diff --git a/Changes.md b/Changes.md
index 1fadcef..2720a0f 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,5 +1,112 @@
 # Build System Changes for Android.mk Writers
 
+## COPY_HEADERS usage now produces warnings {#copy_headers}
+
+We've considered `BUILD_COPY_HEADERS`/`LOCAL_COPY_HEADERS` to be deprecated for
+a long time, and the places where it's been able to be used have shrinked over
+the last several releases. Equivalent functionality is not available in Soong.
+
+See the [build/soong/docs/best_practices.md#headers] for more information about
+how best to handle headers in Android.
+
+## `m4` is not available on `$PATH`
+
+There is a prebuilt of it available in prebuilts/build-tools, and a make
+variable `M4` that contains the path.
+
+Beyond the direct usage, whenever you use bison or flex directly, they call m4
+behind the scene, so you must set the M4 environment variable (and depend upon
+it for incremental build correctness):
+
+```
+$(intermediates)/foo.c: .KATI_IMPLICIT_OUTPUTS := $(intermediates)/foo.h
+$(intermediates)/foo.c: $(LOCAL_PATH)/foo.y $(M4) $(BISON) $(BISON_DATA)
+	M4=$(M4) $(BISON) ...
+```
+
+## Rules executed within limited environment
+
+With `ALLOW_NINJA_ENV=false` (soon to be the default), ninja, and all the
+rules/actions executed within it will only have access to a limited number of
+environment variables. Ninja does not track when environment variables change
+in order to trigger rebuilds, so changing behavior based on arbitrary variables
+is not safe with incremental builds.
+
+Kati and Soong can safely use environment variables, so the expectation is that
+you'd embed any environment variables that you need to use within the command
+line generated by those tools. See the [export section](#export_keyword) below
+for examples.
+
+For a temporary workaround, you can set `ALLOW_NINJA_ENV=true` in your
+environment to restore the previous behavior, or set
+`BUILD_BROKEN_NINJA_USES_ENV_VAR := <var> <var2> ...` in your `BoardConfig.mk`
+to allow specific variables to be passed through until you've fixed the rules.
+
+## LOCAL_C_INCLUDES outside the source/output trees are an error {#BUILD_BROKEN_OUTSIDE_INCLUDE_DIRS}
+
+Include directories are expected to be within the source tree (or in the output
+directory, generated during the build). This has been checked in some form
+since Oreo, but now has better checks.
+
+There's now a `BUILD_BROKEN_OUTSIDE_INCLUDE_DIRS` variable, that when set, will
+turn these errors into warnings temporarily. I don't expect this to last more
+than a release, since they're fairly easy to clean up.
+
+Neither of these cases are supported by Soong, and will produce errors when
+converting your module.
+
+### Absolute paths
+
+This has been checked since Oreo. The common reason to hit this is because a
+makefile is calculating a path, and ran abspath/realpath/etc. This is a problem
+because it makes your build non-reproducible. It's very unlikely that your
+source path is the same on every machine.
+
+### Using `../` to leave the source/output directories
+
+This is the new check that has been added. In every case I've found, this has
+been a mistake in the Android.mk -- assuming that `LOCAL_C_INCLUDES` (which is
+relative to the top of the source tree) acts like `LOCAL_SRC_FILES` (which is
+relative to `LOCAL_PATH`).
+
+Since this usually isn't a valid path, you can almost always just remove the
+offending line.
+
+
+## `BOARD_HAL_STATIC_LIBRARIES` and `LOCAL_HAL_STATIC_LIBRARIES` are obsolete {#BOARD_HAL_STATIC_LIBRARIES}
+
+Define proper HIDL / Stable AIDL HAL instead.
+
+* For libhealthd, use health HAL. See instructions for implementing
+  health HAL:
+
+  * [hardware/interfaces/health/2.1/README.md] for health 2.1 HAL (recommended)
+  * [hardware/interfaces/health/1.0/README.md] for health 1.0 HAL
+
+* For libdumpstate, use at least Dumpstate HAL 1.0.
+
+## PRODUCT_STATIC_BOOT_CONTROL_HAL is obsolete {#PRODUCT_STATIC_BOOT_CONTROL_HAL}
+
+`PRODUCT_STATIC_BOOT_CONTROL_HAL` was the workaround to allow sideloading with
+statically linked boot control HAL, before shared library HALs were supported
+under recovery. Android Q has added such support (HALs will be loaded in
+passthrough mode), and the workarounds are being removed. Targets should build
+and install the recovery variant of boot control HAL modules into recovery
+image, similar to the ones installed for normal boot. See the change to
+crosshatch for example of this:
+
+* [device/google/crosshatch/bootctrl/Android.bp] for `bootctrl.sdm845` building
+  rules
+* [device/google/crosshatch/device.mk] for installing `bootctrl.sdm845.recovery`
+  and `android.hardware.boot@1.0-impl.recovery` into recovery image
+
+[device/google/crosshatch/bootctrl/Android.bp]: https://android.googlesource.com/device/google/crosshatch/+/master/bootctrl/Android.bp
+[device/google/crosshatch/device.mk]: https://android.googlesource.com/device/google/crosshatch/+/master/device.mk
+
+## Deprecation of `BUILD_*` module types
+
+See [build/make/Deprecation.md](Deprecation.md) for the current status.
+
 ## `PRODUCT_HOST_PACKAGES` split from `PRODUCT_PACKAGES` {#PRODUCT_HOST_PACKAGES}
 
 Previously, adding a module to `PRODUCT_PACKAGES` that supported both the host
@@ -45,9 +152,9 @@
 Modules that build for Windows (our only `HOST_CROSS` OS currently) must now be
 defined in `Android.bp` files.
 
-## `LOCAL_MODULE_TAGS := eng debug` deprecation  {#LOCAL_MODULE_TAGS}
+## `LOCAL_MODULE_TAGS := eng debug` are obsolete {#LOCAL_MODULE_TAGS}
 
-`LOCAL_MODULE_TAGS` value `eng` and `debug` are being deprecated. They allowed
+`LOCAL_MODULE_TAGS` value `eng` and `debug` are now obsolete. They allowed
 modules to specify that they should always be installed on `-eng`, or `-eng`
 and `-userdebug` builds. This conflicted with the ability for products to
 specify which modules should be installed, effectively making it impossible to
@@ -190,11 +297,9 @@
 
 ## `export` and `unexport` deprecation  {#export_keyword}
 
-The `export` and `unexport` keywords have been deprecated, and will throw
-warnings or errors depending on where they are used.
+The `export` and `unexport` keywords are obsolete, and will throw errors when
+used.
 
-Early in the make system, during product configuration and BoardConfig.mk
-reading: these will throw a warnings, and will be an error in the future.
 Device specific configuration should not be able to affect common core build
 steps -- we're looking at triggering build steps to be invalidated if the set
 of environment variables they can access changes. If device specific
@@ -202,10 +307,9 @@
 output directory could become significantly more expensive than it already can
 be.
 
-Later, during Android.mk files, and later tasks: these will throw errors, since
-it is increasingly likely that they are being used incorrectly, attempting to
-change the environment for a single build step, and instead setting it for
-hundreds of thousands.
+If used during Android.mk files, and later tasks, it is increasingly likely
+that they are being used incorrectly. Attempting to change the environment for
+a single build step, and instead setting it for hundreds of thousands.
 
 It is not recommended to just move the environment variable setting outside of
 the build (in vendorsetup.sh, or some other configuration script or wrapper).
@@ -369,7 +473,7 @@
 
 | instead of                                                   | use                  |
 |--------------------------------------------------------------|----------------------|
-| OUT {#OUT}                                                   | OUT_DIR              |
+| OUT {#OUT}                                                   | PRODUCT_OUT          |
 | ANDROID_HOST_OUT {#ANDROID_HOST_OUT}                         | HOST_OUT             |
 | ANDROID_PRODUCT_OUT {#ANDROID_PRODUCT_OUT}                   | PRODUCT_OUT          |
 | ANDROID_HOST_OUT_TESTCASES {#ANDROID_HOST_OUT_TESTCASES}     | HOST_OUT_TESTCASES   |
@@ -458,6 +562,9 @@
 
 
 [build/soong/Changes.md]: https://android.googlesource.com/platform/build/soong/+/master/Changes.md
+[build/soong/docs/best_practices.md#headers]: https://android.googlesource.com/platform/build/soong/+/master/docs/best_practices.md#headers
 [external/fonttools/Lib/fontTools/Android.bp]: https://android.googlesource.com/platform/external/fonttools/+/master/Lib/fontTools/Android.bp
 [frameworks/base/Android.bp]: https://android.googlesource.com/platform/frameworks/base/+/master/Android.bp
 [frameworks/base/data/fonts/Android.mk]: https://android.googlesource.com/platform/frameworks/base/+/master/data/fonts/Android.mk
+[hardware/interfaces/health/1.0/README.md]: https://android.googlesource.com/platform/hardware/interfaces/+/master/health/1.0/README.md
+[hardware/interfaces/health/2.1/README.md]: https://android.googlesource.com/platform/hardware/interfaces/+/master/health/2.1/README.md
diff --git a/CleanSpec.mk b/CleanSpec.mk
index 386e14c..3fc7cbc 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -505,9 +505,9 @@
 
 # Remove *_OUT_INTERMEDIATE_LIBRARIES
 $(call add-clean-step, rm -rf $(addsuffix /lib,\
-  $(HOST_OUT_INTERMEDIATES) $(2ND_HOST_OUT_INTERMEDIATES) \
-  $(HOST_CROSS_OUT_INTERMEDIATES) $(2ND_HOST_CROSS_OUT_INTERMEDIATES) \
-  $(TARGET_OUT_INTERMEDIATES) $(2ND_TARGET_OUT_INTERMEDIATES)))
+$(HOST_OUT_INTERMEDIATES) $(2ND_HOST_OUT_INTERMEDIATES) \
+$(HOST_CROSS_OUT_INTERMEDIATES) $(2ND_HOST_CROSS_OUT_INTERMEDIATES) \
+$(TARGET_OUT_INTERMEDIATES) $(2ND_TARGET_OUT_INTERMEDIATES)))
 
 # Remove strip.sh intermediates to save space
 $(call add-clean-step, find $(OUT_DIR) \( -name "*.so.debug" -o -name "*.so.dynsyms" -o -name "*.so.funcsyms" -o -name "*.so.keep_symbols" -o -name "*.so.mini_debuginfo.xz" \) -print0 | xargs -0 rm -f)
@@ -632,6 +632,13 @@
 
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/libjavacrypto.so)
 
+# Clean up old verity tools.
+$(call add-clean-step, rm -rf $(HOST_OUT_JAVA_LIBRARIES)/BootSignature.jar)
+$(call add-clean-step, rm -rf $(HOST_OUT_JAVA_LIBRARIES)/VeritySigner.jar)
+$(call add-clean-step, rm -rf $(HOST_OUT_EXECUTABLES)/build_verity_metadata.py)
+
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/libc_malloc*)
+
 # Clean up old location of soft OMX plugins
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/libstagefright_soft*)
 
@@ -639,10 +646,108 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/odm/build.prop)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/odm/build.prop)
 
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/apex)
+
 # Remove libcameraservice and libcamera_client from base_system
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/libcameraservice.so)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/libcamera_client.so)
 
+# Move product and system_ext to root for emulators
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/product/generic*/*/product)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/product/generic*/*/system_ext)
+
+# link_type and jni_link_type files are no longer needed
+$(call add-clean-step, find $(OUT_DIR) -type f -name "*link_type" -print0 | xargs -0 rm -f)
+
+# import_includes and export_includes files are no longer needed
+$(call add-clean-step, find $(OUT_DIR) -type f -name "import_includes" -o -name "export_includes" -print0 | xargs -0 rm -f)
+
+# Recreate product and system_ext partitions for emulator
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/product/generic*/*product*)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/product/generic*/*system_ext*)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/product/generic*/*/product)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/product/generic*/*/system_ext)
+
+# Move GSI-specific files from /system to /system/system_ext
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/init/init.gsi.rc)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/init/config/)
+
+# Move fuzz targets from /data/fuzz/* to /data/fuzz/<arch>/* for device, and
+# /fuzz/* to /fuzz/<arch>/* on host.
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/data/fuzz/*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/symbols/data/fuzz/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/fuzz/*)
+$(call add-clean-step, rm -rf $(SOONG_OUT_DIR)/host/*/fuzz/*)
+
+# Change file layout of system_other
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system_other)
+
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/apex)
+
+# Migrate preopt files to system_other for some devices
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/*/*app/*/oat)
+
+# Migrate preopt files from system_other for some devices
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system_other)
+
+# Remove Android Core Library artifacts from the system partition, now
+# that they live in the ART APEX (b/142944799).
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/framework/*.jar)
+
+# Remove symlinks for VNDK apexes
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/vndk-*)
+
+# Switch to symlinks for VNDK libs
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib*/vndk-*)
+
+# Remove Android Core Library artifacts from the system partition
+# again, as the original change removing them was reverted.
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/framework/*.jar)
+
+# Remove cas@1.1 from the vendor partition
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.cas@1.1*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.cas@1.1*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/vintf/manifest/android.hardware.cas@1.1*)
+
+# Remove com.android.cellbroadcast apex for Go devices
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/apex/com.android.cellbroadcast.apex)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/apex/com.android.cellbroadcast)
+
+# Remove CellBroadcastLegacyApp for Go devices
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/priv-app/CellBroadcastLegacyApp)
+
+# Remove MediaProvider after moving into APEX
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/priv-app/MediaProvider)
+
+# The core image variant has been renamed to ""
+$(call add-clean-step, find $(SOONG_OUT_DIR)/.intermediates -type d -name "android_*_core*" -print0 | xargs -0 rm -rf)
+
+# Remove 'media' command
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/bin/media)
+
+# Remove CtsShim apks from system partition, since the have been moved inside
+# the cts shim apex. Also remove the cts shim apex prebuilt since it has been
+# removed in flattened apexs configurations.
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/priv-app/CtsShimPrivPrebuilt)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/app/CtsShimPrebuilt)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/apex/com.android.apex.cts.shim.apex)
+
+# Remove vendor and recovery variants, the directory name has changed.
+$(call add-clean-step, find $(SOONG_OUT_DIR)/.intermediates -type d -name "android_*_recovery*" -print0 | xargs -0 rm -rf)
+$(call add-clean-step, find $(SOONG_OUT_DIR)/.intermediates -type d -name "android_*_vendor*" -print0 | xargs -0 rm -rf)
+
+# Remove PermissionController after moving into APEX
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/priv-app/*PermissionController)
+
+# Clean up VTS-Core and VTS10 related artifacts.
+$(call add-clean-step, rm -rf $(HOST_OUT)/vts-core/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/framework/vts-core-tradefed.jar)
+$(call add-clean-step, rm -rf $(HOST_OUT)/vts10/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/framework/vts10-tradefed.jar)
+# Clean up VTS again as VTS-Core will be renamed to VTS
+$(call add-clean-step, rm -rf $(HOST_OUT)/vts/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/framework/vts-tradefed.jar)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/Deprecation.md b/Deprecation.md
new file mode 100644
index 0000000..2f936e3
--- /dev/null
+++ b/Deprecation.md
@@ -0,0 +1,69 @@
+# Deprecation of Make
+
+We've made significant progress converting AOSP from Make to Soong (Android.mk
+to Android.bp), and we're ready to start turning off pieces of Make. If you
+have any problems converting, please contact us via:
+
+* The [android-building@googlegroups.com] group.
+* Our [public bug tracker](https://issuetracker.google.com/issues/new?component=381517).
+* Or privately through your existing contacts at Google.
+
+## Status
+
+[build/make/core/deprecation.mk] is the source of truth, but for easy browsing:
+
+| Module type                      | State     |
+| -------------------------------- | --------- |
+| `BUILD_AUX_EXECUTABLE`           | Error     |
+| `BUILD_AUX_STATIC_LIBRARY`       | Error     |
+| `BUILD_COPY_HEADERS`             | Error     |
+| `BUILD_HOST_EXECUTABLE`          | Error     |
+| `BUILD_HOST_FUZZ_TEST`           | Error     |
+| `BUILD_HOST_NATIVE_TEST`         | Error     |
+| `BUILD_HOST_SHARED_LIBRARY`      | Error     |
+| `BUILD_HOST_SHARED_TEST_LIBRARY` | Error     |
+| `BUILD_HOST_STATIC_LIBRARY`      | Error     |
+| `BUILD_HOST_STATIC_TEST_LIBRARY` | Error     |
+| `BUILD_HOST_TEST_CONFIG`         | Error     |
+| `BUILD_NATIVE_BENCHMARK`         | Error     |
+| `BUILD_SHARED_TEST_LIBRARY`      | Error     |
+| `BUILD_STATIC_TEST_LIBRARY`      | Error     |
+| `BUILD_TARGET_TEST_CONFIG`       | Error     |
+| `BUILD_*`                        | Available |
+
+## Module Type Deprecation Process
+
+We'll be turning off `BUILD_*` module types as all of the users are removed
+from AOSP (and Google's internal trees). The process will go something like
+this, using `BUILD_PACKAGE` as an example:
+
+* Prerequisite: all common users of `BUILD_PACKAGE` have been removed (some
+  device-specific ones may remain).
+* `BUILD_PACKAGE` will be moved from `AVAILABLE_BUILD_MODULE_TYPES` to
+  `DEFAULT_WARNING_BUILD_MODULE_TYPES` in [build/make/core/deprecation.mk]. This
+  will make referring to `BUILD_PACKAGE` a warning.
+* Any devices that still have warnings will have
+  `BUILD_BROKEN_USES_BUILD_PACKAGE := true` added to their `BoardConfig.mk`.
+* `BUILD_PACKAGE` will be switched from `DEFAULT_WARNING_BUILD_MODULE_TYPES` to
+  `DEFAULT_ERROR_BUILD_MODULE_TYPES`, which will turn referring to
+  `BUILD_PACKAGE` into an error unless the device has overridden it.
+* At some later point, after all devices in AOSP no longer set
+  `BUILD_BROKEN_USES_BUILD_PACKAGE`, `BUILD_PACKAGE` will be moved from
+  `DEFAULT_ERROR_BUILD_MODULE_TYPES` to `OBSOLETE_BUILD_MODULE_TYPES` and the
+  code will be removed. It will no longer be possible to use `BUILD_PACKAGE`.
+
+In most cases, we expect module types to stay in the default warning state for
+about two weeks before becoming an error by default. Then it will spend some
+amount of time in the default error state before moving to obsolete -- we'll
+try and keep that around for a while, but other development may cause those to
+break, and the fix may to be to obsolete them. There is no expectation that the
+`BUILD_BROKEN_USES_BUILD_*` workarounds will work in a future release, it's a
+short-term workaround.
+
+Just to be clear, the above process will happen on the AOSP master branch. So
+if you're following Android releases, none of the deprecation steps will be in
+Android Q, and the 2020 release will have jumped directly to the end for many
+module types.
+
+[android-building@googlegroups.com]: https://groups.google.com/forum/#!forum/android-building
+[build/make/core/deprecation.mk]: /core/deprecation.mk
diff --git a/OWNERS b/OWNERS
index 320b40a..05f8b3d 100644
--- a/OWNERS
+++ b/OWNERS
@@ -1,6 +1,8 @@
 # Core build team (MTV)
 ccross@android.com
 dwillemsen@google.com
+asmundak@google.com
+jungjw@google.com
 
 # To expedite LON reviews
 hansson@google.com
diff --git a/Usage.txt b/Usage.txt
index 558329b..ea4788a 100644
--- a/Usage.txt
+++ b/Usage.txt
@@ -26,12 +26,6 @@
       If no targets are specified, the build system will build the images
       for the configured product and variant.
 
-  An alternative to setting $TARGET_PRODUCT and $TARGET_BUILD_VARIANT,
-  which you may see in build servers, is to execute:
-
-    m PRODUCT-<product>-<variant>
-
-
   A target may be a file path. For example, out/host/linux-x86/bin/adb .
     Note that when giving a relative file path as a target, that path is
     interpreted relative to the root of the source tree (rather than relative
diff --git a/common/core.mk b/common/core.mk
index e5264b0..7d505c0 100644
--- a/common/core.mk
+++ b/common/core.mk
@@ -42,6 +42,9 @@
 backslash := \a
 backslash := $(patsubst %a,%,$(backslash))
 
+TOP :=$= .
+TOPDIR :=$=
+
 # Prevent accidentally changing these variables
 .KATI_READONLY := SHELL empty space comma newline pound backslash
 
diff --git a/common/math.mk b/common/math.mk
index ac3151e..83f2218 100644
--- a/common/math.mk
+++ b/common/math.mk
@@ -33,8 +33,8 @@
 math-expect-error :=
 
 # Run the math tests with:
-#  make -f ${ANDROID_BUILD_TOP}/build/make/core/math.mk RUN_MATH_TESTS=true
-#  $(get_build_var CKATI) -f ${ANDROID_BUILD_TOP}//build/make/core/math.mk RUN_MATH_TESTS=true
+#  make -f ${ANDROID_BUILD_TOP}/build/make/common/math.mk RUN_MATH_TESTS=true
+#  $(get_build_var CKATI) -f ${ANDROID_BUILD_TOP}//build/make/common/math.mk RUN_MATH_TESTS=true
 ifdef RUN_MATH_TESTS
   MATH_TEST_FAILURE :=
   MATH_TEST_ERROR :=
@@ -134,6 +134,10 @@
 $(if $(filter $(1),$(call math_max,$(1),$(2))),true)
 endef
 
+define math_gt
+$(if $(call math_gt_or_eq,$(2),$(1)),,true)
+endef
+
 define math_lt
 $(if $(call math_gt_or_eq,$(1),$(2)),,true)
 endef
@@ -141,6 +145,12 @@
 $(call math-expect-true,(call math_gt_or_eq, 2, 1))
 $(call math-expect-true,(call math_gt_or_eq, 1, 1))
 $(call math-expect-false,(call math_gt_or_eq, 1, 2))
+$(call math-expect-true,(call math_gt, 4, 3))
+$(call math-expect-false,(call math_gt, 5, 5))
+$(call math-expect-false,(call math_gt, 6, 7))
+$(call math-expect-false,(call math_lt, 1, 0))
+$(call math-expect-false,(call math_lt, 8, 8))
+$(call math-expect-true,(call math_lt, 10, 11))
 
 # $1 is the variable name to increment
 define inc_and_print
diff --git a/common/strings.mk b/common/strings.mk
index ce6d6fb..ba20e27 100644
--- a/common/strings.mk
+++ b/common/strings.mk
@@ -88,7 +88,7 @@
 endef
 
 ###########################################################
-## Convert "a=b c= d e = f" into "a=b c=d e=f"
+## Convert "a=b c= d e = f = g h=" into "a=b c=d e= f=g h="
 ##
 ## $(1): list to collapse
 ## $(2): if set, separator word; usually "=", ":", or ":="
@@ -96,11 +96,29 @@
 ###########################################################
 
 define collapse-pairs
+$(strip \
 $(eval _cpSEP := $(strip $(if $(2),$(2),=)))\
-$(strip $(subst $(space)$(_cpSEP)$(space),$(_cpSEP),$(strip \
-    $(subst $(_cpSEP), $(_cpSEP) ,$(1)))$(space)))
+$(eval _cpLHS :=)\
+$(eval _cpRET :=)\
+$(foreach w,$(subst $(space)$(_cpSEP),$(_cpSEP),$(strip \
+            $(subst $(_cpSEP),$(space)$(_cpSEP)$(space),$(1)))),\
+  $(if $(findstring $(_cpSEP),$(w)),\
+    $(eval _cpRET += $(_cpLHS))$(eval _cpLHS := $(w)),\
+    $(eval _cpRET += $(_cpLHS)$(w))$(eval _cpLHS :=)))\
+$(if $(_cpLHS),$(_cpRET)$(space)$(_cpLHS),$(_cpRET))\
+$(eval _cpSEP :=)\
+$(eval _cpLHS :=)\
+$(eval _cpRET :=))
 endef
 
+# Sanity check for collapse-pairs.
+ifneq (a=b c=d e= f=g h=,$(call collapse-pairs,a=b c= d e = f = g h=))
+  $(error collapse-pairs sanity check failure)
+endif
+ifneq (a:=b c:=d e:=f g:=h,$(call collapse-pairs,a:=b c:= d e :=f g := h,:=))
+  $(error collapse-pairs sanity check failure)
+endif
+
 ###########################################################
 ## Given a list of pairs, if multiple pairs have the same
 ## first components, keep only the first pair.
diff --git a/core/Makefile b/core/Makefile
index d7d1965..45ad60f 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -16,7 +16,28 @@
 define check-product-copy-files
 $(if $(filter-out $(TARGET_COPY_OUT_SYSTEM_OTHER)/%,$(2)), \
   $(if $(filter %.apk, $(2)),$(error \
-     Prebuilt apk found in PRODUCT_COPY_FILES: $(1), use BUILD_PREBUILT instead!)))
+     Prebuilt apk found in PRODUCT_COPY_FILES: $(1), use BUILD_PREBUILT instead!))) \
+$(if $(filter true,$(BUILD_BROKEN_VINTF_PRODUCT_COPY_FILES)),, \
+  $(if $(filter $(TARGET_COPY_OUT_SYSTEM)/etc/vintf/% \
+                $(TARGET_COPY_OUT_SYSTEM)/manifest.xml \
+                $(TARGET_COPY_OUT_SYSTEM)/compatibility_matrix.xml,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), use vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_PRODUCT)/etc/vintf/%,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use PRODUCT_MANIFEST_FILES / DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE / vintf_compatibility_matrix / vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_SYSTEM_EXT)/etc/vintf/%,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use vintf_compatibility_matrix / vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_VENDOR)/etc/vintf/% \
+                $(TARGET_COPY_OUT_VENDOR)/manifest.xml \
+                $(TARGET_COPY_OUT_VENDOR)/compatibility_matrix.xml,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use DEVICE_MANIFEST_FILE / DEVICE_MATRIX_FILE / vintf_compatibility_matrix / vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_ODM)/etc/vintf/% \
+                $(TARGET_COPY_OUT_ODM)/etc/manifest%,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use ODM_MANIFEST_FILES / vintf_fragments instead!)) \
+)
 endef
 # filter out the duplicate <source file>:<dest file> pairs.
 unique_product_copy_files_pairs :=
@@ -91,11 +112,11 @@
 
 ifdef has_dup_copy_headers
   has_dup_copy_headers :=
-  ifneq ($(BUILD_BROKEN_DUP_COPY_HEADERS),true)
-    $(error duplicate header copies are no longer allowed. For more information about headers, see: https://android.googlesource.com/platform/build/soong/+/master/docs/best_practices.md#headers)
-  endif
+  $(error duplicate header copies are no longer allowed. For more information about headers, see: https://android.googlesource.com/platform/build/soong/+/master/docs/best_practices.md#headers)
 endif
 
+$(file >$(PRODUCT_OUT)/.copied_headers_list,$(TARGET_OUT_HEADERS) $(ALL_COPIED_HEADERS))
+
 # -----------------------------------------------------------------
 # docs/index.html
 ifeq (,$(TARGET_BUILD_APPS))
@@ -197,6 +218,7 @@
 
 BUILDINFO_SH := build/make/tools/buildinfo.sh
 BUILDINFO_COMMON_SH := build/make/tools/buildinfo_common.sh
+POST_PROCESS_PROPS :=$= build/make/tools/post_process_props.py
 
 # Generates a set of sysprops common to all partitions to a file.
 # $(1): Partition name
@@ -219,6 +241,7 @@
 	BUILD_VERSION_TAGS="$(BUILD_VERSION_TAGS)" \
 	DATE="$(DATE_FROM_FILE)" \
 	PLATFORM_SDK_VERSION="$(PLATFORM_SDK_VERSION)" \
+	PLATFORM_VERSION_LAST_STABLE="$(PLATFORM_VERSION_LAST_STABLE)" \
 	PLATFORM_VERSION="$(PLATFORM_VERSION)" \
 	TARGET_BUILD_TYPE="$(TARGET_BUILD_VARIANT)" \
 	bash $(BUILDINFO_COMMON_SH) "$(1)" >> $(2)
@@ -246,7 +269,7 @@
 
 intermediate_system_build_prop := $(call intermediates-dir-for,ETC,system_build_prop)/build.prop
 
-$(INSTALLED_DEFAULT_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(intermediate_system_build_prop)
+$(INSTALLED_DEFAULT_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(intermediate_system_build_prop)
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
@@ -255,7 +278,7 @@
 	        echo "#" >> $@;
 	$(hide) $(foreach line,$(FINAL_DEFAULT_PROPERTIES), \
 	    echo "$(line)" >> $@;)
-	$(hide) build/make/tools/post_process_props.py $@
+	$(hide) $(POST_PROCESS_PROPS) $@
 ifdef property_overrides_split_enabled
 	$(hide) mkdir -p $(TARGET_ROOT_OUT)
 	$(hide) ln -sf system/etc/prop.default $(INSTALLED_DEFAULT_PROP_OLD_TARGET)
@@ -268,7 +291,7 @@
 INSTALLED_VENDOR_DEFAULT_PROP_TARGET := $(TARGET_OUT_VENDOR)/default.prop
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_VENDOR_DEFAULT_PROP_TARGET)
 
-$(INSTALLED_VENDOR_DEFAULT_PROP_TARGET): $(INSTALLED_DEFAULT_PROP_TARGET)
+$(INSTALLED_VENDOR_DEFAULT_PROP_TARGET): $(INSTALLED_DEFAULT_PROP_TARGET) $(POST_PROCESS_PROPS)
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo "#" > $@; \
@@ -276,7 +299,7 @@
 	        echo "#" >> $@;
 	$(hide) $(foreach line,$(FINAL_VENDOR_DEFAULT_PROPERTIES), \
 	    echo "$(line)" >> $@;)
-	$(hide) build/make/tools/post_process_props.py $@
+	$(hide) $(POST_PROCESS_PROPS) $@
 
 endif  # property_overrides_split_enabled
 
@@ -300,7 +323,7 @@
 # non-default dev keys (usually private keys from a vendor directory).
 # Both of these tags will be removed and replaced with "release-keys"
 # when the target-files is signed in a post-build step.
-ifeq ($(DEFAULT_SYSTEM_DEV_CERTIFICATE),build/target/product/security/testkey)
+ifeq ($(DEFAULT_SYSTEM_DEV_CERTIFICATE),build/make/target/product/security/testkey)
 BUILD_KEYS := test-keys
 else
 BUILD_KEYS := dev-keys
@@ -393,7 +416,7 @@
 else
 system_prop_file := $(wildcard $(TARGET_DEVICE_DIR)/system.prop)
 endif
-$(intermediate_system_build_prop): $(BUILDINFO_SH) $(BUILDINFO_COMMON_SH) $(INTERNAL_BUILD_ID_MAKEFILE) $(BUILD_SYSTEM)/version_defaults.mk $(system_prop_file) $(INSTALLED_ANDROID_INFO_TXT_TARGET) $(API_FINGERPRINT)
+$(intermediate_system_build_prop): $(BUILDINFO_SH) $(BUILDINFO_COMMON_SH) $(INTERNAL_BUILD_ID_MAKEFILE) $(BUILD_SYSTEM)/version_defaults.mk $(system_prop_file) $(INSTALLED_ANDROID_INFO_TXT_TARGET) $(API_FINGERPRINT) $(POST_PROCESS_PROPS)
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
@@ -423,8 +446,8 @@
 	        BUILD_HOSTNAME="$(BUILD_HOSTNAME)" \
 	        BUILD_NUMBER="$(BUILD_NUMBER_FROM_FILE)" \
 	        BOARD_BUILD_SYSTEM_ROOT_IMAGE="$(BOARD_BUILD_SYSTEM_ROOT_IMAGE)" \
-	        AB_OTA_UPDATER="$(AB_OTA_UPDATER)" \
 	        PLATFORM_VERSION="$(PLATFORM_VERSION)" \
+	        PLATFORM_VERSION_LAST_STABLE="$(PLATFORM_VERSION_LAST_STABLE)" \
 	        PLATFORM_SECURITY_PATCH="$(PLATFORM_SECURITY_PATCH)" \
 	        PLATFORM_BASE_OS="$(PLATFORM_BASE_OS)" \
 	        PLATFORM_SDK_VERSION="$(PLATFORM_SDK_VERSION)" \
@@ -458,17 +481,18 @@
 	            echo "#" >> $@; )
 	$(hide) $(foreach line,$(FINAL_BUILD_PROPERTIES), \
 	    echo "$(line)" >> $@;)
-	$(hide) build/make/tools/post_process_props.py $@ $(PRODUCT_SYSTEM_PROPERTY_BLACKLIST)
+	$(hide) $(POST_PROCESS_PROPS) $@ $(PRODUCT_SYSTEM_PROPERTY_BLACKLIST)
 
 build_desc :=
 
-ifeq (,$(filter true, $(TARGET_NO_KERNEL) $(TARGET_NO_RECOVERY)))
-INSTALLED_RECOVERYIMAGE_TARGET := $(PRODUCT_OUT)/recovery.img
-else
 INSTALLED_RECOVERYIMAGE_TARGET :=
+ifdef BUILDING_RECOVERY_IMAGE
+ifneq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+INSTALLED_RECOVERYIMAGE_TARGET := $(PRODUCT_OUT)/recovery.img
+endif
 endif
 
-$(INSTALLED_BUILD_PROP_TARGET): $(intermediate_system_build_prop) $(INSTALLED_RECOVERYIMAGE_TARGET)
+$(INSTALLED_BUILD_PROP_TARGET): $(intermediate_system_build_prop)
 	@echo "Target build info: $@"
 	$(hide) grep -v 'ro.product.first_api_level' $(intermediate_system_build_prop) > $@
 
@@ -479,6 +503,12 @@
 INSTALLED_VENDOR_BUILD_PROP_TARGET := $(TARGET_OUT_VENDOR)/build.prop
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_VENDOR_BUILD_PROP_TARGET)
 
+ifdef TARGET_VENDOR_PROP
+vendor_prop_files := $(TARGET_VENDOR_PROP)
+else
+vendor_prop_files := $(wildcard $(TARGET_DEVICE_DIR)/vendor.prop)
+endif
+
 ifdef property_overrides_split_enabled
 FINAL_VENDOR_BUILD_PROPERTIES += \
     $(call collapse-pairs, $(PRODUCT_PROPERTY_OVERRIDES))
@@ -486,7 +516,7 @@
     $(FINAL_VENDOR_BUILD_PROPERTIES),=)
 endif  # property_overrides_split_enabled
 
-$(INSTALLED_VENDOR_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(intermediate_system_build_prop)
+$(INSTALLED_VENDOR_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(intermediate_system_build_prop) $(vendor_prop_files)
 	@echo Target vendor buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
@@ -507,6 +537,9 @@
 ifdef TARGET_SCREEN_DENSITY
 	$(hide) echo ro.sf.lcd_density="$(TARGET_SCREEN_DENSITY)">>$@
 endif
+ifeq ($(AB_OTA_UPDATER),true)
+	$(hide) echo ro.build.ab_update=true >> $@
+endif
 	$(hide) $(call generate-common-build-props,vendor,$@)
 	$(hide) echo "#" >> $@; \
 	        echo "# BOOTIMAGE_BUILD_PROPERTIES" >> $@; \
@@ -519,10 +552,20 @@
 	        echo "#" >> $@;
 	$(hide) cat $(INSTALLED_ANDROID_INFO_TXT_TARGET) | grep 'require version-' | sed -e 's/require version-/ro.build.expect./g' >> $@
 ifdef property_overrides_split_enabled
+	$(hide) $(foreach file,$(vendor_prop_files), \
+	    if [ -f "$(file)" ]; then \
+	        echo Target vendor properties from: "$(file)"; \
+	        echo "" >> $@; \
+	        echo "#" >> $@; \
+	        echo "# from $(file)" >> $@; \
+	        echo "#" >> $@; \
+	        cat $(file) >> $@; \
+	        echo "# end of $(file)" >> $@; \
+	    fi;)
 	$(hide) $(foreach line,$(FINAL_VENDOR_BUILD_PROPERTIES), \
 	    echo "$(line)" >> $@;)
 endif  # property_overrides_split_enabled
-	$(hide) build/make/tools/post_process_props.py $@ $(PRODUCT_VENDOR_PROPERTY_BLACKLIST)
+	$(hide) $(POST_PROCESS_PROPS) $@ $(PRODUCT_VENDOR_PROPERTY_BLACKLIST)
 
 # -----------------------------------------------------------------
 # product build.prop
@@ -540,13 +583,11 @@
 FINAL_PRODUCT_PROPERTIES := $(call uniq-pairs-by-first-component, \
     $(FINAL_PRODUCT_PROPERTIES),=)
 
-$(INSTALLED_PRODUCT_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(product_prop_files)
+$(INSTALLED_PRODUCT_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(product_prop_files)
 	@echo Target product buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
-ifdef BOARD_USES_PRODUCTIMAGE
 	$(hide) $(call generate-common-build-props,product,$@)
-endif  # BOARD_USES_PRODUCTIMAGE
 	$(hide) $(foreach file,$(product_prop_files), \
 	    if [ -f "$(file)" ]; then \
 	        echo Target product properties from: "$(file)"; \
@@ -563,19 +604,25 @@
 	        echo "ro.build.characteristics=$(TARGET_AAPT_CHARACTERISTICS)" >> $@;
 	$(hide) $(foreach line,$(FINAL_PRODUCT_PROPERTIES), \
 	    echo "$(line)" >> $@;)
-	$(hide) build/make/tools/post_process_props.py $@
+	$(hide) $(POST_PROCESS_PROPS) $@
 
 # ----------------------------------------------------------------
 # odm build.prop
 INSTALLED_ODM_BUILD_PROP_TARGET := $(TARGET_OUT_ODM)/etc/build.prop
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_ODM_BUILD_PROP_TARGET)
 
+ifdef TARGET_ODM_PROP
+odm_prop_files := $(TARGET_ODM_PROP)
+else
+odm_prop_files := $(wildcard $(TARGET_DEVICE_DIR)/odm.prop)
+endif
+
 FINAL_ODM_BUILD_PROPERTIES += \
     $(call collapse-pairs, $(PRODUCT_ODM_PROPERTIES))
 FINAL_ODM_BUILD_PROPERTIES := $(call uniq-pairs-by-first-component, \
     $(FINAL_ODM_BUILD_PROPERTIES),=)
 
-$(INSTALLED_ODM_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH)
+$(INSTALLED_ODM_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(odm_prop_files)
 	@echo Target odm buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
@@ -583,41 +630,60 @@
 	$(hide) echo ro.odm.product.cpu.abilist32="$(TARGET_CPU_ABI_LIST_32_BIT)">>$@
 	$(hide) echo ro.odm.product.cpu.abilist64="$(TARGET_CPU_ABI_LIST_64_BIT)">>$@
 	$(hide) $(call generate-common-build-props,odm,$@)
+	$(hide) $(foreach file,$(odm_prop_files), \
+	    if [ -f "$(file)" ]; then \
+	        echo Target odm properties from: "$(file)"; \
+	        echo "" >> $@; \
+	        echo "#" >> $@; \
+	        echo "# from $(file)" >> $@; \
+	        echo "#" >> $@; \
+	        cat $(file) >> $@; \
+	        echo "# end of $(file)" >> $@; \
+	    fi;)
 	$(hide) echo "#" >> $@; \
 	        echo "# ADDITIONAL ODM BUILD PROPERTIES" >> $@; \
 	        echo "#" >> $@;
 	$(hide) $(foreach line,$(FINAL_ODM_BUILD_PROPERTIES), \
 	    echo "$(line)" >> $@;)
-	$(hide) build/make/tools/post_process_props.py $@
+	$(hide) $(POST_PROCESS_PROPS) $@
 
 # -----------------------------------------------------------------
-# product_services build.prop (unless it's merged into /product)
-ifdef MERGE_PRODUCT_SERVICES_INTO_PRODUCT
-  ifneq (,$(PRODUCT_PRODUCT_SERVICES_PROPERTIES))
-    $(error PRODUCT_PRODUCT_SERVICES_PROPERTIES is not supported in this build.)
-  endif
-else
-INSTALLED_PRODUCT_SERVICES_BUILD_PROP_TARGET := $(TARGET_OUT_PRODUCT_SERVICES)/build.prop
-ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_PRODUCT_SERVICES_BUILD_PROP_TARGET)
+# system_ext build.prop
+INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET := $(TARGET_OUT_SYSTEM_EXT)/build.prop
+ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET)
 
-FINAL_PRODUCT_SERVICES_PROPERTIES += \
-    $(call collapse-pairs, $(PRODUCT_PRODUCT_SERVICES_PROPERTIES))
-FINAL_PRODUCT_SERVICES_PROPERTIES := $(call uniq-pairs-by-first-component, \
-    $(FINAL_PRODUCT_SERVICES_PROPERTIES),=)
-$(INSTALLED_PRODUCT_SERVICES_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH)
-	@echo Target product_services buildinfo: $@
+ifdef TARGET_SYSTEM_EXT_PROP
+system_ext_prop_files := $(TARGET_SYSTEM_EXT_PROP)
+else
+system_ext_prop_files := $(wildcard $(TARGET_DEVICE_DIR)/system_ext.prop)
+endif
+
+FINAL_SYSTEM_EXT_PROPERTIES += \
+    $(call collapse-pairs, $(PRODUCT_SYSTEM_EXT_PROPERTIES))
+FINAL_SYSTEM_EXT_PROPERTIES := $(call uniq-pairs-by-first-component, \
+    $(FINAL_SYSTEM_EXT_PROPERTIES),=)
+
+$(INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(system_ext_prop_files)
+	@echo Target system_ext buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
-ifdef BOARD_USES_PRODUCT_SERVICESIMAGE
-	$(hide) $(call generate-common-build-props,product_services,$@)
-endif  # BOARD_USES_PRODUCT_SERVICESIMAGE
+	$(hide) $(call generate-common-build-props,system_ext,$@)
+	$(hide) $(foreach file,$(system_ext_prop_files), \
+	    if [ -f "$(file)" ]; then \
+	        echo Target system_ext properties from: "$(file)"; \
+	        echo "" >> $@; \
+	        echo "#" >> $@; \
+	        echo "# from $(file)" >> $@; \
+	        echo "#" >> $@; \
+	        cat $(file) >> $@; \
+	        echo "# end of $(file)" >> $@; \
+	    fi;)
 	$(hide) echo "#" >> $@; \
-	        echo "# ADDITIONAL PRODUCT_SERVICES PROPERTIES" >> $@; \
+	        echo "# ADDITIONAL SYSTEM_EXT BUILD PROPERTIES" >> $@; \
 	        echo "#" >> $@;
-	$(hide) $(foreach line,$(FINAL_PRODUCT_SERVICES_PROPERTIES), \
+	$(hide) $(foreach line,$(FINAL_SYSTEM_EXT_PROPERTIES), \
 	    echo "$(line)" >> $@;)
-	$(hide) build/make/tools/post_process_props.py $@
-endif # MERGE_PRODUCT_SERVICES_INTO_PRODUCT
+	$(hide) $(POST_PROCESS_PROPS) $@
 
 # ----------------------------------------------------------------
 
@@ -648,32 +714,201 @@
 	$(hide) mv $@.tmp $@
 
 # -----------------------------------------------------------------
-# package stats
-PACKAGE_STATS_FILE := $(PRODUCT_OUT)/package-stats.txt
-PACKAGES_TO_STAT := \
-    $(sort $(filter $(TARGET_OUT)/% $(TARGET_OUT_DATA)/%, \
-	$(filter %.jar %.apk, $(ALL_DEFAULT_INSTALLED_MODULES))))
-$(PACKAGE_STATS_FILE): $(PACKAGES_TO_STAT)
-	@echo Package stats: $@
-	@mkdir -p $(dir $@)
-	$(hide) rm -f $@
-ifeq ($(PACKAGES_TO_STAT),)
-# Create empty package stats file if target builds no jar(s) or apk(s).
-	$(hide) touch $@
-else
-	$(hide) build/make/tools/dump-package-stats $^ > $@
+# kernel modules
+
+# Depmod requires a well-formed kernel version so 0.0 is used as a placeholder.
+DEPMOD_STAGING_SUBDIR :=$= lib/modules/0.0
+
+define copy-and-strip-kernel-module
+$(2): $(1)
+	$(LLVM_STRIP) -o $(2) --strip-debug $(1)
+endef
+
+# $(1): modules list
+# $(2): output dir
+# $(3): mount point
+# $(4): staging dir
+# $(5): module load list
+# $(6): module load list filename
+# $(7): module archive
+# $(8): staging dir for stripped modules
+# $(9): module directory name
+# Returns the a list of src:dest pairs to install the modules using copy-many-files.
+define build-image-kernel-modules
+  $(if $(9), \
+    $(eval _dir := $(9)/), \
+    $(eval _dir :=)) \
+  $(foreach module,$(1), \
+    $(eval _src := $(module)) \
+    $(if $(8), \
+      $(eval _src := $(8)/$(notdir $(module))) \
+      $(eval $(call copy-and-strip-kernel-module,$(module),$(_src)))) \
+    $(_src):$(2)/lib/modules/$(_dir)$(notdir $(module))) \
+  $(eval $(call build-image-kernel-modules-depmod,$(1),$(3),$(4),$(5),$(6),$(7),$(2),$(9))) \
+  $(4)/$(DEPMOD_STAGING_SUBDIR)/modules.dep:$(2)/lib/modules/$(_dir)modules.dep \
+  $(4)/$(DEPMOD_STAGING_SUBDIR)/modules.alias:$(2)/lib/modules/$(_dir)modules.alias \
+  $(4)/$(DEPMOD_STAGING_SUBDIR)/modules.softdep:$(2)/lib/modules/$(_dir)modules.softdep \
+  $(4)/$(DEPMOD_STAGING_SUBDIR)/$(6):$(2)/lib/modules/$(_dir)$(6)
+endef
+
+# $(1): modules list
+# $(2): mount point
+# $(3): staging dir
+# $(4): module load list
+# $(5): module load list filename
+# $(6): module archive
+# $(7): output dir
+# $(8): module directory name
+# TODO(b/144844424): If a module archive is being used, this step (which
+# generates obj/PACKAGING/.../modules.dep) also unzips the module archive into
+# the output directory. This should be moved to a module with a
+# LOCAL_POST_INSTALL_CMD so that if modules.dep is removed from the output dir,
+# the archive modules are restored along with modules.dep.
+define build-image-kernel-modules-depmod
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: .KATI_IMPLICIT_OUTPUTS := $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.alias $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.softdep $(3)/$(DEPMOD_STAGING_SUBDIR)/$(5)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: $(DEPMOD)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_MODULES := $(1)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_MOUNT_POINT := $(2)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_MODULE_DIR := $(3)/$(DEPMOD_STAGING_SUBDIR)/$(2)/lib/modules/$(8)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_STAGING_DIR := $(3)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_LOAD_MODULES := $(4)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_LOAD_FILE := $(3)/$(DEPMOD_STAGING_SUBDIR)/$(5)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_MODULE_ARCHIVE := $(6)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_OUTPUT_DIR := $(7)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: $(1) $(6)
+	@echo depmod $$(PRIVATE_STAGING_DIR)
+	rm -rf $$(PRIVATE_STAGING_DIR)
+	mkdir -p $$(PRIVATE_MODULE_DIR)
+	$(if $(6),\
+	  unzip -qoDD -d $$(PRIVATE_MODULE_DIR) $$(PRIVATE_MODULE_ARCHIVE); \
+	  mkdir -p $$(PRIVATE_OUTPUT_DIR)/lib; \
+	  cp -r  $(3)/$(DEPMOD_STAGING_SUBDIR)/$(2)/lib/modules $$(PRIVATE_OUTPUT_DIR)/lib/; \
+	  find $$(PRIVATE_MODULE_DIR) -type f -name *.ko | xargs basename -a > $$(PRIVATE_LOAD_FILE); \
+	)
+	$(if $(1),\
+	  cp $$(PRIVATE_MODULES) $$(PRIVATE_MODULE_DIR)/; \
+	  for MODULE in $$(PRIVATE_LOAD_MODULES); do \
+	    basename $$$$MODULE >> $$(PRIVATE_LOAD_FILE); \
+	  done; \
+	)
+	$(DEPMOD) -b $$(PRIVATE_STAGING_DIR) 0.0
+	# Turn paths in modules.dep into absolute paths
+	sed -i.tmp -e 's|\([^: ]*lib/modules/[^: ]*\)|/\1|g' $$(PRIVATE_STAGING_DIR)/$$(DEPMOD_STAGING_SUBDIR)/modules.dep
+	touch $$(PRIVATE_LOAD_FILE)
+endef
+
+# $(1): staging dir
+# $(2): modules list
+# $(3): module load list
+# $(4): module load list filename
+# $(5): output dir
+define module-load-list-copy-paths
+  $(eval $(call build-image-module-load-list,$(1),$(2),$(3),$(4))) \
+  $(1)/$(DEPMOD_STAGING_SUBDIR)/$(4):$(5)/lib/modules/$(4)
+endef
+
+# $(1): staging dir
+# $(2): modules list
+# $(3): module load list
+# $(4): module load list filename
+define build-image-module-load-list
+$(1)/$(DEPMOD_STAGING_SUBDIR)/$(4): PRIVATE_LOAD_MODULES := $(3)
+$(1)/$(DEPMOD_STAGING_SUBDIR)/$(4): $(2)
+	@echo load-list $$(@)
+	@echo '$$(strip $$(notdir $$(PRIVATE_LOAD_MODULES)))' | tr ' ' '\n' > $$(@)
+endef
+
+# $(1): image name
+# $(2): build output directory (TARGET_OUT_VENDOR, TARGET_RECOVERY_ROOT_OUT, etc)
+# $(3): mount point
+# $(4): module load filename
+# $(5): stripped staging directory
+# $(6): kernel module directory name (top is an out of band value for no directory)
+define build-image-kernel-modules-dir
+$(if $(filter top,$(6)),\
+  $(eval _kver :=)$(eval _sep :=),\
+  $(eval _kver := $(6))$(eval _sep :=_))\
+$(if $(5),\
+  $(eval _stripped_staging_dir := $(5)$(_sep)$(_kver)),\
+  $(eval _stripped_staging_dir :=))\
+$(if $(strip $(BOARD_$(1)_KERNEL_MODULES$(_sep)$(_kver))$(BOARD_$(1)_KERNEL_MODULES_ARCHIVE$(_sep)$(_kver))),\
+  $(if $(BOARD_$(1)_KERNEL_MODULES_LOAD$(_sep)$(_kver)),,\
+    $(eval BOARD_$(1)_KERNEL_MODULES_LOAD$(_sep)$(_kver) := $(BOARD_$(1)_KERNEL_MODULES$(_sep)$(_kver)))) \
+  $(call copy-many-files,$(call build-image-kernel-modules,$(BOARD_$(1)_KERNEL_MODULES$(_sep)$(_kver)),$(2),$(3),$(call intermediates-dir-for,PACKAGING,depmod_$(1)$(_sep)$(_kver)),$(BOARD_$(1)_KERNEL_MODULES_LOAD$(_sep)$(_kver)),$(4),$(BOARD_$(1)_KERNEL_MODULES_ARCHIVE$(_sep)$(_kver)),$(_stripped_staging_dir),$(_kver))))
+endef
+
+# $(1): kernel module directory name (top is an out of band value for no directory)
+define build-recovery-as-boot-load
+$(if $(filter top,$(1)),\
+  $(eval _kver :=)$(eval _sep :=),\
+  $(eval _kver := $(1))$(eval _sep :=_))\
+  $(if $(BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD$(_sep)$(_kver)),\
+    $(call copy-many-files,$(call module-load-list-copy-paths,$(call intermediates-dir-for,PACKAGING,ramdisk_module_list$(_sep)$(_kver)),$(BOARD_GENERIC_RAMDISK_KERNEL_MODULES$(_sep)$(_kver)),$(BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD$(_sep)$(_kver)),modules.load,$(TARGET_RECOVERY_ROOT_OUT))))
+endef
+
+# $(1): kernel module directory name (top is an out of band value for no directory)
+define build-vendor-ramdisk-recovery-load
+$(if $(filter top,$(1)),\
+  $(eval _kver :=)$(eval _sep :=),\
+  $(eval _kver := $(1))$(eval _sep :=_))\
+  $(if $(BOARD_VENDOR_RAMDISK_RECOVERY_KERNEL_MODULES_LOAD$(_sep)$(_kver)),\
+    $(call copy-many-files,$(call module-load-list-copy-paths,$(call intermediates-dir-for,PACKAGING,vendor_ramdisk_recovery_module_list$(_sep)$(_kver)),$(BOARD_VENDOR_RAMDISK_KERNEL_MODULES$(_sep)$(_kver)),$(BOARD_VENDOR_RAMDISK_RECOVERY_KERNEL_MODULES_LOAD$(_sep)$(_kver)),modules.load.recovery,$(TARGET_VENDOR_RAMDISK_OUT))))
+endef
+
+ifneq ($(BUILDING_VENDOR_BOOT_IMAGE),true)
+  # If there is no vendor boot partition, store vendor ramdisk kernel modules in the
+  # boot ramdisk.
+  BOARD_GENERIC_RAMDISK_KERNEL_MODULES += $(BOARD_VENDOR_RAMDISK_KERNEL_MODULES)
+  BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD += $(BOARD_VENDOR_RAMDISK_KERNEL_MODULES_LOAD)
 endif
 
-.PHONY: package-stats
-package-stats: $(PACKAGE_STATS_FILE)
+ifeq ($(BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD),)
+  BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD := $(BOARD_GENERIC_RAMDISK_KERNEL_MODULES)
+endif
+
+ifneq ($(strip $(BOARD_GENERIC_RAMDISK_KERNEL_MODULES)),)
+  ifeq ($(BOARD_USES_RECOVERY_AS_BOOT), true)
+    BOARD_RECOVERY_KERNEL_MODULES += $(BOARD_GENERIC_RAMDISK_KERNEL_MODULES)
+  endif
+endif
+
+ifneq ($(BOARD_DO_NOT_STRIP_VENDOR_MODULES),true)
+	VENDOR_STRIPPED_MODULE_STAGING_DIR := $(call intermediates-dir-for,PACKAGING,depmod_vendor_stripped)
+else
+	VENDOR_STRIPPED_MODULE_STAGING_DIR :=
+endif
+
+ifneq ($(BOARD_DO_NOT_STRIP_VENDOR_RAMDISK_MODULES),true)
+  VENDOR_RAMDISK_STRIPPED_MODULE_STAGING_DIR := $(call intermediates-dir-for,PACKAGING,depmod_vendor_ramdisk_stripped)
+else
+  VENDOR_RAMDISK_STRIPPED_MODULE_STAGING_DIR :=
+endif
+
+BOARD_KERNEL_MODULE_DIRS += top
+$(foreach dir,$(BOARD_KERNEL_MODULE_DIRS), \
+  $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,RECOVERY,$(TARGET_RECOVERY_ROOT_OUT),,modules.load.recovery,,$(dir))) \
+  $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,VENDOR_RAMDISK,$(TARGET_VENDOR_RAMDISK_OUT),,modules.load,$(VENDOR_RAMDISK_STRIPPED_MODULE_STAGING_DIR),$(dir))) \
+  $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-vendor-ramdisk-recovery-load,$(dir))) \
+  $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,VENDOR,$(TARGET_OUT_VENDOR),vendor,modules.load,$(VENDOR_STRIPPED_MODULE_STAGING_DIR),$(dir))) \
+  $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,ODM,$(TARGET_OUT_ODM),odm,modules.load,,$(dir))) \
+  $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)),\
+    $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-recovery-as-boot-load,$(dir))),\
+    $(eval ALL_DEFAULT_INSTALLED_MODULES += $(call build-image-kernel-modules-dir,GENERIC_RAMDISK,$(TARGET_RAMDISK_OUT),,modules.load,,$(dir)))))
 
 # -----------------------------------------------------------------
 # Cert-to-package mapping.  Used by the post-build signing tools.
 # Use a macro to add newline to each echo command
+# $1 stem name of the package
+# $2 certificate
+# $3 private key
+# $4 compressed
+# $5 partition tag
+# $6 output file
 define _apkcerts_write_line
-$(hide) echo -n 'name="$(1).apk" certificate="$2" private_key="$3"' >> $5
-$(if $(4), $(hide) echo -n ' compressed="$4"' >> $5)
-$(hide) echo '' >> $5
+$(hide) echo -n 'name="$(1).apk" certificate="$2" private_key="$3"' >> $6
+$(if $(4), $(hide) echo -n ' compressed="$4"' >> $6)
+$(if $(5), $(hide) echo -n ' partition="$5"' >> $6)
+$(hide) echo '' >> $6
 
 endef
 
@@ -703,12 +938,12 @@
 	@echo APK certs list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
-	$(foreach p,$(PACKAGES),\
+	$(foreach p,$(sort $(PACKAGES)),\
 	  $(if $(PACKAGES.$(p).APKCERTS_FILE),\
 	    $(call _apkcerts_merge,$(PACKAGES.$(p).APKCERTS_FILE), $@),\
 	    $(if $(PACKAGES.$(p).EXTERNAL_KEY),\
-	      $(call _apkcerts_write_line,$(p),"EXTERNAL","",$(PACKAGES.$(p).COMPRESSED),$@),\
-	      $(call _apkcerts_write_line,$(p),$(PACKAGES.$(p).CERTIFICATE),$(PACKAGES.$(p).PRIVATE_KEY),$(PACKAGES.$(p).COMPRESSED),$@))))
+	      $(call _apkcerts_write_line,$(PACKAGES.$(p).STEM),"EXTERNAL","",$(PACKAGES.$(p).COMPRESSED),$(PACKAGES.$(p).PARTITION),$@),\
+	      $(call _apkcerts_write_line,$(PACKAGES.$(p).STEM),$(PACKAGES.$(p).CERTIFICATE),$(PACKAGES.$(p).PRIVATE_KEY),$(PACKAGES.$(p).COMPRESSED),$(PACKAGES.$(p).PARTITION),$@))))
 	# In case value of PACKAGES is empty.
 	$(hide) touch $@
 
@@ -768,6 +1003,10 @@
 $(call dist-for-goals,droidcore,$(WALL_WERROR))
 
 # -----------------------------------------------------------------
+# C/C++ flag information for modules
+$(call dist-for-goals,droidcore,$(SOONG_MODULES_CFLAG_ARTIFACTS))
+
+# -----------------------------------------------------------------
 # Modules missing profile files
 PGO_PROFILE_MISSING := $(PRODUCT_OUT)/pgo_profile_file_missing.txt
 $(PGO_PROFILE_MISSING):
@@ -851,7 +1090,12 @@
   INSTALLED_2NDBOOTLOADER_TARGET :=
 endif # TARGET_NO_BOOTLOADER
 ifneq ($(strip $(TARGET_NO_KERNEL)),true)
-  INSTALLED_KERNEL_TARGET := $(PRODUCT_OUT)/kernel
+  ifneq ($(strip $(BOARD_KERNEL_BINARIES)),)
+    INSTALLED_KERNEL_TARGET := $(foreach k,$(BOARD_KERNEL_BINARIES), \
+      $(PRODUCT_OUT)/$(k))
+  else
+    INSTALLED_KERNEL_TARGET := $(PRODUCT_OUT)/kernel
+  endif
 else
   INSTALLED_KERNEL_TARGET :=
 endif
@@ -865,12 +1109,12 @@
 INSTALLED_FILES_FILE_ROOT := $(PRODUCT_OUT)/installed-files-root.txt
 INSTALLED_FILES_JSON_ROOT := $(INSTALLED_FILES_FILE_ROOT:.txt=.json)
 $(INSTALLED_FILES_FILE_ROOT): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_ROOT)
-$(INSTALLED_FILES_FILE_ROOT) : $(INTERNAL_ROOT_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_ROOT) : $(INTERNAL_ROOT_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_ROOT_OUT) > $(@:.txt=.json)
-	$(hide) build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 $(call dist-for-goals, sdk win_sdk sdk_addon, $(INSTALLED_FILES_FILE_ROOT))
 
@@ -894,59 +1138,79 @@
 INSTALLED_FILES_FILE_RAMDISK := $(PRODUCT_OUT)/installed-files-ramdisk.txt
 INSTALLED_FILES_JSON_RAMDISK := $(INSTALLED_FILES_FILE_RAMDISK:.txt=.json)
 $(INSTALLED_FILES_FILE_RAMDISK): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_RAMDISK)
-$(INSTALLED_FILES_FILE_RAMDISK) : $(INTERNAL_RAMDISK_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_RAMDISK) : $(INTERNAL_RAMDISK_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(TARGET_RAMDISK_OUT)
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_RAMDISK_OUT) > $(@:.txt=.json)
-	$(hide) build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 $(call dist-for-goals, sdk win_sdk sdk_addon, $(INSTALLED_FILES_FILE_RAMDISK))
 BUILT_RAMDISK_TARGET := $(PRODUCT_OUT)/ramdisk.img
 
+ifeq ($(BOARD_RAMDISK_USE_LZ4),true)
+# -l enables the legacy format used by the Linux kernel
+COMPRESSION_COMMAND_DEPS := $(LZ4)
+COMPRESSION_COMMAND := $(LZ4) -l -12 --favor-decSpeed
+RAMDISK_EXT := .lz4
+else
+COMPRESSION_COMMAND_DEPS := $(MINIGZIP)
+COMPRESSION_COMMAND := $(MINIGZIP)
+RAMDISK_EXT := .gz
+endif
+
 # We just build this directly to the install location.
 INSTALLED_RAMDISK_TARGET := $(BUILT_RAMDISK_TARGET)
-$(INSTALLED_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_RAMDISK_FILES) $(INSTALLED_FILES_FILE_RAMDISK) | $(MINIGZIP)
+$(INSTALLED_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_RAMDISK_FILES) $(INSTALLED_FILES_FILE_RAMDISK) | $(COMPRESSION_COMMAND_DEPS)
 	$(call pretty,"Target ram disk: $@")
-	$(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RAMDISK_OUT) | $(MINIGZIP) > $@
+	$(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RAMDISK_OUT) | $(COMPRESSION_COMMAND) > $@
 
 .PHONY: ramdisk-nodeps
-ramdisk-nodeps: $(MKBOOTFS) | $(MINIGZIP)
+ramdisk-nodeps: $(MKBOOTFS) | $(COMPRESSION_COMMAND_DEPS)
 	@echo "make $@: ignoring dependencies"
-	$(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RAMDISK_OUT) | $(MINIGZIP) > $(INSTALLED_RAMDISK_TARGET)
+	$(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RAMDISK_OUT) | $(COMPRESSION_COMMAND) > $(INSTALLED_RAMDISK_TARGET)
 
 endif # BUILDING_RAMDISK_IMAGE
 
-
-INSTALLED_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img
-
-ifneq ($(strip $(TARGET_NO_KERNEL)),true)
-
 # -----------------------------------------------------------------
 # the boot image, which is a collection of other images.
+
+# This is defined here since we may be building recovery as boot
+# below and only want to define this once
+ifneq ($(strip $(BOARD_KERNEL_BINARIES)),)
+  BUILT_BOOTIMAGE_TARGET := $(foreach k,$(subst kernel,boot,$(BOARD_KERNEL_BINARIES)), $(PRODUCT_OUT)/$(k).img)
+else
+  BUILT_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img
+endif
+
+ifdef BOARD_BOOTIMAGE_PARTITION_SIZE
+  BOARD_KERNEL_BOOTIMAGE_PARTITION_SIZE := $(BOARD_BOOTIMAGE_PARTITION_SIZE)
+endif
+
+# $1: boot image file name
+# $2: boot image variant (boot, boot-debug)
+define get-bootimage-partition-size
+  $(BOARD_$(call to-upper,$(subst .img,,$(subst $(2),kernel,$(notdir $(1)))))_BOOTIMAGE_PARTITION_SIZE)
+endef
+
+ifneq ($(strip $(TARGET_NO_KERNEL)),true)
 INTERNAL_BOOTIMAGE_ARGS := \
 	$(addprefix --second ,$(INSTALLED_2NDBOOTLOADER_TARGET)) \
 	--kernel $(INSTALLED_KERNEL_TARGET)
 
-ifdef BOARD_INCLUDE_DTB_IN_BOOTIMG
-  INTERNAL_BOOTIMAGE_ARGS += --dtb $(INSTALLED_DTBIMAGE_TARGET)
-endif
-
 ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
 INTERNAL_BOOTIMAGE_ARGS += --ramdisk $(INSTALLED_RAMDISK_TARGET)
 endif
 
+ifndef BUILDING_VENDOR_BOOT_IMAGE
+ifdef BOARD_INCLUDE_DTB_IN_BOOTIMG
+  INTERNAL_BOOTIMAGE_ARGS += --dtb $(INSTALLED_DTBIMAGE_TARGET)
+endif
+endif
+
 INTERNAL_BOOTIMAGE_FILES := $(filter-out --%,$(INTERNAL_BOOTIMAGE_ARGS))
 
-ifdef BOARD_KERNEL_BASE
-  INTERNAL_BOOTIMAGE_ARGS += --base $(BOARD_KERNEL_BASE)
-endif
-
-ifdef BOARD_KERNEL_PAGESIZE
-  INTERNAL_BOOTIMAGE_ARGS += --pagesize $(BOARD_KERNEL_PAGESIZE)
-endif
-
 ifeq ($(PRODUCT_SUPPORTS_VERITY),true)
 ifeq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
 VERITY_KEYID := veritykeyid=id:`openssl x509 -in $(PRODUCT_VERITY_SIGNING_KEY).x509.pem -text \
@@ -955,16 +1219,32 @@
 endif
 
 INTERNAL_KERNEL_CMDLINE := $(strip $(INTERNAL_KERNEL_CMDLINE) buildvariant=$(TARGET_BUILD_VARIANT) $(VERITY_KEYID))
+
+ifndef BUILDING_VENDOR_BOOT_IMAGE
+ifdef BOARD_KERNEL_BASE
+  INTERNAL_BOOTIMAGE_ARGS += --base $(BOARD_KERNEL_BASE)
+endif
+ifdef BOARD_KERNEL_PAGESIZE
+  INTERNAL_BOOTIMAGE_ARGS += --pagesize $(BOARD_KERNEL_PAGESIZE)
+endif
 ifdef INTERNAL_KERNEL_CMDLINE
-INTERNAL_BOOTIMAGE_ARGS += --cmdline "$(INTERNAL_KERNEL_CMDLINE)"
+  INTERNAL_BOOTIMAGE_ARGS += --cmdline "$(INTERNAL_KERNEL_CMDLINE)"
+endif
+else
+# building vendor boot image, dtb/base/pagesize go there
+ifdef GENERIC_KERNEL_CMDLINE
+  INTERNAL_BOOTIMAGE_ARGS += --cmdline "$(GENERIC_KERNEL_CMDLINE)"
+endif
 endif
 
 INTERNAL_MKBOOTIMG_VERSION_ARGS := \
-    --os_version $(PLATFORM_VERSION) \
+    --os_version $(PLATFORM_VERSION_LAST_STABLE) \
     --os_patch_level $(PLATFORM_SECURITY_PATCH)
 
-# We build recovery as boot image if BOARD_USES_RECOVERY_AS_BOOT is true.
-ifneq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+# Define these only if we are building boot
+ifdef BUILDING_BOOT_IMAGE
+INSTALLED_BOOTIMAGE_TARGET := $(BUILT_BOOTIMAGE_TARGET)
+
 ifeq ($(TARGET_BOOTIMAGE_USE_EXT2),true)
 $(error TARGET_BOOTIMAGE_USE_EXT2 is not supported anymore)
 
@@ -1035,7 +1315,7 @@
 	$(hide) $(call assert-max-image-size,$(INSTALLED_BOOTIMAGE_TARGET),$(BOARD_BOOTIMAGE_PARTITION_SIZE))
 
 endif # TARGET_BOOTIMAGE_USE_EXT2
-endif # BOARD_USES_RECOVERY_AS_BOOT
+endif # BUILDING_BOOT_IMAGE
 
 else # TARGET_NO_KERNEL == "true"
 ifdef BOARD_PREBUILT_BOOTIMAGE
@@ -1043,6 +1323,7 @@
 # Remove when b/63676296 is resolved.
 $(error Prebuilt bootimage is only supported for AB targets)
 endif
+INSTALLED_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img
 $(eval $(call copy-one-file,$(BOARD_PREBUILT_BOOTIMAGE),$(INSTALLED_BOOTIMAGE_TARGET)))
 else # BOARD_PREBUILT_BOOTIMAGE not defined
 INSTALLED_BOOTIMAGE_TARGET :=
@@ -1050,6 +1331,55 @@
 endif # TARGET_NO_KERNEL
 
 # -----------------------------------------------------------------
+# vendor boot image
+ifeq ($(BUILDING_VENDOR_BOOT_IMAGE),true)
+
+ifeq ($(PRODUCT_SUPPORTS_VERITY),true)
+  $(error vboot 1.0 does not support vendor_boot partition)
+endif
+
+INTERNAL_VENDOR_RAMDISK_FILES := $(filter $(TARGET_VENDOR_RAMDISK_OUT)/%, \
+    $(ALL_GENERATED_SOURCES) \
+    $(ALL_DEFAULT_INSTALLED_MODULES))
+
+INTERNAL_VENDOR_RAMDISK_TARGET := $(call intermediates-dir-for,PACKAGING,vendor-boot)/vendor-ramdisk.cpio.gz
+$(INTERNAL_VENDOR_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_VENDOR_RAMDISK_FILES) | $(COMPRESSION_COMMAND_DEPS)
+	$(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_VENDOR_RAMDISK_OUT) | $(COMPRESSION_COMMAND) > $@
+
+ifdef BOARD_INCLUDE_DTB_IN_BOOTIMG
+  INTERNAL_VENDOR_BOOTIMAGE_ARGS += --dtb $(INSTALLED_DTBIMAGE_TARGET)
+endif
+ifdef BOARD_KERNEL_BASE
+  INTERNAL_VENDOR_BOOTIMAGE_ARGS += --base $(BOARD_KERNEL_BASE)
+endif
+ifdef BOARD_KERNEL_PAGESIZE
+  INTERNAL_VENDOR_BOOTIMAGE_ARGS += --pagesize $(BOARD_KERNEL_PAGESIZE)
+endif
+ifdef INTERNAL_KERNEL_CMDLINE
+  INTERNAL_VENDOR_BOOTIMAGE_ARGS += --vendor_cmdline "$(INTERNAL_KERNEL_CMDLINE)"
+endif
+
+INSTALLED_VENDOR_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/vendor_boot.img
+$(INSTALLED_VENDOR_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INTERNAL_VENDOR_RAMDISK_TARGET) $(INSTALLED_DTBIMAGE_TARGET)
+ifeq ($(BOARD_AVB_ENABLE),true)
+$(INSTALLED_VENDOR_BOOTIMAGE_TARGET): $(AVBTOOL) $(BOARD_AVB_VENDOR_BOOTIMAGE_KEY_PATH)
+	$(call pretty,"Target vendor_boot image: $@")
+	$(MKBOOTIMG) $(INTERNAL_VENDOR_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --vendor_ramdisk $(INTERNAL_VENDOR_RAMDISK_TARGET) --vendor_boot $@
+	$(call assert-max-image-size,$@,$(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE))
+	$(AVBTOOL) add_hash_footer \
+           --image $@ \
+	   --partition_size $(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE) \
+	   --partition_name vendor_boot $(INTERNAL_AVB_VENDOR_BOOT_SIGNING_ARGS) \
+	   $(BOARD_AVB_VENDOR_BOOT_ADD_HASH_FOOTER_ARGS)
+else
+$(INSTALLED_VENDOR_BOOTIMAGE_TARGET):
+	$(call pretty,"Target vendor_boot image: $@")
+	$(MKBOOTIMG) $(INTERNAL_VENDOR_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --vendor_ramdisk $(INTERNAL_VENDOR_RAMDISK_TARGET) --vendor_boot $@
+	$(call assert-max-image-size,$@,$(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE))
+endif
+endif # BUILDING_VENDOR_BOOT_IMAGE
+
+# -----------------------------------------------------------------
 # NOTICE files
 #
 # We are required to publish the licenses for all code under BSD, GPL and
@@ -1064,11 +1394,12 @@
 .PHONY: notice_files
 
 # Create the rule to combine the files into text and html/xml forms
-# $(1) - xml_excluded_vendor_product|xml_vendor|xml_product|html
+# $(1) - xml_excluded_system_product_odm|xml_excluded_vendor_product_odm
+#        xml_product|xml_odm|xml_system_ext|xml_system|html
 # $(2) - Plain text output file
 # $(3) - HTML/XML output file
 # $(4) - File title
-# $(5) - Directory to use.  Notice files are all $(4)/src.  Other
+# $(5) - Directory to use.  Notice files are all $(5)/src.  Other
 #		 directories in there will be used for scratch
 # $(6) - Dependencies for the output files
 #
@@ -1089,12 +1420,14 @@
 $(2) : $(3)
 $(3) : $(6) $(BUILD_SYSTEM)/Makefile build/make/tools/generate-notice-files.py
 	build/make/tools/generate-notice-files.py --text-output $(2) \
-	    $(if $(filter $(1),xml_excluded_extra_partitions),-e vendor -e product -e product_services --xml-output, \
-	      $(if $(filter $(1),xml_vendor),-i vendor --xml-output, \
+	    $(if $(filter $(1),xml_excluded_vendor_product_odm),-e vendor -e product -e system_ext -e odm --xml-output, \
+	      $(if $(filter $(1),xml_excluded_system_product_odm),-e system -e product -e system_ext -e odm --xml-output, \
 	        $(if $(filter $(1),xml_product),-i product --xml-output, \
-	          $(if $(filter $(1),xml_product_services),-i product_services --xml-output, \
-	            --html-output)))) $(3) \
-	    -t $$(PRIVATE_MESSAGE) -s $$(PRIVATE_DIR)/src
+	          $(if $(filter $(1),xml_system_ext),-i system_ext --xml-output, \
+	            $(if $(filter $(1),xml_system),-i system --xml-output, \
+	              $(if $(filter $(1),xml_odm),-i odm --xml-output, \
+	                --html-output)))))) $(3) \
+	    -t $$(PRIVATE_MESSAGE) $$(foreach dir,$$(sort $$(PRIVATE_DIR)), -s $$(dir)/src)
 notice_files: $(2) $(3)
 endef
 
@@ -1141,10 +1474,15 @@
 target_product_notice_file_xml_gz := $(TARGET_OUT_INTERMEDIATES)/NOTICE_PRODUCT.xml.gz
 installed_product_notice_xml_gz := $(TARGET_OUT_PRODUCT)/etc/NOTICE.xml.gz
 
-target_product_services_notice_file_txt := $(TARGET_OUT_INTERMEDIATES)/NOTICE_PRODUCT_SERVICES.txt
-target_product_services_notice_file_xml := $(TARGET_OUT_INTERMEDIATES)/NOTICE_PRODUCT_SERVICES.xml
-target_product_services_notice_file_xml_gz := $(TARGET_OUT_INTERMEDIATES)/NOTICE_PRODUCT_SERVICES.xml.gz
-installed_product_services_notice_xml_gz := $(TARGET_OUT_PRODUCT_SERVICES)/etc/NOTICE.xml.gz
+target_system_ext_notice_file_txt := $(TARGET_OUT_INTERMEDIATES)/NOTICE_SYSTEM_EXT.txt
+target_system_ext_notice_file_xml := $(TARGET_OUT_INTERMEDIATES)/NOTICE_SYSTEM_EXT.xml
+target_system_ext_notice_file_xml_gz := $(TARGET_OUT_INTERMEDIATES)/NOTICE_SYSTEM_EXT.xml.gz
+installed_system_ext_notice_xml_gz := $(TARGET_OUT_SYSTEM_EXT)/etc/NOTICE.xml.gz
+
+target_odm_notice_file_txt := $(TARGET_OUT_INTERMEDIATES)/NOTICE_ODM.txt
+target_odm_notice_file_xml := $(TARGET_OUT_INTERMEDIATES)/NOTICE_ODM.xml
+target_odm_notice_file_xml_gz := $(TARGET_OUT_INTERMEDIATES)/NOTICE_ODM.xml.gz
+installed_odm_notice_xml_gz := $(TARGET_OUT_ODM)/etc/NOTICE.xml.gz
 
 # Notice files are copied to TARGET_OUT_NOTICE_FILES as a side-effect of their module
 # being built. A notice xml file must depend on all modules that could potentially
@@ -1152,22 +1490,44 @@
 license_modules := $(ALL_DEFAULT_INSTALLED_MODULES) $(kernel_notice_file) $(pdk_fusion_notice_files)
 # Phonys/fakes don't have notice files (though their deps might)
 license_modules := $(filter-out $(TARGET_OUT_FAKE)/%,$(license_modules))
+# testcases are not relevant to the system image.
+license_modules := $(filter-out $(TARGET_OUT_TESTCASES)/%,$(license_modules))
+license_modules_system := $(filter $(TARGET_OUT)/%,$(license_modules))
+# system_other is relevant to system partition.
+license_modules_system += $(filter $(TARGET_OUT_SYSTEM_OTHER)/%,$(license_modules))
 license_modules_vendor := $(filter $(TARGET_OUT_VENDOR)/%,$(license_modules))
 license_modules_product := $(filter $(TARGET_OUT_PRODUCT)/%,$(license_modules))
-license_modules_product_services := $(filter $(TARGET_OUT_PRODUCT_SERVICES)/%,$(license_modules))
-license_modules_agg := $(license_modules_vendor) $(license_modules_product) $(license_modules_product_services)
+license_modules_system_ext := $(filter $(TARGET_OUT_SYSTEM_EXT)/%,$(license_modules))
+license_modules_odm := $(filter $(TARGET_OUT_ODM)/%,$(license_modules))
+license_modules_agg := $(license_modules_system) \
+                       $(license_modules_vendor) \
+                       $(license_modules_product) \
+                       $(license_modules_system_ext) \
+                       $(license_modules_odm)
 license_modules_rest := $(filter-out $(license_modules_agg),$(license_modules))
 
-$(eval $(call combine-notice-files, xml_excluded_extra_partitions, \
+# If we are building in a configuration that includes a prebuilt vendor.img, we can't
+# update its notice file, so include those notices in the system partition instead
+ifdef BOARD_PREBUILT_VENDORIMAGE
+license_modules_system += $(license_modules_rest)
+system_xml_directories := xml_excluded_vendor_product_odm
+system_notice_file_message := "Notices for files contained in all filesystem images except vendor/system_ext/product/odm in this directory:"
+else
+license_modules_vendor += $(license_modules_rest)
+system_xml_directories := xml_system
+system_notice_file_message := "Notices for files contained in the system filesystem image in this directory:"
+endif
+
+$(eval $(call combine-notice-files, $(system_xml_directories), \
 	        $(target_notice_file_txt), \
 	        $(target_notice_file_xml), \
-	        "Notices for files contained in the filesystem images in this directory:", \
+	        $(system_notice_file_message), \
 	        $(TARGET_OUT_NOTICE_FILES), \
-	        $(license_modules_rest)))
-$(eval $(call combine-notice-files, xml_vendor, \
+	        $(license_modules_system)))
+$(eval $(call combine-notice-files, xml_excluded_system_product_odm, \
 	        $(target_vendor_notice_file_txt), \
 	        $(target_vendor_notice_file_xml), \
-	        "Notices for files contained in the vendor filesystem image in this directory:", \
+	        "Notices for files contained in all filesystem images except system/system_ext/product/odm in this directory:", \
 	        $(TARGET_OUT_NOTICE_FILES), \
 	        $(license_modules_vendor)))
 $(eval $(call combine-notice-files, xml_product, \
@@ -1176,12 +1536,18 @@
 	        "Notices for files contained in the product filesystem image in this directory:", \
 	        $(TARGET_OUT_NOTICE_FILES), \
 	        $(license_modules_product)))
-$(eval $(call combine-notice-files, xml_product_services, \
-	        $(target_product_services_notice_file_txt), \
-	        $(target_product_services_notice_file_xml), \
-	        "Notices for files contained in the product_services filesystem image in this directory:", \
+$(eval $(call combine-notice-files, xml_system_ext, \
+	        $(target_system_ext_notice_file_txt), \
+	        $(target_system_ext_notice_file_xml), \
+	        "Notices for files contained in the system_ext filesystem image in this directory:", \
 	        $(TARGET_OUT_NOTICE_FILES), \
-	        $(license_modules_product_services)))
+	        $(license_modules_system_ext)))
+$(eval $(call combine-notice-files, xml_odm, \
+	        $(target_odm_notice_file_txt), \
+	        $(target_odm_notice_file_xml), \
+	        "Notices for files contained in the odm filesystem image in this directory:", \
+	        $(TARGET_OUT_NOTICE_FILES), \
+	        $(license_modules_odm)))
 
 $(target_notice_file_xml_gz): $(target_notice_file_xml) | $(MINIGZIP)
 	$(hide) $(MINIGZIP) -9 < $< > $@
@@ -1189,7 +1555,9 @@
 	$(hide) $(MINIGZIP) -9 < $< > $@
 $(target_product_notice_file_xml_gz): $(target_product_notice_file_xml) | $(MINIGZIP)
 	$(hide) $(MINIGZIP) -9 < $< > $@
-$(target_product_services_notice_file_xml_gz): $(target_product_services_notice_file_xml) | $(MINIGZIP)
+$(target_system_ext_notice_file_xml_gz): $(target_system_ext_notice_file_xml) | $(MINIGZIP)
+	$(hide) $(MINIGZIP) -9 < $< > $@
+$(target_odm_notice_file_xml_gz): $(target_odm_notice_file_xml) | $(MINIGZIP)
 	$(hide) $(MINIGZIP) -9 < $< > $@
 $(installed_notice_html_or_xml_gz): $(target_notice_file_xml_gz)
 	$(copy-file-to-target)
@@ -1197,26 +1565,19 @@
 	$(copy-file-to-target)
 $(installed_product_notice_xml_gz): $(target_product_notice_file_xml_gz)
 	$(copy-file-to-target)
-
-# No notice file for product_services if its contents are merged into /product.
-# The notices will be part of the /product notice file.
-ifndef MERGE_PRODUCT_SERVICES_INTO_PRODUCT
-$(installed_product_services_notice_xml_gz): $(target_product_services_notice_file_xml_gz)
+$(installed_system_ext_notice_xml_gz): $(target_system_ext_notice_file_xml_gz)
 	$(copy-file-to-target)
-endif
+$(installed_odm_notice_xml_gz): $(target_odm_notice_file_xml_gz)
+	$(copy-file-to-target)
 
-# if we've been run my mm, mmm, etc, don't reinstall this every time
-ifeq ($(ONE_SHOT_MAKEFILE),)
-  ALL_DEFAULT_INSTALLED_MODULES += $(installed_notice_html_or_xml_gz)
-  ALL_DEFAULT_INSTALLED_MODULES += $(installed_vendor_notice_xml_gz)
-  ALL_DEFAULT_INSTALLED_MODULES += $(installed_product_notice_xml_gz)
-  ALL_DEFAULT_INSTALLED_MODULES += $(installed_product_services_notice_xml_gz)
-endif
+ALL_DEFAULT_INSTALLED_MODULES += $(installed_notice_html_or_xml_gz)
+ALL_DEFAULT_INSTALLED_MODULES += $(installed_vendor_notice_xml_gz)
+ALL_DEFAULT_INSTALLED_MODULES += $(installed_product_notice_xml_gz)
+ALL_DEFAULT_INSTALLED_MODULES += $(installed_system_ext_notice_xml_gz)
+ALL_DEFAULT_INSTALLED_MODULES += $(installed_odm_notice_xml_gz)
 endif # PRODUCT_NOTICE_SPLIT
 
-ifeq ($(ONE_SHOT_MAKEFILE),)
-  ALL_DEFAULT_INSTALLED_MODULES += $(installed_notice_html_or_xml_gz)
-endif
+ALL_DEFAULT_INSTALLED_MODULES += $(installed_notice_html_or_xml_gz)
 
 $(eval $(call combine-notice-files, html, \
 	        $(tools_notice_file_txt), \
@@ -1231,55 +1592,9 @@
 # The kernel isn't really a module, so to get its module file in there, we
 # make the target NOTICE files depend on this particular file too, which will
 # then be in the right directory for the find in combine-notice-files to work.
-$(kernel_notice_file): \
-	    $(BUILD_SYSTEM)/LINUX_KERNEL_COPYING \
-	    | $(ACP)
-	@echo Copying: $@
-	$(hide) mkdir -p $(dir $@)
-	$(hide) $(ACP) $< $@
+$(eval $(call copy-one-file,$(BUILD_SYSTEM)/LINUX_KERNEL_COPYING,$(kernel_notice_file)))
 
-$(winpthreads_notice_file): \
-	    $(BUILD_SYSTEM)/WINPTHREADS_COPYING \
-	    | $(ACP)
-	@echo Copying: $@
-	$(hide) mkdir -p $(dir $@)
-	$(hide) $(ACP) $< $@
-
-# -----------------------------------------------------------------
-# Build a keystore with the authorized keys in it, used to verify the
-# authenticity of downloaded OTA packages.
-#
-# This rule adds to ALL_DEFAULT_INSTALLED_MODULES, so it needs to come
-# before the rules that use that variable to build the image.
-ALL_DEFAULT_INSTALLED_MODULES += $(TARGET_OUT_ETC)/security/otacerts.zip
-$(TARGET_OUT_ETC)/security/otacerts.zip: PRIVATE_CERT := $(DEFAULT_KEY_CERT_PAIR).x509.pem
-$(TARGET_OUT_ETC)/security/otacerts.zip: $(SOONG_ZIP)
-$(TARGET_OUT_ETC)/security/otacerts.zip: $(DEFAULT_KEY_CERT_PAIR).x509.pem
-	$(hide) rm -f $@
-	$(hide) mkdir -p $(dir $@)
-	$(hide) $(SOONG_ZIP) -o $@ -C $(dir $(PRIVATE_CERT)) -f $(PRIVATE_CERT)
-
-# Carry the public key for update_engine if it's a non-IoT target that
-# uses the AB updater. We use the same key as otacerts but in RSA public key
-# format.
-ifeq ($(AB_OTA_UPDATER),true)
-ifneq ($(PRODUCT_IOT),true)
-ALL_DEFAULT_INSTALLED_MODULES += $(TARGET_OUT_ETC)/update_engine/update-payload-key.pub.pem
-$(TARGET_OUT_ETC)/update_engine/update-payload-key.pub.pem: $(DEFAULT_KEY_CERT_PAIR).x509.pem
-	$(hide) rm -f $@
-	$(hide) mkdir -p $(dir $@)
-	$(hide) openssl x509 -pubkey -noout -in $< > $@
-
-ALL_DEFAULT_INSTALLED_MODULES += \
-    $(TARGET_RECOVERY_ROOT_OUT)/system/etc/update_engine/update-payload-key.pub.pem
-$(TARGET_RECOVERY_ROOT_OUT)/system/etc/update_engine/update-payload-key.pub.pem: \
-	    $(TARGET_OUT_ETC)/update_engine/update-payload-key.pub.pem
-	$(hide) cp -f $< $@
-endif
-endif
-
-.PHONY: otacerts
-otacerts: $(TARGET_OUT_ETC)/security/otacerts.zip
+$(eval $(call copy-one-file,$(BUILD_SYSTEM)/WINPTHREADS_COPYING,$(winpthreads_notice_file)))
 
 
 # #################################################################
@@ -1309,25 +1624,25 @@
 ifneq (true,$(TARGET_USERIMAGES_SPARSE_EXT_DISABLED))
   INTERNAL_USERIMAGES_SPARSE_EXT_FLAG := -s
 endif
-
-INTERNAL_USERIMAGES_DEPS := $(SIMG2IMG)
-INTERNAL_USERIMAGES_DEPS += $(MKEXTUSERIMG) $(MAKE_EXT4FS) $(E2FSCK) $(TUNE2FS)
-ifeq ($(TARGET_USERIMAGES_USE_F2FS),true)
-INTERNAL_USERIMAGES_DEPS += $(MKF2FSUSERIMG) $(MAKE_F2FS)
-endif
-
-ifeq ($(BOARD_AVB_ENABLE),true)
-INTERNAL_USERIMAGES_DEPS += $(AVBTOOL)
-endif
-
 ifneq (true,$(TARGET_USERIMAGES_SPARSE_SQUASHFS_DISABLED))
   INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG := -s
 endif
-ifneq ($(filter $(BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE) $(BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE) $(BOARD_ODMIMAGE_FILE_SYSTEM_TYPE) $(BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE) $(BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE),squashfs),)
-INTERNAL_USERIMAGES_DEPS += $(MAKE_SQUASHFS) $(MKSQUASHFSUSERIMG) $(IMG2SIMG)
+ifneq (true,$(TARGET_USERIMAGES_SPARSE_F2FS_DISABLED))
+  INTERNAL_USERIMAGES_SPARSE_F2FS_FLAG := -S
 endif
 
-INTERNAL_USERIMAGES_BINARY_PATHS := $(sort $(dir $(INTERNAL_USERIMAGES_DEPS)))
+INTERNAL_USERIMAGES_DEPS := \
+    $(BUILD_IMAGE) \
+    $(MKE2FS_CONF) \
+    $(MKEXTUSERIMG)
+
+ifeq ($(TARGET_USERIMAGES_USE_F2FS),true)
+INTERNAL_USERIMAGES_DEPS += $(MKF2FSUSERIMG)
+endif
+
+ifneq ($(filter $(BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE) $(BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE) $(BOARD_ODMIMAGE_FILE_SYSTEM_TYPE) $(BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE) $(BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE),squashfs),)
+INTERNAL_USERIMAGES_DEPS += $(MKSQUASHFSUSERIMG)
+endif
 
 ifeq (true,$(PRODUCT_SUPPORTS_VERITY))
 INTERNAL_USERIMAGES_DEPS += $(BUILD_VERITY_METADATA) $(BUILD_VERITY_TREE) $(APPEND2SIMG) $(VERITY_SIGNER)
@@ -1336,26 +1651,26 @@
 endif
 endif
 
+ifeq ($(BOARD_AVB_ENABLE),true)
+INTERNAL_USERIMAGES_DEPS += $(AVBTOOL)
+endif
+
+# Get a colon-separated list of search paths.
+INTERNAL_USERIMAGES_BINARY_PATHS := $(subst $(space),:,$(sort $(dir $(INTERNAL_USERIMAGES_DEPS))))
+
 SELINUX_FC := $(call intermediates-dir-for,ETC,file_contexts.bin)/file_contexts.bin
 INTERNAL_USERIMAGES_DEPS += $(SELINUX_FC)
 
-INTERNAL_USERIMAGES_DEPS += $(BLK_ALLOC_TO_BASE_FS)
-
-INTERNAL_USERIMAGES_DEPS += $(MKE2FS_CONF)
-
 ifeq (true,$(PRODUCT_USE_DYNAMIC_PARTITIONS))
 
 ifeq ($(PRODUCT_SUPPORTS_VERITY),true)
   $(error vboot 1.0 doesn't support logical partition)
 endif
 
-# TODO(b/80195851): Should not define BOARD_AVB_SYSTEM_KEY_PATH without
-# BOARD_AVB_SYSTEM_DETACHED_VBMETA.
-
 endif # PRODUCT_USE_DYNAMIC_PARTITIONS
 
 # $(1): the path of the output dictionary file
-# $(2): a subset of "system vendor cache userdata product product_services oem odm"
+# $(2): a subset of "system vendor cache userdata product system_ext oem odm"
 # $(3): additional "key=value" pairs to append to the dictionary file.
 define generate-image-prop-dictionary
 $(if $(filter $(2),system),\
@@ -1372,14 +1687,19 @@
     $(if $(PRODUCT_SYSTEM_BASE_FS_PATH),$(hide) echo "system_base_fs_file=$(PRODUCT_SYSTEM_BASE_FS_PATH)" >> $(1))
     $(if $(PRODUCT_SYSTEM_HEADROOM),$(hide) echo "system_headroom=$(PRODUCT_SYSTEM_HEADROOM)" >> $(1))
     $(if $(BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "system_reserved_size=$(BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
+    $(hide) echo "system_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),userdata),\
     $(if $(BOARD_USERDATAIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "userdata_fs_type=$(BOARD_USERDATAIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
     $(if $(BOARD_USERDATAIMAGE_PARTITION_SIZE),$(hide) echo "userdata_size=$(BOARD_USERDATAIMAGE_PARTITION_SIZE)" >> $(1))
+    $(if $(PRODUCT_FS_CASEFOLD),$(hide) echo "needs_casefold=$(PRODUCT_FS_CASEFOLD)" >> $(1))
+    $(if $(PRODUCT_QUOTA_PROJID),$(hide) echo "needs_projid=$(PRODUCT_QUOTA_PROJID)" >> $(1))
+    $(hide) echo "userdata_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),cache),\
     $(if $(BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "cache_fs_type=$(BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
     $(if $(BOARD_CACHEIMAGE_PARTITION_SIZE),$(hide) echo "cache_size=$(BOARD_CACHEIMAGE_PARTITION_SIZE)" >> $(1))
+    $(hide) echo "cache_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),vendor),\
     $(if $(BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "vendor_fs_type=$(BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
@@ -1393,6 +1713,7 @@
     $(if $(BOARD_VENDORIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "vendor_squashfs_disable_4k_align=$(BOARD_VENDORIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
     $(if $(PRODUCT_VENDOR_BASE_FS_PATH),$(hide) echo "vendor_base_fs_file=$(PRODUCT_VENDOR_BASE_FS_PATH)" >> $(1))
     $(if $(BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "vendor_reserved_size=$(BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
+    $(hide) echo "vendor_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),product),\
     $(if $(BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "product_fs_type=$(BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
@@ -1406,18 +1727,20 @@
     $(if $(BOARD_PRODUCTIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "product_squashfs_disable_4k_align=$(BOARD_PRODUCTIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
     $(if $(PRODUCT_PRODUCT_BASE_FS_PATH),$(hide) echo "product_base_fs_file=$(PRODUCT_PRODUCT_BASE_FS_PATH)" >> $(1))
     $(if $(BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "product_reserved_size=$(BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
+    $(hide) echo "product_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
-$(if $(filter $(2),product_services),\
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "product_services_fs_type=$(BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_EXTFS_INODE_COUNT),$(hide) echo "product_services_extfs_inode_count=$(BOARD_PRODUCT_SERVICESIMAGE_EXTFS_INODE_COUNT)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_EXTFS_RSV_PCT),$(hide) echo "product_services_extfs_rsv_pct=$(BOARD_PRODUCT_SERVICESIMAGE_EXTFS_RSV_PCT)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE),$(hide) echo "product_services_size=$(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_JOURNAL_SIZE),$(hide) echo "product_services_journal_size=$(BOARD_PRODUCT_SERVICESIMAGE_JOURNAL_SIZE)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_COMPRESSOR),$(hide) echo "product_services_squashfs_compressor=$(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_COMPRESSOR)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_COMPRESSOR_OPT),$(hide) echo "product_services_squashfs_compressor_opt=$(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_COMPRESSOR_OPT)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_BLOCK_SIZE),$(hide) echo "product_services_squashfs_block_size=$(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_BLOCK_SIZE)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "product_services_squashfs_disable_4k_align=$(BOARD_PRODUCT_SERVICESIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
-    $(if $(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "product_services_reserved_size=$(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
+$(if $(filter $(2),system_ext),\
+    $(if $(BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "system_ext_fs_type=$(BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_EXTFS_INODE_COUNT),$(hide) echo "system_ext_extfs_inode_count=$(BOARD_SYSTEM_EXTIMAGE_EXTFS_INODE_COUNT)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_EXTFS_RSV_PCT),$(hide) echo "system_ext_extfs_rsv_pct=$(BOARD_SYSTEM_EXTIMAGE_EXTFS_RSV_PCT)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_PARTITION_SIZE),$(hide) echo "system_ext_size=$(BOARD_SYSTEM_EXTIMAGE_PARTITION_SIZE)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_JOURNAL_SIZE),$(hide) echo "system_ext_journal_size=$(BOARD_SYSTEM_EXTIMAGE_JOURNAL_SIZE)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_COMPRESSOR),$(hide) echo "system_ext_squashfs_compressor=$(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_COMPRESSOR)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_COMPRESSOR_OPT),$(hide) echo "system_ext_squashfs_compressor_opt=$(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_COMPRESSOR_OPT)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_BLOCK_SIZE),$(hide) echo "system_ext_squashfs_block_size=$(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_BLOCK_SIZE)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "system_ext_squashfs_disable_4k_align=$(BOARD_SYSTEM_EXTIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
+    $(if $(BOARD_SYSTEM_EXTIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "system_ext_reserved_size=$(BOARD_SYSTEM_EXTIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
+    $(hide) echo "system_ext_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),odm),\
     $(if $(BOARD_ODMIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "odm_fs_type=$(BOARD_ODMIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
@@ -1431,22 +1754,24 @@
     $(if $(BOARD_ODMIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "odm_squashfs_disable_4k_align=$(BOARD_ODMIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
     $(if $(PRODUCT_ODM_BASE_FS_PATH),$(hide) echo "odm_base_fs_file=$(PRODUCT_ODM_BASE_FS_PATH)" >> $(1))
     $(if $(BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "odm_reserved_size=$(BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
+    $(hide) echo "odm_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),oem),\
     $(if $(BOARD_OEMIMAGE_PARTITION_SIZE),$(hide) echo "oem_size=$(BOARD_OEMIMAGE_PARTITION_SIZE)" >> $(1))
     $(if $(BOARD_OEMIMAGE_JOURNAL_SIZE),$(hide) echo "oem_journal_size=$(BOARD_OEMIMAGE_JOURNAL_SIZE)" >> $(1))
     $(if $(BOARD_OEMIMAGE_EXTFS_INODE_COUNT),$(hide) echo "oem_extfs_inode_count=$(BOARD_OEMIMAGE_EXTFS_INODE_COUNT)" >> $(1))
     $(if $(BOARD_OEMIMAGE_EXTFS_RSV_PCT),$(hide) echo "oem_extfs_rsv_pct=$(BOARD_OEMIMAGE_EXTFS_RSV_PCT)" >> $(1))
+    $(hide) echo "oem_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(hide) echo "ext_mkuserimg=$(notdir $(MKEXTUSERIMG))" >> $(1)
 
 $(if $(INTERNAL_USERIMAGES_EXT_VARIANT),$(hide) echo "fs_type=$(INTERNAL_USERIMAGES_EXT_VARIANT)" >> $(1))
 $(if $(INTERNAL_USERIMAGES_SPARSE_EXT_FLAG),$(hide) echo "extfs_sparse_flag=$(INTERNAL_USERIMAGES_SPARSE_EXT_FLAG)" >> $(1))
 $(if $(INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG),$(hide) echo "squashfs_sparse_flag=$(INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG)" >> $(1))
+$(if $(INTERNAL_USERIMAGES_SPARSE_F2FS_FLAG),$(hide) echo "f2fs_sparse_flag=$(INTERNAL_USERIMAGES_SPARSE_F2FS_FLAG)" >> $(1))
 $(if $(BOARD_EXT4_SHARE_DUP_BLOCKS),$(hide) echo "ext4_share_dup_blocks=$(BOARD_EXT4_SHARE_DUP_BLOCKS)" >> $(1))
 $(if $(BOARD_FLASH_LOGICAL_BLOCK_SIZE), $(hide) echo "flash_logical_block_size=$(BOARD_FLASH_LOGICAL_BLOCK_SIZE)" >> $(1))
 $(if $(BOARD_FLASH_ERASE_BLOCK_SIZE), $(hide) echo "flash_erase_block_size=$(BOARD_FLASH_ERASE_BLOCK_SIZE)" >> $(1))
-$(hide) echo "selinux_fc=$(SELINUX_FC)" >> $(1)
 $(if $(PRODUCT_SUPPORTS_BOOT_SIGNER),$(hide) echo "boot_signer=$(PRODUCT_SUPPORTS_BOOT_SIGNER)" >> $(1))
 $(if $(PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity=$(PRODUCT_SUPPORTS_VERITY)" >> $(1))
 $(if $(PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity_key=$(PRODUCT_VERITY_SIGNING_KEY)" >> $(1))
@@ -1456,7 +1781,7 @@
 $(if $(PRODUCT_SYSTEM_VERITY_PARTITION),$(hide) echo "system_verity_block_device=$(PRODUCT_SYSTEM_VERITY_PARTITION)" >> $(1))
 $(if $(PRODUCT_VENDOR_VERITY_PARTITION),$(hide) echo "vendor_verity_block_device=$(PRODUCT_VENDOR_VERITY_PARTITION)" >> $(1))
 $(if $(PRODUCT_PRODUCT_VERITY_PARTITION),$(hide) echo "product_verity_block_device=$(PRODUCT_PRODUCT_VERITY_PARTITION)" >> $(1))
-$(if $(PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION),$(hide) echo "product_services_verity_block_device=$(PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION)" >> $(1))
+$(if $(PRODUCT_SYSTEM_EXT_VERITY_PARTITION),$(hide) echo "system_ext_verity_block_device=$(PRODUCT_SYSTEM_EXT_VERITY_PARTITION)" >> $(1))
 $(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot=$(PRODUCT_SUPPORTS_VBOOT)" >> $(1))
 $(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_key=$(PRODUCT_VBOOT_SIGNING_KEY)" >> $(1))
 $(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_subkey=$(PRODUCT_VBOOT_SIGNING_SUBKEY)" >> $(1))
@@ -1490,14 +1815,14 @@
         $(hide) echo "avb_product_key_path=$(BOARD_AVB_PRODUCT_KEY_PATH)" >> $(1)
         $(hide) echo "avb_product_algorithm=$(BOARD_AVB_PRODUCT_ALGORITHM)" >> $(1)
         $(hide) echo "avb_product_rollback_index_location=$(BOARD_AVB_PRODUCT_ROLLBACK_INDEX_LOCATION)" >> $(1)))
-$(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_product_services_hashtree_enable=$(BOARD_AVB_ENABLE)" >> $(1))
+$(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_system_ext_hashtree_enable=$(BOARD_AVB_ENABLE)" >> $(1))
 $(if $(BOARD_AVB_ENABLE),\
-    $(hide) echo "avb_product_services_add_hashtree_footer_args=$(BOARD_AVB_PRODUCT_SERVICES_ADD_HASHTREE_FOOTER_ARGS)" >> $(1))
+    $(hide) echo "avb_system_ext_add_hashtree_footer_args=$(BOARD_AVB_SYSTEM_EXT_ADD_HASHTREE_FOOTER_ARGS)" >> $(1))
 $(if $(BOARD_AVB_ENABLE),\
-    $(if $(BOARD_AVB_PRODUCT_SERVICES_KEY_PATH),\
-        $(hide) echo "avb_product_services_key_path=$(BOARD_AVB_PRODUCT_SERVICES_KEY_PATH)" >> $(1)
-        $(hide) echo "avb_product_services_algorithm=$(BOARD_AVB_PRODUCT_SERVICES_ALGORITHM)" >> $(1)
-        $(hide) echo "avb_product_services_rollback_index_location=$(BOARD_AVB_PRODUCT_SERVICES_ROLLBACK_INDEX_LOCATION)" >> $(1)))
+    $(if $(BOARD_AVB_SYSTEM_EXT_KEY_PATH),\
+        $(hide) echo "avb_system_ext_key_path=$(BOARD_AVB_SYSTEM_EXT_KEY_PATH)" >> $(1)
+        $(hide) echo "avb_system_ext_algorithm=$(BOARD_AVB_SYSTEM_EXT_ALGORITHM)" >> $(1)
+        $(hide) echo "avb_system_ext_rollback_index_location=$(BOARD_AVB_SYSTEM_EXT_ROLLBACK_INDEX_LOCATION)" >> $(1)))
 $(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_odm_hashtree_enable=$(BOARD_AVB_ENABLE)" >> $(1))
 $(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_odm_add_hashtree_footer_args=$(BOARD_AVB_ODM_ADD_HASHTREE_FOOTER_ARGS)" >> $(1))
 $(if $(BOARD_AVB_ENABLE),\
@@ -1510,14 +1835,37 @@
 $(if $(filter true,$(BOARD_BUILD_SYSTEM_ROOT_IMAGE)),\
     $(hide) echo "system_root_image=true" >> $(1))
 $(hide) echo "root_dir=$(TARGET_ROOT_OUT)" >> $(1)
-$(if $(PRODUCT_USE_DYNAMIC_PARTITION_SIZE),$(hide) echo "use_dynamic_partition_size=true" >> $(1))
+$(if $(filter true,$(PRODUCT_USE_DYNAMIC_PARTITION_SIZE)),\
+    $(hide) echo "use_dynamic_partition_size=true" >> $(1))
 $(if $(3),$(hide) $(foreach kv,$(3),echo "$(kv)" >> $(1);))
 endef
 
 # $(1): the path of the output dictionary file
 # $(2): additional "key=value" pairs to append to the dictionary file.
+PROP_DICTIONARY_IMAGES := oem
+ifdef BUILDING_CACHE_IMAGE
+  PROP_DICTIONARY_IMAGES += cache
+endif
+ifdef BUILDING_SYSTEM_IMAGE
+  PROP_DICTIONARY_IMAGES += system
+endif
+ifdef BUILDING_USERDATA_IMAGE
+  PROP_DICTIONARY_IMAGES += userdata
+endif
+ifdef BUILDING_VENDOR_IMAGE
+  PROP_DICTIONARY_IMAGES += vendor
+endif
+ifdef BUILDING_PRODUCT_IMAGE
+  PROP_DICTIONARY_IMAGES += product
+endif
+ifdef BUILDING_SYSTEM_EXT_IMAGE
+  PROP_DICTIONARY_IMAGES += system_ext
+endif
+ifdef BUILDING_ODM_IMAGE
+  PROP_DICTIONARY_IMAGES += odm
+endif
 define generate-userimage-prop-dictionary
-$(call generate-image-prop-dictionary,$(1),system vendor cache userdata product product_services oem odm,$(2))
+  $(call generate-image-prop-dictionary,$(1),$(PROP_DICTIONARY_IMAGES),$(2))
 endef
 
 # $(1): the path of the input dictionary file, where each line has the format key=value
@@ -1526,28 +1874,11 @@
 $$(grep '$(2)=' $(1) | cut -f2- -d'=')
 endef
 
-# $(1): modules list
-# $(2): output dir
-# $(3): mount point
-# $(4): staging dir
-# Depmod requires a well-formed kernel version so 0.0 is used as a placeholder.
-define build-image-kernel-modules
-    $(hide) rm -rf $(2)/lib/modules
-    $(hide) mkdir -p $(2)/lib/modules
-    $(hide) cp $(1) $(2)/lib/modules/
-    $(hide) rm -rf $(4)
-    $(hide) mkdir -p $(4)/lib/modules/0.0/$(3)lib/modules
-    $(hide) cp $(1) $(4)/lib/modules/0.0/$(3)lib/modules
-    $(hide) $(DEPMOD) -b $(4) 0.0
-    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' $(4)/lib/modules/0.0/modules.dep > $(2)/lib/modules/modules.dep
-    $(hide) cp $(4)/lib/modules/0.0/modules.alias $(2)/lib/modules
-endef
-
 # -----------------------------------------------------------------
 # Recovery image
 
 # Recovery image exists if we are building recovery, or building recovery as boot.
-ifneq (,$(INSTALLED_RECOVERYIMAGE_TARGET)$(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)))
+ifdef BUILDING_RECOVERY_IMAGE
 
 INTERNAL_RECOVERYIMAGE_FILES := $(filter $(TARGET_RECOVERY_OUT)/%, \
     $(ALL_DEFAULT_INSTALLED_MODULES))
@@ -1560,25 +1891,27 @@
 # build-recoveryimage-target, which would touch the files under TARGET_RECOVERY_OUT and race with
 # the call to FILELIST.
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+INSTALLED_BOOTIMAGE_TARGET := $(BUILT_BOOTIMAGE_TARGET)
 $(INSTALLED_FILES_FILE_RECOVERY): $(INSTALLED_BOOTIMAGE_TARGET)
 else
 $(INSTALLED_FILES_FILE_RECOVERY): $(INSTALLED_RECOVERYIMAGE_TARGET)
 endif
 
 $(INSTALLED_FILES_FILE_RECOVERY): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_RECOVERY)
-$(INSTALLED_FILES_FILE_RECOVERY): $(INTERNAL_RECOVERYIMAGE_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_RECOVERY): $(INTERNAL_RECOVERYIMAGE_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_RECOVERY_ROOT_OUT) > $(@:.txt=.json)
-	$(hide) build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
-recovery_initrc := $(call include-path-for, recovery)/etc/init.rc
 recovery_sepolicy := \
     $(TARGET_RECOVERY_ROOT_OUT)/sepolicy \
     $(TARGET_RECOVERY_ROOT_OUT)/plat_file_contexts \
-    $(TARGET_RECOVERY_ROOT_OUT)/vendor_file_contexts \
     $(TARGET_RECOVERY_ROOT_OUT)/plat_property_contexts \
+    $(TARGET_RECOVERY_ROOT_OUT)/system_ext_file_contexts \
+    $(TARGET_RECOVERY_ROOT_OUT)/system_ext_property_contexts \
+    $(TARGET_RECOVERY_ROOT_OUT)/vendor_file_contexts \
     $(TARGET_RECOVERY_ROOT_OUT)/vendor_property_contexts \
     $(TARGET_RECOVERY_ROOT_OUT)/odm_file_contexts \
     $(TARGET_RECOVERY_ROOT_OUT)/odm_property_contexts \
@@ -1762,7 +2095,8 @@
 ifeq (,$(filter true, $(BOARD_USES_FULL_RECOVERY_IMAGE) $(BOARD_USES_RECOVERY_AS_BOOT) \
   $(BOARD_BUILD_SYSTEM_ROOT_IMAGE) $(BOARD_INCLUDE_RECOVERY_DTBO) $(BOARD_INCLUDE_RECOVERY_ACPIO)))
 # Named '.dat' so we don't attempt to use imgdiff for patching it.
-RECOVERY_RESOURCE_ZIP := $(TARGET_OUT)/etc/recovery-resource.dat
+RECOVERY_RESOURCE_ZIP := $(TARGET_OUT_VENDOR)/etc/recovery-resource.dat
+ALL_DEFAULT_INSTALLED_MODULES += $(RECOVERY_RESOURCE_ZIP)
 else
 RECOVERY_RESOURCE_ZIP :=
 endif
@@ -1803,7 +2137,7 @@
 	    $(INSTALLED_VENDOR_BUILD_PROP_TARGET) \
 	    $(INSTALLED_ODM_BUILD_PROP_TARGET) \
 	    $(INSTALLED_PRODUCT_BUILD_PROP_TARGET) \
-	    $(INSTALLED_PRODUCT_SERVICES_BUILD_PROP_TARGET)
+	    $(INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET)
 	@echo "Target recovery buildinfo: $@"
 	$(hide) mkdir -p $(dir $@)
 	$(hide) rm -f $@
@@ -1813,14 +2147,18 @@
 	$(hide) cat $(INSTALLED_VENDOR_BUILD_PROP_TARGET) >> $@
 	$(hide) cat $(INSTALLED_ODM_BUILD_PROP_TARGET) >> $@
 	$(hide) cat $(INSTALLED_PRODUCT_BUILD_PROP_TARGET) >> $@
-	$(hide) cat $(INSTALLED_PRODUCT_SERVICES_BUILD_PROP_TARGET) >> $@
+	$(hide) cat $(INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET) >> $@
 	$(call append-recovery-ui-properties,$(PRIVATE_RECOVERY_UI_PROPERTIES),$@)
 
-INTERNAL_RECOVERYIMAGE_ARGS := \
-	$(addprefix --second ,$(INSTALLED_2NDBOOTLOADER_TARGET)) \
-	--kernel $(recovery_kernel) \
-	--ramdisk $(recovery_ramdisk)
-
+ifeq (truetrue,$(strip $(BUILDING_VENDOR_BOOT_IMAGE))$(strip $(AB_OTA_UPDATER)))
+  INTERNAL_RECOVERYIMAGE_ARGS := --ramdisk $(recovery_ramdisk)
+ifdef GENERIC_KERNEL_CMDLINE
+  INTERNAL_RECOVERYIMAGE_ARGS += --cmdline "$(GENERIC_KERNEL_CMDLINE)"
+endif
+else # not (BUILDING_VENDOR_BOOT_IMAGE and AB_OTA_UPDATER)
+  INTERNAL_RECOVERYIMAGE_ARGS := \
+      $(addprefix --second ,$(INSTALLED_2NDBOOTLOADER_TARGET)) \
+      --ramdisk $(recovery_ramdisk)
 # Assumes this has already been stripped
 ifdef INTERNAL_KERNEL_CMDLINE
   INTERNAL_RECOVERYIMAGE_ARGS += --cmdline "$(INTERNAL_KERNEL_CMDLINE)"
@@ -1837,69 +2175,65 @@
 else
   INTERNAL_RECOVERYIMAGE_ARGS += --recovery_dtbo $(BOARD_PREBUILT_DTBOIMAGE)
 endif
-endif
+endif # BOARD_INCLUDE_RECOVERY_DTBO
 ifdef BOARD_INCLUDE_RECOVERY_ACPIO
   INTERNAL_RECOVERYIMAGE_ARGS += --recovery_acpio $(BOARD_RECOVERY_ACPIO)
 endif
 ifdef BOARD_INCLUDE_DTB_IN_BOOTIMG
   INTERNAL_RECOVERYIMAGE_ARGS += --dtb $(INSTALLED_DTBIMAGE_TARGET)
 endif
+endif # INSTALLED_VENDOR_BOOTIMAGE_TARGET not defined
+ifndef BOARD_RECOVERY_MKBOOTIMG_ARGS
+  BOARD_RECOVERY_MKBOOTIMG_ARGS := $(BOARD_MKBOOTIMG_ARGS)
+endif
 
-# Keys authorized to sign OTA packages this build will accept.  The
-# build always uses dev-keys for this; release packaging tools will
-# substitute other keys for this one.
-OTA_PUBLIC_KEYS := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
-
-# Generate a file containing the keys that will be read by the
-# recovery binary.
-RECOVERY_INSTALL_OTA_KEYS := \
-	$(call intermediates-dir-for,PACKAGING,ota_keys)/otacerts.zip
-$(RECOVERY_INSTALL_OTA_KEYS): PRIVATE_OTA_PUBLIC_KEYS := $(OTA_PUBLIC_KEYS)
-$(RECOVERY_INSTALL_OTA_KEYS): extra_keys := $(patsubst %,%.x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))
-$(RECOVERY_INSTALL_OTA_KEYS): $(SOONG_ZIP) $(OTA_PUBLIC_KEYS) $(extra_keys)
-	$(hide) rm -f $@
-	$(hide) mkdir -p $(dir $@)
-	$(hide) $(SOONG_ZIP) -o $@ $(foreach key_file, $(PRIVATE_OTA_PUBLIC_KEYS) $(extra_keys), -C $(dir $(key_file)) -f $(key_file))
-
-RECOVERYIMAGE_ID_FILE := $(PRODUCT_OUT)/recovery.id
+$(recovery_ramdisk): $(MKBOOTFS) $(COMPRESSION_COMMAND_DEPS) \
+	    $(INTERNAL_ROOT_FILES) \
+	    $(INSTALLED_RAMDISK_TARGET) \
+	    $(INTERNAL_RECOVERYIMAGE_FILES) \
+	    $(recovery_sepolicy) \
+	    $(INSTALLED_2NDBOOTLOADER_TARGET) \
+	    $(INSTALLED_RECOVERY_BUILD_PROP_TARGET) \
+	    $(recovery_resource_deps) \
+	    $(recovery_fstab)
+	# Making recovery image
+	mkdir -p $(TARGET_RECOVERY_OUT)
+	mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/sdcard $(TARGET_RECOVERY_ROOT_OUT)/tmp
+	# Copying baseline ramdisk...
+	# Use rsync because "cp -Rf" fails to overwrite broken symlinks on Mac.
+	rsync -a --exclude=sdcard $(IGNORE_RECOVERY_SEPOLICY) $(IGNORE_CACHE_LINK) $(TARGET_ROOT_OUT) $(TARGET_RECOVERY_OUT)
+	# Modifying ramdisk contents...
+	$(if $(filter true,$(BOARD_BUILD_SYSTEM_ROOT_IMAGE)),, \
+	  ln -sf /system/bin/init $(TARGET_RECOVERY_ROOT_OUT)/init)
+	# Removes $(TARGET_RECOVERY_ROOT_OUT)/init*.rc EXCEPT init.recovery*.rc.
+	find $(TARGET_RECOVERY_ROOT_OUT) -maxdepth 1 -name 'init*.rc' -type f -not -name "init.recovery.*.rc" | xargs rm -f
+	cp $(TARGET_ROOT_OUT)/init.recovery.*.rc $(TARGET_RECOVERY_ROOT_OUT)/ 2> /dev/null || true # Ignore error when the src file doesn't exist.
+	mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/res
+	rm -rf $(TARGET_RECOVERY_ROOT_OUT)/res/*
+	cp -rf $(recovery_resources_common)/* $(TARGET_RECOVERY_ROOT_OUT)/res
+	$(foreach recovery_text_file,$(generated_recovery_text_files), \
+	  cp -rf $(recovery_text_file) $(TARGET_RECOVERY_ROOT_OUT)/res/images/ &&) true
+	cp -f $(recovery_font) $(TARGET_RECOVERY_ROOT_OUT)/res/images/font.png
+	$(foreach item,$(TARGET_PRIVATE_RES_DIRS), \
+	  cp -rf $(item) $(TARGET_RECOVERY_ROOT_OUT)/$(newline))
+	$(foreach item,$(recovery_fstab), \
+	  cp -f $(item) $(TARGET_RECOVERY_ROOT_OUT)/system/etc/recovery.fstab)
+	$(if $(strip $(recovery_wipe)), \
+	  cp -f $(recovery_wipe) $(TARGET_RECOVERY_ROOT_OUT)/system/etc/recovery.wipe)
+	ln -sf prop.default $(TARGET_RECOVERY_ROOT_OUT)/default.prop
+	$(BOARD_RECOVERY_IMAGE_PREPARE)
+	$(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RECOVERY_ROOT_OUT) | $(COMPRESSION_COMMAND) > $(recovery_ramdisk)
 
 # $(1): output file
+# $(2): kernel file
 define build-recoveryimage-target
-  # Making recovery image
-  $(hide) mkdir -p $(TARGET_RECOVERY_OUT)
-  $(hide) mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/sdcard $(TARGET_RECOVERY_ROOT_OUT)/tmp
-  # Copying baseline ramdisk...
-  # Use rsync because "cp -Rf" fails to overwrite broken symlinks on Mac.
-  $(hide) rsync -a --exclude=sdcard $(IGNORE_RECOVERY_SEPOLICY) $(IGNORE_CACHE_LINK) $(TARGET_ROOT_OUT) $(TARGET_RECOVERY_OUT)
-  # Modifying ramdisk contents...
-  $(if $(filter true,$(BOARD_BUILD_SYSTEM_ROOT_IMAGE)),, \
-    $(hide) ln -sf /system/bin/init $(TARGET_RECOVERY_ROOT_OUT)/init)
-  $(if $(BOARD_RECOVERY_KERNEL_MODULES), \
-    $(call build-image-kernel-modules,$(BOARD_RECOVERY_KERNEL_MODULES),$(TARGET_RECOVERY_ROOT_OUT),,$(call intermediates-dir-for,PACKAGING,depmod_recovery)))
-  # Removes $(TARGET_RECOVERY_ROOT_OUT)/init*.rc EXCEPT init.recovery*.rc.
-  $(hide) find $(TARGET_RECOVERY_ROOT_OUT) -maxdepth 1 -name 'init*.rc' -type f -not -name "init.recovery.*.rc" | xargs rm -f
-  $(hide) cp -f $(recovery_initrc) $(TARGET_RECOVERY_ROOT_OUT)/
-  $(hide) cp $(TARGET_ROOT_OUT)/init.recovery.*.rc $(TARGET_RECOVERY_ROOT_OUT)/ 2> /dev/null || true # Ignore error when the src file doesn't exist.
-  $(hide) mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/res
-  $(hide) rm -rf $(TARGET_RECOVERY_ROOT_OUT)/res/*
-  $(hide) cp -rf $(recovery_resources_common)/* $(TARGET_RECOVERY_ROOT_OUT)/res
-  $(hide) $(foreach recovery_text_file,$(generated_recovery_text_files), \
-    cp -rf $(recovery_text_file) $(TARGET_RECOVERY_ROOT_OUT)/res/images/ &&) true
-  $(hide) cp -f $(recovery_font) $(TARGET_RECOVERY_ROOT_OUT)/res/images/font.png
-  $(hide) $(foreach item,$(TARGET_PRIVATE_RES_DIRS), \
-    cp -rf $(item) $(TARGET_RECOVERY_ROOT_OUT)/$(newline))
-  $(hide) $(foreach item,$(recovery_fstab), \
-    cp -f $(item) $(TARGET_RECOVERY_ROOT_OUT)/system/etc/recovery.fstab)
-  $(if $(strip $(recovery_wipe)), \
-    $(hide) cp -f $(recovery_wipe) $(TARGET_RECOVERY_ROOT_OUT)/system/etc/recovery.wipe)
-  $(hide) mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/system/etc/security
-  $(hide) cp $(RECOVERY_INSTALL_OTA_KEYS) $(TARGET_RECOVERY_ROOT_OUT)/system/etc/security/otacerts.zip
-  $(hide) ln -sf prop.default $(TARGET_RECOVERY_ROOT_OUT)/default.prop
-  $(BOARD_RECOVERY_IMAGE_PREPARE)
-  $(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RECOVERY_ROOT_OUT) | $(MINIGZIP) > $(recovery_ramdisk)
   $(if $(filter true,$(PRODUCT_SUPPORTS_VBOOT)), \
-    $(hide) $(MKBOOTIMG) $(INTERNAL_RECOVERYIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(1).unsigned, \
-    $(hide) $(MKBOOTIMG) $(INTERNAL_RECOVERYIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(1) --id > $(RECOVERYIMAGE_ID_FILE))
+    $(MKBOOTIMG) --kernel $(2) $(INTERNAL_RECOVERYIMAGE_ARGS) \
+                 $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_RECOVERY_MKBOOTIMG_ARGS) \
+                 --output $(1).unsigned, \
+    $(MKBOOTIMG) --kernel $(2) $(INTERNAL_RECOVERYIMAGE_ARGS) \
+                 $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_RECOVERY_MKBOOTIMG_ARGS) \
+                 --output $(1))
   $(if $(filter true,$(PRODUCT_SUPPORTS_BOOT_SIGNER)),\
     $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)),\
       $(BOOT_SIGNER) /boot $(1) $(PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCT_VERITY_SIGNING_KEY).x509.pem $(1),\
@@ -1909,82 +2243,46 @@
   $(if $(filter true,$(PRODUCT_SUPPORTS_VBOOT)), \
     $(VBOOT_SIGNER) $(FUTILITY) $(1).unsigned $(PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $(1).keyblock $(1))
   $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)), \
-    $(hide) $(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(BOARD_BOOTIMAGE_PARTITION_SIZE))), \
-    $(hide) $(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(BOARD_RECOVERYIMAGE_PARTITION_SIZE))))
+    $(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(call get-bootimage-partition-size,$(1),boot))), \
+    $(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(BOARD_RECOVERYIMAGE_PARTITION_SIZE))))
   $(if $(filter true,$(BOARD_AVB_ENABLE)), \
     $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)), \
-      $(hide) $(AVBTOOL) add_hash_footer --image $(1) --partition_size $(BOARD_BOOTIMAGE_PARTITION_SIZE) --partition_name boot $(INTERNAL_AVB_BOOT_SIGNING_ARGS) $(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS),\
-      $(hide) $(AVBTOOL) add_hash_footer --image $(1) --partition_size $(BOARD_RECOVERYIMAGE_PARTITION_SIZE) --partition_name recovery $(INTERNAL_AVB_RECOVERY_SIGNING_ARGS) $(BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS)))
+      $(AVBTOOL) add_hash_footer --image $(1) --partition_size $(call get-bootimage-partition-size,$(1),boot) --partition_name boot $(INTERNAL_AVB_BOOT_SIGNING_ARGS) $(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS),\
+      $(AVBTOOL) add_hash_footer --image $(1) --partition_size $(BOARD_RECOVERYIMAGE_PARTITION_SIZE) --partition_name recovery $(INTERNAL_AVB_RECOVERY_SIGNING_ARGS) $(BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS)))
 endef
 
-ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+recoveryimage-deps := $(MKBOOTIMG) $(recovery_ramdisk) $(recovery_kernel)
 ifeq (true,$(PRODUCT_SUPPORTS_BOOT_SIGNER))
-$(INSTALLED_BOOTIMAGE_TARGET) : $(BOOT_SIGNER)
+  recoveryimage-deps += $(BOOT_SIGNER)
 endif
 ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
-$(INSTALLED_BOOTIMAGE_TARGET) : $(VBOOT_SIGNER)
+  recoveryimage-deps += $(VBOOT_SIGNER)
 endif
 ifeq (true,$(BOARD_AVB_ENABLE))
-$(INSTALLED_BOOTIMAGE_TARGET) : $(AVBTOOL) $(BOARD_AVB_BOOT_KEY_PATH)
+  recoveryimage-deps += $(AVBTOOL) $(BOARD_AVB_BOOT_KEY_PATH)
 endif
 ifdef BOARD_INCLUDE_RECOVERY_DTBO
-ifdef BOARD_PREBUILT_RECOVERY_DTBOIMAGE
-$(INSTALLED_BOOTIMAGE_TARGET): $(BOARD_PREBUILT_RECOVERY_DTBOIMAGE)
-else
-$(INSTALLED_BOOTIMAGE_TARGET): $(BOARD_PREBUILT_DTBOIMAGE)
-endif
+  ifdef BOARD_PREBUILT_RECOVERY_DTBOIMAGE
+    recoveryimage-deps += $(BOARD_PREBUILT_RECOVERY_DTBOIMAGE)
+  else
+    recoveryimage-deps += $(BOARD_PREBUILT_DTBOIMAGE)
+  endif
 endif
 ifdef BOARD_INCLUDE_RECOVERY_ACPIO
-$(INSTALLED_BOOTIMAGE_TARGET): $(BOARD_RECOVERY_ACPIO)
+  recoveryimage-deps += $(BOARD_RECOVERY_ACPIO)
 endif
 ifdef BOARD_INCLUDE_DTB_IN_BOOTIMG
-$(INSTALLED_BOOTIMAGE_TARGET): $(INSTALLED_DTBIMAGE_TARGET)
+  recoveryimage-deps += $(INSTALLED_DTBIMAGE_TARGET)
 endif
 
-$(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
-	    $(INTERNAL_ROOT_FILES) \
-	    $(INSTALLED_RAMDISK_TARGET) \
-	    $(INTERNAL_RECOVERYIMAGE_FILES) \
-	    $(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
-	    $(INSTALLED_2NDBOOTLOADER_TARGET) \
-	    $(INSTALLED_RECOVERY_BUILD_PROP_TARGET) \
-	    $(recovery_resource_deps) \
-	    $(recovery_fstab) \
-	    $(RECOVERY_INSTALL_OTA_KEYS) \
-	    $(BOARD_RECOVERY_KERNEL_MODULES) \
-	    $(DEPMOD)
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+$(INSTALLED_BOOTIMAGE_TARGET): $(recoveryimage-deps)
 	$(call pretty,"Target boot image from recovery: $@")
-	$(call build-recoveryimage-target, $@)
+	$(call build-recoveryimage-target, $@, $(PRODUCT_OUT)/$(subst .img,,$(subst boot,kernel,$(notdir $@))))
 endif # BOARD_USES_RECOVERY_AS_BOOT
 
-ifdef BOARD_INCLUDE_RECOVERY_DTBO
-ifdef BOARD_PREBUILT_RECOVERY_DTBOIMAGE
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(BOARD_PREBUILT_RECOVERY_DTBOIMAGE)
-else
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(BOARD_PREBUILT_DTBOIMAGE)
-endif
-endif
-ifdef BOARD_INCLUDE_RECOVERY_ACPIO
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(BOARD_RECOVERY_ACPIO)
-endif
-ifdef BOARD_INCLUDE_DTB_IN_BOOTIMG
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(INSTALLED_DTBIMAGE_TARGET)
-endif
-
-$(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
-	    $(INTERNAL_ROOT_FILES) \
-	    $(INSTALLED_RAMDISK_TARGET) \
-	    $(INSTALLED_BOOTIMAGE_TARGET) \
-	    $(INTERNAL_RECOVERYIMAGE_FILES) \
-	    $(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
-	    $(INSTALLED_2NDBOOTLOADER_TARGET) \
-	    $(INSTALLED_RECOVERY_BUILD_PROP_TARGET) \
-	    $(recovery_resource_deps) \
-	    $(recovery_fstab) \
-	    $(RECOVERY_INSTALL_OTA_KEYS) \
-	    $(BOARD_RECOVERY_KERNEL_MODULES) \
-	    $(DEPMOD)
-	$(call build-recoveryimage-target, $@)
+$(INSTALLED_RECOVERYIMAGE_TARGET): $(recoveryimage-deps)
+	$(call build-recoveryimage-target, $@, $(recovery_kernel))
 
 ifdef RECOVERY_RESOURCE_ZIP
 $(RECOVERY_RESOURCE_ZIP): $(INSTALLED_RECOVERYIMAGE_TARGET) | $(ZIPTIME)
@@ -1998,9 +2296,9 @@
 	@echo "make $@: ignoring dependencies"
 	$(call build-recoveryimage-target, $(INSTALLED_RECOVERYIMAGE_TARGET))
 
-else # INSTALLED_RECOVERYIMAGE_TARGET not defined
+else # BUILDING_RECOVERY_IMAGE
 RECOVERY_RESOURCE_ZIP :=
-endif
+endif # BUILDING_RECOVERY_IMAGE
 
 .PHONY: recoveryimage
 recoveryimage: $(INSTALLED_RECOVERYIMAGE_TARGET) $(RECOVERY_RESOURCE_ZIP)
@@ -2013,6 +2311,7 @@
 $(error MTD device is no longer supported and thus BOARD_NAND_SPARE_SIZE is deprecated.)
 endif
 
+ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
 # -----------------------------------------------------------------
 # the debug ramdisk, which is the original ramdisk plus additional
 # files: force_debuggable, adb_debug.prop and userdebug sepolicy.
@@ -2041,12 +2340,12 @@
 # Because ramdisk-debug.img will rsync from either ramdisk.img or ramdisk-recovery.img.
 # Need to depend on the built ramdisk-debug.img, to get a complete list of the installed files.
 $(INSTALLED_FILES_FILE_DEBUG_RAMDISK) : $(INSTALLED_DEBUG_RAMDISK_TARGET)
-$(INSTALLED_FILES_FILE_DEBUG_RAMDISK) : $(INTERNAL_DEBUG_RAMDISK_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_DEBUG_RAMDISK) : $(INTERNAL_DEBUG_RAMDISK_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	echo Installed file list: $@
 	mkdir -p $(dir $@)
 	rm -f $@
 	$(FILESLIST) $(DEBUG_RAMDISK_ROOT_DIR) > $(@:.txt=.json)
-	build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 # ramdisk-debug.img will rsync the content from either ramdisk.img or ramdisk-recovery.img,
 # depending on whether BOARD_USES_RECOVERY_AS_BOOT is set or not.
@@ -2066,22 +2365,22 @@
 # Depends on ramdisk.img, note that some target has ramdisk.img but no boot.img, e.g., emulator.
 $(INSTALLED_DEBUG_RAMDISK_TARGET): $(INSTALLED_RAMDISK_TARGET)
 endif # BOARD_USES_RECOVERY_AS_BOOT
-$(INSTALLED_DEBUG_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_DEBUG_RAMDISK_FILES) | $(MINIGZIP)
+$(INSTALLED_DEBUG_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_DEBUG_RAMDISK_FILES) | $(COMPRESSION_COMMAND_DEPS)
 	$(call pretty,"Target debug ram disk: $@")
 	mkdir -p $(TARGET_DEBUG_RAMDISK_OUT)
 	touch $(TARGET_DEBUG_RAMDISK_OUT)/force_debuggable
 	rsync -a $(DEBUG_RAMDISK_SYNC_DIR)/ $(DEBUG_RAMDISK_ROOT_DIR)
-	$(MKBOOTFS) -d $(TARGET_OUT) $(DEBUG_RAMDISK_ROOT_DIR) | $(MINIGZIP) > $@
+	$(MKBOOTFS) -d $(TARGET_OUT) $(DEBUG_RAMDISK_ROOT_DIR) | $(COMPRESSION_COMMAND) > $@
 
 .PHONY: ramdisk_debug-nodeps
 ramdisk_debug-nodeps: DEBUG_RAMDISK_SYNC_DIR := $(my_debug_ramdisk_sync_dir)
 ramdisk_debug-nodeps: DEBUG_RAMDISK_ROOT_DIR := $(my_debug_ramdisk_root_dir)
-ramdisk_debug-nodeps: $(MKBOOTFS) | $(MINIGZIP)
+ramdisk_debug-nodeps: $(MKBOOTFS) | $(COMPRESSION_COMMAND_DEPS)
 	echo "make $@: ignoring dependencies"
 	mkdir -p $(TARGET_DEBUG_RAMDISK_OUT)
 	touch $(TARGET_DEBUG_RAMDISK_OUT)/force_debuggable
 	rsync -a $(DEBUG_RAMDISK_SYNC_DIR)/ $(DEBUG_RAMDISK_ROOT_DIR)
-	$(MKBOOTFS) -d $(TARGET_OUT) $(DEBUG_RAMDISK_ROOT_DIR) | $(MINIGZIP) > $(INSTALLED_DEBUG_RAMDISK_TARGET)
+	$(MKBOOTFS) -d $(TARGET_OUT) $(DEBUG_RAMDISK_ROOT_DIR) | $(COMPRESSION_COMMAND) > $(INSTALLED_DEBUG_RAMDISK_TARGET)
 
 my_debug_ramdisk_sync_dir :=
 my_debug_ramdisk_root_dir :=
@@ -2094,8 +2393,12 @@
 # Note: it's intentional to skip signing for boot-debug.img, because it
 # can only be used if the device is unlocked with verification error.
 ifneq ($(strip $(TARGET_NO_KERNEL)),true)
-
-INSTALLED_DEBUG_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot-debug.img
+ifneq ($(strip $(BOARD_KERNEL_BINARIES)),)
+  INSTALLED_DEBUG_BOOTIMAGE_TARGET := $(foreach k,$(subst kernel,boot-debug,$(BOARD_KERNEL_BINARIES)), \
+         $(PRODUCT_OUT)/$(k).img)
+else
+  INSTALLED_DEBUG_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot-debug.img
+endif
 
 # Replace ramdisk.img in $(MKBOOTIMG) ARGS with ramdisk-debug.img to build boot-debug.img
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
@@ -2109,38 +2412,205 @@
 # Using a test key to sign boot-debug.img to continue booting with the mismatched
 # public key, if the device is unlocked.
 ifneq ($(BOARD_AVB_BOOT_KEY_PATH),)
-BOARD_AVB_DEBUG_BOOT_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
-$(INSTALLED_DEBUG_BOOTIMAGE_TARGET): PRIVATE_AVB_DEBUG_BOOT_SIGNING_ARGS := \
-  --algorithm SHA256_RSA2048 --key $(BOARD_AVB_DEBUG_BOOT_KEY_PATH)
-$(INSTALLED_DEBUG_BOOTIMAGE_TARGET): $(AVBTOOL) $(BOARD_AVB_DEBUG_BOOT_KEY_PATH)
+$(INSTALLED_DEBUG_BOOTIMAGE_TARGET): $(AVBTOOL) $(BOARD_AVB_BOOT_TEST_KEY_PATH)
 endif
 
+BOARD_AVB_BOOT_TEST_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
+INTERNAL_AVB_BOOT_TEST_SIGNING_ARGS := --algorithm SHA256_RSA2048 --key $(BOARD_AVB_BOOT_TEST_KEY_PATH)
+# $(1): the bootimage to sign
+define test-key-sign-bootimage
+$(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(call get-bootimage-partition-size,$(1),boot-debug)))
+$(AVBTOOL) add_hash_footer \
+  --image $(1) \
+  --partition_size $(call get-bootimage-partition-size,$(1),boot-debug)\
+  --partition_name boot $(INTERNAL_AVB_BOOT_TEST_SIGNING_ARGS) \
+  $(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS)
+$(call assert-max-image-size,$(1),$(call get-bootimage-partition-size,$(1),boot-debug))
+endef
+
+# $(1): output file
+define build-debug-bootimage-target
+  $(MKBOOTIMG) --kernel $(PRODUCT_OUT)/$(subst .img,,$(subst boot-debug,kernel,$(notdir $(1)))) \
+    $(INTERNAL_DEBUG_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $1
+  $(if $(BOARD_AVB_BOOT_KEY_PATH),$(call test-key-sign-bootimage,$1))
+endef
+
 # Depends on original boot.img and ramdisk-debug.img, to build the new boot-debug.img
 $(INSTALLED_DEBUG_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INSTALLED_BOOTIMAGE_TARGET) $(INSTALLED_DEBUG_RAMDISK_TARGET)
 	$(call pretty,"Target boot debug image: $@")
-	$(MKBOOTIMG) $(INTERNAL_DEBUG_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $@
-	$(if $(BOARD_AVB_BOOT_KEY_PATH),\
-	  $(call assert-max-image-size,$@,$(call get-hash-image-max-size,$(BOARD_BOOTIMAGE_PARTITION_SIZE))); \
-	  $(AVBTOOL) add_hash_footer \
-	    --image $@ \
-	    --partition_size $(BOARD_BOOTIMAGE_PARTITION_SIZE) \
-	    --partition_name boot $(PRIVATE_AVB_DEBUG_BOOT_SIGNING_ARGS), \
-	  $(call assert-max-image-size,$@,$(BOARD_BOOTIMAGE_PARTITION_SIZE)))
+	$(call build-debug-bootimage-target, $@)
 
 .PHONY: bootimage_debug-nodeps
 bootimage_debug-nodeps: $(MKBOOTIMG)
 	echo "make $@: ignoring dependencies"
-	$(MKBOOTIMG) $(INTERNAL_DEBUG_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(INSTALLED_DEBUG_BOOTIMAGE_TARGET)
-	$(if $(BOARD_AVB_BOOT_KEY_PATH),\
-	  $(call assert-max-image-size,$(INSTALLED_DEBUG_BOOTIMAGE_TARGET),$(call get-hash-image-max-size,$(BOARD_BOOTIMAGE_PARTITION_SIZE))); \
-	  $(AVBTOOL) add_hash_footer \
-	    --image $(INSTALLED_DEBUG_BOOTIMAGE_TARGET) \
-	    --partition_size $(BOARD_BOOTIMAGE_PARTITION_SIZE) \
-	    --partition_name boot $(PRIVATE_AVB_DEBUG_BOOT_SIGNING_ARGS), \
-	  $(call assert-max-image-size,$(INSTALLED_DEBUG_BOOTIMAGE_TARGET),$(BOARD_BOOTIMAGE_PARTITION_SIZE)))
+	$(foreach b,$(INSTALLED_DEBUG_BOOTIMAGE_TARGET),$(call build-debug-bootimage-target,$b))
 
 endif # TARGET_NO_KERNEL
 
+ifeq ($(BUILDING_VENDOR_BOOT_IMAGE),true)
+ifeq ($(BUILDING_RAMDISK_IMAGE),true)
+# -----------------------------------------------------------------
+# vendor debug ramdisk
+# Combines vendor ramdisk files and debug ramdisk files to build the vendor debug ramdisk.
+INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET := $(PRODUCT_OUT)/vendor-ramdisk-debug.cpio$(RAMDISK_EXT)
+$(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET): DEBUG_RAMDISK_FILES := $(INTERNAL_DEBUG_RAMDISK_FILES)
+$(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET): VENDOR_RAMDISK_DIR := $(TARGET_VENDOR_RAMDISK_OUT)
+
+INTERNAL_VENDOR_DEBUG_RAMDISK_FILES := $(filter $(TARGET_VENDOR_DEBUG_RAMDISK_OUT)/%, \
+    $(ALL_GENERATED_SOURCES) \
+    $(ALL_DEFAULT_INSTALLED_MODULES))
+
+# Note: TARGET_VENDOR_DEBUG_RAMDISK_OUT will be $(PRODUCT_OUT)/vendor_debug_ramdisk/first_stage_ramdisk,
+# if BOARD_USES_RECOVERY_AS_BOOT is true. Otherwise, it will be $(PRODUCT_OUT)/vendor_debug_ramdisk.
+# But the path of $(VENDOR_DEBUG_RAMDISK_DIR) to build the vendor debug ramdisk, is always
+# $(PRODUCT_OUT)/vendor_debug_ramdisk.
+$(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET): VENDOR_DEBUG_RAMDISK_DIR := $(PRODUCT_OUT)/vendor_debug_ramdisk
+$(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET): $(INTERNAL_VENDOR_RAMDISK_TARGET) $(INSTALLED_DEBUG_RAMDISK_TARGET)
+$(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_VENDOR_DEBUG_RAMDISK_FILES) | $(COMPRESSION_COMMAND_DEPS)
+	$(call pretty,"Target vendor debug ram disk: $@")
+	mkdir -p $(TARGET_VENDOR_DEBUG_RAMDISK_OUT)
+	touch $(TARGET_VENDOR_DEBUG_RAMDISK_OUT)/force_debuggable
+	$(foreach debug_file,$(DEBUG_RAMDISK_FILES), \
+	  cp -f $(debug_file) $(subst $(PRODUCT_OUT)/debug_ramdisk,$(PRODUCT_OUT)/vendor_debug_ramdisk,$(debug_file)) &&) true
+	rsync -a $(VENDOR_RAMDISK_DIR)/ $(VENDOR_DEBUG_RAMDISK_DIR)
+	$(MKBOOTFS) -d $(TARGET_OUT) $(VENDOR_DEBUG_RAMDISK_DIR) | $(COMPRESSION_COMMAND) > $@
+
+INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK := $(PRODUCT_OUT)/installed-files-vendor-ramdisk-debug.txt
+INSTALLED_FILES_JSON_VENDOR_DEBUG_RAMDISK := $(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK:.txt=.json)
+$(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_VENDOR_DEBUG_RAMDISK)
+$(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK): VENDOR_DEBUG_RAMDISK_DIR := $(PRODUCT_OUT)/vendor_debug_ramdisk
+
+# The vendor debug ramdisk will rsync from $(TARGET_VENDOR_RAMDISK_OUT) and $(INTERNAL_DEBUG_RAMDISK_FILES),
+# so we have to wait for the vendor debug ramdisk to be built before generating the installed file list.
+$(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK): $(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET)
+$(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK): $(INTERNAL_VENDOR_DEBUG_RAMDISK_FILES) $(FILESLIST) $(FILESLIST_UTIL)
+	echo Installed file list: $@
+	mkdir -p $(dir $@)
+	rm -f $@
+	$(FILESLIST) $(VENDOR_DEBUG_RAMDISK_DIR) > $(@:.txt=.json)
+	$(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
+
+# -----------------------------------------------------------------
+# vendor_boot-debug.img.
+INSTALLED_VENDOR_DEBUG_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/vendor_boot-debug.img
+
+# The util to sign vendor_boot-debug.img with a test key.
+BOARD_AVB_VENDOR_BOOT_TEST_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
+INTERNAL_AVB_VENDOR_BOOT_TEST_SIGNING_ARGS := --algorithm SHA256_RSA2048 --key $(BOARD_AVB_VENDOR_BOOT_TEST_KEY_PATH)
+# $(1): the vendor bootimage to sign
+define test-key-sign-vendor-bootimage
+$(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE)))
+$(AVBTOOL) add_hash_footer \
+  --image $(1) \
+  --partition_size $(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE) \
+  --partition_name vendor_boot $(INTERNAL_AVB_VENDOR_BOOT_TEST_SIGNING_ARGS) \
+  $(BOARD_AVB_VENDOR_BOOT_ADD_HASH_FOOTER_ARGS)
+$(call assert-max-image-size,$(1),$(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE))
+endef
+
+ifneq ($(BOARD_AVB_VENDOR_BOOT_KEY_PATH),)
+$(INSTALLED_VENDOR_DEBUG_BOOTIMAGE_TARGET): $(AVBTOOL) $(BOARD_AVB_VENDOR_BOOT_TEST_KEY_PATH)
+endif
+
+# Depends on vendor_boot.img and vendor-ramdisk-debug.cpio.gz to build the new vendor_boot-debug.img
+$(INSTALLED_VENDOR_DEBUG_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INSTALLED_VENDOR_BOOTIMAGE_TARGET) $(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET)
+	$(call pretty,"Target vendor_boot debug image: $@")
+	$(MKBOOTIMG) $(INTERNAL_VENDOR_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --vendor_ramdisk $(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET) --vendor_boot $@
+	$(call assert-max-image-size,$@,$(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE))
+	$(if $(BOARD_AVB_VENDOR_BOOT_KEY_PATH),$(call test-key-sign-vendor-bootimage,$@))
+
+endif # BUILDING_RAMDISK_IMAGE
+endif # BUILDING_VENDOR_BOOT_IMAGE
+
+# -----------------------------------------------------------------
+# The test harness ramdisk, which is based off debug_ramdisk, plus a
+# few additional test-harness-specific properties in adb_debug.prop.
+
+ifdef BUILDING_RAMDISK_IMAGE
+BUILT_TEST_HARNESS_RAMDISK_TARGET := $(PRODUCT_OUT)/ramdisk-test-harness.img
+INSTALLED_TEST_HARNESS_RAMDISK_TARGET := $(BUILT_TEST_HARNESS_RAMDISK_TARGET)
+
+# rsync the content from ramdisk-debug.img to ramdisk-test-harness.img, then
+# appends a few test harness specific properties into the adb_debug.prop.
+TEST_HARNESS_RAMDISK_SYNC_DIR := $(PRODUCT_OUT)/debug_ramdisk
+TEST_HARNESS_RAMDISK_ROOT_DIR := $(PRODUCT_OUT)/test_harness_ramdisk
+
+# The following TARGET_TEST_HARNESS_RAMDISK_OUT will be $(PRODUCT_OUT)/test_harness_ramdisk/first_stage_ramdisk,
+# if BOARD_USES_RECOVERY_AS_BOOT is true. Otherwise, it will be $(PRODUCT_OUT)/test_harness_ramdisk.
+TEST_HARNESS_PROP_TARGET := $(TARGET_TEST_HARNESS_RAMDISK_OUT)/adb_debug.prop
+ADDITIONAL_TEST_HARNESS_PROPERTIES := ro.audio.silent=1
+ADDITIONAL_TEST_HARNESS_PROPERTIES += ro.test_harness=1
+
+# $(1): a list of key=value pairs for additional property assignments
+# $(2): the target .prop file to append the properties from $(1)
+define append-test-harness-props
+  echo "#" >> $(2); \
+  echo "# ADDITIONAL TEST HARNESS_PROPERTIES" >> $(2); \
+  echo "#" >> $(2);
+  $(foreach line,$(1), echo "$(line)" >> $(2);)
+endef
+
+$(INSTALLED_TEST_HARNESS_RAMDISK_TARGET): $(INSTALLED_DEBUG_RAMDISK_TARGET)
+$(INSTALLED_TEST_HARNESS_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_TEST_HARNESS_RAMDISK_FILES) | $(COMPRESSION_COMMAND_DEPS)
+	$(call pretty,"Target test harness ram disk: $@")
+	rsync -a $(TEST_HARNESS_RAMDISK_SYNC_DIR)/ $(TEST_HARNESS_RAMDISK_ROOT_DIR)
+	$(call append-test-harness-props,$(ADDITIONAL_TEST_HARNESS_PROPERTIES),$(TEST_HARNESS_PROP_TARGET))
+	$(MKBOOTFS) -d $(TARGET_OUT) $(TEST_HARNESS_RAMDISK_ROOT_DIR) | $(COMPRESSION_COMMAND) > $@
+
+.PHONY: ramdisk_test_harness-nodeps
+ramdisk_test_harness-nodeps: $(MKBOOTFS) | $(COMPRESSION_COMMAND_DEPS)
+	echo "make $@: ignoring dependencies"
+	rsync -a $(TEST_HARNESS_RAMDISK_SYNC_DIR)/ $(TEST_HARNESS_RAMDISK_ROOT_DIR)
+	$(call append-test-harness-props,$(ADDITIONAL_TEST_HARNESS_PROPERTIES),$(TEST_HARNESS_PROP_TARGET))
+	$(MKBOOTFS) -d $(TARGET_OUT) $(TEST_HARNESS_RAMDISK_ROOT_DIR) | $(COMPRESSION_COMMAND) > $(INSTALLED_TEST_HARNESS_RAMDISK_TARGET)
+
+endif # BUILDING_RAMDISK_IMAGE
+
+# -----------------------------------------------------------------
+# the boot-test-harness.img, which is the kernel plus ramdisk-test-harness.img
+#
+# Note: it's intentional to skip signing for boot-test-harness.img, because it
+# can only be used if the device is unlocked with verification error.
+ifneq ($(strip $(TARGET_NO_KERNEL)),true)
+
+ifneq ($(strip $(BOARD_KERNEL_BINARIES)),)
+  INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET := $(foreach k,$(subst kernel,boot-test-harness,$(BOARD_KERNEL_BINARIES)), \
+    $(PRODUCT_OUT)/$(k).img)
+else
+  INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot-test-harness.img
+endif
+
+# Replace ramdisk-debug.img in $(MKBOOTIMG) ARGS with ramdisk-test-harness.img to build boot-test-harness.img
+INTERNAL_TEST_HARNESS_BOOTIMAGE_ARGS := $(subst $(INSTALLED_DEBUG_RAMDISK_TARGET),$(INSTALLED_TEST_HARNESS_RAMDISK_TARGET),$(INTERNAL_DEBUG_BOOTIMAGE_ARGS))
+
+# If boot.img is chained but boot-test-harness.img is not signed, libavb in bootloader
+# will fail to find valid AVB metadata from the end of /boot, thus stop booting.
+# Using a test key to sign boot-test-harness.img to continue booting with the mismatched
+# public key, if the device is unlocked.
+ifneq ($(BOARD_AVB_BOOT_KEY_PATH),)
+$(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET): $(AVBTOOL) $(BOARD_AVB_BOOT_TEST_KEY_PATH)
+endif
+
+# $(1): output file
+define build-boot-test-harness-target
+  $(MKBOOTIMG) --kernel $(PRODUCT_OUT)/$(subst .img,,$(subst boot-test-harness,kernel,$(notdir $(1)))) \
+    $(INTERNAL_TEST_HARNESS_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $@
+  $(if $(BOARD_AVB_BOOT_KEY_PATH),$(call test-key-sign-bootimage,$@))
+endef
+
+# Build the new boot-test-harness.img, based on boot-debug.img and ramdisk-test-harness.img.
+$(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INSTALLED_DEBUG_BOOTIMAGE_TARGET) $(INSTALLED_TEST_HARNESS_RAMDISK_TARGET)
+	$(call pretty,"Target boot test harness image: $@")
+	$(call build-boot-test-harness-target,$@)
+
+.PHONY: bootimage_test_harness-nodeps
+bootimage_test_harness-nodeps: $(MKBOOTIMG)
+	echo "make $@: ignoring dependencies"
+	$(foreach b,$(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET),$(call build-boot-test-harness-target,$b))
+
+endif # TARGET_NO_KERNEL
+endif # BOARD_BUILD_SYSTEM_ROOT_IMAGE is not true
+
 # -----------------------------------------------------------------
 # system image
 #
@@ -2152,8 +2622,7 @@
 INTERNAL_SYSTEMIMAGE_FILES := $(sort $(filter $(TARGET_OUT)/%, \
     $(ALL_GENERATED_SOURCES) \
     $(ALL_DEFAULT_INSTALLED_MODULES) \
-    $(PDK_FUSION_SYSIMG_FILES) \
-    $(RECOVERY_RESOURCE_ZIP)) \
+    $(PDK_FUSION_SYSIMG_FILES)) \
     $(PDK_FUSION_SYMLINK_STAMP))
 
 FULL_SYSTEMIMAGE_DEPS := $(INTERNAL_SYSTEMIMAGE_FILES) $(INTERNAL_USERIMAGES_DEPS)
@@ -2179,12 +2648,12 @@
 INSTALLED_FILES_FILE := $(PRODUCT_OUT)/installed-files.txt
 INSTALLED_FILES_JSON := $(INSTALLED_FILES_FILE:.txt=.json)
 $(INSTALLED_FILES_FILE): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON)
-$(INSTALLED_FILES_FILE): $(FULL_SYSTEMIMAGE_DEPS) $(FILESLIST)
+$(INSTALLED_FILES_FILE): $(FULL_SYSTEMIMAGE_DEPS) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_OUT) > $(@:.txt=.json)
-	$(hide) build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 .PHONY: installed-file-list
 installed-file-list: $(INSTALLED_FILES_FILE)
@@ -2225,33 +2694,18 @@
 endef
 endif
 
-# Create symlink /system/product_services to /product_services if necessary.
-ifdef BOARD_USES_PRODUCT_SERVICESIMAGE
-define create-system-product_services-symlink
-$(hide) if [ -d $(TARGET_OUT)/product_services ] && [ ! -h $(TARGET_OUT)/product_services ]; then \
-  echo 'Non-symlink $(TARGET_OUT)/product_services detected!' 1>&2; \
-  echo 'You cannot install files to $(TARGET_OUT)/product_services while building a separate product_services.img!' 1>&2; \
+# Create symlink /system/system_ext to /system_ext if necessary.
+ifdef BOARD_USES_SYSTEM_EXTIMAGE
+define create-system-system_ext-symlink
+$(hide) if [ -d $(TARGET_OUT)/system_ext ] && [ ! -h $(TARGET_OUT)/system_ext ]; then \
+  echo 'Non-symlink $(TARGET_OUT)/system_ext detected!' 1>&2; \
+  echo 'You cannot install files to $(TARGET_OUT)/system_ext while building a separate system_ext.img!' 1>&2; \
   exit 1; \
 fi
-$(hide) ln -sf /product_services $(TARGET_OUT)/product_services
+$(hide) ln -sf /system_ext $(TARGET_OUT)/system_ext
 endef
 else
-define create-system-product_services-symlink
-endef
-endif
-
-# Create symlink /vendor/odm to /odm if necessary.
-ifdef BOARD_USES_ODMIMAGE
-define create-vendor-odm-symlink
-$(hide) if [ -d $(TARGET_OUT_VENDOR)/odm ] && [ ! -h $(TARGET_OUT_VENDOR)/odm ]; then \
-  echo 'Non-symlink $(TARGET_OUT_VENDOR)/odm detected!' 1>&2; \
-  echo 'You cannot install files to $(TARGET_OUT_VENDOR)/odm while building a separate odm.img!' 1>&2; \
-  exit 1; \
-fi
-$(hide) ln -sf /odm $(TARGET_OUT_VENDOR)/odm
-endef
-else
-define create-vendor-odm-symlink
+define create-system-system_ext-symlink
 endef
 endif
 
@@ -2260,19 +2714,22 @@
   @echo "Target system fs image: $(1)"
   $(call create-system-vendor-symlink)
   $(call create-system-product-symlink)
-  $(call create-system-product_services-symlink)
-  $(call check-apex-libs-absence-on-disk)
+  $(call create-system-system_ext-symlink)
   @mkdir -p $(dir $(1)) $(systemimage_intermediates) && rm -rf $(systemimage_intermediates)/system_image_info.txt
   $(call generate-image-prop-dictionary, $(systemimage_intermediates)/system_image_info.txt,system, \
       skip_fsck=true)
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      build/make/tools/releasetools/build_image.py \
-      $(TARGET_OUT) $(systemimage_intermediates)/system_image_info.txt $(1) $(TARGET_OUT) \
-      || ( mkdir -p $${DIST_DIR}; cp $(INSTALLED_FILES_FILE) $${DIST_DIR}/installed-files-rescued.txt; \
-           exit 1 )
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT) $(systemimage_intermediates)/system_image_info.txt $(1) $(TARGET_OUT) \
+          || ( mkdir -p $${DIST_DIR}; \
+               cp $(INSTALLED_FILES_FILE) $${DIST_DIR}/installed-files-rescued.txt; \
+               exit 1 )
 endef
 
-$(BUILT_SYSTEMIMAGE): $(FULL_SYSTEMIMAGE_DEPS) $(INSTALLED_FILES_FILE) $(BUILD_IMAGE_SRCS)
+ifeq ($(BOARD_AVB_ENABLE),true)
+$(BUILT_SYSTEMIMAGE): $(BOARD_AVB_SYSTEM_KEY_PATH)
+endif
+$(BUILT_SYSTEMIMAGE): $(FULL_SYSTEMIMAGE_DEPS) $(INSTALLED_FILES_FILE)
 	$(call build-systemimage-target,$@)
 
 INSTALLED_SYSTEMIMAGE_TARGET := $(PRODUCT_OUT)/system.img
@@ -2311,10 +2768,10 @@
 endif # INSTALLED_RECOVERYIMAGE_TARGET
 endif # INSTALLED_BOOTIMAGE_TARGET
 
-$(INSTALLED_SYSTEMIMAGE_TARGET): $(BUILT_SYSTEMIMAGE) $(RECOVERY_FROM_BOOT_PATCH)
+$(INSTALLED_SYSTEMIMAGE_TARGET): $(BUILT_SYSTEMIMAGE)
 	@echo "Install system fs image: $@"
 	$(copy-file-to-target)
-	$(hide) $(call assert-max-image-size,$@ $(RECOVERY_FROM_BOOT_PATCH),$(BOARD_SYSTEMIMAGE_PARTITION_SIZE))
+	$(hide) $(call assert-max-image-size,$@,$(BOARD_SYSTEMIMAGE_PARTITION_SIZE))
 
 systemimage: $(INSTALLED_SYSTEMIMAGE_TARGET)
 
@@ -2336,36 +2793,6 @@
 .PHONY: sync syncsys
 sync syncsys: $(INTERNAL_SYSTEMIMAGE_FILES)
 
-#######
-## system tarball
-define build-systemtarball-target
-  $(call pretty,"Target system fs tarball: $(INSTALLED_SYSTEMTARBALL_TARGET)")
-  $(call create-system-vendor-symlink)
-  $(call create-system-product-symlink)
-  $(call create-system-product_services-symlink)
-  $(MKTARBALL) $(FS_GET_STATS) \
-    $(PRODUCT_OUT) system $(PRIVATE_SYSTEM_TAR) \
-    $(INSTALLED_SYSTEMTARBALL_TARGET) $(TARGET_OUT)
-endef
-
-ifndef SYSTEM_TARBALL_FORMAT
-    SYSTEM_TARBALL_FORMAT := bz2
-endif
-
-system_tar := $(PRODUCT_OUT)/system.tar
-INSTALLED_SYSTEMTARBALL_TARGET := $(system_tar).$(SYSTEM_TARBALL_FORMAT)
-$(INSTALLED_SYSTEMTARBALL_TARGET): PRIVATE_SYSTEM_TAR := $(system_tar)
-$(INSTALLED_SYSTEMTARBALL_TARGET): $(FS_GET_STATS) $(INTERNAL_SYSTEMIMAGE_FILES)
-	$(build-systemtarball-target)
-
-.PHONY: systemtarball-nodeps
-systemtarball-nodeps: $(FS_GET_STATS) \
-                      $(filter-out systemtarball-nodeps stnod,$(MAKECMDGOALS))
-	$(build-systemtarball-target)
-
-.PHONY: stnod
-stnod: systemtarball-nodeps
-
 # -----------------------------------------------------------------
 ## platform.zip: system, plus other files to be used in PDK fusion build,
 ## in a zip file
@@ -2380,7 +2807,7 @@
   $(if $(filter $(DEXPREOPT.$(m).INSTALLED_STRIPPED),$(ALL_DEFAULT_INSTALLED_MODULES)),$(m))))
 pdk_classes_dex := $(strip \
   $(foreach m,$(pdk_odex_javalibs),$(call intermediates-dir-for,JAVA_LIBRARIES,$(m),,COMMON)/javalib.jar) \
-  $(foreach m,$(pdk_odex_apps),$(call intermediates-dir-for,APPS,$(m))/package.dex.apk))
+  $(foreach m,$(pdk_odex_apps),$(call intermediates-dir-for,APPS,$(m))/package.apk))
 
 pdk_odex_config_mk := $(PRODUCT_OUT)/pdk_dexpreopt_config.mk
 $(pdk_odex_config_mk): PRIVATE_JAVA_LIBRARIES := $(pdk_odex_javalibs)
@@ -2398,7 +2825,7 @@
 	  $(hide) echo "PDK.DEXPREOPT.$(m).DEX_PREOPT_FLAGS:=$(DEXPREOPT.$(m).DEX_PREOPT_FLAGS)" >> $@$(newline)\
 	  )
 	$(foreach m,$(PRIVATE_APPS),\
-	  $(hide) echo "PDK.DEXPREOPT.$(m).SRC:=$(patsubst $(OUT_DIR)/%,%,$(call intermediates-dir-for,APPS,$(m))/package.dex.apk)" >> $@$(newline)\
+	  $(hide) echo "PDK.DEXPREOPT.$(m).SRC:=$(patsubst $(OUT_DIR)/%,%,$(call intermediates-dir-for,APPS,$(m))/package.apk)" >> $@$(newline)\
 	  $(hide) echo "PDK.DEXPREOPT.$(m).DEX_PREOPT:=$(DEXPREOPT.$(m).DEX_PREOPT)" >> $@$(newline)\
 	  $(hide) echo "PDK.DEXPREOPT.$(m).MULTILIB:=$(DEXPREOPT.$(m).MULTILIB)" >> $@$(newline)\
 	  $(hide) echo "PDK.DEXPREOPT.$(m).DEX_PREOPT_FLAGS:=$(DEXPREOPT.$(m).DEX_PREOPT_FLAGS)" >> $@$(newline)\
@@ -2429,8 +2856,8 @@
 ifdef BUILDING_PRODUCT_IMAGE
 	echo "-D $(TARGET_OUT_PRODUCT)" >> $@.lst
 endif
-ifdef BUILDING_PRODUCT_SERVICES_IMAGE
-	echo "-D $(TARGET_OUT_PRODUCT_SERVICES)" >> $@.lst
+ifdef BUILDING_SYSTEM_EXT_IMAGE
+	echo "-D $(TARGET_OUT_SYSTEM_EXT)" >> $@.lst
 endif
 ifdef BUILDING_ODM_IMAGE
 	echo "-D $(TARGET_OUT_ODM)" >> $@.lst
@@ -2468,34 +2895,6 @@
 endif # BUILD_PLATFORM_ZIP
 
 # -----------------------------------------------------------------
-## boot tarball
-define build-boottarball-target
-    $(hide) echo "Target boot fs tarball: $(INSTALLED_BOOTTARBALL_TARGET)"
-    $(hide) mkdir -p $(PRODUCT_OUT)/boot
-    $(hide) cp -f $(INTERNAL_BOOTIMAGE_FILES) $(PRODUCT_OUT)/boot/.
-    $(hide) echo $(INTERNAL_KERNEL_CMDLINE) > $(PRODUCT_OUT)/boot/cmdline
-    $(hide) $(MKTARBALL) $(FS_GET_STATS) \
-                 $(PRODUCT_OUT) boot $(PRIVATE_BOOT_TAR) \
-                 $(INSTALLED_BOOTTARBALL_TARGET) $(TARGET_OUT)
-endef
-
-ifndef BOOT_TARBALL_FORMAT
-    BOOT_TARBALL_FORMAT := bz2
-endif
-
-boot_tar := $(PRODUCT_OUT)/boot.tar
-INSTALLED_BOOTTARBALL_TARGET := $(boot_tar).$(BOOT_TARBALL_FORMAT)
-$(INSTALLED_BOOTTARBALL_TARGET): PRIVATE_BOOT_TAR := $(boot_tar)
-$(INSTALLED_BOOTTARBALL_TARGET): $(FS_GET_STATS) $(INTERNAL_BOOTIMAGE_FILES)
-	$(build-boottarball-target)
-
-.PHONY: boottarball-nodeps btnod
-boottarball-nodeps btnod: $(FS_GET_STATS) \
-                      $(filter-out boottarball-nodeps btnod,$(MAKECMDGOALS))
-	$(build-boottarball-target)
-
-
-# -----------------------------------------------------------------
 # data partition image
 INTERNAL_USERDATAIMAGE_FILES := \
     $(filter $(TARGET_OUT_DATA)/%,$(ALL_DEFAULT_INSTALLED_MODULES))
@@ -2510,18 +2909,18 @@
   @mkdir -p $(TARGET_OUT_DATA)
   @mkdir -p $(userdataimage_intermediates) && rm -rf $(userdataimage_intermediates)/userdata_image_info.txt
   $(call generate-image-prop-dictionary, $(userdataimage_intermediates)/userdata_image_info.txt,userdata,skip_fsck=true)
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      build/make/tools/releasetools/build_image.py \
-      $(TARGET_OUT_DATA) $(userdataimage_intermediates)/userdata_image_info.txt $(INSTALLED_USERDATAIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_USERDATAIMAGE_TARGET),$(BOARD_USERDATAIMAGE_PARTITION_SIZE))
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_DATA) $(userdataimage_intermediates)/userdata_image_info.txt \
+          $(INSTALLED_USERDATAIMAGE_TARGET) $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_USERDATAIMAGE_TARGET),$(BOARD_USERDATAIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
 INSTALLED_USERDATAIMAGE_TARGET := $(BUILT_USERDATAIMAGE_TARGET)
 INSTALLED_USERDATAIMAGE_TARGET_DEPS := \
     $(INTERNAL_USERIMAGES_DEPS) \
-    $(INTERNAL_USERDATAIMAGE_FILES) \
-    $(BUILD_IMAGE_SRCS)
+    $(INTERNAL_USERDATAIMAGE_FILES)
 $(INSTALLED_USERDATAIMAGE_TARGET): $(INSTALLED_USERDATAIMAGE_TARGET_DEPS)
 	$(build-userdataimage-target)
 
@@ -2544,29 +2943,6 @@
 $(ASAN_IN_SYSTEM_INSTALLED): $(INSTALLED_USERDATAIMAGE_TARGET_DEPS)
 	tar cfj $(ASAN_IN_SYSTEM_INSTALLED) $(ASAN_SYSTEM_INSTALL_OPTIONS) -C $(TARGET_OUT_DATA)/.. $(ASAN_OUT_DIRS_FOR_SYSTEM_INSTALL) >/dev/null
 
-#######
-## data partition tarball
-define build-userdatatarball-target
-    $(call pretty,"Target userdata fs tarball: " \
-                  "$(INSTALLED_USERDATATARBALL_TARGET)")
-    $(MKTARBALL) $(FS_GET_STATS) \
-	    $(PRODUCT_OUT) data $(PRIVATE_USERDATA_TAR) \
-	    $(INSTALLED_USERDATATARBALL_TARGET) $(TARGET_OUT)
-endef
-
-userdata_tar := $(PRODUCT_OUT)/userdata.tar
-INSTALLED_USERDATATARBALL_TARGET := $(userdata_tar).bz2
-$(INSTALLED_USERDATATARBALL_TARGET): PRIVATE_USERDATA_TAR := $(userdata_tar)
-$(INSTALLED_USERDATATARBALL_TARGET): $(FS_GET_STATS) $(INTERNAL_USERDATAIMAGE_FILES)
-	$(build-userdatatarball-target)
-
-$(call dist-for-goals,userdatatarball,$(INSTALLED_USERDATATARBALL_TARGET))
-
-.PHONY: userdatatarball-nodeps
-userdatatarball-nodeps: $(FS_GET_STATS)
-	$(build-userdatatarball-target)
-
-
 # -----------------------------------------------------------------
 # partition table image
 ifdef BOARD_BPT_INPUT_FILES
@@ -2616,15 +2992,16 @@
   @mkdir -p $(TARGET_OUT_CACHE)
   @mkdir -p $(cacheimage_intermediates) && rm -rf $(cacheimage_intermediates)/cache_image_info.txt
   $(call generate-image-prop-dictionary, $(cacheimage_intermediates)/cache_image_info.txt,cache,skip_fsck=true)
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      build/make/tools/releasetools/build_image.py \
-      $(TARGET_OUT_CACHE) $(cacheimage_intermediates)/cache_image_info.txt $(INSTALLED_CACHEIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_CACHEIMAGE_TARGET),$(BOARD_CACHEIMAGE_PARTITION_SIZE))
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_CACHE) $(cacheimage_intermediates)/cache_image_info.txt \
+          $(INSTALLED_CACHEIMAGE_TARGET) $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_CACHEIMAGE_TARGET),$(BOARD_CACHEIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
 INSTALLED_CACHEIMAGE_TARGET := $(BUILT_CACHEIMAGE_TARGET)
-$(INSTALLED_CACHEIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_CACHEIMAGE_FILES) $(BUILD_IMAGE_SRCS)
+$(INSTALLED_CACHEIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_CACHEIMAGE_FILES)
 	$(build-cacheimage-target)
 
 .PHONY: cacheimage-nodeps
@@ -2659,12 +3036,12 @@
 INSTALLED_FILES_FILE_SYSTEMOTHER := $(PRODUCT_OUT)/installed-files-system-other.txt
 INSTALLED_FILES_JSON_SYSTEMOTHER := $(INSTALLED_FILES_FILE_SYSTEMOTHER:.txt=.json)
 $(INSTALLED_FILES_FILE_SYSTEMOTHER): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_SYSTEMOTHER)
-$(INSTALLED_FILES_FILE_SYSTEMOTHER) : $(INTERNAL_SYSTEMOTHERIMAGE_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_SYSTEMOTHER) : $(INTERNAL_SYSTEMOTHERIMAGE_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_OUT_SYSTEM_OTHER) > $(@:.txt=.json)
-	$(hide) build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 # Determines partition size for system_other.img.
 ifeq ($(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS),true)
@@ -2687,10 +3064,11 @@
   @mkdir -p $(TARGET_OUT_SYSTEM_OTHER)
   @mkdir -p $(systemotherimage_intermediates) && rm -rf $(systemotherimage_intermediates)/system_other_image_info.txt
   $(call generate-image-prop-dictionary, $(systemotherimage_intermediates)/system_other_image_info.txt,system,skip_fsck=true)
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      build/make/tools/releasetools/build_image.py \
-      $(TARGET_OUT_SYSTEM_OTHER) $(systemotherimage_intermediates)/system_other_image_info.txt $(INSTALLED_SYSTEMOTHERIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_SYSTEMOTHERIMAGE_TARGET),$(BOARD_SYSTEMIMAGE_PARTITION_SIZE))
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_SYSTEM_OTHER) $(systemotherimage_intermediates)/system_other_image_info.txt \
+          $(INSTALLED_SYSTEMOTHERIMAGE_TARGET) $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_SYSTEMOTHERIMAGE_TARGET),$(BOARD_SYSTEMIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
@@ -2717,104 +3095,33 @@
       $(ALL_PDK_FUSION_FILES)) \
     $(PDK_FUSION_SYMLINK_STAMP)
 
-# Final Vendor VINTF manifest including fragments. This is not assembled
-# on the device because it depends on everything in a given device
-# image which defines a vintf_fragment.
-ifdef BUILT_VENDOR_MANIFEST
-BUILT_ASSEMBLED_VENDOR_MANIFEST := $(PRODUCT_OUT)/verified_assembled_vendor_manifest.xml
-ifeq (true,$(PRODUCT_ENFORCE_VINTF_MANIFEST))
-ifneq ($(strip $(DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE) $(DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE)),)
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): PRIVATE_SYSTEM_ASSEMBLE_VINTF_ENV_VARS := VINTF_ENFORCE_NO_UNUSED_HALS=true
-endif # DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE or DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE
-endif # PRODUCT_ENFORCE_VINTF_MANIFEST
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): $(HOST_OUT_EXECUTABLES)/assemble_vintf
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): $(BUILT_SYSTEM_MATRIX)
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): $(BUILT_VENDOR_MANIFEST)
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): $(INTERNAL_VENDORIMAGE_FILES)
-
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): PRIVATE_FLAGS :=
-
-# -- Kernel version and configurations.
-ifeq ($(PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS),true)
-
-# BOARD_KERNEL_CONFIG_FILE and BOARD_KERNEL_VERSION can be used to override the values extracted
-# from INSTALLED_KERNEL_TARGET.
-ifdef BOARD_KERNEL_CONFIG_FILE
-ifdef BOARD_KERNEL_VERSION
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): $(BOARD_KERNEL_CONFIG_FILE)
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): PRIVATE_FLAGS += --kernel $(BOARD_KERNEL_VERSION):$(BOARD_KERNEL_CONFIG_FILE)
-my_board_extracted_kernel := true
-endif # BOARD_KERNEL_VERSION
-endif # BOARD_KERNEL_CONFIG_FILE
-
-ifneq ($(my_board_extracted_kernel),true)
-ifndef INSTALLED_KERNEL_TARGET
-$(warning No INSTALLED_KERNEL_TARGET is defined when PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS \
-    is true. Information about the updated kernel cannot be built into OTA update package. \
-    You can fix this by: (1) setting TARGET_NO_KERNEL to false and installing the built kernel \
-    to $(PRODUCT_OUT)/kernel, so that kernel information will be extracted from the built kernel; \
-    or (2) extracting kernel configuration and defining BOARD_KERNEL_CONFIG_FILE and \
-    BOARD_KERNEL_VERSION manually; or (3) unsetting PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS \
-    manually.)
-else
-intermediates := $(call intermediates-dir-for,ETC,$(notdir $(BUILT_ASSEMBLED_VENDOR_MANIFEST)))
-
-# Tools for decompression that is not in PATH.
-# Check $(EXTRACT_KERNEL) for decompression algorithms supported by the script.
-# Algorithms that are in the script but not in this list will be found in PATH.
-my_decompress_tools := \
-    lz4:$(HOST_OUT_EXECUTABLES)/lz4 \
-
-my_kernel_configs := $(intermediates)/kernel_configs.txt
-my_kernel_version := $(intermediates)/kernel_version.txt
-$(my_kernel_configs): .KATI_IMPLICIT_OUTPUTS := $(my_kernel_version)
-$(my_kernel_configs): PRIVATE_KERNEL_VERSION_FILE := $(my_kernel_version)
-$(my_kernel_configs): PRIVATE_DECOMPRESS_TOOLS := $(my_decompress_tools)
-$(my_kernel_configs): $(foreach pair,$(my_decompress_tools),$(call word-colon,2,$(pair)))
-$(my_kernel_configs): $(EXTRACT_KERNEL) $(INSTALLED_KERNEL_TARGET)
-	$< --tools $(PRIVATE_DECOMPRESS_TOOLS) --input $(INSTALLED_KERNEL_TARGET) \
-	  --output-configs $@ \
-	  --output-version $(PRIVATE_KERNEL_VERSION_FILE)
-
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): $(my_kernel_configs) $(my_kernel_version)
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST): PRIVATE_FLAGS += --kernel $$(cat $(my_kernel_version)):$(my_kernel_configs)
-
-intermediates :=
-my_kernel_configs :=
-my_kernel_version :=
-my_decompress_tools :=
-
-endif # my_board_extracted_kernel
-my_board_extracted_kernel :=
-
-endif # INSTALLED_KERNEL_TARGET
-endif # PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS
-
-$(BUILT_ASSEMBLED_VENDOR_MANIFEST):
-	@echo "Verifying vendor VINTF manifest."
-	PRODUCT_ENFORCE_VINTF_MANIFEST=$(PRODUCT_ENFORCE_VINTF_MANIFEST) \
-	$(PRIVATE_SYSTEM_ASSEMBLE_VINTF_ENV_VARS) \
-	$(HOST_OUT_EXECUTABLES)/assemble_vintf \
-	    $(PRIVATE_FLAGS) \
-	    -c $(BUILT_SYSTEM_MATRIX) \
-	    -i $(BUILT_VENDOR_MANIFEST) \
-	    $$([ -d $(TARGET_OUT_VENDOR)/etc/vintf/manifest ] && \
-	        find $(TARGET_OUT_VENDOR)/etc/vintf/manifest -type f -name "*.xml" | \
-	        sed "s/^/-i /" | tr '\n' ' ') -o $@
-endif # BUILT_VENDOR_MANIFEST
-
 # platform.zip depends on $(INTERNAL_VENDORIMAGE_FILES).
 $(INSTALLED_PLATFORM_ZIP) : $(INTERNAL_VENDORIMAGE_FILES)
 
 INSTALLED_FILES_FILE_VENDOR := $(PRODUCT_OUT)/installed-files-vendor.txt
 INSTALLED_FILES_JSON_VENDOR := $(INSTALLED_FILES_FILE_VENDOR:.txt=.json)
 $(INSTALLED_FILES_FILE_VENDOR): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_VENDOR)
-$(INSTALLED_FILES_FILE_VENDOR) : $(INTERNAL_VENDORIMAGE_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_VENDOR) : $(INTERNAL_VENDORIMAGE_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_OUT_VENDOR) > $(@:.txt=.json)
-	$(hide) build/make/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
+
+# Create symlink /vendor/odm to /odm if necessary.
+ifdef BOARD_USES_ODMIMAGE
+define create-vendor-odm-symlink
+$(hide) if [ -d $(TARGET_OUT_VENDOR)/odm ] && [ ! -h $(TARGET_OUT_VENDOR)/odm ]; then \
+  echo 'Non-symlink $(TARGET_OUT_VENDOR)/odm detected!' 1>&2; \
+  echo 'You cannot install files to $(TARGET_OUT_VENDOR)/odm while building a separate odm.img!' 1>&2; \
+  exit 1; \
+fi
+$(hide) ln -sf /odm $(TARGET_OUT_VENDOR)/odm
+endef
+else
+define create-vendor-odm-symlink
+endef
+endif
 
 vendorimage_intermediates := \
     $(call intermediates-dir-for,PACKAGING,vendor)
@@ -2825,24 +3132,24 @@
   $(call create-vendor-odm-symlink)
   @mkdir -p $(vendorimage_intermediates) && rm -rf $(vendorimage_intermediates)/vendor_image_info.txt
   $(call generate-image-prop-dictionary, $(vendorimage_intermediates)/vendor_image_info.txt,vendor,skip_fsck=true)
-  $(if $(BOARD_VENDOR_KERNEL_MODULES), \
-    $(call build-image-kernel-modules,$(BOARD_VENDOR_KERNEL_MODULES),$(TARGET_OUT_VENDOR),vendor/,$(call intermediates-dir-for,PACKAGING,depmod_vendor)))
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      build/make/tools/releasetools/build_image.py \
-      $(TARGET_OUT_VENDOR) $(vendorimage_intermediates)/vendor_image_info.txt $(INSTALLED_VENDORIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_VENDORIMAGE_TARGET),$(BOARD_VENDORIMAGE_PARTITION_SIZE))
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_VENDOR) $(vendorimage_intermediates)/vendor_image_info.txt \
+          $(INSTALLED_VENDORIMAGE_TARGET) $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_VENDORIMAGE_TARGET) $(RECOVERY_FROM_BOOT_PATCH),$(BOARD_VENDORIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
 INSTALLED_VENDORIMAGE_TARGET := $(BUILT_VENDORIMAGE_TARGET)
-ifdef BUILT_VENDOR_MANIFEST
-$(INSTALLED_VENDORIMAGE_TARGET): $(BUILT_ASSEMBLED_VENDOR_MANIFEST)
-endif
-$(INSTALLED_VENDORIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_VENDORIMAGE_FILES) $(INSTALLED_FILES_FILE_VENDOR) $(BUILD_IMAGE_SRCS) $(DEPMOD) $(BOARD_VENDOR_KERNEL_MODULES)
+$(INSTALLED_VENDORIMAGE_TARGET): \
+    $(INTERNAL_USERIMAGES_DEPS) \
+    $(INTERNAL_VENDORIMAGE_FILES) \
+    $(INSTALLED_FILES_FILE_VENDOR) \
+    $(RECOVERY_FROM_BOOT_PATCH)
 	$(build-vendorimage-target)
 
 .PHONY: vendorimage-nodeps vnod
-vendorimage-nodeps vnod: | $(INTERNAL_USERIMAGES_DEPS) $(DEPMOD)
+vendorimage-nodeps vnod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-vendorimage-target)
 
 sync: $(INTERNAL_VENDORIMAGE_FILES)
@@ -2867,12 +3174,12 @@
 INSTALLED_FILES_FILE_PRODUCT := $(PRODUCT_OUT)/installed-files-product.txt
 INSTALLED_FILES_JSON_PRODUCT := $(INSTALLED_FILES_FILE_PRODUCT:.txt=.json)
 $(INSTALLED_FILES_FILE_PRODUCT): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_PRODUCT)
-$(INSTALLED_FILES_FILE_PRODUCT) : $(INTERNAL_PRODUCTIMAGE_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_PRODUCT) : $(INTERNAL_PRODUCTIMAGE_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_OUT_PRODUCT) > $(@:.txt=.json)
-	$(hide) build/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 productimage_intermediates := \
     $(call intermediates-dir-for,PACKAGING,product)
@@ -2882,15 +3189,19 @@
   @mkdir -p $(TARGET_OUT_PRODUCT)
   @mkdir -p $(productimage_intermediates) && rm -rf $(productimage_intermediates)/product_image_info.txt
   $(call generate-image-prop-dictionary, $(productimage_intermediates)/product_image_info.txt,product,skip_fsck=true)
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      ./build/tools/releasetools/build_image.py \
-      $(TARGET_OUT_PRODUCT) $(productimage_intermediates)/product_image_info.txt $(INSTALLED_PRODUCTIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_PRODUCTIMAGE_TARGET),$(BOARD_PRODUCTIMAGE_PARTITION_SIZE))
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_PRODUCT) $(productimage_intermediates)/product_image_info.txt \
+          $(INSTALLED_PRODUCTIMAGE_TARGET) $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_PRODUCTIMAGE_TARGET),$(BOARD_PRODUCTIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
 INSTALLED_PRODUCTIMAGE_TARGET := $(BUILT_PRODUCTIMAGE_TARGET)
-$(INSTALLED_PRODUCTIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_PRODUCTIMAGE_FILES) $(INSTALLED_FILES_FILE_PRODUCT) $(BUILD_IMAGE_SRCS)
+$(INSTALLED_PRODUCTIMAGE_TARGET): \
+    $(INTERNAL_USERIMAGES_DEPS) \
+    $(INTERNAL_PRODUCTIMAGE_FILES) \
+    $(INSTALLED_FILES_FILE_PRODUCT)
 	$(build-productimage-target)
 
 .PHONY: productimage-nodeps pnod
@@ -2905,80 +3216,61 @@
 endif
 
 # -----------------------------------------------------------------
-# Final Framework VINTF manifest including fragments. This is not assembled
-# on the device because it depends on everything in a given device
-# image which defines a vintf_fragment.
-
-BUILT_ASSEMBLED_FRAMEWORK_MANIFEST := $(PRODUCT_OUT)/verified_assembled_framework_manifest.xml
-$(BUILT_ASSEMBLED_FRAMEWORK_MANIFEST): $(HOST_OUT_EXECUTABLES)/assemble_vintf \
-                                       $(BUILT_VENDOR_MATRIX) \
-                                       $(BUILT_SYSTEM_MANIFEST) \
-                                       $(FULL_SYSTEMIMAGE_DEPS) \
-                                       $(BUILT_PRODUCT_MANIFEST) \
-                                       $(BUILT_PRODUCTIMAGE_TARGET)
-	@echo "Verifying framework VINTF manifest."
-	PRODUCT_ENFORCE_VINTF_MANIFEST=$(PRODUCT_ENFORCE_VINTF_MANIFEST) \
-	$(HOST_OUT_EXECUTABLES)/assemble_vintf \
-	    -o $@ \
-	    -c $(BUILT_VENDOR_MATRIX) \
-	    -i $(BUILT_SYSTEM_MANIFEST) \
-	    $(addprefix -i ,\
-	      $(filter $(TARGET_OUT)/etc/vintf/manifest/%.xml,$(FULL_SYSTEMIMAGE_DEPS)) \
-	      $(BUILT_PRODUCT_MANIFEST) \
-	      $(filter $(TARGET_OUT_PRODUCT)/etc/vintf/manifest/%.xml,$(INTERNAL_PRODUCTIMAGE_FILES)))
-
-droidcore: $(BUILT_ASSEMBLED_FRAMEWORK_MANIFEST)
-
-# -----------------------------------------------------------------
-# product_services partition image
-ifdef BUILDING_PRODUCT_SERVICES_IMAGE
-INTERNAL_PRODUCT_SERVICESIMAGE_FILES := \
-    $(filter $(TARGET_OUT_PRODUCT_SERVICES)/%,\
+# system_ext partition image
+ifdef BUILDING_SYSTEM_EXT_IMAGE
+INTERNAL_SYSTEM_EXTIMAGE_FILES := \
+    $(filter $(TARGET_OUT_SYSTEM_EXT)/%,\
       $(ALL_DEFAULT_INSTALLED_MODULES)\
       $(ALL_PDK_FUSION_FILES)) \
     $(PDK_FUSION_SYMLINK_STAMP)
 
-# platform.zip depends on $(INTERNAL_PRODUCT_SERVICESIMAGE_FILES).
-$(INSTALLED_PLATFORM_ZIP) : $(INTERNAL_PRODUCT_SERVICESIMAGE_FILES)
+# platform.zip depends on $(INTERNAL_SYSTEM_EXTIMAGE_FILES).
+$(INSTALLED_PLATFORM_ZIP) : $(INTERNAL_SYSTEM_EXTIMAGE_FILES)
 
-INSTALLED_FILES_FILE_PRODUCT_SERVICES := $(PRODUCT_OUT)/installed-files-product_services.txt
-INSTALLED_FILES_JSON_PRODUCT_SERVICES := $(INSTALLED_FILES_FILE_PRODUCT_SERVICES:.txt=.json)
-$(INSTALLED_FILES_FILE_PRODUCT_SERVICES): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_PRODUCT_SERVICES)
-$(INSTALLED_FILES_FILE_PRODUCT_SERVICES) : $(INTERNAL_PRODUCT_SERVICESIMAGE_FILES) $(FILESLIST)
+INSTALLED_FILES_FILE_SYSTEM_EXT := $(PRODUCT_OUT)/installed-files-system_ext.txt
+INSTALLED_FILES_JSON_SYSTEM_EXT := $(INSTALLED_FILES_FILE_SYSTEM_EXT:.txt=.json)
+$(INSTALLED_FILES_FILE_SYSTEM_EXT): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_SYSTEM_EXT)
+$(INSTALLED_FILES_FILE_SYSTEM_EXT) : $(INTERNAL_SYSTEM_EXTIMAGE_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
-	$(hide) $(FILESLIST) $(TARGET_OUT_PRODUCT_SERVICES) > $(@:.txt=.json)
-	$(hide) build/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST) $(TARGET_OUT_SYSTEM_EXT) > $(@:.txt=.json)
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
-product_servicesimage_intermediates := \
-    $(call intermediates-dir-for,PACKAGING,product_services)
-BUILT_PRODUCT_SERVICESIMAGE_TARGET := $(PRODUCT_OUT)/product_services.img
-define build-product_servicesimage-target
-  $(call pretty,"Target product_services fs image: $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET)")
-  @mkdir -p $(TARGET_OUT_PRODUCT_SERVICES)
-  @mkdir -p $(product_servicesimage_intermediates) && rm -rf $(product_servicesimage_intermediates)/product_services_image_info.txt
-  $(call generate-image-prop-dictionary, $(product_servicesimage_intermediates)/product_services_image_info.txt,product_services, skip_fsck=true)
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      ./build/tools/releasetools/build_image.py \
-      $(TARGET_OUT_PRODUCT_SERVICES) $(product_servicesimage_intermediates)/product_services_image_info.txt $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET),$(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE))
+system_extimage_intermediates := \
+    $(call intermediates-dir-for,PACKAGING,system_ext)
+BUILT_SYSTEM_EXTIMAGE_TARGET := $(PRODUCT_OUT)/system_ext.img
+define build-system_extimage-target
+  $(call pretty,"Target system_ext fs image: $(INSTALLED_SYSTEM_EXTIMAGE_TARGET)")
+  @mkdir -p $(TARGET_OUT_SYSTEM_EXT)
+  @mkdir -p $(system_extimage_intermediates) && rm -rf $(system_extimage_intermediates)/system_ext_image_info.txt
+  $(call generate-image-prop-dictionary, $(system_extimage_intermediates)/system_ext_image_info.txt,system_ext, skip_fsck=true)
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_SYSTEM_EXT) \
+          $(system_extimage_intermediates)/system_ext_image_info.txt \
+          $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) \
+          $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET),$(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
-INSTALLED_PRODUCT_SERVICESIMAGE_TARGET := $(BUILT_PRODUCT_SERVICESIMAGE_TARGET)
-$(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_PRODUCT_SERVICESIMAGE_FILES) $(INSTALLED_FILES_FILE_PRODUCT_SERVICES) $(BUILD_IMAGE_SRCS)
-	$(build-product_servicesimage-target)
+INSTALLED_SYSTEM_EXTIMAGE_TARGET := $(BUILT_SYSTEM_EXTIMAGE_TARGET)
+$(INSTALLED_SYSTEM_EXTIMAGE_TARGET): \
+    $(INTERNAL_USERIMAGES_DEPS) \
+    $(INTERNAL_SYSTEM_EXTIMAGE_FILES) \
+    $(INSTALLED_FILES_FILE_SYSTEM_EXT)
+	$(build-system_extimage-target)
 
-.PHONY: productservicesimage-nodeps psnod
-productservicesimage-nodeps psnod: | $(INTERNAL_USERIMAGES_DEPS)
-	$(build-product_servicesimage-target)
+.PHONY: systemextimage-nodeps senod
+systemextimage-nodeps senod: | $(INTERNAL_USERIMAGES_DEPS)
+	$(build-system_extimage-target)
 
-sync: $(INTERNAL_PRODUCT_SERVICESIMAGE_FILES)
+sync: $(INTERNAL_SYSTEM_EXTIMAGE_FILES)
 
-else ifdef BOARD_PREBUILT_PRODUCT_SERVICESIMAGE
-INSTALLED_PRODUCT_SERVICESIMAGE_TARGET := $(PRODUCT_OUT)/product_services.img
-$(eval $(call copy-one-file,$(BOARD_PREBUILT_PRODUCT_SERVICESIMAGE),$(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET)))
+else ifdef BOARD_PREBUILT_SYSTEM_EXTIMAGE
+INSTALLED_SYSTEM_EXTIMAGE_TARGET := $(PRODUCT_OUT)/system_ext.img
+$(eval $(call copy-one-file,$(BOARD_PREBUILT_SYSTEM_EXTIMAGE),$(INSTALLED_SYSTEM_EXTIMAGE_TARGET)))
 endif
 
 # -----------------------------------------------------------------
@@ -2995,12 +3287,12 @@
 INSTALLED_FILES_FILE_ODM := $(PRODUCT_OUT)/installed-files-odm.txt
 INSTALLED_FILES_JSON_ODM := $(INSTALLED_FILES_FILE_ODM:.txt=.json)
 $(INSTALLED_FILES_FILE_ODM): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_ODM)
-$(INSTALLED_FILES_FILE_ODM) : $(INTERNAL_ODMIMAGE_FILES) $(FILESLIST)
+$(INSTALLED_FILES_FILE_ODM) : $(INTERNAL_ODMIMAGE_FILES) $(FILESLIST) $(FILESLIST_UTIL)
 	@echo Installed file list: $@
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_OUT_ODM) > $(@:.txt=.json)
-	$(hide) build/tools/fileslist_util.py -c $(@:.txt=.json) > $@
+	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
 odmimage_intermediates := \
     $(call intermediates-dir-for,PACKAGING,odm)
@@ -3010,21 +3302,23 @@
   @mkdir -p $(TARGET_OUT_ODM)
   @mkdir -p $(odmimage_intermediates) && rm -rf $(odmimage_intermediates)/odm_image_info.txt
   $(call generate-userimage-prop-dictionary, $(odmimage_intermediates)/odm_image_info.txt, skip_fsck=true)
-  $(if $(BOARD_ODM_KERNEL_MODULES), \
-    $(call build-image-kernel-modules,$(BOARD_ODM_KERNEL_MODULES),$(TARGET_OUT_ODM),odm/,$(call intermediates-dir-for,PACKAGING,depmod_odm)))
-  $(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-      ./build/tools/releasetools/build_image.py \
-      $(TARGET_OUT_ODM) $(odmimage_intermediates)/odm_image_info.txt $(INSTALLED_ODMIMAGE_TARGET) $(TARGET_OUT)
-  $(hide) $(call assert-max-image-size,$(INSTALLED_ODMIMAGE_TARGET),$(BOARD_ODMIMAGE_PARTITION_SIZE))
+  PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+      $(BUILD_IMAGE) \
+          $(TARGET_OUT_ODM) $(odmimage_intermediates)/odm_image_info.txt \
+          $(INSTALLED_ODMIMAGE_TARGET) $(TARGET_OUT)
+  $(call assert-max-image-size,$(INSTALLED_ODMIMAGE_TARGET),$(BOARD_ODMIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
 INSTALLED_ODMIMAGE_TARGET := $(BUILT_ODMIMAGE_TARGET)
-$(INSTALLED_ODMIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_ODMIMAGE_FILES) $(INSTALLED_FILES_FILE_ODM) $(BUILD_IMAGE_SRCS) $(DEPMOD) $(BOARD_ODM_KERNEL_MODULES)
+$(INSTALLED_ODMIMAGE_TARGET): \
+    $(INTERNAL_USERIMAGES_DEPS) \
+    $(INTERNAL_ODMIMAGE_FILES) \
+    $(INSTALLED_FILES_FILE_ODM)
 	$(build-odmimage-target)
 
 .PHONY: odmimage-nodeps onod
-odmimage-nodeps onod: | $(INTERNAL_USERIMAGES_DEPS) $(DEPMOD)
+odmimage-nodeps onod: | $(INTERNAL_USERIMAGES_DEPS)
 	$(build-odmimage-target)
 
 sync: $(INTERNAL_ODMIMAGE_FILES)
@@ -3057,12 +3351,47 @@
 # Returns a list of image targets corresponding to the given list of partitions. For example, it
 # returns "$(INSTALLED_PRODUCTIMAGE_TARGET)" for "product", or "$(INSTALLED_SYSTEMIMAGE_TARGET)
 # $(INSTALLED_VENDORIMAGE_TARGET)" for "system vendor".
-# (1): list of partitions like "system", "vendor" or "system product product_services".
+# (1): list of partitions like "system", "vendor" or "system product system_ext".
 define images-for-partitions
 $(strip $(foreach item,$(1),$(INSTALLED_$(call to-upper,$(item))IMAGE_TARGET)))
 endef
 
 # -----------------------------------------------------------------
+# custom images
+INSTALLED_CUSTOMIMAGES_TARGET :=
+
+ifneq ($(strip $(BOARD_CUSTOMIMAGES_PARTITION_LIST)),)
+INTERNAL_AVB_CUSTOMIMAGES_SIGNING_ARGS :=
+
+# Sign custom image.
+# $(1): the prebuilt custom image.
+# $(2): the mount point of the prebuilt custom image.
+# $(3): the signed custom image target.
+define sign_custom_image
+$(3): $(1) $(INTERNAL_USERIMAGES_DEPS)
+	@echo Target custom image: $(3)
+	mkdir -p $(dir $(3))
+	cp $(1) $(3)
+ifeq ($(BOARD_AVB_ENABLE),true)
+	PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$$$PATH \
+          $(AVBTOOL) add_hashtree_footer \
+          --image $(3) \
+          --key $(BOARD_AVB_$(call to-upper,$(2))_KEY_PATH) \
+          --algorithm $(BOARD_AVB_$(call to-upper,$(2))_ALGORITHM) \
+          --partition_size $(BOARD_AVB_$(call to-upper,$(2))_PARTITION_SIZE) \
+          --partition_name $(2) \
+          $(INTERNAL_AVB_CUSTOMIMAGES_SIGNING_ARGS) \
+          $(BOARD_AVB_$(call to-upper,$(2))_ADD_HASHTREE_FOOTER_ARGS)
+endif
+INSTALLED_CUSTOMIMAGES_TARGET += $(3)
+endef
+
+$(foreach partition,$(BOARD_CUSTOMIMAGES_PARTITION_LIST), \
+  $(foreach image,$(BOARD_AVB_$(call to-upper,$(partition))_IMAGE_LIST), \
+     $(eval $(call sign_custom_image,$(image),$(partition),$(PRODUCT_OUT)/$(notdir $(image))))))
+endif
+
+# -----------------------------------------------------------------
 # vbmeta image
 ifeq ($(BOARD_AVB_ENABLE),true)
 
@@ -3109,28 +3438,54 @@
   $(error BOARD_AVB_VBMETA_SYSTEM and BOARD_AVB_VBMETA_VENDOR cannot have duplicates)
 endif
 
+# When building a standalone recovery image for non-A/B devices, recovery image must be self-signed
+# to be verified independently, and cannot be chained into vbmeta.img. See the link below for
+# details.
+ifeq ($(TARGET_OTA_ALLOW_NON_AB),true)
+ifneq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
+$(if $(BOARD_AVB_RECOVERY_KEY_PATH),,\
+    $(error BOARD_AVB_RECOVERY_KEY_PATH must be defined for if non-A/B is supported. \
+            See https://android.googlesource.com/platform/external/avb/+/master/README.md#booting-into-recovery))
+endif
+endif
+
 # Appends os version and security patch level as a AVB property descriptor
 
 BOARD_AVB_SYSTEM_ADD_HASHTREE_FOOTER_ARGS += \
-    --prop com.android.build.system.os_version:$(PLATFORM_VERSION) \
+    --prop com.android.build.system.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+    --prop com.android.build.system.os_version:$(PLATFORM_VERSION_LAST_STABLE) \
     --prop com.android.build.system.security_patch:$(PLATFORM_SECURITY_PATCH)
 
 BOARD_AVB_PRODUCT_ADD_HASHTREE_FOOTER_ARGS += \
-    --prop com.android.build.product.os_version:$(PLATFORM_VERSION) \
+    --prop com.android.build.product.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+    --prop com.android.build.product.os_version:$(PLATFORM_VERSION_LAST_STABLE) \
     --prop com.android.build.product.security_patch:$(PLATFORM_SECURITY_PATCH)
 
-BOARD_AVB_PRODUCT_SERVICES_ADD_HASHTREE_FOOTER_ARGS += \
-    --prop com.android.build.product_services.os_version:$(PLATFORM_VERSION) \
-    --prop com.android.build.product_services.security_patch:$(PLATFORM_SECURITY_PATCH)
+BOARD_AVB_SYSTEM_EXT_ADD_HASHTREE_FOOTER_ARGS += \
+    --prop com.android.build.system_ext.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+    --prop com.android.build.system_ext.os_version:$(PLATFORM_VERSION_LAST_STABLE) \
+    --prop com.android.build.system_ext.security_patch:$(PLATFORM_SECURITY_PATCH)
 
 BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS += \
-    --prop com.android.build.boot.os_version:$(PLATFORM_VERSION)
+    --prop com.android.build.boot.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+    --prop com.android.build.boot.os_version:$(PLATFORM_VERSION_LAST_STABLE)
+
+BOARD_AVB_VENDOR_BOOT_ADD_HASH_FOOTER_ARGS += \
+    --prop com.android.build.vendor_boot.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+
+BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS += \
+    --prop com.android.build.recovery.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE)
 
 BOARD_AVB_VENDOR_ADD_HASHTREE_FOOTER_ARGS += \
-    --prop com.android.build.vendor.os_version:$(PLATFORM_VERSION)
+    --prop com.android.build.vendor.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+    --prop com.android.build.vendor.os_version:$(PLATFORM_VERSION_LAST_STABLE)
 
 BOARD_AVB_ODM_ADD_HASHTREE_FOOTER_ARGS += \
-    --prop com.android.build.odm.os_version:$(PLATFORM_VERSION)
+    --prop com.android.build.odm.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE) \
+    --prop com.android.build.odm.os_version:$(PLATFORM_VERSION_LAST_STABLE)
+
+BOARD_AVB_DTBO_ADD_HASH_FOOTER_ARGS += \
+    --prop com.android.build.dtbo.fingerprint:$(BUILD_FINGERPRINT_FROM_FILE)
 
 # The following vendor- and odm-specific images needs explicit SPL set per board.
 ifdef BOOT_SECURITY_PATCH
@@ -3149,12 +3504,13 @@
 endif
 
 BOOT_FOOTER_ARGS := BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS
+VENDOR_BOOT_FOOTER_ARGS := BOARD_AVB_VENDOR_BOOT_ADD_HASH_FOOTER_ARGS
 DTBO_FOOTER_ARGS := BOARD_AVB_DTBO_ADD_HASH_FOOTER_ARGS
 SYSTEM_FOOTER_ARGS := BOARD_AVB_SYSTEM_ADD_HASHTREE_FOOTER_ARGS
 VENDOR_FOOTER_ARGS := BOARD_AVB_VENDOR_ADD_HASHTREE_FOOTER_ARGS
 RECOVERY_FOOTER_ARGS := BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS
 PRODUCT_FOOTER_ARGS := BOARD_AVB_PRODUCT_ADD_HASHTREE_FOOTER_ARGS
-PRODUCT_SERVICES_FOOTER_ARGS := BOARD_AVB_PRODUCT_SERVICES_ADD_HASHTREE_FOOTER_ARGS
+SYSTEM_EXT_FOOTER_ARGS := BOARD_AVB_SYSTEM_EXT_ADD_HASHTREE_FOOTER_ARGS
 ODM_FOOTER_ARGS := BOARD_AVB_ODM_ADD_HASHTREE_FOOTER_ARGS
 
 # Helper function that checks and sets required build variables for an AVB chained partition.
@@ -3177,8 +3533,11 @@
 $(eval $(_signing_args) := \
     --algorithm $($(_signing_algorithm)) --key $($(_key_path)))
 
-$(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
-    --chain_partition $(part):$($(_rollback_index_location)):$(AVB_CHAIN_KEY_DIR)/$(part).avbpubkey)
+# The recovery partition in non-A/B devices should be verified separately. Skip adding the chain
+# partition descriptor for recovery partition into vbmeta.img.
+$(if $(or $(filter-out true,$(TARGET_OTA_ALLOW_NON_AB)),$(filter-out recovery,$(part))),\
+    $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
+        --chain_partition $(part):$($(_rollback_index_location)):$(AVB_CHAIN_KEY_DIR)/$(part).avbpubkey))
 
 # Set rollback_index via footer args for non-chained vbmeta image. Chained vbmeta image will pick up
 # the index via a separate flag (e.g. BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX).
@@ -3191,6 +3550,9 @@
 # configured as a chained partition, if BOARD_AVB_<partition>_KEY_PATH is defined. Otherwise the
 # image descriptor will be included into vbmeta.img, unless it has been already added to any chained
 # VBMeta image.
+# Multiple boot images can be generated based on BOARD_KERNEL_BINARIES
+# but vbmeta would capture the image descriptor of only the first boot
+# image specified in BUILT_BOOTIMAGE_TARGET.
 # $(1): Partition name, e.g. boot or system.
 define check-and-set-avb-args
 $(eval _in_chained_vbmeta := $(filter $(1),$(INTERNAL_AVB_PARTITIONS_IN_CHAINED_VBMETA_IMAGES)))
@@ -3199,14 +3561,33 @@
         $(error Chaining partition "$(1)" in chained VBMeta image is not supported)) \
     $(call _check-and-set-avb-chain-args,$(1)),\
     $(if $(_in_chained_vbmeta),,\
-        $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
-            --include_descriptors_from_image $(call images-for-partitions,$(1)))))
+        $(if $(filter boot,$(1)),\
+            $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
+                --include_descriptors_from_image $(firstword $(call images-for-partitions,$(1)))),\
+            $(eval INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
+                --include_descriptors_from_image $(call images-for-partitions,$(1))))))
+endef
+
+# Checks and sets build variables for a custom chained partition to include it into vbmeta.img.
+# $(1): the custom partition to enable AVB chain.
+define check-and-set-custom-avb-chain-args
+$(eval part := $(1))
+$(eval PART=$(call to-upper,$(part)))
+$(eval _rollback_index_location := BOARD_AVB_$(PART)_ROLLBACK_INDEX_LOCATION)
+$(if $($(_rollback_index_location)),,$(error $(_rollback_index_location) is not defined))
+
+INTERNAL_AVB_MAKE_VBMETA_IMAGE_ARGS += \
+    --chain_partition $(part):$($(_rollback_index_location)):$(AVB_CHAIN_KEY_DIR)/$(part).avbpubkey
 endef
 
 ifdef INSTALLED_BOOTIMAGE_TARGET
 $(eval $(call check-and-set-avb-args,boot))
 endif
 
+ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
+$(eval $(call check-and-set-avb-args,vendor_boot))
+endif
+
 $(eval $(call check-and-set-avb-args,system))
 
 ifdef INSTALLED_VENDORIMAGE_TARGET
@@ -3217,8 +3598,8 @@
 $(eval $(call check-and-set-avb-args,product))
 endif
 
-ifdef INSTALLED_PRODUCT_SERVICESIMAGE_TARGET
-$(eval $(call check-and-set-avb-args,product_services))
+ifdef INSTALLED_SYSTEM_EXTIMAGE_TARGET
+$(eval $(call check-and-set-avb-args,system_ext))
 endif
 
 ifdef INSTALLED_ODMIMAGE_TARGET
@@ -3242,6 +3623,11 @@
 $(eval $(call check-and-set-avb-args,vbmeta_vendor))
 endif
 
+ifneq ($(strip $(BOARD_CUSTOMIMAGES_PARTITION_LIST)),)
+$(foreach partition,$(BOARD_CUSTOMIMAGES_PARTITION_LIST), \
+    $(eval $(call check-and-set-custom-avb-chain-args,$(partition))))
+endif
+
 # Add kernel cmdline descriptor for kernel to mount system.img as root with
 # dm-verity. This works when system.img is either chained or not-chained:
 # - chained: The --setup_as_rootfs_from_kernel option will add dm-verity kernel
@@ -3282,6 +3668,9 @@
   $(if $(BOARD_AVB_BOOT_KEY_PATH),\
     $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_BOOT_KEY_PATH) \
       --output $(1)/boot.avbpubkey)
+  $(if $(BOARD_AVB_VENDOR_BOOT_KEY_PATH),\
+    $(AVBTOOL) extract_public_key --key $(BOARD_AVB_VENDOR_BOOT_KEY_PATH) \
+      --output $(1)/vendor_boot.avbpubkey)
   $(if $(BOARD_AVB_SYSTEM_KEY_PATH),\
     $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_SYSTEM_KEY_PATH) \
       --output $(1)/system.avbpubkey)
@@ -3291,9 +3680,9 @@
   $(if $(BOARD_AVB_PRODUCT_KEY_PATH),\
     $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_PRODUCT_KEY_PATH) \
       --output $(1)/product.avbpubkey)
-  $(if $(BOARD_AVB_PRODUCT_SERVICES_KEY_PATH),\
-    $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_PRODUCT_SERVICES_KEY_PATH) \
-      --output $(1)/product_services.avbpubkey)
+  $(if $(BOARD_AVB_SYSTEM_EXT_KEY_PATH),\
+    $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_SYSTEM_EXT_KEY_PATH) \
+      --output $(1)/system_ext.avbpubkey)
   $(if $(BOARD_AVB_ODM_KEY_PATH),\
     $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_ODM_KEY_PATH) \
       --output $(1)/odm.avbpubkey)
@@ -3309,13 +3698,17 @@
   $(if $(BOARD_AVB_VBMETA_VENDOR_KEY_PATH),\
     $(hide) $(AVBTOOL) extract_public_key --key $(BOARD_AVB_VBMETA_VENDOR_KEY_PATH) \
         --output $(1)/vbmeta_vendor.avbpubkey)
+  $(if $(BOARD_CUSTOMIMAGES_PARTITION_LIST),\
+    $(hide) $(foreach partition,$(BOARD_CUSTOMIMAGES_PARTITION_LIST), \
+        $(AVBTOOL) extract_public_key --key $(BOARD_AVB_$(call to-upper,$(partition))_KEY_PATH) \
+            --output $(1)/$(partition).avbpubkey;))
 endef
 
 # Builds a chained VBMeta image. This VBMeta image will contain the descriptors for the partitions
 # specified in BOARD_AVB_VBMETA_<NAME>. The built VBMeta image will be included into the top-level
 # vbmeta image as a chained partition. For example, if a target defines `BOARD_AVB_VBMETA_SYSTEM
-# := system product_services`, `vbmeta_system.img` will be created that includes the descriptors
-# for `system.img` and `product_services.img`. `vbmeta_system.img` itself will be included into
+# := system system_ext`, `vbmeta_system.img` will be created that includes the descriptors for
+# `system.img` and `system_ext.img`. `vbmeta_system.img` itself will be included into
 # `vbmeta.img` as a chained partition.
 # $(1): VBMeta image name, such as "vbmeta_system", "vbmeta_vendor" etc.
 # $(2): Output filename.
@@ -3329,6 +3722,7 @@
       --output $@
 endef
 
+ifdef BUILDING_SYSTEM_IMAGE
 ifdef BOARD_AVB_VBMETA_SYSTEM
 INSTALLED_VBMETA_SYSTEMIMAGE_TARGET := $(PRODUCT_OUT)/vbmeta_system.img
 $(INSTALLED_VBMETA_SYSTEMIMAGE_TARGET): \
@@ -3337,6 +3731,7 @@
 	    $(BOARD_AVB_VBMETA_SYSTEM_KEY_PATH)
 	$(call build-chained-vbmeta-image,vbmeta_system)
 endif
+endif # BUILDING_SYSTEM_IMAGE
 
 ifdef BOARD_AVB_VBMETA_VENDOR
 INSTALLED_VBMETA_VENDORIMAGE_TARGET := $(PRODUCT_OUT)/vbmeta_vendor.img
@@ -3359,6 +3754,7 @@
   $(hide) rm -rf $(AVB_CHAIN_KEY_DIR)
 endef
 
+ifdef BUILDING_VBMETA_IMAGE
 INSTALLED_VBMETAIMAGE_TARGET := $(BUILT_VBMETAIMAGE_TARGET)
 $(INSTALLED_VBMETAIMAGE_TARGET): PRIVATE_AVB_VBMETA_SIGNING_ARGS := \
     --algorithm $(BOARD_AVB_ALGORITHM) --key $(BOARD_AVB_KEY_PATH)
@@ -3366,12 +3762,14 @@
 $(INSTALLED_VBMETAIMAGE_TARGET): \
 	    $(AVBTOOL) \
 	    $(INSTALLED_BOOTIMAGE_TARGET) \
+	    $(INSTALLED_VENDOR_BOOTIMAGE_TARGET) \
 	    $(INSTALLED_SYSTEMIMAGE_TARGET) \
 	    $(INSTALLED_VENDORIMAGE_TARGET) \
 	    $(INSTALLED_PRODUCTIMAGE_TARGET) \
-	    $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) \
+	    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) \
 	    $(INSTALLED_ODMIMAGE_TARGET) \
 	    $(INSTALLED_DTBOIMAGE_TARGET) \
+	    $(INSTALLED_CUSTOMIMAGES_TARGET) \
 	    $(INSTALLED_RECOVERYIMAGE_TARGET) \
 	    $(INSTALLED_VBMETA_SYSTEMIMAGE_TARGET) \
 	    $(INSTALLED_VBMETA_VENDORIMAGE_TARGET) \
@@ -3381,12 +3779,226 @@
 	$(build-vbmetaimage-target)
 
 .PHONY: vbmetaimage-nodeps
+vbmetaimage-nodeps: PRIVATE_AVB_VBMETA_SIGNING_ARGS := \
+    --algorithm $(BOARD_AVB_ALGORITHM) --key $(BOARD_AVB_KEY_PATH)
 vbmetaimage-nodeps:
 	$(build-vbmetaimage-target)
+endif # BUILDING_VBMETA_IMAGE
 
 endif # BOARD_AVB_ENABLE
 
 # -----------------------------------------------------------------
+# Check VINTF of build
+
+ifndef TARGET_BUILD_APPS
+intermediates := $(call intermediates-dir-for,PACKAGING,check_vintf_all)
+check_vintf_all_deps :=
+
+# The build system only writes VINTF metadata to */etc/vintf paths. Legacy paths aren't needed here
+# because they are only used for prebuilt images.
+check_vintf_common_srcs_patterns := \
+  $(TARGET_OUT)/etc/vintf/% \
+  $(TARGET_OUT_VENDOR)/etc/vintf/% \
+  $(TARGET_OUT_ODM)/etc/vintf/% \
+  $(TARGET_OUT_PRODUCT)/etc/vintf/% \
+  $(TARGET_OUT_SYSTEM_EXT)/etc/vintf/% \
+
+check_vintf_common_srcs := $(sort $(filter $(check_vintf_common_srcs_patterns), \
+  $(INTERNAL_SYSTEMIMAGE_FILES) \
+  $(INTERNAL_VENDORIMAGE_FILES) \
+  $(INTERNAL_ODMIMAGE_FILES) \
+  $(INTERNAL_PRODUCTIMAGE_FILES) \
+  $(INTERNAL_SYSTEM_EXTIMAGE_FILES) \
+))
+check_vintf_common_srcs_patterns :=
+
+check_vintf_has_system :=
+check_vintf_has_vendor :=
+
+ifneq (,$(filter EMPTY_ODM_SKU_PLACEHOLDER,$(ODM_MANIFEST_SKUS)))
+$(error EMPTY_ODM_SKU_PLACEHOLDER is an internal variable and cannot be used for ODM_MANIFEST_SKUS)
+endif
+ifneq (,$(filter EMPTY_VENDOR_SKU_PLACEHOLDER,$(DEVICE_MANIFEST_SKUS)))
+$(error EMPTY_VENDOR_SKU_PLACEHOLDER is an internal variable and cannot be used for DEIVCE_MANIFEST_SKUS)
+endif
+
+# -- Check system manifest / matrix including fragments (excluding other framework manifests / matrices, e.g. product);
+check_vintf_system_deps := $(filter $(TARGET_OUT)/etc/vintf/%, $(check_vintf_common_srcs))
+ifneq ($(check_vintf_system_deps),)
+check_vintf_has_system := true
+check_vintf_system_log := $(intermediates)/check_vintf_system_log
+check_vintf_all_deps += $(check_vintf_system_log)
+$(check_vintf_system_log): $(HOST_OUT_EXECUTABLES)/checkvintf $(check_vintf_system_deps)
+	@( $< --check-one --dirmap /system:$(TARGET_OUT) > $@ 2>&1 ) || ( cat $@ && exit 1 )
+check_vintf_system_log :=
+endif # check_vintf_system_deps
+check_vintf_system_deps :=
+
+# -- Check vendor manifest / matrix including fragments (excluding other device manifests / matrices)
+check_vintf_vendor_deps := $(filter $(TARGET_OUT_VENDOR)/etc/vintf/%, $(check_vintf_common_srcs))
+ifneq ($(check_vintf_vendor_deps),)
+check_vintf_has_vendor := true
+check_vintf_vendor_log := $(intermediates)/check_vintf_vendor_log
+check_vintf_all_deps += $(check_vintf_vendor_log)
+# Check vendor SKU=(empty) case when:
+# - DEVICE_MANIFEST_FILE is not empty; OR
+# - DEVICE_MANIFEST_FILE is empty AND DEVICE_MANIFEST_SKUS is empty (only vendor manifest fragments are used)
+$(check_vintf_vendor_log): PRIVATE_VENDOR_SKUS := \
+  $(if $(DEVICE_MANIFEST_FILE),EMPTY_VENDOR_SKU_PLACEHOLDER,\
+    $(if $(DEVICE_MANIFEST_SKUS),,EMPTY_VENDOR_SKU_PLACEHOLDER)) \
+  $(DEVICE_MANIFEST_SKUS)
+$(check_vintf_vendor_log): $(HOST_OUT_EXECUTABLES)/checkvintf $(check_vintf_vendor_deps)
+	$(foreach vendor_sku,$(PRIVATE_VENDOR_SKUS), \
+	  ( $< --check-one --dirmap /vendor:$(TARGET_OUT_VENDOR) \
+	       --property ro.boot.product.vendor.sku=$(filter-out EMPTY_VENDOR_SKU_PLACEHOLDER,$(vendor_sku)) \
+	       > $@ 2>&1 ) || ( cat $@ && exit 1 ); )
+check_vintf_vendor_log :=
+endif # check_vintf_vendor_deps
+check_vintf_vendor_deps :=
+
+# -- Check VINTF compatibility of build.
+# Skip partial builds; only check full builds. Only check if:
+# - PRODUCT_ENFORCE_VINTF_MANIFEST is true
+# - system / vendor VINTF metadata exists
+# - Building product / system_ext / odm images if board has product / system_ext / odm images
+ifeq ($(PRODUCT_ENFORCE_VINTF_MANIFEST),true)
+ifeq ($(check_vintf_has_system),true)
+ifeq ($(check_vintf_has_vendor),true)
+ifeq ($(filter true,$(BUILDING_ODM_IMAGE)),$(filter true,$(BOARD_USES_ODMIMAGE)))
+ifeq ($(filter true,$(BUILDING_PRODUCT_IMAGE)),$(filter true,$(BOARD_USES_PRODUCTIMAGE)))
+ifeq ($(filter true,$(BUILDING_SYSTEM_EXT_IMAGE)),$(filter true,$(BOARD_USES_SYSTEM_EXTIMAGE)))
+
+check_vintf_compatible_log := $(intermediates)/check_vintf_compatible_log
+check_vintf_all_deps += $(check_vintf_compatible_log)
+
+check_vintf_compatible_args :=
+check_vintf_compatible_deps := $(check_vintf_common_srcs)
+
+# -- Kernel version and configurations.
+ifeq ($(PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS),true)
+
+BUILT_KERNEL_CONFIGS_FILE := $(intermediates)/kernel_configs.txt
+BUILT_KERNEL_VERSION_FILE := $(intermediates)/kernel_version.txt
+
+my_board_extracted_kernel :=
+
+# BOARD_KERNEL_CONFIG_FILE and BOARD_KERNEL_VERSION can be used to override the values extracted
+# from INSTALLED_KERNEL_TARGET.
+ifdef BOARD_KERNEL_CONFIG_FILE
+ifdef BOARD_KERNEL_VERSION
+$(BUILT_KERNEL_CONFIGS_FILE): $(BOARD_KERNEL_CONFIG_FILE)
+	cp $< $@
+$(BUILT_KERNEL_VERSION_FILE):
+	echo $(BOARD_KERNEL_VERSION) > $@
+
+my_board_extracted_kernel := true
+endif # BOARD_KERNEL_VERSION
+endif # BOARD_KERNEL_CONFIG_FILE
+
+ifneq ($(my_board_extracted_kernel),true)
+ifndef INSTALLED_KERNEL_TARGET
+$(warning No INSTALLED_KERNEL_TARGET is defined when PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS \
+    is true. Information about the updated kernel cannot be built into OTA update package. \
+    You can fix this by: (1) setting TARGET_NO_KERNEL to false and installing the built kernel \
+    to $(PRODUCT_OUT)/kernel, so that kernel information will be extracted from the built kernel; \
+    or (2) extracting kernel configuration and defining BOARD_KERNEL_CONFIG_FILE and \
+    BOARD_KERNEL_VERSION manually; or (3) unsetting PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS \
+    manually.)
+else
+
+# Tools for decompression that is not in PATH.
+# Check $(EXTRACT_KERNEL) for decompression algorithms supported by the script.
+# Algorithms that are in the script but not in this list will be found in PATH.
+my_decompress_tools := \
+    lz4:$(HOST_OUT_EXECUTABLES)/lz4 \
+
+$(BUILT_KERNEL_CONFIGS_FILE): .KATI_IMPLICIT_OUTPUTS := $(BUILT_KERNEL_VERSION_FILE)
+$(BUILT_KERNEL_CONFIGS_FILE): PRIVATE_DECOMPRESS_TOOLS := $(my_decompress_tools)
+$(BUILT_KERNEL_CONFIGS_FILE): $(foreach pair,$(my_decompress_tools),$(call word-colon,2,$(pair)))
+$(BUILT_KERNEL_CONFIGS_FILE): $(EXTRACT_KERNEL) $(INSTALLED_KERNEL_TARGET)
+	$< --tools $(PRIVATE_DECOMPRESS_TOOLS) --input $(INSTALLED_KERNEL_TARGET) \
+	  --output-configs $@ \
+	  --output-version $(BUILT_KERNEL_VERSION_FILE)
+
+my_decompress_tools :=
+
+endif # my_board_extracted_kernel
+my_board_extracted_kernel :=
+
+endif # INSTALLED_KERNEL_TARGET
+
+check_vintf_compatible_args += --kernel $$(cat $(BUILT_KERNEL_VERSION_FILE)):$(BUILT_KERNEL_CONFIGS_FILE)
+check_vintf_compatible_deps += $(BUILT_KERNEL_CONFIGS_FILE) $(BUILT_KERNEL_VERSION_FILE)
+
+endif # PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS
+
+check_vintf_compatible_args += \
+  --dirmap /system:$(TARGET_OUT) \
+  --dirmap /vendor:$(TARGET_OUT_VENDOR) \
+  --dirmap /odm:$(TARGET_OUT_ODM) \
+  --dirmap /product:$(TARGET_OUT_PRODUCT) \
+  --dirmap /system_ext:$(TARGET_OUT_SYSTEM_EXT) \
+
+ifdef PRODUCT_SHIPPING_API_LEVEL
+check_vintf_compatible_args += --property ro.product.first_api_level=$(PRODUCT_SHIPPING_API_LEVEL)
+endif # PRODUCT_SHIPPING_API_LEVEL
+
+$(check_vintf_compatible_log): PRIVATE_CHECK_VINTF_ARGS := $(check_vintf_compatible_args)
+$(check_vintf_compatible_log): PRIVATE_CHECK_VINTF_DEPS := $(check_vintf_compatible_deps)
+# Check ODM SKU=(empty) case when:
+# - ODM_MANIFEST_FILES is not empty; OR
+# - ODM_MANIFEST_FILES is empty AND ODM_MANIFEST_SKUS is empty (only ODM manifest fragments are used)
+$(check_vintf_compatible_log): PRIVATE_ODM_SKUS := \
+  $(if $(ODM_MANIFEST_FILES),EMPTY_ODM_SKU_PLACEHOLDER,\
+    $(if $(ODM_MANIFEST_SKUS),,EMPTY_ODM_SKU_PLACEHOLDER)) \
+  $(ODM_MANIFEST_SKUS)
+# Check vendor SKU=(empty) case when:
+# - DEVICE_MANIFEST_FILE is not empty; OR
+# - DEVICE_MANIFEST_FILE is empty AND DEVICE_MANIFEST_SKUS is empty (only vendor manifest fragments are used)
+$(check_vintf_compatible_log): PRIVATE_VENDOR_SKUS := \
+  $(if $(DEVICE_MANIFEST_FILE),EMPTY_VENDOR_SKU_PLACEHOLDER,\
+    $(if $(DEVICE_MANIFEST_SKUS),,EMPTY_VENDOR_SKU_PLACEHOLDER)) \
+  $(DEVICE_MANIFEST_SKUS)
+$(check_vintf_compatible_log): $(HOST_OUT_EXECUTABLES)/checkvintf $(check_vintf_compatible_deps)
+	@echo -n -e 'Deps: \n  ' > $@
+	@sed 's/ /\n  /g' <<< "$(PRIVATE_CHECK_VINTF_DEPS)" >> $@
+	@echo -n -e 'Args: \n  ' >> $@
+	@cat <<< "$(PRIVATE_CHECK_VINTF_ARGS)" >> $@
+	$(foreach odm_sku,$(PRIVATE_ODM_SKUS), $(foreach vendor_sku,$(PRIVATE_VENDOR_SKUS), \
+	  echo "For ODM SKU = $(odm_sku), vendor SKU = $(vendor_sku)" >> $@; \
+	  ( $< --check-compat $(PRIVATE_CHECK_VINTF_ARGS) \
+	       --property ro.boot.product.hardware.sku=$(filter-out EMPTY_ODM_SKU_PLACEHOLDER,$(odm_sku)) \
+	       --property ro.boot.product.vendor.sku=$(filter-out EMPTY_VENDOR_SKU_PLACEHOLDER,$(vendor_sku)) \
+	       >> $@ 2>&1 ) || (cat $@ && exit 1); ))
+
+check_vintf_compatible_log :=
+check_vintf_compatible_args :=
+check_vintf_compatible_deps :=
+
+endif # BUILDING_SYSTEM_EXT_IMAGE equals BOARD_USES_SYSTEM_EXTIMAGE
+endif # BUILDING_PRODUCT_IMAGE equals BOARD_USES_PRODUCTIMAGE
+endif # BUILDING_ODM_IMAGE equals BOARD_USES_ODMIMAGE
+endif # check_vintf_has_vendor
+endif # check_vintf_has_system
+endif # PRODUCT_ENFORCE_VINTF_MANIFEST
+
+# Add all logs of VINTF checks to dist builds
+droid_targets: $(check_vintf_all_deps)
+$(call dist-for-goals, droid_targets, $(check_vintf_all_deps))
+
+# Helper alias to check all VINTF of current build.
+.PHONY: check-vintf-all
+check-vintf-all: $(check_vintf_all_deps)
+	$(foreach file,$^,echo "$(file)"; cat "$(file)"; echo;)
+
+check_vintf_has_vendor :=
+check_vintf_has_system :=
+check_vintf_common_srcs :=
+check_vintf_all_deps :=
+intermediates :=
+endif # !TARGET_BUILD_APPS
+
+# -----------------------------------------------------------------
 # Check image sizes <= size of super partition
 
 ifeq (,$(TARGET_BUILD_APPS))
@@ -3394,133 +4006,35 @@
 
 ifeq (true,$(PRODUCT_BUILD_SUPER_PARTITION))
 
-# (1): list of items like "system", "vendor", "product", "product_services"
-# return: map each item into a command ( wrapped in $$() ) that reads the size
-define read-size-of-partitions
-$(foreach image,$(call images-for-partitions,$(1)),$$( \
-    build/make/tools/releasetools/sparse_img.py --get_partition_size $(image)))
-endef
-
-# round result to BOARD_SUPER_PARTITION_ALIGNMENT
-#$(1): the calculated size
-ifeq (,$(BOARD_SUPER_PARTITION_ALIGNMENT))
-define round-partition-size
-$(1)
-endef
-else
-define round-partition-size
-$$((($(1)+$(BOARD_SUPER_PARTITION_ALIGNMENT)-1)/$(BOARD_SUPER_PARTITION_ALIGNMENT)*$(BOARD_SUPER_PARTITION_ALIGNMENT)))
-endef
-endif
-
-define super-slot-suffix
-$(if $(filter true,$(AB_OTA_UPDATER)),$(if $(filter true,$(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS)),,_a))
-endef
-
-ifndef BOARD_SUPER_PARTITION_WARN_LIMIT
-BOARD_SUPER_PARTITION_WARN_LIMIT := $$(($(BOARD_SUPER_PARTITION_SIZE) * 95 / 100))
-endif
-
-ifndef BOARD_SUPER_PARTITION_ERROR_LIMIT
-BOARD_SUPER_PARTITION_ERROR_LIMIT := $(BOARD_SUPER_PARTITION_SIZE)
-endif
-
-droid_targets: check-all-partition-sizes
-
-.PHONY: check-all-partition-sizes check-all-partition-sizes-nodeps
-
-# Add image dependencies so that generated_*_image_info.txt are written before checking.
-check-all-partition-sizes: \
-    build/make/tools/releasetools/sparse_img.py \
-    $(call images-for-partitions,$(BOARD_SUPER_PARTITION_PARTITION_LIST))
-
-ifeq ($(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS),true)
-# Check sum(super partition block devices) == super partition
-# Non-retrofit devices already defines BOARD_SUPER_PARTITION_SUPER_DEVICE_SIZE = BOARD_SUPER_PARTITION_SIZE
-define check-super-partition-size
-  size_list="$(foreach device,$(call to-upper,$(BOARD_SUPER_PARTITION_BLOCK_DEVICES)),$(BOARD_SUPER_PARTITION_$(device)_DEVICE_SIZE))"; \
-  sum_sizes_expr=$$(sed -e 's/ /+/g' <<< "$${size_list}"); \
-  max_size_expr="$(BOARD_SUPER_PARTITION_SIZE)"; \
-  if [ $$(( $${sum_sizes_expr} )) -ne $$(( $${max_size_expr} )) ]; then \
-    echo "The sum of super partition block device sizes is not equal to BOARD_SUPER_PARTITION_SIZE:"; \
-    echo $${sum_sizes_expr} '!=' $${max_size_expr}; \
-    exit 1; \
-  else \
-    echo "The sum of super partition block device sizes is equal to BOARD_SUPER_PARTITION_SIZE:"; \
-    echo $${sum_sizes_expr} '==' $${max_size_expr}; \
-  fi
-endef
-endif
-
-# $(1): human-readable max size string
-# $(2): max size expression
-# $(3): list of partition names
-# $(4): human-readable warn size string
-# $(5): warn size expression
-# $(6): human readable error size string
-# $(7): error size expression
-define check-sum-of-partition-sizes
-  partition_size_list="$$(for i in $(call read-size-of-partitions,$(3)); do \
-    echo $(call round-partition-size,$${i}); \
-  done)"; \
-  sum_sizes_expr=$$(tr '\n' '+' <<< "$${partition_size_list}" | sed 's/+$$//'); \
-  if [ $$(( $${sum_sizes_expr} )) -gt $$(( $(2) )) ]; then \
-    echo "The sum of sizes of [$(strip $(3))] is larger than $(strip $(1)):"; \
-    echo $${sum_sizes_expr} '==' $$(( $${sum_sizes_expr} )) '>' "$(2)" '==' $$(( $(2) )); \
-    exit 1; \
-  else \
-    if [[ ! -z "$(7)" ]] && [ $$(( $${sum_sizes_expr} )) -gt $$(( $(7) )) ]; then \
-        echo "!!!! ERROR !!!! The sum of sizes of [$(strip $(3))] is larger than $(strip $(6)):"; \
-        echo $${sum_sizes_expr} '==' $$(( $${sum_sizes_expr} )) '>' "$(7)" '==' $$(( $(7) )); \
-        echo "Super partition is" $$(( $$(( $$(( $${sum_sizes_expr} )) * 100)) / $$(( $(2) )) )) "percent occupied!"; \
-        exit 1; \
-    fi; \
-    if [[ ! -z "$(5)" ]] && [ $$(( $${sum_sizes_expr} )) -gt $$(( $(5) )) ]; then \
-        echo "!!!! WARNING !!!! The sum of sizes of [$(strip $(3))] is larger than $(strip $(4)):"; \
-        echo $${sum_sizes_expr} '==' $$(( $${sum_sizes_expr} )) '>' "$(5)" '==' $$(( $(5) )); \
-        echo "Super partition is" $$(( $$(( $$(( $${sum_sizes_expr} )) * 100)) / $$(( $(2) )) )) "percent occupied!"; \
-    fi; \
-    echo "The sum of sizes of [$(strip $(3))] is within $(strip $(1)):"; \
-    echo $${sum_sizes_expr} '==' $$(( $${sum_sizes_expr} )) '<=' "$(2)" '==' $$(( $(2) )); \
-  fi;
-endef
-
+# $(1): misc_info.txt
+# #(2): optional log file
 define check-all-partition-sizes-target
-  # Check sum(all partitions) <= super partition (/ 2 for A/B devices launched with dynamic partitions)
-  $(if $(BOARD_SUPER_PARTITION_SIZE),$(if $(BOARD_SUPER_PARTITION_PARTITION_LIST), \
-    $(call check-sum-of-partition-sizes,BOARD_SUPER_PARTITION_SIZE$(if $(call super-slot-suffix), / 2), \
-      $(BOARD_SUPER_PARTITION_SIZE)$(if $(call super-slot-suffix), / 2),$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
-      BOARD_SUPER_PARTITION_WARN_LIMIT$(if $(call super-slot-suffix), / 2), \
-      $(BOARD_SUPER_PARTITION_WARN_LIMIT)$(if $(call super-slot-suffix), / 2), \
-      BOARD_SUPER_PARTITION_ERROR_LIMIT$(if $(call super-slot-suffix), / 2), \
-      $(BOARD_SUPER_PARTITION_ERROR_LIMIT)$(if $(call super-slot-suffix), / 2)) \
-  ))
-
-  # For each group, check sum(partitions in group) <= group size
-  $(foreach group,$(call to-upper,$(BOARD_SUPER_PARTITION_GROUPS)), \
-    $(if $(BOARD_$(group)_SIZE),$(if $(BOARD_$(group)_PARTITION_LIST), \
-      $(call check-sum-of-partition-sizes,BOARD_$(group)_SIZE,$(BOARD_$(group)_SIZE),$(BOARD_$(group)_PARTITION_LIST)))))
-
-  # Check sum(all group sizes) <= super partition (/ 2 for A/B devices launched with dynamic partitions)
-  if [[ ! -z $(BOARD_SUPER_PARTITION_SIZE) ]]; then \
-    group_size_list="$(foreach group,$(call to-upper,$(BOARD_SUPER_PARTITION_GROUPS)),$(BOARD_$(group)_SIZE))"; \
-    sum_sizes_expr=$$(sed -e 's/ /+/g' <<< "$${group_size_list}"); \
-    max_size_tail=$(if $(call super-slot-suffix)," / 2"); \
-    max_size_expr="$(BOARD_SUPER_PARTITION_SIZE)$${max_size_tail}"; \
-    if [ $$(( $${sum_sizes_expr} )) -gt $$(( $${max_size_expr} )) ]; then \
-      echo "The sum of sizes of [$(strip $(BOARD_SUPER_PARTITION_GROUPS))] is larger than BOARD_SUPER_PARTITION_SIZE$${max_size_tail}:"; \
-      echo $${sum_sizes_expr} '==' $$(( $${sum_sizes_expr} )) '>' $${max_size_expr} '==' $$(( $${max_size_expr} )); \
-      exit 1; \
-    else \
-      echo "The sum of sizes of [$(strip $(BOARD_SUPER_PARTITION_GROUPS))] is within BOARD_SUPER_PARTITION_SIZE$${max_size_tail}:"; \
-      echo $${sum_sizes_expr} '==' $$(( $${sum_sizes_expr} )) '<=' $${max_size_expr} '==' $$(( $${max_size_expr} )); \
-    fi \
-  fi
+  mkdir -p $(dir $(1))
+  rm -f $(1)
+  $(call dump-super-image-info, $(1))
+  $(foreach partition,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
+    echo "$(partition)_image="$(call images-for-partitions,$(partition)) >> $(1);)
+  $(CHECK_PARTITION_SIZES) $(if $(2),--logfile $(2),-v) $(1)
 endef
 
-check-all-partition-sizes check-all-partition-sizes-nodeps:
-	$(call check-all-partition-sizes-target)
-	$(call check-super-partition-size)
+check_all_partition_sizes_log := $(call intermediates-dir-for,PACKAGING,check-all-partition-sizes)/check_all_partition_sizes_log
+droid_targets: $(check_all_partition_sizes_log)
+$(call dist-for-goals, droid_targets, $(check_all_partition_sizes_log))
+
+$(check_all_partition_sizes_log): \
+    $(CHECK_PARTITION_SIZES) \
+    $(call images-for-partitions,$(BOARD_SUPER_PARTITION_PARTITION_LIST))
+	$(call check-all-partition-sizes-target, \
+	  $(call intermediates-dir-for,PACKAGING,check-all-partition-sizes)/misc_info.txt, \
+	  $@)
+
+.PHONY: check-all-partition-sizes
+check-all-partition-sizes: $(check_all_partition_sizes_log)
+
+.PHONY: check-all-partition-sizes-nodeps
+check-all-partition-sizes-nodeps:
+	$(call check-all-partition-sizes-target, \
+	  $(call intermediates-dir-for,PACKAGING,check-all-partition-sizes-nodeps)/misc_info.txt)
 
 endif # PRODUCT_BUILD_SUPER_PARTITION
 
@@ -3539,7 +4053,7 @@
   build_ota_package := false
   build_otatools_package := false
 else
-  # set build_ota_package, and allow opt-out below
+  # Set build_ota_package, and allow opt-out below.
   build_ota_package := true
   ifeq ($(TARGET_SKIP_OTA_PACKAGE),true)
     build_ota_package := false
@@ -3550,20 +4064,22 @@
   ifeq ($(TARGET_PRODUCT),sdk)
     build_ota_package := false
   endif
-  ifneq ($(filter generic%,$(TARGET_DEVICE)),)
-    build_ota_package := false
-  endif
-  ifeq ($(TARGET_NO_KERNEL),true)
-    build_ota_package := false
-  endif
-  ifeq ($(recovery_fstab),)
-    build_ota_package := false
-  endif
   ifeq ($(TARGET_BUILD_PDK),true)
     build_ota_package := false
   endif
+  ifneq ($(PRODUCT_BUILD_GENERIC_OTA_PACKAGE),true)
+    ifneq ($(filter generic%,$(TARGET_DEVICE)),)
+      build_ota_package := false
+    endif
+    ifeq ($(TARGET_NO_KERNEL),true)
+      build_ota_package := false
+    endif
+    ifeq ($(recovery_fstab),)
+      build_ota_package := false
+    endif
+  endif # PRODUCT_BUILD_GENERIC_OTA_PACKAGE
 
-  # set build_otatools_package, and allow opt-out below
+  # Set build_otatools_package, and allow opt-out below.
   build_otatools_package := true
   ifeq ($(TARGET_SKIP_OTATOOLS_PACKAGE),true)
     build_otatools_package := false
@@ -3571,135 +4087,136 @@
 endif
 
 ifeq ($(build_otatools_package),true)
-OTATOOLS :=  $(HOST_OUT_EXECUTABLES)/minigzip \
-  $(HOST_OUT_EXECUTABLES)/aapt \
-  $(HOST_OUT_EXECUTABLES)/aapt2 \
-  $(HOST_OUT_EXECUTABLES)/checkvintf \
-  $(HOST_OUT_EXECUTABLES)/mkbootfs \
-  $(HOST_OUT_EXECUTABLES)/mkbootimg \
-  $(HOST_OUT_EXECUTABLES)/fs_config \
-  $(HOST_OUT_EXECUTABLES)/zipalign \
-  $(HOST_OUT_EXECUTABLES)/bsdiff \
-  $(HOST_OUT_EXECUTABLES)/imgdiff \
-  $(HOST_OUT_JAVA_LIBRARIES)/signapk.jar \
-  $(HOST_OUT_JAVA_LIBRARIES)/BootSignature.jar \
-  $(HOST_OUT_JAVA_LIBRARIES)/VeritySigner.jar \
-  $(HOST_OUT_EXECUTABLES)/mke2fs \
-  $(HOST_OUT_EXECUTABLES)/mkuserimg_mke2fs \
-  $(HOST_OUT_EXECUTABLES)/e2fsdroid \
-  $(HOST_OUT_EXECUTABLES)/tune2fs \
-  $(HOST_OUT_EXECUTABLES)/mksquashfsimage.sh \
-  $(HOST_OUT_EXECUTABLES)/mksquashfs \
-  $(HOST_OUT_EXECUTABLES)/mkf2fsuserimg.sh \
-  $(HOST_OUT_EXECUTABLES)/make_f2fs \
-  $(HOST_OUT_EXECUTABLES)/sload_f2fs \
-  $(HOST_OUT_EXECUTABLES)/simg2img \
-  $(HOST_OUT_EXECUTABLES)/e2fsck \
-  $(HOST_OUT_EXECUTABLES)/generate_verity_key \
-  $(HOST_OUT_EXECUTABLES)/verity_signer \
-  $(HOST_OUT_EXECUTABLES)/verity_verifier \
-  $(HOST_OUT_EXECUTABLES)/append2simg \
-  $(HOST_OUT_EXECUTABLES)/img2simg \
-  $(HOST_OUT_EXECUTABLES)/boot_signer \
-  $(HOST_OUT_EXECUTABLES)/fec \
-  $(HOST_OUT_EXECUTABLES)/brillo_update_payload \
-  $(HOST_OUT_EXECUTABLES)/lib/shflags/shflags \
-  $(HOST_OUT_EXECUTABLES)/delta_generator \
-  $(HOST_OUT_EXECUTABLES)/care_map_generator \
-  $(HOST_OUT_EXECUTABLES)/fc_sort \
-  $(HOST_OUT_EXECUTABLES)/sefcontext_compile \
-  $(LPMAKE) \
-  $(AVBTOOL) \
-  $(BLK_ALLOC_TO_BASE_FS) \
-  $(BROTLI) \
-  $(BUILD_VERITY_METADATA) \
-  $(BUILD_VERITY_TREE)
+
+INTERNAL_OTATOOLS_MODULES := \
+  aapt2 \
+  add_img_to_target_files \
+  apksigner \
+  append2simg \
+  avbtool \
+  blk_alloc_to_base_fs \
+  boot_signer \
+  brillo_update_payload \
+  brotli \
+  bsdiff \
+  build_image \
+  build_super_image \
+  build_verity_metadata \
+  build_verity_tree \
+  care_map_generator \
+  check_ota_package_signature \
+  check_target_files_signatures \
+  check_target_files_vintf \
+  checkvintf \
+  delta_generator \
+  e2fsck \
+  e2fsdroid \
+  fc_sort \
+  fec \
+  fs_config \
+  generate_verity_key \
+  img2simg \
+  img_from_target_files \
+  imgdiff \
+  libconscrypt_openjdk_jni \
+  lpmake \
+  lpunpack \
+  lz4 \
+  make_f2fs \
+  merge_target_files \
+  minigzip \
+  mk_combined_img \
+  mkbootfs \
+  mkbootimg \
+  mke2fs \
+  mke2fs.conf \
+  mkf2fsuserimg.sh \
+  mksquashfs \
+  mksquashfsimage.sh \
+  mkuserimg_mke2fs \
+  ota_from_target_files \
+  sefcontext_compile \
+  sgdisk \
+  shflags \
+  sign_apex \
+  sign_target_files_apks \
+  signapk \
+  simg2img \
+  sload_f2fs \
+  tune2fs \
+  unpack_bootimg \
+  update_host_simulator \
+  validate_target_files \
+  verity_signer \
+  verity_verifier \
+  zipalign \
+
+# Additional tools to unpack and repack the apex file.
+INTERNAL_OTATOOLS_MODULES += \
+  apexer \
+  deapexer \
+  debugfs_static \
+  merge_zips \
+  resize2fs \
+  soong_zip \
 
 ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
-OTATOOLS += \
-  $(FUTILITY) \
-  $(VBOOT_SIGNER)
+INTERNAL_OTATOOLS_MODULES += \
+  futility \
+  vboot_signer
 endif
 
-# Shared libraries.
-OTATOOLS += \
-  $(HOST_LIBRARY_PATH)/libc++$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/liblog$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libcutils$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libselinux$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libcrypto_utils$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libcrypto-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2fs-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_blkid-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_com_err-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_e2p-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_misc$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_profile-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_quota-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_uuid-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libconscrypt_openjdk_jni$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libbrillo$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libbrillo-stream$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libchrome$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libcurl-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libevent-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libprotobuf-cpp-lite$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libssl-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libz-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libsparse-host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libbase$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libpcre2$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libbrotli$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/liblp$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext4_utils$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libfec$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libsquashfs_utils$(HOST_SHLIB_SUFFIX)
-
+INTERNAL_OTATOOLS_FILES := \
+  $(filter $(HOST_OUT)/%,$(call module-installed-files,$(INTERNAL_OTATOOLS_MODULES)))
 
 .PHONY: otatools
-otatools: $(OTATOOLS)
+otatools: $(INTERNAL_OTATOOLS_FILES)
 
-BUILT_OTATOOLS_PACKAGE := $(PRODUCT_OUT)/otatools.zip
-$(BUILT_OTATOOLS_PACKAGE): zip_root := $(call intermediates-dir-for,PACKAGING,otatools)/otatools
+# For each module, recursively resolve its host shared library dependencies. Then we have a full
+# list of modules whose installed files need to be packed.
+INTERNAL_OTATOOLS_MODULES_WITH_DEPS := \
+  $(sort $(INTERNAL_OTATOOLS_MODULES) \
+      $(foreach m,$(INTERNAL_OTATOOLS_MODULES),$(call get-all-shared-libs-deps,$(m))))
 
-OTATOOLS_DEPS := \
-  system/extras/ext4_utils/mke2fs.conf \
-  $(sort $(shell find build/target/product/security -type f -name "*.x509.pem" -o -name "*.pk8" -o \
-      -name verity_key))
+INTERNAL_OTATOOLS_PACKAGE_FILES := \
+  $(filter $(HOST_OUT)/%,$(call module-installed-files,$(INTERNAL_OTATOOLS_MODULES_WITH_DEPS)))
+
+INTERNAL_OTATOOLS_PACKAGE_FILES += \
+  $(sort $(shell find build/make/target/product/security -type f -name "*.x509.pem" -o \
+      -name "*.pk8" -o -name verity_key))
 
 ifneq (,$(wildcard device))
-OTATOOLS_DEPS += \
+INTERNAL_OTATOOLS_PACKAGE_FILES += \
   $(sort $(shell find device $(wildcard vendor) -type f -name "*.pk8" -o -name "verifiedboot*" -o \
       -name "*.pem" -o -name "oem*.prop" -o -name "*.avbpubkey"))
 endif
 ifneq (,$(wildcard external/avb))
-OTATOOLS_DEPS += \
+INTERNAL_OTATOOLS_PACKAGE_FILES += \
   $(sort $(shell find external/avb/test/data -type f -name "testkey_*.pem" -o \
       -name "atx_metadata.bin"))
 endif
-ifneq (,$(wildcard system/update_engine))
-OTATOOLS_DEPS += \
-  $(sort $(shell find system/update_engine/scripts -name "*.pyc" -prune -o -type f -print))
-endif
-
-OTATOOLS_RELEASETOOLS := \
-  $(sort $(shell find build/make/tools/releasetools -name "*.pyc" -prune -o -type f))
-
 ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
-OTATOOLS_DEPS += \
+INTERNAL_OTATOOLS_PACKAGE_FILES += \
   $(sort $(shell find external/vboot_reference/tests/devkeys -type f))
 endif
 
-$(BUILT_OTATOOLS_PACKAGE): $(OTATOOLS) $(OTATOOLS_DEPS) $(OTATOOLS_RELEASETOOLS) $(SOONG_ZIP)
+INTERNAL_OTATOOLS_RELEASETOOLS := \
+  $(sort $(shell find build/make/tools/releasetools -name "*.pyc" -prune -o \
+      \( -type f -o -type l \) -print))
+
+BUILT_OTATOOLS_PACKAGE := $(PRODUCT_OUT)/otatools.zip
+$(BUILT_OTATOOLS_PACKAGE): PRIVATE_ZIP_ROOT := $(call intermediates-dir-for,PACKAGING,otatools)/otatools
+$(BUILT_OTATOOLS_PACKAGE): PRIVATE_OTATOOLS_PACKAGE_FILES := $(INTERNAL_OTATOOLS_PACKAGE_FILES)
+$(BUILT_OTATOOLS_PACKAGE): PRIVATE_OTATOOLS_RELEASETOOLS := $(INTERNAL_OTATOOLS_RELEASETOOLS)
+$(BUILT_OTATOOLS_PACKAGE): $(INTERNAL_OTATOOLS_PACKAGE_FILES) $(INTERNAL_OTATOOLS_RELEASETOOLS)
+$(BUILT_OTATOOLS_PACKAGE): $(SOONG_ZIP) $(ZIP2ZIP)
 	@echo "Package OTA tools: $@"
-	$(hide) rm -rf $@ $(zip_root)
-	$(hide) mkdir -p $(dir $@) $(zip_root)/bin $(zip_root)/framework $(zip_root)/releasetools
-	$(call copy-files-with-structure,$(OTATOOLS),$(HOST_OUT)/,$(zip_root))
-	$(hide) cp $(SOONG_ZIP) $(zip_root)/bin/
-	$(hide) cp -r -d -p build/make/tools/releasetools/* $(zip_root)/releasetools
-	$(hide) rm -rf $@ $(zip_root)/releasetools/*.pyc
-	$(hide) $(SOONG_ZIP) -o $@ -C $(zip_root) -D $(zip_root) \
-	  -C . $(addprefix -f ,$(OTATOOLS_DEPS))
+	rm -rf $@ $(PRIVATE_ZIP_ROOT)
+	mkdir -p $(dir $@)
+	$(call copy-files-with-structure,$(PRIVATE_OTATOOLS_PACKAGE_FILES),$(HOST_OUT)/,$(PRIVATE_ZIP_ROOT))
+	$(call copy-files-with-structure,$(PRIVATE_OTATOOLS_RELEASETOOLS),build/make/tools/,$(PRIVATE_ZIP_ROOT))
+	cp $(SOONG_ZIP) $(ZIP2ZIP) $(MERGE_ZIPS) $(PRIVATE_ZIP_ROOT)/bin/
+	$(SOONG_ZIP) -o $@ -C $(PRIVATE_ZIP_ROOT) -D $(PRIVATE_ZIP_ROOT)
 
 .PHONY: otatools-package
 otatools-package: $(BUILT_OTATOOLS_PACKAGE)
@@ -3707,6 +4224,193 @@
 endif # build_otatools_package
 
 # -----------------------------------------------------------------
+#  misc_info.txt
+
+INSTALLED_MISC_INFO_TARGET := $(PRODUCT_OUT)/misc_info.txt
+
+ifeq ($(TARGET_RELEASETOOLS_EXTENSIONS),)
+# default to common dir for device vendor
+tool_extensions := $(TARGET_DEVICE_DIR)/../common
+else
+tool_extensions := $(TARGET_RELEASETOOLS_EXTENSIONS)
+endif
+.KATI_READONLY := tool_extensions
+
+# $1: boot image file name
+define misc_boot_size
+$(subst .img,_size,$(1))=$(BOARD_KERNEL$(call to-upper,$(subst boot,,$(subst .img,,$(1))))_BOOTIMAGE_PARTITION_SIZE)
+endef
+
+$(INSTALLED_MISC_INFO_TARGET):
+	rm -f $@
+	$(call pretty,"Target misc_info.txt: $@")
+	$(hide) echo "recovery_api_version=$(RECOVERY_API_VERSION)" >> $@
+	$(hide) echo "fstab_version=$(RECOVERY_FSTAB_VERSION)" >> $@
+ifdef BOARD_FLASH_BLOCK_SIZE
+	$(hide) echo "blocksize=$(BOARD_FLASH_BLOCK_SIZE)" >> $@
+endif
+ifneq ($(strip $(BOARD_BOOTIMAGE_PARTITION_SIZE))$(strip $(BOARD_KERNEL_BINARIES)),)
+	$(foreach b,$(INSTALLED_BOOTIMAGE_TARGET),\
+		echo "$(call misc_boot_size,$(notdir $(b)))" >> $@;)
+endif
+ifeq ($(INSTALLED_BOOTIMAGE_TARGET),)
+	$(hide) echo "no_boot=true" >> $@
+else
+	echo "boot_images=$(foreach b,$(INSTALLED_BOOTIMAGE_TARGET),$(notdir $(b)))" >> $@
+endif
+ifeq ($(BOARD_RAMDISK_USE_LZ4),true)
+	echo "lz4_ramdisks=true" >> $@
+endif
+ifneq ($(INSTALLED_VENDOR_BOOTIMAGE_TARGET),)
+	echo "vendor_boot=true" >> $@
+	echo "vendor_boot_size=$(BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE)" >> $@
+endif
+ifeq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
+	$(hide) echo "no_recovery=true" >> $@
+endif
+ifdef BOARD_INCLUDE_RECOVERY_DTBO
+	$(hide) echo "include_recovery_dtbo=true" >> $@
+endif
+ifdef BOARD_INCLUDE_RECOVERY_ACPIO
+	$(hide) echo "include_recovery_acpio=true" >> $@
+endif
+ifdef BOARD_RECOVERYIMAGE_PARTITION_SIZE
+	$(hide) echo "recovery_size=$(BOARD_RECOVERYIMAGE_PARTITION_SIZE)" >> $@
+endif
+ifdef TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS
+	@# TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS can be empty to indicate that nothing but defaults should be used.
+	$(hide) echo "recovery_mount_options=$(TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS)" >> $@
+else
+	$(hide) echo "recovery_mount_options=$(DEFAULT_TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS)" >> $@
+endif
+	$(hide) echo "tool_extensions=$(tool_extensions)" >> $@
+	$(hide) echo "default_system_dev_certificate=$(DEFAULT_SYSTEM_DEV_CERTIFICATE)" >> $@
+ifdef PRODUCT_EXTRA_RECOVERY_KEYS
+	$(hide) echo "extra_recovery_keys=$(PRODUCT_EXTRA_RECOVERY_KEYS)" >> $@
+endif
+	$(hide) echo 'mkbootimg_args=$(BOARD_MKBOOTIMG_ARGS)' >> $@
+	$(hide) echo 'recovery_mkbootimg_args=$(BOARD_RECOVERY_MKBOOTIMG_ARGS)' >> $@
+	$(hide) echo 'mkbootimg_version_args=$(INTERNAL_MKBOOTIMG_VERSION_ARGS)' >> $@
+	$(hide) echo "multistage_support=1" >> $@
+	$(hide) echo "blockimgdiff_versions=3,4" >> $@
+ifeq ($(PRODUCT_BUILD_GENERIC_OTA_PACKAGE),true)
+	$(hide) echo "build_generic_ota_package=true" >> $@
+endif
+ifneq ($(OEM_THUMBPRINT_PROPERTIES),)
+	# OTA scripts are only interested in fingerprint related properties
+	$(hide) echo "oem_fingerprint_properties=$(OEM_THUMBPRINT_PROPERTIES)" >> $@
+endif
+ifneq (,$(filter address, $(SANITIZE_TARGET)))
+	# We need to create userdata.img with real data because the instrumented libraries are in userdata.img.
+	$(hide) echo "userdata_img_with_data=true" >> $@
+endif
+ifeq ($(BOARD_USES_FULL_RECOVERY_IMAGE),true)
+	$(hide) echo "full_recovery_image=true" >> $@
+endif
+ifdef BOARD_USES_VENDORIMAGE
+	$(hide) echo "board_uses_vendorimage=true" >> $@
+endif
+ifeq ($(BOARD_AVB_ENABLE),true)
+	$(hide) echo "avb_enable=true" >> $@
+	$(hide) echo "avb_vbmeta_key_path=$(BOARD_AVB_KEY_PATH)" >> $@
+	$(hide) echo "avb_vbmeta_algorithm=$(BOARD_AVB_ALGORITHM)" >> $@
+	$(hide) echo "avb_vbmeta_args=$(BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS)" >> $@
+	$(hide) echo "avb_boot_add_hash_footer_args=$(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS)" >> $@
+ifdef BOARD_AVB_BOOT_KEY_PATH
+	$(hide) echo "avb_boot_key_path=$(BOARD_AVB_BOOT_KEY_PATH)" >> $@
+	$(hide) echo "avb_boot_algorithm=$(BOARD_AVB_BOOT_ALGORITHM)" >> $@
+	$(hide) echo "avb_boot_rollback_index_location=$(BOARD_AVB_BOOT_ROLLBACK_INDEX_LOCATION)" >> $@
+endif # BOARD_AVB_BOOT_KEY_PATH
+	echo "avb_vendor_boot_add_hash_footer_args=$(BOARD_AVB_VENDOR_BOOT_ADD_HASH_FOOTER_ARGS)" >> $@
+ifdef BOARD_AVB_VENDOR_BOOT_KEY_PATH
+	echo "avb_vendor_boot_key_path=$(BOARD_AVB_VENDOR_BOOT_KEY_PATH)" >> $@
+	echo "avb_vendor_boot_algorithm=$(BOARD_AVB_VENDOR_BOOT_ALGORITHM)" >> $@
+	echo "avb_vendor_boot_rollback_index_location=$(BOARD_AVB_VENDOR_BOOT_ROLLBACK_INDEX_LOCATION)" >> $@
+endif # BOARD_AVB_VENDOR_BOOT_KEY_PATH
+	$(hide) echo "avb_recovery_add_hash_footer_args=$(BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS)" >> $@
+ifdef BOARD_AVB_RECOVERY_KEY_PATH
+	$(hide) echo "avb_recovery_key_path=$(BOARD_AVB_RECOVERY_KEY_PATH)" >> $@
+	$(hide) echo "avb_recovery_algorithm=$(BOARD_AVB_RECOVERY_ALGORITHM)" >> $@
+	$(hide) echo "avb_recovery_rollback_index_location=$(BOARD_AVB_RECOVERY_ROLLBACK_INDEX_LOCATION)" >> $@
+endif # BOARD_AVB_RECOVERY_KEY_PATH
+ifneq (,$(strip $(BOARD_CUSTOMIMAGES_PARTITION_LIST)))
+	$(hide) echo "avb_custom_images_partition_list=$(BOARD_CUSTOMIMAGES_PARTITION_LIST)" >> $@
+	$(hide) $(foreach partition,$(BOARD_CUSTOMIMAGES_PARTITION_LIST), \
+	    echo "avb_$(partition)_key_path=$(BOARD_AVB_$(call to-upper,$(partition))_KEY_PATH)"  >> $@; \
+	    echo "avb_$(partition)_algorithm=$(BOARD_AVB_$(call to-upper,$(partition))_ALGORITHM)"  >> $@; \
+	    echo "avb_$(partition)_add_hashtree_footer_args=$(BOARD_AVB_$(call to-upper,$(partition))_ADD_HASHTREE_FOOTER_ARGS)"  >> $@; \
+	    echo "avb_$(partition)_rollback_index_location=$(BOARD_AVB_$(call to-upper,$(partition))_ROLLBACK_INDEX_LOCATION)"  >> $@; \
+	    echo "avb_$(partition)_partition_size=$(BOARD_AVB_$(call to-upper,$(partition))_PARTITION_SIZE)"  >> $@; \
+	    echo "avb_$(partition)_image_list=$(foreach image,$(BOARD_AVB_$(call to-upper,$(partition))_IMAGE_LIST),$(notdir $(image)))" >> $@;)
+endif # BOARD_CUSTOMIMAGES_PARTITION_LIST
+ifneq (,$(strip $(BOARD_AVB_VBMETA_SYSTEM)))
+	$(hide) echo "avb_vbmeta_system=$(BOARD_AVB_VBMETA_SYSTEM)" >> $@
+	$(hide) echo "avb_vbmeta_system_args=$(BOARD_AVB_MAKE_VBMETA_SYSTEM_IMAGE_ARGS)" >> $@
+	$(hide) echo "avb_vbmeta_system_key_path=$(BOARD_AVB_VBMETA_SYSTEM_KEY_PATH)" >> $@
+	$(hide) echo "avb_vbmeta_system_algorithm=$(BOARD_AVB_VBMETA_SYSTEM_ALGORITHM)" >> $@
+	$(hide) echo "avb_vbmeta_system_rollback_index_location=$(BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX_LOCATION)" >> $@
+endif # BOARD_AVB_VBMETA_SYSTEM
+ifneq (,$(strip $(BOARD_AVB_VBMETA_VENDOR)))
+	$(hide) echo "avb_vbmeta_vendor=$(BOARD_AVB_VBMETA_VENDOR)" >> $@
+	$(hide) echo "avb_vbmeta_vendor_args=$(BOARD_AVB_MAKE_VBMETA_SYSTEM_IMAGE_ARGS)" >> $@
+	$(hide) echo "avb_vbmeta_vendor_key_path=$(BOARD_AVB_VBMETA_VENDOR_KEY_PATH)" >> $@
+	$(hide) echo "avb_vbmeta_vendor_algorithm=$(BOARD_AVB_VBMETA_VENDOR_ALGORITHM)" >> $@
+	$(hide) echo "avb_vbmeta_vendor_rollback_index_location=$(BOARD_AVB_VBMETA_VENDOR_ROLLBACK_INDEX_LOCATION)" >> $@
+endif # BOARD_AVB_VBMETA_VENDOR_KEY_PATH
+endif # BOARD_AVB_ENABLE
+ifdef BOARD_BPT_INPUT_FILES
+	$(hide) echo "board_bpt_enable=true" >> $@
+	$(hide) echo "board_bpt_make_table_args=$(BOARD_BPT_MAKE_TABLE_ARGS)" >> $@
+	$(hide) echo "board_bpt_input_files=$(BOARD_BPT_INPUT_FILES)" >> $@
+endif
+ifdef BOARD_BPT_DISK_SIZE
+	$(hide) echo "board_bpt_disk_size=$(BOARD_BPT_DISK_SIZE)" >> $@
+endif
+	$(call generate-userimage-prop-dictionary, $@)
+ifeq ($(AB_OTA_UPDATER),true)
+	@# Include the build type in META/misc_info.txt so the server can easily differentiate production builds.
+	$(hide) echo "build_type=$(TARGET_BUILD_VARIANT)" >> $@
+	$(hide) echo "ab_update=true" >> $@
+endif
+ifeq ($(TARGET_OTA_ALLOW_NON_AB),true)
+	$(hide) echo "allow_non_ab=true" >> $@
+endif
+ifdef BOARD_PREBUILT_DTBOIMAGE
+	$(hide) echo "has_dtbo=true" >> $@
+ifeq ($(BOARD_AVB_ENABLE),true)
+	$(hide) echo "dtbo_size=$(BOARD_DTBOIMG_PARTITION_SIZE)" >> $@
+	$(hide) echo "avb_dtbo_add_hash_footer_args=$(BOARD_AVB_DTBO_ADD_HASH_FOOTER_ARGS)" >> $@
+ifdef BOARD_AVB_DTBO_KEY_PATH
+	$(hide) echo "avb_dtbo_key_path=$(BOARD_AVB_DTBO_KEY_PATH)" >> $@
+	$(hide) echo "avb_dtbo_algorithm=$(BOARD_AVB_DTBO_ALGORITHM)" >> $@
+	$(hide) echo "avb_dtbo_rollback_index_location=$(BOARD_AVB_DTBO_ROLLBACK_INDEX_LOCATION)" >> $@
+endif # BOARD_AVB_DTBO_KEY_PATH
+endif # BOARD_AVB_ENABLE
+endif # BOARD_PREBUILT_DTBOIMAGE
+	$(call dump-dynamic-partitions-info,$@)
+	@# VINTF checks
+ifeq ($(PRODUCT_ENFORCE_VINTF_MANIFEST),true)
+	$(hide) echo "vintf_enforce=true" >> $@
+endif
+ifdef ODM_MANIFEST_SKUS
+	$(hide) echo "vintf_odm_manifest_skus=$(ODM_MANIFEST_SKUS)" >> $@
+endif
+ifdef ODM_MANIFEST_FILES
+	$(hide) echo "vintf_include_empty_odm_sku=true" >> $@
+endif
+ifdef DEVICE_MANIFEST_SKUS
+	$(hide) echo "vintf_vendor_manifest_skus=$(DEVICE_MANIFEST_SKUS)" >> $@
+endif
+ifdef DEVICE_MANIFEST_FILE
+	$(hide) echo "vintf_include_empty_vendor_sku=true" >> $@
+endif
+
+.PHONY: misc_info
+misc_info: $(INSTALLED_MISC_INFO_TARGET)
+
+droidcore: $(INSTALLED_MISC_INFO_TARGET)
+
+# -----------------------------------------------------------------
 # A zip of the directories that map to the target filesystem.
 # This zip can be used to create an OTA package or filesystem image
 # as a post-build step.
@@ -3743,25 +4447,18 @@
 
