Update Security String to 2017-11-01 on oc-dev bug:65631379 am: 8f4a4c2131
am: 8e3eac06fb

Change-Id: Icd9ef222b91081a89b386d124eeed39d0caa6df8
diff --git a/Android.mk b/Android.mk
index a1455d4..5053e7d 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,8 +1 @@
-LOCAL_PATH := $(call my-dir)
-
-# We're relocating the build project to a subdirectory, then using symlinks
-# to expose the subdirectories where they used to be. If the manifest hasn't
-# been updated, we need to include all the subdirectories.
-ifeq ($(LOCAL_PATH),build)
-include $(call first-makefiles-under,$(LOCAL_PATH))
-endif
+include $(call all-subdir-makefiles)
diff --git a/CleanSpec.mk b/CleanSpec.mk
index b955e25..63d6f66 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -420,6 +420,18 @@
 # Version checking moving to Soong
 $(call add-clean-step, rm -rf $(OUT_DIR)/versions_checked.mk)
 
+# Vendor tests were being installed into /vendor/bin accidentally
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/vendor/nativetest*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/nativetest*)
+
+# Jack is no longer the default compiler, remove the intermediates
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/*/*/classes*.jack)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/*/*/jack*)
+
+# Move adbd from $(PRODUCT_OUT)/root/sbin to $(PRODUCT_OUT)/system/bin
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/sbin/adbd)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/symbols/sbin/adbd)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/OWNERS b/OWNERS
new file mode 100644
index 0000000..89b446a
--- /dev/null
+++ b/OWNERS
@@ -0,0 +1,2 @@
+ccross@android.com
+dwillemsen@google.com
diff --git a/README.txt b/README.txt
new file mode 100644
index 0000000..004210b
--- /dev/null
+++ b/README.txt
@@ -0,0 +1,85 @@
+Android build system usage:
+
+m [-j] [<targets>] [<variable>=<value>...]
+
+
+Ways to specify what to build:
+  The common way to specify what to build is to set that information in the
+  environment via:
+
+    # Set up the shell environment.
+    source build/envsetup.sh # Run "hmm" after sourcing for more info
+    # Select the device and variant to target. If no argument is given, it
+    # will list choices and prompt.
+    lunch [<product>-<variant>] # Selects the device and variant to target.
+    # Invoke the configured build.
+    m [<options>] [<targets>] [<variable>=<value>...]
+
+      <product> is the device that the created image is intended to be run on.
+        This is saved in the shell environment as $TARGET_PRODUCT by `lunch`.
+      <variant> is one of "user", "userdebug", or "eng", and controls the
+        amount of debugging to be added into the generated image.
+        This gets saved in the shell environment as $TARGET_BUILD_VARIANT by
+          `lunch`.
+
+    Each of <options>, <targets>, and <variable>=<value> is optional.
+      If no targets are specified, the build system will build the images
+      for the configured product and variant.
+
+  An alternative to setting $TARGET_PRODUCT and $TARGET_BUILD_VARIANT,
+  which you may see in build servers, is to execute:
+
+    make PRODUCT-<product>-<variant>
+
+
+  A target may be a file path. For example, out/host/linux-x86/bin/adb .
+    Note that when giving a relative file path as a target, that path is
+    interpreted relative to the root of the source tree (rather than relative
+    to the current working directory).
+
+  A target may also be any other target defined within a Makefile. Run
+    `m help` to view the names of some common targets.
+
+  To view the modules and targets defined in a particular directory, look for:
+    files named *.mk (most commonly Android.mk)
+      these files are defined in Make syntax
+    files named Android.bp
+      these files are defined in Blueprint syntax
+
+  For now, the full (extremely large) compiled list of targets can be found
+    (after running the build once), split among these two files:
+
+    ${OUT}/build-<product>*.ninja
+    ${OUT}/soong/build.ninja
+
+    If you find yourself interacting with these files, you are encouraged to
+    provide a more convenient tool for browsing targets, and to mention the
+    tool here.
+
+Targets that adjust an existing build:
+  showcommands              Display the individual commands run to implement
+                            the build
+  dist                      Copy into ${DIST_DIR} the portion of the build
+                            that must be distributed
+
+Flags
+  -j <N>                    Run <N> processes at once
+  -j                        Autodetect the number of processes to run at once,
+                            and run that many
+
+Variables
+  Variables can either be set in the surrounding shell environment or can be
+    passed as command-line arguments. For example:
+      export I_AM_A_SHELL_VAR=1
+      I_AM_ANOTHER_SHELL_VAR=2 make droid I_AM_A_MAKE_VAR=3
+  Here are some common variables and their meanings:
+    TARGET_PRODUCT          The <product> to build # as described above
+    TARGET_BUILD_VARIANT    The <variant> to build # as described above
+    DIST_DIR                The directory in which to place the distribution
+                            artifacts.
+    OUT_DIR                 The directory in which to place non-distribution
+                            artifacts.
+
+  There is not yet known a convenient method by which to discover the full
+  list of supported variables. Please mention it here when there is.
+
diff --git a/core/Makefile b/core/Makefile
index 317e6e8..fdbe45c 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -240,7 +240,7 @@
 # if it isn't already a part of the flavor (via a dedicated lunch
 # config for example).
 TARGET_BUILD_FLAVOR := $(TARGET_PRODUCT)-$(TARGET_BUILD_VARIANT)
-ifdef SANITIZE_TARGET
+ifneq (, $(filter address, $(SANITIZE_TARGET)))
 ifeq (,$(findstring _asan,$(TARGET_BUILD_FLAVOR)))
 TARGET_BUILD_FLAVOR := $(TARGET_BUILD_FLAVOR)_asan
 endif
@@ -932,6 +932,10 @@
 endif
 endif
 
+ifeq ($(BOARD_AVB_ENABLE),true)
+INTERNAL_USERIMAGES_DEPS += $(AVBTOOL)
+endif
+
 ifneq (true,$(TARGET_USERIMAGES_SPARSE_SQUASHFS_DISABLED))
   INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG := -s
 endif
@@ -1029,6 +1033,23 @@
 $(if $(2),$(hide) $(foreach kv,$(2),echo "$(kv)" >> $(1);))
 endef
 
+# $(1): modules list
+# $(2): output dir
+# $(3): mount point
+# $(4): staging dir
+# Depmod requires a well-formed kernel version so 0.0 is used as a placeholder.
+define build-image-kernel-modules
+    $(hide) rm -rf $(2)/lib/modules
+    $(hide) mkdir -p $(2)/lib/modules
+    $(hide) cp $(1) $(2)/lib/modules/
+    $(hide) rm -rf $(4)
+    $(hide) mkdir -p $(4)/lib/modules/0.0/$(3)lib/modules
+    $(hide) cp $(1) $(4)/lib/modules/0.0/$(3)lib/modules
+    $(hide) $(DEPMOD) -b $(4) 0.0
+    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' $(4)/lib/modules/0.0/modules.dep > $(2)/lib/modules/modules.dep
+    $(hide) cp $(4)/lib/modules/0.0/modules.alias $(2)/lib/modules
+endef
+
 # -----------------------------------------------------------------
 # Recovery image
 
@@ -1159,27 +1180,10 @@
 	@echo "DumpPublicKey: $@ <= $(PRIVATE_OTA_PUBLIC_KEYS) $(extra_keys)"
 	@rm -rf $@
 	@mkdir -p $(dir $@)
-	java -jar $(DUMPKEY_JAR) $(PRIVATE_OTA_PUBLIC_KEYS) $(extra_keys) > $@
+	$(JAVA) -jar $(DUMPKEY_JAR) $(PRIVATE_OTA_PUBLIC_KEYS) $(extra_keys) > $@
 
 RECOVERYIMAGE_ID_FILE := $(PRODUCT_OUT)/recovery.id
 
-# $(1): modules list
-# $(2): output dir
-# $(3): mount point
-# $(4): staging dir
-# Depmod requires a well-formed kernel version so 0.0 is used as a placeholder.
-define build-image-kernel-modules
-    $(hide) rm -rf $(2)/lib/modules
-    $(hide) mkdir -p $(2)/lib/modules
-    $(hide) cp $(1) $(2)/lib/modules/
-    $(hide) rm -rf $(4)
-    $(hide) mkdir -p $(4)/lib/modules/0.0/$(3)lib/modules
-    $(hide) cp $(1) $(4)/lib/modules/0.0/$(3)lib/modules
-    $(hide) $(DEPMOD) -b $(4) 0.0
-    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' $(4)/lib/modules/0.0/modules.dep > $(2)/lib/modules/modules.dep
-    $(hide) cp $(4)/lib/modules/0.0/modules.alias $(2)/lib/modules
-endef
-
 # $(1): output file
 define build-recoveryimage-target
   @echo ----- Making recovery image ------
@@ -1188,6 +1192,8 @@
   @echo Copying baseline ramdisk...
   # Use rsync because "cp -Rf" fails to overwrite broken symlinks on Mac.
   $(hide) rsync -a --exclude=etc --exclude=sdcard $(IGNORE_RECOVERY_SEPOLICY) $(IGNORE_CACHE_LINK) $(TARGET_ROOT_OUT) $(TARGET_RECOVERY_OUT)
+  # Copy adbd from system/bin to recovery/root/sbin
+  $(hide) cp -f $(TARGET_OUT_EXECUTABLES)/adbd $(TARGET_RECOVERY_ROOT_OUT)/sbin/adbd
   @echo Modifying ramdisk contents...
   $(if $(BOARD_RECOVERY_KERNEL_MODULES), \
     $(call build-image-kernel-modules,$(BOARD_RECOVERY_KERNEL_MODULES),$(TARGET_RECOVERY_ROOT_OUT),,$(call intermediates-dir-for,PACKAGING,depmod_recovery)))
@@ -1242,6 +1248,8 @@
   @echo ----- Made recovery image: $(1) --------
 endef
 
+ADBD := $(TARGET_OUT_EXECUTABLES)/adbd
+
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
 ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER))
 $(INSTALLED_BOOTIMAGE_TARGET) : $(BOOT_SIGNER)
@@ -1252,7 +1260,7 @@
 ifeq (true,$(BOARD_AVB_ENABLE))
 $(INSTALLED_BOOTIMAGE_TARGET) : $(AVBTOOL) $(BOARD_AVB_BOOT_KEY_PATH)
 endif
-$(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
+$(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) $(ADBD) \
 		$(INSTALLED_RAMDISK_TARGET) \
 		$(INTERNAL_RECOVERYIMAGE_FILES) \
 		$(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
@@ -1267,7 +1275,7 @@
 		$(call build-recoveryimage-target, $@)
 endif
 
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
+$(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) $(ADBD) \
 		$(INSTALLED_RAMDISK_TARGET) \
 		$(INSTALLED_BOOTIMAGE_TARGET) \
 		$(INTERNAL_RECOVERYIMAGE_FILES) \
@@ -1322,7 +1330,6 @@
     $(PDK_FUSION_SYSIMG_FILES) \
     $(RECOVERY_RESOURCE_ZIP))
 
-
 FULL_SYSTEMIMAGE_DEPS := $(INTERNAL_SYSTEMIMAGE_FILES) $(INTERNAL_USERIMAGES_DEPS)
 
 # ASAN libraries in the system image - add dependency.
@@ -1444,6 +1451,9 @@
 endif
 endif
 
+.PHONY: sync
+sync: $(INTERNAL_SYSTEMIMAGE_FILES)
+
 #######
 ## system tarball
 define build-systemtarball-target
@@ -1772,8 +1782,11 @@
 
 # We just build this directly to the install location.
 INSTALLED_SYSTEMOTHERIMAGE_TARGET := $(BUILT_SYSTEMOTHERIMAGE_TARGET)
+ifneq (true,$(SANITIZE_LITE))
+# Only create system_other when not building the second stage of a SANITIZE_LITE build.
 $(INSTALLED_SYSTEMOTHERIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_SYSTEMOTHERIMAGE_FILES) $(INSTALLED_FILES_FILE_SYSTEMOTHER)
 	$(build-systemotherimage-target)
+endif
 
 .PHONY: systemotherimage-nodeps
 systemotherimage-nodeps: | $(INTERNAL_USERIMAGES_DEPS)
@@ -1826,6 +1839,8 @@
 vendorimage-nodeps vnod: | $(INTERNAL_USERIMAGES_DEPS) $(DEPMOD)
 	$(build-vendorimage-target)
 
+sync: $(INTERNAL_VENDORIMAGE_FILES)
+
 else ifdef BOARD_PREBUILT_VENDORIMAGE
 INSTALLED_VENDORIMAGE_TARGET := $(PRODUCT_OUT)/vendor.img
 $(eval $(call copy-one-file,$(BOARD_PREBUILT_VENDORIMAGE),$(INSTALLED_VENDORIMAGE_TARGET)))
@@ -1856,6 +1871,11 @@
 $(subst H,h,$(subst I,i,$(subst J,j,$(subst K,k,$(subst L,l,$(subst M,m,$(subst N,n,$(subst O,o,\
 $(subst P,p,$(subst Q,q,$(subst R,r,$(subst S,s,$(subst T,t,$(subst U,u,$(subst V,v,$(subst W,w,\
 $(subst X,x,$(subst Y,y,$(subst Z,z,$1))))))))))))))))))))))))))
+# Convert to upper case without requiring a shell, which isn't cacheable.
+to-upper=$(subst a,A,$(subst b,B,$(subst c,C,$(subst d,D,$(subst e,E,$(subst f,F,$(subst g,G,\
+$(subst h,H,$(subst i,I,$(subst j,J,$(subst k,K,$(subst l,L,$(subst m,M,$(subst n,N,$(subst o,O,\
+$(subst p,P,$(subst q,Q,$(subst r,R,$(subst s,S,$(subst t,T,$(subst u,U,$(subst v,V,$(subst w,W,\
+$(subst x,X,$(subst y,Y,$(subst z,Z,$1))))))))))))))))))))))))))
 
 # -----------------------------------------------------------------
 # vbmeta image
@@ -2000,9 +2020,6 @@
 vbmetaimage-nodeps:
 	$(build-vbmetaimage-target)
 
-# We need $(AVBTOOL) for system.img generation.
-FULL_SYSTEMIMAGE_DEPS += $(AVBTOOL)
-
 endif # BOARD_AVB_ENABLE
 
 # -----------------------------------------------------------------
@@ -2075,7 +2092,8 @@
   $(HOST_OUT_EXECUTABLES)/lib/shflags/shflags \
   $(HOST_OUT_EXECUTABLES)/delta_generator \
   $(AVBTOOL) \
-  $(BLK_ALLOC_TO_BASE_FS)
+  $(BLK_ALLOC_TO_BASE_FS) \
+  $(BRO)
 
 ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
 OTATOOLS += \
@@ -2109,7 +2127,9 @@
   $(HOST_LIBRARY_PATH)/libz-host$(HOST_SHLIB_SUFFIX) \
   $(HOST_LIBRARY_PATH)/libsparse-host$(HOST_SHLIB_SUFFIX) \
   $(HOST_LIBRARY_PATH)/libbase$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libpcre2$(HOST_SHLIB_SUFFIX)
+  $(HOST_LIBRARY_PATH)/libpcre2$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libbrotli$(HOST_SHLIB_SUFFIX)
+
 
 .PHONY: otatools
 otatools: $(OTATOOLS)
@@ -2121,6 +2141,7 @@
   system/extras/verity/build_verity_metadata.py \
   system/extras/ext4_utils/mke2fs.conf \
   external/avb/test/data/testkey_rsa4096.pem \
+  $(shell find system/update_engine/scripts -name \*.pyc -prune -o -type f -print | sort) \
   $(shell find build/target/product/security -type f -name \*.x509.pem -o -name \*.pk8 -o \
       -name verity_key | sort) \
   $(shell find device vendor -type f -name \*.pk8 -o -name verifiedboot\* -o \
@@ -2484,6 +2505,11 @@
 endif # BOARD_AVB_DTBO_KEY_PATH
 endif # BOARD_AVB_ENABLE
 endif # BOARD_PREBUILT_DTBOIMAGE
+	@# The radio images in BOARD_PACK_RADIOIMAGES will be additionally copied from RADIO/ into
+	@# IMAGES/, which then will be added into <product>-img.zip. Such images must be listed in
+	@# INSTALLED_RADIOIMAGE_TARGET.
+	$(hide) $(foreach part,$(BOARD_PACK_RADIOIMAGES), \
+	    echo $(part) >> $(zip_root)/META/pack_radioimages.txt;)
 	@# Run fs_config on all the system, vendor, boot ramdisk,
 	@# and recovery ramdisk files in the zip, and save the output
 	$(hide) $(call fs_config,$(zip_root)/SYSTEM,system/) > $(zip_root)/META/filesystem_config.txt
@@ -2553,6 +2579,8 @@
 
 ifeq ($(AB_OTA_UPDATER),true)
 $(INTERNAL_OTA_PACKAGE_TARGET): $(BRILLO_UPDATE_PAYLOAD)
+else
+$(INTERNAL_OTA_PACKAGE_TARGET): $(BRO)
 endif
 
 $(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) \
@@ -2663,20 +2691,36 @@
 		zip -qjX $@ $$apps_to_zip; \
 	fi
 
-#------------------------------------------------------------------
-# A zip of emma code coverage meta files. Generated for fully emma
-# instrumented build.
-#
 ifeq (true,$(EMMA_INSTRUMENT))
-EMMA_META_ZIP := $(PRODUCT_OUT)/emma_meta.zip
-# the dependency will be set up later in build/core/main.mk.
+  #------------------------------------------------------------------
+  # An archive of classes for use in generating code-coverage reports
+  # These are the uninstrumented versions of any classes that were
+  # to be instrumented.
+  # Any dependencies are set up later in build/core/main.mk.
+
+  ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+    JACOCO_REPORT_CLASSES_ALL := $(PRODUCT_OUT)/jacoco-report-classes-all.jar
+$(JACOCO_REPORT_CLASSES_ALL) :
+	@echo "Collecting uninstrumented classes"
+	$(hide) find $(TARGET_COMMON_OUT_ROOT) $(HOST_COMMON_OUT_ROOT) -name "jacoco-report-classes.jar" | \
+		zip -@ -0 -q -X $@
+# Meaning of these options:
+# -@ scan stdin for file paths to add to the zip
+# -0 don't do any compression
+# -q supress most output
+# -X skip storing extended file attributes
+
+  else
+    EMMA_META_ZIP := $(PRODUCT_OUT)/emma_meta.zip
 $(EMMA_META_ZIP) :
 	@echo "Collecting Emma coverage meta files."
 	$(hide) find $(TARGET_COMMON_OUT_ROOT) $(HOST_COMMON_OUT_ROOT) -name "coverage.em" | \
 		zip -@ -qX $@
+endif
 
 endif # EMMA_INSTRUMENT=true
 
+
 #------------------------------------------------------------------
 # A zip of Proguard obfuscation dictionary files.
 # Only for apps_only build.
@@ -2704,6 +2748,26 @@
 .PHONY: dalvikfiles
 dalvikfiles: $(INTERNAL_DALVIK_MODULES)
 
+ifeq ($(BUILD_QEMU_IMAGES),true)
+INSTALLED_QEMU_SYSTEMIMAGE := $(PRODUCT_OUT)/system-qemu.img
+MK_QEMU_IMAGE_SH := device/generic/goldfish/tools/mk_qemu_image.sh
+SGDISK_HOST := $(HOST_OUT_EXECUTABLES)/sgdisk
+$(INSTALLED_QEMU_SYSTEMIMAGE): $(INSTALLED_SYSTEMIMAGE) $(MK_QEMU_IMAGE_SH) $(SGDISK_HOST)
+	@echo Create system-qemu.img
+	(export SGDISK=$(SGDISK_HOST); $(MK_QEMU_IMAGE_SH) ${PRODUCT_OUT}/system.img)
+
+systemimage: $(INSTALLED_QEMU_SYSTEMIMAGE)
+droidcore: $(INSTALLED_QEMU_SYSTEMIMAGE)
+ifeq ($(BOARD_USES_VENDORIMAGE),true)
+INSTALLED_QEMU_VENDORIMAGE := $(PRODUCT_OUT)/vendor-qemu.img
+$(INSTALLED_QEMU_VENDORIMAGE): $(INSTALLED_VENDORIMAGE_TARGET) $(MK_QEMU_IMAGE_SH) $(SGDISK_HOST)
+	@echo Create vendor-qemu.img
+	(export SGDISK=$(SGDISK_HOST); $(MK_QEMU_IMAGE_SH) ${PRODUCT_OUT}/vendor.img)
+
+vendorimage: $(INSTALLED_QEMU_VENDORIMAGE)
+droidcore: $(INSTALLED_QEMU_VENDORIMAGE)
+endif
+endif
 # -----------------------------------------------------------------
 # The emulator package
 ifeq ($(BUILD_EMULATOR),true)
@@ -2799,6 +2863,8 @@
 	$(SYMBOLS_ZIP) \
 	$(COVERAGE_ZIP) \
 	$(INSTALLED_SYSTEMIMAGE) \
+	$(INSTALLED_QEMU_SYSTEMIMAGE) \
+	$(INSTALLED_QEMU_VENDORIMAGE) \
 	$(INSTALLED_USERDATAIMAGE_TARGET) \
 	$(INSTALLED_RAMDISK_TARGET) \
 	$(INSTALLED_SDK_BUILD_PROP_TARGET) \
diff --git a/core/base_rules.mk b/core/base_rules.mk
index c327d2c..57ac23c 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -243,6 +243,18 @@
 intermediates.COMMON := $(call local-intermediates-dir,COMMON)
 generated_sources_dir := $(call local-generated-sources-dir)
 
+ifneq ($(LOCAL_OVERRIDES_MODULES),)
+  ifeq ($(LOCAL_MODULE_CLASS),EXECUTABLES)
+    ifndef LOCAL_IS_HOST_MODULE
+      EXECUTABLES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
+    else
+      $(call pretty-error,host modules cannot use LOCAL_OVERRIDES_MODULES)
+    endif
+  else
+      $(call pretty-error,LOCAL_MODULE_CLASS := $(LOCAL_MODULE_CLASS) cannot use LOCAL_OVERRIDES_MODULES)
+  endif
+endif
+
 ###########################################################
 # Pick a name for the intermediate and final targets
 ###########################################################
@@ -567,6 +579,9 @@
 ALL_MODULES.$(my_register_name).EXPLICITLY_REQUIRED := \
     $(strip $(ALL_MODULES.$(my_register_name).EXPLICITLY_REQUIRED)\
         $(my_required_modules))
+ALL_MODULES.$(my_register_name).TARGET_REQUIRED := \
+    $(strip $(ALL_MODULES.$(my_register_name).TARGET_REQUIRED)\
+        $(LOCAL_TARGET_REQUIRED_MODULES))
 ALL_MODULES.$(my_register_name).EVENT_LOG_TAGS := \
     $(ALL_MODULES.$(my_register_name).EVENT_LOG_TAGS) $(event_log_tags)
 ALL_MODULES.$(my_register_name).MAKEFILE := \
diff --git a/core/binary.mk b/core/binary.mk
index 625d348..6a58c6c 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -24,9 +24,10 @@
   endif
 else
   ifeq ($(LOCAL_SYSTEM_SHARED_LIBRARIES),none)
-      my_system_shared_libraries := libc libm
+      my_system_shared_libraries := libc libm libdl
   else
       my_system_shared_libraries := $(LOCAL_SYSTEM_SHARED_LIBRARIES)
+      my_system_shared_libraries := $(patsubst libc,libc libdl,$(my_system_shared_libraries))
   endif
 endif
 
@@ -39,7 +40,7 @@
 my_src_files_exclude := $(LOCAL_SRC_FILES_EXCLUDE)
 my_static_libraries := $(LOCAL_STATIC_LIBRARIES)
 my_whole_static_libraries := $(LOCAL_WHOLE_STATIC_LIBRARIES)
-my_shared_libraries := $(LOCAL_SHARED_LIBRARIES)
+my_shared_libraries := $(filter-out $(my_system_shared_libraries),$(LOCAL_SHARED_LIBRARIES))
 my_header_libraries := $(LOCAL_HEADER_LIBRARIES)
 my_cflags := $(LOCAL_CFLAGS)
 my_conlyflags := $(LOCAL_CONLYFLAGS)
@@ -52,6 +53,7 @@
 my_cc := $(LOCAL_CC)
 my_cc_wrapper := $(CC_WRAPPER)
 my_cxx := $(LOCAL_CXX)
+my_cxx_ldlibs :=
 my_cxx_wrapper := $(CXX_WRAPPER)
 my_c_includes := $(LOCAL_C_INCLUDES)
 my_generated_sources := $(LOCAL_GENERATED_SOURCES)
@@ -103,7 +105,7 @@
   ifneq (,$(filter arm64 mips64 x86_64,$(my_arch)))
     my_min_sdk_version := 21
   else
-    my_min_sdk_version := 9
+    my_min_sdk_version := $(MIN_SUPPORTED_SDK_VERSION)
   endif
 
   # Historically we've just set up a bunch of symlinks in prebuilts/ndk to map
@@ -269,7 +271,7 @@
 endif
 
 ifneq ($(LOCAL_USE_VNDK),)
-  my_cflags += -D__ANDROID_API__=__ANDROID_API_FUTURE__
+  my_cflags += -D__ANDROID_API__=__ANDROID_API_FUTURE__ -D__ANDROID_VNDK__
 endif
 
 ifndef LOCAL_IS_HOST_MODULE
@@ -288,6 +290,15 @@
 # Move other ldlibs back to shared libraries
 my_shared_libraries += $(patsubst -l%,lib%,$(filter-out $(my_allowed_ldlibs),$(my_ldlibs)))
 my_ldlibs := $(filter $(my_allowed_ldlibs),$(my_ldlibs))
+else # LOCAL_IS_HOST_MODULE
+  # Add -ldl, -lpthread and -lrt to host builds to match the default behavior of
+  # device builds
+  ifneq ($($(my_prefix)OS),windows)
+    my_ldlibs += -ldl -lpthread
+    ifneq ($(HOST_OS),darwin)
+      my_ldlibs += -lrt
+    endif
+  endif
 endif
 
 ifneq ($(LOCAL_SDK_VERSION),)
@@ -446,7 +457,10 @@
 my_whole_static_libraries := $(LOCAL_WHOLE_STATIC_LIBRARIES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)) $(LOCAL_WHOLE_STATIC_LIBRARIES_$(my_32_64_bit_suffix)) $(my_whole_static_libraries)
 my_header_libraries := $(LOCAL_HEADER_LIBRARIES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)) $(LOCAL_HEADER_LIBRARIES_$(my_32_64_bit_suffix)) $(my_header_libraries)
 
+# soong defined modules already have done through this
+ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
 include $(BUILD_SYSTEM)/cxx_stl_setup.mk
+endif
 
 # Add static HAL libraries
 ifdef LOCAL_HAL_STATIC_LIBRARIES
@@ -463,6 +477,8 @@
   my_linker := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LINKER)
 endif
 
+# Modules from soong do not need this since the dependencies are already handled there.
+ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
 include $(BUILD_SYSTEM)/config_sanitizers.mk
 
 ifneq ($(LOCAL_NO_LIBCOMPILER_RT),true)
@@ -476,6 +492,7 @@
 ifeq ($($(my_prefix)OS),windows)
   my_static_libraries += libwinpthread
 endif
+endif # this module is not from soong
 
 ifneq ($(filter ../%,$(my_src_files)),)
 my_soong_problems += dotdot_srcs
@@ -522,6 +539,7 @@
 my_target_global_c_includes := \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_INCLUDES)
 my_target_global_c_system_includes := \
+    $(TARGET_OUT_HEADERS) \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_SYSTEM_INCLUDES)
 else ifdef LOCAL_SDK_VERSION
 my_target_global_c_includes :=
@@ -1322,14 +1340,9 @@
   ## switch all soong libraries over to the /vendor
   ## variant.
   ####################################################
-  ifeq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
-    # Soong-built libraries should always use the .vendor variant
-    my_whole_static_libraries := $(addsuffix .vendor,$(my_whole_static_libraries))
-    my_static_libraries := $(addsuffix .vendor,$(my_static_libraries))
-    my_shared_libraries := $(addsuffix .vendor,$(my_shared_libraries))
-    my_system_shared_libraries := $(addsuffix .vendor,$(my_system_shared_libraries))
-    my_header_libraries := $(addsuffix .vendor,$(my_header_libraries))
-  else
+  ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+    # We don't do this renaming for soong-defined modules since they already have correct
+    # names (with .vendor suffix when necessary) in their LOCAL_*_LIBRARIES.
     my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
       $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
     my_static_libraries := $(foreach l,$(my_static_libraries),\
@@ -1362,7 +1375,7 @@
 ifdef LOCAL_INSTALLED_MODULE
 ifdef installed_shared_library_module_names
 $(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
-    $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(sort $(installed_shared_library_module_names)))
+    $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(installed_shared_library_module_names))
 endif
 endif
 
@@ -1372,6 +1385,8 @@
 ####################################################
 import_includes := $(intermediates)/import_includes
 import_includes_deps := $(strip \
+    $(if $(LOCAL_USE_VNDK),\
+      $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
     $(foreach l, $(installed_shared_library_module_names), \
       $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
     $(foreach l, $(my_static_libraries) $(my_whole_static_libraries), \
@@ -1464,7 +1479,8 @@
 
 my_c_includes += $(TOPDIR)$(LOCAL_PATH) $(intermediates) $(generated_sources_dir)
 
-ifndef LOCAL_SDK_VERSION
+# The platform JNI header is for platform modules only.
+ifeq ($(LOCAL_SDK_VERSION)$(LOCAL_USE_VNDK),)
   my_c_includes += $(JNI_H_INCLUDE)
 endif
 
diff --git a/core/clang/OWNERS b/core/clang/OWNERS
new file mode 100644
index 0000000..d41d3fc
--- /dev/null
+++ b/core/clang/OWNERS
@@ -0,0 +1,4 @@
+chh@google.com
+pirama@google.com
+srhines@google.com
+yikong@google.com
diff --git a/core/clang/config.mk b/core/clang/config.mk
index 0e59930..408f688 100644
--- a/core/clang/config.mk
+++ b/core/clang/config.mk
@@ -72,6 +72,7 @@
 # INTERNAL_LOCAL_CLANG_EXCEPTION_PROJECTS is defined later in other config.mk.
 LOCAL_CLANG_EXCEPTION_PROJECTS = \
   bionic/tests/ \
+  device/google/contexthub/ \
   device/huawei/angler/ \
   device/lge/bullhead/ \
   external/gentoo/integration/ \
diff --git a/core/cleanbuild.mk b/core/cleanbuild.mk
index 0e1c88d..64c5ae1 100644
--- a/core/cleanbuild.mk
+++ b/core/cleanbuild.mk
@@ -13,8 +13,32 @@
 # limitations under the License.
 #
 
-# Don't bother with the cleanspecs if you are running mm/mmm
-ifeq ($(ONE_SHOT_MAKEFILE)$(dont_bother)$(NO_ANDROID_CLEANSPEC),)
+# Absolute path of the present working direcotry.
+# This overrides the shell variable $PWD, which does not necessarily points to
+# the top of the source tree, for example when "make -C" is used in m/mm/mmm.
+PWD := $(shell pwd)
+
+TOP := .
+TOPDIR :=
+
+BUILD_SYSTEM := $(TOPDIR)build/core
+
+# Set up various standard variables based on configuration
+# and host information.
+include $(BUILD_SYSTEM)/config.mk
+
+include $(SOONG_MAKEVARS_MK)
+
+include $(BUILD_SYSTEM)/clang/config.mk
+
+# CTS-specific config.
+-include cts/build/config.mk
+# VTS-specific config.
+-include test/vts/tools/vts-tradefed/build/config.mk
+# device-tests-specific-config.
+-include tools/tradefederation/build/suites/device-tests/config.mk
+# general-tests-specific-config.
+-include tools/tradefederation/build/suites/general-tests/config.mk
 
 INTERNAL_CLEAN_STEPS :=
 
@@ -58,7 +82,7 @@
 
 # If the clean_steps.mk file is missing (usually after a clean build)
 # then we won't do anything.
-CURRENT_CLEAN_BUILD_VERSION := $(INTERNAL_CLEAN_BUILD_VERSION)
+CURRENT_CLEAN_BUILD_VERSION := MISSING
 CURRENT_CLEAN_STEPS := $(INTERNAL_CLEAN_STEPS)
 
 # Read the current state from the file, if present.
@@ -67,7 +91,9 @@
 clean_steps_file := $(PRODUCT_OUT)/clean_steps.mk
 -include $(clean_steps_file)
 
-ifneq ($(CURRENT_CLEAN_BUILD_VERSION),$(INTERNAL_CLEAN_BUILD_VERSION))
+ifeq ($(CURRENT_CLEAN_BUILD_VERSION),MISSING)
+  # Do nothing
+else ifneq ($(CURRENT_CLEAN_BUILD_VERSION),$(INTERNAL_CLEAN_BUILD_VERSION))
   # The major clean version is out-of-date.  Do a full clean, and
   # don't even bother with the clean steps.
   $(info *** A clean build is required because of a recent change.)
@@ -109,57 +135,18 @@
 
 # Write the new state to the file.
 #
-rewrite_clean_steps_file :=
 ifneq ($(CURRENT_CLEAN_BUILD_VERSION)-$(CURRENT_CLEAN_STEPS),$(INTERNAL_CLEAN_BUILD_VERSION)-$(INTERNAL_CLEAN_STEPS))
-rewrite_clean_steps_file := true
-endif
-ifeq ($(wildcard $(clean_steps_file)),)
-# This is the first build.
-rewrite_clean_steps_file := true
-endif
-ifeq ($(rewrite_clean_steps_file),true)
-$(shell \
-  mkdir -p $(dir $(clean_steps_file)) && \
-  echo "CURRENT_CLEAN_BUILD_VERSION := $(INTERNAL_CLEAN_BUILD_VERSION)" > \
-      $(clean_steps_file) ;\
-  echo "CURRENT_CLEAN_STEPS := $(wordlist 1,500,$(INTERNAL_CLEAN_STEPS))" >> $(clean_steps_file) \
- )
-define -cs-write-clean-steps-if-arg1-not-empty
-$(if $(1),$(shell echo "CURRENT_CLEAN_STEPS += $(1)" >> $(clean_steps_file)))
-endef
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 501,1000,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 1001,1500,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 1501,2000,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 2001,2500,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 2501,3000,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 3001,99999,$(INTERNAL_CLEAN_STEPS)))
+$(shell mkdir -p $(dir $(clean_steps_file)))
+$(file >$(clean_steps_file).tmp,CURRENT_CLEAN_BUILD_VERSION := $(INTERNAL_CLEAN_BUILD_VERSION)$(newline)CURRENT_CLEAN_STEPS := $(INTERNAL_CLEAN_STEPS)$(newline))
+$(shell if ! cmp -s $(clean_steps_file).tmp $(clean_steps_file); then \
+          mv $(clean_steps_file).tmp $(clean_steps_file); \
+        else \
+          rm $(clean_steps_file).tmp; \
+        fi)
 endif
 
