputContext inputContext = (IInputContext)args.arg1;
                 InputConnection ic = inputContext != null
                         ? new InputConnectionWrapper(inputContext) : null;
-                mInputMethod.restartInput(ic, (EditorInfo)args.arg2);
+                inputMethod.restartInput(ic, (EditorInfo)args.arg2);
                 return;
             }
             case DO_CREATE_SESSION: {
-                mInputMethod.createSession(new InputMethodSessionCallbackWrapper(
+                inputMethod.createSession(new InputMethodSessionCallbackWrapper(
                         mCaller.mContext, (IInputMethodCallback)msg.obj));
                 return;
             }
             case DO_SET_SESSION_ENABLED:
-                mInputMethod.setSessionEnabled((InputMethodSession)msg.obj,
+                inputMethod.setSessionEnabled((InputMethodSession)msg.obj,
                         msg.arg1 != 0);
                 return;
             case DO_REVOKE_SESSION:
-                mInputMethod.revokeSession((InputMethodSession)msg.obj);
+                inputMethod.revokeSession((InputMethodSession)msg.obj);
                 return;
             case DO_SHOW_SOFT_INPUT:
-                mInputMethod.showSoftInput(msg.arg1, (ResultReceiver)msg.obj);
+                inputMethod.showSoftInput(msg.arg1, (ResultReceiver)msg.obj);
                 return;
             case DO_HIDE_SOFT_INPUT:
-                mInputMethod.hideSoftInput(msg.arg1, (ResultReceiver)msg.obj);
+                inputMethod.hideSoftInput(msg.arg1, (ResultReceiver)msg.obj);
                 return;
         }
         Log.w(TAG, "Unhandled message code: " + msg.what);
     }
     
     @Override protected void dump(FileDescriptor fd, PrintWriter fout, String[] args) {
-        if (mTarget.checkCallingOrSelfPermission(android.Manifest.permission.DUMP)
+        AbstractInputMethodService target = mTarget.get();
+        if (target == null) {
+            return;
+        }
+        if (target.checkCallingOrSelfPermission(android.Manifest.permission.DUMP)
                 != PackageManager.PERMISSION_GRANTED) {
             
             fout.println("Permission Denial: can't dump InputMethodManager from from pid="
diff --git a/core/java/android/inputmethodservice/InputMethodService.java b/core/java/android/inputmethodservice/InputMethodService.java
index 8c8d3e5..1a261d3 100644
--- a/core/java/android/inputmethodservice/InputMethodService.java
+++ b/core/java/android/inputmethodservice/InputMethodService.java
@@ -1988,15 +1988,19 @@
                 ei.inputType != InputType.TYPE_NULL);
         if (hasAction) {
             mExtractAccessories.setVisibility(View.VISIBLE);
-            if (ei.actionLabel != null) {
-                mExtractAction.setText(ei.actionLabel);
-            } else {
-                mExtractAction.setText(getTextForImeAction(ei.imeOptions));
+            if (mExtractAction != null) {
+                if (ei.actionLabel != null) {
+                    mExtractAction.setText(ei.actionLabel);
+                } else {
+                    mExtractAction.setText(getTextForImeAction(ei.imeOptions));
+                }
+                mExtractAction.setOnClickListener(mActionClickListener);
             }
-            mExtractAction.setOnClickListener(mActionClickListener);
         } else {
             mExtractAccessories.setVisibility(View.GONE);
-            mExtractAction.setOnClickListener(null);
+            if (mExtractAction != null) {
+                mExtractAction.setOnClickListener(null);
+            }
         }
     }
     
diff --git a/core/java/android/view/KeyEvent.java b/core/java/android/view/KeyEvent.java
old mode 100644
new mode 100755
index d4f9787..9aa16b5
--- a/core/java/android/view/KeyEvent.java
+++ b/core/java/android/view/KeyEvent.java
@@ -120,6 +120,10 @@
     public static final int KEYCODE_MEDIA_REWIND    = 89;
     public static final int KEYCODE_MEDIA_FAST_FORWARD = 90;
     public static final int KEYCODE_MUTE            = 91;
+    public static final int KEYCODE_PAGE_UP         = 92;
+    public static final int KEYCODE_PAGE_DOWN       = 93;
+    public static final int KEYCODE_PICTSYMBOLS     = 94;   // switch symbol-sets (Emoji,Kao-moji)
+    public static final int KEYCODE_SWITCH_CHARSET  = 95;   // switch char-sets (Kanji,Katakana)
 
     // NOTE: If you add a new keycode here you must also add it to:
     //  isSystem()
@@ -135,7 +139,7 @@
     //  those new codes.  This is intended to maintain a consistent
     //  set of key code definitions across all Android devices.
    