 $(BUILT_TARGET_FILES_PACKAGE): PRIVATE_OTA_TOOLS := $(built_ota_tools)
 
-$(BUILT_TARGET_FILES_PACKAGE): PRIVATE_RECOVERY_API_VERSION := $(RECOVERY_API_VERSION)
-$(BUILT_TARGET_FILES_PACKAGE): PRIVATE_RECOVERY_FSTAB_VERSION := $(RECOVERY_FSTAB_VERSION)
-
-ifeq ($(TARGET_RELEASETOOLS_EXTENSIONS),)
-# default to common dir for device vendor
-tool_extensions := $(TARGET_DEVICE_DIR)/../common
-else
-tool_extensions := $(TARGET_RELEASETOOLS_EXTENSIONS)
-endif
 tool_extension := $(wildcard $(tool_extensions)/releasetools.py)
-$(BUILT_TARGET_FILES_PACKAGE): PRIVATE_TOOL_EXTENSIONS := $(tool_extensions)
 $(BUILT_TARGET_FILES_PACKAGE): PRIVATE_TOOL_EXTENSION := $(tool_extension)
 
 ifeq ($(AB_OTA_UPDATER),true)
 updater_dep := system/update_engine/update_engine.conf
-else
-# Build OTA tools if not using the AB Updater.
+endif
+
+# Build OTA tools if non-A/B is allowed
+ifeq ($(TARGET_OTA_ALLOW_NON_AB),true)
 updater_dep := $(built_ota_tools)
 endif
+
 $(BUILT_TARGET_FILES_PACKAGE): $(updater_dep)
 
 # If we are using recovery as boot, output recovery files to BOOT/.
@@ -3777,6 +4474,18 @@
     $(BUILT_TARGET_FILES_PACKAGE): $(TARGET_OUT_OEM)/$(OSRELEASED_DIRECTORY)/product_version
     $(BUILT_TARGET_FILES_PACKAGE): $(TARGET_OUT_ETC)/$(OSRELEASED_DIRECTORY)/system_version
   endif
+
+  # Not checking in board_config.mk, since AB_OTA_PARTITIONS may be updated in Android.mk (e.g. to
+  # additionally include radio or bootloader partitions).
+  ifeq ($(AB_OTA_PARTITIONS),)
+    $(error AB_OTA_PARTITIONS must be defined when using AB_OTA_UPDATER)
+  endif
+endif
+
+ifneq ($(AB_OTA_PARTITIONS),)
+  ifneq ($(AB_OTA_UPDATER),true)
+    $(error AB_OTA_UPDATER must be true when defining AB_OTA_PARTITIONS)
+  endif
 endif
 
 # Run fs_config while creating the target files package
@@ -3786,6 +4495,15 @@
 (cd $(1); find . -type d | sed 's,$$,/,'; find . \! -type d) | cut -c 3- | sort | sed 's,^,$(2),' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) -R "$(2)"
 endef
 
+# Filter out vendor from the list for AOSP targets.
+# $(1): list
+define filter-out-missing-vendor
+$(if $(INSTALLED_VENDORIMAGE_TARGET),$(1),$(filter-out vendor,$(1)))
+endef
+
+# Information related to dynamic partitions and virtual A/B. This information
+# is needed for building the super image (see dump-super-image-info) and
+# building OTA packages.
 # $(1): file
 define dump-dynamic-partitions-info
   $(if $(filter true,$(PRODUCT_USE_DYNAMIC_PARTITIONS)), \
@@ -3803,35 +4521,62 @@
   $(foreach device,$(BOARD_SUPER_PARTITION_BLOCK_DEVICES), \
     echo "super_$(device)_device_size=$(BOARD_SUPER_PARTITION_$(call to-upper,$(device))_DEVICE_SIZE)" >> $(1);)
   $(if $(BOARD_SUPER_PARTITION_PARTITION_LIST), \
-    echo "dynamic_partition_list=$(BOARD_SUPER_PARTITION_PARTITION_LIST)" >> $(1))
+    echo "dynamic_partition_list=$(call filter-out-missing-vendor, $(BOARD_SUPER_PARTITION_PARTITION_LIST))" >> $(1))
   $(if $(BOARD_SUPER_PARTITION_GROUPS),
     echo "super_partition_groups=$(BOARD_SUPER_PARTITION_GROUPS)" >> $(1))
   $(foreach group,$(BOARD_SUPER_PARTITION_GROUPS), \
     echo "super_$(group)_group_size=$(BOARD_$(call to-upper,$(group))_SIZE)" >> $(1); \
     $(if $(BOARD_$(call to-upper,$(group))_PARTITION_LIST), \
-      echo "super_$(group)_partition_list=$(BOARD_$(call to-upper,$(group))_PARTITION_LIST)" >> $(1);))
+      echo "super_$(group)_partition_list=$(call filter-out-missing-vendor, $(BOARD_$(call to-upper,$(group))_PARTITION_LIST))" >> $(1);))
   $(if $(filter true,$(TARGET_USERIMAGES_SPARSE_EXT_DISABLED)), \
     echo "build_non_sparse_super_partition=true" >> $(1))
+  $(if $(filter true,$(TARGET_USERIMAGES_SPARSE_F2FS_DISABLED)), \
+    echo "build_non_sparse_super_partition=true" >> $(1))
   $(if $(filter true,$(BOARD_SUPER_IMAGE_IN_UPDATE_PACKAGE)), \
     echo "super_image_in_update_package=true" >> $(1))
+  $(if $(BOARD_SUPER_PARTITION_SIZE), \
+    echo "super_partition_size=$(BOARD_SUPER_PARTITION_SIZE)" >> $(1))
+  $(if $(BOARD_SUPER_PARTITION_ALIGNMENT), \
+    echo "super_partition_alignment=$(BOARD_SUPER_PARTITION_ALIGNMENT)" >> $(1))
+  $(if $(BOARD_SUPER_PARTITION_WARN_LIMIT), \
+    echo "super_partition_warn_limit=$(BOARD_SUPER_PARTITION_WARN_LIMIT)" >> $(1))
+  $(if $(BOARD_SUPER_PARTITION_ERROR_LIMIT), \
+    echo "super_partition_error_limit=$(BOARD_SUPER_PARTITION_ERROR_LIMIT)" >> $(1))
+  $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA)), \
+    echo "virtual_ab=true" >> $(1))
+  $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA_RETROFIT)), \
+    echo "virtual_ab_retrofit=true" >> $(1))
 endef
 
+# By conditionally including the dependency of the target files package on the
+# full system image deps, we speed up builds that do not build the system
+# image.
+ifdef BUILDING_SYSTEM_IMAGE
+$(BUILT_TARGET_FILES_PACKAGE): $(FULL_SYSTEMIMAGE_DEPS)
+endif
+
+ifeq ($(BUILD_QEMU_IMAGES),true)
+MK_VBMETA_BOOT_KERNEL_CMDLINE_SH := device/generic/goldfish/tools/mk_vbmeta_boot_params.sh
+$(BUILT_TARGET_FILES_PACKAGE): $(MK_VBMETA_BOOT_KERNEL_CMDLINE_SH)
+endif
+
 # Depending on the various images guarantees that the underlying
 # directories are up-to-date.
 $(BUILT_TARGET_FILES_PACKAGE): \
 	    $(INSTALLED_RAMDISK_TARGET) \
 	    $(INSTALLED_BOOTIMAGE_TARGET) \
+	    $(INSTALLED_VENDOR_BOOTIMAGE_TARGET) \
 	    $(INSTALLED_RADIOIMAGE_TARGET) \
 	    $(INSTALLED_RECOVERYIMAGE_TARGET) \
-	    $(FULL_SYSTEMIMAGE_DEPS) \
 	    $(INSTALLED_USERDATAIMAGE_TARGET) \
 	    $(INSTALLED_CACHEIMAGE_TARGET) \
 	    $(INSTALLED_VENDORIMAGE_TARGET) \
 	    $(INSTALLED_PRODUCTIMAGE_TARGET) \
-	    $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) \
+	    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) \
 	    $(INSTALLED_VBMETAIMAGE_TARGET) \
 	    $(INSTALLED_ODMIMAGE_TARGET) \
 	    $(INSTALLED_DTBOIMAGE_TARGET) \
+	    $(INSTALLED_CUSTOMIMAGES_TARGET) \
 	    $(INTERNAL_SYSTEMOTHERIMAGE_FILES) \
 	    $(INSTALLED_ANDROID_INFO_TXT_TARGET) \
 	    $(INSTALLED_KERNEL_TARGET) \
@@ -3843,27 +4588,24 @@
 	    $(PRODUCT_SYSTEM_BASE_FS_PATH) \
 	    $(PRODUCT_VENDOR_BASE_FS_PATH) \
 	    $(PRODUCT_PRODUCT_BASE_FS_PATH) \
-	    $(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH) \
+	    $(PRODUCT_SYSTEM_EXT_BASE_FS_PATH) \
 	    $(PRODUCT_ODM_BASE_FS_PATH) \
 	    $(LPMAKE) \
 	    $(SELINUX_FC) \
+	    $(INSTALLED_MISC_INFO_TARGET) \
 	    $(APKCERTS_FILE) \
 	    $(SOONG_APEX_KEYS_FILE) \
 	    $(SOONG_ZIP) \
 	    $(HOST_OUT_EXECUTABLES)/fs_config \
-	    $(HOST_OUT_EXECUTABLES)/imgdiff \
-	    $(HOST_OUT_EXECUTABLES)/bsdiff \
-	    $(HOST_OUT_EXECUTABLES)/care_map_generator \
-	    $(BUILD_IMAGE_SRCS) \
-	    $(BUILT_ASSEMBLED_FRAMEWORK_MANIFEST) \
-	    $(BUILT_ASSEMBLED_VENDOR_MANIFEST) \
-	    $(BUILT_SYSTEM_MATRIX) \
-	    $(BUILT_VENDOR_MATRIX) \
+	    $(ADD_IMG_TO_TARGET_FILES) \
+	    $(MAKE_RECOVERY_PATCH) \
+	    $(BUILT_KERNEL_CONFIGS_FILE) \
+	    $(BUILT_KERNEL_VERSION_FILE) \
 	    | $(ACP)
 	@echo "Package target files: $@"
 	$(call create-system-vendor-symlink)
 	$(call create-system-product-symlink)
-	$(call create-system-product_services-symlink)
+	$(call create-system-system_ext-symlink)
 	$(call create-vendor-odm-symlink)
 	$(hide) rm -rf $@ $@.list $(zip_root)
 	$(hide) mkdir -p $(dir $@) $(zip_root)
@@ -3873,33 +4615,37 @@
 	$(hide) $(call package_files-copy-root, \
 	    $(TARGET_RECOVERY_ROOT_OUT),$(zip_root)/$(PRIVATE_RECOVERY_OUT)/RAMDISK)
 ifdef INSTALLED_KERNEL_TARGET
-	$(hide) cp $(INSTALLED_KERNEL_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/kernel
+	cp $(INSTALLED_KERNEL_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/
 endif
+ifeq (truetrue,$(strip $(BUILDING_VENDOR_BOOT_IMAGE))$(strip $(AB_OTA_UPDATER)))
+	echo "$(GENERIC_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
+else # not (BUILDING_VENDOR_BOOT_IMAGE and AB_OTA_UPDATER)
 ifdef INSTALLED_2NDBOOTLOADER_TARGET
-	$(hide) cp $(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/second
+	cp $(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/second
 endif
 ifdef BOARD_INCLUDE_RECOVERY_DTBO
 ifdef BOARD_PREBUILT_RECOVERY_DTBOIMAGE
-	$(hide) cp $(BOARD_PREBUILT_RECOVERY_DTBOIMAGE) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/recovery_dtbo
+	cp $(BOARD_PREBUILT_RECOVERY_DTBOIMAGE) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/recovery_dtbo
 else
-	$(hide) cp $(BOARD_PREBUILT_DTBOIMAGE) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/recovery_dtbo
+	cp $(BOARD_PREBUILT_DTBOIMAGE) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/recovery_dtbo
 endif
-endif
+endif # BOARD_INCLUDE_RECOVERY_DTBO
 ifdef BOARD_INCLUDE_RECOVERY_ACPIO
-	$(hide) cp $(BOARD_RECOVERY_ACPIO) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/recovery_acpio
+	cp $(BOARD_RECOVERY_ACPIO) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/recovery_acpio
 endif
 ifdef INSTALLED_DTBIMAGE_TARGET
-	$(hide) cp $(INSTALLED_DTBIMAGE_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/dtb
+	cp $(INSTALLED_DTBIMAGE_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/dtb
 endif
 ifdef INTERNAL_KERNEL_CMDLINE
-	$(hide) echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
+	echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
 endif
 ifdef BOARD_KERNEL_BASE
-	$(hide) echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/base
+	echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/base
 endif
 ifdef BOARD_KERNEL_PAGESIZE
-	$(hide) echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/pagesize
+	echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/pagesize
 endif
+endif # INSTALLED_VENDOR_BOOTIMAGE_TARGET not defined
 endif # INSTALLED_RECOVERYIMAGE_TARGET defined or BOARD_USES_RECOVERY_AS_BOOT is true
 	@# Components of the boot image
 	$(hide) mkdir -p $(zip_root)/BOOT
@@ -3915,25 +4661,42 @@
 ifdef INSTALLED_KERNEL_TARGET
 	$(hide) cp $(INSTALLED_KERNEL_TARGET) $(zip_root)/BOOT/kernel
 endif
+ifndef INSTALLED_VENDOR_BOOTIMAGE_TARGET
 ifdef INSTALLED_2NDBOOTLOADER_TARGET
-	$(hide) cp $(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/BOOT/second
+	cp $(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/BOOT/second
 endif
 ifdef INSTALLED_DTBIMAGE_TARGET
-	$(hide) cp $(INSTALLED_DTBIMAGE_TARGET) $(zip_root)/BOOT/dtb
+	cp $(INSTALLED_DTBIMAGE_TARGET) $(zip_root)/BOOT/dtb
 endif
-ifdef INTERNAL_KERNEL_CMDLINE
-	$(hide) echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/BOOT/cmdline
-endif
+	echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/BOOT/cmdline
 ifdef BOARD_KERNEL_BASE
-	$(hide) echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/BOOT/base
+	echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/BOOT/base
 endif
 ifdef BOARD_KERNEL_PAGESIZE
-	$(hide) echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/BOOT/pagesize
+	echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/BOOT/pagesize
 endif
-endif # BOARD_USES_RECOVERY_AS_BOOT
+else # INSTALLED_VENDOR_BOOTIMAGE_TARGET defined
+	echo "$(GENERIC_KERNEL_CMDLINE)" > $(zip_root)/BOOT/cmdline
+endif # INSTALLED_VENDOR_BOOTIMAGE_TARGET defined
+endif # BOARD_USES_RECOVERY_AS_BOOT not true
 	$(hide) $(foreach t,$(INSTALLED_RADIOIMAGE_TARGET),\
 	            mkdir -p $(zip_root)/RADIO; \
 	            cp $(t) $(zip_root)/RADIO/$(notdir $(t));)
+ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
+	mkdir -p $(zip_root)/VENDOR_BOOT
+	$(call package_files-copy-root, \
+	    $(TARGET_VENDOR_RAMDISK_OUT),$(zip_root)/VENDOR_BOOT/RAMDISK)
+ifdef INSTALLED_DTBIMAGE_TARGET
+	cp $(INSTALLED_DTBIMAGE_TARGET) $(zip_root)/VENDOR_BOOT/dtb
+endif
+ifdef BOARD_KERNEL_BASE
+	echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/VENDOR_BOOT/base
+endif
+ifdef BOARD_KERNEL_PAGESIZE
+	echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/VENDOR_BOOT/pagesize
+endif
+	echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/VENDOR_BOOT/vendor_cmdline
+endif # INSTALLED_VENDOR_BOOTIMAGE_TARGET
 ifdef BUILDING_SYSTEM_IMAGE
 	@# Contents of the system image
 	$(hide) $(call package_files-copy-root, \
@@ -3954,10 +4717,10 @@
 	$(hide) $(call package_files-copy-root, \
 	    $(TARGET_OUT_PRODUCT),$(zip_root)/PRODUCT)
 endif
-ifdef BUILDING_PRODUCT_SERVICES_IMAGE
-	@# Contents of the product_services image
+ifdef BUILDING_SYSTEM_EXT_IMAGE
+	@# Contents of the system_ext image
 	$(hide) $(call package_files-copy-root, \
-	    $(TARGET_OUT_PRODUCT_SERVICES),$(zip_root)/PRODUCT_SERVICES)
+	    $(TARGET_OUT_SYSTEM_EXT),$(zip_root)/SYSTEM_EXT)
 endif
 ifdef BUILDING_ODM_IMAGE
 	@# Contents of the odm image
@@ -3972,7 +4735,7 @@
 	@# Extra contents of the OTA package
 	$(hide) mkdir -p $(zip_root)/OTA
 	$(hide) cp $(INSTALLED_ANDROID_INFO_TXT_TARGET) $(zip_root)/OTA/
-ifneq ($(AB_OTA_UPDATER),true)
+ifeq ($(TARGET_OTA_ALLOW_NON_AB),true)
 ifneq ($(built_ota_tools),)
 	$(hide) mkdir -p $(zip_root)/OTA/bin
 	$(hide) cp $(PRIVATE_OTA_TOOLS) $(zip_root)/OTA/bin/
@@ -3988,45 +4751,7 @@
 endif
 	$(hide) echo "$(PRODUCT_OTA_PUBLIC_KEYS)" > $(zip_root)/META/otakeys.txt
 	$(hide) cp $(SELINUX_FC) $(zip_root)/META/file_contexts.bin
-	$(hide) echo "recovery_api_version=$(PRIVATE_RECOVERY_API_VERSION)" > $(zip_root)/META/misc_info.txt
-	$(hide) echo "fstab_version=$(PRIVATE_RECOVERY_FSTAB_VERSION)" >> $(zip_root)/META/misc_info.txt
-ifdef BOARD_FLASH_BLOCK_SIZE
-	$(hide) echo "blocksize=$(BOARD_FLASH_BLOCK_SIZE)" >> $(zip_root)/META/misc_info.txt
-endif
-ifdef BOARD_BOOTIMAGE_PARTITION_SIZE
-	$(hide) echo "boot_size=$(BOARD_BOOTIMAGE_PARTITION_SIZE)" >> $(zip_root)/META/misc_info.txt
-endif
-ifeq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
-	$(hide) echo "no_recovery=true" >> $(zip_root)/META/misc_info.txt
-endif
-ifdef BOARD_INCLUDE_RECOVERY_DTBO
-	$(hide) echo "include_recovery_dtbo=true" >> $(zip_root)/META/misc_info.txt
-endif
-ifdef BOARD_INCLUDE_RECOVERY_ACPIO
-	$(hide) echo "include_recovery_acpio=true" >> $(zip_root)/META/misc_info.txt
-endif
-ifdef BOARD_RECOVERYIMAGE_PARTITION_SIZE
-	$(hide) echo "recovery_size=$(BOARD_RECOVERYIMAGE_PARTITION_SIZE)" >> $(zip_root)/META/misc_info.txt
-endif
-ifdef TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS
-	@# TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS can be empty to indicate that nothing but defaults should be used.
-	$(hide) echo "recovery_mount_options=$(TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS)" >> $(zip_root)/META/misc_info.txt
-else
-	$(hide) echo "recovery_mount_options=$(DEFAULT_TARGET_RECOVERY_FSTYPE_MOUNT_OPTIONS)" >> $(zip_root)/META/misc_info.txt
-endif
-	$(hide) echo "tool_extensions=$(PRIVATE_TOOL_EXTENSIONS)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "default_system_dev_certificate=$(DEFAULT_SYSTEM_DEV_CERTIFICATE)" >> $(zip_root)/META/misc_info.txt
-ifdef PRODUCT_EXTRA_RECOVERY_KEYS
-	$(hide) echo "extra_recovery_keys=$(PRODUCT_EXTRA_RECOVERY_KEYS)" >> $(zip_root)/META/misc_info.txt
-endif
-	$(hide) echo 'mkbootimg_args=$(BOARD_MKBOOTIMG_ARGS)' >> $(zip_root)/META/misc_info.txt
-	$(hide) echo 'mkbootimg_version_args=$(INTERNAL_MKBOOTIMG_VERSION_ARGS)' >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "multistage_support=1" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "blockimgdiff_versions=3,4" >> $(zip_root)/META/misc_info.txt
-ifneq ($(OEM_THUMBPRINT_PROPERTIES),)
-	# OTA scripts are only interested in fingerprint related properties
-	$(hide) echo "oem_fingerprint_properties=$(OEM_THUMBPRINT_PROPERTIES)" >> $(zip_root)/META/misc_info.txt
-endif
+	$(hide) cp $(INSTALLED_MISC_INFO_TARGET) $(zip_root)/META/misc_info.txt
 ifneq ($(PRODUCT_SYSTEM_BASE_FS_PATH),)
 	$(hide) cp $(PRODUCT_SYSTEM_BASE_FS_PATH) \
 	  $(zip_root)/META/$(notdir $(PRODUCT_SYSTEM_BASE_FS_PATH))
@@ -4039,67 +4764,19 @@
 	$(hide) cp $(PRODUCT_PRODUCT_BASE_FS_PATH) \
 	  $(zip_root)/META/$(notdir $(PRODUCT_PRODUCT_BASE_FS_PATH))
 endif
-ifneq ($(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH),)
-	$(hide) cp $(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH) \
-	  $(zip_root)/META/$(notdir $(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH))
+ifneq ($(PRODUCT_SYSTEM_EXT_BASE_FS_PATH),)
+	$(hide) cp $(PRODUCT_SYSTEM_EXT_BASE_FS_PATH) \
+	  $(zip_root)/META/$(notdir $(PRODUCT_SYSTEM_EXT_BASE_FS_PATH))
 endif
 ifneq ($(PRODUCT_ODM_BASE_FS_PATH),)
 	$(hide) cp $(PRODUCT_ODM_BASE_FS_PATH) \
 	  $(zip_root)/META/$(notdir $(PRODUCT_ODM_BASE_FS_PATH))
 endif
-ifneq (,$(filter address, $(SANITIZE_TARGET)))
-	# We need to create userdata.img with real data because the instrumented libraries are in userdata.img.
-	$(hide) echo "userdata_img_with_data=true" >> $(zip_root)/META/misc_info.txt
-endif
-ifeq ($(BOARD_USES_FULL_RECOVERY_IMAGE),true)
-	$(hide) echo "full_recovery_image=true" >> $(zip_root)/META/misc_info.txt
-endif
-ifeq ($(BOARD_AVB_ENABLE),true)
-	$(hide) echo "avb_enable=true" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_key_path=$(BOARD_AVB_KEY_PATH)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_algorithm=$(BOARD_AVB_ALGORITHM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_args=$(BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_boot_add_hash_footer_args=$(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS)" >> $(zip_root)/META/misc_info.txt
-ifdef BOARD_AVB_BOOT_KEY_PATH
-	$(hide) echo "avb_boot_key_path=$(BOARD_AVB_BOOT_KEY_PATH)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_boot_algorithm=$(BOARD_AVB_BOOT_ALGORITHM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_boot_rollback_index_location=$(BOARD_AVB_BOOT_ROLLBACK_INDEX_LOCATION)" >> $(zip_root)/META/misc_info.txt
-endif # BOARD_AVB_BOOT_KEY_PATH
-	$(hide) echo "avb_recovery_add_hash_footer_args=$(BOARD_AVB_RECOVERY_ADD_HASH_FOOTER_ARGS)" >> $(zip_root)/META/misc_info.txt
-ifdef BOARD_AVB_RECOVERY_KEY_PATH
-	$(hide) echo "avb_recovery_key_path=$(BOARD_AVB_RECOVERY_KEY_PATH)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_recovery_algorithm=$(BOARD_AVB_RECOVERY_ALGORITHM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_recovery_rollback_index_location=$(BOARD_AVB_RECOVERY_ROLLBACK_INDEX_LOCATION)" >> $(zip_root)/META/misc_info.txt
-endif # BOARD_AVB_RECOVERY_KEY_PATH
-ifneq (,$(strip $(BOARD_AVB_VBMETA_SYSTEM)))
-	$(hide) echo "avb_vbmeta_system=$(BOARD_AVB_VBMETA_SYSTEM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_system_args=$(BOARD_AVB_MAKE_VBMETA_SYSTEM_IMAGE_ARGS)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_system_key_path=$(BOARD_AVB_VBMETA_SYSTEM_KEY_PATH)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_system_algorithm=$(BOARD_AVB_VBMETA_SYSTEM_ALGORITHM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_system_rollback_index_location=$(BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX_LOCATION)" >> $(zip_root)/META/misc_info.txt
-endif # BOARD_AVB_VBMETA_SYSTEM
-ifneq (,$(strip $(BOARD_AVB_VBMETA_VENDOR)))
-	$(hide) echo "avb_vbmeta_vendor=$(BOARD_AVB_VBMETA_VENDOR)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_vendor_args=$(BOARD_AVB_MAKE_VBMETA_SYSTEM_IMAGE_ARGS)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_vendor_key_path=$(BOARD_AVB_VBMETA_VENDOR_KEY_PATH)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_vendor_algorithm=$(BOARD_AVB_VBMETA_VENDOR_ALGORITHM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_vbmeta_vendor_rollback_index_location=$(BOARD_AVB_VBMETA_VENDOR_ROLLBACK_INDEX_LOCATION)" >> $(zip_root)/META/misc_info.txt
-endif # BOARD_AVB_VBMETA_VENDOR_KEY_PATH
-endif # BOARD_AVB_ENABLE
-ifdef BOARD_BPT_INPUT_FILES
-	$(hide) echo "board_bpt_enable=true" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "board_bpt_make_table_args=$(BOARD_BPT_MAKE_TABLE_ARGS)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "board_bpt_input_files=$(BOARD_BPT_INPUT_FILES)" >> $(zip_root)/META/misc_info.txt
-endif
-ifdef BOARD_BPT_DISK_SIZE
-	$(hide) echo "board_bpt_disk_size=$(BOARD_BPT_DISK_SIZE)" >> $(zip_root)/META/misc_info.txt
-endif
-	$(call generate-userimage-prop-dictionary, $(zip_root)/META/misc_info.txt)
+ifeq ($(TARGET_OTA_ALLOW_NON_AB),true)
 ifneq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
-ifdef BUILDING_SYSTEM_IMAGE
-	$(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH MKBOOTIMG=$(MKBOOTIMG) \
-	    build/make/tools/releasetools/make_recovery_patch $(zip_root) $(zip_root)
-endif # BUILDING_SYSTEM_IMAGE
+	$(hide) PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH MKBOOTIMG=$(MKBOOTIMG) \
+	    $(MAKE_RECOVERY_PATCH) $(zip_root) $(zip_root)
+endif
 endif
 ifeq ($(AB_OTA_UPDATER),true)
 	@# When using the A/B updater, include the updater config files in the zip.
@@ -4110,9 +4787,6 @@
 	$(hide) for conf in $(AB_OTA_POSTINSTALL_CONFIG); do \
 	  echo "$${conf}" >> $(zip_root)/META/postinstall_config.txt; \
 	done
-	@# Include the build type in META/misc_info.txt so the server can easily differentiate production builds.
-	$(hide) echo "build_type=$(TARGET_BUILD_VARIANT)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "ab_update=true" >> $(zip_root)/META/misc_info.txt
 ifdef OSRELEASED_DIRECTORY
 	$(hide) cp $(TARGET_OUT_OEM)/$(OSRELEASED_DIRECTORY)/product_id $(zip_root)/META/product_id.txt
 	$(hide) cp $(TARGET_OUT_OEM)/$(OSRELEASED_DIRECTORY)/product_version $(zip_root)/META/product_version.txt
@@ -4121,7 +4795,7 @@
 endif
 ifeq ($(BREAKPAD_GENERATE_SYMBOLS),true)
 	@# If breakpad symbols have been generated, add them to the zip.
-	$(hide) $(ACP) -r $(TARGET_OUT_BREAKPAD) $(zip_root)/BREAKPAD
+	$(hide) cp -R $(TARGET_OUT_BREAKPAD) $(zip_root)/BREAKPAD
 endif
 ifdef BOARD_PREBUILT_VENDORIMAGE
 	$(hide) mkdir -p $(zip_root)/IMAGES
@@ -4131,9 +4805,9 @@
 	$(hide) mkdir -p $(zip_root)/IMAGES
 	$(hide) cp $(INSTALLED_PRODUCTIMAGE_TARGET) $(zip_root)/IMAGES/
 endif
-ifdef BOARD_PREBUILT_PRODUCT_SERVICESIMAGE
+ifdef BOARD_PREBUILT_SYSTEM_EXTIMAGE
 	$(hide) mkdir -p $(zip_root)/IMAGES
-	$(hide) cp $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) $(zip_root)/IMAGES/
+	$(hide) cp $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) $(zip_root)/IMAGES/
 endif
 ifdef BOARD_PREBUILT_BOOTIMAGE
 	$(hide) mkdir -p $(zip_root)/IMAGES
@@ -4146,19 +4820,12 @@
 ifdef BOARD_PREBUILT_DTBOIMAGE
 	$(hide) mkdir -p $(zip_root)/PREBUILT_IMAGES
 	$(hide) cp $(INSTALLED_DTBOIMAGE_TARGET) $(zip_root)/PREBUILT_IMAGES/
-	$(hide) echo "has_dtbo=true" >> $(zip_root)/META/misc_info.txt
-ifeq ($(BOARD_AVB_ENABLE),true)
-	$(hide) echo "dtbo_size=$(BOARD_DTBOIMG_PARTITION_SIZE)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_dtbo_add_hash_footer_args=$(BOARD_AVB_DTBO_ADD_HASH_FOOTER_ARGS)" >> $(zip_root)/META/misc_info.txt
-ifdef BOARD_AVB_DTBO_KEY_PATH
-	$(hide) echo "avb_dtbo_key_path=$(BOARD_AVB_DTBO_KEY_PATH)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_dtbo_algorithm=$(BOARD_AVB_DTBO_ALGORITHM)" >> $(zip_root)/META/misc_info.txt
-	$(hide) echo "avb_dtbo_rollback_index_location=$(BOARD_AVB_DTBO_ROLLBACK_INDEX_LOCATION)" \
-	    >> $(zip_root)/META/misc_info.txt
-endif # BOARD_AVB_DTBO_KEY_PATH
-endif # BOARD_AVB_ENABLE
 endif # BOARD_PREBUILT_DTBOIMAGE
-	$(call dump-dynamic-partitions-info,$(zip_root)/META/misc_info.txt)
+ifneq ($(strip $(BOARD_CUSTOMIMAGES_PARTITION_LIST)),)
+	$(hide) mkdir -p $(zip_root)/PREBUILT_IMAGES
+	$(hide) $(foreach partition,$(BOARD_CUSTOMIMAGES_PARTITION_LIST), \
+	    $(foreach image,$(BOARD_AVB_$(call to-upper,$(partition))_IMAGE_LIST),cp $(image) $(zip_root)/PREBUILT_IMAGES/;))
+endif # BOARD_CUSTOMIMAGES_PARTITION_LIST
 	@# The radio images in BOARD_PACK_RADIOIMAGES will be additionally copied from RADIO/ into
 	@# IMAGES/, which then will be added into <product>-img.zip. Such images must be listed in
 	@# INSTALLED_RADIOIMAGE_TARGET.
@@ -4175,8 +4842,8 @@
 ifdef BUILDING_PRODUCT_IMAGE
 	$(hide) $(call fs_config,$(zip_root)/PRODUCT,product/) > $(zip_root)/META/product_filesystem_config.txt
 endif
-ifdef BUILDING_PRODUCT_SERVICES_IMAGE
-	$(hide) $(call fs_config,$(zip_root)/PRODUCT_SERVICES,product_services/) > $(zip_root)/META/product_services_filesystem_config.txt
+ifdef BUILDING_SYSTEM_EXT_IMAGE
+	$(hide) $(call fs_config,$(zip_root)/SYSTEM_EXT,system_ext/) > $(zip_root)/META/system_ext_filesystem_config.txt
 endif
 ifdef BUILDING_ODM_IMAGE
 	$(hide) $(call fs_config,$(zip_root)/ODM,odm/) > $(zip_root)/META/odm_filesystem_config.txt
@@ -4187,6 +4854,9 @@
 	@# BOOT/RAMDISK exists and contains the ramdisk for recovery if using BOARD_USES_RECOVERY_AS_BOOT.
 	$(hide) $(call fs_config,$(zip_root)/BOOT/RAMDISK,) > $(zip_root)/META/boot_filesystem_config.txt
 endif
+ifneq ($(INSTALLED_VENDOR_BOOTIMAGE_TARGET),)
+	$(call fs_config,$(zip_root)/VENDOR_BOOT/RAMDISK,) > $(zip_root)/META/vendor_boot_filesystem_config.txt
+endif
 ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
 	@# BOOT/RAMDISK also exists and contains the first stage ramdisk if not using BOARD_BUILD_SYSTEM_ROOT_IMAGE.
 	$(hide) $(call fs_config,$(zip_root)/BOOT/RAMDISK,) > $(zip_root)/META/boot_filesystem_config.txt
@@ -4198,29 +4868,22 @@
 	$(hide) $(call fs_config,$(zip_root)/SYSTEM_OTHER,system/) > $(zip_root)/META/system_other_filesystem_config.txt
 endif
 	@# Metadata for compatibility verification.
-	$(hide) cp $(BUILT_SYSTEM_MATRIX) $(zip_root)/META/system_matrix.xml
-	$(hide) cp $(BUILT_ASSEMBLED_FRAMEWORK_MANIFEST) $(zip_root)/META/system_manifest.xml
-ifdef BUILT_ASSEMBLED_VENDOR_MANIFEST
-	$(hide) cp $(BUILT_ASSEMBLED_VENDOR_MANIFEST) $(zip_root)/META/vendor_manifest.xml
+ifdef BUILT_KERNEL_CONFIGS_FILE
+	$(hide) cp $(BUILT_KERNEL_CONFIGS_FILE) $(zip_root)/META/kernel_configs.txt
 endif
-ifdef BUILT_VENDOR_MATRIX
-	$(hide) cp $(BUILT_VENDOR_MATRIX) $(zip_root)/META/vendor_matrix.xml
+ifdef BUILT_KERNEL_VERSION_FILE
+	$(hide) cp $(BUILT_KERNEL_VERSION_FILE) $(zip_root)/META/kernel_version.txt
 endif
-ifneq ($(BOARD_SUPER_PARTITION_GROUPS),)
-	$(hide) echo "super_partition_groups=$(BOARD_SUPER_PARTITION_GROUPS)" > $(zip_root)/META/dynamic_partitions_info.txt
-	@# Remove 'vendor' from the group partition list if the image is not available. This should only
-	@# happen to AOSP targets built without vendor.img. We can't remove the partition from the
-	@# BoardConfig file, as it's still needed elsewhere (e.g. when creating super_empty.img).
-	$(foreach group,$(BOARD_SUPER_PARTITION_GROUPS), \
-	    $(eval _group_partition_list := $(BOARD_$(call to-upper,$(group))_PARTITION_LIST)) \
-	    $(if $(INSTALLED_VENDORIMAGE_TARGET),,$(eval _group_partition_list := $(filter-out vendor,$(_group_partition_list)))) \
-	    echo "$(group)_size=$(BOARD_$(call to-upper,$(group))_SIZE)" >> $(zip_root)/META/dynamic_partitions_info.txt; \
-	    $(if $(_group_partition_list), \
-	        echo "$(group)_partition_list=$(_group_partition_list)" >> $(zip_root)/META/dynamic_partitions_info.txt;))
-endif # BOARD_SUPER_PARTITION_GROUPS
-	@# TODO(b/134525174): Remove `-r` after addressing the issue with recovery patch generation.
-	$(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH MKBOOTIMG=$(MKBOOTIMG) \
-	    build/make/tools/releasetools/add_img_to_target_files -a -r -v -p $(HOST_OUT) $(zip_root)
+	rm -rf $(zip_root)/META/dynamic_partitions_info.txt
+ifeq (true,$(PRODUCT_USE_DYNAMIC_PARTITIONS))
+	$(call dump-dynamic-partitions-info, $(zip_root)/META/dynamic_partitions_info.txt)
+endif
+	PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH MKBOOTIMG=$(MKBOOTIMG) \
+	    $(ADD_IMG_TO_TARGET_FILES) -a -v -p $(HOST_OUT) $(zip_root)
+ifeq ($(BUILD_QEMU_IMAGES),true)
+	$(hide) AVBTOOL=$(AVBTOOL) $(MK_VBMETA_BOOT_KERNEL_CMDLINE_SH) $(zip_root)/IMAGES/vbmeta.img \
+	    $(zip_root)/IMAGES/system.img $(zip_root)/IMAGES/VerifiedBootParams.textproto
+endif
 	@# Zip everything up, preserving symlinks and placing META/ files first to
 	@# help early validation of the .zip file while uploading it.
 	$(hide) find $(zip_root)/META | sort >$@.list
@@ -4250,14 +4913,14 @@
 # $(1): output file
 # $(2): additional args
 define build-ota-package-target
-PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH MKBOOTIMG=$(MKBOOTIMG) \
-   build/make/tools/releasetools/ota_from_target_files -v \
-   --block \
-   --extracted_input_target_files $(patsubst %.zip,%,$(BUILT_TARGET_FILES_PACKAGE)) \
-   -p $(HOST_OUT) \
-   $(if $(OEM_OTA_CONFIG), -o $(OEM_OTA_CONFIG)) \
-   $(2) \
-   $(BUILT_TARGET_FILES_PACKAGE) $(1)
+PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+    $(OTA_FROM_TARGET_FILES) \
+        --verbose \
+        --extracted_input_target_files $(patsubst %.zip,%,$(BUILT_TARGET_FILES_PACKAGE)) \
+        --path $(HOST_OUT) \
+        $(if $(OEM_OTA_CONFIG), --oem_settings $(OEM_OTA_CONFIG)) \
+        $(2) \
+        $(BUILT_TARGET_FILES_PACKAGE) $(1)
 endef
 
 name := $(TARGET_PRODUCT)
@@ -4267,21 +4930,11 @@
 name := $(name)-ota-$(FILE_NAME_TAG)
 
 INTERNAL_OTA_PACKAGE_TARGET := $(PRODUCT_OUT)/$(name).zip
-
 INTERNAL_OTA_METADATA := $(PRODUCT_OUT)/ota_metadata
 
 $(INTERNAL_OTA_PACKAGE_TARGET): KEY_CERT_PAIR := $(DEFAULT_KEY_CERT_PAIR)
-
-ifeq ($(AB_OTA_UPDATER),true)
-$(INTERNAL_OTA_PACKAGE_TARGET): $(BRILLO_UPDATE_PAYLOAD)
-else
-$(INTERNAL_OTA_PACKAGE_TARGET): $(BROTLI)
-endif
-
 $(INTERNAL_OTA_PACKAGE_TARGET): .KATI_IMPLICIT_OUTPUTS := $(INTERNAL_OTA_METADATA)
-
-$(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) \
-	    build/make/tools/releasetools/ota_from_target_files
+$(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) $(OTA_FROM_TARGET_FILES)
 	@echo "Package OTA: $@"
 	$(call build-ota-package-target,$@,-k $(KEY_CERT_PAIR) --output_metadata_path $(INTERNAL_OTA_METADATA))
 
@@ -4296,17 +4949,10 @@
 name := $(name)-ota-retrofit-$(FILE_NAME_TAG)
 
 INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET := $(PRODUCT_OUT)/$(name).zip
-
 $(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): KEY_CERT_PAIR := $(DEFAULT_KEY_CERT_PAIR)
-
-ifeq ($(AB_OTA_UPDATER),true)
-$(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): $(BRILLO_UPDATE_PAYLOAD)
-else
-$(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): $(BROTLI)
-endif
-
-$(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) \
-	    build/make/tools/releasetools/ota_from_target_files
+$(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET): \
+    $(BUILT_TARGET_FILES_PACKAGE) \
+    $(OTA_FROM_TARGET_FILES)
 	@echo "Package OTA (retrofit dynamic partitions): $@"
 	$(call build-ota-package-target,$@,-k $(KEY_CERT_PAIR) --retrofit_dynamic_partitions)
 
@@ -4329,7 +4975,7 @@
 	    $(INSTALLED_USERDATAIMAGE_TARGET) \
 	    $(INSTALLED_VENDORIMAGE_TARGET) \
 	    $(INSTALLED_PRODUCTIMAGE_TARGET) \
-	    $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET)
+	    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET)
 endif
 $(APPCOMPAT_ZIP): PRIVATE_LIST_FILE := $(call intermediates-dir-for,PACKAGING,appcompat)/filelist
 $(APPCOMPAT_ZIP): $(SOONG_ZIP)
@@ -4358,7 +5004,7 @@
 	    $(INSTALLED_USERDATAIMAGE_TARGET) \
 	    $(INSTALLED_VENDORIMAGE_TARGET) \
 	    $(INSTALLED_PRODUCTIMAGE_TARGET) \
-	    $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) \
+	    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) \
 	    $(INSTALLED_ODMIMAGE_TARGET) \
 	    $(updater_dep)
 endif
@@ -4368,7 +5014,7 @@
 	$(hide) rm -rf $@ $(PRIVATE_LIST_FILE)
 	$(hide) mkdir -p $(dir $@) $(TARGET_OUT_UNSTRIPPED) $(dir $(PRIVATE_LIST_FILE))
 	$(hide) find -L $(TARGET_OUT_UNSTRIPPED) -type f | sort >$(PRIVATE_LIST_FILE)
-	$(hide) $(SOONG_ZIP) -d -o $@ -C $(OUT_DIR)/.. -l $(PRIVATE_LIST_FILE)
+	$(hide) $(SOONG_ZIP) --ignore_missing_files -d -o $@ -C $(OUT_DIR)/.. -l $(PRIVATE_LIST_FILE)
 # -----------------------------------------------------------------
 # A zip of the coverage directory.
 #
@@ -4384,7 +5030,7 @@
 	    $(INSTALLED_USERDATAIMAGE_TARGET) \
 	    $(INSTALLED_VENDORIMAGE_TARGET) \
 	    $(INSTALLED_PRODUCTIMAGE_TARGET) \
-	    $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) \
+	    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) \
 	    $(INSTALLED_ODMIMAGE_TARGET)
 endif
 $(COVERAGE_ZIP): PRIVATE_LIST_FILE := $(call intermediates-dir-for,PACKAGING,coverage)/filelist
@@ -4395,6 +5041,19 @@
 	$(hide) find $(TARGET_OUT_COVERAGE) | sort >$(PRIVATE_LIST_FILE)
 	$(hide) $(SOONG_ZIP) -d -o $@ -C $(TARGET_OUT_COVERAGE) -l $(PRIVATE_LIST_FILE)
 
+#------------------------------------------------------------------
+# Export the LLVM profile data tool and dependencies for Clang coverage processing
+#
+ifeq (true,$(CLANG_COVERAGE))
+  LLVM_PROFDATA := $(LLVM_PREBUILTS_BASE)/linux-x86/$(LLVM_PREBUILTS_VERSION)/bin/llvm-profdata
+  LIBCXX := $(LLVM_PREBUILTS_BASE)/linux-x86/$(LLVM_PREBUILTS_VERSION)/lib64/libc++.so.1
+  PROFDATA_ZIP := $(PRODUCT_OUT)/llvm-profdata.zip
+  $(PROFDATA_ZIP): $(SOONG_ZIP)
+	$(hide) $(SOONG_ZIP) -d -o $@ -C $(LLVM_PREBUILTS_BASE)/linux-x86/$(LLVM_PREBUILTS_VERSION) -f $(LLVM_PROFDATA) -f $(LIBCXX)
+
+  $(call dist-for-goals,droidcore,$(PROFDATA_ZIP))
+endif
+
 # -----------------------------------------------------------------
 # A zip of the Android Apps. Not keeping full path so that we don't
 # include product names when distributing
@@ -4428,38 +5087,36 @@
 JACOCO_REPORT_CLASSES_ALL := $(PRODUCT_OUT)/jacoco-report-classes-all.jar
 $(JACOCO_REPORT_CLASSES_ALL) :
 	@echo "Collecting uninstrumented classes"
-	$(hide) find $(TARGET_COMMON_OUT_ROOT) $(HOST_COMMON_OUT_ROOT) -name "jacoco-report-classes.jar" | \
-	    zip -@ -0 -q -X $@
-# Meaning of these options:
-# -@ scan stdin for file paths to add to the zip
-# -0 don't do any compression
-# -q supress most output
-# -X skip storing extended file attributes
+	find $(TARGET_COMMON_OUT_ROOT) $(HOST_COMMON_OUT_ROOT) -name "jacoco-report-classes.jar" 2>/dev/null | sort > $@.list
+	$(SOONG_ZIP) -o $@ -L 0 -C $(OUT_DIR) -P out -l $@.list
 
 endif # EMMA_INSTRUMENT=true
 
 
 #------------------------------------------------------------------
 # A zip of Proguard obfuscation dictionary files.
-# Only for apps_only build.
 #
-ifdef TARGET_BUILD_APPS
 PROGUARD_DICT_ZIP := $(PRODUCT_OUT)/$(TARGET_PRODUCT)-proguard-dict-$(FILE_NAME_TAG).zip
-# the dependency will be set up later in build/make/core/main.mk.
-$(PROGUARD_DICT_ZIP) :
+# For apps_only build we'll establish the dependency later in build/make/core/main.mk.
+ifndef TARGET_BUILD_APPS
+$(PROGUARD_DICT_ZIP): \
+    $(INSTALLED_SYSTEMIMAGE_TARGET) \
+    $(INSTALLED_RAMDISK_TARGET) \
+    $(INSTALLED_BOOTIMAGE_TARGET) \
+    $(INSTALLED_USERDATAIMAGE_TARGET) \
+    $(INSTALLED_VENDORIMAGE_TARGET) \
+    $(INSTALLED_PRODUCTIMAGE_TARGET) \
+    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) \
+    $(INSTALLED_ODMIMAGE_TARGET) \
+    $(updater_dep)
+endif
+$(PROGUARD_DICT_ZIP): PRIVATE_LIST_FILE := $(call intermediates-dir-for,PACKAGING,proguard)/filelist
+$(PROGUARD_DICT_ZIP): $(SOONG_ZIP)
 	@echo "Packaging Proguard obfuscation dictionary files."
-	$(hide) dict_files=`find $(TARGET_OUT_COMMON_INTERMEDIATES)/APPS -name proguard_dictionary`; \
-	    if [ -n "$$dict_files" ]; then \
-	      unobfuscated_jars=$${dict_files//proguard_dictionary/classes.jar}; \
-	      zip -qX $@ $$dict_files $$unobfuscated_jars; \
-	    else \
-	      touch $(dir $@)/zipdummy; \
-	      (cd $(dir $@) && zip -q $(notdir $@) zipdummy); \
-	      zip -qd $@ zipdummy; \
-	      rm $(dir $@)/zipdummy; \
-	    fi
-
-endif # TARGET_BUILD_APPS
+	mkdir -p $(dir $@) $(TARGET_OUT_COMMON_INTERMEDIATES)/APPS $(dir $(PRIVATE_LIST_FILE))
+	find $(TARGET_OUT_COMMON_INTERMEDIATES)/APPS -name proguard_dictionary | \
+	    sed -e 's/\(.*\)\/proguard_dictionary/\0\n\1\/classes.jar/' > $(PRIVATE_LIST_FILE)
+	$(SOONG_ZIP) --ignore_missing_files -d -o $@ -C $(OUT_DIR)/.. -l $(PRIVATE_LIST_FILE)
 
 
 ifeq (true,$(PRODUCT_USE_DYNAMIC_PARTITIONS))
@@ -4520,6 +5177,8 @@
   $(call dump-super-image-info,$(2))
   $(foreach p,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
     echo "$(p)_image=$(INSTALLED_$(call to-upper,$(p))IMAGE_TARGET)" >> $(2);)
+  $(if $(BUILDING_SYSTEM_OTHER_IMAGE), $(if $(filter system,$(BOARD_SUPER_PARTITION_PARTITION_LIST)), \
+    echo "system_other_image=$(INSTALLED_SYSTEMOTHERIMAGE_TARGET)" >> $(2);))
   mkdir -p $(dir $(1))
   PATH=$(dir $(LPMAKE)):$$PATH \
     $(BUILD_SUPER_IMAGE) -v $(2) $(1)
@@ -4529,6 +5188,12 @@
 INSTALLED_SUPERIMAGE_DEPENDENCIES := $(LPMAKE) $(BUILD_SUPER_IMAGE) \
     $(foreach p, $(BOARD_SUPER_PARTITION_PARTITION_LIST), $(INSTALLED_$(call to-upper,$(p))IMAGE_TARGET))
 
+ifdef BUILDING_SYSTEM_OTHER_IMAGE
+ifneq ($(filter system,$(BOARD_SUPER_PARTITION_PARTITION_LIST)),)
+INSTALLED_SUPERIMAGE_DEPENDENCIES += $(INSTALLED_SYSTEMOTHERIMAGE_TARGET)
+endif
+endif
+
 # If BOARD_BUILD_SUPER_IMAGE_BY_DEFAULT is set, super.img is built from images in the
 # $(PRODUCT_OUT) directory, and is built to $(PRODUCT_OUT)/super.img. Also, it will
 # be built for non-dist builds. This is useful for devices that uses super.img directly, e.g.
@@ -4537,13 +5202,15 @@
 $(INSTALLED_SUPERIMAGE_TARGET): $(INSTALLED_SUPERIMAGE_DEPENDENCIES)
 	$(call pretty,"Target super fs image for debug: $@")
 	$(call build-superimage-target,$(INSTALLED_SUPERIMAGE_TARGET),\
-	  $(call intermediates-dir-for,PACKAGING,superimage_debug)/misc_info.txt)
+          $(call intermediates-dir-for,PACKAGING,superimage_debug)/misc_info.txt)
 
 droidcore: $(INSTALLED_SUPERIMAGE_TARGET)
 
 # For devices that uses super image directly, the superimage target points to the file in $(PRODUCT_OUT).
 .PHONY: superimage
 superimage: $(INSTALLED_SUPERIMAGE_TARGET)
+
+$(call dist-for-goals,dist_files,$(INSTALLED_MISC_INFO_TARGET):super_misc_info.txt)
 endif # BOARD_BUILD_SUPER_IMAGE_BY_DEFAULT
 
 # Build $(PRODUCT_OUT)/super.img without dependencies.
@@ -4591,36 +5258,16 @@
 
 INTERNAL_UPDATE_PACKAGE_TARGET := $(PRODUCT_OUT)/$(name).zip
 
-$(INTERNAL_UPDATE_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) $(ZIP2ZIP)
-
-ifeq (true,$(BOARD_SUPER_IMAGE_IN_UPDATE_PACKAGE))
-$(INTERNAL_UPDATE_PACKAGE_TARGET): $(INTERNAL_SUPERIMAGE_DIST_TARGET)
-	@echo "Package: $@"
-	# Filter out super_empty and images in BOARD_SUPER_PARTITION_PARTITION_LIST.
-	# Filter out system_other for launch DAP devices because it is in super image.
-	# Include OTA/super_*.img for retrofit devices and super.img for non-retrofit
-	# devices.
-	$(hide) $(ZIP2ZIP) -i $(BUILT_TARGET_FILES_PACKAGE) -o $@ \
-	  -x IMAGES/super_empty.img \
-	  $(foreach partition,$(BOARD_SUPER_PARTITION_PARTITION_LIST), \
-	    -x IMAGES/$(partition).img) \
-	  $(if $(filter system, $(BOARD_SUPER_PARTITION_PARTITION_LIST)), \
-	    $(if $(filter true, $(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS)),, \
-	      -x IMAGES/system_other.img)) \
-	  $(if $(filter true,$(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS)), \
-	    $(foreach device,$(BOARD_SUPER_PARTITION_BLOCK_DEVICES), \
-	      OTA/super_$(device).img:super_$(device).img)) \
-	  OTA/android-info.txt:android-info.txt "IMAGES/*.img:."
-	$(if $(INTERNAL_SUPERIMAGE_DIST_TARGET), zip -q -j -u $@ $(INTERNAL_SUPERIMAGE_DIST_TARGET))
-else
-$(INTERNAL_UPDATE_PACKAGE_TARGET):
-	@echo "Package: $@"
-	$(hide) $(ZIP2ZIP) -i $(BUILT_TARGET_FILES_PACKAGE) -o $@ \
-	  OTA/android-info.txt:android-info.txt "IMAGES/*.img:."
-endif # BOARD_SUPER_IMAGE_IN_UPDATE_PACKAGE
+$(INTERNAL_UPDATE_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) $(IMG_FROM_TARGET_FILES)
+	$(call pretty,"Package: $@")
+	PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$(dir $(ZIP2ZIP)):$$PATH \
+	    $(IMG_FROM_TARGET_FILES) \
+	        --additional IMAGES/VerifiedBootParams.textproto:VerifiedBootParams.textproto \
+	        $(BUILT_TARGET_FILES_PACKAGE) $@
 
 .PHONY: updatepackage
 updatepackage: $(INTERNAL_UPDATE_PACKAGE_TARGET)
+$(call dist-for-goals,updatepackage,$(INTERNAL_UPDATE_PACKAGE_TARGET))
 
 
 # -----------------------------------------------------------------
@@ -4630,7 +5277,7 @@
 
 ifeq ($(BUILD_QEMU_IMAGES),true)
 MK_QEMU_IMAGE_SH := device/generic/goldfish/tools/mk_qemu_image.sh
-MK_COMBINE_QEMU_IMAGE_SH := device/generic/goldfish/tools/mk_combined_img.py
+MK_COMBINE_QEMU_IMAGE := $(HOST_OUT_EXECUTABLES)/mk_combined_img
 SGDISK_HOST := $(HOST_OUT_EXECUTABLES)/sgdisk
 
 ifdef INSTALLED_SYSTEMIMAGE_TARGET
@@ -4639,11 +5286,11 @@
 $(INSTALLED_SYSTEM_QEMU_CONFIG): $(INSTALLED_SUPERIMAGE_TARGET) $(INSTALLED_VBMETAIMAGE_TARGET)
 	@echo "$(PRODUCT_OUT)/vbmeta.img vbmeta 1" > $@
 	@echo "$(INSTALLED_SUPERIMAGE_TARGET) super 2" >> $@
-$(INSTALLED_QEMU_SYSTEMIMAGE): $(INSTALLED_VBMETAIMAGE_TARGET) $(MK_COMBINE_QEMU_IMAGE_SH) $(SGDISK_HOST) $(SIMG2IMG) \
+$(INSTALLED_QEMU_SYSTEMIMAGE): $(INSTALLED_VBMETAIMAGE_TARGET) $(MK_COMBINE_QEMU_IMAGE) $(SGDISK_HOST) $(SIMG2IMG) \
     $(INSTALLED_SUPERIMAGE_TARGET) $(INSTALLED_SYSTEM_QEMU_CONFIG)
 	@echo Create system-qemu.img now
 	(export SGDISK=$(SGDISK_HOST) SIMG2IMG=$(SIMG2IMG); \
-     $(MK_COMBINE_QEMU_IMAGE_SH) -i $(INSTALLED_SYSTEM_QEMU_CONFIG) -o $@)
+     $(MK_COMBINE_QEMU_IMAGE) -i $(INSTALLED_SYSTEM_QEMU_CONFIG) -o $@)
 
 systemimage: $(INSTALLED_QEMU_SYSTEMIMAGE)
 droidcore: $(INSTALLED_QEMU_SYSTEMIMAGE)
@@ -4657,6 +5304,20 @@
 vendorimage: $(INSTALLED_QEMU_VENDORIMAGE)
 droidcore: $(INSTALLED_QEMU_VENDORIMAGE)
 endif
+
+ifdef INSTALLED_RAMDISK_TARGET
+ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
+ifdef INTERNAL_VENDOR_RAMDISK_TARGET
+INSTALLED_QEMU_RAMDISKIMAGE := $(PRODUCT_OUT)/ramdisk-qemu.img
+$(INSTALLED_QEMU_RAMDISKIMAGE): $(INTERNAL_VENDOR_RAMDISK_TARGET) $(INSTALLED_RAMDISK_TARGET)
+	@echo Create ramdisk-qemu.img
+	(cat $(INSTALLED_RAMDISK_TARGET) $(INTERNAL_VENDOR_RAMDISK_TARGET) > $(INSTALLED_QEMU_RAMDISKIMAGE))
+
+droidcore: $(INSTALLED_QEMU_RAMDISKIMAGE)
+endif
+endif
+endif
+
 ifdef INSTALLED_PRODUCTIMAGE_TARGET
 INSTALLED_QEMU_PRODUCTIMAGE := $(PRODUCT_OUT)/product-qemu.img
 $(INSTALLED_QEMU_PRODUCTIMAGE): $(INSTALLED_PRODUCTIMAGE_TARGET) $(MK_QEMU_IMAGE_SH) $(SGDISK_HOST) $(SIMG2IMG)
@@ -4666,14 +5327,14 @@
 productimage: $(INSTALLED_QEMU_PRODUCTIMAGE)
 droidcore: $(INSTALLED_QEMU_PRODUCTIMAGE)
 endif
-ifdef INSTALLED_PRODUCT_SERVICESIMAGE_TARGET
-INSTALLED_QEMU_PRODUCT_SERVICESIMAGE := $(PRODUCT_OUT)/product_services-qemu.img
-$(INSTALLED_QEMU_PRODUCT_SERVICESIMAGE): $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET) $(MK_QEMU_IMAGE_SH) $(SGDISK_HOST) $(SIMG2IMG)
-	@echo Create product_services-qemu.img
-	(export SGDISK=$(SGDISK_HOST) SIMG2IMG=$(SIMG2IMG); $(MK_QEMU_IMAGE_SH) $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET))
+ifdef INSTALLED_SYSTEM_EXTIMAGE_TARGET
+INSTALLED_QEMU_SYSTEM_EXTIMAGE := $(PRODUCT_OUT)/system_ext-qemu.img
+$(INSTALLED_QEMU_SYSTEM_EXTIMAGE): $(INSTALLED_SYSTEM_EXTIMAGE_TARGET) $(MK_QEMU_IMAGE_SH) $(SGDISK_HOST) $(SIMG2IMG)
+	@echo Create system_ext-qemu.img
+	(export SGDISK=$(SGDISK_HOST) SIMG2IMG=$(SIMG2IMG); $(MK_QEMU_IMAGE_SH) $(INSTALLED_SYSTEM_EXTIMAGE_TARGET))
 
-productservicesimage: $(INSTALLED_QEMU_PRODUCT_SERVICESIMAGE)
-droidcore: $(INSTALLED_QEMU_PRODUCT_SERVICESIMAGE)
+systemextimage: $(INSTALLED_QEMU_SYSTEM_EXTIMAGE)
+droidcore: $(INSTALLED_QEMU_SYSTEM_EXTIMAGE)
 endif
 ifdef INSTALLED_ODMIMAGE_TARGET
 INSTALLED_QEMU_ODMIMAGE := $(PRODUCT_OUT)/odm-qemu.img
@@ -4686,7 +5347,6 @@
 endif
 
 QEMU_VERIFIED_BOOT_PARAMS := $(PRODUCT_OUT)/VerifiedBootParams.textproto
-MK_VBMETA_BOOT_KERNEL_CMDLINE_SH := device/generic/goldfish/tools/mk_vbmeta_boot_params.sh
 $(QEMU_VERIFIED_BOOT_PARAMS): $(INSTALLED_VBMETAIMAGE_TARGET) $(INSTALLED_SYSTEMIMAGE_TARGET) \
     $(MK_VBMETA_BOOT_KERNEL_CMDLINE_SH) $(AVBTOOL)
 	@echo Creating $@
@@ -4759,7 +5419,6 @@
 	$(ALL_DEFAULT_INSTALLED_MODULES) \
 	$(INSTALLED_RAMDISK_TARGET) \
 	$(ALL_DOCS) \
-	$(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/api-stubs-docs_annotations.zip \
 	$(ALL_SDK_FILES)
 endif
 
@@ -4796,6 +5455,7 @@
 	$(APPCOMPAT_ZIP) \
 	$(INSTALLED_SYSTEMIMAGE_TARGET) \
 	$(INSTALLED_QEMU_SYSTEMIMAGE) \
+	$(INSTALLED_QEMU_RAMDISKIMAGE) \
 	$(INSTALLED_QEMU_VENDORIMAGE) \
 	$(QEMU_VERIFIED_BOOT_PARAMS) \
 	$(INSTALLED_USERDATAIMAGE_TARGET) \
@@ -4906,3 +5566,34 @@
 ifneq ($(sdk_repo_goal),)
 include $(TOPDIR)development/build/tools/sdk_repo.mk
 endif
+
+# -----------------------------------------------------------------
+# Soong generates the list of all shared libraries that are depended on by fuzz
+# targets. It saves this list as a source:destination pair to
+# FUZZ_TARGET_SHARED_DEPS_INSTALL_PAIRS, where the source is the path to the
+# build of the unstripped shared library, and the destination is the
+# /data/fuzz/$ARCH/lib (for device) or /fuzz/$ARCH/lib (for host) directory
+# where fuzz target shared libraries are to be "reinstalled". The
+# copy-many-files below generates the rules to copy the unstripped shared
+# libraries to the device or host "reinstallation" directory. These rules are
+# depended on by each module in soong_cc_prebuilt.mk, where the module will have
+# a dependency on each shared library that it needs to be "reinstalled".
+FUZZ_SHARED_DEPS := $(call copy-many-files,$(strip $(FUZZ_TARGET_SHARED_DEPS_INSTALL_PAIRS)))
+
+# -----------------------------------------------------------------
+# The rule to build all fuzz targets, and package them.
+# Note: The packages are created in Soong, and in a perfect world,
+# we'd be able to create the phony rule there. But, if we want to
+# have dist goals for the fuzz target, we need to have the PHONY
+# target defined in make. MakeVarsContext.DistForGoal doesn't take
+# into account that a PHONY rule create by Soong won't be available
+# during make, and such will fail with `writing to readonly
+# directory`, because kati will see 'haiku' as being a file, not a
+# phony target.
+.PHONY: haiku
+haiku: $(SOONG_FUZZ_PACKAGING_ARCH_MODULES) $(ALL_FUZZ_TARGETS)
+$(call dist-for-goals,haiku,$(SOONG_FUZZ_PACKAGING_ARCH_MODULES))
+
+# -----------------------------------------------------------------
+# The makefile for haiku line coverage.
+include $(BUILD_SYSTEM)/line_coverage.mk
diff --git a/core/aapt2.mk b/core/aapt2.mk
index fbbf3dd..7b17df4 100644
--- a/core/aapt2.mk
+++ b/core/aapt2.mk
@@ -61,8 +61,8 @@
 
 # Always set --pseudo-localize, it will be stripped out later for release
 # builds that don't want it.
-$(my_res_resources_flat) $(my_overlay_resources_flat) $(my_resources_flata): \
-  PRIVATE_AAPT2_CFLAGS := --pseudo-localize
+$(my_res_resources_flat) $(my_overlay_resources_flat) $(my_resources_flata) $(my_generated_resources_flata) $(my_zippped_resources_flata): \
+  PRIVATE_AAPT2_CFLAGS := --pseudo-localize $(filter --legacy,$(LOCAL_AAPT_FLAGS))
 
 # TODO(b/78447299): Forbid LOCAL_STATIC_JAVA_AAR_LIBRARIES in aapt2 and remove
 # support for it.
diff --git a/core/android_manifest.mk b/core/android_manifest.mk
index 1f7acf1..8fab9c6 100644
--- a/core/android_manifest.mk
+++ b/core/android_manifest.mk
@@ -23,12 +23,6 @@
     $(call intermediates-dir-for,JAVA_LIBRARIES,$(lib),,COMMON)/manifest/AndroidManifest.xml)
 endif
 
-# With aapt2, we'll link in the built resource from the AAR.
-ifneq ($(LOCAL_USE_AAPT2),true)
-  LOCAL_RESOURCE_DIR += $(foreach lib, $(LOCAL_STATIC_JAVA_AAR_LIBRARIES),\
-    $(call intermediates-dir-for,JAVA_LIBRARIES,$(lib),,COMMON)/aar/res)
-endif
-
 full_android_manifest := $(intermediates.COMMON)/manifest/AndroidManifest.xml
 
 ifneq (,$(strip $(my_full_libs_manifest_files)))
@@ -48,19 +42,21 @@
 endif
 
 my_target_sdk_version := $(call module-target-sdk-version)
+my_min_sdk_version := $(call module-min-sdk-version)
 
 ifdef TARGET_BUILD_APPS
   ifndef TARGET_BUILD_APPS_USE_PREBUILT_SDK
     ifeq ($(my_target_sdk_version),$(PLATFORM_VERSION_CODENAME))
       ifdef UNBUNDLED_BUILD_TARGET_SDK_WITH_API_FINGERPRINT
         my_target_sdk_version := $(my_target_sdk_version).$$(cat $(API_FINGERPRINT))
+        my_min_sdk_version := $(my_min_sdk_version).$$(cat $(API_FINGERPRINT))
         $(fixed_android_manifest): $(API_FINGERPRINT)
       endif
     endif
   endif
 endif
 
-$(fixed_android_manifest): PRIVATE_MIN_SDK_VERSION := $(call module-min-sdk-version)
+$(fixed_android_manifest): PRIVATE_MIN_SDK_VERSION := $(my_min_sdk_version)
 $(fixed_android_manifest): PRIVATE_TARGET_SDK_VERSION := $(my_target_sdk_version)
 
 my_exported_sdk_libs_file := $(call local-intermediates-dir,COMMON)/exported-sdk-libs
diff --git a/core/app_certificate_validate.mk b/core/app_certificate_validate.mk
index c01526a..1ccacfb 100644
--- a/core/app_certificate_validate.mk
+++ b/core/app_certificate_validate.mk
@@ -3,7 +3,7 @@
   ifneq (,$(filter $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))%,$(LOCAL_CERTIFICATE)))
     CERTIFICATE_VIOLATION_MODULES += $(LOCAL_MODULE)
     ifeq (true,$(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT))
-      $(if $(filter $(LOCAL_MODULE),$(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)),,\
+      $(if $(filter $(LOCAL_MODULE),$(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_ALLOW_LIST)),,\
         $(call pretty-error,The module in product partition cannot be signed with certificate in system.))
     endif
   endif
diff --git a/core/app_prebuilt_internal.mk b/core/app_prebuilt_internal.mk
index dd263dd..ab574b3 100644
--- a/core/app_prebuilt_internal.mk
+++ b/core/app_prebuilt_internal.mk
@@ -41,7 +41,7 @@
 include $(BUILD_SYSTEM)/base_rules.mk
 built_module := $(LOCAL_BUILT_MODULE)
 
-# Run veridex on product, product_services and vendor modules.
+# Run veridex on product, system_ext and vendor modules.
 # We skip it for unbundled app builds where we cannot build veridex.
 module_run_appcompat :=
 ifeq (true,$(non_system_module))
@@ -92,6 +92,32 @@
 endif
 endif
 
+# Verify LOCAL_USES_LIBRARIES/LOCAL_OPTIONAL_USES_LIBRARIES
+# If LOCAL_ENFORCE_USES_LIBRARIES is not set, default to true if either of LOCAL_USES_LIBRARIES or
+# LOCAL_OPTIONAL_USES_LIBRARIES are specified.
+# Will change the default to true unconditionally in the future.
+ifndef LOCAL_ENFORCE_USES_LIBRARIES
+  ifneq (,$(strip $(LOCAL_USES_LIBRARIES)$(LOCAL_OPTIONAL_USES_LIBRARIES)))
+    LOCAL_ENFORCE_USES_LIBRARIES := true
+  endif
+endif
+
+my_enforced_uses_libraries :=
+ifdef LOCAL_ENFORCE_USES_LIBRARIES
+  my_enforced_uses_libraries := $(intermediates.COMMON)/enforce_uses_libraries.timestamp
+  $(my_enforced_uses_libraries): PRIVATE_USES_LIBRARIES := $(LOCAL_USES_LIBRARIES)
+  $(my_enforced_uses_libraries): PRIVATE_OPTIONAL_USES_LIBRARIES := $(LOCAL_OPTIONAL_USES_LIBRARIES)
+  $(my_enforced_uses_libraries): $(BUILD_SYSTEM)/verify_uses_libraries.sh $(AAPT)
+  $(my_enforced_uses_libraries): $(my_prebuilt_src_file)
+	@echo Verifying uses-libraries: $<
+	aapt_binary=$(AAPT) \
+	  uses_library_names="$(strip $(PRIVATE_USES_LIBRARIES))" \
+	  optional_uses_library_names="$(strip $(PRIVATE_OPTIONAL_USES_LIBRARIES))" \
+	  $(BUILD_SYSTEM)/verify_uses_libraries.sh $<
+	touch $@
+  $(built_module) : $(my_enforced_uses_libraries)
+endif
+
 dex_preopt_profile_src_file := $(my_prebuilt_src_file)
 
 rs_compatibility_jni_libs :=
@@ -137,10 +163,26 @@
   $(built_module) : $(LOCAL_CERTIFICATE).pk8 $(LOCAL_CERTIFICATE).x509.pem
   $(built_module) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8
   $(built_module) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem
+
+  additional_certificates := $(foreach c,$(LOCAL_ADDITIONAL_CERTIFICATES), $(c).x509.pem $(c).pk8)
+  $(built_module): $(additional_certificates)
+  $(built_module): PRIVATE_ADDITIONAL_CERTIFICATES := $(additional_certificates)
+
+  $(built_module): $(LOCAL_CERTIFICATE_LINEAGE)
+  $(built_module): PRIVATE_CERTIFICATE_LINEAGE := $(LOCAL_CERTIFICATE_LINEAGE)
+endif
+
+ifneq ($(LOCAL_MODULE_STEM),)
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
+else
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
 endif
 
 include $(BUILD_SYSTEM)/app_certificate_validate.mk
 
+# Set a actual_partition_tag (calculated in base_rules.mk) for the package.
+PACKAGES.$(LOCAL_MODULE).PARTITION := $(actual_partition_tag)
+
 # Disable dex-preopt of prebuilts to save space, if requested.
 ifndef LOCAL_DEX_PREOPT
 ifeq ($(DONT_DEXPREOPT_PREBUILTS),true)
@@ -189,17 +231,6 @@
 $(LOCAL_BUILT_MODULE): PRIVATE_INSTALLED_MODULE := $(LOCAL_INSTALLED_MODULE)
 endif
 
-ifneq ($(BUILD_PLATFORM_ZIP),)
-$(built_module) : .KATI_IMPLICIT_OUTPUTS := $(dir $(LOCAL_BUILT_MODULE))package.dex.apk
-endif
-ifneq ($(LOCAL_CERTIFICATE),PRESIGNED)
-ifdef LOCAL_DEX_PREOPT
-$(built_module) : PRIVATE_STRIP_SCRIPT := $(intermediates)/strip.sh
-$(built_module) : $(intermediates)/strip.sh
-$(built_module) : | $(DEXPREOPT_STRIP_DEPS)
-$(built_module) : .KATI_DEPFILE := $(built_module).d
-endif
-endif
 ifeq ($(module_run_appcompat),true)
 $(built_module) : $(AAPT2)
 endif
@@ -209,23 +240,11 @@
 ifeq (true, $(LOCAL_UNCOMPRESS_DEX))
 	$(uncompress-dexs)
 endif  # LOCAL_UNCOMPRESS_DEX
-ifdef LOCAL_DEX_PREOPT
-ifneq ($(BUILD_PLATFORM_ZIP),)
-	@# Keep a copy of apk with classes.dex unstripped
-	$(hide) cp -f $@ $(dir $@)package.dex.apk
-endif  # BUILD_PLATFORM_ZIP
-endif  # LOCAL_DEX_PREOPT
 ifneq ($(LOCAL_CERTIFICATE),PRESIGNED)
-	@# Only strip out files if we can re-sign the package.
-# Run appcompat before stripping the classes.dex file.
 ifeq ($(module_run_appcompat),true)
 	$(call appcompat-header, aapt2)
 	$(run-appcompat)
 endif  # module_run_appcompat
-ifdef LOCAL_DEX_PREOPT
-	mv -f $@ $@.tmp
-	$(PRIVATE_STRIP_SCRIPT) $@.tmp $@
-endif  # LOCAL_DEX_PREOPT
 	$(sign-package)
 	# No need for align-package because sign-package takes care of alignment
 else  # LOCAL_CERTIFICATE == PRESIGNED
diff --git a/core/aux_config.mk b/core/aux_config.mk
index a508a2d..10d2536 100644
--- a/core/aux_config.mk
+++ b/core/aux_config.mk
@@ -32,7 +32,7 @@
 
 # setup AUX globals
 AUX_SHLIB_SUFFIX := .so
-AUX_GLOBAL_ARFLAGS := cqsD
+AUX_GLOBAL_ARFLAGS := crsPD
 AUX_STATIC_LIB_SUFFIX := .a
 
 # Load ever-lasting "indexed" version of AUX variant environment; it is treated as READ-ONLY from this
@@ -149,6 +149,8 @@
 variant_sfx :=_aux_variant_config.mk
 os_sfx :=_aux_os_config.mk
 
+ifdef AUX_OS_VARIANT_LIST
+
 config_roots := $(wildcard device vendor)
 all_configs :=
 ifdef config_roots
@@ -180,4 +182,6 @@
 )
 endif
 
+endif # AUX_OS_VARIANT_LIST
+
 INSTALLED_AUX_TARGETS :=
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 94aa1e4..e608ee7 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -81,11 +81,17 @@
 LOCAL_ODM_MODULE := true
 else ifneq ($(filter $(TARGET_OUT_PRODUCT)/%,$(_path)),)
 LOCAL_PRODUCT_MODULE := true
-else ifneq ($(filter $(TARGET_OUT_PRODUCT_SERVICES)/%,$(_path)),)
-LOCAL_PRODUCT_SERVICES_MODULE := true
+else ifneq ($(filter $(TARGET_OUT_SYSTEM_EXT)/%,$(_path)),)
+LOCAL_SYSTEM_EXT_MODULE := true
 endif
 _path :=
 
+# TODO(b/135957588) Remove following workaround
+# LOCAL_PRODUCT_SERVICES_MODULE to LOCAL_PRODUCT_MODULE for all Android.mk
+ifndef LOCAL_PRODUCT_MODULE
+LOCAL_PRODUCT_MODULE := $(LOCAL_PRODUCT_SERVICES_MODULE)
+endif
+
 ifndef LOCAL_PROPRIETARY_MODULE
   LOCAL_PROPRIETARY_MODULE := $(LOCAL_VENDOR_MODULE)
 endif
@@ -98,7 +104,7 @@
 
 non_system_module := $(filter true, \
    $(LOCAL_PRODUCT_MODULE) \
-   $(LOCAL_PRODUCT_SERVICES_MODULE) \
+   $(LOCAL_SYSTEM_EXT_MODULE) \
    $(LOCAL_VENDOR_MODULE) \
    $(LOCAL_PROPRIETARY_MODULE))
 
@@ -109,12 +115,6 @@
 ifeq ($(my_host_cross),true)
   my_module_tags :=
 endif
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-ifdef LOCAL_2ND_ARCH_VAR_PREFIX
-# Don't pull in modules by tags if this is for translation TARGET_2ND_ARCH.
-  my_module_tags :=
-endif
-endif
 
 # Ninja has an implicit dependency on the command being run, and kati will
 # regenerate the ninja manifest if any read makefile changes, so there is no
@@ -167,19 +167,14 @@
   ifeq (true,$(LOCAL_UNINSTALLABLE_MODULE))
     $(call pretty-warning,LOCAL_MODULE_TAGS := $(my_bad_module_tags) does not do anything for uninstallable modules)
   endif
-  ifneq ($(BUILD_BROKEN_ENG_DEBUG_TAGS),true)
-    $(call pretty-error,LOCAL_MODULE_TAGS := $(my_bad_module_tags) is obsolete. See $(CHANGES_URL)#LOCAL_MODULE_TAGS)
-  else
-    $(call pretty-warning,LOCAL_MODULE_TAGS := $(my_bad_module_tags) is deprecated. See $(CHANGES_URL)#LOCAL_MODULE_TAGS)
-  endif
-  my_bad_module_tags :=
+  $(call pretty-error,LOCAL_MODULE_TAGS := $(my_bad_module_tags) is obsolete. See $(CHANGES_URL)#LOCAL_MODULE_TAGS)
 endif
 
 # Only the tags mentioned in this test are expected to be set by module
 # makefiles. Anything else is either a typo or a source of unexpected
 # behaviors.
-ifneq ($(filter-out debug eng tests optional samples,$(my_module_tags)),)
-$(call pretty-error,unusual tags: $(filter-out debug eng tests optional samples,$(my_module_tags)))
+ifneq ($(filter-out tests optional samples,$(my_module_tags)),)
+$(call pretty-error,unusual tags: $(filter-out tests optional samples,$(my_module_tags)))
 endif
 
 # Add implicit tags.
@@ -188,11 +183,10 @@
 # file, tag the module as "gnu".  Search for "*_GPL*", "*_LGPL*" and "*_MPL*"
 # so that we can also find files like MODULE_LICENSE_GPL_AND_AFL
 #
-license_files := $(call find-parent-file,$(LOCAL_PATH),MODULE_LICENSE*)
 gpl_license_file := $(call find-parent-file,$(LOCAL_PATH),MODULE_LICENSE*_GPL* MODULE_LICENSE*_MPL* MODULE_LICENSE*_LGPL*)
 ifneq ($(gpl_license_file),)
   my_module_tags += gnu
-  ALL_GPL_MODULE_LICENSE_FILES := $(sort $(ALL_GPL_MODULE_LICENSE_FILES) $(gpl_license_file))
+  ALL_GPL_MODULE_LICENSE_FILES += $(gpl_license_file)
 endif
 
 LOCAL_MODULE_CLASS := $(strip $(LOCAL_MODULE_CLASS))
@@ -203,17 +197,7 @@
 my_32_64_bit_suffix := $(if $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)IS_64_BIT),64,32)
 
 ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-# When in TARGET_TRANSLATE_2ND_ARCH both TARGET_ARCH and TARGET_2ND_ARCH are 32-bit,
-# to avoid path conflict we force using LOCAL_MODULE_PATH_64 for the first arch.
-ifdef LOCAL_2ND_ARCH_VAR_PREFIX
-my_multilib_module_path := $(LOCAL_MODULE_PATH_32)
-else  # ! LOCAL_2ND_ARCH_VAR_PREFIX
-my_multilib_module_path := $(LOCAL_MODULE_PATH_64)
-endif  # ! LOCAL_2ND_ARCH_VAR_PREFIX
-else  # ! TARGET_TRANSLATE_2ND_ARCH
 my_multilib_module_path := $(strip $(LOCAL_MODULE_PATH_$(my_32_64_bit_suffix)))
-endif # ! TARGET_TRANSLATE_2ND_ARCH
 ifdef my_multilib_module_path
 my_module_path := $(my_multilib_module_path)
 else
@@ -223,23 +207,39 @@
 my_module_relative_path := $(strip $(LOCAL_MODULE_RELATIVE_PATH))
 ifdef LOCAL_IS_HOST_MODULE
   partition_tag :=
+  actual_partition_tag :=
 else
 ifeq (true,$(strip $(LOCAL_VENDOR_MODULE)))
   partition_tag := _VENDOR
+  # A vendor module could be on the vendor partition at "vendor" or the system
+  # partition at "system/vendor".
+  actual_partition_tag := $(if $(filter true,$(BOARD_USES_VENDORIMAGE)),vendor,system)
 else ifeq (true,$(strip $(LOCAL_OEM_MODULE)))
   partition_tag := _OEM
+  actual_partition_tag := oem
 else ifeq (true,$(strip $(LOCAL_ODM_MODULE)))
   partition_tag := _ODM
+  # An ODM module could be on the odm partition at "odm", the vendor partition
+  # at "vendor/odm", or the system partition at "system/vendor/odm".
+  actual_partition_tag := $(if $(filter true,$(BOARD_USES_ODMIMAGE)),odm,$(if $(filter true,$(BOARD_USES_VENDORIMAGE)),vendor,system))
 else ifeq (true,$(strip $(LOCAL_PRODUCT_MODULE)))
   partition_tag := _PRODUCT
-else ifeq (true,$(strip $(LOCAL_PRODUCT_SERVICES_MODULE)))
-  partition_tag := _PRODUCT_SERVICES
+  # A product module could be on the product partition at "product" or the
+  # system partition at "system/product".
+  actual_partition_tag := $(if $(filter true,$(BOARD_USES_PRODUCTIMAGE)),product,system)
+else ifeq (true,$(strip $(LOCAL_SYSTEM_EXT_MODULE)))
+  partition_tag := _SYSTEM_EXT
+  # A system_ext-specific module could be on the system_ext partition at
+  # "system_ext" or the system partition at "system/system_ext".
+  actual_partition_tag := $(if $(filter true,$(BOARD_USES_SYSTEM_EXTIMAGE)),system_ext,system)
 else ifeq (NATIVE_TESTS,$(LOCAL_MODULE_CLASS))
   partition_tag := _DATA
+  actual_partition_tag := data
 else
   # The definition of should-install-to-system will be different depending
   # on which goal (e.g., sdk or just droid) is being built.
   partition_tag := $(if $(call should-install-to-system,$(my_module_tags)),,_DATA)
+  actual_partition_tag := $(if $(partition_tag),data,system)
 endif
 endif
 # For test modules that lack a suite tag, set null-suite as the default.
@@ -326,9 +326,19 @@
 endif
 $(module_id) := $(LOCAL_PATH)
 
-intermediates := $(call local-intermediates-dir,,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))
-intermediates.COMMON := $(call local-intermediates-dir,COMMON)
-generated_sources_dir := $(call local-generated-sources-dir)
+# These are the same as local-intermediates-dir / local-generated-sources dir, but faster
+intermediates.COMMON := $($(my_prefix)OUT_COMMON_INTERMEDIATES)/$(LOCAL_MODULE_CLASS)/$(LOCAL_MODULE)_intermediates
+ifneq (,$(filter $(my_prefix)$(LOCAL_MODULE_CLASS),$(COMMON_MODULE_CLASSES)))
+  intermediates := $($(my_prefix)OUT_COMMON_INTERMEDIATES)/$(LOCAL_MODULE_CLASS)/$(LOCAL_MODULE)_intermediates
+  generated_sources_dir := $($(my_prefix)OUT_COMMON_GEN)/$(LOCAL_MODULE_CLASS)/$(LOCAL_MODULE)_intermediates
+else
+  ifneq (,$(filter $(LOCAL_MODULE_CLASS),$(PER_ARCH_MODULE_CLASSES)))
+    intermediates := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_INTERMEDIATES)/$(LOCAL_MODULE_CLASS)/$(LOCAL_MODULE)_intermediates
+  else
+    intermediates := $($(my_prefix)OUT_INTERMEDIATES)/$(LOCAL_MODULE_CLASS)/$(LOCAL_MODULE)_intermediates
+  endif
+  generated_sources_dir := $($(my_prefix)OUT_GEN)/$(LOCAL_MODULE_CLASS)/$(LOCAL_MODULE)_intermediates
+endif
 
 ifneq ($(LOCAL_OVERRIDES_MODULES),)
   ifndef LOCAL_IS_HOST_MODULE
@@ -336,6 +346,8 @@
       EXECUTABLES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
     else ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
       SHARED_LIBRARIES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
+    else ifeq ($(LOCAL_MODULE_CLASS),ETC)
+      ETC.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
     else
       $(call pretty-error,LOCAL_MODULE_CLASS := $(LOCAL_MODULE_CLASS) cannot use LOCAL_OVERRIDES_MODULES)
     endif
@@ -401,7 +413,7 @@
 logtags_sources := $(filter %.logtags,$(LOCAL_SRC_FILES)) $(LOCAL_LOGTAGS_FILES)
 
 ifneq ($(strip $(logtags_sources)),)
-event_log_tags := $(addprefix $(LOCAL_PATH)/,$(logtags_sources))
+event_log_tags := $(foreach f,$(addprefix $(LOCAL_PATH)/,$(logtags_sources)),$(call clean-path,$(f)))
 else
 event_log_tags :=
 endif
@@ -523,11 +535,11 @@
 
 # Only set up copy rules once, even if another arch variant shares it
 my_vintf_new_pairs := $(filter-out $(ALL_VINTF_MANIFEST_FRAGMENTS_LIST),$(my_vintf_pairs))
-my_vintf_new_installed := $(call copy-many-vintf-manifest-files-checked,$(my_vintf_pairs))
+my_vintf_new_installed := $(call copy-many-vintf-manifest-files-checked,$(my_vintf_new_pairs))
 
 ALL_VINTF_MANIFEST_FRAGMENTS_LIST += $(my_vintf_new_pairs)
 
-$(my_all_targets) : $(my_vintf_installed)
+$(my_all_targets) : $(my_vintf_new_installed)
 endif # LOCAL_VINTF_FRAGMENTS
 endif # !LOCAL_IS_HOST_MODULE
 endif # !LOCAL_UNINSTALLABLE_MODULE
@@ -567,21 +579,39 @@
 # Source to relative dst file paths for reuse in LOCAL_COMPATIBILITY_SUITE.
 my_test_data_file_pairs :=
 
-ifneq ($(filter NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
+ifneq ($(strip $(filter NATIVE_TESTS,$(LOCAL_MODULE_CLASS)) $(LOCAL_IS_FUZZ_TARGET)),)
 ifneq ($(strip $(LOCAL_TEST_DATA)),)
 ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
 
-my_test_data_pairs := $(strip $(foreach td,$(LOCAL_TEST_DATA), \
-    $(eval _file := $(call word-colon,2,$(td))) \
-    $(if $(_file), \
-      $(eval _src_base := $(call word-colon,1,$(td))), \
-      $(eval _src_base := $(LOCAL_PATH)) \
-        $(eval _file := $(call word-colon,1,$(td)))) \
-    $(if $(call streq,$(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK)),, \
-      $(if $(findstring ..,$(_file)),$(error $(LOCAL_MODULE_MAKEFILE): LOCAL_TEST_DATA may not include '..': $(_file))) \
-      $(if $(filter /%,$(_src_base) $(_file)),$(error $(LOCAL_MODULE_MAKEFILE): LOCAL_TEST_DATA may not include absolute paths: $(_src_base) $(_file)))) \
-    $(eval my_test_data_file_pairs := $(my_test_data_file_pairs) $(call append-path,$(_src_base),$(_file)):$(_file)) \
-    $(call append-path,$(_src_base),$(_file)):$(call append-path,$(my_module_path),$(_file))))
+ifeq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+  define copy_test_data_pairs
+    _src_base := $$(call word-colon,1,$$(td))
+    _file := $$(call word-colon,2,$$(td))
+    my_test_data_pairs += $$(call append-path,$$(_src_base),$$(_file)):$$(call append-path,$$(my_module_path),$$(_file))
+    my_test_data_file_pairs += $$(call append-path,$$(_src_base),$$(_file)):$$(_file)
+  endef
+else
+  define copy_test_data_pairs
+    _src_base := $$(call word-colon,1,$$(td))
+    _file := $$(call word-colon,2,$$(td))
+    ifndef _file
+      _file := $$(_src_base)
+      _src_base := $$(LOCAL_PATH)
+    endif
+    ifneq (,$$(findstring ..,$$(_file)))
+      $$(call pretty-error,LOCAL_TEST_DATA may not include '..': $$(_file))
+    endif
+    ifneq (,$$(filter/%,$$(_src_base) $$(_file)))
+      $$(call pretty-error,LOCAL_TEST_DATA may not include absolute paths: $$(_src_base) $$(_file))
+    endif
+    my_test_data_pairs += $$(call append-path,$$(_src_base),$$(_file)):$$(call append-path,$$(my_module_path),$$(_file))
+    my_test_data_file_pairs += $$(call append-path,$$(_src_base),$$(_file)):$$(_file)
+  endef
+endif
+
+$(foreach td,$(LOCAL_TEST_DATA),$(eval $(copy_test_data_pairs)))
+
+copy_test_data_pairs :=
 
 my_installed_test_data := $(call copy-many-files,$(my_test_data_pairs))
 $(LOCAL_INSTALLED_MODULE): $(my_installed_test_data)
@@ -594,6 +624,7 @@
 ## Compatibility suite files.
 ###########################################################
 ifdef LOCAL_COMPATIBILITY_SUITE
+ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
 
 # If we are building a native test or benchmark and its stem variants are not defined,
 # separate the multiple architectures into subdirectories of the testcase folder.
@@ -747,6 +778,7 @@
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
   $(eval my_compat_dist_config_$(suite) := ))
 
+endif  # LOCAL_UNINSTALLABLE_MODULE
 endif  # LOCAL_COMPATIBILITY_SUITE
 
 ###########################################################
@@ -760,7 +792,7 @@
 ## Register with ALL_MODULES
 ###########################################################
 
-ifeq ($(filter $(my_register_name),$(ALL_MODULES)),)
+ifndef ALL_MODULES.$(my_register_name).PATH
     # These keys are no longer used, they've been replaced by keys that specify
     # target/host/host_cross (REQUIRED_FROM_TARGET / REQUIRED_FROM_HOST) and similar.
     #
@@ -806,6 +838,16 @@
 ALL_MODULES.$(my_register_name).PICKUP_FILES := \
     $(ALL_MODULES.$(my_register_name).PICKUP_FILES) $(LOCAL_PICKUP_FILES)
 endif
+# Record the platform availability of this module. Note that the availability is not
+# meaningful for non-installable modules (e.g., static libs) or host modules.
+# We only care about modules that are installable to the device.
+ifeq (true,$(LOCAL_NOT_AVAILABLE_FOR_PLATFORM))
+  ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
+    ifndef LOCAL_IS_HOST_MODULE
+      ALL_MODULES.$(my_register_name).NOT_AVAILABLE_FOR_PLATFORM := true
+    endif
+  endif
+endif
 
 my_required_modules := $(LOCAL_REQUIRED_MODULES) \
     $(LOCAL_REQUIRED_MODULES_$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
@@ -813,22 +855,28 @@
 my_required_modules += $(LOCAL_REQUIRED_MODULES_$($(my_prefix)OS))
 endif
 
-###############################################################################
-## When compiling against the VNDK, add the .vendor suffix to required modules.
-###############################################################################
+##########################################################################
+## When compiling against the VNDK, add the .vendor or .product suffix to
+## required modules.
+##########################################################################
 ifneq ($(LOCAL_USE_VNDK),)
-  ####################################################
-  ## Soong modules may be built twice, once for /system
-  ## and once for /vendor. If we're using the VNDK,
-  ## switch all soong libraries over to the /vendor
-  ## variant.
-  ####################################################
+  #####################################################
+  ## Soong modules may be built three times, once for
+  ## /system, once for /vendor and once for /product.
+  ## If we're using the VNDK, switch all soong
+  ## libraries over to the /vendor or /product variant.
+  #####################################################
   ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
     # We don't do this renaming for soong-defined modules since they already
-    # have correct names (with .vendor suffix when necessary) in their
-    # LOCAL_*_LIBRARIES.
-    my_required_modules := $(foreach l,$(my_required_modules),\
-      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    # have correct names (with .vendor or .product suffix when necessary) in
+    # their LOCAL_*_LIBRARIES.
+    ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+      my_required_modules := $(foreach l,$(my_required_modules),\
+        $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+    else
+      my_required_modules := $(foreach l,$(my_required_modules),\
+        $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    endif
   endif
 endif
 
@@ -890,18 +938,24 @@
 ##########################################################
 # Track module-level dependencies.
 # Use $(LOCAL_MODULE) instead of $(my_register_name) to ignore module's bitness.
-ALL_DEPS.MODULES := $(ALL_DEPS.MODULES) $(LOCAL_MODULE)
+ifneq (,$(filter deps-license,$(MAKECMDGOALS)))
+ALL_DEPS.MODULES += $(LOCAL_MODULE)
 ALL_DEPS.$(LOCAL_MODULE).ALL_DEPS := $(sort \
-  $(ALL_MODULES.$(LOCAL_MODULE).ALL_DEPS) \
+  $(ALL_DEPS.$(LOCAL_MODULE).ALL_DEPS) \
   $(LOCAL_STATIC_LIBRARIES) \
   $(LOCAL_WHOLE_STATIC_LIBRARIES) \
   $(LOCAL_SHARED_LIBRARIES) \
+  $(LOCAL_DYLIB_LIBRARIES) \
+  $(LOCAL_RLIB_LIBRARIES) \
+  $(LOCAL_PROC_MACRO_LIBRARIES) \
   $(LOCAL_HEADER_LIBRARIES) \
   $(LOCAL_STATIC_JAVA_LIBRARIES) \
-  $(LOCAL_JAVA_LIBRARIES)\
+  $(LOCAL_JAVA_LIBRARIES) \
   $(LOCAL_JNI_SHARED_LIBRARIES))
 
+license_files := $(call find-parent-file,$(LOCAL_PATH),MODULE_LICENSE*)
 ALL_DEPS.$(LOCAL_MODULE).LICENSE := $(sort $(ALL_DEPS.$(LOCAL_MODULE).LICENSE) $(license_files))
+endif
 
 ###########################################################
 ## Take care of my_module_tags
@@ -911,14 +965,14 @@
 ALL_MODULE_TAGS := $(sort $(ALL_MODULE_TAGS) $(my_module_tags))
 
 # Add this module name to the tag list of each specified tag.
-$(foreach tag,$(my_module_tags),\
+$(foreach tag,$(filter-out optional,$(my_module_tags)),\
     $(eval ALL_MODULE_NAME_TAGS.$(tag) := $$(ALL_MODULE_NAME_TAGS.$(tag)) $(my_register_name)))
 
 ###########################################################
 ## umbrella targets used to verify builds
 ###########################################################
 j_or_n :=
-ifneq (,$(filter EXECUTABLES SHARED_LIBRARIES STATIC_LIBRARIES HEADER_LIBRARIES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)))
+ifneq (,$(filter EXECUTABLES SHARED_LIBRARIES STATIC_LIBRARIES HEADER_LIBRARIES NATIVE_TESTS RLIB_LIBRARIES DYLIB_LIBRARIES PROC_MACRO_LIBRARIES,$(LOCAL_MODULE_CLASS)))
 j_or_n := native
 else
 ifneq (,$(filter JAVA_LIBRARIES APPS,$(LOCAL_MODULE_CLASS)))
diff --git a/core/binary.mk b/core/binary.mk
index 87a8a92..23a201c 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -64,8 +64,19 @@
 my_export_c_include_deps := $(LOCAL_EXPORT_C_INCLUDE_DEPS)
 my_arflags :=
 
-ifneq (,$(strip $(foreach dir,$(COVERAGE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
-ifeq (,$(strip $(foreach dir,$(COVERAGE_EXCLUDE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
+# Configure the pool to use for clang rules.
+# If LOCAL_CC or LOCAL_CXX is set don't use goma or RBE.
+my_pool :=
+ifeq (,$(strip $(my_cc))$(strip $(my_cxx)))
+  my_pool := $(GOMA_OR_RBE_POOL)
+endif
+
+# TODO(b/158212027): Remove `$(COVERAGE_PATHS)` from this condition when all users have been moved
+# to `NATIVE_COVERAGE_PATHS`.
+ifneq (,$(strip $(foreach dir,$(COVERAGE_PATHS) $(NATIVE_COVERAGE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
+# TODO(b/158212027): Remove `$(COVERAGE_EXCLUDE_PATHS)` from this condition when all users have been
+# moved to `NATIVE_COVERAGE_EXCLUDE_PATHS`.
+ifeq (,$(strip $(foreach dir,$(COVERAGE_EXCLUDE_PATHS) $(NATIVE_COVERAGE_EXCLUDE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
   my_native_coverage := true
 else
   my_native_coverage := false
@@ -77,30 +88,10 @@
   my_native_coverage := false
 endif
 
-ifneq ($(strip $(ENABLE_XOM)),false)
-  ifndef LOCAL_IS_HOST_MODULE
-    my_xom := true
-    # Disable XOM in excluded paths.
-    combined_xom_exclude_paths := $(XOM_EXCLUDE_PATHS) \
-                                  $(PRODUCT_XOM_EXCLUDE_PATHS)
-    ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_xom_exclude_paths)),\
-           $(filter $(dir)%,$(LOCAL_PATH)))),)
-      my_xom := false
-    endif
-
-    # Allow LOCAL_XOM to override the above
-    ifdef LOCAL_XOM
-      my_xom := $(LOCAL_XOM)
-    endif
-
-    ifeq ($(strip $(my_xom)),true)
-      ifeq (arm64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
-        ifeq ($(my_use_clang_lld),true)
-          my_ldflags += -Wl,-execute-only
-        endif
-      endif
-    endif
-  endif
+# Exclude directories from checking allowed manual binder interface lists.
+# TODO(b/145621474): Move this check into IInterface.h when clang-tidy no longer uses absolute paths.
+ifneq (,$(filter $(addsuffix %,$(ALLOWED_MANUAL_INTERFACE_PATHS)),$(LOCAL_PATH)))
+  my_cflags += -DDO_NOT_CHECK_MANUAL_BINDER_INTERFACES
 endif
 
 my_allow_undefined_symbols := $(strip $(LOCAL_ALLOW_UNDEFINED_SYMBOLS))
@@ -113,6 +104,8 @@
 my_ndk_sysroot :=
 my_ndk_sysroot_include :=
 my_ndk_sysroot_lib :=
+my_api_level := 10000
+
 ifneq ($(LOCAL_SDK_VERSION),)
   ifdef LOCAL_IS_HOST_MODULE
     $(error $(LOCAL_PATH): LOCAL_SDK_VERSION cannot be used in host module)
@@ -148,20 +141,14 @@
     my_ndk_api := $(call math_max,$(my_ndk_api),$(my_min_sdk_version))
   endif
 
-  my_ndk_api_def := $(my_ndk_api)
   my_ndk_hist_api := $(my_ndk_api)
   ifeq ($(my_ndk_api),current)
-    my_ndk_api_def := __ANDROID_API_FUTURE__
     # The last API level supported by the old prebuilt NDKs.
     my_ndk_hist_api := 24
+  else
+    my_api_level := $(my_ndk_api)
   endif
 
-
-  # Traditionally this has come from android/api-level.h, but with the libc
-  # headers unified it must be set by the build system since we don't have
-  # per-API level copies of that header now.
-  my_cflags += -D__ANDROID_API__=$(my_ndk_api_def)
-
   my_ndk_source_root := \
       $(HISTORICAL_NDK_VERSIONS_ROOT)/$(LOCAL_NDK_VERSION)/sources
   my_ndk_sysroot := \
@@ -284,14 +271,17 @@
 
 ifneq ($(LOCAL_USE_VNDK),)
   # Required VNDK version for vendor modules is BOARD_VNDK_VERSION.
-  my_vndk_version := $(BOARD_VNDK_VERSION)
-  ifeq ($(my_vndk_version),current)
+  my_api_level := $(BOARD_VNDK_VERSION)
+  ifeq ($(my_api_level),current)
     # Build with current PLATFORM_VNDK_VERSION.
     # If PLATFORM_VNDK_VERSION has a CODENAME, it will return
     # __ANDROID_API_FUTURE__.
-    my_vndk_version := $(call codename-or-sdk-to-sdk,$(PLATFORM_VNDK_VERSION))
+    my_api_level := $(call codename-or-sdk-to-sdk,$(PLATFORM_VNDK_VERSION))
+  else
+    # Build with current BOARD_VNDK_VERSION.
+    my_api_level := $(call codename-or-sdk-to-sdk,$(BOARD_VNDK_VERSION))
   endif
-  my_cflags += -D__ANDROID_API__=$(my_vndk_version) -D__ANDROID_VNDK__
+  my_cflags += -D__ANDROID_VNDK__
 endif
 
 ifndef LOCAL_IS_HOST_MODULE
@@ -432,15 +422,6 @@
 
 include $(BUILD_SYSTEM)/cxx_stl_setup.mk
 
-# Add static HAL libraries
-ifdef LOCAL_HAL_STATIC_LIBRARIES
-$(foreach lib, $(LOCAL_HAL_STATIC_LIBRARIES), \
-    $(eval b_lib := $(filter $(lib).%,$(BOARD_HAL_STATIC_LIBRARIES)))\
-    $(if $(b_lib), $(eval my_static_libraries += $(b_lib)),\
-                   $(eval my_static_libraries += $(lib).default)))
-b_lib :=
-endif
-
 ifneq ($(strip $(CUSTOM_$(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)LINKER)),)
   my_linker := $(CUSTOM_$(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)LINKER)
 else
@@ -473,8 +454,8 @@
   endif
   # Disable ccache (or other compiler wrapper) except gomacc, which
   # can handle -fprofile-use properly.
-  my_cc_wrapper := $(filter $(GOMA_CC),$(my_cc_wrapper))
-  my_cxx_wrapper := $(filter $(GOMA_CC),$(my_cxx_wrapper))
+  my_cc_wrapper := $(filter $(GOMA_CC) $(RBE_WRAPPER),$(my_cc_wrapper))
+  my_cxx_wrapper := $(filter $(GOMA_CC) $(RBE_WRAPPER),$(my_cxx_wrapper))
 endif
 
 ###########################################################
@@ -575,7 +556,7 @@
 ## Compile RenderScript with reflected C++
 ####################################################
 
-renderscript_sources := $(filter %.rs %.fs,$(my_src_files))
+renderscript_sources := $(filter %.rscript %.fs,$(my_src_files))
 
 ifneq (,$(renderscript_sources))
 my_soong_problems += rs
@@ -619,7 +600,7 @@
 endif
 
 bc_dep_files := $(addprefix $(renderscript_intermediate)/, \
-    $(patsubst %.fs,%.d, $(patsubst %.rs,%.d, $(notdir $(renderscript_sources)))))
+    $(patsubst %.fs,%.d, $(patsubst %.rscript,%.d, $(notdir $(renderscript_sources)))))
 
 $(RenderScript_file_stamp): PRIVATE_RS_INCLUDES := $(renderscript_includes)
 $(RenderScript_file_stamp): PRIVATE_RS_CC := $(LOCAL_RENDERSCRIPT_CC)
@@ -637,7 +618,7 @@
 LOCAL_INTERMEDIATE_TARGETS += $(RenderScript_file_stamp)
 
 rs_generated_cpps := $(addprefix \
-    $(renderscript_intermediate)/ScriptC_,$(patsubst %.fs,%.cpp, $(patsubst %.rs,%.cpp, \
+    $(renderscript_intermediate)/ScriptC_,$(patsubst %.fs,%.cpp, $(patsubst %.rscript,%.cpp, \
     $(notdir $(renderscript_sources)))))
 
 $(call track-src-file-gen,$(renderscript_sources),$(rs_generated_cpps))
@@ -816,7 +797,7 @@
     $(intermediates)/,$(y_yacc_sources:.y=.c))
 ifneq ($(y_yacc_cs),)
 $(y_yacc_cs): $(intermediates)/%.c: \
-    $(TOPDIR)$(LOCAL_PATH)/%.y $(BISON) $(BISON_DATA) \
+    $(TOPDIR)$(LOCAL_PATH)/%.y $(BISON) $(BISON_DATA) $(M4) \
     $(my_additional_dependencies)
 	$(call transform-y-to-c-or-cpp)
 $(call track-src-file-gen,$(y_yacc_sources),$(y_yacc_cs))
@@ -829,7 +810,7 @@
     $(intermediates)/,$(yy_yacc_sources:.yy=$(LOCAL_CPP_EXTENSION)))
 ifneq ($(yy_yacc_cpps),)
 $(yy_yacc_cpps): $(intermediates)/%$(LOCAL_CPP_EXTENSION): \
-    $(TOPDIR)$(LOCAL_PATH)/%.yy $(BISON) $(BISON_DATA) \
+    $(TOPDIR)$(LOCAL_PATH)/%.yy $(BISON) $(BISON_DATA) $(M4) \
     $(my_additional_dependencies)
 	$(call transform-y-to-c-or-cpp)
 $(call track-src-file-gen,$(yy_yacc_sources),$(yy_yacc_cpps))
@@ -845,6 +826,7 @@
 l_lex_cs := $(addprefix \
     $(intermediates)/,$(l_lex_sources:.l=.c))
 ifneq ($(l_lex_cs),)
+$(l_lex_cs): $(LEX) $(M4)
 $(l_lex_cs): $(intermediates)/%.c: \
     $(TOPDIR)$(LOCAL_PATH)/%.l
 	$(transform-l-to-c-or-cpp)
@@ -857,6 +839,7 @@
 ll_lex_cpps := $(addprefix \
     $(intermediates)/,$(ll_lex_sources:.ll=$(LOCAL_CPP_EXTENSION)))
 ifneq ($(ll_lex_cpps),)
+$(ll_lex_cpps): $(LEX) $(M4)
 $(ll_lex_cpps): $(intermediates)/%$(LOCAL_CPP_EXTENSION): \
     $(TOPDIR)$(LOCAL_PATH)/%.ll
 	$(transform-l-to-c-or-cpp)
@@ -878,7 +861,8 @@
 $(foreach s,$(dotdot_sources),\
   $(eval $(call compile-dotdot-cpp-file,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects)))
+    dotdot_objects,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects))
 
 cpp_normal_sources := $(filter-out ../%,$(filter %$(LOCAL_CPP_EXTENSION),$(my_src_files)))
@@ -889,9 +873,10 @@
 $(dotdot_objects) $(cpp_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 
 ifneq ($(strip $(cpp_objects)),)
+$(cpp_objects): .KATI_NINJA_POOL := $(my_pool)
 $(cpp_objects): $(intermediates)/%.o: \
     $(TOPDIR)$(LOCAL_PATH)/%$(LOCAL_CPP_EXTENSION) \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG_CXX)
 	$(transform-$(PRIVATE_HOST)cpp-to-o)
 $(call include-depfiles-for-objs, $(cpp_objects))
 endif
@@ -908,11 +893,12 @@
 
 ifneq ($(strip $(gen_cpp_objects)),)
 # Compile all generated files as thumb.
+$(gen_cpp_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_cpp_objects): PRIVATE_ARM_MODE := $(normal_objects_mode)
 $(gen_cpp_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 $(gen_cpp_objects): $(intermediates)/%.o: \
     $(intermediates)/%$(LOCAL_CPP_EXTENSION) \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG_CXX)
 	$(transform-$(PRIVATE_HOST)cpp-to-o)
 $(call include-depfiles-for-objs, $(gen_cpp_objects))
 endif
@@ -926,8 +912,9 @@
 $(call track-gen-file-obj,$(gen_S_sources),$(gen_S_objects))
 
 ifneq ($(strip $(gen_S_sources)),)
+$(gen_S_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_S_objects): $(intermediates)/%.o: $(intermediates)/%.S \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
 $(call include-depfiles-for-objs, $(gen_S_objects))
 endif
@@ -937,8 +924,9 @@
 $(call track-gen-file-obj,$(gen_s_sources),$(gen_s_objects))
 
 ifneq ($(strip $(gen_s_objects)),)
+$(gen_s_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_s_objects): $(intermediates)/%.o: $(intermediates)/%.s \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
 endif
 
@@ -964,7 +952,8 @@
 $(foreach s, $(dotdot_sources),\
   $(eval $(call compile-dotdot-c-file,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects)))
+    dotdot_objects,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects))
 
 c_normal_sources := $(filter-out ../%,$(filter %.c,$(my_src_files)))
@@ -975,8 +964,9 @@
 $(dotdot_objects) $(c_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 
 ifneq ($(strip $(c_objects)),)
+$(c_objects): .KATI_NINJA_POOL := $(my_pool)
 $(c_objects): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.c \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)c-to-o)
 $(call include-depfiles-for-objs, $(c_objects))
 endif
@@ -993,10 +983,11 @@
 
 ifneq ($(strip $(gen_c_objects)),)
 # Compile all generated files as thumb.
+$(gen_c_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_c_objects): PRIVATE_ARM_MODE := $(normal_objects_mode)
 $(gen_c_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 $(gen_c_objects): $(intermediates)/%.o: $(intermediates)/%.c \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)c-to-o)
 $(call include-depfiles-for-objs, $(gen_c_objects))
 endif
@@ -1011,8 +1002,9 @@
 
 ifneq ($(strip $(objc_objects)),)
 my_soong_problems += objc
+$(objc_objects): .KATI_NINJA_POOL := $(my_pool)
 $(objc_objects): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.m \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)m-to-o)
 $(call include-depfiles-for-objs, $(objc_objects))
 endif
@@ -1026,8 +1018,9 @@
 $(call track-src-file-obj,$(objcpp_sources),$(objcpp_objects))
 
 ifneq ($(strip $(objcpp_objects)),)
+$(objcpp_objects): .KATI_NINJA_POOL := $(my_pool)
 $(objcpp_objects): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.mm \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG_CXX)
 	$(transform-$(PRIVATE_HOST)mm-to-o)
 $(call include-depfiles-for-objs, $(objcpp_objects))
 endif
@@ -1046,12 +1039,14 @@
 $(foreach s,$(dotdot_sources),\
   $(eval $(call compile-dotdot-s-file,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects_S)))
+    dotdot_objects_S,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects_S))
 
 ifneq ($(strip $(asm_objects_S)),)
+$(asm_objects_S): .KATI_NINJA_POOL := $(my_pool)
 $(asm_objects_S): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.S \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
 $(call include-depfiles-for-objs, $(asm_objects_S))
 endif
@@ -1066,12 +1061,14 @@
 $(foreach s,$(dotdot_sources),\
   $(eval $(call compile-dotdot-s-file-no-deps,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects_s)))
+    dotdot_objects_s,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects_s))
 
 ifneq ($(strip $(asm_objects_s)),)
+$(asm_objects_s): .KATI_NINJA_POOL := $(my_pool)
 $(asm_objects_s): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.s \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
 endif
 
@@ -1084,7 +1081,7 @@
 ifneq ($(strip $(asm_sources_asm)),)
 asm_objects_asm := $(addprefix $(intermediates)/,$(asm_sources_asm:.asm=.o))
 $(asm_objects_asm): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.asm \
-    $(my_additional_dependencies)
+    $(my_additional_dependencies) $(YASM)
 	$(transform-asm-to-o)
 $(call track-src-file-obj,$(asm_sources_asm),$(asm_objects_asm))
 
@@ -1129,22 +1126,35 @@
 ## When compiling against the VNDK, use LL-NDK libraries
 ###########################################################
 ifneq ($(LOCAL_USE_VNDK),)
-  ####################################################
-  ## Soong modules may be built twice, once for /system
-  ## and once for /vendor. If we're using the VNDK,
-  ## switch all soong libraries over to the /vendor
-  ## variant.
-  ####################################################
-  my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
-    $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_static_libraries := $(foreach l,$(my_static_libraries),\
-    $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_shared_libraries := $(foreach l,$(my_shared_libraries),\
-    $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_system_shared_libraries := $(foreach l,$(my_system_shared_libraries),\
-    $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_header_libraries := $(foreach l,$(my_header_libraries),\
-    $(if $(SPLIT_VENDOR.HEADER_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  #####################################################
+  ## Soong modules may be built three times, once for
+  ## /system, once for /vendor and once for /product.
+  ## If we're using the VNDK, switch all soong
+  ## libraries over to the /vendor or /product variant.
+  #####################################################
+  ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+    my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
+      $(if $(SPLIT_PRODUCT.STATIC_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_static_libraries := $(foreach l,$(my_static_libraries),\
+      $(if $(SPLIT_PRODUCT.STATIC_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_system_shared_libraries := $(foreach l,$(my_system_shared_libraries),\
+      $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_header_libraries := $(foreach l,$(my_header_libraries),\
+      $(if $(SPLIT_PRODUCT.HEADER_LIBRARIES.$(l)),$(l).product,$(l)))
+  else
+    my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
+      $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_static_libraries := $(foreach l,$(my_static_libraries),\
+      $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_system_shared_libraries := $(foreach l,$(my_system_shared_libraries),\
+      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_header_libraries := $(foreach l,$(my_header_libraries),\
+      $(if $(SPLIT_VENDOR.HEADER_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  endif
 endif
 
 # Platform can use vendor public libraries. If a required shared lib is one of
@@ -1154,6 +1164,18 @@
     $(if $(filter $(l),$(VENDOR_PUBLIC_LIBRARIES)),$(l).vendorpublic,$(l)))
 endif
 
+###########################################################
+## When compiling against the NDK, use SDK variants of Soong libraries
+###########################################################
+
+ifneq ($(LOCAL_SDK_VERSION),)
+  my_whole_static_libraries := $(call use_soong_sdk_libraries,$(my_whole_static_libraries))
+  my_static_libraries := $(call use_soong_sdk_libraries,$(my_static_libraries))
+  my_shared_libraries := $(call use_soong_sdk_libraries,$(my_shared_libraries))
+  my_system_shared_libraries := $(call use_soong_sdk_libraries,$(my_system_shared_libraries))
+  my_header_libraries := $(call use_soong_sdk_libraries,$(my_header_libraries))
+endif
+
 ##########################################################
 ## Set up installed module dependency
 ## We cannot compute the full path of the LOCAL_SHARED_LIBRARIES for
@@ -1179,31 +1201,6 @@
 
 
 ####################################################
-## Import includes
-####################################################
-import_includes := $(intermediates)/import_includes
-import_includes_deps := $(strip \
-    $(if $(LOCAL_USE_VNDK),\
-      $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
-    $(foreach l, $(installed_shared_library_module_names), \
-      $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
-    $(foreach l, $(my_static_libraries) $(my_whole_static_libraries), \
-      $(call intermediates-dir-for,STATIC_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes) \
-    $(foreach l, $(my_header_libraries), \
-      $(call intermediates-dir-for,HEADER_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes))
-$(import_includes): PRIVATE_IMPORT_EXPORT_INCLUDES := $(import_includes_deps)
-$(import_includes) : $(import_includes_deps)
-	@echo Import includes file: $@
-	$(hide) mkdir -p $(dir $@) && rm -f $@
-ifdef import_includes_deps
-	$(hide) for f in $(PRIVATE_IMPORT_EXPORT_INCLUDES); do \
-	  cat $$f >> $@; \
-	done
-else
-	$(hide) touch $@
-endif
-
-####################################################
 ## Verify that NDK-built libraries only link against
 ## other NDK-built libraries
 ####################################################
@@ -1216,6 +1213,7 @@
 my_allowed_types := $(my_allowed_ndk_types)
 else ifdef LOCAL_USE_VNDK
     _name := $(patsubst %.vendor,%,$(LOCAL_MODULE))
+    _name := $(patsubst %.product,%,$(LOCAL_MODULE))
     ifneq ($(filter $(_name),$(VNDK_CORE_LIBRARIES) $(VNDK_SAMEPROCESS_LIBRARIES) $(LLNDK_LIBRARIES)),)
         ifeq ($(filter $(_name),$(VNDK_PRIVATE_LIBRARIES)),)
             my_link_type := native:vndk
@@ -1224,6 +1222,12 @@
         endif
         my_warn_types :=
         my_allowed_types := native:vndk native:vndk_private
+    else ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+        # Modules installed to /product cannot directly depend on modules marked
+        # with vendor_available: false
+        my_link_type := native:product
+        my_warn_types :=
+        my_allowed_types := native:product native:vndk native:platform_vndk
     else
         # Modules installed to /vendor cannot directly depend on modules marked
         # with vendor_available: false
@@ -1304,9 +1308,15 @@
   my_c_includes += $(JNI_H_INCLUDE)
 endif
 
-my_outside_includes := $(filter-out $(OUT_DIR)/%,$(filter /%,$(my_c_includes)))
+my_c_includes := $(foreach inc,$(my_c_includes),$(call clean-path,$(inc)))
+
+my_outside_includes := $(filter-out $(OUT_DIR)/%,$(filter /%,$(my_c_includes)) $(filter ../%,$(my_c_includes)))
 ifneq ($(my_outside_includes),)
-$(error $(LOCAL_MODULE_MAKEFILE): $(LOCAL_MODULE): C_INCLUDES must be under the source or output directories: $(my_outside_includes))
+  ifeq ($(BUILD_BROKEN_OUTSIDE_INCLUDE_DIRS),true)
+    $(call pretty-warning,C_INCLUDES must be under the source or output directories: $(my_outside_includes))
+  else
+    $(call pretty-error,C_INCLUDES must be under the source or output directories: $(my_outside_includes))
+  endif
 endif
 
 # all_objects includes gen_o_objects which were part of LOCAL_GENERATED_SOURCES;
@@ -1314,7 +1324,6 @@
 # that custom build rules which generate .o files don't consume other generated
 # sources as input (or if they do they take care of that dependency themselves).
 $(normal_objects) : | $(my_generated_sources)
-$(all_objects) : $(import_includes)
 ALL_C_CPP_ETC_OBJECTS += $(all_objects)
 
 
@@ -1377,6 +1386,10 @@
     $(my_ndk_shared_libraries_fullpath) \
     $(my_system_shared_libraries_fullpath) \
 
+built_shared_library_deps += \
+    $(my_ndk_shared_libraries_fullpath) \
+    $(my_system_shared_libraries_fullpath) \
+
 else
 built_shared_libraries := \
     $(foreach lib,$(installed_shared_library_module_names), \
@@ -1404,15 +1417,9 @@
 # libraries have already been linked into the module at that point.
 # We do, however, care about the NOTICE files for any static
 # libraries that we use. (see notice_files.mk)
-#
-# Don't do this in mm, since many of the targets won't exist.
-ifeq ($(ONE_SHOT_MAKEFILE),)
 installed_static_library_notice_file_targets := \
     $(foreach lib,$(my_static_libraries) $(my_whole_static_libraries), \
       NOTICE-$(if $(LOCAL_IS_HOST_MODULE),HOST$(if $(my_host_cross),_CROSS,),TARGET)-STATIC_LIBRARIES-$(lib))
-else
-installed_static_library_notice_file_targets :=
-endif
 
 $(notice_target): | $(installed_static_library_notice_file_targets)
 $(LOCAL_INSTALLED_MODULE): | $(notice_target)
@@ -1473,10 +1480,10 @@
 
 # Check if -Werror or -Wno-error is used in C compiler flags.
 # Header libraries do not need cflags.
+my_all_cflags := $(my_cflags) $(my_cppflags) $(my_cflags_no_override)
 ifneq (HEADER_LIBRARIES,$(LOCAL_MODULE_CLASS))
   # Prebuilt modules do not need cflags.
   ifeq (,$(LOCAL_PREBUILT_MODULE_FILE))
-    my_all_cflags := $(my_cflags) $(my_cppflags) $(my_cflags_no_override)
     # Issue warning if -Wno-error is used.
     ifneq (,$(filter -Wno-error,$(my_all_cflags)))
       $(eval MODULES_USING_WNO_ERROR := $(MODULES_USING_WNO_ERROR) $(LOCAL_MODULE_MAKEFILE):$(LOCAL_MODULE))
@@ -1495,6 +1502,13 @@
   endif
 endif
 
+ifneq (,$(filter -Weverything,$(my_all_cflags)))
+  ifeq (,$(ANDROID_TEMPORARILY_ALLOW_WEVERYTHING))
+    $(call pretty-error, -Weverything is not allowed in Android.mk files.\
+      Build with `m ANDROID_TEMPORARILY_ALLOW_WEVERYTHING=true` to experiment locally with -Weverything.)
+  endif
+endif
+
 # Disable clang-tidy if it is not found.
 ifeq ($(PATH_TO_CLANG_TIDY),)
   my_tidy_enabled := false
@@ -1550,11 +1564,10 @@
 
 # Add dependency of clang-tidy and clang-tidy.sh
 ifneq ($(my_tidy_checks),)
-  my_clang_tidy_programs := $(PATH_TO_CLANG_TIDY) $(PATH_TO_CLANG_TIDY_SHELL)
-  $(cpp_objects): $(intermediates)/%.o: $(my_clang_tidy_programs)
-  $(c_objects): $(intermediates)/%.o: $(my_clang_tidy_programs)
-  $(gen_cpp_objects): $(intermediates)/%.o: $(my_clang_tidy_programs)
-  $(gen_c_objects): $(intermediates)/%.o: $(my_clang_tidy_programs)
+  $(cpp_objects): $(intermediates)/%.o: $(PATH_TO_CLANG_TIDY)
+  $(c_objects): $(intermediates)/%.o: $(PATH_TO_CLANG_TIDY)
+  $(gen_cpp_objects): $(intermediates)/%.o: $(PATH_TO_CLANG_TIDY)
+  $(gen_c_objects): $(intermediates)/%.o: $(PATH_TO_CLANG_TIDY)
 endif
 
 # Move -l* entries from ldflags to ldlibs, and everything else to ldflags
@@ -1616,13 +1629,25 @@
 ifeq ($(my_use_clang_lld),true)
   my_target_global_ldflags := $($(LOCAL_2ND_ARCH_VAR_PREFIX)CLANG_$(my_prefix)GLOBAL_LLDFLAGS)
   include $(BUILD_SYSTEM)/pack_dyn_relocs_setup.mk
-  ifeq ($(my_pack_module_relocations),false)
+  ifeq ($(my_pack_module_relocations),true)
+    my_target_global_ldflags += -Wl,--pack-dyn-relocs=android+relr -Wl,--use-android-relr-tags
+  else
     my_target_global_ldflags += -Wl,--pack-dyn-relocs=none
   endif
 else
   my_target_global_ldflags := $($(LOCAL_2ND_ARCH_VAR_PREFIX)CLANG_$(my_prefix)GLOBAL_LDFLAGS)
 endif # my_use_clang_lld
 
+my_target_triple := $($(LOCAL_2ND_ARCH_VAR_PREFIX)CLANG_$(my_prefix)TRIPLE)
+ifndef LOCAL_IS_HOST_MODULE
+  my_target_triple_flag := -target $(my_target_triple)$(my_api_level)
+else
+  my_target_triple_flag := -target $(my_target_triple)
+endif
+my_asflags += $(my_target_triple_flag)
+my_cflags += $(my_target_triple_flag)
+my_ldflags += $(my_target_triple_flag)
+
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_GLOBAL_C_INCLUDES := $(my_target_global_c_includes)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_GLOBAL_C_SYSTEM_INCLUDES := $(my_target_global_c_system_includes)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_TARGET_GLOBAL_CFLAGS := $(my_target_global_cflags)
@@ -1674,6 +1699,22 @@
     $(LOCAL_INTERMEDIATE_TARGETS): $(my_coverage_lib)
 endif
 
+####################################################
+## Import includes
+####################################################
+imported_includes := $(strip \
+    $(if $(LOCAL_USE_VNDK),\
+      $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))) \
+    $(foreach l, $(installed_shared_library_module_names), \
+      $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))) \
+    $(foreach l, $(my_static_libraries) $(my_whole_static_libraries), \
+      $(call intermediates-dir-for,STATIC_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))) \
+    $(foreach l, $(my_header_libraries), \
+      $(call intermediates-dir-for,HEADER_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))))
+
+$(foreach dep,$(imported_includes),\
+  $(eval EXPORTS.$$(dep).USERS := $$(EXPORTS.$$(dep).USERS) $$(all_objects)))
+
 ###########################################################
 ## Define PRIVATE_ variables used by multiple module types
 ###########################################################
@@ -1733,7 +1774,7 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RTTI_FLAG := $(LOCAL_RTTI_FLAG)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_DEBUG_CFLAGS := $(debug_cflags)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_C_INCLUDES := $(my_c_includes)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_IMPORT_INCLUDES := $(import_includes)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_IMPORTED_INCLUDES := $(imported_includes)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_LDFLAGS := $(my_ldflags)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_LDLIBS := $(my_ldlibs)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_TIDY_CHECKS := $(my_tidy_checks)
@@ -1760,51 +1801,30 @@
 ###########################################################
 # Export includes
 ###########################################################
-export_includes := $(intermediates)/export_includes
-export_cflags := $(foreach d,$(my_export_c_include_dirs),-I $(d))
-$(export_includes): PRIVATE_EXPORT_CFLAGS := $(export_cflags)
+
 # Headers exported by whole static libraries are also exported by this library.
 export_include_deps := $(strip \
    $(foreach l,$(my_whole_static_libraries), \
-     $(call intermediates-dir-for,STATIC_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes))
+     $(call intermediates-dir-for,STATIC_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))))
 # Re-export requested headers from shared libraries.
 export_include_deps += $(strip \
    $(foreach l,$(LOCAL_EXPORT_SHARED_LIBRARY_HEADERS), \
-     $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes))
+     $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))))
 # Re-export requested headers from static libraries.
 export_include_deps += $(strip \
    $(foreach l,$(LOCAL_EXPORT_STATIC_LIBRARY_HEADERS), \
-     $(call intermediates-dir-for,STATIC_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes))
+     $(call intermediates-dir-for,STATIC_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))))
 # Re-export requested headers from header libraries.
 export_include_deps += $(strip \
    $(foreach l,$(LOCAL_EXPORT_HEADER_LIBRARY_HEADERS), \
-     $(call intermediates-dir-for,HEADER_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))/export_includes))
-$(export_includes): PRIVATE_REEXPORTED_INCLUDES := $(export_include_deps)
-# By adding $(my_generated_sources) it makes sure the headers get generated
-# before any dependent source files get compiled.
-$(export_includes) : $(my_export_c_include_deps) $(my_generated_sources) $(export_include_deps) $(LOCAL_EXPORT_C_INCLUDE_DEPS)
-	@echo Export includes file: $< -- $@
-	$(hide) mkdir -p $(dir $@) && rm -f $@.tmp && touch $@.tmp
-ifdef export_cflags
-	$(hide) echo "$(PRIVATE_EXPORT_CFLAGS)" >>$@.tmp
-endif
-ifdef export_include_deps
-	$(hide) for f in $(PRIVATE_REEXPORTED_INCLUDES); do \
-		cat $$f >> $@.tmp; \
-		done
-endif
-	$(hide) if cmp -s $@.tmp $@ ; then \
-	  rm $@.tmp ; \
-	else \
-	  mv $@.tmp $@ ; \
-	fi
-export_cflags :=
+     $(call intermediates-dir-for,HEADER_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))))
 
-# Kati adds restat=1 to ninja. GNU make does nothing for this.
-.KATI_RESTAT: $(export_includes)
-
-# Make sure export_includes gets generated when you are running mm/mmm
-$(LOCAL_BUILT_MODULE) : | $(export_includes)
+ifneq ($(strip $(my_export_c_include_dirs)$(export_include_deps)),)
+  EXPORTS_LIST += $(intermediates)
+  EXPORTS.$(intermediates).FLAGS := $(foreach d,$(my_export_c_include_dirs),-I $(call clean-path,$(d)))
+  EXPORTS.$(intermediates).REEXPORT := $(export_include_deps)
+  EXPORTS.$(intermediates).DEPS := $(my_export_c_include_deps) $(my_generated_sources) $(LOCAL_EXPORT_C_INCLUDE_DEPS)
+endif
 
 ifneq (,$(filter-out $(LOCAL_PATH)/%,$(my_export_c_include_dirs)))
 my_soong_problems += non_local__export_c_include_dirs
diff --git a/core/board_config.mk b/core/board_config.mk
index e58b123..86162b6 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -26,6 +26,7 @@
   BOARD_KERNEL_CMDLINE \
   BOARD_KERNEL_BASE \
   BOARD_USES_GENERIC_AUDIO \
+  BOARD_USES_RECOVERY_AS_BOOT \
   BOARD_VENDOR_USE_AKMD \
   BOARD_WPA_SUPPLICANT_DRIVER \
   BOARD_WLAN_DEVICE \
@@ -67,8 +68,8 @@
   BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE \
   BOARD_PRODUCTIMAGE_PARTITION_SIZE \
   BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE \
-  BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE \
-  BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE \
+  BOARD_SYSTEM_EXTIMAGE_PARTITION_SIZE \
+  BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE \
   BOARD_ODMIMAGE_PARTITION_SIZE \
   BOARD_ODMIMAGE_FILE_SYSTEM_TYPE \
 
@@ -78,22 +79,29 @@
   BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE \
   BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE \
   BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE \
-  BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE \
+  BOARD_SYSTEM_EXTIMAGE_PARTITION_RESERVED_SIZE \
   BOARD_SUPER_PARTITION_SIZE \
   BOARD_SUPER_PARTITION_GROUPS \
 
 _board_strip_readonly_list += $(_dynamic_partitions_var_list)
 
 _build_broken_var_list := \
-  BUILD_BROKEN_ANDROIDMK_EXPORTS \
-  BUILD_BROKEN_DUP_COPY_HEADERS \
   BUILD_BROKEN_DUP_RULES \
-  BUILD_BROKEN_PHONY_TARGETS \
-  BUILD_BROKEN_ENG_DEBUG_TAGS \
+  BUILD_BROKEN_OUTSIDE_INCLUDE_DIRS \
+  BUILD_BROKEN_PREBUILT_ELF_FILES \
+  BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW \
   BUILD_BROKEN_USES_NETWORK \
+  BUILD_BROKEN_VINTF_PRODUCT_COPY_FILES \
+
+_build_broken_var_list += \
+  $(foreach m,$(AVAILABLE_BUILD_MODULE_TYPES) \
+              $(DEFAULT_WARNING_BUILD_MODULE_TYPES) \
+              $(DEFAULT_ERROR_BUILD_MODULE_TYPES), \
+    BUILD_BROKEN_USES_$(m))
 
 _board_true_false_vars := $(_build_broken_var_list)
-_board_strip_readonly_list += $(_build_broken_var_list)
+_board_strip_readonly_list += $(_build_broken_var_list) \
+  BUILD_BROKEN_NINJA_USES_ENV_VARS
 
 # Conditional to building on linux, as dex2oat currently does not work on darwin.
 ifeq ($(HOST_OS),linux)
@@ -104,6 +112,7 @@
 # Broken build defaults
 # ###############################################################
 $(foreach v,$(_build_broken_var_list),$(eval $(v) :=))
+BUILD_BROKEN_NINJA_USES_ENV_VARS :=
 
 # Boards may be defined under $(SRC_TARGET_DIR)/board/$(TARGET_DEVICE)
 # or under vendor/*/$(TARGET_DEVICE).  Search in both places, but
@@ -177,7 +186,7 @@
 # Sanity check to warn about likely cryptic errors later in the build.
 ifeq ($(TARGET_IS_64_BIT),true)
   ifeq (,$(filter true false,$(TARGET_SUPPORTS_64_BIT_APPS)))
-    $(warning Building a 32-bit-app-only product on a 64-bit device. \
+    $(error Building a 32-bit-app-only product on a 64-bit device. \
       If this is intentional, set TARGET_SUPPORTS_64_BIT_APPS := false)
   endif
 endif
@@ -191,20 +200,37 @@
 # Note that this assumes that the 2ND_CPU_ABI for a 64 bit target
 # is always 32 bits. If this isn't the case, these variables should
 # be overriden in the board configuration.
+#
+# Similarly, TARGET_NATIVE_BRIDGE_2ND_ABI for a 64 bit target is always
+# 32 bits. Note that all CPU_ABIs are preferred over all NATIVE_BRIDGE_ABIs.
+_target_native_bridge_abi_list_32_bit :=
+_target_native_bridge_abi_list_64_bit :=
+
 ifeq (,$(TARGET_CPU_ABI_LIST_64_BIT))
   ifeq (true|true,$(TARGET_IS_64_BIT)|$(TARGET_SUPPORTS_64_BIT_APPS))
     TARGET_CPU_ABI_LIST_64_BIT := $(TARGET_CPU_ABI) $(TARGET_CPU_ABI2)
+    _target_native_bridge_abi_list_64_bit := $(TARGET_NATIVE_BRIDGE_ABI)
+  endif
+endif
+
+# "arm64-v8a-hwasan", the ABI for libraries compiled with HWASAN, is supported
+# in all builds with SANITIZE_TARGET=hwaddress.
+ifneq ($(filter hwaddress,$(SANITIZE_TARGET)),)
+  ifneq ($(filter arm64-v8a,$(TARGET_CPU_ABI_LIST_64_BIT)),)
+    TARGET_CPU_ABI_LIST_64_BIT := arm64-v8a-hwasan $(TARGET_CPU_ABI_LIST_64_BIT)
   endif
 endif
 
 ifeq (,$(TARGET_CPU_ABI_LIST_32_BIT))
   ifneq (true,$(TARGET_IS_64_BIT))
     TARGET_CPU_ABI_LIST_32_BIT := $(TARGET_CPU_ABI) $(TARGET_CPU_ABI2)
+    _target_native_bridge_abi_list_32_bit := $(TARGET_NATIVE_BRIDGE_ABI)
   else
     ifeq (true,$(TARGET_SUPPORTS_32_BIT_APPS))
       # For a 64 bit target, assume that the 2ND_CPU_ABI
       # is a 32 bit ABI.
       TARGET_CPU_ABI_LIST_32_BIT := $(TARGET_2ND_CPU_ABI) $(TARGET_2ND_CPU_ABI2)
+      _target_native_bridge_abi_list_32_bit := $(TARGET_NATIVE_BRIDGE_2ND_ABI)
     endif
   endif
 endif
@@ -213,22 +239,38 @@
 # of preference) that the target supports. If a TARGET_CPU_ABI_LIST
 # is specified by the board configuration, we use that. If not, we
 # build a list out of the TARGET_CPU_ABIs specified by the config.
+# Add NATIVE_BRIDGE_ABIs at the end to keep order of preference.
 ifeq (,$(TARGET_CPU_ABI_LIST))
   ifeq ($(TARGET_IS_64_BIT)|$(TARGET_PREFER_32_BIT_APPS),true|true)
-    TARGET_CPU_ABI_LIST := $(TARGET_CPU_ABI_LIST_32_BIT) $(TARGET_CPU_ABI_LIST_64_BIT)
+    TARGET_CPU_ABI_LIST := $(TARGET_CPU_ABI_LIST_32_BIT) $(TARGET_CPU_ABI_LIST_64_BIT) \
+                           $(_target_native_bridge_abi_list_32_bit) $(_target_native_bridge_abi_list_64_bit)
   else
-    TARGET_CPU_ABI_LIST := $(TARGET_CPU_ABI_LIST_64_BIT) $(TARGET_CPU_ABI_LIST_32_BIT)
+    TARGET_CPU_ABI_LIST := $(TARGET_CPU_ABI_LIST_64_BIT) $(TARGET_CPU_ABI_LIST_32_BIT) \
+                           $(_target_native_bridge_abi_list_64_bit) $(_target_native_bridge_abi_list_32_bit)
   endif
 endif
 
+# Add NATIVE_BRIDGE_ABIs at the end of 32 and 64 bit CPU_ABIs to keep order of preference.
+TARGET_CPU_ABI_LIST_32_BIT += $(_target_native_bridge_abi_list_32_bit)
+TARGET_CPU_ABI_LIST_64_BIT += $(_target_native_bridge_abi_list_64_bit)
+
 # Strip whitespace from the ABI list string.
 TARGET_CPU_ABI_LIST := $(subst $(space),$(comma),$(strip $(TARGET_CPU_ABI_LIST)))
 TARGET_CPU_ABI_LIST_32_BIT := $(subst $(space),$(comma),$(strip $(TARGET_CPU_ABI_LIST_32_BIT)))
 TARGET_CPU_ABI_LIST_64_BIT := $(subst $(space),$(comma),$(strip $(TARGET_CPU_ABI_LIST_64_BIT)))
 
-ifneq ($(BUILD_BROKEN_ANDROIDMK_EXPORTS),true)
-$(KATI_obsolete_export It is a global setting. See $(CHANGES_URL)#export_keyword)
-endif
+# Check if config about image building is valid or not.
+define check_image_config
+  $(eval _uc_name := $(call to-upper,$(1))) \
+  $(eval _lc_name := $(call to-lower,$(1))) \
+  $(if $(filter $(_lc_name),$(TARGET_COPY_OUT_$(_uc_name))), \
+    $(if $(BOARD_USES_$(_uc_name)IMAGE),, \
+      $(error If TARGET_COPY_OUT_$(_uc_name) is '$(_lc_name)', either BOARD_PREBUILT_$(_uc_name)IMAGE or BOARD_$(_uc_name)IMAGE_FILE_SYSTEM_TYPE must be set)), \
+  $(if $(BOARD_USES_$(_uc_name)IMAGE), \
+    $(error TARGET_COPY_OUT_$(_uc_name) must be set to '$(_lc_name)' to use a $(_lc_name) image))) \
+  $(eval _uc_name :=) \
+  $(eval _lc_name :=)
+endef
 
 ###########################################
 # Now we can substitute with the real value of TARGET_COPY_OUT_RAMDISK
@@ -240,6 +282,8 @@
 # Now we can substitute with the real value of TARGET_COPY_OUT_DEBUG_RAMDISK
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
 TARGET_COPY_OUT_DEBUG_RAMDISK := debug_ramdisk/first_stage_ramdisk
+TARGET_COPY_OUT_VENDOR_DEBUG_RAMDISK := vendor_debug_ramdisk/first_stage_ramdisk
+TARGET_COPY_OUT_TEST_HARNESS_RAMDISK := test_harness_ramdisk/first_stage_ramdisk
 endif
 
 ###########################################
@@ -286,8 +330,44 @@
 endif
 .KATI_READONLY := BUILDING_CACHE_IMAGE
 
-# TODO: Add BUILDING_BOOT_IMAGE / BUILDING_RECOVERY_IMAGE
-# This gets complicated with BOARD_USES_RECOVERY_AS_BOOT, so skipping for now.
+# Are we building a boot image
+BUILDING_BOOT_IMAGE :=
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+  BUILDING_BOOT_IMAGE :=
+else ifeq ($(PRODUCT_BUILD_BOOT_IMAGE),)
+  ifdef BOARD_BOOTIMAGE_PARTITION_SIZE
+    BUILDING_BOOT_IMAGE := true
+  endif
+else ifeq ($(PRODUCT_BUILD_BOOT_IMAGE),true)
+  BUILDING_BOOT_IMAGE := true
+endif
+.KATI_READONLY := BUILDING_BOOT_IMAGE
+
+# Are we building a recovery image
+BUILDING_RECOVERY_IMAGE :=
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+  BUILDING_RECOVERY_IMAGE := true
+else ifeq ($(PRODUCT_BUILD_RECOVERY_IMAGE),)
+  ifdef BOARD_RECOVERYIMAGE_PARTITION_SIZE
+    ifeq (,$(filter true, $(TARGET_NO_KERNEL) $(TARGET_NO_RECOVERY)))
+      BUILDING_RECOVERY_IMAGE := true
+    endif
+  endif
+else ifeq ($(PRODUCT_BUILD_RECOVERY_IMAGE),true)
+  BUILDING_RECOVERY_IMAGE := true
+endif
+.KATI_READONLY := BUILDING_RECOVERY_IMAGE
+
+# Are we building a vendor boot image
+BUILDING_VENDOR_BOOT_IMAGE :=
+ifdef BOARD_BOOT_HEADER_VERSION
+  ifneq ($(call math_gt_or_eq,$(BOARD_BOOT_HEADER_VERSION),3),)
+    ifneq ($(TARGET_NO_VENDOR_BOOT),true)
+      BUILDING_VENDOR_BOOT_IMAGE := true
+    endif
+  endif
+endif
+.KATI_READONLY := BUILDING_VENDOR_BOOT_IMAGE
 
 # Are we building a ramdisk image
 BUILDING_RAMDISK_IMAGE := true
@@ -311,6 +391,13 @@
 endif
 .KATI_READONLY := BUILDING_USERDATA_IMAGE
 
+# Are we building a vbmeta image
+BUILDING_VBMETA_IMAGE := true
+ifeq ($(PRODUCT_BUILD_VBMETA_IMAGE),false)
+  BUILDING_VBMETA_IMAGE :=
+endif
+.KATI_READONLY := BUILDING_VBMETA_IMAGE
+
 ###########################################
 # Now we can substitute with the real value of TARGET_COPY_OUT_VENDOR
 ifeq ($(TARGET_COPY_OUT_VENDOR),$(_vendor_path_placeholder))
@@ -327,6 +414,8 @@
 ifdef BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE
   BOARD_USES_VENDORIMAGE := true
 endif
+# TODO(b/137169253): For now, some AOSP targets build with prebuilt vendor image.
+# But target's BOARD_PREBUILT_VENDORIMAGE is not filled.
 ifeq ($(TARGET_COPY_OUT_VENDOR),vendor)
   BOARD_USES_VENDORIMAGE := true
 else ifdef BOARD_USES_VENDORIMAGE
@@ -366,11 +455,7 @@
 ifdef BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE
   BOARD_USES_PRODUCTIMAGE := true
 endif
-ifeq ($(TARGET_COPY_OUT_PRODUCT),product)
-  BOARD_USES_PRODUCTIMAGE := true
-else ifdef BOARD_USES_PRODUCTIMAGE
-  $(error TARGET_COPY_OUT_PRODUCT must be set to 'product' to use a product image)
-endif
+$(call check_image_config,product)
 .KATI_READONLY := BOARD_USES_PRODUCTIMAGE
 
 BUILDING_PRODUCT_IMAGE :=
@@ -390,55 +475,51 @@
 .KATI_READONLY := BUILDING_PRODUCT_IMAGE
 
 ###########################################
-# Now we can substitute with the real value of TARGET_COPY_OUT_PRODUCT_SERVICES
-MERGE_PRODUCT_SERVICES_INTO_PRODUCT :=
-ifeq ($(TARGET_COPY_OUT_PRODUCT_SERVICES),$(_product_services_path_placeholder))
-  TARGET_COPY_OUT_PRODUCT_SERVICES := $(TARGET_COPY_OUT_PRODUCT)
-  MERGE_PRODUCT_SERVICES_INTO_PRODUCT := true
-else ifeq ($(TARGET_COPY_OUT_PRODUCT),$(TARGET_COPY_OUT_PRODUCT_SERVICES))
-  MERGE_PRODUCT_SERVICES_INTO_PRODUCT := true
-else ifeq ($(filter system/product_services,$(TARGET_COPY_OUT_PRODUCT_SERVICES)),)
-  $(error TARGET_COPY_OUT_PRODUCT_SERVICES must be either '$(TARGET_COPY_OUT_PRODUCT)'\
-    or 'system/product_services', seeing '$(TARGET_COPY_OUT_PRODUCT_SERVICES)'.)
-endif
-.KATI_READONLY := MERGE_PRODUCT_SERVICES_INTO_PRODUCT
-PRODUCT_COPY_FILES := $(subst $(_product_services_path_placeholder),$(TARGET_COPY_OUT_PRODUCT_SERVICES),$(PRODUCT_COPY_FILES))
+# TODO(b/135957588) TARGET_COPY_OUT_PRODUCT_SERVICES will be set to
+# TARGET_COPY_OUT_PRODUCT as a workaround.
+TARGET_COPY_OUT_PRODUCT_SERVICES := $(TARGET_COPY_OUT_PRODUCT)
 
-BOARD_USES_PRODUCT_SERVICESIMAGE :=
-ifdef BOARD_PREBUILT_PRODUCT_SERVICESIMAGE
-  BOARD_USES_PRODUCT_SERVICESIMAGE := true
+###########################################
+# Now we can substitute with the real value of TARGET_COPY_OUT_SYSTEM_EXT
+ifeq ($(TARGET_COPY_OUT_SYSTEM_EXT),$(_system_ext_path_placeholder))
+TARGET_COPY_OUT_SYSTEM_EXT := system/system_ext
+else ifeq ($(filter system_ext system/system_ext,$(TARGET_COPY_OUT_SYSTEM_EXT)),)
+$(error TARGET_COPY_OUT_SYSTEM_EXT must be either 'system_ext' or 'system/system_ext', seeing '$(TARGET_COPY_OUT_SYSTEM_EXT)'.)
 endif
-ifdef BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE
-  BOARD_USES_PRODUCT_SERVICESIMAGE := true
-endif
-ifeq ($(TARGET_COPY_OUT_PRODUCT_SERVICES),product_services)
-  BOARD_USES_PRODUCT_SERVICESIMAGE := true
-else ifdef BOARD_USES_PRODUCT_SERVICESIMAGE
-  $(error A 'product_services' partition should not be used. Use 'system/product_services' instead.)
-endif
+PRODUCT_COPY_FILES := $(subst $(_system_ext_path_placeholder),$(TARGET_COPY_OUT_SYSTEM_EXT),$(PRODUCT_COPY_FILES))
 
-BUILDING_PRODUCT_SERVICES_IMAGE :=
-ifeq ($(PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE),)
-  ifdef BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE
-    BUILDING_PRODUCT_SERVICES_IMAGE := true
+BOARD_USES_SYSTEM_EXTIMAGE :=
+ifdef BOARD_PREBUILT_SYSTEM_EXTIMAGE
+  BOARD_USES_SYSTEM_EXTIMAGE := true
+endif
+ifdef BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE
+  BOARD_USES_SYSTEM_EXTIMAGE := true
+endif
+$(call check_image_config,system_ext)
+.KATI_READONLY := BOARD_USES_SYSTEM_EXTIMAGE
+
+BUILDING_SYSTEM_EXT_IMAGE :=
+ifeq ($(PRODUCT_BUILD_SYSTEM_EXT_IMAGE),)
+  ifdef BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE
+    BUILDING_SYSTEM_EXT_IMAGE := true
   endif
-else ifeq ($(PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE),true)
-  BUILDING_PRODUCT_SERVICES_IMAGE := true
-  ifndef BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE
-    $(error PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE set to true, but BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE not defined)
+else ifeq ($(PRODUCT_BUILD_SYSTEM_EXT_IMAGE),true)
+  BUILDING_SYSTEM_EXT_IMAGE := true
+  ifndef BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE
+    $(error PRODUCT_BUILD_SYSTEM_EXT_IMAGE set to true, but BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE not defined)
   endif
 endif
-ifdef BOARD_PREBUILT_PRODUCT_SERVICESIMAGE
-  BUILDING_PRODUCT_SERVICES_IMAGE :=
+ifdef BOARD_PREBUILT_SYSTEM_EXTIMAGE
+  BUILDING_SYSTEM_EXT_IMAGE :=
 endif
-.KATI_READONLY := BUILDING_PRODUCT_SERVICES_IMAGE
+.KATI_READONLY := BUILDING_SYSTEM_EXT_IMAGE
 
 ###########################################
 # Now we can substitute with the real value of TARGET_COPY_OUT_ODM
 ifeq ($(TARGET_COPY_OUT_ODM),$(_odm_path_placeholder))
-  TARGET_COPY_OUT_ODM := vendor/odm
-else ifeq ($(filter odm vendor/odm,$(TARGET_COPY_OUT_ODM)),)
-  $(error TARGET_COPY_OUT_ODM must be either 'odm' or 'vendor/odm', seeing '$(TARGET_COPY_OUT_ODM)'.)
+  TARGET_COPY_OUT_ODM := $(TARGET_COPY_OUT_VENDOR)/odm
+else ifeq ($(filter odm system/vendor/odm vendor/odm,$(TARGET_COPY_OUT_ODM)),)
+  $(error TARGET_COPY_OUT_ODM must be either 'odm', 'system/vendor/odm' or 'vendor/odm', seeing '$(TARGET_COPY_OUT_ODM)'.)
 endif
 PRODUCT_COPY_FILES := $(subst $(_odm_path_placeholder),$(TARGET_COPY_OUT_ODM),$(PRODUCT_COPY_FILES))
 
@@ -449,11 +530,7 @@
 ifdef BOARD_ODMIMAGE_FILE_SYSTEM_TYPE
   BOARD_USES_ODMIMAGE := true
 endif
-ifeq ($(TARGET_COPY_OUT_ODM),odm)
-  BOARD_USES_ODMIMAGE := true
-else ifdef BOARD_USES_ODMIMAGE
-  $(error TARGET_COPY_OUT_ODM must be set to 'odm' to use an odm image)
-endif
+$(call check_image_config,odm)
 
 BUILDING_ODM_IMAGE :=
 ifeq ($(PRODUCT_BUILD_ODM_IMAGE),)
@@ -472,13 +549,38 @@
 .KATI_READONLY := BUILDING_ODM_IMAGE
 
 ###########################################
-# Ensure that only TARGET_RECOVERY_UPDATER_LIBS *or* AB_OTA_UPDATER is set.
+# Ensure consistency among TARGET_RECOVERY_UPDATER_LIBS, AB_OTA_UPDATER, and PRODUCT_OTA_FORCE_NON_AB_PACKAGE.
 TARGET_RECOVERY_UPDATER_LIBS ?=
 AB_OTA_UPDATER ?=
 .KATI_READONLY := TARGET_RECOVERY_UPDATER_LIBS AB_OTA_UPDATER
-ifeq ($(AB_OTA_UPDATER),true)
+
+# Ensure that if PRODUCT_OTA_FORCE_NON_AB_PACKAGE == true, then AB_OTA_UPDATER must be true
+ifeq ($(PRODUCT_OTA_FORCE_NON_AB_PACKAGE),true)
+  ifneq ($(AB_OTA_UPDATER),true)
+    $(error AB_OTA_UPDATER must be set to true when PRODUCT_OTA_FORCE_NON_AB_PACKAGE is true)
+  endif
+endif
+
+# In some configurations, A/B and non-A/B may coexist. Check TARGET_OTA_ALLOW_NON_AB
+# to see if non-A/B is supported.
+TARGET_OTA_ALLOW_NON_AB := false
+ifneq ($(AB_OTA_UPDATER),true)
+  TARGET_OTA_ALLOW_NON_AB := true
+else ifeq ($(PRODUCT_OTA_FORCE_NON_AB_PACKAGE),true)
+  TARGET_OTA_ALLOW_NON_AB := true
+endif
+.KATI_READONLY := TARGET_OTA_ALLOW_NON_AB
+
+ifneq ($(TARGET_OTA_ALLOW_NON_AB),true)
   ifneq ($(strip $(TARGET_RECOVERY_UPDATER_LIBS)),)
-    $(error Do not use TARGET_RECOVERY_UPDATER_LIBS when using AB_OTA_UPDATER)
+    $(error Do not use TARGET_RECOVERY_UPDATER_LIBS when using TARGET_OTA_ALLOW_NON_AB)
+  endif
+endif
+
+# Sanity check for building generic OTA packages. Currently it only supports A/B OTAs.
+ifeq ($(PRODUCT_BUILD_GENERIC_OTA_PACKAGE),true)
+  ifneq ($(AB_OTA_UPDATER),true)
+    $(error PRODUCT_BUILD_GENERIC_OTA_PACKAGE with 'AB_OTA_UPDATER != true' is not supported)
   endif
 endif
 
@@ -496,9 +598,8 @@
 
 ifdef BOARD_VNDK_VERSION
   ifneq ($(BOARD_VNDK_VERSION),current)
-    $(error BOARD_VNDK_VERSION: Only "current" is implemented)
+    $(call check_vndk_version,$(BOARD_VNDK_VERSION))
   endif
-
   TARGET_VENDOR_TEST_SUFFIX := /vendor
 else
   TARGET_VENDOR_TEST_SUFFIX :=
@@ -532,3 +633,20 @@
   $(error System SDK versions '$(_unsupported_systemsdk_versions)' in BOARD_SYSTEMSDK_VERSIONS are not supported.\
           Supported versions are $(PLATFORM_SYSTEMSDK_VERSIONS))
 endif
+
+###########################################
+# Handle BUILD_BROKEN_USES_BUILD_*
+
+$(foreach m,$(DEFAULT_WARNING_BUILD_MODULE_TYPES),\
+  $(if $(filter false,$(BUILD_BROKEN_USES_$(m))),\
+    $(KATI_obsolete_var $(m),Please convert to Soong),\
+    $(KATI_deprecated_var $(m),Please convert to Soong)))
+
+$(if $(filter true,$(BUILD_BROKEN_USES_BUILD_COPY_HEADERS)),\
+  $(KATI_deprecated_var BUILD_COPY_HEADERS,See $(CHANGES_URL)#copy_headers),\
+  $(KATI_obsolete_var BUILD_COPY_HEADERS,See $(CHANGES_URL)#copy_headers))
+
+$(foreach m,$(filter-out BUILD_COPY_HEADERS,$(DEFAULT_ERROR_BUILD_MODULE_TYPES)),\
+  $(if $(filter true,$(BUILD_BROKEN_USES_$(m))),\
+    $(KATI_deprecated_var $(m),Please convert to Soong),\
+    $(KATI_obsolete_var $(m),Please convert to Soong)))
diff --git a/core/build-system.html b/core/build-system.html
index 3a11a47..cc242d9 100644
--- a/core/build-system.html
+++ b/core/build-system.html
@@ -516,8 +516,8 @@
 example the root filesystem instead of in /system, add these lines to your
 Android.mk:</p>
 <pre>
-LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT_SBIN)
-LOCAL_UNSTRIPPED_PATH := $(TARGET_ROOT_OUT_SBIN_UNSTRIPPED)
+LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
+LOCAL_UNSTRIPPED_PATH := $(TARGET_ROOT_OUT_UNSTRIPPED)
 </pre>
 <p>For executables and libraries, you need to specify a
 <code>LOCAL_UNSTRIPPED_PATH</code> location if you specified a
@@ -527,9 +527,6 @@
 <code>LOCAL_MODULE_RELATIVE_PATH</code>.</p>
 <p>Look in <code>core/envsetup.mk</code> for all of the variables defining
 places to build things.</p>
-<p>FYI: If you're installing an executable to /sbin, you probably also want to
-set <code>LOCAL_FORCE_STATIC_EXCUTABLE := true</code> in your Android.mk, which
-will force the linker to only accept static libraries.</p>
 
 
 <h3>Android.mk variables</h3>
@@ -685,8 +682,7 @@
 <h4>LOCAL_FORCE_STATIC_EXECUTABLE</h4>
 <p>If your executable should be linked statically, set 
 <code>LOCAL_FORCE_STATIC_EXECUTABLE:=true</code>.  There is a very short
-list of libraries that we have in static form (currently only libc).  This is
-really only used for executables in /sbin on the root filesystem.</p>
+list of libraries that we have in static form (currently only libc).</p>
 
 <h4>LOCAL_GENERATED_SOURCES</h4>
 <p>Files that you add to <code>LOCAL_GENERATED_SOURCES</code> will be
@@ -812,7 +808,7 @@
 <h4>LOCAL_STATIC_LIBRARIES</h4>
 <p>These are the static libraries that you want to include in your module.
 Mostly, we use shared libraries, but there are a couple of places, like
-executables in sbin and host executables where we use static libraries instead.
+host executables where we use static libraries instead.
 <p><code>LOCAL_STATIC_LIBRARIES := \<br/>
 	&nbsp;&nbsp;&nbsp;&nbsp;libutils \<br/>
 	&nbsp;&nbsp;&nbsp;&nbsp;libtinyxml
diff --git a/core/build_id.mk b/core/build_id.mk
index 2329288..11f4a80 100644
--- a/core/build_id.mk
+++ b/core/build_id.mk
@@ -18,4 +18,4 @@
 # (like "CRB01").  It must be a single word, and is
 # capitalized by convention.
 
-BUILD_ID=QT
+BUILD_ID=RVC
diff --git a/core/build_rro_package.mk b/core/build_rro_package.mk
index a6921d5..ae528bd 100644
--- a/core/build_rro_package.mk
+++ b/core/build_rro_package.mk
@@ -20,8 +20,8 @@
   partition := $(TARGET_OUT_ODM)
 else ifeq ($(strip $(LOCAL_VENDOR_MODULE)),true)
   partition := $(TARGET_OUT_VENDOR)
-else ifeq ($(strip $(LOCAL_PRODUCT_SERVICES_MODULE)),true)
-  partition := $(TARGET_OUT_PRODUCT_SERVICES)
+else ifeq ($(strip $(LOCAL_SYSTEM_EXT_MODULE)),true)
+  partition := $(TARGET_OUT_SYSTEM_EXT)
 else
   partition := $(TARGET_OUT_PRODUCT)
 endif
@@ -32,6 +32,12 @@
   LOCAL_MODULE_PATH := $(partition)/overlay/$(LOCAL_RRO_THEME)
 endif
 
+# Do not remove resources without default values nor dedupe resource
+# configurations with the same value
+LOCAL_AAPT_FLAGS += \
+    --no-resource-deduping \
+    --no-resource-removal
+
 partition :=
 
 include $(BUILD_SYSTEM)/package.mk
diff --git a/core/cc_prebuilt_internal.mk b/core/cc_prebuilt_internal.mk
new file mode 100644
index 0000000..99b7d0f
--- /dev/null
+++ b/core/cc_prebuilt_internal.mk
@@ -0,0 +1,198 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+############################################################
+# Internal build rules for native prebuilt modules
+############################################################
+
+prebuilt_module_classes := STATIC_LIBRARIES SHARED_LIBRARIES EXECUTABLES NATIVE_TESTS
+ifeq ($(filter $(prebuilt_module_classes),$(LOCAL_MODULE_CLASS)),)
+$(call pretty-error,cc_prebuilt_internal.mk is for $(prebuilt_module_classes) modules only)
+endif
+
+my_strip_module := $(firstword \
+  $(LOCAL_STRIP_MODULE_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)) \
+  $(LOCAL_STRIP_MODULE))
+
+ifeq (SHARED_LIBRARIES,$(LOCAL_MODULE_CLASS))
+  ifeq ($(LOCAL_IS_HOST_MODULE)$(my_strip_module),)
+    # Strip but not try to add debuglink
+    my_strip_module := no_debuglink
+  endif
+endif
+
+ifneq ($(filter STATIC_LIBRARIES SHARED_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
+  prebuilt_module_is_a_library := true
+else
+  prebuilt_module_is_a_library :=
+endif
+
+# Don't install static libraries by default.
+ifndef LOCAL_UNINSTALLABLE_MODULE
+ifeq (STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS))
+  LOCAL_UNINSTALLABLE_MODULE := true
+endif
+endif
+
+my_check_elf_file_shared_lib_files :=
+
+ifneq ($(filter true keep_symbols no_debuglink mini-debug-info,$(my_strip_module)),)
+  ifdef LOCAL_IS_HOST_MODULE
+    $(call pretty-error,Cannot strip/pack host module)
+  endif
+  ifeq ($(filter SHARED_LIBRARIES EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
+    $(call pretty-error,Can strip/pack only shared libraries or executables)
+  endif
+  ifneq ($(LOCAL_PREBUILT_STRIP_COMMENTS),)
+    $(call pretty-error,Cannot strip/pack scripts)
+  endif
+  # Set the arch-specific variables to set up the strip rules
+  LOCAL_STRIP_MODULE_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH) := $(my_strip_module)
+  include $(BUILD_SYSTEM)/dynamic_binary.mk
+  built_module := $(linked_module)
+
+  ifneq ($(LOCAL_SDK_VERSION),)
+    # binary.mk filters out NDK_MIGRATED_LIBS from my_shared_libs, thus those NDK libs are not added
+    # to DEPENDENCIES_ON_SHARED_LIBRARIES. Assign $(my_ndk_shared_libraries_fullpath) to
+    # my_check_elf_file_shared_lib_files so that check_elf_file.py can see those NDK stub libs.
+    my_check_elf_file_shared_lib_files := $(my_ndk_shared_libraries_fullpath)
+  endif
+else  # my_strip_module not true
+  include $(BUILD_SYSTEM)/base_rules.mk
+  built_module := $(LOCAL_BUILT_MODULE)
+
+ifdef prebuilt_module_is_a_library
+EXPORTS_LIST += $(intermediates)
+EXPORTS.$(intermediates).FLAGS := $(foreach d,$(LOCAL_EXPORT_C_INCLUDE_DIRS),-I $(d))
+EXPORTS.$(intermediates).DEPS := $(LOCAL_EXPORT_C_INCLUDE_DEPS)
+
+include $(BUILD_SYSTEM)/allowed_ndk_types.mk
+
+ifdef LOCAL_SDK_VERSION
+my_link_type := native:ndk:$(my_ndk_stl_family):$(my_ndk_stl_link_type)
+else ifdef LOCAL_USE_VNDK
+    _name := $(patsubst %.vendor,%,$(LOCAL_MODULE))
+    _name := $(patsubst %.product,%,$(LOCAL_MODULE))
+    ifneq ($(filter $(_name),$(VNDK_CORE_LIBRARIES) $(VNDK_SAMEPROCESS_LIBRARIES) $(LLNDK_LIBRARIES)),)
+        ifeq ($(filter $(_name),$(VNDK_PRIVATE_LIBRARIES)),)
+            my_link_type := native:vndk
+        else
+            my_link_type := native:vndk_private
+        endif
+    else
+        ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+            my_link_type := native:product
+        else
+            my_link_type := native:vendor
+        endif
+    endif
+else ifneq ($(filter $(TARGET_RECOVERY_OUT)/%,$(LOCAL_MODULE_PATH)),)
+my_link_type := native:recovery
+else
+my_link_type := native:platform
+endif
+
+# TODO: check dependencies of prebuilt files
+my_link_deps :=
+
+my_2nd_arch_prefix := $(LOCAL_2ND_ARCH_VAR_PREFIX)
+my_common :=
+include $(BUILD_SYSTEM)/link_type.mk
+endif  # prebuilt_module_is_a_library
+
+# The real dependency will be added after all Android.mks are loaded and the install paths
+# of the shared libraries are determined.
+ifdef LOCAL_INSTALLED_MODULE
+ifdef LOCAL_IS_HOST_MODULE
+    ifeq ($(LOCAL_SYSTEM_SHARED_LIBRARIES),none)
+        my_system_shared_libraries :=
+    else
+        my_system_shared_libraries := $(LOCAL_SYSTEM_SHARED_LIBRARIES)
+    endif
+else
+    ifeq ($(LOCAL_SYSTEM_SHARED_LIBRARIES),none)
+        my_system_shared_libraries := libc libm libdl
+    else
+        my_system_shared_libraries := $(LOCAL_SYSTEM_SHARED_LIBRARIES)
+        my_system_shared_libraries := $(patsubst libc,libc libdl,$(my_system_shared_libraries))
+    endif
+endif
+
+my_shared_libraries := $(strip \
+    $(filter-out $(my_system_shared_libraries),$(LOCAL_SHARED_LIBRARIES)) \
+    $(my_system_shared_libraries))
+
+# Extra shared libraries introduced by LOCAL_CXX_STL (may append some libraries to
+# my_shared_libraries).
+include $(BUILD_SYSTEM)/cxx_stl_setup.mk
+
+ifdef my_shared_libraries
+ifdef LOCAL_USE_VNDK
+  ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+  else
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  endif
+endif
+$(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
+  $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(my_shared_libraries))
+endif  # my_shared_libraries
+endif  # LOCAL_INSTALLED_MODULE
+
+# We need to enclose the above export_includes and my_built_shared_libraries in
+# "my_strip_module not true" because otherwise the rules are defined in dynamic_binary.mk.
+endif  # my_strip_module not true
+
+
+# Check prebuilt ELF binaries.
+include $(BUILD_SYSTEM)/check_elf_file.mk
+
+ifeq ($(NATIVE_COVERAGE),true)
+ifneq (,$(strip $(LOCAL_PREBUILT_COVERAGE_ARCHIVE)))
+  $(eval $(call copy-one-file,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(intermediates)/$(LOCAL_MODULE).gcnodir))
+  ifneq ($(LOCAL_UNINSTALLABLE_MODULE),true)
+    ifdef LOCAL_IS_HOST_MODULE
+      my_coverage_path := $($(my_prefix)OUT_COVERAGE)/$(patsubst $($(my_prefix)OUT)/%,%,$(my_module_path))
+    else
+      my_coverage_path := $(TARGET_OUT_COVERAGE)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
+    endif
+    my_coverage_path := $(my_coverage_path)/$(patsubst %.so,%,$(my_installed_module_stem)).gcnodir
+    $(eval $(call copy-one-file,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(my_coverage_path)))
+    $(LOCAL_BUILT_MODULE): $(my_coverage_path)
+  endif
+else
+# Coverage information is needed when static lib is a dependency of another
+# coverage-enabled module.
+ifeq (STATIC_LIBRARIES, $(LOCAL_MODULE_CLASS))
+GCNO_ARCHIVE := $(LOCAL_MODULE).gcnodir
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_OBJECTS :=
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_WHOLE_STATIC_LIBRARIES :=
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_PREFIX := $(my_prefix)
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_2ND_ARCH_VAR_PREFIX := $(LOCAL_2ND_ARCH_VAR_PREFIX)
+$(intermediates)/$(GCNO_ARCHIVE) :
+	$(transform-o-to-static-lib)
+endif
+endif
+endif
+
+$(built_module) : $(my_prebuilt_src_file)
+	$(transform-prebuilt-to-target)
+ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
+	$(hide) chmod +x $@
+endif
+
diff --git a/core/check_elf_file.mk b/core/check_elf_file.mk
index 0faaadd..da4168d 100644
--- a/core/check_elf_file.mk
+++ b/core/check_elf_file.mk
@@ -38,12 +38,12 @@
 	    $<
 	$(hide) touch $@
 
-ifneq ($(PRODUCT_CHECK_ELF_FILES)$(CHECK_ELF_FILES),)
 ifneq ($(strip $(LOCAL_CHECK_ELF_FILES)),false)
+ifneq ($(strip $(BUILD_BROKEN_PREBUILT_ELF_FILES)),true)
 $(LOCAL_BUILT_MODULE): $(check_elf_files_stamp)
 check-elf-files: $(check_elf_files_stamp)
+endif  # BUILD_BROKEN_PREBUILT_ELF_FILES
 endif  # LOCAL_CHECK_ELF_FILES
-endif  # PRODUCT_CHECK_ELF_FILES or CHECK_ELF_FILES
 
 endif  # SHARED_LIBRARIES, EXECUTABLES, NATIVE_TESTS
 endif  # !LOCAL_IS_HOST_MODULE
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index d3afc65..ebdb663 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -31,6 +31,7 @@
 LOCAL_CC:=
 LOCAL_CERTIFICATE:=
 LOCAL_CFLAGS:=
+LOCAL_CHECK_SAME_VNDK_VARIANTS:=
 LOCAL_CHECKED_MODULE:=
 LOCAL_C_INCLUDES:=
 LOCAL_CLANG:=
@@ -58,7 +59,7 @@
 LOCAL_DEX_PREOPT_FLAGS:=
 LOCAL_DEX_PREOPT_GENERATE_PROFILE:=
 LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING:=
-LOCAL_DEX_PREOPT:= # '',true,false,nostripping
+LOCAL_DEX_PREOPT:= # '',true,false
 LOCAL_DISABLE_AUTO_GENERATE_TEST_CONFIG:=
 LOCAL_DISABLE_RESOLVE_SUPPORT_LIBRARIES:=
 LOCAL_DONT_CHECK_MODULE:=
@@ -83,6 +84,7 @@
 LOCAL_DROIDDOC_TEMPLATE_DIR:=
 LOCAL_DROIDDOC_USE_STANDARD_DOCLET:=
 LOCAL_DX_FLAGS:=
+LOCAL_DYLIB_LIBRARIES:=
 LOCAL_EMMA_COVERAGE_FILTER:=
 LOCAL_EMMA_INSTRUMENT:=
 LOCAL_ENFORCE_USES_LIBRARIES:=
@@ -107,22 +109,24 @@
 LOCAL_FULL_MANIFEST_FILE:=
 LOCAL_FULL_TEST_CONFIG:=
 LOCAL_FUZZ_ENGINE:=
+LOCAL_FUZZ_INSTALLED_SHARED_DEPS:=
 LOCAL_GCNO_FILES:=
 LOCAL_GENERATED_SOURCES:=
 # Group static libraries with "-Wl,--start-group" and "-Wl,--end-group" when linking.
 LOCAL_GROUP_STATIC_LIBRARIES:=
 LOCAL_GTEST:=true
-LOCAL_HAL_STATIC_LIBRARIES:=
 LOCAL_HEADER_LIBRARIES:=
 LOCAL_HOST_PREFIX:=
 LOCAL_HOST_REQUIRED_MODULES:=
 LOCAL_INIT_RC:=
+LOCAL_INJECT_BSSL_HASH:=
 LOCAL_INSTALLED_MODULE:=
 LOCAL_INSTALLED_MODULE_STEM:=
 LOCAL_INSTRUMENTATION_FOR:=
 LOCAL_INTERMEDIATE_SOURCE_DIR:=
 LOCAL_INTERMEDIATE_SOURCES:=
 LOCAL_INTERMEDIATE_TARGETS:=
+LOCAL_IS_FUZZ_TARGET:=
 LOCAL_IS_HOST_MODULE:=
 LOCAL_IS_RUNTIME_RESOURCE_OVERLAY:=
 LOCAL_JACK_CLASSPATH:=
@@ -150,6 +154,7 @@
 LOCAL_JETIFIER_ENABLED:=
 LOCAL_JNI_SHARED_LIBRARIES:=
 LOCAL_JNI_SHARED_LIBRARIES_ABI:=
+LOCAL_CERTIFICATE_LINEAGE:=
 LOCAL_LDFLAGS:=
 LOCAL_LDLIBS:=
 LOCAL_LOGTAGS_FILES:=
@@ -183,13 +188,13 @@
 LOCAL_NO_CRT:=
 LOCAL_NO_DEFAULT_COMPILER_FLAGS:=
 LOCAL_NO_FPIE :=
-LOCAL_NO_LIBGCC:=
 LOCAL_NO_LIBCRT_BUILTINS:=
 LOCAL_NO_NOTICE_FILE:=
 LOCAL_NO_PIC:=
 LOCAL_NOSANITIZE:=
 LOCAL_NO_STANDARD_LIBRARIES:=
 LOCAL_NO_STATIC_ANALYZER:=
+LOCAL_NOT_AVAILABLE_FOR_PLATFORM:=
 LOCAL_NOTICE_FILE:=
 LOCAL_ODM_MODULE:=
 LOCAL_OEM_MODULE:=
@@ -217,12 +222,15 @@
 LOCAL_PRESUBMIT_DISABLED:=
 LOCAL_PRIVATE_PLATFORM_APIS:=
 LOCAL_PRIVILEGED_MODULE:=
+LOCAL_PROC_MACRO_LIBRARIES:=
 # '',full,custom,disabled,obfuscation,optimization
 LOCAL_PRODUCT_MODULE:=
-LOCAL_PRODUCT_SERVICES_MODULE:=
+# TODO(b/135957588) Remove LOCAL_PRODUCT_SERVICES_MODULE
+LOCAL_PRODUCT_SERVICES_MODULE :=
 LOCAL_PROGUARD_ENABLED:=
 LOCAL_PROGUARD_FLAG_FILES:=
 LOCAL_PROGUARD_FLAGS:=
+LOCAL_PROGUARD_FLAGS_DEPS:=
 LOCAL_PROPRIETARY_MODULE:=
 LOCAL_PROTOC_FLAGS:=
 # lite(default),micro,nano,stream,full,nanopb-c,nanopb-c-enable_malloc,nanopb-c-16bit,nanopb-c-enable_malloc-16bit,nanopb-c-32bit,nanopb-c-enable_malloc-32bit
@@ -242,6 +250,7 @@
 LOCAL_REQUIRED_MODULES:=
 LOCAL_RES_LIBRARIES:=
 LOCAL_RESOURCE_DIR:=
+LOCAL_RLIB_LIBRARIES:=
 LOCAL_RMTYPEDEFS:=
 LOCAL_RRO_THEME:=
 LOCAL_RTTI_FLAG:=
@@ -264,6 +273,7 @@
 LOCAL_SOONG_HEADER_JAR :=
 LOCAL_SOONG_JACOCO_REPORT_CLASSES_JAR :=
 LOCAL_SOONG_LINK_TYPE :=
+LOCAL_SOONG_LINT_REPORTS :=
 LOCAL_SOONG_PROGUARD_DICT :=
 LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE :=
 LOCAL_SOONG_DEVICE_RRO_DIRS :=
@@ -272,6 +282,7 @@
 LOCAL_SOONG_SYMBOL_PATH :=
 LOCAL_SOONG_TOC :=
 LOCAL_SOONG_UNSTRIPPED_BINARY :=
+LOCAL_SOONG_VNDK_VERSION :=
 # '',true
 LOCAL_SOURCE_FILES_ALL_GENERATED:=
 LOCAL_SRC_FILES:=
@@ -281,6 +292,7 @@
 LOCAL_STATIC_JAVA_AAR_LIBRARIES:=
 LOCAL_STATIC_JAVA_LIBRARIES:=
 LOCAL_STATIC_LIBRARIES:=
+LOCAL_SYSTEM_EXT_MODULE:=
 LOCAL_STRIP_MODULE:=
 LOCAL_SYSTEM_SHARED_LIBRARIES:=none
 LOCAL_TARGET_REQUIRED_MODULES:=
@@ -294,9 +306,10 @@
 LOCAL_UNCOMPRESS_DEX:=
 LOCAL_UNINSTALLABLE_MODULE:=
 LOCAL_UNSTRIPPED_PATH:=
-LOCAL_USE_AAPT2:=$(USE_AAPT2)
+LOCAL_USE_AAPT2:=
 LOCAL_USE_CLANG_LLD:=
 LOCAL_USE_VNDK:=
+LOCAL_USE_VNDK_PRODUCT:=
 LOCAL_USES_LIBRARIES:=
 LOCAL_VENDOR_MODULE:=
 LOCAL_VINTF_FRAGMENTS:=
@@ -306,7 +319,6 @@
 LOCAL_VTS_MODE:=
 LOCAL_WARNINGS_ENABLE:=
 LOCAL_WHOLE_STATIC_LIBRARIES:=
-LOCAL_XOM:=
 LOCAL_YACCFLAGS:=
 LOCAL_CHECK_ELF_FILES:=
 # TODO: deprecate, it does nothing
@@ -330,6 +342,7 @@
 LOCAL_REQUIRED_MODULES_$(TARGET_ARCH):=
 LOCAL_SHARED_LIBRARIES_$(TARGET_ARCH):=
 LOCAL_SOONG_JNI_LIBS_$(TARGET_ARCH):=
+LOCAL_SOONG_JNI_LIBS_SYMBOLS:=
 LOCAL_SRC_FILES_EXCLUDE_$(TARGET_ARCH):=
 LOCAL_SRC_FILES_$(TARGET_ARCH):=
 LOCAL_STATIC_LIBRARIES_$(TARGET_ARCH):=
diff --git a/core/combo/HOST_darwin-x86_64.mk b/core/combo/HOST_darwin-x86_64.mk
index 07f8d9f..dac3bbf 100644
--- a/core/combo/HOST_darwin-x86_64.mk
+++ b/core/combo/HOST_darwin-x86_64.mk
@@ -59,8 +59,3 @@
         $(PRIVATE_LDFLAGS) \
         $(PRIVATE_LDLIBS)
 endef
-
-# $(1): The file to check
-define get-file-size
-stat -f "%z" $(1)
-endef
diff --git a/core/combo/HOST_linux-x86.mk b/core/combo/HOST_linux-x86.mk
index deed943..3f4ec0a 100644
--- a/core/combo/HOST_linux-x86.mk
+++ b/core/combo/HOST_linux-x86.mk
@@ -23,8 +23,3 @@
 
 ############################################################
 ## Macros after this line are shared by the 64-bit config.
-
-# $(1): The file to check
-define get-file-size
-stat -c "%s" "$(1)" | tr -d '\n'
-endef
diff --git a/core/combo/TARGET_linux-mips.mk b/core/combo/TARGET_linux-mips.mk
index ba76969..9f14aa2 100644
--- a/core/combo/TARGET_linux-mips.mk
+++ b/core/combo/TARGET_linux-mips.mk
@@ -33,12 +33,6 @@
 TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT := mips32r2-fp
 endif
 
-TARGET_ARCH_SPECIFIC_MAKEFILE := $(BUILD_COMBOS)/arch/$(TARGET_$(combo_2nd_arch_prefix)ARCH)/$(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT).mk
-ifeq ($(strip $(wildcard $(TARGET_ARCH_SPECIFIC_MAKEFILE))),)
-$(error Unknown MIPS architecture variant: $(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT))
-endif
-
-include $(TARGET_ARCH_SPECIFIC_MAKEFILE)
 include $(BUILD_SYSTEM)/combo/fdo.mk
 
 define $(combo_var_prefix)transform-shared-lib-to-toc
diff --git a/core/combo/TARGET_linux-mips64.mk b/core/combo/TARGET_linux-mips64.mk
index b498d1f..ae17e46 100644
--- a/core/combo/TARGET_linux-mips64.mk
+++ b/core/combo/TARGET_linux-mips64.mk
@@ -33,12 +33,6 @@
 TARGET_ARCH_VARIANT := mips64r6
 endif
 
-TARGET_ARCH_SPECIFIC_MAKEFILE := $(BUILD_COMBOS)/arch/$(TARGET_ARCH)/$(TARGET_ARCH_VARIANT).mk
-ifeq ($(strip $(wildcard $(TARGET_ARCH_SPECIFIC_MAKEFILE))),)
-$(error Unknown MIPS architecture variant: $(TARGET_ARCH_VARIANT))
-endif
-
-include $(TARGET_ARCH_SPECIFIC_MAKEFILE)
 include $(BUILD_SYSTEM)/combo/fdo.mk
 
 define $(combo_var_prefix)transform-shared-lib-to-toc
diff --git a/core/combo/arch/arm/armv7-a-neon.mk b/core/combo/arch/arm/armv7-a-neon.mk
index 01d2235..0c01ac3 100644
--- a/core/combo/arch/arm/armv7-a-neon.mk
+++ b/core/combo/arch/arm/armv7-a-neon.mk
@@ -1,7 +1,6 @@
 # Configuration for Linux on ARM.
 # Generating binaries for the ARMv7-a architecture and higher with NEON
 #
-ARCH_ARM_HAVE_ARMV7A            := true
 ARCH_ARM_HAVE_VFP               := true
 ARCH_ARM_HAVE_VFP_D32           := true
 ARCH_ARM_HAVE_NEON              := true
diff --git a/core/combo/arch/arm/armv8-2a.mk b/core/combo/arch/arm/armv8-2a.mk
index c1d8182..7e2ca18 100644
--- a/core/combo/arch/arm/armv8-2a.mk
+++ b/core/combo/arch/arm/armv8-2a.mk
@@ -3,7 +3,6 @@
 #
 # Many libraries are not aware of armv8-2a, and AArch32 is (almost) a superset
 # of armv7-a-neon. So just let them think we are just like v7.
-ARCH_ARM_HAVE_ARMV7A            := true
 ARCH_ARM_HAVE_VFP               := true
 ARCH_ARM_HAVE_VFP_D32           := true
 ARCH_ARM_HAVE_NEON              := true
diff --git a/core/combo/arch/arm/armv8-a.mk b/core/combo/arch/arm/armv8-a.mk
index 9ef5c49..19bc014 100644
--- a/core/combo/arch/arm/armv8-a.mk
+++ b/core/combo/arch/arm/armv8-a.mk
@@ -3,7 +3,6 @@
 #
 # Many libraries are not aware of armv8-a, and AArch32 is (almost) a superset
 # of armv7-a-neon. So just let them think we are just like v7.
-ARCH_ARM_HAVE_ARMV7A            := true
 ARCH_ARM_HAVE_VFP               := true
 ARCH_ARM_HAVE_VFP_D32           := true
 ARCH_ARM_HAVE_NEON              := true
diff --git a/core/combo/arch/mips/mips32-fp.mk b/core/combo/arch/mips/mips32-fp.mk
deleted file mode 100644
index 4b09bc1..0000000
--- a/core/combo/arch/mips/mips32-fp.mk
+++ /dev/null
@@ -1,5 +0,0 @@
-# Configuration for Android on MIPS.
-# Generating binaries for MIPS32/hard-float/little-endian
-
-ARCH_MIPS_HAS_FPU	:=true
-ARCH_HAVE_ALIGNED_DOUBLES :=true
diff --git a/core/combo/arch/mips/mips32r2-fp-xburst.mk b/core/combo/arch/mips/mips32r2-fp-xburst.mk
deleted file mode 100644
index 83fb12e..0000000
--- a/core/combo/arch/mips/mips32r2-fp-xburst.mk
+++ /dev/null
@@ -1,6 +0,0 @@
-# Configuration for Android on Ingenic xb4780/Xburst MIPS CPU.
-# Generating binaries for MIPS32R2/hard-float/little-endian without
-# support for the Madd family of instructions.
-
-ARCH_MIPS_HAS_FPU :=true
-ARCH_HAVE_ALIGNED_DOUBLES :=true
diff --git a/core/combo/arch/mips/mips32r2-fp.mk b/core/combo/arch/mips/mips32r2-fp.mk
deleted file mode 100644
index 97c14c3..0000000
--- a/core/combo/arch/mips/mips32r2-fp.mk
+++ /dev/null
@@ -1,5 +0,0 @@
-# Configuration for Android on MIPS.
-# Generating binaries for MIPS32R2/hard-float/little-endian
-
-ARCH_MIPS_HAS_FPU	:=true
-ARCH_HAVE_ALIGNED_DOUBLES :=true
diff --git a/core/combo/arch/mips/mips32r2dsp-fp.mk b/core/combo/arch/mips/mips32r2dsp-fp.mk
deleted file mode 100644
index 522b6b9..0000000
--- a/core/combo/arch/mips/mips32r2dsp-fp.mk
+++ /dev/null
@@ -1,7 +0,0 @@
-# Configuration for Android on MIPS.
-# Generating binaries for MIPS32R2/hard-float/little-endian/dsp
-
-ARCH_MIPS_HAS_DSP  	:=true
-ARCH_MIPS_DSP_REV	:=1
-ARCH_MIPS_HAS_FPU       :=true
-ARCH_HAVE_ALIGNED_DOUBLES :=true
diff --git a/core/combo/arch/mips/mips32r2dspr2-fp.mk b/core/combo/arch/mips/mips32r2dspr2-fp.mk
deleted file mode 100644
index 886d378..0000000
--- a/core/combo/arch/mips/mips32r2dspr2-fp.mk
+++ /dev/null
@@ -1,7 +0,0 @@
-# Configuration for Android on MIPS.
-# Generating binaries for MIPS32R2/hard-float/little-endian/dsp
-
-ARCH_MIPS_HAS_DSP  	:=true
-ARCH_MIPS_DSP_REV	:=2
-ARCH_MIPS_HAS_FPU       :=true
-ARCH_HAVE_ALIGNED_DOUBLES :=true
diff --git a/core/combo/arch/mips/mips32r6.mk b/core/combo/arch/mips/mips32r6.mk
deleted file mode 100644
index 7bc6cac..0000000
--- a/core/combo/arch/mips/mips32r6.mk
+++ /dev/null
@@ -1,4 +0,0 @@
-# Configuration for Android on MIPS.
-# Generating binaries for MIPS32R6/hard-float/little-endian
-
-ARCH_MIPS_REV6 := true
diff --git a/core/combo/arch/mips64/mips64r2.mk b/core/combo/arch/mips64/mips64r2.mk
deleted file mode 100644
index 54aa387..0000000
--- a/core/combo/arch/mips64/mips64r2.mk
+++ /dev/null
@@ -1,6 +0,0 @@
-# Configuration for Android on mips64r2.
-
-# This target is for temporary use only, until mips64r6 is supported by Android's qemu.
-
-ARCH_MIPS_HAS_FPU	:=true
-ARCH_HAVE_ALIGNED_DOUBLES :=true
diff --git a/core/combo/arch/mips64/mips64r6.mk b/core/combo/arch/mips64/mips64r6.mk
deleted file mode 100644
index 42d6c9e..0000000
--- a/core/combo/arch/mips64/mips64r6.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-# Configuration for Android on mips64r6.
-
-ARCH_MIPS64_REV6 := true
diff --git a/core/combo/arch/x86/amberlake.mk b/core/combo/arch/x86/amberlake.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86/amberlake.mk
+++ b/core/combo/arch/x86/amberlake.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/atom.mk b/core/combo/arch/x86/atom.mk
index 43a170c..bae7946 100644
--- a/core/combo/arch/x86/atom.mk
+++ b/core/combo/arch/x86/atom.mk
@@ -4,6 +4,3 @@
 #
 # See build/make/core/combo/arch/x86/x86.mk for differences.
 #
-ARCH_X86_HAVE_SSSE3 := true
-ARCH_X86_HAVE_MOVBE := true
-ARCH_X86_HAVE_POPCNT := false   # popcnt is not supported by current Atom CPUs
diff --git a/core/combo/arch/x86/broadwell.mk b/core/combo/arch/x86/broadwell.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86/broadwell.mk
+++ b/core/combo/arch/x86/broadwell.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/haswell.mk b/core/combo/arch/x86/haswell.mk
index 50c27b4..ffa3bac 100644
--- a/core/combo/arch/x86/haswell.mk
+++ b/core/combo/arch/x86/haswell.mk
@@ -1,11 +1,4 @@
 # Configuration for Linux on x86.
 # Generating binaries for Haswell processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/icelake.mk b/core/combo/arch/x86/icelake.mk
index 76fe212..a7ae6ed 100644
--- a/core/combo/arch/x86/icelake.mk
+++ b/core/combo/arch/x86/icelake.mk
@@ -3,12 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_AVX512 := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/ivybridge.mk b/core/combo/arch/x86/ivybridge.mk
index 44035d8..a1358e6 100644
--- a/core/combo/arch/x86/ivybridge.mk
+++ b/core/combo/arch/x86/ivybridge.mk
@@ -1,11 +1,4 @@
 # Configuration for Linux on x86.
 # Generating binaries for Ivy Bridge processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := false
diff --git a/core/combo/arch/x86/kabylake.mk b/core/combo/arch/x86/kabylake.mk
index 50518d6..9906259 100644
--- a/core/combo/arch/x86/kabylake.mk
+++ b/core/combo/arch/x86/kabylake.mk
@@ -3,11 +3,4 @@
 # that support AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/sandybridge.mk b/core/combo/arch/x86/sandybridge.mk
index a4c1bd9..d6552ab 100644
--- a/core/combo/arch/x86/sandybridge.mk
+++ b/core/combo/arch/x86/sandybridge.mk
@@ -1,11 +1,4 @@
 # Configuration for Linux on x86.
 # Generating binaries for SandyBridge processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := false
-ARCH_X86_HAVE_AVX    := false
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := false
diff --git a/core/combo/arch/x86/silvermont.mk b/core/combo/arch/x86/silvermont.mk
index cba1079..8ac2b98 100644
--- a/core/combo/arch/x86/silvermont.mk
+++ b/core/combo/arch/x86/silvermont.mk
@@ -4,10 +4,4 @@
 # See build/make/core/combo/arch/x86/x86-atom.mk for differences.
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/skylake.mk b/core/combo/arch/x86/skylake.mk
index 03705c0..9906259 100644
--- a/core/combo/arch/x86/skylake.mk
+++ b/core/combo/arch/x86/skylake.mk
@@ -3,13 +3,4 @@
 # that support AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_AVX512 := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
-
diff --git a/core/combo/arch/x86/stoneyridge.mk b/core/combo/arch/x86/stoneyridge.mk
index 30405a1..05ff77a 100644
--- a/core/combo/arch/x86/stoneyridge.mk
+++ b/core/combo/arch/x86/stoneyridge.mk
@@ -1,12 +1,4 @@
 # Configuration for Linux on x86.
 # Generating binaries for Stoney Ridge processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/tigerlake.mk b/core/combo/arch/x86/tigerlake.mk
index 76fe212..a7ae6ed 100644
--- a/core/combo/arch/x86/tigerlake.mk
+++ b/core/combo/arch/x86/tigerlake.mk
@@ -3,12 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_AVX512 := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/whiskeylake.mk b/core/combo/arch/x86/whiskeylake.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86/whiskeylake.mk
+++ b/core/combo/arch/x86/whiskeylake.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86/x86.mk b/core/combo/arch/x86/x86.mk
index db55ff8..066f66a 100644
--- a/core/combo/arch/x86/x86.mk
+++ b/core/combo/arch/x86/x86.mk
@@ -8,9 +8,3 @@
 # These features are optional and shall not be included in the base platform
 # Otherwise, sdk_x86-eng system images might fail to run on some
 # developer machines.
-ARCH_X86_HAVE_SSSE3 := false
-ARCH_X86_HAVE_MOVBE := false
-ARCH_X86_HAVE_POPCNT := false
-ARCH_X86_HAVE_AVX := false
-ARCH_X86_HAVE_AVX2 := false
-ARCH_X86_HAVE_AVX512 := false
diff --git a/core/combo/arch/x86/x86_64.mk b/core/combo/arch/x86/x86_64.mk
index fc2a087..eff406b 100644
--- a/core/combo/arch/x86/x86_64.mk
+++ b/core/combo/arch/x86/x86_64.mk
@@ -4,9 +4,4 @@
 # The generic 'x86' variant cannot be used, since it resets some flags used
 # by the 'x86_64' variant.
 
-ARCH_X86_HAVE_SSSE3 := true
-ARCH_X86_HAVE_MOVBE := false # Only supported on Atom.
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_SSE4 := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
diff --git a/core/combo/arch/x86_64/amberlake.mk b/core/combo/arch/x86_64/amberlake.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86_64/amberlake.mk
+++ b/core/combo/arch/x86_64/amberlake.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/broadwell.mk b/core/combo/arch/x86_64/broadwell.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86_64/broadwell.mk
+++ b/core/combo/arch/x86_64/broadwell.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/haswell.mk b/core/combo/arch/x86_64/haswell.mk
index f9c6ebd..faf12fa 100644
--- a/core/combo/arch/x86_64/haswell.mk
+++ b/core/combo/arch/x86_64/haswell.mk
@@ -1,11 +1,4 @@
 # Configuration for Linux on x86_64.
 # Generating binaries for Haswell processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/icelake.mk b/core/combo/arch/x86_64/icelake.mk
index 76fe212..a7ae6ed 100644
--- a/core/combo/arch/x86_64/icelake.mk
+++ b/core/combo/arch/x86_64/icelake.mk
@@ -3,12 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_AVX512 := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/ivybridge.mk b/core/combo/arch/x86_64/ivybridge.mk
index 69011d6..464fa98 100644
--- a/core/combo/arch/x86_64/ivybridge.mk
+++ b/core/combo/arch/x86_64/ivybridge.mk
@@ -1,11 +1,4 @@
 # Configuration for Linux on x86_64.
 # Generating binaries for Ivy Bridge processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := false
diff --git a/core/combo/arch/x86_64/kabylake.mk b/core/combo/arch/x86_64/kabylake.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86_64/kabylake.mk
+++ b/core/combo/arch/x86_64/kabylake.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/sandybridge.mk b/core/combo/arch/x86_64/sandybridge.mk
index 2092d19..a09db2a 100644
--- a/core/combo/arch/x86_64/sandybridge.mk
+++ b/core/combo/arch/x86_64/sandybridge.mk
@@ -1,11 +1,4 @@
 # Configuration for Linux on x86_64.
 # Generating binaries for SandyBridge processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := false
-ARCH_X86_HAVE_AVX    := false
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := false
diff --git a/core/combo/arch/x86_64/silvermont.mk b/core/combo/arch/x86_64/silvermont.mk
index cba1079..8ac2b98 100644
--- a/core/combo/arch/x86_64/silvermont.mk
+++ b/core/combo/arch/x86_64/silvermont.mk
@@ -4,10 +4,4 @@
 # See build/make/core/combo/arch/x86/x86-atom.mk for differences.
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/skylake.mk b/core/combo/arch/x86_64/skylake.mk
index 76fe212..a7ae6ed 100644
--- a/core/combo/arch/x86_64/skylake.mk
+++ b/core/combo/arch/x86_64/skylake.mk
@@ -3,12 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_AVX512 := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/stoneyridge.mk b/core/combo/arch/x86_64/stoneyridge.mk
index f7d9583..5950d9a 100644
--- a/core/combo/arch/x86_64/stoneyridge.mk
+++ b/core/combo/arch/x86_64/stoneyridge.mk
@@ -1,12 +1,4 @@
 # Configuration for Linux on x86_64.
 # Generating binaries for Stoney Ridge processors.
 #
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AES_NI := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/tigerlake.mk b/core/combo/arch/x86_64/tigerlake.mk
index 76fe212..a7ae6ed 100644
--- a/core/combo/arch/x86_64/tigerlake.mk
+++ b/core/combo/arch/x86_64/tigerlake.mk
@@ -3,12 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_AVX512 := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/whiskeylake.mk b/core/combo/arch/x86_64/whiskeylake.mk
index 37100a4..a7ae6ed 100644
--- a/core/combo/arch/x86_64/whiskeylake.mk
+++ b/core/combo/arch/x86_64/whiskeylake.mk
@@ -3,11 +3,4 @@
 # that have AVX2 feature flag
 #
 
-ARCH_X86_HAVE_SSSE3  := true
-ARCH_X86_HAVE_SSE4   := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX    := true
-ARCH_X86_HAVE_AVX2   := true
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_MOVBE  := true
diff --git a/core/combo/arch/x86_64/x86_64.mk b/core/combo/arch/x86_64/x86_64.mk
index e7c8928..17413c7 100755
--- a/core/combo/arch/x86_64/x86_64.mk
+++ b/core/combo/arch/x86_64/x86_64.mk
@@ -5,12 +5,4 @@
 # that are run in the emulator under KVM emulation (i.e. running directly on
 # the host development machine's CPU).
 
-ARCH_X86_HAVE_SSSE3 := true
-ARCH_X86_HAVE_MOVBE := false # Only supported on Atom.
-ARCH_X86_HAVE_POPCNT := true
-ARCH_X86_HAVE_SSE4 := true
 ARCH_X86_HAVE_SSE4_1 := true
-ARCH_X86_HAVE_SSE4_2 := true
-ARCH_X86_HAVE_AVX := false
-ARCH_X86_HAVE_AVX2 := false
-ARCH_X86_HAVE_AVX512 := false
diff --git a/core/combo/javac.mk b/core/combo/javac.mk
index dac2628..32a5c9e 100644
--- a/core/combo/javac.mk
+++ b/core/combo/javac.mk
@@ -16,4 +16,5 @@
 
 # TODO(ccross): remove this, it is needed for now because it is used by
 # config.mk before makevars from soong are loaded
-JAVA := $(ANDROID_JAVA_TOOLCHAIN)/java
+JAVA := $(ANDROID_JAVA_TOOLCHAIN)/java -XX:OnError="cat hs_err_pid%p.log" -XX:CICompilerCount=6 -XX:+UseDynamicNumberOfGCThreads
+
diff --git a/core/combo/select.mk b/core/combo/select.mk
index eab4c72..33c8e6d 100644
--- a/core/combo/select.mk
+++ b/core/combo/select.mk
@@ -28,7 +28,7 @@
 
 # Set reasonable defaults for the various variables
 
-$(combo_var_prefix)GLOBAL_ARFLAGS := cqsD -format=gnu
+$(combo_var_prefix)GLOBAL_ARFLAGS := crsPD -format=gnu
 
 $(combo_var_prefix)STATIC_LIB_SUFFIX := .a
 
diff --git a/core/config.mk b/core/config.mk
index 4386489..90eea5b 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -93,9 +93,37 @@
 $(KATI_obsolete_var DIST_DIR dist_goal,Use dist-for-goals instead. See $(CHANGES_URL)#dist)
 $(KATI_obsolete_var TARGET_ANDROID_FILESYSTEM_CONFIG_H,Use TARGET_FS_CONFIG_GEN instead)
 $(KATI_deprecated_var USER,Use BUILD_USERNAME instead. See $(CHANGES_URL)#USER)
-
-# This is marked as obsolete in envsetup.mk after reading the BoardConfig.mk
-$(KATI_deprecate_export It is a global setting. See $(CHANGES_URL)#export_keyword)
+$(KATI_obsolete_var TARGET_ROOT_OUT_SBIN,/sbin has been removed, use /system/bin instead)
+$(KATI_obsolete_var TARGET_ROOT_OUT_SBIN_UNSTRIPPED,/sbin has been removed, use /system/bin instead)
+$(KATI_obsolete_var BUILD_BROKEN_PHONY_TARGETS)
+$(KATI_obsolete_var BUILD_BROKEN_DUP_COPY_HEADERS)
+$(KATI_obsolete_var BUILD_BROKEN_ENG_DEBUG_TAGS)
+$(KATI_obsolete_export It is a global setting. See $(CHANGES_URL)#export_keyword)
+$(KATI_obsolete_var BUILD_BROKEN_ANDROIDMK_EXPORTS)
+$(KATI_obsolete_var PRODUCT_STATIC_BOOT_CONTROL_HAL,Use shared library module instead. See $(CHANGES_URL)#PRODUCT_STATIC_BOOT_CONTROL_HAL)
+$(KATI_obsolete_var \
+  ARCH_ARM_HAVE_ARMV7A \
+  ARCH_DSP_REV \
+  ARCH_HAVE_ALIGNED_DOUBLES \
+  ARCH_MIPS_HAS_DSP \
+  ARCH_MIPS_HAS_FPU \
+  ARCH_MIPS_REV6 \
+  ARCH_X86_HAVE_AES_NI \
+  ARCH_X86_HAVE_AVX \
+  ARCH_X86_HAVE_AVX2 \
+  ARCH_X86_HAVE_AVX512 \
+  ARCH_X86_HAVE_MOVBE \
+  ARCH_X86_HAVE_POPCNT \
+  ARCH_X86_HAVE_SSE4 \
+  ARCH_X86_HAVE_SSE4_2 \
+  ARCH_X86_HAVE_SSSE3 \
+)
+$(KATI_obsolete_var PRODUCT_IOT)
+$(KATI_obsolete_var MD5SUM)
+$(KATI_obsolete_var BOARD_HAL_STATIC_LIBRARIES, See $(CHANGES_URL)#BOARD_HAL_STATIC_LIBRARIES)
+$(KATI_obsolete_var LOCAL_HAL_STATIC_LIBRARIES, See $(CHANGES_URL)#BOARD_HAL_STATIC_LIBRARIES)
+$(KATI_obsolete_var PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST,Use PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_ALLOW_LIST.)
+$(KATI_obsolete_var PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST,Use PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST.)
 
 # Used to force goals to build.  Only use for conditionally defined goals.
 .PHONY: FORCE
@@ -105,7 +133,7 @@
 
 UNAME := $(shell uname -sm)
 
-SRC_TARGET_DIR := $(TOPDIR)build/target
+SRC_TARGET_DIR := $(TOPDIR)build/make/target
 
 # Some specific paths to tools
 SRC_DROIDDOC_DIR := $(TOPDIR)build/make/tools/droiddoc
@@ -115,6 +143,9 @@
   .KATI_READONLY := TARGET_DEVICE_DIR
 endif
 
+ONE_SHOT_MAKEFILE :=
+.KATI_READONLY := ONE_SHOT_MAKEFILE
+
 # Set up efficient math functions which are used in make.
 # Here since this file is included by envsetup as well as during build.
 include $(BUILD_SYSTEM_COMMON)/math.mk
@@ -133,45 +164,48 @@
 # Build system internal files
 # ###############################################################
 
-BUILD_COMBOS:= $(BUILD_SYSTEM)/combo
+BUILD_COMBOS :=$= $(BUILD_SYSTEM)/combo
 
-CLEAR_VARS:= $(BUILD_SYSTEM)/clear_vars.mk
-BUILD_HOST_STATIC_LIBRARY:= $(BUILD_SYSTEM)/host_static_library.mk
-BUILD_HOST_SHARED_LIBRARY:= $(BUILD_SYSTEM)/host_shared_library.mk
-BUILD_STATIC_LIBRARY:= $(BUILD_SYSTEM)/static_library.mk
-BUILD_HEADER_LIBRARY:= $(BUILD_SYSTEM)/header_library.mk
-BUILD_AUX_STATIC_LIBRARY:= $(BUILD_SYSTEM)/aux_static_library.mk
-BUILD_AUX_EXECUTABLE:= $(BUILD_SYSTEM)/aux_executable.mk
-BUILD_SHARED_LIBRARY:= $(BUILD_SYSTEM)/shared_library.mk
-BUILD_EXECUTABLE:= $(BUILD_SYSTEM)/executable.mk
-BUILD_HOST_EXECUTABLE:= $(BUILD_SYSTEM)/host_executable.mk
-BUILD_PACKAGE:= $(BUILD_SYSTEM)/package.mk
-BUILD_PHONY_PACKAGE:= $(BUILD_SYSTEM)/phony_package.mk
-BUILD_RRO_PACKAGE:= $(BUILD_SYSTEM)/build_rro_package.mk
-BUILD_HOST_PREBUILT:= $(BUILD_SYSTEM)/host_prebuilt.mk
-BUILD_PREBUILT:= $(BUILD_SYSTEM)/prebuilt.mk
-BUILD_MULTI_PREBUILT:= $(BUILD_SYSTEM)/multi_prebuilt.mk
-BUILD_JAVA_LIBRARY:= $(BUILD_SYSTEM)/java_library.mk
-BUILD_STATIC_JAVA_LIBRARY:= $(BUILD_SYSTEM)/static_java_library.mk
-BUILD_HOST_JAVA_LIBRARY:= $(BUILD_SYSTEM)/host_java_library.mk
-BUILD_COPY_HEADERS := $(BUILD_SYSTEM)/copy_headers.mk
-BUILD_NATIVE_TEST := $(BUILD_SYSTEM)/native_test.mk
-BUILD_NATIVE_BENCHMARK := $(BUILD_SYSTEM)/native_benchmark.mk
-BUILD_HOST_NATIVE_TEST := $(BUILD_SYSTEM)/host_native_test.mk
-BUILD_FUZZ_TEST := $(BUILD_SYSTEM)/fuzz_test.mk
-BUILD_HOST_FUZZ_TEST := $(BUILD_SYSTEM)/host_fuzz_test.mk
+CLEAR_VARS :=$= $(BUILD_SYSTEM)/clear_vars.mk
 
-BUILD_SHARED_TEST_LIBRARY := $(BUILD_SYSTEM)/shared_test_lib.mk
-BUILD_HOST_SHARED_TEST_LIBRARY := $(BUILD_SYSTEM)/host_shared_test_lib.mk
-BUILD_STATIC_TEST_LIBRARY := $(BUILD_SYSTEM)/static_test_lib.mk
-BUILD_HOST_STATIC_TEST_LIBRARY := $(BUILD_SYSTEM)/host_static_test_lib.mk
+BUILD_HOST_STATIC_LIBRARY :=$= $(BUILD_SYSTEM)/host_static_library.mk
+BUILD_HOST_SHARED_LIBRARY :=$= $(BUILD_SYSTEM)/host_shared_library.mk
+BUILD_STATIC_LIBRARY :=$= $(BUILD_SYSTEM)/static_library.mk
+BUILD_HEADER_LIBRARY :=$= $(BUILD_SYSTEM)/header_library.mk
+BUILD_AUX_STATIC_LIBRARY :=$= $(BUILD_SYSTEM)/aux_static_library.mk
+BUILD_AUX_EXECUTABLE :=$= $(BUILD_SYSTEM)/aux_executable.mk
+BUILD_SHARED_LIBRARY :=$= $(BUILD_SYSTEM)/shared_library.mk
+BUILD_EXECUTABLE :=$= $(BUILD_SYSTEM)/executable.mk
+BUILD_HOST_EXECUTABLE :=$= $(BUILD_SYSTEM)/host_executable.mk
+BUILD_PACKAGE :=$= $(BUILD_SYSTEM)/package.mk
+BUILD_PHONY_PACKAGE :=$= $(BUILD_SYSTEM)/phony_package.mk
+BUILD_RRO_PACKAGE :=$= $(BUILD_SYSTEM)/build_rro_package.mk
+BUILD_HOST_PREBUILT :=$= $(BUILD_SYSTEM)/host_prebuilt.mk
+BUILD_PREBUILT :=$= $(BUILD_SYSTEM)/prebuilt.mk
+BUILD_MULTI_PREBUILT :=$= $(BUILD_SYSTEM)/multi_prebuilt.mk
+BUILD_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/java_library.mk
+BUILD_STATIC_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/static_java_library.mk
+BUILD_HOST_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/host_java_library.mk
+BUILD_COPY_HEADERS :=$= $(BUILD_SYSTEM)/copy_headers.mk
+BUILD_NATIVE_TEST :=$= $(BUILD_SYSTEM)/native_test.mk
+BUILD_NATIVE_BENCHMARK :=$= $(BUILD_SYSTEM)/native_benchmark.mk
+BUILD_HOST_NATIVE_TEST :=$= $(BUILD_SYSTEM)/host_native_test.mk
+BUILD_FUZZ_TEST :=$= $(BUILD_SYSTEM)/fuzz_test.mk
+BUILD_HOST_FUZZ_TEST :=$= $(BUILD_SYSTEM)/host_fuzz_test.mk
 
-BUILD_NOTICE_FILE := $(BUILD_SYSTEM)/notice_files.mk
-BUILD_HOST_DALVIK_JAVA_LIBRARY := $(BUILD_SYSTEM)/host_dalvik_java_library.mk
-BUILD_HOST_DALVIK_STATIC_JAVA_LIBRARY := $(BUILD_SYSTEM)/host_dalvik_static_java_library.mk
+BUILD_SHARED_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/shared_test_lib.mk
+BUILD_HOST_SHARED_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/host_shared_test_lib.mk
+BUILD_STATIC_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/static_test_lib.mk
+BUILD_HOST_STATIC_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/host_static_test_lib.mk
 
-BUILD_HOST_TEST_CONFIG := $(BUILD_SYSTEM)/host_test_config.mk
-BUILD_TARGET_TEST_CONFIG := $(BUILD_SYSTEM)/target_test_config.mk
+BUILD_NOTICE_FILE :=$= $(BUILD_SYSTEM)/notice_files.mk
+BUILD_HOST_DALVIK_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/host_dalvik_java_library.mk
+BUILD_HOST_DALVIK_STATIC_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/host_dalvik_static_java_library.mk
+
+BUILD_HOST_TEST_CONFIG :=$= $(BUILD_SYSTEM)/host_test_config.mk
+BUILD_TARGET_TEST_CONFIG :=$= $(BUILD_SYSTEM)/target_test_config.mk
+
+include $(BUILD_SYSTEM)/deprecation.mk
 
 # ###############################################################
 # Parse out any modifier targets.
@@ -196,6 +230,36 @@
 # Initialize SOONG_CONFIG_NAMESPACES so that it isn't recursive.
 SOONG_CONFIG_NAMESPACES :=
 
+# The add_soong_config_namespace function adds a namespace and initializes it
+# to be empty.
+# $1 is the namespace.
+# Ex: $(call add_soong_config_namespace,acme)
+
+define add_soong_config_namespace
+$(eval SOONG_CONFIG_NAMESPACES += $1) \
+$(eval SOONG_CONFIG_$1 :=)
+endef
+
+# The add_soong_config_var function adds a a list of soong config variables to
+# SOONG_CONFIG_*. The variables and their values are then available to a
+# soong_config_module_type in an Android.bp file.
+# $1 is the namespace. $2 is the list of variables.
+# Ex: $(call add_soong_config_var,acme,COOL_FEATURE_A COOL_FEATURE_B)
+define add_soong_config_var
+$(eval SOONG_CONFIG_$1 += $2) \
+$(foreach v,$2,$(eval SOONG_CONFIG_$1_$v := $($v)))
+endef
+
+# The add_soong_config_var_value function defines a make variable and also adds
+# the variable to SOONG_CONFIG_*.
+# $1 is the namespace. $2 is the variable name. $3 is the variable value.
+# Ex: $(call add_soong_config_var_value,acme,COOL_FEATURE,true)
+
+define add_soong_config_var_value
+$(eval $2 := $3) \
+$(call add_soong_config_var,$1,$2)
+endef
+
 # Set the extensions used for various packages
 COMMON_PACKAGE_SUFFIX := .zip
 COMMON_JAVA_PACKAGE_SUFFIX := .jar
@@ -444,9 +508,6 @@
 ifneq ($(filter true,$(SOONG_ALLOW_MISSING_DEPENDENCIES)),)
 ALLOW_MISSING_DEPENDENCIES := true
 endif
-ifneq ($(ONE_SHOT_MAKEFILE),)
-ALLOW_MISSING_DEPENDENCIES := true
-endif
 .KATI_READONLY := ALLOW_MISSING_DEPENDENCIES
 
 TARGET_BUILD_APPS_USE_PREBUILT_SDK :=
@@ -459,7 +520,6 @@
 prebuilt_sdk_tools := prebuilts/sdk/tools
 prebuilt_sdk_tools_bin := $(prebuilt_sdk_tools)/$(HOST_OS)/bin
 
-# Always use prebuilts for ckati and makeparallel
 prebuilt_build_tools := prebuilts/build-tools
 prebuilt_build_tools_wrappers := prebuilts/build-tools/common/bin
 prebuilt_build_tools_jars := prebuilts/build-tools/common/framework
@@ -481,22 +541,12 @@
 # Tools that are prebuilts for TARGET_BUILD_APPS
 #
 ifeq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
-  AIDL := $(HOST_OUT_EXECUTABLES)/aidl
   AAPT := $(HOST_OUT_EXECUTABLES)/aapt
-  AAPT2 := $(HOST_OUT_EXECUTABLES)/aapt2
   MAINDEXCLASSES := $(HOST_OUT_EXECUTABLES)/mainDexClasses
-  SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
-  SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
-  ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
 
 else # TARGET_BUILD_APPS || TARGET_BUILD_PDK
-  AIDL := $(prebuilt_build_tools_bin)/aidl
   AAPT := $(prebuilt_sdk_tools_bin)/aapt
-  AAPT2 := $(prebuilt_sdk_tools_bin)/aapt2
   MAINDEXCLASSES := $(prebuilt_sdk_tools)/mainDexClasses
-  SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
-  SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
-  ZIPALIGN := $(prebuilt_build_tools_bin)/zipalign
 endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
 
 ifeq (,$(TARGET_BUILD_APPS))
@@ -515,14 +565,13 @@
 CKATI := $(prebuilt_build_tools_bin)/ckati
 DEPMOD := $(HOST_OUT_EXECUTABLES)/depmod
 FILESLIST := $(SOONG_HOST_OUT_EXECUTABLES)/fileslist
+FILESLIST_UTIL :=$= build/make/tools/fileslist_util.py
 HOST_INIT_VERIFIER := $(HOST_OUT_EXECUTABLES)/host_init_verifier
-MAKEPARALLEL := $(prebuilt_build_tools_bin)/makeparallel
-SOONG_JAVAC_WRAPPER := $(SOONG_HOST_OUT_EXECUTABLES)/soong_javac_wrapper
-SOONG_ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/soong_zip
-MERGE_ZIPS := $(SOONG_HOST_OUT_EXECUTABLES)/merge_zips
 XMLLINT := $(SOONG_HOST_OUT_EXECUTABLES)/xmllint
-ZIP2ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/zip2zip
-ZIPTIME := $(prebuilt_build_tools_bin)/ziptime
+
+# SOONG_ZIP is exported by Soong, but needs to be defined early for
+# $OUT/dexpreopt.global.  It will be verified against the Soong version.
+SOONG_ZIP := $(SOONG_HOST_OUT_EXECUTABLES)/soong_zip
 
 # ---------------------------------------------------------------
 # Generic tools.
@@ -536,6 +585,7 @@
 BISON := $(prebuilt_build_tools_bin_noasan)/bison
 YACC := $(BISON) -d
 BISON_DATA := $(wildcard $(BISON_PKGDATADIR)/* $(BISON_PKGDATADIR)/*/*)
+M4 :=$= $(prebuilt_build_tools_bin_noasan)/m4
 
 YASM := prebuilts/misc/$(BUILD_OS)-$(HOST_PREBUILT_ARCH)/yasm/yasm
 
@@ -551,7 +601,7 @@
 VTSC := $(HOST_OUT_EXECUTABLES)/vtsc$(HOST_EXECUTABLE_SUFFIX)
 MKBOOTFS := $(HOST_OUT_EXECUTABLES)/mkbootfs$(HOST_EXECUTABLE_SUFFIX)
 MINIGZIP := $(HOST_OUT_EXECUTABLES)/minigzip$(HOST_EXECUTABLE_SUFFIX)
-BROTLI := $(HOST_OUT_EXECUTABLES)/brotli$(HOST_EXECUTABLE_SUFFIX)
+LZ4 := $(HOST_OUT_EXECUTABLES)/lz4$(HOST_EXECUTABLE_SUFFIX)
 ifeq (,$(strip $(BOARD_CUSTOM_MKBOOTIMG)))
 MKBOOTIMG := $(HOST_OUT_EXECUTABLES)/mkbootimg$(HOST_EXECUTABLE_SUFFIX)
 else
@@ -569,44 +619,42 @@
 endif
 APICHECK := $(HOST_OUT_JAVA_LIBRARIES)/metalava$(COMMON_JAVA_PACKAGE_SUFFIX)
 FS_GET_STATS := $(HOST_OUT_EXECUTABLES)/fs_get_stats$(HOST_EXECUTABLE_SUFFIX)
-MAKE_EXT4FS := $(HOST_OUT_EXECUTABLES)/mke2fs$(HOST_EXECUTABLE_SUFFIX)
 MKEXTUSERIMG := $(HOST_OUT_EXECUTABLES)/mkuserimg_mke2fs
 MKE2FS_CONF := system/extras/ext4_utils/mke2fs.conf
-BLK_ALLOC_TO_BASE_FS := $(HOST_OUT_EXECUTABLES)/blk_alloc_to_base_fs$(HOST_EXECUTABLE_SUFFIX)
-MAKE_SQUASHFS := $(HOST_OUT_EXECUTABLES)/mksquashfs$(HOST_EXECUTABLE_SUFFIX)
 MKSQUASHFSUSERIMG := $(HOST_OUT_EXECUTABLES)/mksquashfsimage.sh
-MAKE_F2FS := $(HOST_OUT_EXECUTABLES)/make_f2fs$(HOST_EXECUTABLE_SUFFIX)
 MKF2FSUSERIMG := $(HOST_OUT_EXECUTABLES)/mkf2fsuserimg.sh
 SIMG2IMG := $(HOST_OUT_EXECUTABLES)/simg2img$(HOST_EXECUTABLE_SUFFIX)
-IMG2SIMG := $(HOST_OUT_EXECUTABLES)/img2simg$(HOST_EXECUTABLE_SUFFIX)
 E2FSCK := $(HOST_OUT_EXECUTABLES)/e2fsck$(HOST_EXECUTABLE_SUFFIX)
-MKTARBALL := build/make/tools/mktarball.sh
 TUNE2FS := $(HOST_OUT_EXECUTABLES)/tune2fs$(HOST_EXECUTABLE_SUFFIX)
 JARJAR := $(HOST_OUT_JAVA_LIBRARIES)/jarjar.jar
 DATA_BINDING_COMPILER := $(HOST_OUT_JAVA_LIBRARIES)/databinding-compiler.jar
 FAT16COPY := build/make/tools/fat16copy.py
-CHECK_LINK_TYPE := build/make/tools/check_link_type.py
 CHECK_ELF_FILE := build/make/tools/check_elf_file.py
 LPMAKE := $(HOST_OUT_EXECUTABLES)/lpmake$(HOST_EXECUTABLE_SUFFIX)
-BUILD_SUPER_IMAGE := build/make/tools/releasetools/build_super_image.py
+ADD_IMG_TO_TARGET_FILES := $(HOST_OUT_EXECUTABLES)/add_img_to_target_files$(HOST_EXECUTABLE_SUFFIX)
+BUILD_IMAGE := $(HOST_OUT_EXECUTABLES)/build_image$(HOST_EXECUTABLE_SUFFIX)
+BUILD_SUPER_IMAGE := $(HOST_OUT_EXECUTABLES)/build_super_image$(HOST_EXECUTABLE_SUFFIX)
+IMG_FROM_TARGET_FILES := $(HOST_OUT_EXECUTABLES)/img_from_target_files$(HOST_EXECUTABLE_SUFFIX)
+MAKE_RECOVERY_PATCH := $(HOST_OUT_EXECUTABLES)/make_recovery_patch$(HOST_EXECUTABLE_SUFFIX)
+OTA_FROM_TARGET_FILES := $(HOST_OUT_EXECUTABLES)/ota_from_target_files$(HOST_EXECUTABLE_SUFFIX)
+SPARSE_IMG := $(HOST_OUT_EXECUTABLES)/sparse_img$(HOST_EXECUTABLE_SUFFIX)
+CHECK_PARTITION_SIZES := $(HOST_OUT_EXECUTABLES)/check_partition_sizes$(HOST_EXECUTABLE_SUFFIX)
 
 PROGUARD_HOME := external/proguard
 PROGUARD := $(PROGUARD_HOME)/bin/proguard.sh
 PROGUARD_DEPS := $(PROGUARD) $(PROGUARD_HOME)/lib/proguard.jar
 JAVATAGS := build/make/tools/java-event-log-tags.py
 MERGETAGS := build/make/tools/merge-event-log-tags.py
-BUILD_IMAGE_SRCS := $(wildcard build/make/tools/releasetools/*.py)
 APPEND2SIMG := $(HOST_OUT_EXECUTABLES)/append2simg
 VERITY_SIGNER := $(HOST_OUT_EXECUTABLES)/verity_signer
-BUILD_VERITY_METADATA := $(HOST_OUT_EXECUTABLES)/build_verity_metadata.py
+BUILD_VERITY_METADATA := $(HOST_OUT_EXECUTABLES)/build_verity_metadata
 BUILD_VERITY_TREE := $(HOST_OUT_EXECUTABLES)/build_verity_tree
 BOOT_SIGNER := $(HOST_OUT_EXECUTABLES)/boot_signer
 FUTILITY := $(HOST_OUT_EXECUTABLES)/futility-host
-VBOOT_SIGNER := prebuilts/misc/scripts/vboot_signer/vboot_signer.sh
+VBOOT_SIGNER := $(HOST_OUT_EXECUTABLES)/vboot_signer
 FEC := $(HOST_OUT_EXECUTABLES)/fec
-BRILLO_UPDATE_PAYLOAD := $(HOST_OUT_EXECUTABLES)/brillo_update_payload
 
-DEXDUMP := $(HOST_OUT_EXECUTABLES)/dexdump2$(BUILD_EXECUTABLE_SUFFIX)
+DEXDUMP := $(HOST_OUT_EXECUTABLES)/dexdump$(BUILD_EXECUTABLE_SUFFIX)
 PROFMAN := $(HOST_OUT_EXECUTABLES)/profman
 
 FINDBUGS_DIR := external/owasp/sanitizer/tools/findbugs/bin
@@ -616,29 +664,12 @@
 
 EXTRACT_KERNEL := build/make/tools/extract_kernel.py
 
-USE_OPENJDK9 := true
-
-ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
-TARGET_OPENJDK9 :=
-else ifeq ($(EXPERIMENTAL_USE_OPENJDK9),1.8)
-TARGET_OPENJDK9 :=
-else ifeq ($(EXPERIMENTAL_USE_OPENJDK9),true)
-TARGET_OPENJDK9 := true
-endif
-
 # Path to tools.jar
 HOST_JDK_TOOLS_JAR := $(ANDROID_JAVA8_HOME)/lib/tools.jar
 
-# It's called md5 on Mac OS and md5sum on Linux
-ifeq ($(HOST_OS),darwin)
-MD5SUM:=md5 -q
-else
-MD5SUM:=md5sum
-endif
-
 APICHECK_COMMAND := $(JAVA) -Xmx4g -jar $(APICHECK) --no-banner --compatible-output=yes
 
-# Boolean variable determining if the whitelist for compatible properties is enabled
+# Boolean variable determining if the allow list for compatible properties is enabled
 PRODUCT_COMPATIBLE_PROPERTY := false
 ifneq ($(PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE),)
   PRODUCT_COMPATIBLE_PROPERTY := $(PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE)
@@ -712,19 +743,37 @@
   PRODUCT_USE_VNDK := $(PRODUCT_USE_VNDK_OVERRIDE)
 else ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
   # No shipping level defined
-else ifeq ($(call math_gt_or_eq,27,$(PRODUCT_SHIPPING_API_LEVEL)),)
+else ifeq ($(call math_gt,$(PRODUCT_SHIPPING_API_LEVEL),27),true)
   PRODUCT_USE_VNDK := $(PRODUCT_FULL_TREBLE)
 endif
 
+# Define PRODUCT_PRODUCT_VNDK_VERSION if PRODUCT_USE_VNDK is true and
+# PRODUCT_SHIPPING_API_LEVEL is greater than 29.
+PRODUCT_USE_PRODUCT_VNDK := false
 ifeq ($(PRODUCT_USE_VNDK),true)
+  ifneq ($(PRODUCT_USE_PRODUCT_VNDK_OVERRIDE),)
+    PRODUCT_USE_PRODUCT_VNDK := $(PRODUCT_USE_PRODUCT_VNDK_OVERRIDE)
+  else ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
+    # No shipping level defined
+  else ifeq ($(call math_gt,$(PRODUCT_SHIPPING_API_LEVEL),29),true)
+    PRODUCT_USE_PRODUCT_VNDK := true
+  endif
+
   ifndef BOARD_VNDK_VERSION
     BOARD_VNDK_VERSION := current
   endif
+
+  ifeq ($(PRODUCT_USE_PRODUCT_VNDK),true)
+    ifndef PRODUCT_PRODUCT_VNDK_VERSION
+      PRODUCT_PRODUCT_VNDK_VERSION := current
+    endif
+  endif
 endif
 
-$(KATI_obsolete_var PRODUCT_USE_VNDK_OVERRIDE,Use PRODUCT_USE_VNDK instead)
-.KATI_READONLY := \
-    PRODUCT_USE_VNDK
+$(KATI_obsolete_var PRODUCT_USE_VNDK,Use BOARD_VNDK_VERSION instead)
+$(KATI_obsolete_var PRODUCT_USE_VNDK_OVERRIDE,Use BOARD_VNDK_VERSION instead)
+$(KATI_obsolete_var PRODUCT_USE_PRODUCT_VNDK,Use PRODUCT_PRODUCT_VNDK_VERSION instead)
+$(KATI_obsolete_var PRODUCT_USE_PRODUCT_VNDK_OVERRIDE,Use PRODUCT_PRODUCT_VNDK_VERSION instead)
 
 # Set BOARD_SYSTEMSDK_VERSIONS to the latest SystemSDK version starting from P-launching
 # devices if unset.
@@ -763,11 +812,18 @@
 ifdef PRODUCT_DEFAULT_DEV_CERTIFICATE
   DEFAULT_SYSTEM_DEV_CERTIFICATE := $(PRODUCT_DEFAULT_DEV_CERTIFICATE)
 else
-  DEFAULT_SYSTEM_DEV_CERTIFICATE := build/target/product/security/testkey
+  DEFAULT_SYSTEM_DEV_CERTIFICATE := build/make/target/product/security/testkey
 endif
 .KATI_READONLY := DEFAULT_SYSTEM_DEV_CERTIFICATE
 
-BUILD_NUMBER_FROM_FILE := $$(cat $(OUT_DIR)/build_number.txt)
+# Certificate for the NetworkStack sepolicy context
+ifdef PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES
+  MAINLINE_SEPOLICY_DEV_CERTIFICATES := $(PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES)
+else
+  MAINLINE_SEPOLICY_DEV_CERTIFICATES := $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))
+endif
+
+BUILD_NUMBER_FROM_FILE := $$(cat $(SOONG_OUT_DIR)/build_number.txt)
 BUILD_DATETIME_FROM_FILE := $$(cat $(BUILD_DATETIME_FILE))
 
 # SEPolicy versions
@@ -782,7 +838,7 @@
 # is made which breaks compatibility with the previous platform sepolicy version,
 # not just on every increase in PLATFORM_SDK_VERSION.  The minor version should
 # be reset to 0 on every bump of the PLATFORM_SDK_VERSION.
-sepolicy_major_vers := 29
+sepolicy_major_vers := 30
 sepolicy_minor_vers := 0
 
 ifneq ($(sepolicy_major_vers), $(PLATFORM_SDK_VERSION))
@@ -803,6 +859,8 @@
     26.0 \
     27.0 \
     28.0 \
+    29.0 \
+    30.0 \
 
 .KATI_READONLY := \
     PLATFORM_SEPOLICY_COMPAT_VERSIONS \
@@ -868,10 +926,10 @@
 endif
 endif
 
-ifneq ($(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE),)
-ifneq ($(BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE),)
-$(error Should not define BOARD_PRODUCT_SERVICESIMAGE_PARTITION_SIZE and \
-    BOARD_PRODUCT_SERVICESIMAGE_PARTITION_RESERVED_SIZE together)
+ifneq ($(BOARD_SYSTEM_EXTIMAGE_PARTITION_SIZE),)
+ifneq ($(BOARD_SYSTEM_EXTIMAGE_PARTITION_RESERVED_SIZE),)
+$(error Should not define BOARD_SYSTEM_EXTIMAGE_PARTITION_SIZE and \
+    BOARD_SYSTEM_EXTIMAGE_PARTITION_RESERVED_SIZE together)
 endif
 endif
 
@@ -896,7 +954,7 @@
 )
 
 # BOARD_*_PARTITION_LIST: a list of the following tokens
-valid_super_partition_list := system vendor product product_services odm
+valid_super_partition_list := system vendor product system_ext odm
 $(foreach group,$(call to-upper,$(BOARD_SUPER_PARTITION_GROUPS)), \
     $(if $(filter-out $(valid_super_partition_list),$(BOARD_$(group)_PARTITION_LIST)), \
         $(error BOARD_$(group)_PARTITION_LIST contains invalid partition name \
@@ -1093,24 +1151,14 @@
 TARGET_AVAIALBLE_SDK_VERSIONS := $(call numerically_sort,$(TARGET_AVAILABLE_SDK_VERSIONS))
 
 TARGET_SDK_VERSIONS_WITHOUT_JAVA_18_SUPPORT := $(call numbers_less_than,24,$(TARGET_AVAILABLE_SDK_VERSIONS))
-TARGET_SDK_VERSIONS_WITHOUT_JAVA_19_SUPPORT := $(call numbers_less_than,27,$(TARGET_AVAILABLE_SDK_VERSIONS))
-
-ifndef INTERNAL_PLATFORM_PRIVATE_API_FILE
-INTERNAL_PLATFORM_PRIVATE_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/private.txt
-endif
-ifndef INTERNAL_PLATFORM_PRIVATE_DEX_API_FILE
-INTERNAL_PLATFORM_PRIVATE_DEX_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/private-dex.txt
-endif
-ifndef INTERNAL_PLATFORM_SYSTEM_PRIVATE_API_FILE
-INTERNAL_PLATFORM_SYSTEM_PRIVATE_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/system-private.txt
-endif
-ifndef INTERNAL_PLATFORM_SYSTEM_PRIVATE_DEX_API_FILE
-INTERNAL_PLATFORM_SYSTEM_PRIVATE_DEX_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/system-private-dex.txt
-endif
+TARGET_SDK_VERSIONS_WITHOUT_JAVA_19_SUPPORT := $(call numbers_less_than,30,$(TARGET_AVAILABLE_SDK_VERSIONS))
 
 # Missing optional uses-libraries so that the platform doesn't create build rules that depend on
-# them. See setup_one_odex.mk.
-INTERNAL_PLATFORM_MISSING_USES_LIBRARIES := com.google.android.ble com.google.android.wearable
+# them.
+INTERNAL_PLATFORM_MISSING_USES_LIBRARIES := \
+  com.google.android.ble \
+  com.google.android.media.effects \
+  com.google.android.wearable \
 
 # This is the standard way to name a directory containing prebuilt target
 # objects. E.g., prebuilt/$(TARGET_PREBUILT_TAG)/libc.so
@@ -1144,23 +1192,39 @@
     $(filter $(ANDROID_WARNING_ALLOWED_PROJECTS),$(1)/)
 endef
 
+GOMA_POOL :=
+RBE_POOL :=
+GOMA_OR_RBE_POOL :=
+# When goma or RBE are enabled, kati will be passed --default_pool=local_pool to put
+# most rules into the local pool.  Explicitly set the pool to "none" for rules that
+# should be run outside the local pool, i.e. with -j500.
+ifneq (,$(filter-out false,$(USE_GOMA)))
+  GOMA_POOL := none
+  GOMA_OR_RBE_POOL := none
+else ifneq (,$(filter-out false,$(USE_RBE)))
+  RBE_POOL := none
+  GOMA_OR_RBE_POOL := none
+endif
+.KATI_READONLY := GOMA_POOL RBE_POOL GOMA_OR_RBE_POOL
+
 # These goals don't need to collect and include Android.mks/CleanSpec.mks
 # in the source tree.
 dont_bother_goals := out \
     snod systemimage-nodeps \
-    stnod systemtarball-nodeps \
-    userdataimage-nodeps userdatatarball-nodeps \
+    userdataimage-nodeps \
     cacheimage-nodeps \
     bptimage-nodeps \
     vnod vendorimage-nodeps \
     pnod productimage-nodeps \
-    psnod productservicesimage-nodeps \
+    senod systemextimage-nodeps \
     onod odmimage-nodeps \
     systemotherimage-nodeps \
     ramdisk-nodeps \
     ramdisk_debug-nodeps \
+    ramdisk_test_harness-nodeps \
     bootimage-nodeps \
     bootimage_debug-nodeps \
+    bootimage_test_harness-nodeps \
     recoveryimage-nodeps \
     vbmetaimage-nodeps \
     product-graph dump-products
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index d3adee5..efb21e7 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -182,7 +182,9 @@
   my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)HWADDRESS_SANITIZER_RUNTIME_LIBRARY)
   ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
     ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
-      my_static_libraries := $(my_static_libraries) $($(LOCAL_2ND_ARCH_VAR_PREFIX)HWADDRESS_SANITIZER_STATIC_LIBRARY)
+      my_static_libraries := $(my_static_libraries) \
+                             $($(LOCAL_2ND_ARCH_VAR_PREFIX)HWADDRESS_SANITIZER_STATIC_LIBRARY) \
+                             libdl
     endif
   endif
 endif
@@ -235,12 +237,20 @@
   my_sanitize := $(CLANG_DEFAULT_UB_CHECKS)
 endif
 
-ifneq ($(filter coverage,$(my_sanitize)),)
-  ifeq ($(filter address,$(my_sanitize)),)
-    $(error $(LOCAL_PATH): $(LOCAL_MODULE): Use of 'coverage' also requires 'address')
-  endif
-  my_cflags += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
-  my_sanitize := $(filter-out coverage,$(my_sanitize))
+ifneq ($(filter fuzzer,$(my_sanitize)),)
+  # SANITIZE_TARGET='fuzzer' actually means to create the fuzzer coverage
+  # information, not to link against the fuzzer main().
+  my_sanitize := $(filter-out fuzzer,$(my_sanitize))
+  my_sanitize += fuzzer-no-link
+
+  # TODO(b/131771163): Disable LTO for fuzzer builds. Note that Cfi causes
+  # dependency on LTO.
+  my_sanitize := $(filter-out cfi,$(my_sanitize))
+  my_cflags += -fno-lto
+  my_ldflags += -fno-lto
+
+  # TODO(b/133876586): Disable experimental pass manager for fuzzer builds.
+  my_cflags += -fno-experimental-new-pass-manager
 endif
 
 ifneq ($(filter integer_overflow,$(my_sanitize)),)
@@ -280,7 +290,12 @@
   my_cflags += -fsanitize=$(fsanitize_arg)
   my_asflags += -fsanitize=$(fsanitize_arg)
 
-  ifdef LOCAL_IS_HOST_MODULE
+  # When fuzzing, we wish to crash with diagnostics on any bug.
+  ifneq ($(filter fuzzer-no-link,$(my_sanitize)),)
+    my_cflags += -fno-sanitize-trap=all
+    my_cflags += -fno-sanitize-recover=all
+    my_ldflags += -fsanitize=fuzzer-no-link
+  else ifdef LOCAL_IS_HOST_MODULE
     my_cflags += -fno-sanitize-recover=all
     my_ldflags += -fsanitize=$(fsanitize_arg)
   else
@@ -332,9 +347,6 @@
       my_shared_libraries := $($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_RUNTIME_LIBRARY) \
                              $(my_shared_libraries)
     endif
-    ifeq (,$(filter $(LOCAL_MODULE),$(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES)))
-      my_static_libraries += $(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES)
-    endif
 
     # Do not add unnecessary dependency in shared libraries.
     ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
@@ -378,7 +390,7 @@
   ifneq ($(filter unsigned-integer-overflow signed-integer-overflow integer,$(my_sanitize)),)
     ifeq ($(filter unsigned-integer-overflow signed-integer-overflow integer,$(my_sanitize_diag)),)
       ifeq ($(filter cfi,$(my_sanitize_diag)),)
-        ifeq ($(filter address hwaddress,$(my_sanitize)),)
+        ifeq ($(filter address hwaddress fuzzer-no-link,$(my_sanitize)),)
           my_cflags += -fsanitize-minimal-runtime
           my_cflags += -fno-sanitize-trap=integer
           my_cflags += -fno-sanitize-recover=integer
diff --git a/core/construct_context.sh b/core/construct_context.sh
index 399c15d..794795a 100755
--- a/core/construct_context.sh
+++ b/core/construct_context.sh
@@ -22,6 +22,11 @@
 # class_loader_context_arg: final class loader conext arg
 # stored_class_loader_context_arg: final stored class loader context arg
 
+if [ -z "${target_sdk_version}" ]; then
+    echo "ERROR: target_sdk_version not set"
+    exit 2
+fi
+
 # The hidl.manager shared library has a dependency on hidl.base. We'll manually
 # add that information to the class loader context if we see those libraries.
 hidl_manager="android.hidl.manager-V1.0-java"
diff --git a/core/copy_headers.mk b/core/copy_headers.mk
index c26d51d..054d271 100644
--- a/core/copy_headers.mk
+++ b/core/copy_headers.mk
@@ -4,15 +4,13 @@
 ###########################################################
 $(call record-module-type,COPY_HEADERS)
 ifneq ($(strip $(LOCAL_IS_HOST_MODULE)),)
-  $(shell echo $(LOCAL_MODULE_MAKEFILE): $(LOCAL_MODULE): LOCAL_COPY_HEADERS may not be used with host modules >&2)
-  $(error done)
+  $(call pretty-error,LOCAL_COPY_HEADERS may not be used with host modules)
 endif
 
 # Modules linking against the SDK do not have the include path to use
 # COPY_HEADERS, so prevent them from exporting any either.
 ifdef LOCAL_SDK_VERSION
-$(shell echo $(LOCAL_MODULE_MAKEFILE): $(LOCAL_MODULE): Modules using LOCAL_SDK_VERSION may not use LOCAL_COPY_HEADERS >&2)
-$(error done)
+  $(call pretty-error,Modules using LOCAL_SDK_VERSION may not use LOCAL_COPY_HEADERS)
 endif
 
 include $(BUILD_SYSTEM)/local_vndk.mk
@@ -22,11 +20,20 @@
 # present.
 ifdef BOARD_VNDK_VERSION
 ifndef LOCAL_USE_VNDK
-$(shell echo $(LOCAL_MODULE_MAKEFILE): $(LOCAL_MODULE): Only vendor modules using LOCAL_USE_VNDK may use LOCAL_COPY_HEADERS >&2)
-$(error done)
+  $(call pretty-error,Only vendor modules using LOCAL_USE_VNDK may use LOCAL_COPY_HEADERS)
 endif
 endif
 
+# Clean up LOCAL_COPY_HEADERS_TO, since soong_ui will be comparing cleaned
+# paths to figure out which headers are obsolete and should be removed.
+LOCAL_COPY_HEADERS_TO := $(call clean-path,$(LOCAL_COPY_HEADERS_TO))
+ifneq ($(filter /% .. ../%,$(LOCAL_COPY_HEADERS_TO)),)
+  $(call pretty-error,LOCAL_COPY_HEADERS_TO may not start with / or ../ : $(LOCAL_COPY_HEADERS_TO))
+endif
+ifeq ($(LOCAL_COPY_HEADERS_TO),.)
+  LOCAL_COPY_HEADERS_TO :=
+endif
+
 # Create a rule to copy each header, and make the
 # all_copied_headers phony target depend on each
 # destination header.  copy-one-header defines the
diff --git a/core/cxx_stl_setup.mk b/core/cxx_stl_setup.mk
index 7d3ca5c..a2abb1a 100644
--- a/core/cxx_stl_setup.mk
+++ b/core/cxx_stl_setup.mk
@@ -33,12 +33,6 @@
     endif
 endif
 
-# Yes, this is actually what the clang driver does.
-linux_dynamic_gcclibs := -lgcc_s -lgcc -lc -lgcc_s -lgcc
-linux_static_gcclibs := -Wl,--start-group -lgcc -lgcc_eh -lc -Wl,--end-group
-darwin_dynamic_gcclibs := -lc -lSystem
-darwin_static_gcclibs := NO_STATIC_HOST_BINARIES_ON_DARWIN
-
 my_link_type := dynamic
 ifdef LOCAL_IS_HOST_MODULE
     ifneq (,$(BUILD_HOST_static))
@@ -55,8 +49,6 @@
 
 my_cxx_ldlibs :=
 ifneq ($(filter $(my_cxx_stl),libc++ libc++_static),)
-    my_cflags += -D_USING_LIBCXX
-
     ifeq ($($(my_prefix)OS),darwin)
         # libc++'s headers are annotated with availability macros that indicate
         # which version of Mac OS was the first to ship with a libc++ feature
@@ -81,27 +73,36 @@
 
     ifdef LOCAL_IS_HOST_MODULE
         my_cppflags += -nostdinc++
-        my_ldflags += -nodefaultlibs
-        my_cxx_ldlibs += $($($(my_prefix)OS)_$(my_link_type)_gcclibs)
+        my_ldflags += -nostdlib++
     else
-        ifeq (arm,$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
-            my_static_libraries += libunwind_llvm
-            my_ldflags += -Wl,--exclude-libs,libunwind_llvm.a
-        endif
+        my_static_libraries += libc++demangle
 
         ifeq ($(my_link_type),static)
-            my_static_libraries += libm libc libdl
+            my_static_libraries += libm libc
+            ifeq (arm,$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
+                my_static_libraries += libunwind_llvm
+                my_ldflags += -Wl,--exclude-libs,libunwind_llvm.a
+            else
+                my_static_libraries += libgcc_stripped
+                my_ldflags += -Wl,--exclude-libs,libgcc_stripped.a
+            endif
         endif
     endif
 else ifeq ($(my_cxx_stl),ndk)
-    # Using an NDK STL. Handled in binary.mk.
+    # Using an NDK STL. Handled in binary.mk, except for the unwinder.
+    ifeq (arm,$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
+        my_static_libraries += libunwind_llvm
+        my_ldflags += -Wl,--exclude-libs,libunwind_llvm.a
+    else
+        my_static_libraries += libgcc_stripped
+        my_ldflags += -Wl,--exclude-libs,libgcc_stripped.a
+    endif
 else ifeq ($(my_cxx_stl),libstdc++)
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): libstdc++ is not supported)
 else ifeq ($(my_cxx_stl),none)
     ifdef LOCAL_IS_HOST_MODULE
         my_cppflags += -nostdinc++
-        my_ldflags += -nodefaultlibs
-        my_cxx_ldlibs += $($($(my_prefix)OS)_$(my_link_type)_gcclibs)
+        my_ldflags += -nostdlib++
     endif
 else
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): $(my_cxx_stl) is not a supported STL.)
diff --git a/core/definitions.mk b/core/definitions.mk
index 2c9bb0e..89c2e27 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -108,6 +108,21 @@
 # All tests that should be skipped in presubmit check.
 ALL_DISABLED_PRESUBMIT_TESTS :=
 
+# All compatibility suites mentioned in LOCAL_COMPATIBILITY_SUITES
+ALL_COMPATIBILITY_SUITES :=
+
+# All LINK_TYPE entries
+ALL_LINK_TYPES :=
+
+# All exported/imported include entries
+EXPORTS_LIST :=
+
+# All modules already converted to Soong
+SOONG_ALREADY_CONV :=
+
+# ALL_DEPS.*.ALL_DEPS keys
+ALL_DEPS.MODULES :=
+
 ###########################################################
 ## Debugging; prints a variable list to stdout
 ###########################################################
@@ -364,7 +379,7 @@
 ###########################################################
 
 define all-renderscript-files-under
-$(call find-subdir-files,$(1) \( -name "*.rs" -or -name "*.fs" \) -and -not -name ".*")
+$(call find-subdir-files,$(1) \( -name "*.rscript" -or -name "*.fs" \) -and -not -name ".*")
 endef
 
 ###########################################################
@@ -425,8 +440,8 @@
 
 define find-subdir-assets
 $(sort $(if $(1),$(patsubst ./%,%, \
-	$(shell if [ -d $(1) ] ; then cd $(1) ; find -L ./ -not -name '.*' -and -type f ; fi)), \
-	$(warning Empty argument supplied to find-subdir-assets in $(LOCAL_PATH)) \
+  $(shell if [ -d $(1) ] ; then cd $(1) ; find -L ./ -not -name '.*' -and -type f ; fi)), \
+  $(warning Empty argument supplied to find-subdir-assets in $(LOCAL_PATH)) \
 ))
 endef
 
@@ -553,7 +568,7 @@
         $(error $(LOCAL_PATH): Name not defined in call to intermediates-dir-for)) \
     $(eval _idfPrefix := $(call find-idf-prefix,$(3),$(6))) \
     $(eval _idf2ndArchPrefix := $(if $(strip $(5)),$(TARGET_2ND_ARCH_VAR_PREFIX))) \
-    $(if $(filter $(_idfPrefix)-$(_idfClass),$(COMMON_MODULE_CLASSES))$(4), \
+    $(if $(filter $(_idfPrefix)_$(_idfClass),$(COMMON_MODULE_CLASSES))$(4), \
         $(eval _idfIntBase := $($(_idfPrefix)_OUT_COMMON_INTERMEDIATES)) \
       ,$(if $(filter $(_idfClass),$(PER_ARCH_MODULE_CLASSES)),\
           $(eval _idfIntBase := $($(_idf2ndArchPrefix)$(_idfPrefix)_OUT_INTERMEDIATES)) \
@@ -602,7 +617,7 @@
     $(if $(_idfName),, \
         $(error $(LOCAL_PATH): Name not defined in call to generated-sources-dir-for)) \
     $(eval _idfPrefix := $(call find-idf-prefix,$(3),)) \
-    $(if $(filter $(_idfPrefix)-$(_idfClass),$(COMMON_MODULE_CLASSES))$(4), \
+    $(if $(filter $(_idfPrefix)_$(_idfClass),$(COMMON_MODULE_CLASSES))$(4), \
         $(eval _idfIntBase := $($(_idfPrefix)_OUT_COMMON_GEN)) \
       , \
         $(eval _idfIntBase := $($(_idfPrefix)_OUT_GEN)) \
@@ -782,8 +797,8 @@
 #TODO(jbq): as of 20100106 nobody uses the second parameter
 define get-tagged-modules
 $(filter-out \
-	$(call modules-for-tag-list,$(2)), \
-	    $(call modules-for-tag-list,$(1)))
+  $(call modules-for-tag-list,$(2)), \
+    $(call modules-for-tag-list,$(1)))
 endef
 
 ###########################################################
@@ -886,7 +901,7 @@
 define transform-l-to-c-or-cpp
 @echo "Lex: $(PRIVATE_MODULE) <= $<"
 @mkdir -p $(dir $@)
-$(hide) $(LEX) -o$@ $<
+M4=$(M4) $(LEX) -o$@ $<
 endef
 
 ###########################################################
@@ -897,7 +912,7 @@
 define transform-y-to-c-or-cpp
 @echo "Yacc: $(PRIVATE_MODULE) <= $<"
 @mkdir -p $(dir $@)
-$(YACC) $(PRIVATE_YACCFLAGS) \
+M4=$(M4) $(YACC) $(PRIVATE_YACCFLAGS) \
   --defines=$(basename $@).h \
   -o $@ $<
 endef
@@ -950,16 +965,16 @@
 @echo "Renderscript compatibility: $(notdir $@) <= $(notdir $<)"
 $(hide) mkdir -p $(dir $@)
 $(hide) $(BCC_COMPAT) -O3 -o $(dir $@)/$(notdir $(<:.bc=.o)) -fPIC -shared \
-	-rt-path $(RS_PREBUILT_CLCORE) -mtriple $(RS_COMPAT_TRIPLE) $<
+  -rt-path $(RS_PREBUILT_CLCORE) -mtriple $(RS_COMPAT_TRIPLE) $<
 $(hide) $(PRIVATE_CXX_LINK) -shared -Wl,-soname,$(notdir $@) -nostdlib \
-	-Wl,-rpath,\$$ORIGIN/../lib \
-	$(dir $@)/$(notdir $(<:.bc=.o)) \
-	$(RS_PREBUILT_COMPILER_RT) \
-	-o $@ $(CLANG_TARGET_GLOBAL_LDFLAGS) -Wl,--hash-style=sysv \
-	-L $(SOONG_OUT_DIR)/ndk/platforms/android-$(PRIVATE_SDK_VERSION)/arch-$(TARGET_ARCH)/usr/lib64 \
-	-L $(SOONG_OUT_DIR)/ndk/platforms/android-$(PRIVATE_SDK_VERSION)/arch-$(TARGET_ARCH)/usr/lib \
-	$(call intermediates-dir-for,SHARED_LIBRARIES,libRSSupport)/libRSSupport.so \
-	-lm -lc
+  -Wl,-rpath,\$$ORIGIN/../lib \
+  $(dir $@)/$(notdir $(<:.bc=.o)) \
+  $(RS_PREBUILT_COMPILER_RT) \
+  -o $@ $(CLANG_TARGET_GLOBAL_LDFLAGS) -Wl,--hash-style=sysv \
+  -L $(SOONG_OUT_DIR)/ndk/platforms/android-$(PRIVATE_SDK_VERSION)/arch-$(TARGET_ARCH)/usr/lib64 \
+  -L $(SOONG_OUT_DIR)/ndk/platforms/android-$(PRIVATE_SDK_VERSION)/arch-$(TARGET_ARCH)/usr/lib \
+  $(call intermediates-dir-for,SHARED_LIBRARIES,libRSSupport)/libRSSupport.so \
+  -lm -lc
 endef
 
 ###########################################################
@@ -1012,7 +1027,7 @@
 # You must call this with $(eval).
 define define-aidl-java-rule
 define-aidl-java-rule-src := $(patsubst %.aidl,%.java,$(subst ../,dotdot/,$(addprefix $(2)/,$(1))))
-$$(define-aidl-java-rule-src) : $(LOCAL_PATH)/$(1) $(AIDL)
+$$(define-aidl-java-rule-src) : $(call clean-path,$(LOCAL_PATH)/$(1)) $(AIDL)
 	$$(transform-aidl-to-java)
 $(3) += $$(define-aidl-java-rule-src)
 endef
@@ -1025,7 +1040,7 @@
 # You must call this with $(eval).
 define define-aidl-cpp-rule
 define-aidl-cpp-rule-src := $(patsubst %.aidl,%$(LOCAL_CPP_EXTENSION),$(subst ../,dotdot/,$(addprefix $(2)/,$(1))))
-$$(define-aidl-cpp-rule-src) : $(LOCAL_PATH)/$(1) $(AIDL_CPP)
+$$(define-aidl-cpp-rule-src) : $(call clean-path,$(LOCAL_PATH)/$(1)) $(AIDL_CPP)
 	$$(transform-aidl-to-cpp)
 $(3) += $$(define-aidl-cpp-rule-src)
 endef
@@ -1082,7 +1097,7 @@
         $(PRIVATE_PROTOC_FLAGS) \
         $$f || exit 33; \
         done
-$(hide) touch $@
+$(SOONG_ZIP) -o $@ -C $(PRIVATE_PROTO_JAVA_OUTPUT_DIR) -D $(PRIVATE_PROTO_JAVA_OUTPUT_DIR)
 endef
 
 ######################################################################
@@ -1093,10 +1108,10 @@
 @echo "Protoc: $@ <= $<"
 @mkdir -p $(dir $@)
 $(hide) \
-	$(PROTOC) \
-	$(addprefix --proto_path=, $(PRIVATE_PROTO_INCLUDES)) \
-	$(PRIVATE_PROTOC_FLAGS) \
-	$<
+  $(PROTOC) \
+  $(addprefix --proto_path=, $(PRIVATE_PROTO_INCLUDES)) \
+  $(PRIVATE_PROTOC_FLAGS) \
+  $<
 @# aprotoc outputs only .cc. Rename it to .cpp if necessary.
 $(if $(PRIVATE_RENAME_CPP_EXT),\
   $(hide) mv $(basename $@).cc $@)
@@ -1107,7 +1122,7 @@
 ###########################################################
 define c-includes
 $(addprefix -I , $(PRIVATE_C_INCLUDES)) \
-$$(cat $(PRIVATE_IMPORT_INCLUDES))\
+$(foreach i,$(PRIVATE_IMPORTED_INCLUDES),$(EXPORTS.$(i)))\
 $(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),,\
     $(addprefix -I ,\
         $(filter-out $(PRIVATE_C_INCLUDES), \
@@ -1122,25 +1137,24 @@
 ###########################################################
 
 define transform-cpp-to-o-compiler-args
-	$(c-includes) \
-	-c \
-	$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
-	    $(PRIVATE_TARGET_GLOBAL_CFLAGS) \
-	    $(PRIVATE_TARGET_GLOBAL_CPPFLAGS) \
-	    $(PRIVATE_ARM_CFLAGS) \
-	 ) \
-	$(PRIVATE_RTTI_FLAG) \
-	$(PRIVATE_CFLAGS) \
-	$(PRIVATE_CPPFLAGS) \
-	$(PRIVATE_DEBUG_CFLAGS) \
-	$(PRIVATE_CFLAGS_NO_OVERRIDE) \
-	$(PRIVATE_CPPFLAGS_NO_OVERRIDE)
+$(c-includes) \
+-c \
+$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
+    $(PRIVATE_TARGET_GLOBAL_CFLAGS) \
+    $(PRIVATE_TARGET_GLOBAL_CPPFLAGS) \
+    $(PRIVATE_ARM_CFLAGS) \
+ ) \
+$(PRIVATE_RTTI_FLAG) \
+$(PRIVATE_CFLAGS) \
+$(PRIVATE_CPPFLAGS) \
+$(PRIVATE_DEBUG_CFLAGS) \
+$(PRIVATE_CFLAGS_NO_OVERRIDE) \
+$(PRIVATE_CPPFLAGS_NO_OVERRIDE)
 endef
 
-# PATH_TO_CLANG_TIDY_SHELL is defined in build/soong
+# PATH_TO_CLANG_TIDY is defined in build/soong
 define call-clang-tidy
-CLANG_TIDY=$(PATH_TO_CLANG_TIDY) \
-  $(PATH_TO_CLANG_TIDY_SHELL) \
+$(PATH_TO_CLANG_TIDY) \
   $(PRIVATE_TIDY_FLAGS) \
   -checks=$(PRIVATE_TIDY_CHECKS)
 endef
@@ -1173,14 +1187,14 @@
 
 # $(1): extra flags
 define transform-c-or-s-to-o-compiler-args
-	$(c-includes) \
-	-c \
-	$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
-	    $(PRIVATE_TARGET_GLOBAL_CFLAGS) \
-	    $(PRIVATE_TARGET_GLOBAL_CONLYFLAGS) \
-	    $(PRIVATE_ARM_CFLAGS) \
-	 ) \
-	 $(1)
+$(c-includes) \
+-c \
+$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
+    $(PRIVATE_TARGET_GLOBAL_CFLAGS) \
+    $(PRIVATE_TARGET_GLOBAL_CONLYFLAGS) \
+    $(PRIVATE_ARM_CFLAGS) \
+ ) \
+ $(1)
 endef
 
 define transform-c-to-o-compiler-args
@@ -1246,17 +1260,17 @@
 ###########################################################
 
 define transform-host-cpp-to-o-compiler-args
-	$(c-includes) \
-	-c \
-	$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
-	    $(PRIVATE_HOST_GLOBAL_CFLAGS) \
-	    $(PRIVATE_HOST_GLOBAL_CPPFLAGS) \
-	 ) \
-	$(PRIVATE_CFLAGS) \
-	$(PRIVATE_CPPFLAGS) \
-	$(PRIVATE_DEBUG_CFLAGS) \
-	$(PRIVATE_CFLAGS_NO_OVERRIDE) \
-	$(PRIVATE_CPPFLAGS_NO_OVERRIDE)
+$(c-includes) \
+-c \
+$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
+    $(PRIVATE_HOST_GLOBAL_CFLAGS) \
+    $(PRIVATE_HOST_GLOBAL_CPPFLAGS) \
+ ) \
+$(PRIVATE_CFLAGS) \
+$(PRIVATE_CPPFLAGS) \
+$(PRIVATE_DEBUG_CFLAGS) \
+$(PRIVATE_CFLAGS_NO_OVERRIDE) \
+$(PRIVATE_CPPFLAGS_NO_OVERRIDE)
 endef
 
 define clang-tidy-host-cpp
@@ -1286,12 +1300,12 @@
 ###########################################################
 
 define transform-host-c-or-s-to-o-common-args
-	$(c-includes) \
-	-c \
-	$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
-	    $(PRIVATE_HOST_GLOBAL_CFLAGS) \
-	    $(PRIVATE_HOST_GLOBAL_CONLYFLAGS) \
-	 )
+$(c-includes) \
+-c \
+$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
+    $(PRIVATE_HOST_GLOBAL_CFLAGS) \
+    $(PRIVATE_HOST_GLOBAL_CONLYFLAGS) \
+ )
 endef
 