 CURRENT_CLEAN_BUILD_VERSION :=
 CURRENT_CLEAN_STEPS :=
 clean_steps_file :=
-rewrite_clean_steps_file :=
 INTERNAL_CLEAN_STEPS :=
 INTERNAL_CLEAN_BUILD_VERSION :=
-
-endif  # if not ONE_SHOT_MAKEFILE dont_bother NO_ANDROID_CLEANSPEC
-
-###########################################################
-
-.PHONY: clean-jack-files
-clean-jack-files: clean-dex-files
-	$(hide) find $(OUT_DIR) -name "*.jack" | xargs rm -f
-	$(hide) find $(OUT_DIR) -type d -name "jack" | xargs rm -rf
-	@echo "All jack files have been removed."
-
-.PHONY: clean-dex-files
-clean-dex-files:
-	$(hide) find $(OUT_DIR) -name "*.dex" ! -path "*/jack-incremental/*" | xargs rm -f
-	$(hide) for i in `find $(OUT_DIR) -name "*.jar" -o -name "*.apk"` ; do ((unzip -l $$i 2> /dev/null | \
-				grep -q "\.dex$$" && rm -f $$i) || continue ) ; done
-	@echo "All dex files and archives containing dex files have been removed."
-
-.PHONY: clean-jack-incremental
-clean-jack-incremental:
-	$(hide) find $(OUT_DIR) -name "jack-incremental" -type d | xargs rm -rf
-	@echo "All jack incremental dirs have been removed."
diff --git a/core/cleanspec.mk b/core/cleanspec.mk
index 4441e2a..af28954 100644
--- a/core/cleanspec.mk
+++ b/core/cleanspec.mk
@@ -64,6 +64,6 @@
 # ************************************************
 
 subdir_cleanspecs := \
-    $(shell build/tools/findleaves.py $(FIND_LEAVES_EXCLUDES) . CleanSpec.mk)
+    $(file <$(OUT_DIR)/.module_paths/CleanSpec.mk.list)
 include $(subdir_cleanspecs)
 subdir_cleanspecs :=
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index ac3593b..c38059c 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -85,6 +85,8 @@
 LOCAL_FORCE_STATIC_EXECUTABLE:=
 LOCAL_FULL_LIBS_MANIFEST_FILES:=
 LOCAL_FULL_MANIFEST_FILE:=
+LOCAL_FULL_CLASSES_JACOCO_JAR:=
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR:=
 LOCAL_GCNO_FILES:=
 LOCAL_GENERATED_SOURCES:=
 # Group static libraries with "-Wl,--start-group" and "-Wl,--end-group" when linking.
@@ -171,6 +173,7 @@
 LOCAL_ODM_MODULE:=
 LOCAL_OEM_MODULE:=
 LOCAL_OVERRIDES_PACKAGES:=
+LOCAL_OVERRIDES_MODULES:=
 LOCAL_PACKAGE_NAME:=
 LOCAL_PACKAGE_SPLITS:=
 LOCAL_PACK_MODULE_RELOCATIONS:=
@@ -215,6 +218,7 @@
 LOCAL_SANITIZE:=
 LOCAL_SANITIZE_DIAG:=
 LOCAL_SANITIZE_RECOVER:=
+LOCAL_SANITIZE_BLACKLIST :=
 LOCAL_SDK_RES_VERSION:=
 LOCAL_SDK_VERSION:=
 LOCAL_SHARED_ANDROID_LIBRARIES:=
@@ -229,6 +233,7 @@
 LOCAL_STATIC_LIBRARIES:=
 LOCAL_STRIP_MODULE:=
 LOCAL_SYSTEM_SHARED_LIBRARIES:=none
+LOCAL_TARGET_REQUIRED_MODULES:=
 LOCAL_TEST_DATA:=
 LOCAL_TEST_MODULE_TO_PROGUARD_WITH:=
 LOCAL_TIDY:=
diff --git a/core/combo/TARGET_linux-arm.mk b/core/combo/TARGET_linux-arm.mk
index 2e179f6..73b1c04 100644
--- a/core/combo/TARGET_linux-arm.mk
+++ b/core/combo/TARGET_linux-arm.mk
@@ -29,6 +29,26 @@
 # include defines, and compiler settings for the given architecture
 # version.
 #
+ifeq ($(strip $(TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT)),)
+TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT := generic
+endif
+
+KNOWN_ARMv8_CORES := cortex-a53 cortex-a53.a57 cortex-a73
+KNOWN_ARMv8_CORES += kryo denver64 exynos-m1 exynos-m2
+
+# Many devices (incorrectly) use armv7-a-neon as the 2nd architecture variant
+# for cores that implement armv8-a ISAs. The following sets it to armv8-a.
+ifneq (,$(filter $(TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT), $(KNOWN_ARMv8_CORES)))
+  ifneq ($(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT),armv8-a)
+    $(warning $(TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT) is armv8-a.)
+    ifneq (,$(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT))
+      $(warning TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT, $(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT), ignored! Use armv8-a instead.)
+    endif
+    # Overwrite TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT
+    TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT := armv8-a
+  endif
+endif
+
 ifeq ($(strip $(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT)),)
 TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT := armv5te
 endif
diff --git a/core/combo/arch/arm/armv8-a.mk b/core/combo/arch/arm/armv8-a.mk
new file mode 100644
index 0000000..9ef5c49
--- /dev/null
+++ b/core/combo/arch/arm/armv8-a.mk
@@ -0,0 +1,9 @@
+# Configuration for Linux on ARM.
+# Generating binaries for the ARMv8-a architecture
+#
+# Many libraries are not aware of armv8-a, and AArch32 is (almost) a superset
+# of armv7-a-neon. So just let them think we are just like v7.
+ARCH_ARM_HAVE_ARMV7A            := true
+ARCH_ARM_HAVE_VFP               := true
+ARCH_ARM_HAVE_VFP_D32           := true
+ARCH_ARM_HAVE_NEON              := true
diff --git a/core/combo/javac.mk b/core/combo/javac.mk
index d067ce7..835ee82 100644
--- a/core/combo/javac.mk
+++ b/core/combo/javac.mk
@@ -1,49 +1,36 @@
 # Selects a Java compiler.
 #
 # Inputs:
-#	CUSTOM_JAVA_COMPILER -- "eclipse", "openjdk". or nothing for the system
-#                           default
-#	ALTERNATE_JAVAC -- the alternate java compiler to use
+#   OVERRIDE_ANDROID_JAVA_HOME -- alternate location to use for jdk
 #
 # Outputs:
-#   COMMON_JAVAC -- Java compiler command with common arguments
+#   ANDROID_JAVA_HOME -- Directory that contains JDK
+#   ANDROID_JAVA_TOOLCHAIN -- Directory that contains javac and other java tools
 #
 
 ifndef ANDROID_COMPILE_WITH_JACK
-# Defines if compilation with jack is enabled by default.
-ANDROID_COMPILE_WITH_JACK := true
-endif
-
-common_jdk_flags := -Xmaxerrs 9999999
-
-# Use the indexer wrapper to index the codebase instead of the javac compiler
-ifeq ($(ALTERNATE_JAVAC),)
-JAVACC := javac
-else
-JAVACC := $(ALTERNATE_JAVAC)
-endif
-
-# The actual compiler can be wrapped by setting the JAVAC_WRAPPER var.
-ifdef JAVAC_WRAPPER
-    ifneq ($(JAVAC_WRAPPER),$(firstword $(JAVACC)))
-        JAVACC := $(JAVAC_WRAPPER) $(JAVACC)
+    # TODO(b/64113890, b/35788202): remove PRODUCT_COMPILE_WITH_JACK
+    ifdef PRODUCT_COMPILE_WITH_JACK
+        ANDROID_COMPILE_WITH_JACK := $(PRODUCT_COMPILE_WITH_JACK)
+    else
+        # TODO(b/62038127): remove TARGET_BUILD_APPS check
+        ifdef TARGET_BUILD_APPS
+            ANDROID_COMPILE_WITH_JACK := true
+        else
+            ANDROID_COMPILE_WITH_JACK := false
+        endif
     endif
 endif
 
-# Whatever compiler is on this system.
-COMMON_JAVAC := $(JAVACC) -J-Xmx2048M $(common_jdk_flags)
-
-# Eclipse.
-ifeq ($(CUSTOM_JAVA_COMPILER), eclipse)
-    COMMON_JAVAC := java -Xmx256m -jar prebuilt/common/ecj/ecj.jar -5 \
-        -maxProblems 9999999 -nowarn
-    $(info CUSTOM_JAVA_COMPILER=eclipse)
+ifeq ($(OVERRIDE_ANDROID_JAVA_HOME),)
+ANDROID_JAVA_HOME := prebuilts/jdk/jdk8/$(HOST_PREBUILT_TAG)
+else
+# Use this build toolchain instead of the bundled one.
+ANDROID_JAVA_HOME := $(OVERRIDE_ANDROID_JAVA_HOME)
 endif
+ANDROID_JAVA_TOOLCHAIN := $(ANDROID_JAVA_HOME)/bin
+export JAVA_HOME := $(abspath $(ANDROID_JAVA_HOME))
 
-GLOBAL_JAVAC_DEBUG_FLAGS := -g
-
-HOST_JAVAC ?= $(COMMON_JAVAC)
-TARGET_JAVAC ?= $(COMMON_JAVAC)
-
-#$(info HOST_JAVAC=$(HOST_JAVAC))
-#$(info TARGET_JAVAC=$(TARGET_JAVAC))
+# TODO(ccross): remove this, it is needed for now because it is used by
+# config.mk before makevars from soong are loaded
+JAVA := $(ANDROID_JAVA_TOOLCHAIN)/java
diff --git a/core/config.mk b/core/config.mk
index 62f1337..d30a7da 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -71,6 +71,8 @@
 $(error Please remove --color=always from your  $$GREP_OPTIONS)
 endif
 
+UNAME := $(shell uname -sm)
+
 SRC_TARGET_DIR := $(TOPDIR)build/target
 SRC_API_DIR := $(TOPDIR)prebuilts/sdk/api
 SRC_SYSTEM_API_DIR := $(TOPDIR)prebuilts/sdk/system-api
@@ -308,6 +310,7 @@
 
 export CC_WRAPPER
 export CXX_WRAPPER
+export JAVAC_WRAPPER
 endif
 
 ifdef TARGET_PREFER_32_BIT
@@ -493,39 +496,53 @@
 endif
 .KATI_READONLY := ALLOW_MISSING_DEPENDENCIES
 
-#
-# Tools that are prebuilts for TARGET_BUILD_APPS
-#
 prebuilt_sdk_tools := prebuilts/sdk/tools
 prebuilt_sdk_tools_bin := $(prebuilt_sdk_tools)/$(HOST_OS)/bin
 
-AIDL := $(HOST_OUT_EXECUTABLES)/aidl
-AAPT := $(HOST_OUT_EXECUTABLES)/aapt
-AAPT2 := $(HOST_OUT_EXECUTABLES)/aapt2
-ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
-SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
-SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
-LLVM_RS_CC := $(HOST_OUT_EXECUTABLES)/llvm-rs-cc
-BCC_COMPAT := $(HOST_OUT_EXECUTABLES)/bcc_compat
-DEPMOD := $(HOST_OUT_EXECUTABLES)/depmod
+USE_PREBUILT_SDK_TOOLS_IN_PLACE := true
 
-#TODO: use a smaller -Xmx value for most libraries;
-#      only core.jar and framework.jar need a heap this big.
-ifndef DX_ALT_JAR
-DX := $(HOST_OUT_EXECUTABLES)/dx
-DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+#
+# Tools that are prebuilts for TARGET_BUILD_APPS
+#
+ifeq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
+  AIDL := $(HOST_OUT_EXECUTABLES)/aidl
+  AAPT := $(HOST_OUT_EXECUTABLES)/aapt
+  AAPT2 := $(HOST_OUT_EXECUTABLES)/aapt2
+  MAINDEXCLASSES := $(HOST_OUT_EXECUTABLES)/mainDexClasses
+  SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
+  SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
+  ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
+
+  ifndef DX_ALT_JAR
+    DX := $(HOST_OUT_EXECUTABLES)/dx
+    DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+  else
+    DX := $(DX_ALT_JAR)
+    DX_COMMAND := $(JAVA) -Xms16M -Xmx2048M -jar $(DX)
+  endif
+else # TARGET_BUILD_APPS || TARGET_BUILD_PDK
+  AIDL := $(prebuilt_sdk_tools_bin)/aidl
+  AAPT := $(prebuilt_sdk_tools_bin)/aapt
+  AAPT2 := $(prebuilt_sdk_tools_bin)/aapt2
+  DX := $(prebuilt_sdk_tools)/dx
+  DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+  MAINDEXCLASSES := $(prebuilt_sdk_tools)/mainDexClasses
+  ZIPALIGN := $(prebuilt_sdk_tools_bin)/zipalign
+  SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
+  SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
+endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
+
+ifeq (,$(TARGET_BUILD_APPS))
+  # Use RenderScript prebuilts for unbundled builds but not PDK builds
+  LLVM_RS_CC := $(HOST_OUT_EXECUTABLES)/llvm-rs-cc
+  BCC_COMPAT := $(HOST_OUT_EXECUTABLES)/bcc_compat
 else
-DX := $(DX_ALT_JAR)
-DX_COMMAND := java -Xms16M -Xmx2048M -jar $(DX)
-endif
+  LLVM_RS_CC := $(prebuilt_sdk_tools_bin)/llvm-rs-cc
+  BCC_COMPAT := $(prebuilt_sdk_tools_bin)/bcc_compat
+endif # TARGET_BUILD_PDK
 
-MAINDEXCLASSES := $(HOST_OUT_EXECUTABLES)/mainDexClasses
-
-SOONG_ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/soong_zip
-ZIP2ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/zip2zip
-FILESLIST := $(SOONG_HOST_OUT_EXECUTABLES)/fileslist
-
-SOONG_JAVAC_WRAPPER := $(SOONG_HOST_OUT_EXECUTABLES)/soong_javac_wrapper
+prebuilt_sdk_tools :=
+prebuilt_sdk_tools_bin :=
 
 # Always use prebuilts for ckati and makeparallel
 prebuilt_build_tools := prebuilts/build-tools
@@ -534,37 +551,18 @@
 else
 prebuilt_build_tools_bin := $(prebuilt_build_tools)/$(HOST_PREBUILT_TAG)/asan/bin
 endif
+
 ACP := $(prebuilt_build_tools_bin)/acp
 CKATI := $(prebuilt_build_tools_bin)/ckati
+DEPMOD := $(HOST_OUT_EXECUTABLES)/depmod
+FILESLIST := $(SOONG_HOST_OUT_EXECUTABLES)/fileslist
 IJAR := $(prebuilt_build_tools_bin)/ijar
 MAKEPARALLEL := $(prebuilt_build_tools_bin)/makeparallel
+SOONG_JAVAC_WRAPPER := $(SOONG_HOST_OUT_EXECUTABLES)/soong_javac_wrapper
+SOONG_ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/soong_zip
+ZIP2ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/zip2zip
 ZIPTIME := $(prebuilt_build_tools_bin)/ziptime
 
-USE_PREBUILT_SDK_TOOLS_IN_PLACE := true
-
-# Override the definitions above for unbundled and PDK builds
-ifneq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
-AIDL := $(prebuilt_sdk_tools_bin)/aidl
-AAPT := $(prebuilt_sdk_tools_bin)/aapt
-AAPT2 := $(prebuilt_sdk_tools_bin)/aapt2
-ZIPALIGN := $(prebuilt_sdk_tools_bin)/zipalign
-SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
-# Use 64-bit libraries unconditionally because 32-bit JVMs are no longer supported
-SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
-
-DX := $(prebuilt_sdk_tools)/dx
-MAINDEXCLASSES := $(prebuilt_sdk_tools)/mainDexClasses
-
-# Don't use prebuilts in PDK
-ifneq ($(TARGET_BUILD_PDK),true)
-LLVM_RS_CC := $(prebuilt_sdk_tools_bin)/llvm-rs-cc
-BCC_COMPAT := $(prebuilt_sdk_tools_bin)/bcc_compat
-endif # TARGET_BUILD_PDK
-endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
-prebuilt_sdk_tools :=
-prebuilt_sdk_tools_bin :=
-
-
 # ---------------------------------------------------------------
 # Generic tools.
 JACK := $(HOST_OUT_EXECUTABLES)/jack
@@ -596,6 +594,7 @@
 VTSC := $(HOST_OUT_EXECUTABLES)/vtsc$(HOST_EXECUTABLE_SUFFIX)
 MKBOOTFS := $(HOST_OUT_EXECUTABLES)/mkbootfs$(HOST_EXECUTABLE_SUFFIX)
 MINIGZIP := $(HOST_OUT_EXECUTABLES)/minigzip$(HOST_EXECUTABLE_SUFFIX)
+BRO := $(HOST_OUT_EXECUTABLES)/bro$(HOST_EXECUTABLE_SUFFIX)
 ifeq (,$(strip $(BOARD_CUSTOM_MKBOOTIMG)))
 MKBOOTIMG := $(HOST_OUT_EXECUTABLES)/mkbootimg$(HOST_EXECUTABLE_SUFFIX)
 else
@@ -651,6 +650,7 @@
 DEFAULT_JACK_EXTRA_ARGS := @$(JACK_DEFAULT_ARGS)
 endif
 
+TURBINE := $(HOST_OUT_JAVA_LIBRARIES)/turbine$(COMMON_JAVA_PACKAGE_SUFFIX)
 PROGUARD := external/proguard/bin/proguard.sh
 JAVATAGS := build/tools/java-event-log-tags.py
 MERGETAGS := build/tools/merge-event-log-tags.py
@@ -672,38 +672,22 @@
 
 FINDBUGS_DIR := external/owasp/sanitizer/tools/findbugs/bin
 FINDBUGS := $(FINDBUGS_DIR)/findbugs
-EMMA_JAR := external/emma/lib/emma$(COMMON_JAVA_PACKAGE_SUFFIX)
+JACOCO_CLI_JAR := $(HOST_OUT_JAVA_LIBRARIES)/jacoco-cli$(COMMON_JAVA_PACKAGE_SUFFIX)
 
 # Tool to merge AndroidManifest.xmls
-ANDROID_MANIFEST_MERGER := java -classpath prebuilts/devtools/tools/lib/manifest-merger.jar com.android.manifmerger.Main merge
+ANDROID_MANIFEST_MERGER := $(JAVA) -classpath prebuilts/devtools/tools/lib/manifest-merger.jar com.android.manifmerger.Main merge
 
 COLUMN:= column
 
-# We may not have the right JAVA_HOME/PATH set up yet when this is run from envsetup.sh.
-ifneq ($(CALLED_FROM_SETUP),true)
-
 # Path to tools.jar, or empty if EXPERIMENTAL_USE_OPENJDK9 is set
 HOST_JDK_TOOLS_JAR :=
 # TODO: Remove HOST_JDK_TOOLS_JAR and all references to it once OpenJDK 8
 # toolchains are no longer supported (i.e. when what is now
 # EXPERIMENTAL_USE_OPENJDK9 becomes the standard). http://b/38418220
 ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
-HOST_JDK_TOOLS_JAR := $(shell $(BUILD_SYSTEM)/find-jdk-tools-jar.sh)
-
-ifneq ($(HOST_JDK_TOOLS_JAR),)
-ifeq ($(wildcard $(HOST_JDK_TOOLS_JAR)),)
-$(error Error: could not find jdk tools.jar at $(HOST_JDK_TOOLS_JAR), please check if your JDK was installed correctly)
-endif
-endif
+HOST_JDK_TOOLS_JAR := $(ANDROID_JAVA_TOOLCHAIN)/../lib/tools.jar
 endif # ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
 
-# Is the host JDK 64-bit version?
-HOST_JDK_IS_64BIT_VERSION :=
-ifneq ($(filter 64-Bit, $(shell java -version 2>&1)),)
-HOST_JDK_IS_64BIT_VERSION := true
-endif
-endif  # CALLED_FROM_SETUP not true
-
 # It's called md5 on Mac OS and md5sum on Linux
 ifeq ($(HOST_OS),darwin)
 MD5SUM:=md5 -q
@@ -795,11 +779,6 @@
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_PROJECT_SYSTEM_INCLUDES := $(TARGET_PROJECT_SYSTEM_INCLUDES)
 endif
 
-# allow overriding default Java libraries on a per-target basis
-ifeq ($(TARGET_DEFAULT_JAVA_LIBRARIES),)
-  TARGET_DEFAULT_JAVA_LIBRARIES := core-oj core-libart ext framework okhttp
-endif
-
 # Flags for DEX2OAT
 first_non_empty_of_three = $(if $(1),$(1),$(if $(2),$(2),$(3)))
 DEX2OAT_TARGET_ARCH := $(TARGET_ARCH)
@@ -893,6 +872,17 @@
 unexport JAVA_HOME
 export ANDROID_BUILD_PATHS:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(ANDROID_BUILD_PATHS)
 export PATH:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(PATH)
+else
+  # Put java first on the path
+  # TODO(ccross): remove this once tools run during the build no longer depend on
+  # finding java in the path
+  ifeq (,$(strip $(CALLED_FROM_SETUP)))
+    ifneq ($(shell which java),$(abspath $(ANDROID_JAVA_TOOLCHAIN)/java))
+      $(warning Found incorrect java $(shell which java) in $$PATH)
+      $(warning Adding $(abspath $(ANDROID_JAVA_TOOLCHAIN)) to $$PATH)
+      export PATH:=$(abspath $(ANDROID_JAVA_TOOLCHAIN)):$(PATH)
+    endif
+  endif
 endif
 
 # Projects clean of compiler warnings should be compiled with -Werror.
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index 04aedf4..e02f03a 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -9,6 +9,7 @@
 # modules that haven't set `LOCAL_CLANG := false` and device modules that
 # have set `LOCAL_CLANG := true`.
 my_global_sanitize :=
+my_global_sanitize_diag :=
 ifeq ($(my_clang),true)
   ifdef LOCAL_IS_HOST_MODULE
     my_global_sanitize := $(strip $(SANITIZE_HOST))
@@ -17,18 +18,35 @@
     my_global_sanitize := $(subst true,address,$(my_global_sanitize))
   else
     my_global_sanitize := $(strip $(SANITIZE_TARGET))
+    my_global_sanitize_diag := $(strip $(SANITIZE_TARGET_DIAG))
+  endif
+endif
+
+# Disable global integer_overflow in excluded paths.
+ifneq ($(filter integer_overflow, $(my_global_sanitize)),)
+  combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
+                            $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
+
+  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
+         $(filter $(dir)%,$(LOCAL_PATH)))),)
+    my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize))
+    my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag))
   endif
 endif
 
 ifneq ($(my_global_sanitize),)
   my_sanitize := $(my_global_sanitize) $(my_sanitize)
 endif
+ifneq ($(my_global_sanitize_diag),)
+  my_sanitize_diag := $(my_global_sanitize_diag) $(my_sanitize_diag)
+endif
 
 # The sanitizer specified in the product configuration wins over the previous.
 ifneq ($(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG),)
   my_sanitize := $(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG)
   ifeq ($(my_sanitize),never)
     my_sanitize :=
+    my_sanitize_diag :=
   endif
 endif
 
@@ -37,6 +55,7 @@
   SANITIZE_TARGET_ARCH ?= $(TARGET_ARCH) $(TARGET_2ND_ARCH)
   ifeq ($(filter $(SANITIZE_TARGET_ARCH),$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
     my_sanitize :=
+    my_sanitize_diag :=
   endif
 endif
 
@@ -47,6 +66,7 @@
     ifneq (,$(filter $(LOCAL_MODULE_OWNER),$(subst :, ,$(SANITIZE_NEVER_BY_OWNER))))
       $(warning Not sanitizing $(LOCAL_MODULE) based on module owner.)
       my_sanitize :=
+      my_sanitize_diag :=
     endif
   endif
 endif
@@ -55,11 +75,13 @@
 ifdef LOCAL_SDK_VERSION
   my_sanitize :=
   my_global_sanitize :=
+  my_sanitize_diag :=
 endif
 
 # Never always wins.
 ifeq ($(LOCAL_SANITIZE),never)
   my_sanitize :=
+  my_sanitize_diag :=
 endif
 
 # If CFI is disabled globally, remove it from my_sanitize.
@@ -86,6 +108,21 @@
   my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
 endif
 
+# Support for local sanitize blacklist paths.
+ifneq ($(my_sanitize)$(my_global_sanitize),)
+  ifneq ($(LOCAL_SANITIZE_BLACKLIST),)
+    my_cflags += -fsanitize-blacklist=$(LOCAL_PATH)/$(LOCAL_SANITIZE_BLACKLIST)
+  endif
+endif
+
+# Disable integer_overflow if LOCAL_NOSANITIZE=integer.
+ifneq ($(filter integer_overflow, $(my_global_sanitize) $(my_sanitize)),)
+  ifneq ($(filter integer, $(strip $(LOCAL_NOSANITIZE))),)
+    my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
+    my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
+  endif
+endif
+
 my_nosanitize = $(strip $(LOCAL_NOSANITIZE))
 ifneq ($(my_nosanitize),)
   my_sanitize := $(filter-out $(my_nosanitize),$(my_sanitize))
@@ -138,10 +175,41 @@
   ifeq ($(filter address,$(my_sanitize)),)
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): Use of 'coverage' also requires 'address')
   endif
-  my_cflags += -fsanitize-coverage=edge,indirect-calls,8bit-counters,trace-cmp
+  my_cflags += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
   my_sanitize := $(filter-out coverage,$(my_sanitize))
 endif
 
+ifneq ($(filter integer_overflow,$(my_sanitize)),)
+  ifneq ($(filter SHARED_LIBRARIES EXECUTABLES,$(LOCAL_MODULE_CLASS)),)
+    ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
+
+      # Respect LOCAL_NOSANITIZE for integer-overflow flags.
+      ifeq ($(filter signed-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),)
+        my_cflags += -fsanitize=signed-integer-overflow
+      endif
+      ifeq ($(filter unsigned-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),)
+        my_cflags += -fsanitize=unsigned-integer-overflow
+      endif
+      my_cflags += -fsanitize-trap=all
+      my_cflags += -ftrap-function=abort
+      my_cflags += $(INTEGER_OVERFLOW_EXTRA_CFLAGS)
+
+      # Check for diagnostics mode (on by default).
+      ifneq ($(filter integer_overflow,$(my_sanitize_diag)),)
+        my_cflags += -fno-sanitize-trap=signed-integer-overflow,unsigned-integer-overflow
+        my_shared_libraries := $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY) $(my_shared_libraries)
+      endif
+    endif
+  endif
+  my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
+endif
+
+# Makes sure integer_overflow diagnostics is removed from the diagnostics list
+# even if integer_overflow is not set for some reason.
+ifneq ($(filter integer_overflow,$(my_sanitize_diag)),)
+  my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
+endif
+
 ifneq ($(my_sanitize),)
   fsanitize_arg := $(subst $(space),$(comma),$(my_sanitize))
   my_cflags += -fsanitize=$(fsanitize_arg)
@@ -219,12 +287,6 @@
   endif
 endif
 
-ifneq ($(filter undefined,$(my_sanitize)),)
-  ifndef LOCAL_IS_HOST_MODULE
-    $(error ubsan is not yet supported on the target)
-  endif
-endif
-
 ifneq ($(strip $(LOCAL_SANITIZE_RECOVER)),)
   recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_RECOVER)),
   my_cflags += -fsanitize-recover=$(recover_arg)
diff --git a/core/cxx_stl_setup.mk b/core/cxx_stl_setup.mk
index fd9c442..0baec26 100644
--- a/core/cxx_stl_setup.mk
+++ b/core/cxx_stl_setup.mk
@@ -99,8 +99,6 @@
 
         ifeq ($(my_link_type),static)
             my_static_libraries += libm libc libdl
-        else
-            my_shared_libraries += libdl
         endif
     endif
 else ifeq ($(my_cxx_stl),ndk)
diff --git a/core/definitions.mk b/core/definitions.mk
index 1da169f..ffeb663 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -692,6 +692,14 @@
 $(foreach lib,$(1),$(call _java-lib-full-classes.jar,$(lib),$(2)))
 endef
 
+# Get the header jar files (you can pass to "javac -classpath") of static or shared
+# Java libraries that you want to link against.
+# $(1): library name list
+# $(2): Non-empty if IS_HOST_MODULE
+define java-lib-header-files
+$(foreach lib,$(1),$(call intermediates-dir-for, JAVA_LIBRARIES,$(lib),$(2),COMMON)/classes-header.jar)
+endef
+
 # Get the dependency files (you can put on the right side of "|" of a build rule)
 # of the Java libraries.
 # $(1): library name list
@@ -2184,6 +2192,7 @@
       exit 1; \
     fi; \
     unzip -qo $$f -d $(2); \
+    rm -f $(2)/module-info.class; \
   done
   $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,$(hide) rm -rf $(2)/META-INF)
 endef
@@ -2194,48 +2203,61 @@
  JACK_VERSION=$(PRIVATE_JACK_VERSION) $(JACK) $(DEFAULT_JACK_EXTRA_ARGS)
 endef
 
-# Common definition to invoke javac on the host and target.
+# Return jar arguments to compress files in a given directory
+# $(1): directory
 #
+# Returns an @-file argument that contains the output of a subshell
+# that looks like -C $(1) path/to/file1 -C $(1) path/to/file2
+# Also adds "-C out/empty ." which avoids errors in jar when
+# there are no files in the directory.
+define jar-args-sorted-files-in-directory
+    @<(find $(1) -type f | sort | $(JAR_ARGS) $(1); echo "-C $(EMPTY_DIRECTORY) .")
+endef
+
 # Some historical notes:
 # - below we write the list of java files to java-source-list to avoid argument
 #   list length problems with Cygwin
 # - we filter out duplicate java file names because eclipse's compiler
 #   doesn't like them.
+define write-java-source-list
+@echo "$($(PRIVATE_PREFIX)DISPLAY) Java source list: $(PRIVATE_MODULE)"
+$(hide) rm -f $@
+$(call dump-words-to-file,$(sort $(PRIVATE_JAVA_SOURCES)),$@.tmp)
+$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
+    find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $@.tmp; \
+fi
+$(if $(PRIVATE_HAS_PROTO_SOURCES), \
+    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $@.tmp)
+$(if $(PRIVATE_HAS_RS_SOURCES), \
+    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $@.tmp)
+$(hide) tr ' ' '\n' < $@.tmp | $(NORMALIZE_PATH) | sort -u > $@
+endef
+
+# Common definition to invoke javac on the host and target.
 #
 # $(1): javac
 # $(2): bootclasspath
+# $(3): classpath_libs
 define compile-java
 $(hide) rm -f $@
 $(hide) rm -rf $(PRIVATE_CLASS_INTERMEDIATES_DIR) $(PRIVATE_ANNO_INTERMEDIATES_DIR)
 $(hide) mkdir -p $(dir $@)
 $(hide) mkdir -p $(PRIVATE_CLASS_INTERMEDIATES_DIR) $(PRIVATE_ANNO_INTERMEDIATES_DIR)
 $(call unzip-jar-files,$(PRIVATE_STATIC_JAVA_LIBRARIES),$(PRIVATE_CLASS_INTERMEDIATES_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list)
-$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-          find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list; \
-fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list )
-$(hide) tr ' ' '\n' < $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list \
-    | $(NORMALIZE_PATH) | sort -u > $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq
-$(hide) if [ -s $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
     $(SOONG_JAVAC_WRAPPER) $(1) -encoding UTF-8 \
     $(if $(findstring true,$(PRIVATE_WARNINGS_ENABLE)),$(xlint_unchecked),) \
     $(2) \
     $(addprefix -classpath ,$(strip \
-        $(call normalize-path-list,$(PRIVATE_ALL_JAVA_LIBRARIES)))) \
+        $(call normalize-path-list,$(3)))) \
     $(if $(findstring true,$(PRIVATE_WARNINGS_ENABLE)),$(xlint_unchecked),) \
-    -extdirs "" -d $(PRIVATE_CLASS_INTERMEDIATES_DIR) -s $(PRIVATE_ANNO_INTERMEDIATES_DIR) \
+    -d $(PRIVATE_CLASS_INTERMEDIATES_DIR) -s $(PRIVATE_ANNO_INTERMEDIATES_DIR) \
     $(PRIVATE_JAVACFLAGS) \
-    \@$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq \
+    \@$(PRIVATE_JAVA_SOURCE_LIST) \
     || ( rm -rf $(PRIVATE_CLASS_INTERMEDIATES_DIR) ; exit 41 ) \
 fi
 $(if $(PRIVATE_JAVA_LAYERS_FILE), $(hide) build/tools/java-layers.py \
-    $(PRIVATE_JAVA_LAYERS_FILE) \@$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq,)
-$(hide) rm -f $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list
-$(hide) rm -f $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq
+    $(PRIVATE_JAVA_LAYERS_FILE) @$(PRIVATE_JAVA_SOURCE_LIST),)
 $(if $(PRIVATE_JAR_EXCLUDE_FILES), $(hide) find $(PRIVATE_CLASS_INTERMEDIATES_DIR) \
     -name $(word 1, $(PRIVATE_JAR_EXCLUDE_FILES)) \
     $(addprefix -o -name , $(wordlist 2, 999, $(PRIVATE_JAR_EXCLUDE_FILES))) \
@@ -2251,23 +2273,42 @@
 $(if $(PRIVATE_JAR_MANIFEST), \
     $(hide) sed -e "s/%BUILD_NUMBER%/$(BUILD_NUMBER_FROM_FILE)/" \
             $(PRIVATE_JAR_MANIFEST) > $(dir $@)/manifest.mf && \
-        jar -cfm $@ $(dir $@)/manifest.mf \
-            -C $(PRIVATE_CLASS_INTERMEDIATES_DIR) ., \
-    $(hide) jar -cf $@ -C $(PRIVATE_CLASS_INTERMEDIATES_DIR) .)
+        $(JAR) -cfm $@ $(dir $@)/manifest.mf, \
+    $(hide) $(JAR) -cf $@) \
+        $(call jar-args-sorted-files-in-directory,$(PRIVATE_CLASS_INTERMEDIATES_DIR))
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(call add-java-resources-to,$@))
 endef
 
 define transform-java-to-classes.jar
 @echo "$($(PRIVATE_PREFIX)DISPLAY) Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
-$(call compile-java,$(TARGET_JAVAC),$(PRIVATE_BOOTCLASSPATH))
+$(call compile-java,$(TARGET_JAVAC),$(PRIVATE_BOOTCLASSPATH),$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))
+endef
+
+define transform-java-to-header.jar
+@echo "$($(PRIVATE_PREFIX)DISPLAY) Turbine: $(PRIVATE_MODULE)"
+@mkdir -p $(dir $@)
+@rm -rf $(dir $@)/classes-turbine
+@mkdir $(dir $@)/classes-turbine
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
+    $(JAVA) -jar $(TURBINE) \
+    --output $@.tmp --temp_dir $(dir $@)/classes-turbine -$(PRIVATE_BOOTCLASSPATH) \
+    --sources \@$(PRIVATE_JAVA_SOURCE_LIST) \
+    --javacopts $(PRIVATE_JAVACFLAGS) $(COMMON_JDK_FLAGS) \
+    $(addprefix --classpath ,$(strip \
+        $(call normalize-path-list,$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)))) \
+    || ( rm -rf $(dir $@)/classes-turbine ; exit 41 ) \
+fi
+$(hide) $(call unzip-jar-files,$(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES),$(dir $@)/classes-turbine)
+$(hide) if [ -s $@.tmp ] ; then \
+    unzip -qo $@.tmp -d $(dir $@)/classes-turbine; rm -f $(dir $@)/classes-turbine/module-info.class; \
+fi
+$(hide) $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,$(hide) rm -rf $(dir $@)/classes-turbine/META-INF)
+$(hide) $(JAR) -cf $@.tmp $(call jar-args-sorted-files-in-directory,$(dir $@)/classes-turbine)
+$(hide) $(ZIPTIME) $@.tmp
+$(hide) $(call commit-change-for-toc,$@)
 endef
 
