Merge "Stubs of android-support-multidex-instrumentation."
diff --git a/core/Makefile b/core/Makefile
index bd67c89..0afb30f 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1173,6 +1173,7 @@
 		$(INSTALLED_CACHEIMAGE_TARGET) \
 		$(INSTALLED_VENDORIMAGE_TARGET) \
 		$(INSTALLED_ANDROID_INFO_TXT_TARGET) \
+		$(SELINUX_FC) \
 		$(built_ota_tools) \
 		$(APKCERTS_FILE) \
 		$(HOST_OUT_EXECUTABLES)/fs_config \
@@ -1260,13 +1261,14 @@
 	$(hide) echo "extra_recovery_keys=$(PRODUCT_EXTRA_RECOVERY_KEYS)" >> $(zip_root)/META/misc_info.txt
 endif
 	$(hide) echo "mkbootimg_args=$(BOARD_MKBOOTIMG_ARGS)" >> $(zip_root)/META/misc_info.txt
+	$(hide) echo "use_set_metadata=1" >> $(zip_root)/META/misc_info.txt
 	$(call generate-userimage-prop-dictionary, $(zip_root)/META/misc_info.txt)
 	@# Zip everything up, preserving symlinks
 	$(hide) (cd $(zip_root) && zip -qry ../$(notdir $@) .)
 	@# Run fs_config on all the system, boot ramdisk, and recovery ramdisk files in the zip, and save the output
-	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="SYSTEM/" } /^SYSTEM\// {print "system/" $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config > $(zip_root)/META/filesystem_config.txt
-	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="BOOT/RAMDISK/" } /^BOOT\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config > $(zip_root)/META/boot_filesystem_config.txt
-	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="RECOVERY/RAMDISK/" } /^RECOVERY\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config > $(zip_root)/META/recovery_filesystem_config.txt
+	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="SYSTEM/" } /^SYSTEM\// {print "system/" $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -S $(SELINUX_FC) > $(zip_root)/META/filesystem_config.txt
+	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="BOOT/RAMDISK/" } /^BOOT\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -S $(SELINUX_FC) > $(zip_root)/META/boot_filesystem_config.txt
+	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="RECOVERY/RAMDISK/" } /^RECOVERY\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -S $(SELINUX_FC) > $(zip_root)/META/recovery_filesystem_config.txt
 	$(hide) (cd $(zip_root) && zip -q ../$(notdir $@) META/*filesystem_config.txt)
 
 .PHONY: target-files-package
diff --git a/core/binary.mk b/core/binary.mk
index 481edc0..8685060 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -127,7 +127,7 @@
 ####################################################
 ## Add FDO flags if FDO is turned on and supported
 ####################################################
-ifeq ($(strip $(LOCAL_NO_FDO_SUPPORT)),)
+ifneq ($(strip $(LOCAL_FDO_SUPPORT)),)
   ifeq ($(strip $(LOCAL_IS_HOST_MODULE)),)
     LOCAL_CFLAGS += $(TARGET_FDO_CFLAGS)
     LOCAL_CPPFLAGS += $(TARGET_FDO_CFLAGS)
@@ -179,6 +179,20 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_NO_DEFAULT_COMPILER_FLAGS := \
     $(strip $(LOCAL_NO_DEFAULT_COMPILER_FLAGS))
 
+ifeq ($(strip $(WITH_SYNTAX_CHECK)),)
+  LOCAL_NO_SYNTAX_CHECK := true
+endif
+
+ifeq ($(strip $(WITH_STATIC_ANALYZER)),)
+  LOCAL_NO_STATIC_ANALYZER := true
+endif
+
+ifneq ($(strip $(LOCAL_IS_HOST_MODULE)),)
+  my_syntax_arch := host
+else
+  my_syntax_arch := $(TARGET_ARCH)
+endif
+
 ifeq ($(strip $(LOCAL_CC)),)
   ifeq ($(strip $(LOCAL_CLANG)),true)
     LOCAL_CC := $(CLANG)
@@ -186,6 +200,13 @@
     LOCAL_CC := $($(my_prefix)CC)
   endif
 endif
+ifneq ($(LOCAL_NO_STATIC_ANALYZER),true)
+  LOCAL_CC := $(SYNTAX_TOOLS_PREFIX)/ccc-analyzer $(my_syntax_arch) "$(LOCAL_CC)"
+else
+ifneq ($(LOCAL_NO_SYNTAX_CHECK),true)
+  LOCAL_CC := $(SYNTAX_TOOLS_PREFIX)/ccc-syntax $(my_syntax_arch) "$(LOCAL_CC)"
+endif
+endif
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_CC := $(LOCAL_CC)
 