 # $(1): extra flags
@@ -1364,9 +1378,11 @@
 # $(1): the C++ source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-cpp-file
 o := $(intermediates)/$(patsubst %$(LOCAL_CPP_EXTENSION),%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
-$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2)
+$$(o) : .KATI_NINJA_POOL := $(4)
+$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG_CXX)
 	$$(transform-$$(PRIVATE_HOST)cpp-to-o)
 $$(call include-depfiles-for-objs, $$(o))
 $(3) += $$(o)
@@ -1377,9 +1393,11 @@
 # $(1): the C source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-c-file
 o := $(intermediates)/$(patsubst %.c,%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
-$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2)
+$$(o) : .KATI_NINJA_POOL := $(4)
+$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG)
 	$$(transform-$$(PRIVATE_HOST)c-to-o)
 $$(call include-depfiles-for-objs, $$(o))
 $(3) += $$(o)
@@ -1390,9 +1408,11 @@
 # $(1): the .S source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-s-file
 o := $(intermediates)/$(patsubst %.S,%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
-$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2)
+$$(o) : .KATI_NINJA_POOL := $(4)
+$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG)
 	$$(transform-$$(PRIVATE_HOST)s-to-o)
 $$(call include-depfiles-for-objs, $$(o))
 $(3) += $$(o)
@@ -1403,9 +1423,11 @@
 # $(1): the .s source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-s-file-no-deps
 o := $(intermediates)/$(patsubst %.s,%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
-$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2)
+$$(o) : .KATI_NINJA_POOL := $(4)
+$$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG)
 	$$(transform-$$(PRIVATE_HOST)s-to-o)
 $(3) += $$(o)
 endef
@@ -1535,15 +1557,15 @@
 
 define transform-o-to-aux-executable-inner
 $(hide) $(PRIVATE_CXX_LINK) -pie \
-	-Bdynamic \
-	-Wl,--gc-sections \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(PRIVATE_ALL_STATIC_LIBRARIES) \
-	$(PRIVATE_LDFLAGS) \
-	-o $@
+  -Bdynamic \
+  -Wl,--gc-sections \
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(PRIVATE_ALL_STATIC_LIBRARIES) \
+  $(PRIVATE_LDFLAGS) \
+  -o $@
 endef
 
 define transform-o-to-aux-executable
@@ -1554,16 +1576,16 @@
 
 define transform-o-to-aux-static-executable-inner
 $(hide) $(PRIVATE_CXX_LINK) \
-	-Bstatic \
-	-Wl,--gc-sections \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(PRIVATE_ALL_STATIC_LIBRARIES) \
-	$(PRIVATE_LDFLAGS) \
-	-Wl,-Map=$(@).map \
-	-o $@
+  -Bstatic \
+  -Wl,--gc-sections \
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(PRIVATE_ALL_STATIC_LIBRARIES) \
+  $(PRIVATE_LDFLAGS) \
+  -Wl,-Map=$(@).map \
+  -o $@
 endef
 
 define transform-o-to-aux-static-executable
@@ -1655,25 +1677,25 @@
 ifneq ($(HOST_CUSTOM_LD_COMMAND),true)
 define transform-host-o-to-shared-lib-inner
 $(hide) $(PRIVATE_CXX_LINK) \
-	-Wl,-rpath,\$$ORIGIN/../$(notdir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)OUT_SHARED_LIBRARIES)) \
-	-Wl,-rpath,\$$ORIGIN/$(notdir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)OUT_SHARED_LIBRARIES)) \
-	-shared -Wl,-soname,$(notdir $@) \
-	$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
-	   $(PRIVATE_HOST_GLOBAL_LDFLAGS) \
-	) \
-	$(PRIVATE_LDFLAGS) \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
-	$(PRIVATE_ALL_STATIC_LIBRARIES) \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),-lgcov) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_HOST_LIBPROFILE_RT)) \
-	$(PRIVATE_ALL_SHARED_LIBRARIES) \
-	-o $@ \
-	$(PRIVATE_LDLIBS)
+  -Wl,-rpath,\$$ORIGIN/../$(notdir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)OUT_SHARED_LIBRARIES)) \
+  -Wl,-rpath,\$$ORIGIN/$(notdir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)OUT_SHARED_LIBRARIES)) \
+  -shared -Wl,-soname,$(notdir $@) \
+  $(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
+     $(PRIVATE_HOST_GLOBAL_LDFLAGS) \
+  ) \
+  $(PRIVATE_LDFLAGS) \
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
+  $(PRIVATE_ALL_STATIC_LIBRARIES) \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),-lgcov) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_HOST_LIBPROFILE_RT)) \
+  $(PRIVATE_ALL_SHARED_LIBRARIES) \
+  -o $@ \
+  $(PRIVATE_LDLIBS)
 endef
 endif
 
@@ -1696,27 +1718,26 @@
 
 define transform-o-to-shared-lib-inner
 $(hide) $(PRIVATE_CXX_LINK) \
-	-nostdlib -Wl,-soname,$(notdir $@) \
-	-Wl,--gc-sections \
-	-shared \
-	$(PRIVATE_TARGET_CRTBEGIN_SO_O) \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
-	$(PRIVATE_ALL_STATIC_LIBRARIES) \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
-	$(PRIVATE_TARGET_LIBCRT_BUILTINS) \
-	$(PRIVATE_TARGET_LIBATOMIC) \
-	$(PRIVATE_TARGET_LIBGCC) \
-	$(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
-	$(PRIVATE_LDFLAGS) \
-	$(PRIVATE_ALL_SHARED_LIBRARIES) \
-	-o $@ \
-	$(PRIVATE_TARGET_CRTEND_SO_O) \
-	$(PRIVATE_LDLIBS)
+  -nostdlib -Wl,-soname,$(notdir $@) \
+  -Wl,--gc-sections \
+  -shared \
+  $(PRIVATE_TARGET_CRTBEGIN_SO_O) \
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
+  $(PRIVATE_ALL_STATIC_LIBRARIES) \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
+  $(PRIVATE_TARGET_LIBCRT_BUILTINS) \
+  $(PRIVATE_TARGET_LIBATOMIC) \
+  $(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
+  $(PRIVATE_LDFLAGS) \
+  $(PRIVATE_ALL_SHARED_LIBRARIES) \
+  -o $@ \
+  $(PRIVATE_TARGET_CRTEND_SO_O) \
+  $(PRIVATE_LDLIBS)
 endef
 
 define transform-o-to-shared-lib
@@ -1731,28 +1752,27 @@
 
 define transform-o-to-executable-inner
 $(hide) $(PRIVATE_CXX_LINK) -pie \
-	-nostdlib -Bdynamic \
-	-Wl,-dynamic-linker,$(PRIVATE_LINKER) \
-	-Wl,--gc-sections \
-	-Wl,-z,nocopyreloc \
-	$(PRIVATE_TARGET_CRTBEGIN_DYNAMIC_O) \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
-	$(PRIVATE_ALL_STATIC_LIBRARIES) \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
-	$(PRIVATE_TARGET_LIBCRT_BUILTINS) \
-	$(PRIVATE_TARGET_LIBATOMIC) \
-	$(PRIVATE_TARGET_LIBGCC) \
-	$(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
-	$(PRIVATE_LDFLAGS) \
-	$(PRIVATE_ALL_SHARED_LIBRARIES) \
-	-o $@ \
-	$(PRIVATE_TARGET_CRTEND_O) \
-	$(PRIVATE_LDLIBS)
+  -nostdlib -Bdynamic \
+  -Wl,-dynamic-linker,$(PRIVATE_LINKER) \
+  -Wl,--gc-sections \
+  -Wl,-z,nocopyreloc \
+  $(PRIVATE_TARGET_CRTBEGIN_DYNAMIC_O) \
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
+  $(PRIVATE_ALL_STATIC_LIBRARIES) \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
+  $(PRIVATE_TARGET_LIBCRT_BUILTINS) \
+  $(PRIVATE_TARGET_LIBATOMIC) \
+  $(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
+  $(PRIVATE_LDFLAGS) \
+  $(PRIVATE_ALL_SHARED_LIBRARIES) \
+  -o $@ \
+  $(PRIVATE_TARGET_CRTEND_O) \
+  $(PRIVATE_LDLIBS)
 endef
 
 define transform-o-to-executable
@@ -1774,28 +1794,27 @@
 
 define transform-o-to-static-executable-inner
 $(hide) $(PRIVATE_CXX_LINK) \
-	-nostdlib -Bstatic \
-	$(if $(filter $(PRIVATE_LDFLAGS),-shared),,-static) \
-	-Wl,--gc-sections \
-	-o $@ \
-	$(PRIVATE_TARGET_CRTBEGIN_STATIC_O) \
-	$(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
-	$(PRIVATE_LDFLAGS) \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(filter-out %libcompiler_rt.hwasan.a %libc_nomalloc.hwasan.a %libc.hwasan.a %libcompiler_rt.a %libc_nomalloc.a %libc.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
-	-Wl,--start-group \
-	$(filter %libc.a %libc.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
-	$(filter %libc_nomalloc.a %libc_nomalloc.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
-	$(PRIVATE_TARGET_LIBATOMIC) \
-	$(filter %libcompiler_rt.a %libcompiler_rt.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
-	$(PRIVATE_TARGET_LIBCRT_BUILTINS) \
-	$(PRIVATE_TARGET_LIBGCC) \
-	-Wl,--end-group \
-	$(PRIVATE_TARGET_CRTEND_O)
+  -nostdlib -Bstatic \
+  $(if $(filter $(PRIVATE_LDFLAGS),-shared),,-static) \
+  -Wl,--gc-sections \
+  -o $@ \
+  $(PRIVATE_TARGET_CRTBEGIN_STATIC_O) \
+  $(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
+  $(PRIVATE_LDFLAGS) \
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(filter-out %libcompiler_rt.hwasan.a %libc_nomalloc.hwasan.a %libc.hwasan.a %libcompiler_rt.a %libc_nomalloc.a %libc.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
+  -Wl,--start-group \
+  $(filter %libc.a %libc.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
+  $(filter %libc_nomalloc.a %libc_nomalloc.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
+  $(PRIVATE_TARGET_LIBATOMIC) \
+  $(filter %libcompiler_rt.a %libcompiler_rt.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
+  $(PRIVATE_TARGET_LIBCRT_BUILTINS) \
+  -Wl,--end-group \
+  $(PRIVATE_TARGET_CRTEND_O)
 endef
 
 define transform-o-to-static-executable
@@ -1812,24 +1831,24 @@
 ifneq ($(HOST_CUSTOM_LD_COMMAND),true)
 define transform-host-o-to-executable-inner
 $(hide) $(PRIVATE_CXX_LINK) \
-	$(PRIVATE_ALL_OBJECTS) \
-	-Wl,--whole-archive \
-	$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-	-Wl,--no-whole-archive \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
-	$(PRIVATE_ALL_STATIC_LIBRARIES) \
-	$(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),-lgcov) \
-	$(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_HOST_LIBPROFILE_RT)) \
-	$(PRIVATE_ALL_SHARED_LIBRARIES) \
-	$(foreach path,$(PRIVATE_RPATHS), \
-	  -Wl,-rpath,\$$ORIGIN/$(path)) \
-	$(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
-		$(PRIVATE_HOST_GLOBAL_LDFLAGS) \
-	) \
-	$(PRIVATE_LDFLAGS) \
-	-o $@ \
-	$(PRIVATE_LDLIBS)
+  $(PRIVATE_ALL_OBJECTS) \
+  -Wl,--whole-archive \
+  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
+  -Wl,--no-whole-archive \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--start-group) \
+  $(PRIVATE_ALL_STATIC_LIBRARIES) \
+  $(if $(PRIVATE_GROUP_STATIC_LIBRARIES),-Wl$(comma)--end-group) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),-lgcov) \
+  $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_HOST_LIBPROFILE_RT)) \
+  $(PRIVATE_ALL_SHARED_LIBRARIES) \
+  $(foreach path,$(PRIVATE_RPATHS), \
+    -Wl,-rpath,\$$ORIGIN/$(path)) \
+  $(if $(PRIVATE_NO_DEFAULT_COMPILER_FLAGS),, \
+      $(PRIVATE_HOST_GLOBAL_LDFLAGS) \
+  ) \
+  $(PRIVATE_LDFLAGS) \
+  -o $@ \
+  $(PRIVATE_LDLIBS)
 endef
 endif
 
@@ -1857,42 +1876,6 @@
 # b/37750224
 AAPT_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
 
-# TODO: Right now we generate the asset resources twice, first as part
-# of generating the Java classes, then at the end when packaging the final
-# assets.  This should be changed to do one of two things: (1) Don't generate
-# any resource files the first time, only create classes during that stage;
-# or (2) Don't use the -c flag with the second stage, instead taking the
-# resource files from the first stage as additional input.  My original intent
-# was to use approach (2), but this requires a little more work in the tool.
-# Maybe we should just use approach (1).
-
-# This rule creates the R.java and Manifest.java files, both of which
-# are PRODUCT-neutral.  Don't pass PRIVATE_PRODUCT_AAPT_CONFIG to this invocation.
-define create-resource-java-files
-@mkdir -p $(dir $(PRIVATE_RESOURCE_PUBLICS_OUTPUT))
-rm -rf $(PRIVATE_JAVA_GEN_DIR)
-mkdir -p $(PRIVATE_JAVA_GEN_DIR)
-$(hide) $(AAPT_ASAN_OPTIONS) $(AAPT) package $(PRIVATE_AAPT_FLAGS) -m \
-    $(eval # PRIVATE_PRODUCT_AAPT_CONFIG is intentionally missing-- see comment.) \
-    $(addprefix -J , $(PRIVATE_JAVA_GEN_DIR)) \
-    $(addprefix -M , $(PRIVATE_ANDROID_MANIFEST)) \
-    $(addprefix -P , $(PRIVATE_RESOURCE_PUBLICS_OUTPUT)) \
-    $(addprefix -S , $(PRIVATE_RESOURCE_DIR)) \
-    $(addprefix -A , $(PRIVATE_ASSET_DIR)) \
-    $(addprefix -I , $(PRIVATE_AAPT_INCLUDES)) \
-    $(addprefix -G , $(PRIVATE_PROGUARD_OPTIONS_FILE)) \
-    $(addprefix --min-sdk-version , $(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
-    $(addprefix --target-sdk-version , $(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
-    $(if $(filter --version-code,$(PRIVATE_AAPT_FLAGS)),,--version-code $(PLATFORM_SDK_VERSION)) \
-    $(if $(filter --version-name,$(PRIVATE_AAPT_FLAGS)),,--version-name $(APPS_DEFAULT_VERSION_NAME)) \
-    $(addprefix --rename-manifest-package , $(PRIVATE_MANIFEST_PACKAGE_NAME)) \
-    $(addprefix --rename-instrumentation-target-package , $(PRIVATE_MANIFEST_INSTRUMENTATION_FOR)) \
-    --skip-symbols-without-default-localization
-$(SOONG_ZIP) -o $(PRIVATE_SRCJAR) -C $(PRIVATE_JAVA_GEN_DIR) -D $(PRIVATE_JAVA_GEN_DIR)
-# So that we re-run aapt when the list of input files change
-$(hide) echo $(PRIVATE_RESOURCE_LIST) >/dev/null
-endef
-
 # Search for generated R.java/Manifest.java in $1, copy the found R.java as $2.
 # Also copy them to a central 'R' directory to make it easier to add the files to an IDE.
 define find-generated-R.java
@@ -1900,15 +1883,15 @@
   -name Manifest.java 2> /dev/null`; do \
     dir=`awk '/package/{gsub(/\./,"/",$$2);gsub(/;/,"",$$2);print $$2;exit}' $$GENERATED_MANIFEST_FILE`; \
     mkdir -p $(TARGET_COMMON_OUT_ROOT)/R/$$dir; \
-    $(ACP) -fp $$GENERATED_MANIFEST_FILE $(TARGET_COMMON_OUT_ROOT)/R/$$dir; \
+    cp $$GENERATED_MANIFEST_FILE $(TARGET_COMMON_OUT_ROOT)/R/$$dir; \
   done;
 $(hide) for GENERATED_R_FILE in `find $(1) \
   -name R.java 2> /dev/null`; do \
     dir=`awk '/package/{gsub(/\./,"/",$$2);gsub(/;/,"",$$2);print $$2;exit}' $$GENERATED_R_FILE`; \
     mkdir -p $(TARGET_COMMON_OUT_ROOT)/R/$$dir; \
-    $(ACP) -fp $$GENERATED_R_FILE $(TARGET_COMMON_OUT_ROOT)/R/$$dir \
+    cp $$GENERATED_R_FILE $(TARGET_COMMON_OUT_ROOT)/R/$$dir \
       || exit 31; \
-    $(ACP) -fp $$GENERATED_R_FILE $(2) || exit 32; \
+    cp $$GENERATED_R_FILE $(2) || exit 32; \
   done;
 @# Ensure that the target file is always created, i.e. also in case we did not
 @# enter the GENERATED_R_FILE-loop above. This avoids unnecessary rebuilding.
@@ -1920,20 +1903,20 @@
 ###########################################################
 define aapt2-compile-one-resource-file
 @mkdir -p $(dir $@)
-$(hide) $(AAPT2) compile -o $(dir $@) $(PRIVATE_AAPT2_CFLAGS) --legacy $<
+$(hide) $(AAPT2) compile -o $(dir $@) $(PRIVATE_AAPT2_CFLAGS) $<
 endef
 
 define aapt2-compile-resource-dirs
 @mkdir -p $(dir $@)
 $(hide) $(AAPT2) compile -o $@ $(addprefix --dir ,$(PRIVATE_SOURCE_RES_DIRS)) \
-  $(PRIVATE_AAPT2_CFLAGS) --legacy
+  $(PRIVATE_AAPT2_CFLAGS)
 endef
 
 # TODO(b/74574557): use aapt2 compile --zip if it gets implemented
 define aapt2-compile-resource-zips
 @mkdir -p $(dir $@)
 $(ZIPSYNC) -d $@.contents -l $@.list $(PRIVATE_SOURCE_RES_ZIPS)
-$(hide) $(AAPT2) compile -o $@ --dir $@.contents $(PRIVATE_AAPT2_CFLAGS) --legacy
+$(hide) $(AAPT2) compile -o $@ --dir $@.contents $(PRIVATE_AAPT2_CFLAGS)
 endef
 
 # Set up rule to compile one resource file with aapt2.
@@ -1972,7 +1955,7 @@
   $(addprefix --manifest ,$(PRIVATE_ANDROID_MANIFEST)) \
   $(addprefix -I ,$(PRIVATE_AAPT_INCLUDES)) \
   $(addprefix -I ,$(PRIVATE_SHARED_ANDROID_LIBRARIES)) \
-  $(addprefix -A ,$(PRIVATE_ASSET_DIR)) \
+  $(addprefix -A ,$(foreach d,$(PRIVATE_ASSET_DIR),$(call clean-path,$(d)))) \
   $(addprefix --java ,$(PRIVATE_JAVA_GEN_DIR)) \
   $(addprefix --proguard ,$(PRIVATE_PROGUARD_OPTIONS_FILE)) \
   $(addprefix --min-sdk-version ,$(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
@@ -2044,26 +2027,6 @@
         @$(call emit-line,$(wordlist 13001,13500,$(1)),$(2))
         @$(if $(wordlist 13501,13502,$(1)),$(error Too many words ($(words $(1)))))
 endef
-
-# For a list of jar files, unzip them to a specified directory,
-# but make sure that no META-INF files come along for the ride,
-# unless PRIVATE_DONT_DELETE_JAR_META_INF is set.
-#
-# $(1): files to unzip
-# $(2): destination directory
-define unzip-jar-files
-  $(hide) for f in $(1); \
-  do \
-    if [ ! -f $$f ]; then \
-      echo Missing file $$f; \
-      exit 1; \
-    fi; \
-    unzip -qo $$f -d $(2); \
-    rm -f $(2)/module-info.class; \
-  done
-  $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,$(hide) rm -rf $(2)/META-INF)
-endef
-
 # Return jar arguments to compress files in a given directory
 # $(1): directory
 #
@@ -2080,8 +2043,6 @@
 $(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
     find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(1); \
 fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(1))
 endef
 
 # Some historical notes:
@@ -2158,12 +2119,16 @@
     --output $@.premerged --temp_dir $(dir $@)/classes-turbine \
     --sources \@$(PRIVATE_JAVA_SOURCE_LIST) --source_jars $(PRIVATE_SRCJARS) \
     --javacopts $(PRIVATE_JAVACFLAGS) $(COMMON_JDK_FLAGS) -- \
-    $(addprefix --bootclasspath ,$(strip $(PRIVATE_BOOTCLASSPATH))) \
-    $(addprefix --classpath ,$(strip $(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))) \
+    $(if $(PRIVATE_USE_SYSTEM_MODULES), \
+      --system $(PRIVATE_SYSTEM_MODULES_DIR), \
+      --bootclasspath $(strip $(PRIVATE_BOOTCLASSPATH))) \
+    --classpath $(strip $(if $(PRIVATE_USE_SYSTEM_MODULES), \
+        $(filter-out $(PRIVATE_SYSTEM_MODULES_LIBS),$(PRIVATE_BOOTCLASSPATH))) \
+      $(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)) \
     || ( rm -rf $(dir $@)/classes-turbine ; exit 41 ) && \
-    $(MERGE_ZIPS) -j --ignore-duplicates -stripDir META-INF $@.tmp $@.premerged $(call reverse-list,$(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES)) ; \
+    $(MERGE_ZIPS) -j --ignore-duplicates -stripDir META-INF $@.tmp $@.premerged $(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES) ; \
 else \
-    $(MERGE_ZIPS) -j --ignore-duplicates -stripDir META-INF $@.tmp $(call reverse-list,$(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES)) ; \
+    $(MERGE_ZIPS) -j --ignore-duplicates -stripDir META-INF $@.tmp $(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES) ; \
 fi
 $(hide) $(ZIPTIME) $@.tmp
 $(hide) $(call commit-change-for-toc,$@)
@@ -2259,37 +2224,6 @@
 $(hide) rm -rf $(dir $@)tmp
 endef
 
-#TODO: we kinda want to build different asset packages for
-#      different configurations, then combine them later (or something).
-#      Per-locale, etc.
-#      A list of dynamic and static parameters;  build layers for
-#      dynamic params that lay over the static ones.
-#TODO: update the manifest to point to the package file
-#Note that the version numbers are given to aapt as simple default
-#values; applications can override these by explicitly stating
-#them in their manifest.
-# $(1) the package file
-define create-assets-package
-$(hide) $(AAPT_ASAN_OPTIONS) $(AAPT) package $(PRIVATE_AAPT_FLAGS) \
-    $(addprefix -c , $(PRIVATE_PRODUCT_AAPT_CONFIG)) \
-    $(addprefix --preferred-density , $(PRIVATE_PRODUCT_AAPT_PREF_CONFIG)) \
-    $(addprefix -M , $(PRIVATE_ANDROID_MANIFEST)) \
-    $(addprefix -S , $(PRIVATE_RESOURCE_DIR)) \
-    $(addprefix -A , $(PRIVATE_ASSET_DIR)) \
-    $(addprefix -I , $(PRIVATE_AAPT_INCLUDES)) \
-    $(addprefix --min-sdk-version , $(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
-    $(addprefix --target-sdk-version , $(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
-    $(if $(filter --product,$(PRIVATE_AAPT_FLAGS)),,$(addprefix --product , $(PRIVATE_TARGET_AAPT_CHARACTERISTICS))) \
-    $(if $(filter --version-code,$(PRIVATE_AAPT_FLAGS)),,--version-code $(PLATFORM_SDK_VERSION)) \
-    $(if $(filter --version-name,$(PRIVATE_AAPT_FLAGS)),,--version-name $(APPS_DEFAULT_VERSION_NAME)) \
-    $(addprefix --rename-manifest-package , $(PRIVATE_MANIFEST_PACKAGE_NAME)) \
-    $(addprefix --rename-instrumentation-target-package , $(PRIVATE_MANIFEST_INSTRUMENTATION_FOR)) \
-    --skip-symbols-without-default-localization \
-    -F $(1)
-# So that we re-run aapt when the list of input files change
-$(hide) echo $(PRIVATE_RESOURCE_LIST) >/dev/null
-endef
-
 # We need the extra blank line, so that the command will be on a separate line.
 # $(1): the package
 # $(2): the ABI name
@@ -2362,7 +2296,8 @@
 # $(1): the package file we are signing.
 define sign-package-arg
 $(hide) mv $(1) $(1).unsigned
-$(hide) $(JAVA) -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) -jar $(SIGNAPK_JAR) \
+$(hide) $(JAVA) -Djava.library.path=$$(dirname $(SIGNAPK_JNI_LIBRARY_PATH)) -jar $(SIGNAPK_JAR) \
+    $(if $(strip $(PRIVATE_CERTIFICATE_LINEAGE)), --lineage $(PRIVATE_CERTIFICATE_LINEAGE)) \
     $(PRIVATE_CERTIFICATE) $(PRIVATE_PRIVATE_KEY) \
     $(PRIVATE_ADDITIONAL_CERTIFICATES) $(1).unsigned $(1).signed
 $(hide) mv $(1).signed $(1)
@@ -2371,7 +2306,7 @@
 # Align STORED entries of a package on 4-byte boundaries to make them easier to mmap.
 #
 define align-package
-$(hide) if ! $(ZIPALIGN) -c $(ZIPALIGN_PAGE_ALIGN_FLAGS) 4 $@ >/dev/null ; then \
+$(hide) if ! $(ZIPALIGN) -c -p 4 $@ >/dev/null ; then \
   mv $@ $@.unaligned; \
   $(ZIPALIGN) \
     -f \
@@ -2394,28 +2329,28 @@
 ifeq ($(HOST_OS),linux)
 # Runs appcompat and store logs in $(PRODUCT_OUT)/appcompat
 define extract-package
-$(if $(filter aapt2, $(1)), \
-  $(AAPT2) dump resources $@ | awk -F ' |=' '/^Package/{print $$3}' >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log &&, \
-  $(AAPT) dump badging $@ | awk -F \' '/^package/{print $$2}' >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log &&)
+$(AAPT2) dump resources $@ | awk -F ' |=' '/^Package/{print $$3}' >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log &&
 endef
 define appcompat-header
 $(hide) \
   mkdir -p $(PRODUCT_OUT)/appcompat && \
   rm -f $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
   echo -n "Package name: " >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
-  $(call extract-package, $(1)) \
+  $(extract-package) \
   echo "Module name in Android tree: $(PRIVATE_MODULE)" >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
   echo "Local path in Android tree: $(PRIVATE_PATH)" >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
   echo "Install path on $(TARGET_PRODUCT)-$(TARGET_BUILD_VARIANT): $(PRIVATE_INSTALLED_MODULE)" >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
   echo >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log
 endef
+ART_VERIDEX_APPCOMPAT_SCRIPT:=$(HOST_OUT)/bin/appcompat.sh
 define run-appcompat
 $(hide) \
   echo "appcompat.sh output:" >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
-  PACKAGING=$(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING ANDROID_LOG_TAGS="*:e" art/tools/veridex/appcompat.sh --dex-file=$@ --api-flags=$(INTERNAL_PLATFORM_HIDDENAPI_FLAGS) 2>&1 >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log
+  PACKAGING=$(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING ANDROID_LOG_TAGS="*:e" $(ART_VERIDEX_APPCOMPAT_SCRIPT) --dex-file=$@ --api-flags=$(INTERNAL_PLATFORM_HIDDENAPI_FLAGS) 2>&1 >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log
 endef
 appcompat-files = \
-  art/tools/veridex/appcompat.sh \
+  $(AAPT2) \
+  $(ART_VERIDEX_APPCOMPAT_SCRIPT) \
   $(INTERNAL_PLATFORM_HIDDENAPI_FLAGS) \
   $(HOST_OUT_EXECUTABLES)/veridex \
   $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/core_dex_intermediates/classes.dex \
@@ -2543,8 +2478,29 @@
 define copy-init-script-file-checked
 # Host init verifier doesn't exist on darwin.
 ifneq ($(HOST_OS),darwin)
-$(2): $(1) $(HOST_INIT_VERIFIER) $(call intermediates-dir-for,ETC,passwd)/passwd
-	$(hide) $(HOST_INIT_VERIFIER) $$< $(call intermediates-dir-for,ETC,passwd)/passwd
+$(2): \
+	$(1) \
+	$(HOST_INIT_VERIFIER) \
+	$(call intermediates-dir-for,ETC,passwd_system)/passwd_system \
+	$(call intermediates-dir-for,ETC,passwd_vendor)/passwd_vendor \
+	$(call intermediates-dir-for,ETC,passwd_odm)/passwd_odm \
+	$(call intermediates-dir-for,ETC,passwd_product)/passwd_product \
+	$(call intermediates-dir-for,ETC,plat_property_contexts)/plat_property_contexts \
+	$(call intermediates-dir-for,ETC,system_ext_property_contexts)/system_ext_property_contexts \
+	$(call intermediates-dir-for,ETC,product_property_contexts)/product_property_contexts \
+	$(call intermediates-dir-for,ETC,vendor_property_contexts)/vendor_property_contexts \
+	$(call intermediates-dir-for,ETC,odm_property_contexts)/odm_property_contexts
+	$(hide) $(HOST_INIT_VERIFIER) \
+	  -p $(call intermediates-dir-for,ETC,passwd_system)/passwd_system \
+	  -p $(call intermediates-dir-for,ETC,passwd_vendor)/passwd_vendor \
+	  -p $(call intermediates-dir-for,ETC,passwd_odm)/passwd_odm \
+	  -p $(call intermediates-dir-for,ETC,passwd_product)/passwd_product \
+	  --property-contexts=$(call intermediates-dir-for,ETC,plat_property_contexts)/plat_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,system_ext_property_contexts)/system_ext_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,product_property_contexts)/product_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,vendor_property_contexts)/vendor_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,odm_property_contexts)/odm_property_contexts \
+	  $$<
 else
 $(2): $(1)
 endif
@@ -2684,17 +2640,15 @@
 endef
 
 # Define a rule to create a symlink to a file.
-# $(1): full path to source
+# $(1): any dependencies
 # $(2): source (may be relative)
 # $(3): full path to destination
 define symlink-file
 $(eval $(_symlink-file))
 endef
 
-# Order-only dependency because make/ninja will follow the link when checking
-# the timestamp, so the file must exist
 define _symlink-file
-$(3): | $(1)
+$(3): $(1)
 	@echo "Symlink: $$@ -> $(2)"
 	@mkdir -p $(dir $$@)
 	@rm -rf $$@
@@ -2768,9 +2722,9 @@
 ###########################################################
 
 # $(1): The file to check
-ifndef get-file-size
-$(error HOST_OS must define get-file-size)
-endif
+define get-file-size
+stat -c "%s" "$(1)" | tr -d '\n'
+endef
 
 # $(1): The file(s) to check (often $@)
 # $(2): The partition size.
@@ -2826,60 +2780,6 @@
 
 
 ###########################################################
-# Override the package defined in $(1), setting the
-# variables listed below differently.
-#
-#  $(1): The makefile to override (relative to the source
-#        tree root)
-#  $(2): Old LOCAL_PACKAGE_NAME value.
-#  $(3): New LOCAL_PACKAGE_NAME value.
-#  $(4): New LOCAL_MANIFEST_PACKAGE_NAME value.
-#  $(5): New LOCAL_CERTIFICATE value.
-#  $(6): New LOCAL_INSTRUMENTATION_FOR value.
-#  $(7): New LOCAL_MANIFEST_INSTRUMENTATION_FOR value.
-#  $(8): New LOCAL_COMPATIBILITY_SUITE value.
-#
-# Note that LOCAL_PACKAGE_OVERRIDES is NOT cleared in
-# clear_vars.mk.
-###########################################################
-define inherit-package
-  $(eval $(call inherit-package-internal,$(1),$(2),$(3),$(4),$(5),$(6),$(7),$(8)))
-endef
-
-define inherit-package-internal
-  LOCAL_PACKAGE_OVERRIDES \
-      := $(strip $(1))||$(strip $(2))||$(strip $(3))||$(strip $(4))||&&$(strip $(5))||&&$(strip $(6))||&&$(strip $(7))||&&$(strip $(8)) $(LOCAL_PACKAGE_OVERRIDES)
-  include $(1)
-  LOCAL_PACKAGE_OVERRIDES \
-      := $(wordlist 1,$(words $(LOCAL_PACKAGE_OVERRIDES)), $(LOCAL_PACKAGE_OVERRIDES))
-endef
-
-# To be used with inherit-package above
-# Evalutes to true if the package was overridden
-define set-inherited-package-variables
-$(strip $(call set-inherited-package-variables-internal))
-endef
-
-define keep-or-override
-$(eval $(1) := $(if $(2),$(2),$($(1))))
-endef
-
-define set-inherited-package-variables-internal
-  $(eval _o := $(subst ||, ,$(lastword $(LOCAL_PACKAGE_OVERRIDES))))
-  $(eval _n := $(subst ||, ,$(firstword $(LOCAL_PACKAGE_OVERRIDES))))
-  $(if $(filter $(word 2,$(_n)),$(LOCAL_PACKAGE_NAME)), \
-    $(eval LOCAL_PACKAGE_NAME := $(word 3,$(_o))) \
-    $(eval LOCAL_MANIFEST_PACKAGE_NAME := $(word 4,$(_o))) \
-    $(call keep-or-override,LOCAL_CERTIFICATE,$(patsubst &&%,%,$(word 5,$(_o)))) \
-    $(call keep-or-override,LOCAL_INSTRUMENTATION_FOR,$(patsubst &&%,%,$(word 6,$(_o)))) \
-    $(call keep-or-override,LOCAL_MANIFEST_INSTRUMENTATION_FOR,$(patsubst &&%,%,$(word 7,$(_o)))) \
-    $(call keep-or-override,LOCAL_COMPATIBILITY_SUITE,$(patsubst &&%,%,$(word 8,$(_o)))) \
-    $(eval LOCAL_OVERRIDES_PACKAGES := $(sort $(LOCAL_OVERRIDES_PACKAGES) $(word 2,$(_o)))) \
-    true \
-  ,)
-endef
-
-###########################################################
 ## API Check
 ###########################################################
 
@@ -2991,7 +2891,9 @@
 # Can be passed a subdirectory to use for the common testcase directory.
 define compatibility_suite_dirs
   $(strip \
-    $(COMPATIBILITY_TESTCASES_OUT_$(1)) \
+    $(if $(COMPATIBILITY_TESTCASES_OUT_INCLUDE_MODULE_FOLDER_$(1)),\
+      $(COMPATIBILITY_TESTCASES_OUT_$(1))/$(LOCAL_MODULE)$(2),\
+      $(COMPATIBILITY_TESTCASES_OUT_$(1))) \
     $($(my_prefix)OUT_TESTCASES)/$(LOCAL_MODULE)$(2))
 endef
 
@@ -3005,11 +2907,14 @@
 #    and use my_compat_dist_$(suite) to define the others.
 define create-suite-dependencies
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
-  $(eval COMPATIBILITY.$(suite).FILES := \
-    $$(COMPATIBILITY.$(suite).FILES) $$(foreach f,$$(my_compat_dist_$(suite)),$$(call word-colon,2,$$(f))) \
-      $$(foreach f,$$(my_compat_dist_config_$(suite)),$$(call word-colon,2,$$(f)))) \
-  $(eval COMPATIBILITY.$(suite).MODULES := \
-    $$(COMPATIBILITY.$(suite).MODULES) $$(my_register_name))) \
+  $(if $(filter $(suite),$(ALL_COMPATIBILITY_SUITES)),,\
+    $(eval ALL_COMPATIBILITY_SUITES += $(suite)) \
+    $(eval COMPATIBILITY.$(suite).FILES :=) \
+    $(eval COMPATIBILITY.$(suite).MODULES :=)) \
+  $(eval COMPATIBILITY.$(suite).FILES += \
+    $$(foreach f,$$(my_compat_dist_$(suite)),$$(call word-colon,2,$$(f))) \
+    $$(foreach f,$$(my_compat_dist_config_$(suite)),$$(call word-colon,2,$$(f)))) \
+  $(eval COMPATIBILITY.$(suite).MODULES += $$(my_register_name))) \
 $(eval $(my_all_targets) : $(call copy-many-files, \
   $(sort $(foreach suite,$(LOCAL_COMPATIBILITY_SUITE),$(my_compat_dist_$(suite))))) \
   $(call copy-many-xml-files-checked, \
@@ -3352,11 +3257,12 @@
 
 ###########################################################
 ## Find system_$(VER) in LOCAL_SDK_VERSION
+## note: system_server_* is excluded. It's a different API surface
 ##
 ## $(1): LOCAL_SDK_VERSION
 ###########################################################
 define has-system-sdk-version
-$(filter system_%,$(1))
+$(filter-out system_server_%,$(filter system_%,$(1)))
 endef
 
 ###########################################################
@@ -3411,7 +3317,8 @@
 $(KATI_obsolete_var \
   create-empty-package \
   initialize-package-file \
-  add-jni-shared-libs-to-package,\
+  add-jni-shared-libs-to-package \
+  inherit-package,\
   These functions have been removed)
 
 ###########################################################
@@ -3425,7 +3332,13 @@
 define verify-vndk-libs-identical
 @echo "Checking VNDK vendor variant: $(2)"
 $(hide) CLANG_BIN="$(LLVM_PREBUILTS_PATH)" \
-	CROSS_COMPILE="$(strip $(3))" \
-	XZ="$(XZ)" \
-	$(LIBRARY_IDENTITY_CHECK_SCRIPT) $(SOONG_STRIP_PATH) $(1) $(2)
+  CROSS_COMPILE="$(strip $(3))" \
+  XZ="$(XZ)" \
+  $(LIBRARY_IDENTITY_CHECK_SCRIPT) $(SOONG_STRIP_PATH) $(1) $(2)
+endef
+
+# Convert Soong libraries that have SDK variant
+define use_soong_sdk_libraries
+  $(foreach l,$(1),$(if $(filter $(l),$(SOONG_SDK_VARIANT_MODULES)),\
+      $(l).sdk,$(l)))
 endef
diff --git a/core/deprecation.mk b/core/deprecation.mk
new file mode 100644
index 0000000..19bd4cf
--- /dev/null
+++ b/core/deprecation.mk
@@ -0,0 +1,55 @@
+# These module types can still be used without warnings or errors.
+AVAILABLE_BUILD_MODULE_TYPES :=$= \
+  BUILD_EXECUTABLE \
+  BUILD_FUZZ_TEST \
+  BUILD_HEADER_LIBRARY \
+  BUILD_HOST_DALVIK_JAVA_LIBRARY \
+  BUILD_HOST_DALVIK_STATIC_JAVA_LIBRARY \
+  BUILD_HOST_JAVA_LIBRARY \
+  BUILD_HOST_PREBUILT \
+  BUILD_JAVA_LIBRARY \
+  BUILD_MULTI_PREBUILT \
+  BUILD_NATIVE_TEST \
+  BUILD_NOTICE_FILE \
+  BUILD_PACKAGE \
+  BUILD_PHONY_PACKAGE \
+  BUILD_PREBUILT \
+  BUILD_RRO_PACKAGE \
+  BUILD_SHARED_LIBRARY \
+  BUILD_STATIC_JAVA_LIBRARY \
+  BUILD_STATIC_LIBRARY \
+
+# These are BUILD_* variables that will throw a warning when used. This is
+# generally a temporary state until all the devices are marked with the
+# relevant BUILD_BROKEN_USES_BUILD_* variables, then these would move to
+# DEFAULT_ERROR_BUILD_MODULE_TYPES.
+DEFAULT_WARNING_BUILD_MODULE_TYPES :=$= \
+
+# These are BUILD_* variables that are errors to reference, but you can set
+# BUILD_BROKEN_USES_BUILD_* in your BoardConfig.mk in order to turn them back
+# to warnings.
+DEFAULT_ERROR_BUILD_MODULE_TYPES :=$= \
+  BUILD_AUX_EXECUTABLE \
+  BUILD_AUX_STATIC_LIBRARY \
+  BUILD_COPY_HEADERS \
+  BUILD_HOST_EXECUTABLE \
+  BUILD_HOST_FUZZ_TEST \
+  BUILD_HOST_NATIVE_TEST \
+  BUILD_HOST_SHARED_LIBRARY \
+  BUILD_HOST_STATIC_LIBRARY \
+  BUILD_HOST_STATIC_TEST_LIBRARY \
+  BUILD_HOST_TEST_CONFIG \
+  BUILD_NATIVE_BENCHMARK \
+  BUILD_STATIC_TEST_LIBRARY \
+  BUILD_TARGET_TEST_CONFIG \
+
+# These are BUILD_* variables that are always errors to reference.
+# Setting the BUILD_BROKEN_USES_BUILD_* variables is also an error.
+OBSOLETE_BUILD_MODULE_TYPES :=$= \
+  BUILD_HOST_SHARED_TEST_LIBRARY \
+  BUILD_SHARED_TEST_LIBRARY \
+
+$(foreach m,$(OBSOLETE_BUILD_MODULE_TYPES),\
+  $(KATI_obsolete_var $(m),Please convert to Soong) \
+  $(KATI_obsolete_var BUILD_BROKEN_USES_$(m),Please convert to Soong))
+
diff --git a/core/dex_preopt.mk b/core/dex_preopt.mk
index 180edaf..55eeec6 100644
--- a/core/dex_preopt.mk
+++ b/core/dex_preopt.mk
@@ -26,7 +26,7 @@
 # We can do this only if preopt is enabled and if the product uses libart config (which sets the
 # default properties for preopting).
 ifeq ($(WITH_DEXPREOPT), true)
-ifeq ($(PRODUCT_USES_ART), true)
+ifeq ($(PRODUCT_USES_DEFAULT_ART_CONFIG), true)
 
 boot_zip := $(PRODUCT_OUT)/boot.zip
 bootclasspath_jars := $(DEXPREOPT_BOOTCLASSPATH_DEX_FILES)
@@ -34,16 +34,16 @@
 
 $(boot_zip): PRIVATE_BOOTCLASSPATH_JARS := $(bootclasspath_jars)
 $(boot_zip): PRIVATE_SYSTEM_SERVER_JARS := $(system_server_jars)
-$(boot_zip): $(bootclasspath_jars) $(system_server_jars) $(SOONG_ZIP) $(MERGE_ZIPS) $(DEXPREOPT_IMAGE_ZIP_boot)
+$(boot_zip): $(bootclasspath_jars) $(system_server_jars) $(SOONG_ZIP) $(MERGE_ZIPS) $(DEXPREOPT_IMAGE_ZIP_boot) $(DEXPREOPT_IMAGE_ZIP_art)
 	@echo "Create boot package: $@"
 	rm -f $@
 	$(SOONG_ZIP) -o $@.tmp \
 	  -C $(dir $(firstword $(PRIVATE_BOOTCLASSPATH_JARS)))/.. $(addprefix -f ,$(PRIVATE_BOOTCLASSPATH_JARS)) \
 	  -C $(PRODUCT_OUT) $(addprefix -f ,$(PRIVATE_SYSTEM_SERVER_JARS))
-	$(MERGE_ZIPS) $@ $@.tmp $(DEXPREOPT_IMAGE_ZIP_boot)
+	$(MERGE_ZIPS) $@ $@.tmp $(DEXPREOPT_IMAGE_ZIP_boot) $(DEXPREOPT_IMAGE_ZIP_art)
 	rm -f $@.tmp
 
 $(call dist-for-goals, droidcore, $(boot_zip))
 
-endif  #PRODUCT_USES_ART
+endif  #PRODUCT_USES_DEFAULT_ART_CONFIG
 endif  #WITH_DEXPREOPT
diff --git a/core/dex_preopt_config.mk b/core/dex_preopt_config.mk
index b5834b0..ccf53f5 100644
--- a/core/dex_preopt_config.mk
+++ b/core/dex_preopt_config.mk
@@ -1,28 +1,22 @@
-DEX_PREOPT_CONFIG := $(PRODUCT_OUT)/dexpreopt.config
+DEX_PREOPT_CONFIG := $(SOONG_OUT_DIR)/dexpreopt.config
 
 # The default value for LOCAL_DEX_PREOPT
 DEX_PREOPT_DEFAULT ?= true
 
 # The default filter for which files go into the system_other image (if it is
-# being used). To bundle everything one should set this to '%'
+# being used). Note that each pattern p here matches both '/<p>' and /system/<p>'.
+# To bundle everything one should set this to '%'.
 SYSTEM_OTHER_ODEX_FILTER ?= \
     app/% \
     priv-app/% \
-    product_services/app/% \
-    product_services/priv-app/% \
+    system_ext/app/% \
+    system_ext/priv-app/% \
     product/app/% \
     product/priv-app/% \
 
-# The default values for pre-opting. To support the runtime module we ensure no dex files
-# get stripped.
-ifeq ($(PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING),)
-  PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING := true
-endif
 # Conditional to building on linux, as dex2oat currently does not work on darwin.
 ifeq ($(HOST_OS),linux)
   ifeq (eng,$(TARGET_BUILD_VARIANT))
-    # Don't strip for quick development turnarounds.
-    DEX_PREOPT_DEFAULT := nostripping
     # For an eng build only pre-opt the boot image and system server. This gives reasonable performance
     # and still allows a simple workflow: building in frameworks/base and syncing.
     WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY ?= true
@@ -43,16 +37,6 @@
   endif
 endif
 
-# Default to debug version to help find bugs.
-# Set USE_DEX2OAT_DEBUG to false for only building non-debug versions.
-ifeq ($(USE_DEX2OAT_DEBUG),false)
-DEX2OAT := $(SOONG_HOST_OUT_EXECUTABLES)/dex2oat$(HOST_EXECUTABLE_SUFFIX)
-else
-DEX2OAT := $(SOONG_HOST_OUT_EXECUTABLES)/dex2oatd$(HOST_EXECUTABLE_SUFFIX)
-endif
-
-DEX2OAT_DEPENDENCY += $(DEX2OAT)
-
 # Use the first preloaded-classes file in PRODUCT_COPY_FILES.
 PRELOADED_CLASSES := $(call word-colon,1,$(firstword \
     $(filter %system/etc/preloaded-classes,$(PRODUCT_COPY_FILES))))
@@ -86,12 +70,10 @@
 
   $(call json_start)
 
-  $(call add_json_bool, DefaultNoStripping,                 $(filter nostripping,$(DEX_PREOPT_DEFAULT)))
-  $(call add_json_bool, DisablePreopt,                      $(call invert_bool,$(filter true,$(WITH_DEXPREOPT))))
+  $(call add_json_bool, DisablePreopt,                      $(call invert_bool,$(and $(filter true,$(PRODUCT_USES_DEFAULT_ART_CONFIG)),$(filter true,$(WITH_DEXPREOPT)))))
   $(call add_json_list, DisablePreoptModules,               $(DEXPREOPT_DISABLED_MODULES))
   $(call add_json_bool, OnlyPreoptBootImageAndSystemServer, $(filter true,$(WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY)))
-  $(call add_json_bool, GenerateApexImage,                  $(filter true,$(DEXPREOPT_GENERATE_APEX_IMAGE)))
-  $(call add_json_bool, UseApexImage,                       $(filter true,$(DEXPREOPT_USE_APEX_IMAGE)))
+  $(call add_json_bool, UseArtImage,                        $(filter true,$(DEXPREOPT_USE_ART_IMAGE)))
   $(call add_json_bool, DontUncompressPrivAppsDex,          $(filter true,$(DONT_UNCOMPRESS_PRIV_APPS_DEXS)))
   $(call add_json_list, ModulesLoadedByPrivilegedModules,   $(PRODUCT_LOADED_BY_PRIVILEGED_MODULES))
   $(call add_json_bool, HasSystemOther,                     $(BOARD_USES_SYSTEM_OTHER_ODEX))
@@ -99,11 +81,11 @@
   $(call add_json_bool, DisableGenerateProfile,             $(filter false,$(WITH_DEX_PREOPT_GENERATE_PROFILE)))
   $(call add_json_str,  ProfileDir,                         $(PRODUCT_DEX_PREOPT_PROFILE_DIR))
   $(call add_json_list, BootJars,                           $(PRODUCT_BOOT_JARS))
-  $(call add_json_list, RuntimeApexJars,                    $(RUNTIME_APEX_JARS))
-  $(call add_json_list, ProductUpdatableBootModules,        $(PRODUCT_UPDATABLE_BOOT_MODULES))
-  $(call add_json_list, ProductUpdatableBootLocations,      $(PRODUCT_UPDATABLE_BOOT_LOCATIONS))
+  $(call add_json_list, UpdatableBootJars,                  $(PRODUCT_UPDATABLE_BOOT_JARS))
+  $(call add_json_list, ArtApexJars,                        $(ART_APEX_JARS))
   $(call add_json_list, SystemServerJars,                   $(PRODUCT_SYSTEM_SERVER_JARS))
   $(call add_json_list, SystemServerApps,                   $(PRODUCT_SYSTEM_SERVER_APPS))
+  $(call add_json_list, UpdatableSystemServerJars,          $(PRODUCT_UPDATABLE_SYSTEM_SERVER_JARS))
   $(call add_json_list, SpeedApps,                          $(PRODUCT_DEXPREOPT_SPEED_APPS))
   $(call add_json_list, PreoptFlags,                        $(PRODUCT_DEX_PREOPT_DEFAULT_FLAGS))
   $(call add_json_str,  DefaultCompilerFilter,              $(PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER))
@@ -116,7 +98,6 @@
   $(call add_json_bool, NeverSystemServerDebugInfo,         $(filter false,$(PRODUCT_SYSTEM_SERVER_DEBUG_INFO)))
   $(call add_json_bool, AlwaysOtherDebugInfo,               $(filter true,$(PRODUCT_OTHER_JAVA_DEBUG_INFO)))
   $(call add_json_bool, NeverOtherDebugInfo,                $(filter false,$(PRODUCT_OTHER_JAVA_DEBUG_INFO)))
-  $(call add_json_list, MissingUsesLibraries,               $(INTERNAL_PLATFORM_MISSING_USES_LIBRARIES))
   $(call add_json_bool, IsEng,                              $(filter eng,$(TARGET_BUILD_VARIANT)))
   $(call add_json_bool, SanitizeLite,                       $(SANITIZE_LITE))
   $(call add_json_bool, DefaultAppImages,                   $(WITH_DEX_PREOPT_APP_IMAGE))
@@ -139,23 +120,11 @@
   $(call end_json_map)
 
   $(call add_json_str,  DirtyImageObjects,                  $(DIRTY_IMAGE_OBJECTS))
-  $(call add_json_str,  PreloadedClasses,                   $(PRELOADED_CLASSES))
   $(call add_json_list, BootImageProfiles,                  $(PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION))
-  $(call add_json_bool, UseProfileForBootImage,             $(call invert_bool,$(filter false,$(PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE))))
   $(call add_json_str,  BootFlags,                          $(PRODUCT_DEX_PREOPT_BOOT_FLAGS))
   $(call add_json_str,  Dex2oatImageXmx,                    $(DEX2OAT_IMAGE_XMX))
   $(call add_json_str,  Dex2oatImageXms,                    $(DEX2OAT_IMAGE_XMS))
 
-  $(call add_json_map,  Tools)
-  $(call add_json_str,  Profman,                            $(SOONG_HOST_OUT_EXECUTABLES)/profman)
-  $(call add_json_str,  Dex2oat,                            $(DEX2OAT))
-  $(call add_json_str,  Aapt,                               $(SOONG_HOST_OUT_EXECUTABLES)/aapt)
-  $(call add_json_str,  SoongZip,                           $(SOONG_ZIP))
-  $(call add_json_str,  Zip2zip,                            $(ZIP2ZIP))
-  $(call add_json_str,  VerifyUsesLibraries,                $(BUILD_SYSTEM)/verify_uses_libraries.sh)
-  $(call add_json_str,  ConstructContext,                   $(BUILD_SYSTEM)/construct_context.sh)
-  $(call end_json_map)
-
   $(call json_end)
 
   $(shell mkdir -p $(dir $(DEX_PREOPT_CONFIG)))
@@ -168,21 +137,3 @@
       rm $(DEX_PREOPT_CONFIG).tmp; \
     fi)
 endif
-
-# Dummy rule to create dexpreopt.config, it will already have been created
-# by the $(file) call above, but a rule needs to exist to keep the dangling
-# rule check happy.
-$(DEX_PREOPT_CONFIG):
-	@#empty
-
-DEXPREOPT_GEN_DEPS := \
-  $(SOONG_HOST_OUT_EXECUTABLES)/profman \
-  $(DEX2OAT) \
-  $(SOONG_HOST_OUT_EXECUTABLES)/aapt \
-  $(SOONG_ZIP) \
-  $(ZIP2ZIP) \
-  $(BUILD_SYSTEM)/verify_uses_libraries.sh \
-  $(BUILD_SYSTEM)/construct_context.sh \
-
-DEXPREOPT_STRIP_DEPS := \
-  $(ZIP2ZIP) \
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index 85f2f3b..79d5f8c 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -21,10 +21,8 @@
 	mkdir -p $(dir $@)/$(TARGET_ARCH)
 	ln -sfn ../$(notdir $@) $(dir $@)/$(TARGET_ARCH)
 ifdef TARGET_2ND_ARCH
-  ifneq ($(TARGET_TRANSLATE_2ND_ARCH),true)
 	mkdir -p $(dir $@)/$(TARGET_2ND_ARCH)
 	ln -sfn ../$(notdir $@) $(dir $@)/$(TARGET_2ND_ARCH)
-  endif
 endif
 
 my_dexpreopt_image_extra_deps := $(firstword $(my_installed))
@@ -33,10 +31,8 @@
 include $(BUILD_SYSTEM)/dex_preopt_libart_boot.mk
 
 ifdef TARGET_2ND_ARCH
-  ifneq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-    my_2nd_arch_prefix := $(TARGET_2ND_ARCH_VAR_PREFIX)
-    include $(BUILD_SYSTEM)/dex_preopt_libart_boot.mk
-  endif
+  my_2nd_arch_prefix := $(TARGET_2ND_ARCH_VAR_PREFIX)
+  include $(BUILD_SYSTEM)/dex_preopt_libart_boot.mk
 endif
 
 my_2nd_arch_prefix :=
diff --git a/core/dex_preopt_odex_install.mk b/core/dex_preopt_odex_install.mk
index 85ddbfa..9dbddf6 100644
--- a/core/dex_preopt_odex_install.mk
+++ b/core/dex_preopt_odex_install.mk
@@ -58,6 +58,11 @@
   LOCAL_DEX_PREOPT :=
 endif
 
+# Don't preopt system server jars that are updatable.
+ifneq (,$(filter %:$(LOCAL_MODULE), $(PRODUCT_UPDATABLE_SYSTEM_SERVER_JARS)))
+  LOCAL_DEX_PREOPT :=
+endif
+
 # if WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY=true and module is not in boot class path skip
 # Also preopt system server jars since selinux prevents system server from loading anything from
 # /data. If we don't do this they will need to be extracted which is not favorable for RAM usage
@@ -103,23 +108,13 @@
   endif
 endif
 
-# If LOCAL_ENFORCE_USES_LIBRARIES is not set, default to true if either of LOCAL_USES_LIBRARIES or
-# LOCAL_OPTIONAL_USES_LIBRARIES are specified.
-ifeq (,$(LOCAL_ENFORCE_USES_LIBRARIES))
-  # Will change the default to true unconditionally in the future.
-  ifneq (,$(LOCAL_OPTIONAL_USES_LIBRARIES))
-    LOCAL_ENFORCE_USES_LIBRARIES := true
-  endif
-  ifneq (,$(LOCAL_USES_LIBRARIES))
-    LOCAL_ENFORCE_USES_LIBRARIES := true
-  endif
-endif
-
 my_dexpreopt_archs :=
 my_dexpreopt_images :=
+my_dexpreopt_images_deps :=
+my_dexpreopt_image_locations :=
 my_dexpreopt_infix := boot
-ifeq (true, $(DEXPREOPT_USE_APEX_IMAGE))
-  my_dexpreopt_infix := apex
+ifeq (true, $(DEXPREOPT_USE_ART_IMAGE))
+  my_dexpreopt_infix := art
 endif
 
 ifdef LOCAL_DEX_PREOPT
@@ -155,12 +150,14 @@
     # Odex for the 1st arch
     my_dexpreopt_archs += $(TARGET_ARCH)
     my_dexpreopt_images += $(DEXPREOPT_IMAGE_$(my_dexpreopt_infix)_$(TARGET_ARCH))
+    my_dexpreopt_images_deps += $(DEXPREOPT_IMAGE_DEPS_$(my_dexpreopt_infix)_$(TARGET_ARCH))
     # Odex for the 2nd arch
     ifdef TARGET_2ND_ARCH
       ifneq ($(TARGET_TRANSLATE_2ND_ARCH),true)
         ifneq (first,$(my_module_multilib))
           my_dexpreopt_archs += $(TARGET_2ND_ARCH)
           my_dexpreopt_images += $(DEXPREOPT_IMAGE_$(my_dexpreopt_infix)_$(TARGET_2ND_ARCH))
+          my_dexpreopt_images_deps += $(DEXPREOPT_IMAGE_DEPS_$(my_dexpreopt_infix)_$(TARGET_2ND_ARCH))
         endif  # my_module_multilib is not first.
       endif  # TARGET_TRANSLATE_2ND_ARCH not true
     endif  # TARGET_2ND_ARCH
@@ -172,6 +169,8 @@
     my_dexpreopt_archs += $(TARGET_$(my_2nd_arch_prefix)ARCH)
     my_dexpreopt_images += \
         $(DEXPREOPT_IMAGE_$(my_dexpreopt_infix)_$(TARGET_$(my_2nd_arch_prefix)ARCH))
+    my_dexpreopt_images_deps += \
+        $(DEXPREOPT_IMAGE_DEPS_$(my_dexpreopt_infix)_$(TARGET_$(my_2nd_arch_prefix)ARCH))
     ifdef TARGET_2ND_ARCH
       ifeq ($(my_module_multilib),both)
         # The non-preferred arch
@@ -179,10 +178,30 @@
         my_dexpreopt_archs += $(TARGET_$(my_2nd_arch_prefix)ARCH)
         my_dexpreopt_images += \
             $(DEXPREOPT_IMAGE_$(my_dexpreopt_infix)_$(TARGET_$(my_2nd_arch_prefix)ARCH))
+        my_dexpreopt_images_deps += \
+            $(DEXPREOPT_IMAGE_DEPS_$(my_dexpreopt_infix)_$(TARGET_$(my_2nd_arch_prefix)ARCH))
       endif  # LOCAL_MULTILIB is both
     endif  # TARGET_2ND_ARCH
   endif  # LOCAL_MODULE_CLASS
 
+  my_dexpreopt_image_locations += $(DEXPREOPT_IMAGE_LOCATIONS_$(my_dexpreopt_infix))
+
+  my_filtered_optional_uses_libraries := $(filter-out $(INTERNAL_PLATFORM_MISSING_USES_LIBRARIES), \
+    $(LOCAL_OPTIONAL_USES_LIBRARIES))
+
+  # dexpreopt needs the paths to the dex jars of these libraries in case
+  # construct_context.sh needs to pass them to dex2oat.
+  my_extra_dexpreopt_libs := \
+    org.apache.http.legacy \
+    android.hidl.base-V1.0-java \
+    android.hidl.manager-V1.0-java \
+
+  my_dexpreopt_libs := $(sort \
+    $(LOCAL_USES_LIBRARIES) \
+    $(my_filtered_optional_uses_libraries) \
+    $(my_extra_dexpreopt_libs) \
+  )
+
   # Record dex-preopt config.
   DEXPREOPT.$(LOCAL_MODULE).DEX_PREOPT := $(LOCAL_DEX_PREOPT)
   DEXPREOPT.$(LOCAL_MODULE).MULTILIB := $(LOCAL_MULTILIB)
@@ -196,12 +215,12 @@
 
   $(call json_start)
 
-  # DexPath, StripInputPath, and StripOutputPath are not set, they will
-  # be filled in by dexpreopt_gen.
+  # DexPath is not set: it will be filled in by dexpreopt_gen.
 
   $(call add_json_str,  Name,                           $(LOCAL_MODULE))
   $(call add_json_str,  DexLocation,                    $(patsubst $(PRODUCT_OUT)%,%,$(LOCAL_INSTALLED_MODULE)))
   $(call add_json_str,  BuildPath,                      $(LOCAL_BUILT_MODULE))
+  $(call add_json_str,  ManifestPath,                   $(full_android_manifest))
   $(call add_json_str,  ExtrasOutputPath,               $$2)
   $(call add_json_bool, Privileged,                     $(filter true,$(LOCAL_PRIVILEGED_MODULE)))
   $(call add_json_bool, UncompressedDex,                $(filter true,$(LOCAL_UNCOMPRESS_DEX)))
@@ -210,14 +229,15 @@
   $(call add_json_str,  ProfileClassListing,            $(if $(my_process_profile),$(LOCAL_DEX_PREOPT_PROFILE)))
   $(call add_json_bool, ProfileIsTextListing,           $(my_profile_is_text_listing))
   $(call add_json_bool, EnforceUsesLibraries,           $(LOCAL_ENFORCE_USES_LIBRARIES))
-  $(call add_json_list, OptionalUsesLibraries,          $(LOCAL_OPTIONAL_USES_LIBRARIES))
+  $(call add_json_list, OptionalUsesLibraries,          $(my_filtered_optional_uses_libraries))
   $(call add_json_list, UsesLibraries,                  $(LOCAL_USES_LIBRARIES))
   $(call add_json_map,  LibraryPaths)
-  $(foreach lib,$(sort $(LOCAL_USES_LIBRARIES) $(LOCAL_OPTIONAL_USES_LIBRARIES) org.apache.http.legacy android.hidl.base-V1.0-java android.hidl.manager-V1.0-java),\
+  $(foreach lib,$(my_dexpreopt_libs),\
     $(call add_json_str, $(lib), $(call intermediates-dir-for,JAVA_LIBRARIES,$(lib),,COMMON)/javalib.jar))
   $(call end_json_map)
   $(call add_json_list, Archs,                          $(my_dexpreopt_archs))
   $(call add_json_list, DexPreoptImages,                $(my_dexpreopt_images))
+  $(call add_json_list, DexPreoptImageLocations,        $(my_dexpreopt_image_locations))
   $(call add_json_list, PreoptBootClassPathDexFiles,    $(DEXPREOPT_BOOTCLASSPATH_DEX_FILES))
   $(call add_json_list, PreoptBootClassPathDexLocations,$(DEXPREOPT_BOOTCLASSPATH_DEX_LOCATIONS))
   $(call add_json_bool, PreoptExtractedApk,             $(my_preopt_for_extracted_apk))
@@ -225,13 +245,10 @@
   $(call add_json_bool, ForceCreateAppImage,            $(filter true,$(LOCAL_DEX_PREOPT_APP_IMAGE)))
   $(call add_json_bool, PresignedPrebuilt,              $(filter PRESIGNED,$(LOCAL_CERTIFICATE)))
 
-  $(call add_json_bool, NoStripping,                    $(filter nostripping,$(LOCAL_DEX_PREOPT)))
-
   $(call json_end)
 
   my_dexpreopt_config := $(intermediates)/dexpreopt.config
   my_dexpreopt_script := $(intermediates)/dexpreopt.sh
-  my_strip_script := $(intermediates)/strip.sh
   my_dexpreopt_zip := $(intermediates)/dexpreopt.zip
 
   $(my_dexpreopt_config): PRIVATE_MODULE := $(LOCAL_MODULE)
@@ -240,25 +257,27 @@
 	@echo "$(PRIVATE_MODULE) dexpreopt.config"
 	echo -e -n '$(subst $(newline),\n,$(subst ','\'',$(subst \,\\,$(PRIVATE_CONTENTS))))' > $@
 
-  .KATI_RESTAT: $(my_dexpreopt_script) $(my_strip_script)
+  .KATI_RESTAT: $(my_dexpreopt_script)
   $(my_dexpreopt_script): PRIVATE_MODULE := $(LOCAL_MODULE)
-  $(my_dexpreopt_script): PRIVATE_GLOBAL_CONFIG := $(PRODUCT_OUT)/dexpreopt.config
+  $(my_dexpreopt_script): PRIVATE_GLOBAL_SOONG_CONFIG := $(DEX_PREOPT_SOONG_CONFIG_FOR_MAKE)
+  $(my_dexpreopt_script): PRIVATE_GLOBAL_CONFIG := $(DEX_PREOPT_CONFIG_FOR_MAKE)
   $(my_dexpreopt_script): PRIVATE_MODULE_CONFIG := $(my_dexpreopt_config)
-  $(my_dexpreopt_script): PRIVATE_STRIP_SCRIPT := $(my_strip_script)
-  $(my_dexpreopt_script): .KATI_IMPLICIT_OUTPUTS := $(my_strip_script)
   $(my_dexpreopt_script): $(DEXPREOPT_GEN)
-  $(my_dexpreopt_script): $(my_dexpreopt_config) $(PRODUCT_OUT)/dexpreopt.config
+  $(my_dexpreopt_script): $(my_dexpreopt_config) $(DEX_PREOPT_SOONG_CONFIG_FOR_MAKE) $(DEX_PREOPT_CONFIG_FOR_MAKE)
 	@echo "$(PRIVATE_MODULE) dexpreopt gen"
-	$(DEXPREOPT_GEN) -global $(PRIVATE_GLOBAL_CONFIG) -module $(PRIVATE_MODULE_CONFIG) \
-	-dexpreopt_script $@ -strip_script $(PRIVATE_STRIP_SCRIPT) \
+	$(DEXPREOPT_GEN) \
+	-global_soong $(PRIVATE_GLOBAL_SOONG_CONFIG) \
+	-global $(PRIVATE_GLOBAL_CONFIG) \
+	-module $(PRIVATE_MODULE_CONFIG) \
+	-dexpreopt_script $@ \
 	-out_dir $(OUT_DIR)
 
   my_dexpreopt_deps := $(my_dex_jar)
   my_dexpreopt_deps += $(if $(my_process_profile),$(LOCAL_DEX_PREOPT_PROFILE))
   my_dexpreopt_deps += \
-    $(foreach lib,$(sort $(LOCAL_USES_LIBRARIES) $(LOCAL_OPTIONAL_USES_LIBRARIES) org.apache.http.legacy android.hidl.base-V1.0-java android.hidl.manager-V1.0-java),\
+    $(foreach lib, $(my_dexpreopt_libs), \
       $(call intermediates-dir-for,JAVA_LIBRARIES,$(lib),,COMMON)/javalib.jar)
-  my_dexpreopt_deps += $(my_dexpreopt_images)
+  my_dexpreopt_deps += $(my_dexpreopt_images_deps)
   my_dexpreopt_deps += $(DEXPREOPT_BOOTCLASSPATH_DEX_FILES)
 
   $(my_dexpreopt_zip): PRIVATE_MODULE := $(LOCAL_MODULE)
@@ -280,7 +299,7 @@
     for i in $$(zipinfo -1 $(my_dexpreopt_zip)); \
       do mkdir -p $(PRODUCT_OUT)/$$(dirname $$i); \
     done && \
-    ( unzip -qo -d $(PRODUCT_OUT) $(my_dexpreopt_zip) 2>&1 | grep -v "zipfile is empty"; exit $${PIPESTATUS[0]} ) || \
+    ( unzip -qoDD -d $(PRODUCT_OUT) $(my_dexpreopt_zip) 2>&1 | grep -v "zipfile is empty"; exit $${PIPESTATUS[0]} ) || \
       ( code=$$?; if [ $$code -ne 0 -a $$code -ne 1 ]; then exit $$code; fi )
 
   $(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD := $(LOCAL_POST_INSTALL_CMD)
@@ -290,6 +309,5 @@
 
   my_dexpreopt_config :=
   my_dexpreopt_script :=
-  my_strip_script :=
   my_dexpreopt_zip :=
 endif # LOCAL_DEX_PREOPT
diff --git a/core/dpi_specific_apk.mk b/core/dpi_specific_apk.mk
deleted file mode 100644
index ad073c7..0000000
--- a/core/dpi_specific_apk.mk
+++ /dev/null
@@ -1,77 +0,0 @@
-# Set up rules to build dpi-specific apk, with whatever else from the base apk.
-# Input variable: my_dpi, and all other variables set up in package_internal.mk.
-#
-
-dpi_apk_name := $(LOCAL_MODULE)_$(my_dpi)
-dpi_intermediate := $(call intermediates-dir-for,APPS,$(dpi_apk_name))
-built_dpi_apk := $(dpi_intermediate)/package.apk
-additional_certificates := $(foreach c,$(LOCAL_ADDITIONAL_CERTIFICATES), $(c).x509.pem $(c).pk8)
-
-# Set up all the target-specific variables.
-$(built_dpi_apk): PRIVATE_MODULE := $(dpi_apk_name)
-$(built_dpi_apk): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) --pseudo-localize $($(LOCAL_PACKAGE_NAME)_aapt_flags_$(my_dpi))
-# Clear PRIVATE_PRODUCT_AAPT_CONFIG to include everything by default.
-$(built_dpi_apk): PRIVATE_PRODUCT_AAPT_CONFIG :=
-$(built_dpi_apk): PRIVATE_PRODUCT_AAPT_PREF_CONFIG := $(my_dpi)
-$(built_dpi_apk): PRIVATE_ANDROID_MANIFEST := $(full_android_manifest)
-$(built_dpi_apk): PRIVATE_RESOURCE_DIR := $(LOCAL_RESOURCE_DIR)
-$(built_dpi_apk): PRIVATE_ASSET_DIR := $(LOCAL_ASSET_DIR)
-$(built_dpi_apk): PRIVATE_AAPT_INCLUDES := $(all_library_res_package_exports)
-$(built_dpi_apk): PRIVATE_RESOURCE_LIST := $(all_res_assets)
-$(built_dpi_apk): PRIVATE_DEFAULT_APP_TARGET_SDK := $(call module-target-sdk-version)
-$(built_dpi_apk): PRIVATE_MANIFEST_PACKAGE_NAME := $(LOCAL_MANIFEST_PACKAGE_NAME)
-$(built_dpi_apk): PRIVATE_MANIFEST_INSTRUMENTATION_FOR := $(LOCAL_INSTRUMENTATION_FOR)
-$(built_dpi_apk): PRIVATE_JNI_SHARED_LIBRARIES := $(jni_shared_libraries_with_abis)
-$(built_dpi_apk): PRIVATE_JNI_SHARED_LIBRARIES_ABI := $(jni_shared_libraries_abis)
-$(built_dpi_apk): PRIVATE_PRIVATE_KEY := $(private_key)
-$(built_dpi_apk): PRIVATE_CERTIFICATE := $(certificate)
-$(built_dpi_apk): $(additional_certificates)
-$(built_dpi_apk): PRIVATE_ADDITIONAL_CERTIFICATES := $(additional_certificates)
-
-$(built_dpi_apk): PRIVATE_SOURCE_ARCHIVE :=
-ifneq ($(full_classes_jar),)
-$(built_dpi_apk): PRIVATE_DEX_FILE := $(built_dex)
-# Use the jarjar processed arhive as the initial package file.
-$(built_dpi_apk): PRIVATE_SOURCE_ARCHIVE := $(full_classes_pre_proguard_jar)
-$(built_dpi_apk): $(built_dex)
-else
-$(built_dpi_apk): PRIVATE_DEX_FILE :=
-endif # full_classes_jar
-
-# Set up dependenncies and the build recipe.
-$(built_dpi_apk) : $(R_file_stamp)
-$(built_dpi_apk) : $(all_library_res_package_export_deps)
-$(built_dpi_apk) : $(private_key) $(certificate) $(SIGNAPK_JAR)
-$(built_dpi_apk) : $(AAPT)
-$(built_dpi_apk) : $(MERGE_ZIPS) $(SOONG_ZIP) $(ZIP2ZIP)
-$(built_dpi_apk) : $(all_res_assets) $(jni_shared_libraries) $(full_android_manifest)
-	@echo "target Package: $(PRIVATE_MODULE) ($@)"
-	rm -rf $@.parts
-	mkdir -p $@.parts
-	$(call create-assets-package,$@.parts/apk.zip)
-ifneq ($(jni_shared_libraries),)
-	$(call create-jni-shared-libs-package,$@.parts/jni.zip)
-endif
-ifeq ($(full_classes_jar),)
-# We don't build jar, need to add the Java resources here.
-	$(if $(PRIVATE_EXTRA_JAR_ARGS),$(call create-java-resources-jar,$@.parts/res.zip))
-else
-	$(call create-dex-jar,$@.parts/dex.zip,$(PRIVATE_DEX_FILE))
-	$(call extract-resources-jar,$@.parts/res.zip,$(PRIVATE_SOURCE_ARCHIVE))
-endif
-	$(MERGE_ZIPS) $@ $@.parts/*.zip
-	rm -rf $@.parts
-	$(sign-package)
-
-# Set up global variables to register this apk to the higher-level dependency graph.
-ALL_MODULES += $(dpi_apk_name)
-ALL_MODULES.$(dpi_apk_name).CLASS := APPS
-ALL_MODULES.$(dpi_apk_name).BUILT := $(built_dpi_apk)
-ALL_MODULES.$(dpi_apk_name).TARGET_BUILT := $(built_dpi_apk)
-PACKAGES := $(PACKAGES) $(dpi_apk_name)
-PACKAGES.$(dpi_apk_name).PRIVATE_KEY := $(private_key)
-PACKAGES.$(dpi_apk_name).CERTIFICATE := $(certificate)
-
-# Phony targets used by "apps_only".
-.PHONY: $(dpi_apk_name)
-$(dpi_apk_name) : $(built_dpi_apk)
diff --git a/core/dumpvar.mk b/core/dumpvar.mk
index 59efb04..b2ee8fd 100644
--- a/core/dumpvar.mk
+++ b/core/dumpvar.mk
@@ -17,6 +17,7 @@
 ANDROID_BUILD_PATHS := $(ABP)
 ANDROID_PREBUILTS := prebuilt/$(HOST_PREBUILT_TAG)
 ANDROID_GCC_PREBUILTS := prebuilts/gcc/$(HOST_PREBUILT_TAG)
+ANDROID_CLANG_PREBUILTS := prebuilts/clang/host/$(HOST_PREBUILT_TAG)
 
 # Dump mulitple variables to "<var>=<value>" pairs, one per line.
 # The output may be executed as bash script.
@@ -26,6 +27,6 @@
 .PHONY: dump-many-vars
 dump-many-vars :
 	@$(foreach v, $(DUMP_MANY_VARS),\
-	  echo "$(DUMP_VAR_PREFIX)$(v)='$($(v))'";)
+	  printf "%s='%s'\n" '$(DUMP_VAR_PREFIX)$(v)' '$($(v))';)
 
 endif # CALLED_FROM_SETUP
diff --git a/core/dynamic_binary.mk b/core/dynamic_binary.mk
index 0accdc0..48072b3 100644
--- a/core/dynamic_binary.mk
+++ b/core/dynamic_binary.mk
@@ -39,6 +39,17 @@
 include $(BUILD_SYSTEM)/binary.mk
 ###################################
 
+ifdef LOCAL_INJECT_BSSL_HASH
+inject_module := $(intermediates)/INJECT_BSSL_HASH/$(notdir $(my_installed_module_stem))
+LOCAL_INTERMEDIATE_TARGETS += $(inject_module)
+$(inject_module): $(SOONG_HOST_OUT)/bin/bssl_inject_hash
+$(inject_module): $(linked_module)
+	@echo "target inject BSSL hash: $(PRIVATE_MODULE) ($@)"
+	$(SOONG_HOST_OUT)/bin/bssl_inject_hash -in-object $< -o $@
+else
+inject_module := $(linked_module)
+endif
+
 ###########################################################
 ## Store a copy with symbols for symbolic debugging
 ###########################################################
@@ -47,7 +58,7 @@
 else
 my_unstripped_path := $(LOCAL_UNSTRIPPED_PATH)
 endif
-symbolic_input := $(linked_module)
+symbolic_input := $(inject_module)
 symbolic_output := $(my_unstripped_path)/$(my_installed_module_stem)
 $(symbolic_output) : $(symbolic_input)
 	@echo "target Symbolic: $(PRIVATE_MODULE) ($@)"
@@ -59,7 +70,7 @@
 
 ifeq ($(BREAKPAD_GENERATE_SYMBOLS),true)
 my_breakpad_path := $(TARGET_OUT_BREAKPAD)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
-breakpad_input := $(linked_module)
+breakpad_input := $(inject_module)
 breakpad_output := $(my_breakpad_path)/$(my_installed_module_stem).sym
 $(breakpad_output) : $(breakpad_input) | $(BREAKPAD_DUMP_SYMS) $(PRIVATE_READELF)
 	@echo "target breakpad: $(PRIVATE_MODULE) ($@)"
@@ -121,8 +132,8 @@
 	CLANG_BIN=$(LLVM_PREBUILTS_PATH) \
 	CROSS_COMPILE=$(PRIVATE_TOOLS_PREFIX) \
 	XZ=$(XZ) \
-	$(SOONG_STRIP_PATH) -i $< -o $@ -d $@.d $(PRIVATE_STRIP_ARGS)
-  $(call include-depfile,$(strip_output).d)
+	$(SOONG_STRIP_PATH) -i $< -o $@ -d $@.strip.d $(PRIVATE_STRIP_ARGS)
+  $(call include-depfile,$(strip_output).strip.d,$(strip_output))
 else
   # Don't strip the binary, just copy it.  We can't skip this step
   # because a copy of the binary must appear at LOCAL_BUILT_MODULE.
@@ -133,6 +144,7 @@
 
 $(cleantarget): PRIVATE_CLEAN_FILES += \
     $(linked_module) \
+    $(inject_module) \
     $(breakpad_output) \
     $(symbolic_output) \
     $(strip_output)
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 5131598..f4650f9 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -82,8 +82,6 @@
 
 # ---------------------------------------------------------------
 # The product defaults to generic on hardware
-# NOTE: This will be overridden in product_config.mk if make
-# was invoked with a PRODUCT-xxx-yyy goal.
 ifeq ($(TARGET_PRODUCT),)
 TARGET_PRODUCT := aosp_arm
 endif
@@ -94,6 +92,13 @@
 TARGET_BUILD_VARIANT := eng
 endif
 
+TARGET_BUILD_APPS ?=
+
+.KATI_READONLY := \
+  TARGET_PRODUCT \
+  TARGET_BUILD_VARIANT \
+  TARGET_BUILD_APPS
+
 # ---------------------------------------------------------------
 # Set up configuration for host machine.  We don't do cross-
 # compiles except for arm/mips, so the HOST is whatever we are
@@ -106,9 +111,6 @@
 ifneq (,$(findstring Darwin,$(UNAME)))
   HOST_OS := darwin
 endif
-ifneq (,$(findstring Macintosh,$(UNAME)))
-  HOST_OS := darwin
-endif
 
 HOST_OS_EXTRA := $(shell uname -rsm)
 ifeq ($(HOST_OS),linux)
@@ -226,6 +228,8 @@
 TARGET_COPY_OUT_OEM := oem
 TARGET_COPY_OUT_RAMDISK := ramdisk
 TARGET_COPY_OUT_DEBUG_RAMDISK := debug_ramdisk
+TARGET_COPY_OUT_VENDOR_DEBUG_RAMDISK := vendor_debug_ramdisk
+TARGET_COPY_OUT_TEST_HARNESS_RAMDISK := test_harness_ramdisk
 TARGET_COPY_OUT_ROOT := root
 TARGET_COPY_OUT_RECOVERY := recovery
 # The directory used for optional partitions depend on the BoardConfig, so
@@ -233,11 +237,15 @@
 # BoardConfig, to be either the partition dir, or a subdir within 'system'.
 _vendor_path_placeholder := ||VENDOR-PATH-PH||
 _product_path_placeholder := ||PRODUCT-PATH-PH||
-_product_services_path_placeholder := ||PRODUCT_SERVICES-PATH-PH||
+_system_ext_path_placeholder := ||SYSTEM_EXT-PATH-PH||
 _odm_path_placeholder := ||ODM-PATH-PH||
 TARGET_COPY_OUT_VENDOR := $(_vendor_path_placeholder)
+TARGET_COPY_OUT_VENDOR_RAMDISK := vendor-ramdisk
 TARGET_COPY_OUT_PRODUCT := $(_product_path_placeholder)
-TARGET_COPY_OUT_PRODUCT_SERVICES := $(_product_services_path_placeholder)
+# TODO(b/135957588) TARGET_COPY_OUT_PRODUCT_SERVICES will copy the target to
+# product
+TARGET_COPY_OUT_PRODUCT_SERVICES := $(_product_path_placeholder)
+TARGET_COPY_OUT_SYSTEM_EXT := $(_system_ext_path_placeholder)
 TARGET_COPY_OUT_ODM := $(_odm_path_placeholder)
 
 # Returns the non-sanitized version of the path provided in $1.
@@ -248,19 +256,9 @@
 #################################################################
 # Set up minimal BOOTCLASSPATH list of jars to build/execute
 # java code with dalvikvm/art.
-# Jars present in the runtime apex. These should match exactly the list of
-# Java libraries in the runtime apex build rule.
-RUNTIME_APEX_JARS := core-oj core-libart okhttp bouncycastle apache-xml
-TARGET_CORE_JARS := $(RUNTIME_APEX_JARS) conscrypt
-ifeq ($(EMMA_INSTRUMENT),true)
-  ifneq ($(EMMA_INSTRUMENT_STATIC),true)
-    # For instrumented build, if Jacoco is not being included statically
-    # in instrumented packages then include Jacoco classes into the
-    # bootclasspath.
-    TARGET_CORE_JARS += jacocoagent
-  endif # EMMA_INSTRUMENT_STATIC
-endif # EMMA_INSTRUMENT
-HOST_CORE_JARS := $(addsuffix -hostdex,$(TARGET_CORE_JARS))
+# Jars present in the ART apex. These should match exactly the list of
+# Java libraries in the ART apex build rule.
+ART_APEX_JARS := core-oj core-libart core-icu4j okhttp bouncycastle apache-xml
 #################################################################
 
 # Read the product specs so we can get TARGET_DEVICE and other
@@ -323,6 +321,7 @@
 
 HOST_OUT_EXECUTABLES := $(HOST_OUT)/bin
 HOST_OUT_SHARED_LIBRARIES := $(HOST_OUT)/lib64
+HOST_OUT_DYLIB_LIBRARIES := $(HOST_OUT)/lib64
 HOST_OUT_RENDERSCRIPT_BITCODE := $(HOST_OUT_SHARED_LIBRARIES)
 HOST_OUT_JAVA_LIBRARIES := $(HOST_OUT)/framework
 HOST_OUT_SDK_ADDON := $(HOST_OUT)/sdk_addon
@@ -494,12 +493,7 @@
 .KATI_READONLY := TARGET_OUT_SYSTEM_OTHER
 
 # Out for TARGET_2ND_ARCH
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-# With this you can reference the arm binary translation library with libfoo_arm in PRODUCT_PACKAGES.
-TARGET_2ND_ARCH_MODULE_SUFFIX := _$(TARGET_2ND_ARCH)
-else
 TARGET_2ND_ARCH_MODULE_SUFFIX := $(HOST_2ND_ARCH_MODULE_SUFFIX)
-endif
 .KATI_READONLY := TARGET_2ND_ARCH_MODULE_SUFFIX
 
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
@@ -507,11 +501,7 @@
 else
   $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_INTERMEDIATES := $(PRODUCT_OUT)/obj_$(TARGET_2ND_ARCH)
 endif
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SHARED_LIBRARIES := $(target_out_shared_libraries_base)/lib/$(TARGET_2ND_ARCH)
-else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SHARED_LIBRARIES := $(target_out_shared_libraries_base)/lib
-endif
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_RENDERSCRIPT_BITCODE := $($(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SHARED_LIBRARIES)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_EXECUTABLES := $(TARGET_OUT_EXECUTABLES)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_APPS := $(TARGET_OUT_APPS)
@@ -576,17 +566,10 @@
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_EXECUTABLES := $(TARGET_OUT_DATA_EXECUTABLES)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_SHARED_LIBRARIES := $($(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SHARED_LIBRARIES)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_APPS := $(TARGET_OUT_DATA_APPS)
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest/$(TARGET_2ND_ARCH)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest/$(TARGET_2ND_ARCH)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest/$(TARGET_2ND_ARCH)$(TARGET_VENDOR_TEST_SUFFIX)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest/$(TARGET_2ND_ARCH)$(TARGET_VENDOR_TEST_SUFFIX)
-else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_NATIVE_TESTS := $(TARGET_OUT_DATA)/nativetest$(TARGET_VENDOR_TEST_SUFFIX)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_METRIC_TESTS := $(TARGET_OUT_DATA)/benchmarktest$(TARGET_VENDOR_TEST_SUFFIX)
-endif
 .KATI_READONLY := \
   $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_EXECUTABLES \
   $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_SHARED_LIBRARIES \
@@ -638,11 +621,7 @@
   TARGET_OUT_VENDOR_ETC
 
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_EXECUTABLES := $(TARGET_OUT_VENDOR_EXECUTABLES)
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_SHARED_LIBRARIES := $(target_out_vendor_shared_libraries_base)/lib/$(TARGET_2ND_ARCH)
-else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_SHARED_LIBRARIES := $(target_out_vendor_shared_libraries_base)/lib
-endif
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_RENDERSCRIPT_BITCODE := $($(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_SHARED_LIBRARIES)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_APPS := $(TARGET_OUT_VENDOR_APPS)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_APPS_PRIVILEGED := $(TARGET_OUT_VENDOR_APPS_PRIVILEGED)
@@ -672,11 +651,7 @@
   TARGET_OUT_OEM_ETC
 
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_OEM_EXECUTABLES := $(TARGET_OUT_OEM_EXECUTABLES)
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_OEM_SHARED_LIBRARIES := $(TARGET_OUT_OEM)/lib/$(TARGET_2ND_ARCH)
-else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_OEM_SHARED_LIBRARIES := $(TARGET_OUT_OEM)/lib
-endif
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_OEM_APPS := $(TARGET_OUT_OEM_APPS)
 .KATI_READONLY := \
   $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_OEM_EXECUTABLES \
@@ -722,11 +697,7 @@
   TARGET_OUT_ODM_ETC
 
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_EXECUTABLES := $(TARGET_OUT_ODM_EXECUTABLES)
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_SHARED_LIBRARIES := $(target_out_odm_shared_libraries_base)/lib/$(TARGET_2ND_ARCH)
-else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_SHARED_LIBRARIES := $(target_out_odm_shared_libraries_base)/lib
-endif
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_RENDERSCRIPT_BITCODE := $($(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_SHARED_LIBRARIES)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_APPS := $(TARGET_OUT_ODM_APPS)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_ODM_APPS_PRIVILEGED := $(TARGET_OUT_ODM_APPS_PRIVILEGED)
@@ -772,11 +743,7 @@
   TARGET_OUT_PRODUCT_ETC
 
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_EXECUTABLES := $(TARGET_OUT_PRODUCT_EXECUTABLES)
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_SHARED_LIBRARIES := $(target_out_product_shared_libraries_base)/lib/$(TARGET_2ND_ARCH)
-else
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_SHARED_LIBRARIES := $(target_out_product_shared_libraries_base)/lib
-endif
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_APPS := $(TARGET_OUT_PRODUCT_APPS)
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_APPS_PRIVILEGED := $(TARGET_OUT_PRODUCT_APPS_PRIVILEGED)
 .KATI_READONLY := \
@@ -785,38 +752,48 @@
   $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_APPS \
   $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_APPS_PRIVILEGED
 
-TARGET_OUT_PRODUCT_SERVICES := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_PRODUCT_SERVICES)
+TARGET_OUT_SYSTEM_EXT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_SYSTEM_EXT)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
-target_out_product_services_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/$(TARGET_COPY_OUT_PRODUCT_SERVICES)
+target_out_system_ext_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/$(TARGET_COPY_OUT_SYSTEM_EXT)
 ifeq ($(SANITIZE_LITE),true)
 # When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
 # work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
-target_out_product_services_app_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/$(TARGET_COPY_OUT_PRODUCT_SERVICES)
+target_out_system_ext_app_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/$(TARGET_COPY_OUT_SYSTEM_EXT)
 else
-target_out_product_services_app_base := $(TARGET_OUT_PRODUCT_SERVICES)
+target_out_system_ext_app_base := $(TARGET_OUT_SYSTEM_EXT)
 endif
 else
-target_out_product_services_shared_libraries_base := $(TARGET_OUT_PRODUCT_SERVICES)
-target_out_product_services_app_base := $(TARGET_OUT_PRODUCT_SERVICES)
+target_out_system_ext_shared_libraries_base := $(TARGET_OUT_SYSTEM_EXT)
+target_out_system_ext_app_base := $(TARGET_OUT_SYSTEM_EXT)
 endif
 
 ifeq ($(TARGET_IS_64_BIT),true)
-TARGET_OUT_PRODUCT_SERVICES_SHARED_LIBRARIES := $(target_out_product_services_shared_libraries_base)/lib64
+TARGET_OUT_SYSTEM_EXT_SHARED_LIBRARIES := $(target_out_system_ext_shared_libraries_base)/lib64
 else
-TARGET_OUT_PRODUCT_SERVICES_SHARED_LIBRARIES := $(target_out_product_services_shared_libraries_base)/lib
+TARGET_OUT_SYSTEM_EXT_SHARED_LIBRARIES := $(target_out_system_ext_shared_libraries_base)/lib
 endif
-TARGET_OUT_PRODUCT_SERVICES_JAVA_LIBRARIES:= $(TARGET_OUT_PRODUCT_SERVICES)/framework
-TARGET_OUT_PRODUCT_SERVICES_APPS := $(target_out_product_services_app_base)/app
-TARGET_OUT_PRODUCT_SERVICES_APPS_PRIVILEGED := $(target_out_product_services_app_base)/priv-app
-TARGET_OUT_PRODUCT_SERVICES_ETC := $(TARGET_OUT_PRODUCT_SERVICES)/etc
+TARGET_OUT_SYSTEM_EXT_JAVA_LIBRARIES:= $(TARGET_OUT_SYSTEM_EXT)/framework
+TARGET_OUT_SYSTEM_EXT_APPS := $(target_out_system_ext_app_base)/app
+TARGET_OUT_SYSTEM_EXT_APPS_PRIVILEGED := $(target_out_system_ext_app_base)/priv-app
+TARGET_OUT_SYSTEM_EXT_ETC := $(TARGET_OUT_SYSTEM_EXT)/etc
+TARGET_OUT_SYSTEM_EXT_EXECUTABLES := $(TARGET_OUT_SYSTEM_EXT)/bin
+.KATI_READONLY := \
+  TARGET_OUT_SYSTEM_EXT_EXECUTABLES \
+  TARGET_OUT_SYSTEM_EXT_SHARED_LIBRARIES \
+  TARGET_OUT_SYSTEM_EXT_JAVA_LIBRARIES \
+  TARGET_OUT_SYSTEM_EXT_APPS \
+  TARGET_OUT_SYSTEM_EXT_APPS_PRIVILEGED \
+  TARGET_OUT_SYSTEM_EXT_ETC
 
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_SERVICES_SHARED_LIBRARIES := $(target_out_product_services_shared_libraries_base)/lib/$(TARGET_2ND_ARCH)
-else
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_SERVICES_SHARED_LIBRARIES := $(target_out_product_services_shared_libraries_base)/lib
-endif
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_SERVICES_APPS := $(TARGET_OUT_PRODUCT_SERVICES_APPS)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_PRODUCT_SERVICES_APPS_PRIVILEGED := $(TARGET_OUT_PRODUCT_SERVICES_APPS_PRIVILEGED)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_EXECUTABLES := $(TARGET_OUT_SYSTEM_EXT_EXECUTABLES)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_SHARED_LIBRARIES := $(target_out_system_ext_shared_libraries_base)/lib
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_APPS := $(TARGET_OUT_SYSTEM_EXT_APPS)
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_APPS_PRIVILEGED := $(TARGET_OUT_SYSTEM_EXT_APPS_PRIVILEGED)
+.KATI_READONLY := \
+  $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_EXECUTABLES \
+  $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_SHARED_LIBRARIES \
+  $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_APPS \
+  $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_SYSTEM_EXT_APPS_PRIVILEGED
 
 TARGET_OUT_BREAKPAD := $(PRODUCT_OUT)/breakpad
 .KATI_READONLY := TARGET_OUT_BREAKPAD
@@ -826,7 +803,6 @@
 TARGET_OUT_SHARED_LIBRARIES_UNSTRIPPED := $(TARGET_OUT_UNSTRIPPED)/system/lib
 TARGET_OUT_VENDOR_SHARED_LIBRARIES_UNSTRIPPED := $(TARGET_OUT_UNSTRIPPED)/$(TARGET_COPY_OUT_VENDOR)/lib
 TARGET_ROOT_OUT_UNSTRIPPED := $(TARGET_OUT_UNSTRIPPED)
-TARGET_ROOT_OUT_SBIN_UNSTRIPPED := $(TARGET_OUT_UNSTRIPPED)/sbin
 TARGET_ROOT_OUT_BIN_UNSTRIPPED := $(TARGET_OUT_UNSTRIPPED)/bin
 TARGET_OUT_COVERAGE := $(PRODUCT_OUT)/coverage
 .KATI_READONLY := \
@@ -835,23 +811,24 @@
   TARGET_OUT_SHARED_LIBRARIES_UNSTRIPPED \
   TARGET_OUT_VENDOR_SHARED_LIBRARIES_UNSTRIPPED \
   TARGET_ROOT_OUT_UNSTRIPPED \
-  TARGET_ROOT_OUT_SBIN_UNSTRIPPED \
   TARGET_ROOT_OUT_BIN_UNSTRIPPED \
   TARGET_OUT_COVERAGE
 
 TARGET_RAMDISK_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_RAMDISK)
 TARGET_RAMDISK_OUT_UNSTRIPPED := $(TARGET_OUT_UNSTRIPPED)
 TARGET_DEBUG_RAMDISK_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_DEBUG_RAMDISK)
+TARGET_VENDOR_DEBUG_RAMDISK_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_VENDOR_DEBUG_RAMDISK)
+TARGET_TEST_HARNESS_RAMDISK_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_TEST_HARNESS_RAMDISK)
+
+TARGET_VENDOR_RAMDISK_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_VENDOR_RAMDISK)
 
 TARGET_ROOT_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ROOT)
 TARGET_ROOT_OUT_BIN := $(TARGET_ROOT_OUT)/bin
-TARGET_ROOT_OUT_SBIN := $(TARGET_ROOT_OUT)/sbin
 TARGET_ROOT_OUT_ETC := $(TARGET_ROOT_OUT)/etc
 TARGET_ROOT_OUT_USR := $(TARGET_ROOT_OUT)/usr
 .KATI_READONLY := \
   TARGET_ROOT_OUT \
   TARGET_ROOT_OUT_BIN \
-  TARGET_ROOT_OUT_SBIN \
   TARGET_ROOT_OUT_ETC \
   TARGET_ROOT_OUT_USR
 
@@ -879,8 +856,8 @@
   TARGET_INSTALLER_ROOT_OUT \
   TARGET_INSTALLER_SYSTEM_OUT
 
-COMMON_MODULE_CLASSES := TARGET-NOTICE_FILES HOST-NOTICE_FILES HOST-JAVA_LIBRARIES
-PER_ARCH_MODULE_CLASSES := SHARED_LIBRARIES STATIC_LIBRARIES EXECUTABLES GYP RENDERSCRIPT_BITCODE NATIVE_TESTS HEADER_LIBRARIES
+COMMON_MODULE_CLASSES := TARGET_NOTICE_FILES HOST_NOTICE_FILES HOST_JAVA_LIBRARIES
+PER_ARCH_MODULE_CLASSES := SHARED_LIBRARIES STATIC_LIBRARIES EXECUTABLES GYP RENDERSCRIPT_BITCODE NATIVE_TESTS HEADER_LIBRARIES RLIB_LIBRARIES DYLIB_LIBRARIES
 .KATI_READONLY := COMMON_MODULE_CLASSES PER_ARCH_MODULE_CLASSES
 
 ifeq ($(CALLED_FROM_SETUP),true)
diff --git a/core/executable.mk b/core/executable.mk
index e71ff33..db8dcc6 100644
--- a/core/executable.mk
+++ b/core/executable.mk
@@ -6,6 +6,10 @@
 # LOCAL_MODULE_PATH_32 and LOCAL_MODULE_PATH_64 or LOCAL_MODULE_STEM_32 and
 # LOCAL_MODULE_STEM_64
 
+ifdef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,BUILD_EXECUTABLE is incompatible with LOCAL_IS_HOST_MODULE. Use BUILD_HOST_EXECUTABLE instead.)
+endif
+
 my_skip_this_target :=
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
   ifeq (true,$(LOCAL_FORCE_STATIC_EXECUTABLE))
@@ -20,15 +24,6 @@
 ifneq (true,$(my_skip_this_target))
 $(call record-module-type,EXECUTABLE)
 
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-# If a native test explicity specifies to build only for the translation arch,
-# we'll still need LOCAL_MULTILIB=both and let module_arch_supported.mk choose
-# to build only for TARGET_2ND_ARCH.
-ifneq (1,$(words $(LOCAL_MODULE_TARGET_ARCH)))
-LOCAL_MULTILIB := first
-endif
-endif
-
 my_prefix := TARGET_
 include $(BUILD_SYSTEM)/multilib.mk
 
diff --git a/core/executable_internal.mk b/core/executable_internal.mk
index 558e49b..32e56dd 100644
--- a/core/executable_internal.mk
+++ b/core/executable_internal.mk
@@ -41,11 +41,6 @@
 else
 my_target_libcrt_builtins := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LIBCRT_BUILTINS)
 endif
-ifeq ($(LOCAL_NO_LIBGCC),true)
-my_target_libgcc :=
-else
-my_target_libgcc := $(call intermediates-dir-for,STATIC_LIBRARIES,libgcc,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libgcc.a
-endif
 my_target_libatomic := $(call intermediates-dir-for,STATIC_LIBRARIES,libatomic,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libatomic.a
 ifeq ($(LOCAL_NO_CRT),true)
 my_target_crtbegin_dynamic_o :=
@@ -66,7 +61,6 @@
 my_target_crtend_o := $(wildcard $(my_ndk_sysroot_lib)/crtend_android.o)
 endif
 $(linked_module): PRIVATE_TARGET_LIBCRT_BUILTINS := $(my_target_libcrt_builtins)
-$(linked_module): PRIVATE_TARGET_LIBGCC := $(my_target_libgcc)
 $(linked_module): PRIVATE_TARGET_LIBATOMIC := $(my_target_libatomic)
 $(linked_module): PRIVATE_TARGET_CRTBEGIN_DYNAMIC_O := $(my_target_crtbegin_dynamic_o)
 $(linked_module): PRIVATE_TARGET_CRTBEGIN_STATIC_O := $(my_target_crtbegin_static_o)
@@ -74,11 +68,11 @@
 $(linked_module): PRIVATE_POST_LINK_CMD := $(LOCAL_POST_LINK_CMD)
 
 ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
-$(linked_module): $(my_target_crtbegin_static_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libgcc) $(my_target_libatomic)
+$(linked_module): $(my_target_crtbegin_static_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libatomic) $(CLANG_CXX)
 	$(transform-o-to-static-executable)
 	$(PRIVATE_POST_LINK_CMD)
 else
-$(linked_module): $(my_target_crtbegin_dynamic_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libgcc) $(my_target_libatomic)
+$(linked_module): $(my_target_crtbegin_dynamic_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libatomic) $(CLANG_CXX)
 	$(transform-o-to-executable)
 	$(PRIVATE_POST_LINK_CMD)
 endif
diff --git a/core/force_aapt2.mk b/core/force_aapt2.mk
index db2e60f..25b45e4 100644
--- a/core/force_aapt2.mk
+++ b/core/force_aapt2.mk
@@ -14,50 +14,40 @@
 # limitations under the License.
 #
 
-# Including this makefile will force AAPT2 on if FORCE_AAPT2==true,
+# Including this makefile will force AAPT2 on,
 # rewriting some properties to convert standard AAPT usage to AAPT2.
 
-ifneq ($(FORCE_AAPT2),false)
-  ifeq ($(LOCAL_USE_AAPT2),)
-    # Force AAPT2 on
-    LOCAL_USE_AAPT2 := true
-    # Filter out support library resources
-    LOCAL_RESOURCE_DIR := $(filter-out \
-      prebuilts/sdk/current/% \
-      frameworks/support/%,\
-        $(LOCAL_RESOURCE_DIR))
-    # Filter out unnecessary aapt flags
-    ifneq (,$(filter --extra-packages,$(LOCAL_AAPT_FLAGS)))
-      LOCAL_AAPT_FLAGS := $(subst --extra-packages=,--extra-packages$(space), \
-        $(filter-out \
-          --extra-packages=android.support.% \
-          --extra-packages=androidx.%, \
-            $(subst --extra-packages$(space),--extra-packages=,$(LOCAL_AAPT_FLAGS))))
-        ifeq (,$(filter --extra-packages,$(LOCAL_AAPT_FLAGS)))
-          LOCAL_AAPT_FLAGS := $(filter-out --auto-add-overlay,$(LOCAL_AAPT_FLAGS))
-        endif
-    endif
-
-    # AAPT2 is pickier about missing resources.  Support library may have references to resources
-    # added in current, so always treat LOCAL_SDK_VERSION as LOCAL_SDK_RES_VERSION := current.
-    ifdef LOCAL_SDK_VERSION
-      LOCAL_SDK_RES_VERSION := current
-    endif
-
-    ifeq (,$(strip $(LOCAL_MANIFEST_FILE)$(LOCAL_FULL_MANIFEST_FILE)))
-      ifeq (,$(wildcard $(LOCAL_PATH)/AndroidManifest.xml))
-        # work around missing manifests by creating a default one
-        LOCAL_FULL_MANIFEST_FILE := $(call local-intermediates-dir,COMMON)/DefaultManifest.xml
-        $(call create-default-manifest-file,$(LOCAL_FULL_MANIFEST_FILE),$(call module-min-sdk-version))
-      endif
-    endif
-  endif
+ifeq ($(LOCAL_USE_AAPT2),false)
+  $(call pretty-error, LOCAL_USE_AAPT2 := false is no longer supported)
 endif
 
-ifneq ($(LOCAL_USE_AAPT2),true)
-  ifneq ($(LOCAL_USE_AAPT2),false)
-    ifneq ($(LOCAL_USE_AAPT2),)
-      $(call pretty-error,Invalid value for LOCAL_USE_AAPT2: "$(LOCAL_USE_AAPT2)")
+# Filter out support library resources
+LOCAL_RESOURCE_DIR := $(filter-out \
+  prebuilts/sdk/current/% \
+  frameworks/support/%,\
+    $(LOCAL_RESOURCE_DIR))
+# Filter out unnecessary aapt flags
+ifneq (,$(filter --extra-packages,$(LOCAL_AAPT_FLAGS)))
+  LOCAL_AAPT_FLAGS := $(subst --extra-packages=,--extra-packages$(space), \
+    $(filter-out \
+      --extra-packages=android.support.% \
+      --extra-packages=androidx.%, \
+        $(subst --extra-packages$(space),--extra-packages=,$(LOCAL_AAPT_FLAGS))))
+    ifeq (,$(filter --extra-packages,$(LOCAL_AAPT_FLAGS)))
+      LOCAL_AAPT_FLAGS := $(filter-out --auto-add-overlay,$(LOCAL_AAPT_FLAGS))
     endif
+endif
+
+# AAPT2 is pickier about missing resources.  Support library may have references to resources
+# added in current, so always treat LOCAL_SDK_VERSION := <number> as LOCAL_SDK_RES_VERSION := current.
+ifneq (,$(filter-out current system_current test_current core_current,$(LOCAL_SDK_VERSION)))
+  LOCAL_SDK_RES_VERSION := current
+endif
+
+ifeq (,$(strip $(LOCAL_MANIFEST_FILE)$(LOCAL_FULL_MANIFEST_FILE)))
+  ifeq (,$(wildcard $(LOCAL_PATH)/AndroidManifest.xml))
+    # work around missing manifests by creating a default one
+    LOCAL_FULL_MANIFEST_FILE := $(call local-intermediates-dir,COMMON)/DefaultManifest.xml
+    $(call create-default-manifest-file,$(LOCAL_FULL_MANIFEST_FILE),$(call module-min-sdk-version))
   endif
 endif
diff --git a/core/fuzz_test.mk b/core/fuzz_test.mk
index f3bf714..4a0fcfa 100644
--- a/core/fuzz_test.mk
+++ b/core/fuzz_test.mk
@@ -15,8 +15,7 @@
     my_fuzzer:=$(TARGET_FUZZ_ENGINE)
 endif
 
-
-LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
+LOCAL_SANITIZE += fuzzer
 
 ifeq ($(my_fuzzer),libFuzzer)
 LOCAL_STATIC_LIBRARIES += libFuzzer
@@ -68,12 +67,6 @@
 LOCAL_MODULE_PATH_64 := $(TARGET_OUT_DATA_NATIVE_TESTS)/fuzzers/$(my_fuzzer)/$(LOCAL_MODULE)
 LOCAL_MODULE_PATH_32 := $($(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_NATIVE_TESTS)/fuzzers/$(my_fuzzer)/$(LOCAL_MODULE)
 
-ifndef LOCAL_MULTILIB
-ifndef LOCAL_32_BIT_ONLY
-LOCAL_MULTILIB := 64
-endif
-endif
-
 ifndef LOCAL_STRIP_MODULE
 LOCAL_STRIP_MODULE := keep_symbols
 endif
diff --git a/core/generate_enforce_rro.mk b/core/generate_enforce_rro.mk
index f7877f2..6a23aeb 100644
--- a/core/generate_enforce_rro.mk
+++ b/core/generate_enforce_rro.mk
@@ -34,7 +34,6 @@
 endif
 
 LOCAL_FULL_MANIFEST_FILE := $(rro_android_manifest_file)
-LOCAL_CERTIFICATE := platform
 
 LOCAL_AAPT_FLAGS += --auto-add-overlay
 LOCAL_RESOURCE_DIR := $(enforce_rro_source_overlays)
diff --git a/core/host_dalvik_java_library.mk b/core/host_dalvik_java_library.mk
index 2a251e8..882fe3a 100644
--- a/core/host_dalvik_java_library.mk
+++ b/core/host_dalvik_java_library.mk
@@ -73,13 +73,13 @@
 java_sources_deps := \
     $(java_sources) \
     $(java_resource_sources) \
-    $(proto_java_sources_file_stamp) \
     $(LOCAL_SRCJARS) \
     $(LOCAL_ADDITIONAL_DEPENDENCIES)
 
 $(java_source_list_file): $(java_sources_deps)
 	$(write-java-source-list)
 
+$(full_classes_compiled_jar): .KATI_NINJA_POOL := $(GOMA_POOL)
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
@@ -104,7 +104,6 @@
 ifneq ($(TURBINE_ENABLED),false)
 
 $(full_classes_turbine_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
-$(full_classes_turbine_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
 $(full_classes_turbine_jar): PRIVATE_SRCJARS := $(LOCAL_SRCJARS)
 $(full_classes_turbine_jar): \
     $(java_source_list_file) \
@@ -142,7 +141,7 @@
             $(PRIVATE_JAR_MANIFEST) > $(dir $@)/manifest.mf)
 	$(MERGE_ZIPS) -j --ignore-duplicates $(if $(PRIVATE_JAR_MANIFEST),-m $(dir $@)/manifest.mf) \
             $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,-stripDir META-INF -zipToNotStrip $<) \
-            $@ $< $(call reverse-list,$(PRIVATE_STATIC_JAVA_LIBRARIES))
+            $@ $< $(PRIVATE_STATIC_JAVA_LIBRARIES)
 
 # Run jarjar if necessary, otherwise just copy the file.
 ifneq ($(strip $(LOCAL_JARJAR_RULES)),)
diff --git a/core/host_executable_internal.mk b/core/host_executable_internal.mk
index e72c419..0cf62a4 100644
--- a/core/host_executable_internal.mk
+++ b/core/host_executable_internal.mk
@@ -39,7 +39,7 @@
 endif
 my_libdir :=
 
-$(LOCAL_BUILT_MODULE): $(all_objects) $(all_libraries)
+$(LOCAL_BUILT_MODULE): $(all_objects) $(all_libraries) $(CLANG_CXX)
 	$(transform-host-o-to-executable)
 
 endif  # skip_build_from_source
diff --git a/core/host_fuzz_test.mk b/core/host_fuzz_test.mk
index 556e02f..54c6577 100644
--- a/core/host_fuzz_test.mk
+++ b/core/host_fuzz_test.mk
@@ -4,7 +4,7 @@
 ################################################
 $(call record-module-type,HOST_FUZZ_TEST)
 
-LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
+LOCAL_SANITIZE += fuzzer
 LOCAL_STATIC_LIBRARIES += libLLVMFuzzer
 
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index c8d2ee7..beaea2a 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -52,6 +52,8 @@
                 $(filter %.java,$(LOCAL_GENERATED_SOURCES))
 all_java_sources := $(java_sources)
 
+ALL_MODULES.$(my_register_name).SRCS := $(ALL_MODULES.$(my_register_name).SRCS) $(all_java_sources)
+
 include $(BUILD_SYSTEM)/java_common.mk
 
 # The layers file allows you to enforce a layering between java packages.
@@ -62,13 +64,13 @@
 java_sources_deps := \
     $(java_sources) \
     $(java_resource_sources) \
-    $(proto_java_sources_file_stamp) \
     $(LOCAL_SRCJARS) \
     $(LOCAL_ADDITIONAL_DEPENDENCIES)
 
 $(java_source_list_file): $(java_sources_deps)
 	$(write-java-source-list)
 
+$(full_classes_compiled_jar): .KATI_NINJA_POOL := $(GOMA_POOL)
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
@@ -95,13 +97,15 @@
 javac-check-$(LOCAL_MODULE) : $(full_classes_compiled_jar)
 .PHONY: javac-check-$(LOCAL_MODULE)
 
+$(full_classes_combined_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
 $(full_classes_combined_jar): $(full_classes_compiled_jar) \
                               $(jar_manifest_file) \
                               $(full_static_java_libs) | $(MERGE_ZIPS)
 	$(if $(PRIVATE_JAR_MANIFEST), $(hide) sed -e "s/%BUILD_NUMBER%/$(BUILD_NUMBER_FROM_FILE)/" \
             $(PRIVATE_JAR_MANIFEST) > $(dir $@)/manifest.mf)
 	$(MERGE_ZIPS) -j --ignore-duplicates $(if $(PRIVATE_JAR_MANIFEST),-m $(dir $@)/manifest.mf) \
-            -stripDir META-INF -zipToNotStrip $< $@ $< $(call reverse-list,$(PRIVATE_STATIC_JAVA_LIBRARIES))
+            $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,-stripDir META-INF -zipToNotStrip $<) \
+            $@ $< $(PRIVATE_STATIC_JAVA_LIBRARIES)
 
 # Run jarjar if necessary, otherwise just copy the file.
 ifneq ($(strip $(LOCAL_JARJAR_RULES)),)
diff --git a/core/host_shared_library.mk b/core/host_shared_library.mk
index 81236d1..fbe6442 100644
--- a/core/host_shared_library.mk
+++ b/core/host_shared_library.mk
@@ -37,4 +37,9 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(if $(filter true,$(BUILD_BROKEN_USES_BUILD_COPY_HEADERS)),\
+  $(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers),\
+  $(call pretty-error,LOCAL_COPY_HEADERS is obsolete. See $(CHANGES_URL)#copy_headers))
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/host_static_library.mk b/core/host_static_library.mk
index 469da29..23d809c 100644
--- a/core/host_static_library.mk
+++ b/core/host_static_library.mk
@@ -37,4 +37,9 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(if $(filter true,$(BUILD_BROKEN_USES_BUILD_COPY_HEADERS)),\
+  $(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers),\
+  $(call pretty-error,LOCAL_COPY_HEADERS is obsolete. See $(CHANGES_URL)#copy_headers))
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/host_static_test_lib.mk b/core/host_static_test_lib.mk
index a24cd62..a9e39b1 100644
--- a/core/host_static_test_lib.mk
+++ b/core/host_static_test_lib.mk
@@ -6,4 +6,4 @@
 
 include $(BUILD_SYSTEM)/host_test_internal.mk
 
-include $(BUILD_HOST_STATIC_LIBRARY)
+include $(BUILD_SYSTEM)/host_static_library.mk
diff --git a/core/install_jni_libs.mk b/core/install_jni_libs.mk
index 01f7f10..0fec9ca 100644
--- a/core/install_jni_libs.mk
+++ b/core/install_jni_libs.mk
@@ -13,10 +13,10 @@
 
 my_embed_jni :=
 ifneq ($(TARGET_BUILD_APPS),)
-my_embed_jni := true
+  my_embed_jni := true
 endif
 ifneq ($(filter tests samples, $(LOCAL_MODULE_TAGS)),)
-my_embed_jni := true
+  my_embed_jni := true
 endif
 
 # If the APK is not installed in one of the following partitions, force its libraries
@@ -26,16 +26,16 @@
     $(TARGET_OUT_VENDOR)/% \
     $(TARGET_OUT_OEM)/% \
     $(TARGET_OUT_PRODUCT)/% \
-    $(TARGET_OUT_PRODUCT_SERVICES)/% \
+    $(TARGET_OUT_SYSTEM_EXT)/% \
 
 ifeq ($(filter $(supported_partition_patterns),$(my_module_path)),)
-    my_embed_jni := true
+  my_embed_jni := true
 endif
 
 # If we're installing this APP as a compressed module, we include all JNI libraries
 # in the compressed artifact, rather than as separate files on the partition in question.
 ifdef LOCAL_COMPRESSED_MODULE
-my_embed_jni := true
+  my_embed_jni := true
 endif
 
 jni_shared_libraries :=
@@ -50,56 +50,56 @@
 my_add_jni :=
 # The module is built for TARGET_ARCH
 ifeq ($(my_2nd_arch_prefix),$(LOCAL_2ND_ARCH_VAR_PREFIX))
-my_add_jni := true
+  my_add_jni := true
 endif
 # Or it explicitly requires both
 ifeq ($(my_module_multilib),both)
-my_add_jni := true
+  my_add_jni := true
 endif
 ifeq ($(my_add_jni),true)
-my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS_$(TARGET_ARCH))
-ifndef my_prebuilt_jni_libs
-my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS)
-endif
-include $(BUILD_SYSTEM)/install_jni_libs_internal.mk
-jni_shared_libraries += $(my_jni_shared_libraries)
-jni_shared_libraries_abis += $(my_jni_shared_libraries_abi)
-jni_shared_libraries_with_abis += $(addprefix $(my_jni_shared_libraries_abi):,\
-    $(my_jni_shared_libraries))
-embedded_prebuilt_jni_libs += $(my_embedded_prebuilt_jni_libs)
+  my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS_$(TARGET_ARCH))
+  ifndef my_prebuilt_jni_libs
+    my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS)
+  endif
+  include $(BUILD_SYSTEM)/install_jni_libs_internal.mk
+  jni_shared_libraries += $(my_jni_shared_libraries)
+  jni_shared_libraries_abis += $(my_jni_shared_libraries_abi)
+  jni_shared_libraries_with_abis += $(addprefix $(my_jni_shared_libraries_abi):,\
+      $(my_jni_shared_libraries))
+  embedded_prebuilt_jni_libs += $(my_embedded_prebuilt_jni_libs)
 
-# Include RS dynamically-generated libraries as well
-# TODO: Add multilib support once RS supports generating multilib libraries.
-jni_shared_libraries += $(rs_compatibility_jni_libs)
-jni_shared_libraries_with_abis += $(addprefix $(my_jni_shared_libraries_abi):,\
-    $(rs_compatibility_jni_libs))
+  # Include RS dynamically-generated libraries as well
+  # TODO: Add multilib support once RS supports generating multilib libraries.
+  jni_shared_libraries += $(rs_compatibility_jni_libs)
+  jni_shared_libraries_with_abis += $(addprefix $(my_jni_shared_libraries_abi):,\
+      $(rs_compatibility_jni_libs))
 endif  # my_add_jni
 
 #######################################
 # For TARGET_2ND_ARCH
 ifdef TARGET_2ND_ARCH
-my_2nd_arch_prefix := $(TARGET_2ND_ARCH_VAR_PREFIX)
-my_add_jni :=
-# The module is built for TARGET_2ND_ARCH
-ifeq ($(my_2nd_arch_prefix),$(LOCAL_2ND_ARCH_VAR_PREFIX))
-my_add_jni := true
-endif
-# Or it explicitly requires both
-ifeq ($(my_module_multilib),both)
-my_add_jni := true
-endif
-ifeq ($(my_add_jni),true)
-my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS_$(TARGET_2ND_ARCH))
-ifndef my_prebuilt_jni_libs
-my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS)
-endif
-include $(BUILD_SYSTEM)/install_jni_libs_internal.mk
-jni_shared_libraries += $(my_jni_shared_libraries)
-jni_shared_libraries_abis += $(my_jni_shared_libraries_abi)
-jni_shared_libraries_with_abis += $(addprefix $(my_jni_shared_libraries_abi):,\
-    $(my_jni_shared_libraries))
-embedded_prebuilt_jni_libs += $(my_embedded_prebuilt_jni_libs)
-endif  # my_add_jni
+  my_2nd_arch_prefix := $(TARGET_2ND_ARCH_VAR_PREFIX)
+  my_add_jni :=
+  # The module is built for TARGET_2ND_ARCH
+  ifeq ($(my_2nd_arch_prefix),$(LOCAL_2ND_ARCH_VAR_PREFIX))
+    my_add_jni := true
+  endif
+  # Or it explicitly requires both
+  ifeq ($(my_module_multilib),both)
+    my_add_jni := true
+  endif
+  ifeq ($(my_add_jni),true)
+    my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS_$(TARGET_2ND_ARCH))
+    ifndef my_prebuilt_jni_libs
+      my_prebuilt_jni_libs := $(LOCAL_PREBUILT_JNI_LIBS)
+    endif
+    include $(BUILD_SYSTEM)/install_jni_libs_internal.mk
+    jni_shared_libraries += $(my_jni_shared_libraries)
+    jni_shared_libraries_abis += $(my_jni_shared_libraries_abi)
+    jni_shared_libraries_with_abis += $(addprefix $(my_jni_shared_libraries_abi):,\
+        $(my_jni_shared_libraries))
+    embedded_prebuilt_jni_libs += $(my_embedded_prebuilt_jni_libs)
+  endif  # my_add_jni
 endif  # TARGET_2ND_ARCH
 
 jni_shared_libraries := $(strip $(jni_shared_libraries))
diff --git a/core/install_jni_libs_internal.mk b/core/install_jni_libs_internal.mk
index a79a49a..48c93de 100644
--- a/core/install_jni_libs_internal.mk
+++ b/core/install_jni_libs_internal.mk
@@ -12,117 +12,129 @@
 #   my_embedded_prebuilt_jni_libs, prebuilt jni libs embedded in prebuilt apk.
 #
 
-my_jni_shared_libraries := \
-    $(foreach lib,$(LOCAL_JNI_SHARED_LIBRARIES), \
-      $(call intermediates-dir-for,SHARED_LIBRARIES,$(lib),,,$(my_2nd_arch_prefix))/$(lib).so)
+my_sdk_variant = $(1)
+ifneq (,$(and $(my_embed_jni),$(LOCAL_SDK_VERSION)))
+  # Soong produces $(lib).so in $(lib).sdk_intermediates so that the library
+  # has the correct name for embedding in an APK.  Append .sdk to the name
+  # of the intermediates directory, but not the .so name.
+  my_sdk_variant = $(call use_soong_sdk_libraries,$(1))
+endif
+
+my_jni_shared_libraries := $(strip \
+  $(foreach lib,$(LOCAL_JNI_SHARED_LIBRARIES), \
+    $(call intermediates-dir-for,SHARED_LIBRARIES,$(call my_sdk_variant,$(lib)),,,$(my_2nd_arch_prefix))/$(lib).so))
+
 
 # App-specific lib path.
 my_app_lib_path := $(dir $(LOCAL_INSTALLED_MODULE))lib/$(TARGET_$(my_2nd_arch_prefix)ARCH)
 my_embedded_prebuilt_jni_libs :=
 
 ifdef my_embed_jni
-# App explicitly requires the prebuilt NDK stl shared libraies.
-# The NDK stl shared libraries should never go to the system image.
-ifeq ($(LOCAL_NDK_STL_VARIANT),c++_shared)
-ifndef LOCAL_SDK_VERSION
-$(error LOCAL_SDK_VERSION must be defined with LOCAL_NDK_STL_VARIANT, \
-    LOCAL_PACKAGE_NAME=$(LOCAL_PACKAGE_NAME))
-endif
-my_jni_shared_libraries += \
-    $(HISTORICAL_NDK_VERSIONS_ROOT)/$(LOCAL_NDK_VERSION)/sources/cxx-stl/llvm-libc++/libs/$(TARGET_$(my_2nd_arch_prefix)CPU_ABI)/libc++_shared.so
-endif
+  # App explicitly requires the prebuilt NDK stl shared libraies.
+  # The NDK stl shared libraries should never go to the system image.
+  ifeq ($(LOCAL_NDK_STL_VARIANT),c++_shared)
+    ifndef LOCAL_SDK_VERSION
+      $(error LOCAL_SDK_VERSION must be defined with LOCAL_NDK_STL_VARIANT, \
+          LOCAL_PACKAGE_NAME=$(LOCAL_PACKAGE_NAME))
+    endif
+    my_jni_shared_libraries += \
+        $(HISTORICAL_NDK_VERSIONS_ROOT)/$(LOCAL_NDK_VERSION)/sources/cxx-stl/llvm-libc++/libs/$(TARGET_$(my_2nd_arch_prefix)CPU_ABI)/libc++_shared.so
+  endif
 
-# Set the abi directory used by the local JNI shared libraries.
-# (Doesn't change how the local shared libraries are compiled, just
-# sets where they are stored in the apk.)
-ifeq ($(LOCAL_JNI_SHARED_LIBRARIES_ABI),)
+  # Set the abi directory used by the local JNI shared libraries.
+  # (Doesn't change how the local shared libraries are compiled, just
+  # sets where they are stored in the apk.)
+  ifeq ($(LOCAL_JNI_SHARED_LIBRARIES_ABI),)
     my_jni_shared_libraries_abi := $(TARGET_$(my_2nd_arch_prefix)CPU_ABI)
-else
+  else
     my_jni_shared_libraries_abi := $(LOCAL_JNI_SHARED_LIBRARIES_ABI)
-endif
+  endif
 
-else  # not my_embed_jni
+else ifneq ($(my_jni_shared_libraries),) # not my_embed_jni
 
-my_jni_shared_libraries := $(strip $(my_jni_shared_libraries))
-ifneq ($(my_jni_shared_libraries),)
-# The jni libaries will be installed to the system.img.
-my_jni_filenames := $(notdir $(my_jni_shared_libraries))
-# Make sure the JNI libraries get installed
-my_shared_library_path := $(call get_non_asan_path,\
-  $($(my_2nd_arch_prefix)TARGET_OUT$(partition_tag)_SHARED_LIBRARIES))
-# Do not use order-only dependency, because we want to rebuild the image if an jni is updated.
-my_installed_library := $(addprefix $(my_shared_library_path)/, $(my_jni_filenames))
-$(LOCAL_INSTALLED_MODULE) : $(my_installed_library)
-ALL_MODULES.$(LOCAL_MODULE).INSTALLED += $(my_installed_library)
+  # The jni libaries will be installed to the system.img.
+  my_jni_filenames := $(notdir $(my_jni_shared_libraries))
+  # Make sure the JNI libraries get installed
+  my_shared_library_path := $(call get_non_asan_path,\
+      $($(my_2nd_arch_prefix)TARGET_OUT$(partition_tag)_SHARED_LIBRARIES))
+  my_installed_library := $(addprefix $(my_shared_library_path)/, $(my_jni_filenames))
 
-# Create symlink in the app specific lib path
-# Skip creating this symlink when running the second part of a target sanitization build.
-ifeq ($(filter address,$(SANITIZE_TARGET)),)
-ifdef LOCAL_POST_INSTALL_CMD
-# Add a shell command separator
-LOCAL_POST_INSTALL_CMD += ;
-endif
+  ALL_MODULES.$(LOCAL_MODULE).INSTALLED += $(my_installed_library)
 
-my_symlink_target_dir := $(patsubst $(PRODUCT_OUT)%,%,\
-    $(my_shared_library_path))
-LOCAL_POST_INSTALL_CMD += \
-  mkdir -p $(my_app_lib_path) \
-  $(foreach lib, $(my_jni_filenames), ;ln -sf $(my_symlink_target_dir)/$(lib) $(my_app_lib_path)/$(lib))
-$(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD := $(LOCAL_POST_INSTALL_CMD)
-else
-ifdef LOCAL_POST_INSTALL_CMD
-$(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD := $(LOCAL_POST_INSTALL_CMD)
-endif
-endif
+  # Create symlink in the app specific lib path
+  # Skip creating this symlink when running the second part of a target sanitization build.
+  ifeq ($(filter address,$(SANITIZE_TARGET)),)
+    my_symlink_target_dir := $(patsubst $(PRODUCT_OUT)%,%,\
+      $(my_shared_library_path))
+    $(foreach lib,$(my_jni_filenames),\
+      $(call symlink-file, \
+        $(my_shared_library_path)/$(lib), \
+        $(my_symlink_target_dir)/$(lib), \
+        $(my_app_lib_path)/$(lib)) \
+      $(eval $$(LOCAL_INSTALLED_MODULE) : $$(my_app_lib_path)/$$(lib)) \
+      $(eval ALL_MODULES.$$(LOCAL_MODULE).INSTALLED += $$(my_app_lib_path)/$$(lib)))
+  endif
 
-# Clear jni_shared_libraries to not embed it into the apk.
-my_jni_shared_libraries :=
-endif  # $(my_jni_shared_libraries) not empty
+  # Clear jni_shared_libraries to not embed it into the apk.
+  my_jni_shared_libraries :=
 endif  # my_embed_jni
 
 ifdef my_prebuilt_jni_libs
-# Files like @lib/<abi>/libfoo.so (path inside the apk) are JNI libs embedded prebuilt apk;
-# Files like path/to/libfoo.so (path relative to LOCAL_PATH) are prebuilts in the source tree.
-my_embedded_prebuilt_jni_libs := $(patsubst @%,%, \
-    $(filter @%, $(my_prebuilt_jni_libs)))
+  # Files like @lib/<abi>/libfoo.so (path inside the apk) are JNI libs embedded prebuilt apk;
+  # Files like path/to/libfoo.so (path relative to LOCAL_PATH) are prebuilts in the source tree.
+  my_embedded_prebuilt_jni_libs := $(patsubst @%,%, \
+      $(filter @%, $(my_prebuilt_jni_libs)))
 
-# prebuilt JNI exsiting as separate source files.
-my_prebuilt_jni_libs := $(addprefix $(LOCAL_PATH)/, \
-    $(filter-out @%, $(my_prebuilt_jni_libs)))
-ifdef my_prebuilt_jni_libs
-ifdef my_embed_jni
-# Embed my_prebuilt_jni_libs to the apk
-my_jni_shared_libraries += $(my_prebuilt_jni_libs)
-else # not my_embed_jni
-# Install my_prebuilt_jni_libs as separate files.
-$(foreach lib, $(my_prebuilt_jni_libs), \
-    $(eval $(call copy-one-file, $(lib), $(my_app_lib_path)/$(notdir $(lib)))))
+  # prebuilt JNI exsiting as separate source files.
+  my_prebuilt_jni_libs := $(addprefix $(LOCAL_PATH)/, \
+      $(filter-out @%, $(my_prebuilt_jni_libs)))
+  ifdef my_prebuilt_jni_libs
+    ifdef my_embed_jni
+      # Embed my_prebuilt_jni_libs to the apk
+      my_jni_shared_libraries += $(my_prebuilt_jni_libs)
+    else # not my_embed_jni
+      # Install my_prebuilt_jni_libs as separate files.
+      $(foreach lib, $(my_prebuilt_jni_libs), \
+          $(eval $(call copy-one-file, $(lib), $(my_app_lib_path)/$(notdir $(lib)))))
 
-my_installed_library := $(addprefix $(my_app_lib_path)/, $(notdir $(my_prebuilt_jni_libs)))
-$(LOCAL_INSTALLED_MODULE) : $(my_installed_library)
-ALL_MODULES.$(LOCAL_MODULE).INSTALLED += $(my_installed_library)
-endif  # my_embed_jni
-endif  # inner my_prebuilt_jni_libs
+      my_installed_library := $(addprefix $(my_app_lib_path)/, $(notdir $(my_prebuilt_jni_libs)))
+      $(LOCAL_INSTALLED_MODULE) : $(my_installed_library)
+
+      ALL_MODULES.$(LOCAL_MODULE).INSTALLED += $(my_installed_library)
+    endif  # my_embed_jni
+  endif  # inner my_prebuilt_jni_libs
 endif  # outer my_prebuilt_jni_libs
 
 # Verify that all included libraries are built against the NDK
 include $(BUILD_SYSTEM)/allowed_ndk_types.mk
+
 ifneq ($(strip $(LOCAL_JNI_SHARED_LIBRARIES)),)
-ifneq ($(LOCAL_SDK_VERSION),)
-my_link_type := app:sdk
-my_warn_types := native:platform $(my_warn_ndk_types)
-my_allowed_types := $(my_allowed_ndk_types)
+  ifneq ($(LOCAL_SDK_VERSION),)
+    my_link_type := app:sdk
+    my_warn_types := native:platform $(my_warn_ndk_types)
+    my_allowed_types := $(my_allowed_ndk_types)
     ifneq (,$(filter true,$(LOCAL_VENDOR_MODULE) $(LOCAL_ODM_MODULE) $(LOCAL_PROPRIETARY_MODULE)))
-        my_allowed_types += native:vendor native:vndk native:platform_vndk
+      my_allowed_types += native:vendor native:vndk native:platform_vndk
+    else ifeq ($(LOCAL_PRODUCT_MODULE),true)
+      my_allowed_types += native:product native:vndk native:platform_vndk
     endif
-else
-my_link_type := app:platform
-my_warn_types := $(my_warn_ndk_types)
-my_allowed_types := $(my_allowed_ndk_types) native:platform native:vendor native:vndk native:vndk_private native:platform_vndk
-endif
+  else
+    my_link_type := app:platform
+    my_warn_types := $(my_warn_ndk_types)
+    my_allowed_types := $(my_allowed_ndk_types) native:platform native:product native:vendor native:vndk native:vndk_private native:platform_vndk
+  endif
 
-my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
+  ifeq ($(SOONG_ANDROID_MK),$(LOCAL_MODULE_MAKEFILE))
+    # SOONG_SDK_VARIANT_MODULES isn't complete yet while parsing Soong modules, and Soong has
+    # already ensured that apps link against the correct SDK variants, don't check them.
+  else
+    ifneq (,$(LOCAL_SDK_VERSION))
+      my_link_deps := $(addprefix SHARED_LIBRARIES:,$(call use_soong_sdk_libraries,$(LOCAL_JNI_SHARED_LIBRARIES)))
+    else
+      my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
+    endif
+  endif
 
-my_common :=
-include $(BUILD_SYSTEM)/link_type.mk
+  my_common :=
+  include $(BUILD_SYSTEM)/link_type.mk
 endif
diff --git a/core/instrumentation_test_config_template.xml b/core/instrumentation_test_config_template.xml
index afaa561..6ca964e 100644
--- a/core/instrumentation_test_config_template.xml
+++ b/core/instrumentation_test_config_template.xml
@@ -17,13 +17,12 @@
 <configuration description="Runs {LABEL}.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-instrumentation" />
+    {EXTRA_CONFIGS}
     <target_preparer class="com.android.tradefed.targetprep.suite.SuiteApkInstaller">
         <option name="cleanup-apks" value="true" />
         <option name="test-file-name" value="{MODULE}.apk" />
     </target_preparer>
 
-    {EXTRA_CONFIGS}
-
     <test class="com.android.tradefed.testtype.{TEST_TYPE}" >
         <option name="package" value="{PACKAGE}" />
         <option name="runner" value="{RUNNER}" />
diff --git a/core/jacoco.mk b/core/jacoco.mk
index 148bb04..e8fb89b 100644
--- a/core/jacoco.mk
+++ b/core/jacoco.mk
@@ -47,7 +47,7 @@
 $(my_unzipped_timestamp_path): $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
 	rm -rf $(PRIVATE_UNZIPPED_PATH) $@
 	mkdir -p $(PRIVATE_UNZIPPED_PATH)
-	unzip -q $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) \
+	unzip -qDD $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) \
 	  -d $(PRIVATE_UNZIPPED_PATH) \
 	  $(PRIVATE_INCLUDE_ARGS)
 	(cd $(PRIVATE_UNZIPPED_PATH) && rm -rf $(PRIVATE_EXCLUDE_ARGS))
diff --git a/core/java.mk b/core/java.mk
index 1533963..a041321 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -233,18 +233,18 @@
 java_sources_deps := \
     $(java_sources) \
     $(java_resource_sources) \
-    $(proto_java_sources_file_stamp) \
     $(LOCAL_SRCJARS) \
     $(LOCAL_ADDITIONAL_DEPENDENCIES)
 
-$(java_source_list_file): $(java_sources_deps)
+$(java_source_list_file): $(java_sources_deps) $(NORMALIZE_PATH)
 	$(write-java-source-list)
 
+ALL_MODULES.$(my_register_name).SRCJARS := $(LOCAL_SRCJARS)
+
 ifneq ($(TURBINE_ENABLED),false)
 
 $(full_classes_turbine_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_turbine_jar): PRIVATE_SRCJARS := $(LOCAL_SRCJARS)
-$(full_classes_turbine_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
 $(full_classes_turbine_jar): \
     $(java_source_list_file) \
     $(java_sources_deps) \
@@ -274,11 +274,11 @@
 
 endif # TURBINE_ENABLED != false
 
+$(full_classes_compiled_jar): .KATI_NINJA_POOL := $(GOMA_POOL)
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES := $(LOCAL_JAR_EXCLUDE_FILES)
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES := $(LOCAL_JAR_PACKAGES)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES := $(LOCAL_JAR_EXCLUDE_PACKAGES)
-$(full_classes_compiled_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
 $(full_classes_compiled_jar): PRIVATE_JAVA_SOURCE_LIST := $(java_source_list_file)
 $(full_classes_compiled_jar): PRIVATE_ALL_JAVA_HEADER_LIBRARIES := $(full_java_header_libs)
 $(full_classes_compiled_jar): PRIVATE_SRCJARS := $(LOCAL_SRCJARS)
@@ -311,7 +311,7 @@
             $(PRIVATE_JAR_MANIFEST) > $(dir $@)/manifest.mf)
 	$(MERGE_ZIPS) -j --ignore-duplicates $(if $(PRIVATE_JAR_MANIFEST),-m $(dir $@)/manifest.mf) \
             $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,-stripDir META-INF -zipToNotStrip $<) \
-            $@ $< $(call reverse-list,$(PRIVATE_STATIC_JAVA_LIBRARIES))
+            $@ $< $(PRIVATE_STATIC_JAVA_LIBRARIES)
 
 ifdef LOCAL_JAR_PROCESSOR
 # LOCAL_JAR_PROCESSOR_ARGS must be evaluated here to set up the rule-local
@@ -359,9 +359,7 @@
 
 # Temporarily enable --multi-dex until proguard supports v53 class files
 # ( http://b/67673860 ) or we move away from proguard altogether.
-ifdef TARGET_OPENJDK9
 LOCAL_DX_FLAGS := $(filter-out --multi-dex,$(LOCAL_DX_FLAGS)) --multi-dex
-endif
 
 full_classes_pre_proguard_jar := $(LOCAL_FULL_CLASSES_JACOCO_JAR)
 
@@ -410,22 +408,19 @@
     $(full_shared_java_header_libs)))
 
 legacy_proguard_lib_deps := $(my_proguard_sdk_raise) \
-  $(filter-out $(my_proguard_sdk_raise),$(full_shared_java_header_libs))
+  $(filter-out $(my_proguard_sdk_raise),$(full_java_bootclasspath_libs) $(full_shared_java_header_libs))
 
 legacy_proguard_flags += -printmapping $(proguard_dictionary)
 legacy_proguard_flags += -printconfiguration $(proguard_configuration)
 
-common_proguard_flags := -forceprocessing
-
+common_proguard_flags :=
 common_proguard_flag_files := $(BUILD_SYSTEM)/proguard.flags
 ifneq ($(LOCAL_INSTRUMENTATION_FOR)$(filter tests,$(LOCAL_MODULE_TAGS)),)
 common_proguard_flags += -dontshrink # don't shrink tests by default
 endif # test package
 ifneq ($(LOCAL_PROGUARD_ENABLED),custom)
-  ifeq ($(LOCAL_USE_AAPT2),true)
-    common_proguard_flag_files += $(foreach l,$(LOCAL_STATIC_ANDROID_LIBRARIES),\
-        $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/export_proguard_flags)
-  endif
+  common_proguard_flag_files += $(foreach l,$(LOCAL_STATIC_ANDROID_LIBRARIES),\
+      $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/export_proguard_flags)
 endif
 ifneq ($(common_proguard_flag_files),)
 common_proguard_flags += $(addprefix -include , $(common_proguard_flag_files))
@@ -473,6 +468,8 @@
 proguard_flag_files := $(addprefix $(LOCAL_PATH)/, $(LOCAL_PROGUARD_FLAG_FILES))
 proguard_flag_files += $(addprefix $(LOCAL_PATH)/, $(LOCAL_R8_FLAG_FILES))
 LOCAL_PROGUARD_FLAGS += $(addprefix -include , $(proguard_flag_files))
+LOCAL_PROGUARD_FLAGS_DEPS += $(proguard_flag_files)
+proguard_flag_files :=
 
 ifdef LOCAL_TEST_MODULE_TO_PROGUARD_WITH
 extra_input_jar := $(call intermediates-dir-for,APPS,$(LOCAL_TEST_MODULE_TO_PROGUARD_WITH),,COMMON)/classes.jar
@@ -484,8 +481,6 @@
   $(built_dex_intermediate): .KATI_IMPLICIT_OUTPUTS := $(proguard_dictionary) $(proguard_configuration)
 endif
 
-else  # LOCAL_PROGUARD_ENABLED not defined
-proguard_flag_files :=
 endif # LOCAL_PROGUARD_ENABLED defined
 
 ifneq ($(LOCAL_IS_STATIC_JAVA_LIBRARY),true)
@@ -495,7 +490,7 @@
   $(built_dex_intermediate): PRIVATE_EXTRA_INPUT_JAR := $(extra_input_jar)
   $(built_dex_intermediate): PRIVATE_PROGUARD_FLAGS := $(legacy_proguard_flags) $(common_proguard_flags) $(LOCAL_PROGUARD_FLAGS)
   $(built_dex_intermediate): PRIVATE_PROGUARD_DICTIONARY := $(proguard_dictionary)
-  $(built_dex_intermediate) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_proguard_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) $(legacy_proguard_lib_deps) $(R8_COMPAT_PROGUARD)
+  $(built_dex_intermediate) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_proguard_sdk_raise) $(common_proguard_flag_files) $(legacy_proguard_lib_deps) $(R8_COMPAT_PROGUARD) $(LOCAL_PROGUARD_FLAGS_DEPS)
 	$(transform-jar-to-dex-r8)
 else # !LOCAL_PROGUARD_ENABLED
   $(built_dex_intermediate): PRIVATE_D8_LIBS := $(full_java_bootclasspath_libs) $(full_shared_java_header_libs)
diff --git a/core/java_common.mk b/core/java_common.mk
index f5da120..f6e01d2 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -33,8 +33,7 @@
     # TODO(ccross): allow 1.9 for current and unbundled once we have SDK system modules
     LOCAL_JAVA_LANGUAGE_VERSION := 1.8
   else
-    # DEFAULT_JAVA_LANGUAGE_VERSION is 1.8, unless TARGET_OPENJDK9 in which case it is 1.9
-    LOCAL_JAVA_LANGUAGE_VERSION := $(DEFAULT_JAVA_LANGUAGE_VERSION)
+    LOCAL_JAVA_LANGUAGE_VERSION := 1.9
   endif
 endif
 LOCAL_JAVACFLAGS += -source $(LOCAL_JAVA_LANGUAGE_VERSION) -target $(LOCAL_JAVA_LANGUAGE_VERSION)
@@ -67,37 +66,36 @@
   LOCAL_PROTOC_OPTIMIZE_TYPE := lite
 endif
 proto_sources := $(filter %.proto,$(LOCAL_SRC_FILES))
-# Because names of the .java files compiled from .proto files are unknown until the
-# .proto files are compiled, we use a timestamp file as depedency.
-proto_java_sources_file_stamp :=
 ifneq ($(proto_sources),)
 proto_sources_fullpath := $(addprefix $(LOCAL_PATH)/, $(proto_sources))
 
 proto_java_intemediate_dir := $(intermediates.COMMON)/proto
-proto_java_sources_file_stamp := $(proto_java_intemediate_dir)/Proto.stamp
 proto_java_sources_dir := $(proto_java_intemediate_dir)/src
+proto_java_srcjar := $(intermediates.COMMON)/proto.srcjar
 
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_INCLUDES := $(TOP)
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_SRC_FILES := $(proto_sources_fullpath)
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_JAVA_OUTPUT_DIR := $(proto_java_sources_dir)
-$(proto_java_sources_file_stamp): PRIVATE_PROTOC_FLAGS := $(LOCAL_PROTOC_FLAGS)
+LOCAL_SRCJARS += $(proto_java_srcjar)
+
+$(proto_java_srcjar): PRIVATE_PROTO_INCLUDES := $(TOP)
+$(proto_java_srcjar): PRIVATE_PROTO_SRC_FILES := $(proto_sources_fullpath)
+$(proto_java_srcjar): PRIVATE_PROTO_JAVA_OUTPUT_DIR := $(proto_java_sources_dir)
+$(proto_java_srcjar): PRIVATE_PROTOC_FLAGS := $(LOCAL_PROTOC_FLAGS)
 ifeq ($(LOCAL_PROTOC_OPTIMIZE_TYPE),micro)
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --javamicro_out
+  $(proto_java_srcjar): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --javamicro_out
+  $(proto_java_srcjar): PRIVATE_PROTOC_FLAGS += --plugin=$(HOST_OUT_EXECUTABLES)/protoc-gen-javamicro
+  $(proto_java_srcjar): $(HOST_OUT_EXECUTABLES)/protoc-gen-javamicro
+else ifeq ($(LOCAL_PROTOC_OPTIMIZE_TYPE),nano)
+  $(proto_java_srcjar): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --javanano_out
+  $(proto_java_srcjar): PRIVATE_PROTOC_FLAGS += --plugin=$(HOST_OUT_EXECUTABLES)/protoc-gen-javanano
+  $(proto_java_srcjar): $(HOST_OUT_EXECUTABLES)/protoc-gen-javanano
+else ifeq ($(LOCAL_PROTOC_OPTIMIZE_TYPE),stream)
+  $(proto_java_srcjar): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --javastream_out
+  $(proto_java_srcjar): PRIVATE_PROTOC_FLAGS += --plugin=$(HOST_OUT_EXECUTABLES)/protoc-gen-javastream
+  $(proto_java_srcjar): $(HOST_OUT_EXECUTABLES)/protoc-gen-javastream
 else
-  ifeq ($(LOCAL_PROTOC_OPTIMIZE_TYPE),nano)
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --javanano_out
-  else
-    ifeq ($(LOCAL_PROTOC_OPTIMIZE_TYPE),stream)
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --javastream_out
-$(proto_java_sources_file_stamp): PRIVATE_PROTOC_FLAGS += --plugin=$(HOST_OUT_EXECUTABLES)/protoc-gen-javastream
-$(proto_java_sources_file_stamp): $(HOST_OUT_EXECUTABLES)/protoc-gen-javastream
-    else
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --java_out
-    endif
-  endif
+  $(proto_java_srcjar): PRIVATE_PROTO_JAVA_OUTPUT_OPTION := --java_out
 endif
-$(proto_java_sources_file_stamp): PRIVATE_PROTO_JAVA_OUTPUT_PARAMS := $(if $(filter lite,$(LOCAL_PROTOC_OPTIMIZE_TYPE)),lite$(if $(LOCAL_PROTO_JAVA_OUTPUT_PARAMS),:,),)$(LOCAL_PROTO_JAVA_OUTPUT_PARAMS)
-$(proto_java_sources_file_stamp) : $(proto_sources_fullpath) $(PROTOC)
+$(proto_java_srcjar): PRIVATE_PROTO_JAVA_OUTPUT_PARAMS := $(if $(filter lite,$(LOCAL_PROTOC_OPTIMIZE_TYPE)),lite$(if $(LOCAL_PROTO_JAVA_OUTPUT_PARAMS),:,),)$(LOCAL_PROTO_JAVA_OUTPUT_PARAMS)
+$(proto_java_srcjar) : $(proto_sources_fullpath) $(PROTOC) $(SOONG_ZIP)
 	$(call transform-proto-to-java)
 
 #TODO: protoc should output the dependencies introduced by imports.
@@ -231,8 +229,6 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_CLASS_INTERMEDIATES_DIR := $(intermediates.COMMON)/classes
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ANNO_INTERMEDIATES_DIR := $(intermediates.COMMON)/anno
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_SOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/src
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_HAS_PROTO_SOURCES := $(if $(proto_sources),true)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/proto
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_HAS_RS_SOURCES :=
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JAVA_SOURCES := $(all_java_sources)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JAVA_SOURCE_LIST := $(java_source_list_file)
@@ -419,8 +415,8 @@
       ifndef SOONG_SYSTEM_MODULES_$(my_system_modules)
         $(call pretty-error, Invalid system modules $(my_system_modules))
       endif
-      full_java_system_modules_deps := $(SOONG_SYSTEM_MODULES_$(my_system_modules))
-      my_system_modules_dir := $(patsubst %/lib/modules,%,$(SOONG_SYSTEM_MODULES_$(my_system_modules)))
+      full_java_system_modules_deps := $(SOONG_SYSTEM_MODULES_DEPS_$(my_system_modules))
+      my_system_modules_dir := $(SOONG_SYSTEM_MODULES_$(my_system_modules))
     endif
   endif
 endif
@@ -497,13 +493,9 @@
 ##########################################################
 # Copy NOTICE files of transitive static dependencies
 # Don't do this in mm, since many of the targets won't exist.
-ifeq ($(ONE_SHOT_MAKEFILE),)
 installed_static_library_notice_file_targets := \
     $(foreach lib,$(LOCAL_STATIC_JAVA_LIBRARIES), \
       NOTICE-$(if $(LOCAL_IS_HOST_MODULE),HOST$(if $(my_host_cross),_CROSS,),TARGET)-JAVA_LIBRARIES-$(lib))
-else
-installed_static_library_notice_file_targets :=
-endif
 
 $(notice_target): | $(installed_static_library_notice_file_targets)
 $(LOCAL_INSTALLED_MODULE): | $(notice_target)
@@ -534,13 +526,6 @@
 my_allowed_types := java:sdk java:system java:platform java:core
 endif
 
-ifdef LOCAL_AAPT2_ONLY
-my_link_type += aapt2_only
-endif
-ifeq ($(LOCAL_USE_AAPT2),true)
-my_allowed_types += aapt2_only
-endif
-
 my_link_deps := $(addprefix JAVA_LIBRARIES:,$(LOCAL_STATIC_JAVA_LIBRARIES) $(LOCAL_JAVA_LIBRARIES))
 my_link_deps += $(addprefix APPS:,$(apk_libraries))
 
diff --git a/core/java_library.mk b/core/java_library.mk
index c706cea..3ac03dc 100644
--- a/core/java_library.mk
+++ b/core/java_library.mk
@@ -44,6 +44,7 @@
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
 # Exclude jacoco classes from proguard
 LOCAL_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
+LOCAL_PROGUARD_FLAGS_DEPS += $(BUILD_SYSTEM)/proguard.jacoco.flags
 endif # LOCAL_EMMA_INSTRUMENT
 endif # EMMA_INSTRUMENT_STATIC
 else
@@ -68,7 +69,7 @@
 $(common_javalib.jar): PRIVATE_DEX_FILE := $(built_dex)
 $(common_javalib.jar): PRIVATE_SOURCE_ARCHIVE := $(full_classes_pre_proguard_jar)
 $(common_javalib.jar): $(MERGE_ZIPS) $(SOONG_ZIP) $(ZIP2ZIP)
-$(common_javalib.jar) : $(built_dex) $(java_resource_sources) | $(ZIPTIME) $(ZIPALIGN)
+$(common_javalib.jar) : $(full_classes_pre_proguard_jar) $(built_dex) $(java_resource_sources) | $(ZIPTIME) $(ZIPALIGN)
 	@echo "target Jar: $(PRIVATE_MODULE) ($@)"
 	rm -rf $@.parts && mkdir -p $@.parts
 	$(call create-dex-jar,$@.parts/dex.zip,$(PRIVATE_DEX_FILE))
@@ -84,17 +85,6 @@
 
 .KATI_RESTAT: $(common_javalib.jar)
 
-ifdef LOCAL_DEX_PREOPT
-
-$(LOCAL_BUILT_MODULE): PRIVATE_STRIP_SCRIPT := $(intermediates)/strip.sh
-$(LOCAL_BUILT_MODULE): $(intermediates)/strip.sh
-$(LOCAL_BUILT_MODULE): | $(DEXPREOPT_STRIP_DEPS)
-$(LOCAL_BUILT_MODULE): .KATI_DEPFILE := $(LOCAL_BUILT_MODULE).d
-$(LOCAL_BUILT_MODULE): $(common_javalib.jar)
-	$(PRIVATE_STRIP_SCRIPT) $< $@
-
-else # LOCAL_DEX_PREOPT
 $(eval $(call copy-one-file,$(common_javalib.jar),$(LOCAL_BUILT_MODULE)))
 
-endif # LOCAL_DEX_PREOPT
 endif # !LOCAL_IS_STATIC_JAVA_LIBRARY
diff --git a/core/java_prebuilt_internal.mk b/core/java_prebuilt_internal.mk
new file mode 100644
index 0000000..da653b7
--- /dev/null
+++ b/core/java_prebuilt_internal.mk
@@ -0,0 +1,229 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+############################################################
+# Internal build rules for JAVA_LIBRARIES prebuilt modules
+############################################################
+
+ifneq (JAVA_LIBRARIES,$(LOCAL_MODULE_CLASS))
+$(call pretty-error,java_prebuilt_internal.mk is for JAVA_LIBRARIES modules only)
+endif
+
+include $(BUILD_SYSTEM)/base_rules.mk
+built_module := $(LOCAL_BUILT_MODULE)
+
+ifeq (,$(LOCAL_IS_HOST_MODULE)$(filter true,$(LOCAL_UNINSTALLABLE_MODULE)))
+  prebuilt_module_is_dex_javalib := true
+else
+  prebuilt_module_is_dex_javalib :=
+endif
+
+ifeq ($(prebuilt_module_is_dex_javalib),true)
+my_dex_jar := $(my_prebuilt_src_file)
+# This is a target shared library, i.e. a jar with classes.dex.
+
+ifneq ($(filter $(LOCAL_MODULE),$(PRODUCT_BOOT_JARS)),)
+  $(call pretty-error,Modules in PRODUCT_BOOT_JARS must be defined in Android.bp files)
+endif
+
+ALL_MODULES.$(my_register_name).CLASSES_JAR := $(common_classes_jar)
+
+#######################################
+# defines built_odex along with rule to install odex
+include $(BUILD_SYSTEM)/dex_preopt_odex_install.mk
+#######################################
+$(built_module) : $(my_prebuilt_src_file)
+	$(call copy-file-to-target)
+
+else  # ! prebuilt_module_is_dex_javalib
+$(built_module) : $(my_prebuilt_src_file)
+	$(transform-prebuilt-to-target)
+endif # ! prebuilt_module_is_dex_javalib
+
+my_src_jar := $(my_prebuilt_src_file)
+
+ifdef LOCAL_IS_HOST_MODULE
+# for host java libraries deps should be in the common dir, so we make a copy in
+# the common dir.
+common_classes_jar := $(intermediates.COMMON)/classes.jar
+common_header_jar := $(intermediates.COMMON)/classes-header.jar
+
+$(common_classes_jar): PRIVATE_MODULE := $(LOCAL_MODULE)
+$(common_classes_jar): PRIVATE_PREFIX := $(my_prefix)
+
+$(common_classes_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
+ifneq ($(TURBINE_ENABLED),false)
+$(common_header_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+endif
+
+else # !LOCAL_IS_HOST_MODULE
+# for target java libraries, the LOCAL_BUILT_MODULE is in a product-specific dir,
+# while the deps should be in the common dir, so we make a copy in the common dir.
+common_classes_jar := $(intermediates.COMMON)/classes.jar
+common_header_jar := $(intermediates.COMMON)/classes-header.jar
+common_classes_pre_proguard_jar := $(intermediates.COMMON)/classes-pre-proguard.jar
+common_javalib_jar := $(intermediates.COMMON)/javalib.jar
+
+$(common_classes_jar) $(common_classes_pre_proguard_jar) $(common_javalib_jar): PRIVATE_MODULE := $(LOCAL_MODULE)
+$(common_classes_jar) $(common_classes_pre_proguard_jar) $(common_javalib_jar): PRIVATE_PREFIX := $(my_prefix)
+
+ifeq ($(LOCAL_SDK_VERSION),system_current)
+my_link_type := java:system
+else ifneq (,$(call has-system-sdk-version,$(LOCAL_SDK_VERSION)))
+my_link_type := java:system
+else ifeq ($(LOCAL_SDK_VERSION),core_current)
+my_link_type := java:core
+else ifneq ($(LOCAL_SDK_VERSION),)
+my_link_type := java:sdk
+else
+my_link_type := java:platform
+endif
+
+# TODO: check dependencies of prebuilt files
+my_link_deps :=
+
+my_2nd_arch_prefix := $(LOCAL_2ND_ARCH_VAR_PREFIX)
+my_common := COMMON
+include $(BUILD_SYSTEM)/link_type.mk
+
+ifeq ($(prebuilt_module_is_dex_javalib),true)
+# For prebuilt shared Java library we don't have classes.jar.
+$(common_javalib_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
+else  # ! prebuilt_module_is_dex_javalib
+
+my_src_aar := $(filter %.aar, $(my_prebuilt_src_file))
+ifneq ($(my_src_aar),)
+# This is .aar file, archive of classes.jar and Android resources.
+
+# run Jetifier if needed
+LOCAL_JETIFIER_INPUT_FILE := $(my_src_aar)
+include $(BUILD_SYSTEM)/jetifier.mk
+my_src_aar := $(LOCAL_JETIFIER_OUTPUT_FILE)
+
+my_src_jar := $(intermediates.COMMON)/aar/classes.jar
+my_src_proguard_options := $(intermediates.COMMON)/aar/proguard.txt
+my_src_android_manifest := $(intermediates.COMMON)/aar/AndroidManifest.xml
+
+$(my_src_jar) : .KATI_IMPLICIT_OUTPUTS := $(my_src_proguard_options)
+$(my_src_jar) : .KATI_IMPLICIT_OUTPUTS += $(my_src_android_manifest)
+$(my_src_jar) : $(my_src_aar)
+	$(hide) rm -rf $(dir $@) && mkdir -p $(dir $@) $(dir $@)/res
+	$(hide) unzip -qoDD -d $(dir $@) $<
+	# Make sure the proguard and AndroidManifest.xml files exist
+	$(hide) touch $(dir $@)/proguard.txt
+	$(hide) touch $(dir $@)/AndroidManifest.xml
+
+my_prebuilt_android_manifest := $(intermediates.COMMON)/manifest/AndroidManifest.xml
+$(eval $(call copy-one-file,$(my_src_android_manifest),$(my_prebuilt_android_manifest)))
+$(call add-dependency,$(LOCAL_BUILT_MODULE),$(my_prebuilt_android_manifest))
+
+else
+
+# run Jetifier if needed
+LOCAL_JETIFIER_INPUT_FILE := $(my_src_jar)
+include $(BUILD_SYSTEM)/jetifier.mk
+my_src_jar := $(LOCAL_JETIFIER_OUTPUT_FILE)
+
+endif
+
+$(common_classes_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
+ifneq ($(TURBINE_ENABLED),false)
+$(common_header_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+endif
+
+$(common_classes_pre_proguard_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
+$(common_javalib_jar) : $(common_classes_jar)
+	$(transform-prebuilt-to-target)
+
+include $(BUILD_SYSTEM)/force_aapt2.mk
+
+ifneq ($(my_src_aar),)
+
+$(intermediates.COMMON)/export_proguard_flags : $(my_src_proguard_options)
+	$(transform-prebuilt-to-target)
+
+LOCAL_SDK_RES_VERSION:=$(strip $(LOCAL_SDK_RES_VERSION))
+ifeq ($(LOCAL_SDK_RES_VERSION),)
+  LOCAL_SDK_RES_VERSION:=$(LOCAL_SDK_VERSION)
+endif
+
+framework_res_package_export :=
+# Please refer to package.mk
+ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+ifneq ($(filter-out current system_current test_current,$(LOCAL_SDK_RES_VERSION))$(if $(TARGET_BUILD_APPS),$(filter current system_current test_current,$(LOCAL_SDK_RES_VERSION))),)
+framework_res_package_export := \
+    $(call resolve-prebuilt-sdk-jar-path,$(LOCAL_SDK_RES_VERSION))
+else
+framework_res_package_export := \
+    $(call intermediates-dir-for,APPS,framework-res,,COMMON)/package-export.apk
+endif
+endif
+
+my_res_package := $(intermediates.COMMON)/package-res.apk
+
+# We needed only very few PRIVATE variables and aapt2.mk input variables. Reset the unnecessary ones.
+$(my_res_package): PRIVATE_AAPT2_CFLAGS :=
+$(my_res_package): PRIVATE_AAPT_FLAGS := --static-lib --no-static-lib-packages --auto-add-overlay
+$(my_res_package): PRIVATE_ANDROID_MANIFEST := $(my_src_android_manifest)
+$(my_res_package): PRIVATE_AAPT_INCLUDES := $(framework_res_package_export)
+$(my_res_package): PRIVATE_SOURCE_INTERMEDIATES_DIR :=
+$(my_res_package): PRIVATE_PROGUARD_OPTIONS_FILE :=
+$(my_res_package): PRIVATE_DEFAULT_APP_TARGET_SDK :=
+$(my_res_package): PRIVATE_DEFAULT_APP_TARGET_SDK :=
+$(my_res_package): PRIVATE_PRODUCT_AAPT_CONFIG :=
+$(my_res_package): PRIVATE_PRODUCT_AAPT_PREF_CONFIG :=
+$(my_res_package): PRIVATE_TARGET_AAPT_CHARACTERISTICS :=
+$(my_res_package) : $(framework_res_package_export)
+$(my_res_package) : $(my_src_android_manifest)
+
+full_android_manifest :=
+my_res_resources :=
+my_overlay_resources :=
+my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res
+R_file_stamp :=
+proguard_options_file :=
+my_generated_res_dirs := $(intermediates.COMMON)/aar/res
+my_generated_res_dirs_deps := $(my_src_jar)
+include $(BUILD_SYSTEM)/aapt2.mk
+
+# Make sure my_res_package is created when you run mm/mmm.
+$(built_module) : $(my_res_package)
+endif  # $(my_src_aar)
+
+# make sure the classes.jar and javalib.jar are built before $(LOCAL_BUILT_MODULE)
+$(built_module) : $(common_javalib_jar)
+
+my_exported_sdk_libs_file := $(intermediates.COMMON)/exported-sdk-libs
+$(my_exported_sdk_libs_file): PRIVATE_EXPORTED_SDK_LIBS := $(LOCAL_EXPORT_SDK_LIBRARIES)
+$(my_exported_sdk_libs_file):
+	@echo "Export SDK libs $@"
+	$(hide) mkdir -p $(dir $@) && rm -f $@
+	$(if $(PRIVATE_EXPORTED_SDK_LIBS),\
+		$(hide) echo $(PRIVATE_EXPORTED_SDK_LIBS) | tr ' ' '\n' > $@,\
+		$(hide) touch $@)
+
+endif # ! prebuilt_module_is_dex_javalib
+endif # LOCAL_IS_HOST_MODULE is not set
diff --git a/core/java_renderscript.mk b/core/java_renderscript.mk
index 3fe0d0e..672863b 100644
--- a/core/java_renderscript.mk
+++ b/core/java_renderscript.mk
@@ -1,10 +1,10 @@
 ###############################################################
 ## Renderscript support for java
-## Adds rules to convert .rs files to .java and .bc files
+## Adds rules to convert .rscript files to .java and .bc files
 ###############################################################
 
-renderscript_sources := $(filter %.rs,$(LOCAL_SRC_FILES))
-LOCAL_SRC_FILES := $(filter-out %.rs,$(LOCAL_SRC_FILES))
+renderscript_sources := $(filter %.rscript,$(LOCAL_SRC_FILES))
+LOCAL_SRC_FILES := $(filter-out %.rscript,$(LOCAL_SRC_FILES))
 
 rs_generated_res_zip :=
 rs_generated_src_jar :=
@@ -67,7 +67,7 @@
 LOCAL_RENDERSCRIPT_INCLUDES := $(LOCAL_RENDERSCRIPT_INCLUDES_OVERRIDE)
 endif
 
-bc_files := $(patsubst %.rs,%.bc, $(notdir $(renderscript_sources)))
+bc_files := $(patsubst %.rscript,%.bc, $(notdir $(renderscript_sources)))
 bc_dep_files := $(addprefix $(renderscript_intermediate.COMMON)/,$(patsubst %.bc,%.d,$(bc_files)))
 
 $(rs_generated_src_jar): PRIVATE_RS_INCLUDES := $(LOCAL_RENDERSCRIPT_INCLUDES)
diff --git a/core/line_coverage.mk b/core/line_coverage.mk
new file mode 100644
index 0000000..c89642e
--- /dev/null
+++ b/core/line_coverage.mk
@@ -0,0 +1,95 @@
+# -----------------------------------------------------------------
+# Make target for line coverage. This target generates a zip file
+# called `line_coverage_profiles.zip` that contains a large set of
+# zip files one for each fuzz target/critical component. Each zip
+# file contains a set of profile files (*.gcno) that we will use
+# to generate line coverage reports. Furthermore, target compiles
+# all fuzz targets with line coverage instrumentation enabled and
+# packs them into another zip file called `line_coverage_profiles.zip`.
+#
+# To run the make target set the coverage related envvars first:
+# 	NATIVE_COVERAGE=true NATIVE_COVERAGE_PATHS=* make haiku-line-coverage
+# -----------------------------------------------------------------
+
+# TODO(b/148306195): Due this issue some fuzz targets cannot be built with
+# line coverage instrumentation. For now we just blacklist them.
+blacklisted_fuzz_targets := libneuralnetworks_fuzzer
+
+fuzz_targets := $(ALL_FUZZ_TARGETS)
+fuzz_targets := $(filter-out $(blacklisted_fuzz_targets),$(fuzz_targets))
+
+
+# Android components that considered critical.
+# Please note that adding/Removing critical components is very rare.
+critical_components_static := \
+	lib-bt-packets \
+	libbt-stack \
+	libffi \
+	libhevcdec \
+	libhevcenc \
+	libmpeg2dec \
+	libosi \
+	libpdx \
+	libselinux \
+	libvold \
+	libyuv
+
+# Format is <module_name> or <module_name>:<apex_name>
+critical_components_shared := \
+	libaudioprocessing \
+	libbinder \
+	libbluetooth_gd \
+	libbrillo \
+	libcameraservice \
+	libcurl \
+	libhardware \
+	libinputflinger \
+	libopus \
+	libstagefright \
+	libunwind \
+	libvixl:com.android.art.debug
+
+# Use the intermediates directory to avoid installing libraries to the device.
+intermediates := $(call intermediates-dir-for,PACKAGING,haiku-line-coverage)
+
+
+# We want the profile files for all fuzz targets + critical components.
+line_coverage_profiles := $(intermediates)/line_coverage_profiles.zip
+
+critical_components_static_inputs := $(foreach lib,$(critical_components_static), \
+	$(call intermediates-dir-for,STATIC_LIBRARIES,$(lib))/$(lib).a)
+
+critical_components_shared_inputs := $(foreach lib,$(critical_components_shared), \
+	$(eval filename := $(call word-colon,1,$(lib))) \
+	$(eval modulename := $(subst :,.,$(lib))) \
+	$(call intermediates-dir-for,SHARED_LIBRARIES,$(modulename))/$(filename).so)
+
+fuzz_target_inputs := $(foreach fuzz,$(fuzz_targets), \
+	$(call intermediates-dir-for,EXECUTABLES,$(fuzz))/$(fuzz))
+
+# When coverage is enabled (NATIVE_COVERAGE is set), make creates
+# a "coverage" directory and stores all profile (*.gcno) files in inside.
+# We need everything that is stored inside this directory.
+$(line_coverage_profiles): $(fuzz_target_inputs)
+$(line_coverage_profiles): $(critical_components_static_inputs)
+$(line_coverage_profiles): $(critical_components_shared_inputs)
+$(line_coverage_profiles): $(SOONG_ZIP)
+	$(SOONG_ZIP) -o $@ -D $(PRODUCT_OUT)/coverage
+
+
+# Zip all fuzz targets compiled with line coverage.
+line_coverage_fuzz_targets := $(intermediates)/line_coverage_fuzz_targets.zip
+
+$(line_coverage_fuzz_targets): $(fuzz_target_inputs)
+$(line_coverage_fuzz_targets): $(SOONG_ZIP)
+	$(SOONG_ZIP) -o $@ -j $(addprefix -f ,$(fuzz_target_inputs))
+
+
+.PHONY: haiku-line-coverage
+haiku-line-coverage: $(line_coverage_profiles) $(line_coverage_fuzz_targets)
+$(call dist-for-goals, haiku-line-coverage, \
+	$(line_coverage_profiles):line_coverage_profiles.zip \
+	$(line_coverage_fuzz_targets):line_coverage_fuzz_targets.zip)
+
+line_coverage_profiles :=
+line_coverage_fuzz_targets :=
diff --git a/core/link_type.mk b/core/link_type.mk
index f7604ff..e8cfd2e 100644
--- a/core/link_type.mk
+++ b/core/link_type.mk
@@ -12,7 +12,7 @@
 
 my_link_prefix := LINK_TYPE:$(call find-idf-prefix,$(my_kind),$(my_host_cross))$(if $(filter AUX,$(my_kind)),-$(AUX_OS_VARIANT)):$(if $(my_common),$(my_common):_,_:$(if $(my_2nd_arch_prefix),$(my_2nd_arch_prefix),_))
 link_type := $(my_link_prefix):$(LOCAL_MODULE_CLASS):$(LOCAL_MODULE)
-ALL_LINK_TYPES := $(ALL_LINK_TYPES) $(link_type)
+ALL_LINK_TYPES += $(link_type)
 $(link_type).TYPE := $(my_link_type)
 $(link_type).MAKEFILE := $(LOCAL_MODULE_MAKEFILE)
 $(link_type).WARN := $(my_warn_types)
diff --git a/core/local_systemsdk.mk b/core/local_systemsdk.mk
index 6c022f2..460073d 100644
--- a/core/local_systemsdk.mk
+++ b/core/local_systemsdk.mk
@@ -15,19 +15,23 @@
 #
 
 ifdef BOARD_SYSTEMSDK_VERSIONS
-  # Apps and jars in vendor or odm partition are forced to build against System SDK.
-  _is_vendor_app :=
+  # Apps and jars in vendor, product or odm partition are forced to build against System SDK.
+  _cannot_use_platform_apis :=
   ifneq (,$(filter true,$(LOCAL_VENDOR_MODULE) $(LOCAL_ODM_MODULE) $(LOCAL_PROPRIETARY_MODULE)))
     # Note: no need to check LOCAL_MODULE_PATH* since LOCAL_[VENDOR|ODM|OEM]_MODULE is already
     # set correctly before this is included.
-    _is_vendor_app := true
+    _cannot_use_platform_apis := true
+  else ifeq ($(LOCAL_PRODUCT_MODULE),true)
+    ifeq ($(PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE),true)
+      _cannot_use_platform_apis := true
+    endif
   endif
   ifneq (,$(filter JAVA_LIBRARIES APPS,$(LOCAL_MODULE_CLASS)))
     ifndef LOCAL_SDK_VERSION
-      ifeq ($(_is_vendor_app),true)
-        ifeq (,$(filter %__auto_generated_rro_vendor,$(LOCAL_MODULE)))
+      ifeq ($(_cannot_use_platform_apis),true)
+        ifeq (,$(LOCAL_IS_RUNTIME_RESOURCE_OVERLAY))
           # Runtime resource overlays are exempted from building against System SDK.
-          # TODO(b/35859726): remove this exception
+          # TODO(b/155027019): remove this, after no product/vendor apps rely on this behavior.
           LOCAL_SDK_VERSION := system_current
         endif
       endif
@@ -39,7 +43,7 @@
 # The range of support versions becomes narrower when BOARD_SYSTEMSDK_VERSIONS
 # is set, which is a subset of PLATFORM_SYSTEMSDK_VERSIONS.
 ifneq (,$(call has-system-sdk-version,$(LOCAL_SDK_VERSION)))
-  ifneq ($(_is_vendor_app),true)
+  ifneq ($(_cannot_use_platform_apis),true)
     # apps bundled in system partition can use all system sdk versions provided by the platform
     _supported_systemsdk_versions := $(PLATFORM_SYSTEMSDK_VERSIONS)
   else ifdef BOARD_SYSTEMSDK_VERSIONS
diff --git a/core/local_vndk.mk b/core/local_vndk.mk
index 198e361..b1bd3e6 100644
--- a/core/local_vndk.mk
+++ b/core/local_vndk.mk
@@ -1,5 +1,5 @@
 
-#Set LOCAL_USE_VNDK for modules going into vendor or odm partition, except for host modules
+#Set LOCAL_USE_VNDK for modules going into product, vendor or odm partition, except for host modules
 #If LOCAL_SDK_VERSION is set, thats a more restrictive set, so they dont need LOCAL_USE_VNDK
 ifndef LOCAL_IS_HOST_MODULE
 ifndef LOCAL_SDK_VERSION
@@ -8,6 +8,13 @@
     # Note: no need to check LOCAL_MODULE_PATH* since LOCAL_[VENDOR|ODM|OEM]_MODULE is already
     # set correctly before this is included.
   endif
+  ifdef PRODUCT_PRODUCT_VNDK_VERSION
+    # Product modules also use VNDK when PRODUCT_PRODUCT_VNDK_VERSION is defined.
+    ifeq (true,$(LOCAL_PRODUCT_MODULE))
+      LOCAL_USE_VNDK:=true
+      LOCAL_USE_VNDK_PRODUCT:=true
+    endif
+  endif
 endif
 endif
 
@@ -33,6 +40,7 @@
   # If we're not using the VNDK, drop all restrictions
   ifndef BOARD_VNDK_VERSION
     LOCAL_USE_VNDK:=
+    LOCAL_USE_VNDK_PRODUCT:=
   endif
 endif
 
diff --git a/core/main.mk b/core/main.mk
index a13404a..357c70d 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1,31 +1,9 @@
-# Only use ANDROID_BUILD_SHELL to wrap around bash.
-# DO NOT use other shells such as zsh.
-ifdef ANDROID_BUILD_SHELL
-SHELL := $(ANDROID_BUILD_SHELL)
-else
-# Use bash, not whatever shell somebody has installed as /bin/sh
-# This is repeated in config.mk, since envsetup.sh runs that file
-# directly.
-SHELL := /bin/bash
-endif
-
 ifndef KATI
-
-host_prebuilts := linux-x86
-ifeq ($(shell uname),Darwin)
-host_prebuilts := darwin-x86
+$(warning Calling make directly is no longer supported.)
+$(warning Either use 'envsetup.sh; m' or 'build/soong/soong_ui.bash --make-mode')
+$(error done)
 endif
 
-.PHONY: run_soong_ui
-run_soong_ui:
-	+@prebuilts/build-tools/$(host_prebuilts)/bin/makeparallel --ninja build/soong/soong_ui.bash --make-mode $(MAKECMDGOALS)
-
-.PHONY: $(MAKECMDGOALS)
-$(sort $(MAKECMDGOALS)) : run_soong_ui
-	@#empty
-
-else # KATI
-
 $(info [1/1] initializing build system ...)
 
 # Absolute path of the present working direcotry.
@@ -33,9 +11,6 @@
 # the top of the source tree, for example when "make -C" is used in m/mm/mmm.
 PWD := $(shell pwd)
 
-TOP := .
-TOPDIR :=
-
 # This is the default target.  It must be the first declared target.
 .PHONY: droid
 DEFAULT_GOAL := droid
@@ -63,17 +38,15 @@
 # Write the build number to a file so it can be read back in
 # without changing the command line every time.  Avoids rebuilds
 # when using ninja.
-$(shell mkdir -p $(OUT_DIR) && \
-    echo -n $(BUILD_NUMBER) > $(OUT_DIR)/build_number.txt)
-BUILD_NUMBER_FILE := $(OUT_DIR)/build_number.txt
+$(shell mkdir -p $(SOONG_OUT_DIR) && \
+    echo -n $(BUILD_NUMBER) > $(SOONG_OUT_DIR)/build_number.txt)
+BUILD_NUMBER_FILE := $(SOONG_OUT_DIR)/build_number.txt
 .KATI_READONLY := BUILD_NUMBER_FILE
 $(KATI_obsolete_var BUILD_NUMBER,See https://android.googlesource.com/platform/build/+/master/Changes.md#BUILD_NUMBER)
+$(BUILD_NUMBER_FILE):
+	touch $@
 
-ifeq ($(HOST_OS),darwin)
-DATE_FROM_FILE := date -r $(BUILD_DATETIME_FROM_FILE)
-else
 DATE_FROM_FILE := date -d @$(BUILD_DATETIME_FROM_FILE)
-endif
 .KATI_READONLY := DATE_FROM_FILE
 
 # Pick a reasonable string to use to identify files.
@@ -104,6 +77,10 @@
 -include test/suite_harness/tools/cts-instant-tradefed/build/config.mk
 # MTS-specific config.
 -include test/mts/tools/build/config.mk
+# VTS-Core-specific config.
+-include test/vts/tools/vts-core-tradefed/build/config.mk
+# CSUITE-specific config.
+-include test/app_compat/csuite/tools/build/config.mk
 
 # Clean rules
 .PHONY: clean-dex-files
@@ -196,6 +173,8 @@
 $(error stopping)
 endif
 
+# These are the valid values of TARGET_BUILD_VARIANT.
+INTERNAL_VALID_VARIANTS := user userdebug eng
 ifneq ($(filter-out $(INTERNAL_VALID_VARIANTS),$(TARGET_BUILD_VARIANT)),)
 $(info ***************************************************************)
 $(info ***************************************************************)
@@ -218,17 +197,7 @@
 # The pdk (Platform Development Kit) build
 include build/make/core/pdk_config.mk
 
-#
 # -----------------------------------------------------------------
-# Enable dynamic linker warnings for userdebug, eng and non-REL builds
-ifneq ($(TARGET_BUILD_VARIANT),user)
-  ADDITIONAL_BUILD_PROPERTIES += ro.bionic.ld.warning=1
-else
-# Enable it for user builds as long as they are not final.
-ifneq ($(PLATFORM_VERSION_CODENAME),REL)
-  ADDITIONAL_BUILD_PROPERTIES += ro.bionic.ld.warning=1
-endif
-endif
 
 ADDITIONAL_BUILD_PROPERTIES += ro.treble.enabled=${PRODUCT_FULL_TREBLE}
 
@@ -237,8 +206,8 @@
 	variables like PRODUCT_SEPOLICY_SPLIT should be used until that is \
 	possible.)
 
-# Sets ro.actionable_compatible_property.enabled to know on runtime whether the whitelist
-# of actionable compatible properties is enabled or not.
+# Sets ro.actionable_compatible_property.enabled to know on runtime whether the
+# allowed list of actionable compatible properties is enabled or not.
 ifeq ($(PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE),true)
 ADDITIONAL_DEFAULT_PROPERTIES += ro.actionable_compatible_property.enabled=false
 else
@@ -264,6 +233,17 @@
 # mount system_other partition.
 ADDITIONAL_DEFAULT_PROPERTIES += ro.postinstall.fstab.prefix=/system
 
+# Set ro.product.vndk.version to know the VNDK version required by product
+# modules. It uses the version in PRODUCT_PRODUCT_VNDK_VERSION. If the value
+# is "current", use PLATFORM_VNDK_VERSION.
+ifdef PRODUCT_PRODUCT_VNDK_VERSION
+ifeq ($(PRODUCT_PRODUCT_VNDK_VERSION),current)
+ADDITIONAL_PRODUCT_PROPERTIES += ro.product.vndk.version=$(PLATFORM_VNDK_VERSION)
+else
+ADDITIONAL_PRODUCT_PROPERTIES += ro.product.vndk.version=$(PRODUCT_PRODUCT_VNDK_VERSION)
+endif
+endif
+
 # -----------------------------------------------------------------
 ###
 ### In this section we set up the things that are different
@@ -332,7 +312,7 @@
 endif
 ifndef is_sdk_build
   # To speedup startup of non-preopted builds, don't verify or compile the boot image.
-  ADDITIONAL_BUILD_PROPERTIES += dalvik.vm.image-dex2oat-filter=verify-at-runtime
+  ADDITIONAL_BUILD_PROPERTIES += dalvik.vm.image-dex2oat-filter=extract
 endif
 endif
 
@@ -440,50 +420,13 @@
 subdir_makefiles_inc := .
 FULL_BUILD :=
 
-ifneq ($(ONE_SHOT_MAKEFILE),)
-# We've probably been invoked by the "mm" shell function
-# with a subdirectory's makefile.
-include $(SOONG_ANDROID_MK) $(wildcard $(ONE_SHOT_MAKEFILE))
-# Change CUSTOM_MODULES to include only modules that were
-# defined by this makefile; this will install all of those
-# modules as a side-effect.  Do this after including ONE_SHOT_MAKEFILE
-# so that the modules will be installed in the same place they
-# would have been with a normal make.
-CUSTOM_MODULES := $(sort $(call get-tagged-modules,$(ALL_MODULE_TAGS)))
-
-# A helper goal printing out install paths
-define register_module_install_path
-.PHONY: GET-MODULE-INSTALL-PATH-$(1)
-GET-MODULE-INSTALL-PATH-$(1):
-	echo 'INSTALL-PATH: $(1) $(ALL_MODULES.$(1).INSTALLED)'
-endef
-
-SORTED_ALL_MODULES := $(sort $(ALL_MODULES))
-UNIQUE_ALL_MODULES :=
-$(foreach m,$(SORTED_ALL_MODULES),\
-    $(if $(call streq,$(m),$(lastword $(UNIQUE_ALL_MODULES))),,\
-        $(eval UNIQUE_ALL_MODULES += $(m))))
-SORTED_ALL_MODULES :=
-
-$(foreach mod,$(UNIQUE_ALL_MODULES),$(if $(ALL_MODULES.$(mod).INSTALLED),\
-    $(eval $(call register_module_install_path,$(mod)))\
-    $(foreach path,$(ALL_MODULES.$(mod).PATH),\
-        $(eval my_path_prefix := GET-INSTALL-PATH-IN)\
-        $(foreach component,$(subst /,$(space),$(path)),\
-            $(eval my_path_prefix := $$(my_path_prefix)-$$(component))\
-            $(eval .PHONY: $$(my_path_prefix))\
-            $(eval $$(my_path_prefix): GET-MODULE-INSTALL-PATH-$(mod))))))
-UNIQUE_ALL_MODULES :=
-
-else # ONE_SHOT_MAKEFILE
-
 ifneq ($(dont_bother),true)
 FULL_BUILD := true
 #
 # Include all of the makefiles in the system
 #
 
-subdir_makefiles := $(SOONG_ANDROID_MK) $(file <$(OUT_DIR)/.module_paths/Android.mk.list)
+subdir_makefiles := $(SOONG_ANDROID_MK) $(file <$(OUT_DIR)/.module_paths/Android.mk.list) $(SOONG_OUT_DIR)/late-$(TARGET_PRODUCT).mk
 subdir_makefiles_total := $(words int $(subdir_makefiles) post finish)
 .KATI_READONLY := subdir_makefiles_total
 
@@ -498,16 +441,10 @@
 
 endif # dont_bother
 
-endif # ONE_SHOT_MAKEFILE
-
 ifndef subdir_makefiles_total
 subdir_makefiles_total := $(words init post finish)
 endif
 
-droid_targets: no_vendor_variant_vndk_check
-.PHONY: no_vendor_variant_vndk_check
-no_vendor_variant_vndk_check:
-
 $(info [$(call inc_and_print,subdir_makefiles_inc)/$(subdir_makefiles_total)] finishing build rules ...)
 
 # -------------------------------------------------------------------
@@ -556,7 +493,6 @@
 #
 # Resolve the required module name to 32-bit or 64-bit variant.
 # Get a list of corresponding 32-bit module names, if one exists.
-ifneq ($(TARGET_TRANSLATE_2ND_ARCH),true)
 define get-32-bit-modules
 $(sort $(foreach m,$(1),\
   $(if $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).CLASS),\
@@ -570,15 +506,6 @@
     $(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX), \
     $(m))))
 endef
-else  # TARGET_TRANSLATE_2ND_ARCH
-# For binary translation config, by default only install the first arch.
-define get-32-bit-modules
-endef
-
-define get-32-bit-modules-if-we-can
-$(strip $(1))
-endef
-endif  # TARGET_TRANSLATE_2ND_ARCH
 
 # TODO: we can probably check to see if these modules are actually host
 # modules
@@ -815,15 +742,18 @@
 $(_all_deps_for_$(1)_))
 endef
 
-# Scan all modules in general-tests and device-tests suite and flatten the
-# shared library dependencies.
+# Scan all modules in general-tests, device-tests and other selected suites and
+# flatten the shared library dependencies.
 define update-host-shared-libs-deps-for-suites
-$(foreach suite,general-tests device-tests,\
+$(foreach suite,general-tests device-tests vts,\
   $(foreach m,$(COMPATIBILITY.$(suite).MODULES),\
     $(eval my_deps := $(call get-all-shared-libs-deps,$(m)))\
     $(foreach dep,$(my_deps),\
       $(foreach f,$(ALL_MODULES.$(dep).HOST_SHARED_LIBRARY_FILES),\
-        $(eval target := $(HOST_OUT_TESTCASES)/$(lastword $(subst /, ,$(dir $(f))))/$(notdir $(f)))\
+        $(if $(filter $(suite),device-tests general-tests),\
+          $(eval my_testcases := $(HOST_OUT_TESTCASES)),\
+          $(eval my_testcases := $$(COMPATIBILITY_TESTCASES_OUT_$(suite))))\
+        $(eval target := $(my_testcases)/$(lastword $(subst /, ,$(dir $(f))))/$(notdir $(f)))\
         $(eval COMPATIBILITY.$(suite).HOST_SHARED_LIBRARY.FILES := \
           $$(COMPATIBILITY.$(suite).HOST_SHARED_LIBRARY.FILES) $(f):$(target))\
         $(eval COMPATIBILITY.$(suite).HOST_SHARED_LIBRARY.FILES := \
@@ -843,6 +773,9 @@
 $(call update-host-shared-libs-deps-for-suites)
 ifdef HOST_CROSS_OS
 $(call resolve-shared-libs-depes,HOST_CROSS_,,true)
+ifdef HOST_CROSS_2ND_ARCH
+$(call resolve-shared-libs-depes,HOST_CROSS_,true,true)
+endif
 endif
 
 # Pass the shared libraries dependencies to prebuilt ELF file check.
@@ -1003,10 +936,6 @@
       $(call link-type-error,$(1),$(2),$(t)))))
 endef
 
-# TODO: Verify all branches/configs have reasonable warnings/errors, and remove
-# this override
-verify-link-type = $(eval $$(1).MISSING := true)
-
 $(foreach lt,$(ALL_LINK_TYPES),\
   $(foreach d,$($(lt).DEPS),\
     $(if $($(d).TYPE),\
@@ -1017,44 +946,26 @@
   $(error exiting from previous errors)
 endif
 
-# The intermediate filename for link type rules
-#
-# APPS are special -- they have up to three different rules:
-#  1. The COMMON rule for Java libraries
-#  2. The jni_link_type rule for embedded native code
-#  3. The 2ND_jni_link_type for the second architecture native code
-define link-type-file
-$(eval _ltf_aux_variant:=$(link-type-aux-variant))\
-$(if $(_ltf_aux_variant),$(call aux-variant-load-env,$(_ltf_aux_variant)))\
-$(call intermediates-dir-for,$(link-type-class),$(link-type-name),$(filter AUX HOST HOST_CROSS,$(link-type-prefix)),$(link-type-common),$(link-type-2ndarchprefix),$(filter HOST_CROSS,$(link-type-prefix)))/$(if $(filter APPS,$(link-type-class)),$(if $(link-type-common),,$(link-type-2ndarchprefix)jni_))link_type\
-$(if $(_ltf_aux_variant),$(call aux-variant-load-env,none))\
-$(eval _ltf_aux_variant:=)
-endef
+# -------------------------------------------------------------------
+# Handle exported/imported includes
 
-# Write out the file-based link_type rules for the ALLOW_MISSING_DEPENDENCIES
-# case. We always need to write the file for mm to work, but only need to
-# check it if we weren't able to check it when reading the Android.mk files.
-define link-type-file-rule
-my_link_type_deps := $(foreach l,$($(1).DEPS),$(call link-type-file,$(l)))
-my_link_type_file := $(call link-type-file,$(1))
-$($(1).BUILT): | $$(my_link_type_file)
-$$(my_link_type_file): PRIVATE_DEPS := $$(my_link_type_deps)
-ifeq ($($(1).MISSING),true)
-$$(my_link_type_file): $(CHECK_LINK_TYPE)
-endif
-$$(my_link_type_file): $$(my_link_type_deps)
-	@echo Check module type: $$@
-	$$(hide) mkdir -p $$(dir $$@) && rm -f $$@
-ifeq ($($(1).MISSING),true)
-	$$(hide) $(CHECK_LINK_TYPE) --makefile $($(1).MAKEFILE) --module $(link-type-name) \
-	  --type "$($(1).TYPE)" $(addprefix --allowed ,$($(1).ALLOWED)) \
-	  $(addprefix --warn ,$($(1).WARN)) $$(PRIVATE_DEPS)
-endif
-	$$(hide) echo "$($(1).TYPE)" >$$@
-endef
+# Recursively calculate flags
+$(foreach export,$(EXPORTS_LIST), \
+  $(eval EXPORTS.$$(export) = $$(EXPORTS.$(export).FLAGS) \
+    $(foreach dep,$(EXPORTS.$(export).REEXPORT),$$(EXPORTS.$(dep)))))
 
-$(foreach lt,$(ALL_LINK_TYPES),\
-  $(eval $(call link-type-file-rule,$(lt))))
+# Recursively calculate dependencies
+$(foreach export,$(EXPORTS_LIST), \
+  $(eval EXPORT_DEPS.$$(export) = $$(EXPORTS.$(export).DEPS) \
+    $(foreach dep,$(EXPORTS.$(export).REEXPORT),$$(EXPORT_DEPS.$(dep)))))
+
+# Converts the recursive variables to simple variables so that we don't have to
+# evaluate them for every .o rule
+$(foreach export,$(EXPORTS_LIST),$(eval EXPORTS.$$(export) := $$(strip $$(EXPORTS.$$(export)))))
+$(foreach export,$(EXPORTS_LIST),$(eval EXPORT_DEPS.$$(export) := $$(sort $$(EXPORT_DEPS.$$(export)))))
+
+# Add dependencies
+$(foreach export,$(EXPORTS_LIST),$(eval $(call add-dependency,$$(EXPORTS.$$(export).USERS),$$(EXPORT_DEPS.$$(export)))))
 
 # -------------------------------------------------------------------
 # Figure out our module sets.
@@ -1066,7 +977,7 @@
 # Expand a list of modules to the modules that they override (if any)
 # $(1): The list of modules.
 define module-overrides
-$(foreach m,$(1),$(PACKAGES.$(m).OVERRIDES) $(EXECUTABLES.$(m).OVERRIDES) $(SHARED_LIBRARIES.$(m).OVERRIDES))
+$(foreach m,$(1),$(PACKAGES.$(m).OVERRIDES) $(EXECUTABLES.$(m).OVERRIDES) $(SHARED_LIBRARIES.$(m).OVERRIDES) $(ETC.$(m).OVERRIDES))
 endef
 
 ###########################################################
@@ -1110,7 +1021,7 @@
 define resolve-product-relative-paths
   $(subst $(_vendor_path_placeholder),$(TARGET_COPY_OUT_VENDOR),\
     $(subst $(_product_path_placeholder),$(TARGET_COPY_OUT_PRODUCT),\
-      $(subst $(_product_services_path_placeholder),$(TARGET_COPY_OUT_PRODUCT_SERVICES),\
+      $(subst $(_system_ext_path_placeholder),$(TARGET_COPY_OUT_SYSTEM_EXT),\
         $(subst $(_odm_path_placeholder),$(TARGET_COPY_OUT_ODM),\
           $(foreach p,$(1),$(call append-path,$(PRODUCT_OUT),$(p)$(2)))))))
 endef
@@ -1119,7 +1030,8 @@
 # variables being set.
 define auto-included-modules
   $(if $(BOARD_VNDK_VERSION),vndk_package) \
-  $(if $(DEVICE_MANIFEST_FILE),device_manifest.xml) \
+  $(if $(DEVICE_MANIFEST_FILE),vendor_manifest.xml) \
+  $(if $(DEVICE_MANIFEST_SKUS),$(foreach sku, $(DEVICE_MANIFEST_SKUS),vendor_manifest_$(sku).xml)) \
   $(if $(ODM_MANIFEST_FILES),odm_manifest.xml) \
   $(if $(ODM_MANIFEST_SKUS),$(foreach sku, $(ODM_MANIFEST_SKUS),odm_manifest_$(sku).xml)) \
 
@@ -1141,14 +1053,13 @@
 #   32-bit variant, if it exits. See the select-bitness-of-required-modules definition.
 # $(1): product makefile
 define product-installed-files
-  $(eval _mk := $(strip $(1))) \
   $(eval _pif_modules := \
-    $(PRODUCTS.$(_mk).PRODUCT_PACKAGES) \
-    $(if $(filter eng,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_ENG)) \
-    $(if $(filter debug,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_DEBUG)) \
-    $(if $(filter tests,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_TESTS)) \
-    $(if $(filter asan,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_DEBUG_ASAN)) \
-    $(if $(filter java_coverage,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_DEBUG_JAVA_COVERAGE)) \
+    $(call get-product-var,$(1),PRODUCT_PACKAGES) \
+    $(if $(filter eng,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_ENG)) \
+    $(if $(filter debug,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_DEBUG)) \
+    $(if $(filter tests,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_TESTS)) \
+    $(if $(filter asan,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_DEBUG_ASAN)) \
+    $(if $(filter java_coverage,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_DEBUG_JAVA_COVERAGE)) \
     $(call auto-included-modules) \
   ) \
   $(eval ### Filter out the overridden packages and executables before doing expansion) \
@@ -1167,13 +1078,13 @@
   $(call expand-required-modules,_pif_modules,$(_pif_modules),$(_pif_overrides)) \
   $(filter-out $(HOST_OUT_ROOT)/%,$(call module-installed-files, $(_pif_modules))) \
   $(call resolve-product-relative-paths,\
-    $(foreach cf,$(PRODUCTS.$(_mk).PRODUCT_COPY_FILES),$(call word-colon,2,$(cf))))
+    $(foreach cf,$(call get-product-var,$(1),PRODUCT_COPY_FILES),$(call word-colon,2,$(cf))))
 endef
 
 # Similar to product-installed-files above, but handles PRODUCT_HOST_PACKAGES instead
 # This does support the :32 / :64 syntax, but does not support module overrides.
 define host-installed-files
-  $(eval _hif_modules := $(PRODUCTS.$(strip $(1)).PRODUCT_HOST_PACKAGES)) \
+  $(eval _hif_modules := $(call get-product-var,$(1),PRODUCT_HOST_PACKAGES)) \
   $(eval ### Resolve the :32 :64 module name) \
   $(eval _hif_modules_32 := $(patsubst %:32,%,$(filter %:32, $(_hif_modules)))) \
   $(eval _hif_modules_64 := $(patsubst %:64,%,$(filter %:64, $(_hif_modules)))) \
@@ -1204,148 +1115,24 @@
 )
 endef
 
-# Check that libraries that should only be in APEXes don't end up in the system
-# image. For the Runtime APEX this complements the checks in
-# art/build/apex/art_apex_test.py.
-# TODO(b/128708192): Implement this restriction in Soong instead.
-
-# Runtime APEX libraries
-APEX_MODULE_LIBS := \
-  libadbconnection.so \
-  libadbconnectiond.so \
-  libandroidicu.so \
-  libandroidio.so \
-  libart-compiler.so \
-  libart-dexlayout.so \
-  libart-disassembler.so \
-  libart.so \
-  libartbase.so \
-  libartbased.so \
-  libartd-compiler.so \
-  libartd-dexlayout.so \
-  libartd.so \
-  libartpalette.so \
-  libc.so \
-  libdexfile.so \
-  libdexfile_external.so \
-  libdexfiled.so \
-  libdexfiled_external.so \
-  libdl.so \
-  libdt_fd_forward.so \
-  libdt_socket.so \
-  libicui18n.so \
-  libicuuc.so \
-  libjavacore.so \
-  libjdwp.so \
-  libm.so \
-  libnativebridge.so \
-  libnativehelper.so \
-  libnativeloader.so \
-  libnpt.so \
-  libopenjdk.so \
-  libopenjdkjvm.so \
-  libopenjdkjvmd.so \
-  libopenjdkjvmti.so \
-  libopenjdkjvmtid.so \
-  libpac.so \
-  libprofile.so \
-  libprofiled.so \
-  libsigchain.so \
-
-# Conscrypt APEX libraries
-APEX_MODULE_LIBS += \
-  libjavacrypto.so \
-
-# An option to disable the check below, for local use since some build targets
-# still may create these libraries in /system (b/129006418).
-DISABLE_APEX_LIBS_ABSENCE_CHECK ?=
-
-# Bionic should not be in /system, except for the bootstrap instance.
-APEX_LIBS_ABSENCE_CHECK_EXCLUDE := lib/bootstrap lib64/bootstrap
-
-# Exclude lib/arm and lib/arm64 which contain the native bridge proxy libs. They
-# are compiled for the guest architecture and used with an entirely different
-# linker config. The native libs are then linked to as usual via exported
-# interfaces, so the proxy libs do not violate the interface boundaries on the
-# native architecture.
-# TODO(b/130630776): Introduce a make variable for the appropriate directory
-# when native bridge is active.
-APEX_LIBS_ABSENCE_CHECK_EXCLUDE += lib/arm lib/arm64
-
-# Exclude vndk-* subdirectories which contain prebuilts from older releases.
-APEX_LIBS_ABSENCE_CHECK_EXCLUDE += lib/vndk-% lib64/vndk-%
-
-ifdef DISABLE_APEX_LIBS_ABSENCE_CHECK
-  check-apex-libs-absence :=
-  check-apex-libs-absence-on-disk :=
-else
-  # If the check below fails, some library has ended up in system/lib or
-  # system/lib64 that is intended to only go into some APEX package. The likely
-  # cause is that a library or binary in /system has grown a dependency that
-  # directly or indirectly pulls in the prohibited library.
-  #
-  # To resolve this, look for the APEX package that the library belong to -
-  # search for it in 'native_shared_lib' properties in 'apex' build modules (see
-  # art/build/apex/Android.bp for an example). Then check if there is an
-  # exported library in that APEX package that should be used instead, i.e. one
-  # listed in its 'native_shared_lib' property for which the corresponding
-  # 'cc_library' module has a 'stubs' clause (like libdexfile_external in
-  # art/libdexfile/Android.bp).
-  #
-  # If you cannot find an APEX exported library that fits your needs, or you
-  # think that the library you want to depend on should be allowed in /system,
-  # then please contact the owners of the APEX package containing the library.
-  #
-  # If you get this error for a library that is exported in an APEX, then the
-  # APEX might be misconfigured or something is wrong in the build system.
-  # Please reach out to the APEX package owners and/or soong-team@, or
-  # android-building@googlegroups.com externally.
-  define check-apex-libs-absence
-    $(call maybe-print-list-and-error, \
-      $(filter $(foreach lib,$(APEX_MODULE_LIBS),%/$(lib)), \
-        $(filter-out $(foreach dir,$(APEX_LIBS_ABSENCE_CHECK_EXCLUDE), \
-                       $(TARGET_OUT)/$(if $(findstring %,$(dir)),$(dir),$(dir)/%)), \
-          $(filter $(TARGET_OUT)/lib/% $(TARGET_OUT)/lib64/%,$(1)))), \
-      APEX libraries found in system image (see comment for check-apex-libs-absence in \
-      build/make/core/main.mk for details))
-  endef
-
-  # TODO(b/129006418): The check above catches libraries through product
-  # dependencies visible to make, but as long as they have install rules in
-  # /system they may still be created there through other make targets. To catch
-  # that we also do a check on disk just before the system image is built.
-  define check-apex-libs-absence-on-disk
-    $(hide) ( \
-      cd $(TARGET_OUT) && \
-      findres=$$(find lib* \
-        $(foreach dir,$(APEX_LIBS_ABSENCE_CHECK_EXCLUDE),-path "$(subst %,*,$(dir))" -prune -o) \
-        -type f \( -false $(foreach lib,$(APEX_MODULE_LIBS),-o -name $(lib)) \) \
-        -print) && \
-      if [ -n "$$findres" ]; then \
-        echo "APEX libraries found in system image (see comment for check-apex-libs-absence" 1>&2; \
-        echo "in build/make/core/main.mk for details):" 1>&2; \
-        echo "$$findres" | sort 1>&2; \
-        false; \
-      fi; \
-    )
-  endef
-endif
-
 ifdef FULL_BUILD
   ifneq (true,$(ALLOW_MISSING_DEPENDENCIES))
     # Check to ensure that all modules in PRODUCT_PACKAGES exist (opt in per product)
     ifeq (true,$(PRODUCT_ENFORCE_PACKAGES_EXIST))
-      _whitelist := $(PRODUCT_ENFORCE_PACKAGES_EXIST_WHITELIST)
+      _allow_list := $(PRODUCT_ENFORCE_PACKAGES_EXIST_ALLOW_LIST)
       _modules := $(PRODUCT_PACKAGES)
+      # Strip :32 and :64 suffixes
+      _modules := $(patsubst %:32,%,$(_modules))
+      _modules := $(patsubst %:64,%,$(_modules))
       # Sanity check all modules in PRODUCT_PACKAGES exist. We check for the
       # existence if either <module> or the <module>_32 variant.
-      _nonexistant_modules := $(filter-out $(ALL_MODULES),$(_modules))
-      _nonexistant_modules := $(foreach m,$(_nonexistant_modules),\
+      _nonexistent_modules := $(filter-out $(ALL_MODULES),$(_modules))
+      _nonexistent_modules := $(foreach m,$(_nonexistent_modules),\
         $(if $(call get-32-bit-modules,$(m)),,$(m)))
-      $(call maybe-print-list-and-error,$(filter-out $(_whitelist),$(_nonexistant_modules)),\
-        $(INTERNAL_PRODUCT) includes non-existant modules in PRODUCT_PACKAGES)
-      $(call maybe-print-list-and-error,$(filter-out $(_nonexistant_modules),$(_whitelist)),\
-        $(INTERNAL_PRODUCT) includes redundant whitelist entries for nonexistant PRODUCT_PACKAGES)
+      $(call maybe-print-list-and-error,$(filter-out $(_allow_list),$(_nonexistent_modules)),\
+        $(INTERNAL_PRODUCT) includes non-existent modules in PRODUCT_PACKAGES)
+      $(call maybe-print-list-and-error,$(filter-out $(_nonexistent_modules),$(_allow_list)),\
+        $(INTERNAL_PRODUCT) includes redundant allow list entries for non-existent PRODUCT_PACKAGES)
     endif
 
     # Check to ensure that all modules in PRODUCT_HOST_PACKAGES exist
@@ -1354,20 +1141,23 @@
     # maybe it would make sense to have PRODUCT_HOST_PACKAGES_LINUX/_DARWIN?
     ifneq ($(HOST_OS),darwin)
       _modules := $(PRODUCT_HOST_PACKAGES)
-      _nonexistant_modules := $(foreach m,$(_modules),\
+      # Strip :32 and :64 suffixes
+      _modules := $(patsubst %:32,%,$(_modules))
+      _modules := $(patsubst %:64,%,$(_modules))
+      _nonexistent_modules := $(foreach m,$(_modules),\
         $(if $(ALL_MODULES.$(m).REQUIRED_FROM_HOST)$(filter $(HOST_OUT_ROOT)/%,$(ALL_MODULES.$(m).INSTALLED)),,$(m)))
-      $(call maybe-print-list-and-error,$(_nonexistant_modules),\
-        $(INTERNAL_PRODUCT) includes non-existant modules in PRODUCT_HOST_PACKAGES)
+      $(call maybe-print-list-and-error,$(_nonexistent_modules),\
+        $(INTERNAL_PRODUCT) includes non-existent modules in PRODUCT_HOST_PACKAGES)
     endif
   endif
 
   # Some modules produce only host installed files when building with TARGET_BUILD_APPS
   ifeq ($(TARGET_BUILD_APPS),)
-    _modules := $(foreach m,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG_ASAN) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_ENG) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_TESTS),\
+    _modules := $(foreach m,$(PRODUCT_PACKAGES) \
+                            $(PRODUCT_PACKAGES_DEBUG) \
+                            $(PRODUCT_PACKAGES_DEBUG_ASAN) \
+                            $(PRODUCT_PACKAGES_ENG) \
+                            $(PRODUCT_PACKAGES_TESTS),\
                   $(if $(ALL_MODULES.$(m).INSTALLED),\
                     $(if $(filter-out $(HOST_OUT_ROOT)/%,$(ALL_MODULES.$(m).INSTALLED)),,\
                       $(m))))
@@ -1383,22 +1173,22 @@
   # Verify the artifact path requirements made by included products.
   is_asan := $(if $(filter address,$(SANITIZE_TARGET)),true)
   ifneq (true,$(or $(is_asan),$(DISABLE_ARTIFACT_PATH_REQUIREMENTS)))
-  # Fakes don't get installed, host files are irrelevant, and NDK stubs aren't installed to device.
-  static_whitelist_patterns := $(TARGET_OUT_FAKE)/% $(HOST_OUT)/% $(SOONG_OUT_DIR)/ndk/%
+  # Fakes don't get installed, and NDK stubs aren't installed to device.
+  static_allowed_patterns := $(TARGET_OUT_FAKE)/% $(SOONG_OUT_DIR)/ndk/%
   # RROs become REQUIRED by the source module, but are always placed on the vendor partition.
-  static_whitelist_patterns += %__auto_generated_rro_product.apk
-  static_whitelist_patterns += %__auto_generated_rro_vendor.apk
+  static_allowed_patterns += %__auto_generated_rro_product.apk
+  static_allowed_patterns += %__auto_generated_rro_vendor.apk
   # Auto-included targets are not considered
-  static_whitelist_patterns += $(call module-installed-files,$(call auto-included-modules))
+  static_allowed_patterns += $(call product-installed-files,)
   # $(PRODUCT_OUT)/apex is where shared libraries in APEXes get installed.
   # The path can be considered as a fake path, as the shared libraries
   # are installed there just to have symbols files for them under
   # $(PRODUCT_OUT)/symbols/apex for debugging purpose. The /apex directory
   # is never compiled into a filesystem image.
-  static_whitelist_patterns += $(PRODUCT_OUT)/apex/%
+  static_allowed_patterns += $(PRODUCT_OUT)/apex/%
   ifeq (true,$(BOARD_USES_SYSTEM_OTHER_ODEX))
     # Allow system_other odex space optimization.
-    static_whitelist_patterns += \
+    static_allowed_patterns += \
       $(TARGET_OUT_SYSTEM_OTHER)/%.odex \
       $(TARGET_OUT_SYSTEM_OTHER)/%.vdex \
       $(TARGET_OUT_SYSTEM_OTHER)/%.art
@@ -1414,37 +1204,37 @@
   $(foreach makefile,$(ARTIFACT_PATH_REQUIREMENT_PRODUCTS),\
     $(eval requirements := $(PRODUCTS.$(makefile).ARTIFACT_PATH_REQUIREMENTS)) \
     $(eval ### Verify that the product only produces files inside its path requirements.) \
-    $(eval whitelist := $(PRODUCTS.$(makefile).ARTIFACT_PATH_WHITELIST)) \
+    $(eval allowed := $(PRODUCTS.$(makefile).ARTIFACT_PATH_ALLOWED_LIST)) \
     $(eval path_patterns := $(call resolve-product-relative-paths,$(requirements),%)) \
-    $(eval whitelist_patterns := $(call resolve-product-relative-paths,$(whitelist))) \
+    $(eval allowed_patterns := $(call resolve-product-relative-paths,$(allowed))) \
     $(eval files := $(call product-installed-files, $(makefile))) \
-    $(eval offending_files := $(filter-out $(path_patterns) $(whitelist_patterns) $(static_whitelist_patterns),$(files))) \
-    $(call maybe-print-list-and-error,$(offending_files),$(makefile) produces files outside its artifact path requirement.) \
-    $(eval unused_whitelist := $(filter-out $(files),$(whitelist_patterns))) \
-    $(call maybe-print-list-and-error,$(unused_whitelist),$(makefile) includes redundant whitelist entries in its artifact path requirement.) \
+    $(eval offending_files := $(filter-out $(path_patterns) $(allowed_patterns) $(static_allowed_patterns),$(files))) \
+    $(call maybe-print-list-and-error,$(offending_files),\
+      $(makefile) produces files outside its artifact path requirement. \
+      Allowed paths are $(subst $(space),$(comma)$(space),$(addsuffix *,$(requirements)))) \
+    $(eval unused_allowed := $(filter-out $(files),$(allowed_patterns))) \
+    $(call maybe-print-list-and-error,$(unused_allowed),$(makefile) includes redundant allowed entries in its artifact path requirement.) \
     $(eval ### Optionally verify that nothing else produces files inside this artifact path requirement.) \
     $(eval extra_files := $(filter-out $(files) $(HOST_OUT)/%,$(product_target_FILES))) \
     $(eval files_in_requirement := $(filter $(path_patterns),$(extra_files))) \
     $(eval all_offending_files += $(files_in_requirement)) \
-    $(eval whitelist := $(PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST)) \
-    $(eval whitelist_patterns := $(call resolve-product-relative-paths,$(whitelist))) \
-    $(eval offending_files := $(filter-out $(whitelist_patterns),$(files_in_requirement))) \
+    $(eval allowed := $(PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST)) \
+    $(eval allowed_patterns := $(call resolve-product-relative-paths,$(allowed))) \
+    $(eval offending_files := $(filter-out $(allowed_patterns),$(files_in_requirement))) \
     $(eval enforcement := $(PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS)) \
     $(if $(enforcement),\
       $(call maybe-print-list-and-error,$(offending_files),\
         $(INTERNAL_PRODUCT) produces files inside $(makefile)s artifact path requirement. \
         $(PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT)) \
-      $(eval unused_whitelist := $(if $(filter true strict,$(enforcement)),\
-        $(foreach p,$(whitelist_patterns),$(if $(filter $(p),$(extra_files)),,$(p))))) \
-      $(call maybe-print-list-and-error,$(unused_whitelist),$(INTERNAL_PRODUCT) includes redundant artifact path requirement whitelist entries.) \
+      $(eval unused_allowed := $(if $(filter true strict,$(enforcement)),\
+        $(foreach p,$(allowed_patterns),$(if $(filter $(p),$(extra_files)),,$(p))))) \
+      $(call maybe-print-list-and-error,$(unused_allowed),$(INTERNAL_PRODUCT) includes redundant artifact path requirement allowed list entries.) \
     ) \
   )
 $(PRODUCT_OUT)/offending_artifacts.txt:
 	rm -f $@
 	$(foreach f,$(sort $(all_offending_files)),echo $(f) >> $@;)
   endif
-
-  $(call check-apex-libs-absence,$(product_target_FILES))
 else
   # We're not doing a full build, and are probably only including
   # a subset of the module makefiles.  Don't try to build any modules
@@ -1460,10 +1250,33 @@
     $(ALL_DEFAULT_INSTALLED_MODULES) \
     $(product_target_FILES) \
     $(product_host_FILES) \
-    $(call get-tagged-modules,$(tags_to_install)) \
     $(CUSTOM_MODULES) \
   )
 
+ifdef FULL_BUILD
+#
+# Used by the cleanup logic in soong_ui to remove files that should no longer
+# be installed.
+#
+
+# Include all tests, so that we remove them from the test suites / testcase
+# folders when they are removed.
+test_files := $(foreach ts,$(ALL_COMPATIBILITY_SUITES),$(COMPATIBILITY.$(ts).FILES))
+
+$(shell mkdir -p $(PRODUCT_OUT) $(HOST_OUT))
+
+$(file >$(PRODUCT_OUT)/.installable_files$(if $(filter address,$(SANITIZE_TARGET)),_asan), \
+  $(sort $(patsubst $(PRODUCT_OUT)/%,%,$(filter $(PRODUCT_OUT)/%, \
+    $(modules_to_install) $(test_files)))))
+
+$(file >$(HOST_OUT)/.installable_test_files,$(sort \
+  $(patsubst $(HOST_OUT)/%,%,$(filter $(HOST_OUT)/%, \
+    $(test_files)))))
+
+test_files :=
+endif
+
+
 # Don't include any GNU General Public License shared objects or static
 # libraries in SDK images.  GPL executables (not static/dynamic libraries)
 # are okay if they don't link against any closed source libraries (directly
@@ -1527,7 +1340,7 @@
 endif
 
 # Build docs as part of checkbuild to catch more breakages.
-module_to_check += $(ALL_DOCS)
+modules_to_check += $(ALL_DOCS)
 
 # for easier debugging
 modules_to_check := $(sort $(modules_to_check))
@@ -1553,7 +1366,7 @@
 # -------------------------------------------------------------------
 
 .PHONY: checkbuild
-checkbuild: $(modules_to_check) droid_targets
+checkbuild: $(modules_to_check) droid_targets check-elf-files
 
 ifeq (true,$(ANDROID_BUILD_EVERYTHING_BY_DEFAULT))
 droid: checkbuild
@@ -1565,11 +1378,11 @@
 .PHONY: ramdisk_debug
 ramdisk_debug: $(INSTALLED_DEBUG_RAMDISK_TARGET)
 
-.PHONY: systemtarball
-systemtarball: $(INSTALLED_SYSTEMTARBALL_TARGET)
+.PHONY: ramdisk_test_harness
+ramdisk_test_harness: $(INSTALLED_TEST_HARNESS_RAMDISK_TARGET)
 
-.PHONY: boottarball
-boottarball: $(INSTALLED_BOOTTARBALL_TARGET)
+.PHONY: vendor_ramdisk_debug
+vendor_ramdisk_debug: $(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET)
 
 .PHONY: userdataimage
 userdataimage: $(INSTALLED_USERDATAIMAGE_TARGET)
@@ -1578,9 +1391,6 @@
 $(call dist-for-goals, userdataimage, $(BUILT_USERDATAIMAGE_TARGET))
 endif
 
-.PHONY: userdatatarball
-userdatatarball: $(INSTALLED_USERDATATARBALL_TARGET)
-
 .PHONY: cacheimage
 cacheimage: $(INSTALLED_CACHEIMAGE_TARGET)
 
@@ -1590,11 +1400,17 @@
 .PHONY: vendorimage
 vendorimage: $(INSTALLED_VENDORIMAGE_TARGET)
 
+.PHONY: vendorbootimage
+vendorbootimage: $(INSTALLED_VENDOR_BOOTIMAGE_TARGET)
+
+.PHONY: vendorbootimage_debug
+vendorbootimage_debug: $(INSTALLED_VENDOR_DEBUG_BOOTIMAGE_TARGET)
+
 .PHONY: productimage
 productimage: $(INSTALLED_PRODUCTIMAGE_TARGET)
 
-.PHONY: productservicesimage
-productservicesimage: $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET)
+.PHONY: systemextimage
+systemextimage: $(INSTALLED_SYSTEM_EXTIMAGE_TARGET)
 
 .PHONY: odmimage
 odmimage: $(INSTALLED_ODMIMAGE_TARGET)
@@ -1611,6 +1427,9 @@
 .PHONY: bootimage_debug
 bootimage_debug: $(INSTALLED_DEBUG_BOOTIMAGE_TARGET)
 
+.PHONY: bootimage_test_harness
+bootimage_test_harness: $(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET)
+
 .PHONY: vbmetaimage
 vbmetaimage: $(INSTALLED_VBMETAIMAGE_TARGET)
 
@@ -1623,6 +1442,7 @@
     $(INSTALLED_SYSTEMIMAGE_TARGET) \
     $(INSTALLED_RAMDISK_TARGET) \
     $(INSTALLED_BOOTIMAGE_TARGET) \
+    $(INSTALLED_RADIOIMAGE_TARGET) \
     $(INSTALLED_DEBUG_RAMDISK_TARGET) \
     $(INSTALLED_DEBUG_BOOTIMAGE_TARGET) \
     $(INSTALLED_RECOVERYIMAGE_TARGET) \
@@ -1631,6 +1451,9 @@
     $(INSTALLED_CACHEIMAGE_TARGET) \
     $(INSTALLED_BPTIMAGE_TARGET) \
     $(INSTALLED_VENDORIMAGE_TARGET) \
+    $(INSTALLED_VENDOR_BOOTIMAGE_TARGET) \
+    $(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET) \
+    $(INSTALLED_VENDOR_DEBUG_BOOTIMAGE_TARGET) \
     $(INSTALLED_ODMIMAGE_TARGET) \
     $(INSTALLED_SUPERIMAGE_EMPTY_TARGET) \
     $(INSTALLED_PRODUCTIMAGE_TARGET) \
@@ -1643,14 +1466,16 @@
     $(INSTALLED_FILES_JSON_ODM) \
     $(INSTALLED_FILES_FILE_PRODUCT) \
     $(INSTALLED_FILES_JSON_PRODUCT) \
-    $(INSTALLED_FILES_FILE_PRODUCT_SERVICES) \
-    $(INSTALLED_FILES_JSON_PRODUCT_SERVICES) \
+    $(INSTALLED_FILES_FILE_SYSTEM_EXT) \
+    $(INSTALLED_FILES_JSON_SYSTEM_EXT) \
     $(INSTALLED_FILES_FILE_SYSTEMOTHER) \
     $(INSTALLED_FILES_JSON_SYSTEMOTHER) \
     $(INSTALLED_FILES_FILE_RAMDISK) \
     $(INSTALLED_FILES_JSON_RAMDISK) \
     $(INSTALLED_FILES_FILE_DEBUG_RAMDISK) \
     $(INSTALLED_FILES_JSON_DEBUG_RAMDISK) \
+    $(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK) \
+    $(INSTALLED_FILES_JSON_VENDOR_DEBUG_RAMDISK) \
     $(INSTALLED_FILES_FILE_ROOT) \
     $(INSTALLED_FILES_JSON_ROOT) \
     $(INSTALLED_FILES_FILE_RECOVERY) \
@@ -1683,6 +1508,14 @@
     $(if $(ALL_MODULES.$(m).BUNDLE),$(ALL_MODULES.$(m).BUNDLE):$(m)-base.zip))
   $(call dist-for-goals,apps_only, $(apps_only_bundle_files))
 
+  # Dist the lint reports if they exist.
+  apps_only_lint_report_files := $(foreach m,$(unbundled_build_modules),\
+    $(foreach report,$(ALL_MODULES.$(m).LINT_REPORTS),\
+      $(report):$(m)-$(notdir $(report))))
+  .PHONY: lint-check
+  lint-check: $(foreach f, $(apps_only_lint_report_files), $(call word-colon,1,$(f)))
+  $(call dist-for-goals,lint-check, $(apps_only_lint_report_files))
+
   # For uninstallable modules such as static Java library, we have to dist the built file,
   # as <module_name>.<suffix>
   apps_only_dist_built_files := $(foreach m,$(unbundled_build_modules),$(if $(ALL_MODULES.$(m).INSTALLED),,\
@@ -1726,6 +1559,7 @@
     $(INTERNAL_OTA_RETROFIT_DYNAMIC_PARTITIONS_PACKAGE_TARGET) \
     $(BUILT_OTATOOLS_PACKAGE) \
     $(SYMBOLS_ZIP) \
+    $(PROGUARD_DICT_ZIP) \
     $(COVERAGE_ZIP) \
     $(APPCOMPAT_ZIP) \
     $(INSTALLED_FILES_FILE) \
@@ -1736,8 +1570,8 @@
     $(INSTALLED_FILES_JSON_ODM) \
     $(INSTALLED_FILES_FILE_PRODUCT) \
     $(INSTALLED_FILES_JSON_PRODUCT) \
-    $(INSTALLED_FILES_FILE_PRODUCT_SERVICES) \
-    $(INSTALLED_FILES_JSON_PRODUCT_SERVICES) \
+    $(INSTALLED_FILES_FILE_SYSTEM_EXT) \
+    $(INSTALLED_FILES_JSON_SYSTEM_EXT) \
     $(INSTALLED_FILES_FILE_SYSTEMOTHER) \
     $(INSTALLED_FILES_JSON_SYSTEMOTHER) \
     $(INSTALLED_FILES_FILE_RECOVERY) \
@@ -1745,6 +1579,7 @@
     $(INSTALLED_BUILD_PROP_TARGET) \
     $(BUILT_TARGET_FILES_PACKAGE) \
     $(INSTALLED_ANDROID_INFO_TXT_TARGET) \
+    $(INSTALLED_MISC_INFO_TARGET) \
     $(INSTALLED_RAMDISK_TARGET) \
    )
 
@@ -1757,7 +1592,6 @@
     $(call dist-for-goals, droidcore, \
       $(APPS_ZIP) \
       $(INTERNAL_EMULATOR_PACKAGE_TARGET) \
-      $(PACKAGE_STATS_FILE) \
     )
   endif
   endif
@@ -1773,22 +1607,38 @@
       $(INSTALLED_FILES_JSON_RAMDISK) \
       $(INSTALLED_FILES_FILE_DEBUG_RAMDISK) \
       $(INSTALLED_FILES_JSON_DEBUG_RAMDISK) \
+      $(INSTALLED_FILES_FILE_VENDOR_DEBUG_RAMDISK) \
+      $(INSTALLED_FILES_JSON_VENDOR_DEBUG_RAMDISK) \
       $(INSTALLED_DEBUG_RAMDISK_TARGET) \
       $(INSTALLED_DEBUG_BOOTIMAGE_TARGET) \
+      $(INSTALLED_VENDOR_DEBUG_RAMDISK_TARGET) \
+      $(INSTALLED_VENDOR_DEBUG_BOOTIMAGE_TARGET) \
+    )
+    $(call dist-for-goals, bootimage_test_harness, \
+      $(INSTALLED_TEST_HARNESS_RAMDISK_TARGET) \
+      $(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET) \
+    )
+  endif
+
+  ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+    $(call dist-for-goals, droidcore, \
+      $(recovery_ramdisk) \
     )
   endif
 
   ifeq ($(EMMA_INSTRUMENT),true)
-    $(JACOCO_REPORT_CLASSES_ALL) : $(INSTALLED_SYSTEMIMAGE_TARGET)
+    $(JACOCO_REPORT_CLASSES_ALL) : $(modules_to_install)
     $(call dist-for-goals, dist_files, $(JACOCO_REPORT_CLASSES_ALL))
   endif
 
   # Put XML formatted API files in the dist dir.
-  $(TARGET_OUT_COMMON_INTERMEDIATES)/api.xml: $(call java-lib-header-files,android_stubs_current) $(APICHECK)
-  $(TARGET_OUT_COMMON_INTERMEDIATES)/system-api.xml: $(call java-lib-header-files,android_system_stubs_current) $(APICHECK)
-  $(TARGET_OUT_COMMON_INTERMEDIATES)/test-api.xml: $(call java-lib-header-files,android_test_stubs_current) $(APICHECK)
+  $(TARGET_OUT_COMMON_INTERMEDIATES)/api.xml: $(call java-lib-files,android_stubs_current) $(APICHECK)
+  $(TARGET_OUT_COMMON_INTERMEDIATES)/system-api.xml: $(call java-lib-files,android_system_stubs_current) $(APICHECK)
+  $(TARGET_OUT_COMMON_INTERMEDIATES)/module-lib-api.xml: $(call java-lib-files,android_module_lib_stubs_current) $(APICHECK)
+  $(TARGET_OUT_COMMON_INTERMEDIATES)/system-server-api.xml: $(call java-lib-files,android_system_server_stubs_current) $(APICHECK)
+  $(TARGET_OUT_COMMON_INTERMEDIATES)/test-api.xml: $(call java-lib-files,android_test_stubs_current) $(APICHECK)
 
-  api_xmls := $(addprefix $(TARGET_OUT_COMMON_INTERMEDIATES)/,api.xml system-api.xml test-api.xml)
+  api_xmls := $(addprefix $(TARGET_OUT_COMMON_INTERMEDIATES)/,api.xml system-api.xml module-lib-api.xml system-server-api.xml test-api.xml)
   $(api_xmls):
 	$(hide) echo "Converting API file to XML: $@"
 	$(hide) mkdir -p $(dir $@)
@@ -1835,34 +1685,19 @@
 # Phony target to run all java compilations that use javac
 .PHONY: javac-check
 
-ifneq (,$(filter samplecode, $(MAKECMDGOALS)))
-.PHONY: samplecode
-sample_MODULES := $(sort $(call get-tagged-modules,samples))
-sample_APKS_DEST_PATH := $(TARGET_COMMON_OUT_ROOT)/samples
-sample_APKS_COLLECTION := \
-        $(foreach module,$(sample_MODULES),$(sample_APKS_DEST_PATH)/$(notdir $(module)))
-$(foreach module,$(sample_MODULES),$(eval $(call \
-        copy-one-file,$(module),$(sample_APKS_DEST_PATH)/$(notdir $(module)))))
-sample_ADDITIONAL_INSTALLED := \
-        $(filter-out $(modules_to_install) $(modules_to_check),$(sample_MODULES))
-samplecode: $(sample_APKS_COLLECTION)
-	@echo "Collect sample code apks: $^"
-	# remove apks that are not intended to be installed.
-	rm -f $(sample_ADDITIONAL_INSTALLED)
-endif  # samplecode in $(MAKECMDGOALS)
-
 .PHONY: findbugs
 findbugs: $(INTERNAL_FINDBUGS_HTML_TARGET) $(INTERNAL_FINDBUGS_XML_TARGET)
 
 LSDUMP_PATHS_FILE := $(PRODUCT_OUT)/lsdump_paths.txt
 
 .PHONY: findlsdumps
-findlsdumps: $(LSDUMP_PATHS_FILE) $(LSDUMP_PATHS)
+# LSDUMP_PATHS is a list of tag:path.
+findlsdumps: $(LSDUMP_PATHS_FILE) $(foreach p,$(LSDUMP_PATHS),$(call word-colon,2,$(p)))
 
 $(LSDUMP_PATHS_FILE): PRIVATE_LSDUMP_PATHS := $(LSDUMP_PATHS)
 $(LSDUMP_PATHS_FILE):
 	@echo "Generate $@"
-	@rm -rf $@ && echo "$(PRIVATE_LSDUMP_PATHS)" | sed -e 's/ /\n/g' > $@
+	@rm -rf $@ && echo -e "$(subst :,:$(space),$(subst $(space),\n,$(PRIVATE_LSDUMP_PATHS)))" > $@
 
 .PHONY: check-elf-files
 check-elf-files:
@@ -1894,5 +1729,3 @@
 $(call dist-write-file,$(KATI_PACKAGE_MK_DIR)/dist.mk)
 
 $(info [$(call inc_and_print,subdir_makefiles_inc)/$(subdir_makefiles_total)] writing build rules ...)
-
-endif # KATI
diff --git a/core/misc_prebuilt_internal.mk b/core/misc_prebuilt_internal.mk
new file mode 100644
index 0000000..921ea52
--- /dev/null
+++ b/core/misc_prebuilt_internal.mk
@@ -0,0 +1,38 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+############################################################
+# Internal build rules for misc prebuilt modules that don't need additional processing
+############################################################
+
+prebuilt_module_classes := SCRIPT ETC DATA RENDERSCRIPT_BITCODE
+ifeq ($(filter $(prebuilt_module_classes),$(LOCAL_MODULE_CLASS)),)
+$(call pretty-error,misc_prebuilt_internal.mk is for $(prebuilt_module_classes) modules only)
+endif
+
+include $(BUILD_SYSTEM)/base_rules.mk
+
+ifneq ($(filter init%rc,$(notdir $(LOCAL_INSTALLED_MODULE)))$(filter %/etc/init,$(dir $(LOCAL_INSTALLED_MODULE))),)
+  $(eval $(call copy-init-script-file-checked,$(my_prebuilt_src_file),$(LOCAL_BUILT_MODULE)))
+else ifneq ($(LOCAL_PREBUILT_STRIP_COMMENTS),)
+$(LOCAL_BUILT_MODULE) : $(my_prebuilt_src_file)
+	$(transform-prebuilt-to-target-strip-comments)
+else
+$(LOCAL_BUILT_MODULE) : $(my_prebuilt_src_file)
+	$(transform-prebuilt-to-target)
+endif
+
+built_module := $(LOCAL_BUILT_MODULE)
diff --git a/core/ninja_config.mk b/core/ninja_config.mk
index e9e89c3..591937c 100644
--- a/core/ninja_config.mk
+++ b/core/ninja_config.mk
@@ -7,7 +7,7 @@
 KATI_OUTPUT_PATTERNS := $(OUT_DIR)/build%.ninja $(OUT_DIR)/ninja%.sh
 
 # Modifier goals we don't need to pass to Ninja.
-NINJA_EXCLUDE_GOALS := all APP-% PRODUCT-%
+NINJA_EXCLUDE_GOALS := all
 
 # A list of goals which affect parsing of makefiles and we need to pass to Kati.
 PARSE_TIME_MAKE_GOALS := \
@@ -16,7 +16,6 @@
 	all \
 	ECLIPSE-% \
 	AUX-% \
-	boottarball-nodeps \
 	brillo_tests \
 	btnod \
 	build-art% \
@@ -44,20 +43,19 @@
 	snod \
 	stnod \
 	systemimage-nodeps \
-	systemtarball-nodeps \
 	target-files-package \
 	test-art% \
 	user \
 	userdataimage \
 	userdebug \
-	vts \
+	vts10 \
 	win_sdk \
 	winsdk-tools
 
 include $(wildcard vendor/*/build/ninja_config.mk)
 
 # Any Android goals that need to be built.
-ANDROID_GOALS := $(filter-out $(KATI_OUTPUT_PATTERNS) $(CKATI) $(MAKEPARALLEL),\
+ANDROID_GOALS := $(filter-out $(KATI_OUTPUT_PATTERNS),\
     $(sort $(ORIGINAL_MAKECMDGOALS) $(MAKECMDGOALS)))
 # Goals we need to pass to Ninja.
 NINJA_GOALS := $(filter-out $(NINJA_EXCLUDE_GOALS), $(ANDROID_GOALS))
diff --git a/core/node_fns.mk b/core/node_fns.mk
index ccfcc25..b81d60c 100644
--- a/core/node_fns.mk
+++ b/core/node_fns.mk
@@ -142,7 +142,8 @@
 #
 # $(1): context prefix
 # $(2): name of this node
-# $(3): list of variable names
+# $(3): list of node variable names
+# $(4): list of single value variable names (subset of $(3))
 #
 define _expand-inherited-values
   $(foreach v,$(3), \
@@ -154,15 +155,21 @@
             $(patsubst $(INHERIT_TAG)%,%, \
                 $(filter $(INHERIT_TAG)%, $($(_eiv_tv)) \
      )))) \
+    $(eval ### "Whether this variable should only take a single value") \
+    $(eval _eiv_sv := $(filter $(v),$(4))) \
     $(foreach i,$(_eiv_i), \
       $(eval ### "Make sure that this inherit appears only once") \
       $(eval $(_eiv_tv) := \
           $(call uniq-word,$($(_eiv_tv)),$(INHERIT_TAG)$(i))) \
+      $(eval ### "The expanded value, empty if we want a single value and have one") \
+      $(eval _eiv_ev := \
+        $(if $(and $(_eiv_sv),$(filter-out $(INHERIT_TAG)%,$($(_eiv_tv)))),,\
+          $($(1).$(i).$(v)) \
+        ) \
+      ) \
       $(eval ### "Expand the inherit tag") \
       $(eval $(_eiv_tv) := \
-          $(strip \
-              $(patsubst $(INHERIT_TAG)$(i),$($(1).$(i).$(v)), \
-                  $($(_eiv_tv))))) \
+          $(strip $(patsubst $(INHERIT_TAG)$(i),$(_eiv_ev),$($(_eiv_tv))))) \
       $(eval ### "Clear the child so DAGs don't create duplicate entries" ) \
       $(eval $(1).$(i).$(v) :=) \
       $(eval ### "If we just inherited ourselves, it's a cycle.") \
@@ -180,6 +187,7 @@
 # $(1): context prefix
 # $(2): makefile representing this node
 # $(3): list of node variable names
+# $(4): list of single value variable names (subset of $(3))
 #
 # _include_stack contains the list of included files, with the most recent files first.
 define _import-node
@@ -198,7 +206,7 @@
       $(call get-inherited-nodes,$(1).$(2),$(3)))
   $(call _import-nodes-inner,$(1),$($(1).$(2).inherited),$(3))
 
-  $(call _expand-inherited-values,$(1),$(2),$(3))
+  $(call _expand-inherited-values,$(1),$(2),$(3),$(4))
 
   $(eval $(1).$(2).inherited :=)
   $(eval _include_stack := $(wordlist 2,9999,$$(_include_stack)))
@@ -215,6 +223,7 @@
 # $(1): context prefix
 # $(2): list of makefiles representing nodes to import
 # $(3): list of node variable names
+# $(4): list of single value variable names (subset of $(3))
 #
 #TODO: Make the "does not exist" message more helpful;
 #      should print out the name of the file trying to include it.
@@ -225,7 +234,7 @@
         $(eval ### "skipping already-imported $(_in)") \
        , \
         $(eval $(1).$(_in).seen := true) \
-        $(call _import-node,$(1),$(strip $(_in)),$(3)) \
+        $(call _import-node,$(1),$(strip $(_in)),$(3),$(4)) \
        ) \
      , \
       $(error $(1): "$(_in)" does not exist) \
@@ -237,6 +246,8 @@
 # $(1): output list variable name, like "PRODUCTS" or "DEVICES"
 # $(2): list of makefiles representing nodes to import
 # $(3): list of node variable names
+# $(4): list with subset of variable names that take only a single value, instead
+#       of the default list semantics
 #
 define import-nodes
 $(if \
@@ -245,7 +256,7 @@
     $(if $(_include_stack),$(eval $(error ASSERTION FAILED: _include_stack \
                 should be empty here: $(_include_stack))),) \
     $(eval _include_stack := ) \
-    $(call _import-nodes-inner,$(_node_import_context),$(_in),$(3)) \
+    $(call _import-nodes-inner,$(_node_import_context),$(_in),$(3),$(4)) \
     $(call move-var-list,$(_node_import_context).$(_in),$(1).$(_in),$(3)) \
     $(eval _node_import_context :=) \
     $(eval $(1) := $($(1)) $(_in)) \
diff --git a/core/notice_files.mk b/core/notice_files.mk
index c314734..22f8e41 100644
--- a/core/notice_files.mk
+++ b/core/notice_files.mk
@@ -55,12 +55,15 @@
   module_installed_filename := $(patsubst $(PRODUCT_OUT)/%,%,$(LOCAL_INSTALLED_MODULE))
 else
   # This module isn't installable
-  ifneq ($(filter STATIC_LIBRARIES HEADER_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
+  ifneq ($(filter  STATIC_LIBRARIES RLIB_LIBRARIES PROC_MACRO_LIBRARIES HEADER_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
     # Stick the static libraries with the dynamic libraries.
     # We can't use xxx_OUT_STATIC_LIBRARIES because it points into
     # device-obj or host-obj.
     module_installed_filename := \
         $(patsubst $(PRODUCT_OUT)/%,%,$($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_SHARED_LIBRARIES))/$(notdir $(LOCAL_BUILT_MODULE))
+  else ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
+    # Shared modules may be uninstallable(e.g. TARGET_SKIP_CURRENT_VNDK=true)
+    module_installed_filename :=
   else
     ifeq ($(LOCAL_MODULE_CLASS),JAVA_LIBRARIES)
       # Stick the static java libraries with the regular java libraries.
@@ -68,14 +71,21 @@
       # javalib.jar is the default name for the build module (and isn't meaningful)
       # If that's what we have, substitute the module name instead.  These files
       # aren't included on the device, so this name is synthetic anyway.
+      # Extra path "static" is added to try to avoid name conflict between the notice file of
+      # this 'uninstallable' Java module and the notice file for another 'installable' Java module
+      # whose stem is the same as this module's name.
       ifneq ($(filter javalib.jar,$(module_leaf)),)
-        module_leaf := $(LOCAL_MODULE).jar
+        module_leaf := static/$(LOCAL_MODULE).jar
       endif
       module_installed_filename := \
           $(patsubst $(PRODUCT_OUT)/%,%,$($(my_prefix)OUT_JAVA_LIBRARIES))/$(module_leaf)
     else ifeq ($(LOCAL_MODULE_CLASS),ETC)
       # ETC modules may be uninstallable, yet still have a NOTICE file. e.g. apex components
       module_installed_filename :=
+    else ifneq (,$(and $(filter %.sdk,$(LOCAL_MODULE)),$(filter $(patsubst %.sdk,%,$(LOCAL_MODULE)),$(SOONG_SDK_VARIANT_MODULES))))
+      # Soong produces uninstallable *.sdk shared libraries for embedding in APKs.
+      module_installed_filename := \
+          $(patsubst $(PRODUCT_OUT)/%,%,$($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_SHARED_LIBRARIES))/$(notdir $(LOCAL_BUILT_MODULE))
     else
       $(error Cannot determine where to install NOTICE file for $(LOCAL_MODULE))
     endif # JAVA_LIBRARIES
diff --git a/core/pack_dyn_relocs_setup.mk b/core/pack_dyn_relocs_setup.mk
index c5564b1..f86e11e 100644
--- a/core/pack_dyn_relocs_setup.mk
+++ b/core/pack_dyn_relocs_setup.mk
@@ -32,3 +32,12 @@
   # Do not pack relocations on host modules
   my_pack_module_relocations := false
 endif
+
+# Lld relocation packing cannot be enabled for binaries before Android Pie.
+ifneq ($(LOCAL_SDK_VERSION),)
+  ifneq ($(LOCAL_SDK_VERSION),current)
+    ifeq ($(call math_lt,$(LOCAL_SDK_VERSION),28),true)
+      my_pack_module_relocations := false
+    endif
+  endif
+endif
diff --git a/core/package.mk b/core/package.mk
index 854e009..6bde485 100644
--- a/core/package.mk
+++ b/core/package.mk
@@ -7,14 +7,6 @@
 my_prefix := TARGET_
 include $(BUILD_SYSTEM)/multilib.mk
 
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-  ifeq ($(TARGET_SUPPORTS_64_BIT_APPS),true)
-    my_module_multilib := first
-  else ifneq ($(my_module_multilib),64)
-    my_module_multilib := first
-  endif
-endif
-
 ifeq ($(TARGET_SUPPORTS_32_BIT_APPS)|$(TARGET_SUPPORTS_64_BIT_APPS),true|true)
   # packages default to building for either architecture,
   # the preferred if its supported, otherwise the non-preferred.
diff --git a/core/package_internal.mk b/core/package_internal.mk
index e27f6ce..692ff49 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -25,18 +25,6 @@
 ## be set for you.
 ###########################################################
 
-# If this makefile is being read from within an inheritance,
-# use the new values.
-skip_definition:=
-ifdef LOCAL_PACKAGE_OVERRIDES
-  package_overridden := $(call set-inherited-package-variables)
-  ifeq ($(strip $(package_overridden)),)
-    skip_definition := true
-  endif
-endif
-
-ifndef skip_definition
-
 LOCAL_PACKAGE_NAME := $(strip $(LOCAL_PACKAGE_NAME))
 ifeq ($(LOCAL_PACKAGE_NAME),)
 $(error $(LOCAL_PATH): Package modules must define LOCAL_PACKAGE_NAME)
@@ -111,20 +99,20 @@
 
 # Determine whether auto-RRO is enabled for this package.
 enforce_rro_enabled :=
-ifeq ($(PRODUCT_ENFORCE_RRO_TARGETS),*)
-  # * means all system APKs, so enable conditionally based on module path.
+ifneq (,$(filter *, $(PRODUCT_ENFORCE_RRO_TARGETS)))
+  # * means all system and system_ext APKs, so enable conditionally based on module path.
+  # Note that modules in PRODUCT_ENFORCE_RRO_EXEMPTED_TARGETS are excluded even if it is '*'
 
   # Note that base_rules.mk has not yet been included, so it's likely that only
   # one of LOCAL_MODULE_PATH and the LOCAL_X_MODULE flags has been set.
   ifeq (,$(LOCAL_MODULE_PATH))
-    non_system_module := $(filter true,\
+    non_rro_target_module := $(filter true,\
         $(LOCAL_ODM_MODULE) \
         $(LOCAL_OEM_MODULE) \
         $(LOCAL_PRODUCT_MODULE) \
-        $(LOCAL_PRODUCT_SERVICES_MODULE) \
         $(LOCAL_PROPRIETARY_MODULE) \
         $(LOCAL_VENDOR_MODULE))
-    enforce_rro_enabled := $(if $(non_system_module),,true)
+    enforce_rro_enabled := $(if $(non_rro_target_module),,true)
   else ifneq ($(filter $(TARGET_OUT)/%,$(LOCAL_MODULE_PATH)),)
     enforce_rro_enabled := true
   endif
@@ -132,6 +120,12 @@
   enforce_rro_enabled := true
 endif
 
+# TODO(b/150820813) Some modules depend on static overlay, remove this after eliminating the dependency.
+ifneq (,$(filter $(LOCAL_PACKAGE_NAME), $(PRODUCT_ENFORCE_RRO_EXEMPTED_TARGETS)))
+  enforce_rro_enabled :=
+endif
+
+
 product_package_overlays := $(strip \
     $(wildcard $(foreach dir, $(PRODUCT_PACKAGE_OVERLAYS), \
       $(addprefix $(dir)/, $(LOCAL_RESOURCE_DIR)))))
@@ -171,12 +165,7 @@
 need_compile_asset := true
 endif
 
-ifdef LOCAL_AAPT2_ONLY
-LOCAL_USE_AAPT2 := true
-endif
-
 my_res_package :=
-ifeq ($(LOCAL_USE_AAPT2),true)
 # In aapt2 the last takes precedence.
 my_resource_dirs := $(call reverse-list,$(LOCAL_RESOURCE_DIR))
 my_res_dir :=
@@ -210,30 +199,12 @@
 my_res_package := $(intermediates)/package-res.apk
 LOCAL_INTERMEDIATE_TARGETS += $(my_res_package)
 
-ifeq ($(LOCAL_USE_AAPT2),true)
-  my_bundle_module := $(intermediates)/base.zip
-  LOCAL_INTERMEDIATE_TARGETS += $(my_bundle_module)
-endif
+my_bundle_module := $(intermediates)/base.zip
+LOCAL_INTERMEDIATE_TARGETS += $(my_bundle_module)
 
 # Always run aapt2, because we need to at least compile the AndroidManifest.xml.
 need_compile_res := true
 
-else  # LOCAL_USE_AAPT2
-all_resources := $(strip \
-    $(foreach dir, $(LOCAL_RESOURCE_DIR), \
-      $(addprefix $(dir)/, \
-        $(patsubst res/%,%, \
-          $(call find-subdir-assets,$(dir)) \
-         ) \
-       ) \
-     ))
-
-ifdef LOCAL_PACKAGE_SPLITS
-LOCAL_AAPT_FLAGS += $(addprefix --split ,$(LOCAL_PACKAGE_SPLITS))
-endif
-
-endif  # LOCAL_USE_AAPT2
-
 ifneq ($(all_resources),)
   need_compile_res := true
 endif
@@ -288,6 +259,7 @@
 endif # need_compile_res
 endif # !custom
 LOCAL_PROGUARD_FLAGS := $(addprefix -include ,$(proguard_options_file)) $(LOCAL_PROGUARD_FLAGS)
+LOCAL_PROGUARD_FLAGS_DEPS += $(proguard_options_file)
 
 ifeq (true,$(EMMA_INSTRUMENT))
 ifndef LOCAL_EMMA_INSTRUMENT
@@ -307,6 +279,7 @@
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
 # Exclude jacoco classes from proguard
 LOCAL_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
+LOCAL_PROGUARD_FLAGS_DEPS += $(BUILD_SYSTEM)/proguard.jacoco.flags
 endif # Contains java code
 else
 ifdef LOCAL_SDK_VERSION
@@ -317,6 +290,7 @@
 LOCAL_STATIC_JAVA_LIBRARIES += jacocoagent
 # Exclude jacoco classes from proguard
 LOCAL_PROGUARD_FLAGS += -include $(BUILD_SYSTEM)/proguard.jacoco.flags
+LOCAL_PROGUARD_FLAGS_DEPS += $(BUILD_SYSTEM)/proguard.jacoco.flags
 endif # Contains java code
 endif # TARGET_BUILD_APPS
 endif # LOCAL_SDK_VERSION
@@ -363,77 +337,29 @@
 built_apk_splits := $(foreach s,$(my_split_suffixes),$(intermediates)/package_$(s).apk)
 endif
 
-$(R_file_stamp) $(my_res_package): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS)
+$(R_file_stamp) $(my_res_package): PRIVATE_AAPT_FLAGS := $(filter-out --legacy,$(LOCAL_AAPT_FLAGS))
 $(R_file_stamp) $(my_res_package): PRIVATE_TARGET_AAPT_CHARACTERISTICS := $(TARGET_AAPT_CHARACTERISTICS)
 $(R_file_stamp) $(my_res_package): PRIVATE_MANIFEST_PACKAGE_NAME := $(LOCAL_MANIFEST_PACKAGE_NAME)
 $(R_file_stamp) $(my_res_package): PRIVATE_MANIFEST_INSTRUMENTATION_FOR := $(LOCAL_MANIFEST_INSTRUMENTATION_FOR)
 
 ###############################
-## AAPT/AAPT2
+## AAPT2
 
-ifeq ($(LOCAL_USE_AAPT2),true)
-  my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res
-  ifneq (,$(filter-out current,$(renderscript_target_api)))
-    ifneq ($(call math_gt_or_eq,$(renderscript_target_api),21),true)
-      my_generated_res_zips := $(rs_generated_res_zip)
-    endif  # renderscript_target_api < 21
-  endif  # renderscript_target_api is set
-  my_asset_dirs := $(LOCAL_ASSET_DIR)
-  my_full_asset_paths := $(all_assets)
+my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res
+ifneq (,$(filter-out current,$(renderscript_target_api)))
+  ifneq ($(call math_gt_or_eq,$(renderscript_target_api),21),true)
+    my_generated_res_zips := $(rs_generated_res_zip)
+  endif  # renderscript_target_api < 21
+endif  # renderscript_target_api is set
+my_asset_dirs := $(LOCAL_ASSET_DIR)
+my_full_asset_paths := $(all_assets)
 
-  # Add AAPT2 link specific flags.
-  $(my_res_package): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS)
-  ifndef LOCAL_AAPT_NAMESPACES
-    $(my_res_package): PRIVATE_AAPT_FLAGS += --no-static-lib-packages
-  endif
+# Add AAPT2 link specific flags.
+ifndef LOCAL_AAPT_NAMESPACES
+  $(my_res_package): PRIVATE_AAPT_FLAGS += --no-static-lib-packages
+endif
 
-  include $(BUILD_SYSTEM)/aapt2.mk
-else  # LOCAL_USE_AAPT2
-
-  my_srcjar := $(intermediates.COMMON)/aapt.srcjar
-  LOCAL_SRCJARS += $(my_srcjar)
-  $(R_file_stamp): PRIVATE_SRCJAR := $(my_srcjar)
-  $(R_file_stamp): PRIVATE_JAVA_GEN_DIR := $(intermediates.COMMON)/aapt
-  $(R_file_stamp): .KATI_IMPLICIT_OUTPUTS := $(my_srcjar)
-  # Since we don't know where the real R.java file is going to end up,
-  # we need to use another file to stand in its place.  We'll just
-  # copy the generated file to src/R.stamp, which means it will
-  # have the same contents and timestamp as the actual file.
-  #
-  # At the same time, this will copy the R.java file to a central
-  # 'R' directory to make it easier to add the files to an IDE.
-  #
-
-  $(R_file_stamp): PRIVATE_RESOURCE_PUBLICS_OUTPUT := \
-			$(intermediates.COMMON)/public_resources.xml
-  $(R_file_stamp): PRIVATE_PROGUARD_OPTIONS_FILE := $(proguard_options_file)
-  $(R_file_stamp): PRIVATE_RESOURCE_LIST := $(all_res_assets)
-  $(R_file_stamp): $(all_res_assets) $(full_android_manifest) $(rs_generated_res_zip) $(AAPT) $(SOONG_ZIP) | $(ACP)
-	@echo "target R.java/Manifest.java: $(PRIVATE_MODULE) ($@)"
-	@rm -rf $@ && mkdir -p $(dir $@)
-	$(create-resource-java-files)
-	$(call find-generated-R.java,$(PRIVATE_JAVA_GEN_DIR),$@)
-
-  $(proguard_options_file): $(R_file_stamp)
-
-  ifdef LOCAL_EXPORT_PACKAGE_RESOURCES
-    # Put this module's resources into a PRODUCT-agnositc package that
-    # other packages can use to build their own PRODUCT-agnostic R.java (etc.)
-    # files.
-    resource_export_package := $(intermediates.COMMON)/package-export.apk
-    $(R_file_stamp): $(resource_export_package)
-
-    # create-assets-package looks at PRODUCT_AAPT_CONFIG, but this target
-    # can't know anything about PRODUCT.  Clear it out just for this target.
-    $(resource_export_package): PRIVATE_PRODUCT_AAPT_CONFIG :=
-    $(resource_export_package): PRIVATE_PRODUCT_AAPT_PREF_CONFIG :=
-    $(resource_export_package): PRIVATE_RESOURCE_LIST := $(all_res_assets)
-    $(resource_export_package): $(all_res_assets) $(full_android_manifest) $(rs_generated_res_zip) $(AAPT)
-	@echo "target Export Resources: $(PRIVATE_MODULE) ($@)"
-	$(call create-assets-package,$@)
-  endif
-
-endif  # LOCAL_USE_AAPT2
+include $(BUILD_SYSTEM)/aapt2.mk
 
 endif  # need_compile_res
 
@@ -496,23 +422,13 @@
 $(LOCAL_INTERMEDIATE_TARGETS): \
     PRIVATE_AAPT_INCLUDES := $(all_library_res_package_exports)
 
-ifeq ($(LOCAL_USE_AAPT2),true)
 $(my_res_package) : $(all_library_res_package_export_deps)
-endif
-
-# These four are set above for $(R_stamp_file) and $(my_res_package), but
-# $(LOCAL_BUILT_MODULE) is not set before java.mk, so they have to be set again
-# here.
-$(LOCAL_BUILT_MODULE): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS)
-$(LOCAL_BUILT_MODULE): PRIVATE_TARGET_AAPT_CHARACTERISTICS := $(TARGET_AAPT_CHARACTERISTICS)
-$(LOCAL_BUILT_MODULE): PRIVATE_MANIFEST_PACKAGE_NAME := $(LOCAL_MANIFEST_PACKAGE_NAME)
-$(LOCAL_BUILT_MODULE): PRIVATE_MANIFEST_INSTRUMENTATION_FOR := $(LOCAL_MANIFEST_INSTRUMENTATION_FOR)
 
 ifneq ($(full_classes_jar),)
 $(LOCAL_BUILT_MODULE): PRIVATE_DEX_FILE := $(built_dex)
 # Use the jarjar processed arhive as the initial package file.
 $(LOCAL_BUILT_MODULE): PRIVATE_SOURCE_ARCHIVE := $(full_classes_pre_proguard_jar)
-$(LOCAL_BUILT_MODULE): $(built_dex)
+$(LOCAL_BUILT_MODULE): $(built_dex) $(full_classes_pre_proguard_jar)
 else
 $(LOCAL_BUILT_MODULE): PRIVATE_DEX_FILE :=
 $(LOCAL_BUILT_MODULE): PRIVATE_SOURCE_ARCHIVE :=
@@ -545,7 +461,7 @@
 certificate := $(LOCAL_CERTIFICATE).x509.pem
 additional_certificates := $(foreach c,$(LOCAL_ADDITIONAL_CERTIFICATES), $(c).x509.pem $(c).pk8)
 
-$(LOCAL_BUILT_MODULE): $(private_key) $(certificate) $(SIGNAPK_JAR)
+$(LOCAL_BUILT_MODULE): $(private_key) $(certificate) $(SIGNAPK_JAR) $(SIGNAPK_JNI_LIBRARY_PATH)
 $(LOCAL_BUILT_MODULE): PRIVATE_PRIVATE_KEY := $(private_key)
 $(LOCAL_BUILT_MODULE): PRIVATE_CERTIFICATE := $(certificate)
 
@@ -555,6 +471,37 @@
 $(LOCAL_BUILT_MODULE): $(additional_certificates)
 $(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CERTIFICATES := $(additional_certificates)
 
+$(LOCAL_BUILT_MODULE): $(LOCAL_CERTIFICATE_LINEAGE)
+$(LOCAL_BUILT_MODULE): PRIVATE_CERTIFICATE_LINEAGE := $(LOCAL_CERTIFICATE_LINEAGE)
+
+# Set a actual_partition_tag (calculated in base_rules.mk) for the package.
+PACKAGES.$(LOCAL_PACKAGE_NAME).PARTITION := $(actual_partition_tag)
+
+# Verify LOCAL_USES_LIBRARIES/LOCAL_OPTIONAL_USES_LIBRARIES
+# If LOCAL_ENFORCE_USES_LIBRARIES is not set, default to true if either of LOCAL_USES_LIBRARIES or
+# LOCAL_OPTIONAL_USES_LIBRARIES are specified.
+# Will change the default to true unconditionally in the future.
+ifndef LOCAL_ENFORCE_USES_LIBRARIES
+  ifneq (,$(strip $(LOCAL_USES_LIBRARIES)$(LOCAL_OPTIONAL_USES_LIBRARIES)))
+    LOCAL_ENFORCE_USES_LIBRARIES := true
+  endif
+endif
+
+my_enforced_uses_libraries :=
+ifdef LOCAL_ENFORCE_USES_LIBRARIES
+  my_manifest_check := $(intermediates.COMMON)/manifest/AndroidManifest.xml.check
+  $(my_manifest_check): $(MANIFEST_CHECK)
+  $(my_manifest_check): PRIVATE_USES_LIBRARIES := $(LOCAL_USES_LIBRARIES)
+  $(my_manifest_check): PRIVATE_OPTIONAL_USES_LIBRARIES := $(LOCAL_OPTIONAL_USES_LIBRARIES)
+  $(my_manifest_check): $(full_android_manifest)
+	@echo Checking manifest: $<
+	$(MANIFEST_CHECK) --enforce-uses-libraries \
+	  $(addprefix --uses-library ,$(PRIVATE_USES_LIBRARIES)) \
+	  $(addprefix --optional-uses-library ,$(PRIVATE_OPTIONAL_USES_LIBRARIES)) \
+	  $< -o $@
+  $(LOCAL_BUILT_MODULE): $(my_manifest_check)
+endif
+
 # Define the rule to build the actual package.
 # PRIVATE_JNI_SHARED_LIBRARIES is a list of <abi>:<path_of_built_lib>.
 $(LOCAL_BUILT_MODULE): PRIVATE_JNI_SHARED_LIBRARIES := $(jni_shared_libraries_with_abis)
@@ -576,7 +523,7 @@
 endif
 endif
 
-# Run veridex on product, product_services and vendor modules.
+# Run veridex on product, system_ext and vendor modules.
 # We skip it for unbundled app builds where we cannot build veridex.
 module_run_appcompat :=
 ifeq (true,$(non_system_module))
@@ -595,38 +542,20 @@
 $(LOCAL_BUILT_MODULE): PRIVATE_RESOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/resources
 $(LOCAL_BUILT_MODULE) : $(jni_shared_libraries)
 $(LOCAL_BUILT_MODULE) : $(JAR_ARGS) $(SOONG_ZIP) $(MERGE_ZIPS) $(ZIP2ZIP)
-ifeq ($(LOCAL_USE_AAPT2),true)
 $(LOCAL_BUILT_MODULE): PRIVATE_RES_PACKAGE := $(my_res_package)
-$(LOCAL_BUILT_MODULE) : $(my_res_package) $(AAPT2) | $(ACP)
-else
-$(LOCAL_BUILT_MODULE): PRIVATE_RESOURCE_LIST := $(all_res_assets)
-$(LOCAL_BUILT_MODULE) : $(all_res_assets) $(full_android_manifest) $(AAPT) $(ZIPALIGN)
-endif  # LOCAL_USE_AAPT2
+$(LOCAL_BUILT_MODULE) : $(my_res_package) $(AAPT2)
 ifdef LOCAL_COMPRESSED_MODULE
 $(LOCAL_BUILT_MODULE) : $(MINIGZIP)
 endif
 ifeq (true, $(LOCAL_UNCOMPRESS_DEX))
 $(LOCAL_BUILT_MODULE) : $(ZIP2ZIP)
 endif
-ifneq ($(BUILD_PLATFORM_ZIP),)
-$(LOCAL_BUILT_MODULE) : .KATI_IMPLICIT_OUTPUTS := $(dir $(LOCAL_BUILT_MODULE))package.dex.apk
-endif
-ifdef LOCAL_DEX_PREOPT
-$(LOCAL_BUILT_MODULE) : PRIVATE_STRIP_SCRIPT := $(intermediates)/strip.sh
-$(LOCAL_BUILT_MODULE) : $(intermediates)/strip.sh
-$(LOCAL_BUILT_MODULE) : | $(DEXPREOPT_STRIP_DEPS)
-$(LOCAL_BUILT_MODULE): .KATI_DEPFILE := $(LOCAL_BUILT_MODULE).d
-endif
 $(LOCAL_BUILT_MODULE): PRIVATE_USE_EMBEDDED_NATIVE_LIBS := $(LOCAL_USE_EMBEDDED_NATIVE_LIBS)
 $(LOCAL_BUILT_MODULE):
 	@echo "target Package: $(PRIVATE_MODULE) ($@)"
 	rm -rf $@.parts
 	mkdir -p $@.parts
-ifeq ($(LOCAL_USE_AAPT2),true)
 	cp -f $(PRIVATE_RES_PACKAGE) $@.parts/apk.zip
-else  # ! LOCAL_USE_AAPT2
-	$(call create-assets-package,$@.parts/apk.zip)
-endif  # LOCAL_USE_AAPT2
 ifneq ($(jni_shared_libraries),)
 	$(call create-jni-shared-libs-package,$@.parts/jni.zip,$(PRIVATE_USE_EMBEDDED_NATIVE_LIBS))
 endif
@@ -643,85 +572,67 @@
 	@# No need to align, sign-package below will do it.
 	$(uncompress-dexs)
 endif
-# Run appcompat before stripping the classes.dex file.
+# Run appcompat before signing.
 ifeq ($(module_run_appcompat),true)
-ifeq ($(LOCAL_USE_AAPT2),true)
-	$(call appcompat-header, aapt2)
-else
 	$(appcompat-header)
-endif
 	$(run-appcompat)
 endif  # module_run_appcompat
-ifdef LOCAL_DEX_PREOPT
-ifneq ($(BUILD_PLATFORM_ZIP),)
-	@# Keep a copy of apk with classes.dex unstripped
-	$(hide) cp -f $@ $(dir $@)package.dex.apk
-endif  # BUILD_PLATFORM_ZIP
-	mv -f $@ $@.tmp
-	$(PRIVATE_STRIP_SCRIPT) $@.tmp $@
-endif  # LOCAL_DEX_PREOPT
 	$(sign-package)
 ifdef LOCAL_COMPRESSED_MODULE
 	$(compress-package)
 endif  # LOCAL_COMPRESSED_MODULE
 
-ifeq ($(LOCAL_USE_AAPT2),true)
-  my_package_res_pb := $(intermediates)/package-res.pb.apk
-  $(my_package_res_pb): $(my_res_package) $(AAPT2)
+my_package_res_pb := $(intermediates)/package-res.pb.apk
+$(my_package_res_pb): $(my_res_package) $(AAPT2)
 	$(AAPT2) convert --output-format proto $< -o $@
 
-  $(my_bundle_module): $(my_package_res_pb)
-  $(my_bundle_module): PRIVATE_RES_PACKAGE := $(my_package_res_pb)
+$(my_bundle_module): $(my_package_res_pb)
+$(my_bundle_module): PRIVATE_RES_PACKAGE := $(my_package_res_pb)
 
-  $(my_bundle_module): $(jni_shared_libraries)
-  $(my_bundle_module): PRIVATE_JNI_SHARED_LIBRARIES := $(jni_shared_libraries_with_abis)
-  $(my_bundle_module): PRIVATE_JNI_SHARED_LIBRARIES_ABI := $(jni_shared_libraries_abis)
+$(my_bundle_module): $(jni_shared_libraries)
+$(my_bundle_module): PRIVATE_JNI_SHARED_LIBRARIES := $(jni_shared_libraries_with_abis)
+$(my_bundle_module): PRIVATE_JNI_SHARED_LIBRARIES_ABI := $(jni_shared_libraries_abis)
 
