diff --git a/CleanSpec.mk b/CleanSpec.mk
index b955e25..91f1a0b 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -420,6 +420,10 @@
 # Version checking moving to Soong
 $(call add-clean-step, rm -rf $(OUT_DIR)/versions_checked.mk)
 
+# Vendor tests were being installed into /vendor/bin accidentally
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/vendor/nativetest*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/nativetest*)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/Makefile b/core/Makefile
index 33bb296..d6d4bf2 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -579,6 +579,8 @@
 	@echo "make $@: ignoring dependencies"
 	$(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_ROOT_OUT) | $(MINIGZIP) > $(INSTALLED_RAMDISK_TARGET)
 
+INSTALLED_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img
+
 ifneq ($(strip $(TARGET_NO_KERNEL)),true)
 
 # -----------------------------------------------------------------
@@ -617,8 +619,6 @@
     --os_version $(PLATFORM_VERSION) \
     --os_patch_level $(PLATFORM_SECURITY_PATCH)
 
-INSTALLED_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img
-
 # BOARD_USES_RECOVERY_AS_BOOT = true must have BOARD_BUILD_SYSTEM_ROOT_IMAGE = true.
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
 ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
@@ -701,6 +701,13 @@
 endif # BOARD_USES_RECOVERY_AS_BOOT
 
 else	# TARGET_NO_KERNEL
+ifdef BOARD_PREBUILT_BOOTIMAGE
+ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
+# Remove when b/63676296 is resolved.
+$(error Prebuilt bootimage is only supported for AB targets)
+endif
+$(eval $(call copy-one-file,$(BOARD_PREBUILT_BOOTIMAGE),$(INSTALLED_BOOTIMAGE_TARGET)))
+else
 INTERNAL_KERNEL_CMDLINE := $(strip $(BOARD_KERNEL_CMDLINE))
 # HACK: The top-level targets depend on the bootimage.  Not all targets
 # can produce a bootimage, though, and emulator targets need the ramdisk
@@ -709,6 +716,7 @@
 #       kernel-less inputs.
 INSTALLED_BOOTIMAGE_TARGET := $(INSTALLED_RAMDISK_TARGET)
 endif
+endif
 
 # -----------------------------------------------------------------
 # NOTICE files
@@ -1864,6 +1872,11 @@
 $(subst H,h,$(subst I,i,$(subst J,j,$(subst K,k,$(subst L,l,$(subst M,m,$(subst N,n,$(subst O,o,\
 $(subst P,p,$(subst Q,q,$(subst R,r,$(subst S,s,$(subst T,t,$(subst U,u,$(subst V,v,$(subst W,w,\
 $(subst X,x,$(subst Y,y,$(subst Z,z,$1))))))))))))))))))))))))))
+# Convert to upper case without requiring a shell, which isn't cacheable.
+to-upper=$(subst a,A,$(subst b,B,$(subst c,C,$(subst d,D,$(subst e,E,$(subst f,F,$(subst g,G,\
+$(subst h,H,$(subst i,I,$(subst j,J,$(subst k,K,$(subst l,L,$(subst m,M,$(subst n,N,$(subst o,O,\
+$(subst p,P,$(subst q,Q,$(subst r,R,$(subst s,S,$(subst t,T,$(subst u,U,$(subst v,V,$(subst w,W,\
+$(subst x,X,$(subst y,Y,$(subst z,Z,$1))))))))))))))))))))))))))
 
 # -----------------------------------------------------------------
 # vbmeta image
@@ -2080,7 +2093,8 @@
   $(HOST_OUT_EXECUTABLES)/lib/shflags/shflags \
   $(HOST_OUT_EXECUTABLES)/delta_generator \
   $(AVBTOOL) \
-  $(BLK_ALLOC_TO_BASE_FS)
+  $(BLK_ALLOC_TO_BASE_FS) \
+  $(BRO)
 
 ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
 OTATOOLS += \
@@ -2114,7 +2128,9 @@
   $(HOST_LIBRARY_PATH)/libz-host$(HOST_SHLIB_SUFFIX) \
   $(HOST_LIBRARY_PATH)/libsparse-host$(HOST_SHLIB_SUFFIX) \
   $(HOST_LIBRARY_PATH)/libbase$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libpcre2$(HOST_SHLIB_SUFFIX)
+  $(HOST_LIBRARY_PATH)/libpcre2$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libbrotli$(HOST_SHLIB_SUFFIX)
+
 
 .PHONY: otatools
 otatools: $(OTATOOLS)
@@ -2474,6 +2490,10 @@
 	$(hide) mkdir -p $(zip_root)/IMAGES
 	$(hide) cp $(INSTALLED_VENDORIMAGE_TARGET) $(zip_root)/IMAGES/
 endif
+ifdef BOARD_PREBUILT_BOOTIMAGE
+	$(hide) mkdir -p $(zip_root)/IMAGES
+	$(hide) cp $(INSTALLED_BOOTIMAGE_TARGET) $(zip_root)/IMAGES/
+endif
 ifdef BOARD_PREBUILT_DTBOIMAGE
 	$(hide) mkdir -p $(zip_root)/PREBUILT_IMAGES
 	$(hide) cp $(INSTALLED_DTBOIMAGE_TARGET) $(zip_root)/PREBUILT_IMAGES/
@@ -2563,6 +2583,8 @@
 
 ifeq ($(AB_OTA_UPDATER),true)
 $(INTERNAL_OTA_PACKAGE_TARGET): $(BRILLO_UPDATE_PAYLOAD)
+else
+$(INTERNAL_OTA_PACKAGE_TARGET): $(BRO)
 endif
 
 $(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) \
@@ -2673,20 +2695,36 @@
 		zip -qjX $@ $$apps_to_zip; \
 	fi
 
-#------------------------------------------------------------------
-# A zip of emma code coverage meta files. Generated for fully emma
-# instrumented build.
-#
 ifeq (true,$(EMMA_INSTRUMENT))
-EMMA_META_ZIP := $(PRODUCT_OUT)/emma_meta.zip
-# the dependency will be set up later in build/core/main.mk.
+  #------------------------------------------------------------------
+  # An archive of classes for use in generating code-coverage reports
+  # These are the uninstrumented versions of any classes that were
+  # to be instrumented.
+  # Any dependencies are set up later in build/core/main.mk.
+
+  ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+    JACOCO_REPORT_CLASSES_ALL := $(PRODUCT_OUT)/jacoco-report-classes-all.jar
+$(JACOCO_REPORT_CLASSES_ALL) :
+	@echo "Collecting uninstrumented classes"
+	$(hide) find $(TARGET_COMMON_OUT_ROOT) $(HOST_COMMON_OUT_ROOT) -name "jacoco-report-classes.jar" | \
+		zip -@ -0 -q -X $@
+# Meaning of these options:
+# -@ scan stdin for file paths to add to the zip
+# -0 don't do any compression
+# -q supress most output
+# -X skip storing extended file attributes
+
+  else
+    EMMA_META_ZIP := $(PRODUCT_OUT)/emma_meta.zip
 $(EMMA_META_ZIP) :
 	@echo "Collecting Emma coverage meta files."
 	$(hide) find $(TARGET_COMMON_OUT_ROOT) $(HOST_COMMON_OUT_ROOT) -name "coverage.em" | \
 		zip -@ -qX $@
+endif
 
 endif # EMMA_INSTRUMENT=true
 
+
 #------------------------------------------------------------------
 # A zip of Proguard obfuscation dictionary files.
 # Only for apps_only build.
diff --git a/core/binary.mk b/core/binary.mk
index 84e3cb9..bbc3550 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -523,6 +523,7 @@
 my_target_global_c_includes := \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_INCLUDES)
 my_target_global_c_system_includes := \
+    $(TARGET_OUT_HEADERS) \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_SYSTEM_INCLUDES)
 else ifdef LOCAL_SDK_VERSION
 my_target_global_c_includes :=
@@ -1373,6 +1374,8 @@
 ####################################################
 import_includes := $(intermediates)/import_includes
 import_includes_deps := $(strip \
+    $(if $(LOCAL_USE_VNDK),\
+      $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers.vendor,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
     $(foreach l, $(installed_shared_library_module_names), \
       $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
     $(foreach l, $(my_static_libraries) $(my_whole_static_libraries), \
@@ -1465,7 +1468,8 @@
 
 my_c_includes += $(TOPDIR)$(LOCAL_PATH) $(intermediates) $(generated_sources_dir)
 
-ifndef LOCAL_SDK_VERSION
+# The platform JNI header is for platform modules only.
+ifeq ($(LOCAL_SDK_VERSION)$(LOCAL_USE_VNDK),)
   my_c_includes += $(JNI_H_INCLUDE)
 endif
 
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index cd001b2..1fba952 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -85,6 +85,8 @@
 LOCAL_FORCE_STATIC_EXECUTABLE:=
 LOCAL_FULL_LIBS_MANIFEST_FILES:=
 LOCAL_FULL_MANIFEST_FILE:=
+LOCAL_FULL_CLASSES_JACOCO_JAR:=
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR:=
 LOCAL_GCNO_FILES:=
 LOCAL_GENERATED_SOURCES:=
 # Group static libraries with "-Wl,--start-group" and "-Wl,--end-group" when linking.
@@ -216,6 +218,7 @@
 LOCAL_SANITIZE:=
 LOCAL_SANITIZE_DIAG:=
 LOCAL_SANITIZE_RECOVER:=
+LOCAL_SANITIZE_BLACKLIST :=
 LOCAL_SDK_RES_VERSION:=
 LOCAL_SDK_VERSION:=
 LOCAL_SHARED_ANDROID_LIBRARIES:=
diff --git a/core/combo/javac.mk b/core/combo/javac.mk
index 5c2668c..36ac2aa 100644
--- a/core/combo/javac.mk
+++ b/core/combo/javac.mk
@@ -16,16 +16,20 @@
 
 common_jdk_flags := -Xmaxerrs 9999999
 
+ANDROID_JAVA_HOME := prebuilts/jdk/jdk8/$(HOST_PREBUILT_TAG)
+ANDROID_JAVA_TOOLCHAIN := $(ANDROID_JAVA_HOME)/bin
+export JAVA_HOME := $(abspath $(ANDROID_JAVA_HOME))
+
 # Use the indexer wrapper to index the codebase instead of the javac compiler
 ifeq ($(ALTERNATE_JAVAC),)
-JAVACC := javac
+JAVACC := $(ANDROID_JAVA_TOOLCHAIN)/javac
 else
 JAVACC := $(ALTERNATE_JAVAC)
 endif
 
-JAVA := java
-JAVADOC := javadoc
-JAR := jar
+JAVA := $(ANDROID_JAVA_TOOLCHAIN)/java
+JAVADOC := $(ANDROID_JAVA_TOOLCHAIN)/javadoc
+JAR := $(ANDROID_JAVA_TOOLCHAIN)/jar
 
 # The actual compiler can be wrapped by setting the JAVAC_WRAPPER var.
 ifdef JAVAC_WRAPPER
@@ -34,16 +38,8 @@
     endif
 endif
 
-# Whatever compiler is on this system.
 COMMON_JAVAC := $(JAVACC) -J-Xmx2048M $(common_jdk_flags)
 
-# Eclipse.
-ifeq ($(CUSTOM_JAVA_COMPILER), eclipse)
-    COMMON_JAVAC := java -Xmx256m -jar prebuilt/common/ecj/ecj.jar -5 \
-        -maxProblems 9999999 -nowarn
-    $(info CUSTOM_JAVA_COMPILER=eclipse)
-endif
-
 GLOBAL_JAVAC_DEBUG_FLAGS := -g
 
 HOST_JAVAC ?= $(COMMON_JAVAC)
diff --git a/core/config.mk b/core/config.mk
index 0b2e6b3..685d99c 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -494,39 +494,53 @@
 endif
 .KATI_READONLY := ALLOW_MISSING_DEPENDENCIES
 
-#
-# Tools that are prebuilts for TARGET_BUILD_APPS
-#
 prebuilt_sdk_tools := prebuilts/sdk/tools
 prebuilt_sdk_tools_bin := $(prebuilt_sdk_tools)/$(HOST_OS)/bin
 
-AIDL := $(HOST_OUT_EXECUTABLES)/aidl
-AAPT := $(HOST_OUT_EXECUTABLES)/aapt
-AAPT2 := $(HOST_OUT_EXECUTABLES)/aapt2
-ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
-SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
-SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
-LLVM_RS_CC := $(HOST_OUT_EXECUTABLES)/llvm-rs-cc
-BCC_COMPAT := $(HOST_OUT_EXECUTABLES)/bcc_compat
-DEPMOD := $(HOST_OUT_EXECUTABLES)/depmod
+USE_PREBUILT_SDK_TOOLS_IN_PLACE := true
 