-    private static final int LAST_KEYCODE           = KEYCODE_MUTE;
+    private static final int LAST_KEYCODE           = KEYCODE_SWITCH_CHARSET;
     
     /**
      * @deprecated There are now more than MAX_KEYCODE keycodes.
@@ -692,6 +696,8 @@
         case KEYCODE_CAMERA:
         case KEYCODE_FOCUS:
         case KEYCODE_SEARCH:
+        case KEYCODE_PICTSYMBOLS:
+        case KEYCODE_SWITCH_CHARSET:
             return true;
         default:
             return false;
diff --git a/core/java/android/webkit/MimeTypeMap.java b/core/java/android/webkit/MimeTypeMap.java
index 034c88a..ca9ad53 100644
--- a/core/java/android/webkit/MimeTypeMap.java
+++ b/core/java/android/webkit/MimeTypeMap.java
@@ -67,7 +67,7 @@
             // if the filename contains special characters, we don't
             // consider it valid for our matching purposes:
             if (filename.length() > 0 &&
-                Pattern.matches("[a-zA-Z_0-9\\.\\-\\(\\)]+", filename)) {
+                Pattern.matches("[a-zA-Z_0-9\\.\\-\\(\\)\\%]+", filename)) {
                 int dotPos = filename.lastIndexOf('.');
                 if (0 <= dotPos) {
                     return filename.substring(dotPos + 1);
diff --git a/core/java/android/widget/DatePicker.java b/core/java/android/widget/DatePicker.java
index b3d5f1a..1fc23ab 100644
--- a/core/java/android/widget/DatePicker.java
+++ b/core/java/android/widget/DatePicker.java
@@ -328,6 +328,7 @@
         mYear = ss.getYear();
         mMonth = ss.getMonth();
         mDay = ss.getDay();
+        updateSpinners();
     }
 
     /**
diff --git a/core/java/com/android/internal/view/IInputMethodSession.aidl b/core/java/com/android/internal/view/IInputMethodSession.aidl
index a05ff14..338dcaa 100644
--- a/core/java/com/android/internal/view/IInputMethodSession.aidl
+++ b/core/java/com/android/internal/view/IInputMethodSession.aidl
@@ -48,4 +48,6 @@
     void appPrivateCommand(String action, in Bundle data);
 
     void toggleSoftInput(int showFlags, int hideFlags);
+
+    void finishSession();
 }
diff --git a/core/java/com/google/android/mms/ContentType.java b/core/java/com/google/android/mms/ContentType.java
index 94bc9fd..b066fad 100644
--- a/core/java/com/google/android/mms/ContentType.java
+++ b/core/java/com/google/android/mms/ContentType.java
@@ -26,6 +26,7 @@
     public static final String MMS_GENERIC       = "application/vnd.wap.mms-generic";
     public static final String MULTIPART_MIXED   = "application/vnd.wap.multipart.mixed";
     public static final String MULTIPART_RELATED = "application/vnd.wap.multipart.related";
+    public static final String MULTIPART_ALTERNATIVE = "application/vnd.wap.multipart.alternative";
 
     public static final String TEXT_PLAIN        = "text/plain";
     public static final String TEXT_HTML         = "text/html";
diff --git a/core/java/com/google/android/mms/pdu/PduParser.java b/core/java/com/google/android/mms/pdu/PduParser.java
index d465c5a..1cd118b 100644
--- a/core/java/com/google/android/mms/pdu/PduParser.java
+++ b/core/java/com/google/android/mms/pdu/PduParser.java
@@ -200,7 +200,18 @@
         PduHeaders headers = new PduHeaders();
 
         while (keepParsing && (pduDataStream.available() > 0)) {
+            pduDataStream.mark(1);
             int headerField = extractByteValue(pduDataStream);
+            /* parse custom text header */
+            if ((headerField >= TEXT_MIN) && (headerField <= TEXT_MAX)) {
+                pduDataStream.reset();
+                byte [] bVal = parseWapString(pduDataStream, TYPE_TEXT_STRING);
+                if (LOCAL_LOGV) {
+                    Log.v(LOG_TAG, "TextHeader: " + new String(bVal));
+                }
+                /* we should ignore it at the moment */
+                continue;
+            }
             switch (headerField) {
                 case PduHeaders.MESSAGE_TYPE:
                 {
@@ -778,26 +789,34 @@
             /* get part's data */
             if (dataLength > 0) {
                 byte[] partData = new byte[dataLength];
+                String partContentType = new String(part.getContentType());
                 pduDataStream.read(partData, 0, dataLength);
-                // Check Content-Transfer-Encoding.
-                byte[] partDataEncoding = part.getContentTransferEncoding();
-                if (null != partDataEncoding) {
-                    String encoding = new String(partDataEncoding);
-                    if (encoding.equalsIgnoreCase(PduPart.P_BASE64)) {
-                        // Decode "base64" into "binary".
-                        partData = Base64.decodeBase64(partData);
-                    } else if (encoding.equalsIgnoreCase(PduPart.P_QUOTED_PRINTABLE)) {
-                        // Decode "quoted-printable" into "binary".
-                        partData = QuotedPrintable.decodeQuotedPrintable(partData);
-                    } else {
-                        // "binary" is the default encoding.
+                if (partContentType.equalsIgnoreCase(ContentType.MULTIPART_ALTERNATIVE)) {
+                    // parse "multipart/vnd.wap.multipart.alternative".
+                    PduBody childBody = parseParts(new ByteArrayInputStream(partData));
+                    // take the first part of children.
+                    part = childBody.getPart(0);
+                } else {
+                    // Check Content-Transfer-Encoding.
+                    byte[] partDataEncoding = part.getContentTransferEncoding();
+                    if (null != partDataEncoding) {
+                        String encoding = new String(partDataEncoding);
+                        if (encoding.equalsIgnoreCase(PduPart.P_BASE64)) {
+                            // Decode "base64" into "binary".
+                            partData = Base64.decodeBase64(partData);
+                        } else if (encoding.equalsIgnoreCase(PduPart.P_QUOTED_PRINTABLE)) {
+                            // Decode "quoted-printable" into "binary".
+                            partData = QuotedPrintable.decodeQuotedPrintable(partData);
+                        } else {
+                            // "binary" is the default encoding.
+                        }
                     }
+                    if (null == partData) {
+                        log("Decode part data error!");
+                        return null;
+                    }
+                    part.setData(partData);
                 }
-                if (null == partData) {
-                    log("Decode part data error!");
-                    return null;
-                }
-                part.setData(partData);
             }
 