-  ifneq ($(full_classes_jar),)
-    $(my_bundle_module): PRIVATE_DEX_FILE := $(built_dex)
-    # Use the jarjar processed archive as the initial package file.
-    $(my_bundle_module): PRIVATE_SOURCE_ARCHIVE := $(full_classes_pre_proguard_jar)
-    $(my_bundle_module): $(built_dex)
-  else
-    $(my_bundle_module): PRIVATE_DEX_FILE :=
-    $(my_bundle_module): PRIVATE_SOURCE_ARCHIVE :=
-  endif # full_classes_jar
+ifneq ($(full_classes_jar),)
+  $(my_bundle_module): PRIVATE_DEX_FILE := $(built_dex)
+  # Use the jarjar processed archive as the initial package file.
+  $(my_bundle_module): PRIVATE_SOURCE_ARCHIVE := $(full_classes_pre_proguard_jar)
+  $(my_bundle_module): $(built_dex)
+else
+  $(my_bundle_module): PRIVATE_DEX_FILE :=
+  $(my_bundle_module): PRIVATE_SOURCE_ARCHIVE :=
+endif # full_classes_jar
 
-  $(my_bundle_module): $(MERGE_ZIPS) $(SOONG_ZIP) $(ZIP2ZIP)
+$(my_bundle_module): $(MERGE_ZIPS) $(SOONG_ZIP) $(ZIP2ZIP)
 	@echo "target Bundle: $(PRIVATE_MODULE) ($@)"
 	rm -rf $@.parts
 	mkdir -p $@.parts
 	$(ZIP2ZIP) -i $(PRIVATE_RES_PACKAGE) -o $@.parts/apk.zip AndroidManifest.xml:manifest/AndroidManifest.xml resources.pb "res/**/*" "assets/**/*"
-        ifneq ($(jni_shared_libraries),)
+      ifneq ($(jni_shared_libraries),)
 	  $(call create-jni-shared-libs-package,$@.parts/jni.zip)
-        endif
-        ifeq ($(full_classes_jar),)
-        # We don't build jar, need to add the Java resources here.
+      endif
+      ifeq ($(full_classes_jar),)
+      # We don't build jar, need to add the Java resources here.
 	  $(if $(PRIVATE_EXTRA_JAR_ARGS),\
 	    $(call create-java-resources-jar,$@.parts/res.zip) && \
 	    $(ZIP2ZIP) -i $@.parts/res.zip -o $@.parts/res.zip.tmp "**/*:root/" && \
 	    mv -f $@.parts/res.zip.tmp $@.parts/res.zip)
-        else  # full_classes_jar
+      else  # full_classes_jar
 	  $(call create-dex-jar,$@.parts/dex.zip,$(PRIVATE_DEX_FILE))
 	  $(ZIP2ZIP) -i $@.parts/dex.zip -o $@.parts/dex.zip.tmp "classes*.dex:dex/"
 	  mv -f $@.parts/dex.zip.tmp $@.parts/dex.zip
 	  $(call extract-resources-jar,$@.parts/res.zip,$(PRIVATE_SOURCE_ARCHIVE))
 	  $(ZIP2ZIP) -i $@.parts/res.zip -o $@.parts/res.zip.tmp "**/*:root/"
 	  mv -f $@.parts/res.zip.tmp $@.parts/res.zip
-        endif  # full_classes_jar
+      endif  # full_classes_jar
 	$(MERGE_ZIPS) $@ $@.parts/*.zip
 	rm -rf $@.parts
-  ALL_MODULES.$(LOCAL_MODULE).BUNDLE := $(my_bundle_module)
-endif
+ALL_MODULES.$(LOCAL_MODULE).BUNDLE := $(my_bundle_module)
 
-###############################
-## Build dpi-specific apks, if it's apps_only build.
 ifdef TARGET_BUILD_APPS
-ifdef LOCAL_DPI_VARIANTS
-$(foreach d, $(LOCAL_DPI_VARIANTS), \
-  $(eval my_dpi := $(d)) \
-  $(eval include $(BUILD_SYSTEM)/dpi_specific_apk.mk))
-endif
+  ifdef LOCAL_DPI_VARIANTS
+    $(call pretty-error,Building DPI-specific APKs is no longer supported)
+  endif
 endif
 
 ###############################
@@ -729,7 +640,7 @@
 ## the APK
 ifdef LOCAL_DEX_PREOPT
   $(my_dex_jar): PRIVATE_DEX_FILE := $(built_dex)
-  $(my_dex_jar): $(built_dex)
+  $(my_dex_jar): $(built_dex) $(SOONG_ZIP)
 	$(hide) mkdir -p $(dir $@) && rm -f $@
 	$(call create-dex-jar,$@,$(PRIVATE_DEX_FILE))
 endif
@@ -781,9 +692,13 @@
 PACKAGES.$(LOCAL_PACKAGE_NAME).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 PACKAGES.$(LOCAL_PACKAGE_NAME).RESOURCE_FILES := $(all_resources)
 
-PACKAGES := $(PACKAGES) $(LOCAL_PACKAGE_NAME)
+ifneq ($(LOCAL_MODULE_STEM),)
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
+else
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
+endif
 
-endif # skip_definition
+PACKAGES := $(PACKAGES) $(LOCAL_PACKAGE_NAME)
 
 # Reset internal variables.
 all_res_assets :=
diff --git a/core/pdk_config.mk b/core/pdk_config.mk
index ce78ece..922e0ef 100644
--- a/core/pdk_config.mk
+++ b/core/pdk_config.mk
@@ -20,8 +20,9 @@
   target/common/obj/JAVA_LIBRARIES/conscrypt_intermediates \
   target/common/obj/JAVA_LIBRARIES/core-oj_intermediates \
   target/common/obj/JAVA_LIBRARIES/core-libart_intermediates \
+  target/common/obj/JAVA_LIBRARIES/core-icu4j_intermediates \
   target/common/obj/JAVA_LIBRARIES/ext_intermediates \
-  target/common/obj/JAVA_LIBRARIES/framework_intermediates \
+  target/common/obj/JAVA_LIBRARIES/framework-minus-apex_intermediates \
   target/common/obj/JAVA_LIBRARIES/hwbinder_intermediates \
   target/common/obj/JAVA_LIBRARIES/ims-common_intermediates \
   target/common/obj/JAVA_LIBRARIES/okhttp_intermediates \
diff --git a/core/prebuilt.mk b/core/prebuilt.mk
index 9d284fb..4512cd9 100644
--- a/core/prebuilt.mk
+++ b/core/prebuilt.mk
@@ -12,13 +12,6 @@
   LOCAL_HOST_PREFIX :=
 else
   my_prefix := TARGET_
-
-  ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-    # Only support prebuilt shared and static libraries for translated arch
-    ifeq ($(filter SHARED_LIBRARIES STATIC_LIBRARIES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
-      LOCAL_MULTILIB := first
-    endif
-  endif
 endif
 
 include $(BUILD_SYSTEM)/multilib.mk
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index e505945..ef1471d 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -23,430 +23,39 @@
 ifdef LOCAL_PREBUILT_MODULE_FILE
   my_prebuilt_src_file := $(LOCAL_PREBUILT_MODULE_FILE)
 else ifdef LOCAL_SRC_FILES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)
-  my_prebuilt_src_file := $(LOCAL_PATH)/$(LOCAL_SRC_FILES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
+  my_prebuilt_src_file := $(call clean-path,$(LOCAL_PATH)/$(LOCAL_SRC_FILES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)))
   LOCAL_SRC_FILES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH) :=
 else ifdef LOCAL_SRC_FILES_$(my_32_64_bit_suffix)
-  my_prebuilt_src_file := $(LOCAL_PATH)/$(LOCAL_SRC_FILES_$(my_32_64_bit_suffix))
+  my_prebuilt_src_file := $(call clean-path,$(LOCAL_PATH)/$(LOCAL_SRC_FILES_$(my_32_64_bit_suffix)))
   LOCAL_SRC_FILES_$(my_32_64_bit_suffix) :=
 else ifdef LOCAL_SRC_FILES
-  my_prebuilt_src_file := $(LOCAL_PATH)/$(LOCAL_SRC_FILES)
+  my_prebuilt_src_file := $(call clean-path,$(LOCAL_PATH)/$(LOCAL_SRC_FILES))
   LOCAL_SRC_FILES :=
 else ifdef LOCAL_REPLACE_PREBUILT_APK_INSTALLED
-  # This is handled specially below
+  # This is handled specially in app_prebuilt_internal.mk
 else
   $(call pretty-error,No source files specified)
 endif
 
 LOCAL_CHECKED_MODULE := $(my_prebuilt_src_file)
 
-ifeq (APPS,$(LOCAL_MODULE_CLASS))
-include $(BUILD_SYSTEM)/app_prebuilt_internal.mk
-else
-#
-# Non-APPS prebuilt modules handling almost to the end of the file
-#
-
-my_strip_module := $(firstword \
-  $(LOCAL_STRIP_MODULE_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)) \
-  $(LOCAL_STRIP_MODULE))
-
-ifeq (SHARED_LIBRARIES,$(LOCAL_MODULE_CLASS))
-  ifeq ($(LOCAL_IS_HOST_MODULE)$(my_strip_module),)
-    # Strip but not try to add debuglink
-    my_strip_module := no_debuglink
-  endif
-endif
-
-ifneq ($(filter STATIC_LIBRARIES SHARED_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
-  prebuilt_module_is_a_library := true
-else
-  prebuilt_module_is_a_library :=
-endif
-
-# Don't install static libraries by default.
-ifndef LOCAL_UNINSTALLABLE_MODULE
-ifeq (STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS))
-  LOCAL_UNINSTALLABLE_MODULE := true
-endif
-endif
-
-ifeq (JAVA_LIBRARIES,$(LOCAL_IS_HOST_MODULE)$(LOCAL_MODULE_CLASS)$(filter true,$(LOCAL_UNINSTALLABLE_MODULE)))
-  prebuilt_module_is_dex_javalib := true
-else
-  prebuilt_module_is_dex_javalib :=
-endif
-
+ifneq (APPS,$(LOCAL_MODULE_CLASS))
 ifdef LOCAL_COMPRESSED_MODULE
 $(error $(LOCAL_MODULE) : LOCAL_COMPRESSED_MODULE can only be defined for module class APPS)
 endif  # LOCAL_COMPRESSED_MODULE
+endif  # APPS
 
-my_check_elf_file_shared_lib_files :=
-
-ifneq ($(filter true keep_symbols no_debuglink mini-debug-info,$(my_strip_module)),)
-  ifdef LOCAL_IS_HOST_MODULE
-    $(call pretty-error,Cannot strip/pack host module)
-  endif
-  ifeq ($(filter SHARED_LIBRARIES EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
-    $(call pretty-error,Can strip/pack only shared libraries or executables)
-  endif
-  ifneq ($(LOCAL_PREBUILT_STRIP_COMMENTS),)
-    $(call pretty-error,Cannot strip/pack scripts)
-  endif
-  # Set the arch-specific variables to set up the strip rules
-  LOCAL_STRIP_MODULE_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH) := $(my_strip_module)
-  include $(BUILD_SYSTEM)/dynamic_binary.mk
-  built_module := $(linked_module)
-
-  ifneq ($(LOCAL_SDK_VERSION),)
-    # binary.mk filters out NDK_MIGRATED_LIBS from my_shared_libs, thus those NDK libs are not added
-    # to DEPENDENCIES_ON_SHARED_LIBRARIES. Assign $(my_ndk_shared_libraries_fullpath) to
-    # my_check_elf_file_shared_lib_files so that check_elf_file.py can see those NDK stub libs.
-    my_check_elf_file_shared_lib_files := $(my_ndk_shared_libraries_fullpath)
-  endif
-else  # my_strip_module not true
-  include $(BUILD_SYSTEM)/base_rules.mk
-  built_module := $(LOCAL_BUILT_MODULE)
-
-ifdef prebuilt_module_is_a_library
-export_includes := $(intermediates)/export_includes
-export_cflags := $(foreach d,$(LOCAL_EXPORT_C_INCLUDE_DIRS),-I $(d))
-$(export_includes): PRIVATE_EXPORT_CFLAGS := $(export_cflags)
-$(export_includes): $(LOCAL_EXPORT_C_INCLUDE_DEPS)
-	@echo Export includes file: $< -- $@
-	$(hide) mkdir -p $(dir $@) && rm -f $@
-ifdef export_cflags
-	$(hide) echo "$(PRIVATE_EXPORT_CFLAGS)" >$@
+ifeq (APPS,$(LOCAL_MODULE_CLASS))
+  include $(BUILD_SYSTEM)/app_prebuilt_internal.mk
+else ifeq (JAVA_LIBRARIES,$(LOCAL_MODULE_CLASS))
+  include $(BUILD_SYSTEM)/java_prebuilt_internal.mk
+else ifneq ($(filter STATIC_LIBRARIES SHARED_LIBRARIES EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
+  include $(BUILD_SYSTEM)/cc_prebuilt_internal.mk
+else ifneq ($(filter SCRIPT ETC DATA RENDERSCRIPT_BITCODE,$(LOCAL_MODULE_CLASS)),)
+  include $(BUILD_SYSTEM)/misc_prebuilt_internal.mk
 else
-	$(hide) touch $@
+  $(error $(LOCAL_MODULE) : unexpected LOCAL_MODULE_CLASS for prebuilts: $(LOCAL_MODULE_CLASS))
 endif
-export_cflags :=
-
-include $(BUILD_SYSTEM)/allowed_ndk_types.mk
-
-ifdef LOCAL_SDK_VERSION
-my_link_type := native:ndk:$(my_ndk_stl_family):$(my_ndk_stl_link_type)
-else ifdef LOCAL_USE_VNDK
-    _name := $(patsubst %.vendor,%,$(LOCAL_MODULE))
-    ifneq ($(filter $(_name),$(VNDK_CORE_LIBRARIES) $(VNDK_SAMEPROCESS_LIBRARIES) $(LLNDK_LIBRARIES)),)
-        ifeq ($(filter $(_name),$(VNDK_PRIVATE_LIBRARIES)),)
-            my_link_type := native:vndk
-        else
-            my_link_type := native:vndk_private
-        endif
-    else
-        my_link_type := native:vendor
-    endif
-else ifneq ($(filter $(TARGET_RECOVERY_OUT)/%,$(LOCAL_MODULE_PATH)),)
-my_link_type := native:recovery
-else
-my_link_type := native:platform
-endif
-
-# TODO: check dependencies of prebuilt files
-my_link_deps :=
-
-my_2nd_arch_prefix := $(LOCAL_2ND_ARCH_VAR_PREFIX)
-my_common :=
-include $(BUILD_SYSTEM)/link_type.mk
-endif  # prebuilt_module_is_a_library
-
-# The real dependency will be added after all Android.mks are loaded and the install paths
-# of the shared libraries are determined.
-ifdef LOCAL_INSTALLED_MODULE
-ifdef LOCAL_IS_HOST_MODULE
-    ifeq ($(LOCAL_SYSTEM_SHARED_LIBRARIES),none)
-        my_system_shared_libraries :=
-    else
-        my_system_shared_libraries := $(LOCAL_SYSTEM_SHARED_LIBRARIES)
-    endif
-else
-    ifeq ($(LOCAL_SYSTEM_SHARED_LIBRARIES),none)
-        my_system_shared_libraries := libc libm libdl
-    else
-        my_system_shared_libraries := $(LOCAL_SYSTEM_SHARED_LIBRARIES)
-        my_system_shared_libraries := $(patsubst libc,libc libdl,$(my_system_shared_libraries))
-    endif
-endif
-
-my_shared_libraries := \
-    $(filter-out $(my_system_shared_libraries),$(LOCAL_SHARED_LIBRARIES)) \
-    $(my_system_shared_libraries)
-
-ifdef my_shared_libraries
-# Extra shared libraries introduced by LOCAL_CXX_STL.
-include $(BUILD_SYSTEM)/cxx_stl_setup.mk
-ifdef LOCAL_USE_VNDK
-  my_shared_libraries := $(foreach l,$(my_shared_libraries),\
-    $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
-endif
-$(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
-  $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(my_shared_libraries))
-endif
-endif  # my_shared_libraries
-
-# We need to enclose the above export_includes and my_built_shared_libraries in
-# "my_strip_module not true" because otherwise the rules are defined in dynamic_binary.mk.
-endif  # my_strip_module not true
-
-# Check prebuilt ELF binaries.
-include $(BUILD_SYSTEM)/check_elf_file.mk
-
-ifeq ($(NATIVE_COVERAGE),true)
-ifneq (,$(strip $(LOCAL_PREBUILT_COVERAGE_ARCHIVE)))
-  $(eval $(call copy-one-file,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(intermediates)/$(LOCAL_MODULE).gcnodir))
-  ifneq ($(LOCAL_UNINSTALLABLE_MODULE),true)
-    ifdef LOCAL_IS_HOST_MODULE
-      my_coverage_path := $($(my_prefix)OUT_COVERAGE)/$(patsubst $($(my_prefix)OUT)/%,%,$(my_module_path))
-    else
-      my_coverage_path := $(TARGET_OUT_COVERAGE)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
-    endif
-    my_coverage_path := $(my_coverage_path)/$(patsubst %.so,%,$(my_installed_module_stem)).gcnodir
-    $(eval $(call copy-one-file,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(my_coverage_path)))
-    $(LOCAL_BUILT_MODULE): $(my_coverage_path)
-  endif
-else
-# Coverage information is needed when static lib is a dependency of another
-# coverage-enabled module.
-ifeq (STATIC_LIBRARIES, $(LOCAL_MODULE_CLASS))
-GCNO_ARCHIVE := $(LOCAL_MODULE).gcnodir
-$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_OBJECTS :=
-$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_WHOLE_STATIC_LIBRARIES :=
-$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_PREFIX := $(my_prefix)
-$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_2ND_ARCH_VAR_PREFIX := $(LOCAL_2ND_ARCH_VAR_PREFIX)
-$(intermediates)/$(GCNO_ARCHIVE) :
-	$(transform-o-to-static-lib)
-endif
-endif
-endif
-
-ifeq ($(prebuilt_module_is_dex_javalib),true)
-my_dex_jar := $(my_prebuilt_src_file)
-# This is a target shared library, i.e. a jar with classes.dex.
-
-ifneq ($(filter $(LOCAL_MODULE),$(PRODUCT_BOOT_JARS)),)
-  $(call pretty-error,Modules in PRODUCT_BOOT_JARS must be defined in Android.bp files)
-endif
-
-#######################################
-# defines built_odex along with rule to install odex
-include $(BUILD_SYSTEM)/dex_preopt_odex_install.mk
-#######################################
-ifdef LOCAL_DEX_PREOPT
-
-$(built_module): PRIVATE_STRIP_SCRIPT := $(intermediates)/strip.sh
-$(built_module): $(intermediates)/strip.sh
-$(built_module): | $(DEXPREOPT_STRIP_DEPS)
-$(built_module): .KATI_DEPFILE := $(built_module).d
-$(built_module): $(my_prebuilt_src_file)
-	$(PRIVATE_STRIP_SCRIPT) $< $@
-
-else # ! LOCAL_DEX_PREOPT
-$(built_module) : $(my_prebuilt_src_file)
-	$(call copy-file-to-target)
-endif # LOCAL_DEX_PREOPT
-
-else  # ! prebuilt_module_is_dex_javalib
-ifneq ($(filter init%rc,$(notdir $(LOCAL_INSTALLED_MODULE)))$(filter %/etc/init,$(dir $(LOCAL_INSTALLED_MODULE))),)
-  $(eval $(call copy-init-script-file-checked,$(my_prebuilt_src_file),$(built_module)))
-else ifneq ($(LOCAL_PREBUILT_STRIP_COMMENTS),)
-$(built_module) : $(my_prebuilt_src_file)
-	$(transform-prebuilt-to-target-strip-comments)
-else
-$(built_module) : $(my_prebuilt_src_file)
-	$(transform-prebuilt-to-target)
-endif
-ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
-	$(hide) chmod +x $@
-endif
-endif # ! prebuilt_module_is_dex_javalib
-
-ifeq ($(LOCAL_MODULE_CLASS),JAVA_LIBRARIES)
-my_src_jar := $(my_prebuilt_src_file)
-
-ifdef LOCAL_IS_HOST_MODULE
-# for host java libraries deps should be in the common dir, so we make a copy in
-# the common dir.
-common_classes_jar := $(intermediates.COMMON)/classes.jar
-common_header_jar := $(intermediates.COMMON)/classes-header.jar
-
-$(common_classes_jar): PRIVATE_MODULE := $(LOCAL_MODULE)
-$(common_classes_jar): PRIVATE_PREFIX := $(my_prefix)
-
-$(common_classes_jar) : $(my_src_jar)
-	$(transform-prebuilt-to-target)
-
-ifneq ($(TURBINE_ENABLED),false)
-$(common_header_jar) : $(my_src_jar)
-	$(transform-prebuilt-to-target)
-endif
-
-else # !LOCAL_IS_HOST_MODULE
-# for target java libraries, the LOCAL_BUILT_MODULE is in a product-specific dir,
-# while the deps should be in the common dir, so we make a copy in the common dir.
-common_classes_jar := $(intermediates.COMMON)/classes.jar
-common_header_jar := $(intermediates.COMMON)/classes-header.jar
-common_classes_pre_proguard_jar := $(intermediates.COMMON)/classes-pre-proguard.jar
-common_javalib_jar := $(intermediates.COMMON)/javalib.jar
-
-$(common_classes_jar) $(common_classes_pre_proguard_jar) $(common_javalib_jar): PRIVATE_MODULE := $(LOCAL_MODULE)
-$(common_classes_jar) $(common_classes_pre_proguard_jar) $(common_javalib_jar): PRIVATE_PREFIX := $(my_prefix)
-
-ifeq ($(LOCAL_SDK_VERSION),system_current)
-my_link_type := java:system
-else ifneq (,$(call has-system-sdk-version,$(LOCAL_SDK_VERSION)))
-my_link_type := java:system
-else ifeq ($(LOCAL_SDK_VERSION),core_current)
-my_link_type := java:core
-else ifneq ($(LOCAL_SDK_VERSION),)
-my_link_type := java:sdk
-else
-my_link_type := java:platform
-endif
-
-# TODO: check dependencies of prebuilt files
-my_link_deps :=
-
-my_2nd_arch_prefix := $(LOCAL_2ND_ARCH_VAR_PREFIX)
-my_common := COMMON
-include $(BUILD_SYSTEM)/link_type.mk
-
-ifeq ($(prebuilt_module_is_dex_javalib),true)
-# For prebuilt shared Java library we don't have classes.jar.
-$(common_javalib_jar) : $(my_src_jar)
-	$(transform-prebuilt-to-target)
-
-else  # ! prebuilt_module_is_dex_javalib
-
-my_src_aar := $(filter %.aar, $(my_prebuilt_src_file))
-ifneq ($(my_src_aar),)
-# This is .aar file, archive of classes.jar and Android resources.
-
-# run Jetifier if needed
-LOCAL_JETIFIER_INPUT_FILE := $(my_src_aar)
-include $(BUILD_SYSTEM)/jetifier.mk
-my_src_aar := $(LOCAL_JETIFIER_OUTPUT_FILE)
-
-my_src_jar := $(intermediates.COMMON)/aar/classes.jar
-my_src_proguard_options := $(intermediates.COMMON)/aar/proguard.txt
-my_src_android_manifest := $(intermediates.COMMON)/aar/AndroidManifest.xml
-
-$(my_src_jar) : .KATI_IMPLICIT_OUTPUTS := $(my_src_proguard_options)
-$(my_src_jar) : .KATI_IMPLICIT_OUTPUTS += $(my_src_android_manifest)
-$(my_src_jar) : $(my_src_aar)
-	$(hide) rm -rf $(dir $@) && mkdir -p $(dir $@) $(dir $@)/res
-	$(hide) unzip -qo -d $(dir $@) $<
-	# Make sure the extracted classes.jar has a new timestamp.
-	$(hide) touch $@
-	# Make sure the proguard and AndroidManifest.xml files exist
-	# and have a new timestamp.
-	$(hide) touch $(dir $@)/proguard.txt
-	$(hide) touch $(dir $@)/AndroidManifest.xml
-
-my_prebuilt_android_manifest := $(intermediates.COMMON)/manifest/AndroidManifest.xml
-$(eval $(call copy-one-file,$(my_src_android_manifest),$(my_prebuilt_android_manifest)))
-$(call add-dependency,$(LOCAL_BUILT_MODULE),$(my_prebuilt_android_manifest))
-
-else
-
-# run Jetifier if needed
-LOCAL_JETIFIER_INPUT_FILE := $(my_src_jar)
-include $(BUILD_SYSTEM)/jetifier.mk
-my_src_jar := $(LOCAL_JETIFIER_OUTPUT_FILE)
-
-endif
-
-$(common_classes_jar) : $(my_src_jar)
-	$(transform-prebuilt-to-target)
-
-ifneq ($(TURBINE_ENABLED),false)
-$(common_header_jar) : $(my_src_jar)
-	$(transform-prebuilt-to-target)
-endif
-
-$(common_classes_pre_proguard_jar) : $(my_src_jar)
-	$(transform-prebuilt-to-target)
-
-$(common_javalib_jar) : $(common_classes_jar)
-	$(transform-prebuilt-to-target)
-
-include $(BUILD_SYSTEM)/force_aapt2.mk
-
-ifdef LOCAL_AAPT2_ONLY
-LOCAL_USE_AAPT2 := true
-endif
-
-ifeq ($(LOCAL_USE_AAPT2),true)
-ifneq ($(my_src_aar),)
-
-$(intermediates.COMMON)/export_proguard_flags : $(my_src_proguard_options)
-	$(transform-prebuilt-to-target)
-
-LOCAL_SDK_RES_VERSION:=$(strip $(LOCAL_SDK_RES_VERSION))
-ifeq ($(LOCAL_SDK_RES_VERSION),)
-  LOCAL_SDK_RES_VERSION:=$(LOCAL_SDK_VERSION)
-endif
-
-framework_res_package_export :=
-# Please refer to package.mk
-ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
-ifneq ($(filter-out current system_current test_current,$(LOCAL_SDK_RES_VERSION))$(if $(TARGET_BUILD_APPS),$(filter current system_current test_current,$(LOCAL_SDK_RES_VERSION))),)
-framework_res_package_export := \
-    $(call resolve-prebuilt-sdk-jar-path,$(LOCAL_SDK_RES_VERSION))
-else
-framework_res_package_export := \
-    $(call intermediates-dir-for,APPS,framework-res,,COMMON)/package-export.apk
-endif
-endif
-
-my_res_package := $(intermediates.COMMON)/package-res.apk
-
-# We needed only very few PRIVATE variables and aapt2.mk input variables. Reset the unnecessary ones.
-$(my_res_package): PRIVATE_AAPT2_CFLAGS :=
-$(my_res_package): PRIVATE_AAPT_FLAGS := --static-lib --no-static-lib-packages --auto-add-overlay
-$(my_res_package): PRIVATE_ANDROID_MANIFEST := $(my_src_android_manifest)
-$(my_res_package): PRIVATE_AAPT_INCLUDES := $(framework_res_package_export)
-$(my_res_package): PRIVATE_SOURCE_INTERMEDIATES_DIR :=
-$(my_res_package): PRIVATE_PROGUARD_OPTIONS_FILE :=
-$(my_res_package): PRIVATE_DEFAULT_APP_TARGET_SDK :=
-$(my_res_package): PRIVATE_DEFAULT_APP_TARGET_SDK :=
-$(my_res_package): PRIVATE_PRODUCT_AAPT_CONFIG :=
-$(my_res_package): PRIVATE_PRODUCT_AAPT_PREF_CONFIG :=
-$(my_res_package): PRIVATE_TARGET_AAPT_CHARACTERISTICS :=
-$(my_res_package) : $(framework_res_package_export)
-$(my_res_package) : $(my_src_android_manifest)
-
-full_android_manifest :=
-my_res_resources :=
-my_overlay_resources :=
-my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res
-R_file_stamp :=
-proguard_options_file :=
-my_generated_res_dirs := $(intermediates.COMMON)/aar/res
-my_generated_res_dirs_deps := $(my_src_jar)
-include $(BUILD_SYSTEM)/aapt2.mk
-
-# Make sure my_res_package is created when you run mm/mmm.
-$(built_module) : $(my_res_package)
-endif  # $(my_src_aar)
-endif  # LOCAL_USE_AAPT2
-# make sure the classes.jar and javalib.jar are built before $(LOCAL_BUILT_MODULE)
-$(built_module) : $(common_javalib_jar)
-
-my_exported_sdk_libs_file := $(intermediates.COMMON)/exported-sdk-libs
-$(my_exported_sdk_libs_file): PRIVATE_EXPORTED_SDK_LIBS := $(LOCAL_EXPORT_SDK_LIBRARIES)
-$(my_exported_sdk_libs_file):
-	@echo "Export SDK libs $@"
-	$(hide) mkdir -p $(dir $@) && rm -f $@
-	$(if $(PRIVATE_EXPORTED_SDK_LIBS),\
-		$(hide) echo $(PRIVATE_EXPORTED_SDK_LIBS) | tr ' ' '\n' > $@,\
-		$(hide) touch $@)
-
-endif # ! prebuilt_module_is_dex_javalib
-endif # LOCAL_IS_HOST_MODULE is not set
-
-endif # JAVA_LIBRARIES
-
-endif # APPS
 
 $(built_module) : $(LOCAL_ADDITIONAL_DEPENDENCIES)
 
diff --git a/core/product-graph.mk b/core/product-graph.mk
index a114b65..968d01b 100644
--- a/core/product-graph.mk
+++ b/core/product-graph.mk
@@ -33,7 +33,6 @@
 	)
 endef
 
-
 this_makefile := build/make/core/product-graph.mk
 
 products_graph := $(OUT_DIR)/products.dot
@@ -52,13 +51,27 @@
 open_parethesis := (
 close_parenthesis := )
 
+node_color_target := orange
+node_color_common := beige
+node_color_vendor := lavenderblush
+node_color_default := white
+define node-color
+$(if $(filter $(1),$(PRIVATE_PRODUCTS_FILTER)),\
+  $(node_color_target),\
+  $(if $(filter build/make/target/product/%,$(1)),\
+    $(node_color_common),\
+    $(if $(filter vendor/%,$(1)),$(node_color_vendor),$(node_color_default))\
+  )\
+)
+endef
+
 # Emit properties of a product node to a file.
 # $(1) the product
 # $(2) the output file
 define emit-product-node-props
 $(hide) echo \"$(1)\" [ \
-label=\"$(dir $(1))\\n$(notdir $(1))\\n\\n$(subst $(close_parenthesis),,$(subst $(open_parethesis),,$(PRODUCTS.$(strip $(1)).PRODUCT_MODEL)))\\n$(PRODUCTS.$(strip $(1)).PRODUCT_DEVICE)\" \
-$(if $(filter $(1),$(PRIVATE_PRODUCTS_FILTER)), style=\"filled\" fillcolor=\"#FFFDB0\",) \
+label=\"$(dir $(1))\\n$(notdir $(1))\\n\\n$(subst $(close_parenthesis),,$(subst $(open_parethesis),,$(call get-product-var,$(1),PRODUCT_MODEL)))\\n$(call get-product-var,$(1),PRODUCT_DEVICE)\" \
+style=\"filled\" fillcolor=\"$(strip $(call node-color,$(1)))\" \
 colorscheme=\"svg\" fontcolor=\"darkblue\" href=\"products/$(1).html\" \
 ] >> $(2)
 
@@ -91,34 +104,35 @@
 	$(hide) rm -f $$@
 	$(hide) mkdir -p $$(dir $$@)
 	$(hide) echo 'FILE=$(strip $(1))' >> $$@
-	$(hide) echo 'PRODUCT_NAME=$$(PRODUCTS.$(strip $(1)).PRODUCT_NAME)' >> $$@
-	$(hide) echo 'PRODUCT_MODEL=$$(PRODUCTS.$(strip $(1)).PRODUCT_MODEL)' >> $$@
-	$(hide) echo 'PRODUCT_LOCALES=$$(PRODUCTS.$(strip $(1)).PRODUCT_LOCALES)' >> $$@
-	$(hide) echo 'PRODUCT_AAPT_CONFIG=$$(PRODUCTS.$(strip $(1)).PRODUCT_AAPT_CONFIG)' >> $$@
-	$(hide) echo 'PRODUCT_AAPT_PREF_CONFIG=$$(PRODUCTS.$(strip $(1)).PRODUCT_AAPT_PREF_CONFIG)' >> $$@
-	$(hide) echo 'PRODUCT_PACKAGES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PACKAGES)' >> $$@
-	$(hide) echo 'PRODUCT_DEVICE=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEVICE)' >> $$@
-	$(hide) echo 'PRODUCT_MANUFACTURER=$$(PRODUCTS.$(strip $(1)).PRODUCT_MANUFACTURER)' >> $$@
-	$(hide) echo 'PRODUCT_PROPERTY_OVERRIDES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PROPERTY_OVERRIDES)' >> $$@
-	$(hide) echo 'PRODUCT_DEFAULT_PROPERTY_OVERRIDES=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_PROPERTY_OVERRIDES)' >> $$@
-	$(hide) echo 'PRODUCT_SYSTEM_DEFAULT_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SYSTEM_DEFAULT_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_PRODUCT_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PRODUCT_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_PRODUCT_SERVICES_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PRODUCT_SERVICES_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_ODM_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_ODM_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_CHARACTERISTICS=$$(PRODUCTS.$(strip $(1)).PRODUCT_CHARACTERISTICS)' >> $$@
-	$(hide) echo 'PRODUCT_COPY_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_COPY_FILES)' >> $$@
-	$(hide) echo 'PRODUCT_OTA_PUBLIC_KEYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_OTA_PUBLIC_KEYS)' >> $$@
-	$(hide) echo 'PRODUCT_EXTRA_RECOVERY_KEYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_EXTRA_RECOVERY_KEYS)' >> $$@
-	$(hide) echo 'PRODUCT_PACKAGE_OVERLAYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_PACKAGE_OVERLAYS)' >> $$@
-	$(hide) echo 'DEVICE_PACKAGE_OVERLAYS=$$(PRODUCTS.$(strip $(1)).DEVICE_PACKAGE_OVERLAYS)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_NAME=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_NAME)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_COPY_FILES)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_MODULES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_COPY_MODULES)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_DOC_MODULES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_DOC_MODULES)' >> $$@
-	$(hide) echo 'PRODUCT_DEFAULT_WIFI_CHANNELS=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_WIFI_CHANNELS)' >> $$@
-	$(hide) echo 'PRODUCT_DEFAULT_DEV_CERTIFICATE=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_DEV_CERTIFICATE)' >> $$@
-	$(hide) echo 'PRODUCT_RESTRICT_VENDOR_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_RESTRICT_VENDOR_FILES)' >> $$@
-	$(hide) echo 'PRODUCT_VENDOR_KERNEL_HEADERS=$$(PRODUCTS.$(strip $(1)).PRODUCT_VENDOR_KERNEL_HEADERS)' >> $$@
+	$(hide) echo 'PRODUCT_NAME=$(call get-product-var,$(1),PRODUCT_NAME)' >> $$@
+	$(hide) echo 'PRODUCT_MODEL=$(call get-product-var,$(1),PRODUCT_MODEL)' >> $$@
+	$(hide) echo 'PRODUCT_LOCALES=$(call get-product-var,$(1),PRODUCT_LOCALES)' >> $$@
+	$(hide) echo 'PRODUCT_AAPT_CONFIG=$(call get-product-var,$(1),PRODUCT_AAPT_CONFIG)' >> $$@
+	$(hide) echo 'PRODUCT_AAPT_PREF_CONFIG=$(call get-product-var,$(1),PRODUCT_AAPT_PREF_CONFIG)' >> $$@
+	$(hide) echo 'PRODUCT_PACKAGES=$(call get-product-var,$(1),PRODUCT_PACKAGES)' >> $$@
+	$(hide) echo 'PRODUCT_DEVICE=$(call get-product-var,$(1),PRODUCT_DEVICE)' >> $$@
+	$(hide) echo 'PRODUCT_MANUFACTURER=$(call get-product-var,$(1),PRODUCT_MANUFACTURER)' >> $$@
+	$(hide) echo 'PRODUCT_PROPERTY_OVERRIDES=$(call get-product-var,$(1),PRODUCT_PROPERTY_OVERRIDES)' >> $$@
+	$(hide) echo 'PRODUCT_DEFAULT_PROPERTY_OVERRIDES=$(call get-product-var,$(1),PRODUCT_DEFAULT_PROPERTY_OVERRIDES)' >> $$@
+	$(hide) echo 'PRODUCT_SYSTEM_DEFAULT_PROPERTIES=$(call get-product-var,$(1),PRODUCT_SYSTEM_DEFAULT_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_PRODUCT_PROPERTIES=$(call get-product-var,$(1),PRODUCT_PRODUCT_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_SYSTEM_EXT_PROPERTIES=$(call get-product-var,$(1),PRODUCT_SYSTEM_EXT_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_ODM_PROPERTIES=$(call get-product-var,$(1),PRODUCT_ODM_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_CHARACTERISTICS=$(call get-product-var,$(1),PRODUCT_CHARACTERISTICS)' >> $$@
+	$(hide) echo 'PRODUCT_COPY_FILES=$(call get-product-var,$(1),PRODUCT_COPY_FILES)' >> $$@
+	$(hide) echo 'PRODUCT_OTA_PUBLIC_KEYS=$(call get-product-var,$(1),PRODUCT_OTA_PUBLIC_KEYS)' >> $$@
+	$(hide) echo 'PRODUCT_EXTRA_RECOVERY_KEYS=$(call get-product-var,$(1),PRODUCT_EXTRA_RECOVERY_KEYS)' >> $$@
+	$(hide) echo 'PRODUCT_PACKAGE_OVERLAYS=$(call get-product-var,$(1),PRODUCT_PACKAGE_OVERLAYS)' >> $$@
+	$(hide) echo 'DEVICE_PACKAGE_OVERLAYS=$(call get-product-var,$(1),DEVICE_PACKAGE_OVERLAYS)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_NAME=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_NAME)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_FILES=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_COPY_FILES)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_MODULES=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_COPY_MODULES)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_DOC_MODULES=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_DOC_MODULES)' >> $$@
+	$(hide) echo 'PRODUCT_DEFAULT_WIFI_CHANNELS=$(call get-product-var,$(1),PRODUCT_DEFAULT_WIFI_CHANNELS)' >> $$@
+	$(hide) echo 'PRODUCT_DEFAULT_DEV_CERTIFICATE=$(call get-product-var,$(1),PRODUCT_DEFAULT_DEV_CERTIFICATE)' >> $$@
+	$(hide) echo 'PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES=$(call get-product-var,$(1),PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES)' >> $$@
+	$(hide) echo 'PRODUCT_RESTRICT_VENDOR_FILES=$(call get-product-var,$(1),PRODUCT_RESTRICT_VENDOR_FILES)' >> $$@
+	$(hide) echo 'PRODUCT_VENDOR_KERNEL_HEADERS=$(call get-product-var,$(1),PRODUCT_VENDOR_KERNEL_HEADERS)' >> $$@
 
 $(call product-debug-filename, $(p)): \
 			$(OUT_DIR)/products/$(strip $(1)).txt \
diff --git a/core/product.mk b/core/product.mk
index 4048563..f8ba593 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -106,32 +106,39 @@
 $(call get-product-makefiles,$(_find-android-products-files))
 endef
 
-_product_var_list :=
-_product_var_list += PRODUCT_NAME
-_product_var_list += PRODUCT_MODEL
+# Variables that are meant to hold only a single value.
+# - The value set in the current makefile takes precedence over inherited values
+# - If multiple inherited makefiles set the var, the first-inherited value wins
+_product_single_value_vars :=
+
+# Variables that are lists of values.
+_product_list_vars :=
+
+_product_single_value_vars += PRODUCT_NAME
+_product_single_value_vars += PRODUCT_MODEL
 
 # The resoure configuration options to use for this product.
-_product_var_list += PRODUCT_LOCALES
-_product_var_list += PRODUCT_AAPT_CONFIG
-_product_var_list += PRODUCT_AAPT_PREF_CONFIG
-_product_var_list += PRODUCT_AAPT_PREBUILT_DPI
-_product_var_list += PRODUCT_HOST_PACKAGES
-_product_var_list += PRODUCT_PACKAGES
-_product_var_list += PRODUCT_PACKAGES_DEBUG
-_product_var_list += PRODUCT_PACKAGES_DEBUG_ASAN
+_product_list_vars += PRODUCT_LOCALES
+_product_list_vars += PRODUCT_AAPT_CONFIG
+_product_list_vars += PRODUCT_AAPT_PREF_CONFIG
+_product_list_vars += PRODUCT_AAPT_PREBUILT_DPI
+_product_list_vars += PRODUCT_HOST_PACKAGES
+_product_list_vars += PRODUCT_PACKAGES
+_product_list_vars += PRODUCT_PACKAGES_DEBUG
+_product_list_vars += PRODUCT_PACKAGES_DEBUG_ASAN
 # Packages included only for eng/userdebug builds, when building with EMMA_INSTRUMENT=true
-_product_var_list += PRODUCT_PACKAGES_DEBUG_JAVA_COVERAGE
-_product_var_list += PRODUCT_PACKAGES_ENG
-_product_var_list += PRODUCT_PACKAGES_TESTS
+_product_list_vars += PRODUCT_PACKAGES_DEBUG_JAVA_COVERAGE
+_product_list_vars += PRODUCT_PACKAGES_ENG
+_product_list_vars += PRODUCT_PACKAGES_TESTS
 
 # The device that this product maps to.
-_product_var_list += PRODUCT_DEVICE
-_product_var_list += PRODUCT_MANUFACTURER
-_product_var_list += PRODUCT_BRAND
+_product_single_value_vars += PRODUCT_DEVICE
+_product_single_value_vars += PRODUCT_MANUFACTURER
+_product_single_value_vars += PRODUCT_BRAND
 
 # These PRODUCT_SYSTEM_* flags, if defined, are used in place of the
 # corresponding PRODUCT_* flags for the sysprops on /system.
-_product_var_list += \
+_product_single_value_vars += \
     PRODUCT_SYSTEM_NAME \
     PRODUCT_SYSTEM_MODEL \
     PRODUCT_SYSTEM_DEVICE \
@@ -140,24 +147,26 @@
 
 # A list of property assignments, like "key = value", with zero or more
 # whitespace characters on either side of the '='.
-_product_var_list += PRODUCT_PROPERTY_OVERRIDES
+_product_list_vars += PRODUCT_PROPERTY_OVERRIDES
 
 # A list of property assignments, like "key = value", with zero or more
 # whitespace characters on either side of the '='.
 # used for adding properties to default.prop
-_product_var_list += PRODUCT_DEFAULT_PROPERTY_OVERRIDES
+_product_list_vars += PRODUCT_DEFAULT_PROPERTY_OVERRIDES
 
 # A list of property assignments, like "key = value", with zero or more
 # whitespace characters on either side of the '='.
 # used for adding properties to build.prop of product partition
-_product_var_list += PRODUCT_PRODUCT_PROPERTIES
+_product_list_vars += PRODUCT_PRODUCT_PROPERTIES
 
 # A list of property assignments, like "key = value", with zero or more
 # whitespace characters on either side of the '='.
-# used for adding properties to build.prop of product partition
-_product_var_list += PRODUCT_PRODUCT_SERVICES_PROPERTIES
-_product_var_list += PRODUCT_ODM_PROPERTIES
-_product_var_list += PRODUCT_CHARACTERISTICS
+# used for adding properties to build.prop of system_ext and odm partitions
+_product_list_vars += PRODUCT_SYSTEM_EXT_PROPERTIES
+_product_list_vars += PRODUCT_ODM_PROPERTIES
+
+# The characteristics of the product, which among other things is passed to aapt
+_product_single_value_vars += PRODUCT_CHARACTERISTICS
 
 # A list of words like <source path>:<destination path>[:<owner>].
 # The file at the source path should be copied to the destination path
@@ -165,157 +174,180 @@
 # $(PRODUCT_OUT), so it should look like, e.g., "system/etc/file.xml".
 # The rules for these copy steps are defined in build/make/core/Makefile.
 # The optional :<owner> is used to indicate the owner of a vendor file.
-_product_var_list += PRODUCT_COPY_FILES
+_product_list_vars += PRODUCT_COPY_FILES
 
 # The OTA key(s) specified by the product config, if any.  The names
 # of these keys are stored in the target-files zip so that post-build
 # signing tools can substitute them for the test key embedded by
 # default.
-_product_var_list += PRODUCT_OTA_PUBLIC_KEYS
-_product_var_list += PRODUCT_EXTRA_RECOVERY_KEYS
+_product_list_vars += PRODUCT_OTA_PUBLIC_KEYS
+_product_list_vars += PRODUCT_EXTRA_RECOVERY_KEYS
 
 # Should we use the default resources or add any product specific overlays
-_product_var_list += PRODUCT_PACKAGE_OVERLAYS
-_product_var_list += DEVICE_PACKAGE_OVERLAYS
+_product_list_vars += PRODUCT_PACKAGE_OVERLAYS
+_product_list_vars += DEVICE_PACKAGE_OVERLAYS
 
 # Resource overlay list which must be excluded from enforcing RRO.
-_product_var_list += PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS
+_product_list_vars += PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS
 
 # Package list to apply enforcing RRO.
-_product_var_list += PRODUCT_ENFORCE_RRO_TARGETS
+_product_list_vars += PRODUCT_ENFORCE_RRO_TARGETS
 
-_product_var_list += PRODUCT_SDK_ATREE_FILES
-_product_var_list += PRODUCT_SDK_ADDON_NAME
-_product_var_list += PRODUCT_SDK_ADDON_COPY_FILES
-_product_var_list += PRODUCT_SDK_ADDON_COPY_MODULES
-_product_var_list += PRODUCT_SDK_ADDON_DOC_MODULES
-_product_var_list += PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP
+# Packages to skip auto-generating RROs for when PRODUCT_ENFORCE_RRO_TARGETS is set to *.
+_product_list_vars += PRODUCT_ENFORCE_RRO_EXEMPTED_TARGETS
+
+_product_list_vars += PRODUCT_SDK_ATREE_FILES
+_product_list_vars += PRODUCT_SDK_ADDON_NAME
+_product_list_vars += PRODUCT_SDK_ADDON_COPY_FILES
+_product_list_vars += PRODUCT_SDK_ADDON_COPY_MODULES
+_product_list_vars += PRODUCT_SDK_ADDON_DOC_MODULES
+_product_list_vars += PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP
 
 # which Soong namespaces to export to Make
-_product_var_list += PRODUCT_SOONG_NAMESPACES
+_product_list_vars += PRODUCT_SOONG_NAMESPACES
 
-_product_var_list += PRODUCT_DEFAULT_WIFI_CHANNELS
-_product_var_list += PRODUCT_DEFAULT_DEV_CERTIFICATE
-_product_var_list += PRODUCT_RESTRICT_VENDOR_FILES
+_product_list_vars += PRODUCT_DEFAULT_WIFI_CHANNELS
+_product_list_vars += PRODUCT_DEFAULT_DEV_CERTIFICATE
+_product_list_vars += PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES
+_product_list_vars += PRODUCT_RESTRICT_VENDOR_FILES
 
 # The list of product-specific kernel header dirs
-_product_var_list += PRODUCT_VENDOR_KERNEL_HEADERS
+_product_list_vars += PRODUCT_VENDOR_KERNEL_HEADERS
 
 # A list of module names of BOOTCLASSPATH (jar files)
-_product_var_list += PRODUCT_BOOT_JARS
-_product_var_list += PRODUCT_SUPPORTS_BOOT_SIGNER
-_product_var_list += PRODUCT_SUPPORTS_VBOOT
-_product_var_list += PRODUCT_SUPPORTS_VERITY
-_product_var_list += PRODUCT_SUPPORTS_VERITY_FEC
-_product_var_list += PRODUCT_OEM_PROPERTIES
+_product_list_vars += PRODUCT_BOOT_JARS
+
+# A list of extra BOOTCLASSPATH jars (to be appended after common jars).
+# Products that include device-specific makefiles before AOSP makefiles should use this
+# instead of PRODUCT_BOOT_JARS, so that device-specific jars go after common jars.
+_product_list_vars += PRODUCT_BOOT_JARS_EXTRA
+
+_product_list_vars += PRODUCT_SUPPORTS_BOOT_SIGNER
+_product_list_vars += PRODUCT_SUPPORTS_VBOOT
+_product_list_vars += PRODUCT_SUPPORTS_VERITY
+_product_list_vars += PRODUCT_SUPPORTS_VERITY_FEC
+_product_list_vars += PRODUCT_OEM_PROPERTIES
 
 # A list of property assignments, like "key = value", with zero or more
 # whitespace characters on either side of the '='.
 # used for adding properties to default.prop of system partition
-_product_var_list += PRODUCT_SYSTEM_DEFAULT_PROPERTIES
+_product_list_vars += PRODUCT_SYSTEM_DEFAULT_PROPERTIES
 
-_product_var_list += PRODUCT_SYSTEM_PROPERTY_BLACKLIST
-_product_var_list += PRODUCT_VENDOR_PROPERTY_BLACKLIST
-_product_var_list += PRODUCT_SYSTEM_SERVER_APPS
-_product_var_list += PRODUCT_SYSTEM_SERVER_JARS
+_product_list_vars += PRODUCT_SYSTEM_PROPERTY_BLACKLIST
+_product_list_vars += PRODUCT_VENDOR_PROPERTY_BLACKLIST
+_product_list_vars += PRODUCT_SYSTEM_SERVER_APPS
+_product_list_vars += PRODUCT_SYSTEM_SERVER_JARS
+# List of system_server jars delivered via apex. Format = <apex name>:<jar name>.
+_product_list_vars += PRODUCT_UPDATABLE_SYSTEM_SERVER_JARS
+
+# Additional system server jars to be appended at the end of the common list.
+# This is necessary to avoid jars reordering due to makefile inheritance order.
+_product_list_vars += PRODUCT_SYSTEM_SERVER_JARS_EXTRA
 
 # All of the apps that we force preopt, this overrides WITH_DEXPREOPT.
-_product_var_list += PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK
-_product_var_list += PRODUCT_DEXPREOPT_SPEED_APPS
-_product_var_list += PRODUCT_LOADED_BY_PRIVILEGED_MODULES
-_product_var_list += PRODUCT_VBOOT_SIGNING_KEY
-_product_var_list += PRODUCT_VBOOT_SIGNING_SUBKEY
-_product_var_list += PRODUCT_VERITY_SIGNING_KEY
-_product_var_list += PRODUCT_SYSTEM_VERITY_PARTITION
-_product_var_list += PRODUCT_VENDOR_VERITY_PARTITION
-_product_var_list += PRODUCT_PRODUCT_VERITY_PARTITION
-_product_var_list += PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION
-_product_var_list += PRODUCT_ODM_VERITY_PARTITION
-_product_var_list += PRODUCT_SYSTEM_SERVER_DEBUG_INFO
-_product_var_list += PRODUCT_OTHER_JAVA_DEBUG_INFO
+_product_list_vars += PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK
+_product_list_vars += PRODUCT_DEXPREOPT_SPEED_APPS
+_product_list_vars += PRODUCT_LOADED_BY_PRIVILEGED_MODULES
+_product_single_value_vars += PRODUCT_VBOOT_SIGNING_KEY
+_product_single_value_vars += PRODUCT_VBOOT_SIGNING_SUBKEY
+_product_single_value_vars += PRODUCT_VERITY_SIGNING_KEY
+_product_single_value_vars += PRODUCT_SYSTEM_VERITY_PARTITION
+_product_single_value_vars += PRODUCT_VENDOR_VERITY_PARTITION
+_product_single_value_vars += PRODUCT_PRODUCT_VERITY_PARTITION
+_product_single_value_vars += PRODUCT_SYSTEM_EXT_VERITY_PARTITION
+_product_single_value_vars += PRODUCT_ODM_VERITY_PARTITION
+_product_single_value_vars += PRODUCT_SYSTEM_SERVER_DEBUG_INFO
+_product_single_value_vars += PRODUCT_OTHER_JAVA_DEBUG_INFO
 
 # Per-module dex-preopt configs.
-_product_var_list += PRODUCT_DEX_PREOPT_MODULE_CONFIGS
-_product_var_list += PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER
-_product_var_list += PRODUCT_DEX_PREOPT_DEFAULT_FLAGS
-_product_var_list += PRODUCT_DEX_PREOPT_BOOT_FLAGS
-_product_var_list += PRODUCT_DEX_PREOPT_PROFILE_DIR
-_product_var_list += PRODUCT_DEX_PREOPT_GENERATE_DM_FILES
-_product_var_list += PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING
-_product_var_list += PRODUCT_DEX_PREOPT_RESOLVE_STARTUP_STRINGS
+_product_list_vars += PRODUCT_DEX_PREOPT_MODULE_CONFIGS
+_product_list_vars += PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER
+_product_list_vars += PRODUCT_DEX_PREOPT_DEFAULT_FLAGS
+_product_list_vars += PRODUCT_DEX_PREOPT_BOOT_FLAGS
+_product_list_vars += PRODUCT_DEX_PREOPT_PROFILE_DIR
+_product_list_vars += PRODUCT_DEX_PREOPT_GENERATE_DM_FILES
+_product_list_vars += PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING
+_product_list_vars += PRODUCT_DEX_PREOPT_RESOLVE_STARTUP_STRINGS
 
 # Boot image options.
-_product_var_list += \
+_product_single_value_vars += \
     PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE \
     PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION \
-    PRODUCT_USES_ART \
+    PRODUCT_USES_DEFAULT_ART_CONFIG \
 
-_product_var_list += PRODUCT_SYSTEM_SERVER_COMPILER_FILTER
+_product_list_vars += PRODUCT_SYSTEM_SERVER_COMPILER_FILTER
 # Per-module sanitizer configs
-_product_var_list += PRODUCT_SANITIZER_MODULE_CONFIGS
-_product_var_list += PRODUCT_SYSTEM_BASE_FS_PATH
-_product_var_list += PRODUCT_VENDOR_BASE_FS_PATH
-_product_var_list += PRODUCT_PRODUCT_BASE_FS_PATH
-_product_var_list += PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH
-_product_var_list += PRODUCT_ODM_BASE_FS_PATH
-_product_var_list += PRODUCT_SHIPPING_API_LEVEL
-_product_var_list += VENDOR_PRODUCT_RESTRICT_VENDOR_FILES
-_product_var_list += VENDOR_EXCEPTION_MODULES
-_product_var_list += VENDOR_EXCEPTION_PATHS
+_product_list_vars += PRODUCT_SANITIZER_MODULE_CONFIGS
+_product_single_value_vars += PRODUCT_SYSTEM_BASE_FS_PATH
+_product_single_value_vars += PRODUCT_VENDOR_BASE_FS_PATH
+_product_single_value_vars += PRODUCT_PRODUCT_BASE_FS_PATH
+_product_single_value_vars += PRODUCT_SYSTEM_EXT_BASE_FS_PATH
+_product_single_value_vars += PRODUCT_ODM_BASE_FS_PATH
 
+# The first API level this product shipped with
+_product_single_value_vars += PRODUCT_SHIPPING_API_LEVEL
+
+_product_list_vars += VENDOR_PRODUCT_RESTRICT_VENDOR_FILES
+_product_list_vars += VENDOR_EXCEPTION_MODULES
+_product_list_vars += VENDOR_EXCEPTION_PATHS
 # Whether the product wants to ship libartd. For rules and meaning, see art/Android.mk.
-_product_var_list += PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD
+_product_single_value_vars += PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD
 
 # Make this art variable visible to soong_config.mk.
-_product_var_list += PRODUCT_ART_USE_READ_BARRIER
-
-# Whether the product is an Android Things variant.
-_product_var_list += PRODUCT_IOT
+_product_single_value_vars += PRODUCT_ART_USE_READ_BARRIER
 
 # Add reserved headroom to a system image.
-_product_var_list += PRODUCT_SYSTEM_HEADROOM
+_product_single_value_vars += PRODUCT_SYSTEM_HEADROOM
 
 # Whether to save disk space by minimizing java debug info
-_product_var_list += PRODUCT_MINIMIZE_JAVA_DEBUG_INFO
+_product_single_value_vars += PRODUCT_MINIMIZE_JAVA_DEBUG_INFO
 
 # Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
-_product_var_list += PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS
+_product_list_vars += PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS
 
-_product_var_list += PRODUCT_ADB_KEYS
+_product_single_value_vars += PRODUCT_ADB_KEYS
 
 # Whether any paths should have CFI enabled for components
-_product_var_list += PRODUCT_CFI_INCLUDE_PATHS
+_product_list_vars += PRODUCT_CFI_INCLUDE_PATHS
 
 # Whether any paths are excluded from sanitization when SANITIZE_TARGET=cfi
-_product_var_list += PRODUCT_CFI_EXCLUDE_PATHS
+_product_list_vars += PRODUCT_CFI_EXCLUDE_PATHS
 
 # Whether the Scudo hardened allocator is disabled platform-wide
-_product_var_list += PRODUCT_DISABLE_SCUDO
+_product_single_value_vars += PRODUCT_DISABLE_SCUDO
 
 # A flag to override PRODUCT_COMPATIBLE_PROPERTY
-_product_var_list += PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE
+_product_single_value_vars += PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE
 
-# Whether the whitelist of actionable compatible properties should be disabled or not
-_product_var_list += PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE
-_product_var_list += PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS
-_product_var_list += PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT
-_product_var_list += PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST
-_product_var_list += PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT
-_product_var_list += PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST
+# List of extra VNDK versions to be included
+_product_list_vars += PRODUCT_EXTRA_VNDK_VERSIONS
+
+# VNDK version of product partition. It can be 'current' if the product
+# partitions uses PLATFORM_VNDK_VERSION.
+_product_single_value_var += PRODUCT_PRODUCT_VNDK_VERSION
+
+# Whether the list of allowed of actionable compatible properties should be disabled or not
+_product_single_value_vars += PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE
+
+_product_single_value_vars += PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS
+_product_single_value_vars += PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT
+_product_list_vars += PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_ALLOW_LIST
+_product_list_vars += PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT
+_product_list_vars += PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST
 
 # List of modules that should be forcefully unmarked from being LOCAL_PRODUCT_MODULE, and hence
 # installed on /system directory by default.
-_product_var_list += PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION
+_product_list_vars += PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION
 
 # When this is true, dynamic partitions is retrofitted on a device that has
 # already been launched without dynamic partitions. Otherwise, the device
 # is launched with dynamic partitions.
 # This flag implies PRODUCT_USE_DYNAMIC_PARTITIONS.
-_product_var_list += PRODUCT_RETROFIT_DYNAMIC_PARTITIONS
+_product_single_value_vars += PRODUCT_RETROFIT_DYNAMIC_PARTITIONS
 
 # Other dynamic partition feature flags.PRODUCT_USE_DYNAMIC_PARTITION_SIZE and
 # PRODUCT_BUILD_SUPER_PARTITION default to the value of PRODUCT_USE_DYNAMIC_PARTITIONS.
-_product_var_list += \
+_product_single_value_vars += \
     PRODUCT_USE_DYNAMIC_PARTITIONS \
     PRODUCT_USE_DYNAMIC_PARTITION_SIZE \
     PRODUCT_BUILD_SUPER_PARTITION \
@@ -324,33 +356,62 @@
 # during OTA). Otherwise, kernel configuration requirements are enforced in VTS.
 # Devices that checks the running kernel (instead of the kernel in OTA package) should not
 # set this variable to prevent OTA failures.
-_product_var_list += PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS
+_product_list_vars += PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS
 
-# Whether any paths are excluded from being set XOM when ENABLE_XOM=true
-_product_var_list += PRODUCT_XOM_EXCLUDE_PATHS
-_product_var_list += PRODUCT_MANIFEST_PACKAGE_NAME_OVERRIDES
-_product_var_list += PRODUCT_PACKAGE_NAME_OVERRIDES
-_product_var_list += PRODUCT_CERTIFICATE_OVERRIDES
-_product_var_list += PRODUCT_BUILD_SYSTEM_IMAGE
-_product_var_list += PRODUCT_BUILD_SYSTEM_OTHER_IMAGE
-_product_var_list += PRODUCT_BUILD_VENDOR_IMAGE
-_product_var_list += PRODUCT_BUILD_PRODUCT_IMAGE
-_product_var_list += PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE
-_product_var_list += PRODUCT_BUILD_ODM_IMAGE
-_product_var_list += PRODUCT_BUILD_CACHE_IMAGE
-_product_var_list += PRODUCT_BUILD_RAMDISK_IMAGE
-_product_var_list += PRODUCT_BUILD_USERDATA_IMAGE
-_product_var_list += PRODUCT_UPDATABLE_BOOT_MODULES
-_product_var_list += PRODUCT_UPDATABLE_BOOT_LOCATIONS
+# If set to true, this product builds a generic OTA package, which installs generic system images
+# onto matching devices. The product may only build a subset of system images (e.g. only
+# system.img), so devices need to install the package in a system-only OTA manner.
+_product_single_value_vars += PRODUCT_BUILD_GENERIC_OTA_PACKAGE
+
+_product_list_vars += PRODUCT_MANIFEST_PACKAGE_NAME_OVERRIDES
+_product_list_vars += PRODUCT_PACKAGE_NAME_OVERRIDES
+_product_list_vars += PRODUCT_CERTIFICATE_OVERRIDES
+
+# Controls for whether different partitions are built for the current product.
+_product_single_value_vars += PRODUCT_BUILD_SYSTEM_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_SYSTEM_OTHER_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_VENDOR_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_PRODUCT_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_SYSTEM_EXT_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_ODM_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_CACHE_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_RAMDISK_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_USERDATA_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_RECOVERY_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_BOOT_IMAGE
+_product_single_value_vars += PRODUCT_BUILD_VBMETA_IMAGE
+
+# List of boot jars delivered via apex
+_product_list_vars += PRODUCT_UPDATABLE_BOOT_JARS
 
 # Whether the product would like to check prebuilt ELF files.
-_product_var_list += PRODUCT_CHECK_ELF_FILES
-.KATI_READONLY := _product_var_list
+_product_single_value_vars += PRODUCT_CHECK_ELF_FILES
+
+# If set, device uses virtual A/B.
+_product_single_value_vars += PRODUCT_VIRTUAL_AB_OTA
+
+# If set, device retrofits virtual A/B.
+_product_single_value_vars += PRODUCT_VIRTUAL_AB_OTA_RETROFIT
+
+# If set, forcefully generate a non-A/B update package.
+# Note: A device configuration should inherit from virtual_ab_ota_plus_non_ab.mk
+# instead of setting this variable directly.
+# Note: Use TARGET_OTA_ALLOW_NON_AB in the build system because
+# TARGET_OTA_ALLOW_NON_AB takes the value of AB_OTA_UPDATER into account.
+_product_single_value_vars += PRODUCT_OTA_FORCE_NON_AB_PACKAGE
+
+# If set, Java module in product partition cannot use hidden APIs.
+_product_single_value_vars += PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE
+
+_product_single_value_vars += PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES
+
+.KATI_READONLY := _product_single_value_vars _product_list_vars
+_product_var_list :=$= $(_product_single_value_vars) $(_product_list_vars)
 
 define dump-product
 $(warning ==== $(1) ====)\
 $(foreach v,$(_product_var_list),\
-$(warning PRODUCTS.$(1).$(v) := $(PRODUCTS.$(1).$(v))))\
+$(warning PRODUCTS.$(1).$(v) := $(call get-product-var,$(1),$(v))))\
 $(warning --------)
 endef
 
@@ -392,19 +453,19 @@
 define require-artifacts-in-path
   $(eval current_mk := $(strip $(word 1,$(_include_stack)))) \
   $(eval PRODUCTS.$(current_mk).ARTIFACT_PATH_REQUIREMENTS := $(strip $(1))) \
-  $(eval PRODUCTS.$(current_mk).ARTIFACT_PATH_WHITELIST := $(strip $(2))) \
+  $(eval PRODUCTS.$(current_mk).ARTIFACT_PATH_ALLOWED_LIST := $(strip $(2))) \
   $(eval ARTIFACT_PATH_REQUIREMENT_PRODUCTS := \
     $(sort $(ARTIFACT_PATH_REQUIREMENT_PRODUCTS) $(current_mk)))
 endef
 
-# Makes including non-existant modules in PRODUCT_PACKAGES an error.
-# $(1): whitelist of non-existant modules to allow.
+# Makes including non-existent modules in PRODUCT_PACKAGES an error.
+# $(1): list of non-existent modules to allow.
 define enforce-product-packages-exist
   $(eval current_mk := $(strip $(word 1,$(_include_stack)))) \
   $(eval PRODUCTS.$(current_mk).PRODUCT_ENFORCE_PACKAGES_EXIST := true) \
-  $(eval PRODUCTS.$(current_mk).PRODUCT_ENFORCE_PACKAGES_EXIST_WHITELIST := $(1)) \
+  $(eval PRODUCTS.$(current_mk).PRODUCT_ENFORCE_PACKAGES_EXIST_ALLOW_LIST := $(1)) \
   $(eval .KATI_READONLY := PRODUCTS.$(current_mk).PRODUCT_ENFORCE_PACKAGES_EXIST) \
-  $(eval .KATI_READONLY := PRODUCTS.$(current_mk).PRODUCT_ENFORCE_PACKAGES_EXIST_WHITELIST)
+  $(eval .KATI_READONLY := PRODUCTS.$(current_mk).PRODUCT_ENFORCE_PACKAGES_EXIST_ALLOW_LIST)
 endef
 
 #
@@ -419,7 +480,7 @@
 #
 #TODO: check to make sure that products have all the necessary vars defined
 define import-products
-$(call import-nodes,PRODUCTS,$(1),$(_product_var_list))
+$(call import-nodes,PRODUCTS,$(1),$(_product_var_list),$(_product_single_value_vars))
 endef
 
 
@@ -515,12 +576,21 @@
 $(call readonly-variables,$(_readonly_late_variables))
 endef
 
+# Macro re-defined inside strip-product-vars.
+get-product-var = $(PRODUCTS.$(strip $(1)).$(2))
 #
-# Strip the variables in _product_strip_var_list
+# Strip the variables in _product_var_list and a few build-system
+# internal variables, and assign the ones for the current product
+# to a shorthand that is more convenient to read from elsewhere.
 #
 define strip-product-vars
-$(foreach v,$(_product_var_list), \
+$(foreach v,\
+  $(_product_var_list) \
+    PRODUCT_ENFORCE_PACKAGES_EXIST \
+    PRODUCT_ENFORCE_PACKAGES_EXIST_ALLOW_LIST, \
   $(eval $(v) := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).$(v)))) \
+  $(eval get-product-var = $$(if $$(filter $$(1),$$(INTERNAL_PRODUCT)),$$($$(2)),$$(PRODUCTS.$$(strip $$(1)).$$(2)))) \
+  $(KATI_obsolete_var PRODUCTS.$(INTERNAL_PRODUCT).$(v),Use $(v) instead) \
 )
 endef
 
diff --git a/core/product_config.mk b/core/product_config.mk
index 9460357..a16af05 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -78,86 +78,18 @@
 endef
 
 # ---------------------------------------------------------------
-
-# These are the valid values of TARGET_BUILD_VARIANT.  Also, if anything else is passed
-# as the variant in the PRODUCT-$TARGET_BUILD_PRODUCT-$TARGET_BUILD_VARIANT form,
-# it will be treated as a goal, and the eng variant will be used.
-INTERNAL_VALID_VARIANTS := user userdebug eng
-
-# ---------------------------------------------------------------
-# Provide "PRODUCT-<prodname>-<goal>" targets, which lets you build
-# a particular configuration without needing to set up the environment.
-#
+# Check for obsolete PRODUCT- and APP- goals
 ifeq ($(CALLED_FROM_SETUP),true)
 product_goals := $(strip $(filter PRODUCT-%,$(MAKECMDGOALS)))
 ifdef product_goals
-  # Scrape the product and build names out of the goal,
-  # which should be of the form PRODUCT-<productname>-<buildname>.
-  #
-  ifneq ($(words $(product_goals)),1)
-    $(error Only one PRODUCT-* goal may be specified; saw "$(product_goals)")
-  endif
-  goal_name := $(product_goals)
-  product_goals := $(patsubst PRODUCT-%,%,$(product_goals))
-  product_goals := $(subst -, ,$(product_goals))
-  ifneq ($(words $(product_goals)),2)
-    $(error Bad PRODUCT-* goal "$(goal_name)")
-  endif
-
-  # The product they want
-  TARGET_PRODUCT := $(word 1,$(product_goals))
-
-  # The variant they want
-  TARGET_BUILD_VARIANT := $(word 2,$(product_goals))
-
-  ifeq ($(TARGET_BUILD_VARIANT),tests)
-    $(error "tests" has been deprecated as a build variant. Use it as a build goal instead.)
-  endif
-
-  # The build server wants to do make PRODUCT-dream-sdk
-  # which really means TARGET_PRODUCT=dream make sdk.
-  ifneq ($(filter-out $(INTERNAL_VALID_VARIANTS),$(TARGET_BUILD_VARIANT)),)
-    override MAKECMDGOALS := $(MAKECMDGOALS) $(TARGET_BUILD_VARIANT)
-    TARGET_BUILD_VARIANT := userdebug
-    default_goal_substitution :=
-  else
-    default_goal_substitution := droid
-  endif
-
-  # Replace the PRODUCT-* goal with the build goal that it refers to.
-  # Note that this will ensure that it appears in the same relative
-  # position, in case it matters.
-  override MAKECMDGOALS := $(patsubst $(goal_name),$(default_goal_substitution),$(MAKECMDGOALS))
+  $(error The PRODUCT-* goal is no longer supported. Use `TARGET_PRODUCT=<product> m droid` instead)
 endif
-endif # CALLED_FROM_SETUP
-# else: Use the value set in the environment or buildspec.mk.
-
-# ---------------------------------------------------------------
-# Provide "APP-<appname>" targets, which lets you build
-# an unbundled app.
-#
-ifeq ($(CALLED_FROM_SETUP),true)
 unbundled_goals := $(strip $(filter APP-%,$(MAKECMDGOALS)))
 ifdef unbundled_goals
-  ifneq ($(words $(unbundled_goals)),1)
-    $(error Only one APP-* goal may be specified; saw "$(unbundled_goals)")
-  endif
-  TARGET_BUILD_APPS := $(strip $(subst -, ,$(patsubst APP-%,%,$(unbundled_goals))))
-  ifneq ($(filter droid,$(MAKECMDGOALS)),)
-    override MAKECMDGOALS := $(patsubst $(unbundled_goals),,$(MAKECMDGOALS))
-  else
-    override MAKECMDGOALS := $(patsubst $(unbundled_goals),droid,$(MAKECMDGOALS))
-  endif
+  $(error The APP-* goal is no longer supported. Use `TARGET_BUILD_APPS="<app>" m droid` instead)
 endif # unbundled_goals
 endif
 
-# Now that we've parsed APP-* and PRODUCT-*, mark these as readonly
-TARGET_BUILD_APPS ?=
-.KATI_READONLY := \
-  TARGET_PRODUCT \
-  TARGET_BUILD_VARIANT \
-  TARGET_BUILD_APPS
-
 # Default to building dalvikvm on hosts that support it...
 ifeq ($(HOST_OS),linux)
 # ... or if the if the option is already set
@@ -252,6 +184,18 @@
 all_product_makefiles :=
 all_product_configs :=
 
+# Jacoco agent JARS to be built and installed, if any.
+ifeq ($(EMMA_INSTRUMENT),true)
+  ifneq ($(EMMA_INSTRUMENT_STATIC),true)
+    # For instrumented build, if Jacoco is not being included statically
+    # in instrumented packages then include Jacoco classes into the
+    # bootclasspath.
+    $(foreach product,$(PRODUCTS),\
+      $(eval PRODUCTS.$(product).PRODUCT_PACKAGES += jacocoagent)\
+      $(eval PRODUCTS.$(product).PRODUCT_BOOT_JARS += jacocoagent))
+  endif # EMMA_INSTRUMENT_STATIC
+endif # EMMA_INSTRUMENT
+
 ############################################################################
 # Strip and assign the PRODUCT_ variables.
 $(call strip-product-vars)
@@ -284,6 +228,12 @@
 PRODUCT_AAPT_CONFIG_SP := $(PRODUCT_AAPT_CONFIG)
 PRODUCT_AAPT_CONFIG := $(subst $(space),$(comma),$(PRODUCT_AAPT_CONFIG))
 
+# Extra boot jars must be appended at the end after common boot jars.
+PRODUCT_BOOT_JARS += $(PRODUCT_BOOT_JARS_EXTRA)
+
+# The extra system server jars must be appended at the end after common system server jars.
+PRODUCT_SYSTEM_SERVER_JARS += $(PRODUCT_SYSTEM_SERVER_JARS_EXTRA)
+
 ifndef PRODUCT_SYSTEM_NAME
   PRODUCT_SYSTEM_NAME := $(PRODUCT_NAME)
 endif
@@ -320,8 +270,15 @@
   endif
 endif
 
+$(foreach pair,$(PRODUCT_UPDATABLE_BOOT_JARS), \
+  $(if $(findstring $(call word-colon,2,$(pair)),$(PRODUCT_BOOT_JARS)), \
+    $(error A jar in PRODUCT_UPDATABLE_BOOT_JARS must not be in PRODUCT_BOOT_JARS, \
+      but $(call word-colon,2,$(pair)) is) \
+  ) \
+)
+
 ENFORCE_SYSTEM_CERTIFICATE := $(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT)
-ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)
+ENFORCE_SYSTEM_CERTIFICATE_ALLOW_LIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_ALLOW_LIST)
 
 PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))
 PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))
@@ -384,6 +341,35 @@
   endif
 endif
 
+ifdef PRODUCT_SHIPPING_API_LEVEL
+  ifneq (,$(call math_gt_or_eq,29,$(PRODUCT_SHIPPING_API_LEVEL)))
+    PRODUCT_PACKAGES += $(PRODUCT_PACKAGES_SHIPPING_API_LEVEL_29)
+  endif
+endif
+
+# If build command defines OVERRIDE_PRODUCT_EXTRA_VNDK_VERSIONS,
+# override PRODUCT_EXTRA_VNDK_VERSIONS with it.
+ifdef OVERRIDE_PRODUCT_EXTRA_VNDK_VERSIONS
+  PRODUCT_EXTRA_VNDK_VERSIONS := $(OVERRIDE_PRODUCT_EXTRA_VNDK_VERSIONS)
+endif
+
+$(KATI_obsolete_var OVERRIDE_PRODUCT_EXTRA_VNDK_VERSIONS \
+    ,Use PRODUCT_EXTRA_VNDK_VERSIONS instead)
+
+ifdef OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE
+  ifeq (false,$(OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE))
+    PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE :=
+  else
+    PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE := $(OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE)
+  endif
+else ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
+  # No shipping level defined
+else ifeq ($(call math_gt,$(PRODUCT_SHIPPING_API_LEVEL),29),true)
+  PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE := true
+endif
+
+$(KATI_obsolete_var OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE,Use PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE instead)
+
 define product-overrides-config
 $$(foreach rule,$$(PRODUCT_$(1)_OVERRIDES),\
     $$(if $$(filter 2,$$(words $$(subst :,$$(space),$$(rule)))),,\
@@ -398,7 +384,6 @@
 
 # Macro to use below. $(1) is the name of the partition
 define product-build-image-config
-PRODUCT_BUILD_$(1)_IMAGE := $$(firstword $$(PRODUCT_BUILD_$(1)_IMAGE))
 ifneq ($$(filter-out true false,$$(PRODUCT_BUILD_$(1)_IMAGE)),)
     $$(error Invalid PRODUCT_BUILD_$(1)_IMAGE: $$(PRODUCT_BUILD_$(1)_IMAGE) -- true false and empty are supported)
 endif
@@ -410,11 +395,13 @@
     SYSTEM_OTHER \
     VENDOR \
     PRODUCT \
-    PRODUCT_SERVICES \
+    SYSTEM_EXT \
     ODM \
     CACHE \
     RAMDISK \
-    USERDATA, \
+    USERDATA \
+    BOOT \
+    RECOVERY, \
   $(eval $(call product-build-image-config,$(image))))
 
 product-build-image-config :=
diff --git a/core/proguard_basic_keeps.flags b/core/proguard_basic_keeps.flags
index 3c25e89..28ec2d0 100644
--- a/core/proguard_basic_keeps.flags
+++ b/core/proguard_basic_keeps.flags
@@ -1,6 +1,3 @@
-# To prevent name conflict in incremental obfuscation.
--useuniqueclassmembernames
-
 # Some classes in the libraries extend package private classes to chare common functionality
 # that isn't explicitly part of the API
 -dontskipnonpubliclibraryclasses -dontskipnonpubliclibraryclassmembers
@@ -66,5 +63,16 @@
 # See bug/20658265.
 # -dontwarn android.support.**
 
+# From https://github.com/google/guava/wiki/UsingProGuardWithGuava
+# Striped64, LittleEndianByteArray, UnsignedBytes, AbstractFuture
+-dontwarn sun.misc.Unsafe
+# Futures.getChecked (which often won't work with Proguard anyway) uses this. It
+# has a fallback, but again, don't use Futures.getChecked on Android regardless.
+-dontwarn java.lang.ClassValue
+
 # Less spammy.
 -dontnote
+
+# The lite proto runtime uses reflection to access fields based on the names in
+# the schema, keep all the fields.
+-keepclassmembers class * extends com.google.protobuf.MessageLite { <fields>; }
diff --git a/core/rbe.mk b/core/rbe.mk
index e90500c..91606d4 100644
--- a/core/rbe.mk
+++ b/core/rbe.mk
@@ -69,11 +69,11 @@
   endif
 
   ifdef RBE_R8
-    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8 --exec_strategy=$(r8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=out/soong/host/linux-x86/framework/r8-compat-proguard.jar,build/make/core/proguard_basic_keeps.flags --toolchain_inputs=prebuilts/jdk/jdk9/linux-x86/bin/java)
+    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8 --exec_strategy=$(r8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=out/soong/host/linux-x86/framework/r8-compat-proguard.jar,build/make/core/proguard_basic_keeps.flags --toolchain_inputs=prebuilts/jdk/jdk11/linux-x86/bin/java)
   endif
 
   ifdef RBE_D8
-    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8 --exec_strategy=$(d8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=out/soong/host/linux-x86/framework/d8.jar --toolchain_inputs=prebuilts/jdk/jdk9/linux-x86/bin/java)
+    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8 --exec_strategy=$(d8_exec_strategy) --platform=$(java_r8_d8_platform) --inputs=out/soong/host/linux-x86/framework/d8.jar --toolchain_inputs=prebuilts/jdk/jdk11/linux-x86/bin/java)
   endif
 
   rbe_dir :=
diff --git a/core/rust_device_test_config_template.xml b/core/rust_device_test_config_template.xml
new file mode 100644
index 0000000..9429d38
--- /dev/null
+++ b/core/rust_device_test_config_template.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!-- This test config file is auto-generated. -->
+<configuration description="Config to run {MODULE} device tests.">
+    <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
+        <option name="cleanup" value="true" />
+        <option name="push" value="{MODULE}->/data/local/tmp/{MODULE}" />
+    </target_preparer>
+
+    <test class="com.android.tradefed.testtype.rust.RustBinaryTest" >
+        <option name="test-device-path" value="/data/local/tmp" />
+        <option name="module-name" value="{MODULE}" />
+    </test>
+</configuration>
diff --git a/core/rust_host_test_config_template.xml b/core/rust_host_test_config_template.xml
new file mode 100644
index 0000000..fc23fbe
--- /dev/null
+++ b/core/rust_host_test_config_template.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config to run {MODULE} host tests">
+    <test class="com.android.tradefed.testtype.rust.RustBinaryHostTest" >
+        <option name="test-file" value="{MODULE}" />
+        <option name="test-timeout" value="5m" />
+    </test>
+</configuration>
diff --git a/core/sdk_check.mk b/core/sdk_check.mk
index c09fc7c..09fd0eb 100644
--- a/core/sdk_check.mk
+++ b/core/sdk_check.mk
@@ -6,7 +6,7 @@
 # be set to a particular module class to enable warnings and errors for that
 # subtype.
 
-whitelisted_modules := framework-res__auto_generated_rro
+allowed_modules := framework-res__auto_generated_rro
 
 
 ifeq (,$(JAVA_SDK_ENFORCEMENT_ERROR))
@@ -14,7 +14,7 @@
 endif
 
 ifeq ($(LOCAL_SDK_VERSION)$(LOCAL_PRIVATE_PLATFORM_APIS),)
-  ifeq (,$(filter $(LOCAL_MODULE),$(whitelisted_modules)))
+  ifeq (,$(filter $(LOCAL_MODULE),$(allowed_modules)))
     ifneq ($(JAVA_SDK_ENFORCEMENT_WARNING)$(JAVA_SDK_ENFORCEMENT_ERROR),)
       my_message := Must specify LOCAL_SDK_VERSION or LOCAL_PRIVATE_PLATFORM_APIS,
       ifeq ($(LOCAL_MODULE_CLASS),$(JAVA_SDK_ENFORCEMENT_ERROR))
diff --git a/core/sdk_font.mk b/core/sdk_font.mk
index 0259a9c..1742925 100644
--- a/core/sdk_font.mk
+++ b/core/sdk_font.mk
@@ -19,9 +19,9 @@
 
 # The font configuration files - system_fonts.xml, fallback_fonts.xml etc.
 sdk_font_config := $(sort $(wildcard frameworks/base/data/fonts/*.xml))
-sdk_font_config :=  $(addprefix $(SDK_FONT_TEMP)/, $(notdir $(sdk_font_config)))
+sdk_font_config :=  $(addprefix $(SDK_FONT_TEMP)/standard/, $(notdir $(sdk_font_config)))
 
-$(sdk_font_config): $(SDK_FONT_TEMP)/%.xml: \
+$(sdk_font_config): $(SDK_FONT_TEMP)/standard/%.xml: \
 			frameworks/base/data/fonts/%.xml
 	$(hide) mkdir -p $(dir $@)
 	$(hide) cp -vf $< $@
diff --git a/core/shared_library.mk b/core/shared_library.mk
index 2832c17..29d8276 100644
--- a/core/shared_library.mk
+++ b/core/shared_library.mk
@@ -1,4 +1,7 @@
 $(call record-module-type,SHARED_LIBRARY)
+ifdef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,BUILD_SHARED_LIBRARY is incompatible with LOCAL_IS_HOST_MODULE. Use BUILD_HOST_SHARED_LIBRARY instead.)
+endif
 my_prefix := TARGET_
 include $(BUILD_SYSTEM)/multilib.mk
 
@@ -53,4 +56,9 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(if $(filter true,$(BUILD_BROKEN_USES_BUILD_COPY_HEADERS)),\
+  $(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers),\
+  $(call pretty-error,LOCAL_COPY_HEADERS is obsolete. See $(CHANGES_URL)#copy_headers))
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/shared_library_internal.mk b/core/shared_library_internal.mk
index 858884a..219772a 100644
--- a/core/shared_library_internal.mk
+++ b/core/shared_library_internal.mk
@@ -39,11 +39,6 @@
 else
 my_target_libcrt_builtins := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LIBCRT_BUILTINS)
 endif
-ifeq ($(LOCAL_NO_LIBGCC),true)
-my_target_libgcc :=
-else
-my_target_libgcc := $(call intermediates-dir-for,STATIC_LIBRARIES,libgcc,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libgcc.a
-endif
 my_target_libatomic := $(call intermediates-dir-for,STATIC_LIBRARIES,libatomic,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libatomic.a
 ifeq ($(LOCAL_NO_CRT),true)
 my_target_crtbegin_so_o :=
@@ -60,7 +55,6 @@
 my_target_crtend_so_o := $(wildcard $(my_ndk_sysroot_lib)/crtend_so.o)
 endif
 $(linked_module): PRIVATE_TARGET_LIBCRT_BUILTINS := $(my_target_libcrt_builtins)
-$(linked_module): PRIVATE_TARGET_LIBGCC := $(my_target_libgcc)
 $(linked_module): PRIVATE_TARGET_LIBATOMIC := $(my_target_libatomic)
 $(linked_module): PRIVATE_TARGET_CRTBEGIN_SO_O := $(my_target_crtbegin_so_o)
 $(linked_module): PRIVATE_TARGET_CRTEND_SO_O := $(my_target_crtend_so_o)
@@ -71,9 +65,8 @@
         $(my_target_crtbegin_so_o) \
         $(my_target_crtend_so_o) \
         $(my_target_libcrt_builtins) \
-        $(my_target_libgcc) \
         $(my_target_libatomic) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES)
+        $(LOCAL_ADDITIONAL_DEPENDENCIES) $(CLANG_CXX)
 	$(transform-o-to-shared-lib)
 
 ifeq ($(my_native_coverage),true)
diff --git a/core/shell_test_config_template.xml b/core/shell_test_config_template.xml
new file mode 100644
index 0000000..5e1c8ee
--- /dev/null
+++ b/core/shell_test_config_template.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2020 The Android Open Source Project
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+<!-- This test config file is auto-generated. -->
+<configuration description="Config for running {MODULE} through Atest or in Infra">
+    <option name="test-suite-tag" value="{MODULE}" />
+
+    {EXTRA_CONFIGS}
+
+    <!-- This test requires a device, so it's not annotated with a null-device. -->
+    <test class="com.android.tradefed.testtype.binary.ExecutableHostTest" >
+        <option name="binary" value="{OUTPUT_FILENAME}" />
+        <!-- Test script assumes a relative path with the tests/ folders. -->
+        <option name="relative-path-execution" value="true" />
+        <!-- Tests shouldn't be that long but set 15m to be safe. -->
+        <option name="per-binary-timeout" value="15m" />
+    </test>
+</configuration>
\ No newline at end of file
diff --git a/core/soong_android_app_set.mk b/core/soong_android_app_set.mk
index c783b42..c93bb3f 100644
--- a/core/soong_android_app_set.mk
+++ b/core/soong_android_app_set.mk
@@ -24,8 +24,10 @@
 endef
 
 $(eval $(call extract-master-from-apk-set,$(LOCAL_PREBUILT_MODULE_FILE),$(LOCAL_APK_SET_MASTER_FILE)))
-LOCAL_POST_INSTALL_CMD := unzip -qo -j -d $(dir $(LOCAL_INSTALLED_MODULE)) \
-	$(LOCAL_PREBUILT_MODULE_FILE) -x $(LOCAL_APK_SET_MASTER_FILE)
+# unzip returns 11 it there was nothing to extract, which is expected,
+# $(LOCAL_APK_SET_MASTER_FILE) has is already there.
+LOCAL_POST_INSTALL_CMD := unzip -qoDD -j -d $(dir $(LOCAL_INSTALLED_MODULE)) \
+	$(LOCAL_PREBUILT_MODULE_FILE) -x $(LOCAL_APK_SET_MASTER_FILE) || [[ $$? -eq 11 ]]
 $(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD := $(LOCAL_POST_INSTALL_CMD)
 PACKAGES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 
diff --git a/core/soong_app_prebuilt.mk b/core/soong_app_prebuilt.mk
index 8d92b20..4616ad0 100644
--- a/core/soong_app_prebuilt.mk
+++ b/core/soong_app_prebuilt.mk
@@ -11,6 +11,7 @@
 # LOCAL_SOONG_RRO_DIRS
 # LOCAL_SOONG_JNI_LIBS_$(TARGET_ARCH)
 # LOCAL_SOONG_JNI_LIBS_$(TARGET_2ND_ARCH)
+# LOCAL_SOONG_JNI_LIBS_SYMBOLS
 
 ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
   $(call pretty-error,soong_app_prebuilt.mk may only be used from Soong)
@@ -41,9 +42,13 @@
       $(eval $(call copy-one-file,$(full_classes_jar),$(full_classes_header_jar)))
     endif
   endif # TURBINE_ENABLED != false
+
+  javac-check : $(full_classes_jar)
+  javac-check-$(LOCAL_MODULE) : $(full_classes_jar)
+  .PHONY: javac-check-$(LOCAL_MODULE)
 endif
 
-# Run veridex on product, product_services and vendor modules.
+# Run veridex on product, system_ext and vendor modules.
 # We skip it for unbundled app builds where we cannot build veridex.
 module_run_appcompat :=
 ifeq (true,$(non_system_module))
@@ -60,7 +65,7 @@
   $(LOCAL_BUILT_MODULE): $(LOCAL_PREBUILT_MODULE_FILE)
 	@echo "Copy: $@"
 	$(copy-file-to-target)
-	$(call appcompat-header, aapt2)
+	$(appcompat-header)
 	$(run-appcompat)
 else
   $(eval $(call copy-one-file,$(LOCAL_PREBUILT_MODULE_FILE),$(LOCAL_BUILT_MODULE)))
@@ -97,10 +102,6 @@
 java-dex: $(LOCAL_SOONG_DEX_JAR)
 
 
-ifneq ($(BUILD_PLATFORM_ZIP),)
-  $(eval $(call copy-one-file,$(LOCAL_SOONG_DEX_JAR),$(dir $(LOCAL_BUILT_MODULE))package.dex.apk))
-endif
-
 my_built_installed := $(foreach f,$(LOCAL_SOONG_BUILT_INSTALLED),\
   $(call word-colon,1,$(f)):$(PRODUCT_OUT)$(call word-colon,2,$(f)))
 my_installed := $(call copy-many-files, $(my_built_installed))
@@ -108,6 +109,21 @@
 ALL_MODULES.$(my_register_name).BUILT_INSTALLED += $(my_built_installed)
 $(my_all_targets): $(my_installed)
 
+# Copy test suite files.
+ifdef LOCAL_COMPATIBILITY_SUITE
+my_apks_to_install := $(foreach f,$(filter %.apk %.idsig,$(LOCAL_SOONG_BUILT_INSTALLED)),$(call word-colon,1,$(f)))
+$(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
+  $(eval my_compat_dist_$(suite) := $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
+    $(foreach a,$(my_apks_to_install),\
+      $(call compat-copy-pair,$(a),$(dir)/$(notdir $(a)))))))
+$(call create-suite-dependencies)
+endif
+
+# install symbol files of JNI libraries
+my_jni_lib_symbols_copy_files := $(foreach f,$(LOCAL_SOONG_JNI_LIBS_SYMBOLS),\
+  $(call word-colon,1,$(f)):$(patsubst $(PRODUCT_OUT)/%,$(TARGET_OUT_UNSTRIPPED)/%,$(call word-colon,2,$(f))))
+$(LOCAL_BUILT_MODULE): $(call copy-many-files, $(my_jni_lib_symbols_copy_files))
+
 # embedded JNI will already have been handled by soong
 my_embed_jni :=
 my_prebuilt_jni_libs :=
@@ -129,17 +145,41 @@
 my_2nd_arch_prefix :=
 
 PACKAGES := $(PACKAGES) $(LOCAL_MODULE)
-ifdef LOCAL_CERTIFICATE
+ifndef LOCAL_CERTIFICATE
+  $(call pretty-error,LOCAL_CERTIFICATE must be set for soong_app_prebuilt.mk)
+endif
+ifeq ($(LOCAL_CERTIFICATE),PRESIGNED)
+  # The magic string "PRESIGNED" means this package is already checked
+  # signed with its release key.
+  #
+  # By setting .CERTIFICATE but not .PRIVATE_KEY, this package will be
+  # mentioned in apkcerts.txt (with certificate set to "PRESIGNED")
+  # but the dexpreopt process will not try to re-sign the app.
+  PACKAGES.$(LOCAL_MODULE).CERTIFICATE := PRESIGNED
+else ifneq ($(LOCAL_CERTIFICATE),)
   PACKAGES.$(LOCAL_MODULE).CERTIFICATE := $(LOCAL_CERTIFICATE)
   PACKAGES.$(LOCAL_MODULE).PRIVATE_KEY := $(patsubst %.x509.pem,%.pk8,$(LOCAL_CERTIFICATE))
 endif
 include $(BUILD_SYSTEM)/app_certificate_validate.mk
 PACKAGES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 
+ifneq ($(LOCAL_MODULE_STEM),)
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
+else
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
+endif
+
+# Set a actual_partition_tag (calculated in base_rules.mk) for the package.
+PACKAGES.$(LOCAL_MODULE).PARTITION := $(actual_partition_tag)
+
 ifdef LOCAL_SOONG_BUNDLE
   ALL_MODULES.$(LOCAL_MODULE).BUNDLE := $(LOCAL_SOONG_BUNDLE)
 endif
 
+ifdef LOCAL_SOONG_LINT_REPORTS
+  ALL_MODULES.$(my_register_name).LINT_REPORTS := $(LOCAL_SOONG_LINT_REPORTS)
+endif
+
 ifndef LOCAL_IS_HOST_MODULE
 ifeq ($(LOCAL_SDK_VERSION),system_current)
 my_link_type := java:system
@@ -181,4 +221,11 @@
   )
 endif
 
-SOONG_ALREADY_CONV := $(SOONG_ALREADY_CONV) $(LOCAL_MODULE)
+ifdef LOCAL_PREBUILT_COVERAGE_ARCHIVE
+  my_coverage_dir := $(TARGET_OUT_COVERAGE)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
+  my_coverage_copy_pairs := $(foreach f,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(f):$(my_coverage_dir)/$(notdir  $(f)))
+  my_coverage_files := $(call copy-many-files,$(my_coverage_copy_pairs))
+  $(LOCAL_INSTALLED_MODULE): $(my_coverage_files)
+endif
+
+SOONG_ALREADY_CONV += $(LOCAL_MODULE)
diff --git a/core/soong_cc_prebuilt.mk b/core/soong_cc_prebuilt.mk
index 2e7d477..51549bd 100644
--- a/core/soong_cc_prebuilt.mk
+++ b/core/soong_cc_prebuilt.mk
@@ -3,6 +3,7 @@
 # LOCAL_SOONG_LINK_TYPE
 # LOCAL_SOONG_TOC
 # LOCAL_SOONG_UNSTRIPPED_BINARY
+# LOCAL_SOONG_VNDK_VERSION : means the version of VNDK where this module belongs
 
 ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
   $(call pretty-error,soong_cc_prebuilt.mk may only be used from Soong)
@@ -30,20 +31,6 @@
   $(call pretty-error,Unsupported LOCAL_MODULE_$(my_prefix)ARCH=$(LOCAL_MODULE_$(my_prefix)ARCH))
 endif
 
-skip_module :=
-ifeq ($(TARGET_TRANSLATE_2ND_ARCH),true)
-  ifndef LOCAL_IS_HOST_MODULE
-    ifdef LOCAL_2ND_ARCH_VAR_PREFIX
-      # Only support shared and static libraries and tests for translated arch
-      ifeq ($(filter SHARED_LIBRARIES STATIC_LIBRARIES HEADER_LIBRARIES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
-        skip_module := true
-      endif
-    endif
-  endif
-endif
-
-ifndef skip_module
-
 # Don't install static libraries by default.
 ifndef LOCAL_UNINSTALLABLE_MODULE
   ifeq (STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS))
@@ -51,22 +38,22 @@
   endif
 endif
 
+# Don't install modules of current VNDK when it is told so
+ifeq ($(TARGET_SKIP_CURRENT_VNDK),true)
+  ifeq ($(LOCAL_SOONG_VNDK_VERSION),$(PLATFORM_VNDK_VERSION))
+    LOCAL_UNINSTALLABLE_MODULE := true
+  endif
+endif
+
 #######################################
 include $(BUILD_SYSTEM)/base_rules.mk
 #######################################
 
 ifneq ($(filter STATIC_LIBRARIES SHARED_LIBRARIES HEADER_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
   # Soong module is a static or shared library
-  export_includes := $(intermediates)/export_includes
-  $(export_includes): PRIVATE_EXPORT_CFLAGS := $(LOCAL_EXPORT_CFLAGS)
-  $(export_includes): $(LOCAL_EXPORT_C_INCLUDE_DEPS)
-	@echo Export includes file: $< -- $@
-	$(hide) mkdir -p $(dir $@) && rm -f $@
-  ifdef LOCAL_EXPORT_CFLAGS
-	$(hide) echo "$(PRIVATE_EXPORT_CFLAGS)" >$@
-  else
-	$(hide) touch $@
-  endif
+  EXPORTS_LIST += $(intermediates)
+  EXPORTS.$(intermediates).FLAGS := $(LOCAL_EXPORT_CFLAGS)
+  EXPORTS.$(intermediates).DEPS := $(LOCAL_EXPORT_C_INCLUDE_DEPS)
 
   ifdef LOCAL_SOONG_TOC
     $(eval $(call copy-one-file,$(LOCAL_SOONG_TOC),$(LOCAL_BUILT_MODULE).toc))
@@ -74,7 +61,7 @@
     $(my_all_targets): $(LOCAL_BUILT_MODULE).toc
   endif
 
-  SOONG_ALREADY_CONV := $(SOONG_ALREADY_CONV) $(LOCAL_MODULE)
+  SOONG_ALREADY_CONV += $(LOCAL_MODULE)
 
   my_link_type := $(LOCAL_SOONG_LINK_TYPE)
   my_warn_types :=
@@ -88,17 +75,24 @@
 ifdef LOCAL_USE_VNDK
   ifneq ($(LOCAL_VNDK_DEPEND_ON_CORE_VARIANT),true)
     name_without_suffix := $(patsubst %.vendor,%,$(LOCAL_MODULE))
-    ifneq ($(name_without_suffix),$(LOCAL_MODULE)
+    ifneq ($(name_without_suffix),$(LOCAL_MODULE))
       SPLIT_VENDOR.$(LOCAL_MODULE_CLASS).$(name_without_suffix) := 1
+    else
+      name_without_suffix := $(patsubst %.product,%,$(LOCAL_MODULE))
+      ifneq ($(name_without_suffix),$(LOCAL_MODULE))
+        SPLIT_PRODUCT.$(LOCAL_MODULE_CLASS).$(name_without_suffix) := 1
+      endif
     endif
     name_without_suffix :=
   endif
 endif
 
 # Check prebuilt ELF binaries.
-ifneq ($(LOCAL_CHECK_ELF_FILES),)
-my_prebuilt_src_file := $(LOCAL_PREBUILT_MODULE_FILE)
-include $(BUILD_SYSTEM)/check_elf_file.mk
+ifdef LOCAL_INSTALLED_MODULE
+  ifneq ($(LOCAL_CHECK_ELF_FILES),)
+    my_prebuilt_src_file := $(LOCAL_PREBUILT_MODULE_FILE)
+    include $(BUILD_SYSTEM)/check_elf_file.mk
+  endif
 endif
 
 # The real dependency will be added after all Android.mks are loaded and the install paths
@@ -115,39 +109,43 @@
   endif
 endif
 
-ifeq ($(LOCAL_VNDK_DEPEND_ON_CORE_VARIANT),true)
-  # Add $(LOCAL_BUILT_MODULE) as a dependency to no_vendor_variant_vndk_check so
-  # that the vendor variant will be built and checked against the core variant.
-  no_vendor_variant_vndk_check: $(LOCAL_BUILT_MODULE)
+my_check_same_vndk_variants :=
+ifeq ($(LOCAL_CHECK_SAME_VNDK_VARIANTS),true)
+  ifeq ($(filter hwaddress address, $(SANITIZE_TARGET)),)
+    my_check_same_vndk_variants := true
+  endif
+endif
 
-  my_core_register_name := $(subst .vendor,,$(my_register_name))
+ifeq ($(my_check_same_vndk_variants),true)
+  same_vndk_variants_stamp := $(intermediates)/same_vndk_variants.timestamp
+
+  my_core_register_name := $(subst .vendor,,$(subst .product,,$(my_register_name)))
   my_core_variant_files := $(call module-target-built-files,$(my_core_register_name))
   my_core_shared_lib := $(sort $(filter %.so,$(my_core_variant_files)))
-  $(LOCAL_BUILT_MODULE): PRIVATE_CORE_VARIANT := $(my_core_shared_lib)
 
-  # The built vendor variant library needs to depend on the built core variant
-  # so that we can perform identity check against the core variant.
-  $(LOCAL_BUILT_MODULE): $(my_core_shared_lib)
+  $(same_vndk_variants_stamp): PRIVATE_CORE_VARIANT := $(my_core_shared_lib)
+  $(same_vndk_variants_stamp): PRIVATE_VENDOR_VARIANT := $(LOCAL_PREBUILT_MODULE_FILE)
+  $(same_vndk_variants_stamp): PRIVATE_TOOLS_PREFIX := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)TOOLS_PREFIX)
+
+  $(same_vndk_variants_stamp): $(my_core_shared_lib) $(LOCAL_PREBUILT_MODULE_FILE)
+	$(call verify-vndk-libs-identical,\
+	    $(PRIVATE_CORE_VARIANT),\
+	    $(PRIVATE_VENDOR_VARIANT),\
+	    $(PRIVATE_TOOLS_PREFIX))
+	touch $@
+
+  $(LOCAL_BUILT_MODULE): $(same_vndk_variants_stamp)
 endif
 
-ifeq ($(LOCAL_VNDK_DEPEND_ON_CORE_VARIANT),true)
-$(LOCAL_BUILT_MODULE): $(LOCAL_PREBUILT_MODULE_FILE) $(LIBRARY_IDENTITY_CHECK_SCRIPT)
-	$(call verify-vndk-libs-identical,\
-		$(PRIVATE_CORE_VARIANT),\
-		$<,\
-		$($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)TOOLS_PREFIX))
-	$(copy-file-to-target)
-else
 $(LOCAL_BUILT_MODULE): $(LOCAL_PREBUILT_MODULE_FILE)
 	$(transform-prebuilt-to-target)
-endif
 ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
 	$(hide) chmod +x $@
 endif
 
 ifndef LOCAL_IS_HOST_MODULE
   ifdef LOCAL_SOONG_UNSTRIPPED_BINARY
-    ifneq ($(LOCAL_VNDK_DEPEND_ON_CORE_VARIANT),true)
+    ifneq ($(LOCAL_UNINSTALLABLE_MODULE),true)
       my_symbol_path := $(if $(LOCAL_SOONG_SYMBOL_PATH),$(LOCAL_SOONG_SYMBOL_PATH),$(my_module_path))
       # Store a copy with symbols for symbolic debugging
       my_unstripped_path := $(TARGET_OUT_UNSTRIPPED)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_symbol_path))
@@ -220,7 +218,9 @@
 #
 # Filter out some NDK libraries that are not being exported.
 my_static_libraries := \
-    $(filter-out ndk_libc++_static ndk_libc++abi ndk_libandroid_support ndk_libunwind, \
+    $(filter-out ndk_libc++_static ndk_libc++abi ndk_libandroid_support ndk_libunwind \
+      ndk_libc++_static.native_bridge ndk_libc++abi.native_bridge \
+      ndk_libandroid_support.native_bridge ndk_libunwind.native_bridge, \
       $(LOCAL_STATIC_LIBRARIES))
 installed_static_library_notice_file_targets := \
     $(foreach lib,$(my_static_libraries) $(LOCAL_WHOLE_STATIC_LIBRARIES), \
@@ -229,6 +229,8 @@
 $(notice_target): | $(installed_static_library_notice_file_targets)
 $(LOCAL_INSTALLED_MODULE): | $(notice_target)
 
-endif # !skip_module
-
-skip_module :=
+# Reinstall shared library dependencies of fuzz targets to /data/fuzz/ (for
+# target) or /data/ (for host).
+ifdef LOCAL_IS_FUZZ_TARGET
+$(LOCAL_INSTALLED_MODULE): $(LOCAL_FUZZ_INSTALLED_SHARED_DEPS)
+endif
diff --git a/core/soong_config.mk b/core/soong_config.mk
index cdad2f2..51b7e38 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -25,14 +25,13 @@
 $(call add_json_str,  Make_suffix, -$(TARGET_PRODUCT))
 
 $(call add_json_str,  BuildId,                           $(BUILD_ID))
-$(call add_json_str,  BuildNumberFromFile,               $$$(BUILD_NUMBER_FROM_FILE))
+$(call add_json_str,  BuildNumberFile,                   build_number.txt)
 
 $(call add_json_str,  Platform_version_name,             $(PLATFORM_VERSION))
 $(call add_json_val,  Platform_sdk_version,              $(PLATFORM_SDK_VERSION))
 $(call add_json_str,  Platform_sdk_codename,             $(PLATFORM_VERSION_CODENAME))
 $(call add_json_bool, Platform_sdk_final,                $(filter REL,$(PLATFORM_VERSION_CODENAME)))
 $(call add_json_csv,  Platform_version_active_codenames, $(PLATFORM_VERSION_ALL_CODENAMES))
-$(call add_json_csv,  Platform_version_future_codenames, $(PLATFORM_VERSION_FUTURE_CODENAMES))
 $(call add_json_str,  Platform_security_patch,           $(PLATFORM_SECURITY_PATCH))
 $(call add_json_str,  Platform_preview_sdk_version,      $(PLATFORM_PREVIEW_SDK_VERSION))
 $(call add_json_str,  Platform_base_os,                  $(PLATFORM_BASE_OS))
@@ -58,6 +57,18 @@
 $(call add_json_str,  DeviceSecondaryCpuVariant,         $(TARGET_2ND_CPU_VARIANT))
 $(call add_json_list, DeviceSecondaryAbi,                $(TARGET_2ND_CPU_ABI) $(TARGET_2ND_CPU_ABI2))
 
+$(call add_json_str,  NativeBridgeArch,                  $(TARGET_NATIVE_BRIDGE_ARCH))
+$(call add_json_str,  NativeBridgeArchVariant,           $(TARGET_NATIVE_BRIDGE_ARCH_VARIANT))
+$(call add_json_str,  NativeBridgeCpuVariant,            $(TARGET_NATIVE_BRIDGE_CPU_VARIANT))
+$(call add_json_list, NativeBridgeAbi,                   $(TARGET_NATIVE_BRIDGE_ABI))
+$(call add_json_str,  NativeBridgeRelativePath,          $(TARGET_NATIVE_BRIDGE_RELATIVE_PATH))
+
+$(call add_json_str,  NativeBridgeSecondaryArch,         $(TARGET_NATIVE_BRIDGE_2ND_ARCH))
+$(call add_json_str,  NativeBridgeSecondaryArchVariant,  $(TARGET_NATIVE_BRIDGE_2ND_ARCH_VARIANT))
+$(call add_json_str,  NativeBridgeSecondaryCpuVariant,   $(TARGET_NATIVE_BRIDGE_2ND_CPU_VARIANT))
+$(call add_json_list, NativeBridgeSecondaryAbi,          $(TARGET_NATIVE_BRIDGE_2ND_ABI))
+$(call add_json_str,  NativeBridgeSecondaryRelativePath, $(TARGET_NATIVE_BRIDGE_2ND_RELATIVE_PATH))
+
 $(call add_json_str,  HostArch,                          $(HOST_ARCH))
 $(call add_json_str,  HostSecondaryArch,                 $(HOST_2ND_ARCH))
 $(call add_json_bool, HostStaticBinaries,                $(BUILD_HOST_static))
@@ -69,6 +80,7 @@
 $(call add_json_list, DeviceResourceOverlays,            $(DEVICE_PACKAGE_OVERLAYS))
 $(call add_json_list, ProductResourceOverlays,           $(PRODUCT_PACKAGE_OVERLAYS))
 $(call add_json_list, EnforceRROTargets,                 $(PRODUCT_ENFORCE_RRO_TARGETS))
+$(call add_json_list, EnforceRROExemptedTargets,         $(PRODUCT_ENFORCE_RRO_EXEMPTED_TARGETS))
 $(call add_json_list, EnforceRROExcludedOverlays,        $(PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS))
 
 $(call add_json_str,  AAPTCharacteristics,               $(TARGET_AAPT_CHARACTERISTICS))
@@ -89,18 +101,28 @@
 $(call add_json_bool, EnableCFI,                         $(call invert_bool,$(filter false,$(ENABLE_CFI))))
 $(call add_json_list, CFIExcludePaths,                   $(CFI_EXCLUDE_PATHS) $(PRODUCT_CFI_EXCLUDE_PATHS))
 $(call add_json_list, CFIIncludePaths,                   $(CFI_INCLUDE_PATHS) $(PRODUCT_CFI_INCLUDE_PATHS))
-$(call add_json_bool, EnableXOM,                         $(call invert_bool,$(filter false,$(ENABLE_XOM))))
-$(call add_json_list, XOMExcludePaths,                   $(XOM_EXCLUDE_PATHS) $(PRODUCT_XOM_EXCLUDE_PATHS))
 $(call add_json_list, IntegerOverflowExcludePaths,       $(INTEGER_OVERFLOW_EXCLUDE_PATHS) $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
 
+$(call add_json_bool, Experimental_mte,                  $(filter true,$(TARGET_EXPERIMENTAL_MTE)))
+
 $(call add_json_bool, DisableScudo,                      $(filter true,$(PRODUCT_DISABLE_SCUDO)))
 
 $(call add_json_bool, ClangTidy,                         $(filter 1 true,$(WITH_TIDY)))
 $(call add_json_str,  TidyChecks,                        $(WITH_TIDY_CHECKS))
 
-$(call add_json_bool, NativeCoverage,                    $(filter true,$(NATIVE_COVERAGE)))
-$(call add_json_list, CoveragePaths,                     $(COVERAGE_PATHS))
-$(call add_json_list, CoverageExcludePaths,              $(COVERAGE_EXCLUDE_PATHS))
+$(call add_json_list, JavaCoveragePaths,                 $(JAVA_COVERAGE_PATHS))
+$(call add_json_list, JavaCoverageExcludePaths,          $(JAVA_COVERAGE_EXCLUDE_PATHS))
+
+$(call add_json_bool, GcovCoverage,                      $(filter true,$(NATIVE_COVERAGE)))
+$(call add_json_bool, ClangCoverage,                     $(filter true,$(CLANG_COVERAGE)))
+# TODO(b/158212027): Remove `$(COVERAGE_PATHS)` from this list when all users have been moved to
+# `NATIVE_COVERAGE_PATHS`.
+$(call add_json_list, NativeCoveragePaths,               $(COVERAGE_PATHS) $(NATIVE_COVERAGE_PATHS))
+# TODO(b/158212027): Remove `$(COVERAGE_EXCLUDE_PATHS)` from this list when all users have been
+# moved to `NATIVE_COVERAGE_EXCLUDE_PATHS`.
+$(call add_json_list, NativeCoverageExcludePaths,        $(COVERAGE_EXCLUDE_PATHS) $(NATIVE_COVERAGE_EXCLUDE_PATHS))
+
+$(call add_json_bool, SamplingPGO,                       $(filter true,$(SAMPLING_PGO)))
 
 $(call add_json_bool, ArtUseReadBarrier,                 $(call invert_bool,$(filter false,$(PRODUCT_ART_USE_READ_BARRIER))))
 $(call add_json_bool, Binder32bit,                       $(BINDER32BIT))
@@ -110,7 +132,9 @@
 $(call add_json_bool, DevicePrefer32BitExecutables,      $(filter true,$(TARGET_PREFER_32_BIT_EXECUTABLES)))
 $(call add_json_str,  DeviceVndkVersion,                 $(BOARD_VNDK_VERSION))
 $(call add_json_str,  Platform_vndk_version,             $(PLATFORM_VNDK_VERSION))
+$(call add_json_str,  ProductVndkVersion,                $(PRODUCT_PRODUCT_VNDK_VERSION))
 $(call add_json_list, ExtraVndkVersions,                 $(PRODUCT_EXTRA_VNDK_VERSIONS))
+$(call add_json_bool, BoardVndkRuntimeDisable,           $(BOARD_VNDK_RUNTIME_DISABLE))
 $(call add_json_list, DeviceSystemSdkVersions,           $(BOARD_SYSTEMSDK_VERSIONS))
 $(call add_json_list, Platform_systemsdk_versions,       $(PLATFORM_SYSTEMSDK_VERSIONS))
 $(call add_json_bool, Malloc_not_svelte,                 $(call invert_bool,$(filter true,$(MALLOC_SVELTE))))
@@ -120,10 +144,10 @@
 $(call add_json_list, ModulesLoadedByPrivilegedModules,  $(PRODUCT_LOADED_BY_PRIVILEGED_MODULES))
 
 $(call add_json_list, BootJars,                          $(PRODUCT_BOOT_JARS))
+$(call add_json_list, UpdatableBootJars,                 $(PRODUCT_UPDATABLE_BOOT_JARS))
 
 $(call add_json_bool, VndkUseCoreVariant,                $(TARGET_VNDK_USE_CORE_VARIANT))
-
-$(call add_json_bool, Product_is_iot,                    $(filter true,$(PRODUCT_IOT)))
+$(call add_json_bool, VndkSnapshotBuildArtifacts,        $(VNDK_SNAPSHOT_BUILD_ARTIFACTS))
 
 $(call add_json_bool, Treble_linker_namespaces,          $(filter true,$(PRODUCT_TREBLE_LINKER_NAMESPACES)))
 $(call add_json_bool, Enforce_vintf_manifest,            $(filter true,$(PRODUCT_ENFORCE_VINTF_MANIFEST)))
@@ -135,7 +159,7 @@
 $(call add_json_str,  VendorPath,                        $(TARGET_COPY_OUT_VENDOR))
 $(call add_json_str,  OdmPath,                           $(TARGET_COPY_OUT_ODM))
 $(call add_json_str,  ProductPath,                       $(TARGET_COPY_OUT_PRODUCT))
-$(call add_json_str,  ProductServicesPath,               $(TARGET_COPY_OUT_PRODUCT_SERVICES))
+$(call add_json_str,  SystemExtPath,                     $(TARGET_COPY_OUT_SYSTEM_EXT))
 $(call add_json_bool, MinimizeJavaDebugInfo,             $(filter true,$(PRODUCT_MINIMIZE_JAVA_DEBUG_INFO)))
 
 $(call add_json_bool, UseGoma,                           $(filter-out false,$(USE_GOMA)))
@@ -149,12 +173,13 @@
 
 $(call add_json_list, PgoAdditionalProfileDirs,          $(PGO_ADDITIONAL_PROFILE_DIRS))
 
-$(call add_json_list, BoardVendorSepolicyDirs,           $(BOARD_SEPOLICY_DIRS))
+$(call add_json_list, BoardVendorSepolicyDirs,           $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_SEPOLICY_DIRS))
 $(call add_json_list, BoardOdmSepolicyDirs,              $(BOARD_ODM_SEPOLICY_DIRS))
 $(call add_json_list, BoardPlatPublicSepolicyDirs,       $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
 $(call add_json_list, BoardPlatPrivateSepolicyDirs,      $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
+$(call add_json_list, BoardSepolicyM4Defs,               $(BOARD_SEPOLICY_M4DEFS))
 
-$(call add_json_bool, FlattenApex,                       $(filter true,$(TARGET_FLATTEN_APEX)))
+$(call add_json_bool, Flatten_apex,                      $(filter true,$(TARGET_FLATTEN_APEX)))
 
 $(call add_json_str,  DexpreoptGlobalConfig,             $(DEX_PREOPT_CONFIG))
 
@@ -163,14 +188,20 @@
 $(call add_json_list, CertificateOverrides,              $(PRODUCT_CERTIFICATE_OVERRIDES))
 
 $(call add_json_bool, EnforceSystemCertificate,          $(ENFORCE_SYSTEM_CERTIFICATE))
-$(call add_json_list, EnforceSystemCertificateWhitelist, $(ENFORCE_SYSTEM_CERTIFICATE_WHITELIST))
+$(call add_json_list, EnforceSystemCertificateAllowList, $(ENFORCE_SYSTEM_CERTIFICATE_ALLOW_LIST))
 
 $(call add_json_list, ProductHiddenAPIStubs,             $(PRODUCT_HIDDENAPI_STUBS))
 $(call add_json_list, ProductHiddenAPIStubsSystem,       $(PRODUCT_HIDDENAPI_STUBS_SYSTEM))
 $(call add_json_list, ProductHiddenAPIStubsTest,         $(PRODUCT_HIDDENAPI_STUBS_TEST))
 
+$(call add_json_list, ProductPublicSepolicyDirs,         $(PRODUCT_PUBLIC_SEPOLICY_DIRS))
+$(call add_json_list, ProductPrivateSepolicyDirs,        $(PRODUCT_PRIVATE_SEPOLICY_DIRS))
+$(call add_json_bool, ProductCompatibleProperty,         $(PRODUCT_COMPATIBLE_PROPERTY))
+
 $(call add_json_list, TargetFSConfigGen,                 $(TARGET_FS_CONFIG_GEN))
 
+$(call add_json_list, MissingUsesLibraries,              $(INTERNAL_PLATFORM_MISSING_USES_LIBRARIES))
+
 $(call add_json_map, VendorVars)
 $(foreach namespace,$(SOONG_CONFIG_NAMESPACES),\
   $(call add_json_map, $(namespace))\
@@ -179,6 +210,12 @@
   $(call end_json_map))
 $(call end_json_map)
 
+$(call add_json_bool, EnforceProductPartitionInterface,  $(PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE))
+
+$(call add_json_bool, InstallExtraFlattenedApexes, $(PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES))
+
+$(call add_json_bool, BoardUsesRecoveryAsBoot, $(BOARD_USES_RECOVERY_AS_BOOT))
+
 $(call json_end)
 
 $(file >$(SOONG_VARIABLES).tmp,$(json_contents))
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
index 9692a99..bfde944 100644
--- a/core/soong_java_prebuilt.mk
+++ b/core/soong_java_prebuilt.mk
@@ -51,6 +51,13 @@
     $(intermediates.COMMON)/jacoco-report-classes.jar)
 endif
 
+ifdef LOCAL_SOONG_PROGUARD_DICT
+  $(eval $(call copy-one-file,$(LOCAL_SOONG_PROGUARD_DICT),\
+    $(intermediates.COMMON)/proguard_dictionary))
+  $(call add-dependency,$(LOCAL_BUILT_MODULE),\
+    $(intermediates.COMMON)/proguard_dictionary)
+endif
+
 ifdef LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE
   my_res_package := $(intermediates.COMMON)/package-res.apk
 
@@ -121,6 +128,7 @@
 my_installed := $(call copy-many-files, $(my_built_installed))
 ALL_MODULES.$(my_register_name).INSTALLED += $(my_installed)
 ALL_MODULES.$(my_register_name).BUILT_INSTALLED += $(my_built_installed)
+ALL_MODULES.$(my_register_name).CLASSES_JAR := $(full_classes_jar)
 $(my_register_name): $(my_installed)
 
 ifdef LOCAL_SOONG_AAR
@@ -164,4 +172,4 @@
 		$(hide) echo $(PRIVATE_EXPORTED_SDK_LIBS) | tr ' ' '\n' > $@,\
 		$(hide) touch $@)
 
-SOONG_ALREADY_CONV := $(SOONG_ALREADY_CONV) $(LOCAL_MODULE)
+SOONG_ALREADY_CONV += $(LOCAL_MODULE)
diff --git a/core/soong_rust_prebuilt.mk b/core/soong_rust_prebuilt.mk
new file mode 100644
index 0000000..4a9eb4a
--- /dev/null
+++ b/core/soong_rust_prebuilt.mk
@@ -0,0 +1,108 @@
+# Native prebuilt coming from Soong.
+# Extra inputs:
+# LOCAL_SOONG_UNSTRIPPED_BINARY
+
+ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+  $(call pretty-error,soong_rust_prebuilt.mk may only be used from Soong)
+endif
+
+ifdef LOCAL_IS_HOST_MODULE
+  ifneq ($(HOST_OS),$(LOCAL_MODULE_HOST_OS))
+    my_prefix := HOST_CROSS_
+    LOCAL_HOST_PREFIX := $(my_prefix)
+  else
+    my_prefix := HOST_
+    LOCAL_HOST_PREFIX :=
+  endif
+else
+  my_prefix := TARGET_
+endif
+
+ifeq ($($(my_prefix)ARCH),$(LOCAL_MODULE_$(my_prefix)ARCH))
+  # primary arch
+  LOCAL_2ND_ARCH_VAR_PREFIX :=
+else ifeq ($($(my_prefix)2ND_ARCH),$(LOCAL_MODULE_$(my_prefix)ARCH))
+  # secondary arch
+  LOCAL_2ND_ARCH_VAR_PREFIX := $($(my_prefix)2ND_ARCH_VAR_PREFIX)
+else
+  $(call pretty-error,Unsupported LOCAL_MODULE_$(my_prefix)ARCH=$(LOCAL_MODULE_$(my_prefix)ARCH))
+endif
+
+# Don't install rlib/proc_macro libraries.
+ifndef LOCAL_UNINSTALLABLE_MODULE
+  ifneq ($(filter RLIB_LIBRARIES PROC_MACRO_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
+    LOCAL_UNINSTALLABLE_MODULE := true
+  endif
+endif
+
+
+#######################################
+include $(BUILD_SYSTEM)/base_rules.mk
+#######################################
+
+# The real dependency will be added after all Android.mks are loaded and the install paths
+# of the shared libraries are determined.
+ifdef LOCAL_INSTALLED_MODULE
+  ifdef LOCAL_SHARED_LIBRARIES
+    my_shared_libraries := $(LOCAL_SHARED_LIBRARIES)
+    $(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
+      $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(my_shared_libraries))
+  endif
+  ifdef LOCAL_DYLIB_LIBRARIES
+    my_dylibs := $(LOCAL_DYLIB_LIBRARIES)
+    # Treat these as shared library dependencies for installation purposes.
+    $(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
+      $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(my_dylibs))
+  endif
+endif
+
+$(LOCAL_BUILT_MODULE): $(LOCAL_PREBUILT_MODULE_FILE)
+	$(transform-prebuilt-to-target)
+ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
+	$(hide) chmod +x $@
+endif
+
+ifndef LOCAL_IS_HOST_MODULE
+  ifdef LOCAL_SOONG_UNSTRIPPED_BINARY
+    my_symbol_path := $(if $(LOCAL_SOONG_SYMBOL_PATH),$(LOCAL_SOONG_SYMBOL_PATH),$(my_module_path))
+    # Store a copy with symbols for symbolic debugging
+    my_unstripped_path := $(TARGET_OUT_UNSTRIPPED)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_symbol_path))
+    # drop /root as /root is mounted as /
+    my_unstripped_path := $(patsubst $(TARGET_OUT_UNSTRIPPED)/root/%,$(TARGET_OUT_UNSTRIPPED)/%, $(my_unstripped_path))
+    symbolic_output := $(my_unstripped_path)/$(my_installed_module_stem)
+    $(eval $(call copy-one-file,$(LOCAL_SOONG_UNSTRIPPED_BINARY),$(symbolic_output)))
+    $(call add-dependency,$(LOCAL_BUILT_MODULE),$(symbolic_output))
+  endif
+endif
+
+# A product may be configured to strip everything in some build variants.
+# We do the stripping as a post-install command so that LOCAL_BUILT_MODULE
+# is still with the symbols and we don't need to clean it (and relink) when
+# you switch build variant.
+ifneq ($(filter $(STRIP_EVERYTHING_BUILD_VARIANTS),$(TARGET_BUILD_VARIANT)),)
+$(LOCAL_INSTALLED_MODULE): PRIVATE_POST_INSTALL_CMD := \
+  $($(LOCAL_2ND_ARCH_VAR_PREFIX)TARGET_STRIP) --strip-all $(LOCAL_INSTALLED_MODULE)
+endif
+
+$(LOCAL_BUILT_MODULE): $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+# We don't care about installed rlib/static libraries, since the libraries have
+# already been linked into the module at that point. We do, however, care
+# about the NOTICE files for any rlib/static libraries that we use.
+# (see notice_files.mk)
+#
+# Filter out some NDK libraries that are not being exported.
+my_static_libraries := \
+    $(filter-out ndk_libc++_static ndk_libc++abi ndk_libandroid_support ndk_libunwind \
+      ndk_libc++_static.native_bridge ndk_libc++abi.native_bridge \
+      ndk_libandroid_support.native_bridge ndk_libunwind.native_bridge, \
+      $(LOCAL_STATIC_LIBRARIES))
+installed_static_library_notice_file_targets := \
+    $(foreach lib,$(my_static_libraries), \
+      NOTICE-$(if $(LOCAL_IS_HOST_MODULE),HOST$(if $(my_host_cross),_CROSS,),TARGET)-STATIC_LIBRARIES-$(lib))
+installed_static_library_notice_file_targets += \
+    $(foreach lib,$(LOCAL_RLIB_LIBRARIES), \
+      NOTICE-$(if $(LOCAL_IS_HOST_MODULE),HOST$(if $(my_host_cross),_CROSS,),TARGET)-RLIB_LIBRARIES-$(lib))
+
+$(notice_target): | $(installed_static_library_notice_file_targets)
+$(LOCAL_INSTALLED_MODULE): | $(notice_target)
diff --git a/core/static_java_library.mk b/core/static_java_library.mk
index ee759b9..7eef167 100644
--- a/core/static_java_library.mk
+++ b/core/static_java_library.mk
@@ -33,10 +33,6 @@
 
 include $(BUILD_SYSTEM)/force_aapt2.mk
 
-ifdef LOCAL_AAPT2_ONLY
-LOCAL_USE_AAPT2 := true
-endif
-
 # Hack to build static Java library with Android resource
 # See bug 5714516
 all_resources :=
@@ -46,11 +42,9 @@
 need_compile_res := true
 LOCAL_RESOURCE_DIR := $(foreach d,$(LOCAL_RESOURCE_DIR),$(call clean-path,$(d)))
 endif
-ifeq ($(LOCAL_USE_AAPT2),true)
 ifneq ($(strip $(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),)
 need_compile_res := true
 endif
-endif
 
 ifeq ($(need_compile_res),true)
 all_resources := $(strip \
@@ -80,26 +74,25 @@
 endif
 
 LOCAL_PROGUARD_FLAGS := $(addprefix -include ,$(proguard_options_file)) $(LOCAL_PROGUARD_FLAGS)
+LOCAL_PROGUARD_FLAGS_DEPS += $(proguard_options_file)
 
 R_file_stamp := $(intermediates.COMMON)/src/R.stamp
 LOCAL_INTERMEDIATE_TARGETS += $(R_file_stamp)
 
-ifeq ($(LOCAL_USE_AAPT2),true)
-  ifneq ($(strip $(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),)
-    # If we are using static android libraries, every source file becomes an overlay.
-    # This is to emulate old AAPT behavior which simulated library support.
-    my_res_resources :=
-    my_overlay_resources := $(all_resources)
-  else
-    # Otherwise, for a library we treat all the resource equal with no overlay.
-    my_res_resources := $(all_resources)
-    my_overlay_resources :=
-  endif
-  # For libraries put everything in the COMMON intermediate directory.
-  my_res_package := $(intermediates.COMMON)/package-res.apk
+ifneq ($(strip $(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES)),)
+  # If we are using static android libraries, every source file becomes an overlay.
+  # This is to emulate old AAPT behavior which simulated library support.
+  my_res_resources :=
+  my_overlay_resources := $(all_resources)
+else
+  # Otherwise, for a library we treat all the resource equal with no overlay.
+  my_res_resources := $(all_resources)
+  my_overlay_resources :=
+endif
+# For libraries put everything in the COMMON intermediate directory.
+my_res_package := $(intermediates.COMMON)/package-res.apk
 
-  LOCAL_INTERMEDIATE_TARGETS += $(my_res_package)
-endif  # LOCAL_USE_AAPT2
+LOCAL_INTERMEDIATE_TARGETS += $(my_res_package)
 
 endif  # need_compile_res
 
@@ -127,7 +120,6 @@
 endif
 endif
 
-ifeq ($(LOCAL_USE_AAPT2),true)
 import_proguard_flag_files := $(strip $(foreach l,$(LOCAL_STATIC_ANDROID_LIBRARIES) $(LOCAL_STATIC_JAVA_AAR_LIBRARIES),\
     $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/export_proguard_flags))
 $(intermediates.COMMON)/export_proguard_flags: $(import_proguard_flag_files) $(addprefix $(LOCAL_PATH)/,$(LOCAL_EXPORT_PROGUARD_FLAG_FILES))
@@ -139,7 +131,6 @@
 		cat $$f >>$@; \
 	done
 import_proguard_flag_files :=
-endif
 
 include $(BUILD_SYSTEM)/aapt_flags.mk
 
@@ -150,7 +141,6 @@
 
 # add --non-constant-id to prevent inlining constants.
 # AAR needs text symbol file R.txt.
-ifeq ($(LOCAL_USE_AAPT2),true)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) --static-lib --output-text-symbols $(intermediates.COMMON)/R.txt
 ifndef LOCAL_AAPT_NAMESPACES
   $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_AAPT_FLAGS += --no-static-lib-packages
@@ -158,15 +148,6 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_PRODUCT_AAPT_CONFIG :=
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_PRODUCT_AAPT_PREF_CONFIG :=
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_TARGET_AAPT_CHARACTERISTICS :=
-else
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) --non-constant-id --output-text-symbols $(intermediates.COMMON)
-
-my_srcjar := $(intermediates.COMMON)/aapt.srcjar
-LOCAL_SRCJARS += $(my_srcjar)
-$(R_file_stamp): PRIVATE_SRCJAR := $(my_srcjar)
-$(R_file_stamp): PRIVATE_JAVA_GEN_DIR := $(intermediates.COMMON)/aapt
-$(R_file_stamp): .KATI_IMPLICIT_OUTPUTS := $(my_srcjar)
-endif
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ANDROID_MANIFEST := $(full_android_manifest)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RESOURCE_PUBLICS_OUTPUT := $(intermediates.COMMON)/public_resources.xml
@@ -178,26 +159,16 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_MANIFEST_PACKAGE_NAME :=
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_MANIFEST_INSTRUMENTATION_FOR :=
 
-ifeq ($(LOCAL_USE_AAPT2),true)
-  # One more level with name res so we can zip up the flat resources that can be linked by apps.
-  my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res/res
-  ifneq (,$(filter-out current,$(renderscript_target_api)))
-    ifneq ($(call math_gt_or_eq,$(renderscript_target_api),21),true)
-      my_generated_res_zips := $(rs_generated_res_zip)
-    endif  # renderscript_target_api < 21
-  endif  # renderscript_target_api is set
-  include $(BUILD_SYSTEM)/aapt2.mk
-  $(my_res_package) : $(framework_res_package_export)
-  $(my_res_package): .KATI_IMPLICIT_OUTPUTS += $(intermediates.COMMON)/R.txt
-else
-  $(R_file_stamp): .KATI_IMPLICIT_OUTPUTS += $(intermediates.COMMON)/R.txt
-  $(R_file_stamp): PRIVATE_RESOURCE_LIST := $(all_resources)
-  $(R_file_stamp) : $(all_resources) $(full_android_manifest) $(AAPT) $(SOONG_ZIP) \
-    $(framework_res_package_export) $(rs_generated_res_zip)
-	@echo "target R.java/Manifest.java: $(PRIVATE_MODULE) ($@)"
-	$(create-resource-java-files)
-	$(hide) find $(PRIVATE_JAVA_GEN_DIR) -name R.java | xargs cat > $@
-endif  # LOCAL_USE_AAPT2
+# One more level with name res so we can zip up the flat resources that can be linked by apps.
+my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res/res
+ifneq (,$(filter-out current,$(renderscript_target_api)))
+  ifneq ($(call math_gt_or_eq,$(renderscript_target_api),21),true)
+    my_generated_res_zips := $(rs_generated_res_zip)
+  endif  # renderscript_target_api < 21
+endif  # renderscript_target_api is set
+include $(BUILD_SYSTEM)/aapt2.mk
+$(my_res_package) : $(framework_res_package_export)
+$(my_res_package): .KATI_IMPLICIT_OUTPUTS += $(intermediates.COMMON)/R.txt
 
 endif # need_compile_res
 
diff --git a/core/static_library.mk b/core/static_library.mk
index 8002e5c..a450092 100644
--- a/core/static_library.mk
+++ b/core/static_library.mk
@@ -1,4 +1,7 @@
 $(call record-module-type,STATIC_LIBRARY)
+ifdef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,BUILD_STATIC_LIBRARY is incompatible with LOCAL_IS_HOST_MODULE. Use BUILD_HOST_STATIC_LIBRARY instead)
+endif
 my_prefix := TARGET_
 include $(BUILD_SYSTEM)/multilib.mk
 
@@ -38,4 +41,9 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(if $(filter true,$(BUILD_BROKEN_USES_BUILD_COPY_HEADERS)),\
+  $(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers),\
+  $(call pretty-error,LOCAL_COPY_HEADERS is obsolete. See $(CHANGES_URL)#copy_headers))
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/static_library_internal.mk b/core/static_library_internal.mk
index f82e501..0392460 100644
--- a/core/static_library_internal.mk
+++ b/core/static_library_internal.mk
@@ -21,7 +21,7 @@
 include $(BUILD_SYSTEM)/binary.mk
 
 $(LOCAL_BUILT_MODULE) : $(built_whole_libraries)
-$(LOCAL_BUILT_MODULE) : $(all_objects)
+$(LOCAL_BUILT_MODULE) : $(all_objects) $($(LOCAL_2ND_ARCH_VAR_PREFIX)TARGET_AR)
 	$(transform-o-to-static-lib)
 
 ifeq ($(NATIVE_COVERAGE),true)
diff --git a/core/android_vts_host_config.mk b/core/suite_host_config.mk
similarity index 89%
rename from core/android_vts_host_config.mk
rename to core/suite_host_config.mk
index 38ba19d..d575c5b 100644
--- a/core/android_vts_host_config.mk
+++ b/core/suite_host_config.mk
@@ -16,11 +16,9 @@
 
 LOCAL_MODULE_CLASS := FAKE
 LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
 
 include $(BUILD_SYSTEM)/base_rules.mk
 
 $(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
+	@echo "$(LOCAL_COMPATIBILITY_SUITE) host-driven test target: $(PRIVATE_MODULE)"
 	$(hide) touch $@
-
diff --git a/core/tasks/boot_jars_package_check.mk b/core/tasks/boot_jars_package_check.mk
index dc79e23..825bbc3 100644
--- a/core/tasks/boot_jars_package_check.mk
+++ b/core/tasks/boot_jars_package_check.mk
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 #
-# Rules to check if classes in the boot jars are from the whitelisted packages.
+# Rules to check if classes in the boot jars are from the list of allowed packages.
 #
 
 ifneq ($(SKIP_BOOT_JARS_CHECK),true)
@@ -22,17 +22,29 @@
 
 intermediates := $(call intermediates-dir-for, PACKAGING, boot-jars-package-check,,COMMON)
 stamp := $(intermediates)/stamp
-built_boot_jars := $(foreach j, $(PRODUCT_BOOT_JARS), \
+
+# The actual names for the updatable jars are <jar_name>.<apex_name> e.g., updatable-media.com.android.media
+updatable_boot_jars := $(foreach pair,$(PRODUCT_UPDATABLE_BOOT_JARS),\
+  $(eval apex := $(call word-colon,1,$(pair)))\
+  $(eval jar := $(call word-colon,2,$(pair)))\
+  $(jar).$(apex)\
+)
+#TODO(jiyong) merge art_boot_jars into updatable_boot_jars
+art_boot_jars := $(addsuffix .com.android.art.release,$(filter $(ART_APEX_JARS),$(PRODUCT_BOOT_JARS)))
+
+platform_boot_jars := $(filter-out $(ART_APEX_JARS),$(PRODUCT_BOOT_JARS))
+
+built_boot_jars := $(foreach j, $(updatable_boot_jars) $(art_boot_jars) $(platform_boot_jars), \
   $(call intermediates-dir-for, JAVA_LIBRARIES, $(j),,COMMON)/classes.jar)
 script := build/make/core/tasks/check_boot_jars/check_boot_jars.py
-whitelist_file := build/make/core/tasks/check_boot_jars/package_whitelist.txt
+allowed_file := build/make/core/tasks/check_boot_jars/package_allowed_list.txt
 
 $(stamp): PRIVATE_BOOT_JARS := $(built_boot_jars)
 $(stamp): PRIVATE_SCRIPT := $(script)
-$(stamp): PRIVATE_WHITELIST := $(whitelist_file)
-$(stamp) : $(built_boot_jars) $(script) $(whitelist_file)
+$(stamp): PRIVATE_ALLOWED := $(allowed_file)
+$(stamp) : $(built_boot_jars) $(script) $(allowed_file)
 	@echo "Check package name for $(PRIVATE_BOOT_JARS)"
-	$(hide) $(PRIVATE_SCRIPT) $(PRIVATE_WHITELIST) $(PRIVATE_BOOT_JARS)
+	$(hide) $(PRIVATE_SCRIPT) $(PRIVATE_ALLOWED) $(PRIVATE_BOOT_JARS)
 	$(hide) mkdir -p $(dir $@) && touch $@
 
 .PHONY: check-boot-jars
diff --git a/core/tasks/check_boot_jars/check_boot_jars.py b/core/tasks/check_boot_jars/check_boot_jars.py
index 9d71553..cf4ef27 100755
--- a/core/tasks/check_boot_jars/check_boot_jars.py
+++ b/core/tasks/check_boot_jars/check_boot_jars.py
@@ -3,7 +3,7 @@
 """
 Check boot jars.
 
-Usage: check_boot_jars.py <package_whitelist_file> <jar1> <jar2> ...
+Usage: check_boot_jars.py <package_allow_list_file> <jar1> <jar2> ...
 """
 import logging
 import os.path
@@ -12,12 +12,12 @@
 import sys
 
 
-# The compiled whitelist RE.
-whitelist_re = None
+# The compiled allow list RE.
+allow_list_re = None
 
 
-def LoadWhitelist(filename):
-  """ Load and compile whitelist regular expressions from filename.
+def LoadAllowList(filename):
+  """ Load and compile allow list regular expressions from filename.
   """
   lines = []
   with open(filename, 'r') as f:
@@ -27,19 +27,19 @@
         continue
       lines.append(line)
   combined_re = r'^(%s)$' % '|'.join(lines)
-  global whitelist_re
+  global allow_list_re
   try:
-    whitelist_re = re.compile(combined_re)
+    allow_list_re = re.compile(combined_re)
   except re.error:
     logging.exception(
-        'Cannot compile package whitelist regular expression: %r',
+        'Cannot compile package allow list regular expression: %r',
         combined_re)
-    whitelist_re = None
+    allow_list_re = None
     return False
   return True
 
 
-def CheckJar(whitelist_path, jar):
+def CheckJar(allow_list_path, jar):
   """Check a jar file.
   """
   # Get the list of files inside the jar file.
@@ -49,16 +49,20 @@
   if p.returncode != 0:
     return False
   items = stdout.split()
+  classes = 0
   for f in items:
     if f.endswith('.class'):
+      classes += 1
       package_name = os.path.dirname(f)
       package_name = package_name.replace('/', '.')
-      # Skip class without a package name
-      if package_name and not whitelist_re.match(package_name):
-        print >> sys.stderr, ('Error: %s contains class file %s, whose package name %s is not '
-                              'in the whitelist %s of packages allowed on the bootclasspath.'
-                              % (jar, f, package_name, whitelist_path))
+      if not package_name or not allow_list_re.match(package_name):
+        print >> sys.stderr, ('Error: %s contains class file %s, whose package name %s is empty or'
+                              ' not in the allow list %s of packages allowed on the bootclasspath.'
+                              % (jar, f, package_name, allow_list_path))
         return False
+  if classes == 0:
+    print >> sys.stderr, ('Error: %s does not contain any class files.' % jar)
+    return False
   return True
 
 
@@ -66,14 +70,14 @@
   if len(argv) < 2:
     print __doc__
     return 1
-  whitelist_path = argv[0]
+  allow_list_path = argv[0]
 
-  if not LoadWhitelist(whitelist_path):
+  if not LoadAllowList(allow_list_path):
     return 1
 
   passed = True
   for jar in argv[1:]:
-    if not CheckJar(whitelist_path, jar):
+    if not CheckJar(allow_list_path, jar):
       passed = False
   if not passed:
     return 1
diff --git a/core/tasks/check_boot_jars/package_whitelist.txt b/core/tasks/check_boot_jars/package_allowed_list.txt
similarity index 95%
rename from core/tasks/check_boot_jars/package_whitelist.txt
rename to core/tasks/check_boot_jars/package_allowed_list.txt
index 38f2be5..18ab427 100644
--- a/core/tasks/check_boot_jars/package_whitelist.txt
+++ b/core/tasks/check_boot_jars/package_allowed_list.txt
@@ -1,4 +1,4 @@
-# Boot jar package name whitelist.
+# Boot jar package name allowed list.
 # Each line is interpreted as a regular expression.
 
 ###################################################
@@ -46,6 +46,8 @@
 java\.util\.spi
 java\.util\.stream
 java\.util\.zip
+# TODO: Remove javax.annotation.processing if possible, see http://b/132338110:
+javax\.annotation\.processing
 javax\.crypto
 javax\.crypto\.interfaces
 javax\.crypto\.spec
@@ -67,6 +69,8 @@
 javax\.xml\.transform\.stream
 javax\.xml\.validation
 javax\.xml\.xpath
+jdk\.internal\.util
+jdk\.internal\.vm\.annotation
 jdk\.net
 org\.w3c\.dom
 org\.w3c\.dom\.ls
@@ -118,8 +122,6 @@
 libcore\..*
 android\..*
 com\.android\..*
-
-
 ###################################################
 # android.test.base.jar
 junit\.extensions
@@ -237,6 +239,8 @@
 # Packages in the google namespace across all bootclasspath jars.
 com\.google\.android\..*
 com\.google\.vr\.platform.*
+com\.google\.i18n\.phonenumbers\..*
+com\.google\.i18n\.phonenumbers
 
 ###################################################
 # Packages used for Android in Chrome OS
diff --git a/core/tasks/collect_gpl_sources.mk b/core/tasks/collect_gpl_sources.mk
index acbe9be..ebc4181 100644
--- a/core/tasks/collect_gpl_sources.mk
+++ b/core/tasks/collect_gpl_sources.mk
@@ -17,6 +17,8 @@
 # in installclean between incremental builds on build servers.
 gpl_source_tgz := $(call intermediates-dir-for,PACKAGING,gpl_source)/gpl_source.tgz
 
+ALL_GPL_MODULE_LICENSE_FILES := $(sort $(ALL_GPL_MODULE_LICENSE_FILES))
+
 # FORCE since we can't know whether any of the sources changed
 $(gpl_source_tgz): PRIVATE_PATHS := $(sort $(patsubst %/, %, $(dir $(ALL_GPL_MODULE_LICENSE_FILES))))
 $(gpl_source_tgz) : $(ALL_GPL_MODULE_LICENSE_FILES)
diff --git a/core/android_vts_host_config.mk b/core/tasks/csuite.mk
similarity index 62%
copy from core/android_vts_host_config.mk
copy to core/tasks/csuite.mk
index 38ba19d..a8dba1d 100644
--- a/core/android_vts_host_config.mk
+++ b/core/tasks/csuite.mk
@@ -1,5 +1,4 @@
-#
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2019 The Android Open Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,15 +11,13 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-#
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+test_suite_name := csuite
+test_suite_tradefed := csuite-tradefed
+test_suite_readme := test/app_compat/csuite/README.md
 
-include $(BUILD_SYSTEM)/base_rules.mk
+include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
 
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+.PHONY: csuite
+csuite: $(compatibility_zip)
+$(call dist-for-goals, csuite, $(compatibility_zip))
diff --git a/core/tasks/cts.mk b/core/tasks/cts.mk
index f3b4368..cd5fa8e 100644
--- a/core/tasks/cts.mk
+++ b/core/tasks/cts.mk
@@ -16,6 +16,7 @@
 test_suite_tradefed := cts-tradefed
 test_suite_dynamic_config := test/suite_harness/tools/cts-tradefed/DynamicConfig.xml
 test_suite_readme := test/suite_harness/tools/cts-tradefed/README
+include_test_suite_notice := true
 
 include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
 
diff --git a/core/tasks/cts_instant.mk b/core/tasks/cts_instant.mk
deleted file mode 100644
index 18f1db3..0000000
--- a/core/tasks/cts_instant.mk
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright (C) 2018 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-test_suite_name := cts_instant
-test_suite_tradefed := cts-instant-tradefed
-test_suite_dynamic_config := test/suite_harness/tools/cts-instant-tradefed/DynamicConfig.xml
-test_suite_readme := test/suite_harness/tools/cts-instant-tradefed/README
-
-include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
-
-.PHONY: cts_instant
-cts_instant: $(compatibility_zip)
-$(call dist-for-goals, cts_instant, $(compatibility_zip))
-
diff --git a/core/tasks/device-tests.mk b/core/tasks/device-tests.mk
index 0028ce4..73fad7c 100644
--- a/core/tasks/device-tests.mk
+++ b/core/tasks/device-tests.mk
@@ -18,25 +18,41 @@
 device-tests-zip := $(PRODUCT_OUT)/device-tests.zip
 # Create an artifact to include a list of test config files in device-tests.
 device-tests-list-zip := $(PRODUCT_OUT)/device-tests_list.zip
+# Create an artifact to include all test config files in device-tests.
+device-tests-configs-zip := $(PRODUCT_OUT)/device-tests_configs.zip
 my_host_shared_lib_for_device_tests := $(call copy-many-files,$(COMPATIBILITY.device-tests.HOST_SHARED_LIBRARY.FILES))
-$(device-tests-zip) : .KATI_IMPLICIT_OUTPUTS := $(device-tests-list-zip)
+device_tests_host_shared_libs_zip := $(PRODUCT_OUT)/device-tests_host-shared-libs.zip
+
+$(device-tests-zip) : .KATI_IMPLICIT_OUTPUTS := $(device-tests-list-zip) $(device-tests-configs-zip) $(device_tests_host_shared_libs_zip)
 $(device-tests-zip) : PRIVATE_device_tests_list := $(PRODUCT_OUT)/device-tests_list
 $(device-tests-zip) : PRIVATE_HOST_SHARED_LIBS := $(my_host_shared_lib_for_device_tests)
+$(device-tests-zip) : PRIVATE_device_host_shared_libs_zip := $(device_tests_host_shared_libs_zip)
 $(device-tests-zip) : $(COMPATIBILITY.device-tests.FILES) $(my_host_shared_lib_for_device_tests) $(SOONG_ZIP)
+	rm -f $@-shared-libs.list
 	echo $(sort $(COMPATIBILITY.device-tests.FILES)) | tr " " "\n" > $@.list
 	grep $(HOST_OUT_TESTCASES) $@.list > $@-host.list || true
+	grep -e .*\\.config$$ $@-host.list > $@-host-test-configs.list || true
 	$(hide) for shared_lib in $(PRIVATE_HOST_SHARED_LIBS); do \
 	  echo $$shared_lib >> $@-host.list; \
+	  echo $$shared_lib >> $@-shared-libs.list; \
 	done
+	grep $(HOST_OUT_TESTCASES) $@-shared-libs.list > $@-host-shared-libs.list || true
 	grep $(TARGET_OUT_TESTCASES) $@.list > $@-target.list || true
+	grep -e .*\\.config$$ $@-target.list > $@-target-test-configs.list || true
 	$(hide) $(SOONG_ZIP) -d -o $@ -P host -C $(HOST_OUT) -l $@-host.list -P target -C $(PRODUCT_OUT) -l $@-target.list
+	$(hide) $(SOONG_ZIP) -d -o $(device-tests-configs-zip) \
+	  -P host -C $(HOST_OUT) -l $@-host-test-configs.list \
+	  -P target -C $(PRODUCT_OUT) -l $@-target-test-configs.list
+	$(SOONG_ZIP) -d -o $(PRIVATE_device_host_shared_libs_zip) \
+	  -P host -C $(HOST_OUT) -l $@-host-shared-libs.list
 	rm -f $(PRIVATE_device_tests_list)
-	$(hide) grep -e .*.config$$ $@-host.list | sed s%$(HOST_OUT)%host%g > $(PRIVATE_device_tests_list)
-	$(hide) grep -e .*.config$$ $@-target.list | sed s%$(PRODUCT_OUT)%target%g >> $(PRIVATE_device_tests_list)
+	$(hide) grep -e .*\\.config$$ $@-host.list | sed s%$(HOST_OUT)%host%g > $(PRIVATE_device_tests_list)
+	$(hide) grep -e .*\\.config$$ $@-target.list | sed s%$(PRODUCT_OUT)%target%g >> $(PRIVATE_device_tests_list)
 	$(hide) $(SOONG_ZIP) -d -o $(device-tests-list-zip) -C $(dir $@) -f $(PRIVATE_device_tests_list)
-	rm -f $@.list $@-host.list $@-target.list $(PRIVATE_device_tests_list)
+	rm -f $@.list $@-host.list $@-target.list $@-host-test-configs.list $@-target-test-configs.list \
+	  $@-shared-libs.list $@-host-shared-libs.list $(PRIVATE_device_tests_list)
 
 device-tests: $(device-tests-zip)
-$(call dist-for-goals, device-tests, $(device-tests-zip) $(device-tests-list-zip))
+$(call dist-for-goals, device-tests, $(device-tests-zip) $(device-tests-list-zip) $(device-tests-configs-zip) $(device_tests_host_shared_libs_zip))
 
 tests: device-tests
diff --git a/core/tasks/find-shareduid-violation.mk b/core/tasks/find-shareduid-violation.mk
index 45fd937..86052f2 100644
--- a/core/tasks/find-shareduid-violation.mk
+++ b/core/tasks/find-shareduid-violation.mk
@@ -24,7 +24,7 @@
     $(INSTALLED_USERDATAIMAGE_TARGET) \
     $(INSTALLED_VENDORIMAGE_TARGET) \
     $(INSTALLED_PRODUCTIMAGE_TARGET) \
-    $(INSTALLED_PRODUCT_SERVICESIMAGE_TARGET)
+    $(INSTALLED_SYSTEM_EXTIMAGE_TARGET)
 
 $(shareduid_violation_modules_filename): $(find_shareduid_script)
 $(shareduid_violation_modules_filename): $(AAPT2)
diff --git a/core/tasks/general-tests.mk b/core/tasks/general-tests.mk
index 36ab101..cb84a5c 100644
--- a/core/tasks/general-tests.mk
+++ b/core/tasks/general-tests.mk
@@ -14,9 +14,12 @@
 
 .PHONY: general-tests
 
+# TODO(b/149249068): Remove vts10-tradefed.jar after all VTS tests are converted
 general_tests_tools := \
     $(HOST_OUT_JAVA_LIBRARIES)/cts-tradefed.jar \
     $(HOST_OUT_JAVA_LIBRARIES)/compatibility-host-util.jar \
+    $(HOST_OUT_JAVA_LIBRARIES)/vts-tradefed.jar \
+    $(HOST_OUT_JAVA_LIBRARIES)/vts10-tradefed.jar
 
 intermediates_dir := $(call intermediates-dir-for,PACKAGING,general-tests)
 general_tests_zip := $(PRODUCT_OUT)/general-tests.zip
@@ -34,11 +37,18 @@
 
 my_host_shared_lib_for_general_tests += $(call copy-many-files,$(my_general_tests_shared_lib_files))
 
+# Create an artifact to include all test config files in general-tests.
+general_tests_configs_zip := $(PRODUCT_OUT)/general-tests_configs.zip
+# Create an artifact to include all shared librariy files in general-tests.
+general_tests_host_shared_libs_zip := $(PRODUCT_OUT)/general-tests_host-shared-libs.zip
+
 $(general_tests_zip) : PRIVATE_general_tests_list_zip := $(general_tests_list_zip)
-$(general_tests_zip) : .KATI_IMPLICIT_OUTPUTS := $(general_tests_list_zip)
+$(general_tests_zip) : .KATI_IMPLICIT_OUTPUTS := $(general_tests_list_zip) $(general_tests_configs_zip) $(general_tests_host_shared_libs_zip)
 $(general_tests_zip) : PRIVATE_TOOLS := $(general_tests_tools)
 $(general_tests_zip) : PRIVATE_INTERMEDIATES_DIR := $(intermediates_dir)
 $(general_tests_zip) : PRIVATE_HOST_SHARED_LIBS := $(my_host_shared_lib_for_general_tests)
+$(general_tests_zip) : PRIVATE_general_tests_configs_zip := $(general_tests_configs_zip)
+$(general_tests_zip) : PRIVATE_general_host_shared_libs_zip := $(general_tests_host_shared_libs_zip)
 $(general_tests_zip) : $(COMPATIBILITY.general-tests.FILES) $(general_tests_tools) $(my_host_shared_lib_for_general_tests) $(SOONG_ZIP)
 	rm -rf $(PRIVATE_INTERMEDIATES_DIR)
 	rm -f $@ $(PRIVATE_general_tests_list_zip)
@@ -46,22 +56,33 @@
 	echo $(sort $(COMPATIBILITY.general-tests.FILES)) | tr " " "\n" > $(PRIVATE_INTERMEDIATES_DIR)/list
 	grep $(HOST_OUT_TESTCASES) $(PRIVATE_INTERMEDIATES_DIR)/list > $(PRIVATE_INTERMEDIATES_DIR)/host.list || true
 	grep $(TARGET_OUT_TESTCASES) $(PRIVATE_INTERMEDIATES_DIR)/list > $(PRIVATE_INTERMEDIATES_DIR)/target.list || true
+	grep -e .*\\.config$$ $(PRIVATE_INTERMEDIATES_DIR)/host.list > $(PRIVATE_INTERMEDIATES_DIR)/host-test-configs.list || true
+	grep -e .*\\.config$$ $(PRIVATE_INTERMEDIATES_DIR)/target.list > $(PRIVATE_INTERMEDIATES_DIR)/target-test-configs.list || true
 	$(hide) for shared_lib in $(PRIVATE_HOST_SHARED_LIBS); do \
 	  echo $$shared_lib >> $(PRIVATE_INTERMEDIATES_DIR)/host.list; \
+	  echo $$shared_lib >> $(PRIVATE_INTERMEDIATES_DIR)/shared-libs.list; \
 	done
+	grep $(HOST_OUT_TESTCASES) $(PRIVATE_INTERMEDIATES_DIR)/shared-libs.list > $(PRIVATE_INTERMEDIATES_DIR)/host-shared-libs.list || true
 	cp -fp $(PRIVATE_TOOLS) $(PRIVATE_INTERMEDIATES_DIR)/tools/
 	$(SOONG_ZIP) -d -o $@ \
 	  -P host -C $(PRIVATE_INTERMEDIATES_DIR) -D $(PRIVATE_INTERMEDIATES_DIR)/tools \
 	  -P host -C $(HOST_OUT) -l $(PRIVATE_INTERMEDIATES_DIR)/host.list \
 	  -P target -C $(PRODUCT_OUT) -l $(PRIVATE_INTERMEDIATES_DIR)/target.list
-	grep -e .*.config$$ $(PRIVATE_INTERMEDIATES_DIR)/host.list | sed s%$(HOST_OUT)%host%g > $(PRIVATE_INTERMEDIATES_DIR)/general-tests_list
-	grep -e .*.config$$ $(PRIVATE_INTERMEDIATES_DIR)/target.list | sed s%$(PRODUCT_OUT)%target%g >> $(PRIVATE_INTERMEDIATES_DIR)/general-tests_list
+	$(SOONG_ZIP) -d -o $(PRIVATE_general_tests_configs_zip) \
+	  -P host -C $(HOST_OUT) -l $(PRIVATE_INTERMEDIATES_DIR)/host-test-configs.list \
+	  -P target -C $(PRODUCT_OUT) -l $(PRIVATE_INTERMEDIATES_DIR)/target-test-configs.list
+	$(SOONG_ZIP) -d -o $(PRIVATE_general_host_shared_libs_zip) \
+	  -P host -C $(HOST_OUT) -l $(PRIVATE_INTERMEDIATES_DIR)/host-shared-libs.list
+	grep -e .*\\.config$$ $(PRIVATE_INTERMEDIATES_DIR)/host.list | sed s%$(HOST_OUT)%host%g > $(PRIVATE_INTERMEDIATES_DIR)/general-tests_list
+	grep -e .*\\.config$$ $(PRIVATE_INTERMEDIATES_DIR)/target.list | sed s%$(PRODUCT_OUT)%target%g >> $(PRIVATE_INTERMEDIATES_DIR)/general-tests_list
 	$(SOONG_ZIP) -d -o $(PRIVATE_general_tests_list_zip) -C $(PRIVATE_INTERMEDIATES_DIR) -f $(PRIVATE_INTERMEDIATES_DIR)/general-tests_list
 
 general-tests: $(general_tests_zip)
-$(call dist-for-goals, general-tests, $(general_tests_zip) $(general_tests_list_zip))
+$(call dist-for-goals, general-tests, $(general_tests_zip) $(general_tests_list_zip) $(general_tests_configs_zip) $(general_tests_host_shared_libs_zip))
 
 intermediates_dir :=
 general_tests_tools :=
 general_tests_zip :=
 general_tests_list_zip :=
+general_tests_configs_zip :=
+general_tests_host_shared_libs_zip :=
diff --git a/core/tasks/module-info.mk b/core/tasks/module-info.mk
index 2c56162..f6cec15 100644
--- a/core/tasks/module-info.mk
+++ b/core/tasks/module-info.mk
@@ -17,15 +17,13 @@
 			'"test_config": [$(if $(ALL_MODULES.$(m).TEST_CONFIG),"$(ALL_MODULES.$(m).TEST_CONFIG)")], ' \
 			'"dependencies": [$(foreach w,$(sort $(ALL_DEPS.$(m).ALL_DEPS)),"$(w)", )], ' \
 			'"srcs": [$(foreach w,$(sort $(ALL_MODULES.$(m).SRCS)),"$(w)", )], ' \
+			'"srcjars": [$(foreach w,$(sort $(ALL_MODULES.$(m).SRCJARS)),"$(w)", )], ' \
+			'"classes_jar": [$(foreach w,$(sort $(ALL_MODULES.$(m).CLASSES_JAR)),"$(w)", )], ' \
 			'},\n' \
 	 ) | sed -e 's/, *\]/]/g' -e 's/, *\}/ }/g' -e '$$s/,$$//' >> $@
 	$(hide) echo '}' >> $@
 
 
-# If ONE_SHOT_MAKEFILE is set, our view of the world is smaller, so don't
-# rewrite the file in that came.
-ifndef ONE_SHOT_MAKEFILE
 droidcore: $(MODULE_INFO_JSON)
-endif
 
 $(call dist-for-goals, general-tests, $(MODULE_INFO_JSON))
diff --git a/core/tasks/oem_image.mk b/core/tasks/oem_image.mk
index e9c506a..a847b9d 100644
--- a/core/tasks/oem_image.mk
+++ b/core/tasks/oem_image.mk
@@ -34,10 +34,10 @@
 	@mkdir -p $(TARGET_OUT_OEM)
 	@mkdir -p $(oemimage_intermediates) && rm -rf $(oemimage_intermediates)/oem_image_info.txt
 	$(call generate-image-prop-dictionary, $(oemimage_intermediates)/oem_image_info.txt,oem,skip_fsck=true)
-	$(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-	  build/make/tools/releasetools/build_image.py \
-	  $(TARGET_OUT_OEM) $(oemimage_intermediates)/oem_image_info.txt $@ $(TARGET_OUT)
-	$(hide) $(call assert-max-image-size,$@,$(BOARD_OEMIMAGE_PARTITION_SIZE))
+	PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+	    $(BUILD_IMAGE) \
+	        $(TARGET_OUT_OEM) $(oemimage_intermediates)/oem_image_info.txt $@ $(TARGET_OUT)
+	$(call assert-max-image-size,$@,$(BOARD_OEMIMAGE_PARTITION_SIZE))
 
 .PHONY: oem_image
 oem_image : $(INSTALLED_OEMIMAGE_TARGET)
diff --git a/core/tasks/platform_availability_check.mk b/core/tasks/platform_availability_check.mk
new file mode 100644
index 0000000..043d130
--- /dev/null
+++ b/core/tasks/platform_availability_check.mk
@@ -0,0 +1,36 @@
+#
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Check whether there is any module that isn't available for platform
+# is installed to the platform.
+
+# Filter FAKE and NON_INSTALLABLE modules out and then collect those are not
+# available for platform
+_modules_not_available_for_platform := \
+$(strip $(foreach m,$(product_MODULES),\
+  $(if $(filter-out FAKE,$(ALL_MODULES.$(m).CLASS)),\
+    $(if $(ALL_MODULES.$(m).INSTALLED),\
+      $(if $(filter true,$(ALL_MODULES.$(m).NOT_AVAILABLE_FOR_PLATFORM)),\
+        $(m))))))
+
+_violators_with_path := $(foreach m,$(sort $(_modules_not_available_for_platform)),\
+    $(m):$(word 1,$(ALL_MODULES.$(m).PATH))\
+)
+
+$(call maybe-print-list-and-error,$(_violators_with_path),\
+Following modules are requested to be installed. But are not available \
+for platform because they do not have "//apex_available:platform" or \
+they depend on other modules that are not available for platform)
diff --git a/core/tasks/sdk-addon.mk b/core/tasks/sdk-addon.mk
index 93db1de..5097f12 100644
--- a/core/tasks/sdk-addon.mk
+++ b/core/tasks/sdk-addon.mk
@@ -14,8 +14,6 @@
 
 .PHONY: sdk_addon
 
-ifndef ONE_SHOT_MAKEFILE
-
 # If they didn't define PRODUCT_SDK_ADDON_NAME, then we won't define
 # any of these rules.
 addon_name := $(PRODUCT_SDK_ADDON_NAME)
@@ -68,7 +66,7 @@
 files_to_copy += \
 	$(addon_dir_img):$(INSTALLED_QEMU_SYSTEMIMAGE):images/$(TARGET_CPU_ABI)/system.img \
 	$(addon_dir_img):$(INSTALLED_QEMU_VENDORIMAGE):images/$(TARGET_CPU_ABI)/vendor.img \
-	$(addon_dir_img):$(BUILT_RAMDISK_TARGET):images/$(TARGET_CPU_ABI)/ramdisk.img \
+	$(addon_dir_img):$(INSTALLED_QEMU_RAMDISKIMAGE):images/$(TARGET_CPU_ABI)/ramdisk.img \
 	$(addon_dir_img):$(PRODUCT_OUT)/system/build.prop:images/$(TARGET_CPU_ABI)/build.prop \
 	$(addon_dir_img):device/generic/goldfish/data/etc/userdata.img:images/$(TARGET_CPU_ABI)/userdata.img \
 	$(addon_dir_img):$(target_notice_file_txt):images/$(TARGET_CPU_ABI)/NOTICE.txt \
@@ -114,20 +112,20 @@
 
 $(full_target): PRIVATE_STAGING_DIR := $(call append-path,$(staging),$(addon_dir_leaf))
 
-$(full_target): $(sdk_addon_deps) | $(ACP) $(SOONG_ZIP)
+$(full_target): $(sdk_addon_deps) | $(SOONG_ZIP)
 	@echo Packaging SDK Addon: $@
 	$(hide) mkdir -p $(PRIVATE_STAGING_DIR)/docs
 	$(hide) for d in $(PRIVATE_DOCS_DIRS); do \
-	    $(ACP) -r $$d $(PRIVATE_STAGING_DIR)/docs ;\
+	    cp -R $$d $(PRIVATE_STAGING_DIR)/docs ;\
 	  done
 	$(hide) mkdir -p $(dir $@)
 	$(hide) $(SOONG_ZIP) -o $@ -C $(dir $(PRIVATE_STAGING_DIR)) -D $(PRIVATE_STAGING_DIR)
 
 $(full_target_img): PRIVATE_STAGING_DIR := $(call append-path,$(staging),$(addon_dir_img))/images/$(TARGET_CPU_ABI)
-$(full_target_img): $(full_target) $(addon_img_source_prop) | $(ACP) $(SOONG_ZIP)
+$(full_target_img): $(full_target) $(addon_img_source_prop) | $(SOONG_ZIP)
 	@echo Packaging SDK Addon System-Image: $@
 	$(hide) mkdir -p $(dir $@)
-	$(ACP) -r $(PRODUCT_OUT)/data $(PRIVATE_STAGING_DIR)/data
+	cp -R $(PRODUCT_OUT)/data $(PRIVATE_STAGING_DIR)/data
 	$(hide) $(SOONG_ZIP) -o $@ -C $(dir $(PRIVATE_STAGING_DIR)) -D $(PRIVATE_STAGING_DIR)
 
 
@@ -150,5 +148,3 @@
 $(error Trying to build sdk_addon, but product '$(INTERNAL_PRODUCT)' does not define one)
 endif
 endif # addon_name
-
-endif # !ONE_SHOT_MAKEFILE
diff --git a/core/tasks/tools/build_custom_image.mk b/core/tasks/tools/build_custom_image.mk
index 19d2ab5..4721591 100644
--- a/core/tasks/tools/build_custom_image.mk
+++ b/core/tasks/tools/build_custom_image.mk
@@ -54,9 +54,15 @@
       $(eval my_copy_pairs += $(bui):$(my_staging_dir)/$(my_copy_dest)))\
   ))
 
+my_kernel_module_copy_files :=
+my_custom_image_modules_var := BOARD_$(strip $(call to-upper,$(my_custom_image_name)))_KERNEL_MODULES
+ifdef $(my_custom_image_modules_var)
+  my_kernel_module_copy_files += $(call build-image-kernel-modules,$(my_custom_image_modules_var),$(my_staging_dir),$(my_custom_image_name)/,$(call intermediates-dir-for,PACKAGING,depmod_$(my_custom_image_name)))
+endif
+
 # Collect CUSTOM_IMAGE_COPY_FILES.
 my_image_copy_files :=
-$(foreach f,$(CUSTOM_IMAGE_COPY_FILES),\
+$(foreach f,$(CUSTOM_IMAGE_COPY_FILES) $(my_kernel_module_copy_files),\
   $(eval pair := $(subst :,$(space),$(f)))\
   $(eval src := $(word 1,$(pair)))\
   $(eval my_image_copy_files += $(src))\
@@ -102,11 +108,6 @@
 ifeq (true,$(CUSTOM_IMAGE_SUPPORT_VERITY_FEC))
   $(my_built_custom_image): $(FEC)
 endif
-my_custom_image_modules_var:=BOARD_$(strip $(call to-upper,$(my_custom_image_name)))_KERNEL_MODULES
-my_custom_image_modules:=$($(my_custom_image_modules_var))
-my_custom_image_modules_dep:=$(if $(my_custom_image_modules),$(my_custom_image_modules) $(DEPMOD),)
-$(my_built_custom_image): PRIVATE_KERNEL_MODULES := $(my_custom_image_modules)
-$(my_built_custom_image): PRIVATE_IMAGE_NAME := $(my_custom_image_name)
 $(my_built_custom_image): $(INTERNAL_USERIMAGES_DEPS) $(my_built_modules) $(my_image_copy_files) $(my_custom_image_modules_dep) \
   $(CUSTOM_IMAGE_DICT_FILE)
 	@echo "Build image $@"
@@ -117,8 +118,6 @@
 	          $(eval pair := $(subst :,$(space),$(p)))\
 	          mkdir -p $(dir $(word 2,$(pair)));\
 	          cp -Rf $(word 1,$(pair)) $(word 2,$(pair));)
-	$(if $(PRIVATE_KERNEL_MODULES), \
-		$(call build-image-kernel-modules,$(PRIVATE_KERNEL_MODULES),$(PRIVATE_STAGING_DIR),$(PRIVATE_IMAGE_NAME)/,$(call intermediates-dir-for,PACKAGING,depmod_$(PRIVATE_IMAGE_NAME))))
 	$(if $($(PRIVATE_PICKUP_FILES)),$(hide) cp -Rf $(PRIVATE_PICKUP_FILES) $(PRIVATE_STAGING_DIR))
 	# Generate the dict.
 	$(hide) echo "# For all accepted properties, see BuildImage() in tools/releasetools/build_image.py" > $(PRIVATE_INTERMEDIATES)/image_info.txt
@@ -152,9 +151,9 @@
 	# Generate the image.
 	$(if $(filter oem,$(PRIVATE_MOUNT_POINT)), \
 	  $(hide) echo "oem.buildnumber=$(BUILD_NUMBER_FROM_FILE)" >> $(PRIVATE_STAGING_DIR)/oem.prop)
-	$(hide) PATH=$(foreach p,$(INTERNAL_USERIMAGES_BINARY_PATHS),$(p):)$$PATH \
-	  build/make/tools/releasetools/build_image.py \
-	  $(PRIVATE_STAGING_DIR) $(PRIVATE_INTERMEDIATES)/image_info.txt $@ $(TARGET_OUT)
+	$(hide) PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH \
+	    $(BUILD_IMAGE) \
+	        $(PRIVATE_STAGING_DIR) $(PRIVATE_INTERMEDIATES)/image_info.txt $@ $(TARGET_OUT)
 
 my_installed_custom_image := $(PRODUCT_OUT)/$(notdir $(my_built_custom_image))
 $(my_installed_custom_image) : $(my_built_custom_image)
diff --git a/core/tasks/tools/compatibility.mk b/core/tasks/tools/compatibility.mk
index 57a5cf9..c1fed90 100644
--- a/core/tasks/tools/compatibility.mk
+++ b/core/tasks/tools/compatibility.mk
@@ -30,6 +30,7 @@
 test_artifacts := $(COMPATIBILITY.$(test_suite_name).FILES)
 test_tools := $(HOST_OUT_JAVA_LIBRARIES)/hosttestlib.jar \
   $(HOST_OUT_JAVA_LIBRARIES)/tradefed.jar \
+  $(HOST_OUT_JAVA_LIBRARIES)/tradefed-test-framework.jar \
   $(HOST_OUT_JAVA_LIBRARIES)/loganalysis.jar \
   $(HOST_OUT_JAVA_LIBRARIES)/compatibility-host-util.jar \
   $(HOST_OUT_JAVA_LIBRARIES)/compatibility-host-util-tests.jar \
@@ -42,20 +43,43 @@
 
 test_tools += $(test_suite_tools)
 
+# Include host shared libraries
+host_shared_libs := $(call copy-many-files, $(COMPATIBILITY.$(test_suite_name).HOST_SHARED_LIBRARY.FILES))
+
+compatibility_zip_deps := $(test_artifacts) $(test_tools) $(test_suite_prebuilt_tools) $(test_suite_dynamic_config) $(SOONG_ZIP) $(host_shared_libs)
+compatibility_zip_resources := $(out_dir)/tools $(out_dir)/testcases
+
+# Test Suite NOTICE files
+test_suite_notice_txt := $(out_dir)/NOTICE.txt
+test_suite_notice_html := $(out_dir)/NOTICE.html
+
+$(eval $(call combine-notice-files, html, \
+         $(test_suite_notice_txt), \
+         $(test_suite_notice_html), \
+         "Notices for files contained in the test suites filesystem image in this directory:", \
+         $(HOST_OUT_NOTICE_FILES) $(TARGET_OUT_NOTICE_FILES), \
+         $(compatibility_zip_deps)))
+
+ifeq ($(include_test_suite_notice),true)
+  compatibility_zip_deps += $(test_suite_notice_txt)
+  compatibility_zip_resources += $(test_suite_notice_txt)
+endif
+
 compatibility_zip := $(out_dir).zip
 $(compatibility_zip): PRIVATE_NAME := android-$(test_suite_name)
 $(compatibility_zip): PRIVATE_OUT_DIR := $(out_dir)
 $(compatibility_zip): PRIVATE_TOOLS := $(test_tools) $(test_suite_prebuilt_tools)
 $(compatibility_zip): PRIVATE_SUITE_NAME := $(test_suite_name)
 $(compatibility_zip): PRIVATE_DYNAMIC_CONFIG := $(test_suite_dynamic_config)
-$(compatibility_zip): $(test_artifacts) $(test_tools) $(test_suite_prebuilt_tools) $(test_suite_dynamic_config) $(SOONG_ZIP) | $(ADB) $(ACP)
+$(compatibility_zip): PRIVATE_RESOURCES := $(compatibility_zip_resources)
+$(compatibility_zip): $(compatibility_zip_deps) | $(ADB) $(ACP)
 # Make dir structure
 	$(hide) mkdir -p $(PRIVATE_OUT_DIR)/tools $(PRIVATE_OUT_DIR)/testcases
 	$(hide) echo $(BUILD_NUMBER_FROM_FILE) > $(PRIVATE_OUT_DIR)/tools/version.txt
 # Copy tools
-	$(hide) $(ACP) -fp $(PRIVATE_TOOLS) $(PRIVATE_OUT_DIR)/tools
-	$(if $(PRIVATE_DYNAMIC_CONFIG),$(hide) $(ACP) -fp $(PRIVATE_DYNAMIC_CONFIG) $(PRIVATE_OUT_DIR)/testcases/$(PRIVATE_SUITE_NAME).dynamic)
-	$(hide) find $(dir $@)/$(PRIVATE_NAME) | sort >$@.list
+	$(hide) cp $(PRIVATE_TOOLS) $(PRIVATE_OUT_DIR)/tools
+	$(if $(PRIVATE_DYNAMIC_CONFIG),$(hide) cp $(PRIVATE_DYNAMIC_CONFIG) $(PRIVATE_OUT_DIR)/testcases/$(PRIVATE_SUITE_NAME).dynamic)
+	$(hide) find $(PRIVATE_RESOURCES) | sort >$@.list
 	$(hide) $(SOONG_ZIP) -d -o $@ -C $(dir $@) -l $@.list
 
 # Reset all input variables
@@ -65,3 +89,5 @@
 test_suite_readme :=
 test_suite_prebuilt_tools :=
 test_suite_tools :=
+include_test_suite_notice :=
+host_shared_libs :=
diff --git a/core/tasks/tools/package-modules.mk b/core/tasks/tools/package-modules.mk
index d7b3010..7c4266c 100644
--- a/core/tasks/tools/package-modules.mk
+++ b/core/tasks/tools/package-modules.mk
@@ -5,6 +5,11 @@
 #   my_modules: a list of module names
 #   my_package_name: the name of the output zip file.
 #   my_copy_pairs: a list of extra files to install (in src:dest format)
+# Optional input variables:
+#   my_modules_strict: what happens when a module from my_modules does not exist
+#     "true": error out when a module is missing
+#     "false": print a warning when a module is missing
+#     "": defaults to false currently
 # Output variables:
 #   my_package_zip: the path to the output zip file.
 #
@@ -15,6 +20,7 @@
 my_built_modules := $(foreach p,$(my_copy_pairs),$(call word-colon,1,$(p)))
 my_copy_pairs := $(foreach p,$(my_copy_pairs),$(call word-colon,1,$(p)):$(my_staging_dir)/$(call word-colon,2,$(p)))
 my_pickup_files :=
+my_missing_error :=
 
 # Iterate over the modules and include their direct dependencies stated in the
 # LOCAL_REQUIRED_MODULES.
@@ -26,10 +32,17 @@
   $(eval my_modules_and_deps += $(_explicitly_required))\
 )
 
-# Ignore unknown installed files on partial builds
-my_missing_files :=
-ifneq ($(ALLOW_MISSING_DEPENDENCIES),true)
+ifneq ($(filter-out true false,$(my_modules_strict)),)
+  $(shell $(call echo-error,$(my_makefile),$(my_package_name): Invalid value for 'my_module_strict' = '$(my_modules_strict)'. Valid values: 'true', 'false', ''))
+  $(error done)
+endif
+
 my_missing_files = $(shell $(call echo-warning,$(my_makefile),$(my_package_name): Unknown installed file for module '$(1)'))
+ifeq ($(ALLOW_MISSING_DEPENDENCIES),true)
+  # Ignore unknown installed files on partial builds
+  my_missing_files =
+else ifneq ($(my_modules_strict),false)
+  my_missing_files = $(shell $(call echo-error,$(my_makefile),$(my_package_name): Unknown installed file for module '$(1)'))$(eval my_missing_error := true)
 endif
 
 # Iterate over modules' built files and installed files;
@@ -63,6 +76,10 @@
       $(eval my_copy_pairs += $(bui):$(my_staging_dir)/$(my_copy_dest)))\
   ))
 
+ifneq ($(my_missing_error),)
+  $(error done)
+endif
+
 my_package_zip := $(my_staging_dir)/$(my_package_name).zip
 $(my_package_zip): PRIVATE_COPY_PAIRS := $(my_copy_pairs)
 $(my_package_zip): PRIVATE_PICKUP_FILES := $(my_pickup_files)
@@ -84,4 +101,6 @@
 my_copy_pairs :=
 my_pickup_files :=
 my_missing_files :=
+my_missing_error :=
 my_modules_and_deps :=
+my_modules_strict :=
diff --git a/core/tasks/vendor_module_check.mk b/core/tasks/vendor_module_check.mk
index 0b8f1e8..b4c5a3b 100644
--- a/core/tasks/vendor_module_check.mk
+++ b/core/tasks/vendor_module_check.mk
@@ -15,7 +15,7 @@
 #
 
 # Restrict the vendor module owners here.
-_vendor_owner_whitelist := \
+_vendor_owner_allowed_list := \
         asus \
         audience \
         atmel \
@@ -87,14 +87,14 @@
     $(filter vendor/%, $(PRODUCT_COPY_FILES)))
 ifneq (,$(_vendor_check_copy_files))
 $(foreach c, $(_vendor_check_copy_files), \
-  $(if $(filter $(_vendor_owner_whitelist), $(call word-colon,3,$(c))),,\
+  $(if $(filter $(_vendor_owner_allowed_list), $(call word-colon,3,$(c))),,\
     $(error Error: vendor PRODUCT_COPY_FILES file "$(c)" has unknown owner))\
   $(eval _vendor_module_owner_info += $(call word-colon,2,$(c)):$(call word-colon,3,$(c))))
 endif
 _vendor_check_copy_files :=
 
 $(foreach m, $(_vendor_check_modules), \
-  $(if $(filter $(_vendor_owner_whitelist), $(ALL_MODULES.$(m).OWNER)),,\
+  $(if $(filter $(_vendor_owner_allowed_list), $(ALL_MODULES.$(m).OWNER)),,\
     $(error Error: vendor module "$(m)" in $(ALL_MODULES.$(m).PATH) with unknown owner \
       "$(ALL_MODULES.$(m).OWNER)" in product "$(TARGET_PRODUCT)"))\
   $(if $(ALL_MODULES.$(m).INSTALLED),\
diff --git a/core/tasks/vendor_snapshot.mk b/core/tasks/vendor_snapshot.mk
new file mode 100644
index 0000000..8234e3f
--- /dev/null
+++ b/core/tasks/vendor_snapshot.mk
@@ -0,0 +1,34 @@
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+current_makefile := $(lastword $(MAKEFILE_LIST))
+
+# BOARD_VNDK_VERSION must be set to 'current' in order to generate a vendor snapshot.
+ifeq ($(BOARD_VNDK_VERSION),current)
+
+.PHONY: vendor-snapshot
+vendor-snapshot: $(SOONG_VENDOR_SNAPSHOT_ZIP)
+
+$(call dist-for-goals, vendor-snapshot, $(SOONG_VENDOR_SNAPSHOT_ZIP))
+
+else # BOARD_VNDK_VERSION is NOT set to 'current'
+
+.PHONY: vendor-snapshot
+vendor-snapshot: PRIVATE_MAKEFILE := $(current_makefile)
+vendor-snapshot:
+	$(call echo-error,$(PRIVATE_MAKEFILE),\
+		"CANNOT generate Vendor snapshot. BOARD_VNDK_VERSION must be set to 'current'.")
+	exit 1
+
+endif # BOARD_VNDK_VERSION
diff --git a/core/tasks/vndk.mk b/core/tasks/vndk.mk
index 9420638..a2973b4 100644
--- a/core/tasks/vndk.mk
+++ b/core/tasks/vndk.mk
@@ -23,208 +23,10 @@
 # BOARD_VNDK_RUNTIME_DISABLE must not be set to 'true'.
 ifneq ($(BOARD_VNDK_RUNTIME_DISABLE),true)
 
-# Returns list of src:dest paths of the intermediate objs
-#
-# Args:
-#   $(1): list of module and filename pairs (e.g., ld.config.txt:ld.config.27.txt ...)
-#   $(2): if not empty, evaluates for TARGET_2ND_ARCH
-define paths-of-intermediates
-$(strip \
-  $(foreach pair,$(1), \
-    $(eval module := $(call word-colon,1,$(pair))$(if $(2),$(TARGET_2ND_ARCH_MODULE_SUFFIX))) \
-    $(eval built := $(ALL_MODULES.$(module).BUILT_INSTALLED)) \
-    $(eval filename := $(call word-colon,2,$(pair))) \
-    $(if $(wordlist 2,100,$(built)), \
-      $(error Unable to handle multiple built files ($(module)): $(built))) \
-    $(if $(built),$(call word-colon,1,$(built)):$(filename)) \
-  ) \
-)
-endef
-
-# Returns src:dest list of notice files
-#
-# Args:
-#   $(1): list of lib names (e.g., libfoo.vendor)
-define paths-of-notice-files
-$(strip \
-  $(foreach lib,$(1), \
-    $(eval notice := $(sort \
-      $(ALL_MODULES.$(lib).NOTICES) \
-      $(if $(TARGET_2ND_ARCH),
-        $(ALL_MODULES.$(lib)$(TARGET_2ND_ARCH_MODULE_SUFFIX).NOTICES)))) \
-    $(if $(wordlist 2,100,$(notice)), \
-      $(error Unable to handle multiple notice files ($(lib)): $(notice))) \
-    $(if $(notice),$(notice):$(subst .vendor,,$(lib)).so.txt)))
-endef
-
-vndk_core_libs := $(addsuffix .vendor,$(VNDK_CORE_LIBRARIES))
-vndk_sp_libs := $(addsuffix .vendor,$(VNDK_SAMEPROCESS_LIBRARIES))
-vndk_private_libs := $(addsuffix .vendor,$(VNDK_PRIVATE_LIBRARIES))
-
-vndk_snapshot_libs := \
-  $(vndk_core_libs) \
-  $(vndk_sp_libs)
-
-vndk_prebuilt_txts := \
-  ld.config.txt \
-  vndksp.libraries.txt \
-  llndk.libraries.txt
-
-vndk_snapshot_top := $(call intermediates-dir-for,PACKAGING,vndk-snapshot)
-vndk_snapshot_out := $(vndk_snapshot_top)/vndk-snapshot
-vndk_snapshot_configs_out := $(vndk_snapshot_top)/configs
-
-#######################################
-# vndkcore.libraries.txt
-vndkcore.libraries.txt := $(vndk_snapshot_configs_out)/vndkcore.libraries.txt
-$(vndkcore.libraries.txt): PRIVATE_LIBS := $(vndk_core_libs)
-$(vndkcore.libraries.txt):
-	@echo 'Generating: $@'
-	@rm -f $@
-	@mkdir -p $(dir $@)
-	$(hide) echo -n > $@
-	$(hide) $(foreach lib,$(PRIVATE_LIBS),echo $(patsubst %.vendor,%,$(lib)).so >> $@;)
-
-
-#######################################
-# vndkprivate.libraries.txt
-vndkprivate.libraries.txt := $(vndk_snapshot_configs_out)/vndkprivate.libraries.txt
-$(vndkprivate.libraries.txt): PRIVATE_LIBS := $(vndk_private_libs)
-$(vndkprivate.libraries.txt):
-	@echo 'Generating: $@'
-	@rm -f $@
-	@mkdir -p $(dir $@)
-	$(hide) echo -n > $@
-	$(hide) $(foreach lib,$(PRIVATE_LIBS),echo $(patsubst %.vendor,%,$(lib)).so >> $@;)
-
-
-#######################################
-# module_paths.txt
-module_paths.txt := $(vndk_snapshot_configs_out)/module_paths.txt
-$(module_paths.txt): PRIVATE_LIBS := $(vndk_snapshot_libs)
-$(module_paths.txt):
-	@echo 'Generating: $@'
-	@rm -f $@
-	@mkdir -p $(dir $@)
-	$(hide) echo -n > $@
-	$(hide) $(foreach lib,$(PRIVATE_LIBS),echo $(patsubst %.vendor,%,$(lib)).so $(ALL_MODULES.$(lib).PATH) >> $@;)
-
-
-vndk_snapshot_configs := \
-  $(vndkcore.libraries.txt) \
-  $(vndkprivate.libraries.txt) \
-  $(module_paths.txt)
-
-#######################################
-# vndk_snapshot_zip
-vndk_snapshot_variant := $(vndk_snapshot_out)/$(TARGET_ARCH)
-binder :=
-ifneq ($(TARGET_IS_64_BIT), true)
-  ifneq ($(TARGET_USES_64_BIT_BINDER), true)
-    binder := binder32
-  endif
-endif
-vndk_lib_dir := $(subst $(space),/,$(strip $(vndk_snapshot_variant) $(binder) arch-$(TARGET_ARCH)-$(TARGET_ARCH_VARIANT)))
-vndk_lib_dir_2nd := $(subst $(space),/,$(strip $(vndk_snapshot_variant) $(binder) arch-$(TARGET_2ND_ARCH)-$(TARGET_2ND_ARCH_VARIANT)))
-vndk_snapshot_zip := $(PRODUCT_OUT)/android-vndk-$(TARGET_PRODUCT).zip
-
-$(vndk_snapshot_zip): PRIVATE_VNDK_SNAPSHOT_OUT := $(vndk_snapshot_out)
-
-deps := $(call paths-of-intermediates,$(foreach lib,$(vndk_core_libs),$(lib):$(subst .vendor,,$(lib)).so))
-$(vndk_snapshot_zip): PRIVATE_VNDK_CORE_OUT := $(vndk_lib_dir)/shared/vndk-core
-$(vndk_snapshot_zip): PRIVATE_VNDK_CORE_INTERMEDIATES := $(deps)
-$(vndk_snapshot_zip): $(foreach d,$(deps),$(call word-colon,1,$(d)))
-deps :=
-
-deps := $(call paths-of-intermediates,$(foreach lib,$(vndk_sp_libs),$(lib):$(subst .vendor,,$(lib)).so))
-$(vndk_snapshot_zip): PRIVATE_VNDK_SP_OUT := $(vndk_lib_dir)/shared/vndk-sp
-$(vndk_snapshot_zip): PRIVATE_VNDK_SP_INTERMEDIATES := $(deps)
-$(vndk_snapshot_zip): $(foreach d,$(deps),$(call word-colon,1,$(d)))
-deps :=
-
-deps := $(call paths-of-intermediates,$(foreach txt,$(vndk_prebuilt_txts), \
-          $(txt):$(patsubst %.txt,%.$(PLATFORM_VNDK_VERSION).txt,$(txt)))) \
-        $(foreach config,$(vndk_snapshot_configs),$(config):$(notdir $(config)))
-$(vndk_snapshot_zip): PRIVATE_CONFIGS_OUT := $(vndk_snapshot_variant)/configs
-$(vndk_snapshot_zip): PRIVATE_CONFIGS_INTERMEDIATES := $(deps)
-$(vndk_snapshot_zip): $(foreach d,$(deps),$(call word-colon,1,$(d)))
-deps :=
-
-notices := $(call paths-of-notice-files,$(vndk_core_libs) $(vndk_sp_libs))
-$(vndk_snapshot_zip): PRIVATE_NOTICE_FILES_OUT := $(vndk_snapshot_variant)/NOTICE_FILES
-$(vndk_snapshot_zip): PRIVATE_NOTICE_FILES_INTERMEDIATES := $(notices)
-$(vndk_snapshot_zip): $(foreach n,$(notices),$(call word-colon,1,$(n)))
-notices :=
-
-ifdef TARGET_2ND_ARCH
-deps := $(call paths-of-intermediates,$(foreach lib,$(vndk_core_libs),$(lib):$(subst .vendor,,$(lib)).so),true)
-$(vndk_snapshot_zip): PRIVATE_VNDK_CORE_OUT_2ND := $(vndk_lib_dir_2nd)/shared/vndk-core
-$(vndk_snapshot_zip): PRIVATE_VNDK_CORE_INTERMEDIATES_2ND := $(deps)
-$(vndk_snapshot_zip): $(foreach d,$(deps),$(call word-colon,1,$(d)))
-deps :=
-
-deps := $(call paths-of-intermediates,$(foreach lib,$(vndk_sp_libs),$(lib):$(subst .vendor,,$(lib)).so),true)
-$(vndk_snapshot_zip): PRIVATE_VNDK_SP_OUT_2ND := $(vndk_lib_dir_2nd)/shared/vndk-sp
-$(vndk_snapshot_zip): PRIVATE_VNDK_SP_INTERMEDIATES_2ND := $(deps)
-$(vndk_snapshot_zip): $(foreach d,$(deps),$(call word-colon,1,$(d)))
-deps :=
-endif
-
-# Args
-#   $(1): destination directory
-#   $(2): list of files (src:dest) to copy
-$(vndk_snapshot_zip): private-copy-intermediates = \
-  $(if $(2),$(strip \
-    @mkdir -p $(1) && \
-    $(foreach file,$(2), \
-      cp $(call word-colon,1,$(file)) $(call append-path,$(1),$(call word-colon,2,$(file))) && \
-    ) \
-    true \
-  ))
-
-
-$(vndk_snapshot_zip): $(SOONG_ZIP)
-	@echo 'Generating VNDK snapshot: $@'
-	@rm -f $@
-	@rm -rf $(PRIVATE_VNDK_SNAPSHOT_OUT)
-	@mkdir -p $(PRIVATE_VNDK_SNAPSHOT_OUT)
-	$(call private-copy-intermediates, \
-		$(PRIVATE_VNDK_CORE_OUT),$(PRIVATE_VNDK_CORE_INTERMEDIATES))
-	$(call private-copy-intermediates, \
-		$(PRIVATE_VNDK_SP_OUT),$(PRIVATE_VNDK_SP_INTERMEDIATES))
-	$(call private-copy-intermediates, \
-		$(PRIVATE_CONFIGS_OUT),$(PRIVATE_CONFIGS_INTERMEDIATES))
-	$(call private-copy-intermediates, \
-		$(PRIVATE_NOTICE_FILES_OUT),$(PRIVATE_NOTICE_FILES_INTERMEDIATES))
-ifdef TARGET_2ND_ARCH
-	$(call private-copy-intermediates, \
-		$(PRIVATE_VNDK_CORE_OUT_2ND),$(PRIVATE_VNDK_CORE_INTERMEDIATES_2ND))
-	$(call private-copy-intermediates, \
-		$(PRIVATE_VNDK_SP_OUT_2ND),$(PRIVATE_VNDK_SP_INTERMEDIATES_2ND))
-endif
-	$(hide) $(SOONG_ZIP) -o $@ -C $(PRIVATE_VNDK_SNAPSHOT_OUT) -D $(PRIVATE_VNDK_SNAPSHOT_OUT)
-
 .PHONY: vndk
-vndk: $(vndk_snapshot_zip)
+vndk: $(SOONG_VNDK_SNAPSHOT_ZIP)
 
-$(call dist-for-goals, vndk, $(vndk_snapshot_zip))
-
-# clear global vars
-clang-ubsan-vndk-core :=
-paths-of-intermediates :=
-paths-of-notice-files :=
-vndk_core_libs :=
-vndk_sp_libs :=
-vndk_snapshot_libs :=
-vndk_prebuilt_txts :=
-vndk_snapshot_configs :=
-vndk_snapshot_top :=
-vndk_snapshot_out :=
-vndk_snapshot_configs_out :=
-vndk_snapshot_variant :=
-binder :=
-vndk_lib_dir :=
-vndk_lib_dir_2nd :=
+$(call dist-for-goals, vndk, $(SOONG_VNDK_SNAPSHOT_ZIP))
 
 else # BOARD_VNDK_RUNTIME_DISABLE is set to 'true'
 error_msg := "CANNOT generate VNDK snapshot. BOARD_VNDK_RUNTIME_DISABLE must not be set to 'true'."
@@ -241,8 +43,9 @@
 ifneq (,$(error_msg))
 
 .PHONY: vndk
+vndk: PRIVATE_MAKEFILE := $(current_makefile)
 vndk:
-	$(call echo-error,$(current_makefile),$(error_msg))
+	$(call echo-error,$(PRIVATE_MAKEFILE),$(error_msg))
 	exit 1
 
 endif
diff --git a/core/tasks/vts-core-tests.mk b/core/tasks/vts-core-tests.mk
new file mode 100644
index 0000000..a3247da
--- /dev/null
+++ b/core/tasks/vts-core-tests.mk
@@ -0,0 +1,48 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+-include external/linux-kselftest/android/kselftest_test_list.mk
+-include external/ltp/android/ltp_package_list.mk
+
+test_suite_name := vts
+test_suite_tradefed := vts-tradefed
+test_suite_readme := test/vts/tools/vts-core-tradefed/README
+
+# Copy kernel test modules to testcases directories
+kernel_test_host_out := $(HOST_OUT_TESTCASES)/vts_kernel_tests
+kernel_test_vts_out := $(HOST_OUT)/$(test_suite_name)/android-$(test_suite_name)/testcases/vts_kernel_tests
+kernel_test_modules := \
+    $(kselftest_modules) \
+    ltp \
+    $(ltp_packages)
+
+kernel_test_copy_pairs := \
+  $(call target-native-copy-pairs,$(kernel_test_modules),$(kernel_test_vts_out)) \
+  $(call target-native-copy-pairs,$(kernel_test_modules),$(kernel_test_host_out))
+
+copy_kernel_tests := $(call copy-many-files,$(kernel_test_copy_pairs))
+
+# PHONY target to be used to build and test `vts_kernel_tests` without building full vts
+.PHONY: vts_kernel_tests
+vts_kernel_tests: $(copy_kernel_tests)
+
+include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
+
+$(compatibility_zip): $(copy_kernel_tests)
+
+.PHONY: vts
+vts: $(compatibility_zip)
+$(call dist-for-goals, vts, $(compatibility_zip))
+
+tests: vts
diff --git a/core/tasks/with-license.mk b/core/tasks/with-license.mk
new file mode 100644
index 0000000..469ad76
--- /dev/null
+++ b/core/tasks/with-license.mk
@@ -0,0 +1,50 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+.PHONY: with-license
+
+name := $(TARGET_PRODUCT)
+ifeq ($(TARGET_BUILD_TYPE),debug)
+	name := $(name)_debug
+endif
+
+name := $(name)-flashable-$(FILE_NAME_TAG)-with-license
+
+with_license_intermediates := \
+	$(call intermediates-dir-for,PACKAGING,with_license)
+
+# Create a with-license artifact target
+license_image_input_zip := $(with_license_intermediates)/$(name).zip
+$(license_image_input_zip) : $(BUILT_TARGET_FILES_PACKAGE) $(ZIP2ZIP)
+# DO NOT PROCEED without a license file.
+ifndef VENDOR_BLOBS_LICENSE
+	@echo "with-license requires VENDOR_BLOBS_LICENSE to be set."
+	exit 1
+else
+	$(ZIP2ZIP) -i $(BUILT_TARGET_FILES_PACKAGE) -o $@ \
+		RADIO/bootloader.img:bootloader.img RADIO/radio.img:radio.img \
+		IMAGES/*.img:. OTA/android-info.txt:android-info.txt
+endif
+with_license_zip := $(PRODUCT_OUT)/$(name).sh
+$(with_license_zip): PRIVATE_NAME := $(name)
+$(with_license_zip): PRIVATE_INPUT_ZIP := $(license_image_input_zip)
+$(with_license_zip): PRIVATE_VENDOR_BLOBS_LICENSE := $(VENDOR_BLOBS_LICENSE)
+$(with_license_zip): $(license_image_input_zip) $(VENDOR_BLOBS_LICENSE)
+$(with_license_zip): $(HOST_OUT_EXECUTABLES)/generate-self-extracting-archive
+	# Args: <output> <input archive> <comment> <license file>
+	$(HOST_OUT_EXECUTABLES)/generate-self-extracting-archive $@ \
+		$(PRIVATE_INPUT_ZIP) $(PRIVATE_NAME) $(PRIVATE_VENDOR_BLOBS_LICENSE)
+with-license : $(with_license_zip)
+$(call dist-for-goals, with-license, $(with_license_zip))
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 81ca28d..8e40fa7 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -39,9 +39,9 @@
   include $(INTERNAL_BUILD_ID_MAKEFILE)
 endif
 
-DEFAULT_PLATFORM_VERSION := QP1A
-MIN_PLATFORM_VERSION := QP1A
-MAX_PLATFORM_VERSION := QP1A
+DEFAULT_PLATFORM_VERSION := RP1A
+MIN_PLATFORM_VERSION := RP1A
+MAX_PLATFORM_VERSION := RP1A
 
 ALLOWED_VERSIONS := $(call allowed-platform-versions,\
   $(MIN_PLATFORM_VERSION),\
@@ -84,17 +84,56 @@
 # generate the range of allowed SDK versions, so it must have an entry for every
 # unreleased API level targetable by this branch, not just those that are valid
 # lunch targets for this branch.
-PLATFORM_VERSION.QP1A := 10
+
+# The last stable version name of the platform that was released.  During
+# development, this stays at that previous version, while the codename indicates
+# further work based on the previous version.
+PLATFORM_VERSION_LAST_STABLE := 11
+.KATI_READONLY := PLATFORM_VERSION_LAST_STABLE
 
 # These are the current development codenames, if the build is not a final
 # release build.  If this is a final release build, it is simply "REL".
-PLATFORM_VERSION_CODENAME.QP1A := REL
+PLATFORM_VERSION_CODENAME.RP1A := REL
+
+ifndef PLATFORM_VERSION_CODENAME
+  PLATFORM_VERSION_CODENAME := $(PLATFORM_VERSION_CODENAME.$(TARGET_PLATFORM_VERSION))
+  ifndef PLATFORM_VERSION_CODENAME
+    # PLATFORM_VERSION_CODENAME falls back to TARGET_PLATFORM_VERSION
+    PLATFORM_VERSION_CODENAME := $(TARGET_PLATFORM_VERSION)
+  endif
+
+  # This is all of the *active* development codenames.
+  # This confusing name is needed because
+  # all_codenames has been baked into build.prop for ages.
+  #
+  # Should be either the same as PLATFORM_VERSION_CODENAME or a comma-separated
+  # list of additional codenames after PLATFORM_VERSION_CODENAME.
+  PLATFORM_VERSION_ALL_CODENAMES :=
+
+  # Build a list of all active code names. Avoid duplicates, and stop when we
+  # reach a codename that matches PLATFORM_VERSION_CODENAME (anything beyond
+  # that is not included in our build).
+  _versions_in_target := \
+    $(call find_and_earlier,$(ALL_VERSIONS),$(TARGET_PLATFORM_VERSION))
+  $(foreach version,$(_versions_in_target),\
+    $(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
+    $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_CODENAMES)),,\
+      $(eval PLATFORM_VERSION_ALL_CODENAMES += $(_codename))))
+
+  # And convert from space separated to comma separated.
+  PLATFORM_VERSION_ALL_CODENAMES := \
+    $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_ALL_CODENAMES)))
+
+endif
+.KATI_READONLY := \
+  PLATFORM_VERSION_CODENAME \
+  PLATFORM_VERSION_ALL_CODENAMES
 
 ifndef PLATFORM_VERSION
-  PLATFORM_VERSION := $(PLATFORM_VERSION.$(TARGET_PLATFORM_VERSION))
-  ifndef PLATFORM_VERSION
-    # PLATFORM_VERSION falls back to TARGET_PLATFORM_VERSION
-    PLATFORM_VERSION := $(TARGET_PLATFORM_VERSION)
+  ifeq (REL,$(PLATFORM_VERSION_CODENAME))
+      PLATFORM_VERSION := $(PLATFORM_VERSION_LAST_STABLE)
+  else
+      PLATFORM_VERSION := $(PLATFORM_VERSION_CODENAME)
   endif
 endif
 .KATI_READONLY := PLATFORM_VERSION
@@ -112,59 +151,10 @@
   # When you increment the PLATFORM_SDK_VERSION please ensure you also
   # clear out the following text file of all older PLATFORM_VERSION's:
   # cts/tests/tests/os/assets/platform_versions.txt
-  PLATFORM_SDK_VERSION := 29
+  PLATFORM_SDK_VERSION := 30
 endif
 .KATI_READONLY := PLATFORM_SDK_VERSION
 
-ifndef PLATFORM_VERSION_CODENAME
-  PLATFORM_VERSION_CODENAME := $(PLATFORM_VERSION_CODENAME.$(TARGET_PLATFORM_VERSION))
-  ifndef PLATFORM_VERSION_CODENAME
-    # PLATFORM_VERSION_CODENAME falls back to TARGET_PLATFORM_VERSION
-    PLATFORM_VERSION_CODENAME := $(TARGET_PLATFORM_VERSION)
-  endif
-
-  # This is all of the *active* development codenames. There are future
-  # codenames not included in this list. This confusing name is needed because
-  # all_codenames has been baked into build.prop for ages.
-  #
-  # Should be either the same as PLATFORM_VERSION_CODENAME or a comma-separated
-  # list of additional codenames after PLATFORM_VERSION_CODENAME.
-  PLATFORM_VERSION_ALL_CODENAMES :=
-
-  # Build a list of all active code names. Avoid duplicates, and stop when we
-  # reach a codename that matches PLATFORM_VERSION_CODENAME (anything beyond
-  # that is not included in our build).
-  _versions_in_target := \
-    $(call find_and_earlier,$(ALL_VERSIONS),$(TARGET_PLATFORM_VERSION))
-  $(foreach version,$(_versions_in_target),\
-    $(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
-    $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_CODENAMES)),,\
-      $(eval PLATFORM_VERSION_ALL_CODENAMES += $(_codename))))
-
-  # This is all of the inactive development codenames. Available to be targeted
-  # in this branch but in the future relative to our current target.
-  PLATFORM_VERSION_FUTURE_CODENAMES :=
-
-  # Build a list of all untargeted code names. Avoid duplicates.
-  _versions_not_in_target := \
-    $(filter-out $(PLATFORM_VERSION_ALL_CODENAMES),$(ALL_VERSIONS))
-  $(foreach version,$(_versions_not_in_target),\
-    $(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
-    $(if $(filter $(_codename),$(PLATFORM_VERSION_FUTURE_CODENAMES)),,\
-      $(eval PLATFORM_VERSION_FUTURE_CODENAMES += $(_codename))))
-
-  # And convert from space separated to comma separated.
-  PLATFORM_VERSION_ALL_CODENAMES := \
-    $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_ALL_CODENAMES)))
-  PLATFORM_VERSION_FUTURE_CODENAMES := \
-    $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_FUTURE_CODENAMES)))
-
-endif
-.KATI_READONLY := \
-  PLATFORM_VERSION_CODENAME \
-  PLATFORM_VERSION_ALL_CODENAMES \
-  PLATFORM_VERSION_FUTURE_CODENAMES
-
 ifeq (REL,$(PLATFORM_VERSION_CODENAME))
   PLATFORM_PREVIEW_SDK_VERSION := 0
 else
@@ -250,17 +240,13 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2021-06-01
+      PLATFORM_SECURITY_PATCH := 2021-06-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
 ifndef PLATFORM_SECURITY_PATCH_TIMESTAMP
   # Used to indicate the matching timestamp for the security patch string in PLATFORM_SECURITY_PATCH.
-  ifneq (,$(findstring Darwin,$(UNAME)))
-    PLATFORM_SECURITY_PATCH_TIMESTAMP := $(shell date -jf '%Y-%m-%d %T %Z' '$(PLATFORM_SECURITY_PATCH) 00:00:00 GMT' +%s)
-  else
-    PLATFORM_SECURITY_PATCH_TIMESTAMP := $(shell date -d 'TZ="GMT" $(PLATFORM_SECURITY_PATCH)' +%s)
-  endif
+  PLATFORM_SECURITY_PATCH_TIMESTAMP := $(shell date -d 'TZ="GMT" $(PLATFORM_SECURITY_PATCH)' +%s)
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH_TIMESTAMP
 
@@ -289,11 +275,7 @@
   BUILD_DATETIME := $(shell date +%s)
 endif
 
-ifneq (,$(findstring Darwin,$(UNAME)))
-DATE := date -r $(BUILD_DATETIME)
-else
 DATE := date -d @$(BUILD_DATETIME)
-endif
 .KATI_READONLY := DATE
 
 # Everything should be using BUILD_DATETIME_FROM_FILE instead.
diff --git a/envsetup.sh b/envsetup.sh
index 9e381a2..793f4b6 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -11,18 +11,22 @@
 - tapas:      tapas [<App1> <App2> ...] [arm|x86|mips|arm64|x86_64|mips64] [eng|userdebug|user]
 - croot:      Changes directory to the top of the tree, or a subdirectory thereof.
 - m:          Makes from the top of the tree.
-- mm:         Builds all of the modules in the current directory, but not their dependencies.
-- mmm:        Builds all of the modules in the supplied directories, but not their dependencies.
+- mm:         Builds and installs all of the modules in the current directory, and their
+              dependencies.
+- mmm:        Builds and installs all of the modules in the supplied directories, and their
+              dependencies.
               To limit the modules being built use the syntax: mmm dir/:target1,target2.
-- mma:        Builds all of the modules in the current directory, and their dependencies.
-- mmma:       Builds all of the modules in the supplied directories, and their dependencies.
+- mma:        Same as 'mm'
+- mmma:       Same as 'mmm'
 - provision:  Flash device with all required partitions. Options will be passed on to fastboot.
 - cgrep:      Greps on all local C/C++ files.
 - ggrep:      Greps on all local Gradle files.
+- gogrep:     Greps on all local Go files.
 - jgrep:      Greps on all local Java files.
 - resgrep:    Greps on all local res/*.xml files.
 - mangrep:    Greps on all local AndroidManifest.xml files.
-- mgrep:      Greps on all local Makefiles files.
+- mgrep:      Greps on all local Makefiles and *.bp files.
+- owngrep:    Greps on all local OWNERS files.
 - sepgrep:    Greps on all local sepolicy files.
 - sgrep:      Greps on all local source files.
 - godir:      Go to the directory containing a file.
@@ -32,9 +36,7 @@
 - refreshmod: Refresh list of modules for allmod/gomod.
 
 Environment options:
-- SANITIZE_HOST: Set to 'true' to use ASAN for all host modules. Note that
-                 ASAN_OPTIONS=detect_leaks=0 will be set by default until the
-                 build is leak-check clean.
+- SANITIZE_HOST: Set to 'address' to use ASAN for all host modules.
 - ANDROID_QUIET_BUILD: set to 'true' to display only the essential messages.
 
 Look at the source to view more functions. The complete list is:
@@ -246,8 +248,14 @@
     if [ -n "$ANDROID_TOOLCHAIN_2ND_ARCH" ]; then
         ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_TOOLCHAIN_2ND_ARCH
     fi
-    ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_DEV_SCRIPTS:
-    export ANDROID_BUILD_PATHS
+    ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_DEV_SCRIPTS
+
+    # Append llvm binutils prebuilts path to ANDROID_BUILD_PATHS.
+    local ANDROID_LLVM_BINUTILS=$(get_abs_build_var ANDROID_CLANG_PREBUILTS)/llvm-binutils-stable
+    ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_LLVM_BINUTILS
+
+    # Set up ASAN_SYMBOLIZER_PATH for SANITIZE_HOST=address builds.
+    export ASAN_SYMBOLIZER_PATH=$ANDROID_LLVM_BINUTILS/llvm-symbolizer
 
     # If prebuilts/android-emulator/<system>/ exists, prepend it to our PATH
     # to ensure that the corresponding 'emulator' binaries are used.
@@ -263,16 +271,16 @@
             ;;
     esac
     if [ -n "$ANDROID_EMULATOR_PREBUILTS" -a -d "$ANDROID_EMULATOR_PREBUILTS" ]; then
-        ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS$ANDROID_EMULATOR_PREBUILTS:
+        ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_EMULATOR_PREBUILTS
         export ANDROID_EMULATOR_PREBUILTS
     fi
 
     # Append asuite prebuilts path to ANDROID_BUILD_PATHS.
     local os_arch=$(get_build_var HOST_PREBUILT_TAG)
-    local ACLOUD_PATH="$T/prebuilts/asuite/acloud/$os_arch:"
-    local AIDEGEN_PATH="$T/prebuilts/asuite/aidegen/$os_arch:"
-    local ATEST_PATH="$T/prebuilts/asuite/atest/$os_arch:"
-    export ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS$ACLOUD_PATH$AIDEGEN_PATH$ATEST_PATH
+    local ACLOUD_PATH="$T/prebuilts/asuite/acloud/$os_arch"
+    local AIDEGEN_PATH="$T/prebuilts/asuite/aidegen/$os_arch"
+    local ATEST_PATH="$T/prebuilts/asuite/atest/$os_arch"
+    export ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ACLOUD_PATH:$AIDEGEN_PATH:$ATEST_PATH:
 
     export PATH=$ANDROID_BUILD_PATHS$PATH
 
@@ -282,6 +290,9 @@
     fi
     # and in with the new
     export ANDROID_PYTHONPATH=$T/development/python-packages:
+    if [ -n $VENDOR_PYTHONPATH  ]; then
+        ANDROID_PYTHONPATH=$ANDROID_PYTHONPATH$VENDOR_PYTHONPATH
+    fi
     export PYTHONPATH=$ANDROID_PYTHONPATH$PYTHONPATH
 
     export ANDROID_JAVA_HOME=$(get_abs_build_var ANDROID_JAVA_HOME)
@@ -326,7 +337,6 @@
     export ANDROID_BUILD_TOP=$(gettop)
     # With this environment variable new GCC can apply colors to warnings/errors
     export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
-    export ASAN_OPTIONS=detect_leaks=0
 }
 
 function set_sequence_number()
@@ -520,7 +530,7 @@
             export TARGET_BUILD_VARIANT=$default_value
         elif (echo -n $ANSWER | grep -q -e "^[0-9][0-9]*$") ; then
             if [ "$ANSWER" -le "${#VARIANT_CHOICES[@]}" ] ; then
-                export TARGET_BUILD_VARIANT=${VARIANT_CHOICES[$(($ANSWER-1))]}
+                export TARGET_BUILD_VARIANT=${VARIANT_CHOICES[@]:$(($ANSWER-1)):1}
             fi
         else
             if check_variant $ANSWER
@@ -568,6 +578,7 @@
 function print_lunch_menu()
 {
     local uname=$(uname)
+    local choices=$(TARGET_BUILD_APPS= get_build_var COMMON_LUNCH_CHOICES)
     echo
     echo "You're building on" $uname
     echo
@@ -575,7 +586,7 @@
 
     local i=1
     local choice
-    for choice in $(TARGET_BUILD_APPS= get_build_var COMMON_LUNCH_CHOICES)
+    for choice in $(echo $choices)
     do
         echo "     $i. $choice"
         i=$(($i+1))
@@ -765,218 +776,6 @@
     fi
 }
 
-function m()
-{
-    local T=$(gettop)
-    if [ "$T" ]; then
-        _wrap_build $T/build/soong/soong_ui.bash --make-mode $@
-    else
-        echo "Couldn't locate the top of the tree.  Try setting TOP."
-        return 1
-    fi
-}
-
-function findmakefile()
-{
-    local TOPFILE=build/make/core/envsetup.mk
-    local HERE=$PWD
-    if [ "$1" ]; then
-        \cd $1
-    fi;
-    local T=
-    while [ \( ! \( -f $TOPFILE \) \) -a \( $PWD != "/" \) ]; do
-        T=`PWD= /bin/pwd`
-        if [ -f "$T/Android.mk" -o -f "$T/Android.bp" ]; then
-            echo $T/Android.mk
-            \cd $HERE
-            return
-        fi
-        \cd ..
-    done
-    \cd $HERE
-    return 1
-}
-
-function mm()
-{
-    local T=$(gettop)
-    # If we're sitting in the root of the build tree, just do a
-    # normal build.
-    if [ -f build/soong/soong_ui.bash ]; then
-        _wrap_build $T/build/soong/soong_ui.bash --make-mode $@
-    else
-        # Find the closest Android.mk file.
-        local M=$(findmakefile)
-        local MODULES=
-        local GET_INSTALL_PATH=
-        local ARGS=
-        # Remove the path to top as the makefilepath needs to be relative
-        local M=`echo $M|sed 's:'$T'/::'`
-        if [ ! "$T" ]; then
-            echo "Couldn't locate the top of the tree.  Try setting TOP."
-            return 1
-        elif [ ! "$M" ]; then
-            echo "Couldn't locate a makefile from the current directory."
-            return 1
-        else
-            local ARG
-            for ARG in $@; do
-                case $ARG in
-                  GET-INSTALL-PATH) GET_INSTALL_PATH=$ARG;;
-                esac
-            done
-            if [ -n "$GET_INSTALL_PATH" ]; then
-              MODULES=
-              ARGS=GET-INSTALL-PATH-IN-$(dirname ${M})
-              ARGS=${ARGS//\//-}
-            else
-              MODULES=MODULES-IN-$(dirname ${M})
-              # Convert "/" to "-".
-              MODULES=${MODULES//\//-}
-              ARGS=$@
-            fi
-            if [ "1" = "${WITH_TIDY_ONLY}" -o "true" = "${WITH_TIDY_ONLY}" ]; then
-              MODULES=tidy_only
-            fi
-            ONE_SHOT_MAKEFILE=$M _wrap_build $T/build/soong/soong_ui.bash --make-mode $MODULES $ARGS
-        fi
-    fi
-}
-
-function mmm()
-{
-    local T=$(gettop)
-    if [ "$T" ]; then
-        local MAKEFILE=
-        local MODULES=
-        local MODULES_IN_PATHS=
-        local ARGS=
-        local DIR TO_CHOP
-        local DIR_MODULES
-        local GET_INSTALL_PATH=
-        local GET_INSTALL_PATHS=
-        local DASH_ARGS=$(echo "$@" | awk -v RS=" " -v ORS=" " '/^-.*$/')
-        local DIRS=$(echo "$@" | awk -v RS=" " -v ORS=" " '/^[^-].*$/')
-        for DIR in $DIRS ; do
-            DIR_MODULES=`echo $DIR | sed -n -e 's/.*:\(.*$\)/\1/p' | sed 's/,/ /'`
-            DIR=`echo $DIR | sed -e 's/:.*//' -e 's:/$::'`
-            # Remove the leading ./ and trailing / if any exists.
-            DIR=${DIR#./}
-            DIR=${DIR%/}
-            local M
-            if [ "$DIR_MODULES" = "" ]; then
-                M=$(findmakefile $DIR)
-            else
-                # Only check the target directory if a module is specified.
-                if [ -f $DIR/Android.mk -o -f $DIR/Android.bp ]; then
-                    local HERE=$PWD
-                    cd $DIR
-                    M=`PWD= /bin/pwd`
-                    M=$M/Android.mk
-                    cd $HERE
-                fi
-            fi
-            if [ "$M" ]; then
-                # Remove the path to top as the makefilepath needs to be relative
-                local M=`echo $M|sed 's:'$T'/::'`
-                if [ "$DIR_MODULES" = "" ]; then
-                    MODULES_IN_PATHS="$MODULES_IN_PATHS MODULES-IN-$(dirname ${M})"
-                    GET_INSTALL_PATHS="$GET_INSTALL_PATHS GET-INSTALL-PATH-IN-$(dirname ${M})"
-                else
-                    MODULES="$MODULES $DIR_MODULES"
-                fi
-                MAKEFILE="$MAKEFILE $M"
-            else
-                case $DIR in
-                  showcommands | snod | dist | *=*) ARGS="$ARGS $DIR";;
-                  GET-INSTALL-PATH) GET_INSTALL_PATH=$DIR;;
-                  *) if [ -d $DIR ]; then
-                         echo "No Android.mk in $DIR.";
-                     else
-                         echo "Couldn't locate the directory $DIR";
-                     fi
-                     return 1;;
-                esac
-            fi
-        done
-        if [ -n "$GET_INSTALL_PATH" ]; then
-          ARGS=${GET_INSTALL_PATHS//\//-}
-          MODULES=
-          MODULES_IN_PATHS=
-        fi
-        if [ "1" = "${WITH_TIDY_ONLY}" -o "true" = "${WITH_TIDY_ONLY}" ]; then
-          MODULES=tidy_only
-          MODULES_IN_PATHS=
-        fi
-        # Convert "/" to "-".
-        MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-        ONE_SHOT_MAKEFILE="$MAKEFILE" _wrap_build $T/build/soong/soong_ui.bash --make-mode $DASH_ARGS $MODULES $MODULES_IN_PATHS $ARGS
-    else
-        echo "Couldn't locate the top of the tree.  Try setting TOP."
-        return 1
-    fi
-}
-
-function mma()
-{
-  local T=$(gettop)
-  if [ -f build/soong/soong_ui.bash ]; then
-    _wrap_build $T/build/soong/soong_ui.bash --make-mode $@
-  else
-    if [ ! "$T" ]; then
-      echo "Couldn't locate the top of the tree.  Try setting TOP."
-      return 1
-    fi
-    local M=$(findmakefile || echo $(realpath $PWD)/Android.mk)
-    # Remove the path to top as the makefilepath needs to be relative
-    local M=`echo $M|sed 's:'$T'/::'`
-    local MODULES_IN_PATHS=MODULES-IN-$(dirname ${M})
-    # Convert "/" to "-".
-    MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-    _wrap_build $T/build/soong/soong_ui.bash --make-mode $@ $MODULES_IN_PATHS
-  fi
-}
-
-function mmma()
-{
-  local T=$(gettop)
-  if [ "$T" ]; then
-    local DASH_ARGS=$(echo "$@" | awk -v RS=" " -v ORS=" " '/^-.*$/')
-    local DIRS=$(echo "$@" | awk -v RS=" " -v ORS=" " '/^[^-].*$/')
-    local MY_PWD=`PWD= /bin/pwd`
-    if [ "$MY_PWD" = "$T" ]; then
-      MY_PWD=
-    else
-      MY_PWD=`echo $MY_PWD|sed 's:'$T'/::'`
-    fi
-    local DIR=
-    local MODULES_IN_PATHS=
-    local ARGS=
-    for DIR in $DIRS ; do
-      if [ -d $DIR ]; then
-        # Remove the leading ./ and trailing / if any exists.
-        DIR=${DIR#./}
-        DIR=${DIR%/}
-        if [ "$MY_PWD" != "" ]; then
-          DIR=$MY_PWD/$DIR
-        fi
-        MODULES_IN_PATHS="$MODULES_IN_PATHS MODULES-IN-$DIR"
-      else
-        case $DIR in
-          showcommands | snod | dist | *=*) ARGS="$ARGS $DIR";;
-          *) echo "Couldn't find directory $DIR"; return 1;;
-        esac
-      fi
-    done
-    # Convert "/" to "-".
-    MODULES_IN_PATHS=${MODULES_IN_PATHS//\//-}
-    _wrap_build $T/build/soong/soong_ui.bash --make-mode $DASH_ARGS $ARGS $MODULES_IN_PATHS
-  else
-    echo "Couldn't locate the top of the tree.  Try setting TOP."
-    return 1
-  fi
-}
-
 function croot()
 {
     local T=$(gettop)
@@ -1175,6 +974,12 @@
         -exec grep --color -n "$@" {} +
 }
 
+function gogrep()
+{
+    find . -name .repo -prune -o -name .git -prune -o -name out -prune -o -type f -name "*\.go" \
+        -exec grep --color -n "$@" {} +
+}
+
 function jgrep()
 {
     find . -name .repo -prune -o -name .git -prune -o -name out -prune -o -type f -name "*\.java" \
@@ -1201,6 +1006,12 @@
         -exec grep --color -n "$@" {} +
 }
 
+function owngrep()
+{
+    find . -name .repo -prune -o -name .git -prune -o -path ./out -prune -o -type f -name 'OWNERS' \
+        -exec grep --color -n "$@" {} +
+}
+
 function sepgrep()
 {
     find . -name .repo -prune -o -name .git -prune -o -path ./out -prune -o -name sepolicy -type d \
@@ -1217,7 +1028,7 @@
     Darwin)
         function mgrep()
         {
-            find -E . -name .repo -prune -o -name .git -prune -o -path ./out -prune -o \( -iregex '.*/(Makefile|Makefile\..*|.*\.make|.*\.mak|.*\.mk|.*\.bp)' -o -regex '(.*/)?soong/[^/]*.go' \) -type f \
+            find -E . -name .repo -prune -o -name .git -prune -o -path ./out -prune -o \( -iregex '.*/(Makefile|Makefile\..*|.*\.make|.*\.mak|.*\.mk|.*\.bp)' -o -regex '(.*/)?(build|soong)/.*[^/]*\.go' \) -type f \
                 -exec grep --color -n "$@" {} +
         }
 
@@ -1231,7 +1042,7 @@
     *)
         function mgrep()
         {
-            find . -name .repo -prune -o -name .git -prune -o -path ./out -prune -o \( -regextype posix-egrep -iregex '(.*\/Makefile|.*\/Makefile\..*|.*\.make|.*\.mak|.*\.mk|.*\.bp)' -o -regextype posix-extended -regex '(.*/)?soong/[^/]*.go' \) -type f \
+            find . -name .repo -prune -o -name .git -prune -o -path ./out -prune -o \( -regextype posix-egrep -iregex '(.*\/Makefile|.*\/Makefile\..*|.*\.make|.*\.mak|.*\.mk|.*\.bp)' -o -regextype posix-extended -regex '(.*/)?(build|soong)/.*[^/]*\.go' \) -type f \
                 -exec grep --color -n "$@" {} +
         }
 
@@ -1496,10 +1307,10 @@
                 echo "Invalid choice"
                 continue
             fi
-            pathname=${lines[$(($choice-1))]}
+            pathname=${lines[@]:$(($choice-1)):1}
         done
     else
-        pathname=${lines[0]}
+        pathname=${lines[@]:0:1}
     fi
     \cd $T/$pathname
 }
@@ -1534,7 +1345,7 @@
         refreshmod || return 1
     fi
 
-    python -c "import json; print '\n'.join(sorted(json.load(open('$ANDROID_PRODUCT_OUT/module-info.json')).keys()))"
+    python -c "import json; print('\n'.join(sorted(json.load(open('$ANDROID_PRODUCT_OUT/module-info.json')).keys())))"
 }
 
 # Get the path of a specific module in the android tree, as cached in module-info.json. If any build change
@@ -1560,7 +1371,7 @@
 module_info = json.load(open('$ANDROID_PRODUCT_OUT/module-info.json'))
 if module not in module_info:
     exit(1)
-print module_info[module]['path'][0]" 2>/dev/null)
+print(module_info[module]['path'][0])" 2>/dev/null)
 
     if [ -z "$relpath" ]; then
         echo "Could not find module '$1' (try 'refreshmod' if there have been build changes?)." >&2
@@ -1662,6 +1473,41 @@
     return $ret
 }
 
+function _trigger_build()
+(
+    local -r bc="$1"; shift
+    if T="$(gettop)"; then
+      _wrap_build "$T/build/soong/soong_ui.bash" --build-mode --${bc} --dir="$(pwd)" "$@"
+    else
+      echo "Couldn't locate the top of the tree. Try setting TOP."
+    fi
+)
+
+function m()
+(
+    _trigger_build "all-modules" "$@"
+)
+
+function mm()
+(
+    _trigger_build "modules-in-a-dir-no-deps" "$@"
+)
+
+function mmm()
+(
+    _trigger_build "modules-in-dirs-no-deps" "$@"
+)
+
+function mma()
+(
+    _trigger_build "modules-in-a-dir" "$@"
+)
+
+function mmma()
+(
+    _trigger_build "modules-in-dirs" "$@"
+)
+
 function make()
 {
     _wrap_build $(get_make_command "$@") "$@"
@@ -1726,6 +1572,7 @@
 #
 # This allows loading only approved vendorsetup.sh files
 function source_vendorsetup() {
+    unset VENDOR_PYTHONPATH
     allowed=
     for f in $(find -L device vendor product -maxdepth 4 -name 'allowed-vendorsetup_sh-files' 2>/dev/null | sort); do
         if [ -n "$allowed" ]; then
diff --git a/help.sh b/help.sh
index be07344..b02b14c 100755
--- a/help.sh
+++ b/help.sh
@@ -40,8 +40,8 @@
                             Stands for "Vendor, NO Dependencies"
     pnod                    Quickly rebuild the product image from built packages
                             Stands for "Product, NO Dependencies"
-    psnod                   Quickly rebuild the product_services image from built packages
-                            Stands for "ProductServices, NO Dependencies"
+    senod                   Quickly rebuild the system_ext image from built packages
+                            Stands for "SystemExt, NO Dependencies"
     onod                    Quickly rebuild the odm image from built packages
                             Stands for "ODM, NO Dependencies"
 
diff --git a/rbesetup.sh b/rbesetup.sh
index da257b9..8f65b29 100644
--- a/rbesetup.sh
+++ b/rbesetup.sh
@@ -31,8 +31,9 @@
 # for the build to be executed with RBE.
 function use_rbe() {
   local RBE_LOG_DIR="/tmp"
-  local RBE_BINARIES_DIR="prebuilts/remoteexecution-client/latest"
+  local RBE_BINARIES_DIR="prebuilts/remoteexecution-client/latest/"
   local DOCKER_IMAGE="gcr.io/androidbuild-re-dockerimage/android-build-remoteexec-image@sha256:582efb38f0c229ea39952fff9e132ccbe183e14869b39888010dacf56b360d62"
+
   # Do not set an invocation-ID and let reproxy auto-generate one.
   USE_RBE="true" \
   FLAG_server_address="unix:///tmp/reproxy_$RANDOM.sock" \
@@ -49,6 +50,7 @@
   RBE_re_proxy="${RBE_BINARIES_DIR}/reproxy" \
   $@
 }
+
 # This function detects if the uploader is available and sets the path of it to
 # ANDROID_ENABLE_METRICS_UPLOAD.
 function _export_metrics_uploader() {
@@ -57,10 +59,10 @@
     export ANDROID_ENABLE_METRICS_UPLOAD="${uploader_path}"
   fi
 }
+
 # This function sets RBE specific environment variables needed for the build to
 # executed by RBE. This file should be sourced once per checkout of Android code.
 function _set_rbe_vars() {
-  unset USE_GOMA
   export USE_RBE="true"
   export RBE_CXX_EXEC_STRATEGY="racing"
   export RBE_JAVAC_EXEC_STRATEGY="racing"
@@ -71,5 +73,6 @@
   export RBE_R8=1
   export RBE_D8=1
 }
+
 _export_metrics_uploader
 _set_rbe_vars
diff --git a/target/board/Android.mk b/target/board/Android.mk
index 971a7b2..9edc85c 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -19,7 +19,7 @@
 ifndef board_info_txt
 board_info_txt := $(wildcard $(TARGET_DEVICE_DIR)/board-info.txt)
 endif
-$(INSTALLED_ANDROID_INFO_TXT_TARGET): $(board_info_txt)
+$(INSTALLED_ANDROID_INFO_TXT_TARGET): $(board_info_txt) build/make/tools/check_radio_versions.py
 	$(hide) build/make/tools/check_radio_versions.py $< $(BOARD_INFO_CHECK)
 	$(call pretty,"Generated: ($@)")
 ifdef board_info_txt
@@ -34,7 +34,7 @@
 ifdef DEVICE_MANIFEST_FILE
 # $(DEVICE_MANIFEST_FILE) can be a list of files
 include $(CLEAR_VARS)
-LOCAL_MODULE        := device_manifest.xml
+LOCAL_MODULE        := vendor_manifest.xml
 LOCAL_MODULE_STEM   := manifest.xml
 LOCAL_MODULE_CLASS  := ETC
 LOCAL_MODULE_PATH   := $(TARGET_OUT_VENDOR)/etc/vintf
@@ -50,9 +50,45 @@
 
 LOCAL_PREBUILT_MODULE_FILE := $(GEN)
 include $(BUILD_PREBUILT)
-BUILT_VENDOR_MANIFEST := $(LOCAL_BUILT_MODULE)
 endif
 
+# DEVICE_MANIFEST_SKUS: a list of SKUS where DEVICE_MANIFEST_<sku>_FILES is defined.
+ifdef DEVICE_MANIFEST_SKUS
+
+# Install /vendor/etc/vintf/manifest_$(sku).xml
+# $(1): sku
+define _add_device_sku_manifest
+my_fragment_files_var := DEVICE_MANIFEST_$$(call to-upper,$(1))_FILES
+ifndef $$(my_fragment_files_var)
+$$(error $(1) is in DEVICE_MANIFEST_SKUS but $$(my_fragment_files_var) is not defined)
+endif
+my_fragment_files := $$($$(my_fragment_files_var))
+include $$(CLEAR_VARS)
+LOCAL_MODULE := vendor_manifest_$(1).xml
+LOCAL_MODULE_STEM := manifest_$(1).xml
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_PATH   := $(TARGET_OUT_VENDOR)/etc/vintf
+
+GEN := $$(local-generated-sources-dir)/manifest_$(1).xml
+$$(GEN): PRIVATE_SRC_FILES := $$(my_fragment_files)
+$$(GEN): $$(my_fragment_files) $$(HOST_OUT_EXECUTABLES)/assemble_vintf
+	BOARD_SEPOLICY_VERS=$$(BOARD_SEPOLICY_VERS) \
+	PRODUCT_ENFORCE_VINTF_MANIFEST=$$(PRODUCT_ENFORCE_VINTF_MANIFEST) \
+	PRODUCT_SHIPPING_API_LEVEL=$$(PRODUCT_SHIPPING_API_LEVEL) \
+	$$(HOST_OUT_EXECUTABLES)/assemble_vintf -o $$@ \
+		-i $$(call normalize-path-list,$$(PRIVATE_SRC_FILES))
+
+LOCAL_PREBUILT_MODULE_FILE := $$(GEN)
+include $$(BUILD_PREBUILT)
+my_fragment_files_var :=
+my_fragment_files :=
+endef
+
+$(foreach sku, $(DEVICE_MANIFEST_SKUS), $(eval $(call _add_device_sku_manifest,$(sku))))
+_add_device_sku_manifest :=
+
+endif # DEVICE_MANIFEST_SKUS
+
 # ODM manifest
 ifdef ODM_MANIFEST_FILES
 # ODM_MANIFEST_FILES is a list of files that is combined and installed as the default ODM manifest.
diff --git a/target/board/BoardConfigEmuCommon.mk b/target/board/BoardConfigEmuCommon.mk
index 3ab5f12..e9fb096 100644
--- a/target/board/BoardConfigEmuCommon.mk
+++ b/target/board/BoardConfigEmuCommon.mk
@@ -7,6 +7,9 @@
 BOARD_USES_GENERIC_AUDIO := true
 TARGET_BOOTLOADER_BOARD_NAME := goldfish_$(TARGET_ARCH)
 
+# No Kernel
+TARGET_NO_KERNEL := true
+
 # no hardware camera
 USE_CAMERA_STUB := true
 
@@ -30,17 +33,36 @@
   # emulator needs super.img
   BOARD_BUILD_SUPER_IMAGE_BY_DEFAULT := true
 
-  BOARD_EXT4_SHARE_DUP_BLOCKS := true
-
   # 3G + header
   BOARD_SUPER_PARTITION_SIZE := 3229614080
   BOARD_SUPER_PARTITION_GROUPS := emulator_dynamic_partitions
-  BOARD_EMULATOR_DYNAMIC_PARTITIONS_PARTITION_LIST := \
-      system \
-      vendor
+
+  ifeq ($(QEMU_USE_SYSTEM_EXT_PARTITIONS),true)
+    BOARD_EMULATOR_DYNAMIC_PARTITIONS_PARTITION_LIST := \
+        system \
+        system_ext \
+        product \
+        vendor
+
+    TARGET_COPY_OUT_PRODUCT := product
+    BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
+    TARGET_COPY_OUT_SYSTEM_EXT := system_ext
+    BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+  else
+    TARGET_COPY_OUT_PRODUCT := system/product
+    TARGET_COPY_OUT_SYSTEM_EXT := system/system_ext
+    BOARD_EMULATOR_DYNAMIC_PARTITIONS_PARTITION_LIST := \
+        system \
+        vendor
+  endif
 
   # 3G
   BOARD_EMULATOR_DYNAMIC_PARTITIONS_SIZE := 3221225472
+
+  # in build environment to speed up make -j
+  ifeq ($(QEMU_DISABLE_AVB),true)
+    BOARD_AVB_ENABLE := false
+  endif
 else ifeq ($(PRODUCT_USE_DYNAMIC_PARTITION_SIZE),true)
   # Enable dynamic system image size and reserved 64MB in it.
   BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE := 67108864
@@ -50,6 +72,19 @@
   BOARD_VENDORIMAGE_PARTITION_SIZE := 146800640
 endif
 
+#vendor boot
+TARGET_NO_VENDOR_BOOT := false
+BOARD_INCLUDE_DTB_IN_BOOTIMG := false
+BOARD_BOOT_HEADER_VERSION := 3
+BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
+BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE := 0x06000000
+
+# Enable chain partition for system.
+BOARD_AVB_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
+BOARD_AVB_SYSTEM_ALGORITHM := SHA256_RSA2048
+BOARD_AVB_SYSTEM_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)
+BOARD_AVB_SYSTEM_ROLLBACK_INDEX_LOCATION := 1
+
 BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
 BOARD_FLASH_BLOCK_SIZE := 512
 DEVICE_MATRIX_FILE   := device/generic/goldfish/compatibility_matrix.xml
diff --git a/target/board/BoardConfigGsiCommon.mk b/target/board/BoardConfigGsiCommon.mk
index 702ef3c..49f6edc 100644
--- a/target/board/BoardConfigGsiCommon.mk
+++ b/target/board/BoardConfigGsiCommon.mk
@@ -19,8 +19,9 @@
 # Enable dynamic system image size and reserved 64MB in it.
 BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE := 67108864
 
-# GSI forces product packages to /system for now.
+# GSI forces product and system_ext packages to /system for now.
 TARGET_COPY_OUT_PRODUCT := system/product
+TARGET_COPY_OUT_SYSTEM_EXT := system/system_ext
 BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE :=
 
 # Creates metadata partition mount point under root for
@@ -33,16 +34,23 @@
 BOARD_AVB_ROLLBACK_INDEX := 0
 
 # Enable chain partition for system.
+# GSI need to sign on system.img instead of vbmeta.
 BOARD_AVB_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
 BOARD_AVB_SYSTEM_ALGORITHM := SHA256_RSA2048
 BOARD_AVB_SYSTEM_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)
 BOARD_AVB_SYSTEM_ROLLBACK_INDEX_LOCATION := 1
 
+# Enable chain partition for boot, mainly for GKI images.
+BOARD_AVB_BOOT_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
+BOARD_AVB_BOOT_ALGORITHM := SHA256_RSA2048
+BOARD_AVB_BOOT_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)
+BOARD_AVB_BOOT_ROLLBACK_INDEX_LOCATION := 2
+
 # GSI specific System Properties
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
-TARGET_SYSTEM_PROP := build/make/target/board/gsi_system.prop
+TARGET_SYSTEM_EXT_PROP := build/make/target/board/gsi_system_ext.prop
 else
-TARGET_SYSTEM_PROP := build/make/target/board/gsi_system_user.prop
+TARGET_SYSTEM_EXT_PROP := build/make/target/board/gsi_system_ext_user.prop
 endif
 
 # Set this to create /cache mount point for non-A/B devices that mounts /cache.
@@ -55,7 +63,3 @@
 
 # Disable 64 bit mediadrmserver
 TARGET_ENABLE_MEDIADRM_64 :=
-
-# Ordinary (non-flattened) APEX may require kernel changes. For maximum compatibility,
-# use flattened APEX for GSI
-TARGET_FLATTEN_APEX := true
diff --git a/target/board/BoardConfigMainlineCommon.mk b/target/board/BoardConfigMainlineCommon.mk
index 6c56671..bf015e5 100644
--- a/target/board/BoardConfigMainlineCommon.mk
+++ b/target/board/BoardConfigMainlineCommon.mk
@@ -6,12 +6,19 @@
 TARGET_NO_BOOTLOADER := true
 TARGET_NO_RECOVERY := true
 
+BOARD_EXT4_SHARE_DUP_BLOCKS := true
+
 TARGET_USERIMAGES_USE_EXT4 := true
 
-# Mainline devices must have /vendor and /product partitions.
+# Mainline devices must have /system_ext, /vendor and /product partitions.
+TARGET_COPY_OUT_SYSTEM_EXT := system_ext
 TARGET_COPY_OUT_VENDOR := vendor
 TARGET_COPY_OUT_PRODUCT := product
 
+# Creates metadata partition mount point under root for
+# the devices with metadata parition
+BOARD_USES_METADATA_PARTITION := true
+
 BOARD_VNDK_VERSION := current
 
 # Required flag for non-64 bit devices from P.
@@ -36,11 +43,8 @@
 
 BOARD_CHARGER_ENABLE_SUSPEND := true
 
-# Enable A/B update
-AB_OTA_UPDATER := true
-
 # Enable system property split for Treble
 BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true
 
-# Generate an APEX image for experiment b/119800099.
-DEXPREOPT_GENERATE_APEX_IMAGE := true
+# Include stats logging code in LMKD
+TARGET_LMKD_STATS_LOG := true
diff --git a/target/board/emulator_arm64/BoardConfig.mk b/target/board/emulator_arm64/BoardConfig.mk
new file mode 100644
index 0000000..b34ccb4
--- /dev/null
+++ b/target/board/emulator_arm64/BoardConfig.mk
@@ -0,0 +1,77 @@
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# arm64 emulator specific definitions
+TARGET_ARCH := arm64
+TARGET_ARCH_VARIANT := armv8-a
+TARGET_CPU_VARIANT := generic
+TARGET_CPU_ABI := arm64-v8a
+
+TARGET_2ND_ARCH := arm
+TARGET_2ND_CPU_ABI := armeabi-v7a
+TARGET_2ND_CPU_ABI2 := armeabi
+
+ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk vts10,$(MAKECMDGOALS)),)
+# DO NOT USE
+# DO NOT USE
+#
+# This architecture / CPU variant must NOT be used for any 64 bit
+# platform builds. It is the lowest common denominator required
+# to build an unbundled application or cts for all supported 32 and 64 bit
+# platforms.
+#
+# If you're building a 64 bit platform (and not an application) the
+# ARM-v8 specification allows you to assume all the features available in an
+# armv7-a-neon CPU. You should set the following as 2nd arch/cpu variant:
+#
+# TARGET_2ND_ARCH_VARIANT := armv8-a
+# TARGET_2ND_CPU_VARIANT := generic
+#
+# DO NOT USE
+# DO NOT USE
+TARGET_2ND_ARCH_VARIANT := armv7-a-neon
+# DO NOT USE
+# DO NOT USE
+TARGET_2ND_CPU_VARIANT := generic
+# DO NOT USE
+# DO NOT USE
+else
+TARGET_2ND_ARCH_VARIANT := armv8-a
+TARGET_2ND_CPU_VARIANT := generic
+endif
+
+include build/make/target/board/BoardConfigGsiCommon.mk
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+TARGET_NO_KERNEL := false
+TARGET_NO_VENDOR_BOOT := false
+BOARD_USES_RECOVERY_AS_BOOT := true
+
+BOARD_BOOTIMAGE_PARTITION_SIZE := 0x02000000
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
+
+BOARD_BOOT_HEADER_VERSION := 3
+BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
diff --git a/target/board/emulator_arm64/device.mk b/target/board/emulator_arm64/device.mk
new file mode 100644
index 0000000..57675d0
--- /dev/null
+++ b/target/board/emulator_arm64/device.mk
@@ -0,0 +1,32 @@
+#
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
+# Cuttlefish has GKI kernel prebuilts, so use those for the GKI boot.img.
+ifeq ($(TARGET_PREBUILT_KERNEL),)
+    LOCAL_KERNEL := device/google/cuttlefish_kernel/5.4-arm64/kernel
+else
+    LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL)
+endif
+
+PRODUCT_COPY_FILES += \
+    $(LOCAL_KERNEL):kernel
+
+# Adjust the Dalvik heap to be appropriate for a tablet.
+$(call inherit-product-if-exists, frameworks/base/build/tablet-dalvik-heap.mk)
+$(call inherit-product-if-exists, frameworks/native/build/tablet-dalvik-heap.mk)
diff --git a/target/board/emulator_arm64/system_ext.prop b/target/board/emulator_arm64/system_ext.prop
new file mode 100644
index 0000000..2f8f803
--- /dev/null
+++ b/target/board/emulator_arm64/system_ext.prop
@@ -0,0 +1,5 @@
+#
+# system.prop for emulator arm64 sdk
+#
+
+rild.libpath=/vendor/lib64/libreference-ril.so
diff --git a/target/board/generic/device.mk b/target/board/generic/device.mk
index 0a32415..cfb15f0 100644
--- a/target/board/generic/device.mk
+++ b/target/board/generic/device.mk
@@ -14,6 +14,9 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
 # NFC:
 #   Provide default libnfc-nci.conf file for devices that does not have one in
 #   vendor/etc because aosp system image (of aosp_$arch products) is going to
diff --git a/target/board/generic/system.prop b/target/board/generic/system_ext.prop
similarity index 100%
rename from target/board/generic/system.prop
rename to target/board/generic/system_ext.prop
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index f07adb7..ba69623 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -23,7 +23,7 @@
 TARGET_2ND_CPU_ABI := armeabi-v7a
 TARGET_2ND_CPU_ABI2 := armeabi
 
-ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk vts,$(MAKECMDGOALS)),)
+ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk vts10,$(MAKECMDGOALS)),)
 # DO NOT USE
 # DO NOT USE
 #
@@ -53,12 +53,25 @@
 endif
 
 include build/make/target/board/BoardConfigGsiCommon.mk
-include build/make/target/board/BoardConfigEmuCommon.mk
 
+TARGET_NO_KERNEL := false
+TARGET_NO_VENDOR_BOOT := true
+BOARD_USES_RECOVERY_AS_BOOT := true
+
+BOARD_KERNEL-4.19-GZ_BOOTIMAGE_PARTITION_SIZE := 47185920
+BOARD_KERNEL-5.4_BOOTIMAGE_PARTITION_SIZE := 67108864
+BOARD_KERNEL-5.4-GZ_BOOTIMAGE_PARTITION_SIZE := 47185920
+BOARD_KERNEL-5.4-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
 BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
 
-# Emulator system image is going to be used as GSI and some vendor still hasn't
-# cleaned up all device specific directories under root!
+BOARD_RAMDISK_USE_LZ4 := true
+BOARD_BOOT_HEADER_VERSION := 3
+BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
+
+BOARD_KERNEL_BINARIES := kernel-4.19-gz kernel-5.4 kernel-5.4-gz kernel-5.4-lz4
+
+# Some vendors still haven't cleaned up all device specific directories under
+# root!
 
 # TODO(b/111434759, b/111287060) SoC specific hacks
 BOARD_ROOT_EXTRA_SYMLINKS += /vendor/lib/dsp:/dsp
@@ -67,15 +80,4 @@
 
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
-BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
-
-# Wifi.
-BOARD_WLAN_DEVICE           := emulator
-BOARD_HOSTAPD_DRIVER        := NL80211
-BOARD_WPA_SUPPLICANT_DRIVER := NL80211
-BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
-BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
-WPA_SUPPLICANT_VERSION      := VER_0_8_X
-WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
-WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
-WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
+BOARD_SEPOLICY_DIRS += build/make/target/board/generic_arm64/sepolicy
diff --git a/target/board/generic_arm64/device.mk b/target/board/generic_arm64/device.mk
index e5d8e61..d96bfc2 100644
--- a/target/board/generic_arm64/device.mk
+++ b/target/board/generic_arm64/device.mk
@@ -14,6 +14,12 @@
 # limitations under the License.
 #
 
+PRODUCT_COPY_FILES += \
+    kernel/prebuilts/4.19/arm64/Image.gz:kernel-4.19-gz \
+    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4:kernel-5.4 \
+    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-gz:kernel-5.4-gz \
+    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-lz4:kernel-5.4-lz4
+
 # Adjust the Dalvik heap to be appropriate for a tablet.
 $(call inherit-product-if-exists, frameworks/base/build/tablet-dalvik-heap.mk)
 $(call inherit-product-if-exists, frameworks/native/build/tablet-dalvik-heap.mk)
diff --git a/target/board/generic_arm64_ab/sepolicy/OWNERS b/target/board/generic_arm64/sepolicy/OWNERS
similarity index 100%
rename from target/board/generic_arm64_ab/sepolicy/OWNERS
rename to target/board/generic_arm64/sepolicy/OWNERS
diff --git a/target/board/generic_arm64_ab/sepolicy/file.te b/target/board/generic_arm64/sepolicy/file.te
similarity index 100%
rename from target/board/generic_arm64_ab/sepolicy/file.te
rename to target/board/generic_arm64/sepolicy/file.te
diff --git a/target/board/generic_arm64_ab/sepolicy/file_contexts b/target/board/generic_arm64/sepolicy/file_contexts
similarity index 100%
rename from target/board/generic_arm64_ab/sepolicy/file_contexts
rename to target/board/generic_arm64/sepolicy/file_contexts
diff --git a/target/board/generic_arm64/system.prop b/target/board/generic_arm64/system_ext.prop
similarity index 100%
rename from target/board/generic_arm64/system.prop
rename to target/board/generic_arm64/system_ext.prop
diff --git a/target/board/generic_arm64_ab/BoardConfig.mk b/target/board/generic_arm64_ab/BoardConfig.mk
index 6e54d81..7c91607 100644
--- a/target/board/generic_arm64_ab/BoardConfig.mk
+++ b/target/board/generic_arm64_ab/BoardConfig.mk
@@ -36,4 +36,4 @@
 
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
-BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
+BOARD_SEPOLICY_DIRS += build/make/target/board/generic_arm64/sepolicy
diff --git a/target/board/generic_arm_ab/BoardConfig.mk b/target/board/generic_arm_ab/BoardConfig.mk
index 9100094..21b763c 100644
--- a/target/board/generic_arm_ab/BoardConfig.mk
+++ b/target/board/generic_arm_ab/BoardConfig.mk
@@ -33,4 +33,4 @@
 
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
-BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
+BOARD_SEPOLICY_DIRS += build/make/target/board/generic_arm64/sepolicy
diff --git a/target/board/generic_x86/device.mk b/target/board/generic_x86/device.mk
index bbab2b4..2b10a3d 100644
--- a/target/board/generic_x86/device.mk
+++ b/target/board/generic_x86/device.mk
@@ -14,6 +14,9 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
 ifdef NET_ETH0_STARTONBOOT
   PRODUCT_PROPERTY_OVERRIDES += net.eth0.startonboot=1
 endif
diff --git a/target/board/generic_x86/system.prop b/target/board/generic_x86/system_ext.prop
similarity index 100%
rename from target/board/generic_x86/system.prop
rename to target/board/generic_x86/system_ext.prop
diff --git a/target/board/generic_x86_64/device.mk b/target/board/generic_x86_64/device.mk
index bbab2b4..2b10a3d 100755
--- a/target/board/generic_x86_64/device.mk
+++ b/target/board/generic_x86_64/device.mk
@@ -14,6 +14,9 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
 ifdef NET_ETH0_STARTONBOOT
   PRODUCT_PROPERTY_OVERRIDES += net.eth0.startonboot=1
 endif
diff --git a/target/board/generic_x86_64/system.prop b/target/board/generic_x86_64/system_ext.prop
similarity index 100%
rename from target/board/generic_x86_64/system.prop
rename to target/board/generic_x86_64/system_ext.prop
diff --git a/target/board/generic_x86_64_arm64/BoardConfig.mk b/target/board/generic_x86_64_arm64/BoardConfig.mk
new file mode 100755
index 0000000..f528294
--- /dev/null
+++ b/target/board/generic_x86_64_arm64/BoardConfig.mk
@@ -0,0 +1,59 @@
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# x86_64 emulator specific definitions
+TARGET_CPU_ABI := x86_64
+TARGET_ARCH := x86_64
+TARGET_ARCH_VARIANT := x86_64
+
+TARGET_2ND_CPU_ABI := x86
+TARGET_2ND_ARCH := x86
+TARGET_2ND_ARCH_VARIANT := x86_64
+
+TARGET_NATIVE_BRIDGE_ARCH := arm64
+TARGET_NATIVE_BRIDGE_ARCH_VARIANT := armv8-a
+TARGET_NATIVE_BRIDGE_CPU_VARIANT := generic
+TARGET_NATIVE_BRIDGE_ABI := arm64-v8a
+
+TARGET_NATIVE_BRIDGE_2ND_ARCH := arm
+TARGET_NATIVE_BRIDGE_2ND_ARCH_VARIANT := armv7-a-neon
+TARGET_NATIVE_BRIDGE_2ND_CPU_VARIANT := generic
+TARGET_NATIVE_BRIDGE_2ND_ABI := armeabi-v7a armeabi
+
+BUILD_BROKEN_DUP_RULES := true
+
+TARGET_PRELINK_MODULE := false
+
+include build/make/target/board/BoardConfigMainlineCommon.mk
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+# the settings differ from BoardConfigMainlineCommon.mk
+BOARD_USES_SYSTEM_OTHER_ODEX :=
+
+# Resize to 4G to accommodate ASAN and CTS
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 4294967296
+
+BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/x86
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
diff --git a/target/board/generic_x86_64_arm64/README.txt b/target/board/generic_x86_64_arm64/README.txt
new file mode 100644
index 0000000..48ee319
--- /dev/null
+++ b/target/board/generic_x86_64_arm64/README.txt
@@ -0,0 +1,10 @@
+The "generic_x86_64" product defines a non-hardware-specific IA target
+without a kernel or bootloader.
+
+It can be used to build the entire user-level system, and
+will work with the IA version of the emulator,
+
+It is not a product "base class"; no other products inherit
+from it or use it in any way.
+
+Third party arm64 to x86_64 translator has to be installed as well
diff --git a/core/android_vts_host_config.mk b/target/board/generic_x86_64_arm64/device.mk
old mode 100644
new mode 100755
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/board/generic_x86_64_arm64/device.mk
index 38ba19d..76242c9
--- a/core/android_vts_host_config.mk
+++ b/target/board/generic_x86_64_arm64/device.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2009 The Android Open Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,5 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
diff --git a/target/board/generic_x86_64/system.prop b/target/board/generic_x86_64_arm64/system_ext.prop
similarity index 100%
copy from target/board/generic_x86_64/system.prop
copy to target/board/generic_x86_64_arm64/system_ext.prop
diff --git a/target/board/generic_x86_arm/BoardConfig.mk b/target/board/generic_x86_arm/BoardConfig.mk
index 6fae411..f6589b0 100644
--- a/target/board/generic_x86_arm/BoardConfig.mk
+++ b/target/board/generic_x86_arm/BoardConfig.mk
@@ -18,21 +18,23 @@
 TARGET_ARCH := x86
 TARGET_ARCH_VARIANT := x86
 
-TARGET_2ND_ARCH := arm
-TARGET_2ND_CPU_ABI := armeabi-v7a
-TARGET_2ND_CPU_ABI2 := armeabi
-TARGET_2ND_ARCH_VARIANT := armv7-a-neon
-TARGET_2ND_CPU_VARIANT := generic
-
-TARGET_CPU_ABI_LIST := x86 armeabi-v7a armeabi
-TARGET_TRANSLATE_2ND_ARCH := true
+TARGET_NATIVE_BRIDGE_ARCH := arm
+TARGET_NATIVE_BRIDGE_ARCH_VARIANT := armv7-a-neon
+TARGET_NATIVE_BRIDGE_CPU_VARIANT := generic
+TARGET_NATIVE_BRIDGE_ABI := armeabi-v7a armeabi
 
 BUILD_BROKEN_DUP_RULES := true
 
-
-include build/make/target/board/BoardConfigGsiCommon.mk
+#
+# The inclusion order below is important.
+# The settings in latter makefiles overwrite those in the former.
+#
+include build/make/target/board/BoardConfigMainlineCommon.mk
 include build/make/target/board/BoardConfigEmuCommon.mk
 
+# the settings differ from BoardConfigMainlineCommon.mk
+BOARD_USES_SYSTEM_OTHER_ODEX :=
+
 # Resize to 4G to accomodate ASAN and CTS
 BOARD_USERDATAIMAGE_PARTITION_SIZE := 4294967296
 
diff --git a/target/board/generic_x86_arm/device.mk b/target/board/generic_x86_arm/device.mk
index 0a32415..76242c9 100644
--- a/target/board/generic_x86_arm/device.mk
+++ b/target/board/generic_x86_arm/device.mk
@@ -14,11 +14,5 @@
 # limitations under the License.
 #
 
-# NFC:
-#   Provide default libnfc-nci.conf file for devices that does not have one in
-#   vendor/etc because aosp system image (of aosp_$arch products) is going to
-#   be used as GSI.
-#   May need to remove the following for newly launched devices in P since this
-#   NFC configuration file should be in vendor/etc, instead of system/etc
-PRODUCT_COPY_FILES += \
-    device/generic/common/nfc/libnfc-nci.conf:system/etc/libnfc-nci.conf
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
diff --git a/target/board/generic_x86_arm/system.prop b/target/board/generic_x86_arm/system_ext.prop
similarity index 100%
rename from target/board/generic_x86_arm/system.prop
rename to target/board/generic_x86_arm/system_ext.prop
diff --git a/target/board/gsi_arm64/BoardConfig.mk b/target/board/gsi_arm64/BoardConfig.mk
index 90ddd0d..db6f3f0 100644
--- a/target/board/gsi_arm64/BoardConfig.mk
+++ b/target/board/gsi_arm64/BoardConfig.mk
@@ -34,4 +34,4 @@
 
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
-BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
+BOARD_SEPOLICY_DIRS += build/make/target/board/generic_arm64/sepolicy
diff --git a/target/board/gsi_system.prop b/target/board/gsi_system_ext.prop
similarity index 89%
rename from target/board/gsi_system.prop
rename to target/board/gsi_system_ext.prop
index dd3227e..f085b61 100644
--- a/target/board/gsi_system.prop
+++ b/target/board/gsi_system_ext.prop
@@ -14,6 +14,4 @@
 ro.control_privapp_permissions=disable
 
 # TODO(b/136212765): the default for LMK
-ro.lmk.kill_heaviest_task=true
 ro.lmk.kill_timeout_ms=100
-ro.lmk.use_minfree_levels=true
diff --git a/target/board/gsi_system_user.prop b/target/board/gsi_system_ext_user.prop
similarity index 88%
rename from target/board/gsi_system_user.prop
rename to target/board/gsi_system_ext_user.prop
index db6d880..de8c487 100644
--- a/target/board/gsi_system_user.prop
+++ b/target/board/gsi_system_ext_user.prop
@@ -11,6 +11,4 @@
 ro.control_privapp_permissions=disable
 
 # TODO(b/136212765): the default for LMK
-ro.lmk.kill_heaviest_task=true
 ro.lmk.kill_timeout_ms=100
-ro.lmk.use_minfree_levels=true
diff --git a/target/board/mainline_arm64/BoardConfig.mk b/target/board/mainline_arm64/BoardConfig.mk
index 8bb6212..a09960f 100644
--- a/target/board/mainline_arm64/BoardConfig.mk
+++ b/target/board/mainline_arm64/BoardConfig.mk
@@ -26,9 +26,17 @@
 
 include build/make/target/board/BoardConfigMainlineCommon.mk
 
+# TODO(b/143732851): Remove this after replacing /persit with
+# /mnt/vendor/persist
+BOARD_ROOT_EXTRA_SYMLINKS += /mnt/vendor/persist:/persist
+BOARD_SEPOLICY_DIRS += build/make/target/board/mainline_arm64/sepolicy
+
 TARGET_NO_KERNEL := true
 
+# Build generic A/B format system-only OTA.
+AB_OTA_UPDATER := true
 AB_OTA_PARTITIONS := system
 
-BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
 BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/board/generic_arm64_ab/sepolicy/OWNERS b/target/board/mainline_arm64/sepolicy/OWNERS
similarity index 100%
copy from target/board/generic_arm64_ab/sepolicy/OWNERS
copy to target/board/mainline_arm64/sepolicy/OWNERS
diff --git a/target/board/mainline_arm64/sepolicy/file.te b/target/board/mainline_arm64/sepolicy/file.te
new file mode 100644
index 0000000..36baabd
--- /dev/null
+++ b/target/board/mainline_arm64/sepolicy/file.te
@@ -0,0 +1,3 @@
+# TODO(b/143732851): remove this file when the mainline system image
+# no longer need these SoC specific directory
+type persist_file, file_type;
diff --git a/target/board/mainline_arm64/sepolicy/file_contexts b/target/board/mainline_arm64/sepolicy/file_contexts
new file mode 100644
index 0000000..4d02edc
--- /dev/null
+++ b/target/board/mainline_arm64/sepolicy/file_contexts
@@ -0,0 +1,5 @@
+# TODO(b/143732851): remove this file when the mainline system image
+# no longer need these SoC specific directory
+
+# /persist
+/persist(/.*)?          u:object_r:persist_file:s0
diff --git a/target/board/mainline_x86/BoardConfig.mk b/target/board/mainline_x86/BoardConfig.mk
new file mode 100644
index 0000000..4dda058
--- /dev/null
+++ b/target/board/mainline_x86/BoardConfig.mk
@@ -0,0 +1,31 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+TARGET_ARCH := x86
+TARGET_ARCH_VARIANT := x86
+TARGET_CPU_ABI := x86
+
+include build/make/target/board/BoardConfigMainlineCommon.mk
+
+TARGET_NO_KERNEL := true
+
+# Build generic A/B format system-only OTA.
+AB_OTA_UPDATER := true
+AB_OTA_PARTITIONS := system
+
+BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/board/mainline_x86_64/BoardConfig.mk b/target/board/mainline_x86_64/BoardConfig.mk
new file mode 100644
index 0000000..118fda6
--- /dev/null
+++ b/target/board/mainline_x86_64/BoardConfig.mk
@@ -0,0 +1,35 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+TARGET_ARCH := x86_64
+TARGET_ARCH_VARIANT := x86_64
+TARGET_CPU_ABI := x86_64
+
+TARGET_2ND_ARCH := x86
+TARGET_2ND_ARCH_VARIANT := x86_64
+TARGET_2ND_CPU_ABI := x86
+
+include build/make/target/board/BoardConfigMainlineCommon.mk
+
+TARGET_NO_KERNEL := true
+
+# Build generic A/B format system-only OTA.
+AB_OTA_UPDATER := true
+AB_OTA_PARTITIONS := system
+
+BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/board/mainline_x86_arm/BoardConfig.mk b/target/board/mainline_x86_arm/BoardConfig.mk
new file mode 100644
index 0000000..d775a77
--- /dev/null
+++ b/target/board/mainline_x86_arm/BoardConfig.mk
@@ -0,0 +1,36 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+TARGET_ARCH := x86
+TARGET_ARCH_VARIANT := x86
+TARGET_CPU_ABI := x86
+
+TARGET_NATIVE_BRIDGE_ARCH := arm
+TARGET_NATIVE_BRIDGE_ARCH_VARIANT := armv7-a-neon
+TARGET_NATIVE_BRIDGE_CPU_VARIANT := generic
+TARGET_NATIVE_BRIDGE_ABI := armeabi-v7a armeabi
+
+include build/make/target/board/BoardConfigMainlineCommon.mk
+
+TARGET_NO_KERNEL := true
+
+# Build generic A/B format system-only OTA.
+AB_OTA_UPDATER := true
+AB_OTA_PARTITIONS := system
+
+BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/product/AndroidProducts.mk b/target/product/AndroidProducts.mk
index cfb8930..4121bc1 100644
--- a/target/product/AndroidProducts.mk
+++ b/target/product/AndroidProducts.mk
@@ -59,6 +59,9 @@
     $(LOCAL_DIR)/gsi_arm64.mk \
     $(LOCAL_DIR)/mainline_arm64.mk \
     $(LOCAL_DIR)/mainline_system_arm64.mk \
+    $(LOCAL_DIR)/mainline_system_x86.mk \
+    $(LOCAL_DIR)/mainline_system_x86_arm.mk \
+    $(LOCAL_DIR)/mainline_system_x86_64.mk \
     $(LOCAL_DIR)/sdk_arm64.mk \
     $(LOCAL_DIR)/sdk.mk \
     $(LOCAL_DIR)/sdk_phone_arm64.mk \
diff --git a/target/product/aosp_arm.mk b/target/product/aosp_arm.mk
index 0fdd313..0cec14b 100644
--- a/target/product/aosp_arm.mk
+++ b/target/product/aosp_arm.mk
@@ -23,19 +23,44 @@
 # - VNDK enforcement
 # - compatible property override enabled
 
-# GSI for system/product
-$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_common.mk)
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_arm,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
-# Emulator for vendor
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
 $(call inherit-product-if-exists, device/generic/goldfish/arm32-vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
+#
+# Special settings for GSI releasing
+#
+ifeq (aosp_arm,$(TARGET_PRODUCT))
+$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_release.mk)
+endif
+
+
 PRODUCT_NAME := aosp_arm
 PRODUCT_DEVICE := generic
 PRODUCT_BRAND := Android
diff --git a/target/product/aosp_arm64.mk b/target/product/aosp_arm64.mk
index 8ef2023..e88a366 100644
--- a/target/product/aosp_arm64.mk
+++ b/target/product/aosp_arm64.mk
@@ -14,8 +14,6 @@
 # limitations under the License.
 #
 
-PRODUCT_USE_DYNAMIC_PARTITIONS := true
-
 # The system image of aosp_arm64-userdebug is a GSI for the devices with:
 # - ARM 64 bits user space
 # - 64 bits binder interface
@@ -28,31 +26,41 @@
 # build quite specifically for the emulator, and might not be
 # entirely appropriate to inherit from for on-device configurations.
 