-#TODO: use a smaller -Xmx value for most libraries;
-#      only core.jar and framework.jar need a heap this big.
-ifndef DX_ALT_JAR
-DX := $(HOST_OUT_EXECUTABLES)/dx
-DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+#
+# Tools that are prebuilts for TARGET_BUILD_APPS
+#
+ifeq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
+  AIDL := $(HOST_OUT_EXECUTABLES)/aidl
+  AAPT := $(HOST_OUT_EXECUTABLES)/aapt
+  AAPT2 := $(HOST_OUT_EXECUTABLES)/aapt2
+  MAINDEXCLASSES := $(HOST_OUT_EXECUTABLES)/mainDexClasses
+  SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
+  SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
+  ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
+
+  ifndef DX_ALT_JAR
+    DX := $(HOST_OUT_EXECUTABLES)/dx
+    DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+  else
+    DX := $(DX_ALT_JAR)
+    DX_COMMAND := $(JAVA) -Xms16M -Xmx2048M -jar $(DX)
+  endif
+else # TARGET_BUILD_APPS || TARGET_BUILD_PDK
+  AIDL := $(prebuilt_sdk_tools_bin)/aidl
+  AAPT := $(prebuilt_sdk_tools_bin)/aapt
+  AAPT2 := $(prebuilt_sdk_tools_bin)/aapt2
+  DX := $(prebuilt_sdk_tools)/dx
+  DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+  MAINDEXCLASSES := $(prebuilt_sdk_tools)/mainDexClasses
+  ZIPALIGN := $(prebuilt_sdk_tools_bin)/zipalign
+  SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
+  SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
+endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
+
+ifeq (,$(TARGET_BUILD_APPS))
+  # Use RenderScript prebuilts for unbundled builds but not PDK builds
+  LLVM_RS_CC := $(HOST_OUT_EXECUTABLES)/llvm-rs-cc
+  BCC_COMPAT := $(HOST_OUT_EXECUTABLES)/bcc_compat
 else
-DX := $(DX_ALT_JAR)
-DX_COMMAND := $(JAVA) -Xms16M -Xmx2048M -jar $(DX)
-endif
+  LLVM_RS_CC := $(prebuilt_sdk_tools_bin)/llvm-rs-cc
+  BCC_COMPAT := $(prebuilt_sdk_tools_bin)/bcc_compat
+endif # TARGET_BUILD_PDK
 
-MAINDEXCLASSES := $(HOST_OUT_EXECUTABLES)/mainDexClasses
-
-SOONG_ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/soong_zip
-ZIP2ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/zip2zip
-FILESLIST := $(SOONG_HOST_OUT_EXECUTABLES)/fileslist
-
-SOONG_JAVAC_WRAPPER := $(SOONG_HOST_OUT_EXECUTABLES)/soong_javac_wrapper
+prebuilt_sdk_tools :=
+prebuilt_sdk_tools_bin :=
 
 # Always use prebuilts for ckati and makeparallel
 prebuilt_build_tools := prebuilts/build-tools
@@ -535,38 +549,18 @@
 else
 prebuilt_build_tools_bin := $(prebuilt_build_tools)/$(HOST_PREBUILT_TAG)/asan/bin
 endif
+
 ACP := $(prebuilt_build_tools_bin)/acp
 CKATI := $(prebuilt_build_tools_bin)/ckati
+DEPMOD := $(HOST_OUT_EXECUTABLES)/depmod
+FILESLIST := $(SOONG_HOST_OUT_EXECUTABLES)/fileslist
 IJAR := $(prebuilt_build_tools_bin)/ijar
 MAKEPARALLEL := $(prebuilt_build_tools_bin)/makeparallel
+SOONG_JAVAC_WRAPPER := $(SOONG_HOST_OUT_EXECUTABLES)/soong_javac_wrapper
+SOONG_ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/soong_zip
+ZIP2ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/zip2zip
 ZIPTIME := $(prebuilt_build_tools_bin)/ziptime
 
-USE_PREBUILT_SDK_TOOLS_IN_PLACE := true
-
-# Override the definitions above for unbundled and PDK builds
-ifneq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
-AIDL := $(prebuilt_sdk_tools_bin)/aidl
-AAPT := $(prebuilt_sdk_tools_bin)/aapt
-AAPT2 := $(prebuilt_sdk_tools_bin)/aapt2
-ZIPALIGN := $(prebuilt_sdk_tools_bin)/zipalign
-SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
-# Use 64-bit libraries unconditionally because 32-bit JVMs are no longer supported
-SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
-
-DX := $(prebuilt_sdk_tools)/dx
-DX_COMMAND := $(DX) -JXms16M -JXmx2048M
-MAINDEXCLASSES := $(prebuilt_sdk_tools)/mainDexClasses
-
-# Don't use prebuilts in PDK
-ifneq ($(TARGET_BUILD_PDK),true)
-LLVM_RS_CC := $(prebuilt_sdk_tools_bin)/llvm-rs-cc
-BCC_COMPAT := $(prebuilt_sdk_tools_bin)/bcc_compat
-endif # TARGET_BUILD_PDK
-endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
-prebuilt_sdk_tools :=
-prebuilt_sdk_tools_bin :=
-
-
 # ---------------------------------------------------------------
 # Generic tools.
 JACK := $(HOST_OUT_EXECUTABLES)/jack
@@ -598,6 +592,7 @@
 VTSC := $(HOST_OUT_EXECUTABLES)/vtsc$(HOST_EXECUTABLE_SUFFIX)
 MKBOOTFS := $(HOST_OUT_EXECUTABLES)/mkbootfs$(HOST_EXECUTABLE_SUFFIX)
 MINIGZIP := $(HOST_OUT_EXECUTABLES)/minigzip$(HOST_EXECUTABLE_SUFFIX)
+BRO := $(HOST_OUT_EXECUTABLES)/bro$(HOST_EXECUTABLE_SUFFIX)
 ifeq (,$(strip $(BOARD_CUSTOM_MKBOOTIMG)))
 MKBOOTIMG := $(HOST_OUT_EXECUTABLES)/mkbootimg$(HOST_EXECUTABLE_SUFFIX)
 else
@@ -674,29 +669,20 @@
 
 FINDBUGS_DIR := external/owasp/sanitizer/tools/findbugs/bin
 FINDBUGS := $(FINDBUGS_DIR)/findbugs
-EMMA_JAR := external/emma/lib/emma$(COMMON_JAVA_PACKAGE_SUFFIX)
+JACOCO_CLI_JAR := $(HOST_OUT_JAVA_LIBRARIES)/jacoco-cli$(COMMON_JAVA_PACKAGE_SUFFIX)
 
 # Tool to merge AndroidManifest.xmls
 ANDROID_MANIFEST_MERGER := $(JAVA) -classpath prebuilts/devtools/tools/lib/manifest-merger.jar com.android.manifmerger.Main merge
 
 COLUMN:= column
 
-# We may not have the right JAVA_HOME/PATH set up yet when this is run from envsetup.sh.
-ifneq ($(CALLED_FROM_SETUP),true)
-
 # Path to tools.jar, or empty if EXPERIMENTAL_USE_OPENJDK9 is set
 HOST_JDK_TOOLS_JAR :=
 # TODO: Remove HOST_JDK_TOOLS_JAR and all references to it once OpenJDK 8
 # toolchains are no longer supported (i.e. when what is now
 # EXPERIMENTAL_USE_OPENJDK9 becomes the standard). http://b/38418220
 ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
-HOST_JDK_TOOLS_JAR := $(shell $(BUILD_SYSTEM)/find-jdk-tools-jar.sh)
-
-ifneq ($(HOST_JDK_TOOLS_JAR),)
-ifeq ($(wildcard $(HOST_JDK_TOOLS_JAR)),)
-$(error Error: could not find jdk tools.jar at $(HOST_JDK_TOOLS_JAR), please check if your JDK was installed correctly)
-endif
-endif
+HOST_JDK_TOOLS_JAR := $(ANDROID_JAVA_TOOLCHAIN)/../lib/tools.jar
 endif # ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
 
 # Is the host JDK 64-bit version?
@@ -704,7 +690,6 @@
 ifneq ($(filter 64-Bit, $(shell $(JAVA) -version 2>&1)),)
 HOST_JDK_IS_64BIT_VERSION := true
 endif
-endif  # CALLED_FROM_SETUP not true
 
 # It's called md5 on Mac OS and md5sum on Linux
 ifeq ($(HOST_OS),darwin)
@@ -890,6 +875,17 @@
 unexport JAVA_HOME
 export ANDROID_BUILD_PATHS:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(ANDROID_BUILD_PATHS)
 export PATH:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(PATH)
+else
+  # Put java first on the path
+  # TODO(ccross): remove this once tools run during the build no longer depend on
+  # finding java in the path
+  ifeq (,$(strip $(CALLED_FROM_SETUP)))
+    ifneq ($(shell which java),$(abspath $(ANDROID_JAVA_TOOLCHAIN)/java))
+      $(warning Found incorrect java $(shell which java) in $$PATH)
+      $(warning Adding $(abspath $(ANDROID_JAVA_TOOLCHAIN)) to $$PATH)
+      export PATH:=$(abspath $(ANDROID_JAVA_TOOLCHAIN)):$(PATH)
+    endif
+  endif
 endif
 
 # Projects clean of compiler warnings should be compiled with -Werror.
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index 967df2d..c011284 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -9,6 +9,7 @@
 # modules that haven't set `LOCAL_CLANG := false` and device modules that
 # have set `LOCAL_CLANG := true`.
 my_global_sanitize :=
+my_global_sanitize_diag :=
 ifeq ($(my_clang),true)
   ifdef LOCAL_IS_HOST_MODULE
     my_global_sanitize := $(strip $(SANITIZE_HOST))
@@ -17,18 +18,35 @@
     my_global_sanitize := $(subst true,address,$(my_global_sanitize))
   else
     my_global_sanitize := $(strip $(SANITIZE_TARGET))
+    my_global_sanitize_diag := $(strip $(SANITIZE_TARGET_DIAG))
+  endif
+endif
+
+# Disable global integer_overflow in excluded paths.
+ifneq ($(filter integer_overflow, $(my_global_sanitize)),)
+  combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
+                            $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
+
+  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
+         $(filter $(dir)%,$(LOCAL_PATH)))),)
+    my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize))
+    my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag))
   endif
 endif
 
 ifneq ($(my_global_sanitize),)
   my_sanitize := $(my_global_sanitize) $(my_sanitize)
 endif
+ifneq ($(my_global_sanitize_diag),)
+  my_sanitize_diag := $(my_global_sanitize_diag) $(my_sanitize_diag)
+endif
 
 # The sanitizer specified in the product configuration wins over the previous.
 ifneq ($(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG),)
   my_sanitize := $(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG)
   ifeq ($(my_sanitize),never)
     my_sanitize :=
+    my_sanitize_diag :=
   endif
 endif
 
@@ -37,6 +55,7 @@
   SANITIZE_TARGET_ARCH ?= $(TARGET_ARCH) $(TARGET_2ND_ARCH)
   ifeq ($(filter $(SANITIZE_TARGET_ARCH),$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
     my_sanitize :=
+    my_sanitize_diag :=
   endif
 endif
 
@@ -47,6 +66,7 @@
     ifneq (,$(filter $(LOCAL_MODULE_OWNER),$(subst :, ,$(SANITIZE_NEVER_BY_OWNER))))
       $(warning Not sanitizing $(LOCAL_MODULE) based on module owner.)
       my_sanitize :=
+      my_sanitize_diag :=
     endif
   endif
 endif
@@ -55,11 +75,13 @@
 ifdef LOCAL_SDK_VERSION
   my_sanitize :=
   my_global_sanitize :=
+  my_sanitize_diag :=
 endif
 
 # Never always wins.
 ifeq ($(LOCAL_SANITIZE),never)
   my_sanitize :=
+  my_sanitize_diag :=
 endif
 
 # If CFI is disabled globally, remove it from my_sanitize.
@@ -86,6 +108,21 @@
   my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
 endif
 