             /* add this part to body */
diff --git a/core/res/res/values/attrs.xml b/core/res/res/values/attrs.xml
old mode 100644
new mode 100755
index 6d6c47f..8d4fa4e
--- a/core/res/res/values/attrs.xml
+++ b/core/res/res/values/attrs.xml
@@ -916,6 +916,10 @@
         <enum name="KEYCODE_MEDIA_REWIND" value="89" />
         <enum name="KEYCODE_MEDIA_FAST_FORWARD" value="90" />
         <enum name="KEYCODE_MUTE" value="91" />
+        <enum name="KEYCODE_PAGE_UP" value="92" />
+        <enum name="KEYCODE_PAGE_DOWN" value="93" />
+        <enum name="KEYCODE_PICTSYMBOLS" value="94" />
+        <enum name="KEYCODE_SWITCH_CHARSET" value="95" />
     </attr>
 
     <!-- ***************************************************************** -->
diff --git a/graphics/java/android/graphics/Color.java b/graphics/java/android/graphics/Color.java
index 5cefaa3..a50693d 100644
--- a/graphics/java/android/graphics/Color.java
+++ b/graphics/java/android/graphics/Color.java
@@ -30,7 +30,8 @@
  * (green << 8) | blue. Each component ranges between 0..255 with 0
  * meaning no contribution for that component, and 255 meaning 100%
  * contribution. Thus opaque-black would be 0xFF000000 (100% opaque but
- * no contributes from red, gree, blue, and opaque-white would be 0xFFFFFFFF
+ * no contributions from red, green, or blue), and opaque-white would be
+ * 0xFFFFFFFF
  */
 public class Color {
     public static final int BLACK       = 0xFF000000;
diff --git a/include/binder/IInterface.h b/include/binder/IInterface.h
index 273d922..5f9f69c 100644
--- a/include/binder/IInterface.h
+++ b/include/binder/IInterface.h
@@ -72,21 +72,24 @@
 // ----------------------------------------------------------------------
 
 #define DECLARE_META_INTERFACE(INTERFACE)                               \
-    static const String16 descriptor;                                   \
-    static sp<I##INTERFACE> asInterface(const sp<IBinder>& obj);        \
-    virtual const String16& getInterfaceDescriptor() const;             \
+    static const android::String16 descriptor;                          \
+    static android::sp<I##INTERFACE> asInterface(                       \
+            const android::sp<android::IBinder>& obj);                  \
+    virtual const android::String16& getInterfaceDescriptor() const;    \
     I##INTERFACE();                                                     \
     virtual ~I##INTERFACE();                                            \
 
 
 #define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)                       \
-    const String16 I##INTERFACE::descriptor(NAME);                      \
-    const String16& I##INTERFACE::getInterfaceDescriptor() const {      \
+    const android::String16 I##INTERFACE::descriptor(NAME);             \
+    const android::String16&                                            \
+            I##INTERFACE::getInterfaceDescriptor() const {              \
         return I##INTERFACE::descriptor;                                \
     }                                                                   \
-    sp<I##INTERFACE> I##INTERFACE::asInterface(const sp<IBinder>& obj)  \
+    android::sp<I##INTERFACE> I##INTERFACE::asInterface(                \
+            const android::sp<android::IBinder>& obj)                   \
     {                                                                   \
-        sp<I##INTERFACE> intr;                                          \
+        android::sp<I##INTERFACE> intr;                                 \
         if (obj != NULL) {                                              \
             intr = static_cast<I##INTERFACE*>(                          \
                 obj->queryLocalInterface(                               \
diff --git a/include/ui/KeycodeLabels.h b/include/ui/KeycodeLabels.h
old mode 100644
new mode 100755
index 571e47b..e81d0f9
--- a/include/ui/KeycodeLabels.h
+++ b/include/ui/KeycodeLabels.h
@@ -114,6 +114,10 @@
     { "MEDIA_REWIND", 89 },
     { "MEDIA_FAST_FORWARD", 90 },
     { "MUTE", 91 },
+    { "PAGE_UP", 92 },
+    { "PAGE_DOWN", 93 },
+    { "PICTSYMBOLS", 94 },
+    { "SWITCH_CHARSET", 95 },
 