 ifeq ($(strip $(LOCAL_CXX)),)
@@ -195,6 +216,13 @@
     LOCAL_CXX := $($(my_prefix)CXX)
   endif
 endif
+ifneq ($(LOCAL_NO_STATIC_ANALYZER),true)
+  LOCAL_CXX := $(SYNTAX_TOOLS_PREFIX)/cxx-analyzer $(my_syntax_arch) "$(LOCAL_CXX)"
+else
+ifneq ($(LOCAL_NO_SYNTAX_CHECK),true)
+  LOCAL_CXX := $(SYNTAX_TOOLS_PREFIX)/cxx-syntax $(my_syntax_arch) "$(LOCAL_CXX)"
+endif
+endif
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_CXX := $(LOCAL_CXX)
 
 # TODO: support a mix of standard extensions so that this isn't necessary
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 4333c96..12344f3 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -36,7 +36,7 @@
 LOCAL_CXX:=
 LOCAL_CPP_EXTENSION:=
 LOCAL_NO_DEFAULT_COMPILER_FLAGS:=
-LOCAL_NO_FDO_SUPPORT :=
+LOCAL_FDO_SUPPORT:=
 LOCAL_ARM_MODE:=
 LOCAL_YACCFLAGS:=
 LOCAL_ASFLAGS:=
@@ -141,6 +141,8 @@
 LOCAL_DIST_BUNDLED_BINARIES:=
 LOCAL_HAL_STATIC_LIBRARIES:=
 LOCAL_RMTYPEDEFS:=
+LOCAL_NO_SYNTAX_CHECK:=
+LOCAL_NO_STATIC_ANALYZER:=
 
 # Trim MAKEFILE_LIST so that $(call my-dir) doesn't need to
 # iterate over thousands of entries every time.
diff --git a/core/combo/include/arch/darwin-x86/AndroidConfig.h b/core/combo/include/arch/darwin-x86/AndroidConfig.h
index 012f014..121bba3 100644
--- a/core/combo/include/arch/darwin-x86/AndroidConfig.h
+++ b/core/combo/include/arch/darwin-x86/AndroidConfig.h
@@ -56,13 +56,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-/* #define HAVE_OOM_ADJ */
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/freebsd-x86/AndroidConfig.h b/core/combo/include/arch/freebsd-x86/AndroidConfig.h
index 6f50918..120f484 100644
--- a/core/combo/include/arch/freebsd-x86/AndroidConfig.h
+++ b/core/combo/include/arch/freebsd-x86/AndroidConfig.h
@@ -61,13 +61,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-/* #define HAVE_OOM_ADJ */
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/linux-arm/AndroidConfig.h b/core/combo/include/arch/linux-arm/AndroidConfig.h
index 9257d3e..28d0d30 100644
--- a/core/combo/include/arch/linux-arm/AndroidConfig.h
+++ b/core/combo/include/arch/linux-arm/AndroidConfig.h
@@ -69,13 +69,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-#define HAVE_OOM_ADJ
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/linux-mips/AndroidConfig.h b/core/combo/include/arch/linux-mips/AndroidConfig.h
index e24f3ea..8bfbe9f 100644
--- a/core/combo/include/arch/linux-mips/AndroidConfig.h
+++ b/core/combo/include/arch/linux-mips/AndroidConfig.h
@@ -69,13 +69,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-#define HAVE_OOM_ADJ
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/linux-ppc/AndroidConfig.h b/core/combo/include/arch/linux-ppc/AndroidConfig.h
index a12ef47..24b0da5 100644
--- a/core/combo/include/arch/linux-ppc/AndroidConfig.h
+++ b/core/combo/include/arch/linux-ppc/AndroidConfig.h
@@ -56,13 +56,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-#define HAVE_OOM_ADJ
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/linux-x86/AndroidConfig.h b/core/combo/include/arch/linux-x86/AndroidConfig.h
index 2db66a2..359cfb9 100644
--- a/core/combo/include/arch/linux-x86/AndroidConfig.h
+++ b/core/combo/include/arch/linux-x86/AndroidConfig.h
@@ -56,13 +56,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-#define HAVE_OOM_ADJ
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/target_linux-x86/AndroidConfig.h b/core/combo/include/arch/target_linux-x86/AndroidConfig.h
index aaaf0c9..8db5057 100644
--- a/core/combo/include/arch/target_linux-x86/AndroidConfig.h
+++ b/core/combo/include/arch/target_linux-x86/AndroidConfig.h
@@ -55,13 +55,6 @@
 #define HAVE_FORKEXEC
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-#define HAVE_OOM_ADJ
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/combo/include/arch/windows/AndroidConfig.h b/core/combo/include/arch/windows/AndroidConfig.h
index 83d0a0f..ea830ba 100644
--- a/core/combo/include/arch/windows/AndroidConfig.h
+++ b/core/combo/include/arch/windows/AndroidConfig.h
@@ -65,13 +65,6 @@
 #endif
 