 # Invoke Jack to compile java from source to dex and jack files.
-#
-# Some historical notes:
-# - below we write the list of java files to java-source-list to avoid argument
-#   list length problems with Cygwin
-# - we filter out duplicate java file names because Jack doesn't like them.
 define jack-java-to-dex
 $(hide) rm -f $@
 $(hide) rm -f $(PRIVATE_CLASSES_JACK)
@@ -2276,17 +2317,6 @@
 $(hide) mkdir -p $(dir $(PRIVATE_CLASSES_JACK))
 $(hide) mkdir -p $(PRIVATE_JACK_INTERMEDIATES_DIR)
 $(if $(PRIVATE_JACK_INCREMENTAL_DIR),$(hide) mkdir -p $(PRIVATE_JACK_INCREMENTAL_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list)
-$(if $(PRIVATE_SOURCE_INTERMEDIATES_DIR), \
-    $(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-            find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list; \
-    fi)
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(hide) tr ' ' '\n' < $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list \
-    | $(NORMALIZE_PATH) | sort -u > $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq
 $(if $(PRIVATE_JACK_PROGUARD_FLAGS), \
     $(hide) echo -basedirectory $(CURDIR) > $@.flags; \
     echo $(PRIVATE_JACK_PROGUARD_FLAGS) >> $@.flags; \
@@ -2301,8 +2331,8 @@
     $(hide) mkdir -p $@.tmpjill.res
     $(hide) unzip -qo $(PRIVATE_JACK_IMPORT_JAR) -d $@.tmpjill.res
     $(hide) find $@.tmpjill.res -iname "*.class" -delete)
-$(hide) if [ -s $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
-    export tmpEcjArg="@$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq"; \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
+    export tmpEcjArg="@$(PRIVATE_JAVA_SOURCE_LIST)"; \
 else \
     export tmpEcjArg=""; \
 fi; \
@@ -2333,37 +2363,18 @@
     $$tmpEcjArg \
     || ( rm -rf $(PRIVATE_CLASSES_JACK); exit 41 )
 $(hide) mv $(PRIVATE_JACK_INTERMEDIATES_DIR)/classes*.dex $(dir $@)
-$(hide) rm -f $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(hide) rm -rf $@.res.tmp)
-$(hide) mv $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq $(PRIVATE_JACK_INTERMEDIATES_DIR).java-source-list
 $(if $(PRIVATE_JAR_PACKAGES), $(hide) echo unsupported options PRIVATE_JAR_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_EXCLUDE_PACKAGES), $(hide) echo unsupported options JAR_EXCLUDE_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_MANIFEST), $(hide) echo unsupported options JAR_MANIFEST in $@; exit 53)
 endef
 
 # Invoke Jack to compile java source just to check it compiles correctly.
-#
-# Some historical notes:
-# - below we write the list of java files to java-source-list to avoid argument
-#   list length problems with Cygwin
-# - we filter out duplicate java file names because Jack doesn't like them.
 define jack-check-java
 $(hide) rm -f $@
-$(hide) rm -f $@.java-source-list
-$(hide) rm -f $@.java-source-list-uniq
 $(hide) mkdir -p $(dir $@)
 $(if $(PRIVATE_JACK_INCREMENTAL_DIR),$(hide) mkdir -p $(PRIVATE_JACK_INCREMENTAL_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$@.java-source-list)
-$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-          find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $@.java-source-list; \
-fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $@.java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $@.java-source-list )
-$(hide) tr ' ' '\n' < $@.java-source-list \
-    | sort -u > $@.java-source-list-uniq
-$(hide) if [ -s $@.java-source-list-uniq ] ; then \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
 	$(call call-jack,$(PRIVATE_JACK_EXTRA_ARGS)) \
 	    $(strip $(PRIVATE_JACK_FLAGS)) \
 	    $(strip $(PRIVATE_JACK_DEBUG_FLAGS)) \
@@ -2373,7 +2384,7 @@
 	    -D jack.android.min-api-level=$(PRIVATE_JACK_MIN_SDK_VERSION) \
 	    -D jack.import.type.policy=keep-first \
 	    $(if $(PRIVATE_JACK_INCREMENTAL_DIR),--incremental-folder $(PRIVATE_JACK_INCREMENTAL_DIR)) \
-	    @$@.java-source-list-uniq; \
+	    @$(PRIVATE_JAVA_SOURCE_LIST); \
 fi
 touch $@
 endef
@@ -2409,26 +2420,6 @@
 fi
 endef
 
-# b/37756495
-IJAR_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
-
-## Rule to create a table of contents from a .jar file.
-## Must be called with $(eval).
-# $(1): A .jar file
-define _transform-jar-to-toc
-$1.toc: $1 | $(IJAR)
-	@echo Generating TOC: $$@
-	$(hide) $(IJAR_ASAN_OPTIONS) $(IJAR) $$< $$@.tmp
-	$$(call commit-change-for-toc,$$@)
-endef
-
-## Define a rule which generates .jar.toc and mark it as .KATI_RESTAT.
-# $(1): A .jar file
-define define-jar-to-toc-rule
-$(eval $(call _transform-jar-to-toc,$1))\
-$(eval .KATI_RESTAT: $1.toc)
-endef
-
 ifeq (,$(TARGET_BUILD_APPS))
 
 ## Rule to create a table of contents from a .dex file.
@@ -2459,27 +2450,12 @@
 
 
 # Invoke Jack to compile java from source to jack files without shrink or obfuscation.
-#
-# Some historical notes:
-# - below we write the list of java files to java-source-list to avoid argument
-#   list length problems with Cygwin
-# - we filter out duplicate java file names because Jack doesn't like them.
 define java-to-jack
 $(hide) rm -f $@
 $(hide) rm -rf $(PRIVATE_JACK_INTERMEDIATES_DIR)
 $(hide) mkdir -p $(dir $@)
 $(hide) mkdir -p $(PRIVATE_JACK_INTERMEDIATES_DIR)
 $(if $(PRIVATE_JACK_INCREMENTAL_DIR),$(hide) mkdir -p $(PRIVATE_JACK_INCREMENTAL_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list)
-$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-          find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list; \
-fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(hide) tr ' ' '\n' < $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list \
-    | $(NORMALIZE_PATH) | sort -u > $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq
 $(if $(PRIVATE_JACK_PROGUARD_FLAGS), \
     $(hide) echo -basedirectory $(CURDIR) > $@.flags; \
     echo $(PRIVATE_JACK_PROGUARD_FLAGS) >> $@.flags; \
@@ -2490,8 +2466,8 @@
 	$(hide) $(call add-java-resources-to,$@.res.tmp.zip)
 	$(hide) unzip -qo $@.res.tmp.zip -d $@.res.tmp
 	$(hide) rm $@.res.tmp.zip)
-$(hide) if [ -s $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
-    export tmpEcjArg="@$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq"; \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
+    export tmpEcjArg="@$(PRIVATE_JAVA_SOURCE_LIST)"; \
 else \
     export tmpEcjArg=""; \
 fi; \
@@ -2515,21 +2491,13 @@
     $(if $(PRIVATE_JACK_PROGUARD_FLAGS),--config-proguard $@.flags) \
     $$tmpEcjArg \
     || ( rm -f $@ ; exit 41 )
-$(hide) rm -f $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(hide) rm -rf $@.res.tmp)
-$(hide) mv $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq $(PRIVATE_JACK_INTERMEDIATES_DIR).java-source-list
 $(if $(PRIVATE_JAR_PACKAGES), $(hide) echo unsupported options PRIVATE_JAR_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_EXCLUDE_PACKAGES), $(hide) echo unsupported options JAR_EXCLUDE_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_MANIFEST), $(hide) echo unsupported options JAR_MANIFEST in $@; exit 53)
 endef
 
-define transform-classes.jar-to-emma
-$(hide) java -classpath $(EMMA_JAR) emma instr -outmode fullcopy -outfile \
-    $(PRIVATE_EMMA_COVERAGE_FILE) -ip $< -d $(PRIVATE_EMMA_INTERMEDIATES_DIR) \
-    $(addprefix -ix , $(PRIVATE_EMMA_COVERAGE_FILTER))
-endef
-
-define desugar-classpath
+define desugar-bootclasspath
 $(filter-out -classpath -bootclasspath "",$(subst :,$(space),$(1)))
 endef
 
@@ -2541,19 +2509,21 @@
 endef
 
 # --add-opens is required because desugar reflects via java.lang.invoke.MethodHandles.Lookup
+# --desugar_try_with_resources_if_needed=false is needed due to b/63180735, b/63901645, b/63900665
 define desugar-classes-jar
 @echo Desugar: $@
 @mkdir -p $(dir $@)
 $(hide) rm -f $@ $@.tmp
 @rm -rf $(dir $@)/desugar_dumped_classes
 @mkdir $(dir $@)/desugar_dumped_classes
-$(hide) java \
+$(hide) $(JAVA) \
     $(if $(EXPERIMENTAL_USE_OPENJDK9),--add-opens java.base/java.lang.invoke=ALL-UNNAMED,) \
     -Djdk.internal.lambda.dumpProxyClasses=$(abspath $(dir $@))/desugar_dumped_classes \
     -jar $(DESUGAR) \
     $(addprefix --bootclasspath_entry ,$(call desugar-bootclasspath,$(PRIVATE_BOOTCLASSPATH))) \
-    $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_LIBRARIES)) \
+    $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)) \
     --min_sdk_version $(call codename-or-sdk-to-sdk,$(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
+    --desugar_try_with_resources_if_needed=false \
     --allow_empty_bootclasspath \
     $(if $(filter --core-library,$(PRIVATE_DX_FLAGS)),--core_library) \
     -i $< -o $@.tmp
@@ -2585,7 +2555,7 @@
 define create-empty-package-at
 @mkdir -p $(dir $(1))
 $(hide) touch $(dir $(1))zipdummy
-$(hide) (cd $(dir $(1)) && jar cf $(notdir $(1)) zipdummy)
+$(hide) $(JAR) cf $(1) -C $(dir $(1)) zipdummy
 $(hide) zip -qd $(1) zipdummy
 $(hide) rm $(dir $(1))zipdummy
 endef
@@ -2679,37 +2649,49 @@
 #
 define add-java-resources-to
 $(call dump-words-to-file, $(PRIVATE_EXTRA_JAR_ARGS), $(1).jar-arg-list)
-$(hide) jar uf $(1) @$(1).jar-arg-list
+$(hide) $(JAR) uf $(1) @$(1).jar-arg-list
 @rm -f $(1).jar-arg-list
 endef
 
 # Add resources carried by static Jack libraries.
 #
 define add-carried-jack-resources
+$(call add-carried-jack-resources-to,$@)
+endef
+
+# $(1) the target jar.
+define add-carried-jack-resources-to
  $(hide) if [ -d $(PRIVATE_JACK_INTERMEDIATES_DIR) ] ; then \
     find $(PRIVATE_JACK_INTERMEDIATES_DIR) -type f | sort \
         | sed -e "s?^$(PRIVATE_JACK_INTERMEDIATES_DIR)/? -C \"$(PRIVATE_JACK_INTERMEDIATES_DIR)\" \"?" -e "s/$$/\"/" \
-        > $(dir $@)jack_res_jar_flags; \
-    if [ -s $(dir $@)jack_res_jar_flags ] ; then \
-        jar uf $@ @$(dir $@)jack_res_jar_flags; \
+        > $(dir $(1))jack_res_jar_flags; \
+    if [ -s $(dir $(1))jack_res_jar_flags ] ; then \
+        $(JAR) uf $(1) @$(dir $(1))jack_res_jar_flags; \
     fi; \
 fi
 endef
 
+# Add resources (non .class files) from a jar to a package
+# $(1): the package file
+# $(2): the jar file
+# $(3): temporary directory
+define add-jar-resources-to-package
+  rm -rf $(3)
+  mkdir -p $(3)
+  unzip -qo $(2) -d $(3) $$(zipinfo -1 $(2) | grep -v -E "\.class$$")
+  $(JAR) uf $(1) $(call jar-args-sorted-files-in-directory,$(3))
+endef
+
 # Sign a package using the specified key/cert.
 #
 define sign-package
 $(call sign-package-arg,$@)
 endef
 
-# signapk uses internal APIs from sun.security.{pkcs,x509}; see http://b/37137869
 # $(1): the package file we are signing.
 define sign-package-arg
 $(hide) mv $(1) $(1).unsigned
-$(hide) java -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) \
-    $(if $(EXPERIMENTAL_USE_OPENJDK9),--add-exports java.base/sun.security.pkcs=ALL-UNNAMED,) \
-    $(if $(EXPERIMENTAL_USE_OPENJDK9),--add-exports java.base/sun.security.x509=ALL-UNNAMED,) \
-    -jar $(SIGNAPK_JAR) \
+$(hide) $(JAVA) -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) -jar $(SIGNAPK_JAR) \
     $(PRIVATE_CERTIFICATE) $(PRIVATE_PRIVATE_KEY) \
     $(PRIVATE_ADDITIONAL_CERTIFICATES) $(1).unsigned $(1).signed
 $(hide) mv $(1).signed $(1)
@@ -2754,8 +2736,15 @@
 # Note: we intentionally don't clean PRIVATE_CLASS_INTERMEDIATES_DIR
 # in transform-java-to-classes for the sake of vm-tests.
 define transform-host-java-to-package
-@echo "$($(PRIVATE_PREFIX)DISPLAY) Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
-$(call compile-java,$(HOST_JAVAC),$(PRIVATE_BOOTCLASSPATH))
+@echo "Host Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
+$(call compile-java,$(HOST_JAVAC),$(PRIVATE_BOOTCLASSPATH),$(PRIVATE_ALL_JAVA_LIBRARIES))
+endef
+
+# Note: we intentionally don't clean PRIVATE_CLASS_INTERMEDIATES_DIR
+# in transform-java-to-classes for the sake of vm-tests.
+define transform-host-java-to-dalvik-package
+@echo "Dalvik Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
+$(call compile-java,$(HOST_JAVAC),$(PRIVATE_BOOTCLASSPATH),$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))
 endef
 
 ###########################################################
diff --git a/core/dex_preopt.mk b/core/dex_preopt.mk
index 0606c83..439f7e5 100644
--- a/core/dex_preopt.mk
+++ b/core/dex_preopt.mk
@@ -24,7 +24,12 @@
 SYSTEM_OTHER_ODEX_FILTER ?= app/% priv-app/%
 
 # Method returning whether the install path $(1) should be for system_other.
+# Under SANITIZE_LITE, we do not want system_other. Just put things under /data/asan.
+ifeq ($(SANITIZE_LITE),true)
+install-on-system-other =
+else
 install-on-system-other = $(filter-out $(PRODUCT_DEXPREOPT_SPEED_APPS) $(PRODUCT_SYSTEM_SERVER_APPS),$(basename $(notdir $(filter $(foreach f,$(SYSTEM_OTHER_ODEX_FILTER),$(TARGET_OUT)/$(f)),$(1)))))
+endif
 
 # The default values for pre-opting: always preopt PIC.
 # Conditional to building on linux, as dex2oat currently does not work on darwin.
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index 9db5dbf..9616036 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -11,9 +11,9 @@
 DEX2OAT := $(HOST_OUT_EXECUTABLES)/dex2oatd$(HOST_EXECUTABLE_SUFFIX)
 endif
 
-# Pass special classpath to skip uses library check.
+# Pass special class loader context to skip the classpath and collision check.
 # Should modify build system to pass used libraries properly later.
-DEX2OAT_CLASSPATH := "&"
+DEX2OAT_CLASS_LOADER_CONTEXT := "&"
 
 DEX2OAT_DEPENDENCY += $(DEX2OAT)
 
@@ -25,6 +25,10 @@
 COMPILED_CLASSES := $(call word-colon,1,$(firstword \
     $(filter %system/etc/compiled-classes,$(PRODUCT_COPY_FILES))))
 
+# Use the first dirty-image-objects file in PRODUCT_COPY_FILES.
+DIRTY_IMAGE_OBJECTS := $(call word-colon,1,$(firstword \
+    $(filter %system/etc/dirty-image-objects,$(PRODUCT_COPY_FILES))))
+
 define get-product-default-property
 $(strip $(patsubst $(1)=%,%,$(filter $(1)=%,$(PRODUCT_DEFAULT_PROPERTY_OVERRIDES))))
 endef
@@ -88,6 +92,42 @@
 LIBART_TARGET_BOOT_ART_EXTRA_FILES := $(foreach jar,$(wordlist 2,999,$(LIBART_TARGET_BOOT_JARS)),boot-$(jar).art boot-$(jar).oat boot-$(jar).vdex)
 LIBART_TARGET_BOOT_ART_EXTRA_FILES += boot.oat boot.vdex
 
+# If we use a boot image profile.
+my_use_profile_for_boot_image := $(PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE)
+ifeq (,$(my_use_profile_for_boot_image))
+# If not set, use the default.
+my_use_profile_for_boot_image := false
+endif
+
+ifeq (true,$(my_use_profile_for_boot_image))
+
+# Location of text based profile for the boot image.
+my_boot_image_profile_location := $(PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION)
+ifeq (,$(my_boot_image_profile_location))
+# If not set, use the default.
+my_boot_image_profile_location := frameworks/base/config/boot-image-profile.txt
+endif
+
+# Code to create the boot image profile, not in dex_preopt_libart_boot.mk since the profile is the same for all archs.
+my_out_boot_image_profile_location := $(DEXPREOPT_BOOT_JAR_DIR_FULL_PATH)/boot.prof
+$(my_out_boot_image_profile_location): PRIVATE_PROFILE_INPUT_LOCATION := $(my_boot_image_profile_location)
+$(my_out_boot_image_profile_location): $(PROFMAN) $(LIBART_TARGET_BOOT_DEX_FILES) $(my_boot_image_profile_location)
+	@echo "target profman: $@"
+	@mkdir -p $(dir $@)
+	ANDROID_LOG_TAGS="*:e" $(PROFMAN) \
+		--create-profile-from=$(PRIVATE_PROFILE_INPUT_LOCATION) \
+		$(addprefix --apk=,$(LIBART_TARGET_BOOT_DEX_FILES)) \
+		$(addprefix --dex-location=,$(LIBART_TARGET_BOOT_DEX_LOCATIONS)) \
+		--reference-profile-file=$@
+
+# We want to install the profile even if we are not using preopt since it is required to generate
+# the image on the device.
+my_installed_profile := $(TARGET_OUT)/etc/boot-image.prof
+$(eval $(call copy-one-file,$(my_out_boot_image_profile_location),$(my_installed_profile)))
+ALL_DEFAULT_INSTALLED_MODULES += $(my_installed_profile)
+
+endif
+
 my_2nd_arch_prefix :=
 include $(BUILD_SYSTEM)/dex_preopt_libart_boot.mk
 
@@ -110,7 +150,7 @@
 $(hide) mkdir -p $(dir $(2))
 $(hide) ANDROID_LOG_TAGS="*:e" $(DEX2OAT) \
 	--runtime-arg -Xms$(DEX2OAT_XMS) --runtime-arg -Xmx$(DEX2OAT_XMX) \
-	--runtime-arg -classpath --runtime-arg $(DEX2OAT_CLASSPATH) \
+	--class-loader-context=$(DEX2OAT_CLASS_LOADER_CONTEXT) \
 	--boot-image=$(PRIVATE_DEX_PREOPT_IMAGE_LOCATION) \
 	--dex-file=$(1) \
 	--dex-location=$(PRIVATE_DEX_LOCATION) \
diff --git a/core/dex_preopt_libart_boot.mk b/core/dex_preopt_libart_boot.mk
index 860a66a..a06aaca 100644
--- a/core/dex_preopt_libart_boot.mk
+++ b/core/dex_preopt_libart_boot.mk
@@ -37,6 +37,12 @@
   COMPILED_CLASSES_FLAGS := --compiled-classes=$(COMPILED_CLASSES)
 endif
 
+# If we have a dirty-image-objects file, create a parameter.
+DIRTY_IMAGE_OBJECTS_FLAGS :=
+ifneq ($(DIRTY_IMAGE_OBJECTS),)
+  DIRTY_IMAGE_OBJECTS_FLAGS := --dirty-image-objects=$(DIRTY_IMAGE_OBJECTS)
+endif
+
 # The rule to install boot.art
 # Depends on installed boot.oat, boot-*.art, boot-*.oat
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_INSTALLED_IMAGE) : $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME) | $(ACP) $($(my_2nd_arch_prefix)LIBART_TARGET_BOOT_ART_EXTRA_INSTALLED_FILES)
@@ -50,18 +56,34 @@
 	@mkdir -p $(dir $@)
 	$(hide) $(ACP) -fp $(dir $<)$(notdir $@) $@
 
+ifeq (,$(my_out_boot_image_profile_location))
+my_boot_image_flags := $(COMPILED_CLASSES_FLAGS)
+my_boot_image_flags += --image-classes=$(PRELOADED_CLASSES)
+my_boot_image_flags += $(DIRTY_IMAGE_OBJECTS_FLAGS)
+else
+my_boot_image_flags := --compiler-filter=speed-profile
+my_boot_image_flags += --profile-file=$(my_out_boot_image_profile_location)
+endif
+
+ifneq (addresstrue,$(SANITIZE_TARGET)$(SANITIZE_LITE))
+# Skip recompiling the boot image for the second sanitization phase. We'll get separate paths
+# and invalidate first-stage artifacts which are crucial to SANITIZE_LITE builds.
+# Note: this is technically incorrect. Compiled code contains stack checks which may depend
+#       on ASAN settings.
+
+$($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_BOOT_IMAGE_FLAGS := $(my_boot_image_flags)
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_2ND_ARCH_VAR_PREFIX := $(my_2nd_arch_prefix)
 # Use dex2oat debug version for better error reporting
-$($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME) : $(LIBART_TARGET_BOOT_DEX_FILES) $(PRELOADED_CLASSES) $(COMPILED_CLASSES) $(DEX2OAT_DEPENDENCY)
+$($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME) : $(LIBART_TARGET_BOOT_DEX_FILES) $(PRELOADED_CLASSES) $(COMPILED_CLASSES) $(DIRTY_IMAGE_OBJECTS) $(DEX2OAT_DEPENDENCY) $(my_out_boot_image_profile_location)
 	@echo "target dex2oat: $@"
 	@mkdir -p $(dir $@)
 	@mkdir -p $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))
 	@rm -f $(dir $@)/*.art $(dir $@)/*.oat
 	@rm -f $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))/*.art
 	@rm -f $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))/*.oat
-	$(hide) ANDROID_LOG_TAGS="*:e" $(DEX2OAT) --runtime-arg -Xms$(DEX2OAT_IMAGE_XMS) \
+	$(DEX2OAT) --runtime-arg -Xms$(DEX2OAT_IMAGE_XMS) \
 		--runtime-arg -Xmx$(DEX2OAT_IMAGE_XMX) \
-		--image-classes=$(PRELOADED_CLASSES) \
+		$(PRIVATE_BOOT_IMAGE_FLAGS) \
 		$(addprefix --dex-file=,$(LIBART_TARGET_BOOT_DEX_FILES)) \
 		$(addprefix --dex-location=,$(LIBART_TARGET_BOOT_DEX_LOCATIONS)) \
 		--oat-symbols=$($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED) \
@@ -75,4 +97,6 @@
 		--runtime-arg -Xnorelocate --compile-pic \
 		--no-generate-debug-info --generate-build-id \
 		--multi-image --no-inline-from=core-oj.jar \
-		$(PRODUCT_DEX_PREOPT_BOOT_FLAGS) $(GLOBAL_DEXPREOPT_FLAGS) $(COMPILED_CLASSES_FLAGS) $(ART_BOOT_IMAGE_EXTRA_ARGS)
+		$(PRODUCT_DEX_PREOPT_BOOT_FLAGS) $(GLOBAL_DEXPREOPT_FLAGS) $(ART_BOOT_IMAGE_EXTRA_ARGS)
+
+endif
diff --git a/core/dex_preopt_odex_install.mk b/core/dex_preopt_odex_install.mk
index 2b401f0..136def4 100644
--- a/core/dex_preopt_odex_install.mk
+++ b/core/dex_preopt_odex_install.mk
@@ -175,22 +175,47 @@
 endif
 endif
 
-ifneq (,$(filter $(PRODUCT_SYSTEM_SERVER_JARS) $(PRODUCT_DEXPREOPT_SPEED_APPS) $(PRODUCT_SYSTEM_SERVER_APPS),$(LOCAL_MODULE)))
-  # Jars of system server, apps loaded into system server, and apps the product wants to be
-  # compiled with the 'speed' compiler filter.
-  LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=speed
-else
-  # If no compiler filter is specified, default to 'quicken' to save on storage.
-  ifeq (,$(filter --compiler-filter=%, $(LOCAL_DEX_PREOPT_FLAGS)))
-    ifeq (true,$(LOCAL_DEX_PREOPT_GENERATE_PROFILE))
-      # For non system server jars, use speed-profile when we have a profile.
-      LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=speed-profile
+my_system_server_compiler_filter := $(PRODUCT_SYSTEM_SERVER_COMPILER_FILTER)
+ifeq (,$(my_system_server_compiler_filter))
+my_system_server_compiler_filter := speed
+endif
+
+ifeq (,$(filter --compiler-filter=%, $(LOCAL_DEX_PREOPT_FLAGS)))
+  ifneq (,$(filter $(PRODUCT_SYSTEM_SERVER_JARS),$(LOCAL_MODULE)))
+    # Jars of system server, use the product option if it is set, speed otherwise.
+    LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=$(my_system_server_compiler_filter)
+  else
+    ifneq (,$(filter $(PRODUCT_DEXPREOPT_SPEED_APPS) $(PRODUCT_SYSTEM_SERVER_APPS),$(LOCAL_MODULE)))
+      # Apps loaded into system server, and apps the product default to being compiled with the
+      # 'speed' compiler filter.
+      LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=speed
     else
-      LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=quicken
+      ifeq (true,$(LOCAL_DEX_PREOPT_GENERATE_PROFILE))
+        # For non system server jars, use speed-profile when we have a profile.
+        LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=speed-profile
+      else
+        # If no compiler filter is specified, default to 'quicken' to save on storage.
+        LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=quicken
+      endif
     endif
   endif
 endif
 
+# PRODUCT_SYSTEM_SERVER_DEBUG_INFO overrides WITH_DEXPREOPT_DEBUG_INFO.
+my_system_server_debug_info := $(PRODUCT_SYSTEM_SERVER_DEBUG_INFO)
+ifeq (,$(filter eng, $(TARGET_BUILD_VARIANT)))
+# Only enable for non-eng builds.
+ifeq (,$(my_system_server_debug_info))
+my_system_server_debug_info := true
+endif
+endif
+
+ifeq (true, $(my_system_server_debug_info))
+  ifneq (,$(filter $(PRODUCT_SYSTEM_SERVER_JARS),$(LOCAL_MODULE)))
+    LOCAL_DEX_PREOPT_FLAGS += --generate-mini-debug-info
+  endif
+endif
+
 $(built_odex): PRIVATE_DEX_PREOPT_FLAGS := $(LOCAL_DEX_PREOPT_FLAGS)
 $(built_vdex): $(built_odex)
 $(built_art): $(built_odex)
diff --git a/core/droiddoc.mk b/core/droiddoc.mk
index 27e44a0..2676b44 100644
--- a/core/droiddoc.mk
+++ b/core/droiddoc.mk
@@ -86,8 +86,7 @@
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES)) $(LOCAL_CLASSPATH)
 endif # !LOCAL_IS_HOST_MODULE
 
-$(full_target): PRIVATE_CLASSPATH := $(subst $(space),:,$(full_java_libs))
-
+$(full_target): PRIVATE_CLASSPATH := $(call normalize-path-list,$(full_java_libs))
 
 intermediates.COMMON := $(call local-intermediates-dir,COMMON)
 
@@ -130,7 +129,13 @@
 ##
 
 droiddoc_templates := \
-    $(sort $(shell find $(LOCAL_DROIDDOC_CUSTOM_TEMPLATE_DIR) -type f))
+    $(sort $(shell find $(LOCAL_DROIDDOC_CUSTOM_TEMPLATE_DIR) -type f $(if $(ALLOW_MISSING_DEPENDENCIES),2>/dev/null)))
+
+ifdef ALLOW_MISSING_DEPENDENCIES
+  ifndef droiddoc_templates
+    droiddoc_templates := $(LOCAL_DROIDDOC_CUSTOM_TEMPLATE_DIR)
+  endif
+endif
 
 droiddoc := \
 	$(HOST_JDK_TOOLS_JAR) \
@@ -160,6 +165,10 @@
 # TODO: not clear if this is used any more
 $(full_target): PRIVATE_LOCAL_PATH := $(LOCAL_PATH)
 
+# TODO(tobiast): Clean this up once we move to -source 1.9.
+# OpenJDK 9 does not have the concept of a "boot classpath" so we should
+# then rename PRIVATE_BOOTCLASSPATH to PRIVATE_MODULE or similar. For now,
+# keep -bootclasspath here since it works in combination with -source 1.8.
 $(full_target): \
         $(full_src_files) \
         $(droiddoc_templates) \
@@ -173,7 +182,7 @@
 	$(call prepare-doc-source-list,$(PRIVATE_SRC_LIST_FILE),$(PRIVATE_JAVA_FILES), \
 			$(PRIVATE_SOURCE_INTERMEDIATES_DIR) $(PRIVATE_ADDITIONAL_JAVA_DIR))
 	$(hide) ( \
-		javadoc \
+		$(JAVADOC) \
                 -encoding UTF-8 \
                 -source 1.8 \
                 \@$(PRIVATE_SRC_LIST_FILE) \
@@ -205,13 +214,25 @@
 ## standard doclet only
 ##
 ##
+
+ifneq ($(EXPERIMENTAL_USE_OPENJDK9),)
+# For OpenJDK 9 we use --patch-module to define the core libraries code.
+# TODO(tobiast): Reorganize this when adding proper support for OpenJDK 9
+# modules. Here we treat all code in core libraries as being in java.base
+# to work around the OpenJDK 9 module system. http://b/62049770
+$(full_target): PRIVATE_BOOTCLASSPATH_ARG := --patch-module=java.base=$(PRIVATE_BOOTCLASSPATH)
+else
+# For OpenJDK 8 we can use -bootclasspath to define the core libraries code.
+$(full_target): PRIVATE_BOOTCLASSPATH_ARG := $(addprefix -bootclasspath ,$(PRIVATE_BOOTCLASSPATH))
+endif
+
 $(full_target): $(full_src_files) $(full_java_lib_deps)
 	@echo Docs javadoc: $(PRIVATE_OUT_DIR)
 	@mkdir -p $(dir $@)
 	$(call prepare-doc-source-list,$(PRIVATE_SRC_LIST_FILE),$(PRIVATE_JAVA_FILES), \
 			$(PRIVATE_SOURCE_INTERMEDIATES_DIR) $(PRIVATE_ADDITIONAL_JAVA_DIR))
 	$(hide) ( \
-		javadoc \
+		$(JAVADOC) \
                 -encoding UTF-8 \
                 $(PRIVATE_DROIDDOC_OPTIONS) \
                 \@$(PRIVATE_SRC_LIST_FILE) \
@@ -220,7 +241,7 @@
                 -Xdoclint:none \
                 $(PRIVATE_PROFILING_OPTIONS) \
                 $(addprefix -classpath ,$(PRIVATE_CLASSPATH)) \
-                $(addprefix -bootclasspath ,$(PRIVATE_BOOTCLASSPATH)) \
+                $(PRIVATE_BOOTCLASSPATH_ARG) \
                 -sourcepath $(PRIVATE_SOURCE_PATH)$(addprefix :,$(PRIVATE_CLASSPATH)) \
                 -d $(PRIVATE_OUT_DIR) \
                 -quiet \
diff --git a/core/dynamic_binary.mk b/core/dynamic_binary.mk
index 949793b..f44b8a8 100644
--- a/core/dynamic_binary.mk
+++ b/core/dynamic_binary.mk
@@ -99,10 +99,15 @@
 my_breakpad_path := $(TARGET_OUT_BREAKPAD)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
 breakpad_input := $(relocation_packer_output)
 breakpad_output := $(my_breakpad_path)/$(my_installed_module_stem).sym
-$(breakpad_output) : $(breakpad_input) | $(BREAKPAD_DUMP_SYMS)
+$(breakpad_output) : $(breakpad_input) | $(BREAKPAD_DUMP_SYMS) $(PRIVATE_READELF)
 	@echo "target breakpad: $(PRIVATE_MODULE) ($@)"
 	@mkdir -p $(dir $@)
-	$(hide) $(BREAKPAD_DUMP_SYMS) -c $< > $@
+	$(hide) if $(PRIVATE_READELF) -S $< > /dev/null 2>&1 ; then \
+	  $(BREAKPAD_DUMP_SYMS) -c $< > $@ ; \
+	else \
+	  echo "skipped for non-elf file."; \
+	  touch $@; \
+	fi
 $(LOCAL_BUILT_MODULE) : $(breakpad_output)
 endif
 
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 43593e6..db6ddd4 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -97,8 +97,6 @@
 # compiles except for arm/mips, so the HOST is whatever we are
 # running on
 
-UNAME := $(shell uname -sm)
-
 # HOST_OS
 ifneq (,$(findstring Linux,$(UNAME)))
   HOST_OS := linux
@@ -110,7 +108,15 @@
   HOST_OS := darwin
 endif
 
-HOST_OS_EXTRA:=$(shell python -c "import platform; print(platform.platform())")
+HOST_OS_EXTRA := $(shell uname -rsm)
+ifeq ($(HOST_OS),linux)
+  ifneq ($(wildcard /etc/os-release),)
+    HOST_OS_EXTRA += $(shell source /etc/os-release; echo $$PRETTY_NAME)
+  endif
+else ifeq ($(HOST_OS),darwin)
+  HOST_OS_EXTRA += $(shell sw_vers -productVersion)
+endif
+HOST_OS_EXTRA := $(subst $(space),-,$(HOST_OS_EXTRA))
 
 # BUILD_OS is the real host doing the build.
 BUILD_OS := $(HOST_OS)
@@ -190,6 +196,13 @@
 TARGET_COPY_OUT_VENDOR := $(_vendor_path_placeholder)
 ###########################################
 
+#################################################################
+# Set up minimal BOOTCLASSPATH list of jars to build/execute
+# java code with dalvikvm/art.
+TARGET_CORE_JARS := core-oj core-libart conscrypt okhttp bouncycastle apache-xml
+HOST_CORE_JARS := $(addsuffix -hostdex,$(TARGET_CORE_JARS))
+#################################################################
+
 # Read the product specs so we can get TARGET_DEVICE and other
 # variables that we need in order to locate the output files.
 include $(BUILD_SYSTEM)/product_config.mk
@@ -266,6 +279,10 @@
   ifneq ($(BOARD_VNDK_VERSION),current)
     $(error BOARD_VNDK_VERSION: Only "current" is implemented)
   endif
+
+  TARGET_VENDOR_TEST_SUFFIX := /vendor
+else
+  TARGET_VENDOR_TEST_SUFFIX :=
 endif
 
 # ---------------------------------------------------------------
@@ -298,29 +315,17 @@
 
 SOONG_OUT_DIR := $(OUT_DIR)/soong
 
-DEBUG_OUT_DIR := $(OUT_DIR)/debug
+TARGET_OUT_ROOT := $(OUT_DIR)/target
 
-# Move the host or target under the debug/ directory
-# if necessary.
-TARGET_OUT_ROOT_release := $(OUT_DIR)/target
-TARGET_OUT_ROOT_debug := $(DEBUG_OUT_DIR)/target
-TARGET_OUT_ROOT := $(TARGET_OUT_ROOT_$(TARGET_BUILD_TYPE))
-
-HOST_OUT_ROOT_release := $(OUT_DIR)/host
-HOST_OUT_ROOT_debug := $(DEBUG_OUT_DIR)/host
-HOST_OUT_ROOT := $(HOST_OUT_ROOT_$(HOST_BUILD_TYPE))
+HOST_OUT_ROOT := $(OUT_DIR)/host
 