     // NOTE: If you add a new keycode here you must also add it to:
     //   (enum KeyCode, in this file)
@@ -218,7 +222,11 @@
     kKeyCodePreviousSong = 88,
     kKeyCodeRewind = 89,
     kKeyCodeForward = 90,
-    kKeyCodeMute = 91
+    kKeyCodeMute = 91,
+    kKeyCodePageUp = 92,
+    kKeyCodePageDown = 93,
+    kKeyCodePictSymbols = 94,
+    kKeyCodeSwitchCharset = 95
 } KeyCode;
 
 static const KeycodeLabel FLAGS[] = {
diff --git a/location/java/com/android/internal/location/GpsLocationProvider.java b/location/java/com/android/internal/location/GpsLocationProvider.java
index 15d692c..fa53ccf 100755
--- a/location/java/com/android/internal/location/GpsLocationProvider.java
+++ b/location/java/com/android/internal/location/GpsLocationProvider.java
@@ -965,29 +965,6 @@
         if (VERBOSE) Log.v(TAG, "reportLocation lat: " + latitude + " long: " + longitude +
                 " timestamp: " + timestamp);
 
-        mLastFixTime = System.currentTimeMillis();
-        // report time to first fix
-        if (mTTFF == 0 && (flags & LOCATION_HAS_LAT_LONG) == LOCATION_HAS_LAT_LONG) {
-            mTTFF = (int)(mLastFixTime - mFixRequestTime);
-            if (DEBUG) Log.d(TAG, "TTFF: " + mTTFF);
-
-            // notify status listeners
-            synchronized(mListeners) {
-                int size = mListeners.size();
-                for (int i = 0; i < size; i++) {
-                    Listener listener = mListeners.get(i);
-                    try {
-                        listener.mListener.onFirstFix(mTTFF); 
-                    } catch (RemoteException e) {
-                        Log.w(TAG, "RemoteException in stopNavigating");
-                        mListeners.remove(listener);
-                        // adjust for size of list changing
-                        size--;
-                    }
-                }
-            }
-        }
-
         synchronized (mLocation) {
             mLocationFlags = flags;
             if ((flags & LOCATION_HAS_LAT_LONG) == LOCATION_HAS_LAT_LONG) {
@@ -1023,6 +1000,29 @@
             }
         }
 
+        mLastFixTime = System.currentTimeMillis();
+        // report time to first fix
+        if (mTTFF == 0 && (flags & LOCATION_HAS_LAT_LONG) == LOCATION_HAS_LAT_LONG) {
+            mTTFF = (int)(mLastFixTime - mFixRequestTime);
+            if (DEBUG) Log.d(TAG, "TTFF: " + mTTFF);
+
+            // notify status listeners
+            synchronized(mListeners) {
+                int size = mListeners.size();
+                for (int i = 0; i < size; i++) {
+                    Listener listener = mListeners.get(i);
+                    try {
+                        listener.mListener.onFirstFix(mTTFF); 
+                    } catch (RemoteException e) {
+                        Log.w(TAG, "RemoteException in stopNavigating");
+                        mListeners.remove(listener);
+                        // adjust for size of list changing
+                        size--;
+                    }
+                }
+            }
+        }
+
         if (mStarted && mStatus != LocationProvider.AVAILABLE) {
             // we still want to time out if we do not receive MIN_FIX_COUNT
             // within the time out and we are requesting infrequent fixes
diff --git a/media/java/android/media/MediaPlayer.java b/media/java/android/media/MediaPlayer.java
index e8b89e0..8f6564a 100644
--- a/media/java/android/media/MediaPlayer.java
+++ b/media/java/android/media/MediaPlayer.java
@@ -133,7 +133,7 @@
  *         <li>It is good programming practice to have your application
  *         register a OnErrorListener to look out for error notifications from
  *         the internal player engine.</li>
- *         <li>IlleglStateException is
+ *         <li>IllegalStateException is
  *         thrown to prevent programming errors such as calling {@link #prepare()},
  *         {@link #prepareAsync()}, or one of the overloaded <code>setDataSource
  *         </code> methods in an invalid state. </li>
diff --git a/opengl/tests/gl_jni/jni/gl_code.cpp b/opengl/tests/gl_jni/jni/gl_code.cpp
index 33b25ab..f031c79 100644
--- a/opengl/tests/gl_jni/jni/gl_code.cpp
+++ b/opengl/tests/gl_jni/jni/gl_code.cpp
@@ -180,4 +180,5 @@
 JNIEXPORT void JNICALL Java_com_android_gljni_GLJNILib_changeBackground(JNIEnv * env, jobject obj)
 {
     background = 1.0f - background;
-}
\ No newline at end of file
+}
+
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
index 1b4ba81..1019fa8 100644
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
@@ -399,9 +399,12 @@
                     }
                 } else if (prefix == '-' && index >= 0) {
                     // remove the provider from the list if present
-                    // remove leading and trailing commas
-                    if (index > 0) index--;
-                    if (end < providers.length()) end++;
+                    // remove leading or trailing comma
+                    if (index > 0) {
+                        index--;
+                    } else if (end < providers.length()) {
+                        end++;
+                    }
 