+# Support for local sanitize blacklist paths.
+ifneq ($(my_sanitize)$(my_global_sanitize),)
+  ifneq ($(LOCAL_SANITIZE_BLACKLIST),)
+    my_cflags += -fsanitize-blacklist=$(LOCAL_PATH)/$(LOCAL_SANITIZE_BLACKLIST)
+  endif
+endif
+
+# Disable integer_overflow if LOCAL_NOSANITIZE=integer.
+ifneq ($(filter integer_overflow, $(my_global_sanitize) $(my_sanitize)),)
+  ifneq ($(filter integer, $(strip $(LOCAL_NOSANITIZE))),)
+    my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
+    my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
+  endif
+endif
+
 my_nosanitize = $(strip $(LOCAL_NOSANITIZE))
 ifneq ($(my_nosanitize),)
   my_sanitize := $(filter-out $(my_nosanitize),$(my_sanitize))
@@ -142,6 +179,37 @@
   my_sanitize := $(filter-out coverage,$(my_sanitize))
 endif
 
+ifneq ($(filter integer_overflow,$(my_sanitize)),)
+  ifneq ($(filter SHARED_LIBRARIES EXECUTABLES,$(LOCAL_MODULE_CLASS)),)
+    ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
+
+      # Respect LOCAL_NOSANITIZE for integer-overflow flags.
+      ifeq ($(filter signed-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),)
+        my_cflags += -fsanitize=signed-integer-overflow
+      endif
+      ifeq ($(filter unsigned-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),)
+        my_cflags += -fsanitize=unsigned-integer-overflow
+      endif
+      my_cflags += -fsanitize-trap=all
+      my_cflags += -ftrap-function=abort
+      my_cflags += $(INTEGER_OVERFLOW_EXTRA_CFLAGS)
+
+      # Check for diagnostics mode (on by default).
+      ifneq ($(filter integer_overflow,$(my_sanitize_diag)),)
+        my_cflags += -fno-sanitize-trap=signed-integer-overflow,unsigned-integer-overflow
+        my_shared_libraries := $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY) $(my_shared_libraries)
+      endif
+    endif
+  endif
+  my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
+endif
+
+# Makes sure integer_overflow diagnostics is removed from the diagnostics list
+# even if integer_overflow is not set for some reason.
+ifneq ($(filter integer_overflow,$(my_sanitize_diag)),)
+  my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
+endif
+
 ifneq ($(my_sanitize),)
   fsanitize_arg := $(subst $(space),$(comma),$(my_sanitize))
   my_cflags += -fsanitize=$(fsanitize_arg)
@@ -219,12 +287,6 @@
   endif
 endif
 
-ifneq ($(filter undefined,$(my_sanitize)),)
-  ifndef LOCAL_IS_HOST_MODULE
-    $(error ubsan is not yet supported on the target)
-  endif
-endif
-
 ifneq ($(strip $(LOCAL_SANITIZE_RECOVER)),)
   recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_RECOVER)),
   my_cflags += -fsanitize-recover=$(recover_arg)
diff --git a/core/definitions.mk b/core/definitions.mk
index 07e5b69..86bda9e 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2227,7 +2227,7 @@
     $(addprefix -classpath ,$(strip \
         $(call normalize-path-list,$(PRIVATE_ALL_JAVA_LIBRARIES)))) \
     $(if $(findstring true,$(PRIVATE_WARNINGS_ENABLE)),$(xlint_unchecked),) \
-    -extdirs "" -d $(PRIVATE_CLASS_INTERMEDIATES_DIR) -s $(PRIVATE_ANNO_INTERMEDIATES_DIR) \
+    -d $(PRIVATE_CLASS_INTERMEDIATES_DIR) -s $(PRIVATE_ANNO_INTERMEDIATES_DIR) \
     $(PRIVATE_JAVACFLAGS) \
     \@$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq \
     || ( rm -rf $(PRIVATE_CLASS_INTERMEDIATES_DIR) ; exit 41 ) \
@@ -2523,12 +2523,6 @@
 $(if $(PRIVATE_JAR_MANIFEST), $(hide) echo unsupported options JAR_MANIFEST in $@; exit 53)
 endef
 
-define transform-classes.jar-to-emma
-$(hide) $(JAVA) -classpath $(EMMA_JAR) emma instr -outmode fullcopy -outfile \
-    $(PRIVATE_EMMA_COVERAGE_FILE) -ip $< -d $(PRIVATE_EMMA_INTERMEDIATES_DIR) \
-    $(addprefix -ix , $(PRIVATE_EMMA_COVERAGE_FILTER))
-endef
-
 define desugar-classpath
 $(filter-out -classpath -bootclasspath "",$(subst :,$(space),$(1)))
 endef
@@ -2541,6 +2535,7 @@
 endef
 
 # --add-opens is required because desugar reflects via java.lang.invoke.MethodHandles.Lookup
+# --desugar_try_with_resources_if_needed=false is needed due to b/63180735, b/63901645, b/63900665
 define desugar-classes-jar
 @echo Desugar: $@
 @mkdir -p $(dir $@)
@@ -2554,6 +2549,7 @@
     $(addprefix --bootclasspath_entry ,$(call desugar-bootclasspath,$(PRIVATE_BOOTCLASSPATH))) \
     $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_LIBRARIES)) \
     --min_sdk_version $(call codename-or-sdk-to-sdk,$(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
+    --desugar_try_with_resources_if_needed=false \
     --allow_empty_bootclasspath \
     $(if $(filter --core-library,$(PRIVATE_DX_FLAGS)),--core_library) \
     -i $< -o $@.tmp
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index 9db5dbf..47fdba6 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -88,6 +88,42 @@
 LIBART_TARGET_BOOT_ART_EXTRA_FILES := $(foreach jar,$(wordlist 2,999,$(LIBART_TARGET_BOOT_JARS)),boot-$(jar).art boot-$(jar).oat boot-$(jar).vdex)
 LIBART_TARGET_BOOT_ART_EXTRA_FILES += boot.oat boot.vdex
 
+# If we use a boot image profile.
+my_use_profile_for_boot_image := $(PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE)
+ifeq (,$(my_use_profile_for_boot_image))
+# If not set, use the default.
+my_use_profile_for_boot_image := false
+endif
+
+ifeq (true,$(my_use_profile_for_boot_image))
+
+# Location of text based profile for the boot image.
+my_boot_image_profile_location := $(PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION)
+ifeq (,$(my_boot_image_profile_location))
+# If not set, use the default.
+my_boot_image_profile_location := frameworks/base/boot-image-profile.txt
+endif
+
+# Code to create the boot image profile, not in dex_preopt_libart_boot.mk since the profile is the same for all archs.
+my_out_boot_image_profile_location := $(DEXPREOPT_BOOT_JAR_DIR_FULL_PATH)/boot.prof
+$(my_out_boot_image_profile_location): PRIVATE_PROFILE_INPUT_LOCATION := $(my_boot_image_profile_location)
+$(my_out_boot_image_profile_location): $(PROFMAN) $(LIBART_TARGET_BOOT_DEX_FILES) $(my_boot_image_profile_location)
+	@echo "target profman: $@"
+	@mkdir -p $(dir $@)
+	ANDROID_LOG_TAGS="*:e" $(PROFMAN) \
+		--create-profile-from=$(PRIVATE_PROFILE_INPUT_LOCATION) \
+		$(addprefix --apk=,$(LIBART_TARGET_BOOT_DEX_FILES)) \
+		$(addprefix --dex-location=,$(LIBART_TARGET_BOOT_DEX_LOCATIONS)) \
+		--reference-profile-file=$@
+
+# We want to install the profile even if we are not using preopt since it is required to generate
+# the image on the device.
+my_installed_profile := $(TARGET_OUT)/etc/boot-image.prof
+$(eval $(call copy-one-file,$(my_out_boot_image_profile_location),$(my_installed_profile)))
+ALL_DEFAULT_INSTALLED_MODULES += $(my_installed_profile)
+
+endif
+
 my_2nd_arch_prefix :=
 include $(BUILD_SYSTEM)/dex_preopt_libart_boot.mk
 
diff --git a/core/dex_preopt_libart_boot.mk b/core/dex_preopt_libart_boot.mk
index 860a66a..6e49f64 100644
--- a/core/dex_preopt_libart_boot.mk
+++ b/core/dex_preopt_libart_boot.mk
@@ -50,18 +50,27 @@
 	@mkdir -p $(dir $@)
 	$(hide) $(ACP) -fp $(dir $<)$(notdir $@) $@
 
+ifeq (,$(my_out_boot_image_profile_location))
+my_boot_image_flags := $(COMPILED_CLASSES_FLAGS)
+my_boot_image_flags += --image-classes=$(PRELOADED_CLASSES)
+else
+my_boot_image_flags := --compiler-filter=speed-profile
+my_boot_image_flags += --profile-file=$(my_out_boot_image_profile_location)
+endif
+
+$($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_BOOT_IMAGE_FLAGS := $(my_boot_image_flags)
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_2ND_ARCH_VAR_PREFIX := $(my_2nd_arch_prefix)
 # Use dex2oat debug version for better error reporting
-$($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME) : $(LIBART_TARGET_BOOT_DEX_FILES) $(PRELOADED_CLASSES) $(COMPILED_CLASSES) $(DEX2OAT_DEPENDENCY)
+$($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME) : $(LIBART_TARGET_BOOT_DEX_FILES) $(PRELOADED_CLASSES) $(COMPILED_CLASSES) $(DEX2OAT_DEPENDENCY) $(my_out_profile_location)
 	@echo "target dex2oat: $@"
 	@mkdir -p $(dir $@)
 	@mkdir -p $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))
 	@rm -f $(dir $@)/*.art $(dir $@)/*.oat
 	@rm -f $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))/*.art
 	@rm -f $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))/*.oat
-	$(hide) ANDROID_LOG_TAGS="*:e" $(DEX2OAT) --runtime-arg -Xms$(DEX2OAT_IMAGE_XMS) \
+	$(DEX2OAT) --runtime-arg -Xms$(DEX2OAT_IMAGE_XMS) \
 		--runtime-arg -Xmx$(DEX2OAT_IMAGE_XMX) \
-		--image-classes=$(PRELOADED_CLASSES) \
+		$(PRIVATE_BOOT_IMAGE_FLAGS) \
 		$(addprefix --dex-file=,$(LIBART_TARGET_BOOT_DEX_FILES)) \
 		$(addprefix --dex-location=,$(LIBART_TARGET_BOOT_DEX_LOCATIONS)) \
 		--oat-symbols=$($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED) \
@@ -75,4 +84,4 @@
 		--runtime-arg -Xnorelocate --compile-pic \
 		--no-generate-debug-info --generate-build-id \
 		--multi-image --no-inline-from=core-oj.jar \
-		$(PRODUCT_DEX_PREOPT_BOOT_FLAGS) $(GLOBAL_DEXPREOPT_FLAGS) $(COMPILED_CLASSES_FLAGS) $(ART_BOOT_IMAGE_EXTRA_ARGS)
+		$(PRODUCT_DEX_PREOPT_BOOT_FLAGS) $(GLOBAL_DEXPREOPT_FLAGS) $(ART_BOOT_IMAGE_EXTRA_ARGS)
diff --git a/core/droiddoc.mk b/core/droiddoc.mk
index 8e3ecff..2676b44 100644
--- a/core/droiddoc.mk
+++ b/core/droiddoc.mk
@@ -86,8 +86,7 @@
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES)) $(LOCAL_CLASSPATH)
 endif # !LOCAL_IS_HOST_MODULE
 
-$(full_target): PRIVATE_CLASSPATH := $(subst $(space),:,$(full_java_libs))
-
+$(full_target): PRIVATE_CLASSPATH := $(call normalize-path-list,$(full_java_libs))
 
 intermediates.COMMON := $(call local-intermediates-dir,COMMON)
 
@@ -166,6 +165,10 @@
 # TODO: not clear if this is used any more
 $(full_target): PRIVATE_LOCAL_PATH := $(LOCAL_PATH)
 