 /*
- * Process out-of-memory adjustment.  Set if running on Linux,
- * where we can write to /proc/<pid>/oom_adj to modify the out-of-memory
- * badness adjustment.
- */
-/* #define HAVE_OOM_ADJ */
-
-/*
  * IPC model.  Choose one:
  *
  * HAVE_SYSV_IPC - use the classic SysV IPC mechanisms (semget, shmget).
diff --git a/core/config.mk b/core/config.mk
index 024e7f5..6bd2841 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -267,6 +267,37 @@
 TARGET_TOOLCHAIN_ROOT := $(wildcard $(TARGET_TOOLCHAIN_ROOT))
 endif
 
+# Normalize WITH_STATIC_ANALYZER and WITH_SYNTAX_CHECK
+ifeq ($(strip $(WITH_STATIC_ANALYZER)),0)
+  WITH_STATIC_ANALYZER :=
+endif
+ifeq ($(strip $(WITH_SYNTAX_CHECK)),0)
+  WITH_SYNTAX_CHECK :=
+endif
+
+# Disable WITH_STATIC_ANALYZER and WITH_SYNTAX_CHECK if tool can't be found
+SYNTAX_TOOLS_PREFIX := prebuilts/clang/$(HOST_PREBUILT_TAG)/host/3.3/bin
+ifneq ($(strip $(WITH_STATIC_ANALYZER)),)
+  ifeq ($(wildcard $(SYNTAX_TOOLS_PREFIX)/ccc-analyzer),)
+    $(warning *** Disable WITH_STATIC_ANALYZER because $(SYNTAX_TOOLS_PREFIX)/ccc-analyzer does not exist)
+    WITH_STATIC_ANALYZER :=
+  endif
+endif
+ifneq ($(strip $(WITH_SYNTAX_CHECK)),)
+  ifeq ($(wildcard $(SYNTAX_TOOLS_PREFIX)/ccc-syntax),)
+    $(warning *** Disable WITH_SYNTAX_CHECK because $(SYNTAX_TOOLS_PREFIX)/ccc-syntax does not exist)
+    WITH_SYNTAX_CHECK :=
+  endif
+endif
+
+# WITH_STATIC_ANALYZER trumps WITH_SYNTAX_CHECK
+ifneq ($(strip $(WITH_STATIC_ANALYZER)),)
+  ifneq ($(strip $(WITH_SYNTAX_CHECK)),)
+    $(warning *** Disable WITH_SYNTAX_CHECK in the presence of static analyzer WITH_STATIC_ANALYZER)
+    WITH_SYNTAX_CHECK :=
+  endif
+endif
+
 # Pick a Java compiler.
 include $(BUILD_SYSTEM)/combo/javac.mk
 
diff --git a/core/main.mk b/core/main.mk
index ba67189..d424b25 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -417,8 +417,6 @@
 endif
 
 # Bring in all modules that need to be built.
-ifneq ($(dont_bother),true)
-
 ifeq ($(HOST_OS)-$(HOST_ARCH),darwin-ppc)
 SDK_ONLY := true
 $(info Building the SDK under darwin-ppc is actually obsolete and unsupported.)
@@ -479,6 +477,7 @@
 
 else # ONE_SHOT_MAKEFILE
 
+ifneq ($(dont_bother),true)
 #
 # Include all of the makefiles in the system
 #
@@ -490,6 +489,8 @@
 