                     newProviders = providers.substring(0, index);
                     if (end < providers.length()) {
diff --git a/services/java/com/android/server/AppWidgetService.java b/services/java/com/android/server/AppWidgetService.java
index 24526af..dc5fd30 100644
--- a/services/java/com/android/server/AppWidgetService.java
+++ b/services/java/com/android/server/AppWidgetService.java
@@ -869,7 +869,7 @@
                     out.startTag(null, "p");
                     out.attribute(null, "pkg", p.info.provider.getPackageName());
                     out.attribute(null, "cl", p.info.provider.getClassName());
-                    out.endTag(null, "h");
+                    out.endTag(null, "p");
                     p.tag = providerIndex;
                     providerIndex++;
                 }
diff --git a/services/java/com/android/server/InputMethodManagerService.java b/services/java/com/android/server/InputMethodManagerService.java
index 0c205ca..5bf66e4 100644
--- a/services/java/com/android/server/InputMethodManagerService.java
+++ b/services/java/com/android/server/InputMethodManagerService.java
@@ -889,13 +889,27 @@
                     MSG_UNBIND_METHOD, mCurSeq, mCurClient.client));
         }
     }
+    
+    private void finishSession(SessionState sessionState) {
+        if (sessionState != null && sessionState.session != null) {
+            try {
+                sessionState.session.finishSession();
+            } catch (RemoteException e) {
+                Slog.w(TAG, "Session failed to close due to remote exception", e);
+            }
+        }
+    }
 
     void clearCurMethodLocked() {
         if (mCurMethod != null) {
             for (ClientState cs : mClients.values()) {
                 cs.sessionRequested = false;
+                finishSession(cs.curSession);
                 cs.curSession = null;
             }
+
+            finishSession(mEnabledSession);
+            mEnabledSession = null;
             mCurMethod = null;
         }
         mStatusBar.setIconVisibility(mInputMethodIcon, false);
diff --git a/services/java/com/android/server/PackageManagerService.java b/services/java/com/android/server/PackageManagerService.java
index b9204c7..36c07e3 100644
--- a/services/java/com/android/server/PackageManagerService.java
+++ b/services/java/com/android/server/PackageManagerService.java
@@ -2363,7 +2363,7 @@
                         && (p.applicationInfo.flags&ApplicationInfo.FLAG_PERSISTENT) != 0
                         && (!mSafeMode || (p.applicationInfo.flags
                                 &ApplicationInfo.FLAG_SYSTEM) != 0)) {
-                    finalList.add(p.applicationInfo);
+                    finalList.add(PackageParser.generateApplicationInfo(p, flags));
                 }
             }
         }
diff --git a/services/java/com/android/server/WindowManagerService.java b/services/java/com/android/server/WindowManagerService.java
index 53de7d9..9a843a7 100644
--- a/services/java/com/android/server/WindowManagerService.java
+++ b/services/java/com/android/server/WindowManagerService.java
@@ -8684,7 +8684,8 @@
             for (int i=0; i<N; i++) {
                 WindowState win = allAppWindows.get(i);
                 if (win == startingWindow || win.mAppFreezing
-                        || win.mViewVisibility != View.VISIBLE) {
+                        || win.mViewVisibility != View.VISIBLE
+                        || win.mAttrs.type == TYPE_APPLICATION_STARTING) {
                     continue;
                 }
                 if (DEBUG_VISIBILITY) {
@@ -11328,6 +11329,7 @@
                             "DimSurface",
                             -1, 16, 16, PixelFormat.OPAQUE,
                             Surface.FX_SURFACE_DIM);
+                    mDimSurface.setAlpha(0.0f);
                 } catch (Exception e) {
                     Slog.e(TAG, "Exception creating Dim surface", e);
                 }
diff --git a/telephony/java/android/telephony/NeighboringCellInfo.java b/telephony/java/android/telephony/NeighboringCellInfo.java
index ad7dfc9..2f7666d 100644
--- a/telephony/java/android/telephony/NeighboringCellInfo.java
+++ b/telephony/java/android/telephony/NeighboringCellInfo.java
@@ -133,8 +133,11 @@
             case NETWORK_TYPE_GPRS:
             case NETWORK_TYPE_EDGE:
                 mNetworkType = radioType;
-                mLac = Integer.valueOf(location.substring(0, 4), 16);
-                mCid = Integer.valueOf(location.substring(4), 16);
+                // check if 0xFFFFFFFF for UNKNOWN_CID
+                if (!location.equalsIgnoreCase("FFFFFFFF")) {
+                    mCid = Integer.valueOf(location.substring(4), 16);
+                    mLac = Integer.valueOf(location.substring(0, 4), 16);
+                }
                 break;
             case NETWORK_TYPE_UMTS:
             case NETWORK_TYPE_HSDPA:
@@ -293,4 +296,4 @@
             return new NeighboringCellInfo[size];
         }
     };
-}
\ No newline at end of file
+}
diff --git a/telephony/java/com/android/internal/telephony/PhoneFactory.java b/telephony/java/com/android/internal/telephony/PhoneFactory.java
index cd72752..803b736 100644
--- a/telephony/java/com/android/internal/telephony/PhoneFactory.java
+++ b/telephony/java/com/android/internal/telephony/PhoneFactory.java
@@ -109,13 +109,13 @@
 