 # We want to avoid two host bin directories in multilib build.
-HOST_OUT_release := $(HOST_OUT_ROOT_release)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
-HOST_OUT_debug := $(HOST_OUT_ROOT_debug)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
-HOST_OUT := $(HOST_OUT_$(HOST_BUILD_TYPE))
+HOST_OUT := $(HOST_OUT_ROOT)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
 SOONG_HOST_OUT := $(SOONG_OUT_DIR)/host/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
 # TODO: remove
 BUILD_OUT := $(HOST_OUT)
 
-HOST_CROSS_OUT_release := $(HOST_OUT_ROOT_release)/windows-$(HOST_PREBUILT_ARCH)
-HOST_CROSS_OUT_debug := $(HOST_OUT_ROOT_debug)/windows-$(HOST_PREBUILT_ARCH)
-HOST_CROSS_OUT := $(HOST_CROSS_OUT_$(HOST_BUILD_TYPE))
+HOST_CROSS_OUT := $(HOST_OUT_ROOT)/windows-$(HOST_PREBUILT_ARCH)
 
 TARGET_PRODUCT_OUT_ROOT := $(TARGET_OUT_ROOT)/product
 
@@ -410,8 +415,16 @@
 TARGET_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_SYSTEM)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
 target_out_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/system
+ifeq ($(SANITIZE_LITE),true)
+# When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
+# work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
+target_out_app_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/system
+else
+target_out_app_base := $(TARGET_OUT)
+endif
 else
 target_out_shared_libraries_base := $(TARGET_OUT)
+target_out_app_base := $(TARGET_OUT)
 endif
 
 TARGET_OUT_EXECUTABLES := $(TARGET_OUT)/bin
@@ -425,8 +438,8 @@
 endif
 TARGET_OUT_RENDERSCRIPT_BITCODE := $(TARGET_OUT_SHARED_LIBRARIES)
 TARGET_OUT_JAVA_LIBRARIES := $(TARGET_OUT)/framework
-TARGET_OUT_APPS := $(TARGET_OUT)/app
-TARGET_OUT_APPS_PRIVILEGED := $(TARGET_OUT)/priv-app
+TARGET_OUT_APPS := $(target_out_app_base)/app
+TARGET_OUT_APPS_PRIVILEGED := $(target_out_app_base)/priv-app
 TARGET_OUT_KEYLAYOUT := $(TARGET_OUT)/usr/keylayout
 TARGET_OUT_KEYCHARS := $(TARGET_OUT)/usr/keychars
 TARGET_OUT_ETC := $(TARGET_OUT)/etc
@@ -434,7 +447,13 @@
 TARGET_OUT_FAKE := $(PRODUCT_OUT)/fake_packages
 TARGET_OUT_TESTCASES := $(PRODUCT_OUT)/testcases
 
+ifeq ($(SANITIZE_LITE),true)
+# When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
+# work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
+TARGET_OUT_SYSTEM_OTHER := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/$(TARGET_COPY_OUT_SYSTEM_OTHER)
+else
 TARGET_OUT_SYSTEM_OTHER := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_SYSTEM_OTHER)
+endif
 
 # Out for TARGET_2ND_ARCH
 TARGET_2ND_ARCH_VAR_PREFIX := $(HOST_2ND_ARCH_VAR_PREFIX)
@@ -473,9 +492,13 @@
 ifeq ($(TARGET_IS_64_BIT),true)
 TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest64
 TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest64
+TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest64$(TARGET_VENDOR_TEST_SUFFIX)
+TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest64$(TARGET_VENDOR_TEST_SUFFIX)
 else
 TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest
 TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest
+TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest$(TARGET_VENDOR_TEST_SUFFIX)
+TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest$(TARGET_VENDOR_TEST_SUFFIX)
 endif
 TARGET_OUT_DATA_FAKE := $(TARGET_OUT_DATA)/fake_packages
 
@@ -485,9 +508,13 @@
 ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest/$(TARGET_2ND_ARCH)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest/$(TARGET_2ND_ARCH)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest/$(TARGET_2ND_ARCH)$(TARGET_VENDOR_TEST_SUFFIX)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest/$(TARGET_2ND_ARCH)$(TARGET_VENDOR_TEST_SUFFIX)
 else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest$(TARGET_VENDOR_TEST_SUFFIX)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest$(TARGET_VENDOR_TEST_SUFFIX)
 endif
 
 TARGET_OUT_CACHE := $(PRODUCT_OUT)/cache
@@ -495,8 +522,16 @@
 TARGET_OUT_VENDOR := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_VENDOR)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
 target_out_vendor_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/vendor
+ifeq ($(SANITIZE_LITE),true)
+# When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
+# work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
+target_out_vendor_app_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/vendor
+else
+target_out_vendor_app_base := $(TARGET_OUT_VENDOR)
+endif
 else
 target_out_vendor_shared_libraries_base := $(TARGET_OUT_VENDOR)
+target_out_vendor_app_base := $(TARGET_OUT_VENDOR)
 endif
 
 TARGET_OUT_VENDOR_EXECUTABLES := $(TARGET_OUT_VENDOR)/bin
@@ -508,8 +543,8 @@
 endif
 TARGET_OUT_VENDOR_RENDERSCRIPT_BITCODE := $(TARGET_OUT_VENDOR_SHARED_LIBRARIES)
 TARGET_OUT_VENDOR_JAVA_LIBRARIES := $(TARGET_OUT_VENDOR)/framework
-TARGET_OUT_VENDOR_APPS := $(TARGET_OUT_VENDOR)/app
-TARGET_OUT_VENDOR_APPS_PRIVILEGED := $(TARGET_OUT_VENDOR)/priv-app
+TARGET_OUT_VENDOR_APPS := $(target_out_vendor_app_base)/app
+TARGET_OUT_VENDOR_APPS_PRIVILEGED := $(target_out_vendor_app_base)/priv-app
 TARGET_OUT_VENDOR_ETC := $(TARGET_OUT_VENDOR)/etc
 
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_EXECUTABLES := $(TARGET_OUT_VENDOR_EXECUTABLES)
diff --git a/core/find-jdk-tools-jar.sh b/core/find-jdk-tools-jar.sh
deleted file mode 100755
index ac0b3b6..0000000
--- a/core/find-jdk-tools-jar.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-if [ "x$ANDROID_JAVA_HOME" != x ] && [ -e "$ANDROID_JAVA_HOME/lib/tools.jar" ] ; then
-    echo $ANDROID_JAVA_HOME/lib/tools.jar
-else
-    JAVAC=$(realpath $(which javac) 2>/dev/null)
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(readlink -f $(which javac) 2>/dev/null)
-    fi
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(which javac)
-    fi
-    if [ -z "$JAVAC" ] ; then
-        exit 1
-    fi
-    while [ -L "$JAVAC" ] ; do
-        LSLINE=$(ls -l "$JAVAC")
-        JAVAC=$(echo -n "$LSLINE" | sed -e "s/.* -> //")
-    done
-    echo $JAVAC | sed -e 's:\(.*\)/javac$:\1/../lib/tools.jar:'
-fi
diff --git a/core/fuzz_test.mk b/core/fuzz_test.mk
index 4d41871..7e3995a 100644
--- a/core/fuzz_test.mk
+++ b/core/fuzz_test.mk
@@ -8,7 +8,7 @@
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): NDK fuzz tests are not supported.)
 endif
 
-LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard
+LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
 LOCAL_STATIC_LIBRARIES += libFuzzer
 
 ifdef LOCAL_MODULE_PATH
diff --git a/core/goma.mk b/core/goma.mk
index 4e8318a..2fb37a7 100644
--- a/core/goma.mk
+++ b/core/goma.mk
@@ -45,6 +45,7 @@
   # use both ccache and gomacc.
   CC_WRAPPER := $(strip $(CC_WRAPPER) $(GOMA_CC))
   CXX_WRAPPER := $(strip $(CXX_WRAPPER) $(GOMA_CC))
+  JAVAC_WRAPPER := $(strip $(JAVAC_WRAPPER) $(GOMA_CC))
 
   # gomacc can start goma client's daemon process automatically, but
   # it is safer and faster to start up it beforehand. We run this as a
diff --git a/core/help.mk b/core/help.mk
deleted file mode 100644
index c034e79..0000000
--- a/core/help.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-#
-# Copyright (C) 2010 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-.PHONY: help
-help:
-	@echo
-	@echo "Common make targets:"
-	@echo "----------------------------------------------------------------------------------"
-	@echo "droid                   Default target"
-	@echo "clean                   (aka clobber) equivalent to rm -rf out/"
-	@echo "snod                    Quickly rebuild the system image from built packages"
-	@echo "vnod                    Quickly rebuild the vendor image from built packages"
-	@echo "offline-sdk-docs        Generate the HTML for the developer SDK docs"
-	@echo "doc-comment-check-docs  Check HTML doc links & validity, without generating HTML"
-	@echo "libandroid_runtime      All the JNI framework stuff"
-	@echo "framework               All the java framework stuff"
-	@echo "services                The system server (Java) and friends"
-	@echo "help                    You're reading it right now"
-
-.PHONY: out
-out:
-	@echo "I'm sure you're nice and all, but no thanks."
diff --git a/core/host_dalvik_java_library.mk b/core/host_dalvik_java_library.mk
index 7101229..241cf6e 100644
--- a/core/host_dalvik_java_library.mk
+++ b/core/host_dalvik_java_library.mk
@@ -42,6 +42,9 @@
   LOCAL_JAVA_LIBRARIES :=  core-oj-hostdex core-libart-hostdex $(LOCAL_JAVA_LIBRARIES)
 endif
 
+full_classes_turbine_jar := $(intermediates.COMMON)/classes-turbine.jar
+full_classes_header_jarjar := $(intermediates.COMMON)/classes-header-jarjar.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
 full_classes_compiled_jar := $(intermediates.COMMON)/classes-full-debug.jar
 full_classes_desugar_jar := $(intermediates.COMMON)/desugar.classes.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/classes-jarjar.jar
@@ -49,15 +52,18 @@
 full_classes_jack := $(intermediates.COMMON)/classes.jack
 jack_check_timestamp := $(intermediates.COMMON)/jack.check.timestamp
 built_dex := $(intermediates.COMMON)/classes.dex
+java_source_list_file := $(intermediates.COMMON)/java-source-list
 
 LOCAL_INTERMEDIATE_TARGETS += \
+    $(full_classes_turbine_jar) \
     $(full_classes_compiled_jar) \
     $(full_classes_desugar_jar) \
     $(full_classes_jarjar_jar) \
     $(full_classes_jack) \
     $(full_classes_jar) \
     $(jack_check_timestamp) \
-    $(built_dex)
+    $(built_dex) \
+    $(java_source_list_file)
 
 # See comment in java.mk
 ifndef LOCAL_CHECKED_MODULE
@@ -83,30 +89,67 @@
 
 $(cleantarget): PRIVATE_CLEAN_FILES += $(intermediates.COMMON)
 
+# List of dependencies for anything that needs all java sources in place
+java_sources_deps := \
+    $(java_sources) \
+    $(java_resource_sources) \
+    $(proto_java_sources_file_stamp) \
+    $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+$(java_source_list_file): $(java_sources_deps)
+	$(write-java-source-list)
+
 ifndef LOCAL_JACK_ENABLED
 
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
-$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES :=
 $(full_classes_compiled_jar): \
-        $(java_sources) \
-        $(java_resource_sources) \
-        $(full_java_lib_deps) \
-        $(jar_manifest_file) \
-        $(proto_java_sources_file_stamp) \
-        $(annotation_processor_deps) \
-        $(NORMALIZE_PATH) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) \
-        | $(SOONG_JAVAC_WRAPPER)
-	$(transform-host-java-to-package)
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(full_static_java_libs) \
+    $(jar_manifest_file) \
+    $(annotation_processor_deps) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    | $(SOONG_JAVAC_WRAPPER)
+	$(transform-host-java-to-dalvik-package)
+
+$(full_classes_turbine_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_turbine_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
+$(full_classes_turbine_jar): \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(jar_manifest_file) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    $(ZIPTIME) \
+    | $(TURBINE)
+	$(transform-java-to-header.jar)
+
+.KATI_RESTAT: $(full_classes_turbine_jar)
+
+# Run jarjar before generate classes-header.jar if necessary.
+ifneq ($(strip $(LOCAL_JARJAR_RULES)),)
+$(full_classes_header_jarjar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
+$(full_classes_header_jarjar): $(full_classes_turbine_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
+	@echo Header JarJar: $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+else
+full_classes_header_jarjar := $(full_classes_turbine_jar)
+endif
+
+$(eval $(call copy-one-file,$(full_classes_header_jarjar),$(full_classes_header_jar)))
 
 my_desugaring :=
 ifeq ($(LOCAL_JAVA_LANGUAGE_VERSION),1.8)
 my_desugaring := true
 $(full_classes_desugar_jar): PRIVATE_DX_FLAGS := $(LOCAL_DX_FLAGS)
-$(full_classes_desugar_jar): $(full_classes_compiled_jar) $(DESUGAR)
+$(full_classes_desugar_jar): $(full_classes_compiled_jar) $(full_java_header_libs) $(DESUGAR)
 	$(desugar-classes-jar)
 endif
 
@@ -119,7 +162,7 @@
 $(full_classes_jarjar_jar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
 $(full_classes_jarjar_jar): $(full_classes_desugar_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
 	@echo JarJar: $@
-	$(hide) java -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
 else
 full_classes_jarjar_jar := $(full_classes_desugar_jar)
 endif
@@ -168,13 +211,18 @@
 $(LOCAL_INTERMEDIATE_TARGETS): \
   PRIVATE_JACK_INCREMENTAL_DIR :=
 endif
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JACK_FLAGS)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := -g $(LOCAL_JACK_FLAGS)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_VERSION := $(LOCAL_JACK_VERSION)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_MIN_SDK_VERSION := $(PLATFORM_JACK_MIN_SDK_VERSION)
 
-jack_all_deps := $(java_sources) $(java_resource_sources) $(full_jack_deps) \
-        $(jar_manifest_file) $(proto_java_sources_file_stamp) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) $(NORMALIZE_PATH) $(JACK_DEFAULT_ARGS) $(JACK)
+jack_all_deps := \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_jack_deps) \
+    $(jar_manifest_file) \
+    $(NORMALIZE_PATH) \
+    $(JACK_DEFAULT_ARGS) \
+    $(JACK)
 
 ifneq ($(LOCAL_IS_STATIC_JAVA_LIBRARY),true)
 $(built_dex): PRIVATE_CLASSES_JACK := $(full_classes_jack)
diff --git a/core/host_fuzz_test.mk b/core/host_fuzz_test.mk
index 1c9eed2..556e02f 100644
--- a/core/host_fuzz_test.mk
+++ b/core/host_fuzz_test.mk
@@ -4,7 +4,7 @@
 ################################################
 $(call record-module-type,HOST_FUZZ_TEST)
 
-LOCAL_CFLAGS += -fsanitize-coverage=edge,indirect-calls,8bit-counters,trace-cmp
+LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
 LOCAL_STATIC_LIBRARIES += libLLVMFuzzer
 
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index d30c90d..adc30dd 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -33,16 +33,14 @@
 
 full_classes_compiled_jar := $(intermediates.COMMON)/classes-full-debug.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/classes-jarjar.jar
-emma_intermediates_dir := $(intermediates.COMMON)/emma_out
-# emma is hardcoded to use the leaf name of its input for the output file --
-# only the output directory can be changed
-full_classes_emma_jar := $(emma_intermediates_dir)/lib/$(notdir $(full_classes_jarjar_jar))
 full_classes_jar := $(intermediates.COMMON)/classes.jar
+java_source_list_file := $(intermediates.COMMON)/java-source-list
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
 
 LOCAL_INTERMEDIATE_TARGETS += \
     $(full_classes_compiled_jar) \
     $(full_classes_jarjar_jar) \
-    $(full_classes_emma_jar)
+    $(java_source_list_file)
 
 #######################################
 include $(BUILD_SYSTEM)/base_rules.mk
@@ -63,22 +61,31 @@
 LOCAL_JAVACFLAGS += $(LOCAL_ERROR_PRONE_FLAGS)
 endif
 
+# List of dependencies for anything that needs all java sources in place
+java_sources_deps := \
+    $(java_sources) \
+    $(java_resource_sources) \
+    $(proto_java_sources_file_stamp) \
+    $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+$(java_source_list_file): $(java_sources_deps)
+	$(write-java-source-list)
+
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
-$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES :=
 $(full_classes_compiled_jar): \
-        $(java_sources) \
-        $(java_resource_sources) \
-        $(full_java_lib_deps) \
-        $(jar_manifest_file) \
-        $(proto_java_sources_file_stamp) \
-        $(annotation_processor_deps) \
-        $(NORMALIZE_PATH) \
-        $(ZIPTIME) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) \
-        | $(SOONG_JAVAC_WRAPPER)
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_lib_deps) \
+    $(jar_manifest_file) \
+    $(annotation_processor_deps) \
+    $(NORMALIZE_PATH) \
+    $(ZIPTIME) \
+    $(JAR_ARGS) \
+    | $(SOONG_JAVAC_WRAPPER)
 	$(transform-host-java-to-package)
 	$(remove-timestamps-from-package)
 
@@ -90,28 +97,19 @@
 $(full_classes_jarjar_jar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
 $(full_classes_jarjar_jar): $(full_classes_compiled_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
 	@echo JarJar: $@
-	$(hide) java -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
 else
 full_classes_jarjar_jar := $(full_classes_compiled_jar)
 endif
 
-ifeq (true,$(LOCAL_EMMA_INSTRUMENT))
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILE := $(intermediates.COMMON)/coverage.em
-$(full_classes_emma_jar): PRIVATE_EMMA_INTERMEDIATES_DIR := $(emma_intermediates_dir)
-ifdef LOCAL_EMMA_COVERAGE_FILTER
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := $(LOCAL_EMMA_COVERAGE_FILTER)
-else
-# by default, avoid applying emma instrumentation onto emma classes itself,
-# otherwise there will be exceptions thrown
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := *,-emma,-emmarun,-com.vladium.*
-endif
-# this rule will generate both $(PRIVATE_EMMA_COVERAGE_FILE) and
-# $(full_classes_emma_jar)
-$(full_classes_emma_jar) : $(full_classes_jarjar_jar) | $(EMMA_JAR)
-	$(transform-classes.jar-to-emma)
-else # LOCAL_EMMA_INSTRUMENT
-full_classes_emma_jar := $(full_classes_jarjar_jar)
-endif # LOCAL_EMMA_INSTRUMENT
 
-$(eval $(call copy-one-file,$(full_classes_emma_jar),$(LOCAL_BUILT_MODULE)))
-$(eval $(call copy-one-file,$(full_classes_emma_jar),$(full_classes_jar)))
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(full_classes_jarjar_jar)
+
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
+
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
+
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_header_jar)))
diff --git a/core/host_shared_library_internal.mk b/core/host_shared_library_internal.mk
index bfbde21..5e199cc 100644
--- a/core/host_shared_library_internal.mk
+++ b/core/host_shared_library_internal.mk
@@ -39,7 +39,7 @@
 include $(BUILD_SYSTEM)/binary.mk
 
 my_host_libprofile_rt := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LIBPROFILE_RT)
-$(LOCAL_BUILD_MODULE): PRIVATE_HOST_LIBPROFILE_RT := $(my_host_libprofile_rt)
+$(LOCAL_BUILT_MODULE): PRIVATE_HOST_LIBPROFILE_RT := $(my_host_libprofile_rt)
 
 $(LOCAL_BUILT_MODULE): \
         $(all_objects) \
diff --git a/core/install_jni_libs_internal.mk b/core/install_jni_libs_internal.mk
index 0e92153..b5f10cf 100644
--- a/core/install_jni_libs_internal.mk
+++ b/core/install_jni_libs_internal.mk
@@ -116,7 +116,7 @@
 else
 my_link_type := app:platform
 my_warn_types :=
-my_allowed_types := native:ndk native:platform
+my_allowed_types := native:ndk native:platform native:vendor
 endif
 
 my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
diff --git a/core/jacoco.mk b/core/jacoco.mk
new file mode 100644
index 0000000..f4788bf
--- /dev/null
+++ b/core/jacoco.mk
@@ -0,0 +1,141 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This file sets up Java code coverage via Jacoco
+# This file is only intended to be included internally by the build system
+# (at the time of authorship, it is included by java.mk and
+# java_host_library.mk)
+
+my_include_filter :=
+my_exclude_filter :=
+
+ifeq ($(LOCAL_EMMA_INSTRUMENT),true)
+  ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+    # determine Jacoco include/exclude filters
+    DEFAULT_JACOCO_EXCLUDE_FILTER := org/junit/*,org/jacoco/*,org/mockito/*
+    # copy filters from Jack but also skip some known java packages
+    my_include_filter := $(strip $(LOCAL_JACK_COVERAGE_INCLUDE_FILTER))
+    my_exclude_filter := $(strip $(DEFAULT_JACOCO_EXCLUDE_FILTER),$(LOCAL_JACK_COVERAGE_EXCLUDE_FILTER))
+
+    # replace '.' with '/' and ',' with ' ', and quote each arg
+    ifneq ($(strip $(my_include_filter)),)
+      my_include_args := $(strip $(my_include_filter))
+
+      my_include_args := $(subst .,/,$(my_include_args))
+      my_include_args := '$(subst $(comma),' ',$(my_include_args))'
+    else
+      my_include_args :=
+    endif
+
+    # replace '.' with '/' and ',' with ' ', and quote each arg
+    ifneq ($(strip $(my_exclude_filter)),)
+      my_exclude_args := $(my_exclude_filter)
+
+      my_exclude_args := $(subst .,/,$(my_exclude_args))
+      my_exclude_args := $(subst $(comma)$(comma),$(comma),$(my_exclude_args))
+      my_exclude_args := '$(subst $(comma),' ', $(my_exclude_args))'
+    else
+      my_exclude_args :=
+    endif
+  endif # ANDROID_COMPILE_WITH_JACK==false
+endif # LOCAL_EMMA_INSTRUMENT == true
+
+# determine whether to run the instrumenter based on whether there is any work
+# for it to do
+ifneq ($(my_include_filter),)
+
+  my_files := $(intermediates.COMMON)/jacoco
+
+  # make a task that unzips the classes that we want to instrument from the
+  # input jar
+  my_unzipped_path := $(my_files)/work/classes-to-instrument/classes
+  my_unzipped_timestamp_path := $(my_files)/work/classes-to-instrument/updated.stamp
+$(my_unzipped_timestamp_path): PRIVATE_UNZIPPED_PATH := $(my_unzipped_path)
+$(my_unzipped_timestamp_path): PRIVATE_UNZIPPED_TIMESTAMP_PATH := $(my_unzipped_timestamp_path)
+$(my_unzipped_timestamp_path): PRIVATE_INCLUDE_ARGS := $(my_include_args)
+$(my_unzipped_timestamp_path): PRIVATE_EXCLUDE_ARGS := $(my_exclude_args)
+$(my_unzipped_timestamp_path): PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+$(my_unzipped_timestamp_path): $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+	rm -rf $(PRIVATE_UNZIPPED_PATH) $@
+	mkdir -p $(PRIVATE_UNZIPPED_PATH)
+	unzip -q $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) \
+	  -d $(PRIVATE_UNZIPPED_PATH) \
+	  $(PRIVATE_INCLUDE_ARGS)
+	rm -rf $(PRIVATE_EXCLUDE_ARGS)
+	touch $(PRIVATE_UNZIPPED_TIMESTAMP_PATH)
+# Unfortunately in the previous task above,
+# 'rm -rf $(PRIVATE_EXCLUDE_ARGS)' needs to be a separate
+# shell command after 'unzip'.
+# We can't just use the '-x' (exclude) option of 'unzip' because if both
+# inclusions and exclusions are specified and an exclusion matches no
+# inclusions, then 'unzip' exits with an error (error 11).
+# We could ignore the error, but that would make the process less reliable
+
+
+  # make a task that zips only the classes that will be instrumented
+  # (for passing in to the report generator later)
+  my_classes_to_report_on_path := $(my_files)/report-resources/jacoco-report-classes.jar
+$(my_classes_to_report_on_path): PRIVATE_UNZIPPED_PATH := $(my_unzipped_path)
+$(my_classes_to_report_on_path): $(my_unzipped_timestamp_path)
+	rm -f $@
+	zip -q $@ \
+	  -r $(PRIVATE_UNZIPPED_PATH)
+
+
+
+  # make a task that invokes instrumentation
+  my_instrumented_path := $(my_files)/work/instrumented/classes
+  my_instrumented_timestamp_path := $(my_files)/work/instrumented/updated.stamp
+$(my_instrumented_timestamp_path): PRIVATE_INSTRUMENTED_PATH := $(my_instrumented_path)
+$(my_instrumented_timestamp_path): PRIVATE_INSTRUMENTED_TIMESTAMP_PATH := $(my_instrumented_timestamp_path)
+$(my_instrumented_timestamp_path): PRIVATE_UNZIPPED_PATH := $(my_unzipped_path)
+$(my_instrumented_timestamp_path): $(my_unzipped_timestamp_path) $(JACOCO_CLI_JAR)
+	rm -rf $(PRIVATE_INSTRUMENTED_PATH)
+	mkdir -p $(PRIVATE_INSTRUMENTED_PATH)
+	java -jar $(JACOCO_CLI_JAR) \
+	  instrument \
+	  -quiet \
+	  -dest '$(PRIVATE_INSTRUMENTED_PATH)' \
+	  $(PRIVATE_UNZIPPED_PATH)
+	touch $(PRIVATE_INSTRUMENTED_TIMESTAMP_PATH)
+
+
+  # make a task that zips both the instrumented classes and the uninstrumented
+  # classes (this jar is the instrumented application to execute)
+  my_temp_jar_path := $(my_files)/work/usable.jar
+  LOCAL_FULL_CLASSES_JACOCO_JAR := $(intermediates.COMMON)/classes-jacoco.jar
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_TEMP_JAR_PATH := $(my_temp_jar_path)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_INSTRUMENTED_PATH := $(my_instrumented_path)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): $(JAR_ARGS)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): $(my_instrumented_timestamp_path) $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+	rm -f $@ $(PRIVATE_TEMP_JAR_PATH)
+	# copy the pre-jacoco jar (containing files excluded from instrumentation)
+	cp $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) $(PRIVATE_TEMP_JAR_PATH)
+	# copy instrumented files back into the resultant jar
+	$(JAR) -uf $(PRIVATE_TEMP_JAR_PATH) $(call jar-args-sorted-files-in-directory,$(PRIVATE_INSTRUMENTED_PATH))
+	mv $(PRIVATE_TEMP_JAR_PATH) $@
+
+  # this is used to trigger $(my_classes_to_report_on_path) to build
+  # when $(LOCAL_FULL_CLASSES_JACOCO_JAR) builds, but it isn't truly a
+  # dependency.
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): $(my_classes_to_report_on_path)
+
+else # my_include_filter == ''
+  LOCAL_FULL_CLASSES_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+endif # my_include_filter != ''
+
+LOCAL_INTERMEDIATE_TARGETS += $(LOCAL_FULL_CLASSES_JACOCO_JAR)
diff --git a/core/java.mk b/core/java.mk
index 98f6ca7..cc70368 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -113,18 +113,19 @@
 LOCAL_PROGUARD_ENABLED :=
 endif
 
+full_classes_turbine_jar := $(intermediates.COMMON)/classes-turbine.jar
+full_classes_header_jarjar := $(intermediates.COMMON)/classes-header-jarjar.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
 full_classes_compiled_jar := $(intermediates.COMMON)/$(full_classes_compiled_jar_leaf)
 full_classes_processed_jar := $(intermediates.COMMON)/classes-processed.jar
 full_classes_desugar_jar := $(intermediates.COMMON)/classes-desugar.jar
 jarjar_leaf := classes-jarjar.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/$(jarjar_leaf)
-emma_intermediates_dir := $(intermediates.COMMON)/emma_out
-# emma is hardcoded to use the leaf name of its input for the output file --
-# only the output directory can be changed
-full_classes_emma_jar := $(emma_intermediates_dir)/lib/$(jarjar_leaf)
 full_classes_proguard_jar := $(intermediates.COMMON)/classes-proguard.jar
 built_dex_intermediate := $(intermediates.COMMON)/$(built_dex_intermediate_leaf)/classes.dex
 full_classes_stubs_jar := $(intermediates.COMMON)/stubs.jar
+java_source_list_file := $(intermediates.COMMON)/java-source-list
+
 
 ifeq ($(LOCAL_MODULE_CLASS)$(LOCAL_SRC_FILES)$(LOCAL_STATIC_JAVA_LIBRARIES)$(LOCAL_SOURCE_FILES_ALL_GENERATED),APPS)
 # If this is an apk without any Java code (e.g. framework-res), we should skip compiling Java.
@@ -141,10 +142,10 @@
 jack_check_timestamp := $(intermediates.COMMON)/jack.check.timestamp
 
 LOCAL_INTERMEDIATE_TARGETS += \
+    $(full_classes_turbine_jar) \
     $(full_classes_compiled_jar) \
     $(full_classes_desugar_jar) \
     $(full_classes_jarjar_jar) \
-    $(full_classes_emma_jar) \
     $(full_classes_jar) \
     $(full_classes_proguard_jar) \
     $(built_dex_intermediate) \
@@ -152,8 +153,8 @@
     $(noshrob_classes_jack) \
     $(jack_check_timestamp) \
     $(built_dex) \
-    $(full_classes_stubs_jar)
-
+    $(full_classes_stubs_jar) \
+    $(java_source_list_file)
 
 LOCAL_INTERMEDIATE_SOURCE_DIR := $(intermediates.COMMON)/src
 
@@ -429,25 +430,74 @@
 LOCAL_JAVACFLAGS += $(LOCAL_ERROR_PRONE_FLAGS)
 endif
 
-$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+# For user / userdebug builds, strip the local variable table and the local variable
+# type table. This has no bearing on stack traces, but will leave less information
+# available via JDWP.
+ifneq (,$(PRODUCT_MINIMIZE_JAVA_DEBUG_INFO))
+ifneq (,$(filter userdebug user,$(TARGET_BUILD_VARIANT)))
+LOCAL_JAVACFLAGS+= -g:source,lines
+LOCAL_JACK_FLAGS+= -D jack.dex.debug.vars=false -D jack.dex.debug.vars.synthetic=false
+endif
+endif
+
+# List of dependencies for anything that needs all java sources in place
+java_sources_deps := \
+    $(java_sources) \
+    $(java_resource_sources) \
+    $(RenderScript_file_stamp) \
+    $(proto_java_sources_file_stamp) \
+    $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+$(java_source_list_file): $(java_sources_deps)
+	$(write-java-source-list)
+
+$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES := $(LOCAL_JAR_EXCLUDE_FILES)
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES := $(LOCAL_JAR_PACKAGES)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES := $(LOCAL_JAR_EXCLUDE_PACKAGES)
 $(full_classes_compiled_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
+$(full_classes_compiled_jar): PRIVATE_JAVA_SOURCE_LIST := $(java_source_list_file)
 $(full_classes_compiled_jar): \
-        $(java_sources) \
-        $(java_resource_sources) \
-        $(full_java_lib_deps) \
-        $(jar_manifest_file) \
-        $(layers_file) \
-        $(RenderScript_file_stamp) \
-        $(proto_java_sources_file_stamp) \
-        $(annotation_processor_deps) \
-        $(NORMALIZE_PATH) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) \
-        | $(SOONG_JAVAC_WRAPPER)
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(full_static_java_libs) \
+    $(jar_manifest_file) \
+    $(layers_file) \
+    $(annotation_processor_deps) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    | $(SOONG_JAVAC_WRAPPER)
 	$(transform-java-to-classes.jar)
 
+$(full_classes_turbine_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_turbine_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
+$(full_classes_turbine_jar): \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(jar_manifest_file) \
+    $(layers_file) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    $(ZIPTIME) \
+    | $(TURBINE)
+	$(transform-java-to-header.jar)
+
+.KATI_RESTAT: $(full_classes_turbine_jar)
+
+# Run jarjar before generate classes-header.jar if necessary.
+ifneq ($(strip $(LOCAL_JARJAR_RULES)),)
+$(full_classes_header_jarjar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
+$(full_classes_header_jarjar): $(full_classes_turbine_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
+	@echo Header JarJar: $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+else
+full_classes_header_jarjar := $(full_classes_turbine_jar)
+endif
+
+$(eval $(call copy-one-file,$(full_classes_header_jarjar),$(full_classes_header_jar)))
+
 javac-check : $(full_classes_compiled_jar)
 javac-check-$(LOCAL_MODULE) : $(full_classes_compiled_jar)
 
@@ -458,18 +508,21 @@
 # using deferred evaluation (LOCAL_JAR_PROCESSOR_ARGS = instead of :=).
 in := $(full_classes_compiled_jar)
 out := $(full_classes_processed_jar).tmp
+my_jar_processor := $(HOST_OUT_JAVA_LIBRARIES)/$(LOCAL_JAR_PROCESSOR).jar
+
 $(full_classes_processed_jar): PRIVATE_JAR_PROCESSOR_ARGS := $(LOCAL_JAR_PROCESSOR_ARGS)
-$(full_classes_processed_jar): PRIVATE_JAR_PROCESSOR := $(HOST_OUT_JAVA_LIBRARIES)/$(LOCAL_JAR_PROCESSOR).jar
+$(full_classes_processed_jar): PRIVATE_JAR_PROCESSOR := $(my_jar_processor)
 $(full_classes_processed_jar): PRIVATE_TMP_OUT := $(out)
 in :=
 out :=
 
-$(full_classes_processed_jar): $(full_classes_compiled_jar) $(LOCAL_JAR_PROCESSOR)
+$(full_classes_processed_jar): $(full_classes_compiled_jar) $(my_jar_processor)
 	@echo Processing $@ with $(PRIVATE_JAR_PROCESSOR)
 	$(hide) rm -f $@ $(PRIVATE_TMP_OUT)
-	$(hide) java -jar $(PRIVATE_JAR_PROCESSOR) $(PRIVATE_JAR_PROCESSOR_ARGS)
+	$(hide) $(JAVA) -jar $(PRIVATE_JAR_PROCESSOR) $(PRIVATE_JAR_PROCESSOR_ARGS)
 	$(hide) mv $(PRIVATE_TMP_OUT) $@
 
+my_jar_processor :=
 else
 full_classes_processed_jar := $(full_classes_compiled_jar)
 endif
@@ -479,7 +532,7 @@
 ifndef LOCAL_IS_STATIC_JAVA_LIBRARY
 my_desugaring := true
 $(full_classes_desugar_jar): PRIVATE_DX_FLAGS := $(LOCAL_DX_FLAGS)
-$(full_classes_desugar_jar): $(full_classes_processed_jar) $(DESUGAR)
+$(full_classes_desugar_jar): $(full_classes_processed_jar) $(full_java_header_libs) $(DESUGAR)
 	$(desugar-classes-jar)
 endif
 endif
@@ -493,34 +546,18 @@
 $(full_classes_jarjar_jar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
 $(full_classes_jarjar_jar): $(full_classes_desugar_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
 	@echo JarJar: $@
-	$(hide) java -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
 else
 full_classes_jarjar_jar := $(full_classes_desugar_jar)
 endif
 