-# GSI for system/product
+#
+# All components inherited here go to system image
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_common.mk)
-
-# Emulator for vendor
-$(call inherit-product-if-exists, device/generic/goldfish/arm64-vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_arm64/device.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_arm64,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_arm64/device.mk)
+
+#
+# Special settings for GSI releasing
+#
+ifeq (aosp_arm64,$(TARGET_PRODUCT))
+$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_release.mk)
+endif
+
 
 PRODUCT_NAME := aosp_arm64
 PRODUCT_DEVICE := generic_arm64
diff --git a/target/product/aosp_arm64_ab.mk b/target/product/aosp_arm64_ab.mk
index f707a39..75b9cc4 100644
--- a/target/product/aosp_arm64_ab.mk
+++ b/target/product/aosp_arm64_ab.mk
@@ -24,25 +24,33 @@
 # - 64 bits binder interface
 # - system-as-root
 
+#
+# All components inherited here go to system image
+# (The system image of Legacy GSI is not CSI)
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_arm64_ab,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# Special settings for GSI releasing
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_release.mk)
 
 PRODUCT_NAME := aosp_arm64_ab
 PRODUCT_DEVICE := generic_arm64_ab
diff --git a/target/product/aosp_arm_ab.mk b/target/product/aosp_arm_ab.mk
index e760932..80ebdb1 100644
--- a/target/product/aosp_arm_ab.mk
+++ b/target/product/aosp_arm_ab.mk
@@ -24,13 +24,33 @@
 # - 32 bits binder interface
 # - system-as-root
 
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
+#
+# All components inherited here go to system image
+# (The system image of Legacy GSI is not CSI)
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_arm_ab,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# Special settings for GSI releasing
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_release.mk)
+
 PRODUCT_NAME := aosp_arm_ab
 PRODUCT_DEVICE := generic_arm_ab
 PRODUCT_BRAND := Android
diff --git a/target/product/aosp_product.mk b/target/product/aosp_product.mk
new file mode 100644
index 0000000..e3819e6
--- /dev/null
+++ b/target/product/aosp_product.mk
@@ -0,0 +1,45 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Includes all AOSP product packages
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
+
+# Default AOSP sounds
+$(call inherit-product-if-exists, frameworks/base/data/sounds/AllAudio.mk)
+
+# Additional settings used in all AOSP builds
+PRODUCT_PRODUCT_PROPERTIES += \
+    ro.config.ringtone=Ring_Synth_04.ogg \
+    ro.config.notification_sound=pixiedust.ogg \
+    ro.com.android.dataroaming=true \
+
+# More AOSP packages
+PRODUCT_PACKAGES += \
+    messaging \
+    PhotoTable \
+    preinstalled-packages-platform-aosp-product.xml \
+    WallpaperPicker \
+
+# Telephony:
+#   Provide a APN configuration to GSI product
+PRODUCT_COPY_FILES += \
+    device/sample/etc/apns-full-conf.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/apns-conf.xml
+
+# NFC:
+#   Provide a libnfc-nci.conf to GSI product
+PRODUCT_COPY_FILES += \
+    device/generic/common/nfc/libnfc-nci.conf:$(TARGET_COPY_OUT_PRODUCT)/etc/libnfc-nci.conf
diff --git a/target/product/aosp_x86.mk b/target/product/aosp_x86.mk
index 1c71948..51b5daf 100644
--- a/target/product/aosp_x86.mk
+++ b/target/product/aosp_x86.mk
@@ -23,19 +23,43 @@
 # - VNDK enforcement
 # - compatible property override enabled
 
-# GSI for system/product
-$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_common.mk)
-
-# Emulator for vendor
-$(call inherit-product-if-exists, device/generic/goldfish/x86-vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_x86,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product-if-exists, device/generic/goldfish/x86-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
+
+
+#
+# Special settings for GSI releasing
+#
+ifeq (aosp_x86,$(TARGET_PRODUCT))
+$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_release.mk)
+endif
+
+
 PRODUCT_NAME := aosp_x86
 PRODUCT_DEVICE := generic_x86
 PRODUCT_BRAND := Android
diff --git a/target/product/aosp_x86_64.mk b/target/product/aosp_x86_64.mk
index 9dfa2f4..9b26716 100644
--- a/target/product/aosp_x86_64.mk
+++ b/target/product/aosp_x86_64.mk
@@ -28,31 +28,42 @@
 # build quite specifically for the emulator, and might not be
 # entirely appropriate to inherit from for on-device configurations.
 
-# GSI for system/product
+#
+# All components inherited here go to system image
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_common.mk)
-
-# Emulator for vendor
-$(call inherit-product-if-exists, device/generic/goldfish/x86_64-vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_x86_64,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product-if-exists, device/generic/goldfish/x86_64-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
+
+#
+# Special settings for GSI releasing
+#
+ifeq (aosp_x86_64,$(TARGET_PRODUCT))
+$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_release.mk)
+endif
+
 
 PRODUCT_NAME := aosp_x86_64
 PRODUCT_DEVICE := generic_x86_64
diff --git a/target/product/aosp_x86_64_ab.mk b/target/product/aosp_x86_64_ab.mk
index dfb7b49..9d23fc7 100644
--- a/target/product/aosp_x86_64_ab.mk
+++ b/target/product/aosp_x86_64_ab.mk
@@ -24,25 +24,33 @@
 # - 64 bits binder interface
 # - system-as-root
 
+#
+# All components inherited here go to system image
+# (The system image of Legacy GSI is not CSI)
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_x86_64_ab,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# Special settings for GSI releasing
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_release.mk)
 
 PRODUCT_NAME := aosp_x86_64_ab
 PRODUCT_DEVICE := generic_x86_64_ab
diff --git a/target/product/aosp_x86_ab.mk b/target/product/aosp_x86_ab.mk
index d07351c..6b6a4c6 100644
--- a/target/product/aosp_x86_ab.mk
+++ b/target/product/aosp_x86_ab.mk
@@ -24,13 +24,34 @@
 # - 32 bits binder interface
 # - system-as-root
 
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
+#
+# All components inherited here go to system image
+# (The system image of Legacy GSI is not CSI)
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking for excat this product name
 ifeq (aosp_x86_ab,$(TARGET_PRODUCT))
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
 endif
 
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# Special settings for GSI releasing
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_release.mk)
+
 PRODUCT_NAME := aosp_x86_ab
 PRODUCT_DEVICE := generic_x86_ab
 PRODUCT_BRAND := Android
diff --git a/target/product/aosp_x86_arm.mk b/target/product/aosp_x86_arm.mk
index 70aa64e..deba3d9 100644
--- a/target/product/aosp_x86_arm.mk
+++ b/target/product/aosp_x86_arm.mk
@@ -16,27 +16,41 @@
 
 PRODUCT_USE_DYNAMIC_PARTITIONS := true
 
-# aosp_x86 with arm libraries needed by binary translation.
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
-# The system image of aosp_x86-userdebug is a GSI for the devices with:
-# - x86 32 bits user space
-# - 64 bits binder interface
-# - system-as-root
-# - VNDK enforcement
-# - compatible property override enabled
+# Enable mainline checking
+ifeq (aosp_x86_arm,$(TARGET_PRODUCT))
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
+endif
 
--include device/generic/goldfish/x86-vendor.mk
+# TODO (b/138382074): remove following setting after enable product/system_ext
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \
+    system/product/% \
+    system/system_ext/%
 
-include $(SRC_TARGET_DIR)/product/full_x86.mk
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 
-# Enable dynamic partition size
-PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
 
-# Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
-PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product-if-exists, device/generic/goldfish/x86-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_arm/device.mk)
 
-# Support addtional P vendor interface
-PRODUCT_EXTRA_VNDK_VERSIONS := 28
 
 PRODUCT_NAME := aosp_x86_arm
 PRODUCT_DEVICE := generic_x86_arm
+PRODUCT_BRAND := Android
+PRODUCT_MODEL := AOSP on IA Emulator
diff --git a/target/product/base.mk b/target/product/base.mk
index 804a2ee..d3250d4 100644
--- a/target/product/base.mk
+++ b/target/product/base.mk
@@ -17,5 +17,6 @@
 # This makefile is suitable to inherit by products that don't need to be split
 # up by partition.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/base_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_product.mk)
diff --git a/target/product/base_product.mk b/target/product/base_product.mk
index 82557bf..2ed550c 100644
--- a/target/product/base_product.mk
+++ b/target/product/base_product.mk
@@ -16,7 +16,8 @@
 
 # Base modules and settings for the product partition.
 PRODUCT_PACKAGES += \
-    healthd \
+    group_product \
     ModuleMetadata \
+    passwd_product \
     product_compatibility_matrix.xml \
     product_manifest.xml \
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 2f8a634..4569bce 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -16,8 +16,7 @@
 
 # Base modules and settings for the system partition.
 PRODUCT_PACKAGES += \
-    abb \
-    adbd \
+    adbd_system_api \
     am \
     android.hidl.allocator@1.0-service \
     android.hidl.base-V1.0-java \
@@ -29,20 +28,20 @@
     android.test.mock \
     android.test.runner \
     apexd \
-    applypatch \
     appops \
     app_process \
     appwidget \
-    ashmemd \
     atrace \
     audioserver \
     BackupRestoreConfirmation \
     bcc \
     blank_screen \
     blkid \
+    service-blobstore \
     bmgr \
     bootanimation \
     bootstat \
+    boringssl_self_test \
     bpfloader \
     bu \
     bugreport \
@@ -50,12 +49,23 @@
     cgroups.json \
     charger \
     cmd \
+    com.android.adbd \
     com.android.conscrypt \
+    com.android.extservices \
+    com.android.i18n \
+    com.android.ipsec \
     com.android.location.provider \
     com.android.media \
     com.android.media.swcodec \
+    com.android.mediaprovider \
+    com.android.os.statsd \
+    com.android.permission \
     com.android.resolv \
+    com.android.neuralnetworks \
+    com.android.sdkext \
+    com.android.tethering \
     com.android.tzdata \
+    com.android.wifi \
     ContactsProvider \
     content \
     crash_dump \
@@ -71,15 +81,16 @@
     dumpsys \
     DynamicSystemInstallationService \
     e2fsck \
-    ExtServices \
     ExtShared \
     flags_health_check \
-    framework \
+    framework-minus-apex \
     framework-res \
     framework-sysconfig.xml \
     fsck_msdos \
+    fsverity-release-cert-der \
     fs_config_files_system \
     fs_config_dirs_system \
+    group_system \
     gsid \
     gsi_tool \
     heapprofd \
@@ -88,7 +99,6 @@
     gpuservice \
     hid \
     hwservicemanager \
-    idmap \
     idmap2 \
     idmap2d \
     ime \
@@ -96,19 +106,19 @@
     incident \
     incidentd \
     incident_helper \
+    incident-helper-cmd \
     init.environ.rc \
-    init.rc \
     init_system \
     input \
     installd \
     iorapd \
     ip \
-    ip6tables \
     iptables \
     ip-up-vpn \
     javax.obex \
+    service-jobscheduler \
     keystore \
-    ld.config.txt \
+    credstore \
     ld.mc \
     libaaudio \
     libamidi \
@@ -117,20 +127,19 @@
     libandroid_runtime \
     libandroid_servers \
     libartpalette-system \
-    libashmemd_client \
     libaudioeffect_jni \
     libbinder \
     libbinder_ndk \
     libc.bootstrap \
     libcamera2ndk \
-    libc_malloc_debug \
-    libc_malloc_hooks \
     libcutils \
     libdl.bootstrap \
+    libdl_android.bootstrap \
     libdrmframework \
     libdrmframework_jni \
     libEGL \
     libETC1 \
+    libfdtrack \
     libFFTEm \
     libfilterfw \
     libgatekeeper \
@@ -155,11 +164,10 @@
     libnetd_client \
     libnetlink \
     libnetutils \
-    libneuralnetworks \
+    libneuralnetworks_packageinfo \
     libOpenMAXAL \
     libOpenSLES \
     libpdfium \
-    libpixelflinger \
     libpower \
     libpowermanager \
     libradio_metadata \
@@ -173,8 +181,6 @@
     libspeexresampler \
     libsqlite \
     libstagefright \
-    libstagefright_amrnb_common \
-    libstagefright_enc_common \
     libstagefright_foundation \
     libstagefright_omx \
     libstdc++ \
@@ -183,11 +189,10 @@
     libui \
     libusbhost \
     libutils \
-    libvorbisidec \
     libvulkan \
-    libwifi-service \
     libwilhelm \
     linker \
+    linkerconfig \
     lmkd \
     LocalTransport \
     locksettings \
@@ -196,13 +201,11 @@
     lpdump \
     lshal \
     mdnsd \
-    media \
     mediacodec.policy \
-    mediadrmserver \
     mediaextractor \
     mediametrics \
     media_profiles_V1_0.dtd \
-    MediaProvider \
+    MediaProviderLegacy \
     mediaserver \
     mke2fs \
     monkey \
@@ -211,20 +214,23 @@
     netd \
     NetworkStack \
     org.apache.http.legacy \
+    otacerts \
     PackageInstaller \
+    passwd_system \
     perfetto \
-    PermissionController \
     ping \
     ping6 \
     platform.xml \
     pm \
     pppd \
+    preinstalled-packages-platform.xml \
     privapp-permissions-platform.xml \
     racoon \
     recovery-persist \
     resize2fs \
     rss_hwm_reset \
     run-as \
+    sanitizer.libraries.txt \
     schedtest \
     screencap \
     sdcard \
@@ -241,7 +247,8 @@
     Shell \
     shell_and_utilities_system \
     sm \
-    statsd \
+    snapshotctl \
+    SoundPicker \
     storaged \
     surfaceflinger \
     svc \
@@ -264,7 +271,7 @@
     WallpaperBackup \
     watchdogd \
     wificond \
-    wifi-service \
+    wifi.rc \
     wm \
 
 # VINTF data for system image
@@ -283,7 +290,8 @@
     e2fsck \
     fastboot \
     flags_health_check \
-    icu-data_host_runtime_apex \
+    icu-data_host_i18n_apex \
+    icu_tzdata.dat_host_tzdata_apex \
     idmap2 \
     incident_report \
     ld.mc \
@@ -302,64 +310,73 @@
     unwind_symbols \
     viewcompiler \
     tzdata_host \
-    tzdata_host_runtime_apex \
-    tzlookup.xml_host_runtime_apex \
+    tzdata_host_tzdata_apex \
+    tzlookup.xml_host_tzdata_apex \
     tz_version_host \
-    tz_version_host_runtime_apex \
+    tz_version_host_tzdata_apex \
 
-ifeq ($(TARGET_CORE_JARS),)
-$(error TARGET_CORE_JARS is empty; cannot initialize PRODUCT_BOOT_JARS variable)
+ifeq ($(ART_APEX_JARS),)
+$(error ART_APEX_JARS is empty; cannot initialize PRODUCT_BOOT_JARS variable)
 endif
 
 # The order matters for runtime class lookup performance.
 PRODUCT_BOOT_JARS := \
-    $(TARGET_CORE_JARS) \
-    framework \
+    $(ART_APEX_JARS) \
+    framework-minus-apex \
     ext \
     telephony-common \
     voip-common \
-    ims-common \
-    updatable-media
-PRODUCT_UPDATABLE_BOOT_MODULES := conscrypt updatable-media
-PRODUCT_UPDATABLE_BOOT_LOCATIONS := \
-    /apex/com.android.conscrypt/javalib/conscrypt.jar \
-    /apex/com.android.media/javalib/updatable-media.jar
+    ims-common
 
+PRODUCT_UPDATABLE_BOOT_JARS := \
+    com.android.conscrypt:conscrypt \
+    com.android.media:updatable-media \
+    com.android.mediaprovider:framework-mediaprovider \
+    com.android.os.statsd:framework-statsd \
+    com.android.permission:framework-permission \
+    com.android.sdkext:framework-sdkextensions \
+    com.android.wifi:framework-wifi \
+    com.android.tethering:framework-tethering
 
 PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.usb.rc:root/init.usb.rc \
-    system/core/rootdir/init.usb.configfs.rc:root/init.usb.configfs.rc \
-    system/core/rootdir/ueventd.rc:root/ueventd.rc \
+    system/core/rootdir/init.usb.rc:system/etc/init/hw/init.usb.rc \
+    system/core/rootdir/init.usb.configfs.rc:system/etc/init/hw/init.usb.configfs.rc \
     system/core/rootdir/etc/hosts:system/etc/hosts
 
 # Add the compatibility library that is needed when android.test.base
 # is removed from the bootclasspath.
-ifeq ($(REMOVE_ATB_FROM_BCP),true)
+# Default to excluding android.test.base from the bootclasspath.
+ifneq ($(REMOVE_ATB_FROM_BCP),false)
 PRODUCT_PACKAGES += framework-atb-backward-compatibility
 PRODUCT_BOOT_JARS += framework-atb-backward-compatibility
 else
 PRODUCT_BOOT_JARS += android.test.base
 endif
 
-PRODUCT_COPY_FILES += system/core/rootdir/init.zygote32.rc:root/init.zygote32.rc
+PRODUCT_COPY_FILES += system/core/rootdir/init.zygote32.rc:system/etc/init/hw/init.zygote32.rc
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.zygote=zygote32
 
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += debug.atrace.tags.enableflags=0
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += persist.traced.enable=1
 
 # Packages included only for eng or userdebug builds, previously debug tagged
 PRODUCT_PACKAGES_DEBUG := \
     adb_keys \
     arping \
     gdbserver \
+    idlcli \
     init-debug.rc \
     iotop \
+    iperf3 \
     iw \
     logpersist.start \
     logtagd.rc \
     procrank \
+    remount \
     showmap \
     sqlite3 \
     ss \
+    start_with_lockagent \
     strace \
     su \
     sanitizer-status \
diff --git a/core/android_vts_host_config.mk b/target/product/base_system_ext.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/base_system_ext.mk
index 38ba19d..b67549a 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/base_system_ext.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2019 The Android Open Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,8 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+# Base modules and settings for the system_ext partition.
+PRODUCT_PACKAGES += \
+    group_system_ext \
+    system_ext_manifest.xml \
+    passwd_system_ext \
diff --git a/target/product/base_vendor.mk b/target/product/base_vendor.mk
index 584327c..471340b 100644
--- a/target/product/base_vendor.mk
+++ b/target/product/base_vendor.mk
@@ -23,6 +23,7 @@
     init_second_stage.recovery \
     ld.config.recovery.txt \
     linker.recovery \
+    otacerts.recovery \
     recovery \
     shell_and_utilities_recovery \
     watchdogd.recovery \
@@ -35,18 +36,19 @@
     make_f2fs \
 
 PRODUCT_HOST_PACKAGES += \
-    icu-data_host_runtime_apex
+    icu-data_host_i18n_apex
 
 # Base modules and settings for the vendor partition.
 PRODUCT_PACKAGES += \
-    android.hardware.cas@1.1-service \
-    android.hardware.configstore@1.1-service \
+    android.hardware.cas@1.2-service \
     android.hardware.media.omx@1.0-service \
+    boringssl_self_test_vendor \
     dumpsys_vendor \
     fs_config_files_nonsystem \
     fs_config_dirs_nonsystem \
     gralloc.default \
-    group \
+    group_odm \
+    group_vendor \
     init_vendor \
     libbundlewrapper \
     libclearkeycasplugin \
@@ -60,12 +62,22 @@
     libreverbwrapper \
     libril \
     libvisualizer \
-    passwd \
+    passwd_odm \
+    passwd_vendor \
     selinux_policy_nonsystem \
     shell_and_utilities_vendor \
     vndservice \
+
+# Base module when shipping api level is less than or equal to 29
+PRODUCT_PACKAGES_SHIPPING_API_LEVEL_29 += \
+    android.hardware.configstore@1.1-service \
     vndservicemanager \
 
 # VINTF data for vendor image
 PRODUCT_PACKAGES += \
-    device_compatibility_matrix.xml \
+    vendor_compatibility_matrix.xml \
+
+# Packages to update the recovery partition, which will be installed on
+# /vendor. TODO(b/141648565): Don't install these unless they're needed.
+PRODUCT_PACKAGES += \
+    applypatch
diff --git a/target/product/cfi-common.mk b/target/product/cfi-common.mk
index 7a53bc1..42edd92 100644
--- a/target/product/cfi-common.mk
+++ b/target/product/cfi-common.mk
@@ -17,7 +17,7 @@
 # This is a set of common components to enable CFI for (across
 # compatible product configs)
 PRODUCT_CFI_INCLUDE_PATHS :=  \
-    device/google/cuttlefish_common/guest/libs/wpa_supplicant_8_lib \
+    device/google/cuttlefish/guest/libs/wpa_supplicant_8_lib \
     device/google/wahoo/wifi_offload \
     external/tinyxml2 \
     external/wpa_supplicant_8 \
diff --git a/target/product/core_64_bit.mk b/target/product/core_64_bit.mk
index 76e2a36..f9baa27 100644
--- a/target/product/core_64_bit.mk
+++ b/target/product/core_64_bit.mk
@@ -23,7 +23,7 @@
 # for 32-bit only.
 
 # Copy the 64-bit primary, 32-bit secondary zygote startup script
-PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64_32.rc:root/init.zygote64_32.rc
+PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64_32.rc:system/etc/init/hw/init.zygote64_32.rc
 
 # Set the zygote property to select the 64-bit primary, 32-bit secondary script
 # This line must be parsed before the one in core_minimal.mk
diff --git a/target/product/core_64_bit_only.mk b/target/product/core_64_bit_only.mk
index 72d30f5..8901a50 100644
--- a/target/product/core_64_bit_only.mk
+++ b/target/product/core_64_bit_only.mk
@@ -20,7 +20,7 @@
 # to core_minimal.mk.
 
 # Copy the 64-bit zygote startup script
-PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64.rc:root/init.zygote64.rc
+PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64.rc:system/etc/init/hw/init.zygote64.rc
 
 # Set the zygote property to select the 64-bit script.
 # This line must be parsed before the one in core_minimal.mk
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 9718dc6..6fb1173 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -22,6 +22,7 @@
 # handheld_<x>.mk.
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/media_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_product.mk)
 
diff --git a/core/android_vts_host_config.mk b/target/product/emulated_storage.mk
similarity index 64%
copy from core/android_vts_host_config.mk
copy to target/product/emulated_storage.mk
index 38ba19d..ea5d9ad 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/emulated_storage.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2020 The Android Open-Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,10 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+PRODUCT_QUOTA_PROJID := 1
+PRODUCT_PROPERTY_OVERRIDES += external_storage.projid.enabled=1
 
-include $(BUILD_SYSTEM)/base_rules.mk
+PRODUCT_FS_CASEFOLD := 1
+PRODUCT_PROPERTY_OVERRIDES += external_storage.casefold.enabled=1
 
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+PRODUCT_PROPERTY_OVERRIDES += external_storage.sdcardfs.enabled=0
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index f6e1011..93c861f 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -20,8 +20,6 @@
 
 # Device modules
 PRODUCT_PACKAGES += \
-    libGLES_android \
-    vintf \
     CarrierConfig \
 
 # need this for gles libraries to load properly
@@ -52,15 +50,11 @@
 #PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
 #config.disable_location=true
 
-# Enable Perfetto traced
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
-    persist.traced.enable=1
-
 # enable Google-specific location features,
 # like NetworkLocationProvider and LocationCollector
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+PRODUCT_SYSTEM_EXT_PROPERTIES += \
     ro.com.google.locationfeatures=1
 
 # disable setupwizard
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+PRODUCT_SYSTEM_EXT_PROPERTIES += \
     ro.setupwizard.mode=DISABLED
diff --git a/target/product/emulator_system.mk b/target/product/emulator_system.mk
index 4b6987c..b7e7cfa 100644
--- a/target/product/emulator_system.mk
+++ b/target/product/emulator_system.mk
@@ -16,7 +16,7 @@
 # This file lists emulator experimental modules added to PRODUCT_PACKAGES,
 # only included by targets sdk_phone_x86/64 and sdk_gphone_x86/64
 
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST := \
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST := \
     system/lib/libemulator_multidisplay_jni.so \
     system/lib64/libemulator_multidisplay_jni.so \
     system/priv-app/MultiDisplayProvider/MultiDisplayProvider.apk \
diff --git a/target/product/emulator_vendor.mk b/target/product/emulator_vendor.mk
index f0a5354..a935d58 100644
--- a/target/product/emulator_vendor.mk
+++ b/target/product/emulator_vendor.mk
@@ -21,20 +21,6 @@
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 
-# TODO(b/123495142): these files should be clean up
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST := \
-    system/bin/vintf \
-    system/etc/permissions/android.software.verified_boot.xml \
-    system/etc/permissions/privapp-permissions-goldfish.xml \
-    system/lib/egl/libGLES_android.so \
-    system/lib64/egl/libGLES_android.so \
-    system/priv-app/SdkSetup/SdkSetup.apk \
-
-# Device modules
-PRODUCT_PACKAGES += \
-    libGLES_android \
-    vintf \
-
 # need this for gles libraries to load properly
 # after moving to /vendor/lib/
 PRODUCT_PACKAGES += \
@@ -56,15 +42,11 @@
 #PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
 #config.disable_location=true
 
-# Enable Perfetto traced
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
-    persist.traced.enable=1
-
 # enable Google-specific location features,
 # like NetworkLocationProvider and LocationCollector
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+PRODUCT_SYSTEM_EXT_PROPERTIES += \
     ro.com.google.locationfeatures=1
 
 # disable setupwizard
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+PRODUCT_SYSTEM_EXT_PROPERTIES += \
     ro.setupwizard.mode=DISABLED
diff --git a/target/product/full_base.mk b/target/product/full_base.mk
index 447576c..ffd3cde 100644
--- a/target/product/full_base.mk
+++ b/target/product/full_base.mk
@@ -25,7 +25,8 @@
 
 PRODUCT_PACKAGES += \
     LiveWallpapersPicker \
-    PhotoTable
+    PhotoTable \
+    preinstalled-packages-platform-full-base.xml
 
 # Bluetooth:
 #   audio.a2dp.default is a system module. Generic system image includes
diff --git a/target/product/generic.mk b/target/product/generic.mk
index 6fe4818..d3f81b1 100644
--- a/target/product/generic.mk
+++ b/target/product/generic.mk
@@ -14,6 +14,9 @@
 # limitations under the License.
 #
 
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish # for libwifi-hal-emu
+PRODUCT_SOONG_NAMESPACES += device/generic/goldfish-opengl # for goldfish deps.
+
 # This is a generic phone product that isn't specialized for a specific device.
 # It includes the base Android platform.
 
@@ -25,4 +28,5 @@
 PRODUCT_DEVICE := generic
 PRODUCT_NAME := generic
 
-$(call enforce-product-packages-exist,)
+allowed_list := product_manifest.xml
+$(call enforce-product-packages-exist,$(allowed_list))
diff --git a/target/product/generic_no_telephony.mk b/target/product/generic_no_telephony.mk
index 324d36f..eb12872 100644
--- a/target/product/generic_no_telephony.mk
+++ b/target/product/generic_no_telephony.mk
@@ -21,6 +21,7 @@
 # base_<x>.mk or media_<x>.mk.
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
 
diff --git a/target/product/go_defaults.mk b/target/product/go_defaults.mk
index 7bb6d91..b717486 100644
--- a/target/product/go_defaults.mk
+++ b/target/product/go_defaults.mk
@@ -15,7 +15,7 @@
 #
 
 # Inherit common Android Go defaults.
-$(call inherit-product, build/target/product/go_defaults_common.mk)
+$(call inherit-product, build/make/target/product/go_defaults_common.mk)
 
 # Add the system properties.
 TARGET_SYSTEM_PROP += \
diff --git a/target/product/go_defaults_512.mk b/target/product/go_defaults_512.mk
index 5542818..70d067e 100644
--- a/target/product/go_defaults_512.mk
+++ b/target/product/go_defaults_512.mk
@@ -15,7 +15,7 @@
 #
 
 # Inherit common Android Go defaults.
-$(call inherit-product, build/target/product/go_defaults_common.mk)
+$(call inherit-product, build/make/target/product/go_defaults_common.mk)
 
 # Add the system properties.
 TARGET_SYSTEM_PROP += \
diff --git a/target/product/go_defaults_common.mk b/target/product/go_defaults_common.mk
index aee7f47..ca171df 100644
--- a/target/product/go_defaults_common.mk
+++ b/target/product/go_defaults_common.mk
@@ -20,7 +20,6 @@
 # Set lowram options and enable traced by default
 PRODUCT_PROPERTY_OVERRIDES += \
      ro.config.low_ram=true \
-     persist.traced.enable=1 \
 
 # Speed profile services and wifi-service to reduce RAM and storage.
 PRODUCT_SYSTEM_SERVER_COMPILER_FILTER := speed-profile
@@ -39,6 +38,9 @@
 
 # Do not spin up a separate process for the network stack on go devices, use an in-process APK.
 PRODUCT_PACKAGES += InProcessNetworkStack
+PRODUCT_PACKAGES += CellBroadcastAppPlatform
+PRODUCT_PACKAGES += CellBroadcastServiceModulePlatform
+PRODUCT_PACKAGES += com.android.tethering.inprocess
 
 # Strip the local variable table and the local variable type table to reduce
 # the size of the system image. This has no bearing on stack traces, but will
@@ -57,3 +59,6 @@
 # use the go specific handheld_core_hardware.xml from frameworks
 PRODUCT_COPY_FILES += \
     frameworks/native/data/etc/go_handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml
+
+# Dedupe VNDK libraries with identical core variants.
+TARGET_VNDK_USE_CORE_VARIANT := true
diff --git a/target/product/gsi/30.txt b/target/product/gsi/30.txt
new file mode 100644
index 0000000..0589517
--- /dev/null
+++ b/target/product/gsi/30.txt
@@ -0,0 +1,309 @@
+LLNDK: libEGL.so
+LLNDK: libGLESv1_CM.so
+LLNDK: libGLESv2.so
+LLNDK: libGLESv3.so
+LLNDK: libRS.so
+LLNDK: libandroid_net.so
+LLNDK: libbinder_ndk.so
+LLNDK: libc.so
+LLNDK: libcgrouprc.so
+LLNDK: libdl.so
+LLNDK: libft2.so
+LLNDK: liblog.so
+LLNDK: libm.so
+LLNDK: libmediandk.so
+LLNDK: libnativewindow.so
+LLNDK: libneuralnetworks.so
+LLNDK: libselinux.so
+LLNDK: libsync.so
+LLNDK: libvndksupport.so
+LLNDK: libvulkan.so
+VNDK-SP: android.hardware.common-V1-ndk_platform.so
+VNDK-SP: android.hardware.graphics.common-V1-ndk_platform.so
+VNDK-SP: android.hardware.graphics.common@1.0.so
+VNDK-SP: android.hardware.graphics.common@1.1.so
+VNDK-SP: android.hardware.graphics.common@1.2.so
+VNDK-SP: android.hardware.graphics.mapper@2.0.so
+VNDK-SP: android.hardware.graphics.mapper@2.1.so
+VNDK-SP: android.hardware.graphics.mapper@3.0.so
+VNDK-SP: android.hardware.graphics.mapper@4.0.so
+VNDK-SP: android.hardware.renderscript@1.0.so
+VNDK-SP: android.hidl.memory.token@1.0.so
+VNDK-SP: android.hidl.memory@1.0-impl.so
+VNDK-SP: android.hidl.memory@1.0.so
+VNDK-SP: android.hidl.safe_union@1.0.so
+VNDK-SP: libRSCpuRef.so
+VNDK-SP: libRSDriver.so
+VNDK-SP: libRS_internal.so
+VNDK-SP: libbacktrace.so
+VNDK-SP: libbase.so
+VNDK-SP: libbcinfo.so
+VNDK-SP: libblas.so
+VNDK-SP: libc++.so
+VNDK-SP: libcompiler_rt.so
+VNDK-SP: libcutils.so
+VNDK-SP: libgralloctypes.so
+VNDK-SP: libhardware.so
+VNDK-SP: libhidlbase.so
+VNDK-SP: libhidlmemory.so
+VNDK-SP: libion.so
+VNDK-SP: libjsoncpp.so
+VNDK-SP: liblzma.so
+VNDK-SP: libprocessgroup.so
+VNDK-SP: libunwindstack.so
+VNDK-SP: libutils.so
+VNDK-SP: libutilscallstack.so
+VNDK-SP: libz.so
+VNDK-core: android.frameworks.automotive.display@1.0.so
+VNDK-core: android.frameworks.cameraservice.common@2.0.so
+VNDK-core: android.frameworks.cameraservice.device@2.0.so
+VNDK-core: android.frameworks.cameraservice.service@2.0.so
+VNDK-core: android.frameworks.cameraservice.service@2.1.so
+VNDK-core: android.frameworks.displayservice@1.0.so
+VNDK-core: android.frameworks.schedulerservice@1.0.so
+VNDK-core: android.frameworks.sensorservice@1.0.so
+VNDK-core: android.frameworks.stats@1.0.so
+VNDK-core: android.hardware.atrace@1.0.so
+VNDK-core: android.hardware.audio.common@2.0.so
+VNDK-core: android.hardware.audio.common@4.0.so
+VNDK-core: android.hardware.audio.common@5.0.so
+VNDK-core: android.hardware.audio.common@6.0.so
+VNDK-core: android.hardware.audio.effect@2.0.so
+VNDK-core: android.hardware.audio.effect@4.0.so
+VNDK-core: android.hardware.audio.effect@5.0.so
+VNDK-core: android.hardware.audio.effect@6.0.so
+VNDK-core: android.hardware.audio@2.0.so
+VNDK-core: android.hardware.audio@4.0.so
+VNDK-core: android.hardware.audio@5.0.so
+VNDK-core: android.hardware.audio@6.0.so
+VNDK-core: android.hardware.authsecret@1.0.so
+VNDK-core: android.hardware.automotive.audiocontrol@1.0.so
+VNDK-core: android.hardware.automotive.audiocontrol@2.0.so
+VNDK-core: android.hardware.automotive.can@1.0.so
+VNDK-core: android.hardware.automotive.evs@1.0.so
+VNDK-core: android.hardware.automotive.evs@1.1.so
+VNDK-core: android.hardware.automotive.occupant_awareness-V1-ndk_platform.so
+VNDK-core: android.hardware.automotive.sv@1.0.so
+VNDK-core: android.hardware.automotive.vehicle@2.0.so
+VNDK-core: android.hardware.biometrics.face@1.0.so
+VNDK-core: android.hardware.biometrics.fingerprint@2.1.so
+VNDK-core: android.hardware.biometrics.fingerprint@2.2.so
+VNDK-core: android.hardware.bluetooth.a2dp@1.0.so
+VNDK-core: android.hardware.bluetooth.audio@2.0.so
+VNDK-core: android.hardware.bluetooth@1.0.so
+VNDK-core: android.hardware.bluetooth@1.1.so
+VNDK-core: android.hardware.boot@1.0.so
+VNDK-core: android.hardware.boot@1.1.so
+VNDK-core: android.hardware.broadcastradio@1.0.so
+VNDK-core: android.hardware.broadcastradio@1.1.so
+VNDK-core: android.hardware.broadcastradio@2.0.so
+VNDK-core: android.hardware.camera.common@1.0.so
+VNDK-core: android.hardware.camera.device@1.0.so
+VNDK-core: android.hardware.camera.device@3.2.so
+VNDK-core: android.hardware.camera.device@3.3.so
+VNDK-core: android.hardware.camera.device@3.4.so
+VNDK-core: android.hardware.camera.device@3.5.so
+VNDK-core: android.hardware.camera.device@3.6.so
+VNDK-core: android.hardware.camera.metadata@3.2.so
+VNDK-core: android.hardware.camera.metadata@3.3.so
+VNDK-core: android.hardware.camera.metadata@3.4.so
+VNDK-core: android.hardware.camera.metadata@3.5.so
+VNDK-core: android.hardware.camera.provider@2.4.so
+VNDK-core: android.hardware.camera.provider@2.5.so
+VNDK-core: android.hardware.camera.provider@2.6.so
+VNDK-core: android.hardware.cas.native@1.0.so
+VNDK-core: android.hardware.cas@1.0.so
+VNDK-core: android.hardware.cas@1.1.so
+VNDK-core: android.hardware.cas@1.2.so
+VNDK-core: android.hardware.configstore-utils.so
+VNDK-core: android.hardware.configstore@1.0.so
+VNDK-core: android.hardware.configstore@1.1.so
+VNDK-core: android.hardware.confirmationui-support-lib.so
+VNDK-core: android.hardware.confirmationui@1.0.so
+VNDK-core: android.hardware.contexthub@1.0.so
+VNDK-core: android.hardware.contexthub@1.1.so
+VNDK-core: android.hardware.drm@1.0.so
+VNDK-core: android.hardware.drm@1.1.so
+VNDK-core: android.hardware.drm@1.2.so
+VNDK-core: android.hardware.drm@1.3.so
+VNDK-core: android.hardware.dumpstate@1.0.so
+VNDK-core: android.hardware.dumpstate@1.1.so
+VNDK-core: android.hardware.fastboot@1.0.so
+VNDK-core: android.hardware.gatekeeper@1.0.so
+VNDK-core: android.hardware.gnss.measurement_corrections@1.0.so
+VNDK-core: android.hardware.gnss.measurement_corrections@1.1.so
+VNDK-core: android.hardware.gnss.visibility_control@1.0.so
+VNDK-core: android.hardware.gnss@1.0.so
+VNDK-core: android.hardware.gnss@1.1.so
+VNDK-core: android.hardware.gnss@2.0.so
+VNDK-core: android.hardware.gnss@2.1.so
+VNDK-core: android.hardware.graphics.allocator@2.0.so
+VNDK-core: android.hardware.graphics.allocator@3.0.so
+VNDK-core: android.hardware.graphics.allocator@4.0.so
+VNDK-core: android.hardware.graphics.bufferqueue@1.0.so
+VNDK-core: android.hardware.graphics.bufferqueue@2.0.so
+VNDK-core: android.hardware.graphics.composer@2.1.so
+VNDK-core: android.hardware.graphics.composer@2.2.so
+VNDK-core: android.hardware.graphics.composer@2.3.so
+VNDK-core: android.hardware.graphics.composer@2.4.so
+VNDK-core: android.hardware.health.storage@1.0.so
+VNDK-core: android.hardware.health@1.0.so
+VNDK-core: android.hardware.health@2.0.so
+VNDK-core: android.hardware.health@2.1.so
+VNDK-core: android.hardware.identity-V2-ndk_platform.so
+VNDK-core: android.hardware.input.classifier@1.0.so
+VNDK-core: android.hardware.input.common@1.0.so
+VNDK-core: android.hardware.ir@1.0.so
+VNDK-core: android.hardware.keymaster-V2-ndk_platform.so
+VNDK-core: android.hardware.keymaster@3.0.so
+VNDK-core: android.hardware.keymaster@4.0.so
+VNDK-core: android.hardware.keymaster@4.1.so
+VNDK-core: android.hardware.light-V1-ndk_platform.so
+VNDK-core: android.hardware.light@2.0.so
+VNDK-core: android.hardware.media.bufferpool@1.0.so
+VNDK-core: android.hardware.media.bufferpool@2.0.so
+VNDK-core: android.hardware.media.c2@1.0.so
+VNDK-core: android.hardware.media.c2@1.1.so
+VNDK-core: android.hardware.media.omx@1.0.so
+VNDK-core: android.hardware.media@1.0.so
+VNDK-core: android.hardware.memtrack@1.0.so
+VNDK-core: android.hardware.neuralnetworks@1.0.so
+VNDK-core: android.hardware.neuralnetworks@1.1.so
+VNDK-core: android.hardware.neuralnetworks@1.2.so
+VNDK-core: android.hardware.neuralnetworks@1.3.so
+VNDK-core: android.hardware.nfc@1.0.so
+VNDK-core: android.hardware.nfc@1.1.so
+VNDK-core: android.hardware.nfc@1.2.so
+VNDK-core: android.hardware.oemlock@1.0.so
+VNDK-core: android.hardware.power-V1-ndk_platform.so
+VNDK-core: android.hardware.power.stats@1.0.so
+VNDK-core: android.hardware.power@1.0.so
+VNDK-core: android.hardware.power@1.1.so
+VNDK-core: android.hardware.power@1.2.so
+VNDK-core: android.hardware.power@1.3.so
+VNDK-core: android.hardware.radio.config@1.0.so
+VNDK-core: android.hardware.radio.config@1.1.so
+VNDK-core: android.hardware.radio.config@1.2.so
+VNDK-core: android.hardware.radio.deprecated@1.0.so
+VNDK-core: android.hardware.radio@1.0.so
+VNDK-core: android.hardware.radio@1.1.so
+VNDK-core: android.hardware.radio@1.2.so
+VNDK-core: android.hardware.radio@1.3.so
+VNDK-core: android.hardware.radio@1.4.so
+VNDK-core: android.hardware.radio@1.5.so
+VNDK-core: android.hardware.rebootescrow-V1-ndk_platform.so
+VNDK-core: android.hardware.secure_element@1.0.so
+VNDK-core: android.hardware.secure_element@1.1.so
+VNDK-core: android.hardware.secure_element@1.2.so
+VNDK-core: android.hardware.sensors@1.0.so
+VNDK-core: android.hardware.sensors@2.0.so
+VNDK-core: android.hardware.sensors@2.1.so
+VNDK-core: android.hardware.soundtrigger@2.0-core.so
+VNDK-core: android.hardware.soundtrigger@2.0.so
+VNDK-core: android.hardware.soundtrigger@2.1.so
+VNDK-core: android.hardware.soundtrigger@2.2.so
+VNDK-core: android.hardware.soundtrigger@2.3.so
+VNDK-core: android.hardware.tetheroffload.config@1.0.so
+VNDK-core: android.hardware.tetheroffload.control@1.0.so
+VNDK-core: android.hardware.thermal@1.0.so
+VNDK-core: android.hardware.thermal@1.1.so
+VNDK-core: android.hardware.thermal@2.0.so
+VNDK-core: android.hardware.tv.cec@1.0.so
+VNDK-core: android.hardware.tv.cec@2.0.so
+VNDK-core: android.hardware.tv.input@1.0.so
+VNDK-core: android.hardware.tv.tuner@1.0.so
+VNDK-core: android.hardware.usb.gadget@1.0.so
+VNDK-core: android.hardware.usb.gadget@1.1.so
+VNDK-core: android.hardware.usb@1.0.so
+VNDK-core: android.hardware.usb@1.1.so
+VNDK-core: android.hardware.usb@1.2.so
+VNDK-core: android.hardware.vibrator-V1-ndk_platform.so
+VNDK-core: android.hardware.vibrator@1.0.so
+VNDK-core: android.hardware.vibrator@1.1.so
+VNDK-core: android.hardware.vibrator@1.2.so
+VNDK-core: android.hardware.vibrator@1.3.so
+VNDK-core: android.hardware.vr@1.0.so
+VNDK-core: android.hardware.weaver@1.0.so
+VNDK-core: android.hardware.wifi.hostapd@1.0.so
+VNDK-core: android.hardware.wifi.hostapd@1.1.so
+VNDK-core: android.hardware.wifi.hostapd@1.2.so
+VNDK-core: android.hardware.wifi.offload@1.0.so
+VNDK-core: android.hardware.wifi.supplicant@1.0.so
+VNDK-core: android.hardware.wifi.supplicant@1.1.so
+VNDK-core: android.hardware.wifi.supplicant@1.2.so
+VNDK-core: android.hardware.wifi.supplicant@1.3.so
+VNDK-core: android.hardware.wifi@1.0.so
+VNDK-core: android.hardware.wifi@1.1.so
+VNDK-core: android.hardware.wifi@1.2.so
+VNDK-core: android.hardware.wifi@1.3.so
+VNDK-core: android.hardware.wifi@1.4.so
+VNDK-core: android.hidl.allocator@1.0.so
+VNDK-core: android.hidl.memory.block@1.0.so
+VNDK-core: android.hidl.token@1.0-utils.so
+VNDK-core: android.hidl.token@1.0.so
+VNDK-core: android.system.net.netd@1.0.so
+VNDK-core: android.system.net.netd@1.1.so
+VNDK-core: android.system.suspend@1.0.so
+VNDK-core: android.system.wifi.keystore@1.0.so
+VNDK-core: libadf.so
+VNDK-core: libaudioroute.so
+VNDK-core: libaudioutils.so
+VNDK-core: libbinder.so
+VNDK-core: libbufferqueueconverter.so
+VNDK-core: libcamera_metadata.so
+VNDK-core: libcap.so
+VNDK-core: libcn-cbor.so
+VNDK-core: libcodec2.so
+VNDK-core: libcrypto.so
+VNDK-core: libcrypto_utils.so
+VNDK-core: libcurl.so
+VNDK-core: libdiskconfig.so
+VNDK-core: libdumpstateutil.so
+VNDK-core: libevent.so
+VNDK-core: libexif.so
+VNDK-core: libexpat.so
+VNDK-core: libfmq.so
+VNDK-core: libgatekeeper.so
+VNDK-core: libgui.so
+VNDK-core: libhardware_legacy.so
+VNDK-core: libhidlallocatorutils.so
+VNDK-core: libjpeg.so
+VNDK-core: libldacBT_abr.so
+VNDK-core: libldacBT_enc.so
+VNDK-core: liblz4.so
+VNDK-core: libmedia_helper.so
+VNDK-core: libmedia_omx.so
+VNDK-core: libmemtrack.so
+VNDK-core: libminijail.so
+VNDK-core: libmkbootimg_abi_check.so
+VNDK-core: libnetutils.so
+VNDK-core: libnl.so
+VNDK-core: libpcre2.so
+VNDK-core: libpiex.so
+VNDK-core: libpng.so
+VNDK-core: libpower.so
+VNDK-core: libprocinfo.so
+VNDK-core: libradio_metadata.so
+VNDK-core: libspeexresampler.so
+VNDK-core: libsqlite.so
+VNDK-core: libssl.so
+VNDK-core: libstagefright_bufferpool@2.0.so
+VNDK-core: libstagefright_bufferqueue_helper.so
+VNDK-core: libstagefright_foundation.so
+VNDK-core: libstagefright_omx.so
+VNDK-core: libstagefright_omx_utils.so
+VNDK-core: libstagefright_xmlparser.so
+VNDK-core: libsysutils.so
+VNDK-core: libtinyalsa.so
+VNDK-core: libtinyxml2.so
+VNDK-core: libui.so
+VNDK-core: libusbhost.so
+VNDK-core: libwifi-system-iface.so
+VNDK-core: libxml2.so
+VNDK-core: libyuv.so
+VNDK-core: libziparchive.so
+VNDK-private: libbacktrace.so
+VNDK-private: libblas.so
+VNDK-private: libcompiler_rt.so
+VNDK-private: libft2.so
+VNDK-private: libgui.so
diff --git a/tools/makeparallel/Android.bp b/target/product/gsi/Android.bp
similarity index 71%
rename from tools/makeparallel/Android.bp
rename to target/product/gsi/Android.bp
index 898db68..b7ce86e 100644
--- a/tools/makeparallel/Android.bp
+++ b/target/product/gsi/Android.bp
@@ -1,10 +1,10 @@
-// Copyright 2016 Google Inc. All rights reserved
+// Copyright 2020 Google Inc. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//      http://www.apache.org/licenses/LICENSE-2.0
+//     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ -12,10 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-cc_binary_host {
-    name: "makeparallel",
+filegroup {
+    name: "vndk_lib_lists",
     srcs: [
-        "makeparallel.cpp",
+        "*.txt",
     ],
-    cflags: ["-Wall", "-Werror"],
 }
diff --git a/target/product/gsi/Android.mk b/target/product/gsi/Android.mk
index eaaa051..c491d4a 100644
--- a/target/product/gsi/Android.mk
+++ b/target/product/gsi/Android.mk
@@ -1,20 +1,8 @@
 LOCAL_PATH:= $(call my-dir)
 
 #####################################################################
-# Create the list of vndk libraries from the source code.
-INTERNAL_VNDK_LIB_LIST := $(call intermediates-dir-for,PACKAGING,vndk)/libs.txt
-$(INTERNAL_VNDK_LIB_LIST):
-	@echo "Generate: $@"
-	@mkdir -p $(dir $@)
-	$(hide) echo -n > $@
-	$(hide) $(foreach lib, $(filter-out libclang_rt.%,$(LLNDK_LIBRARIES)), \
-	  echo LLNDK: $(lib).so >> $@;)
-	$(hide) $(foreach lib, $(VNDK_SAMEPROCESS_LIBRARIES), \
-	  echo VNDK-SP: $(lib).so >> $@;)
-	$(hide) $(foreach lib, $(filter-out libclang_rt.%,$(VNDK_CORE_LIBRARIES)), \
-	  echo VNDK-core: $(lib).so >> $@;)
-	$(hide) $(foreach lib, $(VNDK_PRIVATE_LIBRARIES), \
-	  echo VNDK-private: $(lib).so >> $@;)
+# list of vndk libraries from the source code.
+INTERNAL_VNDK_LIB_LIST := $(SOONG_VNDK_LIBRARIES_FILE)
 
 #####################################################################
 # This is the up-to-date list of vndk libs.
@@ -38,6 +26,7 @@
 droidcore: check-vndk-list
 
 check-vndk-list-timestamp := $(call intermediates-dir-for,PACKAGING,vndk)/check-list-timestamp
+check-vndk-abi-dump-list-timestamp := $(call intermediates-dir-for,PACKAGING,vndk)/check-abi-dump-list-timestamp
 
 ifeq ($(TARGET_IS_64_BIT)|$(TARGET_2ND_ARCH),true|)
 # TODO(b/110429754) remove this condition when we support 64-bit-only device
@@ -46,15 +35,23 @@
 # b/118634643: don't check VNDK lib list when building PDK. Some libs (libandroid_net.so
 # and some render-script related ones) can't be built in PDK due to missing frameworks/base.
 check-vndk-list: ;
+else ifeq ($(TARGET_SKIP_CURRENT_VNDK),true)
+check-vndk-list: ;
+else ifeq ($(BOARD_VNDK_VERSION),)
+# b/143233626 do not check vndk-list when vndk libs are not built
+check-vndk-list: ;
 else
 check-vndk-list: $(check-vndk-list-timestamp)
+ifneq ($(SKIP_ABI_CHECKS),true)
+check-vndk-list: $(check-vndk-abi-dump-list-timestamp)
+endif
 endif
 
 _vndk_check_failure_message := " error: VNDK library list has been changed.\n"
 ifeq (REL,$(PLATFORM_VERSION_CODENAME))
 _vndk_check_failure_message += "       Changing the VNDK library list is not allowed in API locked branches."
 else
-_vndk_check_failure_message += "       Run update-vndk-list.sh to update $(LATEST_VNDK_LIB_LIST)"
+_vndk_check_failure_message += "       Run \`update-vndk-list.sh\` to update $(LATEST_VNDK_LIB_LIST)"
 endif
 
 $(check-vndk-list-timestamp): $(INTERNAL_VNDK_LIB_LIST) $(LATEST_VNDK_LIB_LIST) $(HOST_OUT_EXECUTABLES)/update-vndk-list.sh
@@ -95,32 +92,122 @@
 endif
 	@chmod a+x $@
 
+#####################################################################
+# Check that all ABI reference dumps have corresponding
+# NDK/VNDK/PLATFORM libraries.
+
+# $(1): The directory containing ABI dumps.
+# Return a list of ABI dump paths ending with .so.lsdump.
+define find-abi-dump-paths
+$(if $(wildcard $(1)), \
+  $(addprefix $(1)/, \
+    $(call find-files-in-subdirs,$(1),"*.so.lsdump" -and -type f,.)))
+endef
+
+# $(1): A list of tags.
+# $(2): A list of tag:path.
+# Return the file names of the ABI dumps that match the tags.
+define filter-abi-dump-paths
+$(eval tag_patterns := $(foreach tag,$(1),$(tag):%))
+$(notdir $(patsubst $(tag_patterns),%,$(filter $(tag_patterns),$(2))))
+endef
+
+VNDK_ABI_DUMP_DIR := prebuilts/abi-dumps/vndk/$(PLATFORM_VNDK_VERSION)
+NDK_ABI_DUMP_DIR := prebuilts/abi-dumps/ndk/$(PLATFORM_VNDK_VERSION)
+PLATFORM_ABI_DUMP_DIR := prebuilts/abi-dumps/platform/$(PLATFORM_VNDK_VERSION)
+VNDK_ABI_DUMPS := $(call find-abi-dump-paths,$(VNDK_ABI_DUMP_DIR))
+NDK_ABI_DUMPS := $(call find-abi-dump-paths,$(NDK_ABI_DUMP_DIR))
+PLATFORM_ABI_DUMPS := $(call find-abi-dump-paths,$(PLATFORM_ABI_DUMP_DIR))
+
+$(check-vndk-abi-dump-list-timestamp): PRIVATE_LSDUMP_PATHS := $(LSDUMP_PATHS)
+$(check-vndk-abi-dump-list-timestamp):
+	$(eval added_vndk_abi_dumps := $(strip $(sort $(filter-out \
+	  $(call filter-abi-dump-paths,LLNDK VNDK-SP VNDK-core,$(PRIVATE_LSDUMP_PATHS)), \
+	  $(notdir $(VNDK_ABI_DUMPS))))))
+	$(if $(added_vndk_abi_dumps), \
+	  echo -e "Found unexpected ABI reference dump files under $(VNDK_ABI_DUMP_DIR). It is caused by mismatch between Android.bp and the dump files. Run \`find \$${ANDROID_BUILD_TOP}/$(VNDK_ABI_DUMP_DIR) '(' -name $(subst $(space), -or -name ,$(added_vndk_abi_dumps)) ')' -delete\` to delete the dump files.")
+
+	$(eval added_ndk_abi_dumps := $(strip $(sort $(filter-out \
+	  $(call filter-abi-dump-paths,NDK,$(PRIVATE_LSDUMP_PATHS)), \
+	  $(notdir $(NDK_ABI_DUMPS))))))
+	$(if $(added_ndk_abi_dumps), \
+	  echo -e "Found unexpected ABI reference dump files under $(NDK_ABI_DUMP_DIR). It is caused by mismatch between Android.bp and the dump files. Run \`find \$${ANDROID_BUILD_TOP}/$(NDK_ABI_DUMP_DIR) '(' -name $(subst $(space), -or -name ,$(added_ndk_abi_dumps)) ')' -delete\` to delete the dump files.")
+
+	$(eval added_platform_abi_dumps := $(strip $(sort $(filter-out \
+	  $(call filter-abi-dump-paths,PLATFORM,$(PRIVATE_LSDUMP_PATHS)), \
+	  $(notdir $(PLATFORM_ABI_DUMPS))))))
+	$(if $(added_platform_abi_dumps), \
+	  echo -e "Found unexpected ABI reference dump files under $(PLATFORM_ABI_DUMP_DIR). It is caused by mismatch between Android.bp and the dump files. Run \`find \$${ANDROID_BUILD_TOP}/$(PLATFORM_ABI_DUMP_DIR) '(' -name $(subst $(space), -or -name ,$(added_platform_abi_dumps)) ')' -delete\` to delete the dump files.")
+
+	$(if $(added_vndk_abi_dumps)$(added_ndk_abi_dumps)$(added_platform_abi_dumps),exit 1)
+	$(hide) mkdir -p $(dir $@)
+	$(hide) touch $@
+
+#####################################################################
+# VNDK package and snapshot.
+
 ifneq ($(BOARD_VNDK_VERSION),)
 
 include $(CLEAR_VARS)
 LOCAL_MODULE := vndk_package
+# Filter LLNDK libs moved to APEX to avoid pulling them into /system/LIB
 LOCAL_REQUIRED_MODULES := \
-    $(LLNDK_LIBRARIES) \
-    llndk.libraries.txt \
-    vndksp.libraries.txt
+    $(filter-out $(LLNDK_MOVED_TO_APEX_LIBRARIES),$(LLNDK_LIBRARIES))
+
 ifneq ($(TARGET_SKIP_CURRENT_VNDK),true)
 LOCAL_REQUIRED_MODULES += \
+    vndkcorevariant.libraries.txt \
     $(addsuffix .vendor,$(VNDK_CORE_LIBRARIES)) \
-    $(addsuffix .vendor,$(VNDK_SAMEPROCESS_LIBRARIES))
+    $(addsuffix .vendor,$(VNDK_SAMEPROCESS_LIBRARIES)) \
+    $(VNDK_USING_CORE_VARIANT_LIBRARIES) \
+    com.android.vndk.current
 endif
 include $(BUILD_PHONY_PACKAGE)
 
 include $(CLEAR_VARS)
-LOCAL_MODULE := vndk_snapshot_package
-_binder32 :=
-ifneq ($(TARGET_USES_64_BIT_BINDER),true)
-ifneq ($(TARGET_IS_64_BIT),true)
-_binder32 := _binder32
+_vndk_versions := $(PRODUCT_EXTRA_VNDK_VERSIONS)
+ifneq ($(BOARD_VNDK_VERSION),current)
+	_vndk_versions += $(BOARD_VNDK_VERSION)
 endif
-endif
-LOCAL_REQUIRED_MODULES := \
-    $(foreach vndk_ver,$(PRODUCT_EXTRA_VNDK_VERSIONS),vndk_v$(vndk_ver)_$(TARGET_ARCH)$(_binder32))
-_binder32 :=
+LOCAL_MODULE := vndk_apex_snapshot_package
+LOCAL_REQUIRED_MODULES := $(foreach vndk_ver,$(_vndk_versions),com.android.vndk.v$(vndk_ver))
 include $(BUILD_PHONY_PACKAGE)
 
+_vndk_versions :=
+
 endif # BOARD_VNDK_VERSION is set
+
+#####################################################################
+# skip_mount.cfg, read by init to skip mounting some partitions when GSI is used.
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := gsi_skip_mount.cfg
+LOCAL_MODULE_STEM := skip_mount.cfg
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+LOCAL_MODULE_CLASS := ETC
+LOCAL_SYSTEM_EXT_MODULE := true
+LOCAL_MODULE_RELATIVE_PATH := init/config
+
+# Adds a symlink under /system/etc/init/config pointing to /system/system_ext/etc/init/config
+# because first-stage init in Android 10.0 will read the skip_mount.cfg from /system/etc/* after
+# chroot /system.
+# TODO: remove this symlink when no need to support new GSI on Android 10.
+# The actual file needs to be under /system/system_ext because it's GSI-specific and does not
+# belong to core CSI.
+LOCAL_POST_INSTALL_CMD := \
+    mkdir -p $(TARGET_OUT)/etc/init; \
+    ln -sf /system/system_ext/etc/init/config $(TARGET_OUT)/etc/init/config
+
+include $(BUILD_PREBUILT)
+
+#####################################################################
+# init.gsi.rc, GSI-specific init script.
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := init.gsi.rc
+LOCAL_SRC_FILES := $(LOCAL_MODULE)
+LOCAL_MODULE_CLASS := ETC
+LOCAL_SYSTEM_EXT_MODULE := true
+LOCAL_MODULE_RELATIVE_PATH := init
+
+include $(BUILD_PREBUILT)
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index 14faba5..0589517 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -4,6 +4,7 @@
 LLNDK: libGLESv3.so
 LLNDK: libRS.so
 LLNDK: libandroid_net.so
+LLNDK: libbinder_ndk.so
 LLNDK: libc.so
 LLNDK: libcgrouprc.so
 LLNDK: libdl.so
@@ -13,19 +14,23 @@
 LLNDK: libmediandk.so
 LLNDK: libnativewindow.so
 LLNDK: libneuralnetworks.so
+LLNDK: libselinux.so
 LLNDK: libsync.so
 LLNDK: libvndksupport.so
 LLNDK: libvulkan.so
+VNDK-SP: android.hardware.common-V1-ndk_platform.so
+VNDK-SP: android.hardware.graphics.common-V1-ndk_platform.so
 VNDK-SP: android.hardware.graphics.common@1.0.so
 VNDK-SP: android.hardware.graphics.common@1.1.so
 VNDK-SP: android.hardware.graphics.common@1.2.so
 VNDK-SP: android.hardware.graphics.mapper@2.0.so
 VNDK-SP: android.hardware.graphics.mapper@2.1.so
 VNDK-SP: android.hardware.graphics.mapper@3.0.so
+VNDK-SP: android.hardware.graphics.mapper@4.0.so
 VNDK-SP: android.hardware.renderscript@1.0.so
 VNDK-SP: android.hidl.memory.token@1.0.so
-VNDK-SP: android.hidl.memory@1.0.so
 VNDK-SP: android.hidl.memory@1.0-impl.so
+VNDK-SP: android.hidl.memory@1.0.so
 VNDK-SP: android.hidl.safe_union@1.0.so
 VNDK-SP: libRSCpuRef.so
 VNDK-SP: libRSDriver.so
@@ -33,17 +38,14 @@
 VNDK-SP: libbacktrace.so
 VNDK-SP: libbase.so
 VNDK-SP: libbcinfo.so
-VNDK-SP: libbinderthreadstate.so
 VNDK-SP: libblas.so
 VNDK-SP: libc++.so
 VNDK-SP: libcompiler_rt.so
 VNDK-SP: libcutils.so
+VNDK-SP: libgralloctypes.so
 VNDK-SP: libhardware.so
 VNDK-SP: libhidlbase.so
 VNDK-SP: libhidlmemory.so
-VNDK-SP: libhidltransport.so
-VNDK-SP: libhwbinder.so
-VNDK-SP: libhwbinder_noltopgo.so
 VNDK-SP: libion.so
 VNDK-SP: libjsoncpp.so
 VNDK-SP: liblzma.so
@@ -52,34 +54,46 @@
 VNDK-SP: libutils.so
 VNDK-SP: libutilscallstack.so
 VNDK-SP: libz.so
+VNDK-core: android.frameworks.automotive.display@1.0.so
 VNDK-core: android.frameworks.cameraservice.common@2.0.so
 VNDK-core: android.frameworks.cameraservice.device@2.0.so
 VNDK-core: android.frameworks.cameraservice.service@2.0.so
+VNDK-core: android.frameworks.cameraservice.service@2.1.so
 VNDK-core: android.frameworks.displayservice@1.0.so
 VNDK-core: android.frameworks.schedulerservice@1.0.so
 VNDK-core: android.frameworks.sensorservice@1.0.so
 VNDK-core: android.frameworks.stats@1.0.so
-VNDK-core: android.frameworks.vr.composer@1.0.so
 VNDK-core: android.hardware.atrace@1.0.so
 VNDK-core: android.hardware.audio.common@2.0.so
 VNDK-core: android.hardware.audio.common@4.0.so
 VNDK-core: android.hardware.audio.common@5.0.so
+VNDK-core: android.hardware.audio.common@6.0.so
 VNDK-core: android.hardware.audio.effect@2.0.so
 VNDK-core: android.hardware.audio.effect@4.0.so
 VNDK-core: android.hardware.audio.effect@5.0.so
+VNDK-core: android.hardware.audio.effect@6.0.so
 VNDK-core: android.hardware.audio@2.0.so
 VNDK-core: android.hardware.audio@4.0.so
 VNDK-core: android.hardware.audio@5.0.so
+VNDK-core: android.hardware.audio@6.0.so
 VNDK-core: android.hardware.authsecret@1.0.so
 VNDK-core: android.hardware.automotive.audiocontrol@1.0.so
+VNDK-core: android.hardware.automotive.audiocontrol@2.0.so
+VNDK-core: android.hardware.automotive.can@1.0.so
 VNDK-core: android.hardware.automotive.evs@1.0.so
+VNDK-core: android.hardware.automotive.evs@1.1.so
+VNDK-core: android.hardware.automotive.occupant_awareness-V1-ndk_platform.so
+VNDK-core: android.hardware.automotive.sv@1.0.so
 VNDK-core: android.hardware.automotive.vehicle@2.0.so
 VNDK-core: android.hardware.biometrics.face@1.0.so
 VNDK-core: android.hardware.biometrics.fingerprint@2.1.so
+VNDK-core: android.hardware.biometrics.fingerprint@2.2.so
 VNDK-core: android.hardware.bluetooth.a2dp@1.0.so
 VNDK-core: android.hardware.bluetooth.audio@2.0.so
 VNDK-core: android.hardware.bluetooth@1.0.so
+VNDK-core: android.hardware.bluetooth@1.1.so
 VNDK-core: android.hardware.boot@1.0.so
+VNDK-core: android.hardware.boot@1.1.so
 VNDK-core: android.hardware.broadcastradio@1.0.so
 VNDK-core: android.hardware.broadcastradio@1.1.so
 VNDK-core: android.hardware.broadcastradio@2.0.so
@@ -89,60 +103,79 @@
 VNDK-core: android.hardware.camera.device@3.3.so
 VNDK-core: android.hardware.camera.device@3.4.so
 VNDK-core: android.hardware.camera.device@3.5.so
+VNDK-core: android.hardware.camera.device@3.6.so
 VNDK-core: android.hardware.camera.metadata@3.2.so
 VNDK-core: android.hardware.camera.metadata@3.3.so
 VNDK-core: android.hardware.camera.metadata@3.4.so
+VNDK-core: android.hardware.camera.metadata@3.5.so
 VNDK-core: android.hardware.camera.provider@2.4.so
 VNDK-core: android.hardware.camera.provider@2.5.so
+VNDK-core: android.hardware.camera.provider@2.6.so
 VNDK-core: android.hardware.cas.native@1.0.so
 VNDK-core: android.hardware.cas@1.0.so
 VNDK-core: android.hardware.cas@1.1.so
+VNDK-core: android.hardware.cas@1.2.so
 VNDK-core: android.hardware.configstore-utils.so
 VNDK-core: android.hardware.configstore@1.0.so
 VNDK-core: android.hardware.configstore@1.1.so
 VNDK-core: android.hardware.confirmationui-support-lib.so
 VNDK-core: android.hardware.confirmationui@1.0.so
 VNDK-core: android.hardware.contexthub@1.0.so
+VNDK-core: android.hardware.contexthub@1.1.so
 VNDK-core: android.hardware.drm@1.0.so
 VNDK-core: android.hardware.drm@1.1.so
 VNDK-core: android.hardware.drm@1.2.so
+VNDK-core: android.hardware.drm@1.3.so
 VNDK-core: android.hardware.dumpstate@1.0.so
+VNDK-core: android.hardware.dumpstate@1.1.so
 VNDK-core: android.hardware.fastboot@1.0.so
 VNDK-core: android.hardware.gatekeeper@1.0.so
 VNDK-core: android.hardware.gnss.measurement_corrections@1.0.so
+VNDK-core: android.hardware.gnss.measurement_corrections@1.1.so
 VNDK-core: android.hardware.gnss.visibility_control@1.0.so
 VNDK-core: android.hardware.gnss@1.0.so
 VNDK-core: android.hardware.gnss@1.1.so
 VNDK-core: android.hardware.gnss@2.0.so
+VNDK-core: android.hardware.gnss@2.1.so
 VNDK-core: android.hardware.graphics.allocator@2.0.so
 VNDK-core: android.hardware.graphics.allocator@3.0.so
+VNDK-core: android.hardware.graphics.allocator@4.0.so
 VNDK-core: android.hardware.graphics.bufferqueue@1.0.so
 VNDK-core: android.hardware.graphics.bufferqueue@2.0.so
 VNDK-core: android.hardware.graphics.composer@2.1.so
 VNDK-core: android.hardware.graphics.composer@2.2.so
 VNDK-core: android.hardware.graphics.composer@2.3.so
+VNDK-core: android.hardware.graphics.composer@2.4.so
 VNDK-core: android.hardware.health.storage@1.0.so
 VNDK-core: android.hardware.health@1.0.so
 VNDK-core: android.hardware.health@2.0.so
+VNDK-core: android.hardware.health@2.1.so
+VNDK-core: android.hardware.identity-V2-ndk_platform.so
 VNDK-core: android.hardware.input.classifier@1.0.so
 VNDK-core: android.hardware.input.common@1.0.so
 VNDK-core: android.hardware.ir@1.0.so
+VNDK-core: android.hardware.keymaster-V2-ndk_platform.so
 VNDK-core: android.hardware.keymaster@3.0.so
 VNDK-core: android.hardware.keymaster@4.0.so
+VNDK-core: android.hardware.keymaster@4.1.so
+VNDK-core: android.hardware.light-V1-ndk_platform.so
 VNDK-core: android.hardware.light@2.0.so
 VNDK-core: android.hardware.media.bufferpool@1.0.so
 VNDK-core: android.hardware.media.bufferpool@2.0.so
 VNDK-core: android.hardware.media.c2@1.0.so
+VNDK-core: android.hardware.media.c2@1.1.so
 VNDK-core: android.hardware.media.omx@1.0.so
 VNDK-core: android.hardware.media@1.0.so
 VNDK-core: android.hardware.memtrack@1.0.so
 VNDK-core: android.hardware.neuralnetworks@1.0.so
 VNDK-core: android.hardware.neuralnetworks@1.1.so
 VNDK-core: android.hardware.neuralnetworks@1.2.so
+VNDK-core: android.hardware.neuralnetworks@1.3.so
 VNDK-core: android.hardware.nfc@1.0.so
 VNDK-core: android.hardware.nfc@1.1.so
 VNDK-core: android.hardware.nfc@1.2.so
 VNDK-core: android.hardware.oemlock@1.0.so
+VNDK-core: android.hardware.power-V1-ndk_platform.so
 VNDK-core: android.hardware.power.stats@1.0.so
 VNDK-core: android.hardware.power@1.0.so
 VNDK-core: android.hardware.power@1.1.so
@@ -157,14 +190,19 @@
 VNDK-core: android.hardware.radio@1.2.so
 VNDK-core: android.hardware.radio@1.3.so
 VNDK-core: android.hardware.radio@1.4.so
+VNDK-core: android.hardware.radio@1.5.so
+VNDK-core: android.hardware.rebootescrow-V1-ndk_platform.so
 VNDK-core: android.hardware.secure_element@1.0.so
 VNDK-core: android.hardware.secure_element@1.1.so
+VNDK-core: android.hardware.secure_element@1.2.so
 VNDK-core: android.hardware.sensors@1.0.so
 VNDK-core: android.hardware.sensors@2.0.so
-VNDK-core: android.hardware.soundtrigger@2.0.so
+VNDK-core: android.hardware.sensors@2.1.so
 VNDK-core: android.hardware.soundtrigger@2.0-core.so
+VNDK-core: android.hardware.soundtrigger@2.0.so
 VNDK-core: android.hardware.soundtrigger@2.1.so
 VNDK-core: android.hardware.soundtrigger@2.2.so
+VNDK-core: android.hardware.soundtrigger@2.3.so
 VNDK-core: android.hardware.tetheroffload.config@1.0.so
 VNDK-core: android.hardware.tetheroffload.control@1.0.so
 VNDK-core: android.hardware.thermal@1.0.so
@@ -173,10 +211,13 @@
 VNDK-core: android.hardware.tv.cec@1.0.so
 VNDK-core: android.hardware.tv.cec@2.0.so
 VNDK-core: android.hardware.tv.input@1.0.so
+VNDK-core: android.hardware.tv.tuner@1.0.so
 VNDK-core: android.hardware.usb.gadget@1.0.so
+VNDK-core: android.hardware.usb.gadget@1.1.so
 VNDK-core: android.hardware.usb@1.0.so
 VNDK-core: android.hardware.usb@1.1.so
 VNDK-core: android.hardware.usb@1.2.so
+VNDK-core: android.hardware.vibrator-V1-ndk_platform.so
 VNDK-core: android.hardware.vibrator@1.0.so
 VNDK-core: android.hardware.vibrator@1.1.so
 VNDK-core: android.hardware.vibrator@1.2.so
@@ -185,18 +226,21 @@
 VNDK-core: android.hardware.weaver@1.0.so
 VNDK-core: android.hardware.wifi.hostapd@1.0.so
 VNDK-core: android.hardware.wifi.hostapd@1.1.so
+VNDK-core: android.hardware.wifi.hostapd@1.2.so
 VNDK-core: android.hardware.wifi.offload@1.0.so
 VNDK-core: android.hardware.wifi.supplicant@1.0.so
 VNDK-core: android.hardware.wifi.supplicant@1.1.so
 VNDK-core: android.hardware.wifi.supplicant@1.2.so
+VNDK-core: android.hardware.wifi.supplicant@1.3.so
 VNDK-core: android.hardware.wifi@1.0.so
 VNDK-core: android.hardware.wifi@1.1.so
 VNDK-core: android.hardware.wifi@1.2.so
 VNDK-core: android.hardware.wifi@1.3.so
+VNDK-core: android.hardware.wifi@1.4.so
 VNDK-core: android.hidl.allocator@1.0.so
 VNDK-core: android.hidl.memory.block@1.0.so
-VNDK-core: android.hidl.token@1.0.so
 VNDK-core: android.hidl.token@1.0-utils.so
+VNDK-core: android.hidl.token@1.0.so
 VNDK-core: android.system.net.netd@1.0.so
 VNDK-core: android.system.net.netd@1.1.so
 VNDK-core: android.system.suspend@1.0.so
@@ -205,6 +249,7 @@
 VNDK-core: libaudioroute.so
 VNDK-core: libaudioutils.so
 VNDK-core: libbinder.so
+VNDK-core: libbufferqueueconverter.so
 VNDK-core: libcamera_metadata.so
 VNDK-core: libcap.so
 VNDK-core: libcn-cbor.so
@@ -222,10 +267,7 @@
 VNDK-core: libgui.so
 VNDK-core: libhardware_legacy.so
 VNDK-core: libhidlallocatorutils.so
-VNDK-core: libhidlcache.so
 VNDK-core: libjpeg.so
-VNDK-core: libkeymaster_messages.so
-VNDK-core: libkeymaster_portable.so
 VNDK-core: libldacBT_abr.so
 VNDK-core: libldacBT_enc.so
 VNDK-core: liblz4.so
@@ -241,12 +283,7 @@
 VNDK-core: libpng.so
 VNDK-core: libpower.so
 VNDK-core: libprocinfo.so
-VNDK-core: libprotobuf-cpp-full.so
-VNDK-core: libprotobuf-cpp-lite.so
-VNDK-core: libpuresoftkeymasterdevice.so
 VNDK-core: libradio_metadata.so
-VNDK-core: libselinux.so
-VNDK-core: libsoftkeymasterdevice.so
 VNDK-core: libspeexresampler.so
 VNDK-core: libsqlite.so
 VNDK-core: libssl.so
@@ -266,7 +303,6 @@
 VNDK-core: libyuv.so
 VNDK-core: libziparchive.so
 VNDK-private: libbacktrace.so
-VNDK-private: libbinderthreadstate.so
 VNDK-private: libblas.so
 VNDK-private: libcompiler_rt.so
 VNDK-private: libft2.so
diff --git a/target/product/gsi/gsi_skip_mount.cfg b/target/product/gsi/gsi_skip_mount.cfg
new file mode 100644
index 0000000..ad3c7d9
--- /dev/null
+++ b/target/product/gsi/gsi_skip_mount.cfg
@@ -0,0 +1,3 @@
+/oem
+/product
+/system_ext
diff --git a/target/product/gsi/skip_mount.cfg b/target/product/gsi/skip_mount.cfg
deleted file mode 100644
index 549767e..0000000
--- a/target/product/gsi/skip_mount.cfg
+++ /dev/null
@@ -1,2 +0,0 @@
-/product
-/product_services
diff --git a/target/product/gsi_arm64.mk b/target/product/gsi_arm64.mk
index b711d88..adf7ca5 100644
--- a/target/product/gsi_arm64.mk
+++ b/target/product/gsi_arm64.mk
@@ -14,22 +14,31 @@
 # limitations under the License.
 #
 
+#
+# All components inherited here go to system image
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_common.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
 # Enable mainline checking
 PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
 
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# Special settings for GSI releasing
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_release.mk)
+
 
 PRODUCT_NAME := gsi_arm64
 PRODUCT_DEVICE := gsi_arm64
diff --git a/target/product/gsi_common.mk b/target/product/gsi_common.mk
deleted file mode 100644
index 7578f92..0000000
--- a/target/product/gsi_common.mk
+++ /dev/null
@@ -1,96 +0,0 @@
-#
-# Copyright (C) 2019 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
-
-# GSI includes all AOSP product packages and placed under /system/product
-$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
-
-# Default AOSP sounds
-$(call inherit-product-if-exists, frameworks/base/data/sounds/AllAudio.mk)
-
-# GSI doesn't support apex for now.
-# Properties set in product take precedence over those in vendor.
-PRODUCT_PRODUCT_PROPERTIES += \
-    ro.apex.updatable=false
-
-# Additional settings used in all AOSP builds
-PRODUCT_PRODUCT_PROPERTIES += \
-    ro.config.ringtone=Ring_Synth_04.ogg \
-    ro.config.notification_sound=pixiedust.ogg \
-
-# The mainline checking whitelist, should be clean up
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    system/app/messaging/messaging.apk \
-    system/app/WAPPushManager/WAPPushManager.apk \
-    system/bin/healthd \
-    system/etc/init/healthd.rc \
-    system/etc/seccomp_policy/crash_dump.%.policy \
-    system/etc/seccomp_policy/mediacodec.policy \
-    system/etc/vintf/manifest/manifest_healthd.xml \
-    system/lib/libframesequence.so \
-    system/lib/libgiftranscode.so \
-    system/lib64/libframesequence.so \
-    system/lib64/libgiftranscode.so \
-
-# Some GSI builds enable dexpreopt, whitelist these preopt files
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += %.odex %.vdex %.art
-
-# Exclude GSI specific files
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    system/etc/init/config/skip_mount.cfg \
-    system/etc/init/init.gsi.rc \
-
-# Exclude all files under system/product and system/product_services
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    system/product/% \
-    system/product_services/%
-
-
-# Split selinux policy
-PRODUCT_FULL_TREBLE_OVERRIDE := true
-
-# Enable dynamic partition size
-PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
-
-# Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
-PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
-
-# GSI specific tasks on boot
-PRODUCT_COPY_FILES += \
-    build/make/target/product/gsi/skip_mount.cfg:system/etc/init/config/skip_mount.cfg \
-    build/make/target/product/gsi/init.gsi.rc:system/etc/init/init.gsi.rc \
-
-# Support addtional P vendor interface
-PRODUCT_EXTRA_VNDK_VERSIONS := 28
-
-# More AOSP packages
-PRODUCT_PACKAGES += \
-    messaging \
-    PhotoTable \
-    WAPPushManager \
-    WallpaperPicker \
-
-# Telephony:
-#   Provide a APN configuration to GSI product
-PRODUCT_COPY_FILES += \
-    device/sample/etc/apns-full-conf.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/apns-conf.xml
-
-# NFC:
-#   Provide a libnfc-nci.conf to GSI product
-PRODUCT_COPY_FILES += \
-    device/generic/common/nfc/libnfc-nci.conf:$(TARGET_COPY_OUT_PRODUCT)/etc/libnfc-nci.conf
diff --git a/target/product/gsi_release.mk b/target/product/gsi_release.mk
new file mode 100644
index 0000000..d3521fc
--- /dev/null
+++ b/target/product/gsi_release.mk
@@ -0,0 +1,58 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# The makefile contains the special settings for GSI releasing.
+# This makefile is used for the build targets which used for releasing GSI.
+#
+# For example:
+# - Released GSI contains skip_mount.cfg to skip mounting prodcut paritition
+# - Released GSI contains more VNDK packages to support old version vendors
+# - etc.
+#
+
+# Exclude all files under system/product and system/system_ext
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \
+    system/product/% \
+    system/system_ext/%
+
+# Split selinux policy
+PRODUCT_FULL_TREBLE_OVERRIDE := true
+
+# Enable dynamic partition size
+PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
+
+# Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
+PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
+
+# GSI targets should install "unflattened" APEXes in /system
+TARGET_FLATTEN_APEX := false
+
+# GSI targets should install "flattened" APEXes in /system_ext as well
+PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES := true
+
+# The flattened version of com.android.apex.cts.shim.v1 should be explicitly installed
+# because the shim apex is prebuilt one and PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES is not
+# supported for prebuilt_apex modules yet.
+PRODUCT_PACKAGES += com.android.apex.cts.shim.v1_with_prebuilts.flattened
+
+# GSI specific tasks on boot
+PRODUCT_PACKAGES += \
+    gsi_skip_mount.cfg \
+    init.gsi.rc
+
+# Support addtional P and Q VNDK packages
+PRODUCT_EXTRA_VNDK_VERSIONS := 28 29
diff --git a/target/product/handheld_product.mk b/target/product/handheld_product.mk
index 54dcaf2..2199c57 100644
--- a/target/product/handheld_product.mk
+++ b/target/product/handheld_product.mk
@@ -17,7 +17,7 @@
 # This makefile contains the product partition contents for
 # a generic phone or tablet device. Only add something here if
 # it definitely doesn't belong on other types of devices (if it
-# does, use base_vendor.mk).
+# does, use base_product.mk).
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_product.mk)
 
 # /product packages
@@ -29,16 +29,11 @@
     DeskClock \
     Gallery2 \
     LatinIME \
-    Launcher3QuickStep \
     Music \
     OneTimeInitializer \
-    Provision \
+    preinstalled-packages-platform-handheld-product.xml \
     QuickSearchBox \
-    Settings \
     SettingsIntelligence \
-    StorageManager \
-    SystemUI \
-    WallpaperCropper \
     frameworks-base-overlays
 
 PRODUCT_PACKAGES_DEBUG += \
diff --git a/target/product/handheld_system.mk b/target/product/handheld_system.mk
index 6463a54..77c103d 100644
--- a/target/product/handheld_system.mk
+++ b/target/product/handheld_system.mk
@@ -54,10 +54,9 @@
     librs_jni \
     ManagedProvisioning \
     MmsService \
-    MtpDocumentsProvider \
+    MtpService \
     MusicFX \
     NfcNci \
-    OsuLogin \
     PacProcessor \
     PrintRecommendationService \
     PrintSpooler \
diff --git a/target/product/handheld_system_ext.mk b/target/product/handheld_system_ext.mk
new file mode 100644
index 0000000..d935fbf
--- /dev/null
+++ b/target/product/handheld_system_ext.mk
@@ -0,0 +1,30 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This makefile contains the system_ext partition contents for
+# a generic phone or tablet device. Only add something here if
+# it definitely doesn't belong on other types of devices (if it
+# does, use base_system_ext.mk).
+$(call inherit-product, $(SRC_TARGET_DIR)/product/media_system_ext.mk)
+
+# /system_ext packages
+PRODUCT_PACKAGES += \
+    Launcher3QuickStep \
+    Provision \
+    Settings \
+    StorageManager \
+    SystemUI \
+    WallpaperCropper \
diff --git a/core/android_vts_host_config.mk b/target/product/iorap_large_memory_config.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/iorap_large_memory_config.mk
index 38ba19d..9aa6642 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/iorap_large_memory_config.mk
@@ -1,5 +1,4 @@
-#
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2020 The Android Open Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +13,6 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+# Disable Camera pinner by default
+PRODUCT_PRODUCT_PROPERTIES += \
+    pinner.pin_camera=false
diff --git a/target/product/legacy_gsi_common.mk b/target/product/legacy_gsi_release.mk
similarity index 80%
rename from target/product/legacy_gsi_common.mk
rename to target/product/legacy_gsi_release.mk
index fdae6eb..c1646bb 100644
--- a/target/product/legacy_gsi_common.mk
+++ b/target/product/legacy_gsi_release.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2019 The Android Open-Source Project
+# Copyright (C) 2020 The Android Open-Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,14 +14,14 @@
 # limitations under the License.
 #
 
-include $(SRC_TARGET_DIR)/product/gsi_common.mk
+include $(SRC_TARGET_DIR)/product/gsi_release.mk
 
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \
     system/etc/init/init.legacy-gsi.rc \
     system/etc/init/gsi/init.vndk-27.rc \
     system/etc/ld.config.vndk_lite.txt \
 
-# Legacy GSI support addtional O-MR1 interface
+# Legacy GSI support additional O-MR1 interface
 PRODUCT_EXTRA_VNDK_VERSIONS += 27
 
 # Support for the O-MR1 devices
@@ -29,7 +29,7 @@
     build/make/target/product/gsi/init.legacy-gsi.rc:system/etc/init/init.legacy-gsi.rc \
     build/make/target/product/gsi/init.vndk-27.rc:system/etc/init/gsi/init.vndk-27.rc
 
-# Name space configuration file for non-enforcing VNDK
+# Namespace configuration file for non-enforcing VNDK
 PRODUCT_PACKAGES += \
     ld.config.vndk_lite.txt
 
diff --git a/target/product/mainline.mk b/target/product/mainline.mk
index 7900cdf..22436e6 100644
--- a/target/product/mainline.mk
+++ b/target/product/mainline.mk
@@ -16,11 +16,13 @@
 
 # This makefile is intended to serve as a base for completely AOSP based
 # mainline devices, It contain the mainline system partition and sensible
-# defaults for the product and vendor partition.
+# defaults for the system_ext, product and vendor partitions.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
 
diff --git a/target/product/mainline_arm64.mk b/target/product/mainline_arm64.mk
index f21fa89..52b3222 100644
--- a/target/product/mainline_arm64.mk
+++ b/target/product/mainline_arm64.mk
@@ -16,52 +16,21 @@
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/mainline.mk)
-$(call enforce-product-packages-exist,)
+whitelist := product_manifest.xml
+$(call enforce-product-packages-exist,$(whitelist))
+
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
+
+# Modules that should probably be moved to /product
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
+  system/bin/healthd \
+  system/etc/init/healthd.rc \
+  system/etc/vintf/manifest/manifest_healthd.xml \
+
+PRODUCT_SHIPPING_API_LEVEL := 29
+
+PRODUCT_RESTRICT_VENDOR_FILES := all
 
 PRODUCT_NAME := mainline_arm64
 PRODUCT_DEVICE := mainline_arm64
 PRODUCT_BRAND := generic
-PRODUCT_SHIPPING_API_LEVEL := 28
-# TODO(b/137033385): change this back to "all"
-PRODUCT_RESTRICT_VENDOR_FILES := owner
-
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-  root/init.zygote64_32.rc \
-
-# Modules that are to be moved to /product
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-  system/app/Browser2/Browser2.apk \
-  system/app/Calendar/Calendar.apk \
-  system/app/Camera2/Camera2.apk \
-  system/app/DeskClock/DeskClock.apk \
-  system/app/DeskClock/oat/arm64/DeskClock.odex \
-  system/app/DeskClock/oat/arm64/DeskClock.vdex \
-  system/app/Email/Email.apk \
-  system/app/Gallery2/Gallery2.apk \
-  system/app/LatinIME/LatinIME.apk \
-  system/app/LatinIME/oat/arm64/LatinIME.odex \
-  system/app/LatinIME/oat/arm64/LatinIME.vdex \
-  system/app/Music/Music.apk \
-  system/app/QuickSearchBox/QuickSearchBox.apk \
-  system/app/webview/webview.apk \
-  system/bin/healthd \
-  system/etc/init/healthd.rc \
-  system/etc/vintf/manifest/manifest_healthd.xml \
-  system/lib64/libjni_eglfence.so \
-  system/lib64/libjni_filtershow_filters.so \
-  system/lib64/libjni_jpegstream.so \
-  system/lib64/libjni_jpegutil.so \
-  system/lib64/libjni_latinime.so \
-  system/lib64/libjni_tinyplanet.so \
-  system/priv-app/CarrierConfig/CarrierConfig.apk \
-  system/priv-app/CarrierConfig/oat/arm64/CarrierConfig.odex \
-  system/priv-app/CarrierConfig/oat/arm64/CarrierConfig.vdex \
-  system/priv-app/Contacts/Contacts.apk \
-  system/priv-app/Dialer/Dialer.apk \
-  system/priv-app/Launcher3QuickStep/Launcher3QuickStep.apk \
-  system/priv-app/OneTimeInitializer/OneTimeInitializer.apk \
-  system/priv-app/Provision/Provision.apk \
-  system/priv-app/SettingsIntelligence/SettingsIntelligence.apk \
-  system/priv-app/StorageManager/StorageManager.apk \
-  system/priv-app/WallpaperCropper/WallpaperCropper.apk \
diff --git a/target/product/mainline_system.mk b/target/product/mainline_system.mk
index 3644a22..a787707 100644
--- a/target/product/mainline_system.mk
+++ b/target/product/mainline_system.mk
@@ -18,11 +18,12 @@
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/languages_default.mk)
-# Enable updating of APEXes
-$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
 # Add adb keys to debuggable AOSP builds (if they exist)
 $(call inherit-product-if-exists, vendor/google/security/adb/vendor_key.mk)
 
+# Enable updating of APEXes
+$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
+
 # Shared java libs
 PRODUCT_PACKAGES += \
     com.android.nfc_extras \
@@ -66,18 +67,21 @@
 # For ringtones that rely on forward lock encryption
 PRODUCT_PACKAGES += libfwdlockengine
 
-# System libraries commonly depended on by things on the product partition.
-# This list will be pruned periodically.
+# System libraries commonly depended on by things on the system_ext or product partitions.
+# These lists will be pruned periodically.
 PRODUCT_PACKAGES += \
     android.hardware.biometrics.fingerprint@2.1 \
     android.hardware.radio@1.0 \
     android.hardware.radio@1.1 \
     android.hardware.radio@1.2 \
+    android.hardware.radio@1.3 \
+    android.hardware.radio@1.4 \
     android.hardware.radio.config@1.0 \
     android.hardware.radio.deprecated@1.0 \
     android.hardware.secure_element@1.0 \
     android.hardware.wifi@1.0 \
     libaudio-resampler \
+    libaudiohal \
     libdrm \
     liblogwrap \
     liblz4 \
@@ -85,10 +89,12 @@
     libnl \
     libprotobuf-cpp-full \
 
-# Camera service uses 'libdepthphoto' for adding dynamic depth
-# metadata inside depth jpegs.
+# These libraries are empty and have been combined into libhidlbase, but are still depended
+# on by things off /system.
+# TODO(b/135686713): remove these
 PRODUCT_PACKAGES += \
-    libdepthphoto \
+    libhidltransport \
+    libhwbinder \
 
 PRODUCT_PACKAGES_DEBUG += \
     avbctl \
@@ -102,22 +108,36 @@
 PRODUCT_HOST_PACKAGES += \
     tinyplay
 
-# Enable stats logging in LMKD
-TARGET_LMKD_STATS_LOG := true
+# Include all zygote init scripts. "ro.zygote" will select one of them.
+PRODUCT_COPY_FILES += \
+    system/core/rootdir/init.zygote32.rc:system/etc/init/hw/init.zygote32.rc \
+    system/core/rootdir/init.zygote64.rc:system/etc/init/hw/init.zygote64.rc \
+    system/core/rootdir/init.zygote32_64.rc:system/etc/init/hw/init.zygote32_64.rc \
+    system/core/rootdir/init.zygote64_32.rc:system/etc/init/hw/init.zygote64_32.rc \
 
 # Enable dynamic partition size
 PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
 
+PRODUCT_ENFORCE_RRO_TARGETS := *
+
 PRODUCT_NAME := mainline_system
 PRODUCT_BRAND := generic
 
-_base_mk_whitelist :=
+# Define /system partition-specific product properties to identify that /system
+# partition is mainline_system.
+PRODUCT_SYSTEM_NAME := mainline
+PRODUCT_SYSTEM_BRAND := Android
+PRODUCT_SYSTEM_MANUFACTURER := Android
+PRODUCT_SYSTEM_MODEL := mainline
+PRODUCT_SYSTEM_DEVICE := generic
 
-_my_whitelist := $(_base_mk_whitelist)
+_base_mk_allowed_list :=
+
+_my_allowed_list := $(_base_mk_allowed_list)
 
 # For mainline, system.img should be mounted at /, so we include ROOT here.
 _my_paths := \
   $(TARGET_COPY_OUT_ROOT)/ \
   $(TARGET_COPY_OUT_SYSTEM)/ \
 
-$(call require-artifacts-in-path, $(_my_paths), $(_my_whitelist))
+$(call require-artifacts-in-path, $(_my_paths), $(_my_allowed_list))
diff --git a/target/product/mainline_system_arm64.mk b/target/product/mainline_system_arm64.mk
index 6cadf84..679af0a 100644
--- a/target/product/mainline_system_arm64.mk
+++ b/target/product/mainline_system_arm64.mk
@@ -14,23 +14,28 @@
 # limitations under the License.
 #
 
+#
+# All components inherited here go to system image
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 $(call enforce-product-packages-exist,)
 
+# Enable mainline checking
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := true
+
 PRODUCT_BUILD_CACHE_IMAGE := false
 PRODUCT_BUILD_ODM_IMAGE := false
 PRODUCT_BUILD_PRODUCT_IMAGE  := false
-PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE := false
 PRODUCT_BUILD_RAMDISK_IMAGE := false
 PRODUCT_BUILD_SYSTEM_IMAGE := true
+PRODUCT_BUILD_SYSTEM_EXT_IMAGE := false
 PRODUCT_BUILD_SYSTEM_OTHER_IMAGE := false
 PRODUCT_BUILD_USERDATA_IMAGE := false
 PRODUCT_BUILD_VENDOR_IMAGE := false
 
+PRODUCT_SHIPPING_API_LEVEL := 29
+
 PRODUCT_NAME := mainline_system_arm64
 PRODUCT_DEVICE := mainline_arm64
 PRODUCT_BRAND := generic
-PRODUCT_SHIPPING_API_LEVEL := 28
-# TODO(b/137033385): change this back to "all"
-PRODUCT_RESTRICT_VENDOR_FILES := owner
diff --git a/target/product/mainline_system_x86.mk b/target/product/mainline_system_x86.mk
new file mode 100644
index 0000000..e1f862c
--- /dev/null
+++ b/target/product/mainline_system_x86.mk
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+$(call enforce-product-packages-exist,)
+
+# Enable mainline checking
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := true
+
+PRODUCT_BUILD_CACHE_IMAGE := false
+PRODUCT_BUILD_ODM_IMAGE := false
+PRODUCT_BUILD_PRODUCT_IMAGE  := false
+PRODUCT_BUILD_RAMDISK_IMAGE := false
+PRODUCT_BUILD_SYSTEM_IMAGE := true
+PRODUCT_BUILD_SYSTEM_EXT_IMAGE := false
+PRODUCT_BUILD_SYSTEM_OTHER_IMAGE := false
+PRODUCT_BUILD_USERDATA_IMAGE := false
+PRODUCT_BUILD_VENDOR_IMAGE := false
+
+PRODUCT_SHIPPING_API_LEVEL := 29
+
+PRODUCT_NAME := mainline_system_x86
+PRODUCT_DEVICE := mainline_x86
+PRODUCT_BRAND := generic
diff --git a/target/product/mainline_system_x86_64.mk b/target/product/mainline_system_x86_64.mk
new file mode 100644
index 0000000..8806d3e
--- /dev/null
+++ b/target/product/mainline_system_x86_64.mk
@@ -0,0 +1,41 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+$(call enforce-product-packages-exist,)
+
+# Enable mainline checking
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := true
+
+PRODUCT_BUILD_CACHE_IMAGE := false
+PRODUCT_BUILD_ODM_IMAGE := false
+PRODUCT_BUILD_PRODUCT_IMAGE  := false
+PRODUCT_BUILD_RAMDISK_IMAGE := false
+PRODUCT_BUILD_SYSTEM_IMAGE := true
+PRODUCT_BUILD_SYSTEM_EXT_IMAGE := false
+PRODUCT_BUILD_SYSTEM_OTHER_IMAGE := false
+PRODUCT_BUILD_USERDATA_IMAGE := false
+PRODUCT_BUILD_VENDOR_IMAGE := false
+
+PRODUCT_SHIPPING_API_LEVEL := 29
+
+PRODUCT_NAME := mainline_system_x86_64
+PRODUCT_DEVICE := mainline_x86_64
+PRODUCT_BRAND := generic
diff --git a/target/product/mainline_system_x86_arm.mk b/target/product/mainline_system_x86_arm.mk
new file mode 100644
index 0000000..04fb652
--- /dev/null
+++ b/target/product/mainline_system_x86_arm.mk
@@ -0,0 +1,40 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+$(call enforce-product-packages-exist,)
+
+# Enable mainline checking
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := true
+
+PRODUCT_BUILD_CACHE_IMAGE := false
+PRODUCT_BUILD_ODM_IMAGE := false
+PRODUCT_BUILD_PRODUCT_IMAGE  := false
+PRODUCT_BUILD_RAMDISK_IMAGE := false
+PRODUCT_BUILD_SYSTEM_IMAGE := true
+PRODUCT_BUILD_SYSTEM_EXT_IMAGE := false
+PRODUCT_BUILD_SYSTEM_OTHER_IMAGE := false
+PRODUCT_BUILD_USERDATA_IMAGE := false
+PRODUCT_BUILD_VENDOR_IMAGE := false
+
+PRODUCT_SHIPPING_API_LEVEL := 29
+
+PRODUCT_NAME := mainline_system_x86_arm
+PRODUCT_DEVICE := mainline_x86_arm
+PRODUCT_BRAND := generic
diff --git a/target/product/media_product.mk b/target/product/media_product.mk
index 17c24ee..76cb311 100644
--- a/target/product/media_product.mk
+++ b/target/product/media_product.mk
@@ -17,7 +17,7 @@
 # This makefile contains the product partition contents for
 # media-capable devices (non-wearables). Only add something here
 # if it definitely doesn't belong on wearables. Otherwise, choose
-# base_vendor.mk.
+# base_product.mk.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_product.mk)
 
 # /product packages
diff --git a/target/product/media_system.mk b/target/product/media_system.mk
index 5c0902d..26fb7f3 100644
--- a/target/product/media_system.mk
+++ b/target/product/media_system.mk
@@ -36,7 +36,6 @@
     make_f2fs \
     requestsync \
     StatementService \
-    vndk_snapshot_package \
 
 PRODUCT_HOST_PACKAGES += \
     fsck.f2fs \
@@ -51,10 +50,16 @@
 
 # The order here is the same order they end up on the classpath, so it matters.
 PRODUCT_SYSTEM_SERVER_JARS := \
-    services \
-    ethernet-service \
-    wifi-service \
     com.android.location.provider \
+    services \
+    ethernet-service
+
+# system server jars which are updated via apex modules.
+# The values should be of the format <apex name>:<jar name>
+PRODUCT_UPDATABLE_SYSTEM_SERVER_JARS := \
+    com.android.permission:service-permission \
+    com.android.wifi:service-wifi \
+    com.android.ipsec:android.net.ipsec.ike \
 
 PRODUCT_COPY_FILES += \
     system/core/rootdir/etc/public.libraries.android.txt:system/etc/public.libraries.txt
diff --git a/target/product/media_system_ext.mk b/target/product/media_system_ext.mk
new file mode 100644
index 0000000..2e20af3
--- /dev/null
+++ b/target/product/media_system_ext.mk
@@ -0,0 +1,25 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This makefile contains the system_ext partition contents for
+# media-capable devices (non-wearables). Only add something here
+# if it definitely doesn't belong on wearables. Otherwise, choose
+# base_system_ext.mk.
+$(call inherit-product, $(SRC_TARGET_DIR)/product/base_system_ext.mk)
+
+# /system_ext packages
+PRODUCT_PACKAGES += \
+    vndk_apex_snapshot_package \
diff --git a/target/product/profile_boot_common.mk b/target/product/profile_boot_common.mk
index 4147dfa..a40b3e9 100644
--- a/target/product/profile_boot_common.mk
+++ b/target/product/profile_boot_common.mk
@@ -19,30 +19,12 @@
 # remove classes that are no longer in use.
 # Ideally we would just generate an empty boot.art but we don't have the build
 # support to separate the image from the compile code.
-PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION := build/target/product/empty-profile
-PRODUCT_DEX_PREOPT_BOOT_FLAGS := --count-hotness-in-compiled-code
+PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION := build/make/target/product/empty-profile
 DEX_PREOPT_DEFAULT := nostripping
 
-# Disable uncompressing priv apps so that there is enough space to build the system partition.
-DONT_UNCOMPRESS_PRIV_APPS_DEXS := true
-
-# Use an empty preloaded-classes list.
-PRODUCT_COPY_FILES += \
-    build/target/product/empty-preloaded-classes:system/etc/preloaded-classes
-
 # Boot image property overrides.
 PRODUCT_PROPERTY_OVERRIDES += \
-    dalvik.vm.jitinitialsize=32m \
-    dalvik.vm.jitmaxsize=32m \
-    dalvik.vm.usejitprofiles=true \
-    dalvik.vm.hot-startup-method-samples=256 \
     dalvik.vm.profilesystemserver=true \
-    dalvik.vm.profilebootimage=true
-
-# Use speed compiler filter since system server doesn't have JIT.
-PRODUCT_DEX_PREOPT_BOOT_FLAGS += --compiler-filter=speed
-# System server is speed compiled and doesn't have a separate preopt flag,
-# so we enable hotness in compiled code for everything.
-PRODUCT_DEX_PREOPT_DEFAULT_FLAGS := --count-hotness-in-compiled-code
+    dalvik.vm.profilebootclasspath=true
 
 PRODUCT_DIST_BOOT_AND_SYSTEM_JARS := true
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index a88ba3c..ad361dc 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -16,15 +16,6 @@
 
 # Provides a functioning ART environment without Android frameworks
 
-ifeq ($(TARGET_CORE_JARS),)
-$(error TARGET_CORE_JARS is empty; cannot update PRODUCT_PACKAGES variable)
-endif
-
-# Minimal boot classpath. This should be a subset of PRODUCT_BOOT_JARS, and equivalent to
-# TARGET_CORE_JARS.
-PRODUCT_PACKAGES += \
-    $(TARGET_CORE_JARS)
-
 # Additional mixins to the boot classpath.
 PRODUCT_PACKAGES += \
     android.test.base \
@@ -33,9 +24,14 @@
 PRODUCT_PACKAGES += \
     ext \
 
-# Android Runtime APEX module.
+# Runtime (Bionic) APEX module.
 PRODUCT_PACKAGES += com.android.runtime
-PRODUCT_HOST_PACKAGES += com.android.runtime
+
+# ART APEX module.
+# Note that this package includes the minimal boot classpath JARs (listed in
+# ART_APEX_JARS), which should no longer be added directly to PRODUCT_PACKAGES.
+PRODUCT_PACKAGES += com.android.art
+PRODUCT_HOST_PACKAGES += com.android.art
 
 # Certificates.
 PRODUCT_PACKAGES += \
@@ -79,6 +75,10 @@
     pm.dexopt.inactive=verify \
     pm.dexopt.shared=speed
 
+# Pass file with the list of updatable boot class path packages to dex2oat.
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+    dalvik.vm.dex2oat-updatable-bcp-packages-file=/system/etc/updatable-bcp-packages.txt
+
 # Enable resolution of startup const strings.
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     dalvik.vm.dex2oat-resolve-startup-strings=true
@@ -92,8 +92,8 @@
     dalvik.vm.minidebuginfo=true \
     dalvik.vm.dex2oat-minidebuginfo=true
 
-# Disable iorapd by default
+# Enable iorapd by default
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
-    ro.iorapd.enable=false
+    ro.iorapd.enable=true
 
-PRODUCT_USES_ART := true
+PRODUCT_USES_DEFAULT_ART_CONFIG := true
diff --git a/target/product/sdk_phone_arm64.mk b/target/product/sdk_phone_arm64.mk
index 96f0bfd..3ab0c57 100644
--- a/target/product/sdk_phone_arm64.mk
+++ b/target/product/sdk_phone_arm64.mk
@@ -13,8 +13,38 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+QEMU_USE_SYSTEM_EXT_PARTITIONS := true
 
-$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_arm64.mk)
+PRODUCT_USE_DYNAMIC_PARTITIONS := true
+
+# This is a build configuration for a full-featured build of the
+# Open-Source part of the tree. It's geared toward a US-centric
+# build quite specifically for the emulator, and might not be
+# entirely appropriate to inherit from for on-device configurations.
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor or vendor_boot image
+#
+$(call inherit-product-if-exists, device/generic/goldfish/arm64-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/emulator_arm64/device.mk)
 
 # Define the host tools and libs that are parts of the SDK.
 $(call inherit-product, sdk/build/product_sdk.mk)
@@ -27,7 +57,7 @@
 # Overrides
 PRODUCT_BRAND := Android
 PRODUCT_NAME := sdk_phone_arm64
-PRODUCT_DEVICE := generic_arm64
+PRODUCT_DEVICE := emulator_arm64
 PRODUCT_MODEL := Android SDK built for arm64
 
 
diff --git a/target/product/sdk_phone_armv7.mk b/target/product/sdk_phone_armv7.mk
index 04d8d6a..77b8b50 100644
--- a/target/product/sdk_phone_armv7.mk
+++ b/target/product/sdk_phone_armv7.mk
@@ -13,6 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+QEMU_USE_SYSTEM_EXT_PARTITIONS := true
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_arm.mk)
 
diff --git a/target/product/sdk_phone_x86.mk b/target/product/sdk_phone_x86.mk
index b34e5b6..9df26a9 100644
--- a/target/product/sdk_phone_x86.mk
+++ b/target/product/sdk_phone_x86.mk
@@ -13,6 +13,36 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+QEMU_USE_SYSTEM_EXT_PARTITIONS := true
+PRODUCT_USE_DYNAMIC_PARTITIONS := true
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+
+# Enable mainline checking for excat this product name
+ifeq (sdk_phone_x86,$(TARGET_PRODUCT))
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
+endif
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product-if-exists, device/generic/goldfish/x86-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_x86.mk)
 
diff --git a/target/product/sdk_phone_x86_64.mk b/target/product/sdk_phone_x86_64.mk
index 37c078e..862c66e 100644
--- a/target/product/sdk_phone_x86_64.mk
+++ b/target/product/sdk_phone_x86_64.mk
@@ -13,8 +13,37 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
+QEMU_USE_SYSTEM_EXT_PARTITIONS := true
+PRODUCT_USE_DYNAMIC_PARTITIONS := true
 
-$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_x86_64.mk)
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+
+# Enable mainline checking for excat this product name
+ifeq (sdk_phone_x86_64,$(TARGET_PRODUCT))
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
+endif
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+$(call inherit-product-if-exists, device/generic/goldfish/x86_64-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
 
 # Define the host tools and libs that are parts of the SDK.
 -include sdk/build/product_sdk.mk
diff --git a/target/product/security/Android.bp b/target/product/security/Android.bp
new file mode 100644
index 0000000..5f4f82b
--- /dev/null
+++ b/target/product/security/Android.bp
@@ -0,0 +1,13 @@
+// AOSP test certificate
+android_app_certificate {
+    name: "aosp-testkey",
+    certificate: "testkey",
+}
+
+// Google-owned certificate for CTS testing, since we can't trust arbitrary keys on release devices.
+prebuilt_etc {
+    name: "fsverity-release-cert-der",
+    src: "fsverity-release.x509.der",
+    sub_dir: "security/fsverity",
+    filename_from_src: true,
+}
diff --git a/target/product/security/Android.mk b/target/product/security/Android.mk
index 4142ea9..d6a8b53 100644
--- a/target/product/security/Android.mk
+++ b/target/product/security/Android.mk
@@ -1,7 +1,7 @@
 LOCAL_PATH:= $(call my-dir)
 
 #######################################
-# verity_key
+# verity_key (installed to /, i.e. part of system.img)
 include $(CLEAR_VARS)
 
 LOCAL_MODULE := verity_key
@@ -9,9 +9,29 @@
 LOCAL_MODULE_CLASS := ETC
 LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
 
+# For devices using a separate ramdisk, we need a copy there to establish the chain of trust.
+ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
+LOCAL_REQUIRED_MODULES := verity_key_ramdisk
+endif
+
 include $(BUILD_PREBUILT)
 
 #######################################
+# verity_key (installed to ramdisk)
+#
+# Enabling the target when using system-as-root would cause build failure, as TARGET_RAMDISK_OUT
+# points to the same location as TARGET_ROOT_OUT.
+ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
+  include $(CLEAR_VARS)
+  LOCAL_MODULE := verity_key_ramdisk
+  LOCAL_MODULE_CLASS := ETC
+  LOCAL_SRC_FILES := verity_key
+  LOCAL_MODULE_STEM := verity_key
+  LOCAL_MODULE_PATH := $(TARGET_RAMDISK_OUT)
+  include $(BUILD_PREBUILT)
+endif
+
+#######################################
 # adb key, if configured via PRODUCT_ADB_KEYS
 ifdef PRODUCT_ADB_KEYS
   ifneq ($(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
@@ -23,3 +43,40 @@
     include $(BUILD_PREBUILT)
   endif
 endif
+
+
+#######################################
+# otacerts: A keystore with the authorized keys in it, which is used to verify the authenticity of
+# downloaded OTA packages.
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := otacerts
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_STEM := otacerts.zip
+LOCAL_MODULE_PATH := $(TARGET_OUT_ETC)/security
+include $(BUILD_SYSTEM)/base_rules.mk
+$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+$(LOCAL_BUILT_MODULE): $(SOONG_ZIP) $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+	$(SOONG_ZIP) -o $@ -j -f $(PRIVATE_CERT)
+
+
+#######################################
+# otacerts for recovery image.
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := otacerts.recovery
+LOCAL_MODULE_CLASS := ETC
+LOCAL_MODULE_STEM := otacerts.zip
+LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/system/etc/security
+include $(BUILD_SYSTEM)/base_rules.mk
+
+extra_recovery_keys := $(patsubst %,%.x509.pem,$(PRODUCT_EXTRA_RECOVERY_KEYS))
+
+$(LOCAL_BUILT_MODULE): PRIVATE_CERT := $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem
+$(LOCAL_BUILT_MODULE): PRIVATE_EXTRA_RECOVERY_KEYS := $(extra_recovery_keys)
+$(LOCAL_BUILT_MODULE): \
+	    $(SOONG_ZIP) \
+	    $(DEFAULT_SYSTEM_DEV_CERTIFICATE).x509.pem \
+	    $(extra_recovery_keys)
+	$(SOONG_ZIP) -o $@ -j \
+	    $(foreach key_file, $(PRIVATE_CERT) $(PRIVATE_EXTRA_RECOVERY_KEYS), -f $(key_file))
diff --git a/target/product/security/README b/target/product/security/README
index 6a6e62d..6e75e4d 100644
--- a/target/product/security/README
+++ b/target/product/security/README
@@ -31,7 +31,7 @@
 dumpkey.jar is a Java tool that takes an x.509 certificate in PEM format as
 input and prints a C structure to standard output:
 
-    $ java -jar out/host/linux-x86/framework/dumpkey.jar build/target/product/security/testkey.x509.pem
+    $ java -jar out/host/linux-x86/framework/dumpkey.jar build/make/target/product/security/testkey.x509.pem
     {64,0xc926ad21,{1795090719,2141396315,950055447,2581568430,4268923165,1920809988,546586521,3498997798,1776797858,3740060814,1805317999,1429410244,129622599,1422441418,1783893377,1222374759,2563319927,323993566,28517732,609753416,1826472888,215237850,4261642700,4049082591,3228462402,774857746,154822455,2497198897,2758199418,3019015328,2794777644,87251430,2534927978,120774784,571297800,3695899472,2479925187,3811625450,3401832990,2394869647,3267246207,950095497,555058928,414729973,1136544882,3044590084,465547824,4058146728,2731796054,1689838846,3890756939,1048029507,895090649,247140249,178744550,3547885223,3165179243,109881576,3944604415,1044303212,3772373029,2985150306,3737520932,3599964420},{3437017481,3784475129,2800224972,3086222688,251333580,2131931323,512774938,325948880,2657486437,2102694287,3820568226,792812816,1026422502,2053275343,2800889200,3113586810,165549746,4273519969,4065247892,1902789247,772932719,3941848426,3652744109,216871947,3164400649,1942378755,3996765851,1055777370,964047799,629391717,2232744317,3910558992,191868569,2758883837,3682816752,2997714732,2702529250,3570700455,3776873832,3924067546,3555689545,2758825434,1323144535,61311905,1997411085,376844204,213777604,4077323584,9135381,1625809335,2804742137,2952293945,1117190829,4237312782,1825108855,3013147971,1111251351,2568837572,1684324211,2520978805,367251975,810756730,2353784344,1175080310}}
 
 This is called by build/make/core/Makefile to incorporate the OTA signing keys
diff --git a/target/product/security/fsverity-release.x509.der b/target/product/security/fsverity-release.x509.der
new file mode 100644
index 0000000..cd8cd79
--- /dev/null
+++ b/target/product/security/fsverity-release.x509.der
Binary files differ
diff --git a/target/product/sysconfig/Android.bp b/target/product/sysconfig/Android.bp
new file mode 100644
index 0000000..5632d17
--- /dev/null
+++ b/target/product/sysconfig/Android.bp
@@ -0,0 +1,33 @@
+// Copyright (C} 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License"};
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+prebuilt_etc {
+    name: "preinstalled-packages-platform-aosp-product.xml",
+    product_specific: true,
+    sub_dir: "sysconfig",
+    src: "preinstalled-packages-platform-aosp-product.xml",
+}
+
+prebuilt_etc {
+    name: "preinstalled-packages-platform-full-base.xml",
+    sub_dir: "sysconfig",
+    src: "preinstalled-packages-platform-full-base.xml",
+}
+
+prebuilt_etc {
+    name: "preinstalled-packages-platform-handheld-product.xml",
+    product_specific: true,
+    sub_dir: "sysconfig",
+    src: "preinstalled-packages-platform-handheld-product.xml",
+}
\ No newline at end of file
diff --git a/target/product/sysconfig/preinstalled-packages-platform-aosp-product.xml b/target/product/sysconfig/preinstalled-packages-platform-aosp-product.xml
new file mode 100644
index 0000000..eec1326
--- /dev/null
+++ b/target/product/sysconfig/preinstalled-packages-platform-aosp-product.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!-- System packages to preinstall on all devices with aosp_product, per user type.
+     Documentation at frameworks/base/data/etc/preinstalled-packages-platform.xml
+-->
+<config>
+    <install-in-user-type package="com.android.wallpaperpicker">
+        <install-in user-type="FULL" />
+    </install-in-user-type>
+</config>
diff --git a/target/product/sysconfig/preinstalled-packages-platform-full-base.xml b/target/product/sysconfig/preinstalled-packages-platform-full-base.xml
new file mode 100644
index 0000000..f601355
--- /dev/null
+++ b/target/product/sysconfig/preinstalled-packages-platform-full-base.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!-- System packages to preinstall on all devices with full_base, per user type.
+     Documentation at frameworks/base/data/etc/preinstalled-packages-platform.xml
+-->
+<config>
+    <install-in-user-type package="com.android.wallpaper.livepicker">
+        <install-in user-type="FULL" />
+    </install-in-user-type>
+</config>
diff --git a/target/product/sysconfig/preinstalled-packages-platform-handheld-product.xml b/target/product/sysconfig/preinstalled-packages-platform-handheld-product.xml
new file mode 100644
index 0000000..a5d9ba2
--- /dev/null
+++ b/target/product/sysconfig/preinstalled-packages-platform-handheld-product.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!-- System packages to preinstall on all devices with handheld_product, per user type.
+     Documentation at frameworks/base/data/etc/preinstalled-packages-platform.xml
+-->
+<config>
+    <install-in-user-type package="com.android.wallpapercropper">
+        <install-in user-type="FULL" />
+    </install-in-user-type>
+</config>
diff --git a/target/product/telephony.mk b/target/product/telephony.mk
index e0eb159..3ad7a1f 100644
--- a/target/product/telephony.mk
+++ b/target/product/telephony.mk
@@ -16,5 +16,6 @@
 
 # All modules for telephony
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
diff --git a/target/product/telephony_product.mk b/target/product/telephony_product.mk
index a4c7e31..3ec954f 100644
--- a/target/product/telephony_product.mk
+++ b/target/product/telephony_product.mk
@@ -19,6 +19,4 @@
 
 # /product packages
 PRODUCT_PACKAGES += \
-    CarrierConfig \
     Dialer \
-    EmergencyInfo \
diff --git a/target/product/telephony_system.mk b/target/product/telephony_system.mk
index 584cf1e..ef48719 100644
--- a/target/product/telephony_system.mk
+++ b/target/product/telephony_system.mk
@@ -21,6 +21,7 @@
     ONS \
     CarrierDefaultApp \
     CallLogBackup \
-    CellBroadcastReceiver \
+    com.android.cellbroadcast \
+    CellBroadcastLegacyApp \
 
 PRODUCT_COPY_FILES := \
diff --git a/core/android_vts_host_config.mk b/target/product/telephony_system_ext.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/telephony_system_ext.mk
index 38ba19d..f81a607 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/telephony_system_ext.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2019 The Android Open Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,10 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+# This is the list of modules that are specific to products that have telephony
+# hardware, and install to the system_ext partition.
 
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+# /system_ext packages
+PRODUCT_PACKAGES += \
+    CarrierConfig \
+    EmergencyInfo \
diff --git a/target/product/updatable_apex.mk b/target/product/updatable_apex.mk
index 9b87165..a84a0d2 100644
--- a/target/product/updatable_apex.mk
+++ b/target/product/updatable_apex.mk
@@ -17,7 +17,9 @@
 # Inherit this when the target needs to support updating APEXes
 
 ifneq ($(OVERRIDE_TARGET_FLATTEN_APEX),true)
-  PRODUCT_PACKAGES := com.android.apex.cts.shim.v1_prebuilt
+  # com.android.apex.cts.shim.v1_prebuilt overrides CtsShimPrebuilt
+  # and CtsShimPrivPrebuilt since they are packaged inside the APEX.
+  PRODUCT_PACKAGES += com.android.apex.cts.shim.v1_prebuilt
   PRODUCT_PROPERTY_OVERRIDES := ro.apex.updatable=true
   TARGET_FLATTEN_APEX := false
 endif
diff --git a/core/android_vts_host_config.mk b/target/product/userspace_reboot.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/userspace_reboot.mk
index 38ba19d..3f881af 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/userspace_reboot.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2019 The Android Open Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,6 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+# Inherit this when the target supports userspace reboot
 
-include $(BUILD_SYSTEM)/base_rules.mk
-
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+PRODUCT_PROPERTY_OVERRIDES := init.userspace_reboot.is_supported=true
diff --git a/target/product/verity.mk b/target/product/verity.mk
index d954159..5f09283 100644
--- a/target/product/verity.mk
+++ b/target/product/verity.mk
@@ -23,7 +23,7 @@
 # The dev key is used to sign boot and recovery images, and the verity
 # metadata table. Actual product deliverables will be re-signed by hand.
 # We expect this file to exist with the suffixes ".x509.pem" and ".pk8".
-PRODUCT_VERITY_SIGNING_KEY := build/target/product/security/verity
+PRODUCT_VERITY_SIGNING_KEY := build/make/target/product/security/verity
 
 PRODUCT_PACKAGES += \
         verity_key
diff --git a/core/android_vts_host_config.mk b/target/product/virtual_ab_ota.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/virtual_ab_ota.mk
index 38ba19d..1774de4 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/virtual_ab_ota.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2019 The Android Open-Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,8 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+PRODUCT_VIRTUAL_AB_OTA := true
 
-include $(BUILD_SYSTEM)/base_rules.mk
+PRODUCT_PROPERTY_OVERRIDES += ro.virtual_ab.enabled=true
 
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+PRODUCT_PACKAGES += e2fsck_ramdisk
diff --git a/core/android_vts_host_config.mk b/target/product/virtual_ab_ota_plus_non_ab.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/virtual_ab_ota_plus_non_ab.mk
index 38ba19d..325d75e 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/virtual_ab_ota_plus_non_ab.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2020 The Android Open-Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,8 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+$(call inherit-product, $(SRC_TARGET_DIR)/product/virtual_ab_ota.mk)
 
-include $(BUILD_SYSTEM)/base_rules.mk
+PRODUCT_OTA_FORCE_NON_AB_PACKAGE := true
 
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+PRODUCT_PROPERTY_OVERRIDES += ro.virtual_ab.allow_non_ab=true
diff --git a/core/android_vts_host_config.mk b/target/product/virtual_ab_ota_retrofit.mk
similarity index 65%
copy from core/android_vts_host_config.mk
copy to target/product/virtual_ab_ota_retrofit.mk
index 38ba19d..3e85741 100644
--- a/core/android_vts_host_config.mk
+++ b/target/product/virtual_ab_ota_retrofit.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 The Android Open Source Project
+# Copyright (C) 2019 The Android Open-Source Project
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,13 +14,8 @@
 # limitations under the License.
 #
 
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_IS_HOST_MODULE := true
-LOCAL_COMPATIBILITY_SUITE := vts
+$(call inherit-product, $(SRC_TARGET_DIR)/product/virtual_ab_ota.mk)
 
-include $(BUILD_SYSTEM)/base_rules.mk
+PRODUCT_VIRTUAL_AB_OTA_RETROFIT := true
 
-$(LOCAL_BUILT_MODULE):
-	@echo "VTS host-driven test target: $(PRIVATE_MODULE)"
-	$(hide) touch $@
-
+PRODUCT_PROPERTY_OVERRIDES += ro.virtual_ab.retrofit=true
diff --git a/tools/makeparallel/Android.bp b/tools/Android.bp
similarity index 67%
copy from tools/makeparallel/Android.bp
copy to tools/Android.bp
index 898db68..8c7eb38 100644
--- a/tools/makeparallel/Android.bp
+++ b/tools/Android.bp
@@ -1,4 +1,4 @@
-// Copyright 2016 Google Inc. All rights reserved
+// Copyright (C) 2019 The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,10 +12,15 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-cc_binary_host {
-    name: "makeparallel",
-    srcs: [
-        "makeparallel.cpp",
-    ],
-    cflags: ["-Wall", "-Werror"],
+python_binary_host {
+  name: "generate-self-extracting-archive",
+  srcs: ["generate-self-extracting-archive.py"],
+  version: {
+    py2: {
+      enabled: true,
+    },
+    py3: {
+      enabled: false,
+    },
+  },
 }
diff --git a/tools/auto_gen_test_config.py b/tools/auto_gen_test_config.py
index c7c5bdc..943f238 100755
--- a/tools/auto_gen_test_config.py
+++ b/tools/auto_gen_test_config.py
@@ -27,6 +27,7 @@
 ATTRIBUTE_PACKAGE = 'package'
 
 PLACEHOLDER_LABEL = '{LABEL}'
+PLACEHOLDER_EXTRA_CONFIGS = '{EXTRA_CONFIGS}'
 PLACEHOLDER_MODULE = '{MODULE}'
 PLACEHOLDER_PACKAGE = '{PACKAGE}'
 PLACEHOLDER_RUNNER = '{RUNNER}'
@@ -41,16 +42,20 @@
   Returns:
     0 if no error, otherwise 1.
   """
-  if len(argv) != 4:
+  if len(argv) != 4 and len(argv) != 6:
     sys.stderr.write(
-        'Invalid arguements. The script requires 4 arguments for file paths: '
+        'Invalid arguments. The script requires 4 arguments for file paths: '
         'target_config android_manifest empty_config '
-        'instrumentation_test_config_template.\n')
+        'instrumentation_test_config_template '
+        'and 2 optional arguments for extra configs: '
+        '--extra-configs \'EXTRA_CONFIGS\'.\n')
     return 1
+
   target_config = argv[0]
   android_manifest = argv[1]
   empty_config = argv[2]
   instrumentation_test_config_template = argv[3]
+  extra_configs = '\n'.join(argv[5].split('\\n')) if len(argv) == 6 else ''
 
   manifest = parse(android_manifest)
   instrumentation_elements = manifest.getElementsByTagName('instrumentation')
@@ -80,6 +85,7 @@
     config = config.replace(PLACEHOLDER_MODULE, module)
     config = config.replace(PLACEHOLDER_PACKAGE, package)
     config = config.replace(PLACEHOLDER_TEST_TYPE, test_type)
+    config = config.replace(PLACEHOLDER_EXTRA_CONFIGS, extra_configs)
     config = config.replace(PLACEHOLDER_RUNNER, runner)
     with open(target_config, 'w') as config_file:
       config_file.write(config)
diff --git a/tools/buildinfo.sh b/tools/buildinfo.sh
index 24ac663..9bee115 100755
--- a/tools/buildinfo.sh
+++ b/tools/buildinfo.sh
@@ -11,7 +11,8 @@
 echo "ro.build.version.preview_sdk_fingerprint=$PLATFORM_PREVIEW_SDK_FINGERPRINT"
 echo "ro.build.version.codename=$PLATFORM_VERSION_CODENAME"
 echo "ro.build.version.all_codenames=$PLATFORM_VERSION_ALL_CODENAMES"
-echo "ro.build.version.release=$PLATFORM_VERSION"
+echo "ro.build.version.release=$PLATFORM_VERSION_LAST_STABLE"
+echo "ro.build.version.release_or_codename=$PLATFORM_VERSION"
 echo "ro.build.version.security_patch=$PLATFORM_SECURITY_PATCH"
 echo "ro.build.version.base_os=$PLATFORM_BASE_OS"
 echo "ro.build.version.min_supported_target_sdk=$PLATFORM_MIN_SUPPORTED_TARGET_SDK_VERSION"
@@ -25,9 +26,6 @@
 if [ -n "$BOARD_BUILD_SYSTEM_ROOT_IMAGE" ] ; then
   echo "ro.build.system_root_image=$BOARD_BUILD_SYSTEM_ROOT_IMAGE"
 fi
-if [ -n "$AB_OTA_UPDATER" ] ; then
-  echo "ro.build.ab_update=$AB_OTA_UPDATER"
-fi
 
 # These values are deprecated, use "ro.product.cpu.abilist"
 # instead (see below).
diff --git a/tools/buildinfo_common.sh b/tools/buildinfo_common.sh
index 6041d79..673e06f 100755
--- a/tools/buildinfo_common.sh
+++ b/tools/buildinfo_common.sh
@@ -17,7 +17,8 @@
 echo "ro.${partition}.build.tags=$BUILD_VERSION_TAGS"
 echo "ro.${partition}.build.type=$TARGET_BUILD_TYPE"
 echo "ro.${partition}.build.version.incremental=$BUILD_NUMBER"
-echo "ro.${partition}.build.version.release=$PLATFORM_VERSION"
+echo "ro.${partition}.build.version.release=$PLATFORM_VERSION_LAST_STABLE"
+echo "ro.${partition}.build.version.release_or_codename=$PLATFORM_VERSION"
 echo "ro.${partition}.build.version.sdk=$PLATFORM_SDK_VERSION"
 
 echo "ro.product.${partition}.brand=$PRODUCT_BRAND"
diff --git a/tools/check_builds.sh b/tools/check_builds.sh
deleted file mode 100644
index 7e4ea7c..0000000
--- a/tools/check_builds.sh
+++ /dev/null
@@ -1,92 +0,0 @@
-# Copyright (C) 2009 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the 'License');
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an 'AS IS' BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#
-# Usage:
-#
-# Source this file into your environment.  Then:
-#
-#    $ golden_builds sdk-sdk generic-eng generic-userdebug dream-eng
-# 
-# will build a set of combos.  This might take a while.  Then you can
-# go make changes, and run:
-#
-#    $ check_builds sdk-sdk generic-eng generic-userdebug dream-eng
-#
-# Go get dinner, and when you get back, there will be a file
-# test-builds/sizes.html that has a pretty chart of which files are
-# in which tree, and how big they are.  In that chart, cells for files
-# that are missing are red, and rows where the file sizes are not all
-# the same will be blue.
-#
-
-TEST_BUILD_DIR=test-builds
-
-function do_builds
-{
-    PREFIX=$1
-    shift
-    while [ -n "$1" ]
-    do
-        rm -rf $TEST_BUILD_DIR/$PREFIX-$1
-        make PRODUCT-$(echo $1 | sed "s/-.*//" )-installclean
-        make -j16 PRODUCT-$1 dist DIST_DIR=$TEST_BUILD_DIR/$PREFIX-$1
-        if [ $? -ne 0 ] ; then
-            echo FAILED
-            return
-        fi
-        shift
-    done
-}
-
-function golden_builds
-{
-    rm -rf $TEST_BUILD_DIR/golden-* $TEST_BUILD_DIR/dist-*
-    do_builds golden "$@"
-}
-
-function compare_builds
-{
-    local inputs=
-    while [ -n "$1" ]
-    do
-        inputs="$inputs $TEST_BUILD_DIR/golden-$1/installed-files.txt"
-        inputs="$inputs $TEST_BUILD_DIR/dist-$1/installed-files.txt"
-        shift
-    done
-    build/make/tools/compare_fileslist.py $inputs > $TEST_BUILD_DIR/sizes.html
-}
-
-function check_builds
-{
-    rm -rf $TEST_BUILD_DIR/dist-*
-    do_builds dist "$@"
-    compare_builds "$@"
-}
-
-function diff_builds
-{
-    local inputs=
-    while [ -n "$1" ]
-    do
-        diff $TEST_BUILD_DIR/golden-$1/installed-files.txt $TEST_BUILD_DIR/dist-$1/installed-files.txt &> /dev/null
-        if [ $? != 0 ]; then
-            echo =========== $1 ===========
-            diff $TEST_BUILD_DIR/golden-$1/installed-files.txt $TEST_BUILD_DIR/dist-$1/installed-files.txt
-        fi
-        shift
-    done
-    build/make/tools/compare_fileslist.py $inputs > $TEST_BUILD_DIR/sizes.html
-}
-
diff --git a/tools/check_identical_lib.sh b/tools/check_identical_lib.sh
index 01007c0..c3aa41a 100755
--- a/tools/check_identical_lib.sh
+++ b/tools/check_identical_lib.sh
@@ -5,11 +5,13 @@
 CORE="${2}"
 VENDOR="${3}"
 
-stripped_core="${CORE}.vndk_lib_check.stripped"
-stripped_vendor="${VENDOR}.vndk_lib_check.stripped"
+TMPDIR="$(mktemp -d ${CORE}.vndk_lib_check.XXXXXXXX)"
+stripped_core="${TMPDIR}/core"
+stripped_vendor="${TMPDIR}/vendor"
 
 function cleanup() {
-  rm -f ${stripped_core} ${stripped_vendor}
+  rm -f "${stripped_core}" "${stripped_vendor}"
+  rmdir "${TMPDIR}"
 }
 trap cleanup EXIT
 
diff --git a/tools/check_link_type.py b/tools/check_link_type.py
deleted file mode 100755
index 40754ad..0000000
--- a/tools/check_link_type.py
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright (C) 2016 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""Utility to verify modules link against acceptable module types"""
-
-from __future__ import print_function
-import argparse
-import os
-import sys
-
-WARNING_MSG = ('\033[1m%(makefile)s: \033[35mwarning:\033[0m\033[1m '
-    '%(module)s (%(type)s) should not link to %(dep_name)s (%(dep_type)s)'
-    '\033[0m')
-ERROR_MSG = ('\033[1m%(makefile)s: \033[31merror:\033[0m\033[1m '
-    '%(module)s (%(type)s) should not link to %(dep_name)s (%(dep_type)s)'
-    '\033[0m')
-
-def parse_args():
-    """Parse commandline arguments."""
-    parser = argparse.ArgumentParser(description='Check link types')
-    parser.add_argument('--makefile', help='Makefile defining module')
-    parser.add_argument('--module', help='The module being checked')
-    parser.add_argument('--type', help='The link type of module')
-    parser.add_argument('--allowed', help='Allow deps to use these types',
-                        action='append', default=[], metavar='TYPE')
-    parser.add_argument('--warn', help='Warn if deps use these types',
-                        action='append', default=[], metavar='TYPE')
-    parser.add_argument('deps', help='The dependencies to check',
-                        metavar='DEP', nargs='*')
-    return parser.parse_args()
-
-def print_msg(msg, args, dep_name, dep_type):
-    """Print a warning or error message"""
-    print(msg % {
-          "makefile": args.makefile,
-          "module": args.module,
-          "type": args.type,
-          "dep_name": dep_name,
-          "dep_type": dep_type}, file=sys.stderr)
-
-def main():
-    """Program entry point."""
-    args = parse_args()
-
-    failed = False
-    for dep in args.deps:
-        dep_name = os.path.basename(os.path.dirname(dep))
-        if dep_name.endswith('_intermediates'):
-            dep_name = dep_name[:len(dep_name)-len('_intermediates')]
-
-        with open(dep, 'r') as dep_file:
-            dep_types = dep_file.read().strip().split(' ')
-
-        for dep_type in dep_types:
-            if dep_type in args.allowed:
-                continue
-            if dep_type in args.warn:
-                print_msg(WARNING_MSG, args, dep_name, dep_type)
-            else:
-                print_msg(ERROR_MSG, args, dep_name, dep_type)
-                failed = True
-
-    if failed:
-        sys.exit(1)
-
-if __name__ == '__main__':
-    main()
diff --git a/tools/dump-package-stats b/tools/dump-package-stats
deleted file mode 100755
index 7814368..0000000
--- a/tools/dump-package-stats
+++ /dev/null
@@ -1,142 +0,0 @@
-#!/bin/bash
-#
-# Copyright (C) 2007 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-PROGNAME=`basename $0`
-
-function fail ()
-{
-    if [ ! -z "$@" ]
-    then
-        echo "$PROGNAME: ERROR: $@" >&2
-    fi
-    echo "$PROGNAME: ERROR: failed." >&2
-    exit 1
-}
-
-function usage ()
-{
-    cat << HERE
-usage: $PROGNAME <.jar/.apk-file-list>
-    Dumps a summary of the compressed and uncompressed sizes of various
-    types of files in each package.  Emits one line per package.
-    Packages must be zipfiles, readable using "unzip".
-
-    Example output line:
-
-        filesize=642684 all=603288/919304 dex=119529/353815 name="out/App.apk"
-
-    filesize: the size of the package on disk
-    name: the name of the package as passed to $PROGNAME
-
-    These fields are presented as <uncompressed bytes>/<compressed bytes>:
-
-        all: the sum of all entries in the package
-        dex: the sum of all "*.dex" entries in the package
-HERE
-    exit 1
-}
-
-if [ $# -lt 1 ]
-then
-    usage
-fi
-
-UNAME=`uname`
-if [ "x$UNAME" = "xDarwin" ]
-then
-    statArgs="-f %z"
-elif [ "x$UNAME" = "xLinux" ]
-then
-    statArgs="-c %s"
-else
-    fail "Unknown uname $UNAME"
-fi
-
-function printFileSize ()
-{
-    stat $statArgs $1
-}
-
-for file
-do
-    if [ ! -f "$file" ]
-    then
-        fail "$file doesn't exist or isn't a file"
-    fi
-    unzip -lvq "$file" | awk '
-        BEGIN {
-          total_compressed = 0;
-          total_uncompressed = 0;
-          dex_compressed = 0;
-          dex_uncompressed = 0;
-        }
-
-        # Make sure the output of unzip -lv looks like something we expect.
-        #
-        NR == "1" {
-            if (NF != "8" ||
-                $1 != "Length" ||
-                $2 != "Method" ||
-                $3 != "Size" ||
-                ($4 != "Ratio" && $4 != "Cmpr") ||
-                $5 != "Date" ||
-                $6 != "Time" ||
-                $7 != "CRC-32" ||
-                $8 != "Name")
-            {
-                print "'$PROGNAME': ERROR: Unexpected zip listing format" > \
-                        "/dev/stderr";
-                print "'$PROGNAME': ERROR: Line 2 is \"" $0 "\"" > \
-                        "/dev/stderr";
-                failed = 1;
-                exit 1;
-            } else {
-                saw_listing = 1;
-            }
-        }
-
-        # Only look for lines where the ratio is the fourth column;
-        # this filters out the header and footer.
-        #
-        $4 ~ /%$/ {
-            uncompressed = $1;
-            compressed = $3;
-            if ($0 ~ /.dex$/) {
-                dex_compressed += compressed;
-                dex_uncompressed += uncompressed;
-            }
-            total_compressed += compressed;
-            total_uncompressed += uncompressed;
-        }
-        { next }
-
-        END {
-            if (!failed && saw_listing) {
-                print "filesize='$(printFileSize "$file")'",
-                      "all=" total_compressed "/" total_uncompressed,
-                      "dex=" dex_compressed "/" dex_uncompressed,
-                      "name=\"'"$file"'\"";
-            } else {
-                exit 1;
-            }
-        }
-    '
-    if [ $? -ne 0 ]
-    then
-        fail "Could not get stats for $file"
-    fi
-done
diff --git a/tools/event_log_tags.py b/tools/event_log_tags.py
index 645839e..35b2de0 100644
--- a/tools/event_log_tags.py
+++ b/tools/event_log_tags.py
@@ -62,9 +62,9 @@
     try:
       for self.linenum, line in enumerate(file_object):
         self.linenum += 1
-
+        line = re.sub('#.*$', '', line) # strip trailing comments
         line = line.strip()
-        if not line or line[0] == '#': continue
+        if not line: continue
         parts = re.split(r"\s+", line, 2)
 
         if len(parts) < 2:
diff --git a/tools/extract_kernel.py b/tools/extract_kernel.py
index 42561cf..8ca11d1 100755
--- a/tools/extract_kernel.py
+++ b/tools/extract_kernel.py
@@ -100,19 +100,25 @@
   return o
 
 
-def try_decompress(cmd, search_bytes, input_bytes):
-  idx = input_bytes.find(search_bytes)
-  if idx < 0:
-    return None
-
-  idx = 0
+def try_decompress_bytes(cmd, input_bytes):
   sp = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                         stderr=subprocess.PIPE)
-  o, _ = sp.communicate(input=input_bytes[idx:])
+  o, _ = sp.communicate(input=input_bytes)
   # ignore errors
   return o
 
 
+def try_decompress(cmd, search_bytes, input_bytes):
+  idx = 0
+  while True:
+    idx = input_bytes.find(search_bytes, idx)
+    if idx < 0:
+      raise StopIteration()
+
+    yield try_decompress_bytes(cmd, input_bytes[idx:])
+    idx += 1
+
+
 def decompress_dump(func, input_bytes):
   """
   Run func(input_bytes) first; and if that fails (returns value evaluates to
@@ -122,15 +128,15 @@
   if o:
     return o
   for cmd, search_bytes in COMPRESSION_ALGO:
-    decompressed = try_decompress(cmd, search_bytes, input_bytes)
-    if decompressed:
-      o = func(decompressed)
-      if o:
-        return o
+    for decompressed in try_decompress(cmd, search_bytes, input_bytes):
+      if decompressed:
+        o = decompress_dump(func, decompressed)
+        if o:
+          return o
     # Force decompress the whole file even if header doesn't match
-    decompressed = try_decompress(cmd, b"", input_bytes)
+    decompressed = try_decompress_bytes(cmd, input_bytes)
     if decompressed:
-      o = func(decompressed)
+      o = decompress_dump(func, decompressed)
       if o:
         return o
 
diff --git a/tools/fs_config/Android.bp b/tools/fs_config/Android.bp
index d9a48d7..1dd5e4a 100644
--- a/tools/fs_config/Android.bp
+++ b/tools/fs_config/Android.bp
@@ -20,7 +20,7 @@
         "soong-genrule",
     ],
     srcs: [
-        "fs_config.go"
+        "fs_config.go",
     ],
     pluginFor: ["soong_build"],
 }
@@ -52,17 +52,18 @@
 
 cc_library_headers {
     name: "oemaids_headers",
+    vendor_available: true,
     generated_headers: ["oemaids_header_gen"],
     export_generated_headers: ["oemaids_header_gen"],
 }
 
-// Generate the vendor/etc/passwd text file for the target
-// This file may be empty if no AIDs are defined in
+// Generate the */etc/passwd text files for the target
+// These files may be empty if no AIDs are defined in
 // TARGET_FS_CONFIG_GEN files.
 genrule {
-    name: "passwd_gen",
+    name: "passwd_gen_system",
     tool_files: ["fs_config_generator.py"],
-    cmd: "$(location fs_config_generator.py) passwd --required-prefix=vendor_ --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    cmd: "$(location fs_config_generator.py) passwd --partition=system --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
     srcs: [
         ":target_fs_config_gen",
         ":android_filesystem_config_header",
@@ -71,18 +72,90 @@
 }
 
 prebuilt_etc {
-    name: "passwd",
-    vendor: true,
-    src: ":passwd_gen",
+    name: "passwd_system",
+    filename: "passwd",
+    src: ":passwd_gen_system",
 }
 
-// Generate the vendor/etc/group text file for the target
-// This file may be empty if no AIDs are defined in
+genrule {
+    name: "passwd_gen_vendor",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) passwd --partition=vendor --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["passwd"],
+}
+
+prebuilt_etc {
+    name: "passwd_vendor",
+    filename: "passwd",
+    vendor: true,
+    src: ":passwd_gen_vendor",
+}
+
+genrule {
+    name: "passwd_gen_odm",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) passwd --partition=odm --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["passwd"],
+}
+
+prebuilt_etc {
+    name: "passwd_odm",
+    filename: "passwd",
+    device_specific: true,
+    src: ":passwd_gen_odm",
+}
+
+genrule {
+    name: "passwd_gen_product",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) passwd --partition=product --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["passwd"],
+}
+
+prebuilt_etc {
+    name: "passwd_product",
+    filename: "passwd",
+    product_specific: true,
+    src: ":passwd_gen_product",
+}
+
+genrule {
+    name: "passwd_gen_system_ext",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) passwd --partition=system_ext --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["passwd"],
+}
+
+prebuilt_etc {
+    name: "passwd_system_ext",
+    filename: "passwd",
+    system_ext_specific: true,
+    src: ":passwd_gen_system_ext",
+}
+
+// Generate the */etc/group text files for the target
+// These files may be empty if no AIDs are defined in
 // TARGET_FS_CONFIG_GEN files.
 genrule {
-    name: "group_gen",
+    name: "group_gen_system",
     tool_files: ["fs_config_generator.py"],
-    cmd: "$(location fs_config_generator.py) group --required-prefix=vendor_ --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    cmd: "$(location fs_config_generator.py) group --partition=system --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
     srcs: [
         ":target_fs_config_gen",
         ":android_filesystem_config_header",
@@ -91,7 +164,79 @@
 }
 
 prebuilt_etc {
-    name: "group",
+    name: "group_system",
+    filename: "group",
+    src: ":group_gen_system",
+}
+
+genrule {
+    name: "group_gen_vendor",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) group --partition=vendor --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["group"],
+}
+
+prebuilt_etc {
+    name: "group_vendor",
+    filename: "group",
     vendor: true,
-    src: ":group_gen",
+    src: ":group_gen_vendor",
+}
+
+genrule {
+    name: "group_gen_odm",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) group --partition=odm --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["group"],
+}
+
+prebuilt_etc {
+    name: "group_odm",
+    filename: "group",
+    device_specific: true,
+    src: ":group_gen_odm",
+}
+
+genrule {
+    name: "group_gen_product",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) group --partition=product --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["group"],
+}
+
+prebuilt_etc {
+    name: "group_product",
+    filename: "group",
+    product_specific: true,
+    src: ":group_gen_product",
+}
+
+genrule {
+    name: "group_gen_system_ext",
+    tool_files: ["fs_config_generator.py"],
+    cmd: "$(location fs_config_generator.py) group --partition=system_ext --aid-header=$(location :android_filesystem_config_header) $(locations :target_fs_config_gen) >$(out)",
+    srcs: [
+        ":target_fs_config_gen",
+        ":android_filesystem_config_header",
+    ],
+    out: ["group"],
+}
+
+prebuilt_etc {
+    name: "group_system_ext",
+    filename: "group",
+    system_ext_specific: true,
+    src: ":group_gen_system_ext",
 }
diff --git a/tools/fs_config/Android.mk b/tools/fs_config/Android.mk
index af0da46..64fabe6 100644
--- a/tools/fs_config/Android.mk
+++ b/tools/fs_config/Android.mk
@@ -27,13 +27,13 @@
 system_android_filesystem_config := system/core/include/private/android_filesystem_config.h
 system_capability_header := bionic/libc/kernel/uapi/linux/capability.h
 
-# List of supported vendor, oem, odm, product and product_services Partitions
+# List of supported vendor, oem, odm, product and system_ext Partitions
 fs_config_generate_extra_partition_list := $(strip \
   $(if $(BOARD_USES_VENDORIMAGE)$(BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE),vendor) \
   $(if $(BOARD_USES_OEMIMAGE)$(BOARD_OEMIMAGE_FILE_SYSTEM_TYPE),oem) \
   $(if $(BOARD_USES_ODMIMAGE)$(BOARD_ODMIMAGE_FILE_SYSTEM_TYPE),odm) \
   $(if $(BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE),product) \
-  $(if $(BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE),product_services) \
+  $(if $(BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE),system_ext) \
 )
 
 ##################################
@@ -332,17 +332,17 @@
 	   $(or $(PRIVATE_TARGET_FS_CONFIG_GEN),/dev/null)
 endif
 
-ifneq ($(filter product_services,$(fs_config_generate_extra_partition_list)),)
+ifneq ($(filter system_ext,$(fs_config_generate_extra_partition_list)),)
 ##################################
-# Generate the product_services/etc/fs_config_dirs binary file for the target
-# Add fs_config_dirs or fs_config_dirs_product_services to PRODUCT_PACKAGES in
+# Generate the system_ext/etc/fs_config_dirs binary file for the target
+# Add fs_config_dirs or fs_config_dirs_system_ext to PRODUCT_PACKAGES in
 # the device make file to enable
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := fs_config_dirs_product_services
+LOCAL_MODULE := fs_config_dirs_system_ext
 LOCAL_MODULE_CLASS := ETC
 LOCAL_INSTALLED_MODULE_STEM := fs_config_dirs
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_SERVICES)/etc
+LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc
 include $(BUILD_SYSTEM)/base_rules.mk
 $(LOCAL_BUILT_MODULE): PRIVATE_ANDROID_FS_HDR := $(system_android_filesystem_config)
 $(LOCAL_BUILT_MODULE): PRIVATE_ANDROID_CAP_HDR := $(system_capability_header)
@@ -352,21 +352,21 @@
 	$< fsconfig \
 	   --aid-header $(PRIVATE_ANDROID_FS_HDR) \
 	   --capability-header $(PRIVATE_ANDROID_CAP_HDR) \
-	   --partition product_services \
+	   --partition system_ext \
 	   --dirs \
 	   --out_file $@ \
 	   $(or $(PRIVATE_TARGET_FS_CONFIG_GEN),/dev/null)
 
 ##################################
-# Generate the product_services/etc/fs_config_files binary file for the target
-# Add fs_config_files of fs_config_files_product_services to PRODUCT_PACKAGES in
+# Generate the system_ext/etc/fs_config_files binary file for the target
+# Add fs_config_files of fs_config_files_system_ext to PRODUCT_PACKAGES in
 # the device make file to enable
 include $(CLEAR_VARS)
 
-LOCAL_MODULE := fs_config_files_product_services
+LOCAL_MODULE := fs_config_files_system_ext
 LOCAL_MODULE_CLASS := ETC
 LOCAL_INSTALLED_MODULE_STEM := fs_config_files
-LOCAL_MODULE_PATH := $(TARGET_OUT_PRODUCT_SERVICES)/etc
+LOCAL_MODULE_PATH := $(TARGET_OUT_SYSTEM_EXT)/etc
 include $(BUILD_SYSTEM)/base_rules.mk
 $(LOCAL_BUILT_MODULE): PRIVATE_ANDROID_FS_HDR := $(system_android_filesystem_config)
 $(LOCAL_BUILT_MODULE): PRIVATE_ANDROID_CAP_HDR := $(system_capability_header)
@@ -376,7 +376,7 @@
 	$< fsconfig \
 	   --aid-header $(PRIVATE_ANDROID_FS_HDR) \
 	   --capability-header $(PRIVATE_ANDROID_CAP_HDR) \
-	   --partition product_services \
+	   --partition system_ext \
 	   --files \
 	   --out_file $@ \
 	   $(or $(PRIVATE_TARGET_FS_CONFIG_GEN),/dev/null)
diff --git a/tools/fs_config/README b/tools/fs_config/README
index f7d4deb..21bdeb8 100644
--- a/tools/fs_config/README
+++ b/tools/fs_config/README
@@ -3,16 +3,33 @@
 |  _  <|   __||  _  ||  |  ||  \/  ||   __|
 \__|\_/\_____/\__|__/|_____/\__ \__/\_____/
 
-Generating the android_filesystem_config.h:
+The fs_config_generator.py tool uses the platform android_filesystem_config.h and the
+TARGET_FS_CONFIG_GEN files to generate the fs_config_dirs and fs_config_files files for each
+partition, as well as passwd and group files, and the generated_oem_aid.h header.
 
-To generate the android_filesystem_config.h file, one can set
-TARGET_FS_CONFIG_GEN, which can be a list of intermediate fs configuration
-files.
+The fs_config_dirs and fs_config_files binary files are interpreted by the libcutils fs_config()
+function, along with the built-in defaults, to serve as overrides to complete the results. The
+Target files are used by filesystem and adb tools to ensure that the file and directory properties
+are preserved during runtime operations. The host files in the ${OUT} directory are used in the
+final stages when building the filesystem images to set the file and directory properties.
 
-The parsing of the config file follows the Python ConfigParser specification,
-with the sections and fields as defined below. There are two types of sections,
-both sections require all options to be specified. The first section type is
-the "caps" section.
+See ./fs_config_generator.py fsconfig --help for how these files are generated.
+
+The passwd and group files are formatted as documented in man pages passwd(5) and group(5) and used
+by bionic for implementing getpwnam() and related functions.
+
+See ./fs_config_generator.py passwd --help and ./fs_config_generator.py group --help for how these
+files are generated.
+
+The generated_oem_aid.h creates identifiers for non-platform AIDs for developers wishing to use them
+in their native code.  To do so, include the oemaids_headers header library in the corresponding
+makefile and #include "generated_oem_aid.h" in the code wishing to use these identifiers.
+
+See ./fs_config_generator.py oemaid --help for how this file is generated.
+
+The parsing of the TARGET_FS_CONFIG_GEN files follows the Python ConfigParser specification, with
+the sections and fields as defined below. There are two types of sections, both sections require all
+options to be specified. The first section type is the "caps" section.
 
 The "caps" section follows the following syntax:
 
@@ -103,11 +120,6 @@
 file and to line up files. Sync lines are placed with the source file as comments in the generated
 header file.
 
-For OEMs wishing to use the define AIDs in their native code, one can access the generated header
-file like so:
-  1. In your C code just #include "generated_oem_aid.h" and start using the declared identifiers.
-  2. In your Makefile add this static library like so: LOCAL_HEADER_LIBRARIES := oemaids_headers
-
 Unit Tests:
 
 From within the fs_config directory, unit tests can be executed like so:
@@ -123,45 +135,3 @@
 
 To add new tests, simply add a test_<xxx> method to the test class. It will automatically
 get picked up and added to the test suite.
-
-Using the android_filesystem_config.h:
-
-The tool fs_config_generate is built as a dependency to fs_config_dirs and
-fs_config_files host targets, and #includes the above supplied or generated
-android_filesystem_config.h file, and can be instructed to generate the binary
-data that lands in the device target locations /system/etc/fs_config_dirs and
-/system/etc/fs_config_files and in the host's ${OUT} locations
-${OUT}/target/product/<device>/system/etc/fs_config_dirs and
-${OUT}/target/product/<device>/system/etc/fs_config_files. The binary files
-are interpreted by the libcutils fs_conf() function, along with the built-in
-defaults, to serve as overrides to complete the results. The Target files are
-used by filesystem and adb tools to ensure that the file and directory
-properties are preserved during runtime operations. The host files in the
-${OUT} directory are used in the final stages when building the filesystem
-images to set the file and directory properties.
-
-For systems with separate partition images, such as vendor or oem,
-fs_config_generate can be instructed to filter the specific file references
-to land in each partition's etc/fs_config_dirs or etc/fs_config_files
-locations. The filter can be instructed to blacklist a partition's data by
-providing the comma separated minus sign prefixed partition names. The filter
-can be instructed to whitelist partition data by providing the partition name.
-
-For example:
-- For system.img, but not vendor, oem or odm file references:
-      -P -vendor,-oem,-odm
-  This makes sure the results only contain content associated with the
-  system, and not vendor, oem or odm, blacklisting their content.
-- For vendor.img file references: -P vendor
-- For oem.img file references: -P oem
-- For odm.img file references: -P odm
-
-fs_config_generate --help reports:
-
-Generate binary content for fs_config_dirs (-D) and fs_config_files (-F)
-from device-specific android_filesystem_config.h override. Filter based
-on a comma separated partition list (-P) whitelist or prefixed by a
-minus blacklist. Partitions are identified as path references to
-<partition>/ or system/<partition>
-
-Usage: fs_config_generate -D|-F [-P list] [-o output-file]
diff --git a/tools/fs_config/fs_config_generator.py b/tools/fs_config/fs_config_generator.py
index 109b29a..1405fd3 100755
--- a/tools/fs_config/fs_config_generator.py
+++ b/tools/fs_config/fs_config_generator.py
@@ -312,13 +312,12 @@
         re.compile(r'%sUSER' % AID.PREFIX)
     ]
     _AID_DEFINE = re.compile(r'\s*#define\s+%s.*' % AID.PREFIX)
-    _OEM_START_KW = 'START'
-    _OEM_END_KW = 'END'
-    _OEM_RANGE = re.compile('%sOEM_RESERVED_[0-9]*_{0,1}(%s|%s)' %
-                            (AID.PREFIX, _OEM_START_KW, _OEM_END_KW))
+    _RESERVED_RANGE = re.compile(
+        r'#define AID_(.+)_RESERVED_\d*_*(START|END)\s+(\d+)')
+
     # AID lines cannot end with _START or _END, ie AID_FOO is OK
     # but AID_FOO_START is skiped. Note that AID_FOOSTART is NOT skipped.
-    _AID_SKIP_RANGE = ['_' + _OEM_START_KW, '_' + _OEM_END_KW]
+    _AID_SKIP_RANGE = ['_START', '_END']
     _COLLISION_OK = ['AID_APP', 'AID_APP_START', 'AID_USER', 'AID_USER_OFFSET']
 
     def __init__(self, aid_header):
@@ -330,7 +329,7 @@
         self._aid_header = aid_header
         self._aid_name_to_value = {}
         self._aid_value_to_name = {}
-        self._oem_ranges = {}
+        self._ranges = {}
 
         with open(aid_header) as open_file:
             self._parse(open_file)
@@ -355,6 +354,23 @@
                 return 'Error "{}" in file: "{}" on line: {}'.format(
                     msg, self._aid_header, str(lineno))
 
+            range_match = self._RESERVED_RANGE.match(line)
+            if range_match:
+                partition = range_match.group(1).lower()
+                value = int(range_match.group(3), 0)
+
+                if partition == 'oem':
+                    partition = 'vendor'
+
+                if partition in self._ranges:
+                    if isinstance(self._ranges[partition][-1], int):
+                        self._ranges[partition][-1] = (
+                            self._ranges[partition][-1], value)
+                    else:
+                        self._ranges[partition].append(value)
+                else:
+                    self._ranges[partition] = [value]
+
             if AIDHeaderParser._AID_DEFINE.match(line):
                 chunks = line.split()
                 identifier = chunks[1]
@@ -366,9 +382,7 @@
                     continue
 
                 try:
-                    if AIDHeaderParser._is_oem_range(identifier):
-                        self._handle_oem_range(identifier, value)
-                    elif not any(
+                    if not any(
                             identifier.endswith(x)
                             for x in AIDHeaderParser._AID_SKIP_RANGE):
                         self._handle_aid(identifier, value)
@@ -404,67 +418,6 @@
         self._aid_name_to_value[aid.friendly] = aid
         self._aid_value_to_name[value] = aid.friendly
 
-    def _handle_oem_range(self, identifier, value):
-        """Handle an OEM range C #define.
-
-        When encountering special AID defines, notably for the OEM ranges
-        this method handles sanity checking and adding them to the internal
-        maps. For internal use only.
-
-        Args:
-            identifier (str): The name of the #define identifier.
-                ie AID_OEM_RESERVED_START/END.
-            value (str): The value associated with the identifier.
-
-        Raises:
-            ValueError: With message set to indicate the error.
-        """
-
-        try:
-            int_value = int(value, 0)
-        except ValueError:
-            raise ValueError(
-                'Could not convert "%s" to integer value, got: "%s"' %
-                (identifier, value))
-
-        # convert AID_OEM_RESERVED_START or AID_OEM_RESERVED_<num>_START
-        # to AID_OEM_RESERVED or AID_OEM_RESERVED_<num>
-        is_start = identifier.endswith(AIDHeaderParser._OEM_START_KW)
-
-        if is_start:
-            tostrip = len(AIDHeaderParser._OEM_START_KW)
-        else:
-            tostrip = len(AIDHeaderParser._OEM_END_KW)
-
-        # ending _
-        tostrip = tostrip + 1
-
-        strip = identifier[:-tostrip]
-        if strip not in self._oem_ranges:
-            self._oem_ranges[strip] = []
-
-        if len(self._oem_ranges[strip]) > 2:
-            raise ValueError('Too many same OEM Ranges "%s"' % identifier)
-
-        if len(self._oem_ranges[strip]) == 1:
-            tmp = self._oem_ranges[strip][0]
-
-            if tmp == int_value:
-                raise ValueError('START and END values equal %u' % int_value)
-            elif is_start and tmp < int_value:
-                raise ValueError(
-                    'END value %u less than START value %u' % (tmp, int_value))
-            elif not is_start and tmp > int_value:
-                raise ValueError(
-                    'END value %u less than START value %u' % (int_value, tmp))
-
-        # Add START values to the head of the list and END values at the end.
-        # Thus, the list is ordered with index 0 as START and index 1 as END.
-        if is_start:
-            self._oem_ranges[strip].insert(0, int_value)
-        else:
-            self._oem_ranges[strip].append(int_value)
-
     def _process_and_check(self):
         """Process, check and populate internal data structures.
 
@@ -475,36 +428,32 @@
             ValueError: With the message set to indicate the specific error.
         """
 
-        # tuplefy the lists since range() does not like them mutable.
-        self._oem_ranges = [
-            AIDHeaderParser._convert_lst_to_tup(k, v)
-            for k, v in self._oem_ranges.iteritems()
-        ]
-
         # Check for overlapping ranges
-        for i, range1 in enumerate(self._oem_ranges):
-            for range2 in self._oem_ranges[i + 1:]:
-                if AIDHeaderParser._is_overlap(range1, range2):
-                    raise ValueError("Overlapping OEM Ranges found %s and %s" %
-                                     (str(range1), str(range2)))
+        for ranges in self._ranges.values():
+            for i, range1 in enumerate(ranges):
+                for range2 in ranges[i + 1:]:
+                    if AIDHeaderParser._is_overlap(range1, range2):
+                        raise ValueError(
+                            "Overlapping OEM Ranges found %s and %s" %
+                            (str(range1), str(range2)))
 
         # No core AIDs should be within any oem range.
         for aid in self._aid_value_to_name:
-
-            if Utils.in_any_range(aid, self._oem_ranges):
-                name = self._aid_value_to_name[aid]
-                raise ValueError(
-                    'AID "%s" value: %u within reserved OEM Range: "%s"' %
-                    (name, aid, str(self._oem_ranges)))
+            for ranges in self._ranges.values():
+                if Utils.in_any_range(aid, ranges):
+                    name = self._aid_value_to_name[aid]
+                    raise ValueError(
+                        'AID "%s" value: %u within reserved OEM Range: "%s"' %
+                        (name, aid, str(ranges)))
 
     @property
-    def oem_ranges(self):
+    def ranges(self):
         """Retrieves the OEM closed ranges as a list of tuples.
 
         Returns:
             A list of closed range tuples: [ (0, 42), (50, 105) ... ]
         """
-        return self._oem_ranges
+        return self._ranges
 
     @property
     def aids(self):
@@ -516,39 +465,6 @@
         return self._aid_name_to_value.values()
 
     @staticmethod
-    def _convert_lst_to_tup(name, lst):
-        """Converts a mutable list to a non-mutable tuple.
-
-        Used ONLY for ranges and thus enforces a length of 2.
-
-        Args:
-            lst (List): list that should be "tuplefied".
-
-        Raises:
-            ValueError if lst is not a list or len is not 2.
-
-        Returns:
-            Tuple(lst)
-        """
-        if not lst or len(lst) != 2:
-            raise ValueError('Mismatched range for "%s"' % name)
-
-        return tuple(lst)
-
-    @staticmethod
-    def _is_oem_range(aid):
-        """Detects if a given aid is within the reserved OEM range.
-
-        Args:
-            aid (int): The aid to test
-
-        Returns:
-            True if it is within the range, False otherwise.
-        """
-
-        return AIDHeaderParser._OEM_RANGE.match(aid)
-
-    @staticmethod
     def _is_overlap(range_a, range_b):
         """Calculates the overlap of two range tuples.
 
@@ -588,12 +504,12 @@
     _SECTIONS = [('_handle_aid', ('value', )),
                  ('_handle_path', ('mode', 'user', 'group', 'caps'))]
 
-    def __init__(self, config_files, oem_ranges):
+    def __init__(self, config_files, ranges):
         """
         Args:
             config_files ([str]): The list of config.fs files to parse.
                 Note the filename is not important.
-            oem_ranges ([(),()]): range tuples indicating reserved OEM ranges.
+            ranges ({str,[()]): Dictionary of partitions and a list of tuples that correspond to their ranges
         """
 
         self._files = []
@@ -604,7 +520,7 @@
         # (name to file, value to aid)
         self._seen_aids = ({}, {})
 
-        self._oem_ranges = oem_ranges
+        self._ranges = ranges
 
         self._config_files = config_files
 
@@ -669,6 +585,27 @@
             # within the generated file.
             self._aids.sort(key=lambda item: item.normalized_value)
 
+    def _verify_valid_range(self, aid):
+        """Verified an AID entry is in a valid range"""
+
+        ranges = None
+
+        partitions = self._ranges.keys()
+        partitions.sort(key=len, reverse=True)
+        for partition in partitions:
+            if aid.friendly.startswith(partition):
+                ranges = self._ranges[partition]
+                break
+
+        if ranges is None:
+            sys.exit('AID "%s" must be prefixed with a partition name' %
+                     aid.friendly)
+
+        if not Utils.in_any_range(int(aid.value, 0), ranges):
+            emsg = '"value" for aid "%s" not in valid range %s, got: %s'
+            emsg = emsg % (aid.friendly, str(ranges), aid.value)
+            sys.exit(emsg)
+
     def _handle_aid(self, file_name, section_name, config):
         """Verifies an AID entry and adds it to the aid list.
 
@@ -702,15 +639,11 @@
             sys.exit(error_message('Found specified but unset "value"'))
 
         try:
-            aid = AID(section_name, value, file_name, '/vendor/bin/sh')
+            aid = AID(section_name, value, file_name, '/bin/sh')
         except ValueError as exception:
             sys.exit(error_message(exception))
 
-        # Values must be within OEM range
-        if not Utils.in_any_range(int(aid.value, 0), self._oem_ranges):
-            emsg = '"value" not in valid range %s, got: %s'
-            emsg = emsg % (str(self._oem_ranges), value)
-            sys.exit(error_message(emsg))
+        self._verify_valid_range(aid)
 
         # use the normalized int value in the dict and detect
         # duplicate definitions of the same value
@@ -1000,7 +933,7 @@
             args['capability_header'])
         self._base_parser = AIDHeaderParser(args['aid_header'])
         self._oem_parser = FSConfigFileParser(args['fsconfig'],
-                                              self._base_parser.oem_ranges)
+                                              self._base_parser.ranges)
 
         self._partition = args['partition']
         self._all_partitions = args['all_partitions']
@@ -1104,7 +1037,7 @@
             caps_split = caps.split(',')
             for cap in caps_split:
                 if cap not in caps_dict:
-                    sys.exit('Unkonwn cap "%s" found!' % cap)
+                    sys.exit('Unknown cap "%s" found!' % cap)
                 caps_value += 1 << caps_dict[cap]
 
         path_length_with_null = len(path) + 1
@@ -1267,7 +1200,7 @@
 
         hdr_parser = AIDHeaderParser(args['aid_header'])
 
-        parser = FSConfigFileParser(args['fsconfig'], hdr_parser.oem_ranges)
+        parser = FSConfigFileParser(args['fsconfig'], hdr_parser.ranges)
 
         print OEMAidGen._GENERATED
 
@@ -1315,17 +1248,19 @@
             'to parse AIDs and OEM Ranges from')
 
         opt_group.add_argument(
-            '--required-prefix',
-            required=False,
-            help='A prefix that the names are required to contain.')
+            '--partition',
+            required=True,
+            help=
+            'Filter the input file and only output entries for the given partition.'
+        )
 
     def __call__(self, args):
 
         hdr_parser = AIDHeaderParser(args['aid_header'])
 
-        parser = FSConfigFileParser(args['fsconfig'], hdr_parser.oem_ranges)
+        parser = FSConfigFileParser(args['fsconfig'], hdr_parser.ranges)
 
-        required_prefix = args['required_prefix']
+        filter_partition = args['partition']
 
         aids = parser.aids
 
@@ -1333,13 +1268,22 @@
         if not aids:
             return
 
+        aids_by_partition = {}
+        partitions = hdr_parser.ranges.keys()
+        partitions.sort(key=len, reverse=True)
+
         for aid in aids:
-            if required_prefix is None or aid.friendly.startswith(
-                    required_prefix):
+            for partition in partitions:
+                if aid.friendly.startswith(partition):
+                    if partition in aids_by_partition:
+                        aids_by_partition[partition].append(aid)
+                    else:
+                        aids_by_partition[partition] = [aid]
+                    break
+
+        if filter_partition in aids_by_partition:
+            for aid in aids_by_partition[filter_partition]:
                 self._print_formatted_line(aid)
-            else:
-                sys.exit("%s: AID '%s' must start with '%s'" %
-                         (args['fsconfig'], aid.friendly, required_prefix))
 
     def _print_formatted_line(self, aid):
         """Prints the aid to stdout in the passwd format. Internal use only.
diff --git a/tools/generate-notice-files.py b/tools/generate-notice-files.py
index 49011b2..bf958fb 100755
--- a/tools/generate-notice-files.py
+++ b/tools/generate-notice-files.py
@@ -73,10 +73,10 @@
 </style>
 """
 
-def combine_notice_files_html(file_hash, input_dir, output_filename):
+def combine_notice_files_html(file_hash, input_dirs, output_filename):
     """Combine notice files in FILE_HASH and output a HTML version to OUTPUT_FILENAME."""
 
-    SRC_DIR_STRIP_RE = re.compile(input_dir + "(/.*).txt")
+    SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(input_dirs) + ")(/.*).txt")
 
     # Set up a filename to row id table (anchors inside tables don't work in
     # most browsers, but href's to table row ids do)
@@ -131,10 +131,10 @@
     print >> output_file, "</body></html>"
     output_file.close()
 
-def combine_notice_files_text(file_hash, input_dir, output_filename, file_title):
+def combine_notice_files_text(file_hash, input_dirs, output_filename, file_title):
     """Combine notice files in FILE_HASH and output a text version to OUTPUT_FILENAME."""
 
-    SRC_DIR_STRIP_RE = re.compile(input_dir + "(/.*).txt")
+    SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(input_dirs) + ")(/.*).txt")
     output_file = open(output_filename, "wb")
     print >> output_file, file_title
     for value in file_hash:
@@ -146,10 +146,10 @@
       print >> output_file, open(value[0]).read()
     output_file.close()
 
-def combine_notice_files_xml(files_with_same_hash, input_dir, output_filename):
+def combine_notice_files_xml(files_with_same_hash, input_dirs, output_filename):
     """Combine notice files in FILE_HASH and output a XML version to OUTPUT_FILENAME."""
 
-    SRC_DIR_STRIP_RE = re.compile(input_dir + "(/.*).txt")
+    SRC_DIR_STRIP_RE = re.compile("(?:" + "|".join(input_dirs) + ")(/.*).txt")
 
     # Set up a filename to row id table (anchors inside tables don't work in
     # most browsers, but href's to table row ids do)
@@ -205,7 +205,7 @@
         '-t', '--title', required=True,
         help='The file title.')
     parser.add_argument(
-        '-s', '--source-dir', required=True,
+        '-s', '--source-dir', required=True, action='append',
         help='The directory containing notices.')
     parser.add_argument(
         '-i', '--included-subdirs', action='append',
@@ -229,39 +229,39 @@
     if args.excluded_subdirs is not None:
         excluded_subdirs = args.excluded_subdirs
 
+    input_dirs = [os.path.normpath(source_dir) for source_dir in args.source_dir]
     # Find all the notice files and md5 them
-    input_dir = os.path.normpath(args.source_dir)
     files_with_same_hash = defaultdict(list)
-    for root, dir, files in os.walk(input_dir):
-        for file in files:
-            matched = True
-            if len(included_subdirs) > 0:
-                matched = False
-                for subdir in included_subdirs:
-                    if (root == (input_dir + '/' + subdir) or
-                        root.startswith(input_dir + '/' + subdir + '/')):
-                        matched = True
-                        break
-            elif len(excluded_subdirs) > 0:
-                for subdir in excluded_subdirs:
-                    if (root == (input_dir + '/' + subdir) or
-                        root.startswith(input_dir + '/' + subdir + '/')):
-                        matched = False
-                        break
-            if matched and file.endswith(".txt"):
-                filename = os.path.join(root, file)
-                file_md5sum = md5sum(filename)
-                files_with_same_hash[file_md5sum].append(filename)
+    for input_dir in input_dirs:
+        for root, dir, files in os.walk(input_dir):
+            for file in files:
+                matched = True
+                if len(included_subdirs) > 0:
+                    matched = False
+                    for subdir in included_subdirs:
+                        if (root == (input_dir + '/' + subdir) or
+                            root.startswith(input_dir + '/' + subdir + '/')):
+                            matched = True
+                            break
+                elif len(excluded_subdirs) > 0:
+                    for subdir in excluded_subdirs:
+                        if (root == (input_dir + '/' + subdir) or
+                            root.startswith(input_dir + '/' + subdir + '/')):
+                            matched = False
+                            break
+                if matched and file.endswith(".txt"):
+                    filename = os.path.join(root, file)
+                    file_md5sum = md5sum(filename)
+                    files_with_same_hash[file_md5sum].append(filename)
 
     filesets = [sorted(files_with_same_hash[md5]) for md5 in sorted(files_with_same_hash.keys())]
-
-    combine_notice_files_text(filesets, input_dir, txt_output_file, file_title)
+    combine_notice_files_text(filesets, input_dirs, txt_output_file, file_title)
 
     if html_output_file is not None:
-        combine_notice_files_html(filesets, input_dir, html_output_file)
+        combine_notice_files_html(filesets, input_dirs, html_output_file)
 
     if xml_output_file is not None:
-        combine_notice_files_xml(files_with_same_hash, input_dir, xml_output_file)
+        combine_notice_files_xml(files_with_same_hash, input_dirs, xml_output_file)
 
 if __name__ == "__main__":
     main(sys.argv)
diff --git a/tools/generate-self-extracting-archive.py b/tools/generate-self-extracting-archive.py
new file mode 100755
index 0000000..5b0628d
--- /dev/null
+++ b/tools/generate-self-extracting-archive.py
@@ -0,0 +1,181 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Generates a self extracting archive with a license click through.
+
+Usage:
+  generate-self-extracting-archive.py $OUTPUT_FILE $INPUT_ARCHIVE $COMMENT $LICENSE_FILE
+
+  The comment will be included at the beginning of the output archive file.
+
+Output:
+  The output of the script is a single executable file that when run will
+  display the provided license and if the user accepts extract the wrapped
+  archive.
+
+  The layout of the output file is roughly:
+   * Executable shell script that extracts the archive
+   * Actual archive contents
+   * Zip file containing the license
+"""
+
+import tempfile
+import sys
+import os
+import zipfile
+
+_HEADER_TEMPLATE = """#!/bin/bash
+#
+{comment_line}
+#
+# Usage is subject to the enclosed license agreement
+
+echo
+echo The license for this software will now be displayed.
+echo You must agree to this license before using this software.
+echo
+echo -n Press Enter to view the license
+read dummy
+echo
+more << EndOfLicense
+{license}
+EndOfLicense
+
+if test $? != 0
+then
+  echo "ERROR: Couldn't display license file" 1>&2
+  exit 1
+fi
+echo
+echo -n 'Type "I ACCEPT" if you agree to the terms of the license: '
+read typed
+if test "$typed" != "I ACCEPT"
+then
+  echo
+  echo "You didn't accept the license. Extraction aborted."
+  exit 2
+fi
+echo
+{extract_command}
+if test $? != 0
+then
+  echo
+  echo "ERROR: Couldn't extract files." 1>&2
+  exit 3
+else
+  echo
+  echo "Files extracted successfully."
+fi
+exit 0
+"""
+
+_PIPE_CHUNK_SIZE = 1048576
+def _pipe_bytes(src, dst):
+  while True:
+    b = src.read(_PIPE_CHUNK_SIZE)
+    if not b:
+      break
+    dst.write(b)
+
+_MAX_OFFSET_WIDTH = 20
+def _generate_extract_command(start, size, extract_name):
+  """Generate the extract command.
+
+  The length of this string must be constant no matter what the start and end
+  offsets are so that its length can be computed before the actual command is
+  generated.
+
+  Args:
+    start: offset in bytes of the start of the wrapped file
+    size: size in bytes of the wrapped file
+    extract_name: of the file to create when extracted
+
+  """
+  # start gets an extra character for the '+'
+  # for tail +1 is the start of the file, not +0
+  start_str = ('+%d' % (start + 1)).rjust(_MAX_OFFSET_WIDTH + 1)
+  if len(start_str) != _MAX_OFFSET_WIDTH + 1:
+    raise Exception('Start offset too large (%d)' % start)
+
+  size_str = ('%d' % size).rjust(_MAX_OFFSET_WIDTH)
+  if len(size_str) != _MAX_OFFSET_WIDTH:
+    raise Exception('Size too large (%d)' % size)
+
+  return "tail -c %s $0 | head -c %s > %s\n" % (start_str, size_str, extract_name)
+
+
+def main(argv):
+  if len(argv) != 5:
+    print 'generate-self-extracting-archive.py expects exactly 4 arguments'
+    sys.exit(1)
+
+  output_filename = argv[1]
+  input_archive_filename = argv[2]
+  comment = argv[3]
+  license_filename = argv[4]
+
+  input_archive_size = os.stat(input_archive_filename).st_size
+
+  with open(license_filename, 'r') as license_file:
+    license = license_file.read()
+
+  if not license:
+    print 'License file was empty'
+    sys.exit(1)
+
+  if 'SOFTWARE LICENSE AGREEMENT' not in license:
+    print 'License does not look like a license'
+    sys.exit(1)
+
+  comment_line = '# %s\n' % comment
+  extract_name = os.path.basename(input_archive_filename)
+
+  # Compute the size of the header before writing the file out. This is required
+  # so that the extract command, which uses the contents offset, can be created
+  # and included inside the header.
+  header_for_size = _HEADER_TEMPLATE.format(
+      comment_line=comment_line,
+      license=license,
+      extract_command=_generate_extract_command(0, 0, extract_name),
+  )
+  header_size = len(header_for_size.encode('utf-8'))
+
+  # write the final output
+  with open(output_filename, 'wb') as output:
+    output.write(_HEADER_TEMPLATE.format(
+        comment_line=comment_line,
+        license=license,
+        extract_command=_generate_extract_command(header_size, input_archive_size, extract_name),
+    ).encode('utf-8'))
+
+    with open(input_archive_filename, 'rb') as input_file:
+      _pipe_bytes(input_file, output)
+
+    with tempfile.TemporaryFile() as trailing_zip:
+      with zipfile.ZipFile(trailing_zip, 'w') as myzip:
+        myzip.writestr('license.txt', license, compress_type=zipfile.ZIP_STORED)
+
+      # append the trailing zip to the end of the file
+      trailing_zip.seek(0)
+      _pipe_bytes(trailing_zip, output)
+
+  umask = os.umask(0)
+  os.umask(umask)
+  os.chmod(output_filename, 0o777 & ~umask)
+
+if __name__ == "__main__":
+  main(sys.argv)
diff --git a/tools/makeparallel/.gitignore b/tools/makeparallel/.gitignore
deleted file mode 100644
index a7d6181..0000000
--- a/tools/makeparallel/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-makeparallel
-*.o
-*.d
-test.out
diff --git a/tools/makeparallel/Makefile b/tools/makeparallel/Makefile
deleted file mode 100644
index 82a4abf..0000000
--- a/tools/makeparallel/Makefile
+++ /dev/null
@@ -1,93 +0,0 @@
-# Copyright 2015 Google Inc. All rights reserved
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Find source file location from path to this Makefile
-MAKEPARALLEL_SRC_PATH := $(patsubst %/,%,$(dir $(lastword $(MAKEFILE_LIST))))
-ifndef MAKEPARALLEL_SRC_PATH
-  MAKEPARALLEL_SRC_PATH := .
-endif
-
-# Set defaults if they weren't set by the including Makefile
-MAKEPARALLEL_CXX ?= $(CXX)
-MAKEPARALLEL_LD ?= $(CXX)
-MAKEPARALLEL_INTERMEDIATES_PATH ?= .
-MAKEPARALLEL_BIN_PATH ?= .
-
-MAKEPARALLEL_CXX_SRCS := \
-	makeparallel.cpp
-
-MAKEPARALLEL_CXXFLAGS := -Wall -Werror -MMD -MP
-
-MAKEPARALLEL_CXX_SRCS := $(addprefix $(MAKEPARALLEL_SRC_PATH)/,\
-	$(MAKEPARALLEL_CXX_SRCS))
-
-MAKEPARALLEL_CXX_OBJS := $(patsubst $(MAKEPARALLEL_SRC_PATH)/%.cpp,$(MAKEPARALLEL_INTERMEDIATES_PATH)/%.o,$(MAKEPARALLEL_CXX_SRCS))
-
-MAKEPARALLEL := $(MAKEPARALLEL_BIN_PATH)/makeparallel
-
-ifeq ($(shell uname),Linux)
-MAKEPARALLEL_LIBS := -lrt -lpthread
-endif
-
-# Rule to build makeparallel into MAKEPARALLEL_BIN_PATH
-$(MAKEPARALLEL): $(MAKEPARALLEL_CXX_OBJS)
-	@mkdir -p $(dir $@)
-	$(MAKEPARALLEL_LD) -std=c++11 $(MAKEPARALLEL_CXXFLAGS) -o $@ $^ $(MAKEPARALLEL_LIBS)
-
-# Rule to build source files into object files in MAKEPARALLEL_INTERMEDIATES_PATH
-$(MAKEPARALLEL_CXX_OBJS): $(MAKEPARALLEL_INTERMEDIATES_PATH)/%.o: $(MAKEPARALLEL_SRC_PATH)/%.cpp
-	@mkdir -p $(dir $@)
-	$(MAKEPARALLEL_CXX) -c -std=c++11 $(MAKEPARALLEL_CXXFLAGS) -o $@ $<
-
-makeparallel_clean:
-	rm -rf $(MAKEPARALLEL)
-	rm -rf $(MAKEPARALLEL_INTERMEDIATES_PATH)/*.o
-	rm -rf $(MAKEPARALLEL_INTERMEDIATES_PATH)/*.d
-
-.PHONY: makeparallel_clean
-
--include $(MAKEPARALLEL_INTERMEDIATES_PATH)/*.d
-
-.PHONY: makeparallel_test
-MAKEPARALLEL_TEST := MAKEFLAGS= MAKELEVEL= MAKEPARALLEL=$(MAKEPARALLEL) $(MAKE) -f Makefile.test test
-MAKEPARALLEL_NINJA_TEST := MAKEFLAGS= MAKELEVEL= MAKEPARALLEL="$(MAKEPARALLEL) --ninja" $(MAKE) -f Makefile.test test
-makeparallel_test: $(MAKEPARALLEL)
-	@EXPECTED="-j1234" $(MAKEPARALLEL_TEST) -j1234
-	@EXPECTED="-j123"  $(MAKEPARALLEL_TEST) -j123
-	@EXPECTED=""       $(MAKEPARALLEL_TEST) -j1
-	@EXPECTED="-j$$(($$(nproc) + 2))"   $(MAKEPARALLEL_TEST) -j
-	@EXPECTED=""       $(MAKEPARALLEL_TEST)
-
-	@EXPECTED="-j1234" $(MAKEPARALLEL_NINJA_TEST) -j1234
-	@EXPECTED="-j123"  $(MAKEPARALLEL_NINJA_TEST) -j123
-	@EXPECTED="-j1"    $(MAKEPARALLEL_NINJA_TEST) -j1
-	@EXPECTED="-j1"    $(MAKEPARALLEL_NINJA_TEST)
-	@EXPECTED=""       $(MAKEPARALLEL_NINJA_TEST) -j
-	@EXPECTED=""       $(MAKEPARALLEL_NINJA_TEST) -j -l
-
-	@EXPECTED="-j1234" $(MAKEPARALLEL_TEST) --no-print-directory -j1234
-	@EXPECTED="-j1234" $(MAKEPARALLEL_TEST) --no-print-directory -k -j1234
-	@EXPECTED="-j1234" $(MAKEPARALLEL_TEST) -k -j1234
-	@EXPECTED="-j1234" $(MAKEPARALLEL_TEST) -j1234 -k
-	@EXPECTED="-j1234" $(MAKEPARALLEL_TEST) -kt -j1234
-
-	@EXPECTED="-j1234"     $(MAKEPARALLEL_NINJA_TEST) --no-print-directory -j1234
-	@EXPECTED="-j1234 -k0" $(MAKEPARALLEL_NINJA_TEST) --no-print-directory -k -j1234
-	@EXPECTED="-j1234 -k0" $(MAKEPARALLEL_NINJA_TEST) -k -j1234
-	@EXPECTED="-j1234 -k0" $(MAKEPARALLEL_NINJA_TEST) -j1234 -k
-	@EXPECTED="-j1234 -k0" $(MAKEPARALLEL_NINJA_TEST) -kt -j1234
-
-	@EXPECTED=""       $(MAKEPARALLEL_TEST) A=-j1234
-
-	@EXPECTED="-j1234 args" ARGS="args" $(MAKEPARALLEL_TEST) -j1234
diff --git a/tools/makeparallel/Makefile.test b/tools/makeparallel/Makefile.test
deleted file mode 100644
index cf53684..0000000
--- a/tools/makeparallel/Makefile.test
+++ /dev/null
@@ -1,12 +0,0 @@
-MAKEPARALLEL ?= ./makeparallel
-
-.PHONY: test
-test:
-	@+echo MAKEFLAGS=$${MAKEFLAGS};              \
-	result=$$($(MAKEPARALLEL) echo $(ARGS));     \
-	echo result: $${result};                     \
-	if [ "$${result}" = "$(EXPECTED)" ]; then    \
-	  echo SUCCESS && echo;                      \
-	else                                         \
-	  echo FAILED expected $(EXPECTED) && false; \
-	fi
diff --git a/tools/makeparallel/README.md b/tools/makeparallel/README.md
deleted file mode 100644
index 2e5fbf9..0000000
--- a/tools/makeparallel/README.md
+++ /dev/null
@@ -1,54 +0,0 @@
-<!---
-Copyright (C) 2015 The Android Open Source Project
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
--->
-
-makeparallel
-============
-makeparallel communicates with the [GNU make jobserver](http://make.mad-scientist.net/papers/jobserver-implementation/)
-in order claim all available jobs, and then passes the number of jobs
-claimed to a subprocess with `-j<jobs>`.
-
-The number of available jobs is determined by reading tokens from the jobserver
-until a read would block.  If the makeparallel rule is the only one running the
-number of jobs will be the total size of the jobserver pool, i.e. the value
-passed to make with `-j`.  Any jobs running in parallel with with the
-makeparellel rule will reduce the measured value, and thus reduce the
-parallelism available to the subprocess.
-
-To run a multi-thread or multi-process binary inside GNU make using
-makeparallel, add
-```Makefile
-	+makeparallel subprocess arguments
-```
-to a rule.  For example, to wrap ninja in make, use something like:
-```Makefile
-	+makeparallel ninja -f build.ninja
-```
-
-To determine the size of the jobserver pool, add
-```Makefile
-	+makeparallel echo > make.jobs
-```
-to a rule that is guarantee to run alone (i.e. all other rules are either
-dependencies of the makeparallel rule, or the depend on the makeparallel
-rule.  The output file will contain the `-j<num>` flag passed to the parent
-make process, or `-j1` if no flag was found.  Since GNU make will run
-makeparallel during the execution phase, after all variables have been
-set and evaluated, it is not possible to get the output of makeparallel
-into a make variable.  Instead, use a shell substitution to read the output
-file directly in a recipe.  For example:
-```Makefile
-	echo Make was started with $$(cat make.jobs)
-```
diff --git a/tools/makeparallel/makeparallel.cpp b/tools/makeparallel/makeparallel.cpp
deleted file mode 100644
index 66babdf..0000000
--- a/tools/makeparallel/makeparallel.cpp
+++ /dev/null
@@ -1,421 +0,0 @@
-// Copyright (C) 2015 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// makeparallel communicates with the GNU make jobserver
-// (http://make.mad-scientist.net/papers/jobserver-implementation/)
-// in order claim all available jobs, and then passes the number of jobs
-// claimed to a subprocess with -j<jobs>.
-
-#include <errno.h>
-#include <fcntl.h>
-#include <getopt.h>
-#include <poll.h>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <sys/resource.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-#include <string>
-#include <vector>
-
-#ifdef __linux__
-#include <error.h>
-#endif
-
-#ifdef __APPLE__
-#include <err.h>
-#define error(code, eval, fmt, ...) errc(eval, code, fmt, ##__VA_ARGS__)
-// Darwin does not interrupt syscalls by default.
-#define TEMP_FAILURE_RETRY(exp) (exp)
-#endif
-
-// Throw an error if fd is not valid.
-static void CheckFd(int fd) {
-  int ret = fcntl(fd, F_GETFD);
-  if (ret < 0) {
-    if (errno == EBADF) {
-      error(errno, 0, "no jobserver pipe, prefix recipe command with '+'");
-    } else {
-      error(errno, errno, "fnctl failed");
-    }
-  }
-}
-
-// Extract flags from MAKEFLAGS that need to be propagated to subproccess
-static std::vector<std::string> ReadMakeflags() {
-  std::vector<std::string> args;
-
-  const char* makeflags_env = getenv("MAKEFLAGS");
-  if (makeflags_env == nullptr) {
-    return args;
-  }
-
-  // The MAKEFLAGS format is pretty useless.  The first argument might be empty
-  // (starts with a leading space), or it might be a set of one-character flags
-  // merged together with no leading space, or it might be a variable
-  // definition.
-
-  std::string makeflags = makeflags_env;
-
-  // Split makeflags into individual args on spaces.  Multiple spaces are
-  // elided, but an initial space will result in a blank arg.
-  size_t base = 0;
-  size_t found;
-  do {
-    found = makeflags.find_first_of(" ", base);
-    args.push_back(makeflags.substr(base, found - base));
-    base = found + 1;
-  } while (found != makeflags.npos);
-
-  // Drop the first argument if it is empty
-  while (args.size() > 0 && args[0].size() == 0) {
-	  args.erase(args.begin());
-  }
-
-  // Prepend a - to the first argument if it does not have one and is not a
-  // variable definition
-  if (args.size() > 0 && args[0][0] != '-') {
-    if (args[0].find('=') == makeflags.npos) {
-      args[0] = '-' + args[0];
-    }
-  }
-
-  return args;
-}
-
-static bool ParseMakeflags(std::vector<std::string>& args,
-    int* in_fd, int* out_fd, bool* parallel, bool* keep_going) {
-
-  std::vector<char*> getopt_argv;
-  // getopt starts reading at argv[1]
-  getopt_argv.reserve(args.size() + 1);
-  getopt_argv.push_back(strdup(""));
-  for (std::string& v : args) {
-    getopt_argv.push_back(strdup(v.c_str()));
-  }
-
-  opterr = 0;
-  optind = 1;
-  while (1) {
-    const static option longopts[] = {
-        {"jobserver-fds", required_argument, 0, 0},
-        {0, 0, 0, 0},
-    };
-    int longopt_index = 0;
-
-    int c = getopt_long(getopt_argv.size(), getopt_argv.data(), "kj",
-        longopts, &longopt_index);
-
-    if (c == -1) {
-      break;
-    }
-
-    switch (c) {
-    case 0:
-      switch (longopt_index) {
-      case 0:
-      {
-        // jobserver-fds
-        if (sscanf(optarg, "%d,%d", in_fd, out_fd) != 2) {
-          error(EXIT_FAILURE, 0, "incorrect format for --jobserver-fds: %s", optarg);
-        }
-        // TODO: propagate in_fd, out_fd
-        break;
-      }
-      default:
-        abort();
-      }
-      break;
-    case 'j':
-      *parallel = true;
-      break;
-    case 'k':
-      *keep_going = true;
-      break;
-    case '?':
-      // ignore unknown arguments
-      break;
-    default:
-      abort();
-    }
-  }
-
-  for (char *v : getopt_argv) {
-    free(v);
-  }
-
-  return true;
-}
-
-// Read a single byte from fd, with timeout in milliseconds.  Returns true if
-// a byte was read, false on timeout.  Throws away the read value.
-// Non-reentrant, uses timer and signal handler global state, plus static
-// variable to communicate with signal handler.
-//
-// Uses a SIGALRM timer to fire a signal after timeout_ms that will interrupt
-// the read syscall if it hasn't yet completed.  If the timer fires before the
-// read the read could block forever, so read from a dup'd fd and close it from
-// the signal handler, which will cause the read to return EBADF if it occurs
-// after the signal.
-// The dup/read/close combo is very similar to the system described to avoid
-// a deadlock between SIGCHLD and read at
-// http://make.mad-scientist.net/papers/jobserver-implementation/
-static bool ReadByteTimeout(int fd, int timeout_ms) {
-  // global variable to communicate with the signal handler
-  static int dup_fd = -1;
-
-  // dup the fd so the signal handler can close it without losing the real one
-  dup_fd = dup(fd);
-  if (dup_fd < 0) {
-    error(errno, errno, "dup failed");
-  }
-
-  // set up a signal handler that closes dup_fd on SIGALRM
-  struct sigaction action = {};
-  action.sa_flags = SA_SIGINFO,
-  action.sa_sigaction = [](int, siginfo_t*, void*) {
-    close(dup_fd);
-  };
-  struct sigaction oldaction = {};
-  int ret = sigaction(SIGALRM, &action, &oldaction);
-  if (ret < 0) {
-    error(errno, errno, "sigaction failed");
-  }
-
-  // queue a SIGALRM after timeout_ms
-  const struct itimerval timeout = {{}, {0, timeout_ms * 1000}};
-  ret = setitimer(ITIMER_REAL, &timeout, NULL);
-  if (ret < 0) {
-    error(errno, errno, "setitimer failed");
-  }
-
-  // start the blocking read
-  char buf;
-  int read_ret = read(dup_fd, &buf, 1);
-  int read_errno = errno;
-
-  // cancel the alarm in case it hasn't fired yet
-  const struct itimerval cancel = {};
-  ret = setitimer(ITIMER_REAL, &cancel, NULL);
-  if (ret < 0) {
-    error(errno, errno, "reset setitimer failed");
-  }
-
-  // remove the signal handler
-  ret = sigaction(SIGALRM, &oldaction, NULL);
-  if (ret < 0) {
-    error(errno, errno, "reset sigaction failed");
-  }
-
-  // clean up the dup'd fd in case the signal never fired
-  close(dup_fd);
-  dup_fd = -1;
-
-  if (read_ret == 0) {
-    error(EXIT_FAILURE, 0, "EOF on jobserver pipe");
-  } else if (read_ret > 0) {
-    return true;
-  } else if (read_errno == EINTR || read_errno == EBADF) {
-    return false;
-  } else {
-    error(read_errno, read_errno, "read failed");
-  }
-  abort();
-}
-
-// Measure the size of the jobserver pool by reading from in_fd until it blocks
-static int GetJobserverTokens(int in_fd) {
-  int tokens = 0;
-  pollfd pollfds[] = {{in_fd, POLLIN, 0}};
-  int ret;
-  while ((ret = TEMP_FAILURE_RETRY(poll(pollfds, 1, 0))) != 0) {
-    if (ret < 0) {
-      error(errno, errno, "poll failed");
-    } else if (pollfds[0].revents != POLLIN) {
-      error(EXIT_FAILURE, 0, "unexpected event %d\n", pollfds[0].revents);
-    }
-
-    // There is probably a job token in the jobserver pipe.  There is a chance
-    // another process reads it first, which would cause a blocking read to
-    // block forever (or until another process put a token back in the pipe).
-    // The file descriptor can't be set to O_NONBLOCK as that would affect
-    // all users of the pipe, including the parent make process.
-    // ReadByteTimeout emulates a non-blocking read on a !O_NONBLOCK socket
-    // using a SIGALRM that fires after a short timeout.
-    bool got_token = ReadByteTimeout(in_fd, 10);
-    if (!got_token) {
-      // No more tokens
-      break;
-    } else {
-      tokens++;
-    }
-  }
-
-  // This process implicitly gets a token, so pool size is measured size + 1
-  return tokens;
-}
-
-// Return tokens to the jobserver pool.
-static void PutJobserverTokens(int out_fd, int tokens) {
-  // Return all the tokens to the pipe
-  char buf = '+';
-  for (int i = 0; i < tokens; i++) {
-    int ret = TEMP_FAILURE_RETRY(write(out_fd, &buf, 1));
-    if (ret < 0) {
-      error(errno, errno, "write failed");
-    } else if (ret == 0) {
-      error(EXIT_FAILURE, 0, "EOF on jobserver pipe");
-    }
-  }
-}
-
-int main(int argc, char* argv[]) {
-  int in_fd = -1;
-  int out_fd = -1;
-  bool parallel = false;
-  bool keep_going = false;
-  bool ninja = false;
-  int tokens = 0;
-
-  if (argc > 1 && strcmp(argv[1], "--ninja") == 0) {
-    ninja = true;
-    argv++;
-    argc--;
-  }
-
-  if (argc < 2) {
-    error(EXIT_FAILURE, 0, "expected command to run");
-  }
-
-  const char* path = argv[1];
-  std::vector<char*> args({argv[1]});
-
-  std::vector<std::string> makeflags = ReadMakeflags();
-  if (ParseMakeflags(makeflags, &in_fd, &out_fd, &parallel, &keep_going)) {
-    if (in_fd >= 0 && out_fd >= 0) {
-      CheckFd(in_fd);
-      CheckFd(out_fd);
-      fcntl(in_fd, F_SETFD, FD_CLOEXEC);
-      fcntl(out_fd, F_SETFD, FD_CLOEXEC);
-      tokens = GetJobserverTokens(in_fd);
-    }
-  }
-
-  std::string jarg;
-  if (parallel) {
-    if (tokens == 0) {
-      if (ninja) {
-        // ninja is parallel by default
-        jarg = "";
-      } else {
-        // make -j with no argument, guess a reasonable parallelism like ninja does
-        jarg = "-j" + std::to_string(sysconf(_SC_NPROCESSORS_ONLN) + 2);
-      }
-    } else {
-      jarg = "-j" + std::to_string(tokens + 1);
-    }
-  }
-
-
-  if (ninja) {
-    if (!parallel) {
-      // ninja is parallel by default, pass -j1 to disable parallelism if make wasn't parallel
-      args.push_back(strdup("-j1"));
-    } else {
-      if (jarg != "") {
-        args.push_back(strdup(jarg.c_str()));
-      }
-    }
-    if (keep_going) {
-      args.push_back(strdup("-k0"));
-    }
-  } else {
-    if (jarg != "") {
-      args.push_back(strdup(jarg.c_str()));
-    }
-  }
-
-  args.insert(args.end(), &argv[2], &argv[argc]);
-
-  args.push_back(nullptr);
-
-  static pid_t pid;
-
-  // Set up signal handlers to forward SIGTERM to child.
-  // Assume that all other signals are sent to the entire process group,
-  // and that we'll wait for our child to exit instead of handling them.
-  struct sigaction action = {};
-  action.sa_flags = SA_RESTART;
-  action.sa_handler = [](int signal) {
-    if (signal == SIGTERM && pid > 0) {
-      kill(pid, signal);
-    }
-  };
-
-  int ret = 0;
-  if (!ret) ret = sigaction(SIGHUP, &action, NULL);
-  if (!ret) ret = sigaction(SIGINT, &action, NULL);
-  if (!ret) ret = sigaction(SIGQUIT, &action, NULL);
-  if (!ret) ret = sigaction(SIGTERM, &action, NULL);
-  if (!ret) ret = sigaction(SIGALRM, &action, NULL);
-  if (ret < 0) {
-    error(errno, errno, "sigaction failed");
-  }
-
-  pid = fork();
-  if (pid < 0) {
-    error(errno, errno, "fork failed");
-  } else if (pid == 0) {
-    // child
-    unsetenv("MAKEFLAGS");
-    unsetenv("MAKELEVEL");
-
-    // make 3.81 sets the stack ulimit to unlimited, which may cause problems
-    // for child processes
-    struct rlimit rlim{};
-    if (getrlimit(RLIMIT_STACK, &rlim) == 0 && rlim.rlim_cur == RLIM_INFINITY) {
-      rlim.rlim_cur = 8*1024*1024;
-      setrlimit(RLIMIT_STACK, &rlim);
-    }
-
-    int ret = execvp(path, args.data());
-    if (ret < 0) {
-      error(errno, errno, "exec %s failed", path);
-    }
-    abort();
-  }
-
-  // parent
-
-  siginfo_t status = {};
-  int exit_status = 0;
-  ret = waitid(P_PID, pid, &status, WEXITED);
-  if (ret < 0) {
-    error(errno, errno, "waitpid failed");
-  } else if (status.si_code == CLD_EXITED) {
-    exit_status = status.si_status;
-  } else {
-    exit_status = -(status.si_status);
-  }
-
-  if (tokens > 0) {
-    PutJobserverTokens(out_fd, tokens);
-  }
-  exit(exit_status);
-}
diff --git a/tools/mktarball.sh b/tools/mktarball.sh
deleted file mode 100755
index ef0fe86..0000000
--- a/tools/mktarball.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/bin/bash
-
-# $1: path to fs_get_stats program
-# $2: start dir
-# $3: subdir to tar up (from $2)
-# $4: target tar name
-# $5: target tarball name (usually $(3).bz2)
-# $6: TARGET_OUT path to query device specific FS configs
-
-if [ $# -ne 6 ]; then
-    echo "Error: wrong number of arguments in cmd: $0 $* "
-    exit 1
-fi
-
-fs_get_stats=`readlink -f $1`
-start_dir=`readlink -f $2`
-dir_to_tar=$3
-target_tar=`readlink -f $4`
-target_tarball=`readlink -f $5`
-target_out=`readlink -f $6`
-
-cd $2
-
-#tar --no-recursion -cvf ${target_tar} ${dir_to_tar}
-rm ${target_tar} > /dev/null 2>&1
-
-# do dirs first
-subdirs=`find ${dir_to_tar} -type d -print`
-files=`find ${dir_to_tar} \! -type d -print`
-for f in ${subdirs} ${files} ; do
-    curr_perms=`stat -c 0%a $f`
-    [ -d "$f" ] && is_dir=1 || is_dir=0
-    new_info=`${fs_get_stats} ${curr_perms} ${is_dir} ${f} ${target_out}`
-    new_uid=`echo ${new_info} | awk '{print $1;}'`
-    new_gid=`echo ${new_info} | awk '{print $2;}'`
-    new_perms=`echo ${new_info} | awk '{print $3;}'`
-#    echo "$f: dir: $is_dir curr: $curr_perms uid: $new_uid gid: $new_gid "\
-#         "perms: $new_perms"
-    tar --no-recursion --numeric-owner --owner $new_uid \
-        --group $new_gid --mode $new_perms -p -rf ${target_tar} ${f}
-done
-
-if [ $? -eq 0 ] ; then
-    case "${target_tarball}" in
-    *.bz2 )
-        bzip2 -c ${target_tar} > ${target_tarball}
-        ;;
-    *.gz )
-        gzip -c ${target_tar} > ${target_tarball}
-        ;;
-    esac
-    success=$?
-    [ $success -eq 0 ] || rm -f ${target_tarball}
-    rm -f ${target_tar}
-    exit $success
-fi
-
-rm -f ${target_tar}
-exit 1
diff --git a/tools/releasetools/Android.bp b/tools/releasetools/Android.bp
new file mode 100644
index 0000000..5785688
--- /dev/null
+++ b/tools/releasetools/Android.bp
@@ -0,0 +1,502 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//
+// Module-specific defaults.
+//
+// For module X, if we need to build it both as a library and an executable:
+//  - A default rule `releasetools_X_defaults` is created, which lists `srcs`, `libs` and
+//    `required` properties.
+//  - `python_library_host` and `python_binary_host` are created by listing
+//    `releasetools_X_defaults` in their defaults.
+//
+
+python_defaults {
+    name: "releasetools_add_img_to_target_files_defaults",
+    srcs: [
+        "add_img_to_target_files.py",
+    ],
+    libs: [
+        "releasetools_build_image",
+        "releasetools_build_super_image",
+        "releasetools_common",
+    ],
+    required: [
+        "care_map_generator",
+    ],
+}
+
+python_defaults {
+    name: "releasetools_build_image_defaults",
+    srcs: [
+        "build_image.py",
+    ],
+    libs: [
+        "releasetools_common",
+        "releasetools_verity_utils",
+    ],
+    required: [
+        "blk_alloc_to_base_fs",
+        "e2fsck",
+        "simg2img",
+        "tune2fs",
+    ],
+}
+
+python_defaults {
+    name: "releasetools_build_super_image_defaults",
+    srcs: [
+        "build_super_image.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+}
+
+python_defaults {
+    name: "releasetools_img_from_target_files_defaults",
+    srcs: [
+        "img_from_target_files.py",
+    ],
+    libs: [
+        "releasetools_build_super_image",
+        "releasetools_common",
+    ],
+    required: [
+        "zip2zip",
+    ],
+}
+
+python_defaults {
+    name: "releasetools_check_target_files_vintf_defaults",
+    srcs: [
+        "check_target_files_vintf.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+    required: [
+        "checkvintf",
+    ],
+}
+
+python_defaults {
+    name: "releasetools_ota_from_target_files_defaults",
+    srcs: [
+        "edify_generator.py",
+        "ota_from_target_files.py",
+        "target_files_diff.py",
+    ],
+    libs: [
+        "releasetools_check_target_files_vintf",
+        "releasetools_common",
+        "releasetools_verity_utils",
+    ],
+    required: [
+        "brillo_update_payload",
+        "checkvintf",
+    ],
+}
+
+//
+// Host libraries.
+//
+
+python_defaults {
+    name: "releasetools_library_defaults",
+    version: {
+        py2: {
+            enabled: true,
+        },
+        py3: {
+            enabled: true,
+        },
+    },
+}
+
+python_library_host {
+    name: "releasetools_add_img_to_target_files",
+    defaults: [
+        "releasetools_library_defaults",
+        "releasetools_add_img_to_target_files_defaults",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_apex_utils",
+    defaults: ["releasetools_library_defaults"],
+    srcs: [
+        "apex_utils.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_build_image",
+    defaults: [
+        "releasetools_library_defaults",
+        "releasetools_build_image_defaults",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_build_super_image",
+    defaults: [
+        "releasetools_library_defaults",
+        "releasetools_build_super_image_defaults",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_check_target_files_vintf",
+    defaults: [
+        "releasetools_library_defaults",
+        "releasetools_check_target_files_vintf_defaults",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_common",
+    defaults: ["releasetools_library_defaults"],
+    srcs: [
+        "blockimgdiff.py",
+        "common.py",
+        "images.py",
+        "rangelib.py",
+        "sparse_img.py",
+    ],
+    // Only the tools that are referenced directly are listed as required modules. For example,
+    // `avbtool` is not here, as the script always uses the one from info_dict['avb_avbtool'].
+    required: [
+        "aapt2",
+        "boot_signer",
+        "brotli",
+        "bsdiff",
+        "imgdiff",
+        "minigzip",
+        "lz4",
+        "mkbootfs",
+        "signapk",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_img_from_target_files",
+    defaults: [
+        "releasetools_library_defaults",
+        "releasetools_img_from_target_files_defaults",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_ota_from_target_files",
+    defaults: [
+        "releasetools_library_defaults",
+        "releasetools_ota_from_target_files_defaults",
+    ],
+}
+
+python_library_host {
+    name: "releasetools_verity_utils",
+    defaults: ["releasetools_library_defaults"],
+    srcs: [
+        "verity_utils.py",
+    ],
+    required: [
+        "append2simg",
+        "build_verity_metadata",
+        "build_verity_tree",
+        "fec",
+    ],
+}
+
+//
+// Host binaries.
+//
+
+python_defaults {
+    name: "releasetools_binary_defaults",
+    version: {
+        py2: {
+            enabled: true,
+            embedded_launcher: true,
+        },
+        py3: {
+            enabled: false,
+            embedded_launcher: false,
+        },
+    },
+}
+
+python_binary_host {
+    name: "add_img_to_target_files",
+    defaults: [
+        "releasetools_binary_defaults",
+        "releasetools_add_img_to_target_files_defaults",
+    ],
+}
+
+python_binary_host {
+    name: "build_image",
+    defaults: [
+        "releasetools_binary_defaults",
+        "releasetools_build_image_defaults",
+    ],
+}
+
+python_binary_host {
+    name: "build_super_image",
+    defaults: [
+        "releasetools_binary_defaults",
+        "releasetools_build_super_image_defaults",
+    ],
+}
+
+python_binary_host {
+    name: "check_partition_sizes",
+    srcs: [
+        "check_partition_sizes.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+    defaults: [
+        "releasetools_binary_defaults",
+    ],
+}
+
+python_binary_host {
+    name: "check_ota_package_signature",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "check_ota_package_signature.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+    required: [
+        "delta_generator",
+    ],
+}
+
+python_binary_host {
+    name: "check_target_files_signatures",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "check_target_files_signatures.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+    required: [
+        "aapt",
+    ],
+}
+
+python_binary_host {
+    name: "check_target_files_vintf",
+    defaults: [
+        "releasetools_binary_defaults",
+        "releasetools_check_target_files_vintf_defaults"
+    ],
+}
+
+python_binary_host {
+    name: "img_from_target_files",
+    defaults: [
+        "releasetools_binary_defaults",
+        "releasetools_img_from_target_files_defaults",
+    ],
+}
+
+python_binary_host {
+    name: "make_recovery_patch",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "make_recovery_patch.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+}
+
+python_binary_host {
+    name: "merge_builds",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "merge_builds.py",
+    ],
+    libs: [
+        "releasetools_build_super_image",
+        "releasetools_common",
+    ],
+}
+
+python_binary_host {
+    name: "merge_target_files",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "merge_target_files.py",
+    ],
+    libs: [
+        "releasetools_add_img_to_target_files",
+        "releasetools_build_super_image",
+        "releasetools_check_target_files_vintf",
+        "releasetools_common",
+        "releasetools_img_from_target_files",
+        "releasetools_ota_from_target_files",
+    ],
+    required: [
+        "checkvintf",
+    ],
+}
+
+python_binary_host {
+    name: "ota_from_target_files",
+    defaults: [
+        "releasetools_binary_defaults",
+        "releasetools_ota_from_target_files_defaults",
+    ],
+}
+
+python_binary_host {
+    name: "ota_package_parser",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "ota_package_parser.py",
+        "rangelib.py",
+    ],
+}
+
+python_binary_host {
+    name: "sparse_img",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "rangelib.py",
+        "sparse_img.py",
+    ],
+}
+
+python_binary_host {
+    name: "sign_apex",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "sign_apex.py",
+    ],
+    libs: [
+        "releasetools_apex_utils",
+        "releasetools_common",
+    ],
+}
+
+python_binary_host {
+    name: "sign_target_files_apks",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "sign_target_files_apks.py",
+    ],
+    libs: [
+        "releasetools_add_img_to_target_files",
+        "releasetools_apex_utils",
+        "releasetools_common",
+    ],
+}
+
+python_binary_host {
+    name: "validate_target_files",
+    defaults: ["releasetools_binary_defaults"],
+    srcs: [
+        "validate_target_files.py",
+    ],
+    libs: [
+        "releasetools_common",
+    ],
+}
+
+//
+// Tests.
+//
+
+python_defaults {
+    name: "releasetools_test_defaults",
+    srcs: [
+        "check_ota_package_signature.py",
+        "check_partition_sizes.py",
+        "check_target_files_signatures.py",
+        "make_recovery_patch.py",
+        "merge_target_files.py",
+        "ota_package_parser.py",
+        "sign_apex.py",
+        "sign_target_files_apks.py",
+        "validate_target_files.py",
+
+        "test_*.py",
+    ],
+    libs: [
+        "releasetools_add_img_to_target_files",
+        "releasetools_apex_utils",
+        "releasetools_build_image",
+        "releasetools_build_super_image",
+        "releasetools_check_target_files_vintf",
+        "releasetools_common",
+        "releasetools_img_from_target_files",
+        "releasetools_ota_from_target_files",
+        "releasetools_verity_utils",
+    ],
+    data: [
+        "testdata/**/*",
+    ],
+    required: [
+        "otatools",
+    ],
+}
+
+python_test_host {
+    name: "releasetools_test",
+    defaults: ["releasetools_test_defaults"],
+    main: "test_utils.py",
+    version: {
+        py2: {
+            enabled: true,
+            // When using embedded launcher, atest will try (but may fail) to load libc++.so from
+            // host, because the test executable won't be able to find the needed libs via its
+            // runpath.
+            embedded_launcher: false,
+        },
+        py3: {
+            enabled: false,
+            embedded_launcher: false,
+        },
+    },
+    test_suites: ["general-tests"],
+}
+
+python_test_host {
+    name: "releasetools_py3_test",
+    defaults: ["releasetools_test_defaults"],
+    main: "test_utils.py",
+    version: {
+        py2: {
+            enabled: false,
+            embedded_launcher: false,
+        },
+        py3: {
+            enabled: true,
+            embedded_launcher: false,
+        },
+    },
+    test_suites: ["general-tests"],
+}
diff --git a/tools/releasetools/OWNERS b/tools/releasetools/OWNERS
index 766adb4..a8295d4 100644
--- a/tools/releasetools/OWNERS
+++ b/tools/releasetools/OWNERS
@@ -1,2 +1,3 @@
-tbao@google.com
+nhdo@google.com
 xunchang@google.com
+zhaojiac@google.com
diff --git a/tools/releasetools/TEST_MAPPING b/tools/releasetools/TEST_MAPPING
new file mode 100644
index 0000000..0af0f04
--- /dev/null
+++ b/tools/releasetools/TEST_MAPPING
@@ -0,0 +1,12 @@
+{
+  "presubmit": [
+    {
+      "name": "releasetools_test",
+      "host": true
+    },
+    {
+      "name": "releasetools_py3_test",
+      "host": true
+    }
+  ]
+}
diff --git a/tools/releasetools/add_img_to_target_files.py b/tools/releasetools/add_img_to_target_files.py
old mode 100755
new mode 100644
index f2b9afa..f58b697
--- a/tools/releasetools/add_img_to_target_files.py
+++ b/tools/releasetools/add_img_to_target_files.py
@@ -60,6 +60,7 @@
 import common
 import rangelib
 import sparse_img
+import verity_utils
 
 if sys.hexversion < 0x02070000:
   print("Python 2.7 or newer is required.", file=sys.stderr)
@@ -114,22 +115,33 @@
 
   Returns:
     (which, care_map_ranges): care_map_ranges is the raw string of the care_map
-    RangeSet.
+    RangeSet; or None.
   """
   assert which in common.PARTITIONS_WITH_CARE_MAP
 
-  simg = sparse_img.SparseImage(imgname)
-  care_map_ranges = simg.care_map
-  size_key = which + "_image_size"
-  image_size = OPTIONS.info_dict.get(size_key)
-  if image_size:
-    # excludes the verity metadata blocks of the given image. When AVB is enabled,
-    # this size is the max image size returned by the AVB tool
-    image_blocks = int(image_size) / 4096 - 1
-    assert image_blocks > 0, "blocks for {} must be positive".format(which)
-    care_map_ranges = care_map_ranges.intersect(
+  # which + "_image_size" contains the size that the actual filesystem image
+  # resides in, which is all that needs to be verified. The additional blocks in
+  # the image file contain verity metadata, by reading which would trigger
+  # invalid reads.
+  image_size = OPTIONS.info_dict.get(which + "_image_size")
+  if not image_size:
+    return None
+
+  image_blocks = int(image_size) // 4096 - 1
+  assert image_blocks > 0, "blocks for {} must be positive".format(which)
+
+  # For sparse images, we will only check the blocks that are listed in the care
+  # map, i.e. the ones with meaningful data.
+  if "extfs_sparse_flag" in OPTIONS.info_dict:
+    simg = sparse_img.SparseImage(imgname)
+    care_map_ranges = simg.care_map.intersect(
         rangelib.RangeSet("0-{}".format(image_blocks)))
 
+  # Otherwise for non-sparse images, we read all the blocks in the filesystem
+  # image.
+  else:
+    care_map_ranges = rangelib.RangeSet("0-{}".format(image_blocks))
+
   return [which, care_map_ranges.to_string_raw()]
 
 
@@ -143,20 +155,23 @@
     return img.name
 
   def output_sink(fn, data):
-    ofile = open(os.path.join(OPTIONS.input_tmp, "SYSTEM", fn), "w")
-    ofile.write(data)
-    ofile.close()
+    output_file = os.path.join(OPTIONS.input_tmp, "SYSTEM", fn)
+    with open(output_file, "wb") as ofile:
+      ofile.write(data)
 
     if output_zip:
       arc_name = "SYSTEM/" + fn
       if arc_name in output_zip.namelist():
         OPTIONS.replace_updated_files_list.append(arc_name)
       else:
-        common.ZipWrite(output_zip, ofile.name, arc_name)
+        common.ZipWrite(output_zip, output_file, arc_name)
 
-  if (OPTIONS.rebuild_recovery and recovery_img is not None and
-      boot_img is not None):
-    logger.info("Building new recovery patch")
+  board_uses_vendorimage = OPTIONS.info_dict.get(
+      "board_uses_vendorimage") == "true"
+
+  if (OPTIONS.rebuild_recovery and not board_uses_vendorimage and
+      recovery_img is not None and boot_img is not None):
+    logger.info("Building new recovery patch on system at system/vendor")
     common.MakeRecoveryPatch(OPTIONS.input_tmp, output_sink, recovery_img,
                              boot_img, info_dict=OPTIONS.info_dict)
 
@@ -179,7 +194,7 @@
   CreateImage(OPTIONS.input_tmp, OPTIONS.info_dict, "system_other", img)
 
 
-def AddVendor(output_zip):
+def AddVendor(output_zip, recovery_img=None, boot_img=None):
   """Turn the contents of VENDOR into a vendor image and store in it
   output_zip."""
 
@@ -188,6 +203,27 @@
     logger.info("vendor.img already exists; no need to rebuild...")
     return img.name
 
+  def output_sink(fn, data):
+    ofile = open(os.path.join(OPTIONS.input_tmp, "VENDOR", fn), "w")
+    ofile.write(data)
+    ofile.close()
+
+    if output_zip:
+      arc_name = "VENDOR/" + fn
+      if arc_name in output_zip.namelist():
+        OPTIONS.replace_updated_files_list.append(arc_name)
+      else:
+        common.ZipWrite(output_zip, ofile.name, arc_name)
+
+  board_uses_vendorimage = OPTIONS.info_dict.get(
+      "board_uses_vendorimage") == "true"
+
+  if (OPTIONS.rebuild_recovery and board_uses_vendorimage and
+      recovery_img is not None and boot_img is not None):
+    logger.info("Building new recovery patch on vendor")
+    common.MakeRecoveryPatch(OPTIONS.input_tmp, output_sink, recovery_img,
+                             boot_img, info_dict=OPTIONS.info_dict)
+
   block_list = OutputFile(output_zip, OPTIONS.input_tmp, "IMAGES", "vendor.map")
   CreateImage(OPTIONS.input_tmp, OPTIONS.info_dict, "vendor", img,
               block_list=block_list)
@@ -211,20 +247,20 @@
   return img.name
 
 
-def AddProductServices(output_zip):
-  """Turn the contents of PRODUCT_SERVICES into a product_services image and
-  store it in output_zip."""
+def AddSystemExt(output_zip):
+  """Turn the contents of SYSTEM_EXT into a system_ext image and store it in
+  output_zip."""
 
   img = OutputFile(output_zip, OPTIONS.input_tmp, "IMAGES",
-                   "product_services.img")
+                   "system_ext.img")
   if os.path.exists(img.name):
-    logger.info("product_services.img already exists; no need to rebuild...")
+    logger.info("system_ext.img already exists; no need to rebuild...")
     return img.name
 
   block_list = OutputFile(
-      output_zip, OPTIONS.input_tmp, "IMAGES", "product_services.map")
+      output_zip, OPTIONS.input_tmp, "IMAGES", "system_ext.map")
   CreateImage(
-      OPTIONS.input_tmp, OPTIONS.info_dict, "product_services", img,
+      OPTIONS.input_tmp, OPTIONS.info_dict, "system_ext", img,
       block_list=block_list)
   return img.name
 
@@ -277,16 +313,61 @@
   img.Write()
   return img.name
 
+def AddCustomImages(output_zip, partition_name):
+  """Adds and signs custom images in IMAGES/.
+
+  Args:
+    output_zip: The output zip file (needs to be already open), or None to
+        write images to OPTIONS.input_tmp/.
+
+  Uses the image under IMAGES/ if it already exists. Otherwise looks for the
+  image under PREBUILT_IMAGES/, signs it as needed, and returns the image name.
+
+  Raises:
+    AssertionError: If image can't be found.
+  """
+
+  partition_size = OPTIONS.info_dict.get(
+      "avb_{}_partition_size".format(partition_name))
+  key_path = OPTIONS.info_dict.get("avb_{}_key_path".format(partition_name))
+  algorithm = OPTIONS.info_dict.get("avb_{}_algorithm".format(partition_name))
+  extra_args = OPTIONS.info_dict.get(
+      "avb_{}_add_hashtree_footer_args".format(partition_name))
+  partition_size = OPTIONS.info_dict.get(
+      "avb_{}_partition_size".format(partition_name))
+
+  builder = verity_utils.CreateCustomImageBuilder(
+      OPTIONS.info_dict, partition_name, partition_size,
+      key_path, algorithm, extra_args)
+
+  for img_name in OPTIONS.info_dict.get(
+      "avb_{}_image_list".format(partition_name)).split():
+    custom_image = OutputFile(output_zip, OPTIONS.input_tmp, "IMAGES", img_name)
+    if os.path.exists(custom_image.name):
+      continue
+
+    custom_image_prebuilt_path = os.path.join(
+        OPTIONS.input_tmp, "PREBUILT_IMAGES", img_name)
+    assert os.path.exists(custom_image_prebuilt_path), \
+      "Failed to find %s at %s" % (img_name, custom_image_prebuilt_path)
+
+    shutil.copy(custom_image_prebuilt_path, custom_image.name)
+
+    if builder is not None:
+      builder.Build(custom_image.name)
+
+    custom_image.Write()
+
+  default = os.path.join(OPTIONS.input_tmp, "IMAGES", partition_name + ".img")
+  assert os.path.exists(default), \
+      "There should be one %s.img" % (partition_name)
+  return default
+
 
 def CreateImage(input_dir, info_dict, what, output_file, block_list=None):
-  logger.info("creating " + what + ".img...")
+  logger.info("creating %s.img...", what)
 
   image_props = build_image.ImagePropFromGlobalDict(info_dict, what)
-  fstab = info_dict["fstab"]
-  mount_point = "/" + what
-  if fstab and mount_point in fstab:
-    image_props["fs_type"] = fstab[mount_point].fs_type
-
   image_props["timestamp"] = FIXED_FILE_TIMESTAMP
 
   if what == "system":
@@ -307,13 +388,8 @@
 
   # Use repeatable ext4 FS UUID and hash_seed UUID (based on partition name and
   # build fingerprint).
-  uuid_seed = what + "-"
-  if "build.prop" in info_dict:
-    build_prop = info_dict["build.prop"]
-    if "ro.build.fingerprint" in build_prop:
-      uuid_seed += build_prop["ro.build.fingerprint"]
-    elif "ro.build.thumbprint" in build_prop:
-      uuid_seed += build_prop["ro.build.thumbprint"]
+  build_info = common.BuildInfo(info_dict)
+  uuid_seed = what + "-" + build_info.GetPartitionFingerprint(what)
   image_props["uuid"] = str(uuid.uuid5(uuid.NAMESPACE_URL, uuid_seed))
   hash_seed = "hash_seed-" + uuid_seed
   image_props["hash_seed"] = str(uuid.uuid5(uuid.NAMESPACE_URL, hash_seed))
@@ -371,37 +447,12 @@
   else:
     user_dir = common.MakeTempDir()
 
-  fstab = OPTIONS.info_dict["fstab"]
-  if fstab:
-    image_props["fs_type"] = fstab["/data"].fs_type
   build_image.BuildImage(user_dir, image_props, img.name)
 
   common.CheckSize(img.name, "userdata.img", OPTIONS.info_dict)
   img.Write()
 
 
-def AppendVBMetaArgsForPartition(cmd, partition, image):
-  """Appends the VBMeta arguments for partition.
-
-  It sets up the VBMeta argument by including the partition descriptor from the
-  given 'image', or by configuring the partition as a chained partition.
-
-  Args:
-    cmd: A list of command args that will be used to generate the vbmeta image.
-        The argument for the partition will be appended to the list.
-    partition: The name of the partition (e.g. "system").
-    image: The path to the partition image.
-  """
-  # Check if chain partition is used.
-  key_path = OPTIONS.info_dict.get("avb_" + partition + "_key_path")
-  if key_path:
-    chained_partition_arg = common.GetAvbChainedPartitionArg(
-        partition, OPTIONS.info_dict)
-    cmd.extend(["--chain_partition", chained_partition_arg])
-  else:
-    cmd.extend(["--include_descriptors_from_image", image])
-
-
 def AddVBMeta(output_zip, partitions, name, needed_partitions):
   """Creates a VBMeta image and stores it in output_zip.
 
@@ -411,8 +462,9 @@
   Args:
     output_zip: The output zip file, which needs to be already open.
     partitions: A dict that's keyed by partition names with image paths as
-        values. Only valid partition names are accepted, as listed in
-        common.AVB_PARTITIONS.
+        values. Only valid partition names are accepted, as partitions listed
+        in common.AVB_PARTITIONS and custom partitions listed in
+        OPTIONS.info_dict.get("avb_custom_images_partition_list")
     name: Name of the VBMeta partition, e.g. 'vbmeta', 'vbmeta_system'.
     needed_partitions: Partitions whose descriptors should be included into the
         generated VBMeta image.
@@ -431,45 +483,7 @@
     logger.info("%s.img already exists; not rebuilding...", name)
     return img.name
 
-  avbtool = OPTIONS.info_dict["avb_avbtool"]
-  cmd = [avbtool, "make_vbmeta_image", "--output", img.name]
-  common.AppendAVBSigningArgs(cmd, name)
-
-  for partition, path in partitions.items():
-    if partition not in needed_partitions:
-      continue
-    assert (partition in common.AVB_PARTITIONS or
-            partition.startswith('vbmeta_')), \
-        'Unknown partition: {}'.format(partition)
-    assert os.path.exists(path), \
-        'Failed to find {} for {}'.format(path, partition)
-    AppendVBMetaArgsForPartition(cmd, partition, path)
-
-  args = OPTIONS.info_dict.get("avb_{}_args".format(name))
-  if args and args.strip():
-    split_args = shlex.split(args)
-    for index, arg in enumerate(split_args[:-1]):
-      # Sanity check that the image file exists. Some images might be defined
-      # as a path relative to source tree, which may not be available at the
-      # same location when running this script (we have the input target_files
-      # zip only). For such cases, we additionally scan other locations (e.g.
-      # IMAGES/, RADIO/, etc) before bailing out.
-      if arg == '--include_descriptors_from_image':
-        image_path = split_args[index + 1]
-        if os.path.exists(image_path):
-          continue
-        found = False
-        for dir_name in ['IMAGES', 'RADIO', 'PREBUILT_IMAGES']:
-          alt_path = os.path.join(
-              OPTIONS.input_tmp, dir_name, os.path.basename(image_path))
-          if os.path.exists(alt_path):
-            split_args[index + 1] = alt_path
-            found = True
-            break
-        assert found, 'Failed to find {}'.format(image_path)
-    cmd.extend(split_args)
-
-  common.RunAndCheckOutput(cmd)
+  common.BuildVBMeta(img.name, partitions, name, needed_partitions)
   img.Write()
   return img.name
 
@@ -520,10 +534,6 @@
   image_props["timestamp"] = FIXED_FILE_TIMESTAMP
 
   user_dir = common.MakeTempDir()
-
-  fstab = OPTIONS.info_dict["fstab"]
-  if fstab:
-    image_props["fs_type"] = fstab["/cache"].fs_type
   build_image.BuildImage(user_dir, image_props, img.name)
 
   common.CheckSize(img.name, "cache.img", OPTIONS.info_dict)
@@ -583,20 +593,26 @@
         OPTIONS.info_dict.get(avb_hashtree_enable) == "true"):
       image_path = image_paths[partition]
       assert os.path.exists(image_path)
-      care_map_list += GetCareMap(partition, image_path)
+
+      care_map = GetCareMap(partition, image_path)
+      if not care_map:
+        continue
+      care_map_list += care_map
 
       # adds fingerprint field to the care_map
-      build_props = OPTIONS.info_dict.get(partition + ".build.prop", {})
+      # TODO(xunchang) revisit the fingerprint calculation for care_map.
+      partition_props = OPTIONS.info_dict.get(partition + ".build.prop")
       prop_name_list = ["ro.{}.build.fingerprint".format(partition),
                         "ro.{}.build.thumbprint".format(partition)]
 
-      present_props = [x for x in prop_name_list if x in build_props]
+      present_props = [x for x in prop_name_list if
+                       partition_props and partition_props.GetProp(x)]
       if not present_props:
         logger.warning("fingerprint is not present for partition %s", partition)
         property_id, fingerprint = "unknown", "unknown"
       else:
         property_id = present_props[0]
-        fingerprint = build_props[property_id]
+        fingerprint = partition_props.GetProp(property_id)
       care_map_list += [property_id, fingerprint]
 
   if not care_map_list:
@@ -717,11 +733,13 @@
   OPTIONS.info_dict = common.LoadInfoDict(OPTIONS.input_tmp, repacking=True)
 
   has_recovery = OPTIONS.info_dict.get("no_recovery") != "true"
+  has_boot = OPTIONS.info_dict.get("no_boot") != "true"
+  has_vendor_boot = OPTIONS.info_dict.get("vendor_boot") == "true"
 
-  # {vendor,odm,product,product_services}.img are unlike system.img or
+  # {vendor,odm,product,system_ext}.img are unlike system.img or
   # system_other.img. Because it could be built from source, or dropped into
   # target_files.zip as a prebuilt blob. We consider either of them as
-  # {vendor,product,product_services}.img being available, which could be
+  # {vendor,product,system_ext}.img being available, which could be
   # used when generating vbmeta.img for AVB.
   has_vendor = (os.path.isdir(os.path.join(OPTIONS.input_tmp, "VENDOR")) or
                 os.path.exists(os.path.join(OPTIONS.input_tmp, "IMAGES",
@@ -732,11 +750,11 @@
   has_product = (os.path.isdir(os.path.join(OPTIONS.input_tmp, "PRODUCT")) or
                  os.path.exists(os.path.join(OPTIONS.input_tmp, "IMAGES",
                                              "product.img")))
-  has_product_services = (os.path.isdir(os.path.join(OPTIONS.input_tmp,
-                                                     "PRODUCT_SERVICES")) or
-                          os.path.exists(os.path.join(OPTIONS.input_tmp,
-                                                      "IMAGES",
-                                                      "product_services.img")))
+  has_system_ext = (os.path.isdir(os.path.join(OPTIONS.input_tmp,
+                                               "SYSTEM_EXT")) or
+                    os.path.exists(os.path.join(OPTIONS.input_tmp,
+                                                "IMAGES",
+                                                "system_ext.img")))
   has_system = os.path.isdir(os.path.join(OPTIONS.input_tmp, "SYSTEM"))
   has_system_other = os.path.isdir(os.path.join(OPTIONS.input_tmp,
                                                 "SYSTEM_OTHER"))
@@ -759,22 +777,45 @@
 
   # A map between partition names and their paths, which could be used when
   # generating AVB vbmeta image.
-  partitions = dict()
+  partitions = {}
 
   def banner(s):
-    logger.info("\n\n++++ " + s + " ++++\n\n")
+    logger.info("\n\n++++ %s  ++++\n\n", s)
 
-  banner("boot")
-  # common.GetBootableImage() returns the image directly if present.
-  boot_image = common.GetBootableImage(
-      "IMAGES/boot.img", "boot.img", OPTIONS.input_tmp, "BOOT")
-  # boot.img may be unavailable in some targets (e.g. aosp_arm64).
-  if boot_image:
-    partitions['boot'] = os.path.join(OPTIONS.input_tmp, "IMAGES", "boot.img")
-    if not os.path.exists(partitions['boot']):
-      boot_image.WriteToDir(OPTIONS.input_tmp)
-      if output_zip:
-        boot_image.AddToZip(output_zip)
+  boot_image = None
+  if has_boot:
+    banner("boot")
+    boot_images = OPTIONS.info_dict.get("boot_images")
+    if boot_images is None:
+      boot_images = "boot.img"
+    for index,b in enumerate(boot_images.split()):
+      # common.GetBootableImage() returns the image directly if present.
+      boot_image = common.GetBootableImage(
+          "IMAGES/" + b, b, OPTIONS.input_tmp, "BOOT")
+      # boot.img may be unavailable in some targets (e.g. aosp_arm64).
+      if boot_image:
+        boot_image_path = os.path.join(OPTIONS.input_tmp, "IMAGES", b)
+        # Although multiple boot images can be generated, include the image
+        # descriptor of only the first boot image in vbmeta
+        if index == 0:
+          partitions['boot'] = boot_image_path
+        if not os.path.exists(boot_image_path):
+          boot_image.WriteToDir(OPTIONS.input_tmp)
+          if output_zip:
+            boot_image.AddToZip(output_zip)
+
+  if has_vendor_boot:
+    banner("vendor_boot")
+    vendor_boot_image = common.GetVendorBootImage(
+        "IMAGES/vendor_boot.img", "vendor_boot.img", OPTIONS.input_tmp,
+        "VENDOR_BOOT")
+    if vendor_boot_image:
+      partitions['vendor_boot'] = os.path.join(OPTIONS.input_tmp, "IMAGES",
+                                               "vendor_boot.img")
+      if not os.path.exists(partitions['vendor_boot']):
+        vendor_boot_image.WriteToDir(OPTIONS.input_tmp)
+        if output_zip:
+          vendor_boot_image.AddToZip(output_zip)
 
   recovery_image = None
   if has_recovery:
@@ -792,11 +833,11 @@
       banner("recovery (two-step image)")
       # The special recovery.img for two-step package use.
       recovery_two_step_image = common.GetBootableImage(
-          "IMAGES/recovery-two-step.img", "recovery-two-step.img",
+          "OTA/recovery-two-step.img", "recovery-two-step.img",
           OPTIONS.input_tmp, "RECOVERY", two_step_image=True)
       assert recovery_two_step_image, "Failed to create recovery-two-step.img."
       recovery_two_step_image_path = os.path.join(
-          OPTIONS.input_tmp, "IMAGES", "recovery-two-step.img")
+          OPTIONS.input_tmp, "OTA", "recovery-two-step.img")
       if not os.path.exists(recovery_two_step_image_path):
         recovery_two_step_image.WriteToDir(OPTIONS.input_tmp)
         if output_zip:
@@ -809,15 +850,16 @@
 
   if has_vendor:
     banner("vendor")
-    partitions['vendor'] = AddVendor(output_zip)
+    partitions['vendor'] = AddVendor(
+        output_zip, recovery_img=recovery_image, boot_img=boot_image)
 
   if has_product:
     banner("product")
     partitions['product'] = AddProduct(output_zip)
 
-  if has_product_services:
-    banner("product_services")
-    partitions['product_services'] = AddProductServices(output_zip)
+  if has_system_ext:
+    banner("system_ext")
+    partitions['system_ext'] = AddSystemExt(output_zip)
 
   if has_odm:
     banner("odm")
@@ -841,11 +883,20 @@
     banner("dtbo")
     partitions['dtbo'] = AddDtbo(output_zip)
 
+  # Custom images.
+  custom_partitions = OPTIONS.info_dict.get(
+      "avb_custom_images_partition_list", "").strip().split()
+  for partition_name in custom_partitions:
+    partition_name = partition_name.strip()
+    banner("custom images for " + partition_name)
+    partitions[partition_name] = AddCustomImages(output_zip, partition_name)
+
   if OPTIONS.info_dict.get("avb_enable") == "true":
     # vbmeta_partitions includes the partitions that should be included into
     # top-level vbmeta.img, which are the ones that are not included in any
     # chained VBMeta image plus the chained VBMeta images themselves.
-    vbmeta_partitions = common.AVB_PARTITIONS[:]
+    # Currently custom_partitions are all chained to VBMeta image.
+    vbmeta_partitions = common.AVB_PARTITIONS[:] + tuple(custom_partitions)
 
     vbmeta_system = OPTIONS.info_dict.get("avb_vbmeta_system", "").strip()
     if vbmeta_system:
@@ -884,7 +935,7 @@
   ab_partitions_txt = os.path.join(OPTIONS.input_tmp, "META",
                                    "ab_partitions.txt")
   if os.path.exists(ab_partitions_txt):
-    with open(ab_partitions_txt, 'r') as f:
+    with open(ab_partitions_txt) as f:
       ab_partitions = f.readlines()
 
     # For devices using A/B update, make sure we have all the needed images
@@ -899,7 +950,7 @@
   pack_radioimages_txt = os.path.join(
       OPTIONS.input_tmp, "META", "pack_radioimages.txt")
   if os.path.exists(pack_radioimages_txt):
-    with open(pack_radioimages_txt, 'r') as f:
+    with open(pack_radioimages_txt) as f:
       AddPackRadioImages(output_zip, f.readlines())
 
   if output_zip:
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index 66715ca..1c61938 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -18,7 +18,7 @@
 import os.path
 import re
 import shlex
-import sys
+import shutil
 import zipfile
 
 import common
@@ -27,6 +27,8 @@
 
 OPTIONS = common.OPTIONS
 
+APEX_PAYLOAD_IMAGE = 'apex_payload.img'
+
 
 class ApexInfoError(Exception):
   """An Exception raised during Apex Information command."""
@@ -42,48 +44,178 @@
     Exception.__init__(self, message)
 
 
-def SignApexPayload(payload_file, payload_key_path, payload_key_name, algorithm,
-                    salt, signing_args=None):
+class ApexApkSigner(object):
+  """Class to sign the apk files in a apex payload image and repack the apex"""
+
+  def __init__(self, apex_path, key_passwords, codename_to_api_level_map):
+    self.apex_path = apex_path
+    self.key_passwords = key_passwords
+    self.codename_to_api_level_map = codename_to_api_level_map
+
+  def ProcessApexFile(self, apk_keys, payload_key, signing_args=None):
+    """Scans and signs the apk files and repack the apex
+
+    Args:
+      apk_keys: A dict that holds the signing keys for apk files.
+
+    Returns:
+      The repacked apex file containing the signed apk files.
+    """
+    list_cmd = ['deapexer', 'list', self.apex_path]
+    entries_names = common.RunAndCheckOutput(list_cmd).split()
+    apk_entries = [name for name in entries_names if name.endswith('.apk')]
+
+    # No need to sign and repack, return the original apex path.
+    if not apk_entries:
+      logger.info('No apk file to sign in %s', self.apex_path)
+      return self.apex_path
+
+    for entry in apk_entries:
+      apk_name = os.path.basename(entry)
+      if apk_name not in apk_keys:
+        raise ApexSigningError('Failed to find signing keys for apk file {} in'
+                               ' apex {}.  Use "-e <apkname>=" to specify a key'
+                               .format(entry, self.apex_path))
+      if not any(dirname in entry for dirname in ['app/', 'priv-app/',
+                                                  'overlay/']):
+        logger.warning('Apk path does not contain the intended directory name:'
+                       ' %s', entry)
+
+    payload_dir, has_signed_apk = self.ExtractApexPayloadAndSignApks(
+        apk_entries, apk_keys)
+    if not has_signed_apk:
+      logger.info('No apk file has been signed in %s', self.apex_path)
+      return self.apex_path
+
+    return self.RepackApexPayload(payload_dir, payload_key, signing_args)
+
+  def ExtractApexPayloadAndSignApks(self, apk_entries, apk_keys):
+    """Extracts the payload image and signs the containing apk files."""
+    payload_dir = common.MakeTempDir()
+    extract_cmd = ['deapexer', 'extract', self.apex_path, payload_dir]
+    common.RunAndCheckOutput(extract_cmd)
+
+    has_signed_apk = False
+    for entry in apk_entries:
+      apk_path = os.path.join(payload_dir, entry)
+      assert os.path.exists(self.apex_path)
+
+      key_name = apk_keys.get(os.path.basename(entry))
+      if key_name in common.SPECIAL_CERT_STRINGS:
+        logger.info('Not signing: %s due to special cert string', apk_path)
+        continue
+
+      logger.info('Signing apk file %s in apex %s', apk_path, self.apex_path)
+      # Rename the unsigned apk and overwrite the original apk path with the
+      # signed apk file.
+      unsigned_apk = common.MakeTempFile()
+      os.rename(apk_path, unsigned_apk)
+      common.SignFile(unsigned_apk, apk_path, key_name, self.key_passwords,
+                      codename_to_api_level_map=self.codename_to_api_level_map)
+      has_signed_apk = True
+    return payload_dir, has_signed_apk
+
+  def RepackApexPayload(self, payload_dir, payload_key, signing_args=None):
+    """Rebuilds the apex file with the updated payload directory."""
+    apex_dir = common.MakeTempDir()
+    # Extract the apex file and reuse its meta files as repack parameters.
+    common.UnzipToDir(self.apex_path, apex_dir)
+    arguments_dict = {
+        'manifest': os.path.join(apex_dir, 'apex_manifest.pb'),
+        'build_info': os.path.join(apex_dir, 'apex_build_info.pb'),
+        'key': payload_key,
+    }
+    for filename in arguments_dict.values():
+      assert os.path.exists(filename), 'file {} not found'.format(filename)
+
+    # The repack process will add back these files later in the payload image.
+    for name in ['apex_manifest.pb', 'apex_manifest.json', 'lost+found']:
+      path = os.path.join(payload_dir, name)
+      if os.path.isfile(path):
+        os.remove(path)
+      elif os.path.isdir(path):
+        shutil.rmtree(path)
+
+    # TODO(xunchang) the signing process can be improved by using
+    # '--unsigned_payload_only'. But we need to parse the vbmeta earlier for
+    # the signing arguments, e.g. algorithm, salt, etc.
+    payload_img = os.path.join(apex_dir, APEX_PAYLOAD_IMAGE)
+    generate_image_cmd = ['apexer', '--force', '--payload_only',
+                          '--do_not_check_keyname', '--apexer_tool_path',
+                          os.getenv('PATH')]
+    for key, val in arguments_dict.items():
+      generate_image_cmd.extend(['--' + key, val])
+
+    # Add quote to the signing_args as we will pass
+    # --signing_args "--signing_helper_with_files=%path" to apexer
+    if signing_args:
+      generate_image_cmd.extend(['--signing_args', '"{}"'.format(signing_args)])
+
+    # optional arguments for apex repacking
+    manifest_json = os.path.join(apex_dir, 'apex_manifest.json')
+    if os.path.exists(manifest_json):
+      generate_image_cmd.extend(['--manifest_json', manifest_json])
+    generate_image_cmd.extend([payload_dir, payload_img])
+    if OPTIONS.verbose:
+      generate_image_cmd.append('-v')
+    common.RunAndCheckOutput(generate_image_cmd)
+
+    # Add the payload image back to the apex file.
+    common.ZipDelete(self.apex_path, APEX_PAYLOAD_IMAGE)
+    with zipfile.ZipFile(self.apex_path, 'a') as output_apex:
+      common.ZipWrite(output_apex, payload_img, APEX_PAYLOAD_IMAGE,
+                      compress_type=zipfile.ZIP_STORED)
+    return self.apex_path
+
+
+def SignApexPayload(avbtool, payload_file, payload_key_path, payload_key_name,
+                    algorithm, salt, hash_algorithm, no_hashtree, signing_args=None):
   """Signs a given payload_file with the payload key."""
   # Add the new footer. Old footer, if any, will be replaced by avbtool.
-  cmd = ['avbtool', 'add_hashtree_footer',
+  cmd = [avbtool, 'add_hashtree_footer',
          '--do_not_generate_fec',
          '--algorithm', algorithm,
          '--key', payload_key_path,
          '--prop', 'apex.key:{}'.format(payload_key_name),
          '--image', payload_file,
-         '--salt', salt]
+         '--salt', salt,
+         '--hash_algorithm', hash_algorithm]
+  if no_hashtree:
+    cmd.append('--no_hashtree')
   if signing_args:
     cmd.extend(shlex.split(signing_args))
 
   try:
     common.RunAndCheckOutput(cmd)
   except common.ExternalError as e:
-    raise ApexSigningError, \
+    raise ApexSigningError(
         'Failed to sign APEX payload {} with {}:\n{}'.format(
-            payload_file, payload_key_path, e), sys.exc_info()[2]
+            payload_file, payload_key_path, e))
 
   # Verify the signed payload image with specified public key.
   logger.info('Verifying %s', payload_file)
-  VerifyApexPayload(payload_file, payload_key_path)
+  VerifyApexPayload(avbtool, payload_file, payload_key_path, no_hashtree)
 
 
-def VerifyApexPayload(payload_file, payload_key):
+def VerifyApexPayload(avbtool, payload_file, payload_key, no_hashtree=False):
   """Verifies the APEX payload signature with the given key."""
-  cmd = ['avbtool', 'verify_image', '--image', payload_file,
+  cmd = [avbtool, 'verify_image', '--image', payload_file,
          '--key', payload_key]
+  if no_hashtree:
+    cmd.append('--accept_zeroed_hashtree')
   try:
     common.RunAndCheckOutput(cmd)
   except common.ExternalError as e:
-    raise ApexSigningError, \
+    raise ApexSigningError(
         'Failed to validate payload signing for {} with {}:\n{}'.format(
-            payload_file, payload_key, e), sys.exc_info()[2]
+            payload_file, payload_key, e))
 
 
-def ParseApexPayloadInfo(payload_path):
+def ParseApexPayloadInfo(avbtool, payload_path):
   """Parses the APEX payload info.
 
   Args:
+    avbtool: The AVB tool to use.
     payload_path: The path to the payload image.
 
   Raises:
@@ -91,24 +223,24 @@
 
   Returns:
     A dict that contains payload property-value pairs. The dict should at least
-    contain Algorithm, Salt and apex.key.
+    contain Algorithm, Salt, Tree Size and apex.key.
   """
   if not os.path.exists(payload_path):
     raise ApexInfoError('Failed to find image: {}'.format(payload_path))
 
-  cmd = ['avbtool', 'info_image', '--image', payload_path]
+  cmd = [avbtool, 'info_image', '--image', payload_path]
   try:
     output = common.RunAndCheckOutput(cmd)
   except common.ExternalError as e:
-    raise ApexInfoError, \
+    raise ApexInfoError(
         'Failed to get APEX payload info for {}:\n{}'.format(
-            payload_path, e), sys.exc_info()[2]
+            payload_path, e))
 
-  # Extract the Algorithm / Salt / Prop info from payload (i.e. an image signed
-  # with avbtool). For example,
+  # Extract the Algorithm / Hash Algorithm / Salt / Prop info / Tree size from
+  # payload (i.e. an image signed with avbtool). For example,
   # Algorithm:                SHA256_RSA4096
   PAYLOAD_INFO_PATTERN = (
-      r'^\s*(?P<key>Algorithm|Salt|Prop)\:\s*(?P<value>.*?)$')
+      r'^\s*(?P<key>Algorithm|Hash Algorithm|Salt|Prop|Tree Size)\:\s*(?P<value>.*?)$')
   payload_info_matcher = re.compile(PAYLOAD_INFO_PATTERN)
 
   payload_info = {}
@@ -142,7 +274,7 @@
       payload_info[key] = value
 
   # Sanity check.
-  for key in ('Algorithm', 'Salt', 'apex.key'):
+  for key in ('Algorithm', 'Salt', 'apex.key', 'Hash Algorithm'):
     if key not in payload_info:
       raise ApexInfoError(
           'Failed to find {} prop in {}'.format(key, payload_path))
@@ -150,8 +282,9 @@
   return payload_info
 
 
-def SignApex(apex_data, payload_key, container_key, container_pw,
-             codename_to_api_level_map, signing_args=None):
+def SignApex(avbtool, apex_data, payload_key, container_key, container_pw,
+             apk_keys, codename_to_api_level_map,
+             no_hashtree, signing_args=None):
   """Signs the current APEX with the given payload/container keys.
 
   Args:
@@ -159,7 +292,9 @@
     payload_key: The path to payload signing key (w/ extension).
     container_key: The path to container signing key (w/o extension).
     container_pw: The matching password of the container_key, or None.
+    apk_keys: A dict that holds the signing keys for apk files.
     codename_to_api_level_map: A dict that maps from codename to API level.
+    no_hashtree: Don't include hashtree in the signed APEX.
     signing_args: Additional args to be passed to the payload signer.
 
   Returns:
@@ -169,28 +304,35 @@
   with open(apex_file, 'wb') as apex_fp:
     apex_fp.write(apex_data)
 
-  APEX_PAYLOAD_IMAGE = 'apex_payload.img'
   APEX_PUBKEY = 'apex_pubkey'
 
-  # 1a. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given
+  # 1. Extract the apex payload image and sign the containing apk files. Repack
+  # the apex file after signing.
+  apk_signer = ApexApkSigner(apex_file, container_pw,
+                             codename_to_api_level_map)
+  apex_file = apk_signer.ProcessApexFile(apk_keys, payload_key, signing_args)
+
+  # 2a. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given
   # payload_key.
   payload_dir = common.MakeTempDir(prefix='apex-payload-')
   with zipfile.ZipFile(apex_file) as apex_fd:
     payload_file = apex_fd.extract(APEX_PAYLOAD_IMAGE, payload_dir)
     zip_items = apex_fd.namelist()
 
-  payload_info = ParseApexPayloadInfo(payload_file)
+  payload_info = ParseApexPayloadInfo(avbtool, payload_file)
   SignApexPayload(
+      avbtool,
       payload_file,
       payload_key,
       payload_info['apex.key'],
       payload_info['Algorithm'],
       payload_info['Salt'],
+      payload_info['Hash Algorithm'],
+      no_hashtree,
       signing_args)
 
-  # 1b. Update the embedded payload public key.
-  payload_public_key = common.ExtractAvbPublicKey(payload_key)
-
+  # 2b. Update the embedded payload public key.
+  payload_public_key = common.ExtractAvbPublicKey(avbtool, payload_key)
   common.ZipDelete(apex_file, APEX_PAYLOAD_IMAGE)
   if APEX_PUBKEY in zip_items:
     common.ZipDelete(apex_file, APEX_PUBKEY)
@@ -199,11 +341,11 @@
   common.ZipWrite(apex_zip, payload_public_key, arcname=APEX_PUBKEY)
   common.ZipClose(apex_zip)
 
-  # 2. Align the files at page boundary (same as in apexer).
+  # 3. Align the files at page boundary (same as in apexer).
   aligned_apex = common.MakeTempFile(prefix='apex-container-', suffix='.apex')
   common.RunAndCheckOutput(['zipalign', '-f', '4096', apex_file, aligned_apex])
 
-  # 3. Sign the APEX container with container_key.
+  # 4. Sign the APEX container with container_key.
   signed_apex = common.MakeTempFile(prefix='apex-container-', suffix='.apex')
 
   # Specify the 4K alignment when calling SignApk.
diff --git a/tools/releasetools/blockimgdiff.py b/tools/releasetools/blockimgdiff.py
index b23eef1..8b6a690 100644
--- a/tools/releasetools/blockimgdiff.py
+++ b/tools/releasetools/blockimgdiff.py
@@ -28,12 +28,12 @@
 import threading
 import zlib
 from collections import deque, namedtuple, OrderedDict
-from hashlib import sha1
 
 import common
+from images import EmptyImage
 from rangelib import RangeSet
 
-__all__ = ["EmptyImage", "DataImage", "BlockImageDiff"]
+__all__ = ["BlockImageDiff"]
 
 logger = logging.getLogger(__name__)
 
@@ -60,210 +60,6 @@
     return PatchInfo(imgdiff, f.read())
 
 
-class Image(object):
-  def RangeSha1(self, ranges):
-    raise NotImplementedError
-
-  def ReadRangeSet(self, ranges):
-    raise NotImplementedError
-
-  def TotalSha1(self, include_clobbered_blocks=False):
-    raise NotImplementedError
-
-  def WriteRangeDataToFd(self, ranges, fd):
-    raise NotImplementedError
-
-
-class EmptyImage(Image):
-  """A zero-length image."""
-
-  def __init__(self):
-    self.blocksize = 4096
-    self.care_map = RangeSet()
-    self.clobbered_blocks = RangeSet()
-    self.extended = RangeSet()
-    self.total_blocks = 0
-    self.file_map = {}
-    self.hashtree_info = None
-
-  def RangeSha1(self, ranges):
-    return sha1().hexdigest()
-
-  def ReadRangeSet(self, ranges):
-    return ()
-
-  def TotalSha1(self, include_clobbered_blocks=False):
-    # EmptyImage always carries empty clobbered_blocks, so
-    # include_clobbered_blocks can be ignored.
-    assert self.clobbered_blocks.size() == 0
-    return sha1().hexdigest()
-
-  def WriteRangeDataToFd(self, ranges, fd):
-    raise ValueError("Can't write data from EmptyImage to file")
-
-
-class DataImage(Image):
-  """An image wrapped around a single string of data."""
-
-  def __init__(self, data, trim=False, pad=False):
-    self.data = data
-    self.blocksize = 4096
-
-    assert not (trim and pad)
-
-    partial = len(self.data) % self.blocksize
-    padded = False
-    if partial > 0:
-      if trim:
-        self.data = self.data[:-partial]
-      elif pad:
-        self.data += '\0' * (self.blocksize - partial)
-        padded = True
-      else:
-        raise ValueError(("data for DataImage must be multiple of %d bytes "
-                          "unless trim or pad is specified") %
-                         (self.blocksize,))
-
-    assert len(self.data) % self.blocksize == 0
-
-    self.total_blocks = len(self.data) / self.blocksize
-    self.care_map = RangeSet(data=(0, self.total_blocks))
-    # When the last block is padded, we always write the whole block even for
-    # incremental OTAs. Because otherwise the last block may get skipped if
-    # unchanged for an incremental, but would fail the post-install
-    # verification if it has non-zero contents in the padding bytes.
-    # Bug: 23828506
-    if padded:
-      clobbered_blocks = [self.total_blocks-1, self.total_blocks]
-    else:
-      clobbered_blocks = []
-    self.clobbered_blocks = clobbered_blocks
-    self.extended = RangeSet()
-
-    zero_blocks = []
-    nonzero_blocks = []
-    reference = '\0' * self.blocksize
-
-    for i in range(self.total_blocks-1 if padded else self.total_blocks):
-      d = self.data[i*self.blocksize : (i+1)*self.blocksize]
-      if d == reference:
-        zero_blocks.append(i)
-        zero_blocks.append(i+1)
-      else:
-        nonzero_blocks.append(i)
-        nonzero_blocks.append(i+1)
-
-    assert zero_blocks or nonzero_blocks or clobbered_blocks
-
-    self.file_map = dict()
-    if zero_blocks:
-      self.file_map["__ZERO"] = RangeSet(data=zero_blocks)
-    if nonzero_blocks:
-      self.file_map["__NONZERO"] = RangeSet(data=nonzero_blocks)
-    if clobbered_blocks:
-      self.file_map["__COPY"] = RangeSet(data=clobbered_blocks)
-
-  def _GetRangeData(self, ranges):
-    for s, e in ranges:
-      yield self.data[s*self.blocksize:e*self.blocksize]
-
-  def RangeSha1(self, ranges):
-    h = sha1()
-    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
-      h.update(data)
-    return h.hexdigest()
-
-  def ReadRangeSet(self, ranges):
-    return list(self._GetRangeData(ranges))
-
-  def TotalSha1(self, include_clobbered_blocks=False):
-    if not include_clobbered_blocks:
-      return self.RangeSha1(self.care_map.subtract(self.clobbered_blocks))
-    else:
-      return sha1(self.data).hexdigest()
-
-  def WriteRangeDataToFd(self, ranges, fd):
-    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
-      fd.write(data)
-
-
-class FileImage(Image):
-  """An image wrapped around a raw image file."""
-
-  def __init__(self, path, hashtree_info_generator=None):
-    self.path = path
-    self.blocksize = 4096
-    self._file_size = os.path.getsize(self.path)
-    self._file = open(self.path, 'r')
-
-    if self._file_size % self.blocksize != 0:
-      raise ValueError("Size of file %s must be multiple of %d bytes, but is %d"
-                       % self.path, self.blocksize, self._file_size)
-
-    self.total_blocks = self._file_size / self.blocksize
-    self.care_map = RangeSet(data=(0, self.total_blocks))
-    self.clobbered_blocks = RangeSet()
-    self.extended = RangeSet()
-
-    self.generator_lock = threading.Lock()
-
-    self.hashtree_info = None
-    if hashtree_info_generator:
-      self.hashtree_info = hashtree_info_generator.Generate(self)
-
-    zero_blocks = []
-    nonzero_blocks = []
-    reference = '\0' * self.blocksize
-
-    for i in range(self.total_blocks):
-      d = self._file.read(self.blocksize)
-      if d == reference:
-        zero_blocks.append(i)
-        zero_blocks.append(i+1)
-      else:
-        nonzero_blocks.append(i)
-        nonzero_blocks.append(i+1)
-
-    assert zero_blocks or nonzero_blocks
-
-    self.file_map = {}
-    if zero_blocks:
-      self.file_map["__ZERO"] = RangeSet(data=zero_blocks)
-    if nonzero_blocks:
-      self.file_map["__NONZERO"] = RangeSet(data=nonzero_blocks)
-    if self.hashtree_info:
-      self.file_map["__HASHTREE"] = self.hashtree_info.hashtree_range
-
-  def __del__(self):
-    self._file.close()
-
-  def _GetRangeData(self, ranges):
-    # Use a lock to protect the generator so that we will not run two
-    # instances of this generator on the same object simultaneously.
-    with self.generator_lock:
-      for s, e in ranges:
-        self._file.seek(s * self.blocksize)
-        for _ in range(s, e):
-          yield self._file.read(self.blocksize)
-
-  def RangeSha1(self, ranges):
-    h = sha1()
-    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
-      h.update(data)
-    return h.hexdigest()
-
-  def ReadRangeSet(self, ranges):
-    return list(self._GetRangeData(ranges))
-
-  def TotalSha1(self, include_clobbered_blocks=False):
-    assert not self.clobbered_blocks
-    return self.RangeSha1(self.care_map)
-
-  def WriteRangeDataToFd(self, ranges, fd):
-    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
-      fd.write(data)
-
-
 class Transfer(object):
   def __init__(self, tgt_name, src_name, tgt_ranges, src_ranges, tgt_sha1,
                src_sha1, style, by_id):
@@ -391,7 +187,7 @@
 
     def print_header(header, separator):
       logger.info(header)
-      logger.info(separator * len(header) + '\n')
+      logger.info('%s\n', separator * len(header))
 
     print_header('  Imgdiff Stats Report  ', '=')
     for key in self.REASONS:
@@ -779,7 +575,7 @@
     out.insert(2, "0\n")
     out.insert(3, str(max_stashed_blocks) + "\n")
 
-    with open(prefix + ".transfer.list", "wb") as f:
+    with open(prefix + ".transfer.list", "w") as f:
       for i in out:
         f.write(i)
 
@@ -1009,7 +805,7 @@
     # - we write every block we care about exactly once.
 