+# TODO(tobiast): Clean this up once we move to -source 1.9.
+# OpenJDK 9 does not have the concept of a "boot classpath" so we should
+# then rename PRIVATE_BOOTCLASSPATH to PRIVATE_MODULE or similar. For now,
+# keep -bootclasspath here since it works in combination with -source 1.8.
 $(full_target): \
         $(full_src_files) \
         $(droiddoc_templates) \
@@ -211,6 +214,18 @@
 ## standard doclet only
 ##
 ##
+
+ifneq ($(EXPERIMENTAL_USE_OPENJDK9),)
+# For OpenJDK 9 we use --patch-module to define the core libraries code.
+# TODO(tobiast): Reorganize this when adding proper support for OpenJDK 9
+# modules. Here we treat all code in core libraries as being in java.base
+# to work around the OpenJDK 9 module system. http://b/62049770
+$(full_target): PRIVATE_BOOTCLASSPATH_ARG := --patch-module=java.base=$(PRIVATE_BOOTCLASSPATH)
+else
+# For OpenJDK 8 we can use -bootclasspath to define the core libraries code.
+$(full_target): PRIVATE_BOOTCLASSPATH_ARG := $(addprefix -bootclasspath ,$(PRIVATE_BOOTCLASSPATH))
+endif
+
 $(full_target): $(full_src_files) $(full_java_lib_deps)
 	@echo Docs javadoc: $(PRIVATE_OUT_DIR)
 	@mkdir -p $(dir $@)
@@ -226,7 +241,7 @@
                 -Xdoclint:none \
                 $(PRIVATE_PROFILING_OPTIONS) \
                 $(addprefix -classpath ,$(PRIVATE_CLASSPATH)) \
-                $(addprefix -bootclasspath ,$(PRIVATE_BOOTCLASSPATH)) \
+                $(PRIVATE_BOOTCLASSPATH_ARG) \
                 -sourcepath $(PRIVATE_SOURCE_PATH)$(addprefix :,$(PRIVATE_CLASSPATH)) \
                 -d $(PRIVATE_OUT_DIR) \
                 -quiet \
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 27cfd7f..46066e3 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -273,6 +273,10 @@
   ifneq ($(BOARD_VNDK_VERSION),current)
     $(error BOARD_VNDK_VERSION: Only "current" is implemented)
   endif
+
+  TARGET_VENDOR_TEST_SUFFIX := /vendor
+else
+  TARGET_VENDOR_TEST_SUFFIX :=
 endif
 
 # ---------------------------------------------------------------
@@ -480,9 +484,13 @@
 ifeq ($(TARGET_IS_64_BIT),true)
 TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest64
 TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest64
+TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest64$(TARGET_VENDOR_TEST_SUFFIX)
+TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest64$(TARGET_VENDOR_TEST_SUFFIX)
 else
 TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest
 TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest
+TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest$(TARGET_VENDOR_TEST_SUFFIX)
+TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest$(TARGET_VENDOR_TEST_SUFFIX)
 endif
 TARGET_OUT_DATA_FAKE := $(TARGET_OUT_DATA)/fake_packages
 
@@ -492,9 +500,13 @@
 ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest/$(TARGET_2ND_ARCH)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest/$(TARGET_2ND_ARCH)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest/$(TARGET_2ND_ARCH)$(TARGET_VENDOR_TEST_SUFFIX)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest/$(TARGET_2ND_ARCH)$(TARGET_VENDOR_TEST_SUFFIX)
 else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest$(TARGET_VENDOR_TEST_SUFFIX)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest$(TARGET_VENDOR_TEST_SUFFIX)
 endif
 
 TARGET_OUT_CACHE := $(PRODUCT_OUT)/cache
diff --git a/core/find-jdk-tools-jar.sh b/core/find-jdk-tools-jar.sh
deleted file mode 100755
index ac0b3b6..0000000
--- a/core/find-jdk-tools-jar.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-if [ "x$ANDROID_JAVA_HOME" != x ] && [ -e "$ANDROID_JAVA_HOME/lib/tools.jar" ] ; then
-    echo $ANDROID_JAVA_HOME/lib/tools.jar
-else
-    JAVAC=$(realpath $(which javac) 2>/dev/null)
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(readlink -f $(which javac) 2>/dev/null)
-    fi
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(which javac)
-    fi
-    if [ -z "$JAVAC" ] ; then
-        exit 1
-    fi
-    while [ -L "$JAVAC" ] ; do
-        LSLINE=$(ls -l "$JAVAC")
-        JAVAC=$(echo -n "$LSLINE" | sed -e "s/.* -> //")
-    done
-    echo $JAVAC | sed -e 's:\(.*\)/javac$:\1/../lib/tools.jar:'
-fi
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index 939ff37..a68be6a 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -33,16 +33,11 @@
 
 full_classes_compiled_jar := $(intermediates.COMMON)/classes-full-debug.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/classes-jarjar.jar
-emma_intermediates_dir := $(intermediates.COMMON)/emma_out
-# emma is hardcoded to use the leaf name of its input for the output file --
-# only the output directory can be changed
-full_classes_emma_jar := $(emma_intermediates_dir)/lib/$(notdir $(full_classes_jarjar_jar))
 full_classes_jar := $(intermediates.COMMON)/classes.jar
 
 LOCAL_INTERMEDIATE_TARGETS += \
     $(full_classes_compiled_jar) \
     $(full_classes_jarjar_jar) \
-    $(full_classes_emma_jar)
 
 #######################################
 include $(BUILD_SYSTEM)/base_rules.mk
@@ -95,23 +90,13 @@
 full_classes_jarjar_jar := $(full_classes_compiled_jar)
 endif
 
-ifeq (true,$(LOCAL_EMMA_INSTRUMENT))
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILE := $(intermediates.COMMON)/coverage.em
-$(full_classes_emma_jar): PRIVATE_EMMA_INTERMEDIATES_DIR := $(emma_intermediates_dir)
-ifdef LOCAL_EMMA_COVERAGE_FILTER
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := $(LOCAL_EMMA_COVERAGE_FILTER)
-else
-# by default, avoid applying emma instrumentation onto emma classes itself,
-# otherwise there will be exceptions thrown
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := *,-emma,-emmarun,-com.vladium.*
-endif
-# this rule will generate both $(PRIVATE_EMMA_COVERAGE_FILE) and
-# $(full_classes_emma_jar)
-$(full_classes_emma_jar) : $(full_classes_jarjar_jar) | $(EMMA_JAR)
-	$(transform-classes.jar-to-emma)
-else # LOCAL_EMMA_INSTRUMENT
-full_classes_emma_jar := $(full_classes_jarjar_jar)
-endif # LOCAL_EMMA_INSTRUMENT
 
-$(eval $(call copy-one-file,$(full_classes_emma_jar),$(LOCAL_BUILT_MODULE)))
-$(eval $(call copy-one-file,$(full_classes_emma_jar),$(full_classes_jar)))
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(full_classes_jarjar_jar)
+
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
+
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
+
diff --git a/core/install_jni_libs_internal.mk b/core/install_jni_libs_internal.mk
index 0e92153..b5f10cf 100644
--- a/core/install_jni_libs_internal.mk
+++ b/core/install_jni_libs_internal.mk
@@ -116,7 +116,7 @@
 else
 my_link_type := app:platform
 my_warn_types :=
-my_allowed_types := native:ndk native:platform
+my_allowed_types := native:ndk native:platform native:vendor
 endif
 
 my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
diff --git a/core/jacoco.mk b/core/jacoco.mk
new file mode 100644
index 0000000..a04d25e
--- /dev/null
+++ b/core/jacoco.mk
@@ -0,0 +1,140 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This file sets up Java code coverage via Jacoco
+# This file is only intended to be included internally by the build system
+# (at the time of authorship, it is included by java.mk and
+# java_host_library.mk)
+
+my_include_filter :=
+my_exclude_filter :=
+
+ifeq ($(LOCAL_EMMA_INSTRUMENT),true)
+  ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+    # determine Jacoco include/exclude filters
+    DEFAULT_JACOCO_EXCLUDE_FILTER := org/junit/*,org/jacoco/*,org/mockito/*
+    # copy filters from Jack but also skip some known java packages
+    my_include_filter := $(strip $(LOCAL_JACK_COVERAGE_INCLUDE_FILTER))
+    my_exclude_filter := $(strip $(DEFAULT_JACOCO_EXCLUDE_FILTER),$(LOCAL_JACK_COVERAGE_EXCLUDE_FILTER))
+
+    # replace '.' with '/' and ',' with ' ', and quote each arg
+    ifneq ($(strip $(my_include_filter)),)
+      my_include_args := $(strip $(my_include_filter))
+
+      my_include_args := $(subst .,/,$(my_include_args))
+      my_include_args := '$(subst $(comma),' ',$(my_include_args))'
+    else
+      my_include_args :=
+    endif
+
+    # replace '.' with '/' and ',' with ' ', and quote each arg
+    ifneq ($(strip $(my_exclude_filter)),)
+      my_exclude_args := $(my_exclude_filter)
+
+      my_exclude_args := $(subst .,/,$(my_exclude_args))
+      my_exclude_args := $(subst $(comma)$(comma),$(comma),$(my_exclude_args))
+      my_exclude_args := '$(subst $(comma),' ', $(my_exclude_args))'
+    else
+      my_exclude_args :=
+    endif
+  endif # ANDROID_COMPILE_WITH_JACK==false
+endif # LOCAL_EMMA_INSTRUMENT == true
+
+# determine whether to run the instrumenter based on whether there is any work
+# for it to do
+ifneq ($(my_include_filter),)
+
+  my_files := $(intermediates.COMMON)/jacoco
+
+  # make a task that unzips the classes that we want to instrument from the
+  # input jar
+  my_unzipped_path := $(my_files)/work/classes-to-instrument/classes
+  my_unzipped_timestamp_path := $(my_files)/work/classes-to-instrument/updated.stamp
+$(my_unzipped_timestamp_path): PRIVATE_UNZIPPED_PATH := $(my_unzipped_path)
+$(my_unzipped_timestamp_path): PRIVATE_UNZIPPED_TIMESTAMP_PATH := $(my_unzipped_timestamp_path)
+$(my_unzipped_timestamp_path): PRIVATE_INCLUDE_ARGS := $(my_include_args)
+$(my_unzipped_timestamp_path): PRIVATE_EXCLUDE_ARGS := $(my_exclude_args)
+$(my_unzipped_timestamp_path): PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+$(my_unzipped_timestamp_path): $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+	rm -rf $(PRIVATE_UNZIPPED_PATH) $@
+	mkdir -p $(PRIVATE_UNZIPPED_PATH)
+	unzip -q $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) \
+	  -d $(PRIVATE_UNZIPPED_PATH) \
+	  $(PRIVATE_INCLUDE_ARGS)
+	rm -rf $(PRIVATE_EXCLUDE_ARGS)
+	touch $(PRIVATE_UNZIPPED_TIMESTAMP_PATH)
+# Unfortunately in the previous task above,
+# 'rm -rf $(PRIVATE_EXCLUDE_ARGS)' needs to be a separate
+# shell command after 'unzip'.
+# We can't just use the '-x' (exclude) option of 'unzip' because if both
+# inclusions and exclusions are specified and an exclusion matches no
+# inclusions, then 'unzip' exits with an error (error 11).
+# We could ignore the error, but that would make the process less reliable
+
+
+  # make a task that zips only the classes that will be instrumented
+  # (for passing in to the report generator later)
+  my_classes_to_report_on_path := $(my_files)/report-resources/jacoco-report-classes.jar
+$(my_classes_to_report_on_path): PRIVATE_UNZIPPED_PATH := $(my_unzipped_path)
+$(my_classes_to_report_on_path): $(my_unzipped_timestamp_path)
+	rm -f $@
+	zip -q $@ \
+	  -r $(PRIVATE_UNZIPPED_PATH)
+
+
+
+  # make a task that invokes instrumentation
+  my_instrumented_path := $(my_files)/work/instrumented/classes
+  my_instrumented_timestamp_path := $(my_files)/work/instrumented/updated.stamp
+$(my_instrumented_timestamp_path): PRIVATE_INSTRUMENTED_PATH := $(my_instrumented_path)
+$(my_instrumented_timestamp_path): PRIVATE_INSTRUMENTED_TIMESTAMP_PATH := $(my_instrumented_timestamp_path)
+$(my_instrumented_timestamp_path): PRIVATE_UNZIPPED_PATH := $(my_unzipped_path)
+$(my_instrumented_timestamp_path): $(my_unzipped_timestamp_path) $(JACOCO_CLI_JAR)
+	rm -rf $(PRIVATE_INSTRUMENTED_PATH)
+	mkdir -p $(PRIVATE_INSTRUMENTED_PATH)
+	java -jar $(JACOCO_CLI_JAR) \
+	  instrument \
+	  -quiet \
+	  -dest '$(PRIVATE_INSTRUMENTED_PATH)' \
+	  $(PRIVATE_UNZIPPED_PATH)
+	touch $(PRIVATE_INSTRUMENTED_TIMESTAMP_PATH)
+
+
+  # make a task that zips both the instrumented classes and the uninstrumented
+  # classes (this jar is the instrumented application to execute)
+  my_temp_jar_path := $(my_files)/work/usable.jar
+  LOCAL_FULL_CLASSES_JACOCO_JAR := $(intermediates.COMMON)/classes-jacoco.jar
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_TEMP_JAR_PATH := $(my_temp_jar_path)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_INSTRUMENTED_PATH := $(my_instrumented_path)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): $(my_instrumented_timestamp_path) $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+	rm -f $@ $(PRIVATE_TEMP_JAR_PATH)
+	# copy the pre-jacoco jar (containing files excluded from instrumentation)
+	cp $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) $(PRIVATE_TEMP_JAR_PATH)
+	# copy instrumented files back into the resultant jar
+	$(JAR) -uf $(PRIVATE_TEMP_JAR_PATH) -C $(PRIVATE_INSTRUMENTED_PATH) .
+	mv $(PRIVATE_TEMP_JAR_PATH) $@
+
+  # this is used to trigger $(my_classes_to_report_on_path) to build
+  # when $(LOCAL_FULL_CLASSES_JACOCO_JAR) builds, but it isn't truly a
+  # dependency.
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): $(my_classes_to_report_on_path)
+
+else # my_include_filter == ''
+  LOCAL_FULL_CLASSES_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+endif # my_include_filter != ''
+
+LOCAL_INTERMEDIATE_TARGETS += $(LOCAL_FULL_CLASSES_JACOCO_JAR)
diff --git a/core/java.mk b/core/java.mk
index 3ee2199..8fde7c2 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -118,10 +118,6 @@
 full_classes_desugar_jar := $(intermediates.COMMON)/classes-desugar.jar
 jarjar_leaf := classes-jarjar.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/$(jarjar_leaf)
-emma_intermediates_dir := $(intermediates.COMMON)/emma_out
-# emma is hardcoded to use the leaf name of its input for the output file --
-# only the output directory can be changed
-full_classes_emma_jar := $(emma_intermediates_dir)/lib/$(jarjar_leaf)
 full_classes_proguard_jar := $(intermediates.COMMON)/classes-proguard.jar
 built_dex_intermediate := $(intermediates.COMMON)/$(built_dex_intermediate_leaf)/classes.dex
 full_classes_stubs_jar := $(intermediates.COMMON)/stubs.jar
@@ -144,7 +140,6 @@
     $(full_classes_compiled_jar) \
     $(full_classes_desugar_jar) \
     $(full_classes_jarjar_jar) \
-    $(full_classes_emma_jar) \
     $(full_classes_jar) \
     $(full_classes_proguard_jar) \
     $(built_dex_intermediate) \
@@ -429,6 +424,16 @@
 LOCAL_JAVACFLAGS += $(LOCAL_ERROR_PRONE_FLAGS)
 endif
 