-ifeq ($(LOCAL_EMMA_INSTRUMENT),true)
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILE := $(intermediates.COMMON)/coverage.emma.ignore
-$(full_classes_emma_jar): PRIVATE_EMMA_INTERMEDIATES_DIR := $(emma_intermediates_dir)
-# module level coverage filter can be defined using LOCAL_EMMA_COVERAGE_FILTER
-# in Android.mk
-ifdef LOCAL_EMMA_COVERAGE_FILTER
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := $(LOCAL_EMMA_COVERAGE_FILTER)
-else
-# by default, avoid applying emma instrumentation onto emma classes itself,
-# otherwise there will be exceptions thrown
-$(full_classes_emma_jar): PRIVATE_EMMA_COVERAGE_FILTER := *,-emma,-emmarun,-com.vladium.*
-endif
-# this rule will generate both $(PRIVATE_EMMA_COVERAGE_FILE) and
-# $(full_classes_emma_jar)
-$(full_classes_emma_jar): $(full_classes_jarjar_jar) | $(EMMA_JAR)
-	$(transform-classes.jar-to-emma)
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(full_classes_jarjar_jar)
 
-else
-full_classes_emma_jar := $(full_classes_jarjar_jar)
-endif
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
 
-# TODO: this should depend on full_classes_emma_jar once coverage works again
-full_classes_pre_proguard_jar := $(full_classes_jarjar_jar)
+full_classes_pre_proguard_jar := $(LOCAL_FULL_CLASSES_JACOCO_JAR)
 
 # Keep a copy of the jar just before proguard processing.
 $(eval $(call copy-one-file,$(full_classes_pre_proguard_jar),$(intermediates.COMMON)/classes-pre-proguard.jar))
@@ -544,19 +581,22 @@
 ifdef LOCAL_SDK_VERSION
 ifdef TARGET_BUILD_APPS
 ifeq (,$(filter current system_current test_current, $(LOCAL_SDK_VERSION)))
-  my_support_library_sdk_raise := $(call java-lib-files, sdk_vcurrent)
+  my_support_library_sdk_raise := $(call java-lib-header-files, sdk_vcurrent)
 endif
 else
   # For platform build, we can't just raise to the "current" SDK,
   # that would break apps that use APIs removed from the current SDK.
-  my_support_library_sdk_raise := $(call java-lib-files,$(TARGET_DEFAULT_JAVA_LIBRARIES))
+  my_support_library_sdk_raise := $(call java-lib-header-files,$(TARGET_DEFAULT_JAVA_LIBRARIES))
 endif
 endif
 endif
 
 # jack already has the libraries in its classpath and doesn't support jars
 legacy_proguard_flags := $(addprefix -libraryjars ,$(my_support_library_sdk_raise) \
-  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_libs)))
+  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_header_libs)))
+
+legacy_proguard_lib_deps := $(my_support_library_sdk_raise) \
+  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_header_libs))
 
 legacy_proguard_flags += -printmapping $(proguard_dictionary)
 jack_proguard_flags := -printmapping $(jack_dictionary)
@@ -601,6 +641,7 @@
 # link_instr_classes_jar is defined in base_rule.mk
 # jack already has this library in its classpath and doesn't support jars
 legacy_proguard_flags += -libraryjars $(link_instr_classes_jar)
+legacy_proguard_lib_deps += $(link_instr_classes_jar)
 else # obfuscation
 # If obfuscation is enabled, the main app must be obfuscated too.
 # We need to run obfuscation using the main app's dictionary,
@@ -646,7 +687,7 @@
 ifndef LOCAL_JACK_ENABLED
 ifdef LOCAL_SDK_VERSION
 ifeq (,$(filter-out current system_current test_current, $(LOCAL_SDK_VERSION)))
-proguard_injar_filters := (!junit/framework/**,!junit/runner/**,!android/test/**,!com/android/internal/util/*)
+proguard_injar_filters := (!junit/framework/**,!junit/runner/**,!junit/textui/**,!android/test/**,!com/android/internal/util/*)
 endif
 endif
 endif
@@ -654,7 +695,7 @@
 $(full_classes_proguard_jar): PRIVATE_PROGUARD_INJAR_FILTERS := $(proguard_injar_filters)
 $(full_classes_proguard_jar): PRIVATE_EXTRA_INPUT_JAR := $(extra_input_jar)
 $(full_classes_proguard_jar): PRIVATE_PROGUARD_FLAGS := $(legacy_proguard_flags) $(common_proguard_flags) $(LOCAL_PROGUARD_FLAGS)
-$(full_classes_proguard_jar) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_support_library_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) | $(PROGUARD)
+$(full_classes_proguard_jar) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_support_library_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) $(legacy_proguard_lib_deps) | $(PROGUARD)
 	$(call transform-jar-to-proguard)
 
 else  # LOCAL_PROGUARD_ENABLED not defined
@@ -663,8 +704,6 @@
 
 $(eval $(call copy-one-file,$(full_classes_proguard_jar),$(full_classes_jar)))
 
-$(call define-jar-to-toc-rule, $(full_classes_jar))
-
 ifneq ($(LOCAL_IS_STATIC_JAVA_LIBRARY),true)
 ifndef LOCAL_JACK_ENABLED
 $(built_dex_intermediate): PRIVATE_DX_FLAGS := $(LOCAL_DX_FLAGS)
@@ -762,15 +801,22 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_PROGUARD_FLAGS :=
 endif # LOCAL_PROGUARD_ENABLED defined
 
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JACK_FLAGS) $(annotation_processor_flags)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := -g $(LOCAL_JACK_FLAGS) $(annotation_processor_flags)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_VERSION := $(LOCAL_JACK_VERSION)
 
-jack_all_deps := $(java_sources) $(java_resource_sources) $(full_jack_deps) \
-        $(jar_manifest_file) $(layers_file) $(RenderScript_file_stamp) \
-        $(common_proguard_flag_files) $(proguard_flag_files) \
-        $(proto_java_sources_file_stamp) $(annotation_processor_deps) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) $(LOCAL_JARJAR_RULES) \
-        $(NORMALIZE_PATH) $(JACK_DEFAULT_ARGS) $(JACK)
+jack_all_deps := \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_jack_deps) \
+    $(jar_manifest_file) \
+    $(layers_file) \
+    $(common_proguard_flag_files) \
+    $(proguard_flag_files) \
+    $(annotation_processor_deps) \
+    $(LOCAL_JARJAR_RULES) \
+    $(NORMALIZE_PATH) \
+    $(JACK_DEFAULT_ARGS) \
+    $(JACK)
 
 $(jack_check_timestamp): $(jack_all_deps) | setup-jack-server
 	@echo Checking build with Jack: $@
diff --git a/core/java_common.mk b/core/java_common.mk
index 0859a46..17803f8 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -19,7 +19,11 @@
   ifneq (,$(filter $(LOCAL_SDK_VERSION), $(private_sdk_versions_without_any_java_18_support)))
     LOCAL_JAVA_LANGUAGE_VERSION := 1.7
   else
-    LOCAL_JAVA_LANGUAGE_VERSION := 1.8
+    ifneq ($(EXPERIMENTAL_USE_OPENJDK9),true)
+      LOCAL_JAVA_LANGUAGE_VERSION := 1.8
+    else
+      LOCAL_JAVA_LANGUAGE_VERSION := 1.9
+    endif
   endif
 endif
 LOCAL_JAVACFLAGS += -source $(LOCAL_JAVA_LANGUAGE_VERSION) -target $(LOCAL_JAVA_LANGUAGE_VERSION)
@@ -167,7 +171,13 @@
       $(call intermediates-dir-for, \
         JAVA_LIBRARIES,$(lib),$(LOCAL_IS_HOST_MODULE),COMMON)/classes.jar)
 
+full_static_java_header_libs := \
+    $(foreach lib,$(LOCAL_STATIC_JAVA_LIBRARIES), \
+      $(call intermediates-dir-for, \
+        JAVA_LIBRARIES,$(lib),$(LOCAL_IS_HOST_MODULE),COMMON)/classes-header.jar)
+
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_STATIC_JAVA_LIBRARIES := $(full_static_java_libs)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_STATIC_JAVA_HEADER_LIBRARIES := $(full_static_java_header_libs)
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RESOURCE_DIR := $(LOCAL_RESOURCE_DIR)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ASSET_DIR := $(LOCAL_ASSET_DIR)
@@ -179,6 +189,7 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/proto
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_HAS_RS_SOURCES :=
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JAVA_SOURCES := $(all_java_sources)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JAVA_SOURCE_LIST := $(java_source_list_file)
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RMTYPEDEFS := $(LOCAL_RMTYPEDEFS)
 
@@ -193,18 +204,18 @@
 # No bootclasspath. But we still need "" to prevent javac from using default host bootclasspath.
 my_bootclasspath := ""
 else  # LOCAL_NO_STANDARD_LIBRARIES
-my_bootclasspath := $(call java-lib-files,core-oj):$(call java-lib-files,core-libart)
+my_bootclasspath := $(call java-lib-header-files,core-oj):$(call java-lib-header-files,core-libart)
 endif  # LOCAL_NO_STANDARD_LIBRARIES
 else
 ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
 # LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
-my_bootclasspath := $(call java-lib-files,android_stubs_current)
+my_bootclasspath := $(call java-lib-header-files,android_stubs_current)
 else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),system_current)
-my_bootclasspath := $(call java-lib-files,android_system_stubs_current)
+my_bootclasspath := $(call java-lib-header-files,android_system_stubs_current)
 else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),test_current)
-my_bootclasspath := $(call java-lib-files,android_test_stubs_current)
+my_bootclasspath := $(call java-lib-header-files,android_test_stubs_current)
 else
-my_bootclasspath := $(call java-lib-files,sdk_v$(LOCAL_SDK_VERSION))
+my_bootclasspath := $(call java-lib-header-files,sdk_v$(LOCAL_SDK_VERSION))
 endif # current, system_current, or test_current
 endif # LOCAL_SDK_VERSION
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(my_bootclasspath)
@@ -222,6 +233,7 @@
 endif
 
 full_shared_java_libs := $(call java-lib-files,$(LOCAL_JAVA_LIBRARIES) $(my_additional_javac_libs),$(LOCAL_IS_HOST_MODULE))
+full_shared_java_header_libs := $(call java-lib-header-files,$(LOCAL_JAVA_LIBRARIES) $(my_additional_javac_libs),$(LOCAL_IS_HOST_MODULE))
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES) $(my_additional_javac_libs),$(LOCAL_IS_HOST_MODULE))
 full_java_lib_deps := $(addsuffix .toc, $(full_java_lib_deps))
 
@@ -231,11 +243,12 @@
 ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
 my_bootclasspath := ""
 else
-my_bootclasspath := $(call normalize-path-list,$(call java-lib-files,core-oj-hostdex core-libart-hostdex,true))
+my_bootclasspath := $(call normalize-path-list,$(call java-lib-header-files,core-oj-hostdex core-libart-hostdex,true))
 endif
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(my_bootclasspath)
 
 full_shared_java_libs := $(call java-lib-files,$(LOCAL_JAVA_LIBRARIES),true)
+full_shared_java_header_libs := $(call java-lib-header-files,$(LOCAL_JAVA_LIBRARIES),true)
 full_java_lib_deps := $(full_shared_java_libs)
 else # !USE_CORE_LIB_BOOTCLASSPATH
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH :=
@@ -246,7 +259,10 @@
 endif # USE_CORE_LIB_BOOTCLASSPATH
 endif # !LOCAL_IS_HOST_MODULE
 
+# Only host java libraries use LOCAL_CLASSPATH.
 full_java_libs := $(full_shared_java_libs) $(full_static_java_libs) $(LOCAL_CLASSPATH)
+full_java_header_libs := $(full_shared_java_header_libs) $(full_static_java_header_libs)
+
 full_java_lib_deps := $(full_java_lib_deps) $(full_static_java_libs) $(LOCAL_CLASSPATH)
 
 ifndef LOCAL_IS_HOST_MODULE
@@ -262,6 +278,7 @@
   # link against the jar with full original names (before proguard processing).
   full_shared_java_libs += $(link_apk_libraries)
   full_java_libs += $(link_apk_libraries)
+  full_java_header_libs += $(link_apk_libraries)
   full_java_lib_deps += $(link_apk_libraries)
 endif
 
@@ -280,6 +297,7 @@
   # link against the jar with full original names (before proguard processing).
   link_instr_classes_jar := $(link_instr_intermediates_dir.COMMON)/classes-pre-proguard.jar
   full_java_libs += $(link_instr_classes_jar)
+  full_java_header_libs += $(link_instr_classes_jar)
   full_java_lib_deps += $(link_instr_classes_jar)
 endif  # LOCAL_INSTRUMENTATION_FOR
 endif  # LOCAL_IS_HOST_MODULE
@@ -328,6 +346,7 @@
 endif  # !LOCAL_IS_HOST_MODULE
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ALL_JAVA_LIBRARIES := $(full_java_libs)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ALL_JAVA_HEADER_LIBRARIES := $(full_java_header_libs)
 
 ALL_MODULES.$(my_register_name).INTERMEDIATE_SOURCE_DIR := \
     $(ALL_MODULES.$(my_register_name).INTERMEDIATE_SOURCE_DIR) $(LOCAL_INTERMEDIATE_SOURCE_DIR)
diff --git a/core/java_library.mk b/core/java_library.mk
index 9db587d..db4ccb5 100644
--- a/core/java_library.mk
+++ b/core/java_library.mk
@@ -53,12 +53,7 @@
 ifeq (true,$(EMMA_INSTRUMENT))
 ifeq (true,$(LOCAL_EMMA_INSTRUMENT))
 ifeq (true,$(EMMA_INSTRUMENT_STATIC))
-ifdef LOCAL_JACK_ENABLED
-# Jack supports coverage with Jacoco
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
-else
-LOCAL_STATIC_JAVA_LIBRARIES += emma
-endif # LOCAL_JACK_ENABLED
 endif # LOCAL_EMMA_INSTRUMENT
 endif # EMMA_INSTRUMENT_STATIC
 else
@@ -88,15 +83,18 @@
 $(common_javalib.jar) : $(built_dex) $(java_resource_sources) | $(ZIPTIME)
 	@echo "target Jar: $(PRIVATE_MODULE) ($@)"
 ifdef LOCAL_JACK_ENABLED
-	$(create-empty-package)
+	$(call create-empty-package-at,$@.tmp)
 else
-	$(call initialize-package-file,$(PRIVATE_SOURCE_ARCHIVE),$@)
+	$(call initialize-package-file,$(PRIVATE_SOURCE_ARCHIVE),$@.tmp)
 endif
-	$(add-dex-to-package)
+	$(call add-dex-to-package-arg,$@.tmp)
 ifdef LOCAL_JACK_ENABLED
-	$(add-carried-jack-resources)
+	$(call add-carried-jack-resources-to,$@.tmp)
 endif
-	$(remove-timestamps-from-package)
+	$(hide) $(ZIPTIME) $@.tmp
+	$(call commit-change-for-toc,$@)
+
+.KATI_RESTAT: $(common_javalib.jar)
 
 ifdef LOCAL_DEX_PREOPT
 ifneq ($(dexpreopt_boot_jar_module),) # boot jar
diff --git a/core/link_type.mk b/core/link_type.mk
index ff525cb..f7604ff 100644
--- a/core/link_type.mk
+++ b/core/link_type.mk
@@ -10,7 +10,7 @@
 #   my_link_deps: the dependencies, in the form of <MODULE_CLASS>:<name>
 #
 
-my_link_prefix := LINK_TYPE:$(call find-idf-prefix,$(my_kind),$(my_host_cross)):$(if $(my_common),$(my_common):_,_:$(if $(my_2nd_arch_prefix),$(my_2nd_arch_prefix),_))
+my_link_prefix := LINK_TYPE:$(call find-idf-prefix,$(my_kind),$(my_host_cross))$(if $(filter AUX,$(my_kind)),-$(AUX_OS_VARIANT)):$(if $(my_common),$(my_common):_,_:$(if $(my_2nd_arch_prefix),$(my_2nd_arch_prefix),_))
 link_type := $(my_link_prefix):$(LOCAL_MODULE_CLASS):$(LOCAL_MODULE)
 ALL_LINK_TYPES := $(ALL_LINK_TYPES) $(link_type)
 $(link_type).TYPE := $(my_link_type)
diff --git a/core/main.mk b/core/main.mk
index 8461e62..e7bf130 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -70,6 +70,10 @@
 DATE_FROM_FILE := date -d @$(BUILD_DATETIME_FROM_FILE)
 endif
 
+# Make an empty directory, which can be used to make empty jars
+EMPTY_DIRECTORY := $(OUT_DIR)/empty
+$(shell mkdir -p $(EMPTY_DIRECTORY) && rm -rf $(EMPTY_DIRECTORY)/*)
+
 # CTS-specific config.
 -include cts/build/config.mk
 # VTS-specific config.
@@ -79,11 +83,24 @@
 # general-tests-specific-config.
 -include tools/tradefederation/build/suites/general-tests/config.mk
 
-# This allows us to force a clean build - included after the config.mk
-# environment setup is done, but before we generate any dependencies.  This
-# file does the rm -rf inline so the deps which are all done below will
-# be generated correctly
-include $(BUILD_SYSTEM)/cleanbuild.mk
+# Clean rules
+.PHONY: clean-jack-files
+clean-jack-files: clean-dex-files
+	$(hide) find $(OUT_DIR) -name "*.jack" | xargs rm -f
+	$(hide) find $(OUT_DIR) -type d -name "jack" | xargs rm -rf
+	@echo "All jack files have been removed."
+
+.PHONY: clean-dex-files
+clean-dex-files:
+	$(hide) find $(OUT_DIR) -name "*.dex" ! -path "*/jack-incremental/*" | xargs rm -f
+	$(hide) for i in `find $(OUT_DIR) -name "*.jar" -o -name "*.apk"` ; do ((unzip -l $$i 2> /dev/null | \
+				grep -q "\.dex$$" && rm -f $$i) || continue ) ; done
+	@echo "All dex files and archives containing dex files have been removed."
+
+.PHONY: clean-jack-incremental
+clean-jack-incremental:
+	$(hide) find $(OUT_DIR) -name "jack-incremental" -type d | xargs rm -rf
+	@echo "All jack incremental dirs have been removed."
 
 # Include the google-specific config
 -include vendor/google/build/config.mk
@@ -227,6 +244,11 @@
   endif
 endif
 
+# Add the system server compiler filter if they are specified for the product.
+ifneq (,$(PRODUCT_SYSTEM_SERVER_COMPILER_FILTER))
+ADDITIONAL_BUILD_PROPERTIES += dalvik.vm.systemservercompilerfilter=$(PRODUCT_SYSTEM_SERVER_COMPILER_FILTER)
+endif
+
 ## user/userdebug ##
 
 user_variant := $(filter user userdebug,$(TARGET_BUILD_VARIANT))
@@ -411,7 +433,7 @@
 # Include all of the makefiles in the system
 #
 
-subdir_makefiles := $(SOONG_ANDROID_MK) $(call first-makefiles-under,$(TOP))
+subdir_makefiles := $(SOONG_ANDROID_MK) $(file <$(OUT_DIR)/.module_paths/Android.mk.list)
 subdir_makefiles_total := $(words $(subdir_makefiles))
 .KATI_READONLY := subdir_makefiles_total
 
@@ -493,9 +515,10 @@
 # If a module is for a cross host os, the required modules must be for
 # that OS too.
 # If a module is built for 32-bit, the required modules must be 32-bit too;
-# Otherwise if the module is an exectuable or shared library,
+# Otherwise if the module is an executable or shared library,
 #   the required modules must be 64-bit;
 #   otherwise we require both 64-bit and 32-bit variant, if one exists.
+define select-bitness-of-required-modules
 $(foreach m,$(ALL_MODULES),\
   $(eval r := $(ALL_MODULES.$(m).REQUIRED))\
   $(if $(r),\
@@ -511,6 +534,8 @@
      $(eval ALL_MODULES.$(m).REQUIRED := $(strip $(r_r)))\
   )\
 )
+endef
+$(call select-bitness-of-required-modules)
 r_r :=
 
 define add-required-deps
@@ -525,24 +550,68 @@
 $(1): $(2)
 endef
 
+# Sets up dependencies such that whenever a host module is installed,
+# any other host modules listed in $(ALL_MODULES.$(m).REQUIRED) will also be installed
+define add-all-host-to-host-required-modules-deps
+$(foreach m,$(ALL_MODULES), \
+  $(eval r := $(ALL_MODULES.$(m).REQUIRED)) \
+  $(if $(r), \
+    $(eval r := $(call module-installed-files,$(r))) \
+    $(eval h_m := $(filter $(HOST_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
+    $(eval hc_m := $(filter $(HOST_CROSS_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
+    $(eval h_r := $(filter $(HOST_OUT)/%, $(r))) \
+    $(eval hc_r := $(filter $(HOST_CROSS_OUT)/%, $(r))) \
+    $(eval h_m := $(filter-out $(h_r), $(h_m))) \
+    $(eval hc_m := $(filter-out $(hc_r), $(hc_m))) \
+    $(if $(h_m), $(eval $(call add-required-deps, $(h_m),$(h_r)))) \
+    $(if $(hc_m), $(eval $(call add-required-deps, $(hc_m),$(hc_r)))) \
+  ) \
+)
+endef
+$(call add-all-host-to-host-required-modules-deps)
+
+# Sets up dependencies such that whenever a target module is installed,
+# any other target modules listed in $(ALL_MODULES.$(m).REQUIRED) will also be installed
+define add-all-target-to-target-required-modules-deps
 $(foreach m,$(ALL_MODULES), \
   $(eval r := $(ALL_MODULES.$(m).REQUIRED)) \
   $(if $(r), \
     $(eval r := $(call module-installed-files,$(r))) \
     $(eval t_m := $(filter $(TARGET_OUT_ROOT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
-    $(eval h_m := $(filter $(HOST_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
-    $(eval hc_m := $(filter $(HOST_CROSS_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
     $(eval t_r := $(filter $(TARGET_OUT_ROOT)/%, $(r))) \
-    $(eval h_r := $(filter $(HOST_OUT)/%, $(r))) \
-    $(eval hc_r := $(filter $(HOST_CROSS_OUT)/%, $(r))) \
     $(eval t_m := $(filter-out $(t_r), $(t_m))) \
-    $(eval h_m := $(filter-out $(h_r), $(h_m))) \
-    $(eval hc_m := $(filter-out $(hc_r), $(hc_m))) \
     $(if $(t_m), $(eval $(call add-required-deps, $(t_m),$(t_r)))) \
-    $(if $(h_m), $(eval $(call add-required-deps, $(h_m),$(h_r)))) \
-    $(if $(hc_m), $(eval $(call add-required-deps, $(hc_m),$(hc_r)))) \
-   ) \
- )
+  ) \
+)
+endef
+$(call add-all-target-to-target-required-modules-deps)
+
+# Sets up dependencies such that whenever a host module is installed,
+# any target modules listed in $(ALL_MODULES.$(m).TARGET_REQUIRED) will also be installed
+define add-all-host-to-target-required-modules-deps
+$(foreach m,$(ALL_MODULES), \
+  $(eval req_mods := $(ALL_MODULES.$(m).TARGET_REQUIRED))\
+  $(if $(req_mods), \
+    $(eval req_files := )\
+    $(foreach req_mod,$(req_mods), \
+      $(eval req_file := $(filter $(TARGET_OUT_ROOT)/%, $(call module-installed-files,$(req_mod)))) \
+      $(if $(strip $(req_file)),\
+        ,\
+        $(error $(m).LOCAL_TARGET_REQUIRED_MODULES : illegal value $(req_mod) : not a device module. If you want to specify host modules to be required to be installed along with your host module, add those module names to LOCAL_REQUIRED_MODULES instead)\
+      )\
+      $(eval req_files := $(req_files)$(space)$(req_file))\
+    )\
+    $(eval req_files := $(strip $(req_files)))\
+    $(eval mod_files := $(filter $(HOST_OUT)/%, $(call module-installed-files,$(m)))) \
+    $(eval mod_files := $(filter-out $(req_files),$(mod_files)))\
+    $(if $(mod_files),\
+      $(eval $(call add-required-deps, $(mod_files),$(req_files))) \
+    )\
+  )\
+)
+endef
+$(call add-all-host-to-target-required-modules-deps)
+
 
 t_m :=
 h_m :=
@@ -551,7 +620,7 @@
 h_r :=
 hc_r :=
 
-# Establish the dependecies on the shared libraries.
+# Establish the dependencies on the shared libraries.
 # It also adds the shared library module names to ALL_MODULES.$(m).REQUIRED,
 # so they can be expanded to product_MODULES later.
 # $(1): TARGET_ or HOST_ or HOST_CROSS_.
@@ -605,7 +674,7 @@
 #     - TARGET
 #     - HOST
 #     - HOST_CROSS
-#     - AUX
+#     - AUX-<variant-name>
 #   3: Whether to use the common intermediates directory or not
 #     - _
 #     - COMMON
@@ -632,9 +701,15 @@
 
 link_type_error :=
 
-define link-type-prefix
+define link-type-prefix-base
 $(word 2,$(subst :,$(space),$(1)))
 endef
+define link-type-prefix
+$(if $(filter AUX-%,$(link-type-prefix-base)),$(patsubst AUX-%,AUX,$(link-type-prefix-base)),$(link-type-prefix-base))
+endef
+define link-type-aux-variant
+$(if $(filter AUX-%,$(link-type-prefix-base)),$(patsubst AUX-%,%,$(link-type-prefix-base)))
+endef
 define link-type-common
 $(patsubst _,,$(word 3,$(subst :,$(space),$(1))))
 endef
@@ -725,7 +800,11 @@
 #  2. The jni_link_type rule for embedded native code
 #  3. The 2ND_jni_link_type for the second architecture native code
 define link-type-file
-$(call intermediates-dir-for,$(link-type-class),$(link-type-name),$(filter AUX HOST HOST_CROSS,$(link-type-prefix)),$(link-type-common),$(link-type-2ndarchprefix),$(filter HOST_CROSS,$(link-type-prefix)))/$(if $(filter APPS,$(link-type-class)),$(if $(link-type-common),,$(link-type-2ndarchprefix)jni_))link_type
+$(eval _ltf_aux_variant:=$(link-type-aux-variant))\
+$(if $(_ltf_aux_variant),$(call aux-variant-load-env,$(_ltf_aux_variant)))\
+$(call intermediates-dir-for,$(link-type-class),$(link-type-name),$(filter AUX HOST HOST_CROSS,$(link-type-prefix)),$(link-type-common),$(link-type-2ndarchprefix),$(filter HOST_CROSS,$(link-type-prefix)))/$(if $(filter APPS,$(link-type-class)),$(if $(link-type-common),,$(link-type-2ndarchprefix)jni_))link_type\
+$(if $(_ltf_aux_variant),$(call aux-variant-load-env,none))\
+$(eval _ltf_aux_variant:=)
 endef
 
 # Write out the file-based link_type rules for the ALLOW_MISSING_DEPENDENCIES
@@ -781,6 +860,9 @@
   # Filter out the overridden packages before doing expansion
   product_MODULES := $(filter-out $(foreach p, $(product_MODULES), \
       $(PACKAGES.$(p).OVERRIDES)), $(product_MODULES))
+  # Filter out executables as well
+  product_MODULES := $(filter-out $(foreach m, $(product_MODULES), \
+      $(EXECUTABLES.$(m).OVERRIDES)), $(product_MODULES))
 
   # Resolve the :32 :64 module name
   modules_32 := $(patsubst %:32,%,$(filter %:32, $(product_MODULES)))
@@ -1016,9 +1098,13 @@
   $(call dist-for-goals,apps_only, $(apps_only_dist_built_files))
 
   ifeq ($(EMMA_INSTRUMENT),true)
-    $(EMMA_META_ZIP) : $(apps_only_installed_files)
-
-    $(call dist-for-goals,apps_only, $(EMMA_META_ZIP))
+    ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+      $(JACOCO_REPORT_CLASSES_ALL) : $(apps_only_installed_files)
+      $(call dist-for-goals,apps_only, $(JACOCO_REPORT_CLASSES_ALL))
+    else
+      $(EMMA_META_ZIP) : $(apps_only_installed_files)
+      $(call dist-for-goals,apps_only, $(EMMA_META_ZIP))
+    endif
   endif
 
   $(PROGUARD_DICT_ZIP) : $(apps_only_installed_files)
@@ -1075,9 +1161,13 @@
   endif
 
   ifeq ($(EMMA_INSTRUMENT),true)
-    $(EMMA_META_ZIP) : $(INSTALLED_SYSTEMIMAGE)
-
-    $(call dist-for-goals, dist_files, $(EMMA_META_ZIP))
+    ifeq ($(ANDROID_COMPILE_WITH_JACK),false)
+      $(JACOCO_REPORT_CLASSES_ALL) : $(INSTALLED_SYSTEMIMAGE)
+      $(call dist-for-goals, dist_files, $(JACOCO_REPORT_CLASSES_ALL))
+    else
+      $(EMMA_META_ZIP) : $(INSTALLED_SYSTEMIMAGE)
+      $(call dist-for-goals, dist_files, $(EMMA_META_ZIP))
+    endif
   endif
 
 # Building a full system-- the default is to build droidcore
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 4003aaf..11138db 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -122,7 +122,18 @@
   endif
 endif
 
-ifndef enforce_rro_enabled
+ifdef enforce_rro_enabled
+  ifneq ($(PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS),)
+    static_only_resource_overlays := $(filter $(addsuffix %,$(PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS)),$(package_resource_overlays))
+    ifneq ($(static_only_resource_overlays),)
+      package_resource_overlays := $(filter-out $(static_only_resource_overlays),$(package_resource_overlays))
+      LOCAL_RESOURCE_DIR := $(static_only_resource_overlays) $(LOCAL_RESOURCE_DIR)
+      ifeq ($(package_resource_overlays),)
+        enforce_rro_enabled :=
+      endif
+    endif
+  endif
+else
 LOCAL_RESOURCE_DIR := $(package_resource_overlays) $(LOCAL_RESOURCE_DIR)
 endif
 
@@ -245,7 +256,7 @@
 
 ifeq (true,$(EMMA_INSTRUMENT))
 ifndef LOCAL_EMMA_INSTRUMENT
-# No emma for test apks.
+# No jacoco for test apks.
 ifeq (,$(LOCAL_INSTRUMENTATION_FOR))
 LOCAL_EMMA_INSTRUMENT := true
 endif # No test apk
@@ -256,21 +267,14 @@
 
 ifeq (true,$(LOCAL_EMMA_INSTRUMENT))
 ifeq (true,$(EMMA_INSTRUMENT_STATIC))
-ifdef LOCAL_JACK_ENABLED
-# Jack supports coverage with Jacoco
 ifneq ($(LOCAL_SRC_FILES)$(LOCAL_STATIC_JAVA_LIBRARIES)$(LOCAL_SOURCE_FILES_ALL_GENERATED),)
 # Only add jacocoagent if the package contains some java code
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
 endif # Contains java code
 else
-LOCAL_STATIC_JAVA_LIBRARIES += emma
-endif # LOCAL_JACK_ENABLED
-else
 ifdef LOCAL_SDK_VERSION
 ifdef TARGET_BUILD_APPS
 # In unbundled build, merge the coverage library into the apk.
-ifdef LOCAL_JACK_ENABLED
-# Jack supports coverage with Jacoco
 ifneq ($(LOCAL_SRC_FILES)$(LOCAL_STATIC_JAVA_LIBRARIES)$(LOCAL_SOURCE_FILES_ALL_GENERATED),)
 # Only add jacocoagent if the package contains some java code
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
@@ -278,9 +282,6 @@
 LOCAL_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
 LOCAL_JACK_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
 endif # Contains java code
-else  # ! LOCAL_JACK_ENABLED
-LOCAL_STATIC_JAVA_LIBRARIES += emma
-endif # ! LOCAL_JACK_ENABLED
 else  # ! TARGET_BUILD_APPS
 ifdef LOCAL_JACK_ENABLED
 # If build against the SDK in full build, core.jar is not used
@@ -291,11 +292,6 @@
 # Note: we have nothing to do for proguard since jacoco will be
 # on the classpath only, thus not modified during the compilation.
 LOCAL_JAVA_LIBRARIES += jacocoagent
-else  # ! LOCAL_JACK_ENABLED
-# If build against the SDK in full build, core.jar is not used,
-# we have to use prebiult emma.jar to make Proguard happy;
-# Otherwise emma classes are included in core.jar.
-LOCAL_PROGUARD_FLAGS += -libraryjars $(EMMA_JAR)
 endif # ! LOCAL_JACK_ENABLED
 endif # ! TARGET_BUILD_APPS
 endif # LOCAL_SDK_VERSION
@@ -354,12 +350,14 @@
 	@rm -rf $(PRIVATE_INTERMEDIATES) $(PRIVATE_SRC_OUT) && \
 	  mkdir -p $(PRIVATE_INTERMEDIATES) $(PRIVATE_SRC_OUT) \
 	      $(PRIVATE_XML_OUT) $(PRIVATE_RES_OUT) $(PRIVATE_ANNO_SRC_DIR)
-	$(hide) java -classpath $(DATA_BINDING_COMPILER) android.databinding.tool.MakeCopy \
+	$(hide) $(JAVA) -classpath $(DATA_BINDING_COMPILER) android.databinding.tool.MakeCopy \
 	  $(PRIVATE_MANIFEST) $(PRIVATE_SRC_OUT) $(PRIVATE_XML_OUT) $(PRIVATE_RES_OUT) $(PRIVATE_RES_IN)
 	$(hide) touch $@
 
 # Make sure the data-binding process happens before javac and generation of R.java.
-$(R_file_stamp) $(full_classes_compiled_jar) : $(data_binding_stamp)
+$(R_file_stamp): $(data_binding_stamp)
+$(java_source_list_file): $(data_binding_stamp)
+$(full_classes_compiled_jar): $(data_binding_stamp)
 # The dependency path when jack is enabled
 $(built_dex_intermediate) : $(data_binding_stamp)
 endif  # LOCAL_DATA_BINDING
@@ -449,26 +447,9 @@
 # they want to use this module's R.java file.
 $(LOCAL_BUILT_MODULE): $(R_file_stamp)
 
-ifdef LOCAL_JACK_ENABLED
-ifneq ($(built_dex_intermediate),)
-$(built_dex_intermediate): $(R_file_stamp)
-endif
-ifneq ($(noshrob_classes_jack),)
-$(noshrob_classes_jack): $(R_file_stamp)
-endif
-ifneq ($(full_classes_jack),)
-$(full_classes_jack): $(R_file_stamp)
-$(jack_check_timestamp): $(R_file_stamp)
-endif
-endif # LOCAL_JACK_ENABLED
-
-ifneq ($(full_classes_jar),)
-# If full_classes_jar is non-empty, we're building sources.
-# If we're building sources, the initial javac step (which
-# produces full_classes_compiled_jar) needs to ensure the
-# R.java and Manifest.java files have been generated first.
-$(full_classes_compiled_jar): $(R_file_stamp)
-endif
+# The R.java file must exist by the time the java source
+# list is generated
+$(java_source_list_file): $(R_file_stamp)
 
 endif  # need_compile_res
 
@@ -578,8 +559,12 @@
     $(my_res_package) $(LOCAL_BUILT_MODULE): PRIVATE_PRODUCT_AAPT_PREF_CONFIG := $(PRODUCT_AAPT_PREF_CONFIG)
 endif
 endif
+
 $(LOCAL_BUILT_MODULE): PRIVATE_DONT_DELETE_JAR_DIRS := $(LOCAL_DONT_DELETE_JAR_DIRS)
+$(LOCAL_BUILT_MODULE): PRIVATE_RESOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/resources
+$(LOCAL_BUILT_MODULE): PRIVATE_FULL_CLASSES_JAR := $(full_classes_jar)
 $(LOCAL_BUILT_MODULE) : $(jni_shared_libraries)
+$(LOCAL_BUILT_MODULE) : $(JAR_ARGS)
 ifdef LOCAL_USE_AAPT2
 $(LOCAL_BUILT_MODULE): PRIVATE_RES_PACKAGE := $(my_res_package)
 $(LOCAL_BUILT_MODULE) : $(my_res_package) $(AAPT2) | $(ACP)
@@ -607,6 +592,11 @@
 	$(if $(PRIVATE_EXTRA_JAR_ARGS),$(call add-java-resources-to,$@))
 else  # full_classes_jar
 	$(add-dex-to-package)
+ifdef LOCAL_USE_AAPT2
+ifndef LOCAL_JACK_ENABLED
+	$(call add-jar-resources-to-package,$@,$(PRIVATE_FULL_CLASSES_JAR),$(PRIVATE_RESOURCE_INTERMEDIATES_DIR))
+endif
+endif
 endif  # full_classes_jar
 ifdef LOCAL_JACK_ENABLED
 	$(add-carried-jack-resources)
diff --git a/core/pathmap.mk b/core/pathmap.mk
index 45213bb..a1c20c9 100644
--- a/core/pathmap.mk
+++ b/core/pathmap.mk
@@ -62,12 +62,6 @@
 endef
 