     # Start with no blocks having been touched yet.
-    touched = array.array("B", "\0" * self.tgt.total_blocks)
+    touched = array.array("B", b"\0" * self.tgt.total_blocks)
 
     # Imagine processing the transfers in order.
     for xf in self.transfers:
@@ -1671,8 +1467,8 @@
 
         split_tgt_size = int(info[1])
         assert split_tgt_size % 4096 == 0
-        assert split_tgt_size / 4096 <= tgt_remain.size()
-        split_tgt_ranges = tgt_remain.first(split_tgt_size / 4096)
+        assert split_tgt_size // 4096 <= tgt_remain.size()
+        split_tgt_ranges = tgt_remain.first(split_tgt_size // 4096)
         tgt_remain = tgt_remain.subtract(split_tgt_ranges)
 
         # Find the split_src_ranges within the image file from its relative
@@ -1744,7 +1540,7 @@
                                                     lines)
         for index, (patch_start, patch_length, split_tgt_ranges,
                     split_src_ranges) in enumerate(split_info_list):
-          with open(patch_file) as f:
+          with open(patch_file, 'rb') as f:
             f.seek(patch_start)
             patch_content = f.read(patch_length)
 
@@ -1762,6 +1558,7 @@
     split_large_apks = []
     cache_size = common.OPTIONS.cache_size
     split_threshold = 0.125
+    assert cache_size is not None
     max_blocks_per_transfer = int(cache_size * split_threshold /
                                   self.tgt.blocksize)
     empty = RangeSet()
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 4136ed4..8cf0741 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -18,7 +18,7 @@
 Builds output_image from the given input_directory, properties_file,
 and writes the image to target_output_directory.
 
-Usage:  build_image.py input_directory properties_file output_image \\
+Usage:  build_image input_directory properties_file output_image \\
             target_output_directory
 """
 
@@ -248,6 +248,8 @@
   build_command = []
   fs_type = prop_dict.get("fs_type", "")
   run_e2fsck = False
+  needs_projid = prop_dict.get("needs_projid", 0)
+  needs_casefold = prop_dict.get("needs_casefold", 0)
 
   if fs_type.startswith("ext"):
     build_command = [prop_dict["ext_mkuserimg"]]
@@ -285,9 +287,12 @@
         build_command.extend(["-U", prop_dict["uuid"]])
       if "hash_seed" in prop_dict:
         build_command.extend(["-S", prop_dict["hash_seed"]])
-    if "ext4_share_dup_blocks" in prop_dict:
+    if prop_dict.get("ext4_share_dup_blocks") == "true":
       build_command.append("-c")
-    build_command.extend(["--inode_size", "256"])
+    if (needs_projid):
+      build_command.extend(["--inode_size", "512"])
+    else:
+      build_command.extend(["--inode_size", "256"])
     if "selinux_fc" in prop_dict:
       build_command.append(prop_dict["selinux_fc"])
   elif fs_type.startswith("squash"):
@@ -315,6 +320,8 @@
   elif fs_type.startswith("f2fs"):
     build_command = ["mkf2fsuserimg.sh"]
     build_command.extend([out_file, prop_dict["image_size"]])
+    if "f2fs_sparse_flag" in prop_dict:
+      build_command.extend([prop_dict["f2fs_sparse_flag"]])
     if fs_config:
       build_command.extend(["-C", fs_config])
     build_command.extend(["-f", in_dir])
@@ -326,6 +333,10 @@
     if "timestamp" in prop_dict:
       build_command.extend(["-T", str(prop_dict["timestamp"])])
     build_command.extend(["-L", prop_dict["mount_point"]])
+    if (needs_projid):
+      build_command.append("--prjquota")
+    if (needs_casefold):
+      build_command.append("--casefold")
   else:
     raise BuildImageError(
         "Error: unknown filesystem type: {}".format(fs_type))
@@ -498,9 +509,9 @@
   d = {}
 
   if "build.prop" in glob_dict:
-    bp = glob_dict["build.prop"]
-    if "ro.build.date.utc" in bp:
-      d["timestamp"] = bp["ro.build.date.utc"]
+    timestamp = glob_dict["build.prop"].GetProp("ro.build.date.utc")
+    if timestamp:
+      d["timestamp"] = timestamp
 
   def copy_prop(src_p, dest_p):
     """Copy a property from the global dictionary.
@@ -519,7 +530,7 @@
   common_props = (
       "extfs_sparse_flag",
       "squashfs_sparse_flag",
-      "selinux_fc",
+      "f2fs_sparse_flag",
       "skip_fsck",
       "ext_mkuserimg",
       "verity",
@@ -529,7 +540,6 @@
       "verity_disable",
       "avb_enable",
       "avb_avbtool",
-      "avb_salt",
       "use_dynamic_partition_size",
   )
   for p in common_props:
@@ -542,6 +552,7 @@
               "avb_add_hashtree_footer_args")
     copy_prop("avb_system_key_path", "avb_key_path")
     copy_prop("avb_system_algorithm", "avb_algorithm")
+    copy_prop("avb_system_salt", "avb_salt")
     copy_prop("fs_type", "fs_type")
     # Copy the generic system fs type first, override with specific one if
     # available.
@@ -564,6 +575,7 @@
     if not copy_prop("system_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
     copy_prop("system_reserved_size", "partition_reserved_size")
+    copy_prop("system_selinux_fc", "selinux_fc")
   elif mount_point == "system_other":
     # We inherit the selinux policies of /system since we contain some of its
     # files.
@@ -572,6 +584,7 @@
               "avb_add_hashtree_footer_args")
     copy_prop("avb_system_other_key_path", "avb_key_path")
     copy_prop("avb_system_other_algorithm", "avb_algorithm")
+    copy_prop("avb_system_other_salt", "avb_salt")
     copy_prop("fs_type", "fs_type")
     copy_prop("system_fs_type", "fs_type")
     copy_prop("system_other_size", "partition_size")
@@ -582,11 +595,11 @@
     copy_prop("system_squashfs_compressor", "squashfs_compressor")
     copy_prop("system_squashfs_compressor_opt", "squashfs_compressor_opt")
     copy_prop("system_squashfs_block_size", "squashfs_block_size")
-    copy_prop("system_base_fs_file", "base_fs_file")
     copy_prop("system_extfs_inode_count", "extfs_inode_count")
     if not copy_prop("system_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
     copy_prop("system_reserved_size", "partition_reserved_size")
+    copy_prop("system_selinux_fc", "selinux_fc")
   elif mount_point == "data":
     # Copy the generic fs type first, override with specific one if available.
     copy_prop("fs_type", "fs_type")
@@ -594,15 +607,20 @@
     copy_prop("userdata_size", "partition_size")
     copy_prop("flash_logical_block_size", "flash_logical_block_size")
     copy_prop("flash_erase_block_size", "flash_erase_block_size")
+    copy_prop("userdata_selinux_fc", "selinux_fc")
+    copy_prop("needs_casefold", "needs_casefold")
+    copy_prop("needs_projid", "needs_projid")
   elif mount_point == "cache":
     copy_prop("cache_fs_type", "fs_type")
     copy_prop("cache_size", "partition_size")
+    copy_prop("cache_selinux_fc", "selinux_fc")
   elif mount_point == "vendor":
     copy_prop("avb_vendor_hashtree_enable", "avb_hashtree_enable")
     copy_prop("avb_vendor_add_hashtree_footer_args",
               "avb_add_hashtree_footer_args")
     copy_prop("avb_vendor_key_path", "avb_key_path")
     copy_prop("avb_vendor_algorithm", "avb_algorithm")
+    copy_prop("avb_vendor_salt", "avb_salt")
     copy_prop("vendor_fs_type", "fs_type")
     copy_prop("vendor_size", "partition_size")
     if not copy_prop("vendor_journal_size", "journal_size"):
@@ -618,12 +636,14 @@
     if not copy_prop("vendor_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
     copy_prop("vendor_reserved_size", "partition_reserved_size")
+    copy_prop("vendor_selinux_fc", "selinux_fc")
   elif mount_point == "product":
     copy_prop("avb_product_hashtree_enable", "avb_hashtree_enable")
     copy_prop("avb_product_add_hashtree_footer_args",
               "avb_add_hashtree_footer_args")
     copy_prop("avb_product_key_path", "avb_key_path")
     copy_prop("avb_product_algorithm", "avb_algorithm")
+    copy_prop("avb_product_salt", "avb_salt")
     copy_prop("product_fs_type", "fs_type")
     copy_prop("product_size", "partition_size")
     if not copy_prop("product_journal_size", "journal_size"):
@@ -639,35 +659,39 @@
     if not copy_prop("product_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
     copy_prop("product_reserved_size", "partition_reserved_size")
-  elif mount_point == "product_services":
-    copy_prop("avb_product_services_hashtree_enable", "avb_hashtree_enable")
-    copy_prop("avb_product_services_add_hashtree_footer_args",
+    copy_prop("product_selinux_fc", "selinux_fc")
+  elif mount_point == "system_ext":
+    copy_prop("avb_system_ext_hashtree_enable", "avb_hashtree_enable")
+    copy_prop("avb_system_ext_add_hashtree_footer_args",
               "avb_add_hashtree_footer_args")
-    copy_prop("avb_product_services_key_path", "avb_key_path")
-    copy_prop("avb_product_services_algorithm", "avb_algorithm")
-    copy_prop("product_services_fs_type", "fs_type")
-    copy_prop("product_services_size", "partition_size")
-    if not copy_prop("product_services_journal_size", "journal_size"):
+    copy_prop("avb_system_ext_key_path", "avb_key_path")
+    copy_prop("avb_system_ext_algorithm", "avb_algorithm")
+    copy_prop("avb_system_ext_salt", "avb_salt")
+    copy_prop("system_ext_fs_type", "fs_type")
+    copy_prop("system_ext_size", "partition_size")
+    if not copy_prop("system_ext_journal_size", "journal_size"):
       d["journal_size"] = "0"
-    copy_prop("product_services_verity_block_device", "verity_block_device")
+    copy_prop("system_ext_verity_block_device", "verity_block_device")
     copy_prop("ext4_share_dup_blocks", "ext4_share_dup_blocks")
-    copy_prop("product_services_squashfs_compressor", "squashfs_compressor")
-    copy_prop("product_services_squashfs_compressor_opt",
+    copy_prop("system_ext_squashfs_compressor", "squashfs_compressor")
+    copy_prop("system_ext_squashfs_compressor_opt",
               "squashfs_compressor_opt")
-    copy_prop("product_services_squashfs_block_size", "squashfs_block_size")
-    copy_prop("product_services_squashfs_disable_4k_align",
+    copy_prop("system_ext_squashfs_block_size", "squashfs_block_size")
+    copy_prop("system_ext_squashfs_disable_4k_align",
               "squashfs_disable_4k_align")
-    copy_prop("product_services_base_fs_file", "base_fs_file")
-    copy_prop("product_services_extfs_inode_count", "extfs_inode_count")
-    if not copy_prop("product_services_extfs_rsv_pct", "extfs_rsv_pct"):
+    copy_prop("system_ext_base_fs_file", "base_fs_file")
+    copy_prop("system_ext_extfs_inode_count", "extfs_inode_count")
+    if not copy_prop("system_ext_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
-    copy_prop("product_services_reserved_size", "partition_reserved_size")
+    copy_prop("system_ext_reserved_size", "partition_reserved_size")
+    copy_prop("system_ext_selinux_fc", "selinux_fc")
   elif mount_point == "odm":
     copy_prop("avb_odm_hashtree_enable", "avb_hashtree_enable")
     copy_prop("avb_odm_add_hashtree_footer_args",
               "avb_add_hashtree_footer_args")
     copy_prop("avb_odm_key_path", "avb_key_path")
     copy_prop("avb_odm_algorithm", "avb_algorithm")
+    copy_prop("avb_odm_salt", "avb_salt")
     copy_prop("odm_fs_type", "fs_type")
     copy_prop("odm_size", "partition_size")
     if not copy_prop("odm_journal_size", "journal_size"):
@@ -683,6 +707,7 @@
     if not copy_prop("odm_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
     copy_prop("odm_reserved_size", "partition_reserved_size")
+    copy_prop("odm_selinux_fc", "selinux_fc")
   elif mount_point == "oem":
     copy_prop("fs_type", "fs_type")
     copy_prop("oem_size", "partition_size")
@@ -692,6 +717,7 @@
     copy_prop("ext4_share_dup_blocks", "ext4_share_dup_blocks")
     if not copy_prop("oem_extfs_rsv_pct", "extfs_rsv_pct"):
       d["extfs_rsv_pct"] = "0"
+    copy_prop("oem_selinux_fc", "selinux_fc")
   d["partition_name"] = mount_point
   return d
 
@@ -728,8 +754,8 @@
     copy_prop("partition_size", "odm_size")
   elif mount_point == "product":
     copy_prop("partition_size", "product_size")
-  elif mount_point == "product_services":
-    copy_prop("partition_size", "product_services_size")
+  elif mount_point == "system_ext":
+    copy_prop("partition_size", "system_ext_size")
   return d
 
 
@@ -769,8 +795,8 @@
       mount_point = "oem"
     elif image_filename == "product.img":
       mount_point = "product"
-    elif image_filename == "product_services.img":
-      mount_point = "product_services"
+    elif image_filename == "system_ext.img":
+      mount_point = "system_ext"
     else:
       logger.error("Unknown image file name %s", image_filename)
       sys.exit(1)
diff --git a/tools/releasetools/build_super_image.py b/tools/releasetools/build_super_image.py
index f63453d..fb31415 100755
--- a/tools/releasetools/build_super_image.py
+++ b/tools/releasetools/build_super_image.py
@@ -55,7 +55,7 @@
 logger = logging.getLogger(__name__)
 
 
-UNZIP_PATTERN = ["IMAGES/*", "META/*"]
+UNZIP_PATTERN = ["IMAGES/*", "META/*", "*/build.prop"]
 
 
 def GetArgumentsForImage(partition, group, image=None):
@@ -76,6 +76,8 @@
          "--super-name", info_dict["super_metadata_device"]]
 
   ab_update = info_dict.get("ab_update") == "true"
+  virtual_ab = info_dict.get("virtual_ab") == "true"
+  virtual_ab_retrofit = info_dict.get("virtual_ab_retrofit") == "true"
   retrofit = info_dict.get("dynamic_partition_retrofit") == "true"
   block_devices = shlex.split(info_dict.get("super_block_devices", "").strip())
   groups = shlex.split(info_dict.get("super_partition_groups", "").strip())
@@ -89,6 +91,8 @@
 
   if ab_update and retrofit:
     cmd.append("--auto-slot-suffixing")
+  if virtual_ab and not virtual_ab_retrofit:
+    cmd.append("--virtual-ab")
 
   for device in block_devices:
     size = info_dict["super_{}_device_size".format(device)]
diff --git a/tools/releasetools/check_ota_package_signature.py b/tools/releasetools/check_ota_package_signature.py
index 7d3424b..0d990f1 100755
--- a/tools/releasetools/check_ota_package_signature.py
+++ b/tools/releasetools/check_ota_package_signature.py
@@ -38,8 +38,7 @@
   """Check if the cert uses SHA-256 hashing algorithm."""
 
   cmd = ['openssl', 'x509', '-text', '-noout', '-in', cert]
-  p1 = common.Run(cmd, stdout=subprocess.PIPE)
-  cert_dump, _ = p1.communicate()
+  cert_dump = common.RunAndCheckOutput(cmd, stdout=subprocess.PIPE)
 
   algorithm = re.search(r'Signature Algorithm: ([a-zA-Z0-9]+)', cert_dump)
   assert algorithm, "Failed to identify the signature algorithm."
@@ -69,13 +68,13 @@
   print('Certificate: %s' % (cert,))
 
   # Read in the package.
-  with open(package) as package_file:
+  with open(package, 'rb') as package_file:
     package_bytes = package_file.read()
 
   length = len(package_bytes)
   assert length >= 6, "Not big enough to contain footer."
 
-  footer = [ord(x) for x in package_bytes[-6:]]
+  footer = bytearray(package_bytes[-6:])
   assert footer[2] == 0xff and footer[3] == 0xff, "Footer is wrong."
 
   signature_start_from_end = (footer[1] << 8) + footer[0]
@@ -111,31 +110,25 @@
 
   # Parse the signature and get the hash.
   cmd = ['openssl', 'asn1parse', '-inform', 'DER', '-in', sig_file]
-  p1 = common.Run(cmd, stdout=subprocess.PIPE)
-  sig, _ = p1.communicate()
-  assert p1.returncode == 0, "Failed to parse the signature."
+  sig = common.RunAndCheckOutput(cmd, stdout=subprocess.PIPE)
 
-  digest_line = sig.strip().split('\n')[-1]
+  digest_line = sig.rstrip().split('\n')[-1]
   digest_string = digest_line.split(':')[3]
   digest_file = common.MakeTempFile(prefix='digest-')
   with open(digest_file, 'wb') as f:
-    f.write(digest_string.decode('hex'))
+    f.write(bytearray.fromhex(digest_string))
 
   # Verify the digest by outputing the decrypted result in ASN.1 structure.
   decrypted_file = common.MakeTempFile(prefix='decrypted-')
   cmd = ['openssl', 'rsautl', '-verify', '-certin', '-inkey', cert,
          '-in', digest_file, '-out', decrypted_file]
-  p1 = common.Run(cmd, stdout=subprocess.PIPE)
-  p1.communicate()
-  assert p1.returncode == 0, "Failed to run openssl rsautl -verify."
+  common.RunAndCheckOutput(cmd, stdout=subprocess.PIPE)
 
   # Parse the output ASN.1 structure.
   cmd = ['openssl', 'asn1parse', '-inform', 'DER', '-in', decrypted_file]
-  p1 = common.Run(cmd, stdout=subprocess.PIPE)
-  decrypted_output, _ = p1.communicate()
-  assert p1.returncode == 0, "Failed to parse the output."
+  decrypted_output = common.RunAndCheckOutput(cmd, stdout=subprocess.PIPE)
 
-  digest_line = decrypted_output.strip().split('\n')[-1]
+  digest_line = decrypted_output.rstrip().split('\n')[-1]
   digest_string = digest_line.split(':')[3].lower()
 
   # Verify that the two digest strings match.
@@ -156,7 +149,7 @@
 
   # Dump pubkey from the certificate.
   pubkey = common.MakeTempFile(prefix="key-", suffix=".pem")
-  with open(pubkey, 'wb') as pubkey_fp:
+  with open(pubkey, 'w') as pubkey_fp:
     pubkey_fp.write(common.ExtractPublicKey(cert))
 
   package_dir = common.MakeTempDir(prefix='package-')
@@ -166,11 +159,7 @@
   cmd = ['delta_generator',
          '--in_file=' + payload_file,
          '--public_key=' + pubkey]
-  proc = common.Run(cmd)
-  stdoutdata, _ = proc.communicate()
-  assert proc.returncode == 0, \
-      'Failed to verify payload with delta_generator: {}\n{}'.format(
-          package, stdoutdata)
+  common.RunAndCheckOutput(cmd)
   common.ZipClose(package_zip)
 
   # Verified successfully upon reaching here.
diff --git a/tools/releasetools/check_partition_sizes.py b/tools/releasetools/check_partition_sizes.py
new file mode 100644
index 0000000..745c136
--- /dev/null
+++ b/tools/releasetools/check_partition_sizes.py
@@ -0,0 +1,276 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Check dynamic partition sizes.
+
+usage: check_partition_sizes [info.txt]
+
+Check dump-super-partitions-info procedure for expected keys in info.txt. In
+addition, *_image (e.g. system_image, vendor_image, etc.) must be defined for
+each partition in dynamic_partition_list.
+
+Exit code is 0 if successful and non-zero if any failures.
+"""
+
+from __future__ import print_function
+
+import logging
+import sys
+
+import common
+import sparse_img
+
+if sys.hexversion < 0x02070000:
+  print("Python 2.7 or newer is required.", file=sys.stderr)
+  sys.exit(1)
+
+logger = logging.getLogger(__name__)
+
+class Expression(object):
+  def __init__(self, desc, expr, value=None):
+    # Human-readable description
+    self.desc = str(desc)
+    # Numeric expression
+    self.expr = str(expr)
+    # Value of expression
+    self.value = int(expr) if value is None else value
+
+  def CheckLe(self, other, level=logging.ERROR):
+    format_args = (self.desc, other.desc, self.expr, self.value,
+                   other.expr, other.value)
+    if self.value <= other.value:
+      logger.info("%s is less than or equal to %s:\n%s == %d <= %s == %d",
+                  *format_args)
+    else:
+      msg = "{} is greater than {}:\n{} == {} > {} == {}".format(*format_args)
+      if level == logging.ERROR:
+        raise RuntimeError(msg)
+      else:
+        logger.log(level, msg)
+
+  def CheckEq(self, other):
+    format_args = (self.desc, other.desc, self.expr, self.value,
+                   other.expr, other.value)
+    if self.value == other.value:
+      logger.info("%s equals %s:\n%s == %d == %s == %d", *format_args)
+    else:
+      raise RuntimeError("{} does not equal {}:\n{} == {} != {} == {}".format(
+          *format_args))
+
+
+# A/B feature flags
+class DeviceType(object):
+  NONE = 0
+  AB = 1
+  RVAB = 2 # retrofit Virtual-A/B
+  VAB = 3
+
+  @staticmethod
+  def Get(info_dict):
+    if info_dict.get("ab_update") != "true":
+      return DeviceType.NONE
+    if info_dict.get("virtual_ab_retrofit") == "true":
+      return DeviceType.RVAB
+    if info_dict.get("virtual_ab") == "true":
+      return DeviceType.VAB
+    return DeviceType.AB
+
+
+# Dynamic partition feature flags
+class Dap(object):
+  NONE = 0
+  RDAP = 1
+  DAP = 2
+
+  @staticmethod
+  def Get(info_dict):
+    if info_dict.get("use_dynamic_partitions") != "true":
+      return Dap.NONE
+    if info_dict.get("dynamic_partition_retrofit") == "true":
+      return Dap.RDAP
+    return Dap.DAP
+
+
+class DynamicPartitionSizeChecker(object):
+  def __init__(self, info_dict):
+    if "super_partition_size" in info_dict:
+      if "super_partition_warn_limit" not in info_dict:
+        info_dict["super_partition_warn_limit"] = \
+            int(info_dict["super_partition_size"]) * 95 // 100
+      if "super_partition_error_limit" not in info_dict:
+        info_dict["super_partition_error_limit"] = \
+            int(info_dict["super_partition_size"])
+    self.info_dict = info_dict
+
+
+  def _ReadSizeOfPartition(self, name):
+    # Tests uses *_image_size instead (to avoid creating empty sparse images
+    # on disk)
+    if name + "_image_size" in self.info_dict:
+      return int(self.info_dict[name + "_image_size"])
+    return sparse_img.GetImagePartitionSize(self.info_dict[name + "_image"])
+
+
+  # Round result to BOARD_SUPER_PARTITION_ALIGNMENT
+  def _RoundPartitionSize(self, size):
+    alignment = self.info_dict.get("super_partition_alignment")
+    if alignment is None:
+      return size
+    return (size + alignment - 1) // alignment * alignment
+
+
+  def _CheckSuperPartitionSize(self):
+    info_dict = self.info_dict
+    super_block_devices = \
+        info_dict.get("super_block_devices", "").strip().split()
+    size_list = [int(info_dict.get("super_{}_device_size".format(b), "0"))
+                 for b in super_block_devices]
+    sum_size = Expression("sum of super partition block device sizes",
+                          "+".join(str(size) for size in size_list),
+                          sum(size_list))
+    super_partition_size = Expression("BOARD_SUPER_PARTITION_SIZE",
+                                      info_dict["super_partition_size"])
+    sum_size.CheckEq(super_partition_size)
+
+  def _CheckSumOfPartitionSizes(self, max_size, partition_names,
+                                warn_size=None, error_size=None):
+    partition_size_list = [self._RoundPartitionSize(
+        self._ReadSizeOfPartition(p)) for p in partition_names]
+    sum_size = Expression("sum of sizes of {}".format(partition_names),
+                          "+".join(str(size) for size in partition_size_list),
+                          sum(partition_size_list))
+    sum_size.CheckLe(max_size)
+    if error_size:
+      sum_size.CheckLe(error_size)
+    if warn_size:
+      sum_size.CheckLe(warn_size, level=logging.WARNING)
+
+  def _NumDeviceTypesInSuper(self):
+    slot = DeviceType.Get(self.info_dict)
+    dap = Dap.Get(self.info_dict)
+
+    if dap == Dap.NONE:
+      raise RuntimeError("check_partition_sizes should only be executed on "
+                         "builds with dynamic partitions enabled")
+
+    # Retrofit dynamic partitions: 1 slot per "super", 2 "super"s on the device
+    if dap == Dap.RDAP:
+      if slot != DeviceType.AB:
+        raise RuntimeError("Device with retrofit dynamic partitions must use "
+                           "regular (non-Virtual) A/B")
+      return 1
+
+    # Launch DAP: 1 super on the device
+    assert dap == Dap.DAP
+
+    # DAP + A/B: 2 slots in super
+    if slot == DeviceType.AB:
+      return 2
+
+    # DAP + retrofit Virtual A/B: same as A/B
+    if slot == DeviceType.RVAB:
+      return 2
+
+    # DAP + Launch Virtual A/B: 1 *real* slot in super (2 virtual slots)
+    if slot == DeviceType.VAB:
+      return 1
+
+    # DAP + non-A/B: 1 slot in super
+    assert slot == DeviceType.NONE
+    return 1
+
+  def _CheckAllPartitionSizes(self):
+    info_dict = self.info_dict
+    num_slots = self._NumDeviceTypesInSuper()
+    size_limit_suffix = (" / %d" % num_slots) if num_slots > 1 else ""
+
+    # Check sum(all partitions) <= super partition (/ 2 for A/B devices launched
+    # with dynamic partitions)
+    if "super_partition_size" in info_dict and \
+        "dynamic_partition_list" in info_dict:
+      max_size = Expression(
+          "BOARD_SUPER_PARTITION_SIZE{}".format(size_limit_suffix),
+          int(info_dict["super_partition_size"]) // num_slots)
+      warn_limit = Expression(
+          "BOARD_SUPER_PARTITION_WARN_LIMIT{}".format(size_limit_suffix),
+          int(info_dict["super_partition_warn_limit"]) // num_slots)
+      error_limit = Expression(
+          "BOARD_SUPER_PARTITION_ERROR_LIMIT{}".format(size_limit_suffix),
+          int(info_dict["super_partition_error_limit"]) // num_slots)
+      self._CheckSumOfPartitionSizes(
+          max_size, info_dict["dynamic_partition_list"].strip().split(),
+          warn_limit, error_limit)
+
+    groups = info_dict.get("super_partition_groups", "").strip().split()
+
+    # For each group, check sum(partitions in group) <= group size
+    for group in groups:
+      if "super_{}_group_size".format(group) in info_dict and \
+          "super_{}_partition_list".format(group) in info_dict:
+        group_size = Expression(
+            "BOARD_{}_SIZE".format(group),
+            int(info_dict["super_{}_group_size".format(group)]))
+        self._CheckSumOfPartitionSizes(
+            group_size,
+            info_dict["super_{}_partition_list".format(group)].strip().split())
+
+    # Check sum(all group sizes) <= super partition (/ 2 for A/B devices
+    # launched with dynamic partitions)
+    if "super_partition_size" in info_dict:
+      group_size_list = [int(info_dict.get(
+          "super_{}_group_size".format(group), 0)) for group in groups]
+      sum_size = Expression("sum of sizes of {}".format(groups),
+                            "+".join(str(size) for size in group_size_list),
+                            sum(group_size_list))
+      max_size = Expression(
+          "BOARD_SUPER_PARTITION_SIZE{}".format(size_limit_suffix),
+          int(info_dict["super_partition_size"]) // num_slots)
+      sum_size.CheckLe(max_size)
+
+  def Run(self):
+    self._CheckAllPartitionSizes()
+    if self.info_dict.get("dynamic_partition_retrofit") == "true":
+      self._CheckSuperPartitionSize()
+
+
+def CheckPartitionSizes(inp):
+  if isinstance(inp, str):
+    info_dict = common.LoadDictionaryFromFile(inp)
+    return DynamicPartitionSizeChecker(info_dict).Run()
+  if isinstance(inp, dict):
+    return DynamicPartitionSizeChecker(inp).Run()
+  raise ValueError("{} is not a dictionary or a valid path".format(inp))
+
+
+def main(argv):
+  args = common.ParseOptions(argv, __doc__)
+  if len(args) != 1:
+    common.Usage(__doc__)
+    sys.exit(1)
+  common.InitLogging()
+  CheckPartitionSizes(args[0])
+
+
+if __name__ == "__main__":
+  try:
+    common.CloseInheritedPipes()
+    main(sys.argv[1:])
+  except common.ExternalError:
+    logger.exception("\n   ERROR:\n")
+    sys.exit(1)
+  finally:
+    common.Cleanup()
diff --git a/tools/releasetools/check_target_files_signatures.py b/tools/releasetools/check_target_files_signatures.py
index 4b0d4c7..6e02e4d 100755
--- a/tools/releasetools/check_target_files_signatures.py
+++ b/tools/releasetools/check_target_files_signatures.py
@@ -39,8 +39,11 @@
 
 """
 
+from __future__ import print_function
+
 import logging
 import os
+import os.path
 import re
 import subprocess
 import sys
@@ -49,7 +52,7 @@
 import common
 
 if sys.hexversion < 0x02070000:
-  print >> sys.stderr, "Python 2.7 or newer is required."
+  print("Python 2.7 or newer is required.", file=sys.stderr)
   sys.exit(1)
 
 
@@ -65,8 +68,10 @@
 class MyZipInfo(zipfile.ZipInfo):
   def _decodeExtra(self):
     pass
+
 zipfile.ZipInfo = MyZipInfo
 
+
 OPTIONS = common.OPTIONS
 
 OPTIONS.text = False
@@ -76,28 +81,34 @@
 PROBLEMS = []
 PROBLEM_PREFIX = []
 
+
 def AddProblem(msg):
   PROBLEMS.append(" ".join(PROBLEM_PREFIX) + " " + msg)
+
+
 def Push(msg):
   PROBLEM_PREFIX.append(msg)
+
+
 def Pop():
   PROBLEM_PREFIX.pop()
 
 
 def Banner(msg):
-  print "-" * 70
-  print "  ", msg
-  print "-" * 70
+  print("-" * 70)
+  print("  ", msg)
+  print("-" * 70)
 
 
 def GetCertSubject(cert):
   p = common.Run(["openssl", "x509", "-inform", "DER", "-text"],
                  stdin=subprocess.PIPE,
-                 stdout=subprocess.PIPE)
+                 stdout=subprocess.PIPE,
+                 universal_newlines=False)
   out, err = p.communicate(cert)
   if err and not err.strip():
     return "(error reading cert subject)"
-  for line in out.split("\n"):
+  for line in out.decode().split("\n"):
     line = line.strip()
     if line.startswith("Subject:"):
       return line[8:].strip()
@@ -105,22 +116,22 @@
 
 
 class CertDB(object):
+
   def __init__(self):
     self.certs = {}
 
-  def Add(self, cert, name=None):
-    if cert in self.certs:
+  def Add(self, cert_digest, subject, name=None):
+    if cert_digest in self.certs:
       if name:
-        self.certs[cert] = self.certs[cert] + "," + name
+        self.certs[cert_digest] = self.certs[cert_digest] + "," + name
     else:
       if name is None:
-        name = "unknown cert %s (%s)" % (common.sha1(cert).hexdigest()[:12],
-                                         GetCertSubject(cert))
-      self.certs[cert] = name
+        name = "unknown cert %s (%s)" % (cert_digest[:12], subject)
+      self.certs[cert_digest] = name
 
-  def Get(self, cert):
-    """Return the name for a given cert."""
-    return self.certs.get(cert, None)
+  def Get(self, cert_digest):
+    """Return the name for a given cert digest."""
+    return self.certs.get(cert_digest, None)
 
   def FindLocalCerts(self):
     to_load = []
@@ -132,12 +143,15 @@
           to_load.extend(certs)
 
     for i in to_load:
-      f = open(i)
-      cert = common.ParseCertificate(f.read())
-      f.close()
+      with open(i) as f:
+        cert = common.ParseCertificate(f.read())
       name, _ = os.path.splitext(i)
       name, _ = os.path.splitext(name)
-      self.Add(cert, name)
+
+      cert_sha1 = common.sha1(cert).hexdigest()
+      cert_subject = GetCertSubject(cert)
+      self.Add(cert_sha1, cert_subject, name)
+
 
 ALL_CERTS = CertDB()
 
@@ -152,13 +166,14 @@
                     "-outform", "PEM",
                     "-print_certs"],
                    stdin=subprocess.PIPE,
-                   stdout=subprocess.PIPE)
+                   stdout=subprocess.PIPE,
+                   universal_newlines=False)
     out, err = p.communicate(data)
     if err and not err.strip():
-      AddProblem("error reading cert:\n" + err)
+      AddProblem("error reading cert:\n" + err.decode())
       return None
 
-    cert = common.ParseCertificate(out)
+    cert = common.ParseCertificate(out.decode())
     if not cert:
       AddProblem("error parsing cert output")
       return None
@@ -171,7 +186,7 @@
 
   def __init__(self, full_filename, filename):
     self.filename = filename
-    self.certs = None
+    self.cert_digests = frozenset()
     self.shared_uid = None
     self.package = None
 
@@ -182,27 +197,71 @@
     finally:
       Pop()
 
-  def RecordCerts(self, full_filename):
-    out = set()
-    try:
-      f = open(full_filename)
-      apk = zipfile.ZipFile(f, "r")
-      pkcs7 = None
+  def ReadCertsDeprecated(self, full_filename):
+    print("reading certs in deprecated way for {}".format(full_filename))
+    cert_digests = set()
+    with zipfile.ZipFile(full_filename) as apk:
       for info in apk.infolist():
-        if info.filename.startswith("META-INF/") and \
-           (info.filename.endswith(".DSA") or info.filename.endswith(".RSA")):
-          pkcs7 = apk.read(info.filename)
-          cert = CertFromPKCS7(pkcs7, info.filename)
-          out.add(cert)
-          ALL_CERTS.Add(cert)
-      if not pkcs7:
-        AddProblem("no signature")
-    finally:
-      f.close()
-      self.certs = frozenset(out)
+        filename = info.filename
+        if (filename.startswith("META-INF/") and
+            info.filename.endswith((".DSA", ".RSA"))):
+          pkcs7 = apk.read(filename)
+          cert = CertFromPKCS7(pkcs7, filename)
+          if not cert:
+            continue
+          cert_sha1 = common.sha1(cert).hexdigest()
+          cert_subject = GetCertSubject(cert)
+          ALL_CERTS.Add(cert_sha1, cert_subject)
+          cert_digests.add(cert_sha1)
+    if not cert_digests:
+      AddProblem("No signature found")
+      return
+    self.cert_digests = frozenset(cert_digests)
+
+  def RecordCerts(self, full_filename):
+    """Parse and save the signature of an apk file."""
+
+    # Dump the cert info with apksigner
+    cmd = ["apksigner", "verify", "--print-certs", full_filename]
+    p = common.Run(cmd, stdout=subprocess.PIPE)
+    output, _ = p.communicate()
+    if p.returncode != 0:
+      self.ReadCertsDeprecated(full_filename)
+      return
+
+    # Sample output:
+    # Signer #1 certificate DN: ...
+    # Signer #1 certificate SHA-256 digest: ...
+    # Signer #1 certificate SHA-1 digest: ...
+    # ...
+    certs_info = {}
+    certificate_regex = re.compile(r"(Signer #[0-9]+) (certificate .*):(.*)")
+    for line in output.splitlines():
+      m = certificate_regex.match(line)
+      if not m:
+        continue
+      signer, key, val = m.group(1), m.group(2), m.group(3)
+      if certs_info.get(signer):
+        certs_info[signer].update({key.strip(): val.strip()})
+      else:
+        certs_info.update({signer: {key.strip(): val.strip()}})
+    if not certs_info:
+      AddProblem("Failed to parse cert info")
+      return
+
+    cert_digests = set()
+    for signer, props in certs_info.items():
+      subject = props.get("certificate DN")
+      digest = props.get("certificate SHA-1 digest")
+      if not subject or not digest:
+        AddProblem("Failed to parse cert subject or digest")
+        return
+      ALL_CERTS.Add(digest, subject)
+      cert_digests.add(digest)
+    self.cert_digests = frozenset(cert_digests)
 
   def ReadManifest(self, full_filename):
-    p = common.Run(["aapt", "dump", "xmltree", full_filename,
+    p = common.Run(["aapt2", "dump", "xmltree", full_filename, "--file",
                     "AndroidManifest.xml"],
                    stdout=subprocess.PIPE)
     manifest, err = p.communicate()
@@ -247,8 +306,8 @@
     # This is the list of wildcards of files we extract from |filename|.
     apk_extensions = ['*.apk', '*.apex']
 
-    self.certmap, compressed_extension = common.ReadApkCerts(
-        zipfile.ZipFile(filename))
+    with zipfile.ZipFile(filename) as input_zip:
+      self.certmap, compressed_extension = common.ReadApkCerts(input_zip)
     if compressed_extension:
       apk_extensions.append('*.apk' + compressed_extension)
 
@@ -287,7 +346,7 @@
     """Look for any instances where packages signed with different
     certs request the same sharedUserId."""
     apks_by_uid = {}
-    for apk in self.apks.itervalues():
+    for apk in self.apks.values():
       if apk.shared_uid:
         apks_by_uid.setdefault(apk.shared_uid, []).append(apk)
 
@@ -302,49 +361,54 @@
 
       AddProblem("different cert sets for packages with uid %s" % (uid,))
 
-      print "uid %s is shared by packages with different cert sets:" % (uid,)
+      print("uid %s is shared by packages with different cert sets:" % (uid,))
       for apk in apks:
-        print "%-*s  [%s]" % (self.max_pkg_len, apk.package, apk.filename)
-        for cert in apk.certs:
-          print "   ", ALL_CERTS.Get(cert)
-      print
+        print("%-*s  [%s]" % (self.max_pkg_len, apk.package, apk.filename))
+        for digest in apk.cert_digests:
+          print("   ", ALL_CERTS.Get(digest))
+      print()
 
   def CheckExternalSignatures(self):
-    for apk_filename, certname in self.certmap.iteritems():
+    for apk_filename, certname in self.certmap.items():
       if certname == "EXTERNAL":
         # Apps marked EXTERNAL should be signed with the test key
         # during development, then manually re-signed after
         # predexopting.  Consider it an error if this app is now
         # signed with any key that is present in our tree.
         apk = self.apks_by_basename[apk_filename]
-        name = ALL_CERTS.Get(apk.cert)
-        if not name.startswith("unknown "):
+        signed_with_external = False
+        for digest in apk.cert_digests:
+          name = ALL_CERTS.Get(digest)
+          if name and name.startswith("unknown "):
+            signed_with_external = True
+
+        if not signed_with_external:
           Push(apk.filename)
           AddProblem("hasn't been signed with EXTERNAL cert")
           Pop()
 
   def PrintCerts(self):
     """Display a table of packages grouped by cert."""
-    by_cert = {}
-    for apk in self.apks.itervalues():
-      for cert in apk.certs:
-        by_cert.setdefault(cert, []).append((apk.package, apk))
+    by_digest = {}
+    for apk in self.apks.values():
+      for digest in apk.cert_digests:
+        by_digest.setdefault(digest, []).append((apk.package, apk))
 
-    order = [(-len(v), k) for (k, v) in by_cert.iteritems()]
+    order = [(-len(v), k) for (k, v) in by_digest.items()]
     order.sort()
 
-    for _, cert in order:
-      print "%s:" % (ALL_CERTS.Get(cert),)
-      apks = by_cert[cert]
+    for _, digest in order:
+      print("%s:" % (ALL_CERTS.Get(digest),))
+      apks = by_digest[digest]
       apks.sort()
       for _, apk in apks:
         if apk.shared_uid:
-          print "  %-*s  %-*s  [%s]" % (self.max_fn_len, apk.filename,
+          print("  %-*s  %-*s  [%s]" % (self.max_fn_len, apk.filename,
                                         self.max_pkg_len, apk.package,
-                                        apk.shared_uid)
+                                        apk.shared_uid))
         else:
-          print "  %-*s  %s" % (self.max_fn_len, apk.filename, apk.package)
-      print
+          print("  %-*s  %s" % (self.max_fn_len, apk.filename, apk.package))
+      print()
 
   def CompareWith(self, other):
     """Look for instances where a given package that exists in both
@@ -355,46 +419,46 @@
 
     max_pkg_len = max(self.max_pkg_len, other.max_pkg_len)
 
-    by_certpair = {}
+    by_digestpair = {}
 
     for i in all_apks:
       if i in self.apks:
         if i in other.apks:
           # in both; should have same set of certs
-          if self.apks[i].certs != other.apks[i].certs:
-            by_certpair.setdefault((other.apks[i].certs,
-                                    self.apks[i].certs), []).append(i)
+          if self.apks[i].cert_digests != other.apks[i].cert_digests:
+            by_digestpair.setdefault((other.apks[i].cert_digests,
+                                      self.apks[i].cert_digests), []).append(i)
         else:
-          print "%s [%s]: new APK (not in comparison target_files)" % (
-              i, self.apks[i].filename)
+          print("%s [%s]: new APK (not in comparison target_files)" % (
+              i, self.apks[i].filename))
       else:
         if i in other.apks:
-          print "%s [%s]: removed APK (only in comparison target_files)" % (
-              i, other.apks[i].filename)
+          print("%s [%s]: removed APK (only in comparison target_files)" % (
+              i, other.apks[i].filename))
 
-    if by_certpair:
+    if by_digestpair:
       AddProblem("some APKs changed certs")
       Banner("APK signing differences")
-      for (old, new), packages in sorted(by_certpair.items()):
+      for (old, new), packages in sorted(by_digestpair.items()):
         for i, o in enumerate(old):
           if i == 0:
-            print "was", ALL_CERTS.Get(o)
+            print("was", ALL_CERTS.Get(o))
           else:
-            print "   ", ALL_CERTS.Get(o)
+            print("   ", ALL_CERTS.Get(o))
         for i, n in enumerate(new):
           if i == 0:
-            print "now", ALL_CERTS.Get(n)
+            print("now", ALL_CERTS.Get(n))
           else:
-            print "   ", ALL_CERTS.Get(n)
+            print("   ", ALL_CERTS.Get(n))
         for i in sorted(packages):
           old_fn = other.apks[i].filename
           new_fn = self.apks[i].filename
           if old_fn == new_fn:
-            print "  %-*s  [%s]" % (max_pkg_len, i, old_fn)
+            print("  %-*s  [%s]" % (max_pkg_len, i, old_fn))
           else:
-            print "  %-*s  [was: %s; now: %s]" % (max_pkg_len, i,
-                                                  old_fn, new_fn)
-        print
+            print("  %-*s  [was: %s; now: %s]" % (max_pkg_len, i,
+                                                  old_fn, new_fn))
+        print()
 
 
 def main(argv):
@@ -451,9 +515,9 @@
     target_files.CompareWith(compare_files)
 
   if PROBLEMS:
-    print "%d problem(s) found:\n" % (len(PROBLEMS),)
+    print("%d problem(s) found:\n" % (len(PROBLEMS),))
     for p in PROBLEMS:
-      print p
+      print(p)
     return 1
 
   return 0
@@ -464,9 +528,7 @@
     r = main(sys.argv[1:])
     sys.exit(r)
   except common.ExternalError as e:
-    print
-    print "   ERROR: %s" % (e,)
-    print
+    print("\n   ERROR: %s\n" % (e,))
     sys.exit(1)
   finally:
     common.Cleanup()
diff --git a/tools/releasetools/check_target_files_vintf.py b/tools/releasetools/check_target_files_vintf.py
new file mode 100755
index 0000000..95d09cc
--- /dev/null
+++ b/tools/releasetools/check_target_files_vintf.py
@@ -0,0 +1,241 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Check VINTF compatibility from a target files package.
+
+Usage: check_target_files_vintf target_files
+
+target_files can be a ZIP file or an extracted target files directory.
+"""
+
+import logging
+import subprocess
+import sys
+import os
+import zipfile
+
+import common
+
+logger = logging.getLogger(__name__)
+
+OPTIONS = common.OPTIONS
+
+# Keys are paths that VINTF searches. Must keep in sync with libvintf's search
+# paths (VintfObject.cpp).
+# These paths are stored in different directories in target files package, so
+# we have to search for the correct path and tell checkvintf to remap them.
+# Look for TARGET_COPY_OUT_* variables in board_config.mk for possible paths for
+# each partition.
+DIR_SEARCH_PATHS = {
+    '/system': ('SYSTEM',),
+    '/vendor': ('VENDOR', 'SYSTEM/vendor'),
+    '/product': ('PRODUCT', 'SYSTEM/product'),
+    '/odm': ('ODM', 'VENDOR/odm', 'SYSTEM/vendor/odm'),
+    '/system_ext': ('SYSTEM_EXT', 'SYSTEM/system_ext'),
+}
+
+UNZIP_PATTERN = ['META/*', '*/build.prop']
+
+
+def GetDirmap(input_tmp):
+  dirmap = {}
+  for device_path, target_files_rel_paths in DIR_SEARCH_PATHS.items():
+    for target_files_rel_path in target_files_rel_paths:
+      target_files_path = os.path.join(input_tmp, target_files_rel_path)
+      if os.path.isdir(target_files_path):
+        dirmap[device_path] = target_files_path
+        break
+    if device_path not in dirmap:
+      raise ValueError("Can't determine path for device path " + device_path +
+                       ". Searched the following:" +
+                       ("\n".join(target_files_rel_paths)))
+  return dirmap
+
+
+def GetArgsForSkus(info_dict):
+  odm_skus = info_dict.get('vintf_odm_manifest_skus', '').strip().split()
+  if info_dict.get('vintf_include_empty_odm_sku', '') == "true" or not odm_skus:
+    odm_skus += ['']
+
+  vendor_skus = info_dict.get('vintf_vendor_manifest_skus', '').strip().split()
+  if info_dict.get('vintf_include_empty_vendor_sku', '') == "true" or \
+      not vendor_skus:
+    vendor_skus += ['']
+
+  return [['--property', 'ro.boot.product.hardware.sku=' + odm_sku,
+           '--property', 'ro.boot.product.vendor.sku=' + vendor_sku]
+          for odm_sku in odm_skus for vendor_sku in vendor_skus]
+
+
+def GetArgsForShippingApiLevel(info_dict):
+  shipping_api_level = info_dict['vendor.build.prop'].GetProp(
+      'ro.product.first_api_level')
+  if not shipping_api_level:
+    logger.warning('Cannot determine ro.product.first_api_level')
+    return []
+  return ['--property', 'ro.product.first_api_level=' + shipping_api_level]
+
+
+def GetArgsForKernel(input_tmp):
+  version_path = os.path.join(input_tmp, 'META/kernel_version.txt')
+  config_path = os.path.join(input_tmp, 'META/kernel_configs.txt')
+
+  if not os.path.isfile(version_path) or not os.path.isfile(config_path):
+    logger.info('Skipping kernel config checks because '
+                'PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS is not set')
+    return []
+
+  with open(version_path) as f:
+    version = f.read().strip()
+
+  return ['--kernel', '{}:{}'.format(version, config_path)]
+
+
+def CheckVintfFromExtractedTargetFiles(input_tmp, info_dict=None):
+  """
+  Checks VINTF metadata of an extracted target files directory.
+
+  Args:
+    inp: path to the directory that contains the extracted target files archive.
+    info_dict: The build-time info dict. If None, it will be loaded from inp.
+
+  Returns:
+    True if VINTF check is skipped or compatible, False if incompatible. Raise
+    a RuntimeError if any error occurs.
+  """
+
+  if info_dict is None:
+    info_dict = common.LoadInfoDict(input_tmp)
+
+  if info_dict.get('vintf_enforce') != 'true':
+    logger.warning('PRODUCT_ENFORCE_VINTF_MANIFEST is not set, skipping checks')
+    return True
+
+  dirmap = GetDirmap(input_tmp)
+  args_for_skus = GetArgsForSkus(info_dict)
+  shipping_api_level_args = GetArgsForShippingApiLevel(info_dict)
+  kernel_args = GetArgsForKernel(input_tmp)
+
+  common_command = [
+      'checkvintf',
+      '--check-compat',
+  ]
+  for device_path, real_path in dirmap.items():
+    common_command += ['--dirmap', '{}:{}'.format(device_path, real_path)]
+  common_command += kernel_args
+  common_command += shipping_api_level_args
+
+  success = True
+  for sku_args in args_for_skus:
+    command = common_command + sku_args
+    proc = common.Run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    out, err = proc.communicate()
+    if proc.returncode == 0:
+      logger.info("Command `%s` returns 'compatible'", ' '.join(command))
+    elif out.strip() == "INCOMPATIBLE":
+      logger.info("Command `%s` returns 'incompatible'", ' '.join(command))
+      success = False
+    else:
+      raise common.ExternalError(
+          "Failed to run command '{}' (exit code {}):\nstdout:{}\nstderr:{}"
+          .format(' '.join(command), proc.returncode, out, err))
+    logger.info("stdout: %s", out)
+    logger.info("stderr: %s", err)
+
+  return success
+
+
+def GetVintfFileList():
+  """
+  Returns a list of VINTF metadata files that should be read from a target files
+  package before executing checkvintf.
+  """
+  def PathToPatterns(path):
+    if path[-1] == '/':
+      path += '*'
+    for device_path, target_files_rel_paths in DIR_SEARCH_PATHS.items():
+      if path.startswith(device_path):
+        suffix = path[len(device_path):]
+        return [rel_path + suffix for rel_path in target_files_rel_paths]
+    raise RuntimeError('Unrecognized path from checkvintf --dump-file-list: ' +
+                       path)
+
+  out = common.RunAndCheckOutput(['checkvintf', '--dump-file-list'])
+  paths = out.strip().split('\n')
+  paths = sum((PathToPatterns(path) for path in paths if path), [])
+  return paths
+
+
+def CheckVintfFromTargetFiles(inp, info_dict=None):
+  """
+  Checks VINTF metadata of a target files zip.
+
+  Args:
+    inp: path to the target files archive.
+    info_dict: The build-time info dict. If None, it will be loaded from inp.
+
+  Returns:
+    True if VINTF check is skipped or compatible, False if incompatible. Raise
+    a RuntimeError if any error occurs.
+  """
+  input_tmp = common.UnzipTemp(inp, GetVintfFileList() + UNZIP_PATTERN)
+  return CheckVintfFromExtractedTargetFiles(input_tmp, info_dict)
+
+
+def CheckVintf(inp, info_dict=None):
+  """
+  Checks VINTF metadata of a target files zip or extracted target files
+  directory.
+
+  Args:
+    inp: path to the (possibly extracted) target files archive.
+    info_dict: The build-time info dict. If None, it will be loaded from inp.
+
+  Returns:
+    True if VINTF check is skipped or compatible, False if incompatible. Raise
+    a RuntimeError if any error occurs.
+  """
+  if os.path.isdir(inp):
+    logger.info('Checking VINTF compatibility extracted target files...')
+    return CheckVintfFromExtractedTargetFiles(inp, info_dict)
+
+  if zipfile.is_zipfile(inp):
+    logger.info('Checking VINTF compatibility target files...')
+    return CheckVintfFromTargetFiles(inp, info_dict)
+
+  raise ValueError('{} is not a valid directory or zip file'.format(inp))
+
+
+def main(argv):
+  args = common.ParseOptions(argv, __doc__)
+  if len(args) != 1:
+    common.Usage(__doc__)
+    sys.exit(1)
+  common.InitLogging()
+  if not CheckVintf(args[0]):
+    sys.exit(1)
+
+
+if __name__ == '__main__':
+  try:
+    common.CloseInheritedPipes()
+    main(sys.argv[1:])
+  except common.ExternalError:
+    logger.exception('\n   ERROR:\n')
+    sys.exit(1)
+  finally:
+    common.Cleanup()
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 9a27ad3..ae7da2f 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -14,6 +14,7 @@
 
 from __future__ import print_function
 
+import base64
 import collections
 import copy
 import errno
@@ -30,7 +31,6 @@
 import re
 import shlex
 import shutil
-import string
 import subprocess
 import sys
 import tempfile
@@ -39,32 +39,37 @@
 import zipfile
 from hashlib import sha1, sha256
 
-import blockimgdiff
+import images
 import sparse_img
+from blockimgdiff import BlockImageDiff
 
 logger = logging.getLogger(__name__)
 
 
 class Options(object):
+
   def __init__(self):
-    base_out_path = os.getenv('OUT_DIR_COMMON_BASE')
-    if base_out_path is None:
-      base_search_path = "out"
-    else:
-      base_search_path = os.path.join(base_out_path,
-                                      os.path.basename(os.getcwd()))
+    # Set up search path, in order to find framework/ and lib64/. At the time of
+    # running this function, user-supplied search path (`--path`) hasn't been
+    # available. So the value set here is the default, which might be overridden
+    # by commandline flag later.
+    exec_path = sys.argv[0]
+    if exec_path.endswith('.py'):
+      script_name = os.path.basename(exec_path)
+      # logger hasn't been initialized yet at this point. Use print to output
+      # warnings.
+      print(
+          'Warning: releasetools script should be invoked as hermetic Python '
+          'executable -- build and run `{}` directly.'.format(script_name[:-3]),
+          file=sys.stderr)
+    self.search_path = os.path.realpath(os.path.join(os.path.dirname(exec_path), '..'))
 
-    platform_search_path = {
-        "linux2": os.path.join(base_search_path, "host/linux-x86"),
-        "darwin": os.path.join(base_search_path, "host/darwin-x86"),
-    }
-
-    self.search_path = platform_search_path.get(sys.platform)
     self.signapk_path = "framework/signapk.jar"  # Relative to search_path
     self.signapk_shared_library_path = "lib64"   # Relative to search_path
     self.extra_signapk_args = []
     self.java_path = "java"  # Use the one on the path by default.
     self.java_args = ["-Xmx2048m"]  # The default JVM args.
+    self.android_jar_path = None
     self.public_key_suffix = ".x509.pem"
     self.private_key_suffix = ".pk8"
     # use otatools built boot_signer by default
@@ -72,6 +77,10 @@
     self.boot_signer_args = []
     self.verity_signer_path = None
     self.verity_signer_args = []
+    self.aftl_server = None
+    self.aftl_key_path = None
+    self.aftl_manufacturer_key_path = None
+    self.aftl_signer_helper = None
     self.verbose = False
     self.tempfiles = []
     self.device_specific = None
@@ -83,6 +92,7 @@
     # Stash size cannot exceed cache_size * threshold.
     self.cache_size = None
     self.stash_threshold = 0.8
+    self.logfile = None
 
 
 OPTIONS = Options()
@@ -93,16 +103,17 @@
 # Values for "certificate" in apkcerts that mean special things.
 SPECIAL_CERT_STRINGS = ("PRESIGNED", "EXTERNAL")
 
-# The partitions allowed to be signed by AVB (Android verified boot 2.0).
-AVB_PARTITIONS = ('boot', 'recovery', 'system', 'vendor', 'product',
-                  'product_services', 'dtbo', 'odm')
+# The partitions allowed to be signed by AVB (Android Verified Boot 2.0). Note
+# that system_other is not in the list because we don't want to include its
+# descriptor into vbmeta.img.
+AVB_PARTITIONS = ('boot', 'dtbo', 'odm', 'product', 'recovery', 'system',
+                  'system_ext', 'vendor', 'vendor_boot')
 
 # Chained VBMeta partitions.
 AVB_VBMETA_PARTITIONS = ('vbmeta_system', 'vbmeta_vendor')
 
 # Partitions that should have their care_map added to META/care_map.pb
-PARTITIONS_WITH_CARE_MAP = ('system', 'vendor', 'product', 'product_services',
-                            'odm')
+PARTITIONS_WITH_CARE_MAP = ('system', 'vendor', 'product', 'system_ext', 'odm')
 
 
 class ErrorCode(object):
@@ -153,13 +164,14 @@
           'default': {
               'class': 'logging.StreamHandler',
               'formatter': 'standard',
+              'level': 'WARNING',
           },
       },
       'loggers': {
           '': {
               'handlers': ['default'],
-              'level': 'WARNING',
               'propagate': True,
+              'level': 'INFO',
           }
       }
   }
@@ -172,8 +184,19 @@
 
     # Increase the logging level for verbose mode.
     if OPTIONS.verbose:
-      config = copy.deepcopy(DEFAULT_LOGGING_CONFIG)
-      config['loggers']['']['level'] = 'INFO'
+      config = copy.deepcopy(config)
+      config['handlers']['default']['level'] = 'INFO'
+
+    if OPTIONS.logfile:
+      config = copy.deepcopy(config)
+      config['handlers']['logfile'] = {
+        'class': 'logging.FileHandler',
+        'formatter': 'standard',
+        'level': 'INFO',
+        'mode': 'w',
+        'filename': OPTIONS.logfile,
+      }
+      config['loggers']['']['handlers'].append('logfile')
 
   logging.config.dictConfig(config)
 
@@ -188,6 +211,8 @@
     kwargs: Any additional args to be passed to subprocess.Popen(), such as env,
         stdin, etc. stdout and stderr will default to subprocess.PIPE and
         subprocess.STDOUT respectively unless caller specifies any of them.
+        universal_newlines will default to True, as most of the users in
+        releasetools expect string output.
 
   Returns:
     A subprocess.Popen object.
@@ -195,6 +220,8 @@
   if 'stdout' not in kwargs and 'stderr' not in kwargs:
     kwargs['stdout'] = subprocess.PIPE
     kwargs['stderr'] = subprocess.STDOUT
+  if 'universal_newlines' not in kwargs:
+    kwargs['universal_newlines'] = True
   # Don't log any if caller explicitly says so.
   if verbose != False:
     logger.info("  Running: \"%s\"", " ".join(args))
@@ -243,6 +270,8 @@
   """
   proc = Run(args, verbose=verbose, **kwargs)
   output, _ = proc.communicate()
+  if output is None:
+    output = ""
   # Don't log any if caller explicitly says so.
   if verbose != False:
     logger.info("%s", output.rstrip())
@@ -274,6 +303,289 @@
       pass
 
 
+class BuildInfo(object):
+  """A class that holds the information for a given build.
+
+  This class wraps up the property querying for a given source or target build.
+  It abstracts away the logic of handling OEM-specific properties, and caches
+  the commonly used properties such as fingerprint.
+
+  There are two types of info dicts: a) build-time info dict, which is generated
+  at build time (i.e. included in a target_files zip); b) OEM info dict that is
+  specified at package generation time (via command line argument
+  '--oem_settings'). If a build doesn't use OEM-specific properties (i.e. not
+  having "oem_fingerprint_properties" in build-time info dict), all the queries
+  would be answered based on build-time info dict only. Otherwise if using
+  OEM-specific properties, some of them will be calculated from two info dicts.
+
+  Users can query properties similarly as using a dict() (e.g. info['fstab']),
+  or to query build properties via GetBuildProp() or GetPartitionBuildProp().
+
+  Attributes:
+    info_dict: The build-time info dict.
+    is_ab: Whether it's a build that uses A/B OTA.
+    oem_dicts: A list of OEM dicts.
+    oem_props: A list of OEM properties that should be read from OEM dicts; None
+        if the build doesn't use any OEM-specific property.
+    fingerprint: The fingerprint of the build, which would be calculated based
+        on OEM properties if applicable.
+    device: The device name, which could come from OEM dicts if applicable.
+  """
+
+  _RO_PRODUCT_RESOLVE_PROPS = ["ro.product.brand", "ro.product.device",
+                               "ro.product.manufacturer", "ro.product.model",
+                               "ro.product.name"]
+  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_CURRENT = [
+      "product", "odm", "vendor", "system_ext", "system"]
+  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_ANDROID_10 = [
+      "product", "product_services", "odm", "vendor", "system"]
+  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_LEGACY = []
+
+  def __init__(self, info_dict, oem_dicts=None):
+    """Initializes a BuildInfo instance with the given dicts.
+
+    Note that it only wraps up the given dicts, without making copies.
+
+    Arguments:
+      info_dict: The build-time info dict.
+      oem_dicts: A list of OEM dicts (which is parsed from --oem_settings). Note
+          that it always uses the first dict to calculate the fingerprint or the
+          device name. The rest would be used for asserting OEM properties only
+          (e.g. one package can be installed on one of these devices).
+
+    Raises:
+      ValueError: On invalid inputs.
+    """
+    self.info_dict = info_dict
+    self.oem_dicts = oem_dicts
+
+    self._is_ab = info_dict.get("ab_update") == "true"
+
+    # Skip _oem_props if oem_dicts is None to use BuildInfo in
+    # sign_target_files_apks
+    if self.oem_dicts:
+      self._oem_props = info_dict.get("oem_fingerprint_properties")
+    else:
+      self._oem_props = None
+
+    def check_fingerprint(fingerprint):
+      if (" " in fingerprint or any(ord(ch) > 127 for ch in fingerprint)):
+        raise ValueError(
+            'Invalid build fingerprint: "{}". See the requirement in Android CDD '
+            "3.2.2. Build Parameters.".format(fingerprint))
+
+
+    self._partition_fingerprints = {}
+    for partition in PARTITIONS_WITH_CARE_MAP:
+      try:
+        fingerprint = self.CalculatePartitionFingerprint(partition)
+        check_fingerprint(fingerprint)
+        self._partition_fingerprints[partition] = fingerprint
+      except ExternalError:
+        continue
+    if "system" in self._partition_fingerprints:
+      # system_other is not included in PARTITIONS_WITH_CARE_MAP, but does
+      # need a fingerprint when creating the image.
+      self._partition_fingerprints[
+          "system_other"] = self._partition_fingerprints["system"]
+
+    # These two should be computed only after setting self._oem_props.
+    self._device = self.GetOemProperty("ro.product.device")
+    self._fingerprint = self.CalculateFingerprint()
+    check_fingerprint(self._fingerprint)
+
+  @property
+  def is_ab(self):
+    return self._is_ab
+
+  @property
+  def device(self):
+    return self._device
+
+  @property
+  def fingerprint(self):
+    return self._fingerprint
+
+  @property
+  def oem_props(self):
+    return self._oem_props
+
+  def __getitem__(self, key):
+    return self.info_dict[key]
+
+  def __setitem__(self, key, value):
+    self.info_dict[key] = value
+
+  def get(self, key, default=None):
+    return self.info_dict.get(key, default)
+
+  def items(self):
+    return self.info_dict.items()
+
+  def _GetRawBuildProp(self, prop, partition):
+    prop_file = '{}.build.prop'.format(
+        partition) if partition else 'build.prop'
+    partition_props = self.info_dict.get(prop_file)
+    if not partition_props:
+      return None
+    return partition_props.GetProp(prop)
+
+  def GetPartitionBuildProp(self, prop, partition):
+    """Returns the inquired build property for the provided partition."""
+    # If provided a partition for this property, only look within that
+    # partition's build.prop.
+    if prop in BuildInfo._RO_PRODUCT_RESOLVE_PROPS:
+      prop = prop.replace("ro.product", "ro.product.{}".format(partition))
+    else:
+      prop = prop.replace("ro.", "ro.{}.".format(partition))
+
+    prop_val = self._GetRawBuildProp(prop, partition)
+    if prop_val is not None:
+      return prop_val
+    raise ExternalError("couldn't find %s in %s.build.prop" %
+                        (prop, partition))
+
+  def GetBuildProp(self, prop):
+    """Returns the inquired build property from the standard build.prop file."""
+    if prop in BuildInfo._RO_PRODUCT_RESOLVE_PROPS:
+      return self._ResolveRoProductBuildProp(prop)
+
+    prop_val = self._GetRawBuildProp(prop, None)
+    if prop_val is not None:
+      return prop_val
+
+    raise ExternalError("couldn't find %s in build.prop" % (prop,))
+
+  def _ResolveRoProductBuildProp(self, prop):
+    """Resolves the inquired ro.product.* build property"""
+    prop_val = self._GetRawBuildProp(prop, None)
+    if prop_val:
+      return prop_val
+
+    default_source_order = self._GetRoProductPropsDefaultSourceOrder()
+    source_order_val = self._GetRawBuildProp(
+        "ro.product.property_source_order", None)
+    if source_order_val:
+      source_order = source_order_val.split(",")
+    else:
+      source_order = default_source_order
+
+    # Check that all sources in ro.product.property_source_order are valid
+    if any([x not in default_source_order for x in source_order]):
+      raise ExternalError(
+          "Invalid ro.product.property_source_order '{}'".format(source_order))
+
+    for source_partition in source_order:
+      source_prop = prop.replace(
+          "ro.product", "ro.product.{}".format(source_partition), 1)
+      prop_val = self._GetRawBuildProp(source_prop, source_partition)
+      if prop_val:
+        return prop_val
+
+    raise ExternalError("couldn't resolve {}".format(prop))
+
+  def _GetRoProductPropsDefaultSourceOrder(self):
+    # NOTE: refer to CDDs and android.os.Build.VERSION for the definition and
+    # values of these properties for each Android release.
+    android_codename = self._GetRawBuildProp("ro.build.version.codename", None)
+    if android_codename == "REL":
+      android_version = self._GetRawBuildProp("ro.build.version.release", None)
+      if android_version == "10":
+        return BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_ANDROID_10
+      # NOTE: float() conversion of android_version will have rounding error.
+      # We are checking for "9" or less, and using "< 10" is well outside of
+      # possible floating point rounding.
+      try:
+        android_version_val = float(android_version)
+      except ValueError:
+        android_version_val = 0
+      if android_version_val < 10:
+        return BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_LEGACY
+    return BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_CURRENT
+
+  def GetOemProperty(self, key):
+    if self.oem_props is not None and key in self.oem_props:
+      return self.oem_dicts[0][key]
+    return self.GetBuildProp(key)
+
+  def GetPartitionFingerprint(self, partition):
+    return self._partition_fingerprints.get(partition, None)
+
+  def CalculatePartitionFingerprint(self, partition):
+    try:
+      return self.GetPartitionBuildProp("ro.build.fingerprint", partition)
+    except ExternalError:
+      return "{}/{}/{}:{}/{}/{}:{}/{}".format(
+          self.GetPartitionBuildProp("ro.product.brand", partition),
+          self.GetPartitionBuildProp("ro.product.name", partition),
+          self.GetPartitionBuildProp("ro.product.device", partition),
+          self.GetPartitionBuildProp("ro.build.version.release", partition),
+          self.GetPartitionBuildProp("ro.build.id", partition),
+          self.GetPartitionBuildProp("ro.build.version.incremental", partition),
+          self.GetPartitionBuildProp("ro.build.type", partition),
+          self.GetPartitionBuildProp("ro.build.tags", partition))
+
+  def CalculateFingerprint(self):
+    if self.oem_props is None:
+      try:
+        return self.GetBuildProp("ro.build.fingerprint")
+      except ExternalError:
+        return "{}/{}/{}:{}/{}/{}:{}/{}".format(
+            self.GetBuildProp("ro.product.brand"),
+            self.GetBuildProp("ro.product.name"),
+            self.GetBuildProp("ro.product.device"),
+            self.GetBuildProp("ro.build.version.release"),
+            self.GetBuildProp("ro.build.id"),
+            self.GetBuildProp("ro.build.version.incremental"),
+            self.GetBuildProp("ro.build.type"),
+            self.GetBuildProp("ro.build.tags"))
+    return "%s/%s/%s:%s" % (
+        self.GetOemProperty("ro.product.brand"),
+        self.GetOemProperty("ro.product.name"),
+        self.GetOemProperty("ro.product.device"),
+        self.GetBuildProp("ro.build.thumbprint"))
+
+  def WriteMountOemScript(self, script):
+    assert self.oem_props is not None
+    recovery_mount_options = self.info_dict.get("recovery_mount_options")
+    script.Mount("/oem", recovery_mount_options)
+
+  def WriteDeviceAssertions(self, script, oem_no_mount):
+    # Read the property directly if not using OEM properties.
+    if not self.oem_props:
+      script.AssertDevice(self.device)
+      return
+
+    # Otherwise assert OEM properties.
+    if not self.oem_dicts:
+      raise ExternalError(
+          "No OEM file provided to answer expected assertions")
+
+    for prop in self.oem_props.split():
+      values = []
+      for oem_dict in self.oem_dicts:
+        if prop in oem_dict:
+          values.append(oem_dict[prop])
+      if not values:
+        raise ExternalError(
+            "The OEM file is missing the property %s" % (prop,))
+      script.AssertOemProperty(prop, values, oem_no_mount)
+
+
+def ReadFromInputFile(input_file, fn):
+  """Reads the contents of fn from input zipfile or directory."""
+  if isinstance(input_file, zipfile.ZipFile):
+    return input_file.read(fn).decode()
+  else:
+    path = os.path.join(input_file, *fn.split("/"))
+    try:
+      with open(path) as f:
+        return f.read()
+    except IOError as e:
+      if e.errno == errno.ENOENT:
+        raise KeyError(fn)
+
+
 def LoadInfoDict(input_file, repacking=False):
   """Loads the key/value pairs from the given input target_files.
 
@@ -311,16 +623,7 @@
         "input_file must be a path str when doing repacking"
 
   def read_helper(fn):
-    if isinstance(input_file, zipfile.ZipFile):
-      return input_file.read(fn)
-    else:
-      path = os.path.join(input_file, *fn.split("/"))
-      try:
-        with open(path) as f:
-          return f.read()
-      except IOError as e:
-        if e.errno == errno.ENOENT:
-          raise KeyError(fn)
+    return ReadFromInputFile(input_file, fn)
 
   try:
     d = LoadDictionaryFromLines(read_helper("META/misc_info.txt").split("\n"))
@@ -333,41 +636,34 @@
     raise ValueError("Failed to find 'fstab_version'")
 
   if repacking:
-    # We carry a copy of file_contexts.bin under META/. If not available, search
-    # BOOT/RAMDISK/. Note that sometimes we may need a different file to build
-    # images than the one running on device, in that case, we must have the one
-    # for image generation copied to META/.
-    fc_basename = os.path.basename(d.get("selinux_fc", "file_contexts"))
-    fc_config = os.path.join(input_file, "META", fc_basename)
-    assert os.path.exists(fc_config)
+    # "selinux_fc" properties should point to the file_contexts files
+    # (file_contexts.bin) under META/.
+    for key in d:
+      if key.endswith("selinux_fc"):
+        fc_basename = os.path.basename(d[key])
+        fc_config = os.path.join(input_file, "META", fc_basename)
+        assert os.path.exists(fc_config)
 
-    d["selinux_fc"] = fc_config
+        d[key] = fc_config
 
     # Similarly we need to redirect "root_dir", and "root_fs_config".
     d["root_dir"] = os.path.join(input_file, "ROOT")
     d["root_fs_config"] = os.path.join(
         input_file, "META", "root_filesystem_config.txt")
 
-    # Redirect {system,vendor}_base_fs_file.
-    if "system_base_fs_file" in d:
-      basename = os.path.basename(d["system_base_fs_file"])
-      system_base_fs_file = os.path.join(input_file, "META", basename)
-      if os.path.exists(system_base_fs_file):
-        d["system_base_fs_file"] = system_base_fs_file
+    # Redirect {partition}_base_fs_file for each of the named partitions.
+    for part_name in ["system", "vendor", "system_ext", "product", "odm"]:
+      key_name = part_name + "_base_fs_file"
+      if key_name not in d:
+        continue
+      basename = os.path.basename(d[key_name])
+      base_fs_file = os.path.join(input_file, "META", basename)
+      if os.path.exists(base_fs_file):
+        d[key_name] = base_fs_file
       else:
         logger.warning(
-            "Failed to find system base fs file: %s", system_base_fs_file)
-        del d["system_base_fs_file"]
-
-    if "vendor_base_fs_file" in d:
-      basename = os.path.basename(d["vendor_base_fs_file"])
-      vendor_base_fs_file = os.path.join(input_file, "META", basename)
-      if os.path.exists(vendor_base_fs_file):
-        d["vendor_base_fs_file"] = vendor_base_fs_file
-      else:
-        logger.warning(
-            "Failed to find vendor base fs file: %s", vendor_base_fs_file)
-        del d["vendor_base_fs_file"]
+            "Failed to find %s base fs file: %s", part_name, base_fs_file)
+        del d[key_name]
 
   def makeint(key):
     if key in d:
@@ -380,77 +676,45 @@
   makeint("userdata_size")
   makeint("cache_size")
   makeint("recovery_size")
-  makeint("boot_size")
   makeint("fstab_version")
 
-  # We changed recovery.fstab path in Q, from ../RAMDISK/etc/recovery.fstab to
-  # ../RAMDISK/system/etc/recovery.fstab. LoadInfoDict() has to handle both
-  # cases, since it may load the info_dict from an old build (e.g. when
-  # generating incremental OTAs from that build).
-  system_root_image = d.get("system_root_image") == "true"
-  if d.get("no_recovery") != "true":
-    recovery_fstab_path = "RECOVERY/RAMDISK/system/etc/recovery.fstab"
-    if isinstance(input_file, zipfile.ZipFile):
-      if recovery_fstab_path not in input_file.namelist():
-        recovery_fstab_path = "RECOVERY/RAMDISK/etc/recovery.fstab"
-    else:
-      path = os.path.join(input_file, *recovery_fstab_path.split("/"))
-      if not os.path.exists(path):
-        recovery_fstab_path = "RECOVERY/RAMDISK/etc/recovery.fstab"
-    d["fstab"] = LoadRecoveryFSTab(
-        read_helper, d["fstab_version"], recovery_fstab_path, system_root_image)
+  boot_images = "boot.img"
+  if "boot_images" in d:
+    boot_images = d["boot_images"]
+  for b in boot_images.split():
+    makeint(b.replace(".img","_size"))
 
-  elif d.get("recovery_as_boot") == "true":
-    recovery_fstab_path = "BOOT/RAMDISK/system/etc/recovery.fstab"
-    if isinstance(input_file, zipfile.ZipFile):
-      if recovery_fstab_path not in input_file.namelist():
-        recovery_fstab_path = "BOOT/RAMDISK/etc/recovery.fstab"
-    else:
-      path = os.path.join(input_file, *recovery_fstab_path.split("/"))
-      if not os.path.exists(path):
-        recovery_fstab_path = "BOOT/RAMDISK/etc/recovery.fstab"
-    d["fstab"] = LoadRecoveryFSTab(
-        read_helper, d["fstab_version"], recovery_fstab_path, system_root_image)
-
-  else:
-    d["fstab"] = None
+  # Load recovery fstab if applicable.
+  d["fstab"] = _FindAndLoadRecoveryFstab(d, input_file, read_helper)
 
   # Tries to load the build props for all partitions with care_map, including
   # system and vendor.
   for partition in PARTITIONS_WITH_CARE_MAP:
     partition_prop = "{}.build.prop".format(partition)
-    d[partition_prop] = LoadBuildProp(
-        read_helper, "{}/build.prop".format(partition.upper()))
-    # Some partition might use /<partition>/etc/build.prop as the new path.
-    # TODO: try new path first when majority of them switch to the new path.
-    if not d[partition_prop]:
-      d[partition_prop] = LoadBuildProp(
-          read_helper, "{}/etc/build.prop".format(partition.upper()))
+    d[partition_prop] = PartitionBuildProps.FromInputFile(
+        input_file, partition)
   d["build.prop"] = d["system.build.prop"]
 
-  # Set up the salt (based on fingerprint or thumbprint) that will be used when
-  # adding AVB footer.
+  # Set up the salt (based on fingerprint) that will be used when adding AVB
+  # hash / hashtree footers.
   if d.get("avb_enable") == "true":
-    fp = None
-    if "build.prop" in d:
-      build_prop = d["build.prop"]
-      if "ro.build.fingerprint" in build_prop:
-        fp = build_prop["ro.build.fingerprint"]
-      elif "ro.build.thumbprint" in build_prop:
-        fp = build_prop["ro.build.thumbprint"]
-    if fp:
-      d["avb_salt"] = sha256(fp).hexdigest()
+    build_info = BuildInfo(d)
+    for partition in PARTITIONS_WITH_CARE_MAP:
+      fingerprint = build_info.GetPartitionFingerprint(partition)
+      if fingerprint:
+        d["avb_{}_salt".format(partition)] = sha256(fingerprint).hexdigest()
 
   return d
 
 
-def LoadBuildProp(read_helper, prop_file):
-  try:
-    data = read_helper(prop_file)
-  except KeyError:
-    logger.warning("Failed to read %s", prop_file)
-    data = ""
-  return LoadDictionaryFromLines(data.split("\n"))
+def LoadListFromFile(file_path):
+  with open(file_path) as f:
+    return f.read().splitlines()
+
+
+def LoadDictionaryFromFile(file_path):
+  lines = LoadListFromFile(file_path)
+  return LoadDictionaryFromLines(lines)
 
 
 def LoadDictionaryFromLines(lines):
@@ -465,15 +729,131 @@
   return d
 
 
+class PartitionBuildProps(object):
+  """The class holds the build prop of a particular partition.
+
+  This class loads the build.prop and holds the build properties for a given
+  partition. It also partially recognizes the 'import' statement in the
+  build.prop; and calculates alternative values of some specific build
+  properties during runtime.
+
+  Attributes:
+    input_file: a zipped target-file or an unzipped target-file directory.
+    partition: name of the partition.
+    props_allow_override: a list of build properties to search for the
+        alternative values during runtime.
+    build_props: a dict of build properties for the given partition.
+    prop_overrides: a set of props that are overridden by import.
+    placeholder_values: A dict of runtime variables' values to replace the
+        placeholders in the build.prop file. We expect exactly one value for
+        each of the variables.
+  """
+  def __init__(self, input_file, name, placeholder_values=None):
+    self.input_file = input_file
+    self.partition = name
+    self.props_allow_override = [props.format(name) for props in [
+        'ro.product.{}.brand', 'ro.product.{}.name', 'ro.product.{}.device']]
+    self.build_props = {}
+    self.prop_overrides = set()
+    self.placeholder_values = {}
+    if placeholder_values:
+      self.placeholder_values = copy.deepcopy(placeholder_values)
+
+  @staticmethod
+  def FromDictionary(name, build_props):
+    """Constructs an instance from a build prop dictionary."""
+
+    props = PartitionBuildProps("unknown", name)
+    props.build_props = build_props.copy()
+    return props
+
+  @staticmethod
+  def FromInputFile(input_file, name, placeholder_values=None):
+    """Loads the build.prop file and builds the attributes."""
+    data = ''
+    for prop_file in ['{}/etc/build.prop'.format(name.upper()),
+                      '{}/build.prop'.format(name.upper())]:
+      try:
+        data = ReadFromInputFile(input_file, prop_file)
+        break
+      except KeyError:
+        logger.warning('Failed to read %s', prop_file)
+
+    props = PartitionBuildProps(input_file, name, placeholder_values)
+    props._LoadBuildProp(data)
+    return props
+
+  def _LoadBuildProp(self, data):
+    for line in data.split('\n'):
+      line = line.strip()
+      if not line or line.startswith("#"):
+        continue
+      if line.startswith("import"):
+        overrides = self._ImportParser(line)
+        duplicates = self.prop_overrides.intersection(overrides.keys())
+        if duplicates:
+          raise ValueError('prop {} is overridden multiple times'.format(
+              ','.join(duplicates)))
+        self.prop_overrides = self.prop_overrides.union(overrides.keys())
+        self.build_props.update(overrides)
+      elif "=" in line:
+        name, value = line.split("=", 1)
+        if name in self.prop_overrides:
+          raise ValueError('prop {} is set again after overridden by import '
+                           'statement'.format(name))
+        self.build_props[name] = value
+
+  def _ImportParser(self, line):
+    """Parses the build prop in a given import statement."""
+
+    tokens = line.split()
+    if tokens[0] != 'import' or (len(tokens) != 2 and len(tokens) != 3) :
+      raise ValueError('Unrecognized import statement {}'.format(line))
+
+    if len(tokens) == 3:
+      logger.info("Import %s from %s, skip", tokens[2], tokens[1])
+      return {}
+
+    import_path = tokens[1]
+    if not re.match(r'^/{}/.*\.prop$'.format(self.partition), import_path):
+      raise ValueError('Unrecognized import path {}'.format(line))
+
+    # We only recognize a subset of import statement that the init process
+    # supports. And we can loose the restriction based on how the dynamic
+    # fingerprint is used in practice. The placeholder format should be
+    # ${placeholder}, and its value should be provided by the caller through
+    # the placeholder_values.
+    for prop, value in self.placeholder_values.items():
+      prop_place_holder = '${{{}}}'.format(prop)
+      if prop_place_holder in import_path:
+        import_path = import_path.replace(prop_place_holder, value)
+    if '$' in import_path:
+      logger.info('Unresolved place holder in import path %s', import_path)
+      return {}
+
+    import_path = import_path.replace('/{}'.format(self.partition),
+                                      self.partition.upper())
+    logger.info('Parsing build props override from %s', import_path)
+
+    lines = ReadFromInputFile(self.input_file, import_path).split('\n')
+    d = LoadDictionaryFromLines(lines)
+    return {key: val for key, val in d.items()
+            if key in self.props_allow_override}
+
+  def GetProp(self, prop):
+    return self.build_props.get(prop)
+
+
 def LoadRecoveryFSTab(read_helper, fstab_version, recovery_fstab_path,
                       system_root_image=False):
   class Partition(object):
-    def __init__(self, mount_point, fs_type, device, length, context):
+    def __init__(self, mount_point, fs_type, device, length, context, slotselect):
       self.mount_point = mount_point
       self.fs_type = fs_type
       self.device = device
       self.length = length
       self.context = context
+      self.slotselect = slotselect
 
   try:
     data = read_helper(recovery_fstab_path)
@@ -501,10 +881,13 @@
 
     # It's a good line, parse it.
     length = 0
+    slotselect = False
     options = options.split(",")
     for i in options:
       if i.startswith("length="):
         length = int(i[7:])
+      elif i == "slotselect":
+        slotselect = True
       else:
         # Ignore all unknown options in the unified fstab.
         continue
@@ -518,26 +901,116 @@
 
     mount_point = pieces[1]
     d[mount_point] = Partition(mount_point=mount_point, fs_type=pieces[2],
-                               device=pieces[0], length=length, context=context)
+                               device=pieces[0], length=length, context=context,
+                               slotselect=slotselect)
 
   # / is used for the system mount point when the root directory is included in
   # system. Other areas assume system is always at "/system" so point /system
   # at /.
   if system_root_image:
-    assert not d.has_key("/system") and d.has_key("/")
+    assert '/system' not in d and '/' in d
     d["/system"] = d["/"]
   return d
 
 
+def _FindAndLoadRecoveryFstab(info_dict, input_file, read_helper):
+  """Finds the path to recovery fstab and loads its contents."""
+  # recovery fstab is only meaningful when installing an update via recovery
+  # (i.e. non-A/B OTA). Skip loading fstab if device used A/B OTA.
+  if info_dict.get('ab_update') == 'true' and \
+     info_dict.get("allow_non_ab") != "true":
+    return None
+
+  # We changed recovery.fstab path in Q, from ../RAMDISK/etc/recovery.fstab to
+  # ../RAMDISK/system/etc/recovery.fstab. This function has to handle both
+  # cases, since it may load the info_dict from an old build (e.g. when
+  # generating incremental OTAs from that build).
+  system_root_image = info_dict.get('system_root_image') == 'true'
+  if info_dict.get('no_recovery') != 'true':
+    recovery_fstab_path = 'RECOVERY/RAMDISK/system/etc/recovery.fstab'
+    if isinstance(input_file, zipfile.ZipFile):
+      if recovery_fstab_path not in input_file.namelist():
+        recovery_fstab_path = 'RECOVERY/RAMDISK/etc/recovery.fstab'
+    else:
+      path = os.path.join(input_file, *recovery_fstab_path.split('/'))
+      if not os.path.exists(path):
+        recovery_fstab_path = 'RECOVERY/RAMDISK/etc/recovery.fstab'
+    return LoadRecoveryFSTab(
+        read_helper, info_dict['fstab_version'], recovery_fstab_path,
+        system_root_image)
+
+  if info_dict.get('recovery_as_boot') == 'true':
+    recovery_fstab_path = 'BOOT/RAMDISK/system/etc/recovery.fstab'
+    if isinstance(input_file, zipfile.ZipFile):
+      if recovery_fstab_path not in input_file.namelist():
+        recovery_fstab_path = 'BOOT/RAMDISK/etc/recovery.fstab'
+    else:
+      path = os.path.join(input_file, *recovery_fstab_path.split('/'))
+      if not os.path.exists(path):
+        recovery_fstab_path = 'BOOT/RAMDISK/etc/recovery.fstab'
+    return LoadRecoveryFSTab(
+        read_helper, info_dict['fstab_version'], recovery_fstab_path,
+        system_root_image)
+
+  return None
+
+
 def DumpInfoDict(d):
   for k, v in sorted(d.items()):
     logger.info("%-25s = (%s) %s", k, type(v).__name__, v)
 
 
+def MergeDynamicPartitionInfoDicts(framework_dict, vendor_dict):
+  """Merges dynamic partition info variables.
+
+  Args:
+    framework_dict: The dictionary of dynamic partition info variables from the
+      partial framework target files.
+    vendor_dict: The dictionary of dynamic partition info variables from the
+      partial vendor target files.
+
+  Returns:
+    The merged dynamic partition info dictionary.
+  """
+  merged_dict = {}
+  # Partition groups and group sizes are defined by the vendor dict because
+  # these values may vary for each board that uses a shared system image.
+  merged_dict["super_partition_groups"] = vendor_dict["super_partition_groups"]
+  framework_dynamic_partition_list = framework_dict.get(
+      "dynamic_partition_list", "")
+  vendor_dynamic_partition_list = vendor_dict.get("dynamic_partition_list", "")
+  merged_dict["dynamic_partition_list"] = ("%s %s" % (
+      framework_dynamic_partition_list, vendor_dynamic_partition_list)).strip()
+  for partition_group in merged_dict["super_partition_groups"].split(" "):
+    # Set the partition group's size using the value from the vendor dict.
+    key = "super_%s_group_size" % partition_group
+    if key not in vendor_dict:
+      raise ValueError("Vendor dict does not contain required key %s." % key)
+    merged_dict[key] = vendor_dict[key]
+
+    # Set the partition group's partition list using a concatenation of the
+    # framework and vendor partition lists.
+    key = "super_%s_partition_list" % partition_group
+    merged_dict[key] = (
+        "%s %s" %
+        (framework_dict.get(key, ""), vendor_dict.get(key, ""))).strip()
+
+  # Pick virtual ab related flags from vendor dict, if defined.
+  if "virtual_ab" in vendor_dict.keys():
+     merged_dict["virtual_ab"] = vendor_dict["virtual_ab"]
+  if "virtual_ab_retrofit" in vendor_dict.keys():
+     merged_dict["virtual_ab_retrofit"] = vendor_dict["virtual_ab_retrofit"]
+  return merged_dict
+
+
 def AppendAVBSigningArgs(cmd, partition):
   """Append signing arguments for avbtool."""
   # e.g., "--key path/to/signing_key --algorithm SHA256_RSA4096"
   key_path = OPTIONS.info_dict.get("avb_" + partition + "_key_path")
+  if key_path and not os.path.exists(key_path) and OPTIONS.search_path:
+    new_key_path = os.path.join(OPTIONS.search_path, key_path)
+    if os.path.exists(new_key_path):
+      key_path = new_key_path
   algorithm = OPTIONS.info_dict.get("avb_" + partition + "_algorithm")
   if key_path and algorithm:
     cmd.extend(["--key", key_path, "--algorithm", algorithm])
@@ -547,6 +1020,42 @@
     cmd.extend(["--salt", avb_salt])
 
 
+def GetAvbPartitionArg(partition, image, info_dict=None):
+  """Returns the VBMeta arguments for partition.
+
+  It sets up the VBMeta argument by including the partition descriptor from the
+  given 'image', or by configuring the partition as a chained partition.
+
+  Args:
+    partition: The name of the partition (e.g. "system").
+    image: The path to the partition image.
+    info_dict: A dict returned by common.LoadInfoDict(). Will use
+        OPTIONS.info_dict if None has been given.
+
+  Returns:
+    A list of VBMeta arguments.
+  """
+  if info_dict is None:
+    info_dict = OPTIONS.info_dict
+
+  # Check if chain partition is used.
+  key_path = info_dict.get("avb_" + partition + "_key_path")
+  if not key_path:
+    return ["--include_descriptors_from_image", image]
+
+  # For a non-A/B device, we don't chain /recovery nor include its descriptor
+  # into vbmeta.img. The recovery image will be configured on an independent
+  # boot chain, to be verified with AVB_SLOT_VERIFY_FLAGS_NO_VBMETA_PARTITION.
+  # See details at
+  # https://android.googlesource.com/platform/external/avb/+/master/README.md#booting-into-recovery.
+  if info_dict.get("ab_update") != "true" and partition == "recovery":
+    return []
+
+  # Otherwise chain the partition into vbmeta.
+  chained_partition_arg = GetAvbChainedPartitionArg(partition, info_dict)
+  return ["--chain_partition", chained_partition_arg]
+
+
 def GetAvbChainedPartitionArg(partition, info_dict, key=None):
   """Constructs and returns the arg to build or verify a chained partition.
 
@@ -563,13 +1072,110 @@
   """
   if key is None:
     key = info_dict["avb_" + partition + "_key_path"]
-  pubkey_path = ExtractAvbPublicKey(key)
+  if key and not os.path.exists(key) and OPTIONS.search_path:
+    new_key_path = os.path.join(OPTIONS.search_path, key)
+    if os.path.exists(new_key_path):
+      key = new_key_path
+  pubkey_path = ExtractAvbPublicKey(info_dict["avb_avbtool"], key)
   rollback_index_location = info_dict[
       "avb_" + partition + "_rollback_index_location"]
   return "{}:{}:{}".format(partition, rollback_index_location, pubkey_path)
 
 
-def _BuildBootableImage(sourcedir, fs_config_file, info_dict=None,
+def BuildVBMeta(image_path, partitions, name, needed_partitions):
+  """Creates a VBMeta image.
+
+  It generates the requested VBMeta image. The requested image could be for
+  top-level or chained VBMeta image, which is determined based on the name.
+
+  Args:
+    image_path: The output path for the new VBMeta image.
+    partitions: A dict that's keyed by partition names with image paths as
+        values. Only valid partition names are accepted, as partitions listed
+        in common.AVB_PARTITIONS and custom partitions listed in
+        OPTIONS.info_dict.get("avb_custom_images_partition_list")
+    name: Name of the VBMeta partition, e.g. 'vbmeta', 'vbmeta_system'.
+    needed_partitions: Partitions whose descriptors should be included into the
+        generated VBMeta image.
+
+  Raises:
+    AssertionError: On invalid input args.
+  """
+  avbtool = OPTIONS.info_dict["avb_avbtool"]
+  cmd = [avbtool, "make_vbmeta_image", "--output", image_path]
+  AppendAVBSigningArgs(cmd, name)
+
+  custom_partitions = OPTIONS.info_dict.get(
+      "avb_custom_images_partition_list", "").strip().split()
+
+  for partition, path in partitions.items():
+    if partition not in needed_partitions:
+      continue
+    assert (partition in AVB_PARTITIONS or
+            partition in AVB_VBMETA_PARTITIONS or
+            partition in custom_partitions), \
+        'Unknown partition: {}'.format(partition)
+    assert os.path.exists(path), \
+        'Failed to find {} for {}'.format(path, partition)
+    cmd.extend(GetAvbPartitionArg(partition, path))
+
+  args = OPTIONS.info_dict.get("avb_{}_args".format(name))
+  if args and args.strip():
+    split_args = shlex.split(args)
+    for index, arg in enumerate(split_args[:-1]):
+      # Sanity check that the image file exists. Some images might be defined
+      # as a path relative to source tree, which may not be available at the
+      # same location when running this script (we have the input target_files
+      # zip only). For such cases, we additionally scan other locations (e.g.
+      # IMAGES/, RADIO/, etc) before bailing out.
+      if arg == '--include_descriptors_from_image':
+        image_path = split_args[index + 1]
+        if os.path.exists(image_path):
+          continue
+        found = False
+        for dir_name in ['IMAGES', 'RADIO', 'PREBUILT_IMAGES']:
+          alt_path = os.path.join(
+              OPTIONS.input_tmp, dir_name, os.path.basename(image_path))
+          if os.path.exists(alt_path):
+            split_args[index + 1] = alt_path
+            found = True
+            break
+        assert found, 'Failed to find {}'.format(image_path)
+    cmd.extend(split_args)
+
+  RunAndCheckOutput(cmd)
+
+  if OPTIONS.aftl_server is not None:
+    # Ensure the other AFTL parameters are set as well.
+    assert OPTIONS.aftl_key_path is not None, 'No AFTL key provided.'
+    assert OPTIONS.aftl_manufacturer_key_path is not None, 'No AFTL manufacturer key provided.'
+    assert OPTIONS.aftl_signer_helper is not None, 'No AFTL signer helper provided.'
+    # AFTL inclusion proof generation code will go here.
+
+def _MakeRamdisk(sourcedir, fs_config_file=None, lz4_ramdisks=False):
+  ramdisk_img = tempfile.NamedTemporaryFile()
+
+  if fs_config_file is not None and os.access(fs_config_file, os.F_OK):
+    cmd = ["mkbootfs", "-f", fs_config_file,
+           os.path.join(sourcedir, "RAMDISK")]
+  else:
+    cmd = ["mkbootfs", os.path.join(sourcedir, "RAMDISK")]
+  p1 = Run(cmd, stdout=subprocess.PIPE)
+  if lz4_ramdisks:
+    p2 = Run(["lz4", "-l", "-12" , "--favor-decSpeed"], stdin=p1.stdout,
+             stdout=ramdisk_img.file.fileno())
+  else:
+    p2 = Run(["minigzip"], stdin=p1.stdout, stdout=ramdisk_img.file.fileno())
+
+  p2.wait()
+  p1.wait()
+  assert p1.returncode == 0, "mkbootfs of %s ramdisk failed" % (sourcedir,)
+  assert p2.returncode == 0, "compression of %s ramdisk failed" % (sourcedir,)
+
+  return ramdisk_img
+
+
+def _BuildBootableImage(image_name, sourcedir, fs_config_file, info_dict=None,
                         has_ramdisk=False, two_step_image=False):
   """Build a bootable image from the specified sourcedir.
 
@@ -582,25 +1188,15 @@
   for building the requested image.
   """
 
-  def make_ramdisk():
-    ramdisk_img = tempfile.NamedTemporaryFile()
+  # "boot" or "recovery", without extension.
+  partition_name = os.path.basename(sourcedir).lower()
 
-    if os.access(fs_config_file, os.F_OK):
-      cmd = ["mkbootfs", "-f", fs_config_file,
-             os.path.join(sourcedir, "RAMDISK")]
-    else:
-      cmd = ["mkbootfs", os.path.join(sourcedir, "RAMDISK")]
-    p1 = Run(cmd, stdout=subprocess.PIPE)
-    p2 = Run(["minigzip"], stdin=p1.stdout, stdout=ramdisk_img.file.fileno())
-
-    p2.wait()
-    p1.wait()
-    assert p1.returncode == 0, "mkbootfs of %s ramdisk failed" % (sourcedir,)
-    assert p2.returncode == 0, "minigzip of %s ramdisk failed" % (sourcedir,)
-
-    return ramdisk_img
-
-  if not os.access(os.path.join(sourcedir, "kernel"), os.F_OK):
+  if partition_name == "recovery":
+    kernel = "kernel"
+  else:
+    kernel = image_name.replace("boot", "kernel")
+    kernel = kernel.replace(".img","")
+  if not os.access(os.path.join(sourcedir, kernel), os.F_OK):
     return None
 
   if has_ramdisk and not os.access(os.path.join(sourcedir, "RAMDISK"), os.F_OK):
@@ -612,12 +1208,13 @@
   img = tempfile.NamedTemporaryFile()
 
   if has_ramdisk:
-    ramdisk_img = make_ramdisk()
+    use_lz4 = info_dict.get("lz4_ramdisks") == 'true'
+    ramdisk_img = _MakeRamdisk(sourcedir, fs_config_file, lz4_ramdisks=use_lz4)
 
   # use MKBOOTIMG from environ, or "mkbootimg" if empty or not set
   mkbootimg = os.getenv('MKBOOTIMG') or "mkbootimg"
 
-  cmd = [mkbootimg, "--kernel", os.path.join(sourcedir, "kernel")]
+  cmd = [mkbootimg, "--kernel", os.path.join(sourcedir, kernel)]
 
   fn = os.path.join(sourcedir, "second")
   if os.access(fn, os.F_OK):
@@ -644,7 +1241,14 @@
     cmd.append("--pagesize")
     cmd.append(open(fn).read().rstrip("\n"))
 
-  args = info_dict.get("mkbootimg_args")
+  if partition_name == "recovery":
+    args = info_dict.get("recovery_mkbootimg_args")
+    if not args:
+      # Fall back to "mkbootimg_args" for recovery image
+      # in case "recovery_mkbootimg_args" is not set.
+      args = info_dict.get("mkbootimg_args")
+  else:
+    args = info_dict.get("mkbootimg_args")
   if args and args.strip():
     cmd.extend(shlex.split(args))
 
@@ -662,9 +1266,6 @@
   else:
     cmd.extend(["--output", img.name])
 
-  # "boot" or "recovery", without extension.
-  partition_name = os.path.basename(sourcedir).lower()
-
   if partition_name == "recovery":
     if info_dict.get("include_recovery_dtbo") == "true":
       fn = os.path.join(sourcedir, "recovery_dtbo")
@@ -715,7 +1316,10 @@
   # AVB: if enabled, calculate and add hash to boot.img or recovery.img.
   if info_dict.get("avb_enable") == "true":
     avbtool = info_dict["avb_avbtool"]
-    part_size = info_dict[partition_name + "_size"]
+    if partition_name == "recovery":
+      part_size = info_dict["recovery_size"]
+    else:
+      part_size = info_dict[image_name.replace(".img","_size")]
     cmd = [avbtool, "add_hash_footer", "--image", img.name,
            "--partition_size", str(part_size), "--partition_name",
            partition_name]
@@ -766,7 +1370,7 @@
                  info_dict.get("recovery_as_boot") == "true")
 
   fs_config = "META/" + tree_subdir.lower() + "_filesystem_config.txt"
-  data = _BuildBootableImage(os.path.join(unpack_dir, tree_subdir),
+  data = _BuildBootableImage(prebuilt_name, os.path.join(unpack_dir, tree_subdir),
                              os.path.join(unpack_dir, fs_config),
                              info_dict, has_ramdisk, two_step_image)
   if data:
@@ -774,6 +1378,106 @@
   return None
 
 
+def _BuildVendorBootImage(sourcedir, info_dict=None):
+  """Build a vendor boot image from the specified sourcedir.
+
+  Take a ramdisk, dtb, and vendor_cmdline from the input (in 'sourcedir'), and
+  turn them into a vendor boot image.
+
+  Return the image data, or None if sourcedir does not appear to contains files
+  for building the requested image.
+  """
+
+  if info_dict is None:
+    info_dict = OPTIONS.info_dict
+
+  img = tempfile.NamedTemporaryFile()
+
+  use_lz4 = info_dict.get("lz4_ramdisks") == 'true'
+  ramdisk_img = _MakeRamdisk(sourcedir, lz4_ramdisks=use_lz4)
+
+  # use MKBOOTIMG from environ, or "mkbootimg" if empty or not set
+  mkbootimg = os.getenv('MKBOOTIMG') or "mkbootimg"
+
+  cmd = [mkbootimg]
+
+  fn = os.path.join(sourcedir, "dtb")
+  if os.access(fn, os.F_OK):
+    cmd.append("--dtb")
+    cmd.append(fn)
+
+  fn = os.path.join(sourcedir, "vendor_cmdline")
+  if os.access(fn, os.F_OK):
+    cmd.append("--vendor_cmdline")
+    cmd.append(open(fn).read().rstrip("\n"))
+
+  fn = os.path.join(sourcedir, "base")
+  if os.access(fn, os.F_OK):
+    cmd.append("--base")
+    cmd.append(open(fn).read().rstrip("\n"))
+
+  fn = os.path.join(sourcedir, "pagesize")
+  if os.access(fn, os.F_OK):
+    cmd.append("--pagesize")
+    cmd.append(open(fn).read().rstrip("\n"))
+
+  args = info_dict.get("mkbootimg_args")
+  if args and args.strip():
+    cmd.extend(shlex.split(args))
+
+  args = info_dict.get("mkbootimg_version_args")
+  if args and args.strip():
+    cmd.extend(shlex.split(args))
+
+  cmd.extend(["--vendor_ramdisk", ramdisk_img.name])
+  cmd.extend(["--vendor_boot", img.name])
+
+  RunAndCheckOutput(cmd)
+
+  # AVB: if enabled, calculate and add hash.
+  if info_dict.get("avb_enable") == "true":
+    avbtool = info_dict["avb_avbtool"]
+    part_size = info_dict["vendor_boot_size"]
+    cmd = [avbtool, "add_hash_footer", "--image", img.name,
+           "--partition_size", str(part_size), "--partition_name", "vendor_boot"]
+    AppendAVBSigningArgs(cmd, "vendor_boot")
+    args = info_dict.get("avb_vendor_boot_add_hash_footer_args")
+    if args and args.strip():
+      cmd.extend(shlex.split(args))
+    RunAndCheckOutput(cmd)
+
+  img.seek(os.SEEK_SET, 0)
+  data = img.read()
+
+  ramdisk_img.close()
+  img.close()
+
+  return data
+
+
+def GetVendorBootImage(name, prebuilt_name, unpack_dir, tree_subdir,
+                       info_dict=None):
+  """Return a File object with the desired vendor boot image.
+
+  Look for it under 'unpack_dir'/IMAGES, otherwise construct it from
+  the source files in 'unpack_dir'/'tree_subdir'."""
+
+  prebuilt_path = os.path.join(unpack_dir, "IMAGES", prebuilt_name)
+  if os.path.exists(prebuilt_path):
+    logger.info("using prebuilt %s from IMAGES...", prebuilt_name)
+    return File.FromLocalFile(name, prebuilt_path)
+
+  logger.info("building image from target_files %s...", tree_subdir)
+
+  if info_dict is None:
+    info_dict = OPTIONS.info_dict
+
+  data = _BuildVendorBootImage(os.path.join(unpack_dir, tree_subdir), info_dict)
+  if data:
+    return File(name, data)
+  return None
+
+
 def Gunzip(in_filename, out_filename):
   """Gunzips the given gzip compressed file to a given output file."""
   with gzip.open(in_filename, "rb") as in_file, \
@@ -861,7 +1565,7 @@
     A Image object. If it is a sparse image and reset_file_map is False, the
     image will have file_map info loaded.
   """
-  if info_dict == None:
+  if info_dict is None:
     info_dict = LoadInfoDict(input_zip)
 
   is_sparse = info_dict.get("extfs_sparse_flag")
@@ -901,8 +1605,8 @@
   # ota_from_target_files.py (since LMP).
   assert os.path.exists(path) and os.path.exists(mappath)
 
-  return blockimgdiff.FileImage(path, hashtree_info_generator=
-                                hashtree_info_generator)
+  return images.FileImage(path, hashtree_info_generator=hashtree_info_generator)
+
 
 def GetSparseImage(which, tmpdir, input_zip, allow_shared_blocks,
                    hashtree_info_generator=None):
@@ -951,7 +1655,7 @@
     # filename listed in system.map may contain an additional leading slash
     # (i.e. "//system/framework/am.jar"). Using lstrip to get consistent
     # results.
-    arcname = string.replace(entry, which, which.upper(), 1).lstrip('/')
+    arcname = entry.replace(which, which.upper(), 1).lstrip('/')
 
     # Special handling another case, where files not under /system
     # (e.g. "/sbin/charger") are packed under ROOT/ in a target_files.zip.
@@ -1028,7 +1732,7 @@
 def GetMinSdkVersion(apk_name):
   """Gets the minSdkVersion declared in the APK.
 
-  It calls 'aapt' to query the embedded minSdkVersion from the given APK file.
+  It calls 'aapt2' to query the embedded minSdkVersion from the given APK file.
   This can be both a decimal number (API Level) or a codename.
 
   Args:
@@ -1041,12 +1745,12 @@
     ExternalError: On failing to obtain the min SDK version.
   """
   proc = Run(
-      ["aapt", "dump", "badging", apk_name], stdout=subprocess.PIPE,
+      ["aapt2", "dump", "badging", apk_name], stdout=subprocess.PIPE,
       stderr=subprocess.PIPE)
   stdoutdata, stderrdata = proc.communicate()
   if proc.returncode != 0:
     raise ExternalError(
-        "Failed to obtain minSdkVersion: aapt return code {}:\n{}\n{}".format(
+        "Failed to obtain minSdkVersion: aapt2 return code {}:\n{}\n{}".format(
             proc.returncode, stdoutdata, stderrdata))
 
   for line in stdoutdata.split("\n"):
@@ -1054,7 +1758,7 @@
     m = re.match(r'sdkVersion:\'([^\']*)\'', line)
     if m:
       return m.group(1)
-  raise ExternalError("No minSdkVersion returned by aapt")
+  raise ExternalError("No minSdkVersion returned by aapt2")
 
 
 def GetMinSdkVersionInt(apk_name, codename_to_api_level_map):
@@ -1221,13 +1925,14 @@
     if basename:
       installed_files.add(basename)
 
-  for line in tf_zip.read("META/apkcerts.txt").split("\n"):
+  for line in tf_zip.read('META/apkcerts.txt').decode().split('\n'):
     line = line.strip()
     if not line:
       continue
     m = re.match(
         r'^name="(?P<NAME>.*)"\s+certificate="(?P<CERT>.*)"\s+'
-        r'private_key="(?P<PRIVKEY>.*?)"(\s+compressed="(?P<COMPRESSED>.*)")?$',
+        r'private_key="(?P<PRIVKEY>.*?)"(\s+compressed="(?P<COMPRESSED>.*?)")?'
+        r'(\s+partition="(?P<PARTITION>.*?)")?$',
         line)
     if not m:
       continue
@@ -1291,6 +1996,9 @@
 
   -h  (--help)
       Display this usage message and exit.
+
+  --logfile <file>
+      Put verbose logs to specified file (regardless of --verbose option.)
 """
 
 def Usage(docstring):
@@ -1313,10 +2021,11 @@
         argv, "hvp:s:x:" + extra_opts,
         ["help", "verbose", "path=", "signapk_path=",
          "signapk_shared_library_path=", "extra_signapk_args=",
-         "java_path=", "java_args=", "public_key_suffix=",
+         "java_path=", "java_args=", "android_jar_path=", "public_key_suffix=",
          "private_key_suffix=", "boot_signer_path=", "boot_signer_args=",
          "verity_signer_path=", "verity_signer_args=", "device_specific=",
-         "extra="] +
+         "extra=", "logfile=", "aftl_server=", "aftl_key_path=",
+         "aftl_manufacturer_key_path=", "aftl_signer_helper="] +
         list(extra_long_opts))
   except getopt.GetoptError as err:
     Usage(docstring)
@@ -1341,6 +2050,8 @@
       OPTIONS.java_path = a
     elif o in ("--java_args",):
       OPTIONS.java_args = shlex.split(a)
+    elif o in ("--android_jar_path",):
+      OPTIONS.android_jar_path = a
     elif o in ("--public_key_suffix",):
       OPTIONS.public_key_suffix = a
     elif o in ("--private_key_suffix",):
@@ -1353,11 +2064,21 @@
       OPTIONS.verity_signer_path = a
     elif o in ("--verity_signer_args",):
       OPTIONS.verity_signer_args = shlex.split(a)
+    elif o in ("--aftl_server",):
+      OPTIONS.aftl_server = a
+    elif o in ("--aftl_key_path",):
+      OPTIONS.aftl_key_path = a
+    elif o in ("--aftl_manufacturer_key_path",):
+      OPTIONS.aftl_manufacturer_key_path = a
+    elif o in ("--aftl_signer_helper",):
+      OPTIONS.aftl_signer_helper = a
     elif o in ("-s", "--device_specific"):
       OPTIONS.device_specific = a
     elif o in ("-x", "--extra"):
       key, value = a.split("=", 1)
       OPTIONS.extras[key] = value
+    elif o in ("--logfile",):
+      OPTIONS.logfile = a
     else:
       if extra_option_handler is None or not extra_option_handler(o, a):
         assert False, "unknown option \"%s\"" % (o,)
@@ -1431,6 +2152,8 @@
 
       if not first:
         print("key file %s still missing some passwords." % (self.pwfile,))
+        if sys.version_info[0] >= 3:
+          raw_input = input  # pylint: disable=redefined-builtin
         answer = raw_input("try to edit again? [y]> ").strip()
         if answer and answer[0] not in 'yY':
           raise RuntimeError("key passwords unavailable")
@@ -1444,7 +2167,7 @@
     values.
     """
     result = {}
-    for k, v in sorted(current.iteritems()):
+    for k, v in sorted(current.items()):
       if v:
         result[k] = v
       else:
@@ -1465,7 +2188,7 @@
     f.write("# (Additional spaces are harmless.)\n\n")
 
     first_line = None
-    sorted_list = sorted([(not v, k, v) for (k, v) in current.iteritems()])
+    sorted_list = sorted([(not v, k, v) for (k, v) in current.items()])
     for i, (_, k, v) in enumerate(sorted_list):
       f.write("[[[  %s  ]]] %s\n" % (v, k))
       if not v and first_line is None:
@@ -1566,6 +2289,15 @@
       perms = 0o100644
   else:
     zinfo = zinfo_or_arcname
+    # Python 2 and 3 behave differently when calling ZipFile.writestr() with
+    # zinfo.external_attr being 0. Python 3 uses `0o600 << 16` as the value for
+    # such a case (since
+    # https://github.com/python/cpython/commit/18ee29d0b870caddc0806916ca2c823254f1a1f9),
+    # which seems to make more sense. Otherwise the entry will have 0o000 as the
+    # permission bits. We follow the logic in Python 3 to get consistent
+    # behavior between using the two versions.
+    if not zinfo.external_attr:
+      zinfo.external_attr = 0o600 << 16
 
   # If compress_type is given, it overrides the value in zinfo.
   if compress_type is not None:
@@ -1598,7 +2330,7 @@
   Raises:
     AssertionError: In case of non-zero return from 'zip'.
   """
-  if isinstance(entries, basestring):
+  if isinstance(entries, str):
     entries = [entries]
   cmd = ["zip", "-d", zip_filename] + entries
   RunAndCheckOutput(cmd)
@@ -1622,7 +2354,7 @@
     """Keyword arguments to the constructor become attributes of this
     object, which is passed to all functions in the device-specific
     module."""
-    for k, v in kwargs.iteritems():
+    for k, v in kwargs.items():
       setattr(self, k, v)
     self.extras = OPTIONS.extras
 
@@ -1891,9 +2623,9 @@
     assert version >= 3
     self.version = version
 
-    b = blockimgdiff.BlockImageDiff(tgt, src, threads=OPTIONS.worker_threads,
-                                    version=self.version,
-                                    disable_imgdiff=self.disable_imgdiff)
+    b = BlockImageDiff(tgt, src, threads=OPTIONS.worker_threads,
+                       version=self.version,
+                       disable_imgdiff=self.disable_imgdiff)
     self.path = os.path.join(MakeTempDir(), partition)
     b.Compute(self.path)
     self._required_cache = b.max_stashed_size
@@ -1924,11 +2656,12 @@
       self.device = 'map_partition("%s")' % partition
     else:
       if OPTIONS.source_info_dict is None:
-        _, device_path = GetTypeAndDevice("/" + partition, OPTIONS.info_dict)
+        _, device_expr = GetTypeAndDeviceExpr("/" + partition,
+                                              OPTIONS.info_dict)
       else:
-        _, device_path = GetTypeAndDevice("/" + partition,
-                                          OPTIONS.source_info_dict)
-      self.device = '"%s"' % device_path
+        _, device_expr = GetTypeAndDeviceExpr("/" + partition,
+                                              OPTIONS.source_info_dict)
+      self.device = device_expr
 
   @property
   def required_cache(self):
@@ -2147,8 +2880,10 @@
     return ctx.hexdigest()
 
 
-DataImage = blockimgdiff.DataImage
-EmptyImage = blockimgdiff.EmptyImage
+# Expose these two classes to support vendor-specific scripts
+DataImage = images.DataImage
+EmptyImage = images.EmptyImage
+
 
 # map recovery.fstab's fs_types to mount/format "partition types"
 PARTITION_TYPES = {
@@ -2158,23 +2893,58 @@
     "squashfs": "EMMC"
 }
 
-
-def GetTypeAndDevice(mount_point, info):
+def GetTypeAndDevice(mount_point, info, check_no_slot=True):
+  """
+  Use GetTypeAndDeviceExpr whenever possible. This function is kept for
+  backwards compatibility. It aborts if the fstab entry has slotselect option
+  (unless check_no_slot is explicitly set to False).
+  """
   fstab = info["fstab"]
   if fstab:
+    if check_no_slot:
+      assert not fstab[mount_point].slotselect, \
+             "Use GetTypeAndDeviceExpr instead"
     return (PARTITION_TYPES[fstab[mount_point].fs_type],
             fstab[mount_point].device)
   else:
     raise KeyError
 
 
+def GetTypeAndDeviceExpr(mount_point, info):
+  """
+  Return the filesystem of the partition, and an edify expression that evaluates
+  to the device at runtime.
+  """
+  fstab = info["fstab"]
+  if fstab:
+    p = fstab[mount_point]
+    device_expr = '"%s"' % fstab[mount_point].device
+    if p.slotselect:
+      device_expr = 'add_slot_suffix(%s)' % device_expr
+    return (PARTITION_TYPES[fstab[mount_point].fs_type], device_expr)
+  else:
+    raise KeyError
+
+
+def GetEntryForDevice(fstab, device):
+  """
+  Returns:
+    The first entry in fstab whose device is the given value.
+  """
+  if not fstab:
+    return None
+  for mount_point in fstab:
+    if fstab[mount_point].device == device:
+      return fstab[mount_point]
+  return None
+
 def ParseCertificate(data):
   """Parses and converts a PEM-encoded certificate into DER-encoded.
 
   This gives the same result as `openssl x509 -in <filename> -outform DER`.
 
   Returns:
-    The decoded certificate string.
+    The decoded certificate bytes.
   """
   cert_buffer = []
   save = False
@@ -2185,7 +2955,7 @@
       cert_buffer.append(line)
     if "--BEGIN CERTIFICATE--" in line:
       save = True
-  cert = "".join(cert_buffer).decode('base64')
+  cert = base64.b64decode("".join(cert_buffer))
   return cert
 
 
@@ -2213,10 +2983,11 @@
   return pubkey
 
 
-def ExtractAvbPublicKey(key):
+def ExtractAvbPublicKey(avbtool, key):
   """Extracts the AVB public key from the given public or private key.
 
   Args:
+    avbtool: The AVB tool to use.
     key: The input key file, which should be PEM-encoded public or private key.
 
   Returns:
@@ -2224,7 +2995,7 @@
   """
   output = MakeTempFile(prefix='avb-', suffix='.avbpubkey')
   RunAndCheckOutput(
-      ['avbtool', 'extract_public_key', "--key", key, "--output", output])
+      [avbtool, 'extract_public_key', "--key", key, "--output", output])
   return output
 
 
@@ -2249,13 +3020,25 @@
     info_dict = OPTIONS.info_dict
 
   full_recovery_image = info_dict.get("full_recovery_image") == "true"
+  board_uses_vendorimage = info_dict.get("board_uses_vendorimage") == "true"
+
+  if board_uses_vendorimage:
+    # In this case, the output sink is rooted at VENDOR
+    recovery_img_path = "etc/recovery.img"
+    recovery_resource_dat_path = "VENDOR/etc/recovery-resource.dat"
+    sh_dir = "bin"
+  else:
+    # In this case the output sink is rooted at SYSTEM
+    recovery_img_path = "vendor/etc/recovery.img"
+    recovery_resource_dat_path = "SYSTEM/vendor/etc/recovery-resource.dat"
+    sh_dir = "vendor/bin"
 
   if full_recovery_image:
-    output_sink("etc/recovery.img", recovery_img.data)
+    output_sink(recovery_img_path, recovery_img.data)
 
   else:
     system_root_image = info_dict.get("system_root_image") == "true"
-    path = os.path.join(input_dir, "SYSTEM", "etc", "recovery-resource.dat")
+    path = os.path.join(input_dir, recovery_resource_dat_path)
     # With system-root-image, boot and recovery images will have mismatching
     # entries (only recovery has the ramdisk entry) (Bug: 72731506). Use bsdiff
     # to handle such a case.
@@ -2268,7 +3051,7 @@
       if os.path.exists(path):
         diff_program.append("-b")
         diff_program.append(path)
-        bonus_args = "--bonus /system/etc/recovery-resource.dat"
+        bonus_args = "--bonus /vendor/etc/recovery-resource.dat"
       else:
         bonus_args = ""
 
@@ -2279,16 +3062,24 @@
   try:
     # The following GetTypeAndDevice()s need to use the path in the target
     # info_dict instead of source_info_dict.
-    boot_type, boot_device = GetTypeAndDevice("/boot", info_dict)
-    recovery_type, recovery_device = GetTypeAndDevice("/recovery", info_dict)
+    boot_type, boot_device = GetTypeAndDevice("/boot", info_dict,
+                                              check_no_slot=False)
+    recovery_type, recovery_device = GetTypeAndDevice("/recovery", info_dict,
+                                                      check_no_slot=False)
   except KeyError:
     return
 
   if full_recovery_image:
-    sh = """#!/system/bin/sh
+
+    # Note that we use /vendor to refer to the recovery resources. This will
+    # work for a separate vendor partition mounted at /vendor or a
+    # /system/vendor subdirectory on the system partition, for which init will
+    # create a symlink from /vendor to /system/vendor.
+
+    sh = """#!/vendor/bin/sh
 if ! applypatch --check %(type)s:%(device)s:%(size)d:%(sha1)s; then
   applypatch \\
-          --flash /system/etc/recovery.img \\
+          --flash /vendor/etc/recovery.img \\
           --target %(type)s:%(device)s:%(size)d:%(sha1)s && \\
       log -t recovery "Installing new recovery image: succeeded" || \\
       log -t recovery "Installing new recovery image: failed"
@@ -2300,10 +3091,10 @@
        'sha1': recovery_img.sha1,
        'size': recovery_img.size}
   else:
-    sh = """#!/system/bin/sh
+    sh = """#!/vendor/bin/sh
 if ! applypatch --check %(recovery_type)s:%(recovery_device)s:%(recovery_size)d:%(recovery_sha1)s; then
   applypatch %(bonus_args)s \\
-          --patch /system/recovery-from-boot.p \\
+          --patch /vendor/recovery-from-boot.p \\
           --source %(boot_type)s:%(boot_device)s:%(boot_size)d:%(boot_sha1)s \\
           --target %(recovery_type)s:%(recovery_device)s:%(recovery_size)d:%(recovery_sha1)s && \\
       log -t recovery "Installing new recovery image: succeeded" || \\
@@ -2316,18 +3107,18 @@
        'recovery_size': recovery_img.size,
        'recovery_sha1': recovery_img.sha1,
        'boot_type': boot_type,
-       'boot_device': boot_device,
+       'boot_device': boot_device + '$(getprop ro.boot.slot_suffix)',
        'recovery_type': recovery_type,
-       'recovery_device': recovery_device,
+       'recovery_device': recovery_device + '$(getprop ro.boot.slot_suffix)',
        'bonus_args': bonus_args}
 
-  # The install script location moved from /system/etc to /system/bin
-  # in the L release.
-  sh_location = "bin/install-recovery.sh"
+  # The install script location moved from /system/etc to /system/bin in the L
+  # release. In the R release it is in VENDOR/bin or SYSTEM/vendor/bin.
+  sh_location = os.path.join(sh_dir, "install-recovery.sh")
 
   logger.info("putting script in %s", sh_location)
 
-  output_sink(sh_location, sh)
+  output_sink(sh_location, sh.encode())
 
 
 class DynamicPartitionUpdate(object):
@@ -2368,14 +3159,16 @@
   def __init__(self, info_dict, block_diffs, progress_dict=None,
                source_info_dict=None):
     if progress_dict is None:
-      progress_dict = dict()
+      progress_dict = {}
 
     self._remove_all_before_apply = False
     if source_info_dict is None:
       self._remove_all_before_apply = True
-      source_info_dict = dict()
+      source_info_dict = {}
 
-    block_diff_dict = {e.partition:e for e in block_diffs}
+    block_diff_dict = collections.OrderedDict(
+        [(e.partition, e) for e in block_diffs])
+
     assert len(block_diff_dict) == len(block_diffs), \
         "Duplicated BlockDifference object for {}".format(
             [partition for partition, count in
diff --git a/tools/releasetools/edify_generator.py b/tools/releasetools/edify_generator.py
index 7ed85fe..b9c9b19 100644
--- a/tools/releasetools/edify_generator.py
+++ b/tools/releasetools/edify_generator.py
@@ -183,11 +183,30 @@
     It checks the checksums of the given partitions. If none of them matches the
     expected checksum, updater will additionally look for a backup on /cache.
     """
+    self._CheckSecondTokenNotSlotSuffixed(target, "PatchPartitionExprCheck")
+    self._CheckSecondTokenNotSlotSuffixed(source, "PatchPartitionExprCheck")
+    self.PatchPartitionExprCheck('"%s"' % target, '"%s"' % source)
+
+  def PatchPartitionExprCheck(self, target_expr, source_expr):
+    """Checks whether updater can patch the given partitions.
+
+    It checks the checksums of the given partitions. If none of them matches the
+    expected checksum, updater will additionally look for a backup on /cache.
+
+    Args:
+      target_expr: an Edify expression that serves as the target arg to
+        patch_partition. Must be evaluated to a string in the form of
+        foo:bar:baz:quux
+      source_expr: an Edify expression that serves as the source arg to
+        patch_partition. Must be evaluated to a string in the form of
+        foo:bar:baz:quux
+    """
     self.script.append(self.WordWrap((
-        'patch_partition_check("{target}",\0"{source}") ||\n    abort('
-        '"E{code}: \\"{target}\\" or \\"{source}\\" has unexpected '
-        'contents.");').format(
-            target=target, source=source,
+        'patch_partition_check({target},\0{source}) ||\n    abort('
+        'concat("E{code}: \\"",{target},"\\" or \\"",{source},"\\" has '
+        'unexpected contents."));').format(
+            target=target_expr,
+            source=source_expr,
             code=common.ErrorCode.BAD_PATCH_FILE)))
 
   def CacheFreeSpaceCheck(self, amount):
@@ -218,8 +237,9 @@
       mount_flags = mount_dict.get(p.fs_type, "")
       if p.context is not None:
         mount_flags = p.context + ("," + mount_flags if mount_flags else "")
-      self.script.append('mount("%s", "%s", "%s", "%s", "%s");' % (
-          p.fs_type, common.PARTITION_TYPES[p.fs_type], p.device,
+      self.script.append('mount("%s", "%s", %s, "%s", "%s");' % (
+          p.fs_type, common.PARTITION_TYPES[p.fs_type],
+          self._GetSlotSuffixDeviceForEntry(p),
           p.mount_point, mount_flags))
       self.mounts.add(p.mount_point)
 
@@ -242,8 +262,9 @@
         raise ValueError("Partition %s cannot be tuned\n" % (partition,))
     self.script.append(
         'tune2fs(' + "".join(['"%s", ' % (i,) for i in options]) +
-        '"%s") || abort("E%d: Failed to tune partition %s");' % (
-            p.device, common.ErrorCode.TUNE_PARTITION_FAILURE, partition))
+        '%s) || abort("E%d: Failed to tune partition %s");' % (
+            self._GetSlotSuffixDeviceForEntry(p),
+            common.ErrorCode.TUNE_PARTITION_FAILURE, partition))
 
   def FormatPartition(self, partition):
     """Format the given partition, specified by its mount point (eg,
@@ -252,18 +273,19 @@
     fstab = self.fstab
     if fstab:
       p = fstab[partition]
-      self.script.append('format("%s", "%s", "%s", "%s", "%s");' %
+      self.script.append('format("%s", "%s", %s, "%s", "%s");' %
                          (p.fs_type, common.PARTITION_TYPES[p.fs_type],
-                          p.device, p.length, p.mount_point))
+                          self._GetSlotSuffixDeviceForEntry(p),
+                          p.length, p.mount_point))
 
   def WipeBlockDevice(self, partition):
     if partition not in ("/system", "/vendor"):
       raise ValueError(("WipeBlockDevice doesn't work on %s\n") % (partition,))
     fstab = self.fstab
     size = self.info.get(partition.lstrip("/") + "_size", None)
-    device = fstab[partition].device
+    device = self._GetSlotSuffixDeviceForEntry(fstab[partition])
 
-    self.script.append('wipe_block_device("%s", %s);' % (device, size))
+    self.script.append('wipe_block_device(%s, %s);' % (device, size))
 
   def ApplyPatch(self, srcfile, tgtfile, tgtsize, tgtsha1, *patchpairs):
     """Apply binary patches (in *patchpairs) to the given srcfile to
@@ -296,14 +318,69 @@
     self.PatchPartition(target, source, patch)
 
   def PatchPartition(self, target, source, patch):
-    """Applies the patch to the source partition and writes it to target."""
+    """
+    Applies the patch to the source partition and writes it to target.
+
+    Args:
+      target: the target arg to patch_partition. Must be in the form of
+        foo:bar:baz:quux
+      source: the source arg to patch_partition. Must be in the form of
+        foo:bar:baz:quux
+      patch: the patch arg to patch_partition. Must be an unquoted string.
+    """
+    self._CheckSecondTokenNotSlotSuffixed(target, "PatchPartitionExpr")
+    self._CheckSecondTokenNotSlotSuffixed(source, "PatchPartitionExpr")
+    self.PatchPartitionExpr('"%s"' % target, '"%s"' % source, '"%s"' % patch)
+
+  def PatchPartitionExpr(self, target_expr, source_expr, patch_expr):
+    """
+    Applies the patch to the source partition and writes it to target.
+
+    Args:
+      target_expr: an Edify expression that serves as the target arg to
+        patch_partition. Must be evaluated to a string in the form of
+        foo:bar:baz:quux
+      source_expr: an Edify expression that serves as the source arg to
+        patch_partition. Must be evaluated to a string in the form of
+        foo:bar:baz:quux
+      patch_expr: an Edify expression that serves as the patch arg to
+        patch_partition. Must be evaluated to a string.
+    """
     self.script.append(self.WordWrap((
-        'patch_partition("{target}",\0"{source}",\0'
-        'package_extract_file("{patch}")) ||\n'
-        '    abort("E{code}: Failed to apply patch to {source}");').format(
-            target=target, source=source, patch=patch,
+        'patch_partition({target},\0{source},\0'
+        'package_extract_file({patch})) ||\n'
+        '    abort(concat('
+        '        "E{code}: Failed to apply patch to ",{source}));').format(
+            target=target_expr,
+            source=source_expr,
+            patch=patch_expr,
             code=common.ErrorCode.APPLY_PATCH_FAILURE)))
 
+  def _GetSlotSuffixDeviceForEntry(self, entry=None):
+    """
+    Args:
+      entry: the fstab entry of device "foo"
+    Returns:
+      An edify expression. Caller must not quote result.
+      If foo is slot suffixed, it returns
+        'add_slot_suffix("foo")'
+      Otherwise it returns
+        '"foo"' (quoted)
+    """
+    assert entry is not None
+    if entry.slotselect:
+      return 'add_slot_suffix("%s")' % entry.device
+    return '"%s"' % entry.device
+
+  def _CheckSecondTokenNotSlotSuffixed(self, s, fn):
+    lst = s.split(':')
+    assert(len(lst) == 4), "{} does not contain 4 tokens".format(s)
+    if self.fstab:
+      entry = common.GetEntryForDevice(self.fstab, lst[1])
+      if entry is not None:
+        assert not entry.slotselect, \
+          "Use %s because %s is slot suffixed" % (fn, lst[1])
+
   def WriteRawImage(self, mount_point, fn, mapfn=None):
     """Write the given package file into the partition for the given
     mount point."""
@@ -312,15 +389,16 @@
     if fstab:
       p = fstab[mount_point]
       partition_type = common.PARTITION_TYPES[p.fs_type]
-      args = {'device': p.device, 'fn': fn}
+      device = self._GetSlotSuffixDeviceForEntry(p)
+      args = {'device': device, 'fn': fn}
       if partition_type == "EMMC":
         if mapfn:
           args["map"] = mapfn
           self.script.append(
-              'package_extract_file("%(fn)s", "%(device)s", "%(map)s");' % args)
+              'package_extract_file("%(fn)s", %(device)s, "%(map)s");' % args)
         else:
           self.script.append(
-              'package_extract_file("%(fn)s", "%(device)s");' % args)
+              'package_extract_file("%(fn)s", %(device)s);' % args)
       else:
         raise ValueError(
             "don't know how to write \"%s\" partitions" % p.fs_type)
diff --git a/tools/releasetools/images.py b/tools/releasetools/images.py
new file mode 100644
index 0000000..a24148a
--- /dev/null
+++ b/tools/releasetools/images.py
@@ -0,0 +1,223 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific
+
+import os
+import threading
+from hashlib import sha1
+
+from rangelib import RangeSet
+
+__all__ = ["EmptyImage", "DataImage", "FileImage"]
+
+
+class Image(object):
+  def RangeSha1(self, ranges):
+    raise NotImplementedError
+
+  def ReadRangeSet(self, ranges):
+    raise NotImplementedError
+
+  def TotalSha1(self, include_clobbered_blocks=False):
+    raise NotImplementedError
+
+  def WriteRangeDataToFd(self, ranges, fd):
+    raise NotImplementedError
+
+
+class EmptyImage(Image):
+  """A zero-length image."""
+
+  def __init__(self):
+    self.blocksize = 4096
+    self.care_map = RangeSet()
+    self.clobbered_blocks = RangeSet()
+    self.extended = RangeSet()
+    self.total_blocks = 0
+    self.file_map = {}
+    self.hashtree_info = None
+
+  def RangeSha1(self, ranges):
+    return sha1().hexdigest()
+
+  def ReadRangeSet(self, ranges):
+    return ()
+
+  def TotalSha1(self, include_clobbered_blocks=False):
+    # EmptyImage always carries empty clobbered_blocks, so
+    # include_clobbered_blocks can be ignored.
+    assert self.clobbered_blocks.size() == 0
+    return sha1().hexdigest()
+
+  def WriteRangeDataToFd(self, ranges, fd):
+    raise ValueError("Can't write data from EmptyImage to file")
+
+
+class DataImage(Image):
+  """An image wrapped around a single string of data."""
+
+  def __init__(self, data, trim=False, pad=False):
+    self.data = data
+    self.blocksize = 4096
+
+    assert not (trim and pad)
+
+    partial = len(self.data) % self.blocksize
+    padded = False
+    if partial > 0:
+      if trim:
+        self.data = self.data[:-partial]
+      elif pad:
+        self.data += '\0' * (self.blocksize - partial)
+        padded = True
+      else:
+        raise ValueError(("data for DataImage must be multiple of %d bytes "
+                          "unless trim or pad is specified") %
+                         (self.blocksize,))
+
+    assert len(self.data) % self.blocksize == 0
+
+    self.total_blocks = len(self.data) // self.blocksize
+    self.care_map = RangeSet(data=(0, self.total_blocks))
+    # When the last block is padded, we always write the whole block even for
+    # incremental OTAs. Because otherwise the last block may get skipped if
+    # unchanged for an incremental, but would fail the post-install
+    # verification if it has non-zero contents in the padding bytes.
+    # Bug: 23828506
+    if padded:
+      clobbered_blocks = [self.total_blocks-1, self.total_blocks]
+    else:
+      clobbered_blocks = []
+    self.clobbered_blocks = clobbered_blocks
+    self.extended = RangeSet()
+
+    zero_blocks = []
+    nonzero_blocks = []
+    reference = '\0' * self.blocksize
+
+    for i in range(self.total_blocks-1 if padded else self.total_blocks):
+      d = self.data[i*self.blocksize : (i+1)*self.blocksize]
+      if d == reference:
+        zero_blocks.append(i)
+        zero_blocks.append(i+1)
+      else:
+        nonzero_blocks.append(i)
+        nonzero_blocks.append(i+1)
+
+    assert zero_blocks or nonzero_blocks or clobbered_blocks
+
+    self.file_map = dict()
+    if zero_blocks:
+      self.file_map["__ZERO"] = RangeSet(data=zero_blocks)
+    if nonzero_blocks:
+      self.file_map["__NONZERO"] = RangeSet(data=nonzero_blocks)
+    if clobbered_blocks:
+      self.file_map["__COPY"] = RangeSet(data=clobbered_blocks)
+
+  def _GetRangeData(self, ranges):
+    for s, e in ranges:
+      yield self.data[s*self.blocksize:e*self.blocksize]
+
+  def RangeSha1(self, ranges):
+    h = sha1()
+    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
+      h.update(data)
+    return h.hexdigest()
+
+  def ReadRangeSet(self, ranges):
+    return list(self._GetRangeData(ranges))
+
+  def TotalSha1(self, include_clobbered_blocks=False):
+    if not include_clobbered_blocks:
+      return self.RangeSha1(self.care_map.subtract(self.clobbered_blocks))
+    return sha1(self.data).hexdigest()
+
+  def WriteRangeDataToFd(self, ranges, fd):
+    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
+      fd.write(data)
+
+
+class FileImage(Image):
+  """An image wrapped around a raw image file."""
+
+  def __init__(self, path, hashtree_info_generator=None):
+    self.path = path
+    self.blocksize = 4096
+    self._file_size = os.path.getsize(self.path)
+    self._file = open(self.path, 'rb')
+
+    if self._file_size % self.blocksize != 0:
+      raise ValueError("Size of file %s must be multiple of %d bytes, but is %d"
+                       % self.path, self.blocksize, self._file_size)
+
+    self.total_blocks = self._file_size // self.blocksize
+    self.care_map = RangeSet(data=(0, self.total_blocks))
+    self.clobbered_blocks = RangeSet()
+    self.extended = RangeSet()
+
+    self.generator_lock = threading.Lock()
+
+    self.hashtree_info = None
+    if hashtree_info_generator:
+      self.hashtree_info = hashtree_info_generator.Generate(self)
+
+    zero_blocks = []
+    nonzero_blocks = []
+    reference = '\0' * self.blocksize
+
+    for i in range(self.total_blocks):
+      d = self._file.read(self.blocksize)
+      if d == reference:
+        zero_blocks.append(i)
+        zero_blocks.append(i+1)
+      else:
+        nonzero_blocks.append(i)
+        nonzero_blocks.append(i+1)
+
+    assert zero_blocks or nonzero_blocks
+
+    self.file_map = {}
+    if zero_blocks:
+      self.file_map["__ZERO"] = RangeSet(data=zero_blocks)
+    if nonzero_blocks:
+      self.file_map["__NONZERO"] = RangeSet(data=nonzero_blocks)
+    if self.hashtree_info:
+      self.file_map["__HASHTREE"] = self.hashtree_info.hashtree_range
+
+  def __del__(self):
+    self._file.close()
+
+  def _GetRangeData(self, ranges):
+    # Use a lock to protect the generator so that we will not run two
+    # instances of this generator on the same object simultaneously.
+    with self.generator_lock:
+      for s, e in ranges:
+        self._file.seek(s * self.blocksize)
+        for _ in range(s, e):
+          yield self._file.read(self.blocksize)
+
+  def RangeSha1(self, ranges):
+    h = sha1()
+    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
+      h.update(data)
+    return h.hexdigest()
+
+  def ReadRangeSet(self, ranges):
+    return list(self._GetRangeData(ranges))
+
+  def TotalSha1(self, include_clobbered_blocks=False):
+    assert not self.clobbered_blocks
+    return self.RangeSha1(self.care_map)
+
+  def WriteRangeDataToFd(self, ranges, fd):
+    for data in self._GetRangeData(ranges): # pylint: disable=not-an-iterable
+      fd.write(data)
diff --git a/tools/releasetools/img_from_target_files.py b/tools/releasetools/img_from_target_files.py
index e01b5e8..ab38d0d 100755
--- a/tools/releasetools/img_from_target_files.py
+++ b/tools/releasetools/img_from_target_files.py
@@ -15,22 +15,32 @@
 # limitations under the License.
 
 """
-Given a target-files zipfile, produces an image zipfile suitable for
-use with 'fastboot update'.
+Given an input target-files, produces an image zipfile suitable for use with
+'fastboot update'.
 
 Usage:  img_from_target_files [flags] input_target_files output_image_zip
 
+input_target_files: Path to the input target_files zip.
+
+Flags:
   -z  (--bootable_zip)
       Include only the bootable images (eg 'boot' and 'recovery') in
       the output.
 
+  --additional <filespec>
+      Include an additional entry into the generated zip file. The filespec is
+      in a format that's accepted by zip2zip (e.g.
+      'OTA/android-info.txt:android-info.txt', to copy `OTA/android-info.txt`
+      from input_file into output_file as `android-info.txt`. Refer to the
+      `filespec` arg in zip2zip's help message). The option can be repeated to
+      include multiple entries.
+
 """
 
 from __future__ import print_function
 
 import logging
 import os
-import shutil
 import sys
 import zipfile
 
@@ -38,152 +48,196 @@
 from build_super_image import BuildSuperImage
 
 if sys.hexversion < 0x02070000:
-  print("Python 2.7 or newer is required.", file=sys.stderr)
+  print('Python 2.7 or newer is required.', file=sys.stderr)
   sys.exit(1)
 
 logger = logging.getLogger(__name__)
 
 OPTIONS = common.OPTIONS
 
+OPTIONS.additional_entries = []
+OPTIONS.bootable_only = False
+OPTIONS.put_super = None
+OPTIONS.dynamic_partition_list = None
+OPTIONS.super_device_list = None
+OPTIONS.retrofit_dap = None
+OPTIONS.build_super = None
+OPTIONS.sparse_userimages = None
+
 
 def LoadOptions(input_file):
-  """
-  Load information from input_file to OPTIONS.
+  """Loads information from input_file to OPTIONS.
 
   Args:
-    input_file: A Zipfile instance of input zip file, or path to the directory
-      of extracted zip.
+    input_file: Path to the input target_files zip file.
   """
-  info = OPTIONS.info_dict = common.LoadInfoDict(input_file)
+  with zipfile.ZipFile(input_file) as input_zip:
+    info = OPTIONS.info_dict = common.LoadInfoDict(input_zip)
 
-  OPTIONS.put_super = info.get("super_image_in_update_package") == "true"
-  OPTIONS.dynamic_partition_list = info.get("dynamic_partition_list",
-                                            "").strip().split()
-  OPTIONS.super_device_list = info.get("super_block_devices",
-                                       "").strip().split()
-  OPTIONS.retrofit_dap = info.get("dynamic_partition_retrofit") == "true"
-  OPTIONS.build_super = info.get("build_super_partition") == "true"
-  OPTIONS.sparse_userimages = bool(info.get("extfs_sparse_flag"))
+  OPTIONS.put_super = info.get('super_image_in_update_package') == 'true'
+  OPTIONS.dynamic_partition_list = info.get('dynamic_partition_list',
+                                            '').strip().split()
+  OPTIONS.super_device_list = info.get('super_block_devices',
+                                       '').strip().split()
+  OPTIONS.retrofit_dap = info.get('dynamic_partition_retrofit') == 'true'
+  OPTIONS.build_super = info.get('build_super_partition') == 'true'
+  OPTIONS.sparse_userimages = bool(info.get('extfs_sparse_flag'))
 
 
-def CopyInfo(input_tmp, output_zip):
-  """Copy the android-info.txt file from the input to the output."""
-  common.ZipWrite(
-      output_zip, os.path.join(input_tmp, "OTA", "android-info.txt"),
-      "android-info.txt")
-
-
-def CopyUserImages(input_tmp, output_zip):
-  """
-  Copy user images from the unzipped input and write to output_zip.
+def CopyZipEntries(input_file, output_file, entries):
+  """Copies ZIP entries between input and output files.
 
   Args:
-    input_tmp: path to the unzipped input.
-    output_zip: a ZipFile instance to write images to.
+    input_file: Path to the input target_files zip.
+    output_file: Output filename.
+    entries: A list of entries to copy, in a format that's accepted by zip2zip
+        (e.g. 'OTA/android-info.txt:android-info.txt', which copies
+        `OTA/android-info.txt` from input_file into output_file as
+        `android-info.txt`. Refer to the `filespec` arg in zip2zip's help
+        message).
   """
-  dynamic_images = [p + ".img" for p in OPTIONS.dynamic_partition_list]
+  logger.info('Writing %d entries to archive...', len(entries))
+  cmd = ['zip2zip', '-i', input_file, '-o', output_file]
+  cmd.extend(entries)
+  common.RunAndCheckOutput(cmd)
+
+
+def EntriesForUserImages(input_file):
+  """Returns the user images entries to be copied.
+
+  Args:
+    input_file: Path to the input target_files zip file.
+  """
+  dynamic_images = [p + '.img' for p in OPTIONS.dynamic_partition_list]
 
   # Filter out system_other for launch DAP devices because it is in super image.
-  if not OPTIONS.retrofit_dap and "system" in OPTIONS.dynamic_partition_list:
-    dynamic_images.append("system_other.img")
+  if not OPTIONS.retrofit_dap and 'system' in OPTIONS.dynamic_partition_list:
+    dynamic_images.append('system_other.img')
 
-  images_path = os.path.join(input_tmp, "IMAGES")
-  # A target-files zip must contain the images since Lollipop.
-  assert os.path.exists(images_path)
-  for image in sorted(os.listdir(images_path)):
-    if OPTIONS.bootable_only and image not in ("boot.img", "recovery.img"):
+  entries = [
+      'OTA/android-info.txt:android-info.txt',
+  ]
+  with zipfile.ZipFile(input_file) as input_zip:
+    namelist = input_zip.namelist()
+
+  for image_path in [name for name in namelist if name.startswith('IMAGES/')]:
+    image = os.path.basename(image_path)
+    if OPTIONS.bootable_only and image not in ('boot.img', 'recovery.img'):
       continue
-    if not image.endswith(".img"):
+    if not image.endswith('.img'):
       continue
-    if image == "recovery-two-step.img":
-      continue
+    # Filter out super_empty and the images that are already in super partition.
     if OPTIONS.put_super:
-      if image == "super_empty.img":
+      if image == 'super_empty.img':
         continue
       if image in dynamic_images:
         continue
-    logger.info("writing %s to archive...", os.path.join("IMAGES", image))
-    common.ZipWrite(output_zip, os.path.join(images_path, image), image)
+    entries.append('{}:{}'.format(image_path, image))
+  return entries
 
 
-def WriteSuperImages(input_tmp, output_zip):
-  """
-  Write super images from the unzipped input and write to output_zip. This is
-  only done if super_image_in_update_package is set to "true".
+def EntriesForSplitSuperImages(input_file):
+  """Returns the entries for split super images.
 
-  - For retrofit dynamic partition devices, copy split super images from target
-    files package.
-  - For devices launched with dynamic partitions, build super image from target
-    files package.
+  This is only done for retrofit dynamic partition devices.
 
   Args:
-    input_tmp: path to the unzipped input.
-    output_zip: a ZipFile instance to write images to.
+    input_file: Path to the input target_files zip file.
   """
-  if not OPTIONS.build_super or not OPTIONS.put_super:
-    return
+  with zipfile.ZipFile(input_file) as input_zip:
+    namelist = input_zip.namelist()
+  entries = []
+  for device in OPTIONS.super_device_list:
+    image = 'OTA/super_{}.img'.format(device)
+    assert image in namelist, 'Failed to find {}'.format(image)
+    entries.append('{}:{}'.format(image, os.path.basename(image)))
+  return entries
 
-  if OPTIONS.retrofit_dap:
-    # retrofit devices already have split super images under OTA/
-    images_path = os.path.join(input_tmp, "OTA")
-    for device in OPTIONS.super_device_list:
-      image = "super_%s.img" % device
-      image_path = os.path.join(images_path, image)
-      assert os.path.exists(image_path)
-      logger.info("writing %s to archive...", os.path.join("OTA", image))
-      common.ZipWrite(output_zip, image_path, image)
-  else:
-    # super image for non-retrofit devices aren't in target files package,
-    # so build it.
-    super_file = common.MakeTempFile("super_", ".img")
-    logger.info("building super image %s...", super_file)
-    BuildSuperImage(input_tmp, super_file)
-    logger.info("writing super.img to archive...")
-    common.ZipWrite(output_zip, super_file, "super.img")
+
+def RebuildAndWriteSuperImages(input_file, output_file):
+  """Builds and writes super images to the output file."""
+  logger.info('Building super image...')
+
+  # We need files under IMAGES/, OTA/, META/ for img_from_target_files.py.
+  # However, common.LoadInfoDict() may read additional files under BOOT/,
+  # RECOVERY/ and ROOT/. So unzip everything from the target_files.zip.
+  input_tmp = common.UnzipTemp(input_file)
+
+  super_file = common.MakeTempFile('super_', '.img')
+  BuildSuperImage(input_tmp, super_file)
+
+  logger.info('Writing super.img to archive...')
+  with zipfile.ZipFile(
+      output_file, 'a', compression=zipfile.ZIP_DEFLATED,
+      allowZip64=not OPTIONS.sparse_userimages) as output_zip:
+    common.ZipWrite(output_zip, super_file, 'super.img')
+
+
+def ImgFromTargetFiles(input_file, output_file):
+  """Creates an image archive from the input target_files zip.
+
+  Args:
+    input_file: Path to the input target_files zip.
+    output_file: Output filename.
+
+  Raises:
+    ValueError: On invalid input.
+  """
+  if not zipfile.is_zipfile(input_file):
+    raise ValueError('%s is not a valid zipfile' % input_file)
+
+  logger.info('Building image zip from target files zip.')
+
+  LoadOptions(input_file)
+
+  # Entries to be copied into the output file.
+  entries = EntriesForUserImages(input_file)
+
+  # Only for devices that retrofit dynamic partitions there're split super
+  # images available in the target_files.zip.
+  rebuild_super = False
+  if OPTIONS.build_super and OPTIONS.put_super:
+    if OPTIONS.retrofit_dap:
+      entries += EntriesForSplitSuperImages(input_file)
+    else:
+      rebuild_super = True
+
+  # Any additional entries provided by caller.
+  entries += OPTIONS.additional_entries
+
+  CopyZipEntries(input_file, output_file, entries)
+
+  if rebuild_super:
+    RebuildAndWriteSuperImages(input_file, output_file)
 
 
 def main(argv):
-  # This allows modifying the value from inner function.
-  bootable_only_array = [False]
 
-  def option_handler(o, _):
-    if o in ("-z", "--bootable_zip"):
-      bootable_only_array[0] = True
+  def option_handler(o, a):
+    if o in ('-z', '--bootable_zip'):
+      OPTIONS.bootable_only = True
+    elif o == '--additional':
+      OPTIONS.additional_entries.append(a)
     else:
       return False
     return True
 
   args = common.ParseOptions(argv, __doc__,
-                             extra_opts="z",
-                             extra_long_opts=["bootable_zip"],
+                             extra_opts='z',
+                             extra_long_opts=[
+                                 'additional=',
+                                 'bootable_zip',
+                             ],
                              extra_option_handler=option_handler)
-
-  OPTIONS.bootable_only = bootable_only_array[0]
-
   if len(args) != 2:
     common.Usage(__doc__)
     sys.exit(1)
 
   common.InitLogging()
 
-  # We need files under IMAGES/, OTA/, META/ for img_from_target_files.py.
-  # However, common.LoadInfoDict() may read additional files under BOOT/,
-  # RECOVERY/ and ROOT/. So unzip everything from the target_files.zip.
-  OPTIONS.input_tmp = common.UnzipTemp(args[0])
-  LoadOptions(OPTIONS.input_tmp)
-  output_zip = zipfile.ZipFile(args[1], "w", compression=zipfile.ZIP_DEFLATED,
-                               allowZip64=not OPTIONS.sparse_userimages)
+  ImgFromTargetFiles(args[0], args[1])
 
-  try:
-    CopyInfo(OPTIONS.input_tmp, output_zip)
-    CopyUserImages(OPTIONS.input_tmp, output_zip)
-    WriteSuperImages(OPTIONS.input_tmp, output_zip)
-  finally:
-    logger.info("cleaning up...")
-    common.ZipClose(output_zip)
-    shutil.rmtree(OPTIONS.input_tmp)
-
-  logger.info("done.")
+  logger.info('done.')
 
 
 if __name__ == '__main__':
@@ -191,5 +245,7 @@
     common.CloseInheritedPipes()
     main(sys.argv[1:])
   except common.ExternalError as e:
-    logger.exception("\n   ERROR:\n")
+    logger.exception('\n   ERROR:\n')
     sys.exit(1)
+  finally:
+    common.Cleanup()
diff --git a/tools/releasetools/make_recovery_patch b/tools/releasetools/make_recovery_patch
deleted file mode 120000
index 45cec08..0000000
--- a/tools/releasetools/make_recovery_patch
+++ /dev/null
@@ -1 +0,0 @@
-make_recovery_patch.py
\ No newline at end of file
diff --git a/tools/releasetools/make_recovery_patch.py b/tools/releasetools/make_recovery_patch.py
old mode 100755
new mode 100644
index 725b355..1497d69
--- a/tools/releasetools/make_recovery_patch.py
+++ b/tools/releasetools/make_recovery_patch.py
@@ -47,8 +47,17 @@
   if not recovery_img or not boot_img:
     sys.exit(0)
 
+  board_uses_vendorimage = OPTIONS.info_dict.get(
+      "board_uses_vendorimage") == "true"
+
+  if board_uses_vendorimage:
+    target_files_dir = "VENDOR"
+  else:
+    target_files_dir = "SYSTEM"
+
   def output_sink(fn, data):
-    with open(os.path.join(output_dir, "SYSTEM", *fn.split("/")), "wb") as f:
+    with open(os.path.join(output_dir, target_files_dir,
+                           *fn.split("/")), "wb") as f:
       f.write(data)
 
   common.MakeRecoveryPatch(input_dir, output_sink, recovery_img, boot_img)
diff --git a/tools/releasetools/merge_builds.py b/tools/releasetools/merge_builds.py
new file mode 100644
index 0000000..3ac4ec4
--- /dev/null
+++ b/tools/releasetools/merge_builds.py
@@ -0,0 +1,192 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy of
+# the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations under
+# the License.
+#
+"""Merges two non-dist partial builds together.
+
+Given two partial builds, a framework build and a vendor build, merge the builds
+together so that the images can be flashed using 'fastboot flashall'.
+
+To support both DAP and non-DAP vendor builds with a single framework partial
+build, the framework partial build should always be built with DAP enabled. The
+vendor partial build determines whether the merged result supports DAP.
+
+This script does not require builds to be built with 'make dist'.
+This script regenerates super_empty.img and vbmeta.img if necessary. Other
+images are assumed to not require regeneration.
+
+Usage: merge_builds.py [args]
+
+  --framework_images comma_separated_image_list
+      Comma-separated list of image names that should come from the framework
+      build.
+
+  --product_out_framework product_out_framework_path
+      Path to out/target/product/<framework build>.
+
+  --product_out_vendor product_out_vendor_path
+      Path to out/target/product/<vendor build>.
+
+  --build_vbmeta
+      If provided, vbmeta.img will be regenerated in out/target/product/<vendor
+      build>.
+
+  --framework_misc_info_keys
+      The optional path to a newline-separated config file containing keys to
+      obtain from the framework instance of misc_info.txt, used for creating
+      vbmeta.img. The remaining keys come from the vendor instance.
+"""
+from __future__ import print_function
+
+import logging
+import os
+import sys
+
+import build_super_image
+import common
+
+logger = logging.getLogger(__name__)
+
+OPTIONS = common.OPTIONS
+OPTIONS.framework_images = ("system",)
+OPTIONS.product_out_framework = None
+OPTIONS.product_out_vendor = None
+OPTIONS.build_vbmeta = False
+OPTIONS.framework_misc_info_keys = None
+
+
+def CreateImageSymlinks():
+  for image in OPTIONS.framework_images:
+    image_path = os.path.join(OPTIONS.product_out_framework, "%s.img" % image)
+    symlink_path = os.path.join(OPTIONS.product_out_vendor, "%s.img" % image)
+    if os.path.exists(symlink_path):
+      if os.path.islink(symlink_path):
+        os.remove(symlink_path)
+      else:
+        raise ValueError("Attempting to overwrite built image: %s" %
+                         symlink_path)
+    os.symlink(image_path, symlink_path)
+
+
+def BuildSuperEmpty():
+  framework_dict = common.LoadDictionaryFromFile(
+      os.path.join(OPTIONS.product_out_framework, "misc_info.txt"))
+  vendor_dict = common.LoadDictionaryFromFile(
+      os.path.join(OPTIONS.product_out_vendor, "misc_info.txt"))
+  # Regenerate super_empty.img if both partial builds enable DAP. If only the
+  # the vendor build enables DAP, the vendor build's existing super_empty.img
+  # will be reused. If only the framework build should enable DAP, super_empty
+  # should be included in the --framework_images flag to copy the existing
+  # super_empty.img from the framework build.
+  if (framework_dict.get("use_dynamic_partitions") == "true") and (
+      vendor_dict.get("use_dynamic_partitions") == "true"):
+    logger.info("Building super_empty.img.")
+    merged_dict = dict(vendor_dict)
+    merged_dict.update(
+        common.MergeDynamicPartitionInfoDicts(
+            framework_dict=framework_dict, vendor_dict=vendor_dict))
+    output_super_empty_path = os.path.join(OPTIONS.product_out_vendor,
+                                           "super_empty.img")
+    build_super_image.BuildSuperImage(merged_dict, output_super_empty_path)
+
+
+def BuildVBMeta():
+  logger.info("Building vbmeta.img.")
+
+  framework_dict = common.LoadDictionaryFromFile(
+      os.path.join(OPTIONS.product_out_framework, "misc_info.txt"))
+  vendor_dict = common.LoadDictionaryFromFile(
+      os.path.join(OPTIONS.product_out_vendor, "misc_info.txt"))
+  merged_dict = dict(vendor_dict)
+  if OPTIONS.framework_misc_info_keys:
+    for key in common.LoadListFromFile(OPTIONS.framework_misc_info_keys):
+      merged_dict[key] = framework_dict[key]
+
+  # Build vbmeta.img using partitions in product_out_vendor.
+  partitions = {}
+  for partition in common.AVB_PARTITIONS:
+    partition_path = os.path.join(OPTIONS.product_out_vendor,
+                                  "%s.img" % partition)
+    if os.path.exists(partition_path):
+      partitions[partition] = partition_path
+
+  # vbmeta_partitions includes the partitions that should be included into
+  # top-level vbmeta.img, which are the ones that are not included in any
+  # chained VBMeta image plus the chained VBMeta images themselves.
+  vbmeta_partitions = common.AVB_PARTITIONS[:]
+  for partition in common.AVB_VBMETA_PARTITIONS:
+    chained_partitions = merged_dict.get("avb_%s" % partition, "").strip()
+    if chained_partitions:
+      partitions[partition] = os.path.join(OPTIONS.product_out_vendor,
+                                           "%s.img" % partition)
+      vbmeta_partitions = [
+          item for item in vbmeta_partitions
+          if item not in chained_partitions.split()
+      ]
+      vbmeta_partitions.append(partition)
+
+  output_vbmeta_path = os.path.join(OPTIONS.product_out_vendor, "vbmeta.img")
+  OPTIONS.info_dict = merged_dict
+  common.BuildVBMeta(output_vbmeta_path, partitions, "vbmeta",
+                     vbmeta_partitions)
+
+
+def MergeBuilds():
+  CreateImageSymlinks()
+  BuildSuperEmpty()
+  if OPTIONS.build_vbmeta:
+    BuildVBMeta()
+
+
+def main():
+  common.InitLogging()
+
+  def option_handler(o, a):
+    if o == "--framework_images":
+      OPTIONS.framework_images = [i.strip() for i in a.split(",")]
+    elif o == "--product_out_framework":
+      OPTIONS.product_out_framework = a
+    elif o == "--product_out_vendor":
+      OPTIONS.product_out_vendor = a
+    elif o == "--build_vbmeta":
+      OPTIONS.build_vbmeta = True
+    elif o == "--framework_misc_info_keys":
+      OPTIONS.framework_misc_info_keys = a
+    else:
+      return False
+    return True
+
+  args = common.ParseOptions(
+      sys.argv[1:],
+      __doc__,
+      extra_long_opts=[
+          "framework_images=",
+          "product_out_framework=",
+          "product_out_vendor=",
+          "build_vbmeta",
+          "framework_misc_info_keys=",
+      ],
+      extra_option_handler=option_handler)
+
+  if (args or OPTIONS.product_out_framework is None or
+      OPTIONS.product_out_vendor is None):
+    common.Usage(__doc__)
+    sys.exit(1)
+
+  MergeBuilds()
+
+
+if __name__ == "__main__":
+  main()
diff --git a/tools/releasetools/merge_target_files.py b/tools/releasetools/merge_target_files.py
index 712e3f7..dd7806b 100755
--- a/tools/releasetools/merge_target_files.py
+++ b/tools/releasetools/merge_target_files.py
@@ -13,40 +13,62 @@
 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations under
 # the License.
+#
+"""This script merges two partial target files packages.
 
-"""
-This script merges two partial target files packages (one of which contains
-system files, and the other contains non-system files) together, producing a
-complete target files package that can be used to generate an OTA package.
+One package contains framework files, and the other contains vendor files.
+It produces a complete target files package that can be used to generate an
+OTA package.
 
 Usage: merge_target_files.py [args]
 
-  --system-target-files system-target-files-zip-archive
-      The input target files package containing system bits. This is a zip
+  --framework-target-files framework-target-files-zip-archive
+      The input target files package containing framework bits. This is a zip
       archive.
 
-  --system-item-list system-item-list-file
+  --framework-item-list framework-item-list-file
       The optional path to a newline-separated config file that replaces the
-      contents of default_system_item_list if provided.
+      contents of DEFAULT_FRAMEWORK_ITEM_LIST if provided.
 
-  --system-misc-info-keys system-misc-info-keys-file
+  --framework-misc-info-keys framework-misc-info-keys-file
       The optional path to a newline-separated config file that replaces the
-      contents of default_system_misc_info_keys if provided.
+      contents of DEFAULT_FRAMEWORK_MISC_INFO_KEYS if provided.
 
-  --other-target-files other-target-files-zip-archive
-      The input target files package containing other bits. This is a zip
+  --vendor-target-files vendor-target-files-zip-archive
+      The input target files package containing vendor bits. This is a zip
       archive.
 
-  --other-item-list other-item-list-file
+  --vendor-item-list vendor-item-list-file
       The optional path to a newline-separated config file that replaces the
-      contents of default_other_item_list if provided.
+      contents of DEFAULT_VENDOR_ITEM_LIST if provided.
 
   --output-target-files output-target-files-package
-      The output merged target files package. Also a zip archive.
+      If provided, the output merged target files package. Also a zip archive.
+
+  --output-dir output-directory
+      If provided, the destination directory for saving merged files. Requires
+      the --output-item-list flag.
+      Can be provided alongside --output-target-files, or by itself.
+
+  --output-item-list output-item-list-file.
+      The optional path to a newline-separated config file that specifies the
+      file patterns to copy into the --output-dir. Required if providing
+      the --output-dir flag.
+
+  --output-ota output-ota-package
+      The output ota package. This is a zip archive. Use of this flag may
+      require passing the --path common flag; see common.py.
+
+  --output-img output-img-package
+      The output img package, suitable for use with 'fastboot update'. Use of
+      this flag may require passing the --path common flag; see common.py.
+
+  --output-super-empty output-super-empty-image
+      If provided, creates a super_empty.img file from the merged target
+      files package and saves it at this path.
 
   --rebuild_recovery
-      Rebuild the recovery patch used by non-A/B devices and write it to the
-      system image.
+      Deprecated; does nothing.
 
   --keep-tmp
       Keep tempoary files for debugging purposes.
@@ -57,54 +79,86 @@
 import fnmatch
 import logging
 import os
+import re
+import shutil
+import subprocess
 import sys
 import zipfile
 
-import common
 import add_img_to_target_files
+import build_super_image
+import check_target_files_vintf
+import common
+import img_from_target_files
+import ota_from_target_files
 
 logger = logging.getLogger(__name__)
+
 OPTIONS = common.OPTIONS
-OPTIONS.verbose = True
-OPTIONS.system_target_files = None
-OPTIONS.system_item_list = None
-OPTIONS.system_misc_info_keys = None
-OPTIONS.other_target_files = None
-OPTIONS.other_item_list = None
+OPTIONS.framework_target_files = None
+OPTIONS.framework_item_list = None
+OPTIONS.framework_misc_info_keys = None
+OPTIONS.vendor_target_files = None
+OPTIONS.vendor_item_list = None
 OPTIONS.output_target_files = None
+OPTIONS.output_dir = None
+OPTIONS.output_item_list = None
+OPTIONS.output_ota = None
+OPTIONS.output_img = None
+OPTIONS.output_super_empty = None
+# TODO(b/132730255): Remove this option.
 OPTIONS.rebuild_recovery = False
 OPTIONS.keep_tmp = False
 
-# default_system_item_list is a list of items to extract from the partial
-# system target files package as is, meaning these items will land in the
-# output target files package exactly as they appear in the input partial
-# system target files package.
+# In an item list (framework or vendor), we may see entries that select whole
+# partitions. Such an entry might look like this 'SYSTEM/*' (e.g., for the
+# system partition). The following regex matches this and extracts the
+# partition name.
 
-default_system_item_list = [
+PARTITION_ITEM_PATTERN = re.compile(r'^([A-Z_]+)/\*$')
+
+# In apexkeys.txt or apkcerts.txt, we will find partition tags on each entry in
+# the file. We use these partition tags to filter the entries in those files
+# from the two different target files packages to produce a merged apexkeys.txt
+# or apkcerts.txt file. A partition tag (e.g., for the product partition) looks
+# like this: 'partition="product"'. We use the group syntax grab the value of
+# the tag. We use non-greedy matching in case there are other fields on the
+# same line.
+
+PARTITION_TAG_PATTERN = re.compile(r'partition="(.*?)"')
+
+# The sorting algorithm for apexkeys.txt and apkcerts.txt does not include the
+# ".apex" or ".apk" suffix, so we use the following pattern to extract a key.
+
+MODULE_KEY_PATTERN = re.compile(r'name="(.+)\.(apex|apk)"')
+
+# DEFAULT_FRAMEWORK_ITEM_LIST is a list of items to extract from the partial
+# framework target files package as is, meaning these items will land in the
+# output target files package exactly as they appear in the input partial
+# framework target files package.
+
+DEFAULT_FRAMEWORK_ITEM_LIST = (
     'META/apkcerts.txt',
     'META/filesystem_config.txt',
     'META/root_filesystem_config.txt',
-    'META/system_manifest.xml',
-    'META/system_matrix.xml',
     'META/update_engine_config.txt',
     'PRODUCT/*',
     'ROOT/*',
     'SYSTEM/*',
-]
+)
 
-# system_extract_special_item_list is a list of items to extract from the
-# partial system target files package that need some special processing, such
-# as some sort of combination with items from the partial other target files
+# FRAMEWORK_EXTRACT_SPECIAL_ITEM_LIST is a list of items to extract from the
+# partial framework target files package that need some special processing, such
+# as some sort of combination with items from the partial vendor target files
 # package.
 
-system_extract_special_item_list = [
-    'META/*',
-]
+FRAMEWORK_EXTRACT_SPECIAL_ITEM_LIST = ('META/*',)
 
-# default_system_misc_info_keys is a list of keys to obtain from the system instance of
-# META/misc_info.txt. The remaining keys from the other instance.
+# DEFAULT_FRAMEWORK_MISC_INFO_KEYS is a list of keys to obtain from the
+# framework instance of META/misc_info.txt. The remaining keys from the
+# vendor instance.
 
-default_system_misc_info_keys = [
+DEFAULT_FRAMEWORK_MISC_INFO_KEYS = (
     'avb_system_hashtree_enable',
     'avb_system_add_hashtree_footer_args',
     'avb_system_key_path',
@@ -112,27 +166,25 @@
     'avb_system_rollback_index_location',
     'avb_product_hashtree_enable',
     'avb_product_add_hashtree_footer_args',
-    'avb_product_services_hashtree_enable',
-    'avb_product_services_add_hashtree_footer_args',
+    'avb_system_ext_hashtree_enable',
+    'avb_system_ext_add_hashtree_footer_args',
     'system_root_image',
     'root_dir',
     'ab_update',
     'default_system_dev_certificate',
     'system_size',
-]
+)
 
-# default_other_item_list is a list of items to extract from the partial
-# other target files package as is, meaning these items will land in the output
-# target files package exactly as they appear in the input partial other target
+# DEFAULT_VENDOR_ITEM_LIST is a list of items to extract from the partial
+# vendor target files package as is, meaning these items will land in the output
+# target files package exactly as they appear in the input partial vendor target
 # files package.
 
-default_other_item_list = [
+DEFAULT_VENDOR_ITEM_LIST = (
     'META/boot_filesystem_config.txt',
     'META/otakeys.txt',
     'META/releasetools.py',
     'META/vendor_filesystem_config.txt',
-    'META/vendor_manifest.xml',
-    'META/vendor_matrix.xml',
     'BOOT/*',
     'DATA/*',
     'ODM/*',
@@ -140,30 +192,63 @@
     'PREBUILT_IMAGES/*',
     'RADIO/*',
     'VENDOR/*',
-]
+)
 
-# other_extract_special_item_list is a list of items to extract from the
-# partial other target files package that need some special processing, such as
-# some sort of combination with items from the partial system target files
+# VENDOR_EXTRACT_SPECIAL_ITEM_LIST is a list of items to extract from the
+# partial vendor target files package that need some special processing, such as
+# some sort of combination with items from the partial framework target files
 # package.
 
-other_extract_special_item_list = [
-    'META/*',
-]
+VENDOR_EXTRACT_SPECIAL_ITEM_LIST = ('META/*',)
+
+# The merge config lists should not attempt to extract items from both
+# builds for any of the following partitions. The partitions in
+# SINGLE_BUILD_PARTITIONS should come entirely from a single build (either
+# framework or vendor, but not both).
+
+SINGLE_BUILD_PARTITIONS = (
+    'BOOT/',
+    'DATA/',
+    'ODM/',
+    'PRODUCT/',
+    'SYSTEM_EXT/',
+    'RADIO/',
+    'RECOVERY/',
+    'ROOT/',
+    'SYSTEM/',
+    'SYSTEM_OTHER/',
+    'VENDOR/',
+)
+
+
+def write_sorted_data(data, path):
+  """Writes the sorted contents of either a list or dict to file.
+
+  This function sorts the contents of the list or dict and then writes the
+  resulting sorted contents to a file specified by path.
+
+  Args:
+    data: The list or dict to sort and write.
+    path: Path to the file to write the sorted values to. The file at path will
+      be overridden if it exists.
+  """
+  with open(path, 'w') as output:
+    for entry in sorted(data):
+      out_str = '{}={}\n'.format(entry, data[entry]) if isinstance(
+          data, dict) else '{}\n'.format(entry)
+      output.write(out_str)
 
 
 def extract_items(target_files, target_files_temp_dir, extract_item_list):
-  """Extract items from target files to temporary directory.
+  """Extracts items from target files to temporary directory.
 
   This function extracts from the specified target files zip archive into the
   specified temporary directory, the items specified in the extract item list.
 
   Args:
     target_files: The target files zip archive from which to extract items.
-
     target_files_temp_dir: The temporary directory where the extracted items
-    will land.
-
+      will land.
     extract_item_list: A list of items to extract.
   """
 
@@ -172,10 +257,7 @@
   # Filter the extract_item_list to remove any items that do not exist in the
   # zip file. Otherwise, the extraction step will fail.
 
-  with zipfile.ZipFile(
-      target_files,
-      'r',
-      allowZip64=True) as target_files_zipfile:
+  with zipfile.ZipFile(target_files, allowZip64=True) as target_files_zipfile:
     target_files_namelist = target_files_zipfile.namelist()
 
   filtered_extract_item_list = []
@@ -189,453 +271,532 @@
   # Extract from target_files into target_files_temp_dir the
   # filtered_extract_item_list.
 
-  common.UnzipToDir(
-      target_files,
-      target_files_temp_dir,
-      filtered_extract_item_list)
+  common.UnzipToDir(target_files, target_files_temp_dir,
+                    filtered_extract_item_list)
 
 
-def read_config_list(config_file_path):
-  """Reads a config file into a list of strings.
+def copy_items(from_dir, to_dir, patterns):
+  """Similar to extract_items() except uses an input dir instead of zip."""
+  file_paths = []
+  for dirpath, _, filenames in os.walk(from_dir):
+    file_paths.extend(
+        os.path.relpath(path=os.path.join(dirpath, filename), start=from_dir)
+        for filename in filenames)
 
-  Expects the file to be newline-separated.
+  filtered_file_paths = set()
+  for pattern in patterns:
+    filtered_file_paths.update(fnmatch.filter(file_paths, pattern))
 
-  Args:
-    config_file_path: The path to the config file to open and read.
-  """
-  with open(config_file_path) as config_file:
-    return config_file.read().splitlines()
+  for file_path in filtered_file_paths:
+    original_file_path = os.path.join(from_dir, file_path)
+    copied_file_path = os.path.join(to_dir, file_path)
+    copied_file_dir = os.path.dirname(copied_file_path)
+    if not os.path.exists(copied_file_dir):
+      os.makedirs(copied_file_dir)
+    if os.path.islink(original_file_path):
+      os.symlink(os.readlink(original_file_path), copied_file_path)
+    else:
+      shutil.copyfile(original_file_path, copied_file_path)
 
 
-def validate_config_lists(
-    system_item_list,
-    system_misc_info_keys,
-    other_item_list):
+def validate_config_lists(framework_item_list, framework_misc_info_keys,
+                          vendor_item_list):
   """Performs validations on the merge config lists.
 
   Args:
-    system_item_list: The list of items to extract from the partial
-    system target files package as is.
-
-    system_misc_info_keys: A list of keys to obtain from the system instance
-    of META/misc_info.txt. The remaining keys from the other instance.
-
-    other_item_list: The list of items to extract from the partial
-    other target files package as is.
+    framework_item_list: The list of items to extract from the partial framework
+      target files package as is.
+    framework_misc_info_keys: A list of keys to obtain from the framework
+      instance of META/misc_info.txt. The remaining keys from the vendor
+      instance.
+    vendor_item_list: The list of items to extract from the partial vendor
+      target files package as is.
 
   Returns:
     False if a validation fails, otherwise true.
   """
-  default_combined_item_set = set(default_system_item_list)
-  default_combined_item_set.update(default_other_item_list)
+  has_error = False
 
-  combined_item_set = set(system_item_list)
-  combined_item_set.update(other_item_list)
+  default_combined_item_set = set(DEFAULT_FRAMEWORK_ITEM_LIST)
+  default_combined_item_set.update(DEFAULT_VENDOR_ITEM_LIST)
+
+  combined_item_set = set(framework_item_list)
+  combined_item_set.update(vendor_item_list)
 
   # Check that the merge config lists are not missing any item specified
   # by the default config lists.
   difference = default_combined_item_set.difference(combined_item_set)
   if difference:
-    logger.error('Missing merge config items: %s' % list(difference))
+    logger.error('Missing merge config items: %s', list(difference))
     logger.error('Please ensure missing items are in either the '
-                 'system-item-list or other-item-list files provided to '
+                 'framework-item-list or vendor-item-list files provided to '
                  'this script.')
-    return False
+    has_error = True
 
-  if ('dynamic_partition_list' in system_misc_info_keys) or (
-      'super_partition_groups' in system_misc_info_keys):
+  for partition in SINGLE_BUILD_PARTITIONS:
+    in_framework = any(
+        item.startswith(partition) for item in framework_item_list)
+    in_vendor = any(item.startswith(partition) for item in vendor_item_list)
+    if in_framework and in_vendor:
+      logger.error(
+          'Cannot extract items from %s for both the framework and vendor'
+          ' builds. Please ensure only one merge config item list'
+          ' includes %s.', partition, partition)
+      has_error = True
+
+  if ('dynamic_partition_list' in framework_misc_info_keys) or (
+      'super_partition_groups' in framework_misc_info_keys):
     logger.error('Dynamic partition misc info keys should come from '
-                 'the other instance of META/misc_info.txt.')
-    return False
+                 'the vendor instance of META/misc_info.txt.')
+    has_error = True
 
-  return True
+  return not has_error
 
 
-def process_ab_partitions_txt(
-    system_target_files_temp_dir,
-    other_target_files_temp_dir,
-    output_target_files_temp_dir):
-  """Perform special processing for META/ab_partitions.txt
+def process_ab_partitions_txt(framework_target_files_temp_dir,
+                              vendor_target_files_temp_dir,
+                              output_target_files_temp_dir):
+  """Performs special processing for META/ab_partitions.txt.
 
-  This function merges the contents of the META/ab_partitions.txt files from
-  the system directory and the other directory, placing the merged result in
-  the output directory. The precondition in that the files are already
-  extracted. The post condition is that the output META/ab_partitions.txt
-  contains the merged content. The format for each ab_partitions.txt a one
-  partition name per line. The output file contains the union of the parition
-  names.
+  This function merges the contents of the META/ab_partitions.txt files from the
+  framework directory and the vendor directory, placing the merged result in the
+  output directory. The precondition in that the files are already extracted.
+  The post condition is that the output META/ab_partitions.txt contains the
+  merged content. The format for each ab_partitions.txt a one partition name per
+  line. The output file contains the union of the parition names.
 
   Args:
-    system_target_files_temp_dir: The name of a directory containing the
-    special items extracted from the system target files package.
-
-    other_target_files_temp_dir: The name of a directory containing the
-    special items extracted from the other target files package.
-
-    output_target_files_temp_dir: The name of a directory that will be used
-    to create the output target files package after all the special cases
-    are processed.
+    framework_target_files_temp_dir: The name of a directory containing the
+      special items extracted from the framework target files package.
+    vendor_target_files_temp_dir: The name of a directory containing the special
+      items extracted from the vendor target files package.
+    output_target_files_temp_dir: The name of a directory that will be used to
+      create the output target files package after all the special cases are
+      processed.
   """
 
-  system_ab_partitions_txt = os.path.join(
-      system_target_files_temp_dir, 'META', 'ab_partitions.txt')
+  framework_ab_partitions_txt = os.path.join(framework_target_files_temp_dir,
+                                             'META', 'ab_partitions.txt')
 
-  other_ab_partitions_txt = os.path.join(
-      other_target_files_temp_dir, 'META', 'ab_partitions.txt')
+  vendor_ab_partitions_txt = os.path.join(vendor_target_files_temp_dir, 'META',
+                                          'ab_partitions.txt')
 
-  with open(system_ab_partitions_txt) as f:
-    system_ab_partitions = f.read().splitlines()
+  with open(framework_ab_partitions_txt) as f:
+    framework_ab_partitions = f.read().splitlines()
 
-  with open(other_ab_partitions_txt) as f:
-    other_ab_partitions = f.read().splitlines()
+  with open(vendor_ab_partitions_txt) as f:
+    vendor_ab_partitions = f.read().splitlines()
 
-  output_ab_partitions = set(system_ab_partitions + other_ab_partitions)
+  output_ab_partitions = set(framework_ab_partitions + vendor_ab_partitions)
 
-  output_ab_partitions_txt = os.path.join(
-      output_target_files_temp_dir, 'META', 'ab_partitions.txt')
+  output_ab_partitions_txt = os.path.join(output_target_files_temp_dir, 'META',
+                                          'ab_partitions.txt')
 
-  with open(output_ab_partitions_txt, 'w') as output:
-    for partition in sorted(output_ab_partitions):
-      output.write('%s\n' % partition)
+  write_sorted_data(data=output_ab_partitions, path=output_ab_partitions_txt)
 
 
-def append_recovery_to_filesystem_config(output_target_files_temp_dir):
-  """Perform special processing for META/filesystem_config.txt
-
-  This function appends recovery information to META/filesystem_config.txt
-  so that recovery patch regeneration will succeed.
-
-  Args:
-    output_target_files_temp_dir: The name of a directory that will be used
-    to create the output target files package after all the special cases
-    are processed. We find filesystem_config.txt here.
-  """
-
-  filesystem_config_txt = os.path.join(
-      output_target_files_temp_dir,
-      'META',
-      'filesystem_config.txt')
-
-  with open(filesystem_config_txt, 'a') as f:
-    # TODO(bpeckham) this data is hard coded. It should be generated
-    # programmatically.
-    f.write(
-        'system/bin/install-recovery.sh 0 0 750 '
-        'selabel=u:object_r:install_recovery_exec:s0 capabilities=0x0\n')
-    f.write(
-        'system/recovery-from-boot.p 0 0 644 '
-        'selabel=u:object_r:system_file:s0 capabilities=0x0\n')
-    f.write(
-        'system/etc/recovery.img 0 0 440 '
-        'selabel=u:object_r:install_recovery_exec:s0 capabilities=0x0\n')
-
-
-def process_misc_info_txt(
-    system_target_files_temp_dir,
-    other_target_files_temp_dir,
-    output_target_files_temp_dir,
-    system_misc_info_keys):
-  """Perform special processing for META/misc_info.txt
+def process_misc_info_txt(framework_target_files_temp_dir,
+                          vendor_target_files_temp_dir,
+                          output_target_files_temp_dir,
+                          framework_misc_info_keys):
+  """Performs special processing for META/misc_info.txt.
 
   This function merges the contents of the META/misc_info.txt files from the
-  system directory and the other directory, placing the merged result in the
+  framework directory and the vendor directory, placing the merged result in the
   output directory. The precondition in that the files are already extracted.
   The post condition is that the output META/misc_info.txt contains the merged
   content.
 
   Args:
-    system_target_files_temp_dir: The name of a directory containing the
-    special items extracted from the system target files package.
-
-    other_target_files_temp_dir: The name of a directory containing the
-    special items extracted from the other target files package.
-
-    output_target_files_temp_dir: The name of a directory that will be used
-    to create the output target files package after all the special cases
-    are processed.
-
-    system_misc_info_keys: A list of keys to obtain from the system instance
-    of META/misc_info.txt. The remaining keys from the other instance.
+    framework_target_files_temp_dir: The name of a directory containing the
+      special items extracted from the framework target files package.
+    vendor_target_files_temp_dir: The name of a directory containing the special
+      items extracted from the vendor target files package.
+    output_target_files_temp_dir: The name of a directory that will be used to
+      create the output target files package after all the special cases are
+      processed.
+    framework_misc_info_keys: A list of keys to obtain from the framework
+      instance of META/misc_info.txt. The remaining keys from the vendor
+      instance.
   """
 
-  def read_helper(d):
-    misc_info_txt = os.path.join(d, 'META', 'misc_info.txt')
-    with open(misc_info_txt) as f:
-      return list(f.read().splitlines())
+  misc_info_path = ['META', 'misc_info.txt']
+  framework_dict = common.LoadDictionaryFromFile(
+      os.path.join(framework_target_files_temp_dir, *misc_info_path))
 
-  system_info_dict = common.LoadDictionaryFromLines(
-      read_helper(system_target_files_temp_dir))
+  # We take most of the misc info from the vendor target files.
 
-  # We take most of the misc info from the other target files.
+  merged_dict = common.LoadDictionaryFromFile(
+      os.path.join(vendor_target_files_temp_dir, *misc_info_path))
 
-  merged_info_dict = common.LoadDictionaryFromLines(
-      read_helper(other_target_files_temp_dir))
+  # Replace certain values in merged_dict with values from
+  # framework_dict.
 
-  # Replace certain values in merged_info_dict with values from
-  # system_info_dict.
-
-  for key in system_misc_info_keys:
-    merged_info_dict[key] = system_info_dict[key]
+  for key in framework_misc_info_keys:
+    merged_dict[key] = framework_dict[key]
 
   # Merge misc info keys used for Dynamic Partitions.
-  if (merged_info_dict.get('use_dynamic_partitions') == 'true') and (
-      system_info_dict.get('use_dynamic_partitions') == 'true'):
-    merged_info_dict['dynamic_partition_list'] = '%s %s' % (
-        system_info_dict.get('dynamic_partition_list', ''),
-        merged_info_dict.get('dynamic_partition_list', ''))
-    # Partition groups and group sizes are defined by the other (non-system)
-    # misc info file because these values may vary for each board that uses
-    # a shared system image.
-    for partition_group in merged_info_dict['super_partition_groups'].split(' '):
-      if ('super_%s_group_size' % partition_group) not in merged_info_dict:
-        raise common.ExternalError(
-            'Other META/misc_info.txt does not contain required key '
-            'super_%s_group_size.' % partition_group)
-      key = 'super_%s_partition_list' % partition_group
-      merged_info_dict[key] = '%s %s' % (
-        system_info_dict.get(key, ''),
-        merged_info_dict.get(key, ''))
+  if (merged_dict.get('use_dynamic_partitions') == 'true') and (
+      framework_dict.get('use_dynamic_partitions') == 'true'):
+    merged_dynamic_partitions_dict = common.MergeDynamicPartitionInfoDicts(
+        framework_dict=framework_dict, vendor_dict=merged_dict)
+    merged_dict.update(merged_dynamic_partitions_dict)
     # Ensure that add_img_to_target_files rebuilds super split images for
     # devices that retrofit dynamic partitions. This flag may have been set to
     # false in the partial builds to prevent duplicate building of super.img.
     merged_dict['build_super_partition'] = 'true'
 
-  output_misc_info_txt = os.path.join(
-      output_target_files_temp_dir,
-      'META', 'misc_info.txt')
+  # Replace <image>_selinux_fc values with framework or vendor file_contexts.bin
+  # depending on which dictionary the key came from.
+  # Only the file basename is required because all selinux_fc properties are
+  # replaced with the full path to the file under META/ when misc_info.txt is
+  # loaded from target files for repacking. See common.py LoadInfoDict().
+  for key in merged_dict:
+    if key.endswith('_selinux_fc'):
+      merged_dict[key] = 'vendor_file_contexts.bin'
+  for key in framework_dict:
+    if key.endswith('_selinux_fc'):
+      merged_dict[key] = 'framework_file_contexts.bin'
 
-  sorted_keys = sorted(merged_info_dict.keys())
-
-  with open(output_misc_info_txt, 'w') as output:
-    for key in sorted_keys:
-      output.write('{}={}\n'.format(key, merged_info_dict[key]))
+  output_misc_info_txt = os.path.join(output_target_files_temp_dir, 'META',
+                                      'misc_info.txt')
+  write_sorted_data(data=merged_dict, path=output_misc_info_txt)
 
 
-def process_file_contexts_bin(temp_dir, output_target_files_temp_dir):
-  """Perform special processing for META/file_contexts.bin.
+def process_dynamic_partitions_info_txt(framework_target_files_dir,
+                                        vendor_target_files_dir,
+                                        output_target_files_dir):
+  """Performs special processing for META/dynamic_partitions_info.txt.
 
-  This function combines plat_file_contexts and vendor_file_contexts, which are
-  expected to already be extracted in temp_dir, to produce a merged
-  file_contexts.bin that will land in temp_dir at META/file_contexts.bin.
+  This function merges the contents of the META/dynamic_partitions_info.txt
+  files from the framework directory and the vendor directory, placing the
+  merged result in the output directory.
+
+  This function does nothing if META/dynamic_partitions_info.txt from the vendor
+  directory does not exist.
 
   Args:
-    temp_dir: The name of a scratch directory that this function can use for
-    intermediate files generated during processing.
-
-    output_target_files_temp_dir: The name of the working directory that must
-    already contain plat_file_contexts and vendor_file_contexts (in the
-    appropriate sub directories), and to which META/file_contexts.bin will be
-    written.
+    framework_target_files_dir: The name of a directory containing the special
+      items extracted from the framework target files package.
+    vendor_target_files_dir: The name of a directory containing the special
+      items extracted from the vendor target files package.
+    output_target_files_dir: The name of a directory that will be used to create
+      the output target files package after all the special cases are processed.
   """
 
-  # To create a merged file_contexts.bin file, we use the system and vendor
-  # file contexts files as input, the m4 tool to combine them, the sorting tool
-  # to sort, and finally the sefcontext_compile tool to generate the final
-  # output. We currently omit a checkfc step since the files had been checked
-  # as part of the build.
+  if not os.path.exists(
+      os.path.join(vendor_target_files_dir, 'META',
+                   'dynamic_partitions_info.txt')):
+    return
 
-  # The m4 step concatenates the two input files contexts files. Since m4
-  # writes to stdout, we receive that into an array of bytes, and then write it
-  # to a file.
+  dynamic_partitions_info_path = ['META', 'dynamic_partitions_info.txt']
 
-  # Collect the file contexts that we're going to combine from SYSTEM, VENDOR,
-  # PRODUCT, and ODM. We require SYSTEM and VENDOR, but others are optional.
+  framework_dynamic_partitions_dict = common.LoadDictionaryFromFile(
+      os.path.join(framework_target_files_dir, *dynamic_partitions_info_path))
+  vendor_dynamic_partitions_dict = common.LoadDictionaryFromFile(
+      os.path.join(vendor_target_files_dir, *dynamic_partitions_info_path))
 
-  file_contexts_list = []
+  merged_dynamic_partitions_dict = common.MergeDynamicPartitionInfoDicts(
+      framework_dict=framework_dynamic_partitions_dict,
+      vendor_dict=vendor_dynamic_partitions_dict)
 
-  for partition in ['SYSTEM', 'VENDOR', 'PRODUCT', 'ODM']:
-    prefix = 'plat' if partition == 'SYSTEM' else partition.lower()
-
-    file_contexts = os.path.join(
-        output_target_files_temp_dir,
-        partition, 'etc', 'selinux', prefix + '_file_contexts')
-
-    mandatory = partition in ['SYSTEM', 'VENDOR']
-
-    if mandatory or os.path.isfile(file_contexts):
-      file_contexts_list.append(file_contexts)
-    else:
-      logger.warning('file not found: %s', file_contexts)
-
-  command = ['m4', '--fatal-warnings', '-s'] + file_contexts_list
-
-  merged_content = common.RunAndCheckOutput(command, verbose=False)
-
-  merged_file_contexts_txt = os.path.join(temp_dir, 'merged_file_contexts.txt')
-
-  with open(merged_file_contexts_txt, 'wb') as f:
-    f.write(merged_content)
-
-  # The sort step sorts the concatenated file.
-
-  sorted_file_contexts_txt = os.path.join(temp_dir, 'sorted_file_contexts.txt')
-  command = ['fc_sort', merged_file_contexts_txt, sorted_file_contexts_txt]
-  common.RunAndWait(command, verbose=True)
-
-  # Finally, the compile step creates the final META/file_contexts.bin.
-
-  file_contexts_bin = os.path.join(
-      output_target_files_temp_dir,
-      'META', 'file_contexts.bin')
-
-  command = [
-      'sefcontext_compile',
-      '-o', file_contexts_bin,
-      sorted_file_contexts_txt,
-  ]
-
-  common.RunAndWait(command, verbose=True)
+  output_dynamic_partitions_info_txt = os.path.join(
+      output_target_files_dir, 'META', 'dynamic_partitions_info.txt')
+  write_sorted_data(
+      data=merged_dynamic_partitions_dict,
+      path=output_dynamic_partitions_info_txt)
 
 
-def process_special_cases(
-    temp_dir,
-    system_target_files_temp_dir,
-    other_target_files_temp_dir,
-    output_target_files_temp_dir,
-    system_misc_info_keys,
-    rebuild_recovery
-):
-  """Perform special-case processing for certain target files items.
+def item_list_to_partition_set(item_list):
+  """Converts a target files item list to a partition set.
+
+  The item list contains items that might look like 'SYSTEM/*' or 'VENDOR/*' or
+  'OTA/android-info.txt'. Items that end in '/*' are assumed to match entire
+  directories where 'SYSTEM' or 'VENDOR' is a directory name that identifies the
+  contents of a partition of the same name. Other items in the list, such as the
+  'OTA' example contain metadata. This function iterates such a list, returning
+  a set that contains the partition entries.
+
+  Args:
+    item_list: A list of items in a target files package.
+  Returns:
+    A set of partitions extracted from the list of items.
+  """
+
+  partition_set = set()
+
+  for item in item_list:
+    match = PARTITION_ITEM_PATTERN.search(item.strip())
+    partition_tag = match.group(1).lower() if match else None
+
+    if partition_tag:
+      partition_set.add(partition_tag)
+
+  return partition_set
+
+
+def process_apex_keys_apk_certs_common(framework_target_files_dir,
+                                       vendor_target_files_dir,
+                                       output_target_files_dir,
+                                       framework_partition_set,
+                                       vendor_partition_set, file_name):
+
+  """Performs special processing for META/apexkeys.txt or META/apkcerts.txt.
+
+  This function merges the contents of the META/apexkeys.txt or
+  META/apkcerts.txt files from the framework directory and the vendor directory,
+  placing the merged result in the output directory. The precondition in that
+  the files are already extracted. The post condition is that the output
+  META/apexkeys.txt or META/apkcerts.txt contains the merged content.
+
+  Args:
+    framework_target_files_dir: The name of a directory containing the special
+      items extracted from the framework target files package.
+    vendor_target_files_dir: The name of a directory containing the special
+      items extracted from the vendor target files package.
+    output_target_files_dir: The name of a directory that will be used to create
+      the output target files package after all the special cases are processed.
+    framework_partition_set: Partitions that are considered framework
+      partitions. Used to filter apexkeys.txt and apkcerts.txt.
+    vendor_partition_set: Partitions that are considered vendor partitions. Used
+      to filter apexkeys.txt and apkcerts.txt.
+    file_name: The name of the file to merge. One of apkcerts.txt or
+      apexkeys.txt.
+  """
+
+  def read_helper(d):
+    temp = {}
+    file_path = os.path.join(d, 'META', file_name)
+    with open(file_path) as f:
+      for line in f:
+        if line.strip():
+          name = line.split()[0]
+          match = MODULE_KEY_PATTERN.search(name)
+          temp[match.group(1)] = line.strip()
+    return temp
+
+  framework_dict = read_helper(framework_target_files_dir)
+  vendor_dict = read_helper(vendor_target_files_dir)
+  merged_dict = {}
+
+  def filter_into_merged_dict(item_dict, partition_set):
+    for key, value in item_dict.items():
+      match = PARTITION_TAG_PATTERN.search(value)
+
+      if match is None:
+        raise ValueError('Entry missing partition tag: %s' % value)
+
+      partition_tag = match.group(1)
+
+      if partition_tag in partition_set:
+        if key in merged_dict:
+          raise ValueError('Duplicate key %s' % key)
+
+        merged_dict[key] = value
+
+  filter_into_merged_dict(framework_dict, framework_partition_set)
+  filter_into_merged_dict(vendor_dict, vendor_partition_set)
+
+  output_file = os.path.join(output_target_files_dir, 'META', file_name)
+
+  # The following code is similar to write_sorted_data, but different enough
+  # that we couldn't use that function. We need the output to be sorted by the
+  # basename of the apex/apk (without the ".apex" or ".apk" suffix). This
+  # allows the sort to be consistent with the framework/vendor input data and
+  # eases comparison of input data with merged data.
+  with open(output_file, 'w') as output:
+    for key in sorted(merged_dict.keys()):
+      out_str = merged_dict[key] + '\n'
+      output.write(out_str)
+
+
+def copy_file_contexts(framework_target_files_dir, vendor_target_files_dir,
+                       output_target_files_dir):
+  """Creates named copies of each build's file_contexts.bin in output META/."""
+  framework_fc_path = os.path.join(framework_target_files_dir, 'META',
+                                   'framework_file_contexts.bin')
+  if not os.path.exists(framework_fc_path):
+    framework_fc_path = os.path.join(framework_target_files_dir, 'META',
+                                     'file_contexts.bin')
+    if not os.path.exists(framework_fc_path):
+      raise ValueError('Missing framework file_contexts.bin.')
+  shutil.copyfile(
+      framework_fc_path,
+      os.path.join(output_target_files_dir, 'META',
+                   'framework_file_contexts.bin'))
+
+  vendor_fc_path = os.path.join(vendor_target_files_dir, 'META',
+                                'vendor_file_contexts.bin')
+  if not os.path.exists(vendor_fc_path):
+    vendor_fc_path = os.path.join(vendor_target_files_dir, 'META',
+                                  'file_contexts.bin')
+    if not os.path.exists(vendor_fc_path):
+      raise ValueError('Missing vendor file_contexts.bin.')
+  shutil.copyfile(
+      vendor_fc_path,
+      os.path.join(output_target_files_dir, 'META', 'vendor_file_contexts.bin'))
+
+
+def process_special_cases(framework_target_files_temp_dir,
+                          vendor_target_files_temp_dir,
+                          output_target_files_temp_dir,
+                          framework_misc_info_keys,
+                          framework_partition_set,
+                          vendor_partition_set):
+  """Performs special-case processing for certain target files items.
 
   Certain files in the output target files package require special-case
   processing. This function performs all that special-case processing.
 
   Args:
-    temp_dir: The name of a scratch directory that this function can use for
-    intermediate files generated during processing.
-
-    system_target_files_temp_dir: The name of a directory containing the
-    special items extracted from the system target files package.
-
-    other_target_files_temp_dir: The name of a directory containing the
-    special items extracted from the other target files package.
-
-    output_target_files_temp_dir: The name of a directory that will be used
-    to create the output target files package after all the special cases
-    are processed.
-
-    system_misc_info_keys: A list of keys to obtain from the system instance
-    of META/misc_info.txt. The remaining keys from the other instance.
-
-    rebuild_recovery: If true, rebuild the recovery patch used by non-A/B
-    devices and write it to the system image.
+    framework_target_files_temp_dir: The name of a directory containing the
+      special items extracted from the framework target files package.
+    vendor_target_files_temp_dir: The name of a directory containing the special
+      items extracted from the vendor target files package.
+    output_target_files_temp_dir: The name of a directory that will be used to
+      create the output target files package after all the special cases are
+      processed.
+    framework_misc_info_keys: A list of keys to obtain from the framework
+      instance of META/misc_info.txt. The remaining keys from the vendor
+      instance.
+    framework_partition_set: Partitions that are considered framework
+      partitions. Used to filter apexkeys.txt and apkcerts.txt.
+    vendor_partition_set: Partitions that are considered vendor partitions. Used
+      to filter apexkeys.txt and apkcerts.txt.
   """
 
-  if 'ab_update' in system_misc_info_keys:
+  if 'ab_update' in framework_misc_info_keys:
     process_ab_partitions_txt(
-        system_target_files_temp_dir=system_target_files_temp_dir,
-        other_target_files_temp_dir=other_target_files_temp_dir,
+        framework_target_files_temp_dir=framework_target_files_temp_dir,
+        vendor_target_files_temp_dir=vendor_target_files_temp_dir,
         output_target_files_temp_dir=output_target_files_temp_dir)
 
-  if rebuild_recovery:
-    append_recovery_to_filesystem_config(
-        output_target_files_temp_dir=output_target_files_temp_dir)
+  copy_file_contexts(
+      framework_target_files_dir=framework_target_files_temp_dir,
+      vendor_target_files_dir=vendor_target_files_temp_dir,
+      output_target_files_dir=output_target_files_temp_dir)
 
   process_misc_info_txt(
-      system_target_files_temp_dir=system_target_files_temp_dir,
-      other_target_files_temp_dir=other_target_files_temp_dir,
+      framework_target_files_temp_dir=framework_target_files_temp_dir,
+      vendor_target_files_temp_dir=vendor_target_files_temp_dir,
       output_target_files_temp_dir=output_target_files_temp_dir,
-      system_misc_info_keys=system_misc_info_keys)
+      framework_misc_info_keys=framework_misc_info_keys)
 
-  process_file_contexts_bin(
-      temp_dir=temp_dir,
-      output_target_files_temp_dir=output_target_files_temp_dir)
+  process_dynamic_partitions_info_txt(
+      framework_target_files_dir=framework_target_files_temp_dir,
+      vendor_target_files_dir=vendor_target_files_temp_dir,
+      output_target_files_dir=output_target_files_temp_dir)
+
+  process_apex_keys_apk_certs_common(
+      framework_target_files_dir=framework_target_files_temp_dir,
+      vendor_target_files_dir=vendor_target_files_temp_dir,
+      output_target_files_dir=output_target_files_temp_dir,
+      framework_partition_set=framework_partition_set,
+      vendor_partition_set=vendor_partition_set,
+      file_name='apkcerts.txt')
+
+  process_apex_keys_apk_certs_common(
+      framework_target_files_dir=framework_target_files_temp_dir,
+      vendor_target_files_dir=vendor_target_files_temp_dir,
+      output_target_files_dir=output_target_files_temp_dir,
+      framework_partition_set=framework_partition_set,
+      vendor_partition_set=vendor_partition_set,
+      file_name='apexkeys.txt')
 
 
-def merge_target_files(
-    temp_dir,
-    system_target_files,
-    system_item_list,
-    system_misc_info_keys,
-    other_target_files,
-    other_item_list,
-    output_target_files,
-    rebuild_recovery):
-  """Merge two target files packages together.
+def files_from_path(target_path, extra_args=None):
+  """Gets files under given path.
 
-  This function takes system and other target files packages as input, performs
-  various file extractions, special case processing, and finally creates a
-  merged zip archive as output.
+  Get (sub)files from given target path and return sorted list.
+
+  Args:
+    target_path: Target path to get subfiles.
+    extra_args: List of extra argument for find command. Optional.
+
+  Returns:
+    Sorted files and directories list.
+  """
+
+  find_command = ['find', target_path] + (extra_args or [])
+  find_process = common.Run(find_command, stdout=subprocess.PIPE, verbose=False)
+  return common.RunAndCheckOutput(['sort'],
+                                  stdin=find_process.stdout,
+                                  verbose=False)
+
+
+def create_merged_package(temp_dir, framework_target_files, framework_item_list,
+                          vendor_target_files, vendor_item_list,
+                          framework_misc_info_keys, rebuild_recovery):
+  """Merges two target files packages into one target files structure.
 
   Args:
     temp_dir: The name of a directory we use when we extract items from the
-    input target files packages, and also a scratch directory that we use for
-    temporary files.
-
-    system_target_files: The name of the zip archive containing the system
-    partial target files package.
-
-    system_item_list: The list of items to extract from the partial system
-    target files package as is, meaning these items will land in the output
-    target files package exactly as they appear in the input partial system
-    target files package.
-
-    system_misc_info_keys: The list of keys to obtain from the system instance
-    of META/misc_info.txt. The remaining keys from the other instance.
-
-    other_target_files: The name of the zip archive containing the other
-    partial target files package.
-
-    other_item_list: The list of items to extract from the partial other
-    target files package as is, meaning these items will land in the output
-    target files package exactly as they appear in the input partial other
-    target files package.
-
-    output_target_files: The name of the output zip archive target files
-    package created by merging system and other.
-
+      input target files packages, and also a scratch directory that we use for
+      temporary files.
+    framework_target_files: The name of the zip archive containing the framework
+      partial target files package.
+    framework_item_list: The list of items to extract from the partial framework
+      target files package as is, meaning these items will land in the output
+      target files package exactly as they appear in the input partial framework
+      target files package.
+    vendor_target_files: The name of the zip archive containing the vendor
+      partial target files package.
+    vendor_item_list: The list of items to extract from the partial vendor
+      target files package as is, meaning these items will land in the output
+      target files package exactly as they appear in the input partial vendor
+      target files package.
+    framework_misc_info_keys: The list of keys to obtain from the framework
+      instance of META/misc_info.txt. The remaining keys from the vendor
+      instance.
     rebuild_recovery: If true, rebuild the recovery patch used by non-A/B
-    devices and write it to the system image.
+      devices and write it to the system image.
+
+  Returns:
+    Path to merged package under temp directory.
   """
 
-  logger.info(
-      'starting: merge system %s and other %s into output %s',
-      system_target_files,
-      other_target_files,
-      output_target_files)
+  # Create directory names that we'll use when we extract files from framework,
+  # and vendor, and for zipping the final output.
 
-  # Create directory names that we'll use when we extract files from system,
-  # and other, and for zipping the final output.
-
-  system_target_files_temp_dir = os.path.join(temp_dir, 'system')
-  other_target_files_temp_dir = os.path.join(temp_dir, 'other')
+  framework_target_files_temp_dir = os.path.join(temp_dir, 'framework')
+  vendor_target_files_temp_dir = os.path.join(temp_dir, 'vendor')
   output_target_files_temp_dir = os.path.join(temp_dir, 'output')
 
-  # Extract "as is" items from the input system partial target files package.
+  # Extract "as is" items from the input framework partial target files package.
   # We extract them directly into the output temporary directory since the
   # items do not need special case processing.
 
   extract_items(
-      target_files=system_target_files,
+      target_files=framework_target_files,
       target_files_temp_dir=output_target_files_temp_dir,
-      extract_item_list=system_item_list)
+      extract_item_list=framework_item_list)
 
-  # Extract "as is" items from the input other partial target files package. We
+  # Extract "as is" items from the input vendor partial target files package. We
   # extract them directly into the output temporary directory since the items
   # do not need special case processing.
 
   extract_items(
-      target_files=other_target_files,
+      target_files=vendor_target_files,
       target_files_temp_dir=output_target_files_temp_dir,
-      extract_item_list=other_item_list)
+      extract_item_list=vendor_item_list)
 
-  # Extract "special" items from the input system partial target files package.
+  # Extract "special" items from the input framework partial target files
+  # package. We extract these items to different directory since they require
+  # special processing before they will end up in the output directory.
+
+  extract_items(
+      target_files=framework_target_files,
+      target_files_temp_dir=framework_target_files_temp_dir,
+      extract_item_list=FRAMEWORK_EXTRACT_SPECIAL_ITEM_LIST)
+
+  # Extract "special" items from the input vendor partial target files package.
   # We extract these items to different directory since they require special
   # processing before they will end up in the output directory.
 
   extract_items(
-      target_files=system_target_files,
-      target_files_temp_dir=system_target_files_temp_dir,
-      extract_item_list=system_extract_special_item_list)
-
-  # Extract "special" items from the input other partial target files package.
-  # We extract these items to different directory since they require special
-  # processing before they will end up in the output directory.
-
-  extract_items(
-      target_files=other_target_files,
-      target_files_temp_dir=other_target_files_temp_dir,
-      extract_item_list=other_extract_special_item_list)
+      target_files=vendor_target_files,
+      target_files_temp_dir=vendor_target_files_temp_dir,
+      extract_item_list=VENDOR_EXTRACT_SPECIAL_ITEM_LIST)
 
   # Now that the temporary directories contain all the extracted files, perform
   # special case processing on any items that need it. After this function
@@ -643,72 +804,201 @@
   # files package are in place.
 
   process_special_cases(
-      temp_dir=temp_dir,
-      system_target_files_temp_dir=system_target_files_temp_dir,
-      other_target_files_temp_dir=other_target_files_temp_dir,
+      framework_target_files_temp_dir=framework_target_files_temp_dir,
+      vendor_target_files_temp_dir=vendor_target_files_temp_dir,
       output_target_files_temp_dir=output_target_files_temp_dir,
-      system_misc_info_keys=system_misc_info_keys,
-      rebuild_recovery=rebuild_recovery)
+      framework_misc_info_keys=framework_misc_info_keys,
+      framework_partition_set=item_list_to_partition_set(framework_item_list),
+      vendor_partition_set=item_list_to_partition_set(vendor_item_list))
 
-  # Regenerate IMAGES in the temporary directory.
+  return output_target_files_temp_dir
+
+
+def generate_images(target_files_dir, rebuild_recovery):
+  """Generate images from target files.
+
+  This function takes merged output temporary directory and create images
+  from it.
+
+  Args:
+    target_files_dir: Path to merged temp directory.
+    rebuild_recovery: If true, rebuild the recovery patch used by non-A/B
+      devices and write it to the system image.
+  """
+
+  # Regenerate IMAGES in the target directory.
 
   add_img_args = ['--verbose']
+  add_img_args.append('--add_missing')
+  # TODO(b/132730255): Remove this if statement.
   if rebuild_recovery:
     add_img_args.append('--rebuild_recovery')
-  add_img_args.append(output_target_files_temp_dir)
+  add_img_args.append(target_files_dir)
 
   add_img_to_target_files.main(add_img_args)
 
-  # Finally, create the output target files zip archive.
 
-  output_zip = os.path.abspath(output_target_files)
+def generate_super_empty_image(target_dir, output_super_empty):
+  """Generates super_empty image from target package.
+
+  Args:
+    target_dir: Path to the target file package which contains misc_info.txt for
+      detailed information for super image.
+    output_super_empty: If provided, copies a super_empty.img file from the
+      target files package to this path.
+  """
+  # Create super_empty.img using the merged misc_info.txt.
+
+  misc_info_txt = os.path.join(target_dir, 'META', 'misc_info.txt')
+
+  use_dynamic_partitions = common.LoadDictionaryFromFile(misc_info_txt).get(
+      'use_dynamic_partitions')
+
+  if use_dynamic_partitions != 'true' and output_super_empty:
+    raise ValueError(
+        'Building super_empty.img requires use_dynamic_partitions=true.')
+  elif use_dynamic_partitions == 'true':
+    super_empty_img = os.path.join(target_dir, 'IMAGES', 'super_empty.img')
+    build_super_image_args = [
+        misc_info_txt,
+        super_empty_img,
+    ]
+    build_super_image.main(build_super_image_args)
+
+    # Copy super_empty.img to the user-provided output_super_empty location.
+    if output_super_empty:
+      shutil.copyfile(super_empty_img, output_super_empty)
+
+
+def create_target_files_archive(output_file, source_dir, temp_dir):
+  """Creates archive from target package.
+
+  Args:
+    output_file: The name of the zip archive target files package.
+    source_dir: The target directory contains package to be archived.
+    temp_dir: Path to temporary directory for any intermediate files.
+  """
   output_target_files_list = os.path.join(temp_dir, 'output.list')
-  output_target_files_meta_dir = os.path.join(
-      output_target_files_temp_dir, 'META')
+  output_zip = os.path.abspath(output_file)
+  output_target_files_meta_dir = os.path.join(source_dir, 'META')
 
-  command = [
-      'find',
-      output_target_files_meta_dir,
-  ]
-  # TODO(bpeckham): sort this to be more like build.
-  meta_content = common.RunAndCheckOutput(command, verbose=False)
-  command = [
-      'find',
-      output_target_files_temp_dir,
-      '-path',
-      output_target_files_meta_dir,
-      '-prune',
-      '-o',
-      '-print'
-  ]
-  # TODO(bpeckham): sort this to be more like build.
-  other_content = common.RunAndCheckOutput(command, verbose=False)
+  meta_content = files_from_path(output_target_files_meta_dir)
+  other_content = files_from_path(
+      source_dir,
+      ['-path', output_target_files_meta_dir, '-prune', '-o', '-print'])
 
-  with open(output_target_files_list, 'wb') as f:
+  with open(output_target_files_list, 'w') as f:
     f.write(meta_content)
     f.write(other_content)
 
   command = [
       'soong_zip',
       '-d',
-      '-o', output_zip,
-      '-C', output_target_files_temp_dir,
-      '-l', output_target_files_list,
+      '-o',
+      output_zip,
+      '-C',
+      source_dir,
+      '-l',
+      output_target_files_list,
   ]
-  logger.info('creating %s', output_target_files)
+
+  logger.info('creating %s', output_file)
   common.RunAndWait(command, verbose=True)
+  logger.info('finished creating %s', output_file)
+
+  return output_zip
+
+
+def merge_target_files(temp_dir, framework_target_files, framework_item_list,
+                       framework_misc_info_keys, vendor_target_files,
+                       vendor_item_list, output_target_files, output_dir,
+                       output_item_list, output_ota, output_img,
+                       output_super_empty, rebuild_recovery):
+  """Merges two target files packages together.
+
+  This function takes framework and vendor target files packages as input,
+  performs various file extractions, special case processing, and finally
+  creates a merged zip archive as output.
+
+  Args:
+    temp_dir: The name of a directory we use when we extract items from the
+      input target files packages, and also a scratch directory that we use for
+      temporary files.
+    framework_target_files: The name of the zip archive containing the framework
+      partial target files package.
+    framework_item_list: The list of items to extract from the partial framework
+      target files package as is, meaning these items will land in the output
+      target files package exactly as they appear in the input partial framework
+      target files package.
+    framework_misc_info_keys: The list of keys to obtain from the framework
+      instance of META/misc_info.txt. The remaining keys from the vendor
+      instance.
+    vendor_target_files: The name of the zip archive containing the vendor
+      partial target files package.
+    vendor_item_list: The list of items to extract from the partial vendor
+      target files package as is, meaning these items will land in the output
+      target files package exactly as they appear in the input partial vendor
+      target files package.
+    output_target_files: The name of the output zip archive target files package
+      created by merging framework and vendor.
+    output_dir: The destination directory for saving merged files.
+    output_item_list: The list of items to copy into the output_dir.
+    output_ota: The name of the output zip archive ota package.
+    output_img: The name of the output zip archive img package.
+    output_super_empty: If provided, creates a super_empty.img file from the
+      merged target files package and saves it at this path.
+    rebuild_recovery: If true, rebuild the recovery patch used by non-A/B
+      devices and write it to the system image.
+  """
+
+  logger.info('starting: merge framework %s and vendor %s into output %s',
+              framework_target_files, vendor_target_files, output_target_files)
+
+  output_target_files_temp_dir = create_merged_package(
+      temp_dir, framework_target_files, framework_item_list,
+      vendor_target_files, vendor_item_list, framework_misc_info_keys,
+      rebuild_recovery)
+
+  if not check_target_files_vintf.CheckVintf(output_target_files_temp_dir):
+    raise RuntimeError("Incompatible VINTF metadata")
+
+  generate_images(output_target_files_temp_dir, rebuild_recovery)
+
+  generate_super_empty_image(output_target_files_temp_dir, output_super_empty)
+
+  # Finally, create the output target files zip archive and/or copy the
+  # output items to the output target files directory.
+
+  if output_dir:
+    copy_items(output_target_files_temp_dir, output_dir, output_item_list)
+
+  if not output_target_files:
+    return
+
+  output_zip = create_target_files_archive(output_target_files,
+                                           output_target_files_temp_dir,
+                                           temp_dir)
+
+  # Create the IMG package from the merged target files package.
+
+  if output_img:
+    img_from_target_files.main([output_zip, output_img])
+
+  # Create the OTA package from the merged target files package.
+
+  if output_ota:
+    ota_from_target_files.main([output_zip, output_ota])
 
 
 def call_func_with_temp_dir(func, keep_tmp):
-  """Manage the creation and cleanup of the temporary directory.
+  """Manages the creation and cleanup of the temporary directory.
 
   This function calls the given function after first creating a temporary
   directory. It also cleans up the temporary directory.
 
   Args:
-    func: The function to call. Should accept one parameter, the path to
-    the temporary directory.
-
+    func: The function to call. Should accept one parameter, the path to the
+      temporary directory.
     keep_tmp: Keep the temporary directory after processing is complete.
   """
 
@@ -720,8 +1010,6 @@
 
   try:
     func(temp_dir)
-  except:
-    raise
   finally:
     if keep_tmp:
       logger.info('keeping %s', temp_dir)
@@ -740,18 +1028,47 @@
 
   def option_handler(o, a):
     if o == '--system-target-files':
-      OPTIONS.system_target_files = a
+      logger.warning(
+          '--system-target-files has been renamed to --framework-target-files')
+      OPTIONS.framework_target_files = a
+    elif o == '--framework-target-files':
+      OPTIONS.framework_target_files = a
     elif o == '--system-item-list':
-      OPTIONS.system_item_list = a
+      logger.warning(
+          '--system-item-list has been renamed to --framework-item-list')
+      OPTIONS.framework_item_list = a
+    elif o == '--framework-item-list':
+      OPTIONS.framework_item_list = a
     elif o == '--system-misc-info-keys':
-      OPTIONS.system_misc_info_keys = a
+      logger.warning('--system-misc-info-keys has been renamed to '
+                     '--framework-misc-info-keys')
+      OPTIONS.framework_misc_info_keys = a
+    elif o == '--framework-misc-info-keys':
+      OPTIONS.framework_misc_info_keys = a
     elif o == '--other-target-files':
-      OPTIONS.other_target_files = a
+      logger.warning(
+          '--other-target-files has been renamed to --vendor-target-files')
+      OPTIONS.vendor_target_files = a
+    elif o == '--vendor-target-files':
+      OPTIONS.vendor_target_files = a
     elif o == '--other-item-list':
-      OPTIONS.other_item_list = a
+      logger.warning('--other-item-list has been renamed to --vendor-item-list')
+      OPTIONS.vendor_item_list = a
+    elif o == '--vendor-item-list':
+      OPTIONS.vendor_item_list = a
     elif o == '--output-target-files':
       OPTIONS.output_target_files = a
-    elif o == '--rebuild_recovery':
+    elif o == '--output-dir':
+      OPTIONS.output_dir = a
+    elif o == '--output-item-list':
+      OPTIONS.output_item_list = a
+    elif o == '--output-ota':
+      OPTIONS.output_ota = a
+    elif o == '--output-img':
+      OPTIONS.output_img = a
+    elif o == '--output-super-empty':
+      OPTIONS.output_super_empty = a
+    elif o == '--rebuild_recovery': # TODO(b/132730255): Warn
       OPTIONS.rebuild_recovery = True
     elif o == '--keep-tmp':
       OPTIONS.keep_tmp = True
@@ -760,58 +1077,83 @@
     return True
 
   args = common.ParseOptions(
-      sys.argv[1:], __doc__,
+      sys.argv[1:],
+      __doc__,
       extra_long_opts=[
           'system-target-files=',
+          'framework-target-files=',
           'system-item-list=',
+          'framework-item-list=',
           'system-misc-info-keys=',
+          'framework-misc-info-keys=',
           'other-target-files=',
+          'vendor-target-files=',
           'other-item-list=',
+          'vendor-item-list=',
           'output-target-files=',
+          'output-dir=',
+          'output-item-list=',
+          'output-ota=',
+          'output-img=',
+          'output-super-empty=',
           'rebuild_recovery',
           'keep-tmp',
       ],
       extra_option_handler=option_handler)
 
-  if (len(args) != 0 or
-      OPTIONS.system_target_files is None or
-      OPTIONS.other_target_files is None or
-      OPTIONS.output_target_files is None):
+  # pylint: disable=too-many-boolean-expressions
+  if (args or OPTIONS.framework_target_files is None or
+      OPTIONS.vendor_target_files is None or
+      (OPTIONS.output_target_files is None and OPTIONS.output_dir is None) or
+      (OPTIONS.output_dir is not None and OPTIONS.output_item_list is None)):
     common.Usage(__doc__)
     sys.exit(1)
 
-  if OPTIONS.system_item_list:
-    system_item_list = read_config_list(OPTIONS.system_item_list)
-  else:
-    system_item_list = default_system_item_list
+  # Always turn on verbose logging.
+  OPTIONS.verbose = True
 
-  if OPTIONS.system_misc_info_keys:
-    system_misc_info_keys = read_config_list(OPTIONS.system_misc_info_keys)
+  if OPTIONS.framework_item_list:
+    framework_item_list = common.LoadListFromFile(OPTIONS.framework_item_list)
   else:
-    system_misc_info_keys = default_system_misc_info_keys
+    framework_item_list = DEFAULT_FRAMEWORK_ITEM_LIST
 
-  if OPTIONS.other_item_list:
-    other_item_list = read_config_list(OPTIONS.other_item_list)
+  if OPTIONS.framework_misc_info_keys:
+    framework_misc_info_keys = common.LoadListFromFile(
+        OPTIONS.framework_misc_info_keys)
   else:
-    other_item_list = default_other_item_list
+    framework_misc_info_keys = DEFAULT_FRAMEWORK_MISC_INFO_KEYS
+
+  if OPTIONS.vendor_item_list:
+    vendor_item_list = common.LoadListFromFile(OPTIONS.vendor_item_list)
+  else:
+    vendor_item_list = DEFAULT_VENDOR_ITEM_LIST
+
+  if OPTIONS.output_item_list:
+    output_item_list = common.LoadListFromFile(OPTIONS.output_item_list)
+  else:
+    output_item_list = None
 
   if not validate_config_lists(
-      system_item_list=system_item_list,
-      system_misc_info_keys=system_misc_info_keys,
-      other_item_list=other_item_list):
+      framework_item_list=framework_item_list,
+      framework_misc_info_keys=framework_misc_info_keys,
+      vendor_item_list=vendor_item_list):
     sys.exit(1)
 
   call_func_with_temp_dir(
       lambda temp_dir: merge_target_files(
           temp_dir=temp_dir,
-          system_target_files=OPTIONS.system_target_files,
-          system_item_list=system_item_list,
-          system_misc_info_keys=system_misc_info_keys,
-          other_target_files=OPTIONS.other_target_files,
-          other_item_list=other_item_list,
+          framework_target_files=OPTIONS.framework_target_files,
+          framework_item_list=framework_item_list,
+          framework_misc_info_keys=framework_misc_info_keys,
+          vendor_target_files=OPTIONS.vendor_target_files,
+          vendor_item_list=vendor_item_list,
           output_target_files=OPTIONS.output_target_files,
-          rebuild_recovery=OPTIONS.rebuild_recovery),
-      OPTIONS.keep_tmp)
+          output_dir=OPTIONS.output_dir,
+          output_item_list=output_item_list,
+          output_ota=OPTIONS.output_ota,
+          output_img=OPTIONS.output_img,
+          output_super_empty=OPTIONS.output_super_empty,
+          rebuild_recovery=OPTIONS.rebuild_recovery), OPTIONS.keep_tmp)
 
 
 if __name__ == '__main__':
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 27854fd..3b68439 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -38,8 +38,8 @@
   -k  (--package_key) <key>
       Key to use to sign the package (default is the value of
       default_system_dev_certificate from the input target-files's
-      META/misc_info.txt, or "build/target/product/security/testkey" if that
-      value is not specified).
+      META/misc_info.txt, or "build/make/target/product/security/testkey" if
+      that value is not specified).
 
       For incremental OTAs, the default value is based on the source
       target-file, not the target build.
@@ -72,12 +72,19 @@
       --skip_postinstall is implied.
 
   --skip_compatibility_check
-      Skip adding the compatibility package to the generated OTA package.
+      Skip checking compatibility of the input target files package.
 
   --output_metadata_path
       Write a copy of the metadata to a separate file. Therefore, users can
       read the post build fingerprint without extracting the OTA package.
 
+  --force_non_ab
+      This flag can only be set on an A/B device that also supports non-A/B
+      updates. Implies --two_step.
+      If set, generate that non-A/B update package.
+      If not set, generates A/B package for A/B device and non-A/B package for
+      non-A/B device.
+
 Non-A/B OTA specific options
 
   -b  (--binary) <file>
@@ -139,6 +146,9 @@
 
 A/B OTA specific options
 
+  --disable_fec_computation
+      Disable the on device FEC data computation for incremental updates.
+
   --include_secondary
       Additionally include the payload for secondary slot images (default:
       False). Only meaningful when generating A/B OTAs.
@@ -168,8 +178,23 @@
   --payload_signer_args <args>
       Specify the arguments needed for payload signer.
 
+  --payload_signer_maximum_signature_size <signature_size>
+      The maximum signature size (in bytes) that would be generated by the given
+      payload signer. Only meaningful when custom payload signer is specified
+      via '--payload_signer'.
+      If the signer uses a RSA key, this should be the number of bytes to
+      represent the modulus. If it uses an EC key, this is the size of a
+      DER-encoded ECDSA signature.
+
   --payload_signer_key_size <key_size>
-      Specify the key size in bytes of the payload signer.
+      Deprecated. Use the '--payload_signer_maximum_signature_size' instead.
+
+  --boot_variable_file <path>
+      A file that contains the possible values of ro.boot.* properties. It's
+      used to calculate the possible runtime fingerprints when some
+      ro.product.* properties are overridden by the 'import' statement.
+      The file expects one property per line, and each line has the following
+      format: 'prop_name=value1,value2'. e.g. 'ro.boot.product.sku=std,pro'
 
   --skip_postinstall
       Skip the postinstall hooks when generating an A/B OTA package (default:
@@ -181,6 +206,9 @@
 
 from __future__ import print_function
 
+import collections
+import copy
+import itertools
 import logging
 import multiprocessing
 import os.path
@@ -188,9 +216,9 @@
 import shutil
 import struct
 import sys
-import tempfile
 import zipfile
 
+import check_target_files_vintf
 import common
 import edify_generator
 import verity_utils
@@ -217,6 +245,7 @@
 OPTIONS.no_signing = False
 OPTIONS.block_based = True
 OPTIONS.updater_binary = None
+OPTIONS.oem_dicts = None
 OPTIONS.oem_source = None
 OPTIONS.oem_no_mount = False
 OPTIONS.full_radio = False
@@ -227,236 +256,34 @@
 OPTIONS.log_diff = None
 OPTIONS.payload_signer = None
 OPTIONS.payload_signer_args = []
-OPTIONS.payload_signer_key_size = None
+OPTIONS.payload_signer_maximum_signature_size = None
 OPTIONS.extracted_input = None
 OPTIONS.key_passwords = []
 OPTIONS.skip_postinstall = False
 OPTIONS.retrofit_dynamic_partitions = False
 OPTIONS.skip_compatibility_check = False
 OPTIONS.output_metadata_path = None
+OPTIONS.disable_fec_computation = False
+OPTIONS.force_non_ab = False
+OPTIONS.boot_variable_file = None
 
 
 METADATA_NAME = 'META-INF/com/android/metadata'
 POSTINSTALL_CONFIG = 'META/postinstall_config.txt'
 DYNAMIC_PARTITION_INFO = 'META/dynamic_partitions_info.txt'
 AB_PARTITIONS = 'META/ab_partitions.txt'
-UNZIP_PATTERN = ['IMAGES/*', 'META/*', 'RADIO/*']
+UNZIP_PATTERN = ['IMAGES/*', 'META/*', 'OTA/*', 'RADIO/*']
+# Files to be unzipped for target diffing purpose.
+TARGET_DIFFING_UNZIP_PATTERN = ['BOOT', 'RECOVERY', 'SYSTEM/*', 'VENDOR/*',
+                                'PRODUCT/*', 'SYSTEM_EXT/*', 'ODM/*']
 RETROFIT_DAP_UNZIP_PATTERN = ['OTA/super_*.img', AB_PARTITIONS]
 
 # Images to be excluded from secondary payload. We essentially only keep
 # 'system_other' and bootloader partitions.
 SECONDARY_PAYLOAD_SKIPPED_IMAGES = [
     'boot', 'dtbo', 'modem', 'odm', 'product', 'radio', 'recovery',
-    'system_ext', 'vbmeta', 'vbmeta_system', 'vbmeta_vendor', 'vendor']
-
-
-class BuildInfo(object):
-  """A class that holds the information for a given build.
-
-  This class wraps up the property querying for a given source or target build.
-  It abstracts away the logic of handling OEM-specific properties, and caches
-  the commonly used properties such as fingerprint.
-
-  There are two types of info dicts: a) build-time info dict, which is generated
-  at build time (i.e. included in a target_files zip); b) OEM info dict that is
-  specified at package generation time (via command line argument
-  '--oem_settings'). If a build doesn't use OEM-specific properties (i.e. not
-  having "oem_fingerprint_properties" in build-time info dict), all the queries
-  would be answered based on build-time info dict only. Otherwise if using
-  OEM-specific properties, some of them will be calculated from two info dicts.
-
-  Users can query properties similarly as using a dict() (e.g. info['fstab']),
-  or to query build properties via GetBuildProp() or GetVendorBuildProp().
-
-  Attributes:
-    info_dict: The build-time info dict.
-    is_ab: Whether it's a build that uses A/B OTA.
-    oem_dicts: A list of OEM dicts.
-    oem_props: A list of OEM properties that should be read from OEM dicts; None
-        if the build doesn't use any OEM-specific property.
-    fingerprint: The fingerprint of the build, which would be calculated based
-        on OEM properties if applicable.
-    device: The device name, which could come from OEM dicts if applicable.
-  """
-
-  _RO_PRODUCT_RESOLVE_PROPS = ["ro.product.brand", "ro.product.device",
-                               "ro.product.manufacturer", "ro.product.model",
-                               "ro.product.name"]
-  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER = ["product", "product_services",
-                                            "odm", "vendor", "system"]
-
-  def __init__(self, info_dict, oem_dicts):
-    """Initializes a BuildInfo instance with the given dicts.
-
-    Note that it only wraps up the given dicts, without making copies.
-
-    Arguments:
-      info_dict: The build-time info dict.
-      oem_dicts: A list of OEM dicts (which is parsed from --oem_settings). Note
-          that it always uses the first dict to calculate the fingerprint or the
-          device name. The rest would be used for asserting OEM properties only
-          (e.g. one package can be installed on one of these devices).
-    """
-    self.info_dict = info_dict
-    self.oem_dicts = oem_dicts
-
-    self._is_ab = info_dict.get("ab_update") == "true"
-    self._oem_props = info_dict.get("oem_fingerprint_properties")
-
-    if self._oem_props:
-      assert oem_dicts, "OEM source required for this build"
-
-    # These two should be computed only after setting self._oem_props.
-    self._device = self.GetOemProperty("ro.product.device")
-    self._fingerprint = self.CalculateFingerprint()
-
-  @property
-  def is_ab(self):
-    return self._is_ab
-
-  @property
-  def device(self):
-    return self._device
-
-  @property
-  def fingerprint(self):
-    return self._fingerprint
-
-  @property
-  def vendor_fingerprint(self):
-    return self._fingerprint_of("vendor")
-
-  @property
-  def product_fingerprint(self):
-    return self._fingerprint_of("product")
-
-  @property
-  def odm_fingerprint(self):
-    return self._fingerprint_of("odm")
-
-  def _fingerprint_of(self, partition):
-    if partition + ".build.prop" not in self.info_dict:
-      return None
-    build_prop = self.info_dict[partition + ".build.prop"]
-    if "ro." + partition + ".build.fingerprint" in build_prop:
-      return build_prop["ro." + partition + ".build.fingerprint"]
-    if "ro." + partition + ".build.thumbprint" in build_prop:
-      return build_prop["ro." + partition + ".build.thumbprint"]
-    return None
-
-  @property
-  def oem_props(self):
-    return self._oem_props
-
-  def __getitem__(self, key):
-    return self.info_dict[key]
-
-  def __setitem__(self, key, value):
-    self.info_dict[key] = value
-
-  def get(self, key, default=None):
-    return self.info_dict.get(key, default)
-
-  def items(self):
-    return self.info_dict.items()
-
-  def GetBuildProp(self, prop):
-    """Returns the inquired build property."""
-    if prop in BuildInfo._RO_PRODUCT_RESOLVE_PROPS:
-      return self._ResolveRoProductBuildProp(prop)
-
-    try:
-      return self.info_dict.get("build.prop", {})[prop]
-    except KeyError:
-      raise common.ExternalError("couldn't find %s in build.prop" % (prop,))
-
-  def _ResolveRoProductBuildProp(self, prop):
-    """Resolves the inquired ro.product.* build property"""
-    prop_val = self.info_dict.get("build.prop", {}).get(prop)
-    if prop_val:
-      return prop_val
-
-    source_order_val = self.info_dict.get("build.prop", {}).get(
-      "ro.product.property_source_order")
-    if source_order_val:
-      source_order = source_order_val.split(",")
-    else:
-      source_order = BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER
-
-    # Check that all sources in ro.product.property_source_order are valid
-    if any([x not in BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER
-            for x in source_order]):
-      raise common.ExternalError(
-        "Invalid ro.product.property_source_order '{}'".format(source_order))
-
-    for source in source_order:
-      source_prop = prop.replace("ro.product", "ro.product.{}".format(source),
-                                 1)
-      prop_val = self.info_dict.get("{}.build.prop".format(source), {}).get(
-        source_prop)
-      if prop_val:
-        return prop_val
-
-    raise common.ExternalError("couldn't resolve {}".format(prop))
-
-  def GetVendorBuildProp(self, prop):
-    """Returns the inquired vendor build property."""
-    try:
-      return self.info_dict.get("vendor.build.prop", {})[prop]
-    except KeyError:
-      raise common.ExternalError(
-          "couldn't find %s in vendor.build.prop" % (prop,))
-
-  def GetOemProperty(self, key):
-    if self.oem_props is not None and key in self.oem_props:
-      return self.oem_dicts[0][key]
-    return self.GetBuildProp(key)
-
-  def CalculateFingerprint(self):
-    if self.oem_props is None:
-      try:
-        return self.GetBuildProp("ro.build.fingerprint")
-      except common.ExternalError:
-        return "{}/{}/{}:{}/{}/{}:{}/{}".format(
-          self.GetBuildProp("ro.product.brand"),
-          self.GetBuildProp("ro.product.name"),
-          self.GetBuildProp("ro.product.device"),
-          self.GetBuildProp("ro.build.version.release"),
-          self.GetBuildProp("ro.build.id"),
-          self.GetBuildProp("ro.build.version.incremental"),
-          self.GetBuildProp("ro.build.type"),
-          self.GetBuildProp("ro.build.tags"))
-    return "%s/%s/%s:%s" % (
-        self.GetOemProperty("ro.product.brand"),
-        self.GetOemProperty("ro.product.name"),
-        self.GetOemProperty("ro.product.device"),
-        self.GetBuildProp("ro.build.thumbprint"))
-
-  def WriteMountOemScript(self, script):
-    assert self.oem_props is not None
-    recovery_mount_options = self.info_dict.get("recovery_mount_options")
-    script.Mount("/oem", recovery_mount_options)
-
-  def WriteDeviceAssertions(self, script, oem_no_mount):
-    # Read the property directly if not using OEM properties.
-    if not self.oem_props:
-      script.AssertDevice(self.device)
-      return
-
-    # Otherwise assert OEM properties.
-    if not self.oem_dicts:
-      raise common.ExternalError(
-          "No OEM file provided to answer expected assertions")
-
-    for prop in self.oem_props.split():
-      values = []
-      for oem_dict in self.oem_dicts:
-        if prop in oem_dict:
-          values.append(oem_dict[prop])
-      if not values:
-        raise common.ExternalError(
-            "The OEM file is missing the property %s" % (prop,))
-      script.AssertOemProperty(prop, values, oem_no_mount)
+    'system_ext', 'vbmeta', 'vbmeta_system', 'vbmeta_vendor', 'vendor',
+    'vendor_boot']
 
 
 class PayloadSigner(object):
@@ -489,35 +316,31 @@
       self.signer = "openssl"
       self.signer_args = ["pkeyutl", "-sign", "-inkey", signing_key,
                           "-pkeyopt", "digest:sha256"]
-      self.key_size = self._GetKeySizeInBytes(signing_key)
+      self.maximum_signature_size = self._GetMaximumSignatureSizeInBytes(
+          signing_key)
     else:
       self.signer = OPTIONS.payload_signer
       self.signer_args = OPTIONS.payload_signer_args
-      if OPTIONS.payload_signer_key_size:
-        self.key_size = int(OPTIONS.payload_signer_key_size)
-        assert self.key_size == 256 or self.key_size == 512, \
-            "Unsupported key size {}".format(OPTIONS.payload_signer_key_size)
+      if OPTIONS.payload_signer_maximum_signature_size:
+        self.maximum_signature_size = int(
+            OPTIONS.payload_signer_maximum_signature_size)
       else:
-        self.key_size = 256
+        # The legacy config uses RSA2048 keys.
+        logger.warning("The maximum signature size for payload signer is not"
+                       " set, default to 256 bytes.")
+        self.maximum_signature_size = 256
 
   @staticmethod
-  def _GetKeySizeInBytes(signing_key):
-    modulus_file = common.MakeTempFile(prefix="modulus-")
-    cmd = ["openssl", "rsa", "-inform", "PEM", "-in", signing_key, "-modulus",
-           "-noout", "-out", modulus_file]
-    common.RunAndCheckOutput(cmd, verbose=False)
-
-    with open(modulus_file) as f:
-      modulus_string = f.read()
-    # The modulus string has the format "Modulus=$data", where $data is the
-    # concatenation of hex dump of the modulus.
-    MODULUS_PREFIX = "Modulus="
-    assert modulus_string.startswith(MODULUS_PREFIX)
-    modulus_string = modulus_string[len(MODULUS_PREFIX):]
-    key_size = len(modulus_string) / 2
-    assert key_size == 256 or key_size == 512, \
-        "Unsupported key size {}".format(key_size)
-    return key_size
+  def _GetMaximumSignatureSizeInBytes(signing_key):
+    out_signature_size_file = common.MakeTempFile("signature_size")
+    cmd = ["delta_generator", "--out_maximum_signature_size_file={}".format(
+        out_signature_size_file), "--private_key={}".format(signing_key)]
+    common.RunAndCheckOutput(cmd)
+    with open(out_signature_size_file) as f:
+      signature_size = f.read().rstrip()
+    logger.info("%s outputs the maximum signature size: %s", cmd[0],
+                signature_size)
+    return int(signature_size)
 
   def Sign(self, in_file):
     """Signs the given input file. Returns the output filename."""
@@ -545,6 +368,15 @@
     self.payload_properties = None
     self.secondary = secondary
 
+  def _Run(self, cmd):  # pylint: disable=no-self-use
+    # Don't pipe (buffer) the output if verbose is set. Let
+    # brillo_update_payload write to stdout/stderr directly, so its progress can
+    # be monitored.
+    if OPTIONS.verbose:
+      common.RunAndCheckOutput(cmd, stdout=None, stderr=None)
+    else:
+      common.RunAndCheckOutput(cmd)
+
   def Generate(self, target_file, source_file=None, additional_args=None):
     """Generates a payload from the given target-files zip(s).
 
@@ -564,8 +396,10 @@
            "--target_image", target_file]
     if source_file is not None:
       cmd.extend(["--source_image", source_file])
+      if OPTIONS.disable_fec_computation:
+        cmd.extend(["--disable_fec_computation", "true"])
     cmd.extend(additional_args)
-    common.RunAndCheckOutput(cmd)
+    self._Run(cmd)
 
     self.payload_file = payload_file
     self.payload_properties = None
@@ -586,10 +420,10 @@
     metadata_sig_file = common.MakeTempFile(prefix="sig-", suffix=".bin")
     cmd = ["brillo_update_payload", "hash",
            "--unsigned_payload", self.payload_file,
-           "--signature_size", str(payload_signer.key_size),
+           "--signature_size", str(payload_signer.maximum_signature_size),
            "--metadata_hash_file", metadata_sig_file,
            "--payload_hash_file", payload_sig_file]
-    common.RunAndCheckOutput(cmd)
+    self._Run(cmd)
 
     # 2. Sign the hashes.
     signed_payload_sig_file = payload_signer.Sign(payload_sig_file)
@@ -601,10 +435,10 @@
     cmd = ["brillo_update_payload", "sign",
            "--unsigned_payload", self.payload_file,
            "--payload", signed_payload_file,
-           "--signature_size", str(payload_signer.key_size),
+           "--signature_size", str(payload_signer.maximum_signature_size),
            "--metadata_signature_file", signed_metadata_sig_file,
            "--payload_signature_file", signed_payload_sig_file]
-    common.RunAndCheckOutput(cmd)
+    self._Run(cmd)
 
     # 4. Dump the signed payload properties.
     properties_file = common.MakeTempFile(prefix="payload-properties-",
@@ -612,7 +446,7 @@
     cmd = ["brillo_update_payload", "properties",
            "--payload", signed_payload_file,
            "--properties_file", properties_file]
-    common.RunAndCheckOutput(cmd)
+    self._Run(cmd)
 
     if self.secondary:
       with open(properties_file, "a") as f:
@@ -687,13 +521,12 @@
 
   recovery_two_step_img_name = "recovery-two-step.img"
   recovery_two_step_img_path = os.path.join(
-      OPTIONS.input_tmp, "IMAGES", recovery_two_step_img_name)
+      OPTIONS.input_tmp, "OTA", recovery_two_step_img_name)
   if os.path.exists(recovery_two_step_img_path):
-    recovery_two_step_img = common.GetBootableImage(
-        recovery_two_step_img_name, recovery_two_step_img_name,
-        OPTIONS.input_tmp, "RECOVERY")
-    common.ZipWriteStr(
-        output_zip, recovery_two_step_img_name, recovery_two_step_img.data)
+    common.ZipWrite(
+        output_zip,
+        recovery_two_step_img_path,
+        arcname=recovery_two_step_img_name)
     logger.info(
         "two-step package: using %s in stage 1/3", recovery_two_step_img_name)
     script.WriteRawImage("/boot", recovery_two_step_img_name)
@@ -703,10 +536,19 @@
     script.WriteRawImage("/boot", "recovery.img")
 
 
-def HasRecoveryPatch(target_files_zip):
+def HasRecoveryPatch(target_files_zip, info_dict):
+  board_uses_vendorimage = info_dict.get("board_uses_vendorimage") == "true"
+
+  if board_uses_vendorimage:
+    target_files_dir = "VENDOR"
+  else:
+    target_files_dir = "SYSTEM/vendor"
+
+  patch = "%s/recovery-from-boot.p" % target_files_dir
+  img = "%s/etc/recovery.img" %target_files_dir
+
   namelist = [name for name in target_files_zip.namelist()]
-  return ("SYSTEM/recovery-from-boot.p" in namelist or
-          "SYSTEM/etc/recovery.img" in namelist)
+  return (patch in namelist or img in namelist)
 
 
 def HasPartition(target_files_zip, partition):
@@ -717,20 +559,15 @@
     return False
 
 
-def HasVendorPartition(target_files_zip):
-  return HasPartition(target_files_zip, "vendor")
+def HasTrebleEnabled(target_files, target_info):
+  def HasVendorPartition(target_files):
+    if os.path.isdir(target_files):
+      return os.path.isdir(os.path.join(target_files, "VENDOR"))
+    if zipfile.is_zipfile(target_files):
+      return HasPartition(zipfile.ZipFile(target_files), "vendor")
+    raise ValueError("Unknown target_files argument")
 
-
-def HasProductPartition(target_files_zip):
-  return HasPartition(target_files_zip, "product")
-
-
-def HasOdmPartition(target_files_zip):
-  return HasPartition(target_files_zip, "odm")
-
-
-def HasTrebleEnabled(target_files_zip, target_info):
-  return (HasVendorPartition(target_files_zip) and
+  return (HasVendorPartition(target_files) and
           target_info.GetBuildProp("ro.treble.enabled") == "true")
 
 
@@ -755,74 +592,23 @@
         source_info.GetBuildProp("ro.build.thumbprint"))
 
 
-def AddCompatibilityArchiveIfTrebleEnabled(target_zip, output_zip, target_info,
-                                           source_info=None):
-  """Adds compatibility info into the output zip if it's Treble-enabled target.
+def CheckVintfIfTrebleEnabled(target_files, target_info):
+  """Checks compatibility info of the input target files.
 
-  Metadata used for on-device compatibility verification is retrieved from
-  target_zip then added to compatibility.zip which is added to the output_zip
-  archive.
+  Metadata used for compatibility verification is retrieved from target_zip.
 
-  Compatibility archive should only be included for devices that have enabled
+  Compatibility should only be checked for devices that have enabled
   Treble support.
 
   Args:
-    target_zip: Zip file containing the source files to be included for OTA.
-    output_zip: Zip file that will be sent for OTA.
+    target_files: Path to zip file containing the source files to be included
+        for OTA. Can also be the path to extracted directory.
     target_info: The BuildInfo instance that holds the target build info.
-    source_info: The BuildInfo instance that holds the source build info, if
-        generating an incremental OTA; None otherwise.
   """
 
-  def AddCompatibilityArchive(framework_updated, device_updated):
-    """Adds compatibility info based on update status of both sides of Treble
-    boundary.
-
-    Args:
-      framework_updated: If True, the system / product image will be updated
-          and therefore their metadata should be included.
-      device_updated: If True, the vendor / odm image will be updated and
-          therefore their metadata should be included.
-    """
-    # Determine what metadata we need. Files are names relative to META/.
-    compatibility_files = []
-    device_metadata = ("vendor_manifest.xml", "vendor_matrix.xml")
-    framework_metadata = ("system_manifest.xml", "system_matrix.xml")
-    if device_updated:
-      compatibility_files += device_metadata
-    if framework_updated:
-      compatibility_files += framework_metadata
-
-    # Create new archive.
-    compatibility_archive = tempfile.NamedTemporaryFile()
-    compatibility_archive_zip = zipfile.ZipFile(
-        compatibility_archive, "w", compression=zipfile.ZIP_DEFLATED)
-
-    # Add metadata.
-    for file_name in compatibility_files:
-      target_file_name = "META/" + file_name
-
-      if target_file_name in target_zip.namelist():
-        data = target_zip.read(target_file_name)
-        common.ZipWriteStr(compatibility_archive_zip, file_name, data)
-
-    # Ensure files are written before we copy into output_zip.
-    compatibility_archive_zip.close()
-
-    # Only add the archive if we have any compatibility info.
-    if compatibility_archive_zip.namelist():
-      common.ZipWrite(output_zip, compatibility_archive.name,
-                      arcname="compatibility.zip",
-                      compress_type=zipfile.ZIP_STORED)
-
-  def FingerprintChanged(source_fp, target_fp):
-    if source_fp is None or target_fp is None:
-      return True
-    return source_fp != target_fp
-
   # Will only proceed if the target has enabled the Treble support (as well as
   # having a /vendor partition).
-  if not HasTrebleEnabled(target_zip, target_info):
+  if not HasTrebleEnabled(target_files, target_info):
     return
 
   # Skip adding the compatibility package as a workaround for b/114240221. The
@@ -830,32 +616,100 @@
   if OPTIONS.skip_compatibility_check:
     return
 
-  # Full OTA carries the info for system/vendor/product/odm
-  if source_info is None:
-    AddCompatibilityArchive(True, True)
-    return
+  if not check_target_files_vintf.CheckVintf(target_files, target_info):
+    raise RuntimeError("VINTF compatibility check failed")
 
-  source_fp = source_info.fingerprint
-  target_fp = target_info.fingerprint
-  system_updated = source_fp != target_fp
 
-  # other build fingerprints could be possibly blacklisted at build time. For
-  # such a case, we consider those images being changed.
-  vendor_updated = FingerprintChanged(source_info.vendor_fingerprint,
-                                      target_info.vendor_fingerprint)
-  product_updated = HasProductPartition(target_zip) and \
-                    FingerprintChanged(source_info.product_fingerprint,
-                                       target_info.product_fingerprint)
-  odm_updated = HasOdmPartition(target_zip) and \
-                FingerprintChanged(source_info.odm_fingerprint,
-                                   target_info.odm_fingerprint)
+def GetBlockDifferences(target_zip, source_zip, target_info, source_info,
+                        device_specific):
+  """Returns a ordered dict of block differences with partition name as key."""
 
-  AddCompatibilityArchive(system_updated or product_updated,
-                          vendor_updated or odm_updated)
+  def GetIncrementalBlockDifferenceForPartition(name):
+    if not HasPartition(source_zip, name):
+      raise RuntimeError("can't generate incremental that adds {}".format(name))
+
+    partition_src = common.GetUserImage(name, OPTIONS.source_tmp, source_zip,
+                                        info_dict=source_info,
+                                        allow_shared_blocks=allow_shared_blocks)
+
+    hashtree_info_generator = verity_utils.CreateHashtreeInfoGenerator(
+        name, 4096, target_info)
+    partition_tgt = common.GetUserImage(name, OPTIONS.target_tmp, target_zip,
+                                        info_dict=target_info,
+                                        allow_shared_blocks=allow_shared_blocks,
+                                        hashtree_info_generator=
+                                        hashtree_info_generator)
+
+    # Check the first block of the source system partition for remount R/W only
+    # if the filesystem is ext4.
+    partition_source_info = source_info["fstab"]["/" + name]
+    check_first_block = partition_source_info.fs_type == "ext4"
+    # Disable using imgdiff for squashfs. 'imgdiff -z' expects input files to be
+    # in zip formats. However with squashfs, a) all files are compressed in LZ4;
+    # b) the blocks listed in block map may not contain all the bytes for a
+    # given file (because they're rounded to be 4K-aligned).
+    partition_target_info = target_info["fstab"]["/" + name]
+    disable_imgdiff = (partition_source_info.fs_type == "squashfs" or
+                       partition_target_info.fs_type == "squashfs")
+    return common.BlockDifference(name, partition_tgt, partition_src,
+                                  check_first_block,
+                                  version=blockimgdiff_version,
+                                  disable_imgdiff=disable_imgdiff)
+
+  if source_zip:
+    # See notes in common.GetUserImage()
+    allow_shared_blocks = (source_info.get('ext4_share_dup_blocks') == "true" or
+                           target_info.get('ext4_share_dup_blocks') == "true")
+    blockimgdiff_version = max(
+        int(i) for i in target_info.get(
+            "blockimgdiff_versions", "1").split(","))
+    assert blockimgdiff_version >= 3
+
+  block_diff_dict = collections.OrderedDict()
+  partition_names = ["system", "vendor", "product", "odm", "system_ext"]
+  for partition in partition_names:
+    if not HasPartition(target_zip, partition):
+      continue
+    # Full OTA update.
+    if not source_zip:
+      tgt = common.GetUserImage(partition, OPTIONS.input_tmp, target_zip,
+                                info_dict=target_info,
+                                reset_file_map=True)
+      block_diff_dict[partition] = common.BlockDifference(partition, tgt,
+                                                          src=None)
+    # Incremental OTA update.
+    else:
+      block_diff_dict[partition] = GetIncrementalBlockDifferenceForPartition(
+          partition)
+  assert "system" in block_diff_dict
+
+  # Get the block diffs from the device specific script. If there is a
+  # duplicate block diff for a partition, ignore the diff in the generic script
+  # and use the one in the device specific script instead.
+  if source_zip:
+    device_specific_diffs = device_specific.IncrementalOTA_GetBlockDifferences()
+    function_name = "IncrementalOTA_GetBlockDifferences"
+  else:
+    device_specific_diffs = device_specific.FullOTA_GetBlockDifferences()
+    function_name = "FullOTA_GetBlockDifferences"
+
+  if device_specific_diffs:
+    assert all(isinstance(diff, common.BlockDifference)
+               for diff in device_specific_diffs), \
+        "{} is not returning a list of BlockDifference objects".format(
+            function_name)
+    for diff in device_specific_diffs:
+      if diff.partition in block_diff_dict:
+        logger.warning("Duplicate block difference found. Device specific block"
+                       " diff for partition '%s' overrides the one in generic"
+                       " script.", diff.partition)
+      block_diff_dict[diff.partition] = diff
+
+  return block_diff_dict
 
 
 def WriteFullOTAPackage(input_zip, output_file):
-  target_info = BuildInfo(OPTIONS.info_dict, OPTIONS.oem_dicts)
+  target_info = common.BuildInfo(OPTIONS.info_dict, OPTIONS.oem_dicts)
 
   # We don't know what version it will be installed on top of. We expect the API
   # just won't change very often. Similarly for fstab, it might have changed in
@@ -885,7 +739,7 @@
       metadata=metadata,
       info_dict=OPTIONS.info_dict)
 
-  assert HasRecoveryPatch(input_zip)
+  assert HasRecoveryPatch(input_zip, info_dict=OPTIONS.info_dict)
 
   # Assertions (e.g. downgrade check, device properties check).
   ts = target_info.GetBuildProp("ro.build.date.utc")
@@ -895,6 +749,11 @@
   target_info.WriteDeviceAssertions(script, OPTIONS.oem_no_mount)
   device_specific.FullOTA_Assertions()
 
+  block_diff_dict = GetBlockDifferences(target_zip=input_zip, source_zip=None,
+                                        target_info=target_info,
+                                        source_info=None,
+                                        device_specific=device_specific)
+
   # Two-step package strategy (in chronological order, which is *not*
   # the order in which the generated script has things):
   #
@@ -946,67 +805,39 @@
 
   device_specific.FullOTA_InstallBegin()
 
-  system_progress = 0.75
-
+  # All other partitions as well as the data wipe use 10% of the progress, and
+  # the update of the system partition takes the remaining progress.
+  system_progress = 0.9 - (len(block_diff_dict) - 1) * 0.1
   if OPTIONS.wipe_user_data:
     system_progress -= 0.1
-  if HasVendorPartition(input_zip):
-    system_progress -= 0.1
-
-  script.ShowProgress(system_progress, 0)
-
-  def GetBlockDifference(partition):
-    # Full OTA is done as an "incremental" against an empty source image. This
-    # has the effect of writing new data from the package to the entire
-    # partition, but lets us reuse the updater code that writes incrementals to
-    # do it.
-    tgt = common.GetUserImage(partition, OPTIONS.input_tmp, input_zip,
-                              info_dict=target_info,
-                              reset_file_map=True)
-    diff = common.BlockDifference(partition, tgt, src=None)
-    return diff
-
-  device_specific_diffs = device_specific.FullOTA_GetBlockDifferences()
-  if device_specific_diffs:
-    assert all(isinstance(diff, common.BlockDifference)
-               for diff in device_specific_diffs), \
-        "FullOTA_GetBlockDifferences is not returning a list of " \
-        "BlockDifference objects"
-
-  progress_dict = dict()
-  block_diffs = [GetBlockDifference("system")]
-  if HasVendorPartition(input_zip):
-    block_diffs.append(GetBlockDifference("vendor"))
-    progress_dict["vendor"] = 0.1
-  if device_specific_diffs:
-    block_diffs += device_specific_diffs
+  progress_dict = {partition: 0.1 for partition in block_diff_dict}
+  progress_dict["system"] = system_progress
 
   if target_info.get('use_dynamic_partitions') == "true":
     # Use empty source_info_dict to indicate that all partitions / groups must
     # be re-added.
     dynamic_partitions_diff = common.DynamicPartitionsDifference(
         info_dict=OPTIONS.info_dict,
-        block_diffs=block_diffs,
+        block_diffs=block_diff_dict.values(),
         progress_dict=progress_dict)
     dynamic_partitions_diff.WriteScript(script, output_zip,
                                         write_verify_script=OPTIONS.verify)
   else:
-    for block_diff in block_diffs:
+    for block_diff in block_diff_dict.values():
       block_diff.WriteScript(script, output_zip,
                              progress=progress_dict.get(block_diff.partition),
                              write_verify_script=OPTIONS.verify)
 
-  AddCompatibilityArchiveIfTrebleEnabled(input_zip, output_zip, target_info)
+  CheckVintfIfTrebleEnabled(OPTIONS.input_tmp, target_info)
 
   boot_img = common.GetBootableImage(
       "boot.img", "boot.img", OPTIONS.input_tmp, "BOOT")
   common.CheckSize(boot_img.data, "boot.img", target_info)
   common.ZipWriteStr(output_zip, "boot.img", boot_img.data)
 
-  script.ShowProgress(0.05, 5)
   script.WriteRawImage("/boot", "boot.img")
 
-  script.ShowProgress(0.2, 10)
+  script.ShowProgress(0.1, 10)
   device_specific.FullOTA_InstallEnd()
 
   if OPTIONS.extra_script is not None:
@@ -1057,7 +888,7 @@
     output: A ZipFile object or a string of the output file path.
   """
 
-  value = "".join(["%s=%s\n" % kv for kv in sorted(metadata.iteritems())])
+  value = "".join(["%s=%s\n" % kv for kv in sorted(metadata.items())])
   if isinstance(output, zipfile.ZipFile):
     common.ZipWriteStr(output, METADATA_NAME, value,
                        compress_type=zipfile.ZIP_STORED)
@@ -1073,7 +904,7 @@
 
   post_timestamp = target_info.GetBuildProp("ro.build.date.utc")
   pre_timestamp = source_info.GetBuildProp("ro.build.date.utc")
-  is_downgrade = long(post_timestamp) < long(pre_timestamp)
+  is_downgrade = int(post_timestamp) < int(pre_timestamp)
 
   if OPTIONS.downgrade:
     if not is_downgrade:
@@ -1104,20 +935,30 @@
   Returns:
     A dict to be written into package metadata entry.
   """
-  assert isinstance(target_info, BuildInfo)
-  assert source_info is None or isinstance(source_info, BuildInfo)
+  assert isinstance(target_info, common.BuildInfo)
+  assert source_info is None or isinstance(source_info, common.BuildInfo)
 
+  separator = '|'
+
+  boot_variable_values = {}
+  if OPTIONS.boot_variable_file:
+    d = common.LoadDictionaryFromFile(OPTIONS.boot_variable_file)
+    for key, values in d.items():
+      boot_variable_values[key] = [val.strip() for val in values.split(',')]
+
+  post_build_devices, post_build_fingerprints = \
+      CalculateRuntimeDevicesAndFingerprints(target_info, boot_variable_values)
   metadata = {
-      'post-build' : target_info.fingerprint,
-      'post-build-incremental' : target_info.GetBuildProp(
+      'post-build': separator.join(sorted(post_build_fingerprints)),
+      'post-build-incremental': target_info.GetBuildProp(
           'ro.build.version.incremental'),
-      'post-sdk-level' : target_info.GetBuildProp(
+      'post-sdk-level': target_info.GetBuildProp(
           'ro.build.version.sdk'),
-      'post-security-patch-level' : target_info.GetBuildProp(
+      'post-security-patch-level': target_info.GetBuildProp(
           'ro.build.version.security_patch'),
   }
 
-  if target_info.is_ab:
+  if target_info.is_ab and not OPTIONS.force_non_ab:
     metadata['ota-type'] = 'AB'
     metadata['ota-required-cache'] = '0'
   else:
@@ -1131,12 +972,15 @@
 
   is_incremental = source_info is not None
   if is_incremental:
-    metadata['pre-build'] = source_info.fingerprint
+    pre_build_devices, pre_build_fingerprints = \
+        CalculateRuntimeDevicesAndFingerprints(source_info,
+                                               boot_variable_values)
+    metadata['pre-build'] = separator.join(sorted(pre_build_fingerprints))
     metadata['pre-build-incremental'] = source_info.GetBuildProp(
         'ro.build.version.incremental')
-    metadata['pre-device'] = source_info.device
+    metadata['pre-device'] = separator.join(sorted(pre_build_devices))
   else:
-    metadata['pre-device'] = target_info.device
+    metadata['pre-device'] = separator.join(sorted(post_build_devices))
 
   # Use the actual post-timestamp, even for a downgrade case.
   metadata['post-timestamp'] = target_info.GetBuildProp('ro.build.date.utc')
@@ -1398,7 +1242,7 @@
     payload_offset += len(payload_info.extra) + len(payload_info.filename)
     payload_size = payload_info.file_size
 
-    with input_zip.open('payload.bin', 'r') as payload_fp:
+    with input_zip.open('payload.bin') as payload_fp:
       header_bin = payload_fp.read(24)
 
     # network byte order (big-endian)
@@ -1518,8 +1362,8 @@
 
 
 def WriteBlockIncrementalOTAPackage(target_zip, source_zip, output_file):
-  target_info = BuildInfo(OPTIONS.target_info_dict, OPTIONS.oem_dicts)
-  source_info = BuildInfo(OPTIONS.source_info_dict, OPTIONS.oem_dicts)
+  target_info = common.BuildInfo(OPTIONS.target_info_dict, OPTIONS.oem_dicts)
+  source_info = common.BuildInfo(OPTIONS.source_info_dict, OPTIONS.oem_dicts)
 
   target_api_version = target_info["recovery_api_version"]
   source_api_version = source_info["recovery_api_version"]
@@ -1566,69 +1410,13 @@
   target_recovery = common.GetBootableImage(
       "/tmp/recovery.img", "recovery.img", OPTIONS.target_tmp, "RECOVERY")
 
-  # See notes in common.GetUserImage()
-  allow_shared_blocks = (source_info.get('ext4_share_dup_blocks') == "true" or
-                         target_info.get('ext4_share_dup_blocks') == "true")
-  system_src = common.GetUserImage("system", OPTIONS.source_tmp, source_zip,
-                                   info_dict=source_info,
-                                   allow_shared_blocks=allow_shared_blocks)
+  block_diff_dict = GetBlockDifferences(target_zip=target_zip,
+                                        source_zip=source_zip,
+                                        target_info=target_info,
+                                        source_info=source_info,
+                                        device_specific=device_specific)
 
-  hashtree_info_generator = verity_utils.CreateHashtreeInfoGenerator(
-      "system", 4096, target_info)
-  system_tgt = common.GetUserImage("system", OPTIONS.target_tmp, target_zip,
-                                   info_dict=target_info,
-                                   allow_shared_blocks=allow_shared_blocks,
-                                   hashtree_info_generator=
-                                   hashtree_info_generator)
-
-  blockimgdiff_version = max(
-      int(i) for i in target_info.get("blockimgdiff_versions", "1").split(","))
-  assert blockimgdiff_version >= 3
-
-  # Check the first block of the source system partition for remount R/W only
-  # if the filesystem is ext4.
-  system_src_partition = source_info["fstab"]["/system"]
-  check_first_block = system_src_partition.fs_type == "ext4"
-  # Disable using imgdiff for squashfs. 'imgdiff -z' expects input files to be
-  # in zip formats. However with squashfs, a) all files are compressed in LZ4;
-  # b) the blocks listed in block map may not contain all the bytes for a given
-  # file (because they're rounded to be 4K-aligned).
-  system_tgt_partition = target_info["fstab"]["/system"]
-  disable_imgdiff = (system_src_partition.fs_type == "squashfs" or
-                     system_tgt_partition.fs_type == "squashfs")
-  system_diff = common.BlockDifference("system", system_tgt, system_src,
-                                       check_first_block,
-                                       version=blockimgdiff_version,
-                                       disable_imgdiff=disable_imgdiff)
-
-  if HasVendorPartition(target_zip):
-    if not HasVendorPartition(source_zip):
-      raise RuntimeError("can't generate incremental that adds /vendor")
-    vendor_src = common.GetUserImage("vendor", OPTIONS.source_tmp, source_zip,
-                                     info_dict=source_info,
-                                     allow_shared_blocks=allow_shared_blocks)
-    hashtree_info_generator = verity_utils.CreateHashtreeInfoGenerator(
-        "vendor", 4096, target_info)
-    vendor_tgt = common.GetUserImage(
-        "vendor", OPTIONS.target_tmp, target_zip,
-        info_dict=target_info,
-        allow_shared_blocks=allow_shared_blocks,
-        hashtree_info_generator=hashtree_info_generator)
-
-    # Check first block of vendor partition for remount R/W only if
-    # disk type is ext4
-    vendor_partition = source_info["fstab"]["/vendor"]
-    check_first_block = vendor_partition.fs_type == "ext4"
-    disable_imgdiff = vendor_partition.fs_type == "squashfs"
-    vendor_diff = common.BlockDifference("vendor", vendor_tgt, vendor_src,
-                                         check_first_block,
-                                         version=blockimgdiff_version,
-                                         disable_imgdiff=disable_imgdiff)
-  else:
-    vendor_diff = None
-
-  AddCompatibilityArchiveIfTrebleEnabled(
-      target_zip, output_zip, target_info, source_info)
+  CheckVintfIfTrebleEnabled(OPTIONS.target_tmp, target_info)
 
   # Assertions (e.g. device properties check).
   target_info.WriteDeviceAssertions(script, OPTIONS.oem_no_mount)
@@ -1692,14 +1480,11 @@
   WriteFingerprintAssertion(script, target_info, source_info)
 
   # Check the required cache size (i.e. stashed blocks).
-  size = []
-  if system_diff:
-    size.append(system_diff.required_cache)
-  if vendor_diff:
-    size.append(vendor_diff.required_cache)
-
+  required_cache_sizes = [diff.required_cache for diff in
+                          block_diff_dict.values()]
   if updating_boot:
-    boot_type, boot_device = common.GetTypeAndDevice("/boot", source_info)
+    boot_type, boot_device_expr = common.GetTypeAndDeviceExpr("/boot",
+                                                              source_info)
     d = common.Difference(target_boot, source_boot)
     _, _, d = d.ComputePatch()
     if d is None:
@@ -1714,16 +1499,20 @@
 
       common.ZipWriteStr(output_zip, "boot.img.p", d)
 
-      script.PatchPartitionCheck(
-          "{}:{}:{}:{}".format(
-              boot_type, boot_device, target_boot.size, target_boot.sha1),
-          "{}:{}:{}:{}".format(
-              boot_type, boot_device, source_boot.size, source_boot.sha1))
+      target_expr = 'concat("{}:",{},":{}:{}")'.format(
+          boot_type, boot_device_expr, target_boot.size, target_boot.sha1)
+      source_expr = 'concat("{}:",{},":{}:{}")'.format(
+          boot_type, boot_device_expr, source_boot.size, source_boot.sha1)
+      script.PatchPartitionExprCheck(target_expr, source_expr)
 
-      size.append(target_boot.size)
+      required_cache_sizes.append(target_boot.size)
 
-  if size:
-    script.CacheFreeSpaceCheck(max(size))
+  if required_cache_sizes:
+    script.CacheFreeSpaceCheck(max(required_cache_sizes))
+
+  # Verify the existing partitions.
+  for diff in block_diff_dict.values():
+    diff.WriteVerifyScript(script, touched_blocks_only=True)
 
   device_specific.IncrementalOTA_VerifyEnd()
 
@@ -1740,30 +1529,12 @@
     # Stage 3/3: Make changes.
     script.Comment("Stage 3/3")
 
-  # Verify the existing partitions.
-  system_diff.WriteVerifyScript(script, touched_blocks_only=True)
-  if vendor_diff:
-    vendor_diff.WriteVerifyScript(script, touched_blocks_only=True)
-  device_specific_diffs = device_specific.IncrementalOTA_GetBlockDifferences()
-  if device_specific_diffs:
-    assert all(isinstance(diff, common.BlockDifference)
-               for diff in device_specific_diffs), \
-        "IncrementalOTA_GetBlockDifferences is not returning a list of " \
-        "BlockDifference objects"
-    for diff in device_specific_diffs:
-      diff.WriteVerifyScript(script, touched_blocks_only=True)
-
   script.Comment("---- start making changes here ----")
 
   device_specific.IncrementalOTA_InstallBegin()
 
-  block_diffs = [system_diff]
-  progress_dict = {"system": 0.8 if vendor_diff else 0.9}
-  if vendor_diff:
-    block_diffs.append(vendor_diff)
-    progress_dict["vendor"] = 0.1
-  if device_specific_diffs:
-    block_diffs += device_specific_diffs
+  progress_dict = {partition: 0.1 for partition in block_diff_dict}
+  progress_dict["system"] = 1 - len(block_diff_dict) * 0.1
 
   if OPTIONS.source_info_dict.get("use_dynamic_partitions") == "true":
     if OPTIONS.target_info_dict.get("use_dynamic_partitions") != "true":
@@ -1772,12 +1543,12 @@
     dynamic_partitions_diff = common.DynamicPartitionsDifference(
         info_dict=OPTIONS.target_info_dict,
         source_info_dict=OPTIONS.source_info_dict,
-        block_diffs=block_diffs,
+        block_diffs=block_diff_dict.values(),
         progress_dict=progress_dict)
     dynamic_partitions_diff.WriteScript(
         script, output_zip, write_verify_script=OPTIONS.verify)
   else:
-    for block_diff in block_diffs:
+    for block_diff in block_diff_dict.values():
       block_diff.WriteScript(script, output_zip,
                              progress=progress_dict.get(block_diff.partition),
                              write_verify_script=OPTIONS.verify)
@@ -1800,12 +1571,11 @@
         logger.info("boot image changed; including patch.")
         script.Print("Patching boot image...")
         script.ShowProgress(0.1, 10)
-        script.PatchPartition(
-            '{}:{}:{}:{}'.format(
-                boot_type, boot_device, target_boot.size, target_boot.sha1),
-            '{}:{}:{}:{}'.format(
-                boot_type, boot_device, source_boot.size, source_boot.sha1),
-            'boot.img.p')
+        target_expr = 'concat("{}:",{},":{}:{}")'.format(
+            boot_type, boot_device_expr, target_boot.size, target_boot.sha1)
+        source_expr = 'concat("{}:",{},":{}:{}")'.format(
+            boot_type, boot_device_expr, source_boot.size, source_boot.sha1)
+        script.PatchPartitionExpr(target_expr, source_expr, '"boot.img.p"')
     else:
       logger.info("boot image unchanged; skipping.")
 