                 int phoneType = getPhoneType(networkMode);
                 if (phoneType == Phone.PHONE_TYPE_GSM) {
+                    Log.i(LOG_TAG, "Creating GSMPhone");
                     sProxyPhone = new PhoneProxy(new GSMPhone(context,
                             sCommandsInterface, sPhoneNotifier));
-                    Log.i(LOG_TAG, "Creating GSMPhone");
                 } else if (phoneType == Phone.PHONE_TYPE_CDMA) {
+                    Log.i(LOG_TAG, "Creating CDMAPhone");
                     sProxyPhone = new PhoneProxy(new CDMAPhone(context,
                             sCommandsInterface, sPhoneNotifier));
-                    Log.i(LOG_TAG, "Creating CDMAPhone");
                 }
 
                 sMadeDefaults = true;
diff --git a/telephony/java/com/android/internal/telephony/cdma/CDMAPhone.java b/telephony/java/com/android/internal/telephony/cdma/CDMAPhone.java
index 1f5accf..d4b807c 100755
--- a/telephony/java/com/android/internal/telephony/cdma/CDMAPhone.java
+++ b/telephony/java/com/android/internal/telephony/cdma/CDMAPhone.java
@@ -67,6 +67,7 @@
 import static com.android.internal.telephony.TelephonyProperties.PROPERTY_ICC_OPERATOR_NUMERIC;
 import static com.android.internal.telephony.TelephonyProperties.PROPERTY_ICC_OPERATOR_ISO_COUNTRY;
 
+import java.util.ArrayList;
 import java.util.List;
 
 
@@ -101,6 +102,7 @@
     RuimFileHandler mRuimFileHandler;
     RuimRecords mRuimRecords;
     RuimCard mRuimCard;
+    ArrayList <CdmaMmiCode> mPendingMmis = new ArrayList<CdmaMmiCode>();
     RuimPhoneBookInterfaceManager mRuimPhoneBookInterfaceManager;
     RuimSmsInterfaceManager mRuimSmsInterfaceManager;
     PhoneSubInfo mSubInfo;
@@ -219,6 +221,8 @@
             mSST.unregisterForNetworkAttach(this); //EVENT_REGISTERED_TO_NETWORK
             mCM.unSetOnSuppServiceNotification(this);
 
+            mPendingMmis.clear();
+
             //Force all referenced classes to unregister their former registered events
             mCT.dispose();
             mDataConnection.dispose();
@@ -355,8 +359,7 @@
 
     public List<? extends MmiCode>
     getPendingMmiCodes() {
-        Log.e(LOG_TAG, "method getPendingMmiCodes is NOT supported in CDMA!");
-        return null;
+        return mPendingMmis;
     }
 
     public void registerForSuppServiceNotification(
@@ -373,6 +376,15 @@
         return false;
     }
 
+    boolean isInCall() {
+        CdmaCall.State foregroundCallState = getForegroundCall().getState();
+        CdmaCall.State backgroundCallState = getBackgroundCall().getState();
+        CdmaCall.State ringingCallState = getRingingCall().getState();
+
+        return (foregroundCallState.isAlive() || backgroundCallState.isAlive() || ringingCallState
+                .isAlive());
+    }
+
     public void
     setNetworkSelectionModeAutomatic(Message response) {
         Log.e(LOG_TAG, "method setNetworkSelectionModeAutomatic is NOT supported in CDMA!");
@@ -472,7 +484,18 @@
     }
 
     public boolean handlePinMmi(String dialString) {
-        Log.e(LOG_TAG, "method handlePinMmi is NOT supported in CDMA!");
+        CdmaMmiCode mmi = CdmaMmiCode.newFromDialString(dialString, this);
+
+        if (mmi == null) {
+            Log.e(LOG_TAG, "Mmi is NULL!");
+            return false;
+        } else if (mmi.isPukCommand()) {
+            mPendingMmis.add(mmi);
+            mMmiRegistrants.notifyRegistrants(new AsyncResult(null, mmi, null));
+            mmi.processCode();
+            return true;
+        }
+        Log.e(LOG_TAG, "Unrecognized mmi!");
         return false;
     }
 
@@ -484,6 +507,22 @@
                 (mDataConnection.getDataOnRoamingEnabled() || !getServiceState().getRoaming());
     }
 