 $(foreach mk, $(subdir_makefiles), $(info including $(mk) ...)$(eval include $(mk)))
 
+endif # dont_bother
+
 endif # ONE_SHOT_MAKEFILE
 
 # Now with all Android.mks loaded we can do post cleaning steps.
@@ -519,16 +520,6 @@
 # All module makefiles have been included at this point.
 # -------------------------------------------------------------------
 
-# -------------------------------------------------------------------
-# Include any makefiles that must happen after the module makefiles
-# have been included.
-# TODO: have these files register themselves via a global var rather
-# than hard-coding the list here.
-ifdef FULL_BUILD
-  # Only include this during a full build, otherwise we can't be
-  # guaranteed that any policies were included.
-  -include frameworks/policies/base/PolicyConfig.mk
-endif
 
 # -------------------------------------------------------------------
 # Fix up CUSTOM_MODULES to refer to installed files rather than
@@ -682,8 +673,6 @@
       $(warning $(ALL_MODULES.$(m).MAKEFILE): Module '$(m)' in PRODUCT_PACKAGES_TESTS has nothing to install!)))
 endif
 
-endif # dont_bother
-
 # build/core/Makefile contains extra stuff that we don't want to pollute this
 # top-level makefile with.  It expects that ALL_DEFAULT_INSTALLED_MODULES
 # contains everything that's built during the current make, but it also further
diff --git a/core/tasks/cts.mk b/core/tasks/cts.mk
index 6468bdb..20f267f 100644
--- a/core/tasks/cts.mk
+++ b/core/tasks/cts.mk
@@ -31,6 +31,7 @@
 CTS_CORE_CASE_LIST := \
 	android.core.tests.libcore.package.dalvik \
 	android.core.tests.libcore.package.com \
+	android.core.tests.libcore.package.conscrypt \
 	android.core.tests.libcore.package.sun \
 	android.core.tests.libcore.package.tests \
 	android.core.tests.libcore.package.org \
@@ -89,12 +90,14 @@
 JUNIT_INTERMEDIATES :=$(call intermediates-dir-for,JAVA_LIBRARIES,core-junit,,COMMON)
 CORETESTS_INTERMEDIATES :=$(call intermediates-dir-for,JAVA_LIBRARIES,core-tests,,COMMON)
 JSR166TESTS_INTERMEDIATES :=$(call intermediates-dir-for,JAVA_LIBRARIES,jsr166-tests,,COMMON)
+CONSCRYPTTESTS_INTERMEDIATES :=$(call intermediates-dir-for,JAVA_LIBRARIES,conscrypt-tests,,COMMON)
 
-GEN_CLASSPATH := $(CORE_INTERMEDIATES)/classes.jar:$(CONSCRYPT_INTERMEDIATES)/classes.jar:$(BOUNCYCASTLE_INTERMEDIATES)/classes.jar:$(APACHEXML_INTERMEDIATES)/classes.jar:$(OKHTTP_INTERMEDIATES)/classes.jar:$(JUNIT_INTERMEDIATES)/classes.jar:$(SQLITEJDBC_INTERMEDIATES)/javalib.jar:$(CORETESTS_INTERMEDIATES)/javalib.jar:$(JSR166TESTS_INTERMEDIATES)/javalib.jar
+GEN_CLASSPATH := $(CORE_INTERMEDIATES)/classes.jar:$(CONSCRYPT_INTERMEDIATES)/classes.jar:$(BOUNCYCASTLE_INTERMEDIATES)/classes.jar:$(APACHEXML_INTERMEDIATES)/classes.jar:$(OKHTTP_INTERMEDIATES)/classes.jar:$(JUNIT_INTERMEDIATES)/classes.jar:$(SQLITEJDBC_INTERMEDIATES)/javalib.jar:$(CORETESTS_INTERMEDIATES)/javalib.jar:$(JSR166TESTS_INTERMEDIATES)/javalib.jar:$(CONSCRYPTTESTS_INTERMEDIATES)/javalib.jar
 