@@ -1898,6 +1668,10 @@
         partitions = [partition for partition in partitions if partition
                       not in SECONDARY_PAYLOAD_SKIPPED_IMAGES]
         output_list.append('{}={}'.format(key, ' '.join(partitions)))
+      elif key == 'virtual_ab' or key == "virtual_ab_retrofit":
+        # Remove virtual_ab flag from secondary payload so that OTA client
+        # don't use snapshots for secondary update
+        pass
       else:
         output_list.append(line)
     return '\n'.join(output_list)
@@ -1907,7 +1681,6 @@
 
   with zipfile.ZipFile(input_file, 'r') as input_zip:
     infolist = input_zip.infolist()
-    namelist = input_zip.namelist()
 
   input_tmp = common.UnzipTemp(input_file, UNZIP_PATTERN)
   for info in infolist:
@@ -2003,7 +1776,7 @@
   target_file = common.MakeTempFile(prefix="targetfiles-", suffix=".zip")
   shutil.copyfile(input_file, target_file)
 
-  with zipfile.ZipFile(input_file, 'r') as input_zip:
+  with zipfile.ZipFile(input_file) as input_zip:
     namelist = input_zip.namelist()
 
   input_tmp = common.UnzipTemp(input_file, RETROFIT_DAP_UNZIP_PATTERN)
@@ -2027,8 +1800,8 @@
     for partition in ab_partitions:
       if (partition in dynamic_partition_list and
           partition not in super_block_devices):
-          logger.info("Dropping %s from ab_partitions.txt", partition)
-          continue
+        logger.info("Dropping %s from ab_partitions.txt", partition)
+        continue
       f.write(partition + "\n")
   to_delete = [AB_PARTITIONS]
 
@@ -2040,7 +1813,7 @@
   to_delete += [DYNAMIC_PARTITION_INFO]
 
   # Remove the existing partition images as well as the map files.
-  to_delete += replace.values()
+  to_delete += list(replace.values())
   to_delete += ['IMAGES/{}.map'.format(dev) for dev in super_block_devices]
 
   common.ZipDelete(target_file, to_delete)
@@ -2050,7 +1823,7 @@
   # Write super_{foo}.img as {foo}.img.
   for src, dst in replace.items():
     assert src in namelist, \
-          'Missing {} in {}; {} cannot be written'.format(src, input_file, dst)
+        'Missing {} in {}; {} cannot be written'.format(src, input_file, dst)
     unzipped_file = os.path.join(input_tmp, *src.split('/'))
     common.ZipWrite(target_zip, unzipped_file, arcname=dst)
 
@@ -2062,8 +1835,7 @@
   return target_file
 
 
-def WriteABOTAPackageWithBrilloScript(target_file, output_file,
-                                      source_file=None):
+def GenerateAbOtaPackage(target_file, output_file, source_file=None):
   """Generates an Android OTA package that has A/B update payload."""
   # Stage the output zip package for package signing.
   if not OPTIONS.no_signing:
@@ -2074,10 +1846,10 @@
                                compression=zipfile.ZIP_DEFLATED)
 
   if source_file is not None:
-    target_info = BuildInfo(OPTIONS.target_info_dict, OPTIONS.oem_dicts)
-    source_info = BuildInfo(OPTIONS.source_info_dict, OPTIONS.oem_dicts)
+    target_info = common.BuildInfo(OPTIONS.target_info_dict, OPTIONS.oem_dicts)
+    source_info = common.BuildInfo(OPTIONS.source_info_dict, OPTIONS.oem_dicts)
   else:
-    target_info = BuildInfo(OPTIONS.info_dict, OPTIONS.oem_dicts)
+    target_info = common.BuildInfo(OPTIONS.info_dict, OPTIONS.oem_dicts)
     source_info = None
 
   # Metadata to comply with Android OTA package format.
@@ -2141,11 +1913,10 @@
     else:
       logger.warning("Cannot find care map file in target_file package")
 
-  AddCompatibilityArchiveIfTrebleEnabled(
-      target_zip, output_zip, target_info, source_info)
-
   common.ZipClose(target_zip)
 
+  CheckVintfIfTrebleEnabled(target_file, target_info)
+
   # We haven't written the metadata entry yet, which will be handled in
   # FinalizeMetadata().
   common.ZipClose(output_zip)
@@ -2161,6 +1932,104 @@
   FinalizeMetadata(metadata, staging_file, output_file, needed_property_files)
 
 
+def GenerateNonAbOtaPackage(target_file, output_file, source_file=None):
+  """Generates a non-A/B OTA package."""
+  # Sanity check the loaded info dicts first.
+  if OPTIONS.info_dict.get("no_recovery") == "true":
+    raise common.ExternalError(
+        "--- target build has specified no recovery ---")
+
+  # Non-A/B OTAs rely on /cache partition to store temporary files.
+  cache_size = OPTIONS.info_dict.get("cache_size")
+  if cache_size is None:
+    logger.warning("--- can't determine the cache partition size ---")
+  OPTIONS.cache_size = cache_size
+
+  if OPTIONS.extra_script is not None:
+    with open(OPTIONS.extra_script) as fp:
+      OPTIONS.extra_script = fp.read()
+
+  if OPTIONS.extracted_input is not None:
+    OPTIONS.input_tmp = OPTIONS.extracted_input
+  else:
+    logger.info("unzipping target target-files...")
+    OPTIONS.input_tmp = common.UnzipTemp(target_file, UNZIP_PATTERN)
+  OPTIONS.target_tmp = OPTIONS.input_tmp
+
+  # If the caller explicitly specified the device-specific extensions path via
+  # -s / --device_specific, use that. Otherwise, use META/releasetools.py if it
+  # is present in the target target_files. Otherwise, take the path of the file
+  # from 'tool_extensions' in the info dict and look for that in the local
+  # filesystem, relative to the current directory.
+  if OPTIONS.device_specific is None:
+    from_input = os.path.join(OPTIONS.input_tmp, "META", "releasetools.py")
+    if os.path.exists(from_input):
+      logger.info("(using device-specific extensions from target_files)")
+      OPTIONS.device_specific = from_input
+    else:
+      OPTIONS.device_specific = OPTIONS.info_dict.get("tool_extensions")
+
+  if OPTIONS.device_specific is not None:
+    OPTIONS.device_specific = os.path.abspath(OPTIONS.device_specific)
+
+  # Generate a full OTA.
+  if source_file is None:
+    with zipfile.ZipFile(target_file) as input_zip:
+      WriteFullOTAPackage(
+          input_zip,
+          output_file)
+
+  # Generate an incremental OTA.
+  else:
+    logger.info("unzipping source target-files...")
+    OPTIONS.source_tmp = common.UnzipTemp(
+        OPTIONS.incremental_source, UNZIP_PATTERN)
+    with zipfile.ZipFile(target_file) as input_zip, \
+        zipfile.ZipFile(source_file) as source_zip:
+      WriteBlockIncrementalOTAPackage(
+          input_zip,
+          source_zip,
+          output_file)
+
+
+def CalculateRuntimeDevicesAndFingerprints(build_info, boot_variable_values):
+  """Returns a tuple of sets for runtime devices and fingerprints"""
+
+  device_names = {build_info.device}
+  fingerprints = {build_info.fingerprint}
+
+  if not boot_variable_values:
+    return device_names, fingerprints
+
+  # Calculate all possible combinations of the values for the boot variables.
+  keys = boot_variable_values.keys()
+  value_list = boot_variable_values.values()
+  combinations = [dict(zip(keys, values))
+                  for values in itertools.product(*value_list)]
+  for placeholder_values in combinations:
+    # Reload the info_dict as some build properties may change their values
+    # based on the value of ro.boot* properties.
+    info_dict = copy.deepcopy(build_info.info_dict)
+    for partition in common.PARTITIONS_WITH_CARE_MAP:
+      partition_prop_key = "{}.build.prop".format(partition)
+      input_file = info_dict[partition_prop_key].input_file
+      if isinstance(input_file, zipfile.ZipFile):
+        with zipfile.ZipFile(input_file.filename) as input_zip:
+          info_dict[partition_prop_key] = \
+              common.PartitionBuildProps.FromInputFile(input_zip, partition,
+                                                       placeholder_values)
+      else:
+        info_dict[partition_prop_key] = \
+            common.PartitionBuildProps.FromInputFile(input_file, partition,
+                                                     placeholder_values)
+    info_dict["build.prop"] = info_dict["system.build.prop"]
+
+    new_build_info = common.BuildInfo(info_dict, build_info.oem_dicts)
+    device_names.add(new_build_info.device)
+    fingerprints.add(new_build_info.fingerprint)
+  return device_names, fingerprints
+
+
 def main(argv):
 
   def option_handler(o, a):
@@ -2215,8 +2084,13 @@
       OPTIONS.payload_signer = a
     elif o == "--payload_signer_args":
       OPTIONS.payload_signer_args = shlex.split(a)
+    elif o == "--payload_signer_maximum_signature_size":
+      OPTIONS.payload_signer_maximum_signature_size = a
     elif o == "--payload_signer_key_size":
-      OPTIONS.payload_signer_key_size = a
+      # TODO(Xunchang) remove this option after cleaning up the callers.
+      logger.warning("The option '--payload_signer_key_size' is deprecated."
+                     " Use '--payload_signer_maximum_signature_size' instead.")
+      OPTIONS.payload_signer_maximum_signature_size = a
     elif o == "--extracted_input_target_files":
       OPTIONS.extracted_input = a
     elif o == "--skip_postinstall":
@@ -2227,6 +2101,12 @@
       OPTIONS.skip_compatibility_check = True
     elif o == "--output_metadata_path":
       OPTIONS.output_metadata_path = a
+    elif o == "--disable_fec_computation":
+      OPTIONS.disable_fec_computation = True
+    elif o == "--force_non_ab":
+      OPTIONS.force_non_ab = True
+    elif o == "--boot_variable_file":
+      OPTIONS.boot_variable_file = a
     else:
       return False
     return True
@@ -2255,12 +2135,16 @@
                                  "log_diff=",
                                  "payload_signer=",
                                  "payload_signer_args=",
+                                 "payload_signer_maximum_signature_size=",
                                  "payload_signer_key_size=",
                                  "extracted_input_target_files=",
                                  "skip_postinstall",
                                  "retrofit_dynamic_partitions",
                                  "skip_compatibility_check",
                                  "output_metadata_path=",
+                                 "disable_fec_computation",
+                                 "force_non_ab",
+                                 "boot_variable_file=",
                              ], extra_option_handler=option_handler)
 
   if len(args) != 2:
@@ -2322,88 +2206,48 @@
     OPTIONS.skip_postinstall = True
 
   ab_update = OPTIONS.info_dict.get("ab_update") == "true"
+  allow_non_ab = OPTIONS.info_dict.get("allow_non_ab") == "true"
+  if OPTIONS.force_non_ab:
+    assert allow_non_ab, "--force_non_ab only allowed on devices that supports non-A/B"
+    assert ab_update, "--force_non_ab only allowed on A/B devices"
+
+  generate_ab = not OPTIONS.force_non_ab and ab_update
 
   # Use the default key to sign the package if not specified with package_key.
   # package_keys are needed on ab_updates, so always define them if an
-  # ab_update is getting created.
-  if not OPTIONS.no_signing or ab_update:
+  # A/B update is getting created.
+  if not OPTIONS.no_signing or generate_ab:
     if OPTIONS.package_key is None:
       OPTIONS.package_key = OPTIONS.info_dict.get(
           "default_system_dev_certificate",
-          "build/target/product/security/testkey")
+          "build/make/target/product/security/testkey")
     # Get signing keys
     OPTIONS.key_passwords = common.GetKeyPasswords([OPTIONS.package_key])
 
-  if ab_update:
-    WriteABOTAPackageWithBrilloScript(
+  if generate_ab:
+    GenerateAbOtaPackage(
         target_file=args[0],
         output_file=args[1],
         source_file=OPTIONS.incremental_source)
 
-    logger.info("done.")
-    return
-
-  # Sanity check the loaded info dicts first.
-  if OPTIONS.info_dict.get("no_recovery") == "true":
-    raise common.ExternalError(
-        "--- target build has specified no recovery ---")
-
-  # Non-A/B OTAs rely on /cache partition to store temporary files.
-  cache_size = OPTIONS.info_dict.get("cache_size")
-  if cache_size is None:
-    logger.warning("--- can't determine the cache partition size ---")
-  OPTIONS.cache_size = cache_size
-
-  if OPTIONS.extra_script is not None:
-    OPTIONS.extra_script = open(OPTIONS.extra_script).read()
-
-  if OPTIONS.extracted_input is not None:
-    OPTIONS.input_tmp = OPTIONS.extracted_input
   else:
-    logger.info("unzipping target target-files...")
-    OPTIONS.input_tmp = common.UnzipTemp(args[0], UNZIP_PATTERN)
-  OPTIONS.target_tmp = OPTIONS.input_tmp
+    GenerateNonAbOtaPackage(
+        target_file=args[0],
+        output_file=args[1],
+        source_file=OPTIONS.incremental_source)
 
-  # If the caller explicitly specified the device-specific extensions path via
-  # -s / --device_specific, use that. Otherwise, use META/releasetools.py if it
-  # is present in the target target_files. Otherwise, take the path of the file
-  # from 'tool_extensions' in the info dict and look for that in the local
-  # filesystem, relative to the current directory.
-  if OPTIONS.device_specific is None:
-    from_input = os.path.join(OPTIONS.input_tmp, "META", "releasetools.py")
-    if os.path.exists(from_input):
-      logger.info("(using device-specific extensions from target_files)")
-      OPTIONS.device_specific = from_input
-    else:
-      OPTIONS.device_specific = OPTIONS.info_dict.get("tool_extensions")
+  # Post OTA generation works.
+  if OPTIONS.incremental_source is not None and OPTIONS.log_diff:
+    logger.info("Generating diff logs...")
+    logger.info("Unzipping target-files for diffing...")
+    target_dir = common.UnzipTemp(args[0], TARGET_DIFFING_UNZIP_PATTERN)
+    source_dir = common.UnzipTemp(
+        OPTIONS.incremental_source, TARGET_DIFFING_UNZIP_PATTERN)
 
-  if OPTIONS.device_specific is not None:
-    OPTIONS.device_specific = os.path.abspath(OPTIONS.device_specific)
-
-  # Generate a full OTA.
-  if OPTIONS.incremental_source is None:
-    with zipfile.ZipFile(args[0], 'r') as input_zip:
-      WriteFullOTAPackage(
-          input_zip,
-          output_file=args[1])
-
-  # Generate an incremental OTA.
-  else:
-    logger.info("unzipping source target-files...")
-    OPTIONS.source_tmp = common.UnzipTemp(
-        OPTIONS.incremental_source, UNZIP_PATTERN)
-    with zipfile.ZipFile(args[0], 'r') as input_zip, \
-        zipfile.ZipFile(OPTIONS.incremental_source, 'r') as source_zip:
-      WriteBlockIncrementalOTAPackage(
-          input_zip,
-          source_zip,
-          output_file=args[1])
-
-    if OPTIONS.log_diff:
-      with open(OPTIONS.log_diff, 'w') as out_file:
-        import target_files_diff
-        target_files_diff.recursiveDiff(
-            '', OPTIONS.source_tmp, OPTIONS.input_tmp, out_file)
+    with open(OPTIONS.log_diff, 'w') as out_file:
+      import target_files_diff
+      target_files_diff.recursiveDiff(
+          '', source_dir, target_dir, out_file)
 
   logger.info("done.")
 
diff --git a/tools/releasetools/rangelib.py b/tools/releasetools/rangelib.py
index 36becf4..9d6e9fb 100644
--- a/tools/releasetools/rangelib.py
+++ b/tools/releasetools/rangelib.py
@@ -52,9 +52,12 @@
   def __ne__(self, other):
     return self.data != other.data
 
-  def __nonzero__(self):
+  def __bool__(self):
     return bool(self.data)
 
+  # Python 2 uses __nonzero__, while Python 3 uses __bool__.
+  __nonzero__ = __bool__
+
   def __str__(self):
     if not self.data:
       return "empty"
diff --git a/tools/releasetools/sign_apex.py b/tools/releasetools/sign_apex.py
index 1778615..fb947f4 100755
--- a/tools/releasetools/sign_apex.py
+++ b/tools/releasetools/sign_apex.py
@@ -19,6 +19,9 @@
 
 Usage:  sign_apex [flags] input_apex_file output_apex_file
 
+  --avbtool <avbtool>
+      Optional flag that specifies the AVB tool to use. Defaults to `avbtool`.
+
   --container_key <key>
       Mandatory flag that specifies the container signing key.
 
@@ -28,6 +31,14 @@
   --payload_extra_args <args>
       Optional flag that specifies any extra args to be passed to payload signer
       (e.g. --payload_extra_args="--signing_helper_with_files /path/to/helper").
+
+  -e  (--extra_apks)  <name,name,...=key>
+      Add extra APK name/key pairs. This is useful to sign the apk files in the
+      apex payload image.
+
+  --codename_to_api_level_map Q:29,R:30,...
+      A Mapping of codename to api level.  This is useful to provide sdk targeting
+      information to APK Signer.
 """
 
 import logging
@@ -40,12 +51,32 @@
 logger = logging.getLogger(__name__)
 
 
+def SignApexFile(avbtool, apex_file, payload_key, container_key, no_hashtree,
+                 apk_keys=None, signing_args=None, codename_to_api_level_map=None):
+  """Signs the given apex file."""
+  with open(apex_file, 'rb') as input_fp:
+    apex_data = input_fp.read()
+
+  return apex_utils.SignApex(
+      avbtool,
+      apex_data,
+      payload_key=payload_key,
+      container_key=container_key,
+      container_pw=None,
+      codename_to_api_level_map=codename_to_api_level_map,
+      no_hashtree=no_hashtree,
+      apk_keys=apk_keys,
+      signing_args=signing_args)
+
+
 def main(argv):
 
   options = {}
 
   def option_handler(o, a):
-    if o == '--container_key':
+    if o == '--avbtool':
+      options['avbtool'] = a
+    elif o == '--container_key':
       # Strip the suffix if any, as common.SignFile expects no suffix.
       DEFAULT_CONTAINER_KEY_SUFFIX = '.x509.pem'
       if a.endswith(DEFAULT_CONTAINER_KEY_SUFFIX):
@@ -55,17 +86,34 @@
       options['payload_key'] = a
     elif o == '--payload_extra_args':
       options['payload_extra_args'] = a
+    elif o == '--codename_to_api_level_map':
+      versions = a.split(",")
+      for v in versions:
+        key, value = v.split(":")
+        if 'codename_to_api_level_map' not in options:
+          options['codename_to_api_level_map'] = {}
+        options['codename_to_api_level_map'].update({key: value})
+    elif o in ("-e", "--extra_apks"):
+      names, key = a.split("=")
+      names = names.split(",")
+      for n in names:
+        if 'extra_apks' not in options:
+          options['extra_apks'] = {}
+        options['extra_apks'].update({n: key})
     else:
       return False
     return True
 
   args = common.ParseOptions(
       argv, __doc__,
-      extra_opts='',
+      extra_opts='e:',
       extra_long_opts=[
+          'avbtool=',
+          'codename_to_api_level_map=',
           'container_key=',
           'payload_extra_args=',
           'payload_key=',
+          'extra_apks=',
       ],
       extra_option_handler=option_handler)
 
@@ -76,20 +124,17 @@
 
   common.InitLogging()
 
-  input_zip = args[0]
-  output_zip = args[1]
-  with open(input_zip) as input_fp:
-    apex_data = input_fp.read()
-
-  signed_apex = apex_utils.SignApex(
-      apex_data,
-      payload_key=options['payload_key'],
-      container_key=options['container_key'],
-      container_pw=None,
-      codename_to_api_level_map=None,
-      signing_args=options.get('payload_extra_args'))
-
-  shutil.copyfile(signed_apex, output_zip)
+  signed_apex = SignApexFile(
+      options.get('avbtool', 'avbtool'),
+      args[0],
+      options['payload_key'],
+      options['container_key'],
+      no_hashtree=False,
+      apk_keys=options.get('extra_apks', {}),
+      signing_args=options.get('payload_extra_args'),
+      codename_to_api_level_map=options.get(
+          'codename_to_api_level_map', {}))
+  shutil.copyfile(signed_apex, args[1])
   logger.info("done.")
 
 
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 1b3d6f1..47360c9 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -56,7 +56,7 @@
 
       where $devkey is the directory part of the value of
       default_system_dev_certificate from the input target-files's
-      META/misc_info.txt.  (Defaulting to "build/target/product/security"
+      META/misc_info.txt.  (Defaulting to "build/make/target/product/security"
       if the value is not present in misc_info.
 
       -d and -k options are added to the set of mappings in the order
@@ -91,6 +91,14 @@
       Replace the veritykeyid in BOOT/cmdline of input_target_file_zip
       with keyid of the cert pointed by <path_to_X509_PEM_cert_file>.
 
+  --remove_avb_public_keys <key1>,<key2>,...
+      Remove AVB public keys from the first-stage ramdisk. The key file to
+      remove is located at either of the following dirs:
+        - BOOT/RAMDISK/avb/ or
+        - BOOT/RAMDISK/first_stage_ramdisk/avb/
+      The second dir will be used for lookup if BOARD_USES_RECOVERY_AS_BOOT is
+      set to true.
+
   --avb_{boot,system,system_other,vendor,dtbo,vbmeta,vbmeta_system,
          vbmeta_vendor}_algorithm <algorithm>
   --avb_{boot,system,system_other,vendor,dtbo,vbmeta,vbmeta_system,
@@ -103,6 +111,20 @@
       Specify any additional args that are needed to AVB-sign the image
       (e.g. "--signing_helper /path/to/helper"). The args will be appended to
       the existing ones in info dict.
+
+  --avb_extra_custom_image_key <partition=key>
+  --avb_extra_custom_image_algorithm <partition=algorithm>
+      Use the specified algorithm (e.g. SHA256_RSA4096) and the key to AVB-sign
+      the specified custom images mounted on the partition. Otherwise it uses
+      the existing values in info dict.
+
+  --avb_extra_custom_image_extra_args <partition=extra_args>
+      Specify any additional args that are needed to AVB-sign the custom images
+      mounted on the partition (e.g. "--signing_helper /path/to/helper"). The
+      args will be appended to the existing ones in info dict.
+
+  --android_jar_path <path>
+      Path to the android.jar to repack the apex file.
 """
 
 from __future__ import print_function
@@ -111,6 +133,7 @@
 import copy
 import errno
 import gzip
+import io
 import itertools
 import logging
 import os
@@ -146,19 +169,35 @@
 OPTIONS.replace_verity_public_key = False
 OPTIONS.replace_verity_private_key = False
 OPTIONS.replace_verity_keyid = False
+OPTIONS.remove_avb_public_keys = None
 OPTIONS.tag_changes = ("-test-keys", "-dev-keys", "+release-keys")
 OPTIONS.avb_keys = {}
 OPTIONS.avb_algorithms = {}
 OPTIONS.avb_extra_args = {}
+OPTIONS.android_jar_path = None
+
+
+AVB_FOOTER_ARGS_BY_PARTITION = {
+    'boot' : 'avb_boot_add_hash_footer_args',
+    'dtbo' : 'avb_dtbo_add_hash_footer_args',
+    'recovery' : 'avb_recovery_add_hash_footer_args',
+    'system' : 'avb_system_add_hashtree_footer_args',
+    'system_other' : 'avb_system_other_add_hashtree_footer_args',
+    'vendor' : 'avb_vendor_add_hashtree_footer_args',
+    'vendor_boot' : 'avb_vendor_boot_add_hash_footer_args',
+    'vbmeta' : 'avb_vbmeta_args',
+    'vbmeta_system' : 'avb_vbmeta_system_args',
+    'vbmeta_vendor' : 'avb_vbmeta_vendor_args',
+}
 
 
 def GetApkCerts(certmap):
   # apply the key remapping to the contents of the file
-  for apk, cert in certmap.iteritems():
+  for apk, cert in certmap.items():
     certmap[apk] = OPTIONS.key_map.get(cert, cert)
 
   # apply all the -e options, overriding anything in the file
-  for apk, cert in OPTIONS.extra_apks.iteritems():
+  for apk, cert in OPTIONS.extra_apks.items():
     if not cert:
       cert = "PRESIGNED"
     certmap[apk] = OPTIONS.key_map.get(cert, cert)
@@ -179,6 +218,9 @@
   Returns:
     A dict that contains the updated APEX key mapping, which should be used for
     the current signing.
+
+  Raises:
+    AssertionError: On invalid container / payload key overrides.
   """
   # Apply all the --extra_apex_payload_key options to override the payload
   # signing keys in the given keys_info.
@@ -203,6 +245,24 @@
       key = 'PRESIGNED'
     keys_info[apex] = (keys_info[apex][0], key_map.get(key, key))
 
+  # A PRESIGNED container entails a PRESIGNED payload. Apply this to all the
+  # APEX key pairs. However, a PRESIGNED container with non-PRESIGNED payload
+  # (overridden via commandline) indicates a config error, which should not be
+  # allowed.
+  for apex, (payload_key, container_key) in keys_info.items():
+    if container_key != 'PRESIGNED':
+      continue
+    if apex in OPTIONS.extra_apex_payload_keys:
+      payload_override = OPTIONS.extra_apex_payload_keys[apex]
+      assert payload_override == '', \
+          ("Invalid APEX key overrides: {} has PRESIGNED container but "
+           "non-PRESIGNED payload key {}").format(apex, payload_override)
+    if payload_key != 'PRESIGNED':
+      print(
+          "Setting {} payload as PRESIGNED due to PRESIGNED container".format(
+              apex))
+    keys_info[apex] = ('PRESIGNED', 'PRESIGNED')
+
   return keys_info
 
 
@@ -295,7 +355,9 @@
        "not sign this apk).".format("\n  ".join(unknown_files)))
 
   # For all the APEXes, double check that we won't have an APEX that has only
-  # one of the payload / container keys set.
+  # one of the payload / container keys set. Note that non-PRESIGNED container
+  # with PRESIGNED payload could be allowed but currently unsupported. It would
+  # require changing SignApex implementation.
   if not apex_keys:
     return
 
@@ -399,7 +461,8 @@
     if filename.startswith("IMAGES/"):
       continue
 
-    # Skip split super images, which will be re-generated during signing.
+    # Skip OTA-specific images (e.g. split super images), which will be
+    # re-generated during signing.
     if filename.startswith("OTA/") and filename.endswith(".img"):
       continue
 
@@ -448,12 +511,15 @@
             maxsize, name, payload_key))
 
         signed_apex = apex_utils.SignApex(
+            misc_info['avb_avbtool'],
             data,
             payload_key,
             container_key,
             key_passwords[container_key],
+            apk_keys,
             codename_to_api_level_map,
-            OPTIONS.avb_extra_args.get('apex'))
+            no_hashtree=True,
+            signing_args=OPTIONS.avb_extra_args.get('apex'))
         common.ZipWrite(output_tf_zip, signed_apex, filename)
 
       else:
@@ -468,52 +534,66 @@
       continue
 
     # System properties.
-    elif filename in ("SYSTEM/build.prop",
-                      "VENDOR/build.prop",
-                      "SYSTEM/vendor/build.prop",
-                      "ODM/build.prop",  # legacy
-                      "ODM/etc/build.prop",
-                      "VENDOR/odm/build.prop",  # legacy
-                      "VENDOR/odm/etc/build.prop",
-                      "PRODUCT/build.prop",
-                      "SYSTEM/product/build.prop",
-                      "PRODUCT_SERVICES/build.prop",
-                      "SYSTEM/product_services/build.prop",
-                      "SYSTEM/etc/prop.default",
-                      "BOOT/RAMDISK/prop.default",
-                      "BOOT/RAMDISK/default.prop",  # legacy
-                      "ROOT/default.prop",  # legacy
-                      "RECOVERY/RAMDISK/prop.default",
-                      "RECOVERY/RAMDISK/default.prop"):  # legacy
+    elif filename in (
+        "SYSTEM/build.prop",
+
+        "VENDOR/build.prop",
+        "SYSTEM/vendor/build.prop",
+
+        "ODM/etc/build.prop",
+        "VENDOR/odm/etc/build.prop",
+
+        "PRODUCT/build.prop",
+        "SYSTEM/product/build.prop",
+
+        "SYSTEM_EXT/build.prop",
+        "SYSTEM/system_ext/build.prop",
+
+        "SYSTEM/etc/prop.default",
+        "BOOT/RAMDISK/prop.default",
+        "RECOVERY/RAMDISK/prop.default",
+
+        # ROOT/default.prop is a legacy path, but may still exist for upgrading
+        # devices that don't support `property_overrides_split_enabled`.
+        "ROOT/default.prop",
+
+        # RECOVERY/RAMDISK/default.prop is a legacy path, but will always exist
+        # as a symlink in the current code. So it's a no-op here. Keeping the
+        # path here for clarity.
+        "RECOVERY/RAMDISK/default.prop"):
       print("Rewriting %s:" % (filename,))
       if stat.S_ISLNK(info.external_attr >> 16):
         new_data = data
       else:
-        new_data = RewriteProps(data)
+        new_data = RewriteProps(data.decode())
       common.ZipWriteStr(output_tf_zip, out_info, new_data)
 
     # Replace the certs in *mac_permissions.xml (there could be multiple, such
     # as {system,vendor}/etc/selinux/{plat,nonplat}_mac_permissions.xml).
     elif filename.endswith("mac_permissions.xml"):
       print("Rewriting %s with new keys." % (filename,))
-      new_data = ReplaceCerts(data)
+      new_data = ReplaceCerts(data.decode())
       common.ZipWriteStr(output_tf_zip, out_info, new_data)
 
     # Ask add_img_to_target_files to rebuild the recovery patch if needed.
     elif filename in ("SYSTEM/recovery-from-boot.p",
+                      "VENDOR/recovery-from-boot.p",
+
                       "SYSTEM/etc/recovery.img",
-                      "SYSTEM/bin/install-recovery.sh"):
+                      "VENDOR/etc/recovery.img",
+
+                      "SYSTEM/bin/install-recovery.sh",
+                      "VENDOR/bin/install-recovery.sh"):
       OPTIONS.rebuild_recovery = True
 
     # Don't copy OTA certs if we're replacing them.
+    # Replacement of update-payload-key.pub.pem was removed in b/116660991.
     elif (
         OPTIONS.replace_ota_keys and
         filename in (
             "BOOT/RAMDISK/system/etc/security/otacerts.zip",
-            "BOOT/RAMDISK/system/etc/update_engine/update-payload-key.pub.pem",
             "RECOVERY/RAMDISK/system/etc/security/otacerts.zip",
-            "SYSTEM/etc/security/otacerts.zip",
-            "SYSTEM/etc/update_engine/update-payload-key.pub.pem")):
+            "SYSTEM/etc/security/otacerts.zip")):
       pass
 
     # Skip META/misc_info.txt since we will write back the new values later.
@@ -525,6 +605,18 @@
           filename in ("BOOT/RAMDISK/verity_key",
                        "ROOT/verity_key")):
       pass
+    elif (OPTIONS.remove_avb_public_keys and
+          (filename.startswith("BOOT/RAMDISK/avb/") or
+           filename.startswith("BOOT/RAMDISK/first_stage_ramdisk/avb/"))):
+        matched_removal = False
+        for key_to_remove in OPTIONS.remove_avb_public_keys:
+          if filename.endswith(key_to_remove):
+            matched_removal = True
+            print("Removing AVB public key from ramdisk: %s" % filename)
+            break
+        if not matched_removal:
+          # Copy it verbatim if we don't want to remove it.
+          common.ZipWriteStr(output_tf_zip, out_info, data)
 
     # Skip verity keyid (for system_root_image use) if we will replace it.
     elif OPTIONS.replace_verity_keyid and filename == "BOOT/cmdline":
@@ -542,15 +634,15 @@
       # key is specified via --avb_system_other_key.
       signing_key = OPTIONS.avb_keys.get("system_other")
       if signing_key:
-        public_key = common.ExtractAvbPublicKey(signing_key)
+        public_key = common.ExtractAvbPublicKey(
+            misc_info['avb_avbtool'], signing_key)
         print("    Rewriting AVB public key of system_other in /product")
         common.ZipWrite(output_tf_zip, public_key, filename)
 
     # Should NOT sign boot-debug.img.
     elif filename in (
         "BOOT/RAMDISK/force_debuggable",
-        "RECOVERY/RAMDISK/force_debuggable"
-        "RECOVERY/RAMDISK/first_stage_ramdisk/force_debuggable"):
+        "BOOT/RAMDISK/first_stage_ramdisk/force_debuggable"):
       raise common.ExternalError("debuggable boot.img cannot be signed")
 
     # A non-APK file; copy it verbatim.
@@ -565,11 +657,16 @@
     ReplaceVerityPrivateKey(misc_info, OPTIONS.replace_verity_private_key[1])
 
   if OPTIONS.replace_verity_public_key:
-    dest = "ROOT/verity_key" if system_root_image else "BOOT/RAMDISK/verity_key"
-    # We are replacing the one in boot image only, since the one under
-    # recovery won't ever be needed.
+    # Replace the one in root dir in system.img.
     ReplaceVerityPublicKey(
-        output_tf_zip, dest, OPTIONS.replace_verity_public_key[1])
+        output_tf_zip, 'ROOT/verity_key', OPTIONS.replace_verity_public_key[1])
+
+    if not system_root_image:
+      # Additionally replace the copy in ramdisk if not using system-as-root.
+      ReplaceVerityPublicKey(
+          output_tf_zip,
+          'BOOT/RAMDISK/verity_key',
+          OPTIONS.replace_verity_public_key[1])
 
   # Replace the keyid string in BOOT/cmdline.
   if OPTIONS.replace_verity_keyid:
@@ -579,6 +676,10 @@
   # Replace the AVB signing keys, if any.
   ReplaceAvbSigningKeys(misc_info)
 
+  # Rewrite the props in AVB signing args.
+  if misc_info.get('avb_enable') == 'true':
+    RewriteAvbProps(misc_info)
+
   # Write back misc_info with the latest values.
   ReplaceMiscInfoTxt(input_tf_zip, output_tf_zip, misc_info)
 
@@ -600,17 +701,17 @@
   Raises:
     AssertionError: On finding duplicate entries.
   """
-  for old, new in OPTIONS.key_map.iteritems():
+  for old, new in OPTIONS.key_map.items():
     if OPTIONS.verbose:
       print("    Replacing %s.x509.pem with %s.x509.pem" % (old, new))
 
     try:
       with open(old + ".x509.pem") as old_fp:
         old_cert16 = base64.b16encode(
-            common.ParseCertificate(old_fp.read())).lower()
+            common.ParseCertificate(old_fp.read())).decode().lower()
       with open(new + ".x509.pem") as new_fp:
         new_cert16 = base64.b16encode(
-            common.ParseCertificate(new_fp.read())).lower()
+            common.ParseCertificate(new_fp.read())).decode().lower()
     except IOError as e:
       if OPTIONS.verbose or e.errno != errno.ENOENT:
         print("    Error accessing %s: %s.\nSkip replacing %s.x509.pem with "
@@ -711,12 +812,7 @@
     filename: The archive name in the output zip.
     keys: A list of public keys to use during OTA package verification.
   """
-
-  try:
-    from StringIO import StringIO
-  except ImportError:
-    from io import StringIO
-  temp_file = StringIO()
+  temp_file = io.BytesIO()
   certs_zip = zipfile.ZipFile(temp_file, "w")
   for k in keys:
     common.ZipWrite(certs_zip, k)
@@ -753,7 +849,7 @@
     print("for OTA package verification")
   else:
     devkey = misc_info.get("default_system_dev_certificate",
-                           "build/target/product/security/testkey")
+                           "build/make/target/product/security/testkey")
     mapped_devkey = OPTIONS.key_map.get(devkey, devkey)
     if mapped_devkey != devkey:
       misc_info["default_system_dev_certificate"] = mapped_devkey
@@ -776,24 +872,6 @@
   # We DO NOT include the extra_recovery_keys (if any) here.
   WriteOtacerts(output_tf_zip, "SYSTEM/etc/security/otacerts.zip", mapped_keys)
 
-  # For A/B devices, update the payload verification key.
-  if misc_info.get("ab_update") == "true":
-    # Unlike otacerts.zip that may contain multiple keys, we can only specify
-    # ONE payload verification key.
-    if len(mapped_keys) > 1:
-      print("\n  WARNING: Found more than one OTA keys; Using the first one"
-            " as payload verification key.\n\n")
-
-    print("Using %s for payload verification." % (mapped_keys[0],))
-    pubkey = common.ExtractPublicKey(mapped_keys[0])
-    common.ZipWriteStr(
-        output_tf_zip,
-        "SYSTEM/etc/update_engine/update-payload-key.pub.pem",
-        pubkey)
-    common.ZipWriteStr(
-        output_tf_zip,
-        "BOOT/RAMDISK/system/etc/update_engine/update-payload-key.pub.pem",
-        pubkey)
 
 
 def ReplaceVerityPublicKey(output_zip, filename, key_path):
@@ -828,7 +906,7 @@
         writable.
     key_path: The path to the PEM encoded X.509 certificate.
   """
-  in_cmdline = input_zip.read("BOOT/cmdline")
+  in_cmdline = input_zip.read("BOOT/cmdline").decode()
   # Copy in_cmdline to output_zip if veritykeyid is not present.
   if "veritykeyid" not in in_cmdline:
     common.ZipWriteStr(output_zip, "BOOT/cmdline", in_cmdline)
@@ -861,7 +939,7 @@
   current in-memory dict contains additional items computed at runtime.
   """
   misc_info_old = common.LoadDictionaryFromLines(
-      input_zip.read('META/misc_info.txt').split('\n'))
+      input_zip.read('META/misc_info.txt').decode().split('\n'))
   items = []
   for key in sorted(misc_info):
     if key in misc_info_old:
@@ -872,18 +950,6 @@
 def ReplaceAvbSigningKeys(misc_info):
   """Replaces the AVB signing keys."""
 
-  AVB_FOOTER_ARGS_BY_PARTITION = {
-      'boot' : 'avb_boot_add_hash_footer_args',
-      'dtbo' : 'avb_dtbo_add_hash_footer_args',
-      'recovery' : 'avb_recovery_add_hash_footer_args',
-      'system' : 'avb_system_add_hashtree_footer_args',
-      'system_other' : 'avb_system_other_add_hashtree_footer_args',
-      'vendor' : 'avb_vendor_add_hashtree_footer_args',
-      'vbmeta' : 'avb_vbmeta_args',
-      'vbmeta_system' : 'avb_vbmeta_system_args',
-      'vbmeta_vendor' : 'avb_vbmeta_vendor_args',
-  }
-
   def ReplaceAvbPartitionSigningKey(partition):
     key = OPTIONS.avb_keys.get(partition)
     if not key:
@@ -901,18 +967,52 @@
     if extra_args:
       print('Setting extra AVB signing args for %s to "%s"' % (
           partition, extra_args))
-      args_key = AVB_FOOTER_ARGS_BY_PARTITION[partition]
+      if partition in AVB_FOOTER_ARGS_BY_PARTITION:
+        args_key = AVB_FOOTER_ARGS_BY_PARTITION[partition]
+      else:
+        # custom partition
+        args_key = "avb_{}_add_hashtree_footer_args".format(partition)
       misc_info[args_key] = (misc_info.get(args_key, '') + ' ' + extra_args)
 
   for partition in AVB_FOOTER_ARGS_BY_PARTITION:
     ReplaceAvbPartitionSigningKey(partition)
 
+  for custom_partition in misc_info.get(
+      "avb_custom_images_partition_list", "").strip().split():
+    ReplaceAvbPartitionSigningKey(custom_partition)
+
+
+def RewriteAvbProps(misc_info):
+  """Rewrites the props in AVB signing args."""
+  for partition, args_key in AVB_FOOTER_ARGS_BY_PARTITION.items():
+    args = misc_info.get(args_key)
+    if not args:
+      continue
+
+    tokens = []
+    changed = False
+    for token in args.split(' '):
+      fingerprint_key = 'com.android.build.{}.fingerprint'.format(partition)
+      if not token.startswith(fingerprint_key):
+        tokens.append(token)
+        continue
+      prefix, tag = token.rsplit('/', 1)
+      tokens.append('{}/{}'.format(prefix, EditTags(tag)))
+      changed = True
+
+    if changed:
+      result = ' '.join(tokens)
+      print('Rewriting AVB prop for {}:\n'.format(partition))
+      print('  replace: {}'.format(args))
+      print('     with: {}'.format(result))
+      misc_info[args_key] = result
+
 
 def BuildKeyMap(misc_info, key_mapping_options):
   for s, d in key_mapping_options:
     if s is None:   # -d option
       devkey = misc_info.get("default_system_dev_certificate",
-                             "build/target/product/security/testkey")
+                             "build/make/target/product/security/testkey")
       devkeydir = os.path.dirname(devkey)
 
       OPTIONS.key_map.update({
@@ -921,13 +1021,14 @@
           devkeydir + "/media":    d + "/media",
           devkeydir + "/shared":   d + "/shared",
           devkeydir + "/platform": d + "/platform",
+          devkeydir + "/networkstack": d + "/networkstack",
           })
     else:
       OPTIONS.key_map[s] = d
 
 
 def GetApiLevelAndCodename(input_tf_zip):
-  data = input_tf_zip.read("SYSTEM/build.prop")
+  data = input_tf_zip.read("SYSTEM/build.prop").decode()
   api_level = None
   codename = None
   for line in data.split("\n"):
@@ -949,7 +1050,7 @@
 
 
 def GetCodenameToApiLevelMap(input_tf_zip):
-  data = input_tf_zip.read("SYSTEM/build.prop")
+  data = input_tf_zip.read("SYSTEM/build.prop").decode()
   api_level = None
   codenames = None
   for line in data.split("\n"):
@@ -967,15 +1068,11 @@
   if codenames is None:
     raise ValueError("No ro.build.version.all_codenames in SYSTEM/build.prop")
 
-  result = dict()
+  result = {}
   for codename in codenames:
     codename = codename.strip()
     if codename:
       result[codename] = api_level
-
-  # Work around APKs that still target 'Q' instead of API 29 (b/132882632).
-  result['Q'] = 29
-
   return result
 
 
@@ -995,7 +1092,7 @@
         key.
   """
   keys = {}
-  for line in tf_zip.read("META/apexkeys.txt").split("\n"):
+  for line in tf_zip.read('META/apexkeys.txt').decode().split('\n'):
     line = line.strip()
     if not line:
       continue
@@ -1004,7 +1101,8 @@
         r'public_key="(?P<PAYLOAD_PUBLIC_KEY>.*)"\s+'
         r'private_key="(?P<PAYLOAD_PRIVATE_KEY>.*)"\s+'
         r'container_certificate="(?P<CONTAINER_CERT>.*)"\s+'
-        r'container_private_key="(?P<CONTAINER_PRIVATE_KEY>.*)"$',
+        r'container_private_key="(?P<CONTAINER_PRIVATE_KEY>.*?)"'
+        r'(\s+partition="(?P<PARTITION>.*?)")?$',
         line)
     if not matches:
       continue
@@ -1077,6 +1175,8 @@
       OPTIONS.replace_verity_private_key = (True, a)
     elif o == "--replace_verity_keyid":
       OPTIONS.replace_verity_keyid = (True, a)
+    elif o == "--remove_avb_public_keys":
+      OPTIONS.remove_avb_public_keys = a.split(",")
     elif o == "--avb_vbmeta_key":
       OPTIONS.avb_keys['vbmeta'] = a
     elif o == "--avb_vbmeta_algorithm":
@@ -1127,6 +1227,18 @@
       OPTIONS.avb_extra_args['vbmeta_vendor'] = a
     elif o == "--avb_apex_extra_args":
       OPTIONS.avb_extra_args['apex'] = a
+    elif o == "--avb_extra_custom_image_key":
+      partition, key = a.split("=")
+      OPTIONS.avb_keys[partition] = key
+    elif o == "--avb_extra_custom_image_algorithm":
+      partition, algorithm = a.split("=")
+      OPTIONS.avb_algorithms[partition] = algorithm
+    elif o == "--avb_extra_custom_image_extra_args":
+      # Setting the maxsplit parameter to one, which will return a list with
+      # two elements. e.g., the second '=' should not be splitted for
+      # 'oem=--signing_helper_with_files=/tmp/avbsigner.sh'.
+      partition, extra_args = a.split("=", 1)
+      OPTIONS.avb_extra_args[partition] = extra_args
     else:
       return False
     return True
@@ -1145,6 +1257,7 @@
           "replace_verity_public_key=",
           "replace_verity_private_key=",
           "replace_verity_keyid=",
+          "remove_avb_public_keys=",
           "avb_apex_extra_args=",
           "avb_vbmeta_algorithm=",
           "avb_vbmeta_key=",
@@ -1170,6 +1283,9 @@
           "avb_vbmeta_vendor_algorithm=",
           "avb_vbmeta_vendor_key=",
           "avb_vbmeta_vendor_extra_args=",
+          "avb_extra_custom_image_key=",
+          "avb_extra_custom_image_algorithm=",
+          "avb_extra_custom_image_extra_args=",
       ],
       extra_option_handler=option_handler)
 
@@ -1194,6 +1310,8 @@
   apex_keys_info = ReadApexKeysInfo(input_zip)
   apex_keys = GetApexKeys(apex_keys_info, apk_keys)
 
+  # TODO(xunchang) check for the apks inside the apex files, and abort early if
+  # the keys are not available.
   CheckApkAndApexKeysAvailable(
       input_zip,
       set(apk_keys.keys()) | set(apex_keys.keys()),
diff --git a/tools/releasetools/sparse_img.py b/tools/releasetools/sparse_img.py
old mode 100755
new mode 100644
index 3367896..524c0f2
--- a/tools/releasetools/sparse_img.py
+++ b/tools/releasetools/sparse_img.py
@@ -249,8 +249,19 @@
 
     with open(fn) as f:
       for line in f:
-        fn, ranges = line.split(None, 1)
-        ranges = rangelib.RangeSet.parse(ranges)
+        fn, ranges_text = line.rstrip().split(None, 1)
+        raw_ranges = rangelib.RangeSet.parse(ranges_text)
+
+        # Note: e2fsdroid records holes in the extent tree as "0" blocks.
+        # This causes confusion because clobbered_blocks always includes
+        # the superblock (physical block #0). Since the 0 blocks here do
+        # not represent actual physical blocks, remove them from the set.
+        ranges = raw_ranges.subtract(rangelib.RangeSet("0"))
+        # b/150334561 we need to perserve the monotonic property of the raw
+        # range. Otherwise, the validation script will read the blocks with
+        # wrong order when pulling files from the image.
+        ranges.monotonic = raw_ranges.monotonic
+        ranges.extra['text_str'] = ranges_text
 
         if allow_shared_blocks:
           # Find the shared blocks that have been claimed by others. If so, tag
@@ -261,9 +272,6 @@
             if not non_shared:
               continue
 
-            # There shouldn't anything in the extra dict yet.
-            assert not ranges.extra, "Non-empty RangeSet.extra"
-
             # Put the non-shared RangeSet as the value in the block map, which
             # has a copy of the original RangeSet.
             non_shared.extra['uses_shared_blocks'] = ranges
diff --git a/tools/releasetools/test_add_img_to_target_files.py b/tools/releasetools/test_add_img_to_target_files.py
index 482f86c..c82a40b 100644
--- a/tools/releasetools/test_add_img_to_target_files.py
+++ b/tools/releasetools/test_add_img_to_target_files.py
@@ -21,7 +21,7 @@
 import common
 import test_utils
 from add_img_to_target_files import (
-    AddCareMapForAbOta, AddPackRadioImages, AppendVBMetaArgsForPartition,
+    AddCareMapForAbOta, AddPackRadioImages,
     CheckAbOtaImages, GetCareMap)
 from rangelib import RangeSet
 
@@ -34,18 +34,6 @@
   def setUp(self):
     OPTIONS.input_tmp = common.MakeTempDir()
 
-  def _verifyCareMap(self, expected, file_name):
-    """Parses the care_map.pb; and checks the content in plain text."""
-    text_file = common.MakeTempFile(prefix="caremap-", suffix=".txt")
-
-    # Calls an external binary to convert the proto message.
-    cmd = ["care_map_generator", "--parse_proto", file_name, text_file]
-    common.RunAndCheckOutput(cmd)
-
-    with open(text_file, 'r') as verify_fp:
-      plain_text = verify_fp.read()
-    self.assertEqual('\n'.join(expected), plain_text)
-
   @staticmethod
   def _create_images(images, prefix):
     """Creates images under OPTIONS.input_tmp/prefix."""
@@ -135,15 +123,21 @@
   def _test_AddCareMapForAbOta():
     """Helper function to set up the test for test_AddCareMapForAbOta()."""
     OPTIONS.info_dict = {
+        'extfs_sparse_flag' : '-s',
+        'system_image_size' : 65536,
+        'vendor_image_size' : 40960,
         'system_verity_block_device': '/dev/block/system',
         'vendor_verity_block_device': '/dev/block/vendor',
-        'system.build.prop': {
-            'ro.system.build.fingerprint':
-                'google/sailfish/12345:user/dev-keys',
-        },
-        'vendor.build.prop': {
-            'ro.vendor.build.fingerprint': 'google/sailfish/678:user/dev-keys',
-        }
+        'system.build.prop': common.PartitionBuildProps.FromDictionary(
+            'system', {
+                'ro.system.build.fingerprint':
+                'google/sailfish/12345:user/dev-keys'}
+        ),
+        'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+            'vendor', {
+                'ro.vendor.build.fingerprint':
+                'google/sailfish/678:user/dev-keys'}
+        ),
     }
 
     # Prepare the META/ folder.
@@ -154,9 +148,9 @@
     system_image = test_utils.construct_sparse_image([
         (0xCAC1, 6),
         (0xCAC3, 4),
-        (0xCAC1, 6)])
+        (0xCAC1, 8)])
     vendor_image = test_utils.construct_sparse_image([
-        (0xCAC2, 10)])
+        (0xCAC2, 12)])
 
     image_paths = {
         'system' : system_image,
@@ -164,6 +158,19 @@
     }
     return image_paths
 
+  def _verifyCareMap(self, expected, file_name):
+    """Parses the care_map.pb; and checks the content in plain text."""
+    text_file = common.MakeTempFile(prefix="caremap-", suffix=".txt")
+
+    # Calls an external binary to convert the proto message.
+    cmd = ["care_map_generator", "--parse_proto", file_name, text_file]
+    common.RunAndCheckOutput(cmd)
+
+    with open(text_file) as verify_fp:
+      plain_text = verify_fp.read()
+    self.assertEqual('\n'.join(expected), plain_text)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta(self):
     image_paths = self._test_AddCareMapForAbOta()
 
@@ -179,6 +186,7 @@
 
     self._verifyCareMap(expected, care_map_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta_withNonCareMapPartitions(self):
     """Partitions without care_map should be ignored."""
     image_paths = self._test_AddCareMapForAbOta()
@@ -196,19 +204,26 @@
 
     self._verifyCareMap(expected, care_map_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta_withAvb(self):
     """Tests the case for device using AVB."""
     image_paths = self._test_AddCareMapForAbOta()
     OPTIONS.info_dict = {
-        'avb_system_hashtree_enable' : 'true',
-        'avb_vendor_hashtree_enable' : 'true',
-        'system.build.prop': {
-            'ro.system.build.fingerprint':
-                'google/sailfish/12345:user/dev-keys',
-        },
-        'vendor.build.prop': {
-            'ro.vendor.build.fingerprint': 'google/sailfish/678:user/dev-keys',
-        }
+        'extfs_sparse_flag': '-s',
+        'system_image_size': 65536,
+        'vendor_image_size': 40960,
+        'avb_system_hashtree_enable': 'true',
+        'avb_vendor_hashtree_enable': 'true',
+        'system.build.prop': common.PartitionBuildProps.FromDictionary(
+            'system', {
+                'ro.system.build.fingerprint':
+                'google/sailfish/12345:user/dev-keys'}
+        ),
+        'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+            'vendor', {
+                'ro.vendor.build.fingerprint':
+                'google/sailfish/678:user/dev-keys'}
+        ),
     }
 
     AddCareMapForAbOta(None, ['system', 'vendor'], image_paths)
@@ -223,10 +238,14 @@
 
     self._verifyCareMap(expected, care_map_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta_noFingerprint(self):
     """Tests the case for partitions without fingerprint."""
     image_paths = self._test_AddCareMapForAbOta()
     OPTIONS.info_dict = {
+        'extfs_sparse_flag' : '-s',
+        'system_image_size' : 65536,
+        'vendor_image_size' : 40960,
         'system_verity_block_device': '/dev/block/system',
         'vendor_verity_block_device': '/dev/block/vendor',
     }
@@ -240,18 +259,26 @@
 
     self._verifyCareMap(expected, care_map_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta_withThumbprint(self):
     """Tests the case for partitions with thumbprint."""
     image_paths = self._test_AddCareMapForAbOta()
     OPTIONS.info_dict = {
+        'extfs_sparse_flag': '-s',
+        'system_image_size': 65536,
+        'vendor_image_size': 40960,
         'system_verity_block_device': '/dev/block/system',
         'vendor_verity_block_device': '/dev/block/vendor',
-        'system.build.prop': {
-            'ro.system.build.thumbprint': 'google/sailfish/123:user/dev-keys',
-        },
-        'vendor.build.prop' : {
-            'ro.vendor.build.thumbprint': 'google/sailfish/456:user/dev-keys',
-        }
+        'system.build.prop': common.PartitionBuildProps.FromDictionary(
+            'system', {
+                'ro.system.build.thumbprint':
+                'google/sailfish/123:user/dev-keys'}
+        ),
+        'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+            'vendor', {
+                'ro.vendor.build.thumbprint':
+                'google/sailfish/456:user/dev-keys'}
+        ),
     }
 
     AddCareMapForAbOta(None, ['system', 'vendor'], image_paths)
@@ -266,6 +293,35 @@
 
     self._verifyCareMap(expected, care_map_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_AddCareMapForAbOta_skipPartition(self):
+    image_paths = self._test_AddCareMapForAbOta()
+
+    # Remove vendor_image_size to invalidate the care_map for vendor.img.
+    del OPTIONS.info_dict['vendor_image_size']
+
+    AddCareMapForAbOta(None, ['system', 'vendor'], image_paths)
+
+    care_map_file = os.path.join(OPTIONS.input_tmp, 'META', 'care_map.pb')
+    expected = ['system', RangeSet("0-5 10-15").to_string_raw(),
+                "ro.system.build.fingerprint",
+                "google/sailfish/12345:user/dev-keys"]
+
+    self._verifyCareMap(expected, care_map_file)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_AddCareMapForAbOta_skipAllPartitions(self):
+    image_paths = self._test_AddCareMapForAbOta()
+
+    # Remove the image_size properties for all the partitions.
+    del OPTIONS.info_dict['system_image_size']
+    del OPTIONS.info_dict['vendor_image_size']
+
+    AddCareMapForAbOta(None, ['system', 'vendor'], image_paths)
+
+    self.assertFalse(
+        os.path.exists(os.path.join(OPTIONS.input_tmp, 'META', 'care_map.pb')))
+
   def test_AddCareMapForAbOta_verityNotEnabled(self):
     """No care_map.pb should be generated if verity not enabled."""
     image_paths = self._test_AddCareMapForAbOta()
@@ -282,6 +338,7 @@
     self.assertRaises(AssertionError, AddCareMapForAbOta, None,
                       ['system', 'vendor'], image_paths)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta_zipOutput(self):
     """Tests the case with ZIP output."""
     image_paths = self._test_AddCareMapForAbOta()
@@ -304,6 +361,7 @@
                 "google/sailfish/678:user/dev-keys"]
     self._verifyCareMap(expected, os.path.join(temp_dir, care_map_name))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_AddCareMapForAbOta_zipOutput_careMapEntryExists(self):
     """Tests the case with ZIP output which already has care_map entry."""
     image_paths = self._test_AddCareMapForAbOta()
@@ -331,37 +389,13 @@
     # The existing entry should be scheduled to be replaced.
     self.assertIn('META/care_map.pb', OPTIONS.replace_updated_files_list)
 
-  def test_AppendVBMetaArgsForPartition(self):
-    OPTIONS.info_dict = {}
-    cmd = []
-    AppendVBMetaArgsForPartition(cmd, 'system', '/path/to/system.img')
-    self.assertEqual(
-        ['--include_descriptors_from_image', '/path/to/system.img'], cmd)
-
-  def test_AppendVBMetaArgsForPartition_vendorAsChainedPartition(self):
-    testdata_dir = test_utils.get_testdata_dir()
-    pubkey = os.path.join(testdata_dir, 'testkey.pubkey.pem')
-    OPTIONS.info_dict = {
-        'avb_avbtool': 'avbtool',
-        'avb_vendor_key_path': pubkey,
-        'avb_vendor_rollback_index_location': 5,
-    }
-    cmd = []
-    AppendVBMetaArgsForPartition(cmd, 'vendor', '/path/to/vendor.img')
-    self.assertEqual(2, len(cmd))
-    self.assertEqual('--chain_partition', cmd[0])
-    chained_partition_args = cmd[1].split(':')
-    self.assertEqual(3, len(chained_partition_args))
-    self.assertEqual('vendor', chained_partition_args[0])
-    self.assertEqual('5', chained_partition_args[1])
-    self.assertTrue(os.path.exists(chained_partition_args[2]))
-
   def test_GetCareMap(self):
     sparse_image = test_utils.construct_sparse_image([
         (0xCAC1, 6),
         (0xCAC3, 4),
         (0xCAC1, 6)])
     OPTIONS.info_dict = {
+        'extfs_sparse_flag' : '-s',
         'system_image_size' : 53248,
     }
     name, care_map = GetCareMap('system', sparse_image)
@@ -377,6 +411,17 @@
         (0xCAC3, 4),
         (0xCAC1, 6)])
     OPTIONS.info_dict = {
+        'extfs_sparse_flag' : '-s',
         'system_image_size' : -45056,
     }
     self.assertRaises(AssertionError, GetCareMap, 'system', sparse_image)
+
+  def test_GetCareMap_nonSparseImage(self):
+    OPTIONS.info_dict = {
+        'system_image_size' : 53248,
+    }
+    # 'foo' is the image filename, which is expected to be not used by
+    # GetCareMap().
+    name, care_map = GetCareMap('system', 'foo')
+    self.assertEqual('system', name)
+    self.assertEqual(RangeSet("0-12").to_string_raw(), care_map)
diff --git a/tools/releasetools/test_apex_utils.py b/tools/releasetools/test_apex_utils.py
index 2f8ee49..7b4a4b0 100644
--- a/tools/releasetools/test_apex_utils.py
+++ b/tools/releasetools/test_apex_utils.py
@@ -14,8 +14,11 @@
 # limitations under the License.
 #
 
+import re
 import os
 import os.path
+import shutil
+import zipfile
 
 import apex_utils
 import common
@@ -31,6 +34,9 @@
     self.testdata_dir = test_utils.get_testdata_dir()
     # The default payload signing key.
     self.payload_key = os.path.join(self.testdata_dir, 'testkey.key')
+    self.apex_with_apk = os.path.join(self.testdata_dir, 'has_apk.apex')
+
+    common.OPTIONS.search_path = test_utils.get_search_path()
 
   @staticmethod
   def _GetTestPayload():
@@ -39,49 +45,145 @@
       payload_fp.write(os.urandom(8192))
     return payload_file
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ParseApexPayloadInfo(self):
     payload_file = self._GetTestPayload()
     apex_utils.SignApexPayload(
-        payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048', self.SALT)
-    payload_info = apex_utils.ParseApexPayloadInfo(payload_file)
+        'avbtool', payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048',
+        self.SALT, 'sha256', no_hashtree=True)
+    payload_info = apex_utils.ParseApexPayloadInfo('avbtool', payload_file)
     self.assertEqual('SHA256_RSA2048', payload_info['Algorithm'])
     self.assertEqual(self.SALT, payload_info['Salt'])
     self.assertEqual('testkey', payload_info['apex.key'])
+    self.assertEqual('sha256', payload_info['Hash Algorithm'])
+    self.assertEqual('0 bytes', payload_info['Tree Size'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_SignApexPayload(self):
     payload_file = self._GetTestPayload()
     apex_utils.SignApexPayload(
-        payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048', self.SALT)
-    apex_utils.VerifyApexPayload(payload_file, self.payload_key)
+        'avbtool', payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048',
+        self.SALT, 'sha256', no_hashtree=True)
+    apex_utils.VerifyApexPayload(
+        'avbtool', payload_file, self.payload_key, True)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_SignApexPayload_withHashtree(self):
+    payload_file = self._GetTestPayload()
+    apex_utils.SignApexPayload(
+        'avbtool', payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048',
+        self.SALT, 'sha256', no_hashtree=False)
+    apex_utils.VerifyApexPayload('avbtool', payload_file, self.payload_key)
+    payload_info = apex_utils.ParseApexPayloadInfo('avbtool', payload_file)
+    self.assertEqual('4096 bytes', payload_info['Tree Size'])
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_SignApexPayload_noHashtree(self):
+    payload_file = self._GetTestPayload()
+    apex_utils.SignApexPayload(
+        'avbtool', payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048',
+        self.SALT, 'sha256', no_hashtree=True)
+    apex_utils.VerifyApexPayload('avbtool', payload_file, self.payload_key,
+                                 no_hashtree=True)
+    payload_info = apex_utils.ParseApexPayloadInfo('avbtool', payload_file)
+    self.assertEqual('0 bytes', payload_info['Tree Size'])
+
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_SignApexPayload_withSignerHelper(self):
     payload_file = self._GetTestPayload()
+    signing_helper = os.path.join(self.testdata_dir, 'signing_helper.sh')
+    os.chmod(signing_helper, 0o700)
     payload_signer_args = '--signing_helper_with_files {}'.format(
-        os.path.join(self.testdata_dir, 'signing_helper.sh'))
+        signing_helper)
     apex_utils.SignApexPayload(
+        'avbtool',
         payload_file,
         self.payload_key,
-        'testkey', 'SHA256_RSA2048', self.SALT,
+        'testkey', 'SHA256_RSA2048', self.SALT, 'sha256',
+        True,
         payload_signer_args)
-    apex_utils.VerifyApexPayload(payload_file, self.payload_key)
+    apex_utils.VerifyApexPayload(
+        'avbtool', payload_file, self.payload_key, True)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_SignApexPayload_invalidKey(self):
     self.assertRaises(
         apex_utils.ApexSigningError,
         apex_utils.SignApexPayload,
+        'avbtool',
         self._GetTestPayload(),
         os.path.join(self.testdata_dir, 'testkey.x509.pem'),
         'testkey',
         'SHA256_RSA2048',
-        self.SALT)
+        self.SALT,
+        'sha256',
+        no_hashtree=True)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_VerifyApexPayload_wrongKey(self):
     payload_file = self._GetTestPayload()
     apex_utils.SignApexPayload(
-        payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048', self.SALT)
-    apex_utils.VerifyApexPayload(payload_file, self.payload_key)
+        'avbtool', payload_file, self.payload_key, 'testkey', 'SHA256_RSA2048',
+        self.SALT, 'sha256', True)
+    apex_utils.VerifyApexPayload(
+        'avbtool', payload_file, self.payload_key, True)
     self.assertRaises(
         apex_utils.ApexSigningError,
         apex_utils.VerifyApexPayload,
+        'avbtool',
         payload_file,
-        os.path.join(self.testdata_dir, 'testkey_with_passwd.key'))
+        os.path.join(self.testdata_dir, 'testkey_with_passwd.key'),
+        no_hashtree=True)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_noApkPresent(self):
+    apex_path = os.path.join(self.testdata_dir, 'foo.apex')
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    processed_apex = signer.ProcessApexFile({}, self.payload_key)
+    self.assertEqual(apex_path, processed_apex)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_apkKeyNotPresent(self):
+    apex_path = common.MakeTempFile(suffix='.apex')
+    shutil.copy(self.apex_with_apk, apex_path)
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    self.assertRaises(apex_utils.ApexSigningError, signer.ProcessApexFile,
+                      {}, self.payload_key)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_signApk(self):
+    apex_path = common.MakeTempFile(suffix='.apex')
+    shutil.copy(self.apex_with_apk, apex_path)
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+
+    self.payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    apex_file = signer.ProcessApexFile(apk_keys, self.payload_key)
+    package_name_extract_cmd = ['aapt', 'dump', 'badging', apex_file]
+    output = common.RunAndCheckOutput(package_name_extract_cmd)
+    for line in output.splitlines():
+      # Sample output from aapt: "package: name='com.google.android.wifi'
+      # versionCode='1' versionName='' platformBuildVersionName='R'
+      # compileSdkVersion='29' compileSdkVersionCodename='R'"
+      match = re.search(r"^package:.* name='([\w|\.]+)'", line, re.IGNORECASE)
+      if match:
+        package_name = match.group(1)
+    self.assertEquals('com.google.android.wifi', package_name)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_noAssetDir(self):
+    no_asset = common.MakeTempFile(suffix='.apex')
+    with zipfile.ZipFile(no_asset, 'w') as output_zip:
+      with zipfile.ZipFile(self.apex_with_apk, 'r') as input_zip:
+        name_list = input_zip.namelist()
+        for name in name_list:
+          if not name.startswith('assets'):
+            output_zip.writestr(name, input_zip.read(name))
+
+    signer = apex_utils.ApexApkSigner(no_asset, None, None)
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+
+    self.payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    signer.ProcessApexFile(apk_keys, self.payload_key)
diff --git a/tools/releasetools/test_blockimgdiff.py b/tools/releasetools/test_blockimgdiff.py
index b6d47d4..0987dcf 100644
--- a/tools/releasetools/test_blockimgdiff.py
+++ b/tools/releasetools/test_blockimgdiff.py
@@ -18,9 +18,8 @@
 from hashlib import sha1
 
 import common
-from blockimgdiff import (
-    BlockImageDiff, DataImage, EmptyImage, FileImage, HeapItem, ImgdiffStats,
-    Transfer)
+from blockimgdiff import BlockImageDiff, HeapItem, ImgdiffStats, Transfer
+from images import DataImage, EmptyImage, FileImage
 from rangelib import RangeSet
 from test_utils import ReleaseToolsTestCase
 
@@ -268,6 +267,7 @@
 
 
 class DataImageTest(ReleaseToolsTestCase):
+
   def test_read_range_set(self):
     data = "file" + ('\0' * 4092)
     image = DataImage(data)
@@ -275,10 +275,11 @@
 
 
 class FileImageTest(ReleaseToolsTestCase):
+
   def setUp(self):
     self.file_path = common.MakeTempFile()
     self.data = os.urandom(4096 * 4)
-    with open(self.file_path, 'w') as f:
+    with open(self.file_path, 'wb') as f:
       f.write(self.data)
     self.file = FileImage(self.file_path)
 
@@ -292,18 +293,18 @@
         expected_data = self.data[s * blocksize : e * blocksize]
 
         rs = RangeSet([s, e])
-        data = "".join(self.file.ReadRangeSet(rs))
+        data = b''.join(self.file.ReadRangeSet(rs))
         self.assertEqual(expected_data, data)
 
         sha1sum = self.file.RangeSha1(rs)
         self.assertEqual(sha1(expected_data).hexdigest(), sha1sum)
 
         tmpfile = common.MakeTempFile()
-        with open(tmpfile, 'w') as f:
+        with open(tmpfile, 'wb') as f:
           self.file.WriteRangeDataToFd(rs, f)
-        with open(tmpfile, 'r') as f:
+        with open(tmpfile, 'rb') as f:
           self.assertEqual(expected_data, f.read())
 
   def test_read_all(self):
-    data = "".join(self.file.ReadRangeSet(self.file.care_map))
+    data = b''.join(self.file.ReadRangeSet(self.file.care_map))
     self.assertEqual(self.data, data)
diff --git a/tools/releasetools/test_build_image.py b/tools/releasetools/test_build_image.py
index 1cebd0c..b24805f 100644
--- a/tools/releasetools/test_build_image.py
+++ b/tools/releasetools/test_build_image.py
@@ -18,12 +18,13 @@
 import os.path
 
 import common
+import test_utils
 from build_image import (
-    BuildImageError, CheckHeadroom, GetFilesystemCharacteristics, SetUpInDirAndFsConfig)
-from test_utils import ReleaseToolsTestCase
+    BuildImageError, CheckHeadroom, GetFilesystemCharacteristics,
+    SetUpInDirAndFsConfig)
 
 
-class BuildImageTest(ReleaseToolsTestCase):
+class BuildImageTest(test_utils.ReleaseToolsTestCase):
 
   # Available: 1000 blocks.
   EXT4FS_OUTPUT = (
@@ -48,6 +49,7 @@
     self.assertRaises(
         BuildImageError, CheckHeadroom, self.EXT4FS_OUTPUT, prop_dict)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_CheckHeadroom_WrongFsType(self):
     prop_dict = {
         'fs_type' : 'f2fs',
@@ -72,6 +74,7 @@
     self.assertRaises(
         AssertionError, CheckHeadroom, self.EXT4FS_OUTPUT, prop_dict)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_CheckHeadroom_WithMke2fsOutput(self):
     """Tests the result parsing from actual call to mke2fs."""
     input_dir = common.MakeTempDir()
@@ -177,13 +180,14 @@
     self.assertIn('fs-config-root\n', fs_config_data)
     self.assertEqual('/', prop_dict['mount_point'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetFilesystemCharacteristics(self):
     input_dir = common.MakeTempDir()
     output_image = common.MakeTempFile(suffix='.img')
     command = ['mkuserimg_mke2fs', input_dir, output_image, 'ext4',
                '/system', '409600', '-j', '0']
     proc = common.Run(command)
-    ext4fs_output, _ = proc.communicate()
+    proc.communicate()
     self.assertEqual(0, proc.returncode)
 
     output_file = common.MakeTempFile(suffix='.img')
diff --git a/tools/releasetools/test_check_partition_sizes.py b/tools/releasetools/test_check_partition_sizes.py
new file mode 100644
index 0000000..ed20873
--- /dev/null
+++ b/tools/releasetools/test_check_partition_sizes.py
@@ -0,0 +1,128 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import common
+import test_utils
+from check_partition_sizes import CheckPartitionSizes
+
+class CheckPartitionSizesTest(test_utils.ReleaseToolsTestCase):
+  def setUp(self):
+    self.info_dict = common.LoadDictionaryFromLines("""
+        use_dynamic_partitions=true
+        ab_update=true
+        super_block_devices=super
+        dynamic_partition_list=system vendor product
+        super_partition_groups=group
+        super_group_partition_list=system vendor product
+        super_partition_size=200
+        super_super_device_size=200
+        super_group_group_size=100
+        system_image_size=50
+        vendor_image_size=20
+        product_image_size=20
+        """.split("\n"))
+
+  def test_ab(self):
+    CheckPartitionSizes(self.info_dict)
+
+  def test_non_ab(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        ab_update=false
+        super_partition_size=100
+        super_super_device_size=100
+        """.split("\n")))
+    CheckPartitionSizes(self.info_dict)
+
+  def test_non_dap(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        use_dynamic_partitions=false
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_retrofit_dap(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        dynamic_partition_retrofit=true
+        super_block_devices=system vendor
+        super_system_device_size=75
+        super_vendor_device_size=25
+        super_partition_size=100
+        """.split("\n")))
+    CheckPartitionSizes(self.info_dict)
+
+  def test_ab_partition_too_big(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        system_image_size=100
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_ab_group_too_big(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        super_group_group_size=110
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_no_image(self):
+    del self.info_dict["system_image_size"]
+    with self.assertRaises(KeyError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_block_devices_not_match(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        dynamic_partition_retrofit=true
+        super_block_devices=system vendor
+        super_system_device_size=80
+        super_vendor_device_size=25
+        super_partition_size=100
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_retrofit_vab(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        virtual_ab_retrofit=true
+        """.split("\n")))
+    CheckPartitionSizes(self.info_dict)
+
+  def test_retrofit_vab_too_big(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        virtual_ab_retrofit=true
+        system_image_size=100
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_vab(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        super_partition_size=100
+        super_super_device_size=100
+        """.split("\n")))
+    CheckPartitionSizes(self.info_dict)
+
+  def test_vab_too_big(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        super_partition_size=100
+        super_super_device_size=100
+        system_image_size=100
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
diff --git a/tools/releasetools/test_check_target_files_vintf.py b/tools/releasetools/test_check_target_files_vintf.py
new file mode 100644
index 0000000..79f9018
--- /dev/null
+++ b/tools/releasetools/test_check_target_files_vintf.py
@@ -0,0 +1,145 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an 'AS IS' BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import os.path
+
+import common
+import test_utils
+from check_target_files_vintf import CheckVintf
+
+# A skeleton target files directory structure. This is VINTF compatible.
+SKELETON_TARGET_FILE_STRUCTURE = {
+    # Empty files
+    'PRODUCT/build.prop': '',
+    'PRODUCT/etc/build.prop': '',
+    'VENDOR/etc/build.prop': '',
+    'ODM/build.prop': '',
+    'ODM/etc/build.prop': '',
+    'RECOVERY/RAMDISK/etc/recovery.fstab': '',
+    'SYSTEM/build.prop': '',
+    'SYSTEM/etc/build.prop': '',
+    'SYSTEM_EXT/build.prop': '',
+    'SYSTEM_EXT/etc/build.prop': '',
+
+    # Non-empty files
+    'SYSTEM/compatibility_matrix.xml':"""
+        <compatibility-matrix version="1.0" type="framework">
+            <sepolicy>
+                <sepolicy-version>0.0</sepolicy-version>
+                <kernel-sepolicy-version>0</kernel-sepolicy-version>
+            </sepolicy>
+        </compatibility-matrix>""",
+    'SYSTEM/manifest.xml':
+        '<manifest version="1.0" type="framework" />',
+    'VENDOR/build.prop': 'ro.product.first_api_level=29\n',
+    'VENDOR/compatibility_matrix.xml':
+        '<compatibility-matrix version="1.0" type="device" />',
+    'VENDOR/manifest.xml':
+        '<manifest version="1.0" type="device"/>',
+    'META/misc_info.txt':
+        'recovery_api_version=3\nfstab_version=2\nvintf_enforce=true\n',
+}
+
+
+def write_string_to_file(content, path, mode='w'):
+  if not os.path.isdir(os.path.dirname(path)):
+    os.makedirs(os.path.dirname(path))
+  with open(path, mode=mode) as f:
+    f.write(content)
+
+
+class CheckTargetFilesVintfTest(test_utils.ReleaseToolsTestCase):
+
+  def setUp(self):
+    self.testdata_dir = test_utils.get_testdata_dir()
+
+  def prepare_test_dir(self, test_delta_rel_path):
+    test_delta_dir = os.path.join(self.testdata_dir, test_delta_rel_path)
+    test_dir = common.MakeTempDir(prefix='check_target_files_vintf')
+
+    # Create a skeleton directory structure of target files
+    for rel_path, content in SKELETON_TARGET_FILE_STRUCTURE.items():
+      write_string_to_file(content, os.path.join(test_dir, rel_path))
+
+    # Overwrite with files from test_delta_rel_path
+    for root, _, files in os.walk(test_delta_dir):
+      rel_root = os.path.relpath(root, test_delta_dir)
+      for f in files:
+        if not f.endswith('.xml'):
+          continue
+        output_file = os.path.join(test_dir, rel_root, f)
+        with open(os.path.join(root, f)) as inp:
+          write_string_to_file(inp.read(), output_file)
+
+    return test_dir
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_sanity(self):
+    msg = 'Sanity check with skeleton target files failed.'
+    test_dir = self.prepare_test_dir('does-not-exist')
+    self.assertTrue(CheckVintf(test_dir), msg=msg)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_matrix_incompat(self):
+    msg = 'vintf/matrix_incompat should be incompatible because sepolicy ' \
+          'version fails to match'
+    test_dir = self.prepare_test_dir('vintf/matrix_incompat')
+    self.assertFalse(CheckVintf(test_dir), msg=msg)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_kernel_compat(self):
+    msg = 'vintf/kernel with 4.14.1 kernel version should be compatible'
+    test_dir = self.prepare_test_dir('vintf/kernel')
+    write_string_to_file('', os.path.join(test_dir, 'META/kernel_configs.txt'))
+    write_string_to_file('4.14.1',
+                         os.path.join(test_dir, 'META/kernel_version.txt'))
+    self.assertTrue(CheckVintf(test_dir), msg=msg)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_kernel_incompat(self):
+    msg = 'vintf/kernel with 4.14.0 kernel version should be incompatible ' \
+          'because 4.14.1 kernel version is required'
+    test_dir = self.prepare_test_dir('vintf/kernel')
+    write_string_to_file('', os.path.join(test_dir, 'META/kernel_configs.txt'))
+    write_string_to_file('4.14.0',
+                         os.path.join(test_dir, 'META/kernel_version.txt'))
+    self.assertFalse(CheckVintf(test_dir), msg=msg)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_sku_compat(self):
+    msg = 'vintf/sku_compat should be compatible because ' \
+          'ODM/etc/vintf/manifest_sku.xml has the required HALs'
+    test_dir = self.prepare_test_dir('vintf/sku_compat')
+    write_string_to_file('vintf_odm_manifest_skus=sku',
+                         os.path.join(test_dir, 'META/misc_info.txt'), mode='a')
+    self.assertTrue(CheckVintf(test_dir), msg=msg)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_sku_incompat(self):
+    msg = 'vintf/sku_compat should be compatible because ' \
+          'ODM/etc/vintf/manifest_sku.xml does not have the required HALs'
+    test_dir = self.prepare_test_dir('vintf/sku_incompat')
+    write_string_to_file('vintf_odm_manifest_skus=sku',
+                         os.path.join(test_dir, 'META/misc_info.txt'), mode='a')
+    self.assertFalse(CheckVintf(test_dir), msg=msg)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_CheckVintf_bad_xml(self):
+    test_dir = self.prepare_test_dir('does-not-exist')
+    write_string_to_file('not an XML',
+                         os.path.join(test_dir, 'VENDOR/manifest.xml'))
+    # Should raise an error because a file has invalid format.
+    self.assertRaises(common.ExternalError, CheckVintf, test_dir)
diff --git a/tools/releasetools/test_common.py b/tools/releasetools/test_common.py
index dce27fe..e4f0812 100644
--- a/tools/releasetools/test_common.py
+++ b/tools/releasetools/test_common.py
@@ -25,9 +25,9 @@
 import common
 import test_utils
 import validate_target_files
+from images import EmptyImage, DataImage
 from rangelib import RangeSet
 
-from blockimgdiff import EmptyImage, DataImage
 
 KiB = 1024
 MiB = 1024 * KiB
@@ -41,7 +41,313 @@
   # Generate a long string with holes, e.g. 'xyz\x00abc\x00...'.
   for _ in range(0, size, step_size):
     yield os.urandom(block_size)
-    yield '\0' * (step_size - block_size)
+    yield b'\0' * (step_size - block_size)
+
+
+class BuildInfoTest(test_utils.ReleaseToolsTestCase):
+
+  TEST_INFO_DICT = {
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.device': 'product-device',
+              'ro.product.name': 'product-name',
+              'ro.build.fingerprint': 'build-fingerprint',
+              'ro.build.foo': 'build-foo'}
+      ),
+      'system.build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.system.brand': 'product-brand',
+              'ro.product.system.name': 'product-name',
+              'ro.product.system.device': 'product-device',
+              'ro.system.build.version.release': 'version-release',
+              'ro.system.build.id': 'build-id',
+              'ro.system.build.version.incremental': 'version-incremental',
+              'ro.system.build.type': 'build-type',
+              'ro.system.build.tags': 'build-tags',
+              'ro.system.build.foo': 'build-foo'}
+      ),
+      'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+          'vendor', {
+              'ro.product.vendor.brand': 'vendor-product-brand',
+              'ro.product.vendor.name': 'vendor-product-name',
+              'ro.product.vendor.device': 'vendor-product-device',
+              'ro.vendor.build.version.release': 'vendor-version-release',
+              'ro.vendor.build.id': 'vendor-build-id',
+              'ro.vendor.build.version.incremental':
+              'vendor-version-incremental',
+              'ro.vendor.build.type': 'vendor-build-type',
+              'ro.vendor.build.tags': 'vendor-build-tags'}
+      ),
+      'property1': 'value1',
+      'property2': 4096,
+  }
+
+  TEST_INFO_DICT_USES_OEM_PROPS = {
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.name': 'product-name',
+              'ro.build.thumbprint': 'build-thumbprint',
+              'ro.build.bar': 'build-bar'}
+      ),
+      'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+          'vendor', {
+              'ro.vendor.build.fingerprint': 'vendor-build-fingerprint'}
+      ),
+      'property1': 'value1',
+      'property2': 4096,
+      'oem_fingerprint_properties': 'ro.product.device ro.product.brand',
+  }
+
+  TEST_OEM_DICTS = [
+      {
+          'ro.product.brand': 'brand1',
+          'ro.product.device': 'device1',
+      },
+      {
+          'ro.product.brand': 'brand2',
+          'ro.product.device': 'device2',
+      },
+      {
+          'ro.product.brand': 'brand3',
+          'ro.product.device': 'device3',
+      },
+  ]
+
+  TEST_INFO_DICT_PROPERTY_SOURCE_ORDER = {
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.build.fingerprint': 'build-fingerprint',
+              'ro.product.property_source_order':
+                  'product,odm,vendor,system_ext,system'}
+      ),
+      'system.build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.system.device': 'system-product-device'}
+      ),
+      'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+          'vendor', {
+              'ro.product.vendor.device': 'vendor-product-device'}
+      ),
+  }
+
+  TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_10 = {
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.build.fingerprint': 'build-fingerprint',
+              'ro.product.property_source_order':
+                  'product,product_services,odm,vendor,system',
+              'ro.build.version.release': '10',
+              'ro.build.version.codename': 'REL'}
+      ),
+      'system.build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.system.device': 'system-product-device'}
+      ),
+      'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+          'vendor', {
+              'ro.product.vendor.device': 'vendor-product-device'}
+      ),
+  }
+
+  TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_9 = {
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.device': 'product-device',
+              'ro.build.fingerprint': 'build-fingerprint',
+              'ro.build.version.release': '9',
+              'ro.build.version.codename': 'REL'}
+      ),
+      'system.build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.system.device': 'system-product-device'}
+      ),
+      'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+          'vendor', {
+              'ro.product.vendor.device': 'vendor-product-device'}
+      ),
+  }
+
+  def test_init(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    self.assertEqual('product-device', target_info.device)
+    self.assertEqual('build-fingerprint', target_info.fingerprint)
+    self.assertFalse(target_info.is_ab)
+    self.assertIsNone(target_info.oem_props)
+
+  def test_init_with_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    self.assertEqual('device1', target_info.device)
+    self.assertEqual('brand1/product-name/device1:build-thumbprint',
+                     target_info.fingerprint)
+
+    # Swap the order in oem_dicts, which would lead to different BuildInfo.
+    oem_dicts = copy.copy(self.TEST_OEM_DICTS)
+    oem_dicts[0], oem_dicts[2] = oem_dicts[2], oem_dicts[0]
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   oem_dicts)
+    self.assertEqual('device3', target_info.device)
+    self.assertEqual('brand3/product-name/device3:build-thumbprint',
+                     target_info.fingerprint)
+
+  def test_init_badFingerprint(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT)
+    info_dict['build.prop'].build_props[
+        'ro.build.fingerprint'] = 'bad fingerprint'
+    self.assertRaises(ValueError, common.BuildInfo, info_dict, None)
+
+    info_dict['build.prop'].build_props[
+        'ro.build.fingerprint'] = 'bad\x80fingerprint'
+    self.assertRaises(ValueError, common.BuildInfo, info_dict, None)
+
+  def test___getitem__(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    self.assertEqual('value1', target_info['property1'])
+    self.assertEqual(4096, target_info['property2'])
+    self.assertEqual('build-foo',
+                     target_info['build.prop'].GetProp('ro.build.foo'))
+
+  def test___getitem__with_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    self.assertEqual('value1', target_info['property1'])
+    self.assertEqual(4096, target_info['property2'])
+    self.assertIsNone(target_info['build.prop'].GetProp('ro.build.foo'))
+
+  def test___setitem__(self):
+    target_info = common.BuildInfo(copy.deepcopy(self.TEST_INFO_DICT), None)
+    self.assertEqual('value1', target_info['property1'])
+    target_info['property1'] = 'value2'
+    self.assertEqual('value2', target_info['property1'])
+
+    self.assertEqual('build-foo',
+                     target_info['build.prop'].GetProp('ro.build.foo'))
+    target_info['build.prop'].build_props['ro.build.foo'] = 'build-bar'
+    self.assertEqual('build-bar',
+                     target_info['build.prop'].GetProp('ro.build.foo'))
+
+  def test_get(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    self.assertEqual('value1', target_info.get('property1'))
+    self.assertEqual(4096, target_info.get('property2'))
+    self.assertEqual(4096, target_info.get('property2', 1024))
+    self.assertEqual(1024, target_info.get('property-nonexistent', 1024))
+    self.assertEqual('build-foo',
+                     target_info.get('build.prop').GetProp('ro.build.foo'))
+
+  def test_get_with_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    self.assertEqual('value1', target_info.get('property1'))
+    self.assertEqual(4096, target_info.get('property2'))
+    self.assertEqual(4096, target_info.get('property2', 1024))
+    self.assertEqual(1024, target_info.get('property-nonexistent', 1024))
+    self.assertIsNone(target_info.get('build.prop').GetProp('ro.build.foo'))
+
+  def test_items(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    items = target_info.items()
+    self.assertIn(('property1', 'value1'), items)
+    self.assertIn(('property2', 4096), items)
+
+  def test_GetBuildProp(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    self.assertEqual('build-foo', target_info.GetBuildProp('ro.build.foo'))
+    self.assertRaises(common.ExternalError, target_info.GetBuildProp,
+                      'ro.build.nonexistent')
+
+  def test_GetBuildProp_with_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    self.assertEqual('build-bar', target_info.GetBuildProp('ro.build.bar'))
+    self.assertRaises(common.ExternalError, target_info.GetBuildProp,
+                      'ro.build.nonexistent')
+
+  def test_GetPartitionFingerprint(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    self.assertEqual(
+        target_info.GetPartitionFingerprint('vendor'),
+        'vendor-product-brand/vendor-product-name/vendor-product-device'
+        ':vendor-version-release/vendor-build-id/vendor-version-incremental'
+        ':vendor-build-type/vendor-build-tags')
+
+  def test_GetPartitionFingerprint_system_other_uses_system(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    self.assertEqual(
+        target_info.GetPartitionFingerprint('system_other'),
+        target_info.GetPartitionFingerprint('system'))
+
+  def test_GetPartitionFingerprint_uses_fingerprint_prop_if_available(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT)
+    info_dict['vendor.build.prop'].build_props[
+        'ro.vendor.build.fingerprint'] = 'vendor:fingerprint'
+    target_info = common.BuildInfo(info_dict, None)
+    self.assertEqual(
+        target_info.GetPartitionFingerprint('vendor'),
+        'vendor:fingerprint')
+
+  def test_WriteMountOemScript(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    script_writer = test_utils.MockScriptWriter()
+    target_info.WriteMountOemScript(script_writer)
+    self.assertEqual([('Mount', '/oem', None)], script_writer.lines)
+
+  def test_WriteDeviceAssertions(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
+    script_writer = test_utils.MockScriptWriter()
+    target_info.WriteDeviceAssertions(script_writer, False)
+    self.assertEqual([('AssertDevice', 'product-device')], script_writer.lines)
+
+  def test_WriteDeviceAssertions_with_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    script_writer = test_utils.MockScriptWriter()
+    target_info.WriteDeviceAssertions(script_writer, False)
+    self.assertEqual(
+        [
+            ('AssertOemProperty', 'ro.product.device',
+             ['device1', 'device2', 'device3'], False),
+            ('AssertOemProperty', 'ro.product.brand',
+             ['brand1', 'brand2', 'brand3'], False),
+        ],
+        script_writer.lines)
+
+  def test_ResolveRoProductProperty_FromVendor(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER)
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('vendor-product-device',
+                     info.GetBuildProp('ro.product.device'))
+
+  def test_ResolveRoProductProperty_FromSystem(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER)
+    del info_dict['vendor.build.prop'].build_props['ro.product.vendor.device']
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('system-product-device',
+                     info.GetBuildProp('ro.product.device'))
+
+  def test_ResolveRoProductProperty_InvalidPropertySearchOrder(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER)
+    info_dict['build.prop'].build_props[
+        'ro.product.property_source_order'] = 'bad-source'
+    with self.assertRaisesRegexp(common.ExternalError,
+        'Invalid ro.product.property_source_order'):
+      info = common.BuildInfo(info_dict, None)
+      info.GetBuildProp('ro.product.device')
+
+  def test_ResolveRoProductProperty_Android10PropertySearchOrder(self):
+    info_dict = copy.deepcopy(
+        self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_10)
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('vendor-product-device',
+                     info.GetBuildProp('ro.product.device'))
+
+  def test_ResolveRoProductProperty_Android9PropertySearchOrder(self):
+    info_dict = copy.deepcopy(
+        self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_9)
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('product-device',
+                     info.GetBuildProp('ro.product.device'))
 
 
 class CommonZipTest(test_utils.ReleaseToolsTestCase):
@@ -72,7 +378,7 @@
     # Verify the zip contents.
     entry = zip_file.open(arcname)
     sha1_hash = sha1()
-    for chunk in iter(lambda: entry.read(4 * MiB), ''):
+    for chunk in iter(lambda: entry.read(4 * MiB), b''):
       sha1_hash.update(chunk)
     self.assertEqual(expected_hash, sha1_hash.hexdigest())
     self.assertIsNone(zip_file.testzip())
@@ -97,8 +403,8 @@
     try:
       sha1_hash = sha1()
       for data in contents:
-        sha1_hash.update(data)
-        test_file.write(data)
+        sha1_hash.update(bytes(data))
+        test_file.write(bytes(data))
       test_file.close()
 
       expected_stat = os.stat(test_file_name)
@@ -136,8 +442,11 @@
         expected_mode = extra_args.get("perms", 0o644)
       else:
         arcname = zinfo_or_arcname.filename
-        expected_mode = extra_args.get("perms",
-                                       zinfo_or_arcname.external_attr >> 16)
+        if zinfo_or_arcname.external_attr:
+          zinfo_perms = zinfo_or_arcname.external_attr >> 16
+        else:
+          zinfo_perms = 0o600
+        expected_mode = extra_args.get("perms", zinfo_perms)
 
       common.ZipWriteStr(zip_file, zinfo_or_arcname, contents, **extra_args)
       common.ZipClose(zip_file)
@@ -262,6 +571,10 @@
         "perms": 0o600,
         "compress_type": zipfile.ZIP_STORED,
     })
+    self._test_ZipWriteStr(zinfo, random_string, {
+        "perms": 0o000,
+        "compress_type": zipfile.ZIP_STORED,
+    })
 
   def test_ZipWriteStr_large_file(self):
     # zipfile.writestr() doesn't work when the str size is over 2GiB even with
@@ -274,9 +587,9 @@
     })
 
   def test_ZipWriteStr_resets_ZIP64_LIMIT(self):
-    self._test_reset_ZIP64_LIMIT(self._test_ZipWriteStr, "foo", "")
+    self._test_reset_ZIP64_LIMIT(self._test_ZipWriteStr, 'foo', b'')
     zinfo = zipfile.ZipInfo(filename="foo")
-    self._test_reset_ZIP64_LIMIT(self._test_ZipWriteStr, zinfo, "")
+    self._test_reset_ZIP64_LIMIT(self._test_ZipWriteStr, zinfo, b'')
 
   def test_bug21309935(self):
     zip_file = tempfile.NamedTemporaryFile(delete=False)
@@ -315,6 +628,7 @@
     finally:
       os.remove(zip_file_name)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ZipDelete(self):
     zip_file = tempfile.NamedTemporaryFile(delete=False, suffix='.zip')
     output_zip = zipfile.ZipFile(zip_file.name, 'w',
@@ -376,6 +690,7 @@
     common.ZipClose(output_zip)
     return zip_file
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_UnzipTemp(self):
     zip_file = self._test_UnzipTemp_createZipFile()
     unzipped_dir = common.UnzipTemp(zip_file)
@@ -385,6 +700,7 @@
     self.assertTrue(os.path.exists(os.path.join(unzipped_dir, 'Bar4')))
     self.assertTrue(os.path.exists(os.path.join(unzipped_dir, 'Dir5/Baz5')))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_UnzipTemp_withPatterns(self):
     zip_file = self._test_UnzipTemp_createZipFile()
 
@@ -425,6 +741,7 @@
     self.assertFalse(os.path.exists(os.path.join(unzipped_dir, 'Bar4')))
     self.assertFalse(os.path.exists(os.path.join(unzipped_dir, 'Dir5/Baz5')))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_UnzipTemp_withPartiallyMatchingPatterns(self):
     zip_file = self._test_UnzipTemp_createZipFile()
     unzipped_dir = common.UnzipTemp(zip_file, ['Test*', 'Nonexistent*'])
@@ -451,14 +768,14 @@
       'name="RecoveryLocalizer.apk" certificate="certs/devkey.x509.pem"'
       ' private_key="certs/devkey.pk8"\n'
       'name="Settings.apk"'
-      ' certificate="build/target/product/security/platform.x509.pem"'
-      ' private_key="build/target/product/security/platform.pk8"\n'
+      ' certificate="build/make/target/product/security/platform.x509.pem"'
+      ' private_key="build/make/target/product/security/platform.pk8"\n'
       'name="TV.apk" certificate="PRESIGNED" private_key=""\n'
   )
 
   APKCERTS_CERTMAP1 = {
       'RecoveryLocalizer.apk' : 'certs/devkey',
-      'Settings.apk' : 'build/target/product/security/platform',
+      'Settings.apk' : 'build/make/target/product/security/platform',
       'TV.apk' : 'PRESIGNED',
   }
 
@@ -489,6 +806,25 @@
       'Compressed4.apk' : 'certs/compressed4',
   }
 
+  # Test parsing with no optional fields, both optional fields, and only the
+  # partition optional field.
+  APKCERTS_TXT4 = (
+      'name="RecoveryLocalizer.apk" certificate="certs/devkey.x509.pem"'
+      ' private_key="certs/devkey.pk8"\n'
+      'name="Settings.apk"'
+      ' certificate="build/make/target/product/security/platform.x509.pem"'
+      ' private_key="build/make/target/product/security/platform.pk8"'
+      ' compressed="gz" partition="system"\n'
+      'name="TV.apk" certificate="PRESIGNED" private_key=""'
+      ' partition="product"\n'
+  )
+
+  APKCERTS_CERTMAP4 = {
+      'RecoveryLocalizer.apk' : 'certs/devkey',
+      'Settings.apk' : 'build/make/target/product/security/platform',
+      'TV.apk' : 'PRESIGNED',
+  }
+
   def setUp(self):
     self.testdata_dir = test_utils.get_testdata_dir()
 
@@ -565,28 +901,40 @@
     with zipfile.ZipFile(target_files, 'r') as input_zip:
       self.assertRaises(ValueError, common.ReadApkCerts, input_zip)
 
+  def test_ReadApkCerts_WithWithoutOptionalFields(self):
+    target_files = self._write_apkcerts_txt(self.APKCERTS_TXT4)
+    with zipfile.ZipFile(target_files, 'r') as input_zip:
+      certmap, ext = common.ReadApkCerts(input_zip)
+
+    self.assertDictEqual(self.APKCERTS_CERTMAP4, certmap)
+    self.assertIsNone(ext)
+
   def test_ExtractPublicKey(self):
     cert = os.path.join(self.testdata_dir, 'testkey.x509.pem')
     pubkey = os.path.join(self.testdata_dir, 'testkey.pubkey.pem')
-    with open(pubkey, 'rb') as pubkey_fp:
+    with open(pubkey) as pubkey_fp:
       self.assertEqual(pubkey_fp.read(), common.ExtractPublicKey(cert))
 
   def test_ExtractPublicKey_invalidInput(self):
     wrong_input = os.path.join(self.testdata_dir, 'testkey.pk8')
     self.assertRaises(AssertionError, common.ExtractPublicKey, wrong_input)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ExtractAvbPublicKey(self):
     privkey = os.path.join(self.testdata_dir, 'testkey.key')
     pubkey = os.path.join(self.testdata_dir, 'testkey.pubkey.pem')
-    with open(common.ExtractAvbPublicKey(privkey)) as privkey_fp, \
-        open(common.ExtractAvbPublicKey(pubkey)) as pubkey_fp:
+    extracted_from_privkey = common.ExtractAvbPublicKey('avbtool', privkey)
+    extracted_from_pubkey = common.ExtractAvbPublicKey('avbtool', pubkey)
+    with open(extracted_from_privkey, 'rb') as privkey_fp, \
+        open(extracted_from_pubkey, 'rb') as pubkey_fp:
       self.assertEqual(privkey_fp.read(), pubkey_fp.read())
 
   def test_ParseCertificate(self):
     cert = os.path.join(self.testdata_dir, 'testkey.x509.pem')
 
     cmd = ['openssl', 'x509', '-in', cert, '-outform', 'DER']
-    proc = common.Run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    proc = common.Run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                      universal_newlines=False)
     expected, _ = proc.communicate()
     self.assertEqual(0, proc.returncode)
 
@@ -594,18 +942,22 @@
       actual = common.ParseCertificate(cert_fp.read())
     self.assertEqual(expected, actual)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetMinSdkVersion(self):
     test_app = os.path.join(self.testdata_dir, 'TestApp.apk')
     self.assertEqual('24', common.GetMinSdkVersion(test_app))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetMinSdkVersion_invalidInput(self):
     self.assertRaises(
         common.ExternalError, common.GetMinSdkVersion, 'does-not-exist.apk')
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetMinSdkVersionInt(self):
     test_app = os.path.join(self.testdata_dir, 'TestApp.apk')
     self.assertEqual(24, common.GetMinSdkVersionInt(test_app, {}))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetMinSdkVersionInt_invalidInput(self):
     self.assertRaises(
         common.ExternalError, common.GetMinSdkVersionInt, 'does-not-exist.apk',
@@ -617,6 +969,7 @@
   def setUp(self):
     self.testdata_dir = test_utils.get_testdata_dir()
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_emptyBlockMapFile(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
@@ -649,6 +1002,7 @@
         AssertionError, common.GetSparseImage, 'unknown', self.testdata_dir,
         None, False)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_missingBlockMapFile(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
@@ -667,6 +1021,7 @@
           AssertionError, common.GetSparseImage, 'system', tempdir, input_zip,
           False)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_sharedBlocks_notAllowed(self):
     """Tests the case of having overlapping blocks but disallowed."""
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
@@ -689,6 +1044,7 @@
           AssertionError, common.GetSparseImage, 'system', tempdir, input_zip,
           False)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_sharedBlocks_allowed(self):
     """Tests the case for target using BOARD_EXT4_SHARE_DUP_BLOCKS := true."""
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
@@ -726,11 +1082,14 @@
     self.assertNotIn(
         'incomplete', sparse_image.file_map['/system/file2'].extra)
 
-    # All other entries should look normal without any tags.
+    # '/system/file1' will only contain one field -- a copy of the input text.
+    self.assertEqual(1, len(sparse_image.file_map['/system/file1'].extra))
+
+    # Meta entries should not have any extra tag.
     self.assertFalse(sparse_image.file_map['__COPY'].extra)
     self.assertFalse(sparse_image.file_map['__NONZERO-0'].extra)
-    self.assertFalse(sparse_image.file_map['/system/file1'].extra)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_incompleteRanges(self):
     """Tests the case of ext4 images with holes."""
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
@@ -751,9 +1110,12 @@
     with zipfile.ZipFile(target_files, 'r') as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
-    self.assertFalse(sparse_image.file_map['/system/file1'].extra)
+    self.assertEqual(
+        '1-5 9-10',
+        sparse_image.file_map['/system/file1'].extra['text_str'])
     self.assertTrue(sparse_image.file_map['/system/file2'].extra['incomplete'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_systemRootImage_filenameWithExtraLeadingSlash(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
@@ -776,11 +1138,14 @@
     with zipfile.ZipFile(target_files, 'r') as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
-    self.assertFalse(sparse_image.file_map['//system/file1'].extra)
+    self.assertEqual(
+        '1-5 9-10',
+        sparse_image.file_map['//system/file1'].extra['text_str'])
     self.assertTrue(sparse_image.file_map['//system/file2'].extra['incomplete'])
     self.assertTrue(
         sparse_image.file_map['/system/app/file3'].extra['incomplete'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_systemRootImage_nonSystemFiles(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
@@ -800,9 +1165,12 @@
     with zipfile.ZipFile(target_files, 'r') as input_zip:
       sparse_image = common.GetSparseImage('system', tempdir, input_zip, False)
 
-    self.assertFalse(sparse_image.file_map['//system/file1'].extra)
+    self.assertEqual(
+        '1-5 9-10',
+        sparse_image.file_map['//system/file1'].extra['text_str'])
     self.assertTrue(sparse_image.file_map['//init.rc'].extra['incomplete'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetSparseImage_fileNotFound(self):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
@@ -822,6 +1190,7 @@
           AssertionError, common.GetSparseImage, 'system', tempdir, input_zip,
           False)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetAvbChainedPartitionArg(self):
     pubkey = os.path.join(self.testdata_dir, 'testkey.pubkey.pem')
     info_dict = {
@@ -835,6 +1204,7 @@
     self.assertEqual('2', args[1])
     self.assertTrue(os.path.exists(args[2]))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetAvbChainedPartitionArg_withPrivateKey(self):
     key = os.path.join(self.testdata_dir, 'testkey.key')
     info_dict = {
@@ -848,6 +1218,7 @@
     self.assertEqual('2', args[1])
     self.assertTrue(os.path.exists(args[2]))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetAvbChainedPartitionArg_withSpecifiedKey(self):
     info_dict = {
         'avb_avbtool': 'avbtool',
@@ -862,6 +1233,7 @@
     self.assertEqual('2', args[1])
     self.assertTrue(os.path.exists(args[2]))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetAvbChainedPartitionArg_invalidKey(self):
     pubkey = os.path.join(self.testdata_dir, 'testkey_with_passwd.x509.pem')
     info_dict = {
@@ -881,12 +1253,29 @@
       'recovery_as_boot': 'true',
   }
 
+  def test_LoadListFromFile(self):
+    file_path = os.path.join(self.testdata_dir,
+                             'merge_config_framework_item_list')
+    contents = common.LoadListFromFile(file_path)
+    expected_contents = [
+        'META/apkcerts.txt',
+        'META/filesystem_config.txt',
+        'META/root_filesystem_config.txt',
+        'META/system_manifest.xml',
+        'META/system_matrix.xml',
+        'META/update_engine_config.txt',
+        'PRODUCT/*',
+        'ROOT/*',
+        'SYSTEM/*',
+    ]
+    self.assertEqual(sorted(contents), sorted(expected_contents))
+
   @staticmethod
   def _test_LoadInfoDict_createTargetFiles(info_dict, fstab_path):
     target_files = common.MakeTempFile(prefix='target_files-', suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
       info_values = ''.join(
-          ['{}={}\n'.format(k, v) for k, v in sorted(info_dict.iteritems())])
+          ['{}={}\n'.format(k, v) for k, v in sorted(info_dict.items())])
       common.ZipWriteStr(target_files_zip, 'META/misc_info.txt', info_values)
 
       FSTAB_TEMPLATE = "/dev/block/system {} ext4 ro,barrier=1 defaults"
@@ -922,6 +1311,7 @@
       self.assertIn('/', loaded_dict['fstab'])
       self.assertIn('/system', loaded_dict['fstab'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_LoadInfoDict_dirInput(self):
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
@@ -933,6 +1323,7 @@
     self.assertIn('/', loaded_dict['fstab'])
     self.assertIn('/system', loaded_dict['fstab'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_LoadInfoDict_dirInput_legacyRecoveryFstabPath(self):
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
@@ -990,6 +1381,7 @@
       self.assertEqual(2, loaded_dict['fstab_version'])
       self.assertIsNone(loaded_dict['fstab'])
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_LoadInfoDict_missingMetaMiscInfoTxt(self):
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
@@ -998,6 +1390,7 @@
     with zipfile.ZipFile(target_files, 'r') as target_files_zip:
       self.assertRaises(ValueError, common.LoadInfoDict, target_files_zip)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_LoadInfoDict_repacking(self):
     target_files = self._test_LoadInfoDict_createTargetFiles(
         self.INFO_DICT_DEFAULT,
@@ -1022,6 +1415,118 @@
       self.assertRaises(
           AssertionError, common.LoadInfoDict, target_files_zip, True)
 
+  def test_MergeDynamicPartitionInfoDicts_ReturnsMergedDict(self):
+    framework_dict = {
+        'super_partition_groups': 'group_a',
+        'dynamic_partition_list': 'system',
+        'super_group_a_partition_list': 'system',
+    }
+    vendor_dict = {
+        'super_partition_groups': 'group_a group_b',
+        'dynamic_partition_list': 'vendor product',
+        'super_group_a_partition_list': 'vendor',
+        'super_group_a_group_size': '1000',
+        'super_group_b_partition_list': 'product',
+        'super_group_b_group_size': '2000',
+    }
+    merged_dict = common.MergeDynamicPartitionInfoDicts(
+        framework_dict=framework_dict,
+        vendor_dict=vendor_dict)
+    expected_merged_dict = {
+        'super_partition_groups': 'group_a group_b',
+        'dynamic_partition_list': 'system vendor product',
+        'super_group_a_partition_list': 'system vendor',
+        'super_group_a_group_size': '1000',
+        'super_group_b_partition_list': 'product',
+        'super_group_b_group_size': '2000',
+    }
+    self.assertEqual(merged_dict, expected_merged_dict)
+
+  def test_MergeDynamicPartitionInfoDicts_IgnoringFrameworkGroupSize(self):
+    framework_dict = {
+        'super_partition_groups': 'group_a',
+        'dynamic_partition_list': 'system',
+        'super_group_a_partition_list': 'system',
+        'super_group_a_group_size': '5000',
+    }
+    vendor_dict = {
+        'super_partition_groups': 'group_a group_b',
+        'dynamic_partition_list': 'vendor product',
+        'super_group_a_partition_list': 'vendor',
+        'super_group_a_group_size': '1000',
+        'super_group_b_partition_list': 'product',
+        'super_group_b_group_size': '2000',
+    }
+    merged_dict = common.MergeDynamicPartitionInfoDicts(
+        framework_dict=framework_dict,
+        vendor_dict=vendor_dict)
+    expected_merged_dict = {
+        'super_partition_groups': 'group_a group_b',
+        'dynamic_partition_list': 'system vendor product',
+        'super_group_a_partition_list': 'system vendor',
+        'super_group_a_group_size': '1000',
+        'super_group_b_partition_list': 'product',
+        'super_group_b_group_size': '2000',
+    }
+    self.assertEqual(merged_dict, expected_merged_dict)
+
+  def test_GetAvbPartitionArg(self):
+    info_dict = {}
+    cmd = common.GetAvbPartitionArg('system', '/path/to/system.img', info_dict)
+    self.assertEqual(
+        ['--include_descriptors_from_image', '/path/to/system.img'], cmd)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_AppendVBMetaArgsForPartition_vendorAsChainedPartition(self):
+    testdata_dir = test_utils.get_testdata_dir()
+    pubkey = os.path.join(testdata_dir, 'testkey.pubkey.pem')
+    info_dict = {
+        'avb_avbtool': 'avbtool',
+        'avb_vendor_key_path': pubkey,
+        'avb_vendor_rollback_index_location': 5,
+    }
+    cmd = common.GetAvbPartitionArg('vendor', '/path/to/vendor.img', info_dict)
+    self.assertEqual(2, len(cmd))
+    self.assertEqual('--chain_partition', cmd[0])
+    chained_partition_args = cmd[1].split(':')
+    self.assertEqual(3, len(chained_partition_args))
+    self.assertEqual('vendor', chained_partition_args[0])
+    self.assertEqual('5', chained_partition_args[1])
+    self.assertTrue(os.path.exists(chained_partition_args[2]))
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_AppendVBMetaArgsForPartition_recoveryAsChainedPartition_nonAb(self):
+    testdata_dir = test_utils.get_testdata_dir()
+    pubkey = os.path.join(testdata_dir, 'testkey.pubkey.pem')
+    info_dict = {
+        'avb_avbtool': 'avbtool',
+        'avb_recovery_key_path': pubkey,
+        'avb_recovery_rollback_index_location': 3,
+    }
+    cmd = common.GetAvbPartitionArg(
+        'recovery', '/path/to/recovery.img', info_dict)
+    self.assertFalse(cmd)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_AppendVBMetaArgsForPartition_recoveryAsChainedPartition_ab(self):
+    testdata_dir = test_utils.get_testdata_dir()
+    pubkey = os.path.join(testdata_dir, 'testkey.pubkey.pem')
+    info_dict = {
+        'ab_update': 'true',
+        'avb_avbtool': 'avbtool',
+        'avb_recovery_key_path': pubkey,
+        'avb_recovery_rollback_index_location': 3,
+    }
+    cmd = common.GetAvbPartitionArg(
+        'recovery', '/path/to/recovery.img', info_dict)
+    self.assertEqual(2, len(cmd))
+    self.assertEqual('--chain_partition', cmd[0])
+    chained_partition_args = cmd[1].split(':')
+    self.assertEqual(3, len(chained_partition_args))
+    self.assertEqual('recovery', chained_partition_args[0])
+    self.assertEqual('3', chained_partition_args[1])
+    self.assertTrue(os.path.exists(chained_partition_args[2]))
+
 
 class InstallRecoveryScriptFormatTest(test_utils.ReleaseToolsTestCase):
   """Checks the format of install-recovery.sh.
@@ -1053,7 +1558,7 @@
     loc = os.path.join(self._tempdir, prefix, name)
     if not os.path.exists(os.path.dirname(loc)):
       os.makedirs(os.path.dirname(loc))
-    with open(loc, "w+") as f:
+    with open(loc, "wb") as f:
       f.write(data)
 
   def test_full_recovery(self):
@@ -1066,6 +1571,7 @@
     validate_target_files.ValidateInstallRecoveryScript(self._tempdir,
                                                         self._info)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_recovery_from_boot(self):
     recovery_image = common.File("recovery.img", self.recovery_data)
     self._out_tmp_sink("recovery.img", recovery_image.data, "IMAGES")
@@ -1077,33 +1583,20 @@
     validate_target_files.ValidateInstallRecoveryScript(self._tempdir,
                                                         self._info)
     # Validate 'recovery-from-boot' with bonus argument.
-    self._out_tmp_sink("etc/recovery-resource.dat", "bonus", "SYSTEM")
+    self._out_tmp_sink("etc/recovery-resource.dat", b"bonus", "SYSTEM")
     common.MakeRecoveryPatch(self._tempdir, self._out_tmp_sink,
                              recovery_image, boot_image, self._info)
     validate_target_files.ValidateInstallRecoveryScript(self._tempdir,
                                                         self._info)
 
 
-class MockScriptWriter(object):
-  """A class that mocks edify_generator.EdifyGenerator.
-  """
-  def __init__(self, enable_comments=False):
-    self.lines = []
-    self.enable_comments = enable_comments
-  def Comment(self, comment):
-    if self.enable_comments:
-      self.lines.append("# {}".format(comment))
-  def AppendExtra(self, extra):
-    self.lines.append(extra)
-  def __str__(self):
-    return "\n".join(self.lines)
-
-
 class MockBlockDifference(object):
+
   def __init__(self, partition, tgt, src=None):
     self.partition = partition
     self.tgt = tgt
     self.src = src
+
   def WriteScript(self, script, _, progress=None,
                   write_verify_script=False):
     if progress:
@@ -1111,11 +1604,13 @@
     script.AppendExtra("patch({});".format(self.partition))
     if write_verify_script:
       self.WritePostInstallVerifyScript(script)
+
   def WritePostInstallVerifyScript(self, script):
     script.AppendExtra("verify({});".format(self.partition))
 
 
 class FakeSparseImage(object):
+
   def __init__(self, size):
     self.blocksize = 4096
     self.total_blocks = size // 4096
@@ -1123,15 +1618,16 @@
 
 
 class DynamicPartitionsDifferenceTest(test_utils.ReleaseToolsTestCase):
+
   @staticmethod
   def get_op_list(output_path):
-    with zipfile.ZipFile(output_path, 'r') as output_zip:
-      with output_zip.open("dynamic_partitions_op_list") as op_list:
-        return [line.strip() for line in op_list.readlines()
-                if not line.startswith("#")]
+    with zipfile.ZipFile(output_path) as output_zip:
+      with output_zip.open('dynamic_partitions_op_list') as op_list:
+        return [line.decode().strip() for line in op_list.readlines()
+                if not line.startswith(b'#')]
 
   def setUp(self):
-    self.script = MockScriptWriter()
+    self.script = test_utils.MockScriptWriter()
     self.output_path = common.MakeTempFile(suffix='.zip')
 
   def test_full(self):
@@ -1150,12 +1646,12 @@
 
     self.assertEqual(str(self.script).strip(), """
 assert(update_dynamic_partitions(package_extract_file("dynamic_partitions_op_list")));
-patch(vendor);
-verify(vendor);
-unmap_partition("vendor");
 patch(system);
 verify(system);
 unmap_partition("system");
+patch(vendor);
+verify(vendor);
+unmap_partition("vendor");
 """.strip())
 
     lines = self.get_op_list(self.output_path)
@@ -1203,16 +1699,17 @@
     grown = lines.index("resize_group group_baz 4294967296")
     added = lines.index("add_group group_qux 1073741824")
 
-    self.assertLess(max(removed, shrunk) < min(grown, added),
+    self.assertLess(max(removed, shrunk),
+                    min(grown, added),
                     "ops that remove / shrink partitions must precede ops that "
                     "grow / add partitions")
 
   def test_incremental(self):
     source_info = common.LoadDictionaryFromLines("""
-dynamic_partition_list=system vendor product product_services
+dynamic_partition_list=system vendor product system_ext
 super_partition_groups=group_foo
 super_group_foo_group_size={group_foo_size}
-super_group_foo_partition_list=system vendor product product_services
+super_group_foo_partition_list=system vendor product system_ext
 """.format(group_foo_size=4 * GiB).split("\n"))
     target_info = common.LoadDictionaryFromLines("""
 dynamic_partition_list=system vendor product odm
@@ -1229,7 +1726,7 @@
                                        src=FakeSparseImage(1024 * MiB)),
                    MockBlockDifference("product", FakeSparseImage(1024 * MiB),
                                        src=FakeSparseImage(1024 * MiB)),
-                   MockBlockDifference("product_services", None,
+                   MockBlockDifference("system_ext", None,
                                        src=FakeSparseImage(1024 * MiB)),
                    MockBlockDifference("odm", FakeSparseImage(1024 * MiB),
                                        src=None)]
@@ -1252,11 +1749,11 @@
       self.assertLess(patch_idx, verify_idx,
                       "Should verify {} after patching".format(p))
 
-    self.assertNotIn("patch(product_services);", self.script.lines)
+    self.assertNotIn("patch(system_ext);", self.script.lines)
 
     lines = self.get_op_list(self.output_path)
 
-    remove = lines.index("remove product_services")
+    remove = lines.index("remove system_ext")
     move_product_out = lines.index("move product default")
     shrink = lines.index("resize vendor 536870912")
     shrink_group = lines.index("resize_group group_foo 3221225472")
@@ -1315,3 +1812,241 @@
 
     lines = self.get_op_list(self.output_path)
     self.assertEqual(lines, ["remove foo"])
+
+
+class PartitionBuildPropsTest(test_utils.ReleaseToolsTestCase):
+  def setUp(self):
+    self.odm_build_prop = [
+        'ro.odm.build.date.utc=1578430045',
+        'ro.odm.build.fingerprint='
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device=coral',
+        'import /odm/etc/build_${ro.boot.product.device_name}.prop',
+    ]
+
+  @staticmethod
+  def _BuildZipFile(entries):
+    input_file = common.MakeTempFile(prefix='target_files-', suffix='.zip')
+    with zipfile.ZipFile(input_file, 'w') as input_zip:
+      for name, content in entries.items():
+        input_zip.writestr(name, content)
+
+    return input_file
+
+  def test_parseBuildProps_noImportStatement(self):
+    build_prop = [
+        'ro.odm.build.date.utc=1578430045',
+        'ro.odm.build.fingerprint='
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device=coral',
+    ]
+    input_file = self._BuildZipFile({
+        'ODM/etc/build.prop': '\n'.join(build_prop),
+    })
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': ['std', 'pro']
+      }
+      partition_props = common.PartitionBuildProps.FromInputFile(
+          input_zip, 'odm', placeholder_values)
+
+    self.assertEqual({
+        'ro.odm.build.date.utc': '1578430045',
+        'ro.odm.build.fingerprint':
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device': 'coral',
+    }, partition_props.build_props)
+
+    self.assertEqual(set(), partition_props.prop_overrides)
+
+  def test_parseBuildProps_singleImportStatement(self):
+    build_std_prop = [
+        'ro.product.odm.device=coral',
+        'ro.product.odm.name=product1',
+    ]
+    build_pro_prop = [
+        'ro.product.odm.device=coralpro',
+        'ro.product.odm.name=product2',
+    ]
+
+    input_file = self._BuildZipFile({
+        'ODM/etc/build.prop': '\n'.join(self.odm_build_prop),
+        'ODM/etc/build_std.prop': '\n'.join(build_std_prop),
+        'ODM/etc/build_pro.prop': '\n'.join(build_pro_prop),
+    })
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': 'std'
+      }
+      partition_props = common.PartitionBuildProps.FromInputFile(
+          input_zip, 'odm', placeholder_values)
+
+    self.assertEqual({
+      'ro.odm.build.date.utc': '1578430045',
+      'ro.odm.build.fingerprint':
+      'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+      'ro.product.odm.device': 'coral',
+      'ro.product.odm.name': 'product1',
+    }, partition_props.build_props)
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': 'pro'
+      }
+      partition_props = common.PartitionBuildProps.FromInputFile(
+          input_zip, 'odm', placeholder_values)
+
+    self.assertEqual({
+        'ro.odm.build.date.utc': '1578430045',
+        'ro.odm.build.fingerprint':
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device': 'coralpro',
+        'ro.product.odm.name': 'product2',
+    }, partition_props.build_props)
+
+  def test_parseBuildProps_noPlaceHolders(self):
+    build_prop = copy.copy(self.odm_build_prop)
+    input_file = self._BuildZipFile({
+        'ODM/etc/build.prop': '\n'.join(build_prop),
+    })
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      partition_props = common.PartitionBuildProps.FromInputFile(
+          input_zip, 'odm')
+
+    self.assertEqual({
+        'ro.odm.build.date.utc': '1578430045',
+        'ro.odm.build.fingerprint':
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device': 'coral',
+    }, partition_props.build_props)
+
+    self.assertEqual(set(), partition_props.prop_overrides)
+
+  def test_parseBuildProps_multipleImportStatements(self):
+    build_prop = copy.deepcopy(self.odm_build_prop)
+    build_prop.append(
+        'import /odm/etc/build_${ro.boot.product.product_name}.prop')
+
+    build_std_prop = [
+        'ro.product.odm.device=coral',
+    ]
+    build_pro_prop = [
+        'ro.product.odm.device=coralpro',
+    ]
+
+    product1_prop = [
+        'ro.product.odm.name=product1',
+        'ro.product.not_care=not_care',
+    ]
+
+    product2_prop = [
+        'ro.product.odm.name=product2',
+        'ro.product.not_care=not_care',
+    ]
+
+    input_file = self._BuildZipFile({
+        'ODM/etc/build.prop': '\n'.join(build_prop),
+        'ODM/etc/build_std.prop': '\n'.join(build_std_prop),
+        'ODM/etc/build_pro.prop': '\n'.join(build_pro_prop),
+        'ODM/etc/build_product1.prop': '\n'.join(product1_prop),
+        'ODM/etc/build_product2.prop': '\n'.join(product2_prop),
+    })
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': 'std',
+          'ro.boot.product.product_name': 'product1',
+          'ro.boot.product.not_care': 'not_care',
+      }
+      partition_props = common.PartitionBuildProps.FromInputFile(
+          input_zip, 'odm', placeholder_values)
+
+    self.assertEqual({
+        'ro.odm.build.date.utc': '1578430045',
+        'ro.odm.build.fingerprint':
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device': 'coral',
+        'ro.product.odm.name': 'product1'
+    }, partition_props.build_props)
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': 'pro',
+          'ro.boot.product.product_name': 'product2',
+          'ro.boot.product.not_care': 'not_care',
+      }
+      partition_props = common.PartitionBuildProps.FromInputFile(
+          input_zip, 'odm', placeholder_values)
+
+    self.assertEqual({
+        'ro.odm.build.date.utc': '1578430045',
+        'ro.odm.build.fingerprint':
+        'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
+        'ro.product.odm.device': 'coralpro',
+        'ro.product.odm.name': 'product2'
+    }, partition_props.build_props)
+
+  def test_parseBuildProps_defineAfterOverride(self):
+    build_prop = copy.deepcopy(self.odm_build_prop)
+    build_prop.append('ro.product.odm.device=coral')
+
+    build_std_prop = [
+        'ro.product.odm.device=coral',
+    ]
+    build_pro_prop = [
+        'ro.product.odm.device=coralpro',
+    ]
+
+    input_file = self._BuildZipFile({
+        'ODM/etc/build.prop': '\n'.join(build_prop),
+        'ODM/etc/build_std.prop': '\n'.join(build_std_prop),
+        'ODM/etc/build_pro.prop': '\n'.join(build_pro_prop),
+    })
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': 'std',
+      }
+
+      self.assertRaises(ValueError, common.PartitionBuildProps.FromInputFile,
+                        input_zip, 'odm', placeholder_values)
+
+  def test_parseBuildProps_duplicateOverride(self):
+    build_prop = copy.deepcopy(self.odm_build_prop)
+    build_prop.append(
+        'import /odm/etc/build_${ro.boot.product.product_name}.prop')
+
+    build_std_prop = [
+        'ro.product.odm.device=coral',
+        'ro.product.odm.name=product1',
+    ]
+    build_pro_prop = [
+        'ro.product.odm.device=coralpro',
+    ]
+
+    product1_prop = [
+        'ro.product.odm.name=product1',
+    ]
+
+    product2_prop = [
+        'ro.product.odm.name=product2',
+    ]
+
+    input_file = self._BuildZipFile({
+        'ODM/etc/build.prop': '\n'.join(build_prop),
+        'ODM/etc/build_std.prop': '\n'.join(build_std_prop),
+        'ODM/etc/build_pro.prop': '\n'.join(build_pro_prop),
+        'ODM/etc/build_product1.prop': '\n'.join(product1_prop),
+        'ODM/etc/build_product2.prop': '\n'.join(product2_prop),
+    })
+
+    with zipfile.ZipFile(input_file, 'r') as input_zip:
+      placeholder_values = {
+          'ro.boot.product.device_name': 'std',
+          'ro.boot.product.product_name': 'product1',
+      }
+      self.assertRaises(ValueError, common.PartitionBuildProps.FromInputFile,
+                        input_zip, 'odm', placeholder_values)
diff --git a/tools/releasetools/test_merge_target_files.py b/tools/releasetools/test_merge_target_files.py
index bb9ce8e..ff8593b 100644
--- a/tools/releasetools/test_merge_target_files.py
+++ b/tools/releasetools/test_merge_target_files.py
@@ -18,9 +18,12 @@
 
 import common
 import test_utils
-from merge_target_files import (
-    read_config_list, validate_config_lists, default_system_item_list,
-    default_other_item_list, default_system_misc_info_keys)
+from merge_target_files import (validate_config_lists,
+                                DEFAULT_FRAMEWORK_ITEM_LIST,
+                                DEFAULT_VENDOR_ITEM_LIST,
+                                DEFAULT_FRAMEWORK_MISC_INFO_KEYS, copy_items,
+                                item_list_to_partition_set,
+                                process_apex_keys_apk_certs_common)
 
 
 class MergeTargetFilesTest(test_utils.ReleaseToolsTestCase):
@@ -28,50 +31,201 @@
   def setUp(self):
     self.testdata_dir = test_utils.get_testdata_dir()
 
-  def test_read_config_list(self):
-    system_item_list_file = os.path.join(self.testdata_dir,
-                                         'merge_config_system_item_list')
-    system_item_list = read_config_list(system_item_list_file)
-    expected_system_item_list = [
-        'META/apkcerts.txt',
-        'META/filesystem_config.txt',
-        'META/root_filesystem_config.txt',
-        'META/system_manifest.xml',
-        'META/system_matrix.xml',
-        'META/update_engine_config.txt',
-        'PRODUCT/*',
-        'ROOT/*',
-        'SYSTEM/*',
-    ]
-    self.assertItemsEqual(system_item_list, expected_system_item_list)
+  def test_copy_items_CopiesItemsMatchingPatterns(self):
+
+    def createEmptyFile(path):
+      if not os.path.exists(os.path.dirname(path)):
+        os.makedirs(os.path.dirname(path))
+      open(path, 'a').close()
+      return path
+
+    def createSymLink(source, dest):
+      os.symlink(source, dest)
+      return dest
+
+    def getRelPaths(start, filepaths):
+      return set(
+          os.path.relpath(path=filepath, start=start) for filepath in filepaths)
+
+    input_dir = common.MakeTempDir()
+    output_dir = common.MakeTempDir()
+    expected_copied_items = []
+    actual_copied_items = []
+    patterns = ['*.cpp', 'subdir/*.txt']
+
+    # Create various files that we expect to get copied because they
+    # match one of the patterns.
+    expected_copied_items.extend([
+        createEmptyFile(os.path.join(input_dir, 'a.cpp')),
+        createEmptyFile(os.path.join(input_dir, 'b.cpp')),
+        createEmptyFile(os.path.join(input_dir, 'subdir', 'c.txt')),
+        createEmptyFile(os.path.join(input_dir, 'subdir', 'd.txt')),
+        createEmptyFile(
+            os.path.join(input_dir, 'subdir', 'subsubdir', 'e.txt')),
+        createSymLink('a.cpp', os.path.join(input_dir, 'a_link.cpp')),
+    ])
+    # Create some more files that we expect to not get copied.
+    createEmptyFile(os.path.join(input_dir, 'a.h'))
+    createEmptyFile(os.path.join(input_dir, 'b.h'))
+    createEmptyFile(os.path.join(input_dir, 'subdir', 'subsubdir', 'f.gif'))
+    createSymLink('a.h', os.path.join(input_dir, 'a_link.h'))
+
+    # Copy items.
+    copy_items(input_dir, output_dir, patterns)
+
+    # Assert the actual copied items match the ones we expected.
+    for dirpath, _, filenames in os.walk(output_dir):
+      actual_copied_items.extend(
+          os.path.join(dirpath, filename) for filename in filenames)
+    self.assertEqual(
+        getRelPaths(output_dir, actual_copied_items),
+        getRelPaths(input_dir, expected_copied_items))
+    self.assertEqual(
+        os.readlink(os.path.join(output_dir, 'a_link.cpp')), 'a.cpp')
 
   def test_validate_config_lists_ReturnsFalseIfMissingDefaultItem(self):
-    system_item_list = default_system_item_list[:]
-    system_item_list.remove('SYSTEM/*')
+    framework_item_list = list(DEFAULT_FRAMEWORK_ITEM_LIST)
+    framework_item_list.remove('SYSTEM/*')
     self.assertFalse(
-        validate_config_lists(system_item_list, default_system_misc_info_keys,
-                              default_other_item_list))
+        validate_config_lists(framework_item_list,
+                              DEFAULT_FRAMEWORK_MISC_INFO_KEYS,
+                              DEFAULT_VENDOR_ITEM_LIST))
 
   def test_validate_config_lists_ReturnsTrueIfDefaultItemInDifferentList(self):
-    system_item_list = default_system_item_list[:]
-    system_item_list.remove('ROOT/*')
-    other_item_list = default_other_item_list[:]
-    other_item_list.append('ROOT/*')
+    framework_item_list = list(DEFAULT_FRAMEWORK_ITEM_LIST)
+    framework_item_list.remove('ROOT/*')
+    vendor_item_list = list(DEFAULT_VENDOR_ITEM_LIST)
+    vendor_item_list.append('ROOT/*')
     self.assertTrue(
-        validate_config_lists(system_item_list, default_system_misc_info_keys,
-                              other_item_list))
+        validate_config_lists(framework_item_list,
+                              DEFAULT_FRAMEWORK_MISC_INFO_KEYS,
+                              vendor_item_list))
 
   def test_validate_config_lists_ReturnsTrueIfExtraItem(self):
-    system_item_list = default_system_item_list[:]
-    system_item_list.append('MY_NEW_PARTITION/*')
+    framework_item_list = list(DEFAULT_FRAMEWORK_ITEM_LIST)
+    framework_item_list.append('MY_NEW_PARTITION/*')
     self.assertTrue(
-        validate_config_lists(system_item_list, default_system_misc_info_keys,
-                              default_other_item_list))
+        validate_config_lists(framework_item_list,
+                              DEFAULT_FRAMEWORK_MISC_INFO_KEYS,
+                              DEFAULT_VENDOR_ITEM_LIST))
+
+  def test_validate_config_lists_ReturnsFalseIfSharedExtractedPartition(self):
+    vendor_item_list = list(DEFAULT_VENDOR_ITEM_LIST)
+    vendor_item_list.append('SYSTEM/my_system_file')
+    self.assertFalse(
+        validate_config_lists(DEFAULT_FRAMEWORK_ITEM_LIST,
+                              DEFAULT_FRAMEWORK_MISC_INFO_KEYS,
+                              vendor_item_list))
 
   def test_validate_config_lists_ReturnsFalseIfBadSystemMiscInfoKeys(self):
     for bad_key in ['dynamic_partition_list', 'super_partition_groups']:
-      system_misc_info_keys = default_system_misc_info_keys[:]
-      system_misc_info_keys.append(bad_key)
+      framework_misc_info_keys = list(DEFAULT_FRAMEWORK_MISC_INFO_KEYS)
+      framework_misc_info_keys.append(bad_key)
       self.assertFalse(
-          validate_config_lists(default_system_item_list, system_misc_info_keys,
-                                default_other_item_list))
+          validate_config_lists(DEFAULT_FRAMEWORK_ITEM_LIST,
+                                framework_misc_info_keys,
+                                DEFAULT_VENDOR_ITEM_LIST))
+
+  def test_process_apex_keys_apk_certs_ReturnsTrueIfNoConflicts(self):
+    output_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(output_dir, 'META'))
+
+    framework_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(framework_dir, 'META'))
+    os.symlink(
+        os.path.join(self.testdata_dir, 'apexkeys_framework.txt'),
+        os.path.join(framework_dir, 'META', 'apexkeys.txt'))
+
+    vendor_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(vendor_dir, 'META'))
+    os.symlink(
+        os.path.join(self.testdata_dir, 'apexkeys_vendor.txt'),
+        os.path.join(vendor_dir, 'META', 'apexkeys.txt'))
+
+    process_apex_keys_apk_certs_common(framework_dir, vendor_dir, output_dir,
+                                       set(['product', 'system', 'system_ext']),
+                                       set(['odm', 'vendor']),
+                                       'apexkeys.txt')
+
+    merged_entries = []
+    merged_path = os.path.join(self.testdata_dir, 'apexkeys_merge.txt')
+
+    with open(merged_path) as f:
+      merged_entries = f.read().split('\n')
+
+    output_entries = []
+    output_path = os.path.join(output_dir, 'META', 'apexkeys.txt')
+
+    with open(output_path) as f:
+      output_entries = f.read().split('\n')
+
+    return self.assertEqual(merged_entries, output_entries)
+
+  def test_process_apex_keys_apk_certs_ReturnsFalseIfConflictsPresent(self):
+    output_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(output_dir, 'META'))
+
+    framework_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(framework_dir, 'META'))
+    os.symlink(
+        os.path.join(self.testdata_dir, 'apexkeys_framework.txt'),
+        os.path.join(framework_dir, 'META', 'apexkeys.txt'))
+
+    conflict_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(conflict_dir, 'META'))
+    os.symlink(
+        os.path.join(self.testdata_dir, 'apexkeys_framework_conflict.txt'),
+        os.path.join(conflict_dir, 'META', 'apexkeys.txt'))
+
+    self.assertRaises(ValueError, process_apex_keys_apk_certs_common,
+                      framework_dir, conflict_dir, output_dir,
+                      set(['product', 'system', 'system_ext']),
+                      set(['odm', 'vendor']),
+                      'apexkeys.txt')
+
+  def test_process_apex_keys_apk_certs_HandlesApkCertsSyntax(self):
+    output_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(output_dir, 'META'))
+
+    framework_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(framework_dir, 'META'))
+    os.symlink(
+        os.path.join(self.testdata_dir, 'apkcerts_framework.txt'),
+        os.path.join(framework_dir, 'META', 'apkcerts.txt'))
+
+    vendor_dir = common.MakeTempDir()
+    os.makedirs(os.path.join(vendor_dir, 'META'))
+    os.symlink(
+        os.path.join(self.testdata_dir, 'apkcerts_vendor.txt'),
+        os.path.join(vendor_dir, 'META', 'apkcerts.txt'))
+
+    process_apex_keys_apk_certs_common(framework_dir, vendor_dir, output_dir,
+                                       set(['product', 'system', 'system_ext']),
+                                       set(['odm', 'vendor']),
+                                       'apkcerts.txt')
+
+    merged_entries = []
+    merged_path = os.path.join(self.testdata_dir, 'apkcerts_merge.txt')
+
+    with open(merged_path) as f:
+      merged_entries = f.read().split('\n')
+
+    output_entries = []
+    output_path = os.path.join(output_dir, 'META', 'apkcerts.txt')
+
+    with open(output_path) as f:
+      output_entries = f.read().split('\n')
+
+    return self.assertEqual(merged_entries, output_entries)
+
+  def test_item_list_to_partition_set(self):
+    item_list = [
+        'META/apexkeys.txt',
+        'META/apkcerts.txt',
+        'META/filesystem_config.txt',
+        'PRODUCT/*',
+        'SYSTEM/*',
+        'SYSTEM_EXT/*',
+    ]
+    partition_set = item_list_to_partition_set(item_list)
+    self.assertEqual(set(['product', 'system', 'system_ext']), partition_set)
diff --git a/tools/releasetools/test_ota_from_target_files.py b/tools/releasetools/test_ota_from_target_files.py
index 07dcffb..7783f96 100644
--- a/tools/releasetools/test_ota_from_target_files.py
+++ b/tools/releasetools/test_ota_from_target_files.py
@@ -22,11 +22,12 @@
 import common
 import test_utils
 from ota_from_target_files import (
-    _LoadOemDicts, AbOtaPropertyFiles, BuildInfo, FinalizeMetadata,
+    _LoadOemDicts, AbOtaPropertyFiles, FinalizeMetadata,
     GetPackageMetadata, GetTargetFilesZipForSecondaryImages,
     GetTargetFilesZipWithoutPostinstallConfig, NonAbOtaPropertyFiles,
     Payload, PayloadSigner, POSTINSTALL_CONFIG, PropertyFiles,
-    StreamingPropertyFiles, WriteFingerprintAssertion)
+    StreamingPropertyFiles, WriteFingerprintAssertion,
+    CalculateRuntimeDevicesAndFingerprints)
 
 
 def construct_target_files(secondary=False):
@@ -74,283 +75,6 @@
   return target_files
 
 
-class MockScriptWriter(object):
-  """A class that mocks edify_generator.EdifyGenerator.
-
-  It simply pushes the incoming arguments onto script stack, which is to assert
-  the calls to EdifyGenerator functions.
-  """
-
-  def __init__(self):
-    self.script = []
-
-  def Mount(self, *args):
-    self.script.append(('Mount',) + args)
-
-  def AssertDevice(self, *args):
-    self.script.append(('AssertDevice',) + args)
-
-  def AssertOemProperty(self, *args):
-    self.script.append(('AssertOemProperty',) + args)
-
-  def AssertFingerprintOrThumbprint(self, *args):
-    self.script.append(('AssertFingerprintOrThumbprint',) + args)
-
-  def AssertSomeFingerprint(self, *args):
-    self.script.append(('AssertSomeFingerprint',) + args)
-
-  def AssertSomeThumbprint(self, *args):
-    self.script.append(('AssertSomeThumbprint',) + args)
-
-
-class BuildInfoTest(test_utils.ReleaseToolsTestCase):
-
-  TEST_INFO_DICT = {
-      'build.prop' : {
-          'ro.product.device' : 'product-device',
-          'ro.product.name' : 'product-name',
-          'ro.build.fingerprint' : 'build-fingerprint',
-          'ro.build.foo' : 'build-foo',
-      },
-      'vendor.build.prop' : {
-          'ro.vendor.build.fingerprint' : 'vendor-build-fingerprint',
-      },
-      'property1' : 'value1',
-      'property2' : 4096,
-  }
-
-  TEST_INFO_DICT_USES_OEM_PROPS = {
-      'build.prop' : {
-          'ro.product.name' : 'product-name',
-          'ro.build.thumbprint' : 'build-thumbprint',
-          'ro.build.bar' : 'build-bar',
-      },
-      'vendor.build.prop' : {
-          'ro.vendor.build.fingerprint' : 'vendor-build-fingerprint',
-      },
-      'property1' : 'value1',
-      'property2' : 4096,
-      'oem_fingerprint_properties' : 'ro.product.device ro.product.brand',
-  }
-
-  TEST_OEM_DICTS = [
-      {
-          'ro.product.brand' : 'brand1',
-          'ro.product.device' : 'device1',
-      },
-      {
-          'ro.product.brand' : 'brand2',
-          'ro.product.device' : 'device2',
-      },
-      {
-          'ro.product.brand' : 'brand3',
-          'ro.product.device' : 'device3',
-      },
-  ]
-
-  def test_init(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    self.assertEqual('product-device', target_info.device)
-    self.assertEqual('build-fingerprint', target_info.fingerprint)
-    self.assertFalse(target_info.is_ab)
-    self.assertIsNone(target_info.oem_props)
-
-  def test_init_with_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    self.assertEqual('device1', target_info.device)
-    self.assertEqual('brand1/product-name/device1:build-thumbprint',
-                     target_info.fingerprint)
-
-    # Swap the order in oem_dicts, which would lead to different BuildInfo.
-    oem_dicts = copy.copy(self.TEST_OEM_DICTS)
-    oem_dicts[0], oem_dicts[2] = oem_dicts[2], oem_dicts[0]
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS, oem_dicts)
-    self.assertEqual('device3', target_info.device)
-    self.assertEqual('brand3/product-name/device3:build-thumbprint',
-                     target_info.fingerprint)
-
-    # Missing oem_dict should be rejected.
-    self.assertRaises(AssertionError, BuildInfo,
-                      self.TEST_INFO_DICT_USES_OEM_PROPS, None)
-
-  def test___getitem__(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    self.assertEqual('value1', target_info['property1'])
-    self.assertEqual(4096, target_info['property2'])
-    self.assertEqual('build-foo', target_info['build.prop']['ro.build.foo'])
-
-  def test___getitem__with_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    self.assertEqual('value1', target_info['property1'])
-    self.assertEqual(4096, target_info['property2'])
-    self.assertRaises(KeyError,
-                      lambda: target_info['build.prop']['ro.build.foo'])
-
-  def test___setitem__(self):
-    target_info = BuildInfo(copy.deepcopy(self.TEST_INFO_DICT), None)
-    self.assertEqual('value1', target_info['property1'])
-    target_info['property1'] = 'value2'
-    self.assertEqual('value2', target_info['property1'])
-
-    self.assertEqual('build-foo', target_info['build.prop']['ro.build.foo'])
-    target_info['build.prop']['ro.build.foo'] = 'build-bar'
-    self.assertEqual('build-bar', target_info['build.prop']['ro.build.foo'])
-
-  def test_get(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    self.assertEqual('value1', target_info.get('property1'))
-    self.assertEqual(4096, target_info.get('property2'))
-    self.assertEqual(4096, target_info.get('property2', 1024))
-    self.assertEqual(1024, target_info.get('property-nonexistent', 1024))
-    self.assertEqual('build-foo', target_info.get('build.prop')['ro.build.foo'])
-
-  def test_get_with_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    self.assertEqual('value1', target_info.get('property1'))
-    self.assertEqual(4096, target_info.get('property2'))
-    self.assertEqual(4096, target_info.get('property2', 1024))
-    self.assertEqual(1024, target_info.get('property-nonexistent', 1024))
-    self.assertIsNone(target_info.get('build.prop').get('ro.build.foo'))
-    self.assertRaises(KeyError,
-                      lambda: target_info.get('build.prop')['ro.build.foo'])
-
-  def test_items(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    items = target_info.items()
-    self.assertIn(('property1', 'value1'), items)
-    self.assertIn(('property2', 4096), items)
-
-  def test_GetBuildProp(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    self.assertEqual('build-foo', target_info.GetBuildProp('ro.build.foo'))
-    self.assertRaises(common.ExternalError, target_info.GetBuildProp,
-                      'ro.build.nonexistent')
-
-  def test_GetBuildProp_with_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    self.assertEqual('build-bar', target_info.GetBuildProp('ro.build.bar'))
-    self.assertRaises(common.ExternalError, target_info.GetBuildProp,
-                      'ro.build.nonexistent')
-
-  def test_GetVendorBuildProp(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    self.assertEqual('vendor-build-fingerprint',
-                     target_info.GetVendorBuildProp(
-                         'ro.vendor.build.fingerprint'))
-    self.assertRaises(common.ExternalError, target_info.GetVendorBuildProp,
-                      'ro.build.nonexistent')
-
-  def test_GetVendorBuildProp_with_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    self.assertEqual('vendor-build-fingerprint',
-                     target_info.GetVendorBuildProp(
-                         'ro.vendor.build.fingerprint'))
-    self.assertRaises(common.ExternalError, target_info.GetVendorBuildProp,
-                      'ro.build.nonexistent')
-
-  def test_vendor_fingerprint(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    self.assertEqual('vendor-build-fingerprint',
-                     target_info.vendor_fingerprint)
-
-  def test_vendor_fingerprint_blacklisted(self):
-    target_info_dict = copy.deepcopy(self.TEST_INFO_DICT_USES_OEM_PROPS)
-    del target_info_dict['vendor.build.prop']['ro.vendor.build.fingerprint']
-    target_info = BuildInfo(target_info_dict, self.TEST_OEM_DICTS)
-    self.assertIsNone(target_info.vendor_fingerprint)
-
-  def test_vendor_fingerprint_without_vendor_build_prop(self):
-    target_info_dict = copy.deepcopy(self.TEST_INFO_DICT_USES_OEM_PROPS)
-    del target_info_dict['vendor.build.prop']
-    target_info = BuildInfo(target_info_dict, self.TEST_OEM_DICTS)
-    self.assertIsNone(target_info.vendor_fingerprint)
-
-  def test_WriteMountOemScript(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    script_writer = MockScriptWriter()
-    target_info.WriteMountOemScript(script_writer)
-    self.assertEqual([('Mount', '/oem', None)], script_writer.script)
-
-  def test_WriteDeviceAssertions(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    script_writer = MockScriptWriter()
-    target_info.WriteDeviceAssertions(script_writer, False)
-    self.assertEqual([('AssertDevice', 'product-device')], script_writer.script)
-
-  def test_WriteDeviceAssertions_with_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    script_writer = MockScriptWriter()
-    target_info.WriteDeviceAssertions(script_writer, False)
-    self.assertEqual(
-        [
-            ('AssertOemProperty', 'ro.product.device',
-             ['device1', 'device2', 'device3'], False),
-            ('AssertOemProperty', 'ro.product.brand',
-             ['brand1', 'brand2', 'brand3'], False),
-        ],
-        script_writer.script)
-
-  def test_WriteFingerprintAssertion_without_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    source_info_dict = copy.deepcopy(self.TEST_INFO_DICT)
-    source_info_dict['build.prop']['ro.build.fingerprint'] = (
-        'source-build-fingerprint')
-    source_info = BuildInfo(source_info_dict, None)
-
-    script_writer = MockScriptWriter()
-    WriteFingerprintAssertion(script_writer, target_info, source_info)
-    self.assertEqual(
-        [('AssertSomeFingerprint', 'source-build-fingerprint',
-          'build-fingerprint')],
-        script_writer.script)
-
-  def test_WriteFingerprintAssertion_with_source_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT, None)
-    source_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-
-    script_writer = MockScriptWriter()
-    WriteFingerprintAssertion(script_writer, target_info, source_info)
-    self.assertEqual(
-        [('AssertFingerprintOrThumbprint', 'build-fingerprint',
-          'build-thumbprint')],
-        script_writer.script)
-
-  def test_WriteFingerprintAssertion_with_target_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    source_info = BuildInfo(self.TEST_INFO_DICT, None)
-
-    script_writer = MockScriptWriter()
-    WriteFingerprintAssertion(script_writer, target_info, source_info)
-    self.assertEqual(
-        [('AssertFingerprintOrThumbprint', 'build-fingerprint',
-          'build-thumbprint')],
-        script_writer.script)
-
-  def test_WriteFingerprintAssertion_with_both_oem_props(self):
-    target_info = BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
-                            self.TEST_OEM_DICTS)
-    source_info_dict = copy.deepcopy(self.TEST_INFO_DICT_USES_OEM_PROPS)
-    source_info_dict['build.prop']['ro.build.thumbprint'] = (
-        'source-build-thumbprint')
-    source_info = BuildInfo(source_info_dict, self.TEST_OEM_DICTS)
-
-    script_writer = MockScriptWriter()
-    WriteFingerprintAssertion(script_writer, target_info, source_info)
-    self.assertEqual(
-        [('AssertSomeThumbprint', 'build-thumbprint',
-          'source-build-thumbprint')],
-        script_writer.script)
-
-
 class LoadOemDictsTest(test_utils.ReleaseToolsTestCase):
 
   def test_NoneDict(self):
@@ -385,29 +109,61 @@
 
 
 class OtaFromTargetFilesTest(test_utils.ReleaseToolsTestCase):
-
   TEST_TARGET_INFO_DICT = {
-      'build.prop' : {
-          'ro.product.device' : 'product-device',
-          'ro.build.fingerprint' : 'build-fingerprint-target',
-          'ro.build.version.incremental' : 'build-version-incremental-target',
-          'ro.build.version.sdk' : '27',
-          'ro.build.version.security_patch' : '2017-12-01',
-          'ro.build.date.utc' : '1500000000',
-      },
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.device': 'product-device',
+              'ro.build.fingerprint': 'build-fingerprint-target',
+              'ro.build.version.incremental': 'build-version-incremental-target',
+              'ro.build.version.sdk': '27',
+              'ro.build.version.security_patch': '2017-12-01',
+              'ro.build.date.utc': '1500000000'}
+      )
   }
 
   TEST_SOURCE_INFO_DICT = {
-      'build.prop' : {
-          'ro.product.device' : 'product-device',
-          'ro.build.fingerprint' : 'build-fingerprint-source',
-          'ro.build.version.incremental' : 'build-version-incremental-source',
-          'ro.build.version.sdk' : '25',
-          'ro.build.version.security_patch' : '2016-12-01',
-          'ro.build.date.utc' : '1400000000',
-      },
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.device': 'product-device',
+              'ro.build.fingerprint': 'build-fingerprint-source',
+              'ro.build.version.incremental': 'build-version-incremental-source',
+              'ro.build.version.sdk': '25',
+              'ro.build.version.security_patch': '2016-12-01',
+              'ro.build.date.utc': '1400000000'}
+      )
   }
 
+  TEST_INFO_DICT_USES_OEM_PROPS = {
+      'build.prop': common.PartitionBuildProps.FromDictionary(
+          'system', {
+              'ro.product.name': 'product-name',
+              'ro.build.thumbprint': 'build-thumbprint',
+              'ro.build.bar': 'build-bar'}
+      ),
+      'vendor.build.prop': common.PartitionBuildProps.FromDictionary(
+          'vendor', {
+               'ro.vendor.build.fingerprint': 'vendor-build-fingerprint'}
+      ),
+      'property1': 'value1',
+      'property2': 4096,
+      'oem_fingerprint_properties': 'ro.product.device ro.product.brand',
+  }
+
+  TEST_OEM_DICTS = [
+      {
+          'ro.product.brand': 'brand1',
+          'ro.product.device': 'device1',
+      },
+      {
+          'ro.product.brand': 'brand2',
+          'ro.product.device': 'device2',
+      },
+      {
+          'ro.product.brand': 'brand3',
+          'ro.product.device': 'device3',
+      },
+  ]
+
   def setUp(self):
     self.testdata_dir = test_utils.get_testdata_dir()
     self.assertTrue(os.path.exists(self.testdata_dir))
@@ -425,12 +181,11 @@
     }
 
     common.OPTIONS.search_path = test_utils.get_search_path()
-    self.assertIsNotNone(common.OPTIONS.search_path)
 
   def test_GetPackageMetadata_abOta_full(self):
     target_info_dict = copy.deepcopy(self.TEST_TARGET_INFO_DICT)
     target_info_dict['ab_update'] = 'true'
-    target_info = BuildInfo(target_info_dict, None)
+    target_info = common.BuildInfo(target_info_dict, None)
     metadata = GetPackageMetadata(target_info)
     self.assertDictEqual(
         {
@@ -448,8 +203,8 @@
   def test_GetPackageMetadata_abOta_incremental(self):
     target_info_dict = copy.deepcopy(self.TEST_TARGET_INFO_DICT)
     target_info_dict['ab_update'] = 'true'
-    target_info = BuildInfo(target_info_dict, None)
-    source_info = BuildInfo(self.TEST_SOURCE_INFO_DICT, None)
+    target_info = common.BuildInfo(target_info_dict, None)
+    source_info = common.BuildInfo(self.TEST_SOURCE_INFO_DICT, None)
     common.OPTIONS.incremental_source = ''
     metadata = GetPackageMetadata(target_info, source_info)
     self.assertDictEqual(
@@ -468,7 +223,7 @@
         metadata)
 
   def test_GetPackageMetadata_nonAbOta_full(self):
-    target_info = BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+    target_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
     metadata = GetPackageMetadata(target_info)
     self.assertDictEqual(
         {
@@ -483,8 +238,8 @@
         metadata)
 
   def test_GetPackageMetadata_nonAbOta_incremental(self):
-    target_info = BuildInfo(self.TEST_TARGET_INFO_DICT, None)
-    source_info = BuildInfo(self.TEST_SOURCE_INFO_DICT, None)
+    target_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+    source_info = common.BuildInfo(self.TEST_SOURCE_INFO_DICT, None)
     common.OPTIONS.incremental_source = ''
     metadata = GetPackageMetadata(target_info, source_info)
     self.assertDictEqual(
@@ -502,7 +257,7 @@
         metadata)
 
   def test_GetPackageMetadata_wipe(self):
-    target_info = BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+    target_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
     common.OPTIONS.wipe_user_data = True
     metadata = GetPackageMetadata(target_info)
     self.assertDictEqual(
@@ -519,7 +274,7 @@
         metadata)
 
   def test_GetPackageMetadata_retrofitDynamicPartitions(self):
-    target_info = BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+    target_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
     common.OPTIONS.retrofit_dynamic_partitions = True
     metadata = GetPackageMetadata(target_info)
     self.assertDictEqual(
@@ -537,10 +292,10 @@
 
   @staticmethod
   def _test_GetPackageMetadata_swapBuildTimestamps(target_info, source_info):
-    (target_info['build.prop']['ro.build.date.utc'],
-     source_info['build.prop']['ro.build.date.utc']) = (
-         source_info['build.prop']['ro.build.date.utc'],
-         target_info['build.prop']['ro.build.date.utc'])
+    (target_info['build.prop'].build_props['ro.build.date.utc'],
+     source_info['build.prop'].build_props['ro.build.date.utc']) = (
+         source_info['build.prop'].build_props['ro.build.date.utc'],
+         target_info['build.prop'].build_props['ro.build.date.utc'])
 
   def test_GetPackageMetadata_unintentionalDowngradeDetected(self):
     target_info_dict = copy.deepcopy(self.TEST_TARGET_INFO_DICT)
@@ -548,8 +303,8 @@
     self._test_GetPackageMetadata_swapBuildTimestamps(
         target_info_dict, source_info_dict)
 
-    target_info = BuildInfo(target_info_dict, None)
-    source_info = BuildInfo(source_info_dict, None)
+    target_info = common.BuildInfo(target_info_dict, None)
+    source_info = common.BuildInfo(source_info_dict, None)
     common.OPTIONS.incremental_source = ''
     self.assertRaises(RuntimeError, GetPackageMetadata, target_info,
                       source_info)
@@ -560,8 +315,8 @@
     self._test_GetPackageMetadata_swapBuildTimestamps(
         target_info_dict, source_info_dict)
 
-    target_info = BuildInfo(target_info_dict, None)
-    source_info = BuildInfo(source_info_dict, None)
+    target_info = common.BuildInfo(target_info_dict, None)
+    source_info = common.BuildInfo(source_info_dict, None)
     common.OPTIONS.incremental_source = ''
     common.OPTIONS.downgrade = True
     common.OPTIONS.wipe_user_data = True
@@ -582,13 +337,14 @@
         },
         metadata)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetTargetFilesZipForSecondaryImages(self):
     input_file = construct_target_files(secondary=True)
     target_file = GetTargetFilesZipForSecondaryImages(input_file)
 
     with zipfile.ZipFile(target_file) as verify_zip:
       namelist = verify_zip.namelist()
-      ab_partitions = verify_zip.read('META/ab_partitions.txt')
+      ab_partitions = verify_zip.read('META/ab_partitions.txt').decode()
 
     self.assertIn('META/ab_partitions.txt', namelist)
     self.assertIn('IMAGES/system.img', namelist)
@@ -668,9 +424,9 @@
 
     with zipfile.ZipFile(target_file) as verify_zip:
       namelist = verify_zip.namelist()
-      updated_misc_info = verify_zip.read('META/misc_info.txt')
+      updated_misc_info = verify_zip.read('META/misc_info.txt').decode()
       updated_dynamic_partitions_info = verify_zip.read(
-          'META/dynamic_partitions_info.txt')
+          'META/dynamic_partitions_info.txt').decode()
 
     self.assertIn('META/ab_partitions.txt', namelist)
     self.assertIn('IMAGES/system.img', namelist)
@@ -698,6 +454,7 @@
     with zipfile.ZipFile(target_file) as verify_zip:
       self.assertNotIn(POSTINSTALL_CONFIG, verify_zip.namelist())
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetTargetFilesZipWithoutPostinstallConfig_missingEntry(self):
     input_file = construct_target_files()
     common.ZipDelete(input_file, POSTINSTALL_CONFIG)
@@ -728,20 +485,25 @@
     FinalizeMetadata(metadata, zip_file, output_file, needed_property_files)
     self.assertIn('ota-test-property-files', metadata)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_FinalizeMetadata(self):
     self._test_FinalizeMetadata()
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_FinalizeMetadata_withNoSigning(self):
     common.OPTIONS.no_signing = True
     self._test_FinalizeMetadata()
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_FinalizeMetadata_largeEntry(self):
     self._test_FinalizeMetadata(large_entry=True)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_FinalizeMetadata_largeEntry_withNoSigning(self):
     common.OPTIONS.no_signing = True
     self._test_FinalizeMetadata(large_entry=True)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_FinalizeMetadata_insufficientSpace(self):
     entries = [
         'required-entry1',
@@ -767,6 +529,59 @@
     FinalizeMetadata(metadata, zip_file, output_file, needed_property_files)
     self.assertIn('ota-test-property-files', metadata)
 
+  def test_WriteFingerprintAssertion_without_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+    source_info_dict = copy.deepcopy(self.TEST_TARGET_INFO_DICT)
+    source_info_dict['build.prop'].build_props['ro.build.fingerprint'] = (
+        'source-build-fingerprint')
+    source_info = common.BuildInfo(source_info_dict, None)
+
+    script_writer = test_utils.MockScriptWriter()
+    WriteFingerprintAssertion(script_writer, target_info, source_info)
+    self.assertEqual(
+        [('AssertSomeFingerprint', 'source-build-fingerprint',
+          'build-fingerprint-target')],
+        script_writer.lines)
+
+  def test_WriteFingerprintAssertion_with_source_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+    source_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+
+    script_writer = test_utils.MockScriptWriter()
+    WriteFingerprintAssertion(script_writer, target_info, source_info)
+    self.assertEqual(
+        [('AssertFingerprintOrThumbprint', 'build-fingerprint-target',
+          'build-thumbprint')],
+        script_writer.lines)
+
+  def test_WriteFingerprintAssertion_with_target_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    source_info = common.BuildInfo(self.TEST_TARGET_INFO_DICT, None)
+
+    script_writer = test_utils.MockScriptWriter()
+    WriteFingerprintAssertion(script_writer, target_info, source_info)
+    self.assertEqual(
+        [('AssertFingerprintOrThumbprint', 'build-fingerprint-target',
+          'build-thumbprint')],
+        script_writer.lines)
+
+  def test_WriteFingerprintAssertion_with_both_oem_props(self):
+    target_info = common.BuildInfo(self.TEST_INFO_DICT_USES_OEM_PROPS,
+                                   self.TEST_OEM_DICTS)
+    source_info_dict = copy.deepcopy(self.TEST_INFO_DICT_USES_OEM_PROPS)
+    source_info_dict['build.prop'].build_props['ro.build.thumbprint'] = (
+        'source-build-thumbprint')
+    source_info = common.BuildInfo(source_info_dict, self.TEST_OEM_DICTS)
+
+    script_writer = test_utils.MockScriptWriter()
+    WriteFingerprintAssertion(script_writer, target_info, source_info)
+    self.assertEqual(
+        [('AssertSomeThumbprint', 'build-thumbprint',
+          'source-build-thumbprint')],
+        script_writer.lines)
+
 
 class TestPropertyFiles(PropertyFiles):
   """A class that extends PropertyFiles for testing purpose."""
@@ -819,6 +634,7 @@
           expected = entry.replace('.', '-').upper().encode()
         self.assertEqual(expected, input_fp.read(size))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Compute(self):
     entries = (
         'required-entry1',
@@ -858,6 +674,7 @@
     with zipfile.ZipFile(zip_file, 'r') as zip_fp:
       self.assertRaises(KeyError, property_files.Compute, zip_fp)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Finalize(self):
     entries = [
         'required-entry1',
@@ -878,6 +695,7 @@
     entries[2] = 'metadata'
     self._verify_entries(zip_file, tokens, entries)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Finalize_assertReservedLength(self):
     entries = (
         'required-entry1',
@@ -1051,6 +869,7 @@
         ),
         property_files.optional)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_GetPayloadMetadataOffsetAndSize(self):
     target_file = construct_target_files()
     payload = Payload()
@@ -1070,10 +889,28 @@
       payload_offset, metadata_total = (
           property_files._GetPayloadMetadataOffsetAndSize(input_zip))
 
-    # Read in the metadata signature directly.
+    # The signature proto has the following format (details in
+    #  /platform/system/update_engine/update_metadata.proto):
+    #  message Signature {
+    #    optional uint32 version = 1;
+    #    optional bytes data = 2;
+    #    optional fixed32 unpadded_signature_size = 3;
+    #  }
+    #
+    # According to the protobuf encoding, the tail of the signature message will
+    # be [signature string(256 bytes) + encoding of the fixed32 number 256]. And
+    # 256 is encoded as 'x1d\x00\x01\x00\x00':
+    # [3 (field number) << 3 | 5 (type) + byte reverse of 0x100 (256)].
+    # Details in (https://developers.google.com/protocol-buffers/docs/encoding)
+    signature_tail_length = self.SIGNATURE_SIZE + 5
+    self.assertGreater(metadata_total, signature_tail_length)
     with open(output_file, 'rb') as verify_fp:
-      verify_fp.seek(payload_offset + metadata_total - self.SIGNATURE_SIZE)
-      metadata_signature = verify_fp.read(self.SIGNATURE_SIZE)
+      verify_fp.seek(payload_offset + metadata_total - signature_tail_length)
+      metadata_signature_proto_tail = verify_fp.read(signature_tail_length)
+
+    self.assertEqual(b'\x1d\x00\x01\x00\x00',
+                     metadata_signature_proto_tail[-5:])
+    metadata_signature = metadata_signature_proto_tail[:-5]
 
     # Now we extract the metadata hash via brillo_update_payload script, which
     # will serve as the oracle result.
@@ -1124,6 +961,7 @@
 
     return zip_file
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Compute(self):
     zip_file = self.construct_zip_package_withValidPayload()
     property_files = AbOtaPropertyFiles()
@@ -1137,6 +975,7 @@
     self._verify_entries(
         zip_file, tokens, ('care_map.txt', 'compatibility.zip'))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Finalize(self):
     zip_file = self.construct_zip_package_withValidPayload(with_metadata=True)
     property_files = AbOtaPropertyFiles()
@@ -1152,6 +991,7 @@
     self._verify_entries(
         zip_file, tokens, ('care_map.txt', 'compatibility.zip'))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Verify(self):
     zip_file = self.construct_zip_package_withValidPayload(with_metadata=True)
     property_files = AbOtaPropertyFiles()
@@ -1232,11 +1072,13 @@
     with open(file1, 'rb') as fp1, open(file2, 'rb') as fp2:
       self.assertEqual(fp1.read(), fp2.read())
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_init(self):
     payload_signer = PayloadSigner()
     self.assertEqual('openssl', payload_signer.signer)
-    self.assertEqual(256, payload_signer.key_size)
+    self.assertEqual(256, payload_signer.maximum_signature_size)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_init_withPassword(self):
     common.OPTIONS.package_key = os.path.join(
         self.testdata_dir, 'testkey_with_passwd')
@@ -1249,17 +1091,27 @@
   def test_init_withExternalSigner(self):
     common.OPTIONS.payload_signer = 'abc'
     common.OPTIONS.payload_signer_args = ['arg1', 'arg2']
-    common.OPTIONS.payload_signer_key_size = '512'
+    common.OPTIONS.payload_signer_maximum_signature_size = '512'
     payload_signer = PayloadSigner()
     self.assertEqual('abc', payload_signer.signer)
     self.assertEqual(['arg1', 'arg2'], payload_signer.signer_args)
-    self.assertEqual(512, payload_signer.key_size)
+    self.assertEqual(512, payload_signer.maximum_signature_size)
 
-  def test_GetKeySizeInBytes_512Bytes(self):
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_GetMaximumSignatureSizeInBytes_512Bytes(self):
     signing_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
-    key_size = PayloadSigner._GetKeySizeInBytes(signing_key)
-    self.assertEqual(512, key_size)
+    # pylint: disable=protected-access
+    signature_size = PayloadSigner._GetMaximumSignatureSizeInBytes(signing_key)
+    self.assertEqual(512, signature_size)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_GetMaximumSignatureSizeInBytes_ECKey(self):
+    signing_key = os.path.join(self.testdata_dir, 'testkey_EC.key')
+    # pylint: disable=protected-access
+    signature_size = PayloadSigner._GetMaximumSignatureSizeInBytes(signing_key)
+    self.assertEqual(72, signature_size)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Sign(self):
     payload_signer = PayloadSigner()
     input_file = os.path.join(self.testdata_dir, self.SIGFILE)
@@ -1286,6 +1138,7 @@
     """Uses testdata/payload_signer.sh as the external payload signer."""
     common.OPTIONS.payload_signer = os.path.join(
         self.testdata_dir, 'payload_signer.sh')
+    os.chmod(common.OPTIONS.payload_signer, 0o700)
     common.OPTIONS.payload_signer_args = [
         os.path.join(self.testdata_dir, 'testkey.pk8')]
     payload_signer = PayloadSigner()
@@ -1325,14 +1178,17 @@
     payload.Generate(target_file, source_file)
     return payload
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Generate_full(self):
     payload = self._create_payload_full()
     self.assertTrue(os.path.exists(payload.payload_file))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Generate_incremental(self):
     payload = self._create_payload_incremental()
     self.assertTrue(os.path.exists(payload.payload_file))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Generate_additionalArgs(self):
     target_file = construct_target_files()
     source_file = construct_target_files()
@@ -1343,12 +1199,14 @@
         target_file, additional_args=["--source_image", source_file])
     self.assertTrue(os.path.exists(payload.payload_file))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Generate_invalidInput(self):
     target_file = construct_target_files()
     common.ZipDelete(target_file, 'IMAGES/vendor.img')
     payload = Payload()
     self.assertRaises(common.ExternalError, payload.Generate, target_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Sign_full(self):
     payload = self._create_payload_full()
     payload.Sign(PayloadSigner())
@@ -1362,6 +1220,7 @@
         os.path.join(self.testdata_dir, 'testkey.x509.pem'),
         output_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Sign_incremental(self):
     payload = self._create_payload_incremental()
     payload.Sign(PayloadSigner())
@@ -1375,6 +1234,7 @@
         os.path.join(self.testdata_dir, 'testkey.x509.pem'),
         output_file)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Sign_withDataWipe(self):
     common.OPTIONS.wipe_user_data = True
     payload = self._create_payload_full()
@@ -1383,6 +1243,7 @@
     with open(payload.payload_properties) as properties_fp:
       self.assertIn("POWERWASH=1", properties_fp.read())
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Sign_secondary(self):
     payload = self._create_payload_full(secondary=True)
     payload.Sign(PayloadSigner())
@@ -1390,6 +1251,7 @@
     with open(payload.payload_properties) as properties_fp:
       self.assertIn("SWITCH_SLOT_ON_REBOOT=0", properties_fp.read())
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_Sign_badSigner(self):
     """Tests that signing failure can be captured."""
     payload = self._create_payload_full()
@@ -1397,6 +1259,7 @@
     payload_signer.signer_args.append('bad-option')
     self.assertRaises(common.ExternalError, payload.Sign, payload_signer)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_WriteToZip(self):
     payload = self._create_payload_full()
     payload.Sign(PayloadSigner())
@@ -1418,6 +1281,7 @@
           continue
         self.assertEqual(zipfile.ZIP_STORED, entry_info.compress_type)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_WriteToZip_unsignedPayload(self):
     """Unsigned payloads should not be allowed to be written to zip."""
     payload = self._create_payload_full()
@@ -1433,6 +1297,7 @@
     with zipfile.ZipFile(output_file, 'w') as output_zip:
       self.assertRaises(AssertionError, payload.WriteToZip, output_zip)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_WriteToZip_secondary(self):
     payload = self._create_payload_full(secondary=True)
     payload.Sign(PayloadSigner())
@@ -1454,3 +1319,239 @@
             Payload.SECONDARY_PAYLOAD_PROPERTIES_TXT):
           continue
         self.assertEqual(zipfile.ZIP_STORED, entry_info.compress_type)
+
+
+class RuntimeFingerprintTest(test_utils.ReleaseToolsTestCase):
+  MISC_INFO = [
+      'recovery_api_version=3',
+      'fstab_version=2',
+      'recovery_as_boot=true',
+  ]
+
+  BUILD_PROP = [
+      'ro.build.version.release=version-release',
+      'ro.build.id=build-id',
+      'ro.build.version.incremental=version-incremental',
+      'ro.build.type=build-type',
+      'ro.build.tags=build-tags',
+      'ro.build.version.sdk=30',
+      'ro.build.version.security_patch=2020',
+      'ro.build.date.utc=12345678'
+  ]
+
+  VENDOR_BUILD_PROP = [
+      'ro.product.vendor.brand=vendor-product-brand',
+      'ro.product.vendor.name=vendor-product-name',
+      'ro.product.vendor.device=vendor-product-device'
+  ]
+
+  def setUp(self):
+    common.OPTIONS.oem_dicts = None
+    self.test_dir = common.MakeTempDir()
+    self.writeFiles({'META/misc_info.txt': '\n'.join(self.MISC_INFO)},
+                    self.test_dir)
+
+  def writeFiles(self, contents_dict, out_dir):
+    for path, content in contents_dict.items():
+      abs_path = os.path.join(out_dir, path)
+      dir_name = os.path.dirname(abs_path)
+      if not os.path.exists(dir_name):
+        os.makedirs(dir_name)
+      with open(abs_path, 'w') as f:
+        f.write(content)
+
+  @staticmethod
+  def constructFingerprint(prefix):
+    return '{}:version-release/build-id/version-incremental:' \
+           'build-type/build-tags'.format(prefix)
+
+  def test_CalculatePossibleFingerprints_no_dynamic_fingerprint(self):
+    build_prop = copy.deepcopy(self.BUILD_PROP)
+    build_prop.extend([
+        'ro.product.brand=product-brand',
+        'ro.product.name=product-name',
+        'ro.product.device=product-device',
+    ])
+    self.writeFiles({
+        'SYSTEM/build.prop': '\n'.join(build_prop),
+        'VENDOR/build.prop': '\n'.join(self.VENDOR_BUILD_PROP),
+    }, self.test_dir)
+
+    build_info = common.BuildInfo(common.LoadInfoDict(self.test_dir))
+    expected = ({'product-device'},
+                {self.constructFingerprint(
+                    'product-brand/product-name/product-device')})
+    self.assertEqual(expected,
+                     CalculateRuntimeDevicesAndFingerprints(build_info, {}))
+
+  def test_CalculatePossibleFingerprints_single_override(self):
+    vendor_build_prop = copy.deepcopy(self.VENDOR_BUILD_PROP)
+    vendor_build_prop.extend([
+        'import /vendor/etc/build_${ro.boot.sku_name}.prop',
+    ])
+    self.writeFiles({
+        'SYSTEM/build.prop': '\n'.join(self.BUILD_PROP),
+        'VENDOR/build.prop': '\n'.join(vendor_build_prop),
+        'VENDOR/etc/build_std.prop':
+        'ro.product.vendor.name=vendor-product-std',
+        'VENDOR/etc/build_pro.prop':
+        'ro.product.vendor.name=vendor-product-pro',
+    }, self.test_dir)
+
+    build_info = common.BuildInfo(common.LoadInfoDict(self.test_dir))
+    boot_variable_values = {'ro.boot.sku_name': ['std', 'pro']}
+
+    expected = ({'vendor-product-device'}, {
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-name/vendor-product-device'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-std/vendor-product-device'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-pro/vendor-product-device'),
+    })
+    self.assertEqual(
+        expected, CalculateRuntimeDevicesAndFingerprints(
+            build_info, boot_variable_values))
+
+  def test_CalculatePossibleFingerprints_multiple_overrides(self):
+    vendor_build_prop = copy.deepcopy(self.VENDOR_BUILD_PROP)
+    vendor_build_prop.extend([
+        'import /vendor/etc/build_${ro.boot.sku_name}.prop',
+        'import /vendor/etc/build_${ro.boot.device_name}.prop',
+    ])
+    self.writeFiles({
+        'SYSTEM/build.prop': '\n'.join(self.BUILD_PROP),
+        'VENDOR/build.prop': '\n'.join(vendor_build_prop),
+        'VENDOR/etc/build_std.prop':
+        'ro.product.vendor.name=vendor-product-std',
+        'VENDOR/etc/build_product1.prop':
+        'ro.product.vendor.device=vendor-device-product1',
+        'VENDOR/etc/build_pro.prop':
+        'ro.product.vendor.name=vendor-product-pro',
+        'VENDOR/etc/build_product2.prop':
+        'ro.product.vendor.device=vendor-device-product2',
+    }, self.test_dir)
+
+    build_info = common.BuildInfo(common.LoadInfoDict(self.test_dir))
+    boot_variable_values = {
+        'ro.boot.sku_name': ['std', 'pro'],
+        'ro.boot.device_name': ['product1', 'product2'],
+    }
+
+    expected_devices = {'vendor-product-device', 'vendor-device-product1',
+                        'vendor-device-product2'}
+    expected_fingerprints = {
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-name/vendor-product-device'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-std/vendor-device-product1'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-pro/vendor-device-product1'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-std/vendor-device-product2'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-pro/vendor-device-product2')
+    }
+    self.assertEqual((expected_devices, expected_fingerprints),
+                     CalculateRuntimeDevicesAndFingerprints(
+                         build_info, boot_variable_values))
+
+  def test_GetPackageMetadata_full_package(self):
+    vendor_build_prop = copy.deepcopy(self.VENDOR_BUILD_PROP)
+    vendor_build_prop.extend([
+        'import /vendor/etc/build_${ro.boot.sku_name}.prop',
+    ])
+    self.writeFiles({
+        'SYSTEM/build.prop': '\n'.join(self.BUILD_PROP),
+        'VENDOR/build.prop': '\n'.join(vendor_build_prop),
+        'VENDOR/etc/build_std.prop':
+        'ro.product.vendor.name=vendor-product-std',
+        'VENDOR/etc/build_pro.prop':
+        'ro.product.vendor.name=vendor-product-pro',
+    }, self.test_dir)
+
+    common.OPTIONS.boot_variable_file = common.MakeTempFile()
+    with open(common.OPTIONS.boot_variable_file, 'w') as f:
+      f.write('ro.boot.sku_name=std,pro')
+
+    build_info = common.BuildInfo(common.LoadInfoDict(self.test_dir))
+    metadata = GetPackageMetadata(build_info)
+    self.assertEqual('vendor-product-device', metadata['pre-device'])
+    fingerprints = [
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-name/vendor-product-device'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-pro/vendor-product-device'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-std/vendor-product-device'),
+    ]
+    self.assertEqual('|'.join(fingerprints), metadata['post-build'])
+
+  def test_GetPackageMetadata_incremental_package(self):
+    vendor_build_prop = copy.deepcopy(self.VENDOR_BUILD_PROP)
+    vendor_build_prop.extend([
+        'import /vendor/etc/build_${ro.boot.sku_name}.prop',
+    ])
+    self.writeFiles({
+        'SYSTEM/build.prop': '\n'.join(self.BUILD_PROP),
+        'VENDOR/build.prop': '\n'.join(vendor_build_prop),
+        'VENDOR/etc/build_std.prop':
+        'ro.product.vendor.device=vendor-device-std',
+        'VENDOR/etc/build_pro.prop':
+        'ro.product.vendor.device=vendor-device-pro',
+    }, self.test_dir)
+
+    common.OPTIONS.boot_variable_file = common.MakeTempFile()
+    with open(common.OPTIONS.boot_variable_file, 'w') as f:
+      f.write('ro.boot.sku_name=std,pro')
+
+    source_dir = common.MakeTempDir()
+    source_build_prop = [
+        'ro.build.version.release=source-version-release',
+        'ro.build.id=source-build-id',
+        'ro.build.version.incremental=source-version-incremental',
+        'ro.build.type=build-type',
+        'ro.build.tags=build-tags',
+        'ro.build.version.sdk=29',
+        'ro.build.version.security_patch=2020',
+        'ro.build.date.utc=12340000'
+    ]
+    self.writeFiles({
+        'META/misc_info.txt': '\n'.join(self.MISC_INFO),
+        'SYSTEM/build.prop': '\n'.join(source_build_prop),
+        'VENDOR/build.prop': '\n'.join(vendor_build_prop),
+        'VENDOR/etc/build_std.prop':
+        'ro.product.vendor.device=vendor-device-std',
+        'VENDOR/etc/build_pro.prop':
+        'ro.product.vendor.device=vendor-device-pro',
+    }, source_dir)
+    common.OPTIONS.incremental_source = source_dir
+
+    target_info = common.BuildInfo(common.LoadInfoDict(self.test_dir))
+    source_info = common.BuildInfo(common.LoadInfoDict(source_dir))
+
+    metadata = GetPackageMetadata(target_info, source_info)
+    self.assertEqual(
+        'vendor-device-pro|vendor-device-std|vendor-product-device',
+        metadata['pre-device'])
+    suffix = ':source-version-release/source-build-id/' \
+             'source-version-incremental:build-type/build-tags'
+    pre_fingerprints = [
+        'vendor-product-brand/vendor-product-name/vendor-device-pro'
+        '{}'.format(suffix),
+        'vendor-product-brand/vendor-product-name/vendor-device-std'
+        '{}'.format(suffix),
+        'vendor-product-brand/vendor-product-name/vendor-product-device'
+        '{}'.format(suffix),
+    ]
+    self.assertEqual('|'.join(pre_fingerprints), metadata['pre-build'])
+
+    post_fingerprints = [
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-name/vendor-device-pro'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-name/vendor-device-std'),
+        self.constructFingerprint(
+            'vendor-product-brand/vendor-product-name/vendor-product-device'),
+    ]
+    self.assertEqual('|'.join(post_fingerprints), metadata['post-build'])
diff --git a/tools/releasetools/test_sign_apex.py b/tools/releasetools/test_sign_apex.py
new file mode 100644
index 0000000..82f5938
--- /dev/null
+++ b/tools/releasetools/test_sign_apex.py
@@ -0,0 +1,59 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import os.path
+
+import common
+import sign_apex
+import test_utils
+
+
+class SignApexTest(test_utils.ReleaseToolsTestCase):
+
+  def setUp(self):
+    self.testdata_dir = test_utils.get_testdata_dir()
+    self.assertTrue(os.path.exists(self.testdata_dir))
+
+    common.OPTIONS.search_path = test_utils.get_search_path()
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_SignApexFile(self):
+    foo_apex = os.path.join(self.testdata_dir, 'foo.apex')
+    payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    container_key = os.path.join(self.testdata_dir, 'testkey')
+    signed_foo_apex = sign_apex.SignApexFile(
+        'avbtool',
+        foo_apex,
+        payload_key,
+        container_key,
+        False)
+    self.assertTrue(os.path.exists(signed_foo_apex))
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_SignApexWithApk(self):
+    test_apex = os.path.join(self.testdata_dir, 'has_apk.apex')
+    payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    container_key = os.path.join(self.testdata_dir, 'testkey')
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+    signed_test_apex = sign_apex.SignApexFile(
+        'avbtool',
+        test_apex,
+        payload_key,
+        container_key,
+        False,
+        apk_keys)
+    self.assertTrue(os.path.exists(signed_test_apex))
diff --git a/tools/releasetools/test_sign_target_files_apks.py b/tools/releasetools/test_sign_target_files_apks.py
index 710fde5..308172f 100644
--- a/tools/releasetools/test_sign_target_files_apks.py
+++ b/tools/releasetools/test_sign_target_files_apks.py
@@ -15,6 +15,7 @@
 #
 
 import base64
+import io
 import os.path
 import zipfile
 
@@ -22,7 +23,8 @@
 import test_utils
 from sign_target_files_apks import (
     CheckApkAndApexKeysAvailable, EditTags, GetApkFileInfo, ReadApexKeysInfo,
-    ReplaceCerts, ReplaceVerityKeyId, RewriteProps)
+    ReplaceCerts, ReplaceVerityKeyId, RewriteAvbProps, RewriteProps,
+    WriteOtacerts)
 
 
 class SignTargetFilesApksTest(test_utils.ReleaseToolsTestCase):
@@ -33,9 +35,13 @@
   <signer signature="{}"><seinfo value="media"/></signer>
 </policy>"""
 
+  # Note that we test one apex with the partition tag, and another without to
+  # make sure that new OTA tools can process an older target files package that
+  # does not include the partition tag.
+
   # pylint: disable=line-too-long
-  APEX_KEYS_TXT = """name="apex.apexd_test.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem" container_certificate="build/target/product/security/testkey.x509.pem" container_private_key="build/target/product/security/testkey.pk8"
-name="apex.apexd_test_different_app.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" container_certificate="build/target/product/security/testkey.x509.pem" container_private_key="build/target/product/security/testkey.pk8"
+  APEX_KEYS_TXT = """name="apex.apexd_test.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem" container_certificate="build/make/target/product/security/testkey.x509.pem" container_private_key="build/make/target/product/security/testkey.pk8" partition="system"
+name="apex.apexd_test_different_app.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" container_certificate="build/make/target/product/security/testkey.x509.pem" container_private_key="build/make/target/product/security/testkey.pk8"
 """
 
   def setUp(self):
@@ -51,6 +57,40 @@
     # Tags are sorted.
     self.assertEqual(EditTags('xyz,abc,dev-keys,xyz'), ('abc,release-keys,xyz'))
 
+  def test_RewriteAvbProps(self):
+    misc_info = {
+      'avb_boot_add_hash_footer_args':
+          ('--prop com.android.build.boot.os_version:R '
+           '--prop com.android.build.boot.security_patch:2019-09-05'),
+      'avb_system_add_hashtree_footer_args':
+          ('--prop com.android.build.system.os_version:R '
+           '--prop com.android.build.system.security_patch:2019-09-05 '
+           '--prop com.android.build.system.fingerprint:'
+           'Android/aosp_taimen/taimen:R/QT/foo:userdebug/test-keys'),
+      'avb_vendor_add_hashtree_footer_args':
+          ('--prop com.android.build.vendor.os_version:R '
+           '--prop com.android.build.vendor.security_patch:2019-09-05 '
+           '--prop com.android.build.vendor.fingerprint:'
+           'Android/aosp_taimen/taimen:R/QT/foo:userdebug/dev-keys'),
+    }
+    expected_dict = {
+      'avb_boot_add_hash_footer_args':
+          ('--prop com.android.build.boot.os_version:R '
+           '--prop com.android.build.boot.security_patch:2019-09-05'),
+      'avb_system_add_hashtree_footer_args':
+          ('--prop com.android.build.system.os_version:R '
+           '--prop com.android.build.system.security_patch:2019-09-05 '
+           '--prop com.android.build.system.fingerprint:'
+           'Android/aosp_taimen/taimen:R/QT/foo:userdebug/release-keys'),
+      'avb_vendor_add_hashtree_footer_args':
+          ('--prop com.android.build.vendor.os_version:R '
+           '--prop com.android.build.vendor.security_patch:2019-09-05 '
+           '--prop com.android.build.vendor.fingerprint:'
+           'Android/aosp_taimen/taimen:R/QT/foo:userdebug/release-keys'),
+    }
+    RewriteAvbProps(misc_info)
+    self.assertDictEqual(expected_dict, misc_info)
+
   def test_RewriteProps(self):
     props = (
         ('', ''),
@@ -70,10 +110,10 @@
          'ro.product.build.fingerprint=foo/bar/release-keys'),
         ('ro.product.build.thumbprint=foo/bar/dev-keys',
          'ro.product.build.thumbprint=foo/bar/release-keys'),
-        ('ro.product_services.build.fingerprint=foo/bar/test-keys',
-         'ro.product_services.build.fingerprint=foo/bar/release-keys'),
-        ('ro.product_services.build.thumbprint=foo/bar/test-keys',
-         'ro.product_services.build.thumbprint=foo/bar/release-keys'),
+        ('ro.system_ext.build.fingerprint=foo/bar/test-keys',
+         'ro.system_ext.build.fingerprint=foo/bar/release-keys'),
+        ('ro.system_ext.build.thumbprint=foo/bar/test-keys',
+         'ro.system_ext.build.thumbprint=foo/bar/release-keys'),
         ('# comment line 1', '# comment line 1'),
         ('ro.bootimage.build.fingerprint=foo/bar/dev-keys',
          'ro.bootimage.build.fingerprint=foo/bar/release-keys'),
@@ -91,8 +131,8 @@
          'ro.odm.build.tags=release-keys'),
         ('ro.product.build.tags=dev-keys',
          'ro.product.build.tags=release-keys'),
-        ('ro.product_services.build.tags=dev-keys',
-         'ro.product_services.build.tags=release-keys'),
+        ('ro.system_ext.build.tags=dev-keys',
+         'ro.system_ext.build.tags=release-keys'),
         ('# comment line 2', '# comment line 2'),
         ('ro.build.display.id=OPR6.170623.012 dev-keys',
          'ro.build.display.id=OPR6.170623.012'),
@@ -136,7 +176,7 @@
       ReplaceVerityKeyId(input_zip, output_zip, cert_file)
 
     with zipfile.ZipFile(output_file) as output_zip:
-      self.assertEqual(BOOT_CMDLINE1, output_zip.read('BOOT/cmdline'))
+      self.assertEqual(BOOT_CMDLINE1, output_zip.read('BOOT/cmdline').decode())
 
     # Test with the second certificate.
     cert_file = os.path.join(self.testdata_dir, 'testkey.x509.pem')
@@ -146,7 +186,7 @@
       ReplaceVerityKeyId(input_zip, output_zip, cert_file)
 
     with zipfile.ZipFile(output_file) as output_zip:
-      self.assertEqual(BOOT_CMDLINE2, output_zip.read('BOOT/cmdline'))
+      self.assertEqual(BOOT_CMDLINE2, output_zip.read('BOOT/cmdline').decode())
 
   def test_ReplaceVerityKeyId_no_veritykeyid(self):
     BOOT_CMDLINE = (
@@ -164,7 +204,7 @@
       ReplaceVerityKeyId(input_zip, output_zip, None)
 
     with zipfile.ZipFile(output_file) as output_zip:
-      self.assertEqual(BOOT_CMDLINE, output_zip.read('BOOT/cmdline'))
+      self.assertEqual(BOOT_CMDLINE, output_zip.read('BOOT/cmdline').decode())
 
   def test_ReplaceCerts(self):
     cert1_path = os.path.join(self.testdata_dir, 'platform.x509.pem')
@@ -236,6 +276,22 @@
     }
     self.assertEqual(output_xml, ReplaceCerts(input_xml))
 
+  def test_WriteOtacerts(self):
+    certs = [
+        os.path.join(self.testdata_dir, 'platform.x509.pem'),
+        os.path.join(self.testdata_dir, 'media.x509.pem'),
+        os.path.join(self.testdata_dir, 'testkey.x509.pem'),
+    ]
+    entry_name = 'SYSTEM/etc/security/otacerts.zip'
+    output_file = common.MakeTempFile(suffix='.zip')
+    with zipfile.ZipFile(output_file, 'w') as output_zip:
+      WriteOtacerts(output_zip, entry_name, certs)
+    with zipfile.ZipFile(output_file) as input_zip:
+      self.assertIn(entry_name, input_zip.namelist())
+      otacerts_file = io.BytesIO(input_zip.read(entry_name))
+      with zipfile.ZipFile(otacerts_file) as otacerts_zip:
+        self.assertEqual(3, len(otacerts_zip.namelist()))
+
   def test_CheckApkAndApexKeysAvailable(self):
     input_file = common.MakeTempFile(suffix='.zip')
     with zipfile.ZipFile(input_file, 'w') as input_zip:
@@ -419,10 +475,10 @@
     self.assertEqual({
         'apex.apexd_test.apex': (
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem',
-            'build/target/product/security/testkey'),
+            'build/make/target/product/security/testkey'),
         'apex.apexd_test_different_app.apex': (
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem',
-            'build/target/product/security/testkey'),
+            'build/make/target/product/security/testkey'),
         }, keys_info)
 
   def test_ReadApexKeysInfo_mismatchingContainerKeys(self):
@@ -431,8 +487,9 @@
         'name="apex.apexd_test_different_app2.apex" '
         'public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" '
         'private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" '
-        'container_certificate="build/target/product/security/testkey.x509.pem" '
-        'container_private_key="build/target/product/security/testkey2.pk8"')
+        'container_certificate="build/make/target/product/security/testkey.x509.pem" '
+        'container_private_key="build/make/target/product/security/testkey2.pk8" '
+        'partition="system"')
     target_files = common.MakeTempFile(suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
@@ -445,8 +502,8 @@
     apex_keys = self.APEX_KEYS_TXT + (
         'name="apex.apexd_test_different_app2.apex" '
         'public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" '
-        'container_certificate="build/target/product/security/testkey.x509.pem" '
-        'container_private_key="build/target/product/security/testkey.pk8"')
+        'container_certificate="build/make/target/product/security/testkey.x509.pem" '
+        'container_private_key="build/make/target/product/security/testkey.pk8"')
     target_files = common.MakeTempFile(suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
@@ -457,10 +514,10 @@
     self.assertEqual({
         'apex.apexd_test.apex': (
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem',
-            'build/target/product/security/testkey'),
+            'build/make/target/product/security/testkey'),
         'apex.apexd_test_different_app.apex': (
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem',
-            'build/target/product/security/testkey'),
+            'build/make/target/product/security/testkey'),
         }, keys_info)
 
   def test_ReadApexKeysInfo_missingPayloadPublicKey(self):
@@ -468,8 +525,8 @@
     apex_keys = self.APEX_KEYS_TXT + (
         'name="apex.apexd_test_different_app2.apex" '
         'private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" '
-        'container_certificate="build/target/product/security/testkey.x509.pem" '
-        'container_private_key="build/target/product/security/testkey.pk8"')
+        'container_certificate="build/make/target/product/security/testkey.x509.pem" '
+        'container_private_key="build/make/target/product/security/testkey.pk8"')
     target_files = common.MakeTempFile(suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
@@ -480,10 +537,33 @@
     self.assertEqual({
         'apex.apexd_test.apex': (
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem',
-            'build/target/product/security/testkey'),
+            'build/make/target/product/security/testkey'),
         'apex.apexd_test_different_app.apex': (
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem',
-            'build/target/product/security/testkey'),
+            'build/make/target/product/security/testkey'),
+        }, keys_info)
+
+  def test_ReadApexKeysInfo_presignedKeys(self):
+    apex_keys = self.APEX_KEYS_TXT + (
+        'name="apex.apexd_test_different_app2.apex" '
+        'private_key="PRESIGNED" '
+        'public_key="PRESIGNED" '
+        'container_certificate="PRESIGNED" '
+        'container_private_key="PRESIGNED"')
+    target_files = common.MakeTempFile(suffix='.zip')
+    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+      target_files_zip.writestr('META/apexkeys.txt', apex_keys)
+
+    with zipfile.ZipFile(target_files) as target_files_zip:
+      keys_info = ReadApexKeysInfo(target_files_zip)
+
+    self.assertEqual({
+        'apex.apexd_test.apex': (
+            'system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem',
+            'build/make/target/product/security/testkey'),
+        'apex.apexd_test_different_app.apex': (
+            'system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem',
+            'build/make/target/product/security/testkey'),
         }, keys_info)
 
   def test_ReadApexKeysInfo_presignedKeys(self):
diff --git a/tools/releasetools/test_utils.py b/tools/releasetools/test_utils.py
old mode 100644
new mode 100755
index edb3d41..e999757
--- a/tools/releasetools/test_utils.py
+++ b/tools/releasetools/test_utils.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python
 #
 # Copyright (C) 2018 The Android Open Source Project
 #
@@ -30,6 +31,21 @@
 # Some test runner doesn't like outputs from stderr.
 logging.basicConfig(stream=sys.stdout)
 
+# Use ANDROID_BUILD_TOP as an indicator to tell if the needed tools (e.g.
+# avbtool, mke2fs) are available while running the tests, unless
+# FORCE_RUN_RELEASETOOLS is set to '1'. Not having the required vars means we
+# can't run the tests that require external tools.
+EXTERNAL_TOOLS_UNAVAILABLE = (
+    not os.environ.get('ANDROID_BUILD_TOP') and
+    os.environ.get('FORCE_RUN_RELEASETOOLS') != '1')
+
+
+def SkipIfExternalToolsUnavailable():
+  """Decorator function that allows skipping tests per tools availability."""
+  if EXTERNAL_TOOLS_UNAVAILABLE:
+    return unittest.skip('External tools unavailable')
+  return lambda func: func
+
 
 def get_testdata_dir():
   """Returns the testdata dir, in relative to the script dir."""
@@ -40,6 +56,19 @@
 
 def get_search_path():
   """Returns the search path that has 'framework/signapk.jar' under."""
+
+  def signapk_exists(path):
+    signapk_path = os.path.realpath(
+        os.path.join(path, 'framework', 'signapk.jar'))
+    return os.path.exists(signapk_path)
+
+  # Try with ANDROID_BUILD_TOP first.
+  full_path = os.path.realpath(os.path.join(
+      os.environ.get('ANDROID_BUILD_TOP', ''), 'out', 'host', 'linux-x86'))
+  if signapk_exists(full_path):
+    return full_path
+
+  # Otherwise try going with relative pathes.
   current_dir = os.path.dirname(os.path.realpath(__file__))
   for path in (
       # In relative to 'build/make/tools/releasetools' in the Android source.
@@ -47,9 +76,7 @@
       # Or running the script unpacked from otatools.zip.
       ['..']):
     full_path = os.path.realpath(os.path.join(current_dir, *path))
-    signapk_path = os.path.realpath(
-        os.path.join(full_path, 'framework', 'signapk.jar'))
-    if os.path.exists(signapk_path):
+    if signapk_exists(full_path):
       return full_path
   return None
 
@@ -118,8 +145,56 @@
   return sparse_image
 
 
+class MockScriptWriter(object):
+  """A class that mocks edify_generator.EdifyGenerator.
+
+  It simply pushes the incoming arguments onto script stack, which is to assert
+  the calls to EdifyGenerator functions.
+  """
+
+  def __init__(self, enable_comments=False):
+    self.lines = []
+    self.enable_comments = enable_comments
+
+  def Mount(self, *args):
+    self.lines.append(('Mount',) + args)
+
+  def AssertDevice(self, *args):
+    self.lines.append(('AssertDevice',) + args)
+
+  def AssertOemProperty(self, *args):
+    self.lines.append(('AssertOemProperty',) + args)
+
+  def AssertFingerprintOrThumbprint(self, *args):
+    self.lines.append(('AssertFingerprintOrThumbprint',) + args)
+
+  def AssertSomeFingerprint(self, *args):
+    self.lines.append(('AssertSomeFingerprint',) + args)
+
+  def AssertSomeThumbprint(self, *args):
+    self.lines.append(('AssertSomeThumbprint',) + args)
+
+  def Comment(self, comment):
+    if not self.enable_comments:
+      return
+    self.lines.append('# {}'.format(comment))
+
+  def AppendExtra(self, extra):
+    self.lines.append(extra)
+
+  def __str__(self):
+    return '\n'.join(self.lines)
+
+
 class ReleaseToolsTestCase(unittest.TestCase):
   """A common base class for all the releasetools unittests."""
 
   def tearDown(self):
     common.Cleanup()
+
+
+if __name__ == '__main__':
+  testsuite = unittest.TestLoader().discover(
+      os.path.dirname(os.path.realpath(__file__)))
+  # atest needs a verbosity level of >= 2 to correctly parse the result.
+  unittest.TextTestRunner(verbosity=2).run(testsuite)
diff --git a/tools/releasetools/test_validate_target_files.py b/tools/releasetools/test_validate_target_files.py
index 5f619ec..6504515 100644
--- a/tools/releasetools/test_validate_target_files.py
+++ b/tools/releasetools/test_validate_target_files.py
@@ -55,6 +55,7 @@
         0, proc.returncode,
         "Failed to sign boot image with boot_signer: {}".format(stdoutdata))
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ValidateVerifiedBootImages_bootImage(self):
     input_tmp = common.MakeTempDir()
     os.mkdir(os.path.join(input_tmp, 'IMAGES'))
@@ -69,6 +70,7 @@
     }
     ValidateVerifiedBootImages(input_tmp, info_dict, options)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ValidateVerifiedBootImages_bootImage_wrongKey(self):
     input_tmp = common.MakeTempDir()
     os.mkdir(os.path.join(input_tmp, 'IMAGES'))
@@ -85,6 +87,7 @@
         AssertionError, ValidateVerifiedBootImages, input_tmp, info_dict,
         options)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ValidateVerifiedBootImages_bootImage_corrupted(self):
     input_tmp = common.MakeTempDir()
     os.mkdir(os.path.join(input_tmp, 'IMAGES'))
@@ -95,7 +98,7 @@
     with open(boot_image, 'r+b') as boot_fp:
       boot_fp.seek(-1, os.SEEK_END)
       last_byte = boot_fp.read(1)
-      last_byte = chr(255 - ord(last_byte))
+      last_byte = bytes([255 - ord(last_byte)])
       boot_fp.seek(-1, os.SEEK_END)
       boot_fp.write(last_byte)
 
@@ -139,21 +142,53 @@
     # Append the verity metadata.
     verity_image_builder.Build(output_file)
 
-  def test_ValidateVerifiedBootImages_systemImage(self):
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ValidateVerifiedBootImages_systemRootImage(self):
     input_tmp = common.MakeTempDir()
     os.mkdir(os.path.join(input_tmp, 'IMAGES'))
     system_image = os.path.join(input_tmp, 'IMAGES', 'system.img')
     self._generate_system_image(system_image)
 
     # Pack the verity key.
-    verity_key_mincrypt = os.path.join(
-        input_tmp, 'BOOT', 'RAMDISK', 'verity_key')
+    verity_key_mincrypt = os.path.join(input_tmp, 'ROOT', 'verity_key')
     os.makedirs(os.path.dirname(verity_key_mincrypt))
     shutil.copyfile(
         os.path.join(self.testdata_dir, 'testkey_mincrypt'),
         verity_key_mincrypt)
 
     info_dict = {
+        'system_root_image' : 'true',
+        'verity' : 'true',
+    }
+    options = {
+        'verity_key' : os.path.join(self.testdata_dir, 'testkey.x509.pem'),
+        'verity_key_mincrypt' : verity_key_mincrypt,
+    }
+    ValidateVerifiedBootImages(input_tmp, info_dict, options)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ValidateVerifiedBootImages_nonSystemRootImage(self):
+    input_tmp = common.MakeTempDir()
+    os.mkdir(os.path.join(input_tmp, 'IMAGES'))
+    system_image = os.path.join(input_tmp, 'IMAGES', 'system.img')
+    self._generate_system_image(system_image)
+
+    # Pack the verity key into the root dir in system.img.
+    verity_key_mincrypt = os.path.join(input_tmp, 'ROOT', 'verity_key')
+    os.makedirs(os.path.dirname(verity_key_mincrypt))
+    shutil.copyfile(
+        os.path.join(self.testdata_dir, 'testkey_mincrypt'),
+        verity_key_mincrypt)
+
+    # And a copy in ramdisk.
+    verity_key_ramdisk = os.path.join(
+        input_tmp, 'BOOT', 'RAMDISK', 'verity_key')
+    os.makedirs(os.path.dirname(verity_key_ramdisk))
+    shutil.copyfile(
+        os.path.join(self.testdata_dir, 'testkey_mincrypt'),
+        verity_key_ramdisk)
+
+    info_dict = {
         'verity' : 'true',
     }
     options = {
@@ -162,6 +197,40 @@
     }
     ValidateVerifiedBootImages(input_tmp, info_dict, options)
 
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ValidateVerifiedBootImages_nonSystemRootImage_mismatchingKeys(self):
+    input_tmp = common.MakeTempDir()
+    os.mkdir(os.path.join(input_tmp, 'IMAGES'))
+    system_image = os.path.join(input_tmp, 'IMAGES', 'system.img')
+    self._generate_system_image(system_image)
+
+    # Pack the verity key into the root dir in system.img.
+    verity_key_mincrypt = os.path.join(input_tmp, 'ROOT', 'verity_key')
+    os.makedirs(os.path.dirname(verity_key_mincrypt))
+    shutil.copyfile(
+        os.path.join(self.testdata_dir, 'testkey_mincrypt'),
+        verity_key_mincrypt)
+
+    # And an invalid copy in ramdisk.
+    verity_key_ramdisk = os.path.join(
+        input_tmp, 'BOOT', 'RAMDISK', 'verity_key')
+    os.makedirs(os.path.dirname(verity_key_ramdisk))
+    shutil.copyfile(
+        os.path.join(self.testdata_dir, 'verity_mincrypt'),
+        verity_key_ramdisk)
+
+    info_dict = {
+        'verity' : 'true',
+    }
+    options = {
+        'verity_key' : os.path.join(self.testdata_dir, 'testkey.x509.pem'),
+        'verity_key_mincrypt' : verity_key_mincrypt,
+    }
+    self.assertRaises(
+        AssertionError, ValidateVerifiedBootImages, input_tmp, info_dict,
+        options)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
   def test_ValidateFileConsistency_incompleteRange(self):
     input_tmp = common.MakeTempDir()
     os.mkdir(os.path.join(input_tmp, 'IMAGES'))
@@ -169,14 +238,14 @@
     system_root = os.path.join(input_tmp, "SYSTEM")
     os.mkdir(system_root)
 
-    # Write the test file that contain multiple blocks of zeros, and these
-    # zero blocks will be omitted by kernel. And the test files will occupy one
-    # block range each in the final system image.
+    # Write test files that contain multiple blocks of zeros, and these zero
+    # blocks will be omitted by kernel. Each test file will occupy one block in
+    # the final system image.
     with open(os.path.join(system_root, 'a'), 'w') as f:
-      f.write("aaa")
+      f.write('aaa')
       f.write('\0' * 4096 * 3)
     with open(os.path.join(system_root, 'b'), 'w') as f:
-      f.write("bbb")
+      f.write('bbb')
       f.write('\0' * 4096 * 3)
 
     raw_file_map = os.path.join(input_tmp, 'IMAGES', 'raw_system.map')
@@ -185,7 +254,7 @@
     # Parse the generated file map and update the block ranges for each file.
     file_map_list = {}
     image_ranges = RangeSet()
-    with open(raw_file_map, 'r') as f:
+    with open(raw_file_map) as f:
       for line in f.readlines():
         info = line.split()
         self.assertEqual(2, len(info))
@@ -196,7 +265,7 @@
     mock_shared_block = RangeSet("10-20").subtract(image_ranges).first(1)
     with open(os.path.join(input_tmp, 'IMAGES', 'system.map'), 'w') as f:
       for key in sorted(file_map_list.keys()):
-        line = "{} {}\n".format(
+        line = '{} {}\n'.format(
             key, file_map_list[key].union(mock_shared_block))
         f.write(line)
 
@@ -208,9 +277,55 @@
       for name in all_entries:
         input_zip.write(os.path.join(input_tmp, name), arcname=name)
 
-    input_zip = zipfile.ZipFile(input_file, 'r')
-    info_dict = {'extfs_sparse_flag': '-s'}
-
     # Expect the validation to pass and both files are skipped due to
     # 'incomplete' block range.
-    ValidateFileConsistency(input_zip, input_tmp, info_dict)
+    with zipfile.ZipFile(input_file) as input_zip:
+      info_dict = {'extfs_sparse_flag': '-s'}
+      ValidateFileConsistency(input_zip, input_tmp, info_dict)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ValidateFileConsistency_nonMonotonicRanges(self):
+    input_tmp = common.MakeTempDir()
+    os.mkdir(os.path.join(input_tmp, 'IMAGES'))
+    system_image = os.path.join(input_tmp, 'IMAGES', 'system.img')
+    system_root = os.path.join(input_tmp, "SYSTEM")
+    os.mkdir(system_root)
+
+    # Write the test file that contain three blocks of 'a', 'b', 'c'.
+    with open(os.path.join(system_root, 'abc'), 'w') as f:
+      f.write('a' * 4096 + 'b' * 4096 + 'c' * 4096)
+    raw_file_map = os.path.join(input_tmp, 'IMAGES', 'raw_system.map')
+    self._generate_system_image(system_image, system_root, raw_file_map)
+
+    # Parse the generated file map and manipulate the block ranges of 'abc' to
+    # be 'cba'.
+    file_map_list = {}
+    with open(raw_file_map) as f:
+      for line in f.readlines():
+        info = line.split()
+        self.assertEqual(2, len(info))
+        ranges = RangeSet(info[1])
+        self.assertTrue(ranges.monotonic)
+        blocks = reversed(list(ranges.next_item()))
+        file_map_list[info[0]] = ' '.join([str(block) for block in blocks])
+
+    # Update the contents of 'abc' to be 'cba'.
+    with open(os.path.join(system_root, 'abc'), 'w') as f:
+      f.write('c' * 4096 + 'b' * 4096 + 'a' * 4096)
+
+    # Update the system.map.
+    with open(os.path.join(input_tmp, 'IMAGES', 'system.map'), 'w') as f:
+      for key in sorted(file_map_list.keys()):
+        f.write('{} {}\n'.format(key, file_map_list[key]))
+
+    # Get the target zip file.
+    input_file = common.MakeTempFile()
+    all_entries = ['SYSTEM/', 'SYSTEM/abc', 'IMAGES/',
+                   'IMAGES/system.map', 'IMAGES/system.img']
+    with zipfile.ZipFile(input_file, 'w') as input_zip:
+      for name in all_entries:
+        input_zip.write(os.path.join(input_tmp, name), arcname=name)
+
+    with zipfile.ZipFile(input_file) as input_zip:
+      info_dict = {'extfs_sparse_flag': '-s'}
+      ValidateFileConsistency(input_zip, input_tmp, info_dict)
diff --git a/tools/releasetools/test_verity_utils.py b/tools/releasetools/test_verity_utils.py
index e0607c8..d02bc7f 100644
--- a/tools/releasetools/test_verity_utils.py
+++ b/tools/releasetools/test_verity_utils.py
@@ -24,7 +24,8 @@
 import common
 import sparse_img
 from rangelib import RangeSet
-from test_utils import get_testdata_dir, ReleaseToolsTestCase
+from test_utils import (
+    get_testdata_dir, ReleaseToolsTestCase, SkipIfExternalToolsUnavailable)
 from verity_utils import (
     CreateHashtreeInfoGenerator, CreateVerityImageBuilder, HashtreeInfo,
     VerifiedBootVersion1HashtreeInfoGenerator)
@@ -46,25 +47,22 @@
     }
 
     self.hash_algorithm = "sha256"
-    self.fixed_salt = \
-        "aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7"
-    self.expected_root_hash = \
-        "0b7c4565e87b1026e11fbab91c0bc29e185c847a5b44d40e6e86e461e8adf80d"
+    self.fixed_salt = (
+        "aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7")
+    self.expected_root_hash = (
+        "0b7c4565e87b1026e11fbab91c0bc29e185c847a5b44d40e6e86e461e8adf80d")
 
-  def _create_simg(self, raw_data):
+  def _CreateSimg(self, raw_data):  # pylint: disable=no-self-use
     output_file = common.MakeTempFile()
     raw_image = common.MakeTempFile()
     with open(raw_image, 'wb') as f:
       f.write(raw_data)
 
     cmd = ["img2simg", raw_image, output_file, '4096']
-    p = common.Run(cmd)
-    p.communicate()
-    self.assertEqual(0, p.returncode)
-
+    common.RunAndCheckOutput(cmd)
     return output_file
 
-  def _generate_image(self):
+  def _GenerateImage(self):
     partition_size = 1024 * 1024
     prop_dict = {
         'partition_size': str(partition_size),
@@ -78,19 +76,20 @@
     self.assertIsNotNone(verity_image_builder)
     adjusted_size = verity_image_builder.CalculateMaxImageSize()
 
-    raw_image = ""
+    raw_image = bytearray(adjusted_size)
     for i in range(adjusted_size):
-      raw_image += str(i % 10)
+      raw_image[i] = ord('0') + i % 10
 
-    output_file = self._create_simg(raw_image)
+    output_file = self._CreateSimg(raw_image)
 
     # Append the verity metadata.
     verity_image_builder.Build(output_file)
 
     return output_file
 
+  @SkipIfExternalToolsUnavailable()
   def test_CreateHashtreeInfoGenerator(self):
-    image_file = sparse_img.SparseImage(self._generate_image())
+    image_file = sparse_img.SparseImage(self._GenerateImage())
 
     generator = CreateHashtreeInfoGenerator(
         'system', image_file, self.prop_dict)
@@ -99,8 +98,9 @@
     self.assertEqual(self.partition_size, generator.partition_size)
     self.assertTrue(generator.fec_supported)
 
+  @SkipIfExternalToolsUnavailable()
   def test_DecomposeSparseImage(self):
-    image_file = sparse_img.SparseImage(self._generate_image())
+    image_file = sparse_img.SparseImage(self._GenerateImage())
 
     generator = VerifiedBootVersion1HashtreeInfoGenerator(
         self.partition_size, 4096, True)
@@ -109,8 +109,9 @@
     self.assertEqual(12288, generator.hashtree_size)
     self.assertEqual(32768, generator.metadata_size)
 
+  @SkipIfExternalToolsUnavailable()
   def test_ParseHashtreeMetadata(self):
-    image_file = sparse_img.SparseImage(self._generate_image())
+    image_file = sparse_img.SparseImage(self._GenerateImage())
     generator = VerifiedBootVersion1HashtreeInfoGenerator(
         self.partition_size, 4096, True)
     generator.DecomposeSparseImage(image_file)
@@ -123,43 +124,46 @@
     self.assertEqual(self.fixed_salt, generator.hashtree_info.salt)
     self.assertEqual(self.expected_root_hash, generator.hashtree_info.root_hash)
 
+  @SkipIfExternalToolsUnavailable()
   def test_ValidateHashtree_smoke(self):
     generator = VerifiedBootVersion1HashtreeInfoGenerator(
         self.partition_size, 4096, True)
-    generator.image = sparse_img.SparseImage(self._generate_image())
+    generator.image = sparse_img.SparseImage(self._GenerateImage())
 
     generator.hashtree_info = info = HashtreeInfo()
-    info.filesystem_range = RangeSet(data=[0, 991232 / 4096])
+    info.filesystem_range = RangeSet(data=[0, 991232 // 4096])
     info.hashtree_range = RangeSet(
-        data=[991232 / 4096, (991232 + 12288) / 4096])
+        data=[991232 // 4096, (991232 + 12288) // 4096])
     info.hash_algorithm = self.hash_algorithm
     info.salt = self.fixed_salt
     info.root_hash = self.expected_root_hash
 
     self.assertTrue(generator.ValidateHashtree())
 
+  @SkipIfExternalToolsUnavailable()
   def test_ValidateHashtree_failure(self):
     generator = VerifiedBootVersion1HashtreeInfoGenerator(
         self.partition_size, 4096, True)
-    generator.image = sparse_img.SparseImage(self._generate_image())
+    generator.image = sparse_img.SparseImage(self._GenerateImage())
 
     generator.hashtree_info = info = HashtreeInfo()
-    info.filesystem_range = RangeSet(data=[0, 991232 / 4096])
+    info.filesystem_range = RangeSet(data=[0, 991232 // 4096])
     info.hashtree_range = RangeSet(
-        data=[991232 / 4096, (991232 + 12288) / 4096])
+        data=[991232 // 4096, (991232 + 12288) // 4096])
     info.hash_algorithm = self.hash_algorithm
     info.salt = self.fixed_salt
     info.root_hash = "a" + self.expected_root_hash[1:]
 
     self.assertFalse(generator.ValidateHashtree())
 
+  @SkipIfExternalToolsUnavailable()
   def test_Generate(self):
-    image_file = sparse_img.SparseImage(self._generate_image())
+    image_file = sparse_img.SparseImage(self._GenerateImage())
     generator = CreateHashtreeInfoGenerator('system', 4096, self.prop_dict)
     info = generator.Generate(image_file)
 
-    self.assertEqual(RangeSet(data=[0, 991232 / 4096]), info.filesystem_range)
-    self.assertEqual(RangeSet(data=[991232 / 4096, (991232 + 12288) / 4096]),
+    self.assertEqual(RangeSet(data=[0, 991232 // 4096]), info.filesystem_range)
+    self.assertEqual(RangeSet(data=[991232 // 4096, (991232 + 12288) // 4096]),
                      info.hashtree_range)
     self.assertEqual(self.hash_algorithm, info.hash_algorithm)
     self.assertEqual(self.fixed_salt, info.salt)
@@ -193,6 +197,7 @@
     del prop_dict['verity_block_device']
     self.assertIsNone(CreateVerityImageBuilder(prop_dict))
 
+  @SkipIfExternalToolsUnavailable()
   def test_CalculateMaxImageSize(self):
     verity_image_builder = CreateVerityImageBuilder(self.DEFAULT_PROP_DICT)
     size = verity_image_builder.CalculateMaxImageSize()
@@ -221,11 +226,13 @@
     cmd = ['verity_verifier', image, '-mincrypt', verify_key]
     common.RunAndCheckOutput(cmd)
 
+  @SkipIfExternalToolsUnavailable()
   def test_Build(self):
     self._BuildAndVerify(
         self.DEFAULT_PROP_DICT,
         os.path.join(get_testdata_dir(), 'testkey_mincrypt'))
 
+  @SkipIfExternalToolsUnavailable()
   def test_Build_SanityCheck(self):
     # A sanity check for the test itself: the image shouldn't be verifiable
     # with wrong key.
@@ -235,6 +242,7 @@
         self.DEFAULT_PROP_DICT,
         os.path.join(get_testdata_dir(), 'verity_mincrypt'))
 
+  @SkipIfExternalToolsUnavailable()
   def test_Build_FecDisabled(self):
     prop_dict = copy.deepcopy(self.DEFAULT_PROP_DICT)
     del prop_dict['verity_fec']
@@ -242,6 +250,7 @@
         prop_dict,
         os.path.join(get_testdata_dir(), 'testkey_mincrypt'))
 
+  @SkipIfExternalToolsUnavailable()
   def test_Build_SquashFs(self):
     verity_image_builder = CreateVerityImageBuilder(self.DEFAULT_PROP_DICT)
     verity_image_builder.CalculateMaxImageSize()
@@ -282,6 +291,7 @@
     verity_image_builder = CreateVerityImageBuilder(prop_dict)
     self.assertIsNone(verity_image_builder)
 
+  @SkipIfExternalToolsUnavailable()
   def test_Build(self):
     prop_dict = copy.deepcopy(self.DEFAULT_PROP_DICT)
     verity_image_builder = CreateVerityImageBuilder(prop_dict)
diff --git a/tools/releasetools/testdata/apexkeys_framework.txt b/tools/releasetools/testdata/apexkeys_framework.txt
new file mode 100644
index 0000000..b9caf9e
--- /dev/null
+++ b/tools/releasetools/testdata/apexkeys_framework.txt
@@ -0,0 +1,7 @@
+name="com.android.conscrypt.apex" public_key="external/conscrypt/apex/com.android.conscrypt.avbpubkey" private_key="external/conscrypt/apex/com.android.conscrypt.pem" container_certificate="external/conscrypt/apex/com.android.conscrypt.x509.pem" container_private_key="external/conscrypt/apex/com.android.conscrypt.pk8" partition="system"
+name="com.android.dummy_product.apex" public_key="selected" private_key="selected" container_certificate="selected" container_private_key="selected" partition="product"
+name="com.android.runtime.apex" public_key="bionic/apex/com.android.runtime.avbpubkey" private_key="bionic/apex/com.android.runtime.pem" container_certificate="bionic/apex/com.android.runtime.x509.pem" container_private_key="bionic/apex/com.android.runtime.pk8" partition="system"
+name="com.android.vndk.current.on_vendor.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="vendor"
+name="com.android.vndk.v27.apex" public_key="packages/modules/vndk/apex/com.android.vndk.v27.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.v27.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.v27.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.v27.pk8" partition="system_ext"
+name="com.android.vndk.v28.apex" public_key="packages/modules/vndk/apex/com.android.vndk.v28.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.v28.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.v28.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.v28.pk8" partition="system_ext"
+name="com.android.vndk.v29.apex" public_key="packages/modules/vndk/apex/com.android.vndk.v29.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.v29.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.v29.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.v29.pk8" partition="system_ext"
diff --git a/tools/releasetools/testdata/apexkeys_framework_conflict.txt b/tools/releasetools/testdata/apexkeys_framework_conflict.txt
new file mode 100644
index 0000000..9a055f4
--- /dev/null
+++ b/tools/releasetools/testdata/apexkeys_framework_conflict.txt
@@ -0,0 +1 @@
+name="com.android.conscrypt.apex" public_key="external/conscrypt/apex/com.android.conscrypt.avbpubkey" private_key="external/conscrypt/apex/com.android.conscrypt.pem" container_certificate="external/conscrypt/apex/com.android.conscrypt.x509.pem" container_private_key="external/conscrypt/apex/com.android.conscrypt.pk8" partition="vendor"
diff --git a/tools/releasetools/testdata/apexkeys_merge.txt b/tools/releasetools/testdata/apexkeys_merge.txt
new file mode 100644
index 0000000..a9355d7
--- /dev/null
+++ b/tools/releasetools/testdata/apexkeys_merge.txt
@@ -0,0 +1,7 @@
+name="com.android.conscrypt.apex" public_key="external/conscrypt/apex/com.android.conscrypt.avbpubkey" private_key="external/conscrypt/apex/com.android.conscrypt.pem" container_certificate="external/conscrypt/apex/com.android.conscrypt.x509.pem" container_private_key="external/conscrypt/apex/com.android.conscrypt.pk8" partition="system"
+name="com.android.dummy_product.apex" public_key="selected" private_key="selected" container_certificate="selected" container_private_key="selected" partition="product"
+name="com.android.runtime.apex" public_key="bionic/apex/com.android.runtime.avbpubkey" private_key="bionic/apex/com.android.runtime.pem" container_certificate="bionic/apex/com.android.runtime.x509.pem" container_private_key="bionic/apex/com.android.runtime.pk8" partition="system"
+name="com.android.vndk.current.on_vendor.apex" public_key="packages/modules/vndk/apex/com.android.vndk.current.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.current.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.current.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.current.pk8" partition="vendor"
+name="com.android.vndk.v27.apex" public_key="packages/modules/vndk/apex/com.android.vndk.v27.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.v27.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.v27.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.v27.pk8" partition="system_ext"
+name="com.android.vndk.v28.apex" public_key="packages/modules/vndk/apex/com.android.vndk.v28.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.v28.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.v28.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.v28.pk8" partition="system_ext"
+name="com.android.vndk.v29.apex" public_key="packages/modules/vndk/apex/com.android.vndk.v29.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.v29.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.v29.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.v29.pk8" partition="system_ext"
diff --git a/tools/releasetools/testdata/apexkeys_vendor.txt b/tools/releasetools/testdata/apexkeys_vendor.txt
new file mode 100644
index 0000000..7dd3964
--- /dev/null
+++ b/tools/releasetools/testdata/apexkeys_vendor.txt
@@ -0,0 +1,7 @@
+name="com.android.conscrypt.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="system"
+name="com.android.dummy_product.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="product"
+name="com.android.runtime.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="system"
+name="com.android.vndk.current.on_vendor.apex" public_key="packages/modules/vndk/apex/com.android.vndk.current.pubkey" private_key="packages/modules/vndk/apex/com.android.vndk.current.pem" container_certificate="packages/modules/vndk/apex/com.android.vndk.current.x509.pem" container_private_key="packages/modules/vndk/apex/com.android.vndk.current.pk8" partition="vendor"
+name="com.android.vndk.v27.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="system_ext"
+name="com.android.vndk.v28.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="system_ext"
+name="com.android.vndk.v29.apex" public_key="not_selected" private_key="not_selected" container_certificate="not_selected" container_private_key="not_selected" partition="system_ext"
diff --git a/tools/releasetools/testdata/apkcerts_framework.txt b/tools/releasetools/testdata/apkcerts_framework.txt
new file mode 100644
index 0000000..a75f55c
--- /dev/null
+++ b/tools/releasetools/testdata/apkcerts_framework.txt
@@ -0,0 +1,6 @@
+name="TestSystem1.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="system"
+name="TestSystem2.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="system"
+name="TestVendor.apk" certificate="not_selected" private_key="not_selected" partition="vendor"
+name="TestOdm.apk" certificate="not_selected" private_key="not_selected" partition="odm"
+name="TestProduct.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="product"
+name="TestSystemExt.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="system_ext"
diff --git a/tools/releasetools/testdata/apkcerts_merge.txt b/tools/releasetools/testdata/apkcerts_merge.txt
new file mode 100644
index 0000000..0425e96
--- /dev/null
+++ b/tools/releasetools/testdata/apkcerts_merge.txt
@@ -0,0 +1,6 @@
+name="TestOdm.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="odm"
+name="TestProduct.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="product"
+name="TestSystem1.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="system"
+name="TestSystem2.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="system"
+name="TestSystemExt.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="system_ext"
+name="TestVendor.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="vendor"
diff --git a/tools/releasetools/testdata/apkcerts_vendor.txt b/tools/releasetools/testdata/apkcerts_vendor.txt
new file mode 100644
index 0000000..13d5255
--- /dev/null
+++ b/tools/releasetools/testdata/apkcerts_vendor.txt
@@ -0,0 +1,6 @@
+name="TestSystem1.apk" certificate="not_selected" private_key="not_selected" partition="system"
+name="TestSystem2.apk" certificate="not_selected" private_key="not_selected" partition="system"
+name="TestVendor.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="vendor"
+name="TestOdm.apk" certificate="build/make/target/product/security/testkey.x509.pem" private_key="build/make/target/product/security/testkey.pk8" partition="odm"
+name="TestProduct.apk" certificate="not_selected" private_key="not_selected" partition="product"
+name="TestSystemExt.apk" certificate="not_selected" private_key="not_selected" partition="system_ext"
diff --git a/tools/releasetools/testdata/foo.apex b/tools/releasetools/testdata/foo.apex
new file mode 100644
index 0000000..42e0adb
--- /dev/null
+++ b/tools/releasetools/testdata/foo.apex
Binary files differ
diff --git a/tools/releasetools/testdata/has_apk.apex b/tools/releasetools/testdata/has_apk.apex
new file mode 100644
index 0000000..12bbdf9
--- /dev/null
+++ b/tools/releasetools/testdata/has_apk.apex
Binary files differ
diff --git a/tools/releasetools/testdata/merge_config_system_item_list b/tools/releasetools/testdata/merge_config_framework_item_list
similarity index 100%
rename from tools/releasetools/testdata/merge_config_system_item_list
rename to tools/releasetools/testdata/merge_config_framework_item_list
diff --git a/tools/releasetools/testdata/testkey_EC.key b/tools/releasetools/testdata/testkey_EC.key
new file mode 100644
index 0000000..9e65a68
--- /dev/null
+++ b/tools/releasetools/testdata/testkey_EC.key
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgGaguGj8Yb1KkqKHd
+ISblUsjtOCbzAuVpX81i02sm8FWhRANCAARBnuotwKOsuvjH6iwTDhOAi7Q5pLWz
+xDkZjg2pcfbfi9FFTvLYETas7B2W6fx9PUezUmHTFTDV2JZuMYYFdZOw
+-----END PRIVATE KEY-----
diff --git a/tools/releasetools/testdata/vintf/kernel/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/kernel/SYSTEM/compatibility_matrix.xml
new file mode 100644
index 0000000..ed46b6b
--- /dev/null
+++ b/tools/releasetools/testdata/vintf/kernel/SYSTEM/compatibility_matrix.xml
@@ -0,0 +1,7 @@
+<compatibility-matrix version="1.0" type="framework">
+    <kernel version="4.14.1" />
+    <sepolicy>
+        <sepolicy-version>0.0</sepolicy-version>
+        <kernel-sepolicy-version>0</kernel-sepolicy-version>
+    </sepolicy>
+</compatibility-matrix>
diff --git a/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/compatibility_matrix.xml
new file mode 100644
index 0000000..5d891fa
--- /dev/null
+++ b/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/compatibility_matrix.xml
@@ -0,0 +1,6 @@
+<compatibility-matrix version="1.0" type="framework">
+    <sepolicy>
+        <sepolicy-version>1.0</sepolicy-version>
+        <kernel-sepolicy-version>0</kernel-sepolicy-version>
+    </sepolicy>
+</compatibility-matrix>
diff --git a/tools/releasetools/testdata/vintf/sku_compat/ODM/etc/vintf/manifest_sku.xml b/tools/releasetools/testdata/vintf/sku_compat/ODM/etc/vintf/manifest_sku.xml
new file mode 100644
index 0000000..bcd7ce4
--- /dev/null
+++ b/tools/releasetools/testdata/vintf/sku_compat/ODM/etc/vintf/manifest_sku.xml
@@ -0,0 +1,7 @@
+<manifest version="1.0" type="device">
+    <hal format="hidl">
+        <name>foo</name>
+        <transport>hwbinder</transport>
+        <fqname>@1.0::IFoo/default</fqname>
+    </hal>
+</manifest>
diff --git a/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/compatibility_matrix.xml
new file mode 100644
index 0000000..19a9b6a
--- /dev/null
+++ b/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/compatibility_matrix.xml
@@ -0,0 +1,14 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="hidl" optional="false">
+        <name>foo</name>
+        <version>1.0</version>
+        <interface>
+            <name>IFoo</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <sepolicy>
+        <sepolicy-version>0.0</sepolicy-version>
+        <kernel-sepolicy-version>0</kernel-sepolicy-version>
+    </sepolicy>
+</compatibility-matrix>
diff --git a/tools/releasetools/testdata/vintf/sku_incompat/ODM/etc/vintf/manifest_sku.xml b/tools/releasetools/testdata/vintf/sku_incompat/ODM/etc/vintf/manifest_sku.xml
new file mode 100644
index 0000000..bcd7ce4
--- /dev/null
+++ b/tools/releasetools/testdata/vintf/sku_incompat/ODM/etc/vintf/manifest_sku.xml
@@ -0,0 +1,7 @@
+<manifest version="1.0" type="device">
+    <hal format="hidl">
+        <name>foo</name>
+        <transport>hwbinder</transport>
+        <fqname>@1.0::IFoo/default</fqname>
+    </hal>
+</manifest>
diff --git a/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/compatibility_matrix.xml
new file mode 100644
index 0000000..e0e0d6c
--- /dev/null
+++ b/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/compatibility_matrix.xml
@@ -0,0 +1,14 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="hidl" optional="false">
+        <name>foo</name>
+        <version>1.1</version>
+        <interface>
+            <name>IFoo</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <sepolicy>
+        <sepolicy-version>0.0</sepolicy-version>
+        <kernel-sepolicy-version>0</kernel-sepolicy-version>
+    </sepolicy>
+</compatibility-matrix>
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 37d5d27..ac469eb 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -36,20 +36,21 @@
 import os.path
 import re
 import zipfile
+from hashlib import sha1
 
 import common
+import rangelib
 
 
 def _ReadFile(file_name, unpacked_name, round_up=False):
   """Constructs and returns a File object. Rounds up its size if needed."""
-
   assert os.path.exists(unpacked_name)
-  with open(unpacked_name, 'r') as f:
+  with open(unpacked_name, 'rb') as f:
     file_data = f.read()
   file_size = len(file_data)
   if round_up:
     file_size_rounded_up = common.RoundUpTo4K(file_size)
-    file_data += '\0' * (file_size_rounded_up - file_size)
+    file_data += b'\0' * (file_size_rounded_up - file_size)
   return common.File(file_name, file_data)
 
 
@@ -96,13 +97,15 @@
         logging.warning('Skipping %s that has incomplete block list', entry)
         continue
 
-      # TODO(b/79951650): Handle files with non-monotonic ranges.
+      # If the file has non-monotonic ranges, read each range in order.
       if not file_ranges.monotonic:
-        logging.warning(
-            'Skipping %s that has non-monotonic ranges: %s', entry, file_ranges)
-        continue
-
-      blocks_sha1 = image.RangeSha1(file_ranges)
+        h = sha1()
+        for file_range in file_ranges.extra['text_str'].split(' '):
+          for data in image.ReadRangeSet(rangelib.RangeSet(file_range)):
+            h.update(data)
+        blocks_sha1 = h.hexdigest()
+      else:
+        blocks_sha1 = image.RangeSha1(file_ranges)
 
       # The filename under unpacked directory, such as SYSTEM/bin/sh.
       unpacked_name = os.path.join(
@@ -138,7 +141,7 @@
   1. full recovery:
   ...
   if ! applypatch --check type:device:size:sha1; then
-    applypatch --flash /system/etc/recovery.img \\
+    applypatch --flash /vendor/etc/recovery.img \\
         type:device:size:sha1 && \\
   ...
 
@@ -146,18 +149,26 @@
   ...
   if ! applypatch --check type:recovery_device:recovery_size:recovery_sha1; then
     applypatch [--bonus bonus_args] \\
-        --patch /system/recovery-from-boot.p \\
+        --patch /vendor/recovery-from-boot.p \\
         --source type:boot_device:boot_size:boot_sha1 \\
         --target type:recovery_device:recovery_size:recovery_sha1 && \\
   ...
 
-  For full recovery, we want to calculate the SHA-1 of /system/etc/recovery.img
+  For full recovery, we want to calculate the SHA-1 of /vendor/etc/recovery.img
   and compare it against the one embedded in the script. While for recovery
   from boot, we want to check the SHA-1 for both recovery.img and boot.img
   under IMAGES/.
   """
 
-  script_path = 'SYSTEM/bin/install-recovery.sh'
+  board_uses_vendorimage = info_dict.get("board_uses_vendorimage") == "true"
+
+  if board_uses_vendorimage:
+    script_path = 'VENDOR/bin/install-recovery.sh'
+    recovery_img = 'VENDOR/etc/recovery.img'
+  else:
+    script_path = 'SYSTEM/vendor/bin/install-recovery.sh'
+    recovery_img = 'SYSTEM/vendor/etc/recovery.img'
+
   if not os.path.exists(os.path.join(input_tmp, script_path)):
     logging.info('%s does not exist in input_tmp', script_path)
     return
@@ -188,7 +199,7 @@
     # Validate the SHA-1 of the recovery image.
     recovery_sha1 = flash_partition.split(':')[3]
     ValidateFileAgainstSha1(
-        input_tmp, 'recovery.img', 'SYSTEM/etc/recovery.img', recovery_sha1)
+        input_tmp, 'recovery.img', recovery_img, recovery_sha1)
   else:
     assert len(lines) == 11, "Invalid line count: {}".format(lines)
 
@@ -257,7 +268,10 @@
     if verity_key is None:
       verity_key = info_dict['verity_key'] + '.x509.pem'
     for image in ('boot.img', 'recovery.img', 'recovery-two-step.img'):
-      image_path = os.path.join(input_tmp, 'IMAGES', image)
+      if image == 'recovery-two-step.img':
+        image_path = os.path.join(input_tmp, 'OTA', image)
+      else:
+        image_path = os.path.join(input_tmp, 'IMAGES', image)
       if not os.path.exists(image_path):
         continue
 
@@ -273,15 +287,12 @@
   # Verify verity signed system images in Verified Boot 1.0. Note that not using
   # 'elif' here, since 'boot_signer' and 'verity' are not bundled in VB 1.0.
   if info_dict.get('verity') == 'true':
-    # First verify that the verity key that's built into the root image (as
-    # /verity_key) matches the one given via command line, if any.
-    if info_dict.get("system_root_image") == "true":
-      verity_key_mincrypt = os.path.join(input_tmp, 'ROOT', 'verity_key')
-    else:
-      verity_key_mincrypt = os.path.join(
-          input_tmp, 'BOOT', 'RAMDISK', 'verity_key')
+    # First verify that the verity key is built into the root image (regardless
+    # of system-as-root).
+    verity_key_mincrypt = os.path.join(input_tmp, 'ROOT', 'verity_key')
     assert os.path.exists(verity_key_mincrypt), 'Missing verity_key'
 
+    # Verify /verity_key matches the one given via command line, if any.
     if options['verity_key_mincrypt'] is None:
       logging.warn(
           'Skipped checking the content of /verity_key, as the key file not '
@@ -292,6 +303,18 @@
           "Mismatching mincrypt verity key files"
       logging.info('Verified the content of /verity_key')
 
+    # For devices with a separate ramdisk (i.e. non-system-as-root), there must
+    # be a copy in ramdisk.
+    if info_dict.get("system_root_image") != "true":
+      verity_key_ramdisk = os.path.join(
+          input_tmp, 'BOOT', 'RAMDISK', 'verity_key')
+      assert os.path.exists(verity_key_ramdisk), 'Missing verity_key in ramdisk'
+
+      assert filecmp.cmp(
+          verity_key_mincrypt, verity_key_ramdisk, shallow=False), \
+              'Mismatching verity_key files in root and ramdisk'
+      logging.info('Verified the content of /verity_key in ramdisk')
+
     # Then verify the verity signed system/vendor/product images, against the
     # verity pubkey in mincrypt format.
     for image in ('system.img', 'vendor.img', 'product.img'):
@@ -323,19 +346,41 @@
       key = info_dict['avb_vbmeta_key_path']
 
     # avbtool verifies all the images that have descriptors listed in vbmeta.
+    # Using `--follow_chain_partitions` so it would additionally verify chained
+    # vbmeta partitions (e.g. vbmeta_system).
     image = os.path.join(input_tmp, 'IMAGES', 'vbmeta.img')
-    cmd = ['avbtool', 'verify_image', '--image', image, '--key', key]
+    cmd = [info_dict['avb_avbtool'], 'verify_image', '--image', image,
+           '--follow_chain_partitions']
+
+    # Custom images.
+    custom_partitions = info_dict.get(
+        "avb_custom_images_partition_list", "").strip().split()
 
     # Append the args for chained partitions if any.
-    for partition in common.AVB_PARTITIONS + common.AVB_VBMETA_PARTITIONS:
+    for partition in (common.AVB_PARTITIONS + common.AVB_VBMETA_PARTITIONS +
+                      tuple(custom_partitions)):
       key_name = 'avb_' + partition + '_key_path'
       if info_dict.get(key_name) is not None:
+        if info_dict.get('ab_update') != 'true' and partition == 'recovery':
+          continue
+
         # Use the key file from command line if specified; otherwise fall back
         # to the one in info dict.
         key_file = options.get(key_name, info_dict[key_name])
         chained_partition_arg = common.GetAvbChainedPartitionArg(
             partition, info_dict, key_file)
-        cmd.extend(["--expected_chain_partition", chained_partition_arg])
+        cmd.extend(['--expected_chain_partition', chained_partition_arg])
+
+    # Handle the boot image with a non-default name, e.g. boot-5.4.img
+    boot_images = info_dict.get("boot_images")
+    if boot_images:
+      # we used the 1st boot image to generate the vbmeta. Rename the filename
+      # to boot.img so that avbtool can find it correctly.
+      first_image_name = boot_images.split()[0]
+      first_image_path = os.path.join(input_tmp, 'IMAGES', first_image_name)
+      assert os.path.isfile(first_image_path)
+      renamed_boot_image_path = os.path.join(input_tmp, 'IMAGES', 'boot.img')
+      os.rename(first_image_path, renamed_boot_image_path)
 
     proc = common.Run(cmd)
     stdoutdata, _ = proc.communicate()
@@ -347,6 +392,22 @@
         'Verified %s with avbtool (key: %s):\n%s', image, key,
         stdoutdata.rstrip())
 
+    # avbtool verifies recovery image for non-A/B devices.
+    if (info_dict.get('ab_update') != 'true' and
+        info_dict.get('no_recovery') != 'true'):
+      image = os.path.join(input_tmp, 'IMAGES', 'recovery.img')
+      key = info_dict['avb_recovery_key_path']
+      cmd = [info_dict['avb_avbtool'], 'verify_image', '--image', image,
+             '--key', key]
+      proc = common.Run(cmd)
+      stdoutdata, _ = proc.communicate()
+      assert proc.returncode == 0, \
+          'Failed to verify {} with avbtool (key: {}):\n{}'.format(
+              image, key, stdoutdata)
+      logging.info(
+          'Verified %s with avbtool (key: %s):\n%s', image, key,
+          stdoutdata.rstrip())
+
 
 def main():
   parser = argparse.ArgumentParser(
diff --git a/tools/releasetools/verity_utils.py b/tools/releasetools/verity_utils.py
index 3a58755..fc83689 100644
--- a/tools/releasetools/verity_utils.py
+++ b/tools/releasetools/verity_utils.py
@@ -52,7 +52,7 @@
 
 
 def GetVerityMetadataSize(image_size):
-  cmd = ["build_verity_metadata.py", "size", str(image_size)]
+  cmd = ["build_verity_metadata", "size", str(image_size)]
   output = common.RunAndCheckOutput(cmd, verbose=False)
   return int(output)
 
@@ -97,7 +97,7 @@
 def BuildVerityMetadata(image_size, verity_metadata_path, root_hash, salt,
                         block_device, signer_path, key, signer_args,
                         verity_disable):
-  cmd = ["build_verity_metadata.py", "build", str(image_size),
+  cmd = ["build_verity_metadata", "build", str(image_size),
          verity_metadata_path, root_hash, salt, block_device, signer_path, key]
   if signer_args:
     cmd.append("--signer_args=\"%s\"" % (' '.join(signer_args),))
@@ -131,7 +131,8 @@
     BuildVerityImageError: On error.
   """
   try:
-    with open(target, "a") as out_file, open(file_to_append, "r") as input_file:
+    with open(target, 'ab') as out_file, \
+        open(file_to_append, 'rb') as input_file:
       for line in input_file:
         out_file.write(line)
   except IOError:
@@ -178,6 +179,8 @@
     # key_path and algorithm are only available when chain partition is used.
     key_path = prop_dict.get("avb_key_path")
     algorithm = prop_dict.get("avb_algorithm")
+
+    # Image uses hash footer.
     if prop_dict.get("avb_hash_enable") == "true":
       return VerifiedBootVersion2VerityImageBuilder(
           prop_dict["partition_name"],
@@ -188,16 +191,17 @@
           algorithm,
           prop_dict.get("avb_salt"),
           prop_dict["avb_add_hash_footer_args"])
-    else:
-      return VerifiedBootVersion2VerityImageBuilder(
-          prop_dict["partition_name"],
-          partition_size,
-          VerifiedBootVersion2VerityImageBuilder.AVB_HASHTREE_FOOTER,
-          prop_dict["avb_avbtool"],
-          key_path,
-          algorithm,
-          prop_dict.get("avb_salt"),
-          prop_dict["avb_add_hashtree_footer_args"])
+
+    # Image uses hashtree footer.
+    return VerifiedBootVersion2VerityImageBuilder(
+        prop_dict["partition_name"],
+        partition_size,
+        VerifiedBootVersion2VerityImageBuilder.AVB_HASHTREE_FOOTER,
+        prop_dict["avb_avbtool"],
+        key_path,
+        algorithm,
+        prop_dict.get("avb_salt"),
+        prop_dict["avb_add_hashtree_footer_args"])
 
   return None
 
@@ -605,19 +609,19 @@
     self.metadata_size = metadata_size
 
     self.hashtree_info.filesystem_range = RangeSet(
-        data=[0, adjusted_size / self.block_size])
+        data=[0, adjusted_size // self.block_size])
     self.hashtree_info.hashtree_range = RangeSet(
-        data=[adjusted_size / self.block_size,
-              (adjusted_size + verity_tree_size) / self.block_size])
+        data=[adjusted_size // self.block_size,
+              (adjusted_size + verity_tree_size) // self.block_size])
 
   def _ParseHashtreeMetadata(self):
     """Parses the hash_algorithm, root_hash, salt from the metadata block."""
 
     metadata_start = self.filesystem_size + self.hashtree_size
     metadata_range = RangeSet(
-        data=[metadata_start / self.block_size,
-              (metadata_start + self.metadata_size) / self.block_size])
-    meta_data = ''.join(self.image.ReadRangeSet(metadata_range))
+        data=[metadata_start // self.block_size,
+              (metadata_start + self.metadata_size) // self.block_size])
+    meta_data = b''.join(self.image.ReadRangeSet(metadata_range))
 
     # More info about the metadata structure available in:
     # system/extras/verity/build_verity_metadata.py
@@ -640,9 +644,9 @@
     assert (int(table_entries[5]) * self.block_size == self.filesystem_size and
             int(table_entries[6]) * self.block_size == self.filesystem_size)
 
-    self.hashtree_info.hash_algorithm = table_entries[7]
-    self.hashtree_info.root_hash = table_entries[8]
-    self.hashtree_info.salt = table_entries[9]
+    self.hashtree_info.hash_algorithm = table_entries[7].decode()
+    self.hashtree_info.root_hash = table_entries[8].decode()
+    self.hashtree_info.salt = table_entries[9].decode()
 
   def ValidateHashtree(self):
     """Checks that we can reconstruct the verity hash tree."""
@@ -669,8 +673,8 @@
 
     # Reads the generated hash tree and checks if it has the exact same bytes
     # as the one in the sparse image.
-    with open(generated_verity_tree, "rb") as fd:
-      return fd.read() == ''.join(self.image.ReadRangeSet(
+    with open(generated_verity_tree, 'rb') as fd:
+      return fd.read() == b''.join(self.image.ReadRangeSet(
           self.hashtree_info.hashtree_range))
 
   def Generate(self, image):
@@ -691,3 +695,22 @@
       raise HashtreeInfoGenerationError("Failed to reconstruct the verity tree")
 
     return self.hashtree_info
+
+
+def CreateCustomImageBuilder(info_dict, partition_name, partition_size,
+                            key_path, algorithm, signing_args):
+  builder = None
+  if info_dict.get("avb_enable") == "true":
+    builder = VerifiedBootVersion2VerityImageBuilder(
+        partition_name,
+        partition_size,
+        VerifiedBootVersion2VerityImageBuilder.AVB_HASHTREE_FOOTER,
+        info_dict.get("avb_avbtool"),
+        key_path,
+        algorithm,
+        # Salt is None because custom images have no fingerprint property to be
+        # used as the salt.
+        None,
+        signing_args)
+
+  return builder
diff --git a/tools/signapk/Android.bp b/tools/signapk/Android.bp
index ad9d957..c799dbf 100644
--- a/tools/signapk/Android.bp
+++ b/tools/signapk/Android.bp
@@ -24,7 +24,7 @@
         "apksig",
         "bouncycastle-unbundled",
         "bouncycastle-bcpkix-unbundled",
-        "conscrypt-nojarjar",
+        "conscrypt-unbundled",
     ],
 
     required: ["libconscrypt_openjdk_jni"],
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 57973ec..7e5c8fc 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -36,10 +36,12 @@
 
 import com.android.apksig.ApkSignerEngine;
 import com.android.apksig.DefaultApkSignerEngine;
+import com.android.apksig.SigningCertificateLineage;
 import com.android.apksig.Hints;
 import com.android.apksig.apk.ApkUtils;
 import com.android.apksig.apk.MinSdkVersionException;
 import com.android.apksig.util.DataSink;
+import com.android.apksig.util.DataSource;
 import com.android.apksig.util.DataSources;
 import com.android.apksig.zip.ZipFormatException;
 
@@ -56,6 +58,7 @@
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.OutputStream;
+import java.io.RandomAccessFile;
 import java.lang.reflect.Constructor;
 import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
@@ -381,9 +384,8 @@
         byte[] buffer = new byte[4096];
         int num;
 
-        List<Pattern> pinPatterns = extractPinPatterns(in);
+        List<Hints.PatternWithRange> pinPatterns = extractPinPatterns(in);
         ArrayList<Hints.ByteRange> pinByteRanges = pinPatterns == null ? null : new ArrayList<>();
-        HashSet<String> namesToPin = new HashSet<>();
 
         ArrayList<String> names = new ArrayList<String>();
         for (Enumeration<JarEntry> e = in.entries(); e.hasMoreElements();) {
@@ -399,13 +401,6 @@
             if (Hints.PIN_BYTE_RANGE_ZIP_ENTRY_NAME.equals(entryName)) {
                 continue;  // We regenerate it below.
             }
-            if (pinPatterns != null) {
-                for (Pattern pinPattern : pinPatterns) {
-                    if (pinPattern.matcher(entryName).matches()) {
-                        namesToPin.add(entryName);
-                    }
-                }
-            }
             names.add(entryName);
         }
         Collections.sort(names);
@@ -485,6 +480,7 @@
             DataSink entryDataSink =
                     (inspectEntryRequest != null) ? inspectEntryRequest.getDataSink() : null;
 
+            long entryDataStart = outCounter.getWrittenBytes();
             try (InputStream data = in.getInputStream(inEntry)) {
                 while ((num = data.read(buffer)) > 0) {
                     out.write(buffer, 0, num);
@@ -500,11 +496,27 @@
                 inspectEntryRequest.done();
             }
 
-            if (namesToPin.contains(name)) {
-                pinByteRanges.add(
-                    new Hints.ByteRange(
-                        entryHeaderStart,
-                        outCounter.getWrittenBytes()));
+            if (pinPatterns != null) {
+                boolean pinFileHeader = false;
+                for (Hints.PatternWithRange pinPattern : pinPatterns) {
+                    if (!pinPattern.matcher(name).matches()) {
+                        continue;
+                    }
+                    Hints.ByteRange dataRange =
+                        new Hints.ByteRange(
+                            entryDataStart,
+                            outCounter.getWrittenBytes());
+                    Hints.ByteRange pinRange =
+                        pinPattern.ClampToAbsoluteByteRange(dataRange);
+                    if (pinRange != null) {
+                        pinFileHeader = true;
+                        pinByteRanges.add(pinRange);
+                    }
+                }
+                if (pinFileHeader) {
+                    pinByteRanges.add(new Hints.ByteRange(entryHeaderStart,
+                                                          entryDataStart));
+                }
             }
         }
 
@@ -528,6 +540,7 @@
             DataSink entryDataSink =
                     (inspectEntryRequest != null) ? inspectEntryRequest.getDataSink() : null;
 
+            long entryDataStart = outCounter.getWrittenBytes();
             InputStream data = in.getInputStream(inEntry);
             while ((num = data.read(buffer)) > 0) {
                 out.write(buffer, 0, num);
@@ -541,11 +554,27 @@
                 inspectEntryRequest.done();
             }
 
-            if (namesToPin.contains(name)) {
-                pinByteRanges.add(
-                    new Hints.ByteRange(
-                        entryHeaderStart,
-                        outCounter.getWrittenBytes()));
+            if (pinPatterns != null) {
+                boolean pinFileHeader = false;
+                for (Hints.PatternWithRange pinPattern : pinPatterns) {
+                    if (!pinPattern.matcher(name).matches()) {
+                        continue;
+                    }
+                    Hints.ByteRange dataRange =
+                        new Hints.ByteRange(
+                            entryDataStart,
+                            outCounter.getWrittenBytes());
+                    Hints.ByteRange pinRange =
+                        pinPattern.ClampToAbsoluteByteRange(dataRange);
+                    if (pinRange != null) {
+                        pinFileHeader = true;
+                        pinByteRanges.add(pinRange);
+                    }
+                }
+                if (pinFileHeader) {
+                    pinByteRanges.add(new Hints.ByteRange(entryHeaderStart,
+                                                          entryDataStart));
+                }
             }
         }
 
@@ -558,7 +587,7 @@
         }
     }
 
-    private static List<Pattern> extractPinPatterns(JarFile in) throws IOException {
+    private static List<Hints.PatternWithRange> extractPinPatterns(JarFile in) throws IOException {
         ZipEntry pinMetaEntry = in.getEntry(Hints.PIN_HINT_ASSET_ZIP_ENTRY_NAME);
         if (pinMetaEntry == null) {
             return null;
@@ -994,9 +1023,10 @@
                            "[-providerClass <className>] " +
                            "[--min-sdk-version <n>] " +
                            "[--disable-v2] " +
+                           "[--enable-v4] " +
                            "publickey.x509[.pem] privatekey.pk8 " +
                            "[publickey2.x509[.pem] privatekey2.pk8 ...] " +
-                           "input.jar output.jar");
+                           "input.jar output.jar [output-v4-file]");
         System.exit(2);
     }
 
@@ -1016,6 +1046,8 @@
         int alignment = 4;
         Integer minSdkVersionOverride = null;
         boolean signUsingApkSignatureSchemeV2 = true;
+        boolean signUsingApkSignatureSchemeV4 = false;
+        SigningCertificateLineage certLineage = null;
 
         int argstart = 0;
         while (argstart < args.length && args[argstart].startsWith("-")) {
@@ -1043,13 +1075,31 @@
             } else if ("--disable-v2".equals(args[argstart])) {
                 signUsingApkSignatureSchemeV2 = false;
                 ++argstart;
+            } else if ("--enable-v4".equals(args[argstart])) {
+                signUsingApkSignatureSchemeV4 = true;
+                ++argstart;
+            } else if ("--lineage".equals(args[argstart])) {
+                File lineageFile = new File(args[++argstart]);
+                try {
+                    certLineage = SigningCertificateLineage.readFromFile(lineageFile);
+                } catch (Exception e) {
+                    throw new IllegalArgumentException(
+                            "Error reading lineage file: " + e.getMessage());
+                }
+                ++argstart;
             } else {
                 usage();
             }
         }
 
-        if ((args.length - argstart) % 2 == 1) usage();
-        int numKeys = ((args.length - argstart) / 2) - 1;
+        int numArgsExcludeV4FilePath;
+        if (signUsingApkSignatureSchemeV4) {
+            numArgsExcludeV4FilePath = args.length - 1;
+        } else {
+            numArgsExcludeV4FilePath = args.length;
+        }
+        if ((numArgsExcludeV4FilePath - argstart) % 2 == 1) usage();
+        int numKeys = ((numArgsExcludeV4FilePath - argstart) / 2) - 1;
         if (signWholeFile && numKeys > 1) {
             System.err.println("Only one key may be used with -w.");
             System.exit(2);
@@ -1057,8 +1107,12 @@
 
         loadProviderIfNecessary(providerClass);
 
-        String inputFilename = args[args.length-2];
-        String outputFilename = args[args.length-1];
+        String inputFilename = args[numArgsExcludeV4FilePath - 2];
+        String outputFilename = args[numArgsExcludeV4FilePath - 1];
+        String outputV4Filename = "";
+        if (signUsingApkSignatureSchemeV4) {
+            outputV4Filename = args[args.length - 1];
+        }
 
         JarFile inputJar = null;
         FileOutputStream outputFile = null;
@@ -1123,6 +1177,7 @@
                                 .setV2SigningEnabled(signUsingApkSignatureSchemeV2)
                                 .setOtherSignersSignaturesPreserved(false)
                                 .setCreatedBy("1.0 (Android SignApk)")
+                                .setSigningCertificateLineage(certLineage)
                                 .build()) {
                     // We don't preserve the input APK's APK Signing Block (which contains v2
                     // signatures)
@@ -1195,6 +1250,13 @@
                     outputFile.close();
                     outputFile = null;
                     apkSigner.outputDone();
+
+                    if (signUsingApkSignatureSchemeV4) {
+                        final DataSource outputApkIn = DataSources.asDataSource(
+                                new RandomAccessFile(new File(outputFilename), "r"));
+                        final File outputV4File =  new File(outputV4Filename);
+                        apkSigner.signV4(outputApkIn, outputV4File, false /* ignore failures */);
+                    }
                 }
 
                 return;
diff --git a/tools/warn.py b/tools/warn.py
index c710164..22ac872 100755
--- a/tools/warn.py
+++ b/tools/warn.py
@@ -1,3545 +1,35 @@
 #!/usr/bin/python
-# This file uses the following encoding: utf-8
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
-"""Grep warnings messages and output HTML tables or warning counts in CSV.
+"""Call -m warn.warn to process warning messages.
 