+# For user / userdebug builds, strip the local variable table and the local variable
+# type table. This has no bearing on stack traces, but will leave less information
+# available via JDWP.
+ifneq (,$(PRODUCT_MINIMIZE_JAVA_DEBUG_INFO))
+ifneq (,$(filter userdebug user,$(TARGET_BUILD_VARIANT)))
+LOCAL_JAVACFLAGS+= -g:source,lines
+LOCAL_JACK_FLAGS+= -D jack.dex.debug.vars=false -D jack.dex.debug.vars.synthetic=false
+endif
+endif
+
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES := $(LOCAL_JAR_EXCLUDE_FILES)
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES := $(LOCAL_JAR_PACKAGES)
@@ -458,18 +463,21 @@
 # using deferred evaluation (LOCAL_JAR_PROCESSOR_ARGS = instead of :=).
 in := $(full_classes_compiled_jar)
 out := $(full_classes_processed_jar).tmp
+my_jar_processor := $(HOST_OUT_JAVA_LIBRARIES)/$(LOCAL_JAR_PROCESSOR).jar
+
 $(full_classes_processed_jar): PRIVATE_JAR_PROCESSOR_ARGS := $(LOCAL_JAR_PROCESSOR_ARGS)
-$(full_classes_processed_jar): PRIVATE_JAR_PROCESSOR := $(HOST_OUT_JAVA_LIBRARIES)/$(LOCAL_JAR_PROCESSOR).jar
+$(full_classes_processed_jar): PRIVATE_JAR_PROCESSOR := $(my_jar_processor)
 $(full_classes_processed_jar): PRIVATE_TMP_OUT := $(out)
 in :=
 out :=
 
-$(full_classes_processed_jar): $(full_classes_compiled_jar) $(LOCAL_JAR_PROCESSOR)
+$(full_classes_processed_jar): $(full_classes_compiled_jar) $(my_jar_processor)
 	@echo Processing $@ with $(PRIVATE_JAR_PROCESSOR)
 	$(hide) rm -f $@ $(PRIVATE_TMP_OUT)
 	$(hide) $(JAVA) -jar $(PRIVATE_JAR_PROCESSOR) $(PRIVATE_JAR_PROCESSOR_ARGS)
 	$(hide) mv $(PRIVATE_TMP_OUT) $@
 
+my_jar_processor :=
 else
 full_classes_processed_jar := $(full_classes_compiled_jar)
 endif
@@ -498,29 +506,13 @@
 full_classes_jarjar_jar := $(full_classes_desugar_jar)
 endif
 
-ifeq ($(LOCAL_EMMA_INSTRUMENT),true)
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILE := $(intermediates.COMMON)/coverage.emma.ignore
-$(full_classes_emma_jar): PRIVATE_EMMA_INTERMEDIATES_DIR := $(emma_intermediates_dir)
-# module level coverage filter can be defined using LOCAL_EMMA_COVERAGE_FILTER
-# in Android.mk
-ifdef LOCAL_EMMA_COVERAGE_FILTER
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := $(LOCAL_EMMA_COVERAGE_FILTER)
-else
-# by default, avoid applying emma instrumentation onto emma classes itself,
-# otherwise there will be exceptions thrown
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := *,-emma,-emmarun,-com.vladium.*
-endif
-# this rule will generate both $(PRIVATE_EMMA_COVERAGE_FILE) and
-# $(full_classes_emma_jar)
-$(full_classes_emma_jar): $(full_classes_jarjar_jar) | $(EMMA_JAR)
-	$(transform-classes.jar-to-emma)
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(full_classes_jarjar_jar)
 
-else
-full_classes_emma_jar := $(full_classes_jarjar_jar)
-endif
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
 
-# TODO: this should depend on full_classes_emma_jar once coverage works again
-full_classes_pre_proguard_jar := $(full_classes_jarjar_jar)
+full_classes_pre_proguard_jar := $(LOCAL_FULL_CLASSES_JACOCO_JAR)
 
 # Keep a copy of the jar just before proguard processing.
 $(eval $(call copy-one-file,$(full_classes_pre_proguard_jar),$(intermediates.COMMON)/classes-pre-proguard.jar))
diff --git a/core/java_library.mk b/core/java_library.mk
index 9db587d..0aad84c 100644
--- a/core/java_library.mk
+++ b/core/java_library.mk
@@ -53,12 +53,7 @@
 ifeq (true,$(EMMA_INSTRUMENT))
 ifeq (true,$(LOCAL_EMMA_INSTRUMENT))
 ifeq (true,$(EMMA_INSTRUMENT_STATIC))
-ifdef LOCAL_JACK_ENABLED
-# Jack supports coverage with Jacoco
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
-else
-LOCAL_STATIC_JAVA_LIBRARIES += emma
-endif # LOCAL_JACK_ENABLED
 endif # LOCAL_EMMA_INSTRUMENT
 endif # EMMA_INSTRUMENT_STATIC
 else
diff --git a/core/main.mk b/core/main.mk
index b30a70b..0aab4f4 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -323,7 +323,7 @@
 
 # Sets the location that the runtime dumps stack traces to when signalled
 # with SIGQUIT. Stack trace dumping is turned on for all android builds.
-ADDITIONAL_BUILD_PROPERTIES += dalvik.vm.stack-trace-file=/data/anr/traces.txt
+ADDITIONAL_BUILD_PROPERTIES += dalvik.vm.stack-trace-dir=/data/anr
 
 # ------------------------------------------------------------
 # Define a function that, given a list of module tags, returns
@@ -709,8 +709,7 @@
 endef
 
 # TODO: Verify all branches/configs have reasonable warnings/errors, and remove
-# these overrides
-link-type-missing = $(eval $$(1).MISSING := true)
+# this override
 verify-link-type = $(eval $$(1).MISSING := true)
 
 $(foreach lt,$(ALL_LINK_TYPES),\
@@ -1024,9 +1023,13 @@
   $(call dist-for-goals,apps_only, $(apps_only_dist_built_files))
 
   ifeq ($(EMMA_INSTRUMENT),true)
-    $(EMMA_META_ZIP) : $(apps_only_installed_files)
-
-    $(call dist-for-goals,apps_only, $(EMMA_META_ZIP))
+    ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+      $(JACOCO_REPORT_CLASSES_ALL) : $(apps_only_installed_files)
+      $(call dist-for-goals,apps_only, $(JACOCO_REPORT_CLASSES_ALL))
+    else
+      $(EMMA_META_ZIP) : $(apps_only_installed_files)
+      $(call dist-for-goals,apps_only, $(EMMA_META_ZIP))
+    endif
   endif
 
   $(PROGUARD_DICT_ZIP) : $(apps_only_installed_files)
@@ -1083,9 +1086,13 @@
   endif
 
   ifeq ($(EMMA_INSTRUMENT),true)
-    $(EMMA_META_ZIP) : $(INSTALLED_SYSTEMIMAGE)
-
-    $(call dist-for-goals, dist_files, $(EMMA_META_ZIP))
+    ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+      $(JACOCO_REPORT_CLASSES_ALL) : $(INSTALLED_SYSTEMIMAGE)
+      $(call dist-for-goals, dist_files, $(JACOCO_REPORT_CLASSES_ALL))
+    else
+      $(EMMA_META_ZIP) : $(INSTALLED_SYSTEMIMAGE)
+      $(call dist-for-goals, dist_files, $(EMMA_META_ZIP))
+    endif
   endif
 
 # Building a full system-- the default is to build droidcore
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 9dff862..74dd15e 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -245,7 +245,7 @@
 
 ifeq (true,$(EMMA_INSTRUMENT))
 ifndef LOCAL_EMMA_INSTRUMENT
-# No emma for test apks.
+# No jacoco for test apks.
 ifeq (,$(LOCAL_INSTRUMENTATION_FOR))
 LOCAL_EMMA_INSTRUMENT := true
 endif # No test apk
@@ -256,21 +256,14 @@
 
 ifeq (true,$(LOCAL_EMMA_INSTRUMENT))
 ifeq (true,$(EMMA_INSTRUMENT_STATIC))
-ifdef LOCAL_JACK_ENABLED
-# Jack supports coverage with Jacoco
 ifneq ($(LOCAL_SRC_FILES)$(LOCAL_STATIC_JAVA_LIBRARIES)$(LOCAL_SOURCE_FILES_ALL_GENERATED),)
 # Only add jacocoagent if the package contains some java code
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
 endif # Contains java code
 else
-LOCAL_STATIC_JAVA_LIBRARIES += emma
-endif # LOCAL_JACK_ENABLED
-else
 ifdef LOCAL_SDK_VERSION
 ifdef TARGET_BUILD_APPS
 # In unbundled build, merge the coverage library into the apk.
-ifdef LOCAL_JACK_ENABLED
-# Jack supports coverage with Jacoco
 ifneq ($(LOCAL_SRC_FILES)$(LOCAL_STATIC_JAVA_LIBRARIES)$(LOCAL_SOURCE_FILES_ALL_GENERATED),)
 # Only add jacocoagent if the package contains some java code
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
@@ -278,9 +271,6 @@
 LOCAL_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
 LOCAL_JACK_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
 endif # Contains java code
-else  # ! LOCAL_JACK_ENABLED
-LOCAL_STATIC_JAVA_LIBRARIES += emma
-endif # ! LOCAL_JACK_ENABLED
 else  # ! TARGET_BUILD_APPS
 ifdef LOCAL_JACK_ENABLED
 # If build against the SDK in full build, core.jar is not used
@@ -291,11 +281,6 @@
 # Note: we have nothing to do for proguard since jacoco will be
 # on the classpath only, thus not modified during the compilation.
 LOCAL_JAVA_LIBRARIES += jacocoagent
-else  # ! LOCAL_JACK_ENABLED
-# If build against the SDK in full build, core.jar is not used,
-# we have to use prebiult emma.jar to make Proguard happy;
-# Otherwise emma classes are included in core.jar.
-LOCAL_PROGUARD_FLAGS += -libraryjars $(EMMA_JAR)
 endif # ! LOCAL_JACK_ENABLED
 endif # ! TARGET_BUILD_APPS
 endif # LOCAL_SDK_VERSION
diff --git a/core/pathmap.mk b/core/pathmap.mk
index 728a309..af33f5d 100644
--- a/core/pathmap.mk
+++ b/core/pathmap.mk
@@ -62,12 +62,6 @@
 endef
 