 CTS_CORE_XMLS := \
 	$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.dalvik.xml \
 	$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.com.xml \
+	$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.conscrypt.xml \
 	$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.sun.xml \
 	$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.tests.xml \
 	$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.org.xml \
@@ -108,7 +111,7 @@
 # build system requires that dependencies use javalib.jar.  If
 # javalib.jar is up-to-date, then classes.jar is as well.  Depending
 # on classes.jar will build the files incorrectly.
-CTS_CORE_XMLS_DEPS := $(CTS_CORE_CASES) $(HOST_OUT_JAVA_LIBRARIES)/descGen.jar $(CORE_INTERMEDIATES)/javalib.jar $(BOUNCYCASTLE_INTERMEDIATES)/javalib.jar $(APACHEXML_INTERMEDIATES)/javalib.jar $(OKHTTP_INTERMEDIATES)/javalib.jar $(SQLITEJDBC_INTERMEDIATES)/javalib.jar $(JUNIT_INTERMEDIATES)/javalib.jar $(CORETESTS_INTERMEDIATES)/javalib.jar $(JSR166TESTS_INTERMEDIATES)/javalib.jar | $(ACP)
+CTS_CORE_XMLS_DEPS := $(CTS_CORE_CASES) $(HOST_OUT_JAVA_LIBRARIES)/descGen.jar $(CORE_INTERMEDIATES)/javalib.jar $(BOUNCYCASTLE_INTERMEDIATES)/javalib.jar $(APACHEXML_INTERMEDIATES)/javalib.jar $(OKHTTP_INTERMEDIATES)/javalib.jar $(SQLITEJDBC_INTERMEDIATES)/javalib.jar $(JUNIT_INTERMEDIATES)/javalib.jar $(CORETESTS_INTERMEDIATES)/javalib.jar $(JSR166TESTS_INTERMEDIATES)/javalib.jar $(CONSCRYPTTESTS_INTERMEDIATES)/javalib.jar | $(ACP)
 
 $(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.dalvik.xml: $(CTS_CORE_XMLS_DEPS)
 	$(hide) mkdir -p $(CTS_TESTCASES_OUT)
@@ -124,6 +127,13 @@
 		$(CORETESTS_INTERMEDIATES)/javalib.jar,com,\
 		libcore/expectations)
 
+$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.conscrypt.xml: $(CTS_CORE_XMLS_DEPS)
+	$(hide) mkdir -p $(CTS_TESTCASES_OUT)
+	$(call generate-core-test-description,$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.conscrypt,\
+		cts/tests/core/libcore/conscrypt/AndroidManifest.xml,\
+		$(CONSCRYPTTESTS_INTERMEDIATES)/javalib.jar,,\
+		libcore/expectations)
+
 $(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.sun.xml: $(CTS_CORE_XMLS_DEPS)
 	$(hide) mkdir -p $(CTS_TESTCASES_OUT)
 	$(call generate-core-test-description,$(CTS_TESTCASES_OUT)/android.core.tests.libcore.package.sun,\
diff --git a/envsetup.sh b/envsetup.sh
index bd66aed..b039bbc 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -603,11 +603,26 @@
     fi
 }
 
+# Return driver for "make", if any (eg. static analyzer)
+function getdriver()
+{
+    local T="$1"
+    test "$WITH_STATIC_ANALYZER" = "0" && unset WITH_STATIC_ANALYZER
+    if [ -n "$WITH_STATIC_ANALYZER" ]; then
+        echo "\
+$T/prebuilts/clang/linux-x86/host/3.3/tools/scan-build/scan-build \
+--use-analyzer $T/prebuilts/clang/linux-x86/host/3.3/bin/clang \
+--status-bugs \
+--top=$T"
+    fi
+}
+
 function m()
 {
-    T=$(gettop)
+    local T=$(gettop)
+    local DRV=$(getdriver $T)
     if [ "$T" ]; then
-        make -C $T -f build/core/main.mk $@
+        $DRV make -C $T -f build/core/main.mk $@
     else
         echo "Couldn't locate the top of the tree.  Try setting TOP."
     fi
@@ -632,13 +647,14 @@
 
 function mm()
 {
+    local T=$(gettop)
+    local DRV=$(getdriver $T)
     # If we're sitting in the root of the build tree, just do a
     # normal make.
     if [ -f build/core/envsetup.mk -a -f Makefile ]; then
-        make $@
+        $DRV make $@
     else
         # Find the closest Android.mk file.
-        T=$(gettop)
         local M=$(findmakefile)
         local MODULES=
         local GET_INSTALL_PATH=
@@ -662,14 +678,15 @@
               MODULES=all_modules
               ARGS=$@
             fi
-            ONE_SHOT_MAKEFILE=$M make -C $T -f build/core/main.mk $MODULES $ARGS
+            ONE_SHOT_MAKEFILE=$M $DRV make -C $T -f build/core/main.mk $MODULES $ARGS
         fi
     fi
 }
 