+    /**
+     * Removes the given MMI from the pending list and notifies registrants that
+     * it is complete.
+     *
+     * @param mmi MMI that is done
+     */
+    void onMMIDone(CdmaMmiCode mmi) {
+        /*
+         * Only notify complete if it's on the pending list. Otherwise, it's
+         * already been handled (eg, previously canceled).
+         */
+        if (mPendingMmis.remove(mmi)) {
+            mMmiCompleteRegistrants.notifyRegistrants(new AsyncResult(null, mmi, null));
+        }
+    }
+
     public void setLine1Number(String alphaTag, String number, Message onComplete) {
         Log.e(LOG_TAG, "setLine1Number: not possible in CDMA");
     }
diff --git a/telephony/java/com/android/internal/telephony/cdma/CdmaMmiCode.java b/telephony/java/com/android/internal/telephony/cdma/CdmaMmiCode.java
new file mode 100644
index 0000000..8dd8c2e
--- /dev/null
+++ b/telephony/java/com/android/internal/telephony/cdma/CdmaMmiCode.java
@@ -0,0 +1,296 @@
+/*
+ * Copyright (C) 2006 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.internal.telephony.cdma;
+
+import android.content.Context;
+
+import com.android.internal.telephony.CommandException;
+import com.android.internal.telephony.MmiCode;
+
+import android.os.AsyncResult;
+import android.os.Handler;
+import android.os.Message;
+import android.util.Log;
+
+import java.util.regex.Pattern;
+import java.util.regex.Matcher;
+
+/**
+ * This class can handle Puk code Mmi
+ *
+ * {@hide}
+ *
+ */
+public final class CdmaMmiCode  extends Handler implements MmiCode {
+    static final String LOG_TAG = "CDMA_MMI";
+
+    // Constants
+
+    // From TS 22.030 6.5.2
+    static final String ACTION_REGISTER = "**";
+
+    // Supp Service codes from TS 22.030 Annex B
+    static final String SC_PUK          = "05";
+
+    // Event Constant
+
+    static final int EVENT_SET_COMPLETE = 1;
+
+    // Instance Variables
+
+    CDMAPhone phone;
+    Context context;
+
+    String action;              // ACTION_REGISTER
+    String sc;                  // Service Code
+    String sia, sib, sic;       // Service Info a,b,c
+    String poundString;         // Entire MMI string up to and including #
+    String dialingNumber;
+    String pwd;                 // For password registration
+
+    State state = State.PENDING;
+    CharSequence message;
+
+    // Class Variables
+
+    static Pattern sPatternSuppService = Pattern.compile(
+        "((\\*|#|\\*#|\\*\\*|##)(\\d{2,3})(\\*([^*#]*)(\\*([^*#]*)(\\*([^*#]*)(\\*([^*#]*))?)?)?)?#)(.*)");
+/*       1  2                    3          4  5       6   7         8    9     10  11             12
+
+         1 = Full string up to and including #
+         2 = action
+         3 = service code
+         5 = SIA
+         7 = SIB
+         9 = SIC
+         10 = dialing number
+*/
+
+    static final int MATCH_GROUP_POUND_STRING = 1;
+    static final int MATCH_GROUP_ACTION = 2;
+    static final int MATCH_GROUP_SERVICE_CODE = 3;
+    static final int MATCH_GROUP_SIA = 5;
+    static final int MATCH_GROUP_SIB = 7;
+    static final int MATCH_GROUP_SIC = 9;
+    static final int MATCH_GROUP_PWD_CONFIRM = 11;
+    static final int MATCH_GROUP_DIALING_NUMBER = 12;
+
+
+    // Public Class methods
+
+    /**
+     * Check if provided string contains Mmi code in it and create corresponding
+     * Mmi if it does
+     */
+
+    public static CdmaMmiCode
+    newFromDialString(String dialString, CDMAPhone phone) {
+        Matcher m;
+        CdmaMmiCode ret = null;
+
+        m = sPatternSuppService.matcher(dialString);
+
+        // Is this formatted like a standard supplementary service code?
+        if (m.matches()) {
+            ret = new CdmaMmiCode(phone);
+            ret.poundString = makeEmptyNull(m.group(MATCH_GROUP_POUND_STRING));
+            ret.action = makeEmptyNull(m.group(MATCH_GROUP_ACTION));
+            ret.sc = makeEmptyNull(m.group(MATCH_GROUP_SERVICE_CODE));
+            ret.sia = makeEmptyNull(m.group(MATCH_GROUP_SIA));
+            ret.sib = makeEmptyNull(m.group(MATCH_GROUP_SIB));
+            ret.sic = makeEmptyNull(m.group(MATCH_GROUP_SIC));
+            ret.pwd = makeEmptyNull(m.group(MATCH_GROUP_PWD_CONFIRM));
+            ret.dialingNumber = makeEmptyNull(m.group(MATCH_GROUP_DIALING_NUMBER));
+
+        }
+
+        return ret;
+    }
+
+    // Private Class methods
+
+    /** make empty strings be null.
+     *  Regexp returns empty strings for empty groups
+     */
+    private static String
+    makeEmptyNull (String s) {
+        if (s != null && s.length() == 0) return null;
+
+        return s;
+    }
+
+    // Constructor
+
+    CdmaMmiCode (CDMAPhone phone) {
+        super(phone.getHandler().getLooper());
+        this.phone = phone;
+        this.context = phone.getContext();
+    }
+
+    // MmiCode implementation
+
+    public State
+    getState() {
+        return state;
+    }
+
+    public CharSequence
+    getMessage() {
+        return message;
+    }
+
+    // inherited javadoc suffices
+    public void
+    cancel() {
+        // Complete or failed cannot be cancelled
+        if (state == State.COMPLETE || state == State.FAILED) {
+            return;
+        }
+
+        state = State.CANCELLED;
+        phone.onMMIDone (this);
+    }
+
+    public boolean isCancelable() {
+        return false;
+    }
+
+    // Instance Methods
+
+    /**
+     * @return true if the Service Code is PIN/PIN2/PUK/PUK2-related
+     */
+    boolean isPukCommand() {
+        return sc != null && sc.equals(SC_PUK);
+     }
+
+    boolean isRegister() {
+        return action != null && action.equals(ACTION_REGISTER);
+    }
+
+    public boolean isUssdRequest() {
+        Log.w(LOG_TAG, "isUssdRequest is not implemented in CdmaMmiCode");
+        return false;
+    }
+
+    /** Process a MMI PUK code */
+    void
+    processCode () {
+        try {
+            if (isPukCommand()) {
+                // sia = old PUK
+                // sib = new PIN
+                // sic = new PIN
+                String oldPinOrPuk = sia;
+                String newPin = sib;
+                int pinLen = newPin.length();
+                if (isRegister()) {
+                    if (!newPin.equals(sic)) {
+                        // password mismatch; return error
+                        handlePasswordError(com.android.internal.R.string.mismatchPin);
+                    } else if (pinLen < 4 || pinLen > 8 ) {
+                        // invalid length
+                        handlePasswordError(com.android.internal.R.string.invalidPin);
+                    } else {
+                        phone.mCM.supplyIccPuk(oldPinOrPuk, newPin,
+                                obtainMessage(EVENT_SET_COMPLETE, this));
+                    }
+                } else {
+                    throw new RuntimeException ("Invalid or Unsupported MMI Code");
+                }
+            } else {
+                throw new RuntimeException ("Invalid or Unsupported MMI Code");
+            }
+        } catch (RuntimeException exc) {
+            state = State.FAILED;
+            message = context.getText(com.android.internal.R.string.mmiError);
+            phone.onMMIDone(this);
+        }
+    }
+
+    private void handlePasswordError(int res) {
+        state = State.FAILED;
+        StringBuilder sb = new StringBuilder(getScString());
+        sb.append("\n");
+        sb.append(context.getText(res));
+        message = sb;
+        phone.onMMIDone(this);
+    }
+
+    public void
+    handleMessage (Message msg) {
+        AsyncResult ar;
+
+        if (msg.what == EVENT_SET_COMPLETE) {
+            ar = (AsyncResult) (msg.obj);
+            onSetComplete(ar);
+        } else {
+            Log.e(LOG_TAG, "Unexpected reply");
+        }
+    }
+    // Private instance methods
+
+    private CharSequence getScString() {
+        if (sc != null) {
+            if (isPukCommand()) {
+                return context.getText(com.android.internal.R.string.PinMmi);
+            }
+        }
+
+        return "";
+    }
+
+    private void
+    onSetComplete(AsyncResult ar){
+        StringBuilder sb = new StringBuilder(getScString());
+        sb.append("\n");
+
+        if (ar.exception != null) {
+            state = State.FAILED;
+            if (ar.exception instanceof CommandException) {
+                CommandException.Error err = ((CommandException)(ar.exception)).getCommandError();
+                if (err == CommandException.Error.PASSWORD_INCORRECT) {
+                    if (isPukCommand()) {
+                        sb.append(context.getText(
+                                com.android.internal.R.string.badPuk));
+                    } else {
+                        sb.append(context.getText(
+                                com.android.internal.R.string.passwordIncorrect));
+                    }
+                } else {
+                    sb.append(context.getText(
+                            com.android.internal.R.string.mmiError));
+                }
+            } else {
+                sb.append(context.getText(
+                        com.android.internal.R.string.mmiError));
+            }
+        } else if (isRegister()) {
+            state = State.COMPLETE;
+            sb.append(context.getText(
+                    com.android.internal.R.string.serviceRegistered));
+        } else {
+            state = State.FAILED;
+            sb.append(context.getText(
+                    com.android.internal.R.string.mmiError));
+        }
+
+        message = sb;
+        phone.onMMIDone(this);
+    }
+
+}
diff --git a/telephony/java/com/android/internal/telephony/gsm/GsmSMSDispatcher.java b/telephony/java/com/android/internal/telephony/gsm/GsmSMSDispatcher.java
index 6ae316d..d720516 100644
--- a/telephony/java/com/android/internal/telephony/gsm/GsmSMSDispatcher.java
+++ b/telephony/java/com/android/internal/telephony/gsm/GsmSMSDispatcher.java
@@ -94,6 +94,13 @@
         SmsMessage sms = (SmsMessage) smsb;
         boolean handled = false;
 