 #
-# Many modules expect to be able to say "#include <jni.h>",
-# so make it easy for them to find the correct path.
-#
-JNI_H_INCLUDE := libnativehelper/include/nativehelper
-
-#
 # A list of all source roots under frameworks/base, which will be
 # built into the android.jar.
 #
diff --git a/core/product.mk b/core/product.mk
index 8551737..6722526 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -125,6 +125,8 @@
     PRODUCT_DEX_PREOPT_DEFAULT_FLAGS \
     PRODUCT_DEX_PREOPT_BOOT_FLAGS \
     PRODUCT_DEX_PREOPT_PROFILE_DIR \
+    PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION \
+    PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE \
     PRODUCT_SYSTEM_SERVER_COMPILER_FILTER \
     PRODUCT_SANITIZER_MODULE_CONFIGS \
     PRODUCT_SYSTEM_BASE_FS_PATH \
@@ -133,9 +135,12 @@
     VENDOR_PRODUCT_RESTRICT_VENDOR_FILES \
     VENDOR_EXCEPTION_MODULES \
     VENDOR_EXCEPTION_PATHS \
+    PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD \
     PRODUCT_ART_USE_READ_BARRIER \
     PRODUCT_IOT \
     PRODUCT_SYSTEM_HEADROOM \
+    PRODUCT_MINIMIZE_JAVA_DEBUG_INFO \
+    PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS \
 
 
 
diff --git a/core/product_config.mk b/core/product_config.mk
index 0676af1..6812b05 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -383,6 +383,12 @@
 PRODUCT_DEX_PREOPT_PROFILE_DIR := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_PROFILE_DIR))
 
+# Boot image options.
+PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE))
+PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION))
+
 PRODUCT_SYSTEM_SERVER_COMPILER_FILTER := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_COMPILER_FILTER))
 PRODUCT_SYSTEM_SERVER_DEBUG_INFO := \
@@ -416,6 +422,10 @@
     $(eval SANITIZER.$(TARGET_PRODUCT).$(m).CONFIG := $(cf))))
 _psmc_modules :=
 
+# Whether the product wants to ship libartd. For rules and meaning, see art/Android.mk.
+PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD))
+
 # Make this art variable visible to soong_config.mk.
 PRODUCT_ART_USE_READ_BARRIER := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ART_USE_READ_BARRIER))
@@ -431,3 +441,11 @@
 # Add reserved headroom to a system image.
 PRODUCT_SYSTEM_HEADROOM := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_HEADROOM))
+
+# Whether to save disk space by minimizing java debug info
+PRODUCT_MINIMIZE_JAVA_DEBUG_INFO := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MINIMIZE_JAVA_DEBUG_INFO))
+
+# Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
+PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
diff --git a/core/soong_config.mk b/core/soong_config.mk
index e21083d..cdd2896 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -41,6 +41,7 @@
 	echo '    "Allow_missing_dependencies": $(if $(ALLOW_MISSING_DEPENDENCIES),true,false),'; \
 	echo '    "SanitizeHost": $(call json_list,$(SANITIZE_HOST)),'; \
 	echo '    "SanitizeDevice": $(call json_list,$(SANITIZE_TARGET)),'; \
+	echo '    "SanitizeDeviceDiag": $(call json_list,$(SANITIZE_TARGET_DIAG)),'; \
 	echo '    "SanitizeDeviceArch": $(call json_list,$(SANITIZE_TARGET_ARCH)),'; \
 	echo '    "HostStaticBinaries": $(if $(strip $(BUILD_HOST_static)),true,false),'; \
 	echo '    "Binder32bit": $(if $(BINDER32BIT),true,false),'; \
@@ -78,6 +79,7 @@
 	echo '    "CrossHostSecondaryArch": "$(HOST_CROSS_2ND_ARCH)",'; \
 	echo '    "Safestack": $(if $(filter true,$(USE_SAFESTACK)),true,false),'; \
 	echo '    "EnableCFI": $(if $(filter false,$(ENABLE_CFI)),false,true),'; \
+	echo '    "IntegerOverflowExcludePaths": $(call json_list,$(INTEGER_OVERFLOW_EXCLUDE_PATHS) $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)),'; \
 	echo '    "Device_uses_hwc2": $(if $(filter true,$(TARGET_USES_HWC2)),true,false),'; \
 	echo '    "Override_rs_driver": "$(OVERRIDE_RS_DRIVER)",'; \
 	echo '    "Treble": $(if $(filter true,$(PRODUCT_FULL_TREBLE)),true,false),'; \
@@ -85,7 +87,9 @@
 	echo ''; \
 	echo '    "ArtUseReadBarrier": $(if $(filter false,$(PRODUCT_ART_USE_READ_BARRIER)),false,true),'; \
 	echo ''; \
-	echo '    "BtConfigIncludeDir": "$(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR)"'; \
+	echo '    "BtConfigIncludeDir": "$(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR)",'; \
+	echo ''; \
+	echo '    "DeviceKernelHeaders": $(call json_list,$(strip $(TARGET_PROJECT_SYSTEM_INCLUDES)))'; \
 	echo '}') > $(SOONG_VARIABLES_TMP); \
 	if ! cmp -s $(SOONG_VARIABLES_TMP) $(SOONG_VARIABLES); then \
 	  mv $(SOONG_VARIABLES_TMP) $(SOONG_VARIABLES); \
diff --git a/core/tasks/build_custom_images.mk b/core/tasks/build_custom_images.mk
index 0750217..c9b07da 100644
--- a/core/tasks/build_custom_images.mk
+++ b/core/tasks/build_custom_images.mk
@@ -36,6 +36,8 @@
 #     image. <dest> is relativ to the root of the image.
 #   - CUSTOM_IMAGE_SELINUX, set to "true" if the image supports selinux.
 #   - CUSTOM_IMAGE_SUPPORT_VERITY, set to "true" if the product supports verity.
+#   - CUSTOM_IMAGE_SUPPORT_VERITY_FEC, set to "true" if the product supports
+#     verity FEC (forward error correction).
 #   - CUSTOM_IMAGE_VERITY_BLOCK_DEVICE
 #   - CUSTOM_IMAGE_AVB_HASH_ENABLE, set to "true" to add AVB HASH footer.
 #   - CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS, additional args of AVB HASH footer.
@@ -61,6 +63,7 @@
   CUSTOM_IMAGE_COPY_FILES \
   CUSTOM_IMAGE_SELINUX \
   CUSTOM_IMAGE_SUPPORT_VERITY \
+  CUSTOM_IMAGE_SUPPORT_VERITY_FEC \
   CUSTOM_IMAGE_VERITY_BLOCK_DEVICE \
   CUSTOM_IMAGE_AVB_HASH_ENABLE \
   CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS \
diff --git a/core/tasks/tools/build_custom_image.mk b/core/tasks/tools/build_custom_image.mk
index 702d8b3..719279c 100644
--- a/core/tasks/tools/build_custom_image.mk
+++ b/core/tasks/tools/build_custom_image.mk
@@ -79,6 +79,7 @@
 $(my_built_custom_image): PRIVATE_PICKUP_FILES := $(my_pickup_files)
 $(my_built_custom_image): PRIVATE_SELINUX := $(CUSTOM_IMAGE_SELINUX)
 $(my_built_custom_image): PRIVATE_SUPPORT_VERITY := $(CUSTOM_IMAGE_SUPPORT_VERITY)
+$(my_built_custom_image): PRIVATE_SUPPORT_VERITY_FEC := $(CUSTOM_IMAGE_SUPPORT_VERITY_FEC)
 $(my_built_custom_image): PRIVATE_VERITY_KEY := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY)
 $(my_built_custom_image): PRIVATE_VERITY_BLOCK_DEVICE := $(CUSTOM_IMAGE_VERITY_BLOCK_DEVICE)
 $(my_built_custom_image): PRIVATE_DICT_FILE := $(CUSTOM_IMAGE_DICT_FILE)
@@ -93,7 +94,15 @@
 else ifneq (,$(filter true, $(CUSTOM_IMAGE_AVB_HASH_ENABLE) $(CUSTOM_IMAGE_AVB_HASHTREE_ENABLE)))
   $(error Cannot set both CUSTOM_IMAGE_AVB_HASH_ENABLE and CUSTOM_IMAGE_AVB_HASHTREE_ENABLE to true)
 endif
-$(my_built_custom_image): $(INTERNAL_USERIMAGES_DEPS) $(my_built_modules) $(my_image_copy_files) \
+ifeq (true,$(CUSTOM_IMAGE_SUPPORT_VERITY_FEC))
+  $(my_built_custom_image): $(FEC)
+endif
+my_custom_image_modules_var:=BOARD_$(strip $(call to-upper,$(my_custom_image_name)))_KERNEL_MODULES
+my_custom_image_modules:=$($(my_custom_image_modules_var))
+my_custom_image_modules_dep:=$(if $(my_custom_image_modules),$(my_custom_image_modules) $(DEPMOD),)
+$(my_built_custom_image): PRIVATE_KERNEL_MODULES := $(my_custom_image_modules)
+$(my_built_custom_image): PRIVATE_IMAGE_NAME := $(my_custom_image_name)
+$(my_built_custom_image): $(INTERNAL_USERIMAGES_DEPS) $(my_built_modules) $(my_image_copy_files) $(my_custom_image_modules_dep) \
   $(CUSTOM_IMAGE_DICT_FILE)
 	@echo "Build image $@"
 	$(hide) rm -rf $(PRIVATE_INTERMEDIATES) && mkdir -p $(PRIVATE_INTERMEDIATES)
@@ -103,6 +112,8 @@
 	          $(eval pair := $(subst :,$(space),$(p)))\
 	          mkdir -p $(dir $(word 2,$(pair)));\
 	          cp -Rf $(word 1,$(pair)) $(word 2,$(pair));)
+	$(if $(PRIVATE_KERNEL_MODULES), \
+		$(call build-image-kernel-modules,$(PRIVATE_KERNEL_MODULES),$(PRIVATE_STAGING_DIR),$(PRIVATE_IMAGE_NAME)/,$(call intermediates-dir-for,PACKAGING,depmod_$(PRIVATE_IMAGE_NAME))))
 	$(if $($(PRIVATE_PICKUP_FILES)),$(hide) cp -Rf $(PRIVATE_PICKUP_FILES) $(PRIVATE_STAGING_DIR))
 	# Generate the dict.
 	$(hide) echo "# For all accepted properties, see BuildImage() in tools/releasetools/build_image.py" > $(PRIVATE_INTERMEDIATES)/image_info.txt
@@ -117,6 +128,8 @@
 	    echo "verity_key=$(PRIVATE_VERITY_KEY)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
 	    echo "verity_signer_cmd=$(VERITY_SIGNER)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
 	    echo "verity_block_device=$(PRIVATE_VERITY_BLOCK_DEVICE)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
+	$(if $(PRIVATE_SUPPORT_VERITY_FEC),\
+	  $(hide) echo "verity_fec=$(PRIVATE_SUPPORT_VERITY_FEC)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
 	$(hide) echo "avb_avbtool=$(PRIVATE_AVB_AVBTOOL)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt
 	$(hide) echo "avb_signing_args=$(PRIVATE_AVB_SIGNING_ARGS)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt
 	$(if $(PRIVATE_AVB_HASH_ENABLE),\
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 15a0eb9..49f65a9 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -182,7 +182,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2017-08-05
+      PLATFORM_SECURITY_PATCH := 2017-09-05
 endif
 
 ifndef PLATFORM_BASE_OS
diff --git a/envsetup.sh b/envsetup.sh
index 7073d82..028da35 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -258,13 +258,11 @@
     export PATH=$ANDROID_BUILD_PATHS$PATH
     export PYTHONPATH=$T/development/python-packages:$PYTHONPATH
 