 function mmm()
 {
-    T=$(gettop)
+    local T=$(gettop)
+    local DRV=$(getdriver $T)
     if [ "$T" ]; then
         local MAKEFILE=
         local MODULES=
@@ -707,7 +724,7 @@
           ARGS=$GET_INSTALL_PATH
           MODULES=
         fi
-        ONE_SHOT_MAKEFILE="$MAKEFILE" make -C $T -f build/core/main.mk $DASH_ARGS $MODULES $ARGS
+        ONE_SHOT_MAKEFILE="$MAKEFILE" $DRV make -C $T -f build/core/main.mk $DASH_ARGS $MODULES $ARGS
     else
         echo "Couldn't locate the top of the tree.  Try setting TOP."
     fi
@@ -715,21 +732,23 @@
 
 function mma()
 {
+  local T=$(gettop)
+  local DRV=$(getdriver $T)
   if [ -f build/core/envsetup.mk -a -f Makefile ]; then
-    make $@
+    $DRV make $@
   else
-    T=$(gettop)
     if [ ! "$T" ]; then
       echo "Couldn't locate the top of the tree.  Try setting TOP."
     fi
     local MY_PWD=`PWD= /bin/pwd|sed 's:'$T'/::'`
-    make -C $T -f build/core/main.mk $@ all_modules BUILD_MODULES_IN_PATHS="$MY_PWD"
+    $DRV make -C $T -f build/core/main.mk $@ all_modules BUILD_MODULES_IN_PATHS="$MY_PWD"
   fi
 }
 
 function mmma()
 {
-  T=$(gettop)
+  local T=$(gettop)
+  local DRV=$(getdriver $T)
   if [ "$T" ]; then
     local DASH_ARGS=$(echo "$@" | awk -v RS=" " -v ORS=" " '/^-.*$/')
     local DIRS=$(echo "$@" | awk -v RS=" " -v ORS=" " '/^[^-].*$/')
@@ -756,7 +775,7 @@
         esac
       fi
     done
-    make -C $T -f build/core/main.mk $DASH_ARGS $ARGS all_modules BUILD_MODULES_IN_PATHS="$MODULE_PATHS"
+    $DRV make -C $T -f build/core/main.mk $DASH_ARGS $ARGS all_modules BUILD_MODULES_IN_PATHS="$MODULE_PATHS"
   else
     echo "Couldn't locate the top of the tree.  Try setting TOP."
   fi
diff --git a/target/product/base.mk b/target/product/base.mk
index 8850b21..2cd39be 100644
--- a/target/product/base.mk
+++ b/target/product/base.mk
@@ -45,6 +45,7 @@
     libcameraservice \
     libchromium_net \
     libdl \
+    libeffectproxy \
     libeffects \
     libinput \
     libinputflinger \
diff --git a/target/product/generic_no_telephony.mk b/target/product/generic_no_telephony.mk
index 074a0a6..d737e70 100644
--- a/target/product/generic_no_telephony.mk
+++ b/target/product/generic_no_telephony.mk
@@ -86,6 +86,7 @@
 $(call inherit-product-if-exists, frameworks/base/data/fonts/fonts.mk)
 $(call inherit-product-if-exists, external/noto-fonts/fonts.mk)
 $(call inherit-product-if-exists, external/naver-fonts/fonts.mk)
+$(call inherit-product-if-exists, external/sil-fonts/fonts.mk)
 $(call inherit-product-if-exists, frameworks/base/data/keyboards/keyboards.mk)
 $(call inherit-product-if-exists, frameworks/webview/chromium/chromium.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core.mk)
diff --git a/target/product/telephony.mk b/target/product/telephony.mk
index 453f156..da1497d 100644
--- a/target/product/telephony.mk
+++ b/target/product/telephony.mk
@@ -18,7 +18,6 @@
 # to products that have telephony hardware.
 