+        if (sms.isTypeZero()) {
+            // As per 3GPP TS 23.040 9.2.3.9, Type Zero messages should not be
+            // Displayed/Stored/Notified. They should only be acknowledged.
+            Log.d(TAG, "Received short message type 0, Dont display or store it. Send Ack");
+            return Intents.RESULT_SMS_HANDLED;
+        }
+
         // Special case the message waiting indicator messages
         if (sms.isMWISetMessage()) {
             mGsmPhone.updateMessageWaitingIndicator(true);
diff --git a/telephony/java/com/android/internal/telephony/gsm/SmsMessage.java b/telephony/java/com/android/internal/telephony/gsm/SmsMessage.java
index d627baf..12c6b88 100644
--- a/telephony/java/com/android/internal/telephony/gsm/SmsMessage.java
+++ b/telephony/java/com/android/internal/telephony/gsm/SmsMessage.java
@@ -111,6 +111,14 @@
     }
 
     /**
+     * 3GPP TS 23.040 9.2.3.9 specifies that Type Zero messages are indicated
+     * by TP_PID field set to value 0x40
+     */
+    public boolean isTypeZero() {
+        return (protocolIdentifier == 0x40);
+    }
+
+    /**
      * TS 27.005 3.4.1 lines[0] and lines[1] are the two lines read from the
      * +CMT unsolicited response (PDU mode, of course)
      *  +CMT: [&lt;alpha>],<length><CR><LF><pdu>