-    unset ANDROID_JAVA_TOOLCHAIN
-    unset ANDROID_PRE_BUILD_PATHS
-    if [ -n "$JAVA_HOME" ]; then
-        export ANDROID_JAVA_TOOLCHAIN=$JAVA_HOME/bin
-        export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
-        export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
-    fi
+    export ANDROID_JAVA_HOME=$(get_abs_build_var ANDROID_JAVA_HOME)
+    export JAVA_HOME=$ANDROID_JAVA_HOME
+    export ANDROID_JAVA_TOOLCHAIN=$(get_abs_build_var ANDROID_JAVA_TOOLCHAIN)
+    export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
+    export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
 
     unset ANDROID_PRODUCT_OUT
     export ANDROID_PRODUCT_OUT=$(get_abs_build_var PRODUCT_OUT)
@@ -297,7 +295,6 @@
 function set_stuff_for_environment()
 {
     settitle
-    set_java_home
     setpaths
     set_sequence_number
 
@@ -753,7 +750,7 @@
     local T=$(gettop)
     local DRV=$(getdriver $T)
     if [ "$T" ]; then
-        $DRV make -C $T -f build/core/main.mk $@
+        _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@
     else
         echo "Couldn't locate the top of the tree.  Try setting TOP."
         return 1
@@ -782,9 +779,9 @@
     local T=$(gettop)
     local DRV=$(getdriver $T)
     # If we're sitting in the root of the build tree, just do a
-    # normal make.
-    if [ -f build/core/envsetup.mk -a -f Makefile ]; then
-        $DRV make $@
+    # normal build.
+    if [ -f build/soong/soong_ui.bash ]; then
+        _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@
     else
         # Find the closest Android.mk file.
         local M=$(findmakefile)
@@ -819,7 +816,7 @@
             if [ "1" = "${WITH_TIDY_ONLY}" -o "true" = "${WITH_TIDY_ONLY}" ]; then
               MODULES=tidy_only
             fi
-            ONE_SHOT_MAKEFILE=$M $DRV make -C $T -f build/core/main.mk $MODULES $ARGS
+            ONE_SHOT_MAKEFILE=$M _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $MODULES $ARGS
         fi
     fi
 }
@@ -887,7 +884,7 @@
         fi
         # Convert "/" to "-".
         MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-        ONE_SHOT_MAKEFILE="$MAKEFILE" $DRV make -C $T -f build/core/main.mk $DASH_ARGS $MODULES $MODULES_IN_PATHS $ARGS
+        ONE_SHOT_MAKEFILE="$MAKEFILE" _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $DASH_ARGS $MODULES $MODULES_IN_PATHS $ARGS
     else
         echo "Couldn't locate the top of the tree.  Try setting TOP."
         return 1
@@ -898,8 +895,8 @@
 {
   local T=$(gettop)
   local DRV=$(getdriver $T)
-  if [ -f build/core/envsetup.mk -a -f Makefile ]; then
-    $DRV make $@
+  if [ -f build/soong/soong_ui.bash ]; then
+    _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@
   else
     if [ ! "$T" ]; then
       echo "Couldn't locate the top of the tree.  Try setting TOP."
@@ -911,7 +908,7 @@
     local MODULES_IN_PATHS=MODULES-IN-$(dirname ${M})
     # Convert "/" to "-".
     MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-    $DRV make -C $T -f build/core/main.mk $@ $MODULES_IN_PATHS
+    _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@ $MODULES_IN_PATHS
   fi
 }
 
@@ -949,7 +946,7 @@
     done
     # Convert "/" to "-".
     MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-    $DRV make -C $T -f build/core/main.mk $DASH_ARGS $ARGS $MODULES_IN_PATHS
+    _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $DASH_ARGS $ARGS $MODULES_IN_PATHS
   else
     echo "Couldn't locate the top of the tree.  Try setting TOP."
     return 1
@@ -1540,46 +1537,6 @@
     \cd $T/$pathname
 }
 
-# Force JAVA_HOME to point to java 1.7/1.8 if it isn't already set.
-function set_java_home() {
-    # Clear the existing JAVA_HOME value if we set it ourselves, so that
-    # we can reset it later, depending on the version of java the build
-    # system needs.
-    #
-    # If we don't do this, the JAVA_HOME value set by the first call to
-    # build/envsetup.sh will persist forever.
-    if [ -n "$ANDROID_SET_JAVA_HOME" ]; then
-      export JAVA_HOME=""
-    fi
-
-    if [ ! "$JAVA_HOME" ]; then
-      if [ -n "$LEGACY_USE_JAVA7" ]; then
-        echo Warning: Support for JDK 7 will be dropped. Switch to JDK 8.
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.7)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64
-                ;;
-        esac
-      else
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
-                ;;
-        esac
-      fi
-
-      # Keep track of the fact that we set JAVA_HOME ourselves, so that
-      # we can change it on the next envsetup.sh, if required.
-      export ANDROID_SET_JAVA_HOME=true
-    fi
-}
-
 # Print colored exit condition
 function pez {
     "$@"
@@ -1595,13 +1552,18 @@
 
 function get_make_command()
 {
-  echo command make
+    # If we're in the top of an Android tree, use soong_ui.bash instead of make
+    if [ -f build/soong/soong_ui.bash ]; then
+        echo build/soong/soong_ui.bash --make-mode
+    else
+        echo command make
+    fi
 }
 
-function make()
+function _wrap_build()
 {
     local start_time=$(date +"%s")
-    $(get_make_command) "$@"
+    "$@"
     local ret=$?
     local end_time=$(date +"%s")
     local tdiff=$(($end_time-$start_time))
@@ -1620,9 +1582,9 @@
     fi
     echo
     if [ $ret -eq 0 ] ; then
-        echo -n "${color_success}#### make completed successfully "
+        echo -n "${color_success}#### build completed successfully "
     else
-        echo -n "${color_failed}#### make failed to build some targets "
+        echo -n "${color_failed}#### failed to build some targets "
     fi
     if [ $hours -gt 0 ] ; then
         printf "(%02g:%02g:%02g (hh:mm:ss))" $hours $mins $secs
@@ -1636,6 +1598,11 @@
     return $ret
 }
 
+function make()
+{
+    _wrap_build $(get_make_command) "$@"
+}
+
 function provision()
 {
     if [ ! "$ANDROID_PRODUCT_OUT" ]; then
diff --git a/target/board/Android.mk b/target/board/Android.mk
index e23ab21..331367f 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -83,7 +83,7 @@
 ifeq ($(PRODUCT_FULL_TREBLE),true)
 ifdef BUILT_VENDOR_MATRIX
 $(GEN): $(BUILT_VENDOR_MATRIX)
-$(GEN): PRIVATE_FLAGS := -c "$(BUILT_VENDOR_MATRIX)"
+$(GEN): PRIVATE_FLAGS += -c "$(BUILT_VENDOR_MATRIX)"
 endif
 endif
 
@@ -110,7 +110,7 @@
 ifeq ($(PRODUCT_FULL_TREBLE),true)
 ifdef BUILT_VENDOR_MANIFEST
 $(GEN): $(BUILT_VENDOR_MANIFEST)
-$(GEN): PRIVATE_FLAGS := -c "$(BUILT_VENDOR_MANIFEST)"
+$(GEN): PRIVATE_FLAGS += -c "$(BUILT_VENDOR_MANIFEST)"
 endif
 endif
 
@@ -130,6 +130,14 @@
 FRAMEWORK_VBMETA_VERSION := 0.0
 endif
 
+# All kernel versions that the system image works with.
+$(GEN): test/vts-testcase/kernel/config/data/android-3.18/android-base.cfg
+$(GEN): test/vts-testcase/kernel/config/data/android-4.4/android-base.cfg
+$(GEN): test/vts-testcase/kernel/config/data/android-4.9/android-base.cfg
+$(GEN): PRIVATE_FLAGS += --kernel=3.18:test/vts-testcase/kernel/config/data/android-3.18/android-base.cfg
+$(GEN): PRIVATE_FLAGS += --kernel=4.4:test/vts-testcase/kernel/config/data/android-4.4/android-base.cfg
+$(GEN): PRIVATE_FLAGS += --kernel=4.9:test/vts-testcase/kernel/config/data/android-4.9/android-base.cfg
+
 $(GEN): $(FRAMEWORK_COMPATIBILITY_MATRIX_FILE) $(HOST_OUT_EXECUTABLES)/assemble_vintf
 	# TODO(b/37405869) (b/37715375) inject avb versions as well for devices that have avb enabled.
 	POLICYVERS=$(POLICYVERS) \
diff --git a/target/board/generic/sepolicy/file_contexts b/target/board/generic/sepolicy/file_contexts
index e9502d9..d1a1e8c 100644
--- a/target/board/generic/sepolicy/file_contexts
+++ b/target/board/generic/sepolicy/file_contexts
@@ -17,4 +17,6 @@
 /system/bin/qemud            u:object_r:qemud_exec:s0
 /sys/qemu_trace(/.*)?        u:object_r:sysfs_writable:s0
 /system/etc/init.goldfish.sh u:object_r:goldfish_setup_exec:s0
+/system/vendor/bin/init.ranchu-core.sh u:object_r:goldfish_setup_exec:s0
+/system/vendor/bin/init.ranchu-net.sh u:object_r:goldfish_setup_exec:s0
 /system/bin/qemu-props       u:object_r:qemu_props_exec:s0
diff --git a/target/board/generic/sepolicy/hal_gnss_default.te b/target/board/generic/sepolicy/hal_gnss_default.te
new file mode 100644
index 0000000..0dd3d03
--- /dev/null
+++ b/target/board/generic/sepolicy/hal_gnss_default.te
@@ -0,0 +1,3 @@
+#============= hal_gnss_default ==============
+allow hal_gnss_default vndbinder_device:chr_file { ioctl open read write };
+
diff --git a/target/board/generic/sepolicy/hal_graphics_composer_default.te b/target/board/generic/sepolicy/hal_graphics_composer_default.te
new file mode 100644
index 0000000..034bdef
--- /dev/null
+++ b/target/board/generic/sepolicy/hal_graphics_composer_default.te
@@ -0,0 +1,3 @@
+#============= hal_graphics_composer_default ==============
+allow hal_graphics_composer_default vndbinder_device:chr_file { ioctl open read write };
+
diff --git a/target/board/generic/system.prop b/target/board/generic/system.prop
index f2424c9..5b2e7bf 100644
--- a/target/board/generic/system.prop
+++ b/target/board/generic/system.prop
@@ -2,5 +2,5 @@
 # system.prop for generic sdk 
 #
 
-rild.libpath=/system/lib/libreference-ril.so
+rild.libpath=/vendor/lib/libreference-ril.so
 rild.libargs=-d /dev/ttyS0
diff --git a/target/board/generic_arm64/system.prop b/target/board/generic_arm64/system.prop
index 24578a9..32c5129 100644
--- a/target/board/generic_arm64/system.prop
+++ b/target/board/generic_arm64/system.prop
@@ -2,5 +2,5 @@
 # system.prop for generic arm64 sdk
 #
 
-rild.libpath=/system/lib64/libreference-ril.so
+rild.libpath=/vendor/lib64/libreference-ril.so
 rild.libargs=-d /dev/ttyS0
diff --git a/target/board/generic_arm64_a/BoardConfig.mk b/target/board/generic_arm64_a/BoardConfig.mk
index 2e3ef78..e92f84d 100644
--- a/target/board/generic_arm64_a/BoardConfig.mk
+++ b/target/board/generic_arm64_a/BoardConfig.mk
@@ -44,7 +44,6 @@
 endif
 
 # Generic AOSP image always requires separate vendor.img
-BOARD_USES_VENDORIMAGE := true
 TARGET_COPY_OUT_VENDOR := vendor
 
 # Generic AOSP image does NOT support HWC1
@@ -71,4 +70,3 @@
 BOARD_FLASH_BLOCK_SIZE := 512
 
 BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true
-
diff --git a/target/board/generic_arm64_ab/BoardConfig.mk b/target/board/generic_arm64_ab/BoardConfig.mk
index b749eb0..83e44a5 100644
--- a/target/board/generic_arm64_ab/BoardConfig.mk
+++ b/target/board/generic_arm64_ab/BoardConfig.mk
@@ -44,7 +44,6 @@
 endif
 
 # Generic AOSP image always requires separate vendor.img
-BOARD_USES_VENDORIMAGE := true
 TARGET_COPY_OUT_VENDOR := vendor
 
 # Generic AOSP image does NOT support HWC1
diff --git a/target/board/generic_arm_a/BoardConfig.mk b/target/board/generic_arm_a/BoardConfig.mk
index 9da72a3..0391248 100644
--- a/target/board/generic_arm_a/BoardConfig.mk
+++ b/target/board/generic_arm_a/BoardConfig.mk
@@ -44,7 +44,6 @@
 endif
 
 # Generic AOSP image always requires separate vendor.img
-BOARD_USES_VENDORIMAGE := true
 TARGET_COPY_OUT_VENDOR := vendor
 