 PRODUCT_PACKAGES := \
-    InCallUI \
     Dialer \
     Mms \
     rild
diff --git a/tools/droiddoc/templates-sdk/assets/css/default.css b/tools/droiddoc/templates-sdk/assets/css/default.css
index 4c01c2e..0120144 100644
--- a/tools/droiddoc/templates-sdk/assets/css/default.css
+++ b/tools/droiddoc/templates-sdk/assets/css/default.css
@@ -2587,6 +2587,12 @@
 background: #efefef;
 }
 
+.samples-nav li a {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 /* --------------------------------------------------------------------------
 Styles for raw formatted line numbers (not used with listformatted version)
 div.sampleLine div.lineNumber {
diff --git a/tools/droiddoc/templates-sdk/docpage.cs b/tools/droiddoc/templates-sdk/docpage.cs
index 566e2da..6faac04 100644
--- a/tools/droiddoc/templates-sdk/docpage.cs
+++ b/tools/droiddoc/templates-sdk/docpage.cs
@@ -130,7 +130,7 @@
         </div>
         <?cs if:!fullscreen ?>
         <div class="paging-links layout-content-col col-4">
-          <?cs if:(design||training||guide||walkthru) && !page.landing && !page.trainingcourse && !footer.hide ?>
+          <?cs if:(design||training||walkthru) && !page.landing && !page.trainingcourse && !footer.hide ?>
             <a href="#" class="prev-page-link hide"
                 zh-tw-lang="上一堂課"
                 zh-cn-lang="上一课"
diff --git a/tools/droiddoc/templates-sdk/head_tag.cs b/tools/droiddoc/templates-sdk/head_tag.cs
index 6a1ce06..37f1b37 100644
--- a/tools/droiddoc/templates-sdk/head_tag.cs
+++ b/tools/droiddoc/templates-sdk/head_tag.cs
@@ -13,7 +13,8 @@
   /if
 ?><?cs # END if/else devsite ?>
 
-<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<meta name="viewport" content="width=device-width" />
 <?cs if:page.metaDescription ?>
 <meta name="Description" content="<?cs var:page.metaDescription ?>">
 <?cs /if ?>
diff --git a/tools/droiddoc/templates-sdk/sample.cs b/tools/droiddoc/templates-sdk/sample.cs
index e0a79e9..a8eaf8c 100644
--- a/tools/droiddoc/templates-sdk/sample.cs
+++ b/tools/droiddoc/templates-sdk/sample.cs
@@ -26,7 +26,16 @@
 </div> <!-- end api-info-block -->
 
 <div id="jd-header" style="border:0;">
-  <?cs var:relative ?>
+
+<div id="pathCrumb">
+<?cs each:item = parentdirs ?>
+  <?cs if:pathCrumbLinks
+    ?><a href="<?cs var:toroot ?><?cs var:item.Link ?>"><?cs var:item.Name ?></a> / 
+  <?cs else
+    ?><?cs var:item.Name ?> / <?cs /if ?>
+<?cs /each ?>
+</div>
+
   <h1 itemprop="name"><?cs var:page.title ?></h1>
 </div>
 <!-- end breadcrumb block -->
diff --git a/tools/fs_config/Android.mk b/tools/fs_config/Android.mk
index 5ef32dd..02deabb 100644
--- a/tools/fs_config/Android.mk
+++ b/tools/fs_config/Android.mk
@@ -17,6 +17,7 @@
 
 LOCAL_SRC_FILES := fs_config.c
 LOCAL_MODULE := fs_config
+LOCAL_STATIC_LIBRARIES := libselinux
 LOCAL_FORCE_STATIC_EXECUTABLE := true
 
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/tools/fs_config/fs_config.c b/tools/fs_config/fs_config.c
index f6760cc..f594c1e 100644
--- a/tools/fs_config/fs_config.c
+++ b/tools/fs_config/fs_config.c
@@ -15,10 +15,16 @@
  */
 
 #include <stdio.h>
+#include <stdlib.h>
 #include <sys/stat.h>
 #include <errno.h>
 #include <unistd.h>
 #include <string.h>
+#include <inttypes.h>
+
+#include <selinux/selinux.h>
+#include <selinux/label.h>
+#include <selinux/android.h>
 
 #include "private/android_filesystem_config.h"
 