 #
-# Many modules expect to be able to say "#include <jni.h>",
-# so make it easy for them to find the correct path.
-#
-JNI_H_INCLUDE := libnativehelper/include/nativehelper
-
-#
 # A list of all source roots under frameworks/base, which will be
 # built into the android.jar.
 #
diff --git a/core/pdk_config.mk b/core/pdk_config.mk
index 8c986d6..bef183e 100644
--- a/core/pdk_config.mk
+++ b/core/pdk_config.mk
@@ -99,9 +99,6 @@
 ifeq (true,$(TARGET_BUILD_PDK_JAVA_PLATFORM))
 
 PDK_FUSION_OUT_DIR := $(OUT_DIR)
-ifeq (debug,$(TARGET_BUILD_TYPE))
-PDK_FUSION_OUT_DIR := $(DEBUG_OUT_DIR)
-endif
 
 define JAVA_dependency_template
 $(call add-dependency,$(PDK_FUSION_OUT_DIR)/$(strip $(1)),\
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index c12084f..5a0ac37 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -84,7 +84,11 @@
   endif
 
   ifdef LOCAL_USE_VNDK
-    SPLIT_VENDOR.$(LOCAL_MODULE_CLASS).$(patsubst %.vendor,%,$(LOCAL_MODULE)) := 1
+    name_without_suffix := $(patsubst %.vendor,%,$(LOCAL_MODULE))
+    ifneq ($(name_without_suffix),$(LOCAL_MODULE)
+      SPLIT_VENDOR.$(LOCAL_MODULE_CLASS).$(name_without_suffix) := 1
+    endif
+    name_without_suffix :=
   endif
 endif
 
@@ -172,9 +176,7 @@
 # Extra shared libraries introduced by LOCAL_CXX_STL.
 include $(BUILD_SYSTEM)/cxx_stl_setup.mk
 ifdef LOCAL_USE_VNDK
-  ifeq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
-    my_shared_libraries := $(addsuffix .vendor,$(my_shared_libraries))
-  else
+  ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
     my_shared_libraries := $(foreach l,$(my_shared_libraries),\
       $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
   endif
@@ -453,6 +455,7 @@
 # for host java libraries deps should be in the common dir, so we make a copy in
 # the common dir.
 common_classes_jar := $(intermediates.COMMON)/classes.jar
+common_header_jar := $(intermediates.COMMON)/classes-header.jar
 
 $(common_classes_jar): PRIVATE_MODULE := $(LOCAL_MODULE)
 $(common_classes_jar): PRIVATE_PREFIX := $(my_prefix)
@@ -460,10 +463,14 @@
 $(common_classes_jar) : $(my_src_jar)
 	$(transform-prebuilt-to-target)
 
+$(common_header_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
 else # !LOCAL_IS_HOST_MODULE
 # for target java libraries, the LOCAL_BUILT_MODULE is in a product-specific dir,
 # while the deps should be in the common dir, so we make a copy in the common dir.
 common_classes_jar := $(intermediates.COMMON)/classes.jar
+common_header_jar := $(intermediates.COMMON)/classes-header.jar
 common_classes_pre_proguard_jar := $(intermediates.COMMON)/classes-pre-proguard.jar
 common_javalib_jar := $(intermediates.COMMON)/javalib.jar
 
@@ -508,14 +515,15 @@
 $(common_classes_jar) : $(my_src_jar)
 	$(transform-prebuilt-to-target)
 
+$(common_header_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
 $(common_classes_pre_proguard_jar) : $(my_src_jar)
 	$(transform-prebuilt-to-target)
 
 $(common_javalib_jar) : $(common_classes_jar)
 	$(transform-prebuilt-to-target)
 
-$(call define-jar-to-toc-rule, $(common_classes_jar))
-
 ifdef LOCAL_USE_AAPT2
 ifneq ($(my_src_aar),)
 LOCAL_SDK_RES_VERSION:=$(strip $(LOCAL_SDK_RES_VERSION))
diff --git a/core/product.mk b/core/product.mk
index fd22532..95e3b27 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -94,6 +94,7 @@
     PRODUCT_EXTRA_RECOVERY_KEYS \
     PRODUCT_PACKAGE_OVERLAYS \
     DEVICE_PACKAGE_OVERLAYS \
+    PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS \
     PRODUCT_ENFORCE_RRO_TARGETS \
     PRODUCT_SDK_ATREE_FILES \
     PRODUCT_SDK_ADDON_NAME \
@@ -120,10 +121,14 @@
     PRODUCT_VERITY_SIGNING_KEY \
     PRODUCT_SYSTEM_VERITY_PARTITION \
     PRODUCT_VENDOR_VERITY_PARTITION \
+    PRODUCT_SYSTEM_SERVER_DEBUG_INFO \
     PRODUCT_DEX_PREOPT_MODULE_CONFIGS \
     PRODUCT_DEX_PREOPT_DEFAULT_FLAGS \
     PRODUCT_DEX_PREOPT_BOOT_FLAGS \
     PRODUCT_DEX_PREOPT_PROFILE_DIR \
+    PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION \
+    PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE \
+    PRODUCT_SYSTEM_SERVER_COMPILER_FILTER \
     PRODUCT_SANITIZER_MODULE_CONFIGS \
     PRODUCT_SYSTEM_BASE_FS_PATH \
     PRODUCT_VENDOR_BASE_FS_PATH \
@@ -131,9 +136,13 @@
     VENDOR_PRODUCT_RESTRICT_VENDOR_FILES \
     VENDOR_EXCEPTION_MODULES \
     VENDOR_EXCEPTION_PATHS \
+    PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD \
     PRODUCT_ART_USE_READ_BARRIER \
     PRODUCT_IOT \
     PRODUCT_SYSTEM_HEADROOM \
+    PRODUCT_MINIMIZE_JAVA_DEBUG_INFO \
+    PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS \
+    PRODUCT_COMPILE_WITH_JACK \
 
 
 
diff --git a/core/product_config.mk b/core/product_config.mk
index 8b908da..6ab40c0 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -383,6 +383,17 @@
 PRODUCT_DEX_PREOPT_PROFILE_DIR := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_PROFILE_DIR))
 
+# Boot image options.
+PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE))
+PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION))
+
+PRODUCT_SYSTEM_SERVER_COMPILER_FILTER := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_COMPILER_FILTER))
+PRODUCT_SYSTEM_SERVER_DEBUG_INFO := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_DEBUG_INFO))
+
 # Resolve and setup per-module dex-preopt configs.
 PRODUCT_DEX_PREOPT_MODULE_CONFIGS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_MODULE_CONFIGS))
@@ -411,6 +422,10 @@
     $(eval SANITIZER.$(TARGET_PRODUCT).$(m).CONFIG := $(cf))))
 _psmc_modules :=
 
+# Whether the product wants to ship libartd. For rules and meaning, see art/Android.mk.
+PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD))
+
 # Make this art variable visible to soong_config.mk.
 PRODUCT_ART_USE_READ_BARRIER := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ART_USE_READ_BARRIER))
@@ -419,6 +434,10 @@
 PRODUCT_IOT := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_IOT))
 
+# Resource overlay list which must be excluded from enforcing RRO.
+PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS))
+
 # Package list to apply enforcing RRO.
 PRODUCT_ENFORCE_RRO_TARGETS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_RRO_TARGETS))
@@ -426,3 +445,15 @@
 # Add reserved headroom to a system image.
 PRODUCT_SYSTEM_HEADROOM := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_HEADROOM))
+
+# Whether to save disk space by minimizing java debug info
+PRODUCT_MINIMIZE_JAVA_DEBUG_INFO := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MINIMIZE_JAVA_DEBUG_INFO))
+
+# Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
+PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
+
+# Temporarily force Jack back on for a product
+PRODUCT_COMPILE_WITH_JACK := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_COMPILE_WITH_JACK))
diff --git a/core/soong_config.mk b/core/soong_config.mk
index e21083d..ae0a0b2 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -34,13 +34,15 @@
 	echo '    "Make_suffix": "-$(TARGET_PRODUCT)",'; \
 	echo ''; \
 	echo '    "Platform_sdk_version": $(PLATFORM_SDK_VERSION),'; \
-	echo '    "Platform_version_all_codenames": $(call csv_to_json_list,$(PLATFORM_VERSION_ALL_CODENAMES)),'; \
+	echo '    "Platform_version_active_codenames": $(call csv_to_json_list,$(PLATFORM_VERSION_ALL_CODENAMES)),'; \
+	echo '    "Platform_version_future_codenames": $(call csv_to_json_list,$(PLATFORM_VERSION_FUTURE_CODENAMES)),'; \
 	echo '    "Unbundled_build": $(if $(TARGET_BUILD_APPS),true,false),'; \
 	echo '    "Brillo": $(if $(BRILLO),true,false),'; \
 	echo '    "Malloc_not_svelte": $(if $(filter true,$(MALLOC_SVELTE)),false,true),'; \
 	echo '    "Allow_missing_dependencies": $(if $(ALLOW_MISSING_DEPENDENCIES),true,false),'; \
 	echo '    "SanitizeHost": $(call json_list,$(SANITIZE_HOST)),'; \
 	echo '    "SanitizeDevice": $(call json_list,$(SANITIZE_TARGET)),'; \
+	echo '    "SanitizeDeviceDiag": $(call json_list,$(SANITIZE_TARGET_DIAG)),'; \
 	echo '    "SanitizeDeviceArch": $(call json_list,$(SANITIZE_TARGET_ARCH)),'; \
 	echo '    "HostStaticBinaries": $(if $(strip $(BUILD_HOST_static)),true,false),'; \
 	echo '    "Binder32bit": $(if $(BINDER32BIT),true,false),'; \
@@ -78,14 +80,18 @@
 	echo '    "CrossHostSecondaryArch": "$(HOST_CROSS_2ND_ARCH)",'; \
 	echo '    "Safestack": $(if $(filter true,$(USE_SAFESTACK)),true,false),'; \
 	echo '    "EnableCFI": $(if $(filter false,$(ENABLE_CFI)),false,true),'; \
+	echo '    "IntegerOverflowExcludePaths": $(call json_list,$(INTEGER_OVERFLOW_EXCLUDE_PATHS) $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)),'; \
 	echo '    "Device_uses_hwc2": $(if $(filter true,$(TARGET_USES_HWC2)),true,false),'; \
 	echo '    "Override_rs_driver": "$(OVERRIDE_RS_DRIVER)",'; \
 	echo '    "Treble": $(if $(filter true,$(PRODUCT_FULL_TREBLE)),true,false),'; \
 	echo '    "Pdk": $(if $(filter true,$(TARGET_BUILD_PDK)),true,false),'; \
+	echo '    "Uml": $(if $(filter true,$(TARGET_USER_MODE_LINUX)),true,false),'; \
 	echo ''; \
 	echo '    "ArtUseReadBarrier": $(if $(filter false,$(PRODUCT_ART_USE_READ_BARRIER)),false,true),'; \
 	echo ''; \
-	echo '    "BtConfigIncludeDir": "$(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR)"'; \
+	echo '    "BtConfigIncludeDir": "$(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR)",'; \
+	echo ''; \
+	echo '    "DeviceKernelHeaders": $(call json_list,$(strip $(TARGET_PROJECT_SYSTEM_INCLUDES)))'; \
 	echo '}') > $(SOONG_VARIABLES_TMP); \
 	if ! cmp -s $(SOONG_VARIABLES_TMP) $(SOONG_VARIABLES); then \
 	  mv $(SOONG_VARIABLES_TMP) $(SOONG_VARIABLES); \
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
new file mode 100644
index 0000000..ee8b199
--- /dev/null
+++ b/core/soong_java_prebuilt.mk
@@ -0,0 +1,45 @@
+# Java prebuilt coming from Soong.
+# Extra inputs:
+# LOCAL_SOONG_HEADER_JAR
+# LOCAL_SOONG_DEX
+
+ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+  $(call pretty-error,soong_java_prebuilt.mk may only be used from Soong)
+endif
+
+# TODO: device support
+ifndef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,exporting soong device jars to make not supported yet)
+endif
+
+LOCAL_MODULE_SUFFIX := .jar
+LOCAL_BUILT_MODULE_STEM := javalib.jar
+
+#######################################
+include $(BUILD_SYSTEM)/base_rules.mk
+#######################################
+
+full_classes_jar := $(intermediates.COMMON)/classes.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
+
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_PREBUILT_MODULE_FILE)
+
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
+
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
+
+ifdef LOCAL_SOONG_HEADER_JAR
+$(eval $(call copy-one-file,$(LOCAL_SOONG_HEADER_JAR),$(full_classes_header_jar)))
+else
+$(eval $(call copy-one-file,$(full_classes_jar),$(full_classes_header_jar)))
+endif
+
+javac-check : $(full_classes_jar)
+javac-check-$(LOCAL_MODULE) : $(full_classes_jar)
+
+# Built in equivalent to include $(CLEAR_VARS)
+LOCAL_SOONG_HEADER_JAR :=
+LOCAL_SOONG_DEX :=
diff --git a/core/static_java_library.mk b/core/static_java_library.mk
index 76584df..c39c40a 100644
--- a/core/static_java_library.mk
+++ b/core/static_java_library.mk
@@ -177,12 +177,14 @@
 endif  # LOCAL_USE_AAPT2
 
 $(LOCAL_BUILT_MODULE): $(R_file_stamp)
+$(java_source_list_file): $(R_file_stamp)
 ifdef LOCAL_JACK_ENABLED
 $(noshrob_classes_jack): $(R_file_stamp)
 $(full_classes_jack): $(R_file_stamp)
 $(jack_check_timestamp): $(R_file_stamp)
 endif # LOCAL_JACK_ENABLED
 $(full_classes_compiled_jar): $(R_file_stamp)
+$(full_classes_turbine_jar): $(R_file_stamp)
 
 
 # if we have custom proguarding done use the proguarded classes jar instead of the normal classes jar
@@ -199,6 +201,7 @@
 $(built_aar): PRIVATE_CLASSES_JAR := $(aar_classes_jar)
 $(built_aar): PRIVATE_RESOURCE_DIR := $(LOCAL_RESOURCE_DIR)
 $(built_aar): PRIVATE_R_TXT := $(LOCAL_INTERMEDIATE_SOURCE_DIR)/R.txt
+$(built_aar): $(JAR_ARGS)
 $(built_aar) : $(aar_classes_jar) $(full_android_manifest)
 	@echo "target AAR:  $(PRIVATE_MODULE) ($@)"
 	$(hide) rm -rf $(dir $@)aar && mkdir -p $(dir $@)aar/res
@@ -207,8 +210,8 @@
 	# Note: Use "cp -n" to honor the resource overlay rules, if multiple res dirs exist.
 	$(hide) $(foreach res,$(PRIVATE_RESOURCE_DIR),cp -Rfn $(res)/* $(dir $@)aar/res;)
 	$(hide) cp $(PRIVATE_R_TXT) $(dir $@)aar/R.txt
-	$(hide) jar -cMf $@ \
-	  -C $(dir $@)aar .
+	$(hide) $(JAR) -cMf $@ \
+	  $(call jar-args-sorted-files-in-directory,$(dir $@)aar)
 
 # Register the aar file.
 ALL_MODULES.$(LOCAL_MODULE).AAR := $(built_aar)
diff --git a/core/tasks/build_custom_images.mk b/core/tasks/build_custom_images.mk
index 0750217..c9b07da 100644
--- a/core/tasks/build_custom_images.mk
+++ b/core/tasks/build_custom_images.mk
@@ -36,6 +36,8 @@
 #     image. <dest> is relativ to the root of the image.
 #   - CUSTOM_IMAGE_SELINUX, set to "true" if the image supports selinux.
 #   - CUSTOM_IMAGE_SUPPORT_VERITY, set to "true" if the product supports verity.
+#   - CUSTOM_IMAGE_SUPPORT_VERITY_FEC, set to "true" if the product supports
+#     verity FEC (forward error correction).
 #   - CUSTOM_IMAGE_VERITY_BLOCK_DEVICE
 #   - CUSTOM_IMAGE_AVB_HASH_ENABLE, set to "true" to add AVB HASH footer.
 #   - CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS, additional args of AVB HASH footer.
@@ -61,6 +63,7 @@
   CUSTOM_IMAGE_COPY_FILES \
   CUSTOM_IMAGE_SELINUX \
   CUSTOM_IMAGE_SUPPORT_VERITY \
+  CUSTOM_IMAGE_SUPPORT_VERITY_FEC \
   CUSTOM_IMAGE_VERITY_BLOCK_DEVICE \
   CUSTOM_IMAGE_AVB_HASH_ENABLE \
   CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS \
diff --git a/core/tasks/device-tests.mk b/core/tasks/device-tests.mk
index b1b936a..d679c59 100644
--- a/core/tasks/device-tests.mk
+++ b/core/tasks/device-tests.mk
@@ -17,11 +17,11 @@
 
 device-tests-zip := $(PRODUCT_OUT)/device-tests.zip
 $(device-tests-zip): $(COMPATIBILITY.device-tests.FILES) $(SOONG_ZIP)
-	echo $(sort $(COMPATIBILITY.device-tests.FILES)) > $@.list
-	sed -i -e 's/\s\+/\n/g' $@.list
+	echo $(sort $(COMPATIBILITY.device-tests.FILES)) | tr " " "\n" > $@.list
 	grep $(HOST_OUT_TESTCASES) $@.list > $@-host.list || true
 	grep $(TARGET_OUT_TESTCASES) $@.list > $@-target.list || true
 	$(hide) $(SOONG_ZIP) -d -o $@ -P host -C $(HOST_OUT) -l $@-host.list -P target -C $(PRODUCT_OUT) -l $@-target.list
+	rm -f $@.list $@-host.list $@-target.list
 
 device-tests: $(device-tests-zip)
 $(call dist-for-goals, device-tests, $(device-tests-zip))
diff --git a/core/tasks/general-tests.mk b/core/tasks/general-tests.mk
index 763dd51..bf4eb1d 100644
--- a/core/tasks/general-tests.mk
+++ b/core/tasks/general-tests.mk
@@ -16,11 +16,11 @@
 
 general-tests-zip := $(PRODUCT_OUT)/general-tests.zip
 $(general-tests-zip): $(COMPATIBILITY.general-tests.FILES) $(SOONG_ZIP)
-	echo $(sort $(COMPATIBILITY.general-tests.FILES)) > $@.list
-	sed -i -e 's/\s\+/\n/g' $@.list
+	echo $(sort $(COMPATIBILITY.general-tests.FILES)) | tr " " "\n" > $@.list
 	grep $(HOST_OUT_TESTCASES) $@.list > $@-host.list || true
 	grep $(TARGET_OUT_TESTCASES) $@.list > $@-target.list || true
 	$(hide) $(SOONG_ZIP) -d -o $@ -P host -C $(HOST_OUT) -l $@-host.list -P target -C $(PRODUCT_OUT) -l $@-target.list
+	rm -f $@.list $@-host.list $@-target.list
 
 general-tests: $(general-tests-zip)
 $(call dist-for-goals, general-tests, $(general-tests-zip))
diff --git a/core/tasks/sdk-addon.mk b/core/tasks/sdk-addon.mk
index 362b229..e3bd47d 100644
--- a/core/tasks/sdk-addon.mk
+++ b/core/tasks/sdk-addon.mk
@@ -35,7 +35,7 @@
 define stub-addon-jar
 $(call stub-addon-jar-file,$(1)): $(1) | mkstubs
 	$(info Stubbing addon jar using $(PRODUCT_SDK_ADDON_STUB_DEFS))
-	$(hide) java -jar $(call module-installed-files,mkstubs) $(if $(hide),,--v) \
+	$(hide) $(JAVA) -jar $(call module-installed-files,mkstubs) $(if $(hide),,--v) \
 		"$$<" "$$@" @$(PRODUCT_SDK_ADDON_STUB_DEFS)
 endef
 
@@ -63,7 +63,7 @@
 
 # Files copied in the system-image directory
 files_to_copy += \
-	$(addon_dir_img):$(BUILT_SYSTEMIMAGE):images/$(TARGET_CPU_ABI)/system.img \
+	$(addon_dir_img):$(INSTALLED_QEMU_SYSTEMIMAGE):images/$(TARGET_CPU_ABI)/system.img \
 	$(addon_dir_img):$(BUILT_USERDATAIMAGE_TARGET):images/$(TARGET_CPU_ABI)/userdata.img \
 	$(addon_dir_img):$(BUILT_RAMDISK_TARGET):images/$(TARGET_CPU_ABI)/ramdisk.img \
 	$(addon_dir_img):$(PRODUCT_OUT)/system/build.prop:images/$(TARGET_CPU_ABI)/build.prop \
diff --git a/core/tasks/tools/build_custom_image.mk b/core/tasks/tools/build_custom_image.mk
index 8c098d6..370934b 100644
--- a/core/tasks/tools/build_custom_image.mk
+++ b/core/tasks/tools/build_custom_image.mk
@@ -62,12 +62,16 @@
   $(eval my_image_copy_files += $(src))\
   $(eval my_copy_pairs += $(src):$(my_staging_dir)/$(word 2,$(pair))))
 
-ifndef CUSTOM_IMAGE_AVB_KEY_PATH
-# If key path isn't specified, use the default signing args.
-my_avb_signing_args := $(INTERNAL_AVB_SIGNING_ARGS)
-else
-my_avb_signing_args := \
-  --algorithm $(CUSTOM_IMAGE_AVB_ALGORITHM) --key $(CUSTOM_IMAGE_AVB_KEY_PATH)
+ifdef CUSTOM_IMAGE_AVB_KEY_PATH
+ifndef CUSTOM_IMAGE_AVB_ALGORITHM
+  $(error CUSTOM_IMAGE_AVB_ALGORITHM is not defined)
+endif
+ifndef CUSTOM_IMAGE_AVB_ROLLBACK_INDEX
+  $(error CUSTOM_IMAGE_AVB_ROLLBACK_INDEX is not defined)
+endif
+# set rollback_index via footer args
+CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS += --rollback_index $(CUSTOM_IMAGE_AVB_ROLLBACK_INDEX)
+CUSTOM_IMAGE_AVB_ADD_HASHTREE_FOOTER_ARGS += --rollback_index $(CUSTOM_IMAGE_AVB_ROLLBACK_INDEX)
 endif
 
 $(my_built_custom_image): PRIVATE_INTERMEDIATES := $(intermediates)
@@ -79,11 +83,13 @@
 $(my_built_custom_image): PRIVATE_PICKUP_FILES := $(my_pickup_files)
 $(my_built_custom_image): PRIVATE_SELINUX := $(CUSTOM_IMAGE_SELINUX)
 $(my_built_custom_image): PRIVATE_SUPPORT_VERITY := $(CUSTOM_IMAGE_SUPPORT_VERITY)
+$(my_built_custom_image): PRIVATE_SUPPORT_VERITY_FEC := $(CUSTOM_IMAGE_SUPPORT_VERITY_FEC)
 $(my_built_custom_image): PRIVATE_VERITY_KEY := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY)
 $(my_built_custom_image): PRIVATE_VERITY_BLOCK_DEVICE := $(CUSTOM_IMAGE_VERITY_BLOCK_DEVICE)
 $(my_built_custom_image): PRIVATE_DICT_FILE := $(CUSTOM_IMAGE_DICT_FILE)
 $(my_built_custom_image): PRIVATE_AVB_AVBTOOL := $(AVBTOOL)
-$(my_built_custom_image): PRIVATE_AVB_SIGNING_ARGS := $(my_avb_signing_args)
+$(my_built_custom_image): PRIVATE_AVB_KEY_PATH := $(CUSTOM_IMAGE_AVB_KEY_PATH)
+$(my_built_custom_image): PRIVATE_AVB_ALGORITHM:= $(CUSTOM_IMAGE_AVB_ALGORITHM)
 $(my_built_custom_image): PRIVATE_AVB_HASH_ENABLE := $(CUSTOM_IMAGE_AVB_HASH_ENABLE)
 $(my_built_custom_image): PRIVATE_AVB_ADD_HASH_FOOTER_ARGS := $(CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS)
 $(my_built_custom_image): PRIVATE_AVB_HASHTREE_ENABLE := $(CUSTOM_IMAGE_AVB_HASHTREE_ENABLE)
@@ -93,7 +99,15 @@
 else ifneq (,$(filter true, $(CUSTOM_IMAGE_AVB_HASH_ENABLE) $(CUSTOM_IMAGE_AVB_HASHTREE_ENABLE)))
   $(error Cannot set both CUSTOM_IMAGE_AVB_HASH_ENABLE and CUSTOM_IMAGE_AVB_HASHTREE_ENABLE to true)
 endif
-$(my_built_custom_image): $(INTERNAL_USERIMAGES_DEPS) $(my_built_modules) $(my_image_copy_files) \
+ifeq (true,$(CUSTOM_IMAGE_SUPPORT_VERITY_FEC))
+  $(my_built_custom_image): $(FEC)
+endif
+my_custom_image_modules_var:=BOARD_$(strip $(call to-upper,$(my_custom_image_name)))_KERNEL_MODULES
+my_custom_image_modules:=$($(my_custom_image_modules_var))
+my_custom_image_modules_dep:=$(if $(my_custom_image_modules),$(my_custom_image_modules) $(DEPMOD),)
+$(my_built_custom_image): PRIVATE_KERNEL_MODULES := $(my_custom_image_modules)
+$(my_built_custom_image): PRIVATE_IMAGE_NAME := $(my_custom_image_name)
+$(my_built_custom_image): $(INTERNAL_USERIMAGES_DEPS) $(my_built_modules) $(my_image_copy_files) $(my_custom_image_modules_dep) \
   $(CUSTOM_IMAGE_DICT_FILE)
 	@echo "Build image $@"
 	$(hide) rm -rf $(PRIVATE_INTERMEDIATES) && mkdir -p $(PRIVATE_INTERMEDIATES)
@@ -103,6 +117,8 @@
 	          $(eval pair := $(subst :,$(space),$(p)))\
 	          mkdir -p $(dir $(word 2,$(pair)));\
 	          cp -Rf $(word 1,$(pair)) $(word 2,$(pair));)
+	$(if $(PRIVATE_KERNEL_MODULES), \
+		$(call build-image-kernel-modules,$(PRIVATE_KERNEL_MODULES),$(PRIVATE_STAGING_DIR),$(PRIVATE_IMAGE_NAME)/,$(call intermediates-dir-for,PACKAGING,depmod_$(PRIVATE_IMAGE_NAME))))
 	$(if $($(PRIVATE_PICKUP_FILES)),$(hide) cp -Rf $(PRIVATE_PICKUP_FILES) $(PRIVATE_STAGING_DIR))
 	# Generate the dict.
 	$(hide) echo "# For all accepted properties, see BuildImage() in tools/releasetools/build_image.py" > $(PRIVATE_INTERMEDIATES)/image_info.txt
@@ -117,8 +133,12 @@
 	    echo "verity_key=$(PRIVATE_VERITY_KEY)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
 	    echo "verity_signer_cmd=$(VERITY_SIGNER)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
 	    echo "verity_block_device=$(PRIVATE_VERITY_BLOCK_DEVICE)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
+	$(if $(PRIVATE_SUPPORT_VERITY_FEC),\
+	  $(hide) echo "verity_fec=$(PRIVATE_SUPPORT_VERITY_FEC)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
 	$(hide) echo "avb_avbtool=$(PRIVATE_AVB_AVBTOOL)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt
-	$(hide) echo "avb_signing_args=$(PRIVATE_AVB_SIGNING_ARGS)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt
+	$(if $(PRIVATE_AVB_KEY_PATH),\
+	  $(hide) echo "avb_key_path=$(PRIVATE_AVB_KEY_PATH)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
+	    echo "avb_algorithm=$(PRIVATE_AVB_ALGORITHM)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
 	$(if $(PRIVATE_AVB_HASH_ENABLE),\
 	  $(hide) echo "avb_hash_enable=$(PRIVATE_AVB_HASH_ENABLE)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
 	    echo "avb_add_hash_footer_args=$(PRIVATE_AVB_ADD_HASH_FOOTER_ARGS)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
@@ -144,3 +164,9 @@
 
 # Archive the built image.
 $(call dist-for-goals, $(my_custom_image_name) custom_images,$(my_installed_custom_image))
+
+my_staging_dir :=
+my_built_modules :=
+my_copy_dest :=
+my_copy_pairs :=
+my_pickup_files :=
diff --git a/core/tasks/tools/package-modules.mk b/core/tasks/tools/package-modules.mk
index 63fab63..629a9b2 100644
--- a/core/tasks/tools/package-modules.mk
+++ b/core/tasks/tools/package-modules.mk
@@ -4,6 +4,7 @@
 # Input variables:
 #   my_modules: a list of module names
 #   my_package_name: the name of the output zip file.
+#   my_copy_pairs: a list of extra files to install (in src:dest format)
 # Output variables:
 #   my_package_zip: the path to the output zip file.
 #
@@ -11,8 +12,8 @@
 
 my_makefile := $(lastword $(filter-out $(lastword $(MAKEFILE_LIST)),$(MAKEFILE_LIST)))
 my_staging_dir := $(call intermediates-dir-for,PACKAGING,$(my_package_name))
-my_built_modules :=
-my_copy_pairs :=
+my_built_modules := $(foreach p,$(my_copy_pairs),$(call word-colon,1,$(p)))
+my_copy_pairs := $(foreach p,$(my_copy_pairs),$(call word-colon,1,$(p)):$(my_staging_dir)/$(call word-colon,2,$(p)))
 my_pickup_files :=
 
 # Iterate over the modules and include their direct dependencies stated in the
@@ -67,3 +68,12 @@
 	$(hide) $(foreach f, $(PRIVATE_PICKUP_FILES),\
 	  cp -RfL $(f) $(dir $@) && ) true
 	$(hide) cd $(dir $@) && zip -rqX $(notdir $@) *
+
+my_makefile :=
+my_staging_dir :=
+my_built_modules :=
+my_copy_dest :=
+my_copy_pairs :=
+my_pickup_files :=
+my_missing_files :=
+my_modules_and_deps :=
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 344843a..84281bb 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -40,7 +40,7 @@
 
 DEFAULT_PLATFORM_VERSION := OPD1
 MIN_PLATFORM_VERSION := OPD1
-MAX_PLATFORM_VERSION := OPD1
+MAX_PLATFORM_VERSION := PPR1
 
 ALLOWED_VERSIONS := $(call allowed-platform-versions,\
   $(MIN_PLATFORM_VERSION),\
@@ -79,11 +79,15 @@
 # When you change PLATFORM_VERSION for a given PLATFORM_SDK_VERSION
 # please add that PLATFORM_VERSION to the following text file:
 # cts/tests/tests/os/assets/platform_versions.txt
-PLATFORM_VERSION.OPD1 := 8.0.0
+PLATFORM_VERSION.OPD1 := 8.0.1
+PLATFORM_VERSION.OPM1 := OMR1
+PLATFORM_VERSION.PPR1 := P
 
 # These are the current development codenames, if the build is not a final
 # release build.  If this is a final release build, it is simply "REL".
 PLATFORM_VERSION_CODENAME.OPD1 := REL
+PLATFORM_VERSION_CODENAME.OPM1 := OMR1
+PLATFORM_VERSION_CODENAME.PPR1 := P
 
 ifndef PLATFORM_VERSION
   PLATFORM_VERSION := $(PLATFORM_VERSION.$(TARGET_PLATFORM_VERSION))
@@ -129,14 +133,17 @@
     PLATFORM_VERSION_CODENAME := $(TARGET_PLATFORM_VERSION)
   endif
 
-  # This is all of the development codenames that are active.  Should be either
-  # the same as PLATFORM_VERSION_CODENAME or a comma-separated list of additional
-  # codenames after PLATFORM_VERSION_CODENAME.
+  # This is all of the *active* development codenames. There are future
+  # codenames not included in this list. This confusing name is needed because
+  # all_codenames has been baked into build.prop for ages.
+  #
+  # Should be either the same as PLATFORM_VERSION_CODENAME or a comma-separated
+  # list of additional codenames after PLATFORM_VERSION_CODENAME.
   PLATFORM_VERSION_ALL_CODENAMES :=
 
-  # Build a list of all possible code names. Avoid duplicates, and stop when we
+  # Build a list of all active code names. Avoid duplicates, and stop when we
   # reach a codename that matches PLATFORM_VERSION_CODENAME (anything beyond
-  # that is not included in our build.
+  # that is not included in our build).
   _versions_in_target := \
     $(call find_and_earlier,$(ALL_VERSIONS),$(TARGET_PLATFORM_VERSION))
   $(foreach version,$(_versions_in_target),\
@@ -144,9 +151,23 @@
     $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_CODENAMES)),,\
       $(eval PLATFORM_VERSION_ALL_CODENAMES += $(_codename))))
 
+  # This is all of the inactive development codenames. Available to be targeted
+  # in this branch but in the future relative to our current target.
+  PLATFORM_VERSION_FUTURE_CODENAMES :=
+
+  # Build a list of all untargeted code names. Avoid duplicates.
+  _versions_not_in_target := \
+    $(filter-out $(PLATFORM_VERSION_ALL_CODENAMES),$(ALL_VERSIONS))
+  $(foreach version,$(_versions_not_in_target),\
+    $(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
+    $(if $(filter $(_codename),$(PLATFORM_VERSION_FUTURE_CODENAMES)),,\
+      $(eval PLATFORM_VERSION_FUTURE_CODENAMES += $(_codename))))
+
   # And convert from space separated to comma separated.
   PLATFORM_VERSION_ALL_CODENAMES := \
     $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_ALL_CODENAMES)))
+  PLATFORM_VERSION_FUTURE_CODENAMES := \
+    $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_FUTURE_CODENAMES)))
 
 endif
 
@@ -212,7 +233,7 @@
   BUILD_DATETIME := $(shell date +%s)
 endif
 
-ifneq (,$(findstring Darwin,$(shell uname -sm)))
+ifneq (,$(findstring Darwin,$(UNAME)))
 DATE := date -r $(BUILD_DATETIME)
 else
 DATE := date -d @$(BUILD_DATETIME)
diff --git a/envsetup.sh b/envsetup.sh
index 7073d82..3f718bd 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -1,7 +1,13 @@
 function hmm() {
 cat <<EOF
+
+Run "m help" for help with the build system itself.
+
 Invoke ". build/envsetup.sh" from your shell to add the following functions to your environment:
 - lunch:     lunch <product_name>-<build_variant>
+             Selects <product_name> as the product to build, and <build_variant> as the variant to
+             build, and stores those selections in the environment to be read by subsequent
+             invocations of 'm' etc.
 - tapas:     tapas [<App1> <App2> ...] [arm|x86|mips|armv5|arm64|x86_64|mips64] [eng|userdebug|user]
 - croot:     Changes directory to the top of the tree.
 - m:         Makes from the top of the tree.
@@ -258,13 +264,11 @@
     export PATH=$ANDROID_BUILD_PATHS$PATH
     export PYTHONPATH=$T/development/python-packages:$PYTHONPATH
 