 # Generic AOSP image does NOT support HWC1
@@ -63,4 +62,3 @@
 BOARD_FLASH_BLOCK_SIZE := 512
 
 BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true
-
diff --git a/target/board/generic_mips/system.prop b/target/board/generic_mips/system.prop
index 137a0f9..973db2c 100644
--- a/target/board/generic_mips/system.prop
+++ b/target/board/generic_mips/system.prop
@@ -2,5 +2,5 @@
 # system.prop for generic sdk
 #
 
-rild.libpath=/system/lib/libreference-ril.so
+rild.libpath=/vendor/lib/libreference-ril.so
 rild.libargs=-d /dev/ttyS0
diff --git a/target/board/generic_mips64/system.prop b/target/board/generic_mips64/system.prop
index aa03eae..4da69c0 100644
--- a/target/board/generic_mips64/system.prop
+++ b/target/board/generic_mips64/system.prop
@@ -2,5 +2,5 @@
 # system.prop for generic mips64 sdk
 #
 
-rild.libpath=/system/lib64/libreference-ril.so
+rild.libpath=/vendor/lib64/libreference-ril.so
 rild.libargs=-d /dev/ttyS0
diff --git a/target/board/generic_x86/system.prop b/target/board/generic_x86/system.prop
index 137a0f9..973db2c 100644
--- a/target/board/generic_x86/system.prop
+++ b/target/board/generic_x86/system.prop
@@ -2,5 +2,5 @@
 # system.prop for generic sdk
 #
 
-rild.libpath=/system/lib/libreference-ril.so
+rild.libpath=/vendor/lib/libreference-ril.so
 rild.libargs=-d /dev/ttyS0
diff --git a/target/board/generic_x86_64/system.prop b/target/board/generic_x86_64/system.prop
index 43d4a88..5e546c4 100644
--- a/target/board/generic_x86_64/system.prop
+++ b/target/board/generic_x86_64/system.prop
@@ -2,5 +2,5 @@
 # system.prop for generic sdk
 #
 
-rild.libpath=/system/lib64/libreference-ril.so
+rild.libpath=/vendor/lib64/libreference-ril.so
 rild.libargs=-d /dev/ttyS0
diff --git a/target/board/treble_system.prop b/target/board/treble_system.prop
index e69de29..bedf10c 100644
--- a/target/board/treble_system.prop
+++ b/target/board/treble_system.prop
@@ -0,0 +1,2 @@
+# GSI always generate dex pre-opt in system image
+ro.cp_system_other_odex=0
diff --git a/target/product/core_base.mk b/target/product/core_base.mk
index e0a20b8..151e8de 100644
--- a/target/product/core_base.mk
+++ b/target/product/core_base.mk
@@ -43,6 +43,7 @@
     libstagefright_soft_amrwbenc \
     libstagefright_soft_avcdec \
     libstagefright_soft_avcenc \
+    libstagefright_soft_flacdec \
     libstagefright_soft_flacenc \
     libstagefright_soft_g711dec \
     libstagefright_soft_gsmdec \
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 9fc792c..e9fbbb1 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -149,5 +149,11 @@
 PRODUCT_COPY_FILES += $(call add-to-product-copy-files-if-exists,\
     frameworks/base/compiled-classes-phone:system/etc/compiled-classes)
 
+# On userdebug builds, collect more tombstones by default.
+ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
+PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    tombstoned.max_tombstone_count=50
+endif
+
 $(call inherit-product, $(SRC_TARGET_DIR)/product/runtime_libart.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base.mk)
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index 04aae58..5a5fb8e 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -56,8 +56,14 @@
     android.hardware.biometrics.fingerprint@2.1-service \
     sensors.ranchu \
     android.hardware.graphics.composer@2.1-impl \
-	hwcomposer.goldfish \
-	hwcomposer.ranchu \
+    android.hardware.graphics.composer@2.1-service \
+    android.hardware.graphics.allocator@2.0-service \
+    android.hardware.graphics.allocator@2.0-impl \
+    android.hardware.graphics.mapper@2.0-impl \
+    hwcomposer.goldfish \
+    hwcomposer.ranchu \
+    vintf \
+    CarrierConfig
 
 PRODUCT_PACKAGES += \
     android.hardware.audio@2.0-impl \
@@ -89,10 +95,14 @@
     device/generic/goldfish/fstab.goldfish:root/fstab.goldfish \
     device/generic/goldfish/init.goldfish.rc:root/init.goldfish.rc \
     device/generic/goldfish/init.goldfish.sh:system/etc/init.goldfish.sh \
+    device/generic/goldfish/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
+    device/generic/goldfish/init.ranchu-net.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-net.sh \
+    device/generic/goldfish/init.ranchu.rc:root/init.ranchu.rc \
     device/generic/goldfish/ueventd.goldfish.rc:root/ueventd.goldfish.rc \
     device/generic/goldfish/init.ranchu.rc:root/init.ranchu.rc \
     device/generic/goldfish/fstab.ranchu:root/fstab.ranchu \
     device/generic/goldfish/ueventd.ranchu.rc:root/ueventd.ranchu.rc \
+    device/generic/goldfish/manifest.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
     device/generic/goldfish/input/goldfish_rotary.idc:system/usr/idc/goldfish_rotary.idc \
     frameworks/native/data/etc/android.hardware.usb.accessory.xml:system/etc/permissions/android.hardware.usb.accessory.xml
 
diff --git a/target/product/generic_no_telephony.mk b/target/product/generic_no_telephony.mk
index c83dace..190a889 100644
--- a/target/product/generic_no_telephony.mk
+++ b/target/product/generic_no_telephony.mk
@@ -29,7 +29,6 @@
     Provision \
     SystemUI \
     SysuiDarkThemeOverlay \
-    SysuiLightWallpaperThemeOverlay \
     EasterEgg \
     WallpaperCropper
 
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index 24eeff9..ed68c78 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -82,4 +82,5 @@
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
     pm.dexopt.install=quicken \
     pm.dexopt.bg-dexopt=speed-profile \
-    pm.dexopt.ab-ota=speed-profile
+    pm.dexopt.ab-ota=speed-profile \
+    pm.dexopt.inactive=verify
diff --git a/target/product/sdk_base.mk b/target/product/sdk_base.mk
index 25056c2..0b14203 100644
--- a/target/product/sdk_base.mk
+++ b/target/product/sdk_base.mk
@@ -47,7 +47,6 @@
 	sqlite3 \
 	SystemUI \
 	SysuiDarkThemeOverlay \
-	SysuiLightWallpaperThemeOverlay \
 	EasterEgg \
 	WallpaperPicker \
 	WidgetPreview
diff --git a/target/product/treble_common.mk b/target/product/treble_common.mk
index a4bcad6..52e2441 100644
--- a/target/product/treble_common.mk
+++ b/target/product/treble_common.mk
@@ -83,6 +83,7 @@
     android.hardware.vr@1.0 \
     android.hardware.weaver@1.0 \
     android.hardware.wifi@1.0 \
+    android.hardware.wifi@1.1 \
     android.hardware.wifi.supplicant@1.0 \
     android.hidl.allocator@1.0 \
     android.hidl.manager@1.0 \
@@ -205,3 +206,11 @@
 #   audio.a2dp.default to support A2DP if board has the capability.
 PRODUCT_PACKAGES += \
     audio.a2dp.default
+
+# Net:
+#   Vendors can use the platform-provided network configuration utilities (ip,
+#   iptable, etc.) to configure the Linux networking stack, but these utilities
+#   do not yet include a HIDL interface wrapper. This is a solution on
+#   Android O.
+PRODUCT_PACKAGES += \
+    netutils-wrapper-1.0
diff --git a/tools/releasetools/add_img_to_target_files.py b/tools/releasetools/add_img_to_target_files.py
index 23c179f..1ce22e7 100755
--- a/tools/releasetools/add_img_to_target_files.py
+++ b/tools/releasetools/add_img_to_target_files.py
@@ -376,7 +376,27 @@
 
   args = OPTIONS.info_dict.get("avb_vbmeta_args")
   if args and args.strip():
-    cmd.extend(shlex.split(args))
+    split_args = shlex.split(args)
+    for index, arg in enumerate(split_args[:-1]):
+      # Sanity check that the image file exists. Some images might be defined
+      # as a path relative to source tree, which may not be available at the
+      # same location when running this script (we have the input target_files
+      # zip only). For such cases, we additionally scan other locations (e.g.
+      # IMAGES/, RADIO/, etc) before bailing out.
+      if arg == '--include_descriptors_from_image':
+        image_path = split_args[index + 1]
+        if os.path.exists(image_path):
+          continue
+        found = False
+        for dir in ['IMAGES', 'RADIO', 'VENDOR_IMAGES', 'PREBUILT_IMAGES']:
+          alt_path = os.path.join(
+              OPTIONS.input_tmp, dir, os.path.basename(image_path))
+          if os.path.exists(alt_path):
+            split_args[index + 1] = alt_path
+            found = True
+            break
+        assert found, 'failed to find %s' % (image_path,)
+    cmd.extend(split_args)
 
   p = common.Run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
   p.communicate()
@@ -602,12 +622,12 @@
     for line in lines:
       if line.strip() == "system" and (
           "system_verity_block_device" in OPTIONS.info_dict or
-          OPTIONS.info_dict.get("system_avb_hashtree_enable") == "true"):
+          OPTIONS.info_dict.get("avb_system_hashtree_enable") == "true"):
         assert os.path.exists(system_img_path)
         care_map_list += GetCareMap("system", system_img_path)
       if line.strip() == "vendor" and (
           "vendor_verity_block_device" in OPTIONS.info_dict or
-          OPTIONS.info_dict.get("vendor_avb_hashtree_enable") == "true"):
+          OPTIONS.info_dict.get("avb_vendor_hashtree_enable") == "true"):
         assert os.path.exists(vendor_img_path)
         care_map_list += GetCareMap("vendor", vendor_img_path)
 
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index c721a24..ce57f62 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -1515,9 +1515,34 @@
     ZipWrite(output_zip,
              '{}.transfer.list'.format(self.path),
              '{}.transfer.list'.format(self.partition))
-    ZipWrite(output_zip,
-             '{}.new.dat'.format(self.path),
-             '{}.new.dat'.format(self.partition))
+
+    # For full OTA, compress the new.dat with brotli with quality 6 to reduce its size. Quailty 9
+    # almost triples the compression time but doesn't further reduce the size too much.
+    # For a typical 1.8G system.new.dat
+    #                       zip  | brotli(quality 6)  | brotli(quality 9)
+    #   compressed_size:    942M | 869M (~8% reduced) | 854M
+    #   compression_time:   75s  | 265s               | 719s
+    #   decompression_time: 15s  | 25s                | 25s
+
+    if not self.src:
+      bro_cmd = ['bro', '--quality', '6',
+                 '--input', '{}.new.dat'.format(self.path),
+                 '--output', '{}.new.dat.br'.format(self.path)]
+      print("Compressing {}.new.dat with brotli".format(self.partition))
+      p = Run(bro_cmd, stdout=subprocess.PIPE)
+      p.communicate()
+      assert p.returncode == 0,\
+          'compression of {}.new.dat failed'.format(self.partition)
+
+      new_data_name = '{}.new.dat.br'.format(self.partition)
+      ZipWrite(output_zip,
+               '{}.new.dat.br'.format(self.path),
+               new_data_name,
+               compress_type=zipfile.ZIP_STORED)
+    else:
+      new_data_name = '{}.new.dat'.format(self.partition)
+      ZipWrite(output_zip, '{}.new.dat'.format(self.path), new_data_name)
+
     ZipWrite(output_zip,
              '{}.patch.dat'.format(self.path),
              '{}.patch.dat'.format(self.partition),
@@ -1530,9 +1555,10 @@
 
     call = ('block_image_update("{device}", '
             'package_extract_file("{partition}.transfer.list"), '
-            '"{partition}.new.dat", "{partition}.patch.dat") ||\n'
+            '"{new_data_name}", "{partition}.patch.dat") ||\n'
             '  abort("E{code}: Failed to update {partition} image.");'.format(
-                device=self.device, partition=self.partition, code=code))
+                device=self.device, partition=self.partition,
+                new_data_name=new_data_name, code=code))
     script.AppendExtra(script.WordWrap(call))
 
   def _HashBlocks(self, source, ranges): # pylint: disable=no-self-use
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index eff4ed2..58bf489 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -102,6 +102,7 @@
 import errno
 import os
 import re
+import stat
 import subprocess
 import tempfile
 import zipfile