-Default is to output warnings in HTML tables grouped by warning severity.
-Use option --byproject to output tables grouped by source file projects.
-Use option --gencsv to output warning counts in CSV format.
+This script is used by Android continuous build bots for all branches.
+Old frozen branches will continue to use the old warn.py, and active
+branches will use this new version to call -m warn.warn.
 """
 
-# List of important data structures and functions in this script.
-#
-# To parse and keep warning message in the input file:
-#   severity:                classification of message severity
-#   severity.range           [0, 1, ... last_severity_level]
-#   severity.colors          for header background
-#   severity.column_headers  for the warning count table
-#   severity.headers         for warning message tables
-#   warn_patterns:
-#   warn_patterns[w]['category']     tool that issued the warning, not used now
-#   warn_patterns[w]['description']  table heading
-#   warn_patterns[w]['members']      matched warnings from input
-#   warn_patterns[w]['option']       compiler flag to control the warning
-#   warn_patterns[w]['patterns']     regular expressions to match warnings
-#   warn_patterns[w]['projects'][p]  number of warnings of pattern w in p
-#   warn_patterns[w]['severity']     severity level
-#   project_list[p][0]               project name
-#   project_list[p][1]               regular expression to match a project path
-#   project_patterns[p]              re.compile(project_list[p][1])
-#   project_names[p]                 project_list[p][0]
-#   warning_messages     array of each warning message, without source url
-#   warning_records      array of [idx to warn_patterns,
-#                                  idx to project_names,
-#                                  idx to warning_messages]
-#   android_root
-#   platform_version
-#   target_product
-#   target_variant
-#   compile_patterns, parse_input_file
-#
-# To emit html page of warning messages:
-#   flags: --byproject, --url, --separator
-# Old stuff for static html components:
-#   html_script_style:  static html scripts and styles
-#   htmlbig:
-#   dump_stats, dump_html_prologue, dump_html_epilogue:
-#   emit_buttons:
-#   dump_fixed
-#   sort_warnings:
-#   emit_stats_by_project:
-#   all_patterns,
-#   findproject, classify_warning
-#   dump_html
-#
-# New dynamic HTML page's static JavaScript data:
-#   Some data are copied from Python to JavaScript, to generate HTML elements.
-#   FlagURL                args.url
-#   FlagSeparator          args.separator
-#   SeverityColors:        severity.colors
-#   SeverityHeaders:       severity.headers
-#   SeverityColumnHeaders: severity.column_headers
-#   ProjectNames:          project_names, or project_list[*][0]
-#   WarnPatternsSeverity:     warn_patterns[*]['severity']
-#   WarnPatternsDescription:  warn_patterns[*]['description']
-#   WarnPatternsOption:       warn_patterns[*]['option']
-#   WarningMessages:          warning_messages
-#   Warnings:                 warning_records
-#   StatsHeader:           warning count table header row
-#   StatsRows:             array of warning count table rows
-#
-# New dynamic HTML page's dynamic JavaScript data:
-#
-# New dynamic HTML related function to emit data:
-#   escape_string, strip_escape_string, emit_warning_arrays
-#   emit_js_data():
-
-import argparse
-import cgi
-import csv
-import multiprocessing
 import os
-import re
-import signal
+import subprocess
 import sys
 
-parser = argparse.ArgumentParser(description='Convert a build log into HTML')
-parser.add_argument('--csvpath',
-                    help='Save CSV warning file to the passed absolute path',
-                    default=None)
-parser.add_argument('--gencsv',
-                    help='Generate a CSV file with number of various warnings',
-                    action='store_true',
-                    default=False)
-parser.add_argument('--byproject',
-                    help='Separate warnings in HTML output by project names',
-                    action='store_true',
-                    default=False)
-parser.add_argument('--url',
-                    help='Root URL of an Android source code tree prefixed '
-                    'before files in warnings')
-parser.add_argument('--separator',
-                    help='Separator between the end of a URL and the line '
-                    'number argument. e.g. #')
-parser.add_argument('--processes',
-                    type=int,
-                    default=multiprocessing.cpu_count(),
-                    help='Number of parallel processes to process warnings')
-parser.add_argument(dest='buildlog', metavar='build.log',
-                    help='Path to build.log file')
-args = parser.parse_args()
-
-
-class Severity(object):
-  """Severity levels and attributes."""
-  # numbered by dump order
-  FIXMENOW = 0
-  HIGH = 1
-  MEDIUM = 2
-  LOW = 3
-  ANALYZER = 4
-  TIDY = 5
-  HARMLESS = 6
-  UNKNOWN = 7
-  SKIP = 8
-  range = range(SKIP + 1)
-  attributes = [
-      # pylint:disable=bad-whitespace
-      ['fuchsia',   'FixNow',    'Critical warnings, fix me now'],
-      ['red',       'High',      'High severity warnings'],
-      ['orange',    'Medium',    'Medium severity warnings'],
-      ['yellow',    'Low',       'Low severity warnings'],
-      ['hotpink',   'Analyzer',  'Clang-Analyzer warnings'],
-      ['peachpuff', 'Tidy',      'Clang-Tidy warnings'],
-      ['limegreen', 'Harmless',  'Harmless warnings'],
-      ['lightblue', 'Unknown',   'Unknown warnings'],
-      ['grey',      'Unhandled', 'Unhandled warnings']
-  ]
-  colors = [a[0] for a in attributes]
-  column_headers = [a[1] for a in attributes]
-  headers = [a[2] for a in attributes]
-
-
-def tidy_warn_pattern(description, pattern):
-  return {
-      'category': 'C/C++',
-      'severity': Severity.TIDY,
-      'description': 'clang-tidy ' + description,
-      'patterns': [r'.*: .+\[' + pattern + r'\]$']
-  }
-
-
-def simple_tidy_warn_pattern(description):
-  return tidy_warn_pattern(description, description)
-
-
-def group_tidy_warn_pattern(description):
-  return tidy_warn_pattern(description, description + r'-.+')
-
-
-warn_patterns = [
-    # pylint:disable=line-too-long,g-inconsistent-quotes
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Security warning',
-     'patterns': [r".*: warning: .+\[clang-analyzer-security.*\]"]},
-    {'category': 'make', 'severity': Severity.MEDIUM,
-     'description': 'make: overriding commands/ignoring old commands',
-     'patterns': [r".*: warning: overriding commands for target .+",
-                  r".*: warning: ignoring old commands for target .+"]},
-    {'category': 'make', 'severity': Severity.HIGH,
-     'description': 'make: LOCAL_CLANG is false',
-     'patterns': [r".*: warning: LOCAL_CLANG is set to false"]},
-    {'category': 'make', 'severity': Severity.HIGH,
-     'description': 'SDK App using platform shared library',
-     'patterns': [r".*: warning: .+ \(.*app:sdk.*\) should not link to .+ \(native:platform\)"]},
-    {'category': 'make', 'severity': Severity.HIGH,
-     'description': 'System module linking to a vendor module',
-     'patterns': [r".*: warning: .+ \(.+\) should not link to .+ \(partition:.+\)"]},
-    {'category': 'make', 'severity': Severity.MEDIUM,
-     'description': 'Invalid SDK/NDK linking',
-     'patterns': [r".*: warning: .+ \(.+\) should not link to .+ \(.+\)"]},
-    {'category': 'make', 'severity': Severity.MEDIUM,
-     'description': 'Duplicate header copy',
-     'patterns': [r".*: warning: Duplicate header copy: .+"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-Wimplicit-function-declaration',
-     'description': 'Implicit function declaration',
-     'patterns': [r".*: warning: implicit declaration of function .+",
-                  r".*: warning: implicitly declaring library function"]},
-    {'category': 'C/C++', 'severity': Severity.SKIP,
-     'description': 'skip, conflicting types for ...',
-     'patterns': [r".*: warning: conflicting types for '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-Wtype-limits',
-     'description': 'Expression always evaluates to true or false',
-     'patterns': [r".*: warning: comparison is always .+ due to limited range of data type",
-                  r".*: warning: comparison of unsigned .*expression .+ is always true",
-                  r".*: warning: comparison of unsigned .*expression .+ is always false"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH,
-     'description': 'Potential leak of memory, bad free, use after free',
-     'patterns': [r".*: warning: Potential leak of memory",
-                  r".*: warning: Potential memory leak",
-                  r".*: warning: Memory allocated by alloca\(\) should not be deallocated",
-                  r".*: warning: Memory allocated by .+ should be deallocated by .+ not .+",
-                  r".*: warning: 'delete' applied to a pointer that was allocated",
-                  r".*: warning: Use of memory after it is freed",
-                  r".*: warning: Argument to .+ is the address of .+ variable",
-                  r".*: warning: Argument to free\(\) is offset by .+ of memory allocated by",
-                  r".*: warning: Attempt to .+ released memory"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH,
-     'description': 'Use transient memory for control value',
-     'patterns': [r".*: warning: .+Using such transient memory for the control value is .*dangerous."]},
-    {'category': 'C/C++', 'severity': Severity.HIGH,
-     'description': 'Return address of stack memory',
-     'patterns': [r".*: warning: Address of stack memory .+ returned to caller",
-                  r".*: warning: Address of stack memory .+ will be a dangling reference"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH,
-     'description': 'Problem with vfork',
-     'patterns': [r".*: warning: This .+ is prohibited after a successful vfork",
-                  r".*: warning: Call to function '.+' is insecure "]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': 'infinite-recursion',
-     'description': 'Infinite recursion',
-     'patterns': [r".*: warning: all paths through this function will call itself"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH,
-     'description': 'Potential buffer overflow',
-     'patterns': [r".*: warning: Size argument is greater than .+ the destination buffer",
-                  r".*: warning: Potential buffer overflow.",
-                  r".*: warning: String copy function overflows destination buffer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Incompatible pointer types',
-     'patterns': [r".*: warning: assignment from incompatible pointer type",
-                  r".*: warning: return from incompatible pointer type",
-                  r".*: warning: passing argument [0-9]+ of '.*' from incompatible pointer type",
-                  r".*: warning: initialization from incompatible pointer type"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-fno-builtin',
-     'description': 'Incompatible declaration of built in function',
-     'patterns': [r".*: warning: incompatible implicit declaration of built-in function .+"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-Wincompatible-library-redeclaration',
-     'description': 'Incompatible redeclaration of library function',
-     'patterns': [r".*: warning: incompatible redeclaration of library function .+"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH,
-     'description': 'Null passed as non-null argument',
-     'patterns': [r".*: warning: Null passed to a callee that requires a non-null"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunused-parameter',
-     'description': 'Unused parameter',
-     'patterns': [r".*: warning: unused parameter '.*'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunused',
-     'description': 'Unused function, variable, label, comparison, etc.',
-     'patterns': [r".*: warning: '.+' defined but not used",
-                  r".*: warning: unused function '.+'",
-                  r".*: warning: unused label '.+'",
-                  r".*: warning: relational comparison result unused",
-                  r".*: warning: lambda capture .* is not used",
-                  r".*: warning: private field '.+' is not used",
-                  r".*: warning: unused variable '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunused-value',
-     'description': 'Statement with no effect or result unused',
-     'patterns': [r".*: warning: statement with no effect",
-                  r".*: warning: expression result unused"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunused-result',
-     'description': 'Ignoreing return value of function',
-     'patterns': [r".*: warning: ignoring return value of function .+Wunused-result"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmissing-field-initializers',
-     'description': 'Missing initializer',
-     'patterns': [r".*: warning: missing initializer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wdelete-non-virtual-dtor',
-     'description': 'Need virtual destructor',
-     'patterns': [r".*: warning: delete called .* has virtual functions but non-virtual destructor"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip, near initialization for ...',
-     'patterns': [r".*: warning: \(near initialization for '.+'\)"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wdate-time',
-     'description': 'Expansion of data or time macro',
-     'patterns': [r".*: warning: expansion of date or time macro is not reproducible"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wformat',
-     'description': 'Format string does not match arguments',
-     'patterns': [r".*: warning: format '.+' expects type '.+', but argument [0-9]+ has type '.+'",
-                  r".*: warning: more '%' conversions than data arguments",
-                  r".*: warning: data argument not used by format string",
-                  r".*: warning: incomplete format specifier",
-                  r".*: warning: unknown conversion type .* in format",
-                  r".*: warning: format .+ expects .+ but argument .+Wformat=",
-                  r".*: warning: field precision should have .+ but argument has .+Wformat",
-                  r".*: warning: format specifies type .+ but the argument has .*type .+Wformat"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wformat-extra-args',
-     'description': 'Too many arguments for format string',
-     'patterns': [r".*: warning: too many arguments for format"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Too many arguments in call',
-     'patterns': [r".*: warning: too many arguments in call to "]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wformat-invalid-specifier',
-     'description': 'Invalid format specifier',
-     'patterns': [r".*: warning: invalid .+ specifier '.+'.+format-invalid-specifier"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wsign-compare',
-     'description': 'Comparison between signed and unsigned',
-     'patterns': [r".*: warning: comparison between signed and unsigned",
-                  r".*: warning: comparison of promoted \~unsigned with unsigned",
-                  r".*: warning: signed and unsigned type in conditional expression"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Comparison between enum and non-enum',
-     'patterns': [r".*: warning: enumeral and non-enumeral type in conditional expression"]},
-    {'category': 'libpng', 'severity': Severity.MEDIUM,
-     'description': 'libpng: zero area',
-     'patterns': [r".*libpng warning: Ignoring attempt to set cHRM RGB triangle with zero area"]},
-    {'category': 'aapt', 'severity': Severity.MEDIUM,
-     'description': 'aapt: no comment for public symbol',
-     'patterns': [r".*: warning: No comment for public symbol .+"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmissing-braces',
-     'description': 'Missing braces around initializer',
-     'patterns': [r".*: warning: missing braces around initializer.*"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'No newline at end of file',
-     'patterns': [r".*: warning: no newline at end of file"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'Missing space after macro name',
-     'patterns': [r".*: warning: missing whitespace after the macro name"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wcast-align',
-     'description': 'Cast increases required alignment',
-     'patterns': [r".*: warning: cast from .* to .* increases required alignment .*"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wcast-qual',
-     'description': 'Qualifier discarded',
-     'patterns': [r".*: warning: passing argument [0-9]+ of '.+' discards qualifiers from pointer target type",
-                  r".*: warning: assignment discards qualifiers from pointer target type",
-                  r".*: warning: passing .+ to parameter of type .+ discards qualifiers",
-                  r".*: warning: assigning to .+ from .+ discards qualifiers",
-                  r".*: warning: initializing .+ discards qualifiers .+types-discards-qualifiers",
-                  r".*: warning: return discards qualifiers from pointer target type"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunknown-attributes',
-     'description': 'Unknown attribute',
-     'patterns': [r".*: warning: unknown attribute '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wignored-attributes',
-     'description': 'Attribute ignored',
-     'patterns': [r".*: warning: '_*packed_*' attribute ignored",
-                  r".*: warning: attribute declaration must precede definition .+ignored-attributes"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wvisibility',
-     'description': 'Visibility problem',
-     'patterns': [r".*: warning: declaration of '.+' will not be visible outside of this function"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wattributes',
-     'description': 'Visibility mismatch',
-     'patterns': [r".*: warning: '.+' declared with greater visibility than the type of its field '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Shift count greater than width of type',
-     'patterns': [r".*: warning: (left|right) shift count >= width of type"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wextern-initializer',
-     'description': 'extern &lt;foo&gt; is initialized',
-     'patterns': [r".*: warning: '.+' initialized and declared 'extern'",
-                  r".*: warning: 'extern' variable has an initializer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wold-style-declaration',
-     'description': 'Old style declaration',
-     'patterns': [r".*: warning: 'static' is not at beginning of declaration"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wreturn-type',
-     'description': 'Missing return value',
-     'patterns': [r".*: warning: control reaches end of non-void function"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wimplicit-int',
-     'description': 'Implicit int type',
-     'patterns': [r".*: warning: type specifier missing, defaults to 'int'",
-                  r".*: warning: type defaults to 'int' in declaration of '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmain-return-type',
-     'description': 'Main function should return int',
-     'patterns': [r".*: warning: return type of 'main' is not 'int'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wuninitialized',
-     'description': 'Variable may be used uninitialized',
-     'patterns': [r".*: warning: '.+' may be used uninitialized in this function"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-Wuninitialized',
-     'description': 'Variable is used uninitialized',
-     'patterns': [r".*: warning: '.+' is used uninitialized in this function",
-                  r".*: warning: variable '.+' is uninitialized when used here"]},
-    {'category': 'ld', 'severity': Severity.MEDIUM, 'option': '-fshort-enums',
-     'description': 'ld: possible enum size mismatch',
-     'patterns': [r".*: warning: .* uses variable-size enums yet the output is to use 32-bit enums; use of enum values across objects may fail"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wpointer-sign',
-     'description': 'Pointer targets differ in signedness',
-     'patterns': [r".*: warning: pointer targets in initialization differ in signedness",
-                  r".*: warning: pointer targets in assignment differ in signedness",
-                  r".*: warning: pointer targets in return differ in signedness",
-                  r".*: warning: pointer targets in passing argument [0-9]+ of '.+' differ in signedness"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wstrict-overflow',
-     'description': 'Assuming overflow does not occur',
-     'patterns': [r".*: warning: assuming signed overflow does not occur when assuming that .* is always (true|false)"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wempty-body',
-     'description': 'Suggest adding braces around empty body',
-     'patterns': [r".*: warning: suggest braces around empty body in an 'if' statement",
-                  r".*: warning: empty body in an if-statement",
-                  r".*: warning: suggest braces around empty body in an 'else' statement",
-                  r".*: warning: empty body in an else-statement"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wparentheses',
-     'description': 'Suggest adding parentheses',
-     'patterns': [r".*: warning: suggest explicit braces to avoid ambiguous 'else'",
-                  r".*: warning: suggest parentheses around arithmetic in operand of '.+'",
-                  r".*: warning: suggest parentheses around comparison in operand of '.+'",
-                  r".*: warning: logical not is only applied to the left hand side of this comparison",
-                  r".*: warning: using the result of an assignment as a condition without parentheses",
-                  r".*: warning: .+ has lower precedence than .+ be evaluated first .+Wparentheses",
-                  r".*: warning: suggest parentheses around '.+?' .+ '.+?'",
-                  r".*: warning: suggest parentheses around assignment used as truth value"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Static variable used in non-static inline function',
-     'patterns': [r".*: warning: '.+' is static but used in inline function '.+' which is not static"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wimplicit int',
-     'description': 'No type or storage class (will default to int)',
-     'patterns': [r".*: warning: data definition has no type or storage class"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Null pointer',
-     'patterns': [r".*: warning: Dereference of null pointer",
-                  r".*: warning: Called .+ pointer is null",
-                  r".*: warning: Forming reference to null pointer",
-                  r".*: warning: Returning null reference",
-                  r".*: warning: Null pointer passed as an argument to a 'nonnull' parameter",
-                  r".*: warning: .+ results in a null pointer dereference",
-                  r".*: warning: Access to .+ results in a dereference of a null pointer",
-                  r".*: warning: Null pointer argument in"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip, parameter name (without types) in function declaration',
-     'patterns': [r".*: warning: parameter names \(without types\) in function declaration"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wstrict-aliasing',
-     'description': 'Dereferencing &lt;foo&gt; breaks strict aliasing rules',
-     'patterns': [r".*: warning: dereferencing .* break strict-aliasing rules"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wpointer-to-int-cast',
-     'description': 'Cast from pointer to integer of different size',
-     'patterns': [r".*: warning: cast from pointer to integer of different size",
-                  r".*: warning: initialization makes pointer from integer without a cast"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wint-to-pointer-cast',
-     'description': 'Cast to pointer from integer of different size',
-     'patterns': [r".*: warning: cast to pointer from integer of different size"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Symbol redefined',
-     'patterns': [r".*: warning: "".+"" redefined"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip, ... location of the previous definition',
-     'patterns': [r".*: warning: this is the location of the previous definition"]},
-    {'category': 'ld', 'severity': Severity.MEDIUM,
-     'description': 'ld: type and size of dynamic symbol are not defined',
-     'patterns': [r".*: warning: type and size of dynamic symbol `.+' are not defined"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Pointer from integer without cast',
-     'patterns': [r".*: warning: assignment makes pointer from integer without a cast"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Pointer from integer without cast',
-     'patterns': [r".*: warning: passing argument [0-9]+ of '.+' makes pointer from integer without a cast"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Integer from pointer without cast',
-     'patterns': [r".*: warning: assignment makes integer from pointer without a cast"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Integer from pointer without cast',
-     'patterns': [r".*: warning: passing argument [0-9]+ of '.+' makes integer from pointer without a cast"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Integer from pointer without cast',
-     'patterns': [r".*: warning: return makes integer from pointer without a cast"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunknown-pragmas',
-     'description': 'Ignoring pragma',
-     'patterns': [r".*: warning: ignoring #pragma .+"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-W#pragma-messages',
-     'description': 'Pragma warning messages',
-     'patterns': [r".*: warning: .+W#pragma-messages"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wclobbered',
-     'description': 'Variable might be clobbered by longjmp or vfork',
-     'patterns': [r".*: warning: variable '.+' might be clobbered by 'longjmp' or 'vfork'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wclobbered',
-     'description': 'Argument might be clobbered by longjmp or vfork',
-     'patterns': [r".*: warning: argument '.+' might be clobbered by 'longjmp' or 'vfork'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wredundant-decls',
-     'description': 'Redundant declaration',
-     'patterns': [r".*: warning: redundant redeclaration of '.+'"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip, previous declaration ... was here',
-     'patterns': [r".*: warning: previous declaration of '.+' was here"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wswitch-enum',
-     'description': 'Enum value not handled in switch',
-     'patterns': [r".*: warning: .*enumeration value.* not handled in switch.+Wswitch"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wuser-defined-warnings',
-     'description': 'User defined warnings',
-     'patterns': [r".*: warning: .* \[-Wuser-defined-warnings\]$"]},
-    {'category': 'java', 'severity': Severity.MEDIUM, 'option': '-encoding',
-     'description': 'Java: Non-ascii characters used, but ascii encoding specified',
-     'patterns': [r".*: warning: unmappable character for encoding ascii"]},
-    {'category': 'java', 'severity': Severity.MEDIUM,
-     'description': 'Java: Non-varargs call of varargs method with inexact argument type for last parameter',
-     'patterns': [r".*: warning: non-varargs call of varargs method with inexact argument type for last parameter"]},
-    {'category': 'java', 'severity': Severity.MEDIUM,
-     'description': 'Java: Unchecked method invocation',
-     'patterns': [r".*: warning: \[unchecked\] unchecked method invocation: .+ in class .+"]},
-    {'category': 'java', 'severity': Severity.MEDIUM,
-     'description': 'Java: Unchecked conversion',
-     'patterns': [r".*: warning: \[unchecked\] unchecked conversion"]},
-    {'category': 'java', 'severity': Severity.MEDIUM,
-     'description': '_ used as an identifier',
-     'patterns': [r".*: warning: '_' used as an identifier"]},
-    {'category': 'java', 'severity': Severity.HIGH,
-     'description': 'Use of internal proprietary API',
-     'patterns': [r".*: warning: .* is internal proprietary API and may be removed"]},
-
-    # Warnings from Javac
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description': 'Java: Use of deprecated member',
-     'patterns': [r'.*: warning: \[deprecation\] .+']},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description': 'Java: Unchecked conversion',
-     'patterns': [r'.*: warning: \[unchecked\] .+']},
-
-    # Begin warnings generated by Error Prone
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Use parameter comments to document ambiguous literals',
-     'patterns': [r".*: warning: \[BooleanParameter\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: This class\'s name looks like a Type Parameter.',
-     'patterns': [r".*: warning: \[ClassNamedLikeTypeParameter\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Field name is CONSTANT_CASE, but field is not static and final',
-     'patterns': [r".*: warning: \[ConstantField\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: @Multibinds is a more efficient and declarative mechanism for ensuring that a set multibinding is present in the graph.',
-     'patterns': [r".*: warning: \[EmptySetMultibindingContributions\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Prefer assertThrows to ExpectedException',
-     'patterns': [r".*: warning: \[ExpectedExceptionRefactoring\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: This field is only assigned during initialization; consider making it final',
-     'patterns': [r".*: warning: \[FieldCanBeFinal\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Fields that can be null should be annotated @Nullable',
-     'patterns': [r".*: warning: \[FieldMissingNullable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Refactors uses of the JSR 305 @Immutable to Error Prone\'s annotation',
-     'patterns': [r".*: warning: \[ImmutableRefactoring\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Use Java\'s utility functional interfaces instead of Function\u003cA, B> for primitive types.',
-     'patterns': [r".*: warning: \[LambdaFunctionalInterface\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: A private method that does not reference the enclosing instance can be static',
-     'patterns': [r".*: warning: \[MethodCanBeStatic\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: C-style array declarations should not be used',
-     'patterns': [r".*: warning: \[MixedArrayDimensions\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Variable declarations should declare only one variable',
-     'patterns': [r".*: warning: \[MultiVariableDeclaration\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Source files should not contain multiple top-level class declarations',
-     'patterns': [r".*: warning: \[MultipleTopLevelClasses\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Avoid having multiple unary operators acting on the same variable in a method call',
-     'patterns': [r".*: warning: \[MultipleUnaryOperatorsInMethodCall\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Package names should match the directory they are declared in',
-     'patterns': [r".*: warning: \[PackageLocation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Non-standard parameter comment; prefer `/* paramName= */ arg`',
-     'patterns': [r".*: warning: \[ParameterComment\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Method parameters that aren\'t checked for null shouldn\'t be annotated @Nullable',
-     'patterns': [r".*: warning: \[ParameterNotNullable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Add a private constructor to modules that will not be instantiated by Dagger.',
-     'patterns': [r".*: warning: \[PrivateConstructorForNoninstantiableModule\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Utility classes (only static members) are not designed to be instantiated and should be made noninstantiable with a default constructor.',
-     'patterns': [r".*: warning: \[PrivateConstructorForUtilityClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Unused imports',
-     'patterns': [r".*: warning: \[RemoveUnusedImports\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Methods that can return null should be annotated @Nullable',
-     'patterns': [r".*: warning: \[ReturnMissingNullable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Scopes on modules have no function and will soon be an error.',
-     'patterns': [r".*: warning: \[ScopeOnModule\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: The default case of a switch should appear at the end of the last statement group',
-     'patterns': [r".*: warning: \[SwitchDefault\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Prefer assertThrows to @Test(expected=...)',
-     'patterns': [r".*: warning: \[TestExceptionRefactoring\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Unchecked exceptions do not need to be declared in the method signature.',
-     'patterns': [r".*: warning: \[ThrowsUncheckedException\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Prefer assertThrows to try/fail',
-     'patterns': [r".*: warning: \[TryFailRefactoring\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Type parameters must be a single letter with an optional numeric suffix, or an UpperCamelCase name followed by the letter \'T\'.',
-     'patterns': [r".*: warning: \[TypeParameterNaming\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Constructors and methods with the same name should appear sequentially with no other code in between. Please re-order or re-name methods.',
-     'patterns': [r".*: warning: \[UngroupedOverloads\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Unnecessary call to NullPointerTester#setDefault',
-     'patterns': [r".*: warning: \[UnnecessarySetDefault\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Using static imports for types is unnecessary',
-     'patterns': [r".*: warning: \[UnnecessaryStaticImport\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: @Binds is a more efficient and declarative mechanism for delegating a binding.',
-     'patterns': [r".*: warning: \[UseBinds\] .+"]},
-    {'category': 'java',
-     'severity': Severity.LOW,
-     'description':
-         'Java: Wildcard imports, static or otherwise, should not be used',
-     'patterns': [r".*: warning: \[WildcardImport\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Method reference is ambiguous',
-     'patterns': [r".*: warning: \[AmbiguousMethodReference\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This method passes a pair of parameters through to String.format, but the enclosing method wasn\'t annotated @FormatMethod. Doing so gives compile-time rather than run-time protection against malformed format strings.',
-     'patterns': [r".*: warning: \[AnnotateFormatMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Annotations should be positioned after Javadocs, but before modifiers..',
-     'patterns': [r".*: warning: \[AnnotationPosition\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Arguments are in the wrong order or could be commented for clarity.',
-     'patterns': [r".*: warning: \[ArgumentSelectionDefectChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Arrays do not override equals() or hashCode, so comparisons will be done on reference equality only. If neither deduplication nor lookup are needed, consider using a List instead. Otherwise, use IdentityHashMap/Set, a Map from a library that handles object arrays, or an Iterable/List of pairs.',
-     'patterns': [r".*: warning: \[ArrayAsKeyOfSetOrMap\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Arguments are swapped in assertEquals-like call',
-     'patterns': [r".*: warning: \[AssertEqualsArgumentOrderChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Assertions may be disabled at runtime and do not guarantee that execution will halt here; consider throwing an exception instead',
-     'patterns': [r".*: warning: \[AssertFalse\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The lambda passed to assertThrows should contain exactly one statement',
-     'patterns': [r".*: warning: \[AssertThrowsMultipleStatements\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This assertion throws an AssertionError if it fails, which will be caught by an enclosing try block.',
-     'patterns': [r".*: warning: \[AssertionFailureIgnored\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: @AssistedInject and @Inject should not be used on different constructors in the same class.',
-     'patterns': [r".*: warning: \[AssistedInjectAndInjectOnConstructors\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Make toString(), hashCode() and equals() final in AutoValue classes, so it is clear to readers that AutoValue is not overriding them',
-     'patterns': [r".*: warning: \[AutoValueFinalMethods\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Classes that implement Annotation must override equals and hashCode. Consider using AutoAnnotation instead of implementing Annotation by hand.',
-     'patterns': [r".*: warning: \[BadAnnotationImplementation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Possible sign flip from narrowing conversion',
-     'patterns': [r".*: warning: \[BadComparable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Importing nested classes/static methods/static fields with commonly-used names can make code harder to read, because it may not be clear from the context exactly which type is being referred to. Qualifying the name with that of the containing class can make the code clearer.',
-     'patterns': [r".*: warning: \[BadImport\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: instanceof used in a way that is equivalent to a null check.',
-     'patterns': [r".*: warning: \[BadInstanceof\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: BigDecimal#equals has surprising behavior: it also compares scale.',
-     'patterns': [r".*: warning: \[BigDecimalEquals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: new BigDecimal(double) loses precision in this case.',
-     'patterns': [r".*: warning: \[BigDecimalLiteralDouble\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: A call to Binder.clearCallingIdentity() should be followed by Binder.restoreCallingIdentity() in a finally block. Otherwise the wrong Binder identity may be used by subsequent code.',
-     'patterns': [r".*: warning: \[BinderIdentityRestoredDangerously\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This code declares a binding for a common value type without a Qualifier annotation.',
-     'patterns': [r".*: warning: \[BindingToUnqualifiedCommonType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: valueOf or autoboxing provides better time and space performance',
-     'patterns': [r".*: warning: \[BoxedPrimitiveConstructor\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: ByteBuffer.array() shouldn\'t be called unless ByteBuffer.arrayOffset() is used or if the ByteBuffer was initialized using ByteBuffer.wrap() or ByteBuffer.allocate().',
-     'patterns': [r".*: warning: \[ByteBufferBackingArray\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Mockito cannot mock final classes',
-     'patterns': [r".*: warning: \[CannotMockFinalClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Duration can be expressed more clearly with different units',
-     'patterns': [r".*: warning: \[CanonicalDuration\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Logging or rethrowing exceptions should usually be preferred to catching and calling printStackTrace',
-     'patterns': [r".*: warning: \[CatchAndPrintStackTrace\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Ignoring exceptions and calling fail() is unnecessary, and makes test output less useful',
-     'patterns': [r".*: warning: \[CatchFail\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Inner class is non-static but does not reference enclosing class',
-     'patterns': [r".*: warning: \[ClassCanBeStatic\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Class.newInstance() bypasses exception checking; prefer getDeclaredConstructor().newInstance()',
-     'patterns': [r".*: warning: \[ClassNewInstance\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Providing Closeable resources makes their lifecycle unclear',
-     'patterns': [r".*: warning: \[CloseableProvides\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The type of the array parameter of Collection.toArray needs to be compatible with the array type',
-     'patterns': [r".*: warning: \[CollectionToArraySafeParameter\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Collector.of() should not use state',
-     'patterns': [r".*: warning: \[CollectorShouldNotUseState\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Class should not implement both `Comparable` and `Comparator`',
-     'patterns': [r".*: warning: \[ComparableAndComparator\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Constructors should not invoke overridable methods.',
-     'patterns': [r".*: warning: \[ConstructorInvokesOverridable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Constructors should not pass the \'this\' reference out in method invocations, since the object may not be fully constructed.',
-     'patterns': [r".*: warning: \[ConstructorLeaksThis\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: DateFormat is not thread-safe, and should not be used as a constant field.',
-     'patterns': [r".*: warning: \[DateFormatConstant\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Implicit use of the platform default charset, which can result in differing behaviour between JVM executions or incorrect behavior if the encoding of the data source doesn\'t match expectations.',
-     'patterns': [r".*: warning: \[DefaultCharset\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Avoid deprecated Thread methods; read the method\'s javadoc for details.',
-     'patterns': [r".*: warning: \[DeprecatedThreadMethods\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Prefer collection factory methods or builders to the double-brace initialization pattern.',
-     'patterns': [r".*: warning: \[DoubleBraceInitialization\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Double-checked locking on non-volatile fields is unsafe',
-     'patterns': [r".*: warning: \[DoubleCheckedLocking\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Empty top-level type declaration',
-     'patterns': [r".*: warning: \[EmptyTopLevelDeclaration\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: equals() implementation may throw NullPointerException when given null',
-     'patterns': [r".*: warning: \[EqualsBrokenForNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Overriding Object#equals in a non-final class by using getClass rather than instanceof breaks substitutability of subclasses.',
-     'patterns': [r".*: warning: \[EqualsGetClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Classes that override equals should also override hashCode.',
-     'patterns': [r".*: warning: \[EqualsHashCode\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: An equality test between objects with incompatible types always returns false',
-     'patterns': [r".*: warning: \[EqualsIncompatibleType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The contract of #equals states that it should return false for incompatible types, while this implementation may throw ClassCastException.',
-     'patterns': [r".*: warning: \[EqualsUnsafeCast\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Implementing #equals by just comparing hashCodes is fragile. Hashes collide frequently, and this will lead to false positives in #equals.',
-     'patterns': [r".*: warning: \[EqualsUsingHashCode\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Calls to ExpectedException#expect should always be followed by exactly one statement.',
-     'patterns': [r".*: warning: \[ExpectedExceptionChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: When only using JUnit Assert\'s static methods, you should import statically instead of extending.',
-     'patterns': [r".*: warning: \[ExtendingJUnitAssert\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Switch case may fall through',
-     'patterns': [r".*: warning: \[FallThrough\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: If you return or throw from a finally, then values returned or thrown from the try-catch block will be ignored. Consider using try-with-resources instead.',
-     'patterns': [r".*: warning: \[Finally\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Use parentheses to make the precedence explicit',
-     'patterns': [r".*: warning: \[FloatCast\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This fuzzy equality check is using a tolerance less than the gap to the next number. You may want a less restrictive tolerance, or to assert equality.',
-     'patterns': [r".*: warning: \[FloatingPointAssertionWithinEpsilon\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Floating point literal loses precision',
-     'patterns': [r".*: warning: \[FloatingPointLiteralPrecision\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Classes extending PreferenceActivity must implement isValidFragment such that it does not unconditionally return true to prevent vulnerability to fragment injection attacks.',
-     'patterns': [r".*: warning: \[FragmentInjection\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Subclasses of Fragment must be instantiable via Class#newInstance(): the class must be public, static and have a public nullary constructor',
-     'patterns': [r".*: warning: \[FragmentNotInstantiable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Overloads will be ambiguous when passing lambda arguments',
-     'patterns': [r".*: warning: \[FunctionalInterfaceClash\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Return value of methods returning Future must be checked. Ignoring returned Futures suppresses exceptions thrown from the code that completes the Future.',
-     'patterns': [r".*: warning: \[FutureReturnValueIgnored\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Calling getClass() on an enum may return a subclass of the enum type',
-     'patterns': [r".*: warning: \[GetClassOnEnum\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Hardcoded reference to /sdcard',
-     'patterns': [r".*: warning: \[HardCodedSdCardPath\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Hiding fields of superclasses may cause confusion and errors',
-     'patterns': [r".*: warning: \[HidingField\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Annotations should always be immutable',
-     'patterns': [r".*: warning: \[ImmutableAnnotationChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Enums should always be immutable',
-     'patterns': [r".*: warning: \[ImmutableEnumChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This annotation has incompatible modifiers as specified by its @IncompatibleModifiers annotation',
-     'patterns': [r".*: warning: \[IncompatibleModifiers\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: It is confusing to have a field and a parameter under the same scope that differ only in capitalization.',
-     'patterns': [r".*: warning: \[InconsistentCapitalization\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Including fields in hashCode which are not compared in equals violates the contract of hashCode.',
-     'patterns': [r".*: warning: \[InconsistentHashCode\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The ordering of parameters in overloaded methods should be as consistent as possible (when viewed from left to right)',
-     'patterns': [r".*: warning: \[InconsistentOverloads\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This for loop increments the same variable in the header and in the body',
-     'patterns': [r".*: warning: \[IncrementInForLoopAndHeader\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Constructors on abstract classes are never directly @Injected, only the constructors of their subclasses can be @Inject\'ed.',
-     'patterns': [r".*: warning: \[InjectOnConstructorOfAbstractClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Please also override int read(byte[], int, int), otherwise multi-byte reads from this input stream are likely to be slow.',
-     'patterns': [r".*: warning: \[InputStreamSlowMultibyteRead\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Casting inside an if block should be plausibly consistent with the instanceof type',
-     'patterns': [r".*: warning: \[InstanceOfAndCastMatchWrongType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Expression of type int may overflow before being assigned to a long',
-     'patterns': [r".*: warning: \[IntLongMath\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This @param tag doesn\'t refer to a parameter of the method.',
-     'patterns': [r".*: warning: \[InvalidParam\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This tag is invalid.',
-     'patterns': [r".*: warning: \[InvalidTag\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The documented method doesn\'t actually throw this checked exception.',
-     'patterns': [r".*: warning: \[InvalidThrows\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Class should not implement both `Iterable` and `Iterator`',
-     'patterns': [r".*: warning: \[IterableAndIterator\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Floating-point comparison without error tolerance',
-     'patterns': [r".*: warning: \[JUnit3FloatingPointComparisonWithoutDelta\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Some JUnit4 construct cannot be used in a JUnit3 context. Convert your class to JUnit4 style to use them.',
-     'patterns': [r".*: warning: \[JUnit4ClassUsedInJUnit3\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Test class inherits from JUnit 3\'s TestCase but has JUnit 4 @Test annotations.',
-     'patterns': [r".*: warning: \[JUnitAmbiguousTestClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Never reuse class names from java.lang',
-     'patterns': [r".*: warning: \[JavaLangClash\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Suggests alternatives to obsolete JDK classes.',
-     'patterns': [r".*: warning: \[JdkObsolete\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Calls to Lock#lock should be immediately followed by a try block which releases the lock.',
-     'patterns': [r".*: warning: \[LockNotBeforeTry\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Assignment where a boolean expression was expected; use == if this assignment wasn\'t expected or add parentheses for clarity.',
-     'patterns': [r".*: warning: \[LogicalAssignment\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Math.abs does not always give a positive result. Please consider other methods for positive random numbers.',
-     'patterns': [r".*: warning: \[MathAbsoluteRandom\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Switches on enum types should either handle all values, or have a default case.',
-     'patterns': [r".*: warning: \[MissingCasesInEnumSwitch\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The Google Java Style Guide requires that each switch statement includes a default statement group, even if it contains no code. (This requirement is lifted for any switch statement that covers all values of an enum.)',
-     'patterns': [r".*: warning: \[MissingDefault\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Not calling fail() when expecting an exception masks bugs',
-     'patterns': [r".*: warning: \[MissingFail\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: method overrides method in supertype; expected @Override',
-     'patterns': [r".*: warning: \[MissingOverride\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: A collection or proto builder was created, but its values were never accessed.',
-     'patterns': [r".*: warning: \[ModifiedButNotUsed\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Modifying a collection while iterating over it in a loop may cause a ConcurrentModificationException to be thrown.',
-     'patterns': [r".*: warning: \[ModifyCollectionInEnhancedForLoop\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Multiple calls to either parallel or sequential are unnecessary and cause confusion.',
-     'patterns': [r".*: warning: \[MultipleParallelOrSequentialCalls\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Constant field declarations should use the immutable type (such as ImmutableList) instead of the general collection interface type (such as List)',
-     'patterns': [r".*: warning: \[MutableConstantField\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Method return type should use the immutable type (such as ImmutableList) instead of the general collection interface type (such as List)',
-     'patterns': [r".*: warning: \[MutableMethodReturnType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Compound assignments may hide dangerous casts',
-     'patterns': [r".*: warning: \[NarrowingCompoundAssignment\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Nested instanceOf conditions of disjoint types create blocks of code that never execute',
-     'patterns': [r".*: warning: \[NestedInstanceOfConditions\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Instead of returning a functional type, return the actual type that the returned function would return and use lambdas at use site.',
-     'patterns': [r".*: warning: \[NoFunctionalReturnType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This update of a volatile variable is non-atomic',
-     'patterns': [r".*: warning: \[NonAtomicVolatileUpdate\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Static import of member uses non-canonical name',
-     'patterns': [r".*: warning: \[NonCanonicalStaticMemberImport\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: equals method doesn\'t override Object.equals',
-     'patterns': [r".*: warning: \[NonOverridingEquals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Constructors should not be annotated with @Nullable since they cannot return null',
-     'patterns': [r".*: warning: \[NullableConstructor\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Dereference of possibly-null value',
-     'patterns': [r".*: warning: \[NullableDereference\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: @Nullable should not be used for primitive types since they cannot be null',
-     'patterns': [r".*: warning: \[NullablePrimitive\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: void-returning methods should not be annotated with @Nullable, since they cannot return null',
-     'patterns': [r".*: warning: \[NullableVoid\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Calling toString on Objects that don\'t override toString() doesn\'t provide useful information',
-     'patterns': [r".*: warning: \[ObjectToString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Objects.hashCode(Object o) should not be passed a primitive value',
-     'patterns': [r".*: warning: \[ObjectsHashCodePrimitive\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Use grouping parenthesis to make the operator precedence explicit',
-     'patterns': [r".*: warning: \[OperatorPrecedence\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: One should not call optional.get() inside an if statement that checks !optional.isPresent',
-     'patterns': [r".*: warning: \[OptionalNotPresent\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: String literal contains format specifiers, but is not passed to a format method',
-     'patterns': [r".*: warning: \[OrphanedFormatString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: To return a custom message with a Throwable class, one should override getMessage() instead of toString() for Throwable.',
-     'patterns': [r".*: warning: \[OverrideThrowableToString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Varargs doesn\'t agree for overridden method',
-     'patterns': [r".*: warning: \[Overrides\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This method is not annotated with @Inject, but it overrides a method that is annotated with @com.google.inject.Inject. Guice will inject this method, and it is recommended to annotate it explicitly.',
-     'patterns': [r".*: warning: \[OverridesGuiceInjectableMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Detects `/* name= */`-style comments on actual parameters where the name doesn\'t match the formal parameter',
-     'patterns': [r".*: warning: \[ParameterName\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Preconditions only accepts the %s placeholder in error message strings',
-     'patterns': [r".*: warning: \[PreconditionsInvalidPlaceholder\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Passing a primitive array to a varargs method is usually wrong',
-     'patterns': [r".*: warning: \[PrimitiveArrayPassedToVarargsMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: A field on a protocol buffer was set twice in the same chained expression.',
-     'patterns': [r".*: warning: \[ProtoRedundantSet\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Protos should not be used as a key to a map, in a set, or in a contains method on a descendant of a collection. Protos have non deterministic ordering and proto equality is deep, which is a performance issue.',
-     'patterns': [r".*: warning: \[ProtosAsKeyOfSetOrMap\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: BugChecker has incorrect ProvidesFix tag, please update',
-     'patterns': [r".*: warning: \[ProvidesFix\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Qualifiers/Scope annotations on @Inject methods don\'t have any effect. Move the qualifier annotation to the binding location.',
-     'patterns': [r".*: warning: \[QualifierOrScopeOnInjectMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Injection frameworks currently don\'t understand Qualifiers in TYPE_PARAMETER or TYPE_USE contexts.',
-     'patterns': [r".*: warning: \[QualifierWithTypeUse\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: reachabilityFence should always be called inside a finally block',
-     'patterns': [r".*: warning: \[ReachabilityFenceUsage\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Thrown exception is a subtype of another',
-     'patterns': [r".*: warning: \[RedundantThrows\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Comparison using reference equality instead of value equality',
-     'patterns': [r".*: warning: \[ReferenceEquality\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This annotation is missing required modifiers as specified by its @RequiredModifiers annotation',
-     'patterns': [r".*: warning: \[RequiredModifiers\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Void methods should not have a @return tag.',
-     'patterns': [r".*: warning: \[ReturnFromVoid\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Prefer the short-circuiting boolean operators \u0026\u0026 and || to \u0026 and |.',
-     'patterns': [r".*: warning: \[ShortCircuitBoolean\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Writes to static fields should not be guarded by instance locks',
-     'patterns': [r".*: warning: \[StaticGuardedByInstance\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: A static variable or method should be qualified with a class name, not expression',
-     'patterns': [r".*: warning: \[StaticQualifiedUsingExpression\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Streams that encapsulate a closeable resource should be closed using try-with-resources',
-     'patterns': [r".*: warning: \[StreamResourceLeak\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: String comparison using reference equality instead of value equality',
-     'patterns': [r".*: warning: \[StringEquality\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: String.split(String) has surprising behavior',
-     'patterns': [r".*: warning: \[StringSplitter\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: SWIG generated code that can\'t call a C++ destructor will leak memory',
-     'patterns': [r".*: warning: \[SwigMemoryLeak\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Synchronizing on non-final fields is not safe: if the field is ever updated, different threads may end up locking on different objects.',
-     'patterns': [r".*: warning: \[SynchronizeOnNonFinalField\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Code that contains System.exit() is untestable.',
-     'patterns': [r".*: warning: \[SystemExitOutsideMain\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Using @Test(expected=...) is discouraged, since the test will pass if *any* statement in the test method throws the expected exception',
-     'patterns': [r".*: warning: \[TestExceptionChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Thread.join needs to be surrounded by a loop until it succeeds, as in Uninterruptibles.joinUninterruptibly.',
-     'patterns': [r".*: warning: \[ThreadJoinLoop\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: ThreadLocals should be stored in static fields',
-     'patterns': [r".*: warning: \[ThreadLocalUsage\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Relying on the thread scheduler is discouraged; see Effective Java Item 72 (2nd edition) / 84 (3rd edition).',
-     'patterns': [r".*: warning: \[ThreadPriorityCheck\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Three-letter time zone identifiers are deprecated, may be ambiguous, and might not do what you intend; the full IANA time zone ID should be used instead.',
-     'patterns': [r".*: warning: \[ThreeLetterTimeZoneID\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: An implementation of Object.toString() should never return null.',
-     'patterns': [r".*: warning: \[ToStringReturnsNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: The actual and expected values appear to be swapped, which results in poor assertion failure messages. The actual value should come first.',
-     'patterns': [r".*: warning: \[TruthAssertExpected\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Truth Library assert is called on a constant.',
-     'patterns': [r".*: warning: \[TruthConstantAsserts\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Argument is not compatible with the subject\'s type.',
-     'patterns': [r".*: warning: \[TruthIncompatibleType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Type parameter declaration shadows another named type',
-     'patterns': [r".*: warning: \[TypeNameShadowing\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Type parameter declaration overrides another type parameter already declared',
-     'patterns': [r".*: warning: \[TypeParameterShadowing\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Declaring a type parameter that is only used in the return type is a misuse of generics: operations on the type parameter are unchecked, it hides unsafe casts at invocations of the method, and it interacts badly with method overload resolution.',
-     'patterns': [r".*: warning: \[TypeParameterUnusedInFormals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Avoid hash-based containers of java.net.URL--the containers rely on equals() and hashCode(), which cause java.net.URL to make blocking internet connections.',
-     'patterns': [r".*: warning: \[URLEqualsHashCode\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Collection, Iterable, Multimap, and Queue do not have well-defined equals behavior',
-     'patterns': [r".*: warning: \[UndefinedEquals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Switch handles all enum values: an explicit default case is unnecessary and defeats error checking for non-exhaustive switches.',
-     'patterns': [r".*: warning: \[UnnecessaryDefaultInEnumSwitch\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Unnecessary use of grouping parentheses',
-     'patterns': [r".*: warning: \[UnnecessaryParentheses\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Finalizer may run before native code finishes execution',
-     'patterns': [r".*: warning: \[UnsafeFinalization\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Prefer `asSubclass` instead of casting the result of `newInstance`, to detect classes of incorrect type before invoking their constructors.This way, if the class is of the incorrect type,it will throw an exception before invoking its constructor.',
-     'patterns': [r".*: warning: \[UnsafeReflectiveConstructionCast\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Unsynchronized method overrides a synchronized method.',
-     'patterns': [r".*: warning: \[UnsynchronizedOverridesSynchronized\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Unused.',
-     'patterns': [r".*: warning: \[Unused\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: This catch block catches an exception and re-throws another, but swallows the caught exception rather than setting it as a cause. This can make debugging harder.',
-     'patterns': [r".*: warning: \[UnusedException\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Java assert is used in test. For testing purposes Assert.* matchers should be used.',
-     'patterns': [r".*: warning: \[UseCorrectAssertInTests\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Non-constant variable missing @Var annotation',
-     'patterns': [r".*: warning: \[Var\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: variableName and type with the same name would refer to the static field instead of the class',
-     'patterns': [r".*: warning: \[VariableNameSameAsType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: Because of spurious wakeups, Object.wait() and Condition.await() must always be called in a loop',
-     'patterns': [r".*: warning: \[WaitNotInLoop\] .+"]},
-    {'category': 'java',
-     'severity': Severity.MEDIUM,
-     'description':
-         'Java: A wakelock acquired with a timeout may be released by the system before calling `release`, even after checking `isHeld()`. If so, it will throw a RuntimeException. Please wrap in a try/catch block.',
-     'patterns': [r".*: warning: \[WakelockReleasedDangerously\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: AndroidInjection.inject() should always be invoked before calling super.lifecycleMethod()',
-     'patterns': [r".*: warning: \[AndroidInjectionBeforeSuper\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Use of class, field, or method that is not compatible with legacy Android devices',
-     'patterns': [r".*: warning: \[AndroidJdkLibsChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Reference equality used to compare arrays',
-     'patterns': [r".*: warning: \[ArrayEquals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Arrays.fill(Object[], Object) called with incompatible types.',
-     'patterns': [r".*: warning: \[ArrayFillIncompatibleType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: hashcode method on array does not hash array contents',
-     'patterns': [r".*: warning: \[ArrayHashCode\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Calling toString on an array does not provide useful information',
-     'patterns': [r".*: warning: \[ArrayToString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Arrays.asList does not autobox primitive arrays, as one might expect.',
-     'patterns': [r".*: warning: \[ArraysAsListPrimitiveArray\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @AssistedInject and @Inject cannot be used on the same constructor.',
-     'patterns': [r".*: warning: \[AssistedInjectAndInjectOnSameConstructor\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: AsyncCallable should not return a null Future, only a Future whose result is null.',
-     'patterns': [r".*: warning: \[AsyncCallableReturnsNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: AsyncFunction should not return a null Future, only a Future whose result is null.',
-     'patterns': [r".*: warning: \[AsyncFunctionReturnsNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @AutoFactory and @Inject should not be used in the same type.',
-     'patterns': [r".*: warning: \[AutoFactoryAtInject\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Arguments to AutoValue constructor are in the wrong order',
-     'patterns': [r".*: warning: \[AutoValueConstructorOrderChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Shift by an amount that is out of range',
-     'patterns': [r".*: warning: \[BadShiftAmount\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Object serialized in Bundle may have been flattened to base type.',
-     'patterns': [r".*: warning: \[BundleDeserializationCast\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: The called constructor accepts a parameter with the same name and type as one of its caller\'s parameters, but its caller doesn\'t pass that parameter to it.  It\'s likely that it was intended to.',
-     'patterns': [r".*: warning: \[ChainingConstructorIgnoresParameter\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Ignored return value of method that is annotated with @CheckReturnValue',
-     'patterns': [r".*: warning: \[CheckReturnValue\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: The source file name should match the name of the top-level class it contains',
-     'patterns': [r".*: warning: \[ClassName\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Incompatible type as argument to Object-accepting Java collections method',
-     'patterns': [r".*: warning: \[CollectionIncompatibleType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java:  Implementing \'Comparable\u003cT>\' where T is not compatible with the implementing class.',
-     'patterns': [r".*: warning: \[ComparableType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: this == null is always false, this != null is always true',
-     'patterns': [r".*: warning: \[ComparingThisWithNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This comparison method violates the contract',
-     'patterns': [r".*: warning: \[ComparisonContractViolated\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Comparison to value that is out of range for the compared type',
-     'patterns': [r".*: warning: \[ComparisonOutOfRange\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @CompatibleWith\'s value is not a type argument.',
-     'patterns': [r".*: warning: \[CompatibleWithAnnotationMisuse\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Non-compile-time constant expression passed to parameter with @CompileTimeConstant type annotation.',
-     'patterns': [r".*: warning: \[CompileTimeConstant\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Non-trivial compile time constant boolean expressions shouldn\'t be used.',
-     'patterns': [r".*: warning: \[ComplexBooleanConstant\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A conditional expression with numeric operands of differing types will perform binary numeric promotion of the operands; when these operands are of reference types, the expression\'s result may not be of the expected type.',
-     'patterns': [r".*: warning: \[ConditionalExpressionNumericPromotion\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Compile-time constant expression overflows',
-     'patterns': [r".*: warning: \[ConstantOverflow\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Dagger @Provides methods may not return null unless annotated with @Nullable',
-     'patterns': [r".*: warning: \[DaggerProvidesNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Exception created but not thrown',
-     'patterns': [r".*: warning: \[DeadException\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Thread created but not started',
-     'patterns': [r".*: warning: \[DeadThread\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Deprecated item is not annotated with @Deprecated',
-     'patterns': [r".*: warning: \[DepAnn\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Division by integer literal zero',
-     'patterns': [r".*: warning: \[DivZero\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method should not be called.',
-     'patterns': [r".*: warning: \[DoNotCall\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Empty statement after if',
-     'patterns': [r".*: warning: \[EmptyIf\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: == NaN always returns false; use the isNaN methods instead',
-     'patterns': [r".*: warning: \[EqualsNaN\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: == must be used in equals method to check equality to itself or an infinite loop will occur.',
-     'patterns': [r".*: warning: \[EqualsReference\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Comparing different pairs of fields/getters in an equals implementation is probably a mistake.',
-     'patterns': [r".*: warning: \[EqualsWrongThing\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Method annotated @ForOverride must be protected or package-private and only invoked from declaring class, or from an override of the method',
-     'patterns': [r".*: warning: \[ForOverride\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Invalid printf-style format string',
-     'patterns': [r".*: warning: \[FormatString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Invalid format string passed to formatting method.',
-     'patterns': [r".*: warning: \[FormatStringAnnotation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Casting a lambda to this @FunctionalInterface can cause a behavior change from casting to a functional superinterface, which is surprising to users.  Prefer decorator methods to this surprising behavior.',
-     'patterns': [r".*: warning: \[FunctionalInterfaceMethodChanged\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Futures.getChecked requires a checked exception type with a standard constructor.',
-     'patterns': [r".*: warning: \[FuturesGetCheckedIllegalExceptionType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: DoubleMath.fuzzyEquals should never be used in an Object.equals() method',
-     'patterns': [r".*: warning: \[FuzzyEqualsShouldNotBeUsedInEqualsMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Calling getClass() on an annotation may return a proxy class',
-     'patterns': [r".*: warning: \[GetClassOnAnnotation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Calling getClass() on an object of type Class returns the Class object for java.lang.Class; you probably meant to operate on the object directly',
-     'patterns': [r".*: warning: \[GetClassOnClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Checks for unguarded accesses to fields and methods with @GuardedBy annotations',
-     'patterns': [r".*: warning: \[GuardedBy\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Scope annotation on implementation class of AssistedInject factory is not allowed',
-     'patterns': [r".*: warning: \[GuiceAssistedInjectScoping\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A constructor cannot have two @Assisted parameters of the same type unless they are disambiguated with named @Assisted annotations.',
-     'patterns': [r".*: warning: \[GuiceAssistedParameters\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Although Guice allows injecting final fields, doing so is disallowed because the injected value may not be visible to other threads.',
-     'patterns': [r".*: warning: \[GuiceInjectOnFinalField\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: contains() is a legacy method that is equivalent to containsValue()',
-     'patterns': [r".*: warning: \[HashtableContains\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A binary expression where both operands are the same is usually incorrect.',
-     'patterns': [r".*: warning: \[IdentityBinaryExpression\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Type declaration annotated with @Immutable is not immutable',
-     'patterns': [r".*: warning: \[Immutable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Modifying an immutable collection is guaranteed to throw an exception and leave the collection unmodified',
-     'patterns': [r".*: warning: \[ImmutableModification\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Passing argument to a generic method with an incompatible type.',
-     'patterns': [r".*: warning: \[IncompatibleArgumentType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: The first argument to indexOf is a Unicode code point, and the second is the index to start the search from',
-     'patterns': [r".*: warning: \[IndexOfChar\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Conditional expression in varargs call contains array and non-array arguments',
-     'patterns': [r".*: warning: \[InexactVarargsConditional\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method always recurses, and will cause a StackOverflowError',
-     'patterns': [r".*: warning: \[InfiniteRecursion\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A scoping annotation\'s Target should include TYPE and METHOD.',
-     'patterns': [r".*: warning: \[InjectInvalidTargetingOnScopingAnnotation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Using more than one qualifier annotation on the same element is not allowed.',
-     'patterns': [r".*: warning: \[InjectMoreThanOneQualifier\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A class can be annotated with at most one scope annotation.',
-     'patterns': [r".*: warning: \[InjectMoreThanOneScopeAnnotationOnClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Members shouldn\'t be annotated with @Inject if constructor is already annotated @Inject',
-     'patterns': [r".*: warning: \[InjectOnMemberAndConstructor\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Scope annotation on an interface or abstact class is not allowed',
-     'patterns': [r".*: warning: \[InjectScopeAnnotationOnInterfaceOrAbstractClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Scoping and qualifier annotations must have runtime retention.',
-     'patterns': [r".*: warning: \[InjectScopeOrQualifierAnnotationRetention\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Injected constructors cannot be optional nor have binding annotations',
-     'patterns': [r".*: warning: \[InjectedConstructorAnnotations\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A standard cryptographic operation is used in a mode that is prone to vulnerabilities',
-     'patterns': [r".*: warning: \[InsecureCryptoUsage\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Invalid syntax used for a regular expression',
-     'patterns': [r".*: warning: \[InvalidPatternSyntax\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Invalid time zone identifier. TimeZone.getTimeZone(String) will silently return GMT instead of the time zone you intended.',
-     'patterns': [r".*: warning: \[InvalidTimeZoneID\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: The argument to Class#isInstance(Object) should not be a Class',
-     'patterns': [r".*: warning: \[IsInstanceOfClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Log tag too long, cannot exceed 23 characters.',
-     'patterns': [r".*: warning: \[IsLoggableTagLength\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Path implements Iterable\u003cPath>; prefer Collection\u003cPath> for clarity',
-     'patterns': [r".*: warning: \[IterablePathParameter\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: jMock tests must have a @RunWith(JMock.class) annotation, or the Mockery field must have a @Rule JUnit annotation',
-     'patterns': [r".*: warning: \[JMockTestWithoutRunWithOrRuleAnnotation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Test method will not be run; please correct method signature (Should be public, non-static, and method name should begin with "test").',
-     'patterns': [r".*: warning: \[JUnit3TestNotRun\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method should be static',
-     'patterns': [r".*: warning: \[JUnit4ClassAnnotationNonStatic\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: setUp() method will not be run; please add JUnit\'s @Before annotation',
-     'patterns': [r".*: warning: \[JUnit4SetUpNotRun\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: tearDown() method will not be run; please add JUnit\'s @After annotation',
-     'patterns': [r".*: warning: \[JUnit4TearDownNotRun\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This looks like a test method but is not run; please add @Test and @Ignore, or, if this is a helper method, reduce its visibility.',
-     'patterns': [r".*: warning: \[JUnit4TestNotRun\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: An object is tested for reference equality to itself using JUnit library.',
-     'patterns': [r".*: warning: \[JUnitAssertSameCheck\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Use of class, field, or method that is not compatible with JDK 7',
-     'patterns': [r".*: warning: \[Java7ApiChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Abstract and default methods are not injectable with javax.inject.Inject',
-     'patterns': [r".*: warning: \[JavaxInjectOnAbstractMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @javax.inject.Inject cannot be put on a final field.',
-     'patterns': [r".*: warning: \[JavaxInjectOnFinalField\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This pattern will silently corrupt certain byte sequences from the serialized protocol message. Use ByteString or byte[] directly',
-     'patterns': [r".*: warning: \[LiteByteStringUtf8\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method does not acquire the locks specified by its @LockMethod annotation',
-     'patterns': [r".*: warning: \[LockMethodChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Prefer \'L\' to \'l\' for the suffix to long literals',
-     'patterns': [r".*: warning: \[LongLiteralLowerCaseSuffix\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Loop condition is never modified in loop body.',
-     'patterns': [r".*: warning: \[LoopConditionChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Math.round(Integer) results in truncation',
-     'patterns': [r".*: warning: \[MathRoundIntLong\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Certain resources in `android.R.string` have names that do not match their content',
-     'patterns': [r".*: warning: \[MislabeledAndroidString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Overriding method is missing a call to overridden super method',
-     'patterns': [r".*: warning: \[MissingSuperCall\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A terminating method call is required for a test helper to have any effect.',
-     'patterns': [r".*: warning: \[MissingTestCall\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Use of "YYYY" (week year) in a date pattern without "ww" (week in year). You probably meant to use "yyyy" (year) instead.',
-     'patterns': [r".*: warning: \[MisusedWeekYear\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: A bug in Mockito will cause this test to fail at runtime with a ClassCastException',
-     'patterns': [r".*: warning: \[MockitoCast\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Missing method call for verify(mock) here',
-     'patterns': [r".*: warning: \[MockitoUsage\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Using a collection function with itself as the argument.',
-     'patterns': [r".*: warning: \[ModifyingCollectionWithItself\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This class has more than one @Inject-annotated constructor. Please remove the @Inject annotation from all but one of them.',
-     'patterns': [r".*: warning: \[MoreThanOneInjectableConstructor\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: The result of this method must be closed.',
-     'patterns': [r".*: warning: \[MustBeClosedChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: The first argument to nCopies is the number of copies, and the second is the item to copy',
-     'patterns': [r".*: warning: \[NCopiesOfChar\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @NoAllocation was specified on this method, but something was found that would trigger an allocation',
-     'patterns': [r".*: warning: \[NoAllocation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Static import of type uses non-canonical name',
-     'patterns': [r".*: warning: \[NonCanonicalStaticImport\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @CompileTimeConstant parameters should be final or effectively final',
-     'patterns': [r".*: warning: \[NonFinalCompileTimeConstant\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Calling getAnnotation on an annotation that is not retained at runtime.',
-     'patterns': [r".*: warning: \[NonRuntimeAnnotation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This conditional expression may evaluate to null, which will result in an NPE when the result is unboxed.',
-     'patterns': [r".*: warning: \[NullTernary\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Numeric comparison using reference equality instead of value equality',
-     'patterns': [r".*: warning: \[NumericEquality\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Comparison using reference equality instead of value equality',
-     'patterns': [r".*: warning: \[OptionalEquality\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Annotations cannot be both Scope annotations and Qualifier annotations: this causes confusion when trying to use them.',
-     'patterns': [r".*: warning: \[OverlappingQualifierAndScopeAnnotation\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method is not annotated with @Inject, but it overrides a method that is  annotated with @javax.inject.Inject. The method will not be Injected.',
-     'patterns': [r".*: warning: \[OverridesJavaxInjectableMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Declaring types inside package-info.java files is very bad form',
-     'patterns': [r".*: warning: \[PackageInfo\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Method parameter has wrong package',
-     'patterns': [r".*: warning: \[ParameterPackage\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Detects classes which implement Parcelable but don\'t have CREATOR',
-     'patterns': [r".*: warning: \[ParcelableCreator\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Literal passed as first argument to Preconditions.checkNotNull() can never be null',
-     'patterns': [r".*: warning: \[PreconditionsCheckNotNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: First argument to `Preconditions.checkNotNull()` is a primitive rather than an object reference',
-     'patterns': [r".*: warning: \[PreconditionsCheckNotNullPrimitive\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Using ::equals or ::isInstance as an incompatible Predicate; the predicate will always return false',
-     'patterns': [r".*: warning: \[PredicateIncompatibleType\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Access to a private protocol buffer field is forbidden. This protocol buffer carries a security contract, and can only be created using an approved library. Direct access to the fields is forbidden.',
-     'patterns': [r".*: warning: \[PrivateSecurityContractProtoAccess\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Protobuf fields cannot be null.',
-     'patterns': [r".*: warning: \[ProtoFieldNullComparison\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Comparing protobuf fields of type String using reference equality',
-     'patterns': [r".*: warning: \[ProtoStringFieldReferenceEquality\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: To get the tag number of a protocol buffer enum, use getNumber() instead.',
-     'patterns': [r".*: warning: \[ProtocolBufferOrdinal\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: @Provides methods need to be declared in a Module to have any effect.',
-     'patterns': [r".*: warning: \[ProvidesMethodOutsideOfModule\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Casting a random number in the range [0.0, 1.0) to an integer or long always results in 0.',
-     'patterns': [r".*: warning: \[RandomCast\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Use Random.nextInt(int).  Random.nextInt() % n can have negative results',
-     'patterns': [r".*: warning: \[RandomModInteger\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Return value of android.graphics.Rect.intersect() must be checked',
-     'patterns': [r".*: warning: \[RectIntersectReturnValueIgnored\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Use of method or class annotated with @RestrictTo',
-     'patterns': [r".*: warning: \[RestrictTo\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java:  Check for non-whitelisted callers to RestrictedApiChecker.',
-     'patterns': [r".*: warning: \[RestrictedApiChecker\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Return value of this method must be used',
-     'patterns': [r".*: warning: \[ReturnValueIgnored\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Variable assigned to itself',
-     'patterns': [r".*: warning: \[SelfAssignment\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: An object is compared to itself',
-     'patterns': [r".*: warning: \[SelfComparison\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Testing an object for equality with itself will always be true.',
-     'patterns': [r".*: warning: \[SelfEquals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method must be called with an even number of arguments.',
-     'patterns': [r".*: warning: \[ShouldHaveEvenArgs\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Comparison of a size >= 0 is always true, did you intend to check for non-emptiness?',
-     'patterns': [r".*: warning: \[SizeGreaterThanOrEqualsZero\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Static and default interface methods are not natively supported on older Android devices. ',
-     'patterns': [r".*: warning: \[StaticOrDefaultInterfaceMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Calling toString on a Stream does not provide useful information',
-     'patterns': [r".*: warning: \[StreamToString\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: StringBuilder does not have a char constructor; this invokes the int constructor.',
-     'patterns': [r".*: warning: \[StringBuilderInitWithChar\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: String.substring(0) returns the original String',
-     'patterns': [r".*: warning: \[SubstringOfZero\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Suppressing "deprecated" is probably a typo for "deprecation"',
-     'patterns': [r".*: warning: \[SuppressWarningsDeprecated\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: throwIfUnchecked(knownCheckedException) is a no-op.',
-     'patterns': [r".*: warning: \[ThrowIfUncheckedKnownChecked\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Throwing \'null\' always results in a NullPointerException being thrown.',
-     'patterns': [r".*: warning: \[ThrowNull\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: isEqualTo should not be used to test an object for equality with itself; the assertion will never fail.',
-     'patterns': [r".*: warning: \[TruthSelfEquals\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Catching Throwable/Error masks failures from fail() or assert*() in the try block',
-     'patterns': [r".*: warning: \[TryFailThrowable\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Type parameter used as type qualifier',
-     'patterns': [r".*: warning: \[TypeParameterQualifier\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: This method does not acquire the locks specified by its @UnlockMethod annotation',
-     'patterns': [r".*: warning: \[UnlockMethod\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Non-generic methods should not be invoked with type arguments',
-     'patterns': [r".*: warning: \[UnnecessaryTypeArgument\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Instance created but never used',
-     'patterns': [r".*: warning: \[UnusedAnonymousClass\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: Collection is modified in place, but the result is not used',
-     'patterns': [r".*: warning: \[UnusedCollectionModifiedInPlace\] .+"]},
-    {'category': 'java',
-     'severity': Severity.HIGH,
-     'description':
-         'Java: `var` should not be used as a type name.',
-     'patterns': [r".*: warning: \[VarTypeName\] .+"]},
-
-    # End warnings generated by Error Prone
-
-    {'category': 'java',
-     'severity': Severity.UNKNOWN,
-     'description': 'Java: Unclassified/unrecognized warnings',
-     'patterns': [r".*: warning: \[.+\] .+"]},
-
-    {'category': 'aapt', 'severity': Severity.MEDIUM,
-     'description': 'aapt: No default translation',
-     'patterns': [r".*: warning: string '.+' has no default translation in .*"]},
-    {'category': 'aapt', 'severity': Severity.MEDIUM,
-     'description': 'aapt: Missing default or required localization',
-     'patterns': [r".*: warning: \*\*\*\* string '.+' has no default or required localization for '.+' in .+"]},
-    {'category': 'aapt', 'severity': Severity.MEDIUM,
-     'description': 'aapt: String marked untranslatable, but translation exists',
-     'patterns': [r".*: warning: string '.+' in .* marked untranslatable but exists in locale '??_??'"]},
-    {'category': 'aapt', 'severity': Severity.MEDIUM,
-     'description': 'aapt: empty span in string',
-     'patterns': [r".*: warning: empty '.+' span found in text '.+"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Taking address of temporary',
-     'patterns': [r".*: warning: taking address of temporary"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Taking address of packed member',
-     'patterns': [r".*: warning: taking address of packed member"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Possible broken line continuation',
-     'patterns': [r".*: warning: backslash and newline separated by space"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wundefined-var-template',
-     'description': 'Undefined variable template',
-     'patterns': [r".*: warning: instantiation of variable .* no definition is available"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wundefined-inline',
-     'description': 'Inline function is not defined',
-     'patterns': [r".*: warning: inline function '.*' is not defined"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Warray-bounds',
-     'description': 'Array subscript out of bounds',
-     'patterns': [r".*: warning: array subscript is above array bounds",
-                  r".*: warning: Array subscript is undefined",
-                  r".*: warning: array subscript is below array bounds"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Excess elements in initializer',
-     'patterns': [r".*: warning: excess elements in .+ initializer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Decimal constant is unsigned only in ISO C90',
-     'patterns': [r".*: warning: this decimal constant is unsigned only in ISO C90"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmain',
-     'description': 'main is usually a function',
-     'patterns': [r".*: warning: 'main' is usually a function"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Typedef ignored',
-     'patterns': [r".*: warning: 'typedef' was ignored in this declaration"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-Waddress',
-     'description': 'Address always evaluates to true',
-     'patterns': [r".*: warning: the address of '.+' will always evaluate as 'true'"]},
-    {'category': 'C/C++', 'severity': Severity.FIXMENOW,
-     'description': 'Freeing a non-heap object',
-     'patterns': [r".*: warning: attempt to free a non-heap object '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wchar-subscripts',
-     'description': 'Array subscript has type char',
-     'patterns': [r".*: warning: array subscript .+ type 'char'.+Wchar-subscripts"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Constant too large for type',
-     'patterns': [r".*: warning: integer constant is too large for '.+' type"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Woverflow',
-     'description': 'Constant too large for type, truncated',
-     'patterns': [r".*: warning: large integer implicitly truncated to unsigned type"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Winteger-overflow',
-     'description': 'Overflow in expression',
-     'patterns': [r".*: warning: overflow in expression; .*Winteger-overflow"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Woverflow',
-     'description': 'Overflow in implicit constant conversion',
-     'patterns': [r".*: warning: overflow in implicit constant conversion"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Declaration does not declare anything',
-     'patterns': [r".*: warning: declaration 'class .+' does not declare anything"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wreorder',
-     'description': 'Initialization order will be different',
-     'patterns': [r".*: warning: '.+' will be initialized after",
-                  r".*: warning: field .+ will be initialized after .+Wreorder"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip,   ....',
-     'patterns': [r".*: warning:   '.+'"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip,   base ...',
-     'patterns': [r".*: warning:   base '.+'"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip,   when initialized here',
-     'patterns': [r".*: warning:   when initialized here"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmissing-parameter-type',
-     'description': 'Parameter type not specified',
-     'patterns': [r".*: warning: type of '.+' defaults to 'int'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmissing-declarations',
-     'description': 'Missing declarations',
-     'patterns': [r".*: warning: declaration does not declare anything"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wmissing-noreturn',
-     'description': 'Missing noreturn',
-     'patterns': [r".*: warning: function '.*' could be declared with attribute 'noreturn'"]},
-    # pylint:disable=anomalous-backslash-in-string
-    # TODO(chh): fix the backslash pylint warning.
-    {'category': 'gcc', 'severity': Severity.MEDIUM,
-     'description': 'Invalid option for C file',
-     'patterns': [r".*: warning: command line option "".+"" is valid for C\+\+\/ObjC\+\+ but not for C"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'User warning',
-     'patterns': [r".*: warning: #warning "".+"""]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wvexing-parse',
-     'description': 'Vexing parsing problem',
-     'patterns': [r".*: warning: empty parentheses interpreted as a function declaration"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wextra',
-     'description': 'Dereferencing void*',
-     'patterns': [r".*: warning: dereferencing 'void \*' pointer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Comparison of pointer and integer',
-     'patterns': [r".*: warning: ordered comparison of pointer with integer zero",
-                  r".*: warning: .*comparison between pointer and integer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Use of error-prone unary operator',
-     'patterns': [r".*: warning: use of unary operator that may be intended as compound assignment"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wwrite-strings',
-     'description': 'Conversion of string constant to non-const char*',
-     'patterns': [r".*: warning: deprecated conversion from string constant to '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wstrict-prototypes',
-     'description': 'Function declaration isn''t a prototype',
-     'patterns': [r".*: warning: function declaration isn't a prototype"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wignored-qualifiers',
-     'description': 'Type qualifiers ignored on function return value',
-     'patterns': [r".*: warning: type qualifiers ignored on function return type",
-                  r".*: warning: .+ type qualifier .+ has no effect .+Wignored-qualifiers"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': '&lt;foo&gt; declared inside parameter list, scope limited to this definition',
-     'patterns': [r".*: warning: '.+' declared inside parameter list"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip, its scope is only this ...',
-     'patterns': [r".*: warning: its scope is only this definition or declaration, which is probably not what you want"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wcomment',
-     'description': 'Line continuation inside comment',
-     'patterns': [r".*: warning: multi-line comment"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wcomment',
-     'description': 'Comment inside comment',
-     'patterns': [r".*: warning: "".+"" within comment"]},
-    # Warning "value stored is never read" could be from clang-tidy or clang static analyzer.
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Value stored is never read',
-     'patterns': [r".*: warning: Value stored to .+ is never read.*clang-analyzer-deadcode.DeadStores"]},
-    {'category': 'C/C++', 'severity': Severity.LOW,
-     'description': 'Value stored is never read',
-     'patterns': [r".*: warning: Value stored to .+ is never read"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wdeprecated-declarations',
-     'description': 'Deprecated declarations',
-     'patterns': [r".*: warning: .+ is deprecated.+deprecated-declarations"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wdeprecated-register',
-     'description': 'Deprecated register',
-     'patterns': [r".*: warning: 'register' storage class specifier is deprecated"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wpointer-sign',
-     'description': 'Converts between pointers to integer types with different sign',
-     'patterns': [r".*: warning: .+ converts between pointers to integer types with different sign"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'Extra tokens after #endif',
-     'patterns': [r".*: warning: extra tokens at end of #endif directive"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wenum-compare',
-     'description': 'Comparison between different enums',
-     'patterns': [r".*: warning: comparison between '.+' and '.+'.+Wenum-compare"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wconversion',
-     'description': 'Conversion may change value',
-     'patterns': [r".*: warning: converting negative value '.+' to '.+'",
-                  r".*: warning: conversion to '.+' .+ may (alter|change)"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wconversion-null',
-     'description': 'Converting to non-pointer type from NULL',
-     'patterns': [r".*: warning: converting to non-pointer type '.+' from NULL"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wsign-conversion',
-     'description': 'Implicit sign conversion',
-     'patterns': [r".*: warning: implicit conversion changes signedness"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wnull-conversion',
-     'description': 'Converting NULL to non-pointer type',
-     'patterns': [r".*: warning: implicit conversion of NULL constant to '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wnon-literal-null-conversion',
-     'description': 'Zero used as null pointer',
-     'patterns': [r".*: warning: expression .* zero treated as a null pointer constant"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Implicit conversion changes value',
-     'patterns': [r".*: warning: implicit conversion .* changes value from .* to .*-conversion"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Passing NULL as non-pointer argument',
-     'patterns': [r".*: warning: passing NULL to non-pointer argument [0-9]+ of '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wctor-dtor-privacy',
-     'description': 'Class seems unusable because of private ctor/dtor',
-     'patterns': [r".*: warning: all member functions in class '.+' are private"]},
-    # skip this next one, because it only points out some RefBase-based classes where having a private destructor is perfectly fine
-    {'category': 'C/C++', 'severity': Severity.SKIP, 'option': '-Wctor-dtor-privacy',
-     'description': 'Class seems unusable because of private ctor/dtor',
-     'patterns': [r".*: warning: 'class .+' only defines a private destructor and has no friends"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wctor-dtor-privacy',
-     'description': 'Class seems unusable because of private ctor/dtor',
-     'patterns': [r".*: warning: 'class .+' only defines private constructors and has no friends"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wgnu-static-float-init',
-     'description': 'In-class initializer for static const float/double',
-     'patterns': [r".*: warning: in-class initializer for static data member of .+const (float|double)"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wpointer-arith',
-     'description': 'void* used in arithmetic',
-     'patterns': [r".*: warning: pointer of type 'void \*' used in (arithmetic|subtraction)",
-                  r".*: warning: arithmetic on .+ to void is a GNU extension.*Wpointer-arith",
-                  r".*: warning: wrong type argument to increment"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wsign-promo',
-     'description': 'Overload resolution chose to promote from unsigned or enum to signed type',
-     'patterns': [r".*: warning: passing '.+' chooses '.+' over '.+'.*Wsign-promo"]},
-    {'category': 'cont.', 'severity': Severity.SKIP,
-     'description': 'skip,   in call to ...',
-     'patterns': [r".*: warning:   in call to '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.HIGH, 'option': '-Wextra',
-     'description': 'Base should be explicitly initialized in copy constructor',
-     'patterns': [r".*: warning: base class '.+' should be explicitly initialized in the copy constructor"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'VLA has zero or negative size',
-     'patterns': [r".*: warning: Declared variable-length array \(VLA\) has .+ size"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Return value from void function',
-     'patterns': [r".*: warning: 'return' with a value, in function returning void"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': 'multichar',
-     'description': 'Multi-character character constant',
-     'patterns': [r".*: warning: multi-character character constant"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': 'writable-strings',
-     'description': 'Conversion from string literal to char*',
-     'patterns': [r".*: warning: .+ does not allow conversion from string literal to 'char \*'"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wextra-semi',
-     'description': 'Extra \';\'',
-     'patterns': [r".*: warning: extra ';' .+extra-semi"]},
-    {'category': 'C/C++', 'severity': Severity.LOW,
-     'description': 'Useless specifier',
-     'patterns': [r".*: warning: useless storage class specifier in empty declaration"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wduplicate-decl-specifier',
-     'description': 'Duplicate declaration specifier',
-     'patterns': [r".*: warning: duplicate '.+' declaration specifier"]},
-    {'category': 'logtags', 'severity': Severity.LOW,
-     'description': 'Duplicate logtag',
-     'patterns': [r".*: warning: tag \".+\" \(.+\) duplicated in .+"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'typedef-redefinition',
-     'description': 'Typedef redefinition',
-     'patterns': [r".*: warning: redefinition of typedef '.+' is a C11 feature"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'gnu-designator',
-     'description': 'GNU old-style field designator',
-     'patterns': [r".*: warning: use of GNU old-style field designator extension"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'missing-field-initializers',
-     'description': 'Missing field initializers',
-     'patterns': [r".*: warning: missing field '.+' initializer"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'missing-braces',
-     'description': 'Missing braces',
-     'patterns': [r".*: warning: suggest braces around initialization of",
-                  r".*: warning: too many braces around scalar initializer .+Wmany-braces-around-scalar-init",
-                  r".*: warning: braces around scalar initializer"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'sign-compare',
-     'description': 'Comparison of integers of different signs',
-     'patterns': [r".*: warning: comparison of integers of different signs.+sign-compare"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'dangling-else',
-     'description': 'Add braces to avoid dangling else',
-     'patterns': [r".*: warning: add explicit braces to avoid dangling else"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'initializer-overrides',
-     'description': 'Initializer overrides prior initialization',
-     'patterns': [r".*: warning: initializer overrides prior initialization of this subobject"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'self-assign',
-     'description': 'Assigning value to self',
-     'patterns': [r".*: warning: explicitly assigning value of .+ to itself"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'gnu-variable-sized-type-not-at-end',
-     'description': 'GNU extension, variable sized type not at end',
-     'patterns': [r".*: warning: field '.+' with variable sized type '.+' not at the end of a struct or class"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'tautological-constant-out-of-range-compare',
-     'description': 'Comparison of constant is always false/true',
-     'patterns': [r".*: comparison of .+ is always .+Wtautological-constant-out-of-range-compare"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'overloaded-virtual',
-     'description': 'Hides overloaded virtual function',
-     'patterns': [r".*: '.+' hides overloaded virtual function"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'incompatible-pointer-types',
-     'description': 'Incompatible pointer types',
-     'patterns': [r".*: warning: incompatible pointer types .+Wincompatible-pointer-types"]},
-    {'category': 'logtags', 'severity': Severity.LOW, 'option': 'asm-operand-widths',
-     'description': 'ASM value size does not match register size',
-     'patterns': [r".*: warning: value size does not match register size specified by the constraint and modifier"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': 'tautological-compare',
-     'description': 'Comparison of self is always false',
-     'patterns': [r".*: self-comparison always evaluates to false"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': 'constant-logical-operand',
-     'description': 'Logical op with constant operand',
-     'patterns': [r".*: use of logical '.+' with constant operand"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': 'literal-suffix',
-     'description': 'Needs a space between literal and string macro',
-     'patterns': [r".*: warning: invalid suffix on literal.+ requires a space .+Wliteral-suffix"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '#warnings',
-     'description': 'Warnings from #warning',
-     'patterns': [r".*: warning: .+-W#warnings"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': 'absolute-value',
-     'description': 'Using float/int absolute value function with int/float argument',
-     'patterns': [r".*: warning: using .+ absolute value function .+ when argument is .+ type .+Wabsolute-value",
-                  r".*: warning: absolute value function '.+' given .+ which may cause truncation .+Wabsolute-value"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Wc++11-extensions',
-     'description': 'Using C++11 extensions',
-     'patterns': [r".*: warning: 'auto' type specifier is a C\+\+11 extension"]},
-    {'category': 'C/C++', 'severity': Severity.LOW,
-     'description': 'Refers to implicitly defined namespace',
-     'patterns': [r".*: warning: using directive refers to implicitly-defined namespace .+"]},
-    {'category': 'C/C++', 'severity': Severity.LOW, 'option': '-Winvalid-pp-token',
-     'description': 'Invalid pp token',
-     'patterns': [r".*: warning: missing .+Winvalid-pp-token"]},
-    {'category': 'link', 'severity': Severity.LOW,
-     'description': 'need glibc to link',
-     'patterns': [r".*: warning: .* requires at runtime .* glibc .* for linking"]},
-
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Operator new returns NULL',
-     'patterns': [r".*: warning: 'operator new' must not return NULL unless it is declared 'throw\(\)' .+"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wnull-arithmetic',
-     'description': 'NULL used in arithmetic',
-     'patterns': [r".*: warning: NULL used in arithmetic",
-                  r".*: warning: comparison between NULL and non-pointer"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': 'header-guard',
-     'description': 'Misspelled header guard',
-     'patterns': [r".*: warning: '.+' is used as a header guard .+ followed by .+ different macro"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': 'empty-body',
-     'description': 'Empty loop body',
-     'patterns': [r".*: warning: .+ loop has empty body"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': 'enum-conversion',
-     'description': 'Implicit conversion from enumeration type',
-     'patterns': [r".*: warning: implicit conversion from enumeration type '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': 'switch',
-     'description': 'case value not in enumerated type',
-     'patterns': [r".*: warning: case value not in enumerated type '.+'"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Undefined result',
-     'patterns': [r".*: warning: The result of .+ is undefined",
-                  r".*: warning: passing an object that .+ has undefined behavior \[-Wvarargs\]",
-                  r".*: warning: 'this' pointer cannot be null in well-defined C\+\+ code;",
-                  r".*: warning: shifting a negative signed value is undefined"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Division by zero',
-     'patterns': [r".*: warning: Division by zero"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Use of deprecated method',
-     'patterns': [r".*: warning: '.+' is deprecated .+"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Use of garbage or uninitialized value',
-     'patterns': [r".*: warning: .+ is a garbage value",
-                  r".*: warning: Function call argument is an uninitialized value",
-                  r".*: warning: Undefined or garbage value returned to caller",
-                  r".*: warning: Called .+ pointer is.+uninitialized",
-                  r".*: warning: Called .+ pointer is.+uninitalized",  # match a typo in compiler message
-                  r".*: warning: Use of zero-allocated memory",
-                  r".*: warning: Dereference of undefined pointer value",
-                  r".*: warning: Passed-by-value .+ contains uninitialized data",
-                  r".*: warning: Branch condition evaluates to a garbage value",
-                  r".*: warning: The .+ of .+ is an uninitialized value.",
-                  r".*: warning: .+ is used uninitialized whenever .+sometimes-uninitialized",
-                  r".*: warning: Assigned value is garbage or undefined"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Result of malloc type incompatible with sizeof operand type',
-     'patterns': [r".*: warning: Result of '.+' is converted to .+ incompatible with sizeof operand type"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wsizeof-array-argument',
-     'description': 'Sizeof on array argument',
-     'patterns': [r".*: warning: sizeof on array function parameter will return"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wsizeof-pointer-memacces',
-     'description': 'Bad argument size of memory access functions',
-     'patterns': [r".*: warning: .+\[-Wsizeof-pointer-memaccess\]"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Return value not checked',
-     'patterns': [r".*: warning: The return value from .+ is not checked"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Possible heap pollution',
-     'patterns': [r".*: warning: .*Possible heap pollution from .+ type .+"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Allocation size of 0 byte',
-     'patterns': [r".*: warning: Call to .+ has an allocation size of 0 byte"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Result of malloc type incompatible with sizeof operand type',
-     'patterns': [r".*: warning: Result of '.+' is converted to .+ incompatible with sizeof operand type"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wfor-loop-analysis',
-     'description': 'Variable used in loop condition not modified in loop body',
-     'patterns': [r".*: warning: variable '.+' used in loop condition.*Wfor-loop-analysis"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM,
-     'description': 'Closing a previously closed file',
-     'patterns': [r".*: warning: Closing a previously closed file"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wunnamed-type-template-args',
-     'description': 'Unnamed template type argument',
-     'patterns': [r".*: warning: template argument.+Wunnamed-type-template-args"]},
-    {'category': 'C/C++', 'severity': Severity.MEDIUM, 'option': '-Wimplicit-fallthrough',
-     'description': 'Unannotated fall-through between switch labels',
-     'patterns': [r".*: warning: unannotated fall-through between switch labels.+Wimplicit-fallthrough"]},
-
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'Discarded qualifier from pointer target type',
-     'patterns': [r".*: warning: .+ discards '.+' qualifier from pointer target type"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'Use snprintf instead of sprintf',
-     'patterns': [r".*: warning: .*sprintf is often misused; please use snprintf"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'Unsupported optimizaton flag',
-     'patterns': [r".*: warning: optimization flag '.+' is not supported"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS,
-     'description': 'Extra or missing parentheses',
-     'patterns': [r".*: warning: equality comparison with extraneous parentheses",
-                  r".*: warning: .+ within .+Wlogical-op-parentheses"]},
-    {'category': 'C/C++', 'severity': Severity.HARMLESS, 'option': 'mismatched-tags',
-     'description': 'Mismatched class vs struct tags',
-     'patterns': [r".*: warning: '.+' defined as a .+ here but previously declared as a .+mismatched-tags",
-                  r".*: warning: .+ was previously declared as a .+mismatched-tags"]},
-    {'category': 'FindEmulator', 'severity': Severity.HARMLESS,
-     'description': 'FindEmulator: No such file or directory',
-     'patterns': [r".*: warning: FindEmulator: .* No such file or directory"]},
-    {'category': 'google_tests', 'severity': Severity.HARMLESS,
-     'description': 'google_tests: unknown installed file',
-     'patterns': [r".*: warning: .*_tests: Unknown installed file for module"]},
-    {'category': 'make', 'severity': Severity.HARMLESS,
-     'description': 'unusual tags debug eng',
-     'patterns': [r".*: warning: .*: unusual tags debug eng"]},
-
-    # these next ones are to deal with formatting problems resulting from the log being mixed up by 'make -j'
-    {'category': 'C/C++', 'severity': Severity.SKIP,
-     'description': 'skip, ,',
-     'patterns': [r".*: warning: ,$"]},
-    {'category': 'C/C++', 'severity': Severity.SKIP,
-     'description': 'skip,',
-     'patterns': [r".*: warning: $"]},
-    {'category': 'C/C++', 'severity': Severity.SKIP,
-     'description': 'skip, In file included from ...',
-     'patterns': [r".*: warning: In file included from .+,"]},
-
-    # warnings from clang-tidy
-    group_tidy_warn_pattern('android'),
-    simple_tidy_warn_pattern('bugprone-argument-comment'),
-    simple_tidy_warn_pattern('bugprone-copy-constructor-init'),
-    simple_tidy_warn_pattern('bugprone-fold-init-type'),
-    simple_tidy_warn_pattern('bugprone-forward-declaration-namespace'),
-    simple_tidy_warn_pattern('bugprone-forwarding-reference-overload'),
-    simple_tidy_warn_pattern('bugprone-inaccurate-erase'),
-    simple_tidy_warn_pattern('bugprone-incorrect-roundings'),
-    simple_tidy_warn_pattern('bugprone-integer-division'),
-    simple_tidy_warn_pattern('bugprone-lambda-function-name'),
-    simple_tidy_warn_pattern('bugprone-macro-parentheses'),
-    simple_tidy_warn_pattern('bugprone-misplaced-widening-cast'),
-    simple_tidy_warn_pattern('bugprone-move-forwarding-reference'),
-    simple_tidy_warn_pattern('bugprone-sizeof-expression'),
-    simple_tidy_warn_pattern('bugprone-string-constructor'),
-    simple_tidy_warn_pattern('bugprone-string-integer-assignment'),
-    simple_tidy_warn_pattern('bugprone-suspicious-enum-usage'),
-    simple_tidy_warn_pattern('bugprone-suspicious-missing-comma'),
-    simple_tidy_warn_pattern('bugprone-suspicious-string-compare'),
-    simple_tidy_warn_pattern('bugprone-suspicious-semicolon'),
-    simple_tidy_warn_pattern('bugprone-undefined-memory-manipulation'),
-    simple_tidy_warn_pattern('bugprone-unused-raii'),
-    simple_tidy_warn_pattern('bugprone-use-after-move'),
-    group_tidy_warn_pattern('bugprone'),
-    group_tidy_warn_pattern('cert'),
-    group_tidy_warn_pattern('clang-diagnostic'),
-    group_tidy_warn_pattern('cppcoreguidelines'),
-    group_tidy_warn_pattern('llvm'),
-    simple_tidy_warn_pattern('google-default-arguments'),
-    simple_tidy_warn_pattern('google-runtime-int'),
-    simple_tidy_warn_pattern('google-runtime-operator'),
-    simple_tidy_warn_pattern('google-runtime-references'),
-    group_tidy_warn_pattern('google-build'),
-    group_tidy_warn_pattern('google-explicit'),
-    group_tidy_warn_pattern('google-redability'),
-    group_tidy_warn_pattern('google-global'),
-    group_tidy_warn_pattern('google-redability'),
-    group_tidy_warn_pattern('google-redability'),
-    group_tidy_warn_pattern('google'),
-    simple_tidy_warn_pattern('hicpp-explicit-conversions'),
-    simple_tidy_warn_pattern('hicpp-function-size'),
-    simple_tidy_warn_pattern('hicpp-invalid-access-moved'),
-    simple_tidy_warn_pattern('hicpp-member-init'),
-    simple_tidy_warn_pattern('hicpp-delete-operators'),
-    simple_tidy_warn_pattern('hicpp-special-member-functions'),
-    simple_tidy_warn_pattern('hicpp-use-equals-default'),
-    simple_tidy_warn_pattern('hicpp-use-equals-delete'),
-    simple_tidy_warn_pattern('hicpp-no-assembler'),
-    simple_tidy_warn_pattern('hicpp-noexcept-move'),
-    simple_tidy_warn_pattern('hicpp-use-override'),
-    group_tidy_warn_pattern('hicpp'),
-    group_tidy_warn_pattern('modernize'),
-    group_tidy_warn_pattern('misc'),
-    simple_tidy_warn_pattern('performance-faster-string-find'),
-    simple_tidy_warn_pattern('performance-for-range-copy'),
-    simple_tidy_warn_pattern('performance-implicit-cast-in-loop'),
-    simple_tidy_warn_pattern('performance-inefficient-string-concatenation'),
-    simple_tidy_warn_pattern('performance-type-promotion-in-math-fn'),
-    simple_tidy_warn_pattern('performance-unnecessary-copy-initialization'),
-    simple_tidy_warn_pattern('performance-unnecessary-value-param'),
-    group_tidy_warn_pattern('performance'),
-    group_tidy_warn_pattern('readability'),
-
-    # warnings from clang-tidy's clang-analyzer checks
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Unreachable code',
-     'patterns': [r".*: warning: This statement is never executed.*UnreachableCode"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Size of malloc may overflow',
-     'patterns': [r".*: warning: .* size of .* may overflow .*MallocOverflow"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Stream pointer might be NULL',
-     'patterns': [r".*: warning: Stream pointer might be NULL .*unix.Stream"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Opened file never closed',
-     'patterns': [r".*: warning: Opened File never closed.*unix.Stream"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer sozeof() on a pointer type',
-     'patterns': [r".*: warning: .*calls sizeof.* on a pointer type.*SizeofPtr"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Pointer arithmetic on non-array variables',
-     'patterns': [r".*: warning: Pointer arithmetic on non-array variables .*PointerArithm"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Subtraction of pointers of different memory chunks',
-     'patterns': [r".*: warning: Subtraction of two pointers .*PointerSub"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Access out-of-bound array element',
-     'patterns': [r".*: warning: Access out-of-bound array element .*ArrayBound"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Out of bound memory access',
-     'patterns': [r".*: warning: Out of bound memory access .*ArrayBoundV2"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Possible lock order reversal',
-     'patterns': [r".*: warning: .* Possible lock order reversal.*PthreadLock"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer Argument is a pointer to uninitialized value',
-     'patterns': [r".*: warning: .* argument is a pointer to uninitialized value .*CallAndMessage"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer cast to struct',
-     'patterns': [r".*: warning: Casting a non-structure type to a structure type .*CastToStruct"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer call path problems',
-     'patterns': [r".*: warning: Call Path : .+"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer excessive padding',
-     'patterns': [r".*: warning: Excessive padding in '.*'"]},
-    {'category': 'C/C++', 'severity': Severity.ANALYZER,
-     'description': 'clang-analyzer other',
-     'patterns': [r".*: .+\[clang-analyzer-.+\]$",
-                  r".*: Call Path : .+$"]},
-
-    # catch-all for warnings this script doesn't know about yet
-    {'category': 'C/C++', 'severity': Severity.UNKNOWN,
-     'description': 'Unclassified/unrecognized warnings',
-     'patterns': [r".*: warning: .+"]},
-]
-
-
-def project_name_and_pattern(name, pattern):
-  return [name, '(^|.*/)' + pattern + '/.*: warning:']
-
-
-def simple_project_pattern(pattern):
-  return project_name_and_pattern(pattern, pattern)
-
-
-# A list of [project_name, file_path_pattern].
-# project_name should not contain comma, to be used in CSV output.
-project_list = [
-    simple_project_pattern('art'),
-    simple_project_pattern('bionic'),
-    simple_project_pattern('bootable'),
-    simple_project_pattern('build'),
-    simple_project_pattern('cts'),
-    simple_project_pattern('dalvik'),
-    simple_project_pattern('developers'),
-    simple_project_pattern('development'),
-    simple_project_pattern('device'),
-    simple_project_pattern('doc'),
-    # match external/google* before external/
-    project_name_and_pattern('external/google', 'external/google.*'),
-    project_name_and_pattern('external/non-google', 'external'),
-    simple_project_pattern('frameworks/av/camera'),
-    simple_project_pattern('frameworks/av/cmds'),
-    simple_project_pattern('frameworks/av/drm'),
-    simple_project_pattern('frameworks/av/include'),
-    simple_project_pattern('frameworks/av/media/img_utils'),
-    simple_project_pattern('frameworks/av/media/libcpustats'),
-    simple_project_pattern('frameworks/av/media/libeffects'),
-    simple_project_pattern('frameworks/av/media/libmediaplayerservice'),
-    simple_project_pattern('frameworks/av/media/libmedia'),
-    simple_project_pattern('frameworks/av/media/libstagefright'),
-    simple_project_pattern('frameworks/av/media/mtp'),
-    simple_project_pattern('frameworks/av/media/ndk'),
-    simple_project_pattern('frameworks/av/media/utils'),
-    project_name_and_pattern('frameworks/av/media/Other',
-                             'frameworks/av/media'),
-    simple_project_pattern('frameworks/av/radio'),
-    simple_project_pattern('frameworks/av/services'),
-    simple_project_pattern('frameworks/av/soundtrigger'),
-    project_name_and_pattern('frameworks/av/Other', 'frameworks/av'),
-    simple_project_pattern('frameworks/base/cmds'),
-    simple_project_pattern('frameworks/base/core'),
-    simple_project_pattern('frameworks/base/drm'),
-    simple_project_pattern('frameworks/base/media'),
-    simple_project_pattern('frameworks/base/libs'),
-    simple_project_pattern('frameworks/base/native'),
-    simple_project_pattern('frameworks/base/packages'),
-    simple_project_pattern('frameworks/base/rs'),
-    simple_project_pattern('frameworks/base/services'),
-    simple_project_pattern('frameworks/base/tests'),
-    simple_project_pattern('frameworks/base/tools'),
-    project_name_and_pattern('frameworks/base/Other', 'frameworks/base'),
-    simple_project_pattern('frameworks/compile/libbcc'),
-    simple_project_pattern('frameworks/compile/mclinker'),
-    simple_project_pattern('frameworks/compile/slang'),
-    project_name_and_pattern('frameworks/compile/Other', 'frameworks/compile'),
-    simple_project_pattern('frameworks/minikin'),
-    simple_project_pattern('frameworks/ml'),
-    simple_project_pattern('frameworks/native/cmds'),
-    simple_project_pattern('frameworks/native/include'),
-    simple_project_pattern('frameworks/native/libs'),
-    simple_project_pattern('frameworks/native/opengl'),
-    simple_project_pattern('frameworks/native/services'),
-    simple_project_pattern('frameworks/native/vulkan'),
-    project_name_and_pattern('frameworks/native/Other', 'frameworks/native'),
-    simple_project_pattern('frameworks/opt'),
-    simple_project_pattern('frameworks/rs'),
-    simple_project_pattern('frameworks/webview'),
-    simple_project_pattern('frameworks/wilhelm'),
-    project_name_and_pattern('frameworks/Other', 'frameworks'),
-    simple_project_pattern('hardware/akm'),
-    simple_project_pattern('hardware/broadcom'),
-    simple_project_pattern('hardware/google'),
-    simple_project_pattern('hardware/intel'),
-    simple_project_pattern('hardware/interfaces'),
-    simple_project_pattern('hardware/libhardware'),
-    simple_project_pattern('hardware/libhardware_legacy'),
-    simple_project_pattern('hardware/qcom'),
-    simple_project_pattern('hardware/ril'),
-    project_name_and_pattern('hardware/Other', 'hardware'),
-    simple_project_pattern('kernel'),
-    simple_project_pattern('libcore'),
-    simple_project_pattern('libnativehelper'),
-    simple_project_pattern('ndk'),
-    # match vendor/unbungled_google/packages before other packages
-    simple_project_pattern('unbundled_google'),
-    simple_project_pattern('packages'),
-    simple_project_pattern('pdk'),
-    simple_project_pattern('prebuilts'),
-    simple_project_pattern('system/bt'),
-    simple_project_pattern('system/connectivity'),
-    simple_project_pattern('system/core/adb'),
-    simple_project_pattern('system/core/base'),
-    simple_project_pattern('system/core/debuggerd'),
-    simple_project_pattern('system/core/fastboot'),
-    simple_project_pattern('system/core/fingerprintd'),
-    simple_project_pattern('system/core/fs_mgr'),
-    simple_project_pattern('system/core/gatekeeperd'),
-    simple_project_pattern('system/core/healthd'),
-    simple_project_pattern('system/core/include'),
-    simple_project_pattern('system/core/init'),
-    simple_project_pattern('system/core/libbacktrace'),
-    simple_project_pattern('system/core/liblog'),
-    simple_project_pattern('system/core/libpixelflinger'),
-    simple_project_pattern('system/core/libprocessgroup'),
-    simple_project_pattern('system/core/libsysutils'),
-    simple_project_pattern('system/core/logcat'),
-    simple_project_pattern('system/core/logd'),
-    simple_project_pattern('system/core/run-as'),
-    simple_project_pattern('system/core/sdcard'),
-    simple_project_pattern('system/core/toolbox'),
-    project_name_and_pattern('system/core/Other', 'system/core'),
-    simple_project_pattern('system/extras/ANRdaemon'),
-    simple_project_pattern('system/extras/cpustats'),
-    simple_project_pattern('system/extras/crypto-perf'),
-    simple_project_pattern('system/extras/ext4_utils'),
-    simple_project_pattern('system/extras/f2fs_utils'),
-    simple_project_pattern('system/extras/iotop'),
-    simple_project_pattern('system/extras/libfec'),
-    simple_project_pattern('system/extras/memory_replay'),
-    simple_project_pattern('system/extras/mmap-perf'),
-    simple_project_pattern('system/extras/multinetwork'),
-    simple_project_pattern('system/extras/perfprofd'),
-    simple_project_pattern('system/extras/procrank'),
-    simple_project_pattern('system/extras/runconuid'),
-    simple_project_pattern('system/extras/showmap'),
-    simple_project_pattern('system/extras/simpleperf'),
-    simple_project_pattern('system/extras/su'),
-    simple_project_pattern('system/extras/tests'),
-    simple_project_pattern('system/extras/verity'),
-    project_name_and_pattern('system/extras/Other', 'system/extras'),
-    simple_project_pattern('system/gatekeeper'),
-    simple_project_pattern('system/keymaster'),
-    simple_project_pattern('system/libhidl'),
-    simple_project_pattern('system/libhwbinder'),
-    simple_project_pattern('system/media'),
-    simple_project_pattern('system/netd'),
-    simple_project_pattern('system/nvram'),
-    simple_project_pattern('system/security'),
-    simple_project_pattern('system/sepolicy'),
-    simple_project_pattern('system/tools'),
-    simple_project_pattern('system/update_engine'),
-    simple_project_pattern('system/vold'),
-    project_name_and_pattern('system/Other', 'system'),
-    simple_project_pattern('toolchain'),
-    simple_project_pattern('test'),
-    simple_project_pattern('tools'),
-    # match vendor/google* before vendor/
-    project_name_and_pattern('vendor/google', 'vendor/google.*'),
-    project_name_and_pattern('vendor/non-google', 'vendor'),
-    # keep out/obj and other patterns at the end.
-    ['out/obj',
-     '.*/(gen|obj[^/]*)/(include|EXECUTABLES|SHARED_LIBRARIES|'
-     'STATIC_LIBRARIES|NATIVE_TESTS)/.*: warning:'],
-    ['other', '.*']  # all other unrecognized patterns
-]
-
-project_patterns = []
-project_names = []
-warning_messages = []
-warning_records = []
-
-
-def initialize_arrays():
-  """Complete global arrays before they are used."""
-  global project_names, project_patterns
-  project_names = [p[0] for p in project_list]
-  project_patterns = [re.compile(p[1]) for p in project_list]
-  for w in warn_patterns:
-    w['members'] = []
-    if 'option' not in w:
-      w['option'] = ''
-    # Each warning pattern has a 'projects' dictionary, that
-    # maps a project name to number of warnings in that project.
-    w['projects'] = {}
-
-
-initialize_arrays()
-
-
-android_root = ''
-platform_version = 'unknown'
-target_product = 'unknown'
-target_variant = 'unknown'
-
-
-##### Data and functions to dump html file. ##################################
-
-html_head_scripts = """\
-  <script type="text/javascript">
-  function expand(id) {
-    var e = document.getElementById(id);
-    var f = document.getElementById(id + "_mark");
-    if (e.style.display == 'block') {
-       e.style.display = 'none';
-       f.innerHTML = '&#x2295';
-    }
-    else {
-       e.style.display = 'block';
-       f.innerHTML = '&#x2296';
-    }
-  };
-  function expandCollapse(show) {
-    for (var id = 1; ; id++) {
-      var e = document.getElementById(id + "");
-      var f = document.getElementById(id + "_mark");
-      if (!e || !f) break;
-      e.style.display = (show ? 'block' : 'none');
-      f.innerHTML = (show ? '&#x2296' : '&#x2295');
-    }
-  };
-  </script>
-  <style type="text/css">
-  th,td{border-collapse:collapse; border:1px solid black;}
-  .button{color:blue;font-size:110%;font-weight:bolder;}
-  .bt{color:black;background-color:transparent;border:none;outline:none;
-      font-size:140%;font-weight:bolder;}
-  .c0{background-color:#e0e0e0;}
-  .c1{background-color:#d0d0d0;}
-  .t1{border-collapse:collapse; width:100%; border:1px solid black;}
-  </style>
-  <script src="https://www.gstatic.com/charts/loader.js"></script>
-"""
-
-
-def html_big(param):
-  return '<font size="+2">' + param + '</font>'
-
-
-def dump_html_prologue(title):
-  print '<html>\n<head>'
-  print '<title>' + title + '</title>'
-  print html_head_scripts
-  emit_stats_by_project()
-  print '</head>\n<body>'
-  print html_big(title)
-  print '<p>'
-
-
-def dump_html_epilogue():
-  print '</body>\n</head>\n</html>'
-
-
-def sort_warnings():
-  for i in warn_patterns:
-    i['members'] = sorted(set(i['members']))
-
-
-def emit_stats_by_project():
-  """Dump a google chart table of warnings per project and severity."""
-  # warnings[p][s] is number of warnings in project p of severity s.
-  warnings = {p: {s: 0 for s in Severity.range} for p in project_names}
-  for i in warn_patterns:
-    s = i['severity']
-    for p in i['projects']:
-      warnings[p][s] += i['projects'][p]
-
-  # total_by_project[p] is number of warnings in project p.
-  total_by_project = {p: sum(warnings[p][s] for s in Severity.range)
-                      for p in project_names}
-
-  # total_by_severity[s] is number of warnings of severity s.
-  total_by_severity = {s: sum(warnings[p][s] for p in project_names)
-                       for s in Severity.range}
-
-  # emit table header
-  stats_header = ['Project']
-  for s in Severity.range:
-    if total_by_severity[s]:
-      stats_header.append("<span style='background-color:{}'>{}</span>".
-                          format(Severity.colors[s],
-                                 Severity.column_headers[s]))
-  stats_header.append('TOTAL')
-
-  # emit a row of warning counts per project, skip no-warning projects
-  total_all_projects = 0
-  stats_rows = []
-  for p in project_names:
-    if total_by_project[p]:
-      one_row = [p]
-      for s in Severity.range:
-        if total_by_severity[s]:
-          one_row.append(warnings[p][s])
-      one_row.append(total_by_project[p])
-      stats_rows.append(one_row)
-      total_all_projects += total_by_project[p]
-
-  # emit a row of warning counts per severity
-  total_all_severities = 0
-  one_row = ['<b>TOTAL</b>']
-  for s in Severity.range:
-    if total_by_severity[s]:
-      one_row.append(total_by_severity[s])
-      total_all_severities += total_by_severity[s]
-  one_row.append(total_all_projects)
-  stats_rows.append(one_row)
-  print '<script>'
-  emit_const_string_array('StatsHeader', stats_header)
-  emit_const_object_array('StatsRows', stats_rows)
-  print draw_table_javascript
-  print '</script>'
-
-
-def dump_stats():
-  """Dump some stats about total number of warnings and such."""
-  known = 0
-  skipped = 0
-  unknown = 0
-  sort_warnings()
-  for i in warn_patterns:
-    if i['severity'] == Severity.UNKNOWN:
-      unknown += len(i['members'])
-    elif i['severity'] == Severity.SKIP:
-      skipped += len(i['members'])
-    else:
-      known += len(i['members'])
-  print 'Number of classified warnings: <b>' + str(known) + '</b><br>'
-  print 'Number of skipped warnings: <b>' + str(skipped) + '</b><br>'
-  print 'Number of unclassified warnings: <b>' + str(unknown) + '</b><br>'
-  total = unknown + known + skipped
-  extra_msg = ''
-  if total < 1000:
-    extra_msg = ' (low count may indicate incremental build)'
-  print 'Total number of warnings: <b>' + str(total) + '</b>' + extra_msg
-
-
-# New base table of warnings, [severity, warn_id, project, warning_message]
-# Need buttons to show warnings in different grouping options.
-# (1) Current, group by severity, id for each warning pattern
-#     sort by severity, warn_id, warning_message
-# (2) Current --byproject, group by severity,
-#     id for each warning pattern + project name
-#     sort by severity, warn_id, project, warning_message
-# (3) New, group by project + severity,
-#     id for each warning pattern
-#     sort by project, severity, warn_id, warning_message
-def emit_buttons():
-  print ('<button class="button" onclick="expandCollapse(1);">'
-         'Expand all warnings</button>\n'
-         '<button class="button" onclick="expandCollapse(0);">'
-         'Collapse all warnings</button>\n'
-         '<button class="button" onclick="groupBySeverity();">'
-         'Group warnings by severity</button>\n'
-         '<button class="button" onclick="groupByProject();">'
-         'Group warnings by project</button><br>')
-
-
-def all_patterns(category):
-  patterns = ''
-  for i in category['patterns']:
-    patterns += i
-    patterns += ' / '
-  return patterns
-
-
-def dump_fixed():
-  """Show which warnings no longer occur."""
-  anchor = 'fixed_warnings'
-  mark = anchor + '_mark'
-  print ('\n<br><p style="background-color:lightblue"><b>'
-         '<button id="' + mark + '" '
-         'class="bt" onclick="expand(\'' + anchor + '\');">'
-         '&#x2295</button> Fixed warnings. '
-         'No more occurrences. Please consider turning these into '
-         'errors if possible, before they are reintroduced in to the build'
-         ':</b></p>')
-  print '<blockquote>'
-  fixed_patterns = []
-  for i in warn_patterns:
-    if not i['members']:
-      fixed_patterns.append(i['description'] + ' (' +
-                            all_patterns(i) + ')')
-    if i['option']:
-      fixed_patterns.append(' ' + i['option'])
-  fixed_patterns.sort()
-  print '<div id="' + anchor + '" style="display:none;"><table>'
-  cur_row_class = 0
-  for text in fixed_patterns:
-    cur_row_class = 1 - cur_row_class
-    # remove last '\n'
-    t = text[:-1] if text[-1] == '\n' else text
-    print '<tr><td class="c' + str(cur_row_class) + '">' + t + '</td></tr>'
-  print '</table></div>'
-  print '</blockquote>'
-
-
-def find_project_index(line):
-  for p in range(len(project_patterns)):
-    if project_patterns[p].match(line):
-      return p
-  return -1
-
-
-def classify_one_warning(line, results):
-  """Classify one warning line."""
-  for i in range(len(warn_patterns)):
-    w = warn_patterns[i]
-    for cpat in w['compiled_patterns']:
-      if cpat.match(line):
-        p = find_project_index(line)
-        results.append([line, i, p])
-        return
-      else:
-        # If we end up here, there was a problem parsing the log
-        # probably caused by 'make -j' mixing the output from
-        # 2 or more concurrent compiles
-        pass
-
-
-def classify_warnings(lines):
-  results = []
-  for line in lines:
-    classify_one_warning(line, results)
-  # After the main work, ignore all other signals to a child process,
-  # to avoid bad warning/error messages from the exit clean-up process.
-  if args.processes > 1:
-    signal.signal(signal.SIGTERM, lambda *args: sys.exit(-signal.SIGTERM))
-  return results
-
-
-def parallel_classify_warnings(warning_lines):
-  """Classify all warning lines with num_cpu parallel processes."""
-  compile_patterns()
-  num_cpu = args.processes
-  if num_cpu > 1:
-    groups = [[] for x in range(num_cpu)]
-    i = 0
-    for x in warning_lines:
-      groups[i].append(x)
-      i = (i + 1) % num_cpu
-    pool = multiprocessing.Pool(num_cpu)
-    group_results = pool.map(classify_warnings, groups)
-  else:
-    group_results = [classify_warnings(warning_lines)]
-
-  for result in group_results:
-    for line, pattern_idx, project_idx in result:
-      pattern = warn_patterns[pattern_idx]
-      pattern['members'].append(line)
-      message_idx = len(warning_messages)
-      warning_messages.append(line)
-      warning_records.append([pattern_idx, project_idx, message_idx])
-      pname = '???' if project_idx < 0 else project_names[project_idx]
-      # Count warnings by project.
-      if pname in pattern['projects']:
-        pattern['projects'][pname] += 1
-      else:
-        pattern['projects'][pname] = 1
-
-
-def compile_patterns():
-  """Precompiling every pattern speeds up parsing by about 30x."""
-  for i in warn_patterns:
-    i['compiled_patterns'] = []
-    for pat in i['patterns']:
-      i['compiled_patterns'].append(re.compile(pat))
-
-
-def find_android_root(path):
-  """Set and return android_root path if it is found."""
-  global android_root
-  parts = path.split('/')
-  for idx in reversed(range(2, len(parts))):
-    root_path = '/'.join(parts[:idx])
-    # Android root directory should contain this script.
-    if os.path.exists(root_path + '/build/make/tools/warn.py'):
-      android_root = root_path
-      return root_path
-  return ''
-
-
-def remove_android_root_prefix(path):
-  """Remove android_root prefix from path if it is found."""
-  if path.startswith(android_root):
-    return path[1 + len(android_root):]
-  else:
-    return path
-
-
-def normalize_path(path):
-  """Normalize file path relative to android_root."""
-  # If path is not an absolute path, just normalize it.
-  path = os.path.normpath(path)
-  if path[0] != '/':
-    return path
-  # Remove known prefix of root path and normalize the suffix.
-  if android_root or find_android_root(path):
-    return remove_android_root_prefix(path)
-  else:
-    return path
-
-
-def normalize_warning_line(line):
-  """Normalize file path relative to android_root in a warning line."""
-  # replace fancy quotes with plain ol' quotes
-  line = line.replace('‘', "'")
-  line = line.replace('’', "'")
-  line = line.strip()
-  first_column = line.find(':')
-  if first_column > 0:
-    return normalize_path(line[:first_column]) + line[first_column:]
-  else:
-    return line
-
-
-def parse_input_file(infile):
-  """Parse input file, collect parameters and warning lines."""
-  global android_root
-  global platform_version
-  global target_product
-  global target_variant
-  line_counter = 0
-
-  # handle only warning messages with a file path
-  warning_pattern = re.compile('^[^ ]*/[^ ]*: warning: .*')
-
-  # Collect all warnings into the warning_lines set.
-  warning_lines = set()
-  for line in infile:
-    if warning_pattern.match(line):
-      line = normalize_warning_line(line)
-      warning_lines.add(line)
-    elif line_counter < 100:
-      # save a little bit of time by only doing this for the first few lines
-      line_counter += 1
-      m = re.search('(?<=^PLATFORM_VERSION=).*', line)
-      if m is not None:
-        platform_version = m.group(0)
-      m = re.search('(?<=^TARGET_PRODUCT=).*', line)
-      if m is not None:
-        target_product = m.group(0)
-      m = re.search('(?<=^TARGET_BUILD_VARIANT=).*', line)
-      if m is not None:
-        target_variant = m.group(0)
-      m = re.search('.* TOP=([^ ]*) .*', line)
-      if m is not None:
-        android_root = m.group(1)
-  return warning_lines
-
-
-# Return s with escaped backslash and quotation characters.
-def escape_string(s):
-  return s.replace('\\', '\\\\').replace('"', '\\"')
-
-
-# Return s without trailing '\n' and escape the quotation characters.
-def strip_escape_string(s):
-  if not s:
-    return s
-  s = s[:-1] if s[-1] == '\n' else s
-  return escape_string(s)
-
-
-def emit_warning_array(name):
-  print 'var warning_{} = ['.format(name)
-  for i in range(len(warn_patterns)):
-    print '{},'.format(warn_patterns[i][name])
-  print '];'
-
-
-def emit_warning_arrays():
-  emit_warning_array('severity')
-  print 'var warning_description = ['
-  for i in range(len(warn_patterns)):
-    if warn_patterns[i]['members']:
-      print '"{}",'.format(escape_string(warn_patterns[i]['description']))
-    else:
-      print '"",'  # no such warning
-  print '];'
-
-scripts_for_warning_groups = """
-  function compareMessages(x1, x2) { // of the same warning type
-    return (WarningMessages[x1[2]] <= WarningMessages[x2[2]]) ? -1 : 1;
-  }
-  function byMessageCount(x1, x2) {
-    return x2[2] - x1[2];  // reversed order
-  }
-  function bySeverityMessageCount(x1, x2) {
-    // orer by severity first
-    if (x1[1] != x2[1])
-      return  x1[1] - x2[1];
-    return byMessageCount(x1, x2);
-  }
-  const ParseLinePattern = /^([^ :]+):(\\d+):(.+)/;
-  function addURL(line) {
-    if (FlagURL == "") return line;
-    if (FlagSeparator == "") {
-      return line.replace(ParseLinePattern,
-        "<a target='_blank' href='" + FlagURL + "/$1'>$1</a>:$2:$3");
-    }
-    return line.replace(ParseLinePattern,
-      "<a target='_blank' href='" + FlagURL + "/$1" + FlagSeparator +
-        "$2'>$1:$2</a>:$3");
-  }
-  function createArrayOfDictionaries(n) {
-    var result = [];
-    for (var i=0; i<n; i++) result.push({});
-    return result;
-  }
-  function groupWarningsBySeverity() {
-    // groups is an array of dictionaries,
-    // each dictionary maps from warning type to array of warning messages.
-    var groups = createArrayOfDictionaries(SeverityColors.length);
-    for (var i=0; i<Warnings.length; i++) {
-      var w = Warnings[i][0];
-      var s = WarnPatternsSeverity[w];
-      var k = w.toString();
-      if (!(k in groups[s]))
-        groups[s][k] = [];
-      groups[s][k].push(Warnings[i]);
-    }
-    return groups;
-  }
-  function groupWarningsByProject() {
-    var groups = createArrayOfDictionaries(ProjectNames.length);
-    for (var i=0; i<Warnings.length; i++) {
-      var w = Warnings[i][0];
-      var p = Warnings[i][1];
-      var k = w.toString();
-      if (!(k in groups[p]))
-        groups[p][k] = [];
-      groups[p][k].push(Warnings[i]);
-    }
-    return groups;
-  }
-  var GlobalAnchor = 0;
-  function createWarningSection(header, color, group) {
-    var result = "";
-    var groupKeys = [];
-    var totalMessages = 0;
-    for (var k in group) {
-       totalMessages += group[k].length;
-       groupKeys.push([k, WarnPatternsSeverity[parseInt(k)], group[k].length]);
-    }
-    groupKeys.sort(bySeverityMessageCount);
-    for (var idx=0; idx<groupKeys.length; idx++) {
-      var k = groupKeys[idx][0];
-      var messages = group[k];
-      var w = parseInt(k);
-      var wcolor = SeverityColors[WarnPatternsSeverity[w]];
-      var description = WarnPatternsDescription[w];
-      if (description.length == 0)
-          description = "???";
-      GlobalAnchor += 1;
-      result += "<table class='t1'><tr bgcolor='" + wcolor + "'><td>" +
-                "<button class='bt' id='" + GlobalAnchor + "_mark" +
-                "' onclick='expand(\\"" + GlobalAnchor + "\\");'>" +
-                "&#x2295</button> " +
-                description + " (" + messages.length + ")</td></tr></table>";
-      result += "<div id='" + GlobalAnchor +
-                "' style='display:none;'><table class='t1'>";
-      var c = 0;
-      messages.sort(compareMessages);
-      for (var i=0; i<messages.length; i++) {
-        result += "<tr><td class='c" + c + "'>" +
-                  addURL(WarningMessages[messages[i][2]]) + "</td></tr>";
-        c = 1 - c;
-      }
-      result += "</table></div>";
-    }
-    if (result.length > 0) {
-      return "<br><span style='background-color:" + color + "'><b>" +
-             header + ": " + totalMessages +
-             "</b></span><blockquote><table class='t1'>" +
-             result + "</table></blockquote>";
-
-    }
-    return "";  // empty section
-  }
-  function generateSectionsBySeverity() {
-    var result = "";
-    var groups = groupWarningsBySeverity();
-    for (s=0; s<SeverityColors.length; s++) {
-      result += createWarningSection(SeverityHeaders[s], SeverityColors[s], groups[s]);
-    }
-    return result;
-  }
-  function generateSectionsByProject() {
-    var result = "";
-    var groups = groupWarningsByProject();
-    for (i=0; i<groups.length; i++) {
-      result += createWarningSection(ProjectNames[i], 'lightgrey', groups[i]);
-    }
-    return result;
-  }
-  function groupWarnings(generator) {
-    GlobalAnchor = 0;
-    var e = document.getElementById("warning_groups");
-    e.innerHTML = generator();
-  }
-  function groupBySeverity() {
-    groupWarnings(generateSectionsBySeverity);
-  }
-  function groupByProject() {
-    groupWarnings(generateSectionsByProject);
-  }
-"""
-
-
-# Emit a JavaScript const string
-def emit_const_string(name, value):
-  print 'const ' + name + ' = "' + escape_string(value) + '";'
-
-
-# Emit a JavaScript const integer array.
-def emit_const_int_array(name, array):
-  print 'const ' + name + ' = ['
-  for n in array:
-    print str(n) + ','
-  print '];'
-
-
-# Emit a JavaScript const string array.
-def emit_const_string_array(name, array):
-  print 'const ' + name + ' = ['
-  for s in array:
-    print '"' + strip_escape_string(s) + '",'
-  print '];'
-
-
-# Emit a JavaScript const string array for HTML.
-def emit_const_html_string_array(name, array):
-  print 'const ' + name + ' = ['
-  for s in array:
-    print '"' + cgi.escape(strip_escape_string(s)) + '",'
-  print '];'
-
-
-# Emit a JavaScript const object array.
-def emit_const_object_array(name, array):
-  print 'const ' + name + ' = ['
-  for x in array:
-    print str(x) + ','
-  print '];'
-
-
-def emit_js_data():
-  """Dump dynamic HTML page's static JavaScript data."""
-  emit_const_string('FlagURL', args.url if args.url else '')
-  emit_const_string('FlagSeparator', args.separator if args.separator else '')
-  emit_const_string_array('SeverityColors', Severity.colors)
-  emit_const_string_array('SeverityHeaders', Severity.headers)
-  emit_const_string_array('SeverityColumnHeaders', Severity.column_headers)
-  emit_const_string_array('ProjectNames', project_names)
-  emit_const_int_array('WarnPatternsSeverity',
-                       [w['severity'] for w in warn_patterns])
-  emit_const_html_string_array('WarnPatternsDescription',
-                               [w['description'] for w in warn_patterns])
-  emit_const_html_string_array('WarnPatternsOption',
-                               [w['option'] for w in warn_patterns])
-  emit_const_html_string_array('WarningMessages', warning_messages)
-  emit_const_object_array('Warnings', warning_records)
-
-draw_table_javascript = """
-google.charts.load('current', {'packages':['table']});
-google.charts.setOnLoadCallback(drawTable);
-function drawTable() {
-  var data = new google.visualization.DataTable();
-  data.addColumn('string', StatsHeader[0]);
-  for (var i=1; i<StatsHeader.length; i++) {
-    data.addColumn('number', StatsHeader[i]);
-  }
-  data.addRows(StatsRows);
-  for (var i=0; i<StatsRows.length; i++) {
-    for (var j=0; j<StatsHeader.length; j++) {
-      data.setProperty(i, j, 'style', 'border:1px solid black;');
-    }
-  }
-  var table = new google.visualization.Table(document.getElementById('stats_table'));
-  table.draw(data, {allowHtml: true, alternatingRowStyle: true});
-}
-"""
-
-
-def dump_html():
-  """Dump the html output to stdout."""
-  dump_html_prologue('Warnings for ' + platform_version + ' - ' +
-                     target_product + ' - ' + target_variant)
-  dump_stats()
-  print '<br><div id="stats_table"></div><br>'
-  print '\n<script>'
-  emit_js_data()
-  print scripts_for_warning_groups
-  print '</script>'
-  emit_buttons()
-  # Warning messages are grouped by severities or project names.
-  print '<br><div id="warning_groups"></div>'
-  if args.byproject:
-    print '<script>groupByProject();</script>'
-  else:
-    print '<script>groupBySeverity();</script>'
-  dump_fixed()
-  dump_html_epilogue()
-
-
-##### Functions to count warnings and dump csv file. #########################
-
-
-def description_for_csv(category):
-  if not category['description']:
-    return '?'
-  return category['description']
-
-
-def count_severity(writer, sev, kind):
-  """Count warnings of given severity."""
-  total = 0
-  for i in warn_patterns:
-    if i['severity'] == sev and i['members']:
-      n = len(i['members'])
-      total += n
-      warning = kind + ': ' + description_for_csv(i)
-      writer.writerow([n, '', warning])
-      # print number of warnings for each project, ordered by project name.
-      projects = i['projects'].keys()
-      projects.sort()
-      for p in projects:
-        writer.writerow([i['projects'][p], p, warning])
-  writer.writerow([total, '', kind + ' warnings'])
-
-  return total
-
-
-# dump number of warnings in csv format to stdout
-def dump_csv(writer):
-  """Dump number of warnings in csv format to stdout."""
-  sort_warnings()
-  total = 0
-  for s in Severity.range:
-    total += count_severity(writer, s, Severity.column_headers[s])
-  writer.writerow([total, '', 'All warnings'])
-
 
 def main():
-  warning_lines = parse_input_file(open(args.buildlog, 'r'))
-  parallel_classify_warnings(warning_lines)
-  # If a user pases a csv path, save the fileoutput to the path
-  # If the user also passed gencsv write the output to stdout
-  # If the user did not pass gencsv flag dump the html report to stdout.
-  if args.csvpath:
-    with open(args.csvpath, 'w') as f:
-      dump_csv(csv.writer(f, lineterminator='\n'))
-  if args.gencsv:
-    dump_csv(csv.writer(sys.stdout, lineterminator='\n'))
-  else:
-    dump_html()
+  os.environ['PYTHONPATH'] = os.path.dirname(os.path.abspath(__file__))
+  subprocess.check_call(['/usr/bin/python', '-m', 'warn.warn'] + sys.argv[1:])
 
 
-# Run main function if warn.py is the main program.
 if __name__ == '__main__':
   main()
diff --git a/tools/warn/OWNERS b/tools/warn/OWNERS
new file mode 100644
index 0000000..8551802
--- /dev/null
+++ b/tools/warn/OWNERS
@@ -0,0 +1 @@
+per-file * = chh@google.com,srhines@google.com
diff --git a/tools/warn/__init__.py b/tools/warn/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tools/warn/__init__.py
diff --git a/tools/warn/android_project_list.py b/tools/warn/android_project_list.py
new file mode 100644
index 0000000..1010b24
--- /dev/null
+++ b/tools/warn/android_project_list.py
@@ -0,0 +1,176 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Define a project list to sort warnings by project directory path."""
+
+
+def create_pattern(name, pattern=None):
+  if pattern is not None:
+    return [name, '(^|.*/)' + pattern + '/.*: warning:']
+  return [name, '(^|.*/)' + name + '/.*: warning:']
+
+
+# A list of [project_name, file_path_pattern].
+# project_name should not contain comma, to be used in CSV output.
+project_list = [
+    create_pattern('art'),
+    create_pattern('bionic'),
+    create_pattern('bootable'),
+    create_pattern('build'),
+    create_pattern('cts'),
+    create_pattern('dalvik'),
+    create_pattern('developers'),
+    create_pattern('development'),
+    create_pattern('device'),
+    create_pattern('doc'),
+    # match external/google* before external/
+    create_pattern('external/google', 'external/google.*'),
+    create_pattern('external/non-google', 'external'),
+    create_pattern('frameworks/av/camera'),
+    create_pattern('frameworks/av/cmds'),
+    create_pattern('frameworks/av/drm'),
+    create_pattern('frameworks/av/include'),
+    create_pattern('frameworks/av/media/img_utils'),
+    create_pattern('frameworks/av/media/libcpustats'),
+    create_pattern('frameworks/av/media/libeffects'),
+    create_pattern('frameworks/av/media/libmediaplayerservice'),
+    create_pattern('frameworks/av/media/libmedia'),
+    create_pattern('frameworks/av/media/libstagefright'),
+    create_pattern('frameworks/av/media/mtp'),
+    create_pattern('frameworks/av/media/ndk'),
+    create_pattern('frameworks/av/media/utils'),
+    create_pattern('frameworks/av/media/Other', 'frameworks/av/media'),
+    create_pattern('frameworks/av/radio'),
+    create_pattern('frameworks/av/services'),
+    create_pattern('frameworks/av/soundtrigger'),
+    create_pattern('frameworks/av/Other', 'frameworks/av'),
+    create_pattern('frameworks/base/cmds'),
+    create_pattern('frameworks/base/core'),
+    create_pattern('frameworks/base/drm'),
+    create_pattern('frameworks/base/media'),
+    create_pattern('frameworks/base/libs'),
+    create_pattern('frameworks/base/native'),
+    create_pattern('frameworks/base/packages'),
+    create_pattern('frameworks/base/rs'),
+    create_pattern('frameworks/base/services'),
+    create_pattern('frameworks/base/tests'),
+    create_pattern('frameworks/base/tools'),
+    create_pattern('frameworks/base/Other', 'frameworks/base'),
+    create_pattern('frameworks/compile/libbcc'),
+    create_pattern('frameworks/compile/mclinker'),
+    create_pattern('frameworks/compile/slang'),
+    create_pattern('frameworks/compile/Other', 'frameworks/compile'),
+    create_pattern('frameworks/minikin'),
+    create_pattern('frameworks/ml'),
+    create_pattern('frameworks/native/cmds'),
+    create_pattern('frameworks/native/include'),
+    create_pattern('frameworks/native/libs'),
+    create_pattern('frameworks/native/opengl'),
+    create_pattern('frameworks/native/services'),
+    create_pattern('frameworks/native/vulkan'),
+    create_pattern('frameworks/native/Other', 'frameworks/native'),
+    create_pattern('frameworks/opt'),
+    create_pattern('frameworks/rs'),
+    create_pattern('frameworks/webview'),
+    create_pattern('frameworks/wilhelm'),
+    create_pattern('frameworks/Other', 'frameworks'),
+    create_pattern('hardware/akm'),
+    create_pattern('hardware/broadcom'),
+    create_pattern('hardware/google'),
+    create_pattern('hardware/intel'),
+    create_pattern('hardware/interfaces'),
+    create_pattern('hardware/libhardware'),
+    create_pattern('hardware/libhardware_legacy'),
+    create_pattern('hardware/qcom'),
+    create_pattern('hardware/ril'),
+    create_pattern('hardware/Other', 'hardware'),
+    create_pattern('kernel'),
+    create_pattern('libcore'),
+    create_pattern('libnativehelper'),
+    create_pattern('ndk'),
+    # match vendor/unbungled_google/packages before other packages
+    create_pattern('unbundled_google'),
+    create_pattern('packages/providers/MediaProvider'),
+    create_pattern('packages'),
+    create_pattern('pdk'),
+    create_pattern('prebuilts'),
+    create_pattern('system/bt'),
+    create_pattern('system/connectivity'),
+    create_pattern('system/core/adb'),
+    create_pattern('system/core/base'),
+    create_pattern('system/core/debuggerd'),
+    create_pattern('system/core/fastboot'),
+    create_pattern('system/core/fingerprintd'),
+    create_pattern('system/core/fs_mgr'),
+    create_pattern('system/core/gatekeeperd'),
+    create_pattern('system/core/healthd'),
+    create_pattern('system/core/include'),
+    create_pattern('system/core/init'),
+    create_pattern('system/core/libbacktrace'),
+    create_pattern('system/core/liblog'),
+    create_pattern('system/core/libpixelflinger'),
+    create_pattern('system/core/libprocessgroup'),
+    create_pattern('system/core/libsysutils'),
+    create_pattern('system/core/logcat'),
+    create_pattern('system/core/logd'),
+    create_pattern('system/core/run-as'),
+    create_pattern('system/core/sdcard'),
+    create_pattern('system/core/toolbox'),
+    create_pattern('system/core/Other', 'system/core'),
+    create_pattern('system/extras/ANRdaemon'),
+    create_pattern('system/extras/cpustats'),
+    create_pattern('system/extras/crypto-perf'),
+    create_pattern('system/extras/ext4_utils'),
+    create_pattern('system/extras/f2fs_utils'),
+    create_pattern('system/extras/iotop'),
+    create_pattern('system/extras/libfec'),
+    create_pattern('system/extras/memory_replay'),
+    create_pattern('system/extras/mmap-perf'),
+    create_pattern('system/extras/multinetwork'),
+    create_pattern('system/extras/perfprofd'),
+    create_pattern('system/extras/procrank'),
+    create_pattern('system/extras/runconuid'),
+    create_pattern('system/extras/showmap'),
+    create_pattern('system/extras/simpleperf'),
+    create_pattern('system/extras/su'),
+    create_pattern('system/extras/tests'),
+    create_pattern('system/extras/verity'),
+    create_pattern('system/extras/Other', 'system/extras'),
+    create_pattern('system/gatekeeper'),
+    create_pattern('system/keymaster'),
+    create_pattern('system/libhidl'),
+    create_pattern('system/libhwbinder'),
+    create_pattern('system/media'),
+    create_pattern('system/netd'),
+    create_pattern('system/nvram'),
+    create_pattern('system/security'),
+    create_pattern('system/sepolicy'),
+    create_pattern('system/tools'),
+    create_pattern('system/update_engine'),
+    create_pattern('system/vold'),
+    create_pattern('system/Other', 'system'),
+    create_pattern('toolchain'),
+    create_pattern('test'),
+    create_pattern('tools'),
+    # match vendor/google* before vendor/
+    create_pattern('vendor/google', 'vendor/google.*'),
+    create_pattern('vendor/non-google', 'vendor'),
+    # keep out/obj and other patterns at the end.
+    [
+        'out/obj', '.*/(gen|obj[^/]*)/(include|EXECUTABLES|SHARED_LIBRARIES|'
+        'STATIC_LIBRARIES|NATIVE_TESTS)/.*: warning:'
+    ],
+    ['other', '.*']  # all other unrecognized patterns
+]
diff --git a/tools/warn/cpp_warn_patterns.py b/tools/warn/cpp_warn_patterns.py
new file mode 100644
index 0000000..65ce73a
--- /dev/null
+++ b/tools/warn/cpp_warn_patterns.py
@@ -0,0 +1,485 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Warning patterns for C/C++ compiler, but not clang-tidy."""
+
+import re
+
+# pylint:disable=relative-beyond-top-level
+# pylint:disable=g-importing-member
+from .severity import Severity
+
+
+def cpp_warn(severity, description, pattern_list):
+  return {
+      'category': 'C/C++',
+      'severity': severity,
+      'description': description,
+      'patterns': pattern_list
+  }
+
+
+def fixmenow(description, pattern_list):
+  return cpp_warn(Severity.FIXMENOW, description, pattern_list)
+
+
+def high(description, pattern_list):
+  return cpp_warn(Severity.HIGH, description, pattern_list)
+
+
+def medium(description, pattern_list):
+  return cpp_warn(Severity.MEDIUM, description, pattern_list)
+
+
+def low(description, pattern_list):
+  return cpp_warn(Severity.LOW, description, pattern_list)
+
+
+def skip(description, pattern_list):
+  return cpp_warn(Severity.SKIP, description, pattern_list)
+
+
+def harmless(description, pattern_list):
+  return cpp_warn(Severity.HARMLESS, description, pattern_list)
+
+
+warn_patterns = [
+    # pylint:disable=line-too-long,g-inconsistent-quotes
+    medium('Implicit function declaration',
+           [r".*: warning: implicit declaration of function .+",
+            r".*: warning: implicitly declaring library function"]),
+    skip('skip, conflicting types for ...',
+         [r".*: warning: conflicting types for '.+'"]),
+    high('Expression always evaluates to true or false',
+         [r".*: warning: comparison is always .+ due to limited range of data type",
+          r".*: warning: comparison of unsigned .*expression .+ is always true",
+          r".*: warning: comparison of unsigned .*expression .+ is always false"]),
+    high('Use transient memory for control value',
+         [r".*: warning: .+Using such transient memory for the control value is .*dangerous."]),
+    high('Return address of stack memory',
+         [r".*: warning: Address of stack memory .+ returned to caller",
+          r".*: warning: Address of stack memory .+ will be a dangling reference"]),
+    high('Infinite recursion',
+         [r".*: warning: all paths through this function will call itself"]),
+    high('Potential buffer overflow',
+         [r".*: warning: Size argument is greater than .+ the destination buffer",
+          r".*: warning: Potential buffer overflow.",
+          r".*: warning: String copy function overflows destination buffer"]),
+    medium('Incompatible pointer types',
+           [r".*: warning: assignment from incompatible pointer type",
+            r".*: warning: return from incompatible pointer type",
+            r".*: warning: passing argument [0-9]+ of '.*' from incompatible pointer type",
+            r".*: warning: initialization from incompatible pointer type"]),
+    high('Incompatible declaration of built in function',
+         [r".*: warning: incompatible implicit declaration of built-in function .+"]),
+    high('Incompatible redeclaration of library function',
+         [r".*: warning: incompatible redeclaration of library function .+"]),
+    high('Null passed as non-null argument',
+         [r".*: warning: Null passed to a callee that requires a non-null"]),
+    medium('Unused parameter',
+           [r".*: warning: unused parameter '.*'"]),
+    medium('Unused function, variable, label, comparison, etc.',
+           [r".*: warning: '.+' defined but not used",
+            r".*: warning: unused function '.+'",
+            r".*: warning: unused label '.+'",
+            r".*: warning: relational comparison result unused",
+            r".*: warning: lambda capture .* is not used",
+            r".*: warning: private field '.+' is not used",
+            r".*: warning: unused variable '.+'"]),
+    medium('Statement with no effect or result unused',
+           [r".*: warning: statement with no effect",
+            r".*: warning: expression result unused"]),
+    medium('Ignoreing return value of function',
+           [r".*: warning: ignoring return value of function .+Wunused-result"]),
+    medium('Missing initializer',
+           [r".*: warning: missing initializer"]),
+    medium('Need virtual destructor',
+           [r".*: warning: delete called .* has virtual functions but non-virtual destructor"]),
+    skip('skip, near initialization for ...',
+         [r".*: warning: \(near initialization for '.+'\)"]),
+    medium('Expansion of data or time macro',
+           [r".*: warning: expansion of date or time macro is not reproducible"]),
+    medium('Macro expansion has undefined behavior',
+           [r".*: warning: macro expansion .* has undefined behavior"]),
+    medium('Format string does not match arguments',
+           [r".*: warning: format '.+' expects type '.+', but argument [0-9]+ has type '.+'",
+            r".*: warning: more '%' conversions than data arguments",
+            r".*: warning: data argument not used by format string",
+            r".*: warning: incomplete format specifier",
+            r".*: warning: unknown conversion type .* in format",
+            r".*: warning: format .+ expects .+ but argument .+Wformat=",
+            r".*: warning: field precision should have .+ but argument has .+Wformat",
+            r".*: warning: format specifies type .+ but the argument has .*type .+Wformat"]),
+    medium('Too many arguments for format string',
+           [r".*: warning: too many arguments for format"]),
+    medium('Too many arguments in call',
+           [r".*: warning: too many arguments in call to "]),
+    medium('Invalid format specifier',
+           [r".*: warning: invalid .+ specifier '.+'.+format-invalid-specifier"]),
+    medium('Comparison between signed and unsigned',
+           [r".*: warning: comparison between signed and unsigned",
+            r".*: warning: comparison of promoted \~unsigned with unsigned",
+            r".*: warning: signed and unsigned type in conditional expression"]),
+    medium('Comparison between enum and non-enum',
+           [r".*: warning: enumeral and non-enumeral type in conditional expression"]),
+    medium('libpng: zero area',
+           [r".*libpng warning: Ignoring attempt to set cHRM RGB triangle with zero area"]),
+    medium('Missing braces around initializer',
+           [r".*: warning: missing braces around initializer.*"]),
+    harmless('No newline at end of file',
+             [r".*: warning: no newline at end of file"]),
+    harmless('Missing space after macro name',
+             [r".*: warning: missing whitespace after the macro name"]),
+    low('Cast increases required alignment',
+        [r".*: warning: cast from .* to .* increases required alignment .*"]),
+    medium('Qualifier discarded',
+           [r".*: warning: passing argument [0-9]+ of '.+' discards qualifiers from pointer target type",
+            r".*: warning: assignment discards qualifiers from pointer target type",
+            r".*: warning: passing .+ to parameter of type .+ discards qualifiers",
+            r".*: warning: assigning to .+ from .+ discards qualifiers",
+            r".*: warning: initializing .+ discards qualifiers .+types-discards-qualifiers",
+            r".*: warning: return discards qualifiers from pointer target type"]),
+    medium('Unknown attribute',
+           [r".*: warning: unknown attribute '.+'"]),
+    medium('Attribute ignored',
+           [r".*: warning: '_*packed_*' attribute ignored",
+            r".*: warning: attribute declaration must precede definition .+ignored-attributes"]),
+    medium('Visibility problem',
+           [r".*: warning: declaration of '.+' will not be visible outside of this function"]),
+    medium('Visibility mismatch',
+           [r".*: warning: '.+' declared with greater visibility than the type of its field '.+'"]),
+    medium('Shift count greater than width of type',
+           [r".*: warning: (left|right) shift count >= width of type"]),
+    medium('extern &lt;foo&gt; is initialized',
+           [r".*: warning: '.+' initialized and declared 'extern'",
+            r".*: warning: 'extern' variable has an initializer"]),
+    medium('Old style declaration',
+           [r".*: warning: 'static' is not at beginning of declaration"]),
+    medium('Missing return value',
+           [r".*: warning: control reaches end of non-void function"]),
+    medium('Implicit int type',
+           [r".*: warning: type specifier missing, defaults to 'int'",
+            r".*: warning: type defaults to 'int' in declaration of '.+'"]),
+    medium('Main function should return int',
+           [r".*: warning: return type of 'main' is not 'int'"]),
+    medium('Variable may be used uninitialized',
+           [r".*: warning: '.+' may be used uninitialized in this function"]),
+    high('Variable is used uninitialized',
+         [r".*: warning: '.+' is used uninitialized in this function",
+          r".*: warning: variable '.+' is uninitialized when used here"]),
+    medium('ld: possible enum size mismatch',
+           [r".*: warning: .* uses variable-size enums yet the output is to use 32-bit enums; use of enum values across objects may fail"]),
+    medium('Pointer targets differ in signedness',
+           [r".*: warning: pointer targets in initialization differ in signedness",
+            r".*: warning: pointer targets in assignment differ in signedness",
+            r".*: warning: pointer targets in return differ in signedness",
+            r".*: warning: pointer targets in passing argument [0-9]+ of '.+' differ in signedness"]),
+    medium('Assuming overflow does not occur',
+           [r".*: warning: assuming signed overflow does not occur when assuming that .* is always (true|false)"]),
+    medium('Suggest adding braces around empty body',
+           [r".*: warning: suggest braces around empty body in an 'if' statement",
+            r".*: warning: empty body in an if-statement",
+            r".*: warning: suggest braces around empty body in an 'else' statement",
+            r".*: warning: empty body in an else-statement"]),
+    medium('Suggest adding parentheses',
+           [r".*: warning: suggest explicit braces to avoid ambiguous 'else'",
+            r".*: warning: suggest parentheses around arithmetic in operand of '.+'",
+            r".*: warning: suggest parentheses around comparison in operand of '.+'",
+            r".*: warning: logical not is only applied to the left hand side of this comparison",
+            r".*: warning: using the result of an assignment as a condition without parentheses",
+            r".*: warning: .+ has lower precedence than .+ be evaluated first .+Wparentheses",
+            r".*: warning: suggest parentheses around '.+?' .+ '.+?'",
+            r".*: warning: suggest parentheses around assignment used as truth value"]),
+    medium('Static variable used in non-static inline function',
+           [r".*: warning: '.+' is static but used in inline function '.+' which is not static"]),
+    medium('No type or storage class (will default to int)',
+           [r".*: warning: data definition has no type or storage class"]),
+    skip('skip, parameter name (without types) in function declaration',
+         [r".*: warning: parameter names \(without types\) in function declaration"]),
+    medium('Dereferencing &lt;foo&gt; breaks strict aliasing rules',
+           [r".*: warning: dereferencing .* break strict-aliasing rules"]),
+    medium('Cast from pointer to integer of different size',
+           [r".*: warning: cast from pointer to integer of different size",
+            r".*: warning: initialization makes pointer from integer without a cast"]),
+    medium('Cast to pointer from integer of different size',
+           [r".*: warning: cast to pointer from integer of different size"]),
+    medium('Macro redefined',
+           [r".*: warning: '.+' macro redefined"]),
+    skip('skip, ... location of the previous definition',
+         [r".*: warning: this is the location of the previous definition"]),
+    medium('ld: type and size of dynamic symbol are not defined',
+           [r".*: warning: type and size of dynamic symbol `.+' are not defined"]),
+    medium('Pointer from integer without cast',
+           [r".*: warning: assignment makes pointer from integer without a cast"]),
+    medium('Pointer from integer without cast',
+           [r".*: warning: passing argument [0-9]+ of '.+' makes pointer from integer without a cast"]),
+    medium('Integer from pointer without cast',
+           [r".*: warning: assignment makes integer from pointer without a cast"]),
+    medium('Integer from pointer without cast',
+           [r".*: warning: passing argument [0-9]+ of '.+' makes integer from pointer without a cast"]),
+    medium('Integer from pointer without cast',
+           [r".*: warning: return makes integer from pointer without a cast"]),
+    medium('Ignoring pragma',
+           [r".*: warning: ignoring #pragma .+"]),
+    medium('Pragma warning messages',
+           [r".*: warning: .+W#pragma-messages"]),
+    medium('Variable might be clobbered by longjmp or vfork',
+           [r".*: warning: variable '.+' might be clobbered by 'longjmp' or 'vfork'"]),
+    medium('Argument might be clobbered by longjmp or vfork',
+           [r".*: warning: argument '.+' might be clobbered by 'longjmp' or 'vfork'"]),
+    medium('Redundant declaration',
+           [r".*: warning: redundant redeclaration of '.+'"]),
+    skip('skip, previous declaration ... was here',
+         [r".*: warning: previous declaration of '.+' was here"]),
+    high('Enum value not handled in switch',
+         [r".*: warning: .*enumeration value.* not handled in switch.+Wswitch"]),
+    medium('User defined warnings',
+           [r".*: warning: .* \[-Wuser-defined-warnings\]$"]),
+    medium('Taking address of temporary',
+           [r".*: warning: taking address of temporary"]),
+    medium('Taking address of packed member',
+           [r".*: warning: taking address of packed member"]),
+    medium('Possible broken line continuation',
+           [r".*: warning: backslash and newline separated by space"]),
+    medium('Undefined variable template',
+           [r".*: warning: instantiation of variable .* no definition is available"]),
+    medium('Inline function is not defined',
+           [r".*: warning: inline function '.*' is not defined"]),
+    medium('Excess elements in initializer',
+           [r".*: warning: excess elements in .+ initializer"]),
+    medium('Decimal constant is unsigned only in ISO C90',
+           [r".*: warning: this decimal constant is unsigned only in ISO C90"]),
+    medium('main is usually a function',
+           [r".*: warning: 'main' is usually a function"]),
+    medium('Typedef ignored',
+           [r".*: warning: 'typedef' was ignored in this declaration"]),
+    high('Address always evaluates to true',
+         [r".*: warning: the address of '.+' will always evaluate as 'true'"]),
+    fixmenow('Freeing a non-heap object',
+             [r".*: warning: attempt to free a non-heap object '.+'"]),
+    medium('Array subscript has type char',
+           [r".*: warning: array subscript .+ type 'char'.+Wchar-subscripts"]),
+    medium('Constant too large for type',
+           [r".*: warning: integer constant is too large for '.+' type"]),
+    medium('Constant too large for type, truncated',
+           [r".*: warning: large integer implicitly truncated to unsigned type"]),
+    medium('Overflow in expression',
+           [r".*: warning: overflow in expression; .*Winteger-overflow"]),
+    medium('Overflow in implicit constant conversion',
+           [r".*: warning: overflow in implicit constant conversion"]),
+    medium('Declaration does not declare anything',
+           [r".*: warning: declaration 'class .+' does not declare anything"]),
+    medium('Initialization order will be different',
+           [r".*: warning: '.+' will be initialized after",
+            r".*: warning: field .+ will be initialized after .+Wreorder"]),
+    skip('skip,   ....',
+         [r".*: warning:   '.+'"]),
+    skip('skip,   base ...',
+         [r".*: warning:   base '.+'"]),
+    skip('skip,   when initialized here',
+         [r".*: warning:   when initialized here"]),
+    medium('Parameter type not specified',
+           [r".*: warning: type of '.+' defaults to 'int'"]),
+    medium('Missing declarations',
+           [r".*: warning: declaration does not declare anything"]),
+    medium('Missing noreturn',
+           [r".*: warning: function '.*' could be declared with attribute 'noreturn'"]),
+    medium('User warning',
+           [r".*: warning: #warning "".+"""]),
+    medium('Vexing parsing problem',
+           [r".*: warning: empty parentheses interpreted as a function declaration"]),
+    medium('Dereferencing void*',
+           [r".*: warning: dereferencing 'void \*' pointer"]),
+    medium('Comparison of pointer and integer',
+           [r".*: warning: ordered comparison of pointer with integer zero",
+            r".*: warning: .*comparison between pointer and integer"]),
+    medium('Use of error-prone unary operator',
+           [r".*: warning: use of unary operator that may be intended as compound assignment"]),
+    medium('Conversion of string constant to non-const char*',
+           [r".*: warning: deprecated conversion from string constant to '.+'"]),
+    medium('Function declaration isn''t a prototype',
+           [r".*: warning: function declaration isn't a prototype"]),
+    medium('Type qualifiers ignored on function return value',
+           [r".*: warning: type qualifiers ignored on function return type",
+            r".*: warning: .+ type qualifier .+ has no effect .+Wignored-qualifiers"]),
+    medium('&lt;foo&gt; declared inside parameter list, scope limited to this definition',
+           [r".*: warning: '.+' declared inside parameter list"]),
+    skip('skip, its scope is only this ...',
+         [r".*: warning: its scope is only this definition or declaration, which is probably not what you want"]),
+    low('Line continuation inside comment',
+        [r".*: warning: multi-line comment"]),
+    low('Comment inside comment',
+        [r".*: warning: '.+' within block comment .*-Wcomment"]),
+    low('Deprecated declarations',
+        [r".*: warning: .+ is deprecated.+deprecated-declarations"]),
+    low('Deprecated register',
+        [r".*: warning: 'register' storage class specifier is deprecated"]),
+    low('Converts between pointers to integer types with different sign',
+        [r".*: warning: .+ converts between pointers to integer types with different sign"]),
+    harmless('Extra tokens after #endif',
+             [r".*: warning: extra tokens at end of #endif directive"]),
+    medium('Comparison between different enums',
+           [r".*: warning: comparison between '.+' and '.+'.+Wenum-compare",
+            r".*: warning: comparison of .* enumeration types .*-Wenum-compare-switch"]),
+    medium('Conversion may change value',
+           [r".*: warning: converting negative value '.+' to '.+'",
+            r".*: warning: conversion to '.+' .+ may (alter|change)"]),
+    medium('Converting to non-pointer type from NULL',
+           [r".*: warning: converting to non-pointer type '.+' from NULL"]),
+    medium('Implicit sign conversion',
+           [r".*: warning: implicit conversion changes signedness"]),
+    medium('Converting NULL to non-pointer type',
+           [r".*: warning: implicit conversion of NULL constant to '.+'"]),
+    medium('Zero used as null pointer',
+           [r".*: warning: expression .* zero treated as a null pointer constant"]),
+    medium('Compare pointer to null character',
+           [r".*: warning: comparing a pointer to a null character constant"]),
+    medium('Implicit conversion changes value or loses precision',
+           [r".*: warning: implicit conversion .* changes value from .* to .*-conversion",
+            r".*: warning: implicit conversion loses integer precision:"]),
+    medium('Passing NULL as non-pointer argument',
+           [r".*: warning: passing NULL to non-pointer argument [0-9]+ of '.+'"]),
+    medium('Class seems unusable because of private ctor/dtor',
+           [r".*: warning: all member functions in class '.+' are private"]),
+    # skip this next one, because it only points out some RefBase-based classes
+    # where having a private destructor is perfectly fine
+    skip('Class seems unusable because of private ctor/dtor',
+         [r".*: warning: 'class .+' only defines a private destructor and has no friends"]),
+    medium('Class seems unusable because of private ctor/dtor',
+           [r".*: warning: 'class .+' only defines private constructors and has no friends"]),
+    medium('In-class initializer for static const float/double',
+           [r".*: warning: in-class initializer for static data member of .+const (float|double)"]),
+    medium('void* used in arithmetic',
+           [r".*: warning: pointer of type 'void \*' used in (arithmetic|subtraction)",
+            r".*: warning: arithmetic on .+ to void is a GNU extension.*Wpointer-arith",
+            r".*: warning: wrong type argument to increment"]),
+    medium('Overload resolution chose to promote from unsigned or enum to signed type',
+           [r".*: warning: passing '.+' chooses '.+' over '.+'.*Wsign-promo"]),
+    skip('skip,   in call to ...',
+         [r".*: warning:   in call to '.+'"]),
+    high('Base should be explicitly initialized in copy constructor',
+         [r".*: warning: base class '.+' should be explicitly initialized in the copy constructor"]),
+    medium('Return value from void function',
+           [r".*: warning: 'return' with a value, in function returning void"]),
+    medium('Multi-character character constant',
+           [r".*: warning: multi-character character constant"]),
+    medium('Conversion from string literal to char*',
+           [r".*: warning: .+ does not allow conversion from string literal to 'char \*'"]),
+    low('Extra \';\'',
+        [r".*: warning: extra ';' .+extra-semi"]),
+    low('Useless specifier',
+        [r".*: warning: useless storage class specifier in empty declaration"]),
+    low('Duplicate declaration specifier',
+        [r".*: warning: duplicate '.+' declaration specifier"]),
+    low('Comparison of self is always false',
+        [r".*: self-comparison always evaluates to false"]),
+    low('Logical op with constant operand',
+        [r".*: use of logical '.+' with constant operand"]),
+    low('Needs a space between literal and string macro',
+        [r".*: warning: invalid suffix on literal.+ requires a space .+Wliteral-suffix"]),
+    low('Warnings from #warning',
+        [r".*: warning: .+-W#warnings"]),
+    low('Using float/int absolute value function with int/float argument',
+        [r".*: warning: using .+ absolute value function .+ when argument is .+ type .+Wabsolute-value",
+         r".*: warning: absolute value function '.+' given .+ which may cause truncation .+Wabsolute-value"]),
+    low('Using C++11 extensions',
+        [r".*: warning: 'auto' type specifier is a C\+\+11 extension"]),
+    low('Refers to implicitly defined namespace',
+        [r".*: warning: using directive refers to implicitly-defined namespace .+"]),
+    low('Invalid pp token',
+        [r".*: warning: missing .+Winvalid-pp-token"]),
+    low('need glibc to link',
+        [r".*: warning: .* requires at runtime .* glibc .* for linking"]),
+    medium('Operator new returns NULL',
+           [r".*: warning: 'operator new' must not return NULL unless it is declared 'throw\(\)' .+"]),
+    medium('NULL used in arithmetic',
+           [r".*: warning: NULL used in arithmetic",
+            r".*: warning: comparison between NULL and non-pointer"]),
+    medium('Misspelled header guard',
+           [r".*: warning: '.+' is used as a header guard .+ followed by .+ different macro"]),
+    medium('Empty loop body',
+           [r".*: warning: .+ loop has empty body"]),
+    medium('Implicit conversion from enumeration type',
+           [r".*: warning: implicit conversion from enumeration type '.+'"]),
+    medium('case value not in enumerated type',
+           [r".*: warning: case value not in enumerated type '.+'"]),
+    medium('Use of deprecated method',
+           [r".*: warning: '.+' is deprecated .+"]),
+    medium('Use of garbage or uninitialized value',
+           [r".*: warning: .+ uninitialized .+\[-Wsometimes-uninitialized\]"]),
+    medium('Sizeof on array argument',
+           [r".*: warning: sizeof on array function parameter will return"]),
+    medium('Bad argument size of memory access functions',
+           [r".*: warning: .+\[-Wsizeof-pointer-memaccess\]"]),
+    medium('Return value not checked',
+           [r".*: warning: The return value from .+ is not checked"]),
+    medium('Possible heap pollution',
+           [r".*: warning: .*Possible heap pollution from .+ type .+"]),
+    medium('Variable used in loop condition not modified in loop body',
+           [r".*: warning: variable '.+' used in loop condition.*Wfor-loop-analysis"]),
+    medium('Closing a previously closed file',
+           [r".*: warning: Closing a previously closed file"]),
+    medium('Unnamed template type argument',
+           [r".*: warning: template argument.+Wunnamed-type-template-args"]),
+    medium('Unannotated fall-through between switch labels',
+           [r".*: warning: unannotated fall-through between switch labels.+Wimplicit-fallthrough"]),
+    medium('Invalid partial specialization',
+           [r".*: warning: class template partial specialization.+Winvalid-partial-specialization"]),
+    medium('Overlapping compatisons',
+           [r".*: warning: overlapping comparisons.+Wtautological-overlap-compare"]),
+    medium('int in bool context',
+           [r".*: warning: converting.+to a boolean.+Wint-in-bool-context"]),
+    medium('bitwise conditional parentheses',
+           [r".*: warning: operator.+has lower precedence.+Wbitwise-conditional-parentheses"]),
+    medium('sizeof array div',
+           [r".*: warning: .+number of elements in.+array.+Wsizeof-array-div"]),
+    medium('bool operation',
+           [r".*: warning: .+boolean.+always.+Wbool-operation"]),
+    medium('Undefined bool conversion',
+           [r".*: warning: .+may be.+always.+true.+Wundefined-bool-conversion"]),
+    medium('Typedef requires a name',
+           [r".*: warning: typedef requires a name.+Wmissing-declaration"]),
+    medium('Unknown escape sequence',
+           [r".*: warning: unknown escape sequence.+Wunknown-escape-sequence"]),
+    medium('Unicode whitespace',
+           [r".*: warning: treating Unicode.+as whitespace.+Wunicode-whitespace"]),
+    medium('Unused local typedef',
+           [r".*: warning: unused typedef.+Wunused-local-typedef"]),
+    medium('varargs warnings',
+           [r".*: warning: .*argument to 'va_start'.+\[-Wvarargs\]"]),
+    harmless('Discarded qualifier from pointer target type',
+             [r".*: warning: .+ discards '.+' qualifier from pointer target type"]),
+    harmless('Use snprintf instead of sprintf',
+             [r".*: warning: .*sprintf is often misused; please use snprintf"]),
+    harmless('Unsupported optimizaton flag',
+             [r".*: warning: optimization flag '.+' is not supported"]),
+    harmless('Extra or missing parentheses',
+             [r".*: warning: equality comparison with extraneous parentheses",
+              r".*: warning: .+ within .+Wlogical-op-parentheses"]),
+    harmless('Mismatched class vs struct tags',
+             [r".*: warning: '.+' defined as a .+ here but previously declared as a .+mismatched-tags",
+              r".*: warning: .+ was previously declared as a .+mismatched-tags"]),
+]
+
+
+def compile_patterns(patterns):
+  """Precompiling every pattern speeds up parsing by about 30x."""
+  for i in patterns:
+    i['compiled_patterns'] = []
+    for pat in i['patterns']:
+      i['compiled_patterns'].append(re.compile(pat))
+
+
+compile_patterns(warn_patterns)
diff --git a/tools/warn/java_warn_patterns.py b/tools/warn/java_warn_patterns.py
new file mode 100644
index 0000000..80e2e1d
--- /dev/null
+++ b/tools/warn/java_warn_patterns.py
@@ -0,0 +1,790 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Warning patterns for Java compiler tools."""
+
+# pylint:disable=relative-beyond-top-level
+from .cpp_warn_patterns import compile_patterns
+# pylint:disable=g-importing-member
+from .severity import Severity
+
+
+def java_warn(severity, description, pattern_list):
+  return {
+      'category': 'Java',
+      'severity': severity,
+      'description': 'Java: ' + description,
+      'patterns': pattern_list
+  }
+
+
+def java_high(description, pattern_list):
+  return java_warn(Severity.HIGH, description, pattern_list)
+
+
+def java_medium(description, pattern_list):
+  return java_warn(Severity.MEDIUM, description, pattern_list)
+
+
+def warn_with_name(name, severity, description=None):
+  if description is None:
+    description = name
+  return java_warn(severity, description,
+                   [r'.*\.java:.*: warning: .+ \[' + name + r'\]$',
+                    r'.*\.java:.*: warning: \[' + name + r'\] .+'])
+
+
+def high(name, description=None):
+  return warn_with_name(name, Severity.HIGH, description)
+
+
+def medium(name, description=None):
+  return warn_with_name(name, Severity.MEDIUM, description)
+
+
+def low(name, description=None):
+  return warn_with_name(name, Severity.LOW, description)
+
+
+warn_patterns = [
+    # pylint:disable=line-too-long,g-inconsistent-quotes
+    # Warnings from Javac
+    java_medium('Use of deprecated',
+                [r'.*: warning: \[deprecation\] .+',
+                 r'.*: warning: \[removal\] .+ has been deprecated and marked for removal$']),
+    java_medium('Incompatible SDK implementation',
+                [r'.*\.java:.*: warning: @Implementation .+ has .+ not .+ as in the SDK ']),
+    medium('unchecked', 'Unchecked conversion'),
+    java_medium('No annotation method',
+                [r'.*\.class\): warning: Cannot find annotation method .+ in']),
+    java_medium('No class/method in SDK ...',
+                [r'.*\.java:.*: warning: No such (class|method) .* for SDK']),
+    # Warnings generated by Error Prone
+    java_medium('Non-ascii characters used, but ascii encoding specified',
+                [r".*: warning: unmappable character for encoding ascii"]),
+    java_medium('Non-varargs call of varargs method with inexact argument type for last parameter',
+                [r".*: warning: non-varargs call of varargs method with inexact argument type for last parameter"]),
+    java_medium('Unchecked method invocation',
+                [r".*: warning: \[unchecked\] unchecked method invocation: .+ in class .+"]),
+    java_medium('Unchecked conversion',
+                [r".*: warning: \[unchecked\] unchecked conversion"]),
+    java_medium('_ used as an identifier',
+                [r".*: warning: '_' used as an identifier"]),
+    java_medium('hidden superclass',
+                [r".*: warning: .* stripped of .* superclass .* \[HiddenSuperclass\]"]),
+    java_high('Use of internal proprietary API',
+              [r".*: warning: .* is internal proprietary API and may be removed"]),
+    low('BooleanParameter',
+        'Use parameter comments to document ambiguous literals'),
+    low('ClassNamedLikeTypeParameter',
+        'This class\'s name looks like a Type Parameter.'),
+    low('ConstantField',
+        'Field name is CONSTANT_CASE, but field is not static and final'),
+    low('EmptySetMultibindingContributions',
+        '@Multibinds is a more efficient and declarative mechanism for ensuring that a set multibinding is present in the graph.'),
+    low('ExpectedExceptionRefactoring',
+        'Prefer assertThrows to ExpectedException'),
+    low('FieldCanBeFinal',
+        'This field is only assigned during initialization; consider making it final'),
+    low('FieldMissingNullable',
+        'Fields that can be null should be annotated @Nullable'),
+    low('ImmutableRefactoring',
+        'Refactors uses of the JSR 305 @Immutable to Error Prone\'s annotation'),
+    low('LambdaFunctionalInterface',
+        u'Use Java\'s utility functional interfaces instead of Function\u003cA, B> for primitive types.'),
+    low('MethodCanBeStatic',
+        'A private method that does not reference the enclosing instance can be static'),
+    low('MixedArrayDimensions',
+        'C-style array declarations should not be used'),
+    low('MultiVariableDeclaration',
+        'Variable declarations should declare only one variable'),
+    low('MultipleTopLevelClasses',
+        'Source files should not contain multiple top-level class declarations'),
+    low('MultipleUnaryOperatorsInMethodCall',
+        'Avoid having multiple unary operators acting on the same variable in a method call'),
+    low('OnNameExpected',
+        'OnNameExpected naming style'),
+    low('PackageLocation',
+        'Package names should match the directory they are declared in'),
+    low('ParameterComment',
+        'Non-standard parameter comment; prefer `/* paramName= */ arg`'),
+    low('ParameterNotNullable',
+        'Method parameters that aren\'t checked for null shouldn\'t be annotated @Nullable'),
+    low('PrivateConstructorForNoninstantiableModule',
+        'Add a private constructor to modules that will not be instantiated by Dagger.'),
+    low('PrivateConstructorForUtilityClass',
+        'Utility classes (only static members) are not designed to be instantiated and should be made noninstantiable with a default constructor.'),
+    low('RemoveUnusedImports',
+        'Unused imports'),
+    low('ReturnMissingNullable',
+        'Methods that can return null should be annotated @Nullable'),
+    low('ScopeOnModule',
+        'Scopes on modules have no function and will soon be an error.'),
+    low('SwitchDefault',
+        'The default case of a switch should appear at the end of the last statement group'),
+    low('TestExceptionRefactoring',
+        'Prefer assertThrows to @Test(expected=...)'),
+    low('ThrowsUncheckedException',
+        'Unchecked exceptions do not need to be declared in the method signature.'),
+    low('TryFailRefactoring',
+        'Prefer assertThrows to try/fail'),
+    low('TypeParameterNaming',
+        'Type parameters must be a single letter with an optional numeric suffix, or an UpperCamelCase name followed by the letter \'T\'.'),
+    low('UngroupedOverloads',
+        'Constructors and methods with the same name should appear sequentially with no other code in between. Please re-order or re-name methods.'),
+    low('UnnecessarySetDefault',
+        'Unnecessary call to NullPointerTester#setDefault'),
+    low('UnnecessaryStaticImport',
+        'Using static imports for types is unnecessary'),
+    low('UseBinds',
+        '@Binds is a more efficient and declarative mechanism for delegating a binding.'),
+    low('WildcardImport',
+        'Wildcard imports, static or otherwise, should not be used'),
+    medium('AcronymName',
+           'AcronymName'),
+    medium('AmbiguousMethodReference',
+           'Method reference is ambiguous'),
+    medium('AnnotateFormatMethod',
+           'This method passes a pair of parameters through to String.format, but the enclosing method wasn\'t annotated @FormatMethod. Doing so gives compile-time rather than run-time protection against malformed format strings.'),
+    medium('AnnotationPosition',
+           'Annotations should be positioned after Javadocs, but before modifiers..'),
+    medium('ArgumentSelectionDefectChecker',
+           'Arguments are in the wrong order or could be commented for clarity.'),
+    medium('ArrayAsKeyOfSetOrMap',
+           'Arrays do not override equals() or hashCode, so comparisons will be done on reference equality only. If neither deduplication nor lookup are needed, consider using a List instead. Otherwise, use IdentityHashMap/Set, a Map from a library that handles object arrays, or an Iterable/List of pairs.'),
+    medium('AssertEqualsArgumentOrderChecker',
+           'Arguments are swapped in assertEquals-like call'),
+    medium('AssertFalse',
+           'Assertions may be disabled at runtime and do not guarantee that execution will halt here; consider throwing an exception instead'),
+    medium('AssertThrowsMultipleStatements',
+           'The lambda passed to assertThrows should contain exactly one statement'),
+    medium('AssertionFailureIgnored',
+           'This assertion throws an AssertionError if it fails, which will be caught by an enclosing try block.'),
+    medium('AssistedInjectAndInjectOnConstructors',
+           '@AssistedInject and @Inject should not be used on different constructors in the same class.'),
+    medium('AutoValueFinalMethods',
+           'Make toString(), hashCode() and equals() final in AutoValue classes, so it is clear to readers that AutoValue is not overriding them'),
+    medium('BadAnnotationImplementation',
+           'Classes that implement Annotation must override equals and hashCode. Consider using AutoAnnotation instead of implementing Annotation by hand.'),
+    medium('BadComparable',
+           'Possible sign flip from narrowing conversion'),
+    medium('BadImport',
+           'Importing nested classes/static methods/static fields with commonly-used names can make code harder to read, because it may not be clear from the context exactly which type is being referred to. Qualifying the name with that of the containing class can make the code clearer.'),
+    medium('BadInstanceof',
+           'instanceof used in a way that is equivalent to a null check.'),
+    medium('BigDecimalEquals',
+           'BigDecimal#equals has surprising behavior: it also compares scale.'),
+    medium('BigDecimalLiteralDouble',
+           'new BigDecimal(double) loses precision in this case.'),
+    medium('BinderIdentityRestoredDangerously',
+           'A call to Binder.clearCallingIdentity() should be followed by Binder.restoreCallingIdentity() in a finally block. Otherwise the wrong Binder identity may be used by subsequent code.'),
+    medium('BindingToUnqualifiedCommonType',
+           'This code declares a binding for a common value type without a Qualifier annotation.'),
+    medium('BoxedPrimitiveConstructor',
+           'valueOf or autoboxing provides better time and space performance'),
+    medium('ByteBufferBackingArray',
+           'ByteBuffer.array() shouldn\'t be called unless ByteBuffer.arrayOffset() is used or if the ByteBuffer was initialized using ByteBuffer.wrap() or ByteBuffer.allocate().'),
+    medium('CannotMockFinalClass',
+           'Mockito cannot mock final classes'),
+    medium('CanonicalDuration',
+           'Duration can be expressed more clearly with different units'),
+    medium('CatchAndPrintStackTrace',
+           'Logging or rethrowing exceptions should usually be preferred to catching and calling printStackTrace'),
+    medium('CatchFail',
+           'Ignoring exceptions and calling fail() is unnecessary, and makes test output less useful'),
+    medium('ClassCanBeStatic',
+           'Inner class is non-static but does not reference enclosing class'),
+    medium('ClassNewInstance',
+           'Class.newInstance() bypasses exception checking; prefer getDeclaredConstructor().newInstance()'),
+    medium('CloseableProvides',
+           'Providing Closeable resources makes their lifecycle unclear'),
+    medium('CollectionToArraySafeParameter',
+           'The type of the array parameter of Collection.toArray needs to be compatible with the array type'),
+    medium('CollectorShouldNotUseState',
+           'Collector.of() should not use state'),
+    medium('ComparableAndComparator',
+           'Class should not implement both `Comparable` and `Comparator`'),
+    medium('ConstructorInvokesOverridable',
+           'Constructors should not invoke overridable methods.'),
+    medium('ConstructorLeaksThis',
+           'Constructors should not pass the \'this\' reference out in method invocations, since the object may not be fully constructed.'),
+    medium('DateFormatConstant',
+           'DateFormat is not thread-safe, and should not be used as a constant field.'),
+    medium('DefaultCharset',
+           'Implicit use of the platform default charset, which can result in differing behaviour between JVM executions or incorrect behavior if the encoding of the data source doesn\'t match expectations.'),
+    medium('DeprecatedThreadMethods',
+           'Avoid deprecated Thread methods; read the method\'s javadoc for details.'),
+    medium('DoubleBraceInitialization',
+           'Prefer collection factory methods or builders to the double-brace initialization pattern.'),
+    medium('DoubleCheckedLocking',
+           'Double-checked locking on non-volatile fields is unsafe'),
+    medium('EmptyTopLevelDeclaration',
+           'Empty top-level type declaration'),
+    medium('EqualsBrokenForNull',
+           'equals() implementation may throw NullPointerException when given null'),
+    medium('EqualsGetClass',
+           'Overriding Object#equals in a non-final class by using getClass rather than instanceof breaks substitutability of subclasses.'),
+    medium('EqualsHashCode',
+           'Classes that override equals should also override hashCode.'),
+    medium('EqualsIncompatibleType',
+           'An equality test between objects with incompatible types always returns false'),
+    medium('EqualsUnsafeCast',
+           'The contract of #equals states that it should return false for incompatible types, while this implementation may throw ClassCastException.'),
+    medium('EqualsUsingHashCode',
+           'Implementing #equals by just comparing hashCodes is fragile. Hashes collide frequently, and this will lead to false positives in #equals.'),
+    medium('ExpectedExceptionChecker',
+           'Calls to ExpectedException#expect should always be followed by exactly one statement.'),
+    medium('ExtendingJUnitAssert',
+           'When only using JUnit Assert\'s static methods, you should import statically instead of extending.'),
+    medium('FallThrough',
+           'Switch case may fall through'),
+    medium('Finally',
+           'If you return or throw from a finally, then values returned or thrown from the try-catch block will be ignored. Consider using try-with-resources instead.'),
+    medium('FloatCast',
+           'Use parentheses to make the precedence explicit'),
+    medium('FloatingPointAssertionWithinEpsilon',
+           'This fuzzy equality check is using a tolerance less than the gap to the next number. You may want a less restrictive tolerance, or to assert equality.'),
+    medium('FloatingPointLiteralPrecision',
+           'Floating point literal loses precision'),
+    medium('FragmentInjection',
+           'Classes extending PreferenceActivity must implement isValidFragment such that it does not unconditionally return true to prevent vulnerability to fragment injection attacks.'),
+    medium('FragmentNotInstantiable',
+           'Subclasses of Fragment must be instantiable via Class#newInstance(): the class must be public, static and have a public nullary constructor'),
+    medium('FunctionalInterfaceClash',
+           'Overloads will be ambiguous when passing lambda arguments'),
+    medium('FutureReturnValueIgnored',
+           'Return value of methods returning Future must be checked. Ignoring returned Futures suppresses exceptions thrown from the code that completes the Future.'),
+    medium('GetClassOnEnum',
+           'Calling getClass() on an enum may return a subclass of the enum type'),
+    medium('HardCodedSdCardPath',
+           'Hardcoded reference to /sdcard'),
+    medium('HidingField',
+           'Hiding fields of superclasses may cause confusion and errors'),
+    medium('ImmutableAnnotationChecker',
+           'Annotations should always be immutable'),
+    medium('ImmutableEnumChecker',
+           'Enums should always be immutable'),
+    medium('IncompatibleModifiers',
+           'This annotation has incompatible modifiers as specified by its @IncompatibleModifiers annotation'),
+    medium('InconsistentCapitalization',
+           'It is confusing to have a field and a parameter under the same scope that differ only in capitalization.'),
+    medium('InconsistentHashCode',
+           'Including fields in hashCode which are not compared in equals violates the contract of hashCode.'),
+    medium('InconsistentOverloads',
+           'The ordering of parameters in overloaded methods should be as consistent as possible (when viewed from left to right)'),
+    medium('IncrementInForLoopAndHeader',
+           'This for loop increments the same variable in the header and in the body'),
+    medium('InjectOnConstructorOfAbstractClass',
+           'Constructors on abstract classes are never directly @Injected, only the constructors of their subclasses can be @Inject\'ed.'),
+    medium('InputStreamSlowMultibyteRead',
+           'Please also override int read(byte[], int, int), otherwise multi-byte reads from this input stream are likely to be slow.'),
+    medium('InstanceOfAndCastMatchWrongType',
+           'Casting inside an if block should be plausibly consistent with the instanceof type'),
+    medium('IntLongMath',
+           'Expression of type int may overflow before being assigned to a long'),
+    medium('IntentBuilderName',
+           'IntentBuilderName'),
+    medium('InvalidParam',
+           'This @param tag doesn\'t refer to a parameter of the method.'),
+    medium('InvalidTag',
+           'This tag is invalid.'),
+    medium('InvalidThrows',
+           'The documented method doesn\'t actually throw this checked exception.'),
+    medium('IterableAndIterator',
+           'Class should not implement both `Iterable` and `Iterator`'),
+    medium('JUnit3FloatingPointComparisonWithoutDelta',
+           'Floating-point comparison without error tolerance'),
+    medium('JUnit4ClassUsedInJUnit3',
+           'Some JUnit4 construct cannot be used in a JUnit3 context. Convert your class to JUnit4 style to use them.'),
+    medium('JUnitAmbiguousTestClass',
+           'Test class inherits from JUnit 3\'s TestCase but has JUnit 4 @Test annotations.'),
+    medium('JavaLangClash',
+           'Never reuse class names from java.lang'),
+    medium('JdkObsolete',
+           'Suggests alternatives to obsolete JDK classes.'),
+    medium('LockNotBeforeTry',
+           'Calls to Lock#lock should be immediately followed by a try block which releases the lock.'),
+    medium('LogicalAssignment',
+           'Assignment where a boolean expression was expected; use == if this assignment wasn\'t expected or add parentheses for clarity.'),
+    medium('MathAbsoluteRandom',
+           'Math.abs does not always give a positive result. Please consider other methods for positive random numbers.'),
+    medium('MissingCasesInEnumSwitch',
+           'Switches on enum types should either handle all values, or have a default case.'),
+    medium('MissingDefault',
+           'The Google Java Style Guide requires that each switch statement includes a default statement group, even if it contains no code. (This requirement is lifted for any switch statement that covers all values of an enum.)'),
+    medium('MissingFail',
+           'Not calling fail() when expecting an exception masks bugs'),
+    medium('MissingOverride',
+           'method overrides method in supertype; expected @Override'),
+    medium('ModifiedButNotUsed',
+           'A collection or proto builder was created, but its values were never accessed.'),
+    medium('ModifyCollectionInEnhancedForLoop',
+           'Modifying a collection while iterating over it in a loop may cause a ConcurrentModificationException to be thrown.'),
+    medium('MultipleParallelOrSequentialCalls',
+           'Multiple calls to either parallel or sequential are unnecessary and cause confusion.'),
+    medium('MutableConstantField',
+           'Constant field declarations should use the immutable type (such as ImmutableList) instead of the general collection interface type (such as List)'),
+    medium('MutableMethodReturnType',
+           'Method return type should use the immutable type (such as ImmutableList) instead of the general collection interface type (such as List)'),
+    medium('NarrowingCompoundAssignment',
+           'Compound assignments may hide dangerous casts'),
+    medium('NestedInstanceOfConditions',
+           'Nested instanceOf conditions of disjoint types create blocks of code that never execute'),
+    medium('NoFunctionalReturnType',
+           'Instead of returning a functional type, return the actual type that the returned function would return and use lambdas at use site.'),
+    medium('NonAtomicVolatileUpdate',
+           'This update of a volatile variable is non-atomic'),
+    medium('NonCanonicalStaticMemberImport',
+           'Static import of member uses non-canonical name'),
+    medium('NonOverridingEquals',
+           'equals method doesn\'t override Object.equals'),
+    medium('NotCloseable',
+           'Not closeable'),
+    medium('NullableConstructor',
+           'Constructors should not be annotated with @Nullable since they cannot return null'),
+    medium('NullableDereference',
+           'Dereference of possibly-null value'),
+    medium('NullablePrimitive',
+           '@Nullable should not be used for primitive types since they cannot be null'),
+    medium('NullableVoid',
+           'void-returning methods should not be annotated with @Nullable, since they cannot return null'),
+    medium('ObjectToString',
+           'Calling toString on Objects that don\'t override toString() doesn\'t provide useful information'),
+    medium('ObjectsHashCodePrimitive',
+           'Objects.hashCode(Object o) should not be passed a primitive value'),
+    medium('OperatorPrecedence',
+           'Use grouping parenthesis to make the operator precedence explicit'),
+    medium('OptionalNotPresent',
+           'One should not call optional.get() inside an if statement that checks !optional.isPresent'),
+    medium('OrphanedFormatString',
+           'String literal contains format specifiers, but is not passed to a format method'),
+    medium('OverrideThrowableToString',
+           'To return a custom message with a Throwable class, one should override getMessage() instead of toString() for Throwable.'),
+    medium('Overrides',
+           'Varargs doesn\'t agree for overridden method'),
+    medium('OverridesGuiceInjectableMethod',
+           'This method is not annotated with @Inject, but it overrides a method that is annotated with @com.google.inject.Inject. Guice will inject this method, and it is recommended to annotate it explicitly.'),
+    medium('ParameterName',
+           'Detects `/* name= */`-style comments on actual parameters where the name doesn\'t match the formal parameter'),
+    medium('PreconditionsInvalidPlaceholder',
+           'Preconditions only accepts the %s placeholder in error message strings'),
+    medium('PrimitiveArrayPassedToVarargsMethod',
+           'Passing a primitive array to a varargs method is usually wrong'),
+    medium('ProtoRedundantSet',
+           'A field on a protocol buffer was set twice in the same chained expression.'),
+    medium('ProtosAsKeyOfSetOrMap',
+           'Protos should not be used as a key to a map, in a set, or in a contains method on a descendant of a collection. Protos have non deterministic ordering and proto equality is deep, which is a performance issue.'),
+    medium('ProvidesFix',
+           'BugChecker has incorrect ProvidesFix tag, please update'),
+    medium('QualifierOrScopeOnInjectMethod',
+           'Qualifiers/Scope annotations on @Inject methods don\'t have any effect. Move the qualifier annotation to the binding location.'),
+    medium('QualifierWithTypeUse',
+           'Injection frameworks currently don\'t understand Qualifiers in TYPE_PARAMETER or TYPE_USE contexts.'),
+    medium('ReachabilityFenceUsage',
+           'reachabilityFence should always be called inside a finally block'),
+    medium('RedundantThrows',
+           'Thrown exception is a subtype of another'),
+    medium('ReferenceEquality',
+           'Comparison using reference equality instead of value equality'),
+    medium('RequiredModifiers',
+           'This annotation is missing required modifiers as specified by its @RequiredModifiers annotation'),
+    medium('ReturnFromVoid',
+           'Void methods should not have a @return tag.'),
+    medium('SamShouldBeLast',
+           'SAM-compatible parameters should be last'),
+    medium('ShortCircuitBoolean',
+           u'Prefer the short-circuiting boolean operators \u0026\u0026 and || to \u0026 and |.'),
+    medium('StaticGuardedByInstance',
+           'Writes to static fields should not be guarded by instance locks'),
+    medium('StaticQualifiedUsingExpression',
+           'A static variable or method should be qualified with a class name, not expression'),
+    medium('StreamResourceLeak',
+           'Streams that encapsulate a closeable resource should be closed using try-with-resources'),
+    medium('StringEquality',
+           'String comparison using reference equality instead of value equality'),
+    medium('StringSplitter',
+           'String.split(String) has surprising behavior'),
+    medium('SwigMemoryLeak',
+           'SWIG generated code that can\'t call a C++ destructor will leak memory'),
+    medium('SynchronizeOnNonFinalField',
+           'Synchronizing on non-final fields is not safe: if the field is ever updated, different threads may end up locking on different objects.'),
+    medium('SystemExitOutsideMain',
+           'Code that contains System.exit() is untestable.'),
+    medium('TestExceptionChecker',
+           'Using @Test(expected=...) is discouraged, since the test will pass if *any* statement in the test method throws the expected exception'),
+    medium('ThreadJoinLoop',
+           'Thread.join needs to be surrounded by a loop until it succeeds, as in Uninterruptibles.joinUninterruptibly.'),
+    medium('ThreadLocalUsage',
+           'ThreadLocals should be stored in static fields'),
+    medium('ThreadPriorityCheck',
+           'Relying on the thread scheduler is discouraged; see Effective Java Item 72 (2nd edition) / 84 (3rd edition).'),
+    medium('ThreeLetterTimeZoneID',
+           'Three-letter time zone identifiers are deprecated, may be ambiguous, and might not do what you intend; the full IANA time zone ID should be used instead.'),
+    medium('ToStringReturnsNull',
+           'An implementation of Object.toString() should never return null.'),
+    medium('TruthAssertExpected',
+           'The actual and expected values appear to be swapped, which results in poor assertion failure messages. The actual value should come first.'),
+    medium('TruthConstantAsserts',
+           'Truth Library assert is called on a constant.'),
+    medium('TruthIncompatibleType',
+           'Argument is not compatible with the subject\'s type.'),
+    medium('TypeNameShadowing',
+           'Type parameter declaration shadows another named type'),
+    medium('TypeParameterShadowing',
+           'Type parameter declaration overrides another type parameter already declared'),
+    medium('TypeParameterUnusedInFormals',
+           'Declaring a type parameter that is only used in the return type is a misuse of generics: operations on the type parameter are unchecked, it hides unsafe casts at invocations of the method, and it interacts badly with method overload resolution.'),
+    medium('URLEqualsHashCode',
+           'Avoid hash-based containers of java.net.URL--the containers rely on equals() and hashCode(), which cause java.net.URL to make blocking internet connections.'),
+    medium('UndefinedEquals',
+           'Collection, Iterable, Multimap, and Queue do not have well-defined equals behavior'),
+    medium('UnnecessaryDefaultInEnumSwitch',
+           'Switch handles all enum values: an explicit default case is unnecessary and defeats error checking for non-exhaustive switches.'),
+    medium('UnnecessaryParentheses',
+           'Unnecessary use of grouping parentheses'),
+    medium('UnsafeFinalization',
+           'Finalizer may run before native code finishes execution'),
+    medium('UnsafeReflectiveConstructionCast',
+           'Prefer `asSubclass` instead of casting the result of `newInstance`, to detect classes of incorrect type before invoking their constructors.This way, if the class is of the incorrect type,it will throw an exception before invoking its constructor.'),
+    medium('UnsynchronizedOverridesSynchronized',
+           'Unsynchronized method overrides a synchronized method.'),
+    medium('Unused',
+           'Unused.'),
+    medium('UnusedException',
+           'This catch block catches an exception and re-throws another, but swallows the caught exception rather than setting it as a cause. This can make debugging harder.'),
+    medium('UseCorrectAssertInTests',
+           'Java assert is used in test. For testing purposes Assert.* matchers should be used.'),
+    medium('UserHandle',
+           'UserHandle'),
+    medium('UserHandleName',
+           'UserHandleName'),
+    medium('Var',
+           'Non-constant variable missing @Var annotation'),
+    medium('VariableNameSameAsType',
+           'variableName and type with the same name would refer to the static field instead of the class'),
+    medium('WaitNotInLoop',
+           'Because of spurious wakeups, Object.wait() and Condition.await() must always be called in a loop'),
+    medium('WakelockReleasedDangerously',
+           'A wakelock acquired with a timeout may be released by the system before calling `release`, even after checking `isHeld()`. If so, it will throw a RuntimeException. Please wrap in a try/catch block.'),
+    java_medium('Found raw type',
+                [r'.*\.java:.*: warning: \[rawtypes\] found raw type']),
+    java_medium('Redundant cast',
+                [r'.*\.java:.*: warning: \[cast\] redundant cast to']),
+    java_medium('Static method should be qualified',
+                [r'.*\.java:.*: warning: \[static\] static method should be qualified']),
+    medium('AbstractInner'),
+    medium('CallbackName'),
+    medium('ExecutorRegistration'),
+    medium('JavaApiUsedByMainlineModule'),
+    medium('ListenerLast'),
+    medium('MissingBuildMethod'),
+    medium('NoByteOrShort'),
+    medium('OverlappingConstants'),
+    medium('SetterReturnsThis'),
+    medium('Typo'),
+    medium('UseIcu'),
+    high('AndroidInjectionBeforeSuper',
+         'AndroidInjection.inject() should always be invoked before calling super.lifecycleMethod()'),
+    high('AndroidJdkLibsChecker',
+         'Use of class, field, or method that is not compatible with legacy Android devices'),
+    high('ArrayEquals',
+         'Reference equality used to compare arrays'),
+    high('ArrayFillIncompatibleType',
+         'Arrays.fill(Object[], Object) called with incompatible types.'),
+    high('ArrayHashCode',
+         'hashcode method on array does not hash array contents'),
+    high('ArrayReturn',
+         'ArrayReturn'),
+    high('ArrayToString',
+         'Calling toString on an array does not provide useful information'),
+    high('ArraysAsListPrimitiveArray',
+         'Arrays.asList does not autobox primitive arrays, as one might expect.'),
+    high('AssistedInjectAndInjectOnSameConstructor',
+         '@AssistedInject and @Inject cannot be used on the same constructor.'),
+    high('AsyncCallableReturnsNull',
+         'AsyncCallable should not return a null Future, only a Future whose result is null.'),
+    high('AsyncFunctionReturnsNull',
+         'AsyncFunction should not return a null Future, only a Future whose result is null.'),
+    high('AutoFactoryAtInject',
+         '@AutoFactory and @Inject should not be used in the same type.'),
+    high('AutoValueConstructorOrderChecker',
+         'Arguments to AutoValue constructor are in the wrong order'),
+    high('BadShiftAmount',
+         'Shift by an amount that is out of range'),
+    high('BundleDeserializationCast',
+         'Object serialized in Bundle may have been flattened to base type.'),
+    high('ChainingConstructorIgnoresParameter',
+         'The called constructor accepts a parameter with the same name and type as one of its caller\'s parameters, but its caller doesn\'t pass that parameter to it.  It\'s likely that it was intended to.'),
+    high('CheckReturnValue',
+         'Ignored return value of method that is annotated with @CheckReturnValue'),
+    high('ClassName',
+         'The source file name should match the name of the top-level class it contains'),
+    high('CollectionIncompatibleType',
+         'Incompatible type as argument to Object-accepting Java collections method'),
+    high('ComparableType',
+         u'Implementing \'Comparable\u003cT>\' where T is not compatible with the implementing class.'),
+    high('ComparingThisWithNull',
+         'this == null is always false, this != null is always true'),
+    high('ComparisonContractViolated',
+         'This comparison method violates the contract'),
+    high('ComparisonOutOfRange',
+         'Comparison to value that is out of range for the compared type'),
+    high('CompatibleWithAnnotationMisuse',
+         '@CompatibleWith\'s value is not a type argument.'),
+    high('CompileTimeConstant',
+         'Non-compile-time constant expression passed to parameter with @CompileTimeConstant type annotation.'),
+    high('ComplexBooleanConstant',
+         'Non-trivial compile time constant boolean expressions shouldn\'t be used.'),
+    high('ConditionalExpressionNumericPromotion',
+         'A conditional expression with numeric operands of differing types will perform binary numeric promotion of the operands; when these operands are of reference types, the expression\'s result may not be of the expected type.'),
+    high('ConstantOverflow',
+         'Compile-time constant expression overflows'),
+    high('DaggerProvidesNull',
+         'Dagger @Provides methods may not return null unless annotated with @Nullable'),
+    high('DeadException',
+         'Exception created but not thrown'),
+    high('DeadThread',
+         'Thread created but not started'),
+    java_high('Deprecated item is not annotated with @Deprecated',
+              [r".*\.java:.*: warning: \[.*\] .+ is not annotated with @Deprecated$"]),
+    high('DivZero',
+         'Division by integer literal zero'),
+    high('DoNotCall',
+         'This method should not be called.'),
+    high('EmptyIf',
+         'Empty statement after if'),
+    high('EqualsNaN',
+         '== NaN always returns false; use the isNaN methods instead'),
+    high('EqualsReference',
+         '== must be used in equals method to check equality to itself or an infinite loop will occur.'),
+    high('EqualsWrongThing',
+         'Comparing different pairs of fields/getters in an equals implementation is probably a mistake.'),
+    high('ForOverride',
+         'Method annotated @ForOverride must be protected or package-private and only invoked from declaring class, or from an override of the method'),
+    high('FormatString',
+         'Invalid printf-style format string'),
+    high('FormatStringAnnotation',
+         'Invalid format string passed to formatting method.'),
+    high('FunctionalInterfaceMethodChanged',
+         'Casting a lambda to this @FunctionalInterface can cause a behavior change from casting to a functional superinterface, which is surprising to users.  Prefer decorator methods to this surprising behavior.'),
+    high('FuturesGetCheckedIllegalExceptionType',
+         'Futures.getChecked requires a checked exception type with a standard constructor.'),
+    high('FuzzyEqualsShouldNotBeUsedInEqualsMethod',
+         'DoubleMath.fuzzyEquals should never be used in an Object.equals() method'),
+    high('GetClassOnAnnotation',
+         'Calling getClass() on an annotation may return a proxy class'),
+    high('GetClassOnClass',
+         'Calling getClass() on an object of type Class returns the Class object for java.lang.Class; you probably meant to operate on the object directly'),
+    high('GuardedBy',
+         'Checks for unguarded accesses to fields and methods with @GuardedBy annotations'),
+    high('GuiceAssistedInjectScoping',
+         'Scope annotation on implementation class of AssistedInject factory is not allowed'),
+    high('GuiceAssistedParameters',
+         'A constructor cannot have two @Assisted parameters of the same type unless they are disambiguated with named @Assisted annotations.'),
+    high('GuiceInjectOnFinalField',
+         'Although Guice allows injecting final fields, doing so is disallowed because the injected value may not be visible to other threads.'),
+    high('HashtableContains',
+         'contains() is a legacy method that is equivalent to containsValue()'),
+    high('IdentityBinaryExpression',
+         'A binary expression where both operands are the same is usually incorrect.'),
+    high('Immutable',
+         'Type declaration annotated with @Immutable is not immutable'),
+    high('ImmutableModification',
+         'Modifying an immutable collection is guaranteed to throw an exception and leave the collection unmodified'),
+    high('IncompatibleArgumentType',
+         'Passing argument to a generic method with an incompatible type.'),
+    high('IndexOfChar',
+         'The first argument to indexOf is a Unicode code point, and the second is the index to start the search from'),
+    high('InexactVarargsConditional',
+         'Conditional expression in varargs call contains array and non-array arguments'),
+    high('InfiniteRecursion',
+         'This method always recurses, and will cause a StackOverflowError'),
+    high('InjectInvalidTargetingOnScopingAnnotation',
+         'A scoping annotation\'s Target should include TYPE and METHOD.'),
+    high('InjectMoreThanOneQualifier',
+         'Using more than one qualifier annotation on the same element is not allowed.'),
+    high('InjectMoreThanOneScopeAnnotationOnClass',
+         'A class can be annotated with at most one scope annotation.'),
+    high('InjectOnMemberAndConstructor',
+         'Members shouldn\'t be annotated with @Inject if constructor is already annotated @Inject'),
+    high('InjectScopeAnnotationOnInterfaceOrAbstractClass',
+         'Scope annotation on an interface or abstact class is not allowed'),
+    high('InjectScopeOrQualifierAnnotationRetention',
+         'Scoping and qualifier annotations must have runtime retention.'),
+    high('InjectedConstructorAnnotations',
+         'Injected constructors cannot be optional nor have binding annotations'),
+    high('InsecureCryptoUsage',
+         'A standard cryptographic operation is used in a mode that is prone to vulnerabilities'),
+    high('InvalidPatternSyntax',
+         'Invalid syntax used for a regular expression'),
+    high('InvalidTimeZoneID',
+         'Invalid time zone identifier. TimeZone.getTimeZone(String) will silently return GMT instead of the time zone you intended.'),
+    high('IsInstanceOfClass',
+         'The argument to Class#isInstance(Object) should not be a Class'),
+    high('IsLoggableTagLength',
+         'Log tag too long, cannot exceed 23 characters.'),
+    high('IterablePathParameter',
+         u'Path implements Iterable\u003cPath>; prefer Collection\u003cPath> for clarity'),
+    high('JMockTestWithoutRunWithOrRuleAnnotation',
+         'jMock tests must have a @RunWith(JMock.class) annotation, or the Mockery field must have a @Rule JUnit annotation'),
+    high('JUnit3TestNotRun',
+         'Test method will not be run; please correct method signature (Should be public, non-static, and method name should begin with "test").'),
+    high('JUnit4ClassAnnotationNonStatic',
+         'This method should be static'),
+    high('JUnit4SetUpNotRun',
+         'setUp() method will not be run; please add JUnit\'s @Before annotation'),
+    high('JUnit4TearDownNotRun',
+         'tearDown() method will not be run; please add JUnit\'s @After annotation'),
+    high('JUnit4TestNotRun',
+         'This looks like a test method but is not run; please add @Test and @Ignore, or, if this is a helper method, reduce its visibility.'),
+    high('JUnitAssertSameCheck',
+         'An object is tested for reference equality to itself using JUnit library.'),
+    high('Java7ApiChecker',
+         'Use of class, field, or method that is not compatible with JDK 7'),
+    high('JavaxInjectOnAbstractMethod',
+         'Abstract and default methods are not injectable with javax.inject.Inject'),
+    high('JavaxInjectOnFinalField',
+         '@javax.inject.Inject cannot be put on a final field.'),
+    high('LiteByteStringUtf8',
+         'This pattern will silently corrupt certain byte sequences from the serialized protocol message. Use ByteString or byte[] directly'),
+    high('LockMethodChecker',
+         'This method does not acquire the locks specified by its @LockMethod annotation'),
+    high('LongLiteralLowerCaseSuffix',
+         'Prefer \'L\' to \'l\' for the suffix to long literals'),
+    high('LoopConditionChecker',
+         'Loop condition is never modified in loop body.'),
+    high('MathRoundIntLong',
+         'Math.round(Integer) results in truncation'),
+    high('MislabeledAndroidString',
+         'Certain resources in `android.R.string` have names that do not match their content'),
+    high('MissingSuperCall',
+         'Overriding method is missing a call to overridden super method'),
+    high('MissingTestCall',
+         'A terminating method call is required for a test helper to have any effect.'),
+    high('MisusedWeekYear',
+         'Use of "YYYY" (week year) in a date pattern without "ww" (week in year). You probably meant to use "yyyy" (year) instead.'),
+    high('MockitoCast',
+         'A bug in Mockito will cause this test to fail at runtime with a ClassCastException'),
+    high('MockitoUsage',
+         'Missing method call for verify(mock) here'),
+    high('ModifyingCollectionWithItself',
+         'Using a collection function with itself as the argument.'),
+    high('MoreThanOneInjectableConstructor',
+         'This class has more than one @Inject-annotated constructor. Please remove the @Inject annotation from all but one of them.'),
+    high('MustBeClosedChecker',
+         'The result of this method must be closed.'),
+    high('NCopiesOfChar',
+         'The first argument to nCopies is the number of copies, and the second is the item to copy'),
+    high('NoAllocation',
+         '@NoAllocation was specified on this method, but something was found that would trigger an allocation'),
+    high('NonCanonicalStaticImport',
+         'Static import of type uses non-canonical name'),
+    high('NonFinalCompileTimeConstant',
+         '@CompileTimeConstant parameters should be final or effectively final'),
+    high('NonRuntimeAnnotation',
+         'Calling getAnnotation on an annotation that is not retained at runtime.'),
+    high('NullTernary',
+         'This conditional expression may evaluate to null, which will result in an NPE when the result is unboxed.'),
+    high('NumericEquality',
+         'Numeric comparison using reference equality instead of value equality'),
+    high('OptionalEquality',
+         'Comparison using reference equality instead of value equality'),
+    high('OverlappingQualifierAndScopeAnnotation',
+         'Annotations cannot be both Scope annotations and Qualifier annotations: this causes confusion when trying to use them.'),
+    high('OverridesJavaxInjectableMethod',
+         'This method is not annotated with @Inject, but it overrides a method that is  annotated with @javax.inject.Inject. The method will not be Injected.'),
+    high('PackageInfo',
+         'Declaring types inside package-info.java files is very bad form'),
+    high('ParameterPackage',
+         'Method parameter has wrong package'),
+    high('ParcelableCreator',
+         'Detects classes which implement Parcelable but don\'t have CREATOR'),
+    high('PreconditionsCheckNotNull',
+         'Literal passed as first argument to Preconditions.checkNotNull() can never be null'),
+    high('PreconditionsCheckNotNullPrimitive',
+         'First argument to `Preconditions.checkNotNull()` is a primitive rather than an object reference'),
+    high('PredicateIncompatibleType',
+         'Using ::equals or ::isInstance as an incompatible Predicate; the predicate will always return false'),
+    high('PrivateSecurityContractProtoAccess',
+         'Access to a private protocol buffer field is forbidden. This protocol buffer carries a security contract, and can only be created using an approved library. Direct access to the fields is forbidden.'),
+    high('ProtoFieldNullComparison',
+         'Protobuf fields cannot be null.'),
+    high('ProtoStringFieldReferenceEquality',
+         'Comparing protobuf fields of type String using reference equality'),
+    high('ProtocolBufferOrdinal',
+         'To get the tag number of a protocol buffer enum, use getNumber() instead.'),
+    high('ProvidesMethodOutsideOfModule',
+         '@Provides methods need to be declared in a Module to have any effect.'),
+    high('RandomCast',
+         'Casting a random number in the range [0.0, 1.0) to an integer or long always results in 0.'),
+    high('RandomModInteger',
+         'Use Random.nextInt(int).  Random.nextInt() % n can have negative results'),
+    high('RectIntersectReturnValueIgnored',
+         'Return value of android.graphics.Rect.intersect() must be checked'),
+    high('RestrictTo',
+         'Use of method or class annotated with @RestrictTo'),
+    high('RestrictedApiChecker',
+         ' Check for non-whitelisted callers to RestrictedApiChecker.'),
+    high('ReturnValueIgnored',
+         'Return value of this method must be used'),
+    high('SelfAssignment',
+         'Variable assigned to itself'),
+    high('SelfComparison',
+         'An object is compared to itself'),
+    high('SelfEquals',
+         'Testing an object for equality with itself will always be true.'),
+    high('ShouldHaveEvenArgs',
+         'This method must be called with an even number of arguments.'),
+    high('SizeGreaterThanOrEqualsZero',
+         'Comparison of a size >= 0 is always true, did you intend to check for non-emptiness?'),
+    high('StaticOrDefaultInterfaceMethod',
+         'Static and default interface methods are not natively supported on older Android devices. '),
+    high('StreamToString',
+         'Calling toString on a Stream does not provide useful information'),
+    high('StringBuilderInitWithChar',
+         'StringBuilder does not have a char constructor; this invokes the int constructor.'),
+    high('SubstringOfZero',
+         'String.substring(0) returns the original String'),
+    high('SuppressWarningsDeprecated',
+         'Suppressing "deprecated" is probably a typo for "deprecation"'),
+    high('ThrowIfUncheckedKnownChecked',
+         'throwIfUnchecked(knownCheckedException) is a no-op.'),
+    high('ThrowNull',
+         'Throwing \'null\' always results in a NullPointerException being thrown.'),
+    high('TruthSelfEquals',
+         'isEqualTo should not be used to test an object for equality with itself; the assertion will never fail.'),
+    high('TryFailThrowable',
+         'Catching Throwable/Error masks failures from fail() or assert*() in the try block'),
+    high('TypeParameterQualifier',
+         'Type parameter used as type qualifier'),
+    high('UnlockMethod',
+         'This method does not acquire the locks specified by its @UnlockMethod annotation'),
+    high('UnnecessaryTypeArgument',
+         'Non-generic methods should not be invoked with type arguments'),
+    high('UnusedAnonymousClass',
+         'Instance created but never used'),
+    high('UnusedCollectionModifiedInPlace',
+         'Collection is modified in place, but the result is not used'),
+    high('VarTypeName',
+         '`var` should not be used as a type name.'),
+
+    # Other javac tool warnings
+    java_medium('addNdkApiCoverage failed to getPackage',
+                [r".*: warning: addNdkApiCoverage failed to getPackage"]),
+    java_medium('Supported version from annotation processor',
+                [r".*: warning: Supported source version .+ from annotation processor"]),
+]
+
+compile_patterns(warn_patterns)
diff --git a/tools/warn/make_warn_patterns.py b/tools/warn/make_warn_patterns.py
new file mode 100644
index 0000000..dd6a1b0
--- /dev/null
+++ b/tools/warn/make_warn_patterns.py
@@ -0,0 +1,62 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Warning patterns for build make tools."""
+
+# pylint:disable=relative-beyond-top-level
+from .cpp_warn_patterns import compile_patterns
+# pylint:disable=g-importing-member
+from .severity import Severity
+
+warn_patterns = [
+    # pylint:disable=line-too-long,g-inconsistent-quotes
+    {'category': 'make', 'severity': Severity.MEDIUM,
+     'description': 'make: overriding commands/ignoring old commands',
+     'patterns': [r".*: warning: overriding commands for target .+",
+                  r".*: warning: ignoring old commands for target .+"]},
+    {'category': 'make', 'severity': Severity.HIGH,
+     'description': 'make: LOCAL_CLANG is false',
+     'patterns': [r".*: warning: LOCAL_CLANG is set to false"]},
+    {'category': 'make', 'severity': Severity.HIGH,
+     'description': 'SDK App using platform shared library',
+     'patterns': [r".*: warning: .+ \(.*app:sdk.*\) should not link to .+ \(native:platform\)"]},
+    {'category': 'make', 'severity': Severity.HIGH,
+     'description': 'System module linking to a vendor module',
+     'patterns': [r".*: warning: .+ \(.+\) should not link to .+ \(partition:.+\)"]},
+    {'category': 'make', 'severity': Severity.MEDIUM,
+     'description': 'Invalid SDK/NDK linking',
+     'patterns': [r".*: warning: .+ \(.+\) should not link to .+ \(.+\)"]},
+    {'category': 'make', 'severity': Severity.MEDIUM,
+     'description': 'Duplicate header copy',
+     'patterns': [r".*: warning: Duplicate header copy: .+"]},
+    {'category': 'FindEmulator', 'severity': Severity.HARMLESS,
+     'description': 'FindEmulator: No such file or directory',
+     'patterns': [r".*: warning: FindEmulator: .* No such file or directory"]},
+    {'category': 'make', 'severity': Severity.HARMLESS,
+     'description': 'make: unknown installed file',
+     'patterns': [r".*: warning: .*_tests: Unknown installed file for module"]},
+    {'category': 'make', 'severity': Severity.HARMLESS,
+     'description': 'unusual tags debug eng',
+     'patterns': [r".*: warning: .*: unusual tags debug eng"]},
+    {'category': 'make', 'severity': Severity.MEDIUM,
+     'description': 'make: please convert to soong',
+     'patterns': [r".*: warning: .* has been deprecated. Please convert to Soong."]},
+    {'category': 'make', 'severity': Severity.MEDIUM,
+     'description': 'make: deprecated macros',
+     'patterns': [r".*\.mk:.* warning:.* [A-Z_]+ (is|has been) deprecated."]},
+]
+
+
+compile_patterns(warn_patterns)
diff --git a/tools/warn/other_warn_patterns.py b/tools/warn/other_warn_patterns.py
new file mode 100644
index 0000000..1350936
--- /dev/null
+++ b/tools/warn/other_warn_patterns.py
@@ -0,0 +1,164 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Warning patterns from other tools."""
+
+# pylint:disable=relative-beyond-top-level
+from .cpp_warn_patterns import compile_patterns
+# pylint:disable=g-importing-member
+from .severity import Severity
+
+
+def warn(name, severity, description, pattern_list):
+  return {
+      'category': name,
+      'severity': severity,
+      'description': name + ': ' + description,
+      'patterns': pattern_list
+  }
+
+
+def aapt(description, pattern_list):
+  return warn('aapt', Severity.MEDIUM, description, pattern_list)
+
+
+def misc(description, pattern_list):
+  return warn('logtags', Severity.LOW, description, pattern_list)
+
+
+def asm(description, pattern_list):
+  return warn('asm', Severity.MEDIUM, description, pattern_list)
+
+
+def kotlin(description, pattern_list):
+  return warn('Kotlin', Severity.MEDIUM, description, pattern_list)
+
+
+def yacc(description, pattern_list):
+  return warn('yacc', Severity.MEDIUM, description, pattern_list)
+
+
+warn_patterns = [
+    # pylint:disable=line-too-long,g-inconsistent-quotes
+    # aapt warnings
+    aapt('No comment for public symbol',
+         [r".*: warning: No comment for public symbol .+"]),
+    aapt('No default translation',
+         [r".*: warning: string '.+' has no default translation in .*"]),
+    aapt('Missing default or required localization',
+         [r".*: warning: \*\*\*\* string '.+' has no default or required localization for '.+' in .+"]),
+    aapt('String marked untranslatable, but translation exists',
+         [r".*: warning: string '.+' in .* marked untranslatable but exists in locale '??_??'"]),
+    aapt('empty span in string',
+         [r".*: warning: empty '.+' span found in text '.+"]),
+    # misc warnings
+    misc('Duplicate logtag',
+         [r".*: warning: tag \".+\" \(.+\) duplicated in .+"]),
+    misc('Typedef redefinition',
+         [r".*: warning: redefinition of typedef '.+' is a C11 feature"]),
+    misc('GNU old-style field designator',
+         [r".*: warning: use of GNU old-style field designator extension"]),
+    misc('Missing field initializers',
+         [r".*: warning: missing field '.+' initializer"]),
+    misc('Missing braces',
+         [r".*: warning: suggest braces around initialization of",
+          r".*: warning: too many braces around scalar initializer .+Wmany-braces-around-scalar-init",
+          r".*: warning: braces around scalar initializer"]),
+    misc('Comparison of integers of different signs',
+         [r".*: warning: comparison of integers of different signs.+sign-compare"]),
+    misc('Add braces to avoid dangling else',
+         [r".*: warning: add explicit braces to avoid dangling else"]),
+    misc('Initializer overrides prior initialization',
+         [r".*: warning: initializer overrides prior initialization of this subobject"]),
+    misc('Assigning value to self',
+         [r".*: warning: explicitly assigning value of .+ to itself"]),
+    misc('GNU extension, variable sized type not at end',
+         [r".*: warning: field '.+' with variable sized type '.+' not at the end of a struct or class"]),
+    misc('Comparison of constant is always false/true',
+         [r".*: comparison of .+ is always .+Wtautological-constant-out-of-range-compare"]),
+    misc('Hides overloaded virtual function',
+         [r".*: '.+' hides overloaded virtual function"]),
+    misc('Incompatible pointer types',
+         [r".*: warning: incompatible .*pointer types .*-Wincompatible-.*pointer-types"]),
+    # Assembler warnings
+    asm('ASM value size does not match register size',
+        [r".*: warning: value size does not match register size specified by the constraint and modifier"]),
+    asm('IT instruction is deprecated',
+        [r".*: warning: applying IT instruction .* is deprecated"]),
+    # NDK warnings
+    {'category': 'NDK', 'severity': Severity.HIGH,
+     'description': 'NDK: Generate guard with empty availability, obsoleted',
+     'patterns': [r".*: warning: .* generate guard with empty availability: obsoleted ="]},
+    # Protoc warnings
+    {'category': 'Protoc', 'severity': Severity.MEDIUM,
+     'description': 'Proto: Enum name collision after strip',
+     'patterns': [r".*: warning: Enum .* has the same name .* ignore case and strip"]},
+    {'category': 'Protoc', 'severity': Severity.MEDIUM,
+     'description': 'Proto: Import not used',
+     'patterns': [r".*: warning: Import .*/.*\.proto but not used.$"]},
+    # Kotlin warnings
+    kotlin('never used parameter or variable',
+           [r".*\.kt:.*: warning: (parameter|variable) '.*' is never used$",
+            r".*\.kt:.*: warning: (parameter|variable) '.*' is never used, could be renamed to _$"]),
+    kotlin('initializer is redundant',
+           [r".*\.kt:.*: warning: .* initializer is redundant$"]),
+    kotlin('elvis operator always returns ...',
+           [r".*\.kt:.*: warning: elvis operator \(\?:\) always returns .+"]),
+    kotlin('shadowed name',
+           [r".*\.kt:.*: warning: name shadowed: .+"]),
+    kotlin('unchecked cast',
+           [r".*\.kt:.*: warning: unchecked cast: .* to .*$"]),
+    kotlin('unnecessary safe call on a non-null receiver',
+           [r".*\.kt:.*: warning: unnecessary safe call on a non-null receiver"]),
+    kotlin('Deprecated in Java',
+           [r".*\.kt:.*: warning: '.*' is deprecated. Deprecated in Java"]),
+    kotlin('Replacing Handler for Executor',
+           [r".*\.kt:.*: warning: .+ Replacing Handler for Executor in "]),
+    kotlin('library has Kotlin runtime',
+           [r".*: warning: library has Kotlin runtime bundled into it",
+            r".*: warning: some JAR files .* have the Kotlin Runtime library"]),
+    # Yacc warnings
+    yacc('deprecate directive',
+         [r".*\.yy?:.*: warning: deprecated directive: "]),
+    yacc('shift/reduce conflicts',
+         [r".*\.yy?: warning: .+ shift/reduce conflicts "]),
+    {'category': 'yacc', 'severity': Severity.SKIP,
+     'description': 'yacc: fix-its can be applied',
+     'patterns': [r".*\.yy?: warning: fix-its can be applied."]},
+    # Rust warnings
+    {'category': 'Rust', 'severity': Severity.HIGH,
+     'description': 'Rust: Does not derive Copy',
+     'patterns': [r".*: warning: .+ does not derive Copy"]},
+    {'category': 'Rust', 'severity': Severity.MEDIUM,
+     'description': 'Rust: Deprecated range pattern',
+     'patterns': [r".*: warning: .+ range patterns are deprecated"]},
+    {'category': 'Rust', 'severity': Severity.MEDIUM,
+     'description': 'Rust: Deprecated missing explicit \'dyn\'',
+     'patterns': [r".*: warning: .+ without an explicit `dyn` are deprecated"]},
+    # Broken/partial warning messages will be skipped.
+    {'category': 'Misc', 'severity': Severity.SKIP,
+     'description': 'skip, ,',
+     'patterns': [r".*: warning: ,?$"]},
+    {'category': 'C/C++', 'severity': Severity.SKIP,
+     'description': 'skip, In file included from ...',
+     'patterns': [r".*: warning: In file included from .+,"]},
+    # catch-all for warnings this script doesn't know about yet
+    {'category': 'C/C++', 'severity': Severity.UNMATCHED,
+     'description': 'Unclassified/unrecognized warnings',
+     'patterns': [r".*: warning: .+"]},
+]
+
+
+compile_patterns(warn_patterns)
diff --git a/tools/warn/severity.py b/tools/warn/severity.py
new file mode 100644
index 0000000..b1c38e4
--- /dev/null
+++ b/tools/warn/severity.py
@@ -0,0 +1,57 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Clang_Tidy_Warn Severity class definition.
+
+This file stores definition for class Severity that is used in warn_patterns.
+"""
+
+
+# pylint:disable=old-style-class
+class Severity:
+  """Class of Severity levels where each level is a SeverityInfo."""
+
+  class SeverityInfo:
+
+    def __init__(self, value, color, column_header, header):
+      self.value = value
+      self.color = color
+      self.column_header = column_header
+      self.header = header
+
+  # SEVERITY_UNKNOWN should never occur since every warn_pattern listed has
+  # a specified severity. It exists for protobuf, the other values must
+  # map to non-zero values (since 0 is reserved for a default UNKNOWN), but
+  # logic in clang_tidy_warn.py assumes severity level values are consecutive
+  # ints starting with 0.
+  SEVERITY_UNKNOWN = SeverityInfo(0, 'blueviolet', 'Errors of unknown severity',
+                                  'Unknown severity (should not occur)')
+  FIXMENOW = SeverityInfo(1, 'fuschia', 'FixNow',
+                          'Critical warnings, fix me now')
+  HIGH = SeverityInfo(2, 'red', 'High', 'High severity warnings')
+  MEDIUM = SeverityInfo(3, 'orange', 'Medium', 'Medium severity warnings')
+  LOW = SeverityInfo(4, 'yellow', 'Low', 'Low severity warnings')
+  ANALYZER = SeverityInfo(5, 'hotpink', 'Analyzer', 'Clang-Analyzer warnings')
+  TIDY = SeverityInfo(6, 'peachpuff', 'Tidy', 'Clang-Tidy warnings')
+  HARMLESS = SeverityInfo(7, 'limegreen', 'Harmless', 'Harmless warnings')
+  UNMATCHED = SeverityInfo(8, 'lightblue', 'Unmatched', 'Unmatched warnings')
+  SKIP = SeverityInfo(9, 'grey', 'Unhandled', 'Unhandled warnings')
+
+  levels = [
+      SEVERITY_UNKNOWN, FIXMENOW, HIGH, MEDIUM, LOW, ANALYZER, TIDY, HARMLESS,
+      UNMATCHED, SKIP
+  ]
+  # HTML relies on ordering by value. Sort here to ensure that this is proper
+  levels = sorted(levels, key=lambda severity: severity.value)
diff --git a/tools/warn/tidy_warn_patterns.py b/tools/warn/tidy_warn_patterns.py
new file mode 100644
index 0000000..2c5ab79
--- /dev/null
+++ b/tools/warn/tidy_warn_patterns.py
@@ -0,0 +1,206 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Warning patterns for clang-tidy."""
+
+# pylint:disable=relative-beyond-top-level
+from .cpp_warn_patterns import compile_patterns
+# pylint:disable=g-importing-member
+from .severity import Severity
+
+
+def tidy_warn_pattern(description, pattern):
+  return {
+      'category': 'C/C++',
+      'severity': Severity.TIDY,
+      'description': 'clang-tidy ' + description,
+      'patterns': [r'.*: .+\[' + pattern + r'\]$']
+  }
+
+
+def simple_tidy_warn_pattern(description):
+  return tidy_warn_pattern(description, description)
+
+
+def group_tidy_warn_pattern(description):
+  return tidy_warn_pattern(description, description + r'-.+')
+
+
+def analyzer_high(description, patterns):
+  # Important clang analyzer warnings to be fixed ASAP.
+  return {
+      'category': 'C/C++',
+      'severity': Severity.HIGH,
+      'description': description,
+      'patterns': patterns
+  }
+
+
+def analyzer_high_check(check):
+  return analyzer_high(check, [r'.*: .+\[' + check + r'\]$'])
+
+
+def analyzer_group_high(check):
+  return analyzer_high(check, [r'.*: .+\[' + check + r'.+\]$'])
+
+
+def analyzer_warn(description, patterns):
+  return {
+      'category': 'C/C++',
+      'severity': Severity.ANALYZER,
+      'description': description,
+      'patterns': patterns
+  }
+
+
+def analyzer_warn_check(check):
+  return analyzer_warn(check, [r'.*: .+\[' + check + r'\]$'])
+
+
+def analyzer_group_check(check):
+  return analyzer_warn(check, [r'.*: .+\[' + check + r'.+\]$'])
+
+
+warn_patterns = [
+    # pylint:disable=line-too-long,g-inconsistent-quotes
+    group_tidy_warn_pattern('android'),
+    simple_tidy_warn_pattern('abseil-string-find-startswith'),
+    simple_tidy_warn_pattern('bugprone-argument-comment'),
+    simple_tidy_warn_pattern('bugprone-copy-constructor-init'),
+    simple_tidy_warn_pattern('bugprone-fold-init-type'),
+    simple_tidy_warn_pattern('bugprone-forward-declaration-namespace'),
+    simple_tidy_warn_pattern('bugprone-forwarding-reference-overload'),
+    simple_tidy_warn_pattern('bugprone-inaccurate-erase'),
+    simple_tidy_warn_pattern('bugprone-incorrect-roundings'),
+    simple_tidy_warn_pattern('bugprone-integer-division'),
+    simple_tidy_warn_pattern('bugprone-lambda-function-name'),
+    simple_tidy_warn_pattern('bugprone-macro-parentheses'),
+    simple_tidy_warn_pattern('bugprone-misplaced-widening-cast'),
+    simple_tidy_warn_pattern('bugprone-move-forwarding-reference'),
+    simple_tidy_warn_pattern('bugprone-sizeof-expression'),
+    simple_tidy_warn_pattern('bugprone-string-constructor'),
+    simple_tidy_warn_pattern('bugprone-string-integer-assignment'),
+    simple_tidy_warn_pattern('bugprone-suspicious-enum-usage'),
+    simple_tidy_warn_pattern('bugprone-suspicious-missing-comma'),
+    simple_tidy_warn_pattern('bugprone-suspicious-string-compare'),
+    simple_tidy_warn_pattern('bugprone-suspicious-semicolon'),
+    simple_tidy_warn_pattern('bugprone-undefined-memory-manipulation'),
+    simple_tidy_warn_pattern('bugprone-unused-raii'),
+    simple_tidy_warn_pattern('bugprone-use-after-move'),
+    group_tidy_warn_pattern('bugprone'),
+    group_tidy_warn_pattern('cert'),
+    group_tidy_warn_pattern('clang-diagnostic'),
+    group_tidy_warn_pattern('cppcoreguidelines'),
+    group_tidy_warn_pattern('llvm'),
+    simple_tidy_warn_pattern('google-default-arguments'),
+    simple_tidy_warn_pattern('google-runtime-int'),
+    simple_tidy_warn_pattern('google-runtime-operator'),
+    simple_tidy_warn_pattern('google-runtime-references'),
+    group_tidy_warn_pattern('google-build'),
+    group_tidy_warn_pattern('google-explicit'),
+    group_tidy_warn_pattern('google-redability'),
+    group_tidy_warn_pattern('google-global'),
+    group_tidy_warn_pattern('google-redability'),
+    group_tidy_warn_pattern('google-redability'),
+    group_tidy_warn_pattern('google'),
+    simple_tidy_warn_pattern('hicpp-explicit-conversions'),
+    simple_tidy_warn_pattern('hicpp-function-size'),
+    simple_tidy_warn_pattern('hicpp-invalid-access-moved'),
+    simple_tidy_warn_pattern('hicpp-member-init'),
+    simple_tidy_warn_pattern('hicpp-delete-operators'),
+    simple_tidy_warn_pattern('hicpp-special-member-functions'),
+    simple_tidy_warn_pattern('hicpp-use-equals-default'),
+    simple_tidy_warn_pattern('hicpp-use-equals-delete'),
+    simple_tidy_warn_pattern('hicpp-no-assembler'),
+    simple_tidy_warn_pattern('hicpp-noexcept-move'),
+    simple_tidy_warn_pattern('hicpp-use-override'),
+    group_tidy_warn_pattern('hicpp'),
+    group_tidy_warn_pattern('modernize'),
+    group_tidy_warn_pattern('misc'),
+    simple_tidy_warn_pattern('performance-faster-string-find'),
+    simple_tidy_warn_pattern('performance-for-range-copy'),
+    simple_tidy_warn_pattern('performance-implicit-cast-in-loop'),
+    simple_tidy_warn_pattern('performance-inefficient-string-concatenation'),
+    simple_tidy_warn_pattern('performance-type-promotion-in-math-fn'),
+    simple_tidy_warn_pattern('performance-unnecessary-copy-initialization'),
+    simple_tidy_warn_pattern('performance-unnecessary-value-param'),
+    simple_tidy_warn_pattern('portability-simd-intrinsics'),
+    group_tidy_warn_pattern('performance'),
+    group_tidy_warn_pattern('readability'),
+    simple_tidy_warn_pattern('abseil-string-find-startwith'),
+    simple_tidy_warn_pattern('abseil-faster-strsplit-delimiter'),
+    simple_tidy_warn_pattern('abseil-no-namespace'),
+    simple_tidy_warn_pattern('abseil-no-internal-dependencies'),
+    group_tidy_warn_pattern('abseil'),
+    simple_tidy_warn_pattern('portability-simd-intrinsics'),
+    group_tidy_warn_pattern('portability'),
+
+    # warnings from clang-tidy's clang-analyzer checks
+    analyzer_high('clang-analyzer-core, null pointer',
+                  [r".*: warning: .+ pointer is null .*\[clang-analyzer-core"]),
+    analyzer_high('clang-analyzer-core, uninitialized value',
+                  [r".*: warning: .+ uninitialized (value|data) .*\[clang-analyzer-core"]),
+    analyzer_warn('clang-analyzer-optin.performance.Padding',
+                  [r".*: warning: Excessive padding in '.*'"]),
+    # analyzer_warn('clang-analyzer Unreachable code',
+    #               [r".*: warning: This statement is never executed.*UnreachableCode"]),
+    analyzer_warn('clang-analyzer Size of malloc may overflow',
+                  [r".*: warning: .* size of .* may overflow .*MallocOverflow"]),
+    analyzer_warn('clang-analyzer sozeof() on a pointer type',
+                  [r".*: warning: .*calls sizeof.* on a pointer type.*SizeofPtr"]),
+    analyzer_warn('clang-analyzer Pointer arithmetic on non-array variables',
+                  [r".*: warning: Pointer arithmetic on non-array variables .*PointerArithm"]),
+    analyzer_warn('clang-analyzer Subtraction of pointers of different memory chunks',
+                  [r".*: warning: Subtraction of two pointers .*PointerSub"]),
+    analyzer_warn('clang-analyzer Access out-of-bound array element',
+                  [r".*: warning: Access out-of-bound array element .*ArrayBound"]),
+    analyzer_warn('clang-analyzer Out of bound memory access',
+                  [r".*: warning: Out of bound memory access .*ArrayBoundV2"]),
+    analyzer_warn('clang-analyzer Possible lock order reversal',
+                  [r".*: warning: .* Possible lock order reversal.*PthreadLock"]),
+    analyzer_warn('clang-analyzer call path problems',
+                  [r".*: warning: Call Path : .+"]),
+    analyzer_warn_check('clang-analyzer-core.CallAndMessage'),
+    analyzer_high_check('clang-analyzer-core.NonNullParamChecker'),
+    analyzer_high_check('clang-analyzer-core.NullDereference'),
+    analyzer_warn_check('clang-analyzer-core.UndefinedBinaryOperatorResult'),
+    analyzer_warn_check('clang-analyzer-core.DivideZero'),
+    analyzer_warn_check('clang-analyzer-core.VLASize'),
+    analyzer_warn_check('clang-analyzer-core.uninitialized.ArraySubscript'),
+    analyzer_warn_check('clang-analyzer-core.uninitialized.Assign'),
+    analyzer_warn_check('clang-analyzer-core.uninitialized.UndefReturn'),
+    analyzer_warn_check('clang-analyzer-cplusplus.Move'),
+    analyzer_warn_check('clang-analyzer-deadcode.DeadStores'),
+    analyzer_warn_check('clang-analyzer-optin.cplusplus.UninitializedObject'),
+    analyzer_warn_check('clang-analyzer-optin.cplusplus.VirtualCall'),
+    analyzer_warn_check('clang-analyzer-portability.UnixAPI'),
+    analyzer_warn_check('clang-analyzer-unix.cstring.NullArg'),
+    analyzer_high_check('clang-analyzer-unix.MallocSizeof'),
+    analyzer_warn_check('clang-analyzer-valist.Uninitialized'),
+    analyzer_warn_check('clang-analyzer-valist.Unterminated'),
+    analyzer_group_check('clang-analyzer-core.uninitialized'),
+    analyzer_group_check('clang-analyzer-deadcode'),
+    analyzer_warn_check('clang-analyzer-security.insecureAPI.strcpy'),
+    analyzer_group_high('clang-analyzer-security.insecureAPI'),
+    analyzer_group_high('clang-analyzer-security'),
+    analyzer_high_check('clang-analyzer-unix.Malloc'),
+    analyzer_high_check('clang-analyzer-cplusplus.NewDeleteLeaks'),
+    analyzer_high_check('clang-analyzer-cplusplus.NewDelete'),
+    analyzer_group_check('clang-analyzer-unix'),
+    analyzer_group_check('clang-analyzer'),  # catch all
+]
+
+
+compile_patterns(warn_patterns)
diff --git a/tools/warn/warn.py b/tools/warn/warn.py
new file mode 100755
index 0000000..bdfd489
--- /dev/null
+++ b/tools/warn/warn.py
@@ -0,0 +1,38 @@
+#!/usr/bin/python
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Simple wrapper to run warn_common with Python standard Pool."""
+
+import multiprocessing
+
+# pylint:disable=relative-beyond-top-level
+# pylint:disable=g-importing-member
+from .warn_common import common_main
+
+
+# This parallel_process could be changed depending on platform
+# and availability of multi-process library functions.
+def parallel_process(num_cpu, classify_warnings, groups):
+  pool = multiprocessing.Pool(num_cpu)
+  return pool.map(classify_warnings, groups)
+
+
+def main():
+  common_main(parallel_process)
+
+
+if __name__ == '__main__':
+  main()
diff --git a/tools/warn/warn_common.py b/tools/warn/warn_common.py
new file mode 100755
index 0000000..0c9d9ef
--- /dev/null
+++ b/tools/warn/warn_common.py
@@ -0,0 +1,903 @@
+# python3
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Grep warnings messages and output HTML tables or warning counts in CSV.
+
+Default is to output warnings in HTML tables grouped by warning severity.
+Use option --byproject to output tables grouped by source file projects.
+Use option --gencsv to output warning counts in CSV format.
+"""
+
+# List of important data structures and functions in this script.
+#
+# To parse and keep warning message in the input file:
+#   severity:                classification of message severity
+#   warn_patterns:
+#   warn_patterns[w]['category']     tool that issued the warning, not used now
+#   warn_patterns[w]['description']  table heading
+#   warn_patterns[w]['members']      matched warnings from input
+#   warn_patterns[w]['patterns']     regular expressions to match warnings
+#   warn_patterns[w]['projects'][p]  number of warnings of pattern w in p
+#   warn_patterns[w]['severity']     severity tuple
+#   project_list[p][0]               project name
+#   project_list[p][1]               regular expression to match a project path
+#   project_patterns[p]              re.compile(project_list[p][1])
+#   project_names[p]                 project_list[p][0]
+#   warning_messages     array of each warning message, without source url
+#   warning_records      array of [idx to warn_patterns,
+#                                  idx to project_names,
+#                                  idx to warning_messages]
+#   android_root
+#   platform_version
+#   target_product
+#   target_variant
+#   parse_input_file
+#
+# To emit html page of warning messages:
+#   flags: --byproject, --url, --separator
+# Old stuff for static html components:
+#   html_script_style:  static html scripts and styles
+#   htmlbig:
+#   dump_stats, dump_html_prologue, dump_html_epilogue:
+#   emit_buttons:
+#   dump_fixed
+#   sort_warnings:
+#   emit_stats_by_project:
+#   all_patterns,
+#   findproject, classify_warning
+#   dump_html
+#
+# New dynamic HTML page's static JavaScript data:
+#   Some data are copied from Python to JavaScript, to generate HTML elements.
+#   FlagURL                args.url
+#   FlagSeparator          args.separator
+#   SeverityColors:        list of colors for all severity levels
+#   SeverityHeaders:       list of headers for all severity levels
+#   SeverityColumnHeaders: list of column_headers for all severity levels
+#   ProjectNames:          project_names, or project_list[*][0]
+#   WarnPatternsSeverity:     warn_patterns[*]['severity']
+#   WarnPatternsDescription:  warn_patterns[*]['description']
+#   WarningMessages:          warning_messages
+#   Warnings:                 warning_records
+#   StatsHeader:           warning count table header row
+#   StatsRows:             array of warning count table rows
+#
+# New dynamic HTML page's dynamic JavaScript data:
+#
+# New dynamic HTML related function to emit data:
+#   escape_string, strip_escape_string, emit_warning_arrays
+#   emit_js_data():
+
+from __future__ import print_function
+import argparse
+import cgi
+import csv
+import io
+import multiprocessing
+import os
+import re
+import signal
+import sys
+
+# pylint:disable=relative-beyond-top-level
+from . import cpp_warn_patterns
+from . import java_warn_patterns
+from . import make_warn_patterns
+from . import other_warn_patterns
+from . import tidy_warn_patterns
+# pylint:disable=g-importing-member
+from .android_project_list import project_list
+from .severity import Severity
+
+parser = argparse.ArgumentParser(description='Convert a build log into HTML')
+parser.add_argument('--csvpath',
+                    help='Save CSV warning file to the passed absolute path',
+                    default=None)
+parser.add_argument('--gencsv',
+                    help='Generate a CSV file with number of various warnings',
+                    action='store_true',
+                    default=False)
+parser.add_argument('--byproject',
+                    help='Separate warnings in HTML output by project names',
+                    action='store_true',
+                    default=False)
+parser.add_argument('--url',
+                    help='Root URL of an Android source code tree prefixed '
+                    'before files in warnings')
+parser.add_argument('--separator',
+                    help='Separator between the end of a URL and the line '
+                    'number argument. e.g. #')
+parser.add_argument('--processes',
+                    type=int,
+                    default=multiprocessing.cpu_count(),
+                    help='Number of parallel processes to process warnings')
+parser.add_argument(dest='buildlog', metavar='build.log',
+                    help='Path to build.log file')
+args = parser.parse_args()
+
+warn_patterns = make_warn_patterns.warn_patterns
+warn_patterns.extend(cpp_warn_patterns.warn_patterns)
+warn_patterns.extend(java_warn_patterns.warn_patterns)
+warn_patterns.extend(tidy_warn_patterns.warn_patterns)
+warn_patterns.extend(other_warn_patterns.warn_patterns)
+
+project_patterns = []
+project_names = []
+warning_messages = []
+warning_records = []
+
+
+def initialize_arrays():
+  """Complete global arrays before they are used."""
+  global project_names, project_patterns
+  project_names = [p[0] for p in project_list]
+  project_patterns = [re.compile(p[1]) for p in project_list]
+  for w in warn_patterns:
+    w['members'] = []
+    # Each warning pattern has a 'projects' dictionary, that
+    # maps a project name to number of warnings in that project.
+    w['projects'] = {}
+
+
+initialize_arrays()
+
+
+android_root = ''
+platform_version = 'unknown'
+target_product = 'unknown'
+target_variant = 'unknown'
+
+
+##### Data and functions to dump html file. ##################################
+
+html_head_scripts = """\
+  <script type="text/javascript">
+  function expand(id) {
+    var e = document.getElementById(id);
+    var f = document.getElementById(id + "_mark");
+    if (e.style.display == 'block') {
+       e.style.display = 'none';
+       f.innerHTML = '&#x2295';
+    }
+    else {
+       e.style.display = 'block';
+       f.innerHTML = '&#x2296';
+    }
+  };
+  function expandCollapse(show) {
+    for (var id = 1; ; id++) {
+      var e = document.getElementById(id + "");
+      var f = document.getElementById(id + "_mark");
+      if (!e || !f) break;
+      e.style.display = (show ? 'block' : 'none');
+      f.innerHTML = (show ? '&#x2296' : '&#x2295');
+    }
+  };
+  </script>
+  <style type="text/css">
+  th,td{border-collapse:collapse; border:1px solid black;}
+  .button{color:blue;font-size:110%;font-weight:bolder;}
+  .bt{color:black;background-color:transparent;border:none;outline:none;
+      font-size:140%;font-weight:bolder;}
+  .c0{background-color:#e0e0e0;}
+  .c1{background-color:#d0d0d0;}
+  .t1{border-collapse:collapse; width:100%; border:1px solid black;}
+  </style>
+  <script src="https://www.gstatic.com/charts/loader.js"></script>
+"""
+
+
+def make_writer(output_stream):
+
+  def writer(text):
+    return output_stream.write(text + '\n')
+
+  return writer
+
+
+def html_big(param):
+  return '<font size="+2">' + param + '</font>'
+
+
+def dump_html_prologue(title, writer):
+  writer('<html>\n<head>')
+  writer('<title>' + title + '</title>')
+  writer(html_head_scripts)
+  emit_stats_by_project(writer)
+  writer('</head>\n<body>')
+  writer(html_big(title))
+  writer('<p>')
+
+
+def dump_html_epilogue(writer):
+  writer('</body>\n</head>\n</html>')
+
+
+def sort_warnings():
+  for i in warn_patterns:
+    i['members'] = sorted(set(i['members']))
+
+
+def emit_stats_by_project(writer):
+  """Dump a google chart table of warnings per project and severity."""
+  # warnings[p][s] is number of warnings in project p of severity s.
+  # pylint:disable=g-complex-comprehension
+  warnings = {p: {s.value: 0 for s in Severity.levels} for p in project_names}
+  for i in warn_patterns:
+    # pytype: disable=attribute-error
+    s = i['severity'].value
+    # pytype: enable=attribute-error
+    for p in i['projects']:
+      warnings[p][s] += i['projects'][p]
+
+  # total_by_project[p] is number of warnings in project p.
+  total_by_project = {
+      p: sum(warnings[p][s.value] for s in Severity.levels)
+      for p in project_names
+  }
+
+  # total_by_severity[s] is number of warnings of severity s.
+  total_by_severity = {
+      s.value: sum(warnings[p][s.value] for p in project_names)
+      for s in Severity.levels
+  }
+
+  # emit table header
+  stats_header = ['Project']
+  for s in Severity.levels:
+    if total_by_severity[s.value]:
+      stats_header.append(
+          '<span style=\'background-color:{}\'>{}</span>'.format(
+              s.color, s.column_header))
+  stats_header.append('TOTAL')
+
+  # emit a row of warning counts per project, skip no-warning projects
+  total_all_projects = 0
+  stats_rows = []
+  for p in project_names:
+    if total_by_project[p]:
+      one_row = [p]
+      for s in Severity.levels:
+        if total_by_severity[s.value]:
+          one_row.append(warnings[p][s.value])
+      one_row.append(total_by_project[p])
+      stats_rows.append(one_row)
+      total_all_projects += total_by_project[p]
+
+  # emit a row of warning counts per severity
+  total_all_severities = 0
+  one_row = ['<b>TOTAL</b>']
+  for s in Severity.levels:
+    if total_by_severity[s.value]:
+      one_row.append(total_by_severity[s.value])
+      total_all_severities += total_by_severity[s.value]
+  one_row.append(total_all_projects)
+  stats_rows.append(one_row)
+  writer('<script>')
+  emit_const_string_array('StatsHeader', stats_header, writer)
+  emit_const_object_array('StatsRows', stats_rows, writer)
+  writer(draw_table_javascript)
+  writer('</script>')
+
+
+def dump_stats(writer):
+  """Dump some stats about total number of warnings and such."""
+  known = 0
+  skipped = 0
+  unknown = 0
+  sort_warnings()
+  for i in warn_patterns:
+    if i['severity'] == Severity.UNMATCHED:
+      unknown += len(i['members'])
+    elif i['severity'] == Severity.SKIP:
+      skipped += len(i['members'])
+    else:
+      known += len(i['members'])
+  writer('Number of classified warnings: <b>' + str(known) + '</b><br>')
+  writer('Number of skipped warnings: <b>' + str(skipped) + '</b><br>')
+  writer('Number of unclassified warnings: <b>' + str(unknown) + '</b><br>')
+  total = unknown + known + skipped
+  extra_msg = ''
+  if total < 1000:
+    extra_msg = ' (low count may indicate incremental build)'
+  writer('Total number of warnings: <b>' + str(total) + '</b>' + extra_msg)
+
+
+# New base table of warnings, [severity, warn_id, project, warning_message]
+# Need buttons to show warnings in different grouping options.
+# (1) Current, group by severity, id for each warning pattern
+#     sort by severity, warn_id, warning_message
+# (2) Current --byproject, group by severity,
+#     id for each warning pattern + project name
+#     sort by severity, warn_id, project, warning_message
+# (3) New, group by project + severity,
+#     id for each warning pattern
+#     sort by project, severity, warn_id, warning_message
+def emit_buttons(writer):
+  writer('<button class="button" onclick="expandCollapse(1);">'
+         'Expand all warnings</button>\n'
+         '<button class="button" onclick="expandCollapse(0);">'
+         'Collapse all warnings</button>\n'
+         '<button class="button" onclick="groupBySeverity();">'
+         'Group warnings by severity</button>\n'
+         '<button class="button" onclick="groupByProject();">'
+         'Group warnings by project</button><br>')
+
+
+def all_patterns(category):
+  patterns = ''
+  for i in category['patterns']:
+    patterns += i
+    patterns += ' / '
+  return patterns
+
+
+def dump_fixed(writer):
+  """Show which warnings no longer occur."""
+  anchor = 'fixed_warnings'
+  mark = anchor + '_mark'
+  writer('\n<br><p style="background-color:lightblue"><b>'
+         '<button id="' + mark + '" '
+         'class="bt" onclick="expand(\'' + anchor + '\');">'
+         '&#x2295</button> Fixed warnings. '
+         'No more occurrences. Please consider turning these into '
+         'errors if possible, before they are reintroduced in to the build'
+         ':</b></p>')
+  writer('<blockquote>')
+  fixed_patterns = []
+  for i in warn_patterns:
+    if not i['members']:
+      fixed_patterns.append(i['description'] + ' (' + all_patterns(i) + ')')
+  fixed_patterns = sorted(fixed_patterns)
+  writer('<div id="' + anchor + '" style="display:none;"><table>')
+  cur_row_class = 0
+  for text in fixed_patterns:
+    cur_row_class = 1 - cur_row_class
+    # remove last '\n'
+    t = text[:-1] if text[-1] == '\n' else text
+    writer('<tr><td class="c' + str(cur_row_class) + '">' + t + '</td></tr>')
+  writer('</table></div>')
+  writer('</blockquote>')
+
+
+def find_project_index(line):
+  for p in range(len(project_patterns)):
+    if project_patterns[p].match(line):
+      return p
+  return -1
+
+
+def classify_one_warning(line, results):
+  """Classify one warning line."""
+  for i in range(len(warn_patterns)):
+    w = warn_patterns[i]
+    for cpat in w['compiled_patterns']:
+      # pytype: disable=attribute-error
+      if cpat.match(line):
+        p = find_project_index(line)
+        results.append([line, i, p])
+        return
+      else:
+        # If we end up here, there was a problem parsing the log
+        # probably caused by 'make -j' mixing the output from
+        # 2 or more concurrent compiles
+        pass
+      # pytype: enable=attribute-error
+
+
+def classify_warnings(lines):
+  results = []
+  for line in lines:
+    classify_one_warning(line, results)
+  # After the main work, ignore all other signals to a child process,
+  # to avoid bad warning/error messages from the exit clean-up process.
+  if args.processes > 1:
+    signal.signal(signal.SIGTERM, lambda *args: sys.exit(-signal.SIGTERM))
+  return results
+
+
+def parallel_classify_warnings(warning_lines, parallel_process):
+  """Classify all warning lines with num_cpu parallel processes."""
+  num_cpu = args.processes
+  if num_cpu > 1:
+    groups = [[] for x in range(num_cpu)]
+    i = 0
+    for x in warning_lines:
+      groups[i].append(x)
+      i = (i + 1) % num_cpu
+    group_results = parallel_process(num_cpu, classify_warnings, groups)
+  else:
+    group_results = [classify_warnings(warning_lines)]
+
+  for result in group_results:
+    for line, pattern_idx, project_idx in result:
+      pattern = warn_patterns[pattern_idx]
+      pattern['members'].append(line)
+      message_idx = len(warning_messages)
+      warning_messages.append(line)
+      warning_records.append([pattern_idx, project_idx, message_idx])
+      pname = '???' if project_idx < 0 else project_names[project_idx]
+      # Count warnings by project.
+      if pname in pattern['projects']:
+        pattern['projects'][pname] += 1
+      else:
+        pattern['projects'][pname] = 1
+
+
+def find_warn_py_and_android_root(path):
+  """Set and return android_root path if it is found."""
+  global android_root
+  parts = path.split('/')
+  for idx in reversed(range(2, len(parts))):
+    root_path = '/'.join(parts[:idx])
+    # Android root directory should contain this script.
+    if os.path.exists(root_path + '/build/make/tools/warn.py'):
+      android_root = root_path
+      return True
+  return False
+
+
+def find_android_root():
+  """Guess android_root from common prefix of file paths."""
+  # Use the longest common prefix of the absolute file paths
+  # of the first 10000 warning messages as the android_root.
+  global android_root
+  warning_lines = set()
+  warning_pattern = re.compile('^/[^ ]*/[^ ]*: warning: .*')
+  count = 0
+  infile = io.open(args.buildlog, mode='r', encoding='utf-8')
+  for line in infile:
+    if warning_pattern.match(line):
+      warning_lines.add(line)
+      count += 1
+      if count > 9999:
+        break
+      # Try to find warn.py and use its location to find
+      # the source tree root.
+      if count < 100:
+        path = os.path.normpath(re.sub(':.*$', '', line))
+        if find_warn_py_and_android_root(path):
+          return
+  # Do not use common prefix of a small number of paths.
+  if count > 10:
+    # pytype: disable=wrong-arg-types
+    root_path = os.path.commonprefix(warning_lines)
+    # pytype: enable=wrong-arg-types
+    if len(root_path) > 2 and root_path[len(root_path) - 1] == '/':
+      android_root = root_path[:-1]
+
+
+def remove_android_root_prefix(path):
+  """Remove android_root prefix from path if it is found."""
+  if path.startswith(android_root):
+    return path[1 + len(android_root):]
+  else:
+    return path
+
+
+def normalize_path(path):
+  """Normalize file path relative to android_root."""
+  # If path is not an absolute path, just normalize it.
+  path = os.path.normpath(path)
+  # Remove known prefix of root path and normalize the suffix.
+  if path[0] == '/' and android_root:
+    return remove_android_root_prefix(path)
+  return path
+
+
+def normalize_warning_line(line):
+  """Normalize file path relative to android_root in a warning line."""
+  # replace fancy quotes with plain ol' quotes
+  line = re.sub(u'[\u2018\u2019]', '\'', line)
+  # replace non-ASCII chars to spaces
+  line = re.sub(u'[^\x00-\x7f]', ' ', line)
+  line = line.strip()
+  first_column = line.find(':')
+  if first_column > 0:
+    return normalize_path(line[:first_column]) + line[first_column:]
+  else:
+    return line
+
+
+def parse_input_file(infile):
+  """Parse input file, collect parameters and warning lines."""
+  global android_root
+  global platform_version
+  global target_product
+  global target_variant
+  line_counter = 0
+
+  # rustc warning messages have two lines that should be combined:
+  #     warning: description
+  #        --> file_path:line_number:column_number
+  # Some warning messages have no file name:
+  #     warning: macro replacement list ... [bugprone-macro-parentheses]
+  # Some makefile warning messages have no line number:
+  #     some/path/file.mk: warning: description
+  # C/C++ compiler warning messages have line and column numbers:
+  #     some/path/file.c:line_number:column_number: warning: description
+  warning_pattern = re.compile('(^[^ ]*/[^ ]*: warning: .*)|(^warning: .*)')
+  warning_without_file = re.compile('^warning: .*')
+  rustc_file_position = re.compile('^[ ]+--> [^ ]*/[^ ]*:[0-9]+:[0-9]+')
+
+  # Collect all warnings into the warning_lines set.
+  warning_lines = set()
+  prev_warning = ''
+  for line in infile:
+    if prev_warning:
+      if rustc_file_position.match(line):
+        # must be a rustc warning, combine 2 lines into one warning
+        line = line.strip().replace('--> ', '') + ': ' + prev_warning
+        warning_lines.add(normalize_warning_line(line))
+        prev_warning = ''
+        continue
+      # add prev_warning, and then process the current line
+      prev_warning = 'unknown_source_file: ' + prev_warning
+      warning_lines.add(normalize_warning_line(prev_warning))
+      prev_warning = ''
+
+    if warning_pattern.match(line):
+      if warning_without_file.match(line):
+        # save this line and combine it with the next line
+        prev_warning = line
+      else:
+        warning_lines.add(normalize_warning_line(line))
+      continue
+
+    if line_counter < 100:
+      # save a little bit of time by only doing this for the first few lines
+      line_counter += 1
+      m = re.search('(?<=^PLATFORM_VERSION=).*', line)
+      if m is not None:
+        platform_version = m.group(0)
+      m = re.search('(?<=^TARGET_PRODUCT=).*', line)
+      if m is not None:
+        target_product = m.group(0)
+      m = re.search('(?<=^TARGET_BUILD_VARIANT=).*', line)
+      if m is not None:
+        target_variant = m.group(0)
+      m = re.search('.* TOP=([^ ]*) .*', line)
+      if m is not None:
+        android_root = m.group(1)
+  return warning_lines
+
+
+# Return s with escaped backslash and quotation characters.
+def escape_string(s):
+  # pytype: disable=attribute-error
+  return s.replace('\\', '\\\\').replace('"', '\\"')
+  # pytype: enable=attribute-error
+
+
+# Return s without trailing '\n' and escape the quotation characters.
+def strip_escape_string(s):
+  if not s:
+    return s
+  s = s[:-1] if s[-1] == '\n' else s
+  return escape_string(s)
+
+
+def emit_warning_array(name, writer):
+  writer('var warning_{} = ['.format(name))
+  for i in range(len(warn_patterns)):
+    writer('{},'.format(warn_patterns[i][name]))
+  writer('];')
+
+
+def emit_warning_arrays(writer):
+  emit_warning_array('severity', writer)
+  writer('var warning_description = [')
+  for i in range(len(warn_patterns)):
+    if warn_patterns[i]['members']:
+      writer('"{}",'.format(escape_string(warn_patterns[i]['description'])))
+    else:
+      writer('"",')  # no such warning
+  writer('];')
+
+
+scripts_for_warning_groups = """
+  function compareMessages(x1, x2) { // of the same warning type
+    return (WarningMessages[x1[2]] <= WarningMessages[x2[2]]) ? -1 : 1;
+  }
+  function byMessageCount(x1, x2) {
+    return x2[2] - x1[2];  // reversed order
+  }
+  function bySeverityMessageCount(x1, x2) {
+    // orer by severity first
+    if (x1[1] != x2[1])
+      return  x1[1] - x2[1];
+    return byMessageCount(x1, x2);
+  }
+  const ParseLinePattern = /^([^ :]+):(\\d+):(.+)/;
+  function addURL(line) {
+    if (FlagURL == "") return line;
+    if (FlagSeparator == "") {
+      return line.replace(ParseLinePattern,
+        "<a target='_blank' href='" + FlagURL + "/$1'>$1</a>:$2:$3");
+    }
+    return line.replace(ParseLinePattern,
+      "<a target='_blank' href='" + FlagURL + "/$1" + FlagSeparator +
+        "$2'>$1:$2</a>:$3");
+  }
+  function createArrayOfDictionaries(n) {
+    var result = [];
+    for (var i=0; i<n; i++) result.push({});
+    return result;
+  }
+  function groupWarningsBySeverity() {
+    // groups is an array of dictionaries,
+    // each dictionary maps from warning type to array of warning messages.
+    var groups = createArrayOfDictionaries(SeverityColors.length);
+    for (var i=0; i<Warnings.length; i++) {
+      var w = Warnings[i][0];
+      var s = WarnPatternsSeverity[w];
+      var k = w.toString();
+      if (!(k in groups[s]))
+        groups[s][k] = [];
+      groups[s][k].push(Warnings[i]);
+    }
+    return groups;
+  }
+  function groupWarningsByProject() {
+    var groups = createArrayOfDictionaries(ProjectNames.length);
+    for (var i=0; i<Warnings.length; i++) {
+      var w = Warnings[i][0];
+      var p = Warnings[i][1];
+      var k = w.toString();
+      if (!(k in groups[p]))
+        groups[p][k] = [];
+      groups[p][k].push(Warnings[i]);
+    }
+    return groups;
+  }
+  var GlobalAnchor = 0;
+  function createWarningSection(header, color, group) {
+    var result = "";
+    var groupKeys = [];
+    var totalMessages = 0;
+    for (var k in group) {
+       totalMessages += group[k].length;
+       groupKeys.push([k, WarnPatternsSeverity[parseInt(k)], group[k].length]);
+    }
+    groupKeys.sort(bySeverityMessageCount);
+    for (var idx=0; idx<groupKeys.length; idx++) {
+      var k = groupKeys[idx][0];
+      var messages = group[k];
+      var w = parseInt(k);
+      var wcolor = SeverityColors[WarnPatternsSeverity[w]];
+      var description = WarnPatternsDescription[w];
+      if (description.length == 0)
+          description = "???";
+      GlobalAnchor += 1;
+      result += "<table class='t1'><tr bgcolor='" + wcolor + "'><td>" +
+                "<button class='bt' id='" + GlobalAnchor + "_mark" +
+                "' onclick='expand(\\"" + GlobalAnchor + "\\");'>" +
+                "&#x2295</button> " +
+                description + " (" + messages.length + ")</td></tr></table>";
+      result += "<div id='" + GlobalAnchor +
+                "' style='display:none;'><table class='t1'>";
+      var c = 0;
+      messages.sort(compareMessages);
+      for (var i=0; i<messages.length; i++) {
+        result += "<tr><td class='c" + c + "'>" +
+                  addURL(WarningMessages[messages[i][2]]) + "</td></tr>";
+        c = 1 - c;
+      }
+      result += "</table></div>";
+    }
+    if (result.length > 0) {
+      return "<br><span style='background-color:" + color + "'><b>" +
+             header + ": " + totalMessages +
+             "</b></span><blockquote><table class='t1'>" +
+             result + "</table></blockquote>";
+
+    }
+    return "";  // empty section
+  }
+  function generateSectionsBySeverity() {
+    var result = "";
+    var groups = groupWarningsBySeverity();
+    for (s=0; s<SeverityColors.length; s++) {
+      result += createWarningSection(SeverityHeaders[s], SeverityColors[s],
+                                     groups[s]);
+    }
+    return result;
+  }
+  function generateSectionsByProject() {
+    var result = "";
+    var groups = groupWarningsByProject();
+    for (i=0; i<groups.length; i++) {
+      result += createWarningSection(ProjectNames[i], 'lightgrey', groups[i]);
+    }
+    return result;
+  }
+  function groupWarnings(generator) {
+    GlobalAnchor = 0;
+    var e = document.getElementById("warning_groups");
+    e.innerHTML = generator();
+  }
+  function groupBySeverity() {
+    groupWarnings(generateSectionsBySeverity);
+  }
+  function groupByProject() {
+    groupWarnings(generateSectionsByProject);
+  }
+"""
+
+
+# Emit a JavaScript const string
+def emit_const_string(name, value, writer):
+  writer('const ' + name + ' = "' + escape_string(value) + '";')
+
+
+# Emit a JavaScript const integer array.
+def emit_const_int_array(name, array, writer):
+  writer('const ' + name + ' = [')
+  for n in array:
+    writer(str(n) + ',')
+  writer('];')
+
+
+# Emit a JavaScript const string array.
+def emit_const_string_array(name, array, writer):
+  writer('const ' + name + ' = [')
+  for s in array:
+    writer('"' + strip_escape_string(s) + '",')
+  writer('];')
+
+
+# Emit a JavaScript const string array for HTML.
+def emit_const_html_string_array(name, array, writer):
+  writer('const ' + name + ' = [')
+  for s in array:
+    # Not using html.escape yet, to work for both python 2 and 3,
+    # until all users switch to python 3.
+    # pylint:disable=deprecated-method
+    writer('"' + cgi.escape(strip_escape_string(s)) + '",')
+  writer('];')
+
+
+# Emit a JavaScript const object array.
+def emit_const_object_array(name, array, writer):
+  writer('const ' + name + ' = [')
+  for x in array:
+    writer(str(x) + ',')
+  writer('];')
+
+
+def emit_js_data(writer):
+  """Dump dynamic HTML page's static JavaScript data."""
+  emit_const_string('FlagURL',
+                    args.url if args.url else '', writer)
+  emit_const_string('FlagSeparator',
+                    args.separator if args.separator else '', writer)
+  emit_const_string_array('SeverityColors',
+                          [s.color for s in Severity.levels], writer)
+  emit_const_string_array('SeverityHeaders',
+                          [s.header for s in Severity.levels], writer)
+  emit_const_string_array('SeverityColumnHeaders',
+                          [s.column_header for s in Severity.levels], writer)
+  emit_const_string_array('ProjectNames', project_names, writer)
+  # pytype: disable=attribute-error
+  emit_const_int_array('WarnPatternsSeverity',
+                       [w['severity'].value for w in warn_patterns], writer)
+  # pytype: enable=attribute-error
+  emit_const_html_string_array('WarnPatternsDescription',
+                               [w['description'] for w in warn_patterns],
+                               writer)
+  emit_const_html_string_array('WarningMessages', warning_messages, writer)
+  emit_const_object_array('Warnings', warning_records, writer)
+
+draw_table_javascript = """
+google.charts.load('current', {'packages':['table']});
+google.charts.setOnLoadCallback(drawTable);
+function drawTable() {
+  var data = new google.visualization.DataTable();
+  data.addColumn('string', StatsHeader[0]);
+  for (var i=1; i<StatsHeader.length; i++) {
+    data.addColumn('number', StatsHeader[i]);
+  }
+  data.addRows(StatsRows);
+  for (var i=0; i<StatsRows.length; i++) {
+    for (var j=0; j<StatsHeader.length; j++) {
+      data.setProperty(i, j, 'style', 'border:1px solid black;');
+    }
+  }
+  var table = new google.visualization.Table(
+      document.getElementById('stats_table'));
+  table.draw(data, {allowHtml: true, alternatingRowStyle: true});
+}
+"""
+
+
+def dump_html(output_stream):
+  """Dump the html output to output_stream."""
+  writer = make_writer(output_stream)
+  dump_html_prologue('Warnings for ' + platform_version + ' - ' +
+                     target_product + ' - ' + target_variant, writer)
+  dump_stats(writer)
+  writer('<br><div id="stats_table"></div><br>')
+  writer('\n<script>')
+  emit_js_data(writer)
+  writer(scripts_for_warning_groups)
+  writer('</script>')
+  emit_buttons(writer)
+  # Warning messages are grouped by severities or project names.
+  writer('<br><div id="warning_groups"></div>')
+  if args.byproject:
+    writer('<script>groupByProject();</script>')
+  else:
+    writer('<script>groupBySeverity();</script>')
+  dump_fixed(writer)
+  dump_html_epilogue(writer)
+
+
+##### Functions to count warnings and dump csv file. #########################
+
+
+def description_for_csv(category):
+  if not category['description']:
+    return '?'
+  return category['description']
+
+
+def count_severity(writer, sev, kind):
+  """Count warnings of given severity."""
+  total = 0
+  for i in warn_patterns:
+    if i['severity'] == sev and i['members']:
+      n = len(i['members'])
+      total += n
+      warning = kind + ': ' + description_for_csv(i)
+      writer.writerow([n, '', warning])
+      # print number of warnings for each project, ordered by project name.
+      # pytype: disable=attribute-error
+      projects = sorted(i['projects'].keys())
+      # pytype: enable=attribute-error
+      for p in projects:
+        writer.writerow([i['projects'][p], p, warning])
+  writer.writerow([total, '', kind + ' warnings'])
+
+  return total
+
+
+# dump number of warnings in csv format to stdout
+def dump_csv(writer):
+  """Dump number of warnings in csv format to stdout."""
+  sort_warnings()
+  total = 0
+  for s in Severity.levels:
+    if s != Severity.SEVERITY_UNKNOWN:
+      total += count_severity(writer, s, s.column_header)
+  writer.writerow([total, '', 'All warnings'])
+
+
+def common_main(parallel_process):
+  """Real main function to classify warnings and generate .html file."""
+  find_android_root()
+  # We must use 'utf-8' codec to parse some non-ASCII code in warnings.
+  warning_lines = parse_input_file(
+      io.open(args.buildlog, mode='r', encoding='utf-8'))
+  parallel_classify_warnings(warning_lines, parallel_process)
+  # If a user pases a csv path, save the fileoutput to the path
+  # If the user also passed gencsv write the output to stdout
+  # If the user did not pass gencsv flag dump the html report to stdout.
+  if args.csvpath:
+    with open(args.csvpath, 'w') as f:
+      dump_csv(csv.writer(f, lineterminator='\n'))
+  if args.gencsv:
+    dump_csv(csv.writer(sys.stdout, lineterminator='\n'))
+  else:
+    dump_html(sys.stdout)