-    unset ANDROID_JAVA_TOOLCHAIN
-    unset ANDROID_PRE_BUILD_PATHS
-    if [ -n "$JAVA_HOME" ]; then
-        export ANDROID_JAVA_TOOLCHAIN=$JAVA_HOME/bin
-        export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
-        export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
-    fi
+    export ANDROID_JAVA_HOME=$(get_abs_build_var ANDROID_JAVA_HOME)
+    export JAVA_HOME=$ANDROID_JAVA_HOME
+    export ANDROID_JAVA_TOOLCHAIN=$(get_abs_build_var ANDROID_JAVA_TOOLCHAIN)
+    export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
+    export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
 
     unset ANDROID_PRODUCT_OUT
     export ANDROID_PRODUCT_OUT=$(get_abs_build_var PRODUCT_OUT)
@@ -297,7 +301,6 @@
 function set_stuff_for_environment()
 {
     settitle
-    set_java_home
     setpaths
     set_sequence_number
 
@@ -753,7 +756,7 @@
     local T=$(gettop)
     local DRV=$(getdriver $T)
     if [ "$T" ]; then
-        $DRV make -C $T -f build/core/main.mk $@
+        _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@
     else
         echo "Couldn't locate the top of the tree.  Try setting TOP."
         return 1
@@ -782,9 +785,9 @@
     local T=$(gettop)
     local DRV=$(getdriver $T)
     # If we're sitting in the root of the build tree, just do a
-    # normal make.
-    if [ -f build/core/envsetup.mk -a -f Makefile ]; then
-        $DRV make $@
+    # normal build.
+    if [ -f build/soong/soong_ui.bash ]; then
+        _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@
     else
         # Find the closest Android.mk file.
         local M=$(findmakefile)
@@ -819,7 +822,7 @@
             if [ "1" = "${WITH_TIDY_ONLY}" -o "true" = "${WITH_TIDY_ONLY}" ]; then
               MODULES=tidy_only
             fi
-            ONE_SHOT_MAKEFILE=$M $DRV make -C $T -f build/core/main.mk $MODULES $ARGS
+            ONE_SHOT_MAKEFILE=$M _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $MODULES $ARGS
         fi
     fi
 }
@@ -887,7 +890,7 @@
         fi
         # Convert "/" to "-".
         MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-        ONE_SHOT_MAKEFILE="$MAKEFILE" $DRV make -C $T -f build/core/main.mk $DASH_ARGS $MODULES $MODULES_IN_PATHS $ARGS
+        ONE_SHOT_MAKEFILE="$MAKEFILE" _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $DASH_ARGS $MODULES $MODULES_IN_PATHS $ARGS
     else
         echo "Couldn't locate the top of the tree.  Try setting TOP."
         return 1
@@ -898,8 +901,8 @@
 {
   local T=$(gettop)
   local DRV=$(getdriver $T)
-  if [ -f build/core/envsetup.mk -a -f Makefile ]; then
-    $DRV make $@
+  if [ -f build/soong/soong_ui.bash ]; then
+    _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@
   else
     if [ ! "$T" ]; then
       echo "Couldn't locate the top of the tree.  Try setting TOP."
@@ -911,7 +914,7 @@
     local MODULES_IN_PATHS=MODULES-IN-$(dirname ${M})
     # Convert "/" to "-".
     MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-    $DRV make -C $T -f build/core/main.mk $@ $MODULES_IN_PATHS
+    _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $@ $MODULES_IN_PATHS
   fi
 }
 
@@ -949,7 +952,7 @@
     done
     # Convert "/" to "-".
     MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-    $DRV make -C $T -f build/core/main.mk $DASH_ARGS $ARGS $MODULES_IN_PATHS
+    _wrap_build $DRV $T/build/soong/soong_ui.bash --make-mode $DASH_ARGS $ARGS $MODULES_IN_PATHS
   else
     echo "Couldn't locate the top of the tree.  Try setting TOP."
     return 1
@@ -1540,46 +1543,6 @@
     \cd $T/$pathname
 }
 
-# Force JAVA_HOME to point to java 1.7/1.8 if it isn't already set.
-function set_java_home() {
-    # Clear the existing JAVA_HOME value if we set it ourselves, so that
-    # we can reset it later, depending on the version of java the build
-    # system needs.
-    #
-    # If we don't do this, the JAVA_HOME value set by the first call to
-    # build/envsetup.sh will persist forever.
-    if [ -n "$ANDROID_SET_JAVA_HOME" ]; then
-      export JAVA_HOME=""
-    fi
-
-    if [ ! "$JAVA_HOME" ]; then
-      if [ -n "$LEGACY_USE_JAVA7" ]; then
-        echo Warning: Support for JDK 7 will be dropped. Switch to JDK 8.
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.7)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64
-                ;;
-        esac
-      else
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
-                ;;
-        esac
-      fi
-
-      # Keep track of the fact that we set JAVA_HOME ourselves, so that
-      # we can change it on the next envsetup.sh, if required.
-      export ANDROID_SET_JAVA_HOME=true
-    fi
-}
-
 # Print colored exit condition
 function pez {
     "$@"
@@ -1595,13 +1558,25 @@
 
 function get_make_command()
 {
-  echo command make
+    # If we're in the top of an Android tree, use soong_ui.bash instead of make
+    if [ -f build/soong/soong_ui.bash ]; then
+        # Always use the real make if -C is passed in
+        for arg in "$@"; do
+            if [[ $arg == -C* ]]; then
+                echo command make
+                return
+            fi
+        done
+        echo build/soong/soong_ui.bash --make-mode
+    else
+        echo command make
+    fi
 }
 
-function make()
+function _wrap_build()
 {
     local start_time=$(date +"%s")
-    $(get_make_command) "$@"
+    "$@"
     local ret=$?
     local end_time=$(date +"%s")
     local tdiff=$(($end_time-$start_time))
@@ -1620,9 +1595,9 @@
     fi
     echo
     if [ $ret -eq 0 ] ; then
-        echo -n "${color_success}#### make completed successfully "
+        echo -n "${color_success}#### build completed successfully "
     else
-        echo -n "${color_failed}#### make failed to build some targets "
+        echo -n "${color_failed}#### failed to build some targets "
     fi
     if [ $hours -gt 0 ] ; then
         printf "(%02g:%02g:%02g (hh:mm:ss))" $hours $mins $secs
@@ -1636,6 +1611,11 @@
     return $ret
 }
 
+function make()
+{
+    _wrap_build $(get_make_command "$@") "$@"
+}
+
 function provision()
 {
     if [ ! "$ANDROID_PRODUCT_OUT" ]; then
@@ -1665,6 +1645,14 @@
     "$ANDROID_PRODUCT_OUT/provision-device" "$@"
 }
 
+function atest()
+{
+    # TODO (sbasi): Replace this to be a destination in the build out when & if
+    # atest is built by the build system. (This will be necessary if it ever
+    # depends on external pip projects).
+    "$(gettop)"/tools/tradefederation/core/atest/atest.py "$@"
+}
+
 if [ "x$SHELL" != "x/bin/bash" ]; then
     case `ps -o command -p $$` in
         *bash*)
diff --git a/help.sh b/help.sh
new file mode 100755
index 0000000..c031dcc
--- /dev/null
+++ b/help.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# locate some directories
+cd "$(dirname $0)"
+SCRIPT_DIR="${PWD}"
+cd ../..
+TOP="${PWD}"
+
+message='The basic Android build process is:
+
+cd '"${TOP}"'
+source build/envsetup.sh    # Add "lunch" (and other utilities and variables)
+                            # to the shell environment.
+lunch [<product>-<variant>] # Choose the device to target.
+m -j [<goals>]              # Execute the configured build.
+
+Usage of "m" imitates usage of the program "make".
+See '"${SCRIPT_DIR}"'/README.txt for more info about build usage and concepts.
+
+Common goals are:
+
+    clean                   (aka clobber) equivalent to rm -rf out/
+    checkbuild              Build every module defined in the source tree
+    droid                   Default target
+    nothing                 Do not build anything, just parse and validate the build structure
+
+    java                    Build all the java code in the source tree
+    native                  Build all the native code in the source tree
+
+    host                    Build all the host code (not to be run on a device) in the source tree
+    target                  Build all the target code (to be run on the device) in the source tree
+
+    (java|native)-(host|target)
+    (host|target)-(java|native)
+                            Build the intersection of the two given arguments
+
+    snod                    Quickly rebuild the system image from built packages
+                            Stands for "System, NO Dependencies"
+    vnod                    Quickly rebuild the vendor image from built packages
+                            Stands for "Vendor, NO Dependencies"
+
+
+So, for example, you could run:
+
+cd '"${TOP}"'
+source build/envsetup.sh
+lunch aosp_arm-userdebug
+m -j java
+
+to build all of the java code for the userdebug variant of the aosp_arm device.
+'
+
+echo "$message"
diff --git a/target/Android.mk b/target/Android.mk
new file mode 100644
index 0000000..9929b00
--- /dev/null
+++ b/target/Android.mk
@@ -0,0 +1,23 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+# Only if this Android.mk was included not by a symlink should it be used.
+# This facilitates the transition away from symlinks: b/64397960
+ifeq ($(LOCAL_PATH),build/make/target)
+include $(call first-makefiles-under,$(LOCAL_PATH))
+endif
diff --git a/target/board/Android.mk b/target/board/Android.mk
index e23ab21..c5678d1 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -83,7 +83,7 @@
 ifeq ($(PRODUCT_FULL_TREBLE),true)
 ifdef BUILT_VENDOR_MATRIX
 $(GEN): $(BUILT_VENDOR_MATRIX)
-$(GEN): PRIVATE_FLAGS := -c "$(BUILT_VENDOR_MATRIX)"
+$(GEN): PRIVATE_FLAGS += -c "$(BUILT_VENDOR_MATRIX)"
 endif
 endif
 
@@ -110,7 +110,7 @@
 ifeq ($(PRODUCT_FULL_TREBLE),true)
 ifdef BUILT_VENDOR_MANIFEST
 $(GEN): $(BUILT_VENDOR_MANIFEST)
-$(GEN): PRIVATE_FLAGS := -c "$(BUILT_VENDOR_MANIFEST)"
+$(GEN): PRIVATE_FLAGS += -c "$(BUILT_VENDOR_MANIFEST)"
 endif
 endif
 
@@ -130,6 +130,19 @@
 FRAMEWORK_VBMETA_VERSION := 0.0
 endif
 
+# All kernel versions that the system image works with.
+KERNEL_VERSIONS := 3.18 4.4 4.9
+KERNEL_CONFIG_DATA := kernel/configs
+
+$(GEN): $(foreach version,$(KERNEL_VERSIONS),\
+	$(wildcard $(KERNEL_CONFIG_DATA)/android-$(version)/android-base*.cfg))
+$(GEN): PRIVATE_FLAGS += $(foreach version,$(KERNEL_VERSIONS),\
+	--kernel=$(version):$(call normalize-path-list,\
+		$(wildcard $(KERNEL_CONFIG_DATA)/android-$(version)/android-base*.cfg)))
+
+KERNEL_VERSIONS :=
+KERNEL_CONFIG_DATA :=
+
 $(GEN): $(FRAMEWORK_COMPATIBILITY_MATRIX_FILE) $(HOST_OUT_EXECUTABLES)/assemble_vintf
 	# TODO(b/37405869) (b/37715375) inject avb versions as well for devices that have avb enabled.
 	POLICYVERS=$(POLICYVERS) \
diff --git a/target/board/generic/BoardConfig.mk b/target/board/generic/BoardConfig.mk
index 946e480..609cf25 100644
--- a/target/board/generic/BoardConfig.mk
+++ b/target/board/generic/BoardConfig.mk
@@ -43,6 +43,7 @@
 
 # Build OpenGLES emulation guest and host libraries
 BUILD_EMULATOR_OPENGL := true
+BUILD_QEMU_IMAGES := true
 
 # Build and enable the OpenGL ES View renderer. When running on the emulator,
 # the GLES renderer disables itself if host GL acceleration isn't available.
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index 5917425..d11f914 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -35,11 +35,11 @@
 # platforms.
 #
 # If you're building a 64 bit platform (and not an application) the
-# ARM-v8 specification allows you to assume NEON and all the features
-# available in a cortex-A15 CPU. You should be able to set :
+# ARM-v8 specification allows you to assume all the features available in an
+# armv7-a-neon CPU. You should set the following as 2nd arch/cpu variant:
 #
-# TARGET_2ND_ARCH_VARIANT := armv7-a-neon
-# TARGET_2ND_CPU_VARIANT := cortex-a15
+# TARGET_2ND_ARCH_VARIANT := armv8-a
+# TARGET_2ND_CPU_VARIANT := generic
 #
 # DO NOT USE
 # DO NOT USE
@@ -50,8 +50,8 @@
 # DO NOT USE
 # DO NOT USE
 else
-TARGET_2ND_ARCH_VARIANT := armv7-a-neon
-TARGET_2ND_CPU_VARIANT := cortex-a15
+TARGET_2ND_ARCH_VARIANT := armv8-a
+TARGET_2ND_CPU_VARIANT := generic
 endif
 
 
@@ -74,6 +74,7 @@
 
 # Build OpenGLES emulation host and guest libraries
 BUILD_EMULATOR_OPENGL := true
+BUILD_QEMU_IMAGES := true
 
 # Build and enable the OpenGL ES View renderer. When running on the emulator,
 # the GLES renderer disables itself if host GL acceleration isn't available.
diff --git a/target/board/generic_arm64_ab/BoardConfig.mk b/target/board/generic_arm64_ab/BoardConfig.mk
index e05f345..5b6b27c 100644
--- a/target/board/generic_arm64_ab/BoardConfig.mk
+++ b/target/board/generic_arm64_ab/BoardConfig.mk
@@ -84,3 +84,5 @@
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
 BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
+
+BOARD_VNDK_VERSION := current
diff --git a/target/board/generic_mips/BoardConfig.mk b/target/board/generic_mips/BoardConfig.mk
index c36cc4a..cd29f35 100644
--- a/target/board/generic_mips/BoardConfig.mk
+++ b/target/board/generic_mips/BoardConfig.mk
@@ -51,6 +51,7 @@
 
 # Build OpenGLES emulation guest and host libraries
 BUILD_EMULATOR_OPENGL := true
+BUILD_QEMU_IMAGES := true
 
 # Build and enable the OpenGL ES View renderer. When running on the emulator,
 # the GLES renderer disables itself if host GL acceleration isn't available.
diff --git a/target/board/generic_mips64/BoardConfig.mk b/target/board/generic_mips64/BoardConfig.mk
index 4798e3f..17aae27 100644
--- a/target/board/generic_mips64/BoardConfig.mk
+++ b/target/board/generic_mips64/BoardConfig.mk
@@ -66,6 +66,7 @@
 
 # Build OpenGLES emulation guest and host libraries
 BUILD_EMULATOR_OPENGL := true
+BUILD_QEMU_IMAGES := true
 
 # Build and enable the OpenGL ES View renderer. When running on the emulator,
 # the GLES renderer disables itself if host GL acceleration isn't available.
diff --git a/target/board/generic_x86/BoardConfig.mk b/target/board/generic_x86/BoardConfig.mk
index 26b2944..08bd6d1 100644
--- a/target/board/generic_x86/BoardConfig.mk
+++ b/target/board/generic_x86/BoardConfig.mk
@@ -31,6 +31,10 @@
 # Build OpenGLES emulation host and guest libraries
 BUILD_EMULATOR_OPENGL := true
 
+# Build partitioned system.img and vendor.img (if applicable)
+# for qemu, otherwise, init cannot find PART_NAME
+BUILD_QEMU_IMAGES := true
+
 # Build and enable the OpenGL ES View renderer. When running on the emulator,
 # the GLES renderer disables itself if host GL acceleration isn't available.
 USE_OPENGL_RENDERER := true
diff --git a/target/board/generic_x86_64/BoardConfig.mk b/target/board/generic_x86_64/BoardConfig.mk
index 9b8e5c8..2499199 100755
--- a/target/board/generic_x86_64/BoardConfig.mk
+++ b/target/board/generic_x86_64/BoardConfig.mk
@@ -36,6 +36,7 @@
 
 # Build OpenGLES emulation host and guest libraries
 BUILD_EMULATOR_OPENGL := true
+BUILD_QEMU_IMAGES := true
 
 # Build and enable the OpenGL ES View renderer. When running on the emulator,
 # the GLES renderer disables itself if host GL acceleration isn't available.
diff --git a/target/product/base.mk b/target/product/base.mk
index ad4c133..9dd48b7 100644
--- a/target/product/base.mk
+++ b/target/product/base.mk
@@ -23,6 +23,7 @@
     appops \
     am \
     android.policy \
+    android.test.mock \
     android.test.runner \
     app_process \
     applypatch \
@@ -147,6 +148,7 @@
 
 # Packages included only for eng or userdebug builds, previously debug tagged
 PRODUCT_PACKAGES_DEBUG := \
+    logpersist.start \
     perfprofd \
     sqlite3
 
@@ -158,5 +160,9 @@
 PRODUCT_COPY_FILES += $(call add-to-product-copy-files-if-exists,\
     frameworks/base/compiled-classes:system/etc/compiled-classes)
 
+# Note: it is acceptable to not have a dirty-image-objects file. In that case, the special bin
+#       for known dirty objects in the image will be empty.
+PRODUCT_COPY_FILES += $(call add-to-product-copy-files-if-exists,\
+    frameworks/base/dirty-image-objects:system/etc/dirty-image-objects)
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/embedded.mk)
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 9ea9a5a..7167160 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -102,20 +102,19 @@
     frameworks/native/data/etc/android.software.preview_sdk.xml:system/etc/permissions/android.software.preview_sdk.xml
 endif
 
+ifeq ($(TARGET_CORE_JARS),)
+$(error TARGET_CORE_JARS is empty; cannot initialize PRODUCT_BOOT_JARS variable)
+endif
+
 # The order of PRODUCT_BOOT_JARS matters.
 PRODUCT_BOOT_JARS := \
-    core-oj \
-    core-libart \
-    conscrypt \
-    okhttp \
+    $(TARGET_CORE_JARS) \
     legacy-test \
-    bouncycastle \
     ext \
     framework \
     telephony-common \
     voip-common \
     ims-common \
-    apache-xml \
     org.apache.http.legacy.boot \
     android.hidl.base-V1.0-java \
     android.hidl.manager-V1.0-java
@@ -124,7 +123,8 @@
 PRODUCT_SYSTEM_SERVER_JARS := \
     services \
     ethernet-service \
-    wifi-service
+    wifi-service \
+    com.android.location.provider \
 
 # The set of packages whose code can be loaded by the system server.
 PRODUCT_SYSTEM_SERVER_APPS += \
@@ -150,5 +150,15 @@
 PRODUCT_COPY_FILES += $(call add-to-product-copy-files-if-exists,\
     frameworks/base/compiled-classes-phone:system/etc/compiled-classes)
 
+# Enable dirty image object binning to reduce dirty pages in the image.
+PRODUCT_COPY_FILES += $(call add-to-product-copy-files-if-exists,\
+    frameworks/base/dirty-image-objects-phone:system/etc/dirty-image-objects)
+
+# On userdebug builds, collect more tombstones by default.
+ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
+PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    tombstoned.max_tombstone_count=50
+endif
+
 $(call inherit-product, $(SRC_TARGET_DIR)/product/runtime_libart.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base.mk)
diff --git a/target/product/core_tiny.mk b/target/product/core_tiny.mk
index f19009c..e473413 100644
--- a/target/product/core_tiny.mk
+++ b/target/product/core_tiny.mk
@@ -89,20 +89,19 @@
     wifi-service \
     wificond \
 
+ifeq ($(TARGET_CORE_JARS),)
+$(error TARGET_CORE_JARS is empty; cannot initialize PRODUCT_BOOT_JARS variable)
+endif
+
 # The order matters
 PRODUCT_BOOT_JARS := \
-    core-oj \
-    core-libart \
-    conscrypt \
-    okhttp \
+    $(TARGET_CORE_JARS) \
     legacy-test \
-    bouncycastle \
     ext \
     framework \
     telephony-common \
     voip-common \
     ims-common \
-    apache-xml \
     nullwebview \
     org.apache.http.legacy.boot \
     android.hidl.base-V1.0-java \
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 6217883..349abd4 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -85,20 +85,10 @@
     system_manifest.xml \
     system_compatibility_matrix.xml \
 
-# SELinux packages
+# SELinux packages are added as dependencies of the selinux_policy
+# phony package.
 PRODUCT_PACKAGES += \
-    nonplat_mac_permissions.xml \
-    nonplat_property_contexts \
-    nonplat_seapp_contexts \
-    nonplat_service_contexts \
-    nonplat_hwservice_contexts \
-    plat_mac_permissions.xml \
-    plat_property_contexts \
-    plat_seapp_contexts \
-    plat_service_contexts \
-    plat_hwservice_contexts \
     selinux_policy \
-    vndservice_contexts
 
 # AID Generation for
 # <pwd.h> and <grp.h>
diff --git a/target/product/product_launched_with_o.mk b/target/product/product_launched_with_o.mk
new file mode 100644
index 0000000..94d30c6
--- /dev/null
+++ b/target/product/product_launched_with_o.mk
@@ -0,0 +1,2 @@
+#PRODUCT_SHIPPING_API_LEVEL indicates the first api level, device has been commercially launced on.
+PRODUCT_SHIPPING_API_LEVEL := 26
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index 0755bf3..50b90ac 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -16,15 +16,14 @@
 
 # Provides a functioning ART environment without Android frameworks
 
+ifeq ($(TARGET_CORE_JARS),)
+$(error TARGET_CORE_JARS is empty; cannot update PRODUCT_PACKAGES variable)
+endif
+
 # Minimal boot classpath. This should be a subset of PRODUCT_BOOT_JARS, and equivalent to
 # TARGET_CORE_JARS.
 PRODUCT_PACKAGES += \
-    apache-xml \
-    bouncycastle \
-    core-oj \
-    core-libart \
-    conscrypt \
-    okhttp \
+    $(TARGET_CORE_JARS)
 
 # Additional mixins to the boot classpath.
 PRODUCT_PACKAGES += \
@@ -42,7 +41,6 @@
 PRODUCT_PACKAGES += \
     libjavacore \
     libopenjdk \
-    libopenjdkjvm \
 
 # Libcore ICU. TODO: Try to figure out if/why we need them explicitly.
 PRODUCT_PACKAGES += \
@@ -50,24 +48,9 @@
     libicuuc \
 
 # ART.
-PRODUCT_PACKAGES += \
-    dalvikvm \
-    dex2oat \
-    dexoptanalyzer \
-    libart \
-    libart_fake \
-    libopenjdkjvmti \
-    patchoat \
-    profman
-
+PRODUCT_PACKAGES += art-runtime
 # ART/dex helpers.
-PRODUCT_PACKAGES += \
-    ahat \
-    dexdiag \
-    dexdump \
-    dexlist \
-    hprof-conv \
-    oatdump \
+PRODUCT_PACKAGES += art-tools
 
 # Certificates.
 PRODUCT_PACKAGES += \
@@ -78,12 +61,14 @@
     dalvik.vm.image-dex2oat-Xmx=64m \
     dalvik.vm.dex2oat-Xms=64m \
     dalvik.vm.dex2oat-Xmx=512m \
-    ro.dalvik.vm.native.bridge=0 \
     dalvik.vm.usejit=true \
     dalvik.vm.usejitprofiles=true \
     dalvik.vm.dexopt.secondary=true \
     dalvik.vm.appimageformat=lz4
 
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.dalvik.vm.native.bridge=0
+
 # Different dexopt types for different package update/install times.
 # On eng builds, make "boot" reasons only extract for faster turnaround.
 ifeq (eng,$(TARGET_BUILD_VARIANT))
diff --git a/target/product/treble_common.mk b/target/product/treble_common.mk
index 8463ace..89b09cf 100644
--- a/target/product/treble_common.mk
+++ b/target/product/treble_common.mk
@@ -46,6 +46,7 @@
     android.hardware.camera.provider@2.4 \
     android.hardware.configstore-utils \
     android.hardware.configstore@1.0 \
+    android.hardware.configstore@1.1 \
     android.hardware.contexthub@1.0 \
     android.hardware.drm@1.0 \
     android.hardware.dumpstate@1.0 \
diff --git a/target/product/vndk/Android.mk b/target/product/vndk/Android.mk
new file mode 100644
index 0000000..20e8436
--- /dev/null
+++ b/target/product/vndk/Android.mk
@@ -0,0 +1,11 @@
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := vndk_package
+LOCAL_REQUIRED_MODULES := \
+    $(addsuffix .vendor,$(VNDK_CORE_LIBRARIES)) \
+    $(addsuffix .vendor,$(VNDK_SAMEPROCESS_LIBRARIES)) \
+    $(LLNDK_LIBRARIES)
+
+include $(BUILD_PHONY_PACKAGE)
diff --git a/tools/Android.mk b/tools/Android.mk
index 9073ac3..c05d681 100644
--- a/tools/Android.mk
+++ b/tools/Android.mk
@@ -16,4 +16,8 @@
 
 LOCAL_PATH := $(call my-dir)
 
+# Only if this Android.mk was included not by a symlink should it be used.
+# This facilitates the transition away from symlinks: b/64397960
+ifeq ($(LOCAL_PATH),build/make/tools)
 include $(call all-makefiles-under,$(LOCAL_PATH))
+endif
diff --git a/tools/OWNERS b/tools/OWNERS
new file mode 100644
index 0000000..7a23adc
--- /dev/null
+++ b/tools/OWNERS
@@ -0,0 +1,2 @@
+per-file warn.py = chh@google.com
+per-file checkowners.py = chh@google.com
diff --git a/tools/atree/Android.bp b/tools/atree/Android.bp
new file mode 100644
index 0000000..3c3a8ef
--- /dev/null
+++ b/tools/atree/Android.bp
@@ -0,0 +1,13 @@
+// Copyright 2007 The Android Open Source Project
+//
+// Copies files into the directory structure described by a manifest
+
+cc_binary_host {
+    name: "atree",
+    srcs: [
+        "atree.cpp",
+        "files.cpp",
+        "fs.cpp",
+    ],
+    static_libs: ["libhost"],
+}
diff --git a/tools/atree/Android.mk b/tools/atree/Android.mk
deleted file mode 100644
index f598db5..0000000
--- a/tools/atree/Android.mk
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2007 The Android Open Source Project
-#
-# Copies files into the directory structure described by a manifest
-
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := \
-	atree.cpp \
-	files.cpp \
-	fs.cpp
-
-LOCAL_STATIC_LIBRARIES := \
-	libhost
-
-LOCAL_MODULE := atree
-
-include $(BUILD_HOST_EXECUTABLE)
-
diff --git a/tools/checkowners.py b/tools/checkowners.py
index b874955..1190d30 100755
--- a/tools/checkowners.py
+++ b/tools/checkowners.py
@@ -34,8 +34,8 @@
                + urllib.quote(address))
     echo('Checking email address: ' + address)
     result = urllib2.urlopen(request).read()
-    expected = '"email": "' + address + '"'
-    checked_addresses[address] = (result.find(expected) >= 0)
+    checked_addresses[address] = (
+        result.find('"email":') >= 0 and result.find('"_account_id":') >= 0)
   return checked_addresses[address]
 
 
diff --git a/tools/fs_config/Android.bp b/tools/fs_config/Android.bp
new file mode 100644
index 0000000..797cfe2
--- /dev/null
+++ b/tools/fs_config/Android.bp
@@ -0,0 +1,63 @@
+// Copyright (C) 2008 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary_host {
+    name: "fs_config",
+    srcs: ["fs_config.c"],
+    shared_libs: [
+        "libcutils",
+        "libselinux",
+    ],
+    cflags: ["-Werror"],
+}
+
+// -----------------------------------------------------------------------------
+// Unit tests.
+// -----------------------------------------------------------------------------
+
+test_c_flags = [
+    "-fstack-protector-all",
+    "-g",
+    "-Wall",
+    "-Wextra",
+    "-Werror",
+    "-fno-builtin",
+    "-DANDROID_FILESYSTEM_CONFIG=\"android_filesystem_config_test_data.h\"",
+]
+
+//#################################
+// test executable
+cc_test_host {
+    name: "fs_config_generate_test",
+    srcs: ["fs_config_generate.c"],
+    shared_libs: ["libcutils"],
+    cflags: test_c_flags,
+    relative_install_path: "fs_config-unit-tests",
+    no_named_install_directory: true,
+    gtest: false,
+
+}
+
+//#################################
+// gTest tool
+cc_test_host {
+    name: "fs_config-unit-tests",
+    cflags: test_c_flags + ["-DHOST"],
+    shared_libs: [
+        "liblog",
+        "libcutils",
+        "libbase",
+    ],
+    srcs: ["fs_config_test.cpp"],
+}
diff --git a/tools/fs_config/Android.mk b/tools/fs_config/Android.mk
index ab7f92d..3773d38 100644
--- a/tools/fs_config/Android.mk
+++ b/tools/fs_config/Android.mk
@@ -14,15 +14,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := fs_config.c
-LOCAL_MODULE := fs_config
-LOCAL_SHARED_LIBRARIES := libcutils libselinux
-LOCAL_CFLAGS := -Werror
-
-include $(BUILD_HOST_EXECUTABLE)
-
 # One can override the default android_filesystem_config.h file in one of two ways:
 #
 # 1. The old way:
@@ -306,36 +297,3 @@
 fs_config_generate_bin :=
 my_gen_oem_aid :=
 fs_config_generate_extra_partition_list :=
-
-# -----------------------------------------------------------------------------
-# Unit tests.
-# -----------------------------------------------------------------------------
-
-test_c_flags := \
-    -fstack-protector-all \
-    -g \
-    -Wall \
-    -Wextra \
-    -Werror \
-    -fno-builtin \
-    -DANDROID_FILESYSTEM_CONFIG='"android_filesystem_config_test_data.h"'
-
-##################################
-# test executable
-include $(CLEAR_VARS)
-LOCAL_MODULE := fs_config_generate_test
-LOCAL_SRC_FILES := fs_config_generate.c
-LOCAL_SHARED_LIBRARIES := libcutils
-LOCAL_CFLAGS := $(test_c_flags)
-LOCAL_MODULE_RELATIVE_PATH := fs_config-unit-tests
-LOCAL_GTEST := false
-include $(BUILD_HOST_NATIVE_TEST)
-
-##################################
-# gTest tool
-include $(CLEAR_VARS)
-LOCAL_MODULE := fs_config-unit-tests
-LOCAL_CFLAGS += $(test_c_flags) -DHOST
-LOCAL_SHARED_LIBRARIES := liblog libcutils libbase
-LOCAL_SRC_FILES := fs_config_test.cpp
-include $(BUILD_HOST_NATIVE_TEST)
diff --git a/tools/fs_get_stats/Android.bp b/tools/fs_get_stats/Android.bp
new file mode 100644
index 0000000..6684319
--- /dev/null
+++ b/tools/fs_get_stats/Android.bp
@@ -0,0 +1,8 @@
+cc_binary_host {
+    name: "fs_get_stats",
+    srcs: ["fs_get_stats.c"],
+    shared_libs: [
+        "libcutils",
+        "liblog",
+    ],
+}
diff --git a/tools/fs_get_stats/Android.mk b/tools/fs_get_stats/Android.mk
deleted file mode 100644
index 4501c1f..0000000
--- a/tools/fs_get_stats/Android.mk
+++ /dev/null
@@ -1,11 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := fs_get_stats.c
-
-LOCAL_MODULE := fs_get_stats
-
-LOCAL_SHARED_LIBRARIES := libcutils liblog
-
-include $(BUILD_HOST_EXECUTABLE)
diff --git a/tools/releasetools/OWNERS b/tools/releasetools/OWNERS
new file mode 100644
index 0000000..39448cf
--- /dev/null
+++ b/tools/releasetools/OWNERS
@@ -0,0 +1 @@
+tbao@google.com
diff --git a/tools/releasetools/add_img_to_target_files.py b/tools/releasetools/add_img_to_target_files.py
index cf78d5e..1ce22e7 100755
--- a/tools/releasetools/add_img_to_target_files.py
+++ b/tools/releasetools/add_img_to_target_files.py
@@ -69,7 +69,7 @@
 
 OPTIONS.add_missing = False
 OPTIONS.rebuild_recovery = False
-OPTIONS.replace_recovery_patch_files_list = []
+OPTIONS.replace_updated_files_list = []
 OPTIONS.replace_verity_public_key = False
 OPTIONS.replace_verity_private_key = False
 OPTIONS.is_signing = False
@@ -99,8 +99,7 @@
   assert which in ("system", "vendor")
 
   simg = sparse_img.SparseImage(imgname)
-  care_map_list = []
-  care_map_list.append(which)
+  care_map_list = [which]
 
   care_map_ranges = simg.care_map
   key = which + "_adjusted_partition_size"
@@ -130,7 +129,7 @@
 
     arc_name = "SYSTEM/" + fn
     if arc_name in output_zip.namelist():
-      OPTIONS.replace_recovery_patch_files_list.append(arc_name)
+      OPTIONS.replace_updated_files_list.append(arc_name)
     else:
       common.ZipWrite(output_zip, ofile.name, arc_name)
 
@@ -473,17 +472,21 @@
   img.Write()
 
 
-def ReplaceRecoveryPatchFiles(zip_filename):
-  """Update the related files under SYSTEM/ after rebuilding recovery."""
+def ReplaceUpdatedFiles(zip_filename, files_list):
+  """Update all the zip entries listed in the files_list.
 
-  cmd = ["zip", "-d", zip_filename] + OPTIONS.replace_recovery_patch_files_list
+  For now the list includes META/care_map.txt, and the related files under
+  SYSTEM/ after rebuilding recovery.
+  """
+
+  cmd = ["zip", "-d", zip_filename] + files_list
   p = common.Run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
   p.communicate()
 
   output_zip = zipfile.ZipFile(zip_filename, "a",
                                compression=zipfile.ZIP_DEFLATED,
                                allowZip64=True)
-  for item in OPTIONS.replace_recovery_patch_files_list:
+  for item in files_list:
     file_path = os.path.join(OPTIONS.input_tmp, item)
     assert os.path.exists(file_path)
     common.ZipWrite(output_zip, file_path, arcname=item)
@@ -662,17 +665,45 @@
         assert os.path.exists(img_path), "cannot find " + img_name
 
     if care_map_list:
-      file_path = "META/care_map.txt"
-      if output_zip:
-        common.ZipWriteStr(output_zip, file_path, '\n'.join(care_map_list))
+      care_map_path = "META/care_map.txt"
+      if output_zip and care_map_path not in output_zip.namelist():
+        common.ZipWriteStr(output_zip, care_map_path, '\n'.join(care_map_list))
       else:
-        with open(os.path.join(OPTIONS.input_tmp, file_path), 'w') as fp:
+        with open(os.path.join(OPTIONS.input_tmp, care_map_path), 'w') as fp:
           fp.write('\n'.join(care_map_list))
+        if output_zip:
+          OPTIONS.replace_updated_files_list.append(care_map_path)
+
+  # Radio images that need to be packed into IMAGES/, and product-img.zip.
+  pack_radioimages = os.path.join(
+      OPTIONS.input_tmp, "META", "pack_radioimages.txt")
+  if os.path.exists(pack_radioimages):
+    with open(pack_radioimages, 'r') as f:
+      lines = f.readlines()
+    for line in lines:
+      img_name = line.strip()
+      _, ext = os.path.splitext(img_name)
+      if not ext:
+        img_name += ".img"
+      prebuilt_path = os.path.join(OPTIONS.input_tmp, "IMAGES", img_name)
+      if os.path.exists(prebuilt_path):
+        print("%s already exists, no need to overwrite..." % (img_name,))
+        continue
+
+      img_radio_path = os.path.join(OPTIONS.input_tmp, "RADIO", img_name)
+      assert os.path.exists(img_radio_path), \
+          "Failed to find %s at %s" % (img_name, img_radio_path)
+      if output_zip:
+        common.ZipWrite(output_zip, img_radio_path,
+                        os.path.join("IMAGES", img_name))
+      else:
+        shutil.copy(img_radio_path, prebuilt_path)
 
   if output_zip:
     common.ZipClose(output_zip)
-    if OPTIONS.replace_recovery_patch_files_list:
-      ReplaceRecoveryPatchFiles(output_zip.filename)
+    if OPTIONS.replace_updated_files_list:
+      ReplaceUpdatedFiles(output_zip.filename,
+                          OPTIONS.replace_updated_files_list)
 
 
 def main(argv):
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 6de9763..d2c9f59 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -36,30 +36,36 @@
 FIXED_SALT = "aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7"
 BLOCK_SIZE = 4096
 
-def RunCommand(cmd):
+def RunCommand(cmd, verbose=None):
   """Echo and run the given command.
 
   Args:
     cmd: the command represented as a list of strings.
+    verbose: show commands being executed.
   Returns:
     A tuple of the output and the exit code.
   """
-  print "Running: ", " ".join(cmd)
+  if verbose is None:
+    verbose = OPTIONS.verbose
+  if verbose:
+    print("Running: " + " ".join(cmd))
   p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
   output, _ = p.communicate()
-  print "%s" % (output.rstrip(),)
+
+  if verbose:
+    print(output.rstrip())
   return (output, p.returncode)
 
 def GetVerityFECSize(partition_size):
   cmd = ["fec", "-s", str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
 
 def GetVerityTreeSize(partition_size):
   cmd = ["build_verity_tree", "-s", str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
@@ -67,7 +73,7 @@
 def GetVerityMetadataSize(partition_size):
   cmd = ["system/extras/verity/build_verity_metadata.py", "size",
          str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
@@ -186,6 +192,8 @@
     else:
       hi = i
 
+  print("Adjusted partition size for verity, partition_size: {},"
+        " verity_size: {}".format(result, verity_size))
   AdjustPartitionSizeForVerity.results[key] = (result, verity_size)
   return (result, verity_size)
 
@@ -513,9 +521,9 @@
 
   try:
     if fs_type.startswith("ext4"):
-      (ext4fs_output, exit_code) = RunCommand(build_command)
+      (ext4fs_output, exit_code) = RunCommand(build_command, True)
     else:
-      (_, exit_code) = RunCommand(build_command)
+      (_, exit_code) = RunCommand(build_command, True)
   finally:
     if in_dir != origin_in:
       # Clean up temporary directories and files.
diff --git a/tools/releasetools/check_ota_package_signature.py b/tools/releasetools/check_ota_package_signature.py
index 548b619..1f8b7bb 100755
--- a/tools/releasetools/check_ota_package_signature.py
+++ b/tools/releasetools/check_ota_package_signature.py
@@ -25,12 +25,19 @@
 import re
 import subprocess
 import sys
+import tempfile
+import zipfile
 
 from hashlib import sha1
 from hashlib import sha256
 
+# 'update_payload' package is under 'system/update_engine/scripts/', which
+# should to be included in PYTHONPATH.
+from update_payload.payload import Payload
+from update_payload.update_metadata_pb2 import Signatures
 
-def cert_uses_sha256(cert):
+
+def CertUsesSha256(cert):
   """Check if the cert uses SHA-256 hashing algorithm."""
 
   cmd = ['openssl', 'x509', '-text', '-noout', '-in', cert]
@@ -46,7 +53,7 @@
   return algorithm.group(1).startswith('sha256')
 
 
-def verify_package(cert, package):
+def VerifyPackage(cert, package):
   """Verify the given package with the certificate.
 
   (Comments from bootable/recovery/verifier.cpp:)
@@ -90,7 +97,7 @@
   print('Signed data length: %d' % (signed_len,))
   print('Signature start: %d' % (signature_start,))
 
-  use_sha256 = cert_uses_sha256(cert)
+  use_sha256 = CertUsesSha256(cert)
   print('Use SHA-256: %s' % (use_sha256,))
 
   if use_sha256:
@@ -100,7 +107,7 @@
   h.update(package_bytes[:signed_len])
   package_digest = h.hexdigest().lower()
 
-  print('Digest: %s\n' % (package_digest,))
+  print('Digest: %s' % (package_digest,))
 
   # Get the signature from the input package.
   signature = package_bytes[signature_start:-6]
@@ -141,7 +148,87 @@
   assert package_digest == digest_string, "Verification failed."
 
   # Verified successfully upon reaching here.
-  print('VERIFIED\n')
+  print('\nWhole package signature VERIFIED\n')
+
+
+def VerifyAbOtaPayload(cert, package):
+  """Verifies the payload and metadata signatures in an A/B OTA payload."""
+
+  def VerifySignatureBlob(hash_file, blob):
+    """Verifies the input hash_file against the signature blob."""
+    signatures = Signatures()
+    signatures.ParseFromString(blob)
+
+    extracted_sig_file = common.MakeTempFile(
+        prefix='extracted-sig-', suffix='.bin')
+    # In Android, we only expect one signature.
+    assert len(signatures.signatures) == 1, \
+        'Invalid number of signatures: %d' % len(signatures.signatures)
+    signature = signatures.signatures[0]
+    length = len(signature.data)
+    assert length == 256, 'Invalid signature length %d' % (length,)
+    with open(extracted_sig_file, 'w') as f:
+      f.write(signature.data)
+
+    # Verify the signature file extracted from the payload, by reversing the
+    # signing operation. Alternatively, this can be done by calling 'openssl
+    # rsautl -verify -certin -inkey <cert.pem> -in <extracted_sig_file> -out
+    # <output>', then to assert that
+    # <output> == SHA-256 DigestInfo prefix || <hash_file>.
+    cmd = ['openssl', 'pkeyutl', '-verify', '-certin', '-inkey', cert,
+           '-pkeyopt', 'digest:sha256', '-in', hash_file,
+           '-sigfile', extracted_sig_file]
+    p = common.Run(cmd, stdout=subprocess.PIPE)
+    result, _ = p.communicate()
+
+    # https://github.com/openssl/openssl/pull/3213
+    # 'openssl pkeyutl -verify' (prior to 1.1.0) returns non-zero return code,
+    # even on successful verification. To avoid the false alarm with older
+    # openssl, check the output directly.
+    assert result.strip() == 'Signature Verified Successfully', result.strip()
+
+  package_zip = zipfile.ZipFile(package, 'r')
+  if 'payload.bin' not in package_zip.namelist():
+    common.ZipClose(package_zip)
+    return
+
+  print('Verifying A/B OTA payload signatures...')
+
+  package_dir = tempfile.mkdtemp(prefix='package-')
+  common.OPTIONS.tempfiles.append(package_dir)
+
+  payload_file = package_zip.extract('payload.bin', package_dir)
+  payload = Payload(open(payload_file, 'rb'))
+  payload.Init()
+
+  # Extract the payload hash and metadata hash from the payload.bin.
+  payload_hash_file = common.MakeTempFile(prefix='hash-', suffix='.bin')
+  metadata_hash_file = common.MakeTempFile(prefix='hash-', suffix='.bin')
+  cmd = ['brillo_update_payload', 'hash',
+         '--unsigned_payload', payload_file,
+         '--signature_size', '256',
+         '--metadata_hash_file', metadata_hash_file,
+         '--payload_hash_file', payload_hash_file]
+  p = common.Run(cmd, stdout=subprocess.PIPE)
+  p.communicate()
+  assert p.returncode == 0, 'brillo_update_payload hash failed'
+
+  # Payload signature verification.
+  assert payload.manifest.HasField('signatures_offset')
+  payload_signature = payload.ReadDataBlob(
+      payload.manifest.signatures_offset, payload.manifest.signatures_size)
+  VerifySignatureBlob(payload_hash_file, payload_signature)
+
+  # Metadata signature verification.
+  metadata_signature = payload.ReadDataBlob(
+      -payload.header.metadata_signature_len,
+      payload.header.metadata_signature_len)
+  VerifySignatureBlob(metadata_hash_file, metadata_signature)
+
+  common.ZipClose(package_zip)
+
+  # Verified successfully upon reaching here.
+  print('\nPayload signatures VERIFIED\n\n')
 
 
 def main():
@@ -150,7 +237,8 @@
   parser.add_argument('package', help='The OTA package to be verified.')
   args = parser.parse_args()
 
-  verify_package(args.certificate, args.package)
+  VerifyPackage(args.certificate, args.package)
+  VerifyAbOtaPayload(args.certificate, args.package)
 
 
 if __name__ == '__main__':
@@ -159,3 +247,5 @@
   except AssertionError as err:
     print('\n    ERROR: %s\n' % (err,))
     sys.exit(1)
+  finally:
+    common.Cleanup()
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 2ad628b..789fefe 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -251,15 +251,16 @@
   else:
     d["fstab"] = None
 
-  d["build.prop"] = LoadBuildProp(read_helper)
+  d["build.prop"] = LoadBuildProp(read_helper, 'SYSTEM/build.prop')
+  d["vendor.build.prop"] = LoadBuildProp(read_helper, 'VENDOR/build.prop')
   return d
 
 
-def LoadBuildProp(read_helper):
+def LoadBuildProp(read_helper, prop_file):
   try:
-    data = read_helper("SYSTEM/build.prop")
+    data = read_helper(prop_file)
   except KeyError:
-    print("Warning: could not find SYSTEM/build.prop in %s" % (zip,))
+    print("Warning: could not read %s" % (prop_file,))
     data = ""
   return LoadDictionaryFromLines(data.split("\n"))
 
@@ -1515,9 +1516,34 @@
     ZipWrite(output_zip,
              '{}.transfer.list'.format(self.path),
              '{}.transfer.list'.format(self.partition))
-    ZipWrite(output_zip,
-             '{}.new.dat'.format(self.path),
-             '{}.new.dat'.format(self.partition))
+
+    # For full OTA, compress the new.dat with brotli with quality 6 to reduce its size. Quailty 9
+    # almost triples the compression time but doesn't further reduce the size too much.
+    # For a typical 1.8G system.new.dat
+    #                       zip  | brotli(quality 6)  | brotli(quality 9)
+    #   compressed_size:    942M | 869M (~8% reduced) | 854M
+    #   compression_time:   75s  | 265s               | 719s
+    #   decompression_time: 15s  | 25s                | 25s
+
+    if not self.src:
+      bro_cmd = ['bro', '--quality', '6',
+                 '--input', '{}.new.dat'.format(self.path),
+                 '--output', '{}.new.dat.br'.format(self.path)]
+      print("Compressing {}.new.dat with brotli".format(self.partition))
+      p = Run(bro_cmd, stdout=subprocess.PIPE)
+      p.communicate()
+      assert p.returncode == 0,\
+          'compression of {}.new.dat failed'.format(self.partition)
+
+      new_data_name = '{}.new.dat.br'.format(self.partition)
+      ZipWrite(output_zip,
+               '{}.new.dat.br'.format(self.path),
+               new_data_name,
+               compress_type=zipfile.ZIP_STORED)
+    else:
+      new_data_name = '{}.new.dat'.format(self.partition)
+      ZipWrite(output_zip, '{}.new.dat'.format(self.path), new_data_name)
+
     ZipWrite(output_zip,
              '{}.patch.dat'.format(self.path),
              '{}.patch.dat'.format(self.partition),
@@ -1530,9 +1556,10 @@
 
     call = ('block_image_update("{device}", '
             'package_extract_file("{partition}.transfer.list"), '
-            '"{partition}.new.dat", "{partition}.patch.dat") ||\n'
+            '"{new_data_name}", "{partition}.patch.dat") ||\n'
             '  abort("E{code}: Failed to update {partition} image.");'.format(
-                device=self.device, partition=self.partition, code=code))
+                device=self.device, partition=self.partition,
+                new_data_name=new_data_name, code=code))
     script.AppendExtra(script.WordWrap(call))
 
   def _HashBlocks(self, source, ranges): # pylint: disable=no-self-use
@@ -1605,7 +1632,6 @@
     info_dict = OPTIONS.info_dict
 
   full_recovery_image = info_dict.get("full_recovery_image", None) == "true"
-  system_root_image = info_dict.get("system_root_image", None) == "true"
 
   if full_recovery_image:
     output_sink("etc/recovery.img", recovery_img.data)
@@ -1661,30 +1687,8 @@
        'bonus_args': bonus_args}
 
   # The install script location moved from /system/etc to /system/bin
-  # in the L release.  Parse init.*.rc files to find out where the
-  # target-files expects it to be, and put it there.
-  sh_location = "etc/install-recovery.sh"
-  found = False
-  if system_root_image:
-    init_rc_dir = os.path.join(input_dir, "ROOT")
-  else:
-    init_rc_dir = os.path.join(input_dir, "BOOT", "RAMDISK")
-  init_rc_files = os.listdir(init_rc_dir)
-  for init_rc_file in init_rc_files:
-    if (not init_rc_file.startswith('init.') or
-        not init_rc_file.endswith('.rc')):
-      continue
-
-    with open(os.path.join(init_rc_dir, init_rc_file)) as f:
-      for line in f:
-        m = re.match(r"^service flash_recovery /system/(\S+)\s*$", line)
-        if m:
-          sh_location = m.group(1)
-          found = True
-          break
-
-    if found:
-      break
+  # in the L release.
+  sh_location = "bin/install-recovery.sh"
 
   print("putting script in", sh_location)
 
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 1b0f68b..a9e1606 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -275,6 +275,11 @@
     return False
 
 
+def HasTrebleEnabled(target_files_zip, info_dict):
+  return (HasVendorPartition(target_files_zip) and
+          GetBuildProp("ro.treble.enabled", info_dict) == "true")
+
+
 def GetOemProperty(name, oem_props, oem_dict, info_dict):
   if oem_props is not None and name in oem_props:
     return oem_dict[name]
@@ -316,57 +321,93 @@
   return sparse_img.SparseImage(path, mappath, clobbered_blocks)
 
 
-def AddCompatibilityArchive(target_zip, output_zip, system_included=True,
-                            vendor_included=True):
-  """Adds compatibility info from target files into the output zip.
+def AddCompatibilityArchiveIfTrebleEnabled(target_zip, output_zip,
+                                           target_info_dict,
+                                           source_info_dict=None):
+  """Adds compatibility info into the output zip if it's Treble-enabled target.
 
   Metadata used for on-device compatibility verification is retrieved from
   target_zip then added to compatibility.zip which is added to the output_zip
   archive.
 
-  Compatibility archive should only be included for devices with a vendor
-  partition as checking provides value when system and vendor are independently
-  versioned.
+  Compatibility archive should only be included for devices that have enabled
+  Treble support.
 
   Args:
     target_zip: Zip file containing the source files to be included for OTA.
     output_zip: Zip file that will be sent for OTA.
-    system_included: If True, the system image will be updated and therefore
-        its metadata should be included.
-    vendor_included: If True, the vendor image will be updated and therefore
-        its metadata should be included.
+    target_info_dict: The dict that holds the target build info.
+    source_info_dict: The dict that holds the source build info, if generating
+        an incremental OTA; None otherwise.
   """
 
-  # Determine what metadata we need. Files are names relative to META/.
-  compatibility_files = []
-  vendor_metadata = ("vendor_manifest.xml", "vendor_matrix.xml")
-  system_metadata = ("system_manifest.xml", "system_matrix.xml")
-  if vendor_included:
-    compatibility_files += vendor_metadata
-  if system_included:
-    compatibility_files += system_metadata
+  def AddCompatibilityArchive(system_updated, vendor_updated):
+    """Adds compatibility info based on system/vendor update status.
 
-  # Create new archive.
-  compatibility_archive = tempfile.NamedTemporaryFile()
-  compatibility_archive_zip = zipfile.ZipFile(compatibility_archive, "w",
-      compression=zipfile.ZIP_DEFLATED)
+    Args:
+      system_updated: If True, the system image will be updated and therefore
+          its metadata should be included.
+      vendor_updated: If True, the vendor image will be updated and therefore
+          its metadata should be included.
+    """
+    # Determine what metadata we need. Files are names relative to META/.
+    compatibility_files = []
+    vendor_metadata = ("vendor_manifest.xml", "vendor_matrix.xml")
+    system_metadata = ("system_manifest.xml", "system_matrix.xml")
+    if vendor_updated:
+      compatibility_files += vendor_metadata
+    if system_updated:
+      compatibility_files += system_metadata
 
-  # Add metadata.
-  for file_name in compatibility_files:
-    target_file_name = "META/" + file_name
+    # Create new archive.
+    compatibility_archive = tempfile.NamedTemporaryFile()
+    compatibility_archive_zip = zipfile.ZipFile(compatibility_archive, "w",
+        compression=zipfile.ZIP_DEFLATED)
 
-    if target_file_name in target_zip.namelist():
-      data = target_zip.read(target_file_name)
-      common.ZipWriteStr(compatibility_archive_zip, file_name, data)
+    # Add metadata.
+    for file_name in compatibility_files:
+      target_file_name = "META/" + file_name
 
-  # Ensure files are written before we copy into output_zip.
-  compatibility_archive_zip.close()
+      if target_file_name in target_zip.namelist():
+        data = target_zip.read(target_file_name)
+        common.ZipWriteStr(compatibility_archive_zip, file_name, data)
 
-  # Only add the archive if we have any compatibility info.
-  if compatibility_archive_zip.namelist():
-    common.ZipWrite(output_zip, compatibility_archive.name,
-                    arcname="compatibility.zip",
-                    compress_type=zipfile.ZIP_STORED)
+    # Ensure files are written before we copy into output_zip.
+    compatibility_archive_zip.close()
+
+    # Only add the archive if we have any compatibility info.
+    if compatibility_archive_zip.namelist():
+      common.ZipWrite(output_zip, compatibility_archive.name,
+                      arcname="compatibility.zip",
+                      compress_type=zipfile.ZIP_STORED)
+
+  # Will only proceed if the target has enabled the Treble support (as well as
+  # having a /vendor partition).
+  if not HasTrebleEnabled(target_zip, target_info_dict):
+    return
+
+  # We don't support OEM thumbprint in Treble world (which calculates
+  # fingerprints in a different way as shown in CalculateFingerprint()).
+  assert not target_info_dict.get("oem_fingerprint_properties")
+
+  # Full OTA carries the info for system/vendor both.
+  if source_info_dict is None:
+    AddCompatibilityArchive(True, True)
+    return
+
+  assert not source_info_dict.get("oem_fingerprint_properties")
+
+  source_fp = GetBuildProp("ro.build.fingerprint", source_info_dict)
+  target_fp = GetBuildProp("ro.build.fingerprint", target_info_dict)
+  system_updated = source_fp != target_fp
+
+  source_fp_vendor = GetVendorBuildProp("ro.vendor.build.fingerprint",
+                                        source_info_dict)
+  target_fp_vendor = GetVendorBuildProp("ro.vendor.build.fingerprint",
+                                        target_info_dict)
+  vendor_updated = source_fp_vendor != target_fp_vendor
+
+  AddCompatibilityArchive(system_updated, vendor_updated)
 
 
 def WriteFullOTAPackage(input_zip, output_zip):
@@ -470,11 +511,6 @@
   if HasVendorPartition(input_zip):
     system_progress -= 0.1
 
-  # Place a copy of file_contexts.bin into the OTA package which will be used
-  # by the recovery program.
-  if "selinux_fc" in OPTIONS.info_dict:
-    WritePolicyConfig(OPTIONS.info_dict["selinux_fc"], output_zip)
-
   recovery_mount_options = OPTIONS.info_dict.get("recovery_mount_options")
 
   script.ShowProgress(system_progress, 0)
@@ -499,6 +535,9 @@
     vendor_diff = common.BlockDifference("vendor", vendor_tgt)
     vendor_diff.WriteScript(script, output_zip)
 
+  AddCompatibilityArchiveIfTrebleEnabled(input_zip, output_zip,
+                                         OPTIONS.info_dict)
+
   common.CheckSize(boot_img.data, "boot.img", OPTIONS.info_dict)
   common.ZipWriteStr(output_zip, "boot.img", boot_img.data)
 
@@ -540,10 +579,6 @@
   WriteMetadata(metadata, output_zip)
 
 
-def WritePolicyConfig(file_name, output_zip):
-  common.ZipWrite(output_zip, file_name, os.path.basename(file_name))
-
-
 def WriteMetadata(metadata, output_zip):
   value = "".join(["%s=%s\n" % kv for kv in sorted(metadata.iteritems())])
   common.ZipWriteStr(output_zip, METADATA_NAME, value,
@@ -551,13 +586,22 @@
 
 
 def GetBuildProp(prop, info_dict):
-  """Return the fingerprint of the build of a given target-files info_dict."""
+  """Returns the inquired build property from a given info_dict."""
   try:
     return info_dict.get("build.prop", {})[prop]
   except KeyError:
     raise common.ExternalError("couldn't find %s in build.prop" % (prop,))
 
 
+def GetVendorBuildProp(prop, info_dict):
+  """Returns the inquired vendor build property from a given info_dict."""
+  try:
+    return info_dict.get("vendor.build.prop", {})[prop]
+  except KeyError:
+    raise common.ExternalError(
+        "couldn't find %s in vendor.build.prop" % (prop,))
+
+
 def HandleDowngradeMetadata(metadata):
   # Only incremental OTAs are allowed to reach here.
   assert OPTIONS.incremental_source is not None
@@ -688,6 +732,10 @@
   else:
     vendor_diff = None
 
+  AddCompatibilityArchiveIfTrebleEnabled(
+      target_zip, output_zip, OPTIONS.target_info_dict,
+      OPTIONS.source_info_dict)
+
   AppendAssertions(script, OPTIONS.target_info_dict, oem_dicts)
   device_specific.IncrementalOTA_Assertions()
 
@@ -1178,32 +1226,13 @@
     else:
       print("Warning: cannot find care map file in target_file package")
 
-  if HasVendorPartition(target_zip):
-    update_vendor = True
-    update_system = True
+  # OPTIONS.source_info_dict must be None for incrementals.
+  if source_file is None:
+    assert OPTIONS.source_info_dict is None
 
-    # If incremental then figure out what is being updated so metadata only for
-    # the updated image is included.
-    if source_file is not None:
-      input_tmp, input_zip = common.UnzipTemp(
-          target_file, UNZIP_PATTERN)
-      source_tmp, source_zip = common.UnzipTemp(
-          source_file, UNZIP_PATTERN)
+  AddCompatibilityArchiveIfTrebleEnabled(
+      target_zip, output_zip, OPTIONS.info_dict, OPTIONS.source_info_dict)
 
-      vendor_src = GetImage("vendor", source_tmp)
-      vendor_tgt = GetImage("vendor", input_tmp)
-      system_src = GetImage("system", source_tmp)
-      system_tgt = GetImage("system", input_tmp)
-
-      update_system = system_src.TotalSha1() != system_tgt.TotalSha1()
-      update_vendor = vendor_src.TotalSha1() != vendor_tgt.TotalSha1()
-
-      input_zip.close()
-      source_zip.close()
-
-    target_zip = zipfile.ZipFile(target_file, "r")
-    AddCompatibilityArchive(target_zip, output_zip, update_system,
-                            update_vendor)
   common.ZipClose(target_zip)
 
   # Write the current metadata entry with placeholders.
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index e671cd5..58bf489 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -740,7 +740,9 @@
     sys.exit(1)
 
   input_zip = zipfile.ZipFile(args[0], "r")
-  output_zip = zipfile.ZipFile(args[1], "w")
+  output_zip = zipfile.ZipFile(args[1], "w",
+                               compression=zipfile.ZIP_DEFLATED,
+                               allowZip64=True)
 
   misc_info = common.LoadInfoDict(input_zip)
 
diff --git a/tools/releasetools/test_common.py b/tools/releasetools/test_common.py
index a861346..36f256d 100644
--- a/tools/releasetools/test_common.py
+++ b/tools/releasetools/test_common.py
@@ -14,12 +14,14 @@
 # limitations under the License.
 #
 import os
+import shutil
 import tempfile
 import time
 import unittest
 import zipfile
 
 import common
+import validate_target_files
 
 
 def random_string_with_holes(size, block_size, step_size):
@@ -295,3 +297,55 @@
                    expected_mode=0o400)
     finally:
       os.remove(zip_file_name)
+
+class InstallRecoveryScriptFormatTest(unittest.TestCase):
+  """Check the format of install-recovery.sh
+
+  Its format should match between common.py and validate_target_files.py."""
+
+  def setUp(self):
+    self._tempdir = tempfile.mkdtemp()
+    # Create a dummy dict that contains the fstab info for boot&recovery.
+    self._info = {"fstab" : {}}
+    dummy_fstab = \
+        ["/dev/soc.0/by-name/boot /boot emmc defaults defaults",
+         "/dev/soc.0/by-name/recovery /recovery emmc defaults defaults"]
+    self._info["fstab"] = common.LoadRecoveryFSTab(lambda x : "\n".join(x),
+                                                   2, dummy_fstab)
+
+  def _out_tmp_sink(self, name, data, prefix="SYSTEM"):
+    loc = os.path.join(self._tempdir, prefix, name)
+    if not os.path.exists(os.path.dirname(loc)):
+      os.makedirs(os.path.dirname(loc))
+    with open(loc, "w+") as f:
+      f.write(data)
+
+  def test_full_recovery(self):
+    recovery_image = common.File("recovery.img", "recovery");
+    boot_image = common.File("boot.img", "boot");
+    self._info["full_recovery_image"] = "true"
+
+    common.MakeRecoveryPatch(self._tempdir, self._out_tmp_sink,
+                             recovery_image, boot_image, self._info)
+    validate_target_files.ValidateInstallRecoveryScript(self._tempdir,
+                                                        self._info)
+
+  def test_recovery_from_boot(self):
+    recovery_image = common.File("recovery.img", "recovery");
+    self._out_tmp_sink("recovery.img", recovery_image.data, "IMAGES")
+    boot_image = common.File("boot.img", "boot");
+    self._out_tmp_sink("boot.img", boot_image.data, "IMAGES")
+
+    common.MakeRecoveryPatch(self._tempdir, self._out_tmp_sink,
+                             recovery_image, boot_image, self._info)
+    validate_target_files.ValidateInstallRecoveryScript(self._tempdir,
+                                                        self._info)
+    # Validate 'recovery-from-boot' with bonus argument.
+    self._out_tmp_sink("etc/recovery-resource.dat", "bonus", "SYSTEM")
+    common.MakeRecoveryPatch(self._tempdir, self._out_tmp_sink,
+                             recovery_image, boot_image, self._info)
+    validate_target_files.ValidateInstallRecoveryScript(self._tempdir,
+                                                        self._info)
+
+  def tearDown(self):
+    shutil.rmtree(self._tempdir)
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 0ad0798..4b34820 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -26,6 +26,7 @@
 import common
 import logging
 import os.path
+import re
 import sparse_img
 import sys
 
@@ -43,13 +44,38 @@
   return sparse_img.SparseImage(path, mappath, clobbered_blocks)
 
 
-def ValidateFileConsistency(input_zip, input_tmp):
-  """Compare the files from image files and unpacked folders."""
+def _ReadFile(file_name, unpacked_name, round_up=False):
+  """Constructs and returns a File object. Rounds up its size if needed."""
 
   def RoundUpTo4K(value):
     rounded_up = value + 4095
     return rounded_up - (rounded_up % 4096)
 
+  assert os.path.exists(unpacked_name)
+  with open(unpacked_name, 'r') as f:
+    file_data = f.read()
+  file_size = len(file_data)
+  if round_up:
+    file_size_rounded_up = RoundUpTo4K(file_size)
+    file_data += '\0' * (file_size_rounded_up - file_size)
+  return common.File(file_name, file_data)
+
+
+def ValidateFileAgainstSha1(input_tmp, file_name, file_path, expected_sha1):
+  """Check if the file has the expected SHA-1."""
+
+  logging.info('Validating the SHA-1 of {}'.format(file_name))
+  unpacked_name = os.path.join(input_tmp, file_path)
+  assert os.path.exists(unpacked_name)
+  actual_sha1 = _ReadFile(file_name, unpacked_name, False).sha1
+  assert actual_sha1 == expected_sha1, \
+      'SHA-1 mismatches for {}. actual {}, expected {}'.format(
+      file_name, actual_sha1, expected_sha1)
+
+
+def ValidateFileConsistency(input_zip, input_tmp):
+  """Compare the files from image files and unpacked folders."""
+
   def CheckAllFiles(which):
     logging.info('Checking %s image.', which)
     image = _GetImage(which, input_tmp)
@@ -66,12 +92,7 @@
       # The filename under unpacked directory, such as SYSTEM/bin/sh.
       unpacked_name = os.path.join(
           input_tmp, which.upper(), entry[(len(prefix) + 1):])
-      with open(unpacked_name) as f:
-        file_data = f.read()
-      file_size = len(file_data)
-      file_size_rounded_up = RoundUpTo4K(file_size)
-      file_data += '\0' * (file_size_rounded_up - file_size)
-      unpacked_file = common.File(entry, file_data)
+      unpacked_file = _ReadFile(entry, unpacked_name, True)
       file_size = unpacked_file.size
 
       # block.map may contain less blocks, because mke2fs may skip allocating
@@ -101,6 +122,78 @@
   # Not checking IMAGES/system_other.img since it doesn't have the map file.
 
 
+def ValidateInstallRecoveryScript(input_tmp, info_dict):
+  """Validate the SHA-1 embedded in install-recovery.sh.
+
+  install-recovery.sh is written in common.py and has the following format:
+
+  1. full recovery:
+  ...
+  if ! applypatch -c type:device:size:SHA-1; then
+  applypatch /system/etc/recovery.img type:device sha1 size && ...
+  ...
+
+  2. recovery from boot:
+  ...
+  applypatch [-b bonus_args] boot_info recovery_info recovery_sha1 \
+  recovery_size patch_info && ...
+  ...
+
+  For full recovery, we want to calculate the SHA-1 of /system/etc/recovery.img
+  and compare it against the one embedded in the script. While for recovery
+  from boot, we want to check the SHA-1 for both recovery.img and boot.img
+  under IMAGES/.
+  """
+
+  script_path = 'SYSTEM/bin/install-recovery.sh'
+  if not os.path.exists(os.path.join(input_tmp, script_path)):
+    logging.info('{} does not exist in input_tmp'.format(script_path))
+    return
+
+  logging.info('Checking {}'.format(script_path))
+  with open(os.path.join(input_tmp, script_path), 'r') as script:
+    lines = script.read().strip().split('\n')
+  assert len(lines) >= 6
+  check_cmd = re.search(r'if ! applypatch -c \w+:.+:\w+:(\w+);',
+                        lines[1].strip())
+  expected_recovery_check_sha1 = check_cmd.group(1)
+  patch_cmd = re.search(r'(applypatch.+)&&', lines[2].strip())
+  applypatch_argv = patch_cmd.group(1).strip().split()
+
+  full_recovery_image = info_dict.get("full_recovery_image") == "true"
+  if full_recovery_image:
+    assert len(applypatch_argv) == 5
+    # Check we have the same expected SHA-1 of recovery.img in both check mode
+    # and patch mode.
+    expected_recovery_sha1 = applypatch_argv[3].strip()
+    assert expected_recovery_check_sha1 == expected_recovery_sha1
+    ValidateFileAgainstSha1(input_tmp, 'recovery.img',
+        'SYSTEM/etc/recovery.img', expected_recovery_sha1)
+  else:
+    # We're patching boot.img to get recovery.img where bonus_args is optional
+    if applypatch_argv[1] == "-b":
+      assert len(applypatch_argv) == 8
+      boot_info_index = 3
+    else:
+      assert len(applypatch_argv) == 6
+      boot_info_index = 1
+
+    # boot_info: boot_type:boot_device:boot_size:boot_sha1
+    boot_info = applypatch_argv[boot_info_index].strip().split(':')
+    assert len(boot_info) == 4
+    ValidateFileAgainstSha1(input_tmp, file_name='boot.img',
+        file_path='IMAGES/boot.img', expected_sha1=boot_info[3])
+
+    recovery_sha1_index = boot_info_index + 2
+    expected_recovery_sha1 = applypatch_argv[recovery_sha1_index]
+    assert expected_recovery_check_sha1 == expected_recovery_sha1
+    ValidateFileAgainstSha1(input_tmp, file_name='recovery.img',
+        file_path='IMAGES/recovery.img',
+        expected_sha1=expected_recovery_sha1)
+
+  logging.info('Done checking {}'.format(script_path))
+
+
 def main(argv):
   def option_handler():
     return True
@@ -124,11 +217,12 @@
 
   ValidateFileConsistency(input_zip, input_tmp)
 
+  info_dict = common.LoadInfoDict(input_tmp)
+  ValidateInstallRecoveryScript(input_tmp, info_dict)
+
   # TODO: Check if the OTA keys have been properly updated (the ones on /system,
   # in recovery image).
 
-  # TODO(b/35411009): Verify the contents in /system/bin/install-recovery.sh.
-
   logging.info("Done.")
 
 
diff --git a/tools/warn.py b/tools/warn.py
index be659b8..44ad368 100755
--- a/tools/warn.py
+++ b/tools/warn.py
@@ -2427,7 +2427,7 @@
     if warning_pattern.match(line):
       line = normalize_warning_line(line)
       warning_lines.add(line)
-    elif line_counter < 50:
+    elif line_counter < 100:
       # save a little bit of time by only doing this for the first few lines
       line_counter += 1
       m = re.search('(?<=^PLATFORM_VERSION=).*', line)
diff --git a/tools/zipalign/Android.bp b/tools/zipalign/Android.bp
new file mode 100644
index 0000000..cfc6aec
--- /dev/null
+++ b/tools/zipalign/Android.bp
@@ -0,0 +1,31 @@
+//
+// Copyright 2008 The Android Open Source Project
+//
+// Zip alignment tool
+//
+
+cc_binary_host {
+    name: "zipalign",
+
+    srcs: [
+        "ZipAlign.cpp",
+        "ZipEntry.cpp",
+        "ZipFile.cpp",
+    ],
+
+    static_libs: [
+        "libandroidfw",
+        "libutils",
+        "libcutils",
+        "liblog",
+        "libzopfli",
+        "libz",
+    ],
+
+    target: {
+        windows: {
+            host_ldlibs: ["-lpthread"],
+            enabled: true,
+        },
+    },
+}
diff --git a/tools/zipalign/Android.mk b/tools/zipalign/Android.mk
deleted file mode 100644
index 8c0240a..0000000
--- a/tools/zipalign/Android.mk
+++ /dev/null
@@ -1,38 +0,0 @@
-# 
-# Copyright 2008 The Android Open Source Project
-#
-# Zip alignment tool
-#
-
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := \
-	ZipAlign.cpp \
-	ZipEntry.cpp \
-	ZipFile.cpp
-
-LOCAL_C_INCLUDES += external/zlib \
-	external/zopfli/src
-
-LOCAL_STATIC_LIBRARIES := \
-	libandroidfw \
-	libutils \
-	libcutils \
-	liblog \
-	libzopfli
-
-LOCAL_LDLIBS_linux += -lrt
-
-LOCAL_STATIC_LIBRARIES_windows += libz
-LOCAL_LDLIBS_linux += -lz
-LOCAL_LDLIBS_darwin += -lz
-
-ifneq ($(strip $(BUILD_HOST_static)),)
-LOCAL_LDLIBS += -lpthread
-endif # BUILD_HOST_static
-
-LOCAL_MODULE := zipalign
-LOCAL_MODULE_HOST_OS := darwin linux windows
-
-include $(BUILD_HOST_EXECUTABLE)