@@ -27,21 +33,67 @@
 // filename along with its desired uid, gid, and mode (in octal).
 // The leading slash should be stripped from the input.
 //
+// After the first 4 columns, optional key=value pairs are emitted
+// for each file.  Currently, the following keys are supported:
+// * -S: selabel=[selinux_label]
+// * -C: capabilities=[hex capabilities value]
+//
 // Example input:
 //
-//    system/etc/dbus.conf
-//    data/app/
+//      system/etc/dbus.conf
+//      data/app/
 //
 // Output:
 //
-//    system/etc/dbus.conf 1002 1002 440
-//    data/app 1000 1000 771
+//      system/etc/dbus.conf 1002 1002 440
+//      data/app 1000 1000 771
+//
+//   or if, for example, -S is used:
+//
+//      system/etc/dbus.conf 1002 1002 440 selabel=u:object_r:system_file:s0
+//      data/app 1000 1000 771 selabel=u:object_r:apk_data_file:s0
 //
 // Note that the output will omit the trailing slash from
 // directories.
 
+static struct selabel_handle* get_sehnd(const char* context_file) {
+  struct selinux_opt seopts[] = { { SELABEL_OPT_PATH, context_file } };
+  struct selabel_handle* sehnd = selabel_open(SELABEL_CTX_FILE, seopts, 1);
+
+  if (!sehnd) {
+    perror("error running selabel_open");
+    exit(EXIT_FAILURE);
+  }
+  return sehnd;
+}
+
+static void usage() {
+  fprintf(stderr, "Usage: fs_config [-S context_file] [-C]\n");
+}
+
 int main(int argc, char** argv) {
   char buffer[1024];
+  const char* context_file = NULL;
+  struct selabel_handle* sehnd = NULL;
+  int print_capabilities = 0;
+  int opt;
+  while((opt = getopt(argc, argv, "CS:")) != -1) {
+    switch(opt) {
+    case 'C':
+      print_capabilities = 1;
+      break;
+    case 'S':
+      context_file = optarg;
+      break;
+    default:
+      usage();
+      exit(EXIT_FAILURE);
+    }
+  }
+
+  if (context_file != NULL) {
+    sehnd = get_sehnd(context_file);
+  }
 
   while (fgets(buffer, 1023, stdin) != NULL) {
     int is_dir = 0;
@@ -64,7 +116,40 @@
     unsigned uid = 0, gid = 0, mode = 0;
     uint64_t capabilities;
     fs_config(buffer, is_dir, &uid, &gid, &mode, &capabilities);
-    printf("%s %d %d %o\n", buffer, uid, gid, mode);
+    printf("%s %d %d %o", buffer, uid, gid, mode);
+
+    if (sehnd != NULL) {
+      size_t buffer_strlen = strnlen(buffer, sizeof(buffer));
+      if (buffer_strlen >= sizeof(buffer)) {
+        fprintf(stderr, "non null terminated buffer, aborting\n");
+        exit(EXIT_FAILURE);
+      }
+      size_t full_name_size = buffer_strlen + 2;
+      char* full_name = (char*) malloc(full_name_size);
+      if (full_name == NULL) {
+        perror("malloc");
+        exit(EXIT_FAILURE);
+      }
+
+      full_name[0] = '/';
+      strncpy(full_name + 1, buffer, full_name_size - 1);
+      full_name[full_name_size - 1] = '\0';
+
+      char* secontext;
+      if (selabel_lookup(sehnd, &secontext, full_name, ( mode | (is_dir ? S_IFDIR : S_IFREG)))) {
+        secontext = strdup("u:object_r:unlabeled:s0");
+      }
+
+      printf(" selabel=%s", secontext);
+      free(full_name);
+      freecon(secontext);
+    }
+
+    if (print_capabilities) {
+      printf(" capabilities=0x%" PRIx64, capabilities);
+    }
+
+    printf("\n");
   }
   return 0;
 }
diff --git a/tools/releasetools/edify_generator.py b/tools/releasetools/edify_generator.py
index 9ef1926..2c3b9e7 100644
--- a/tools/releasetools/edify_generator.py
+++ b/tools/releasetools/edify_generator.py
@@ -217,14 +217,33 @@
       else:
         raise ValueError("don't know how to write \"%s\" partitions" % (p.fs_type,))
 
-  def SetPermissions(self, fn, uid, gid, mode):
+  def SetPermissions(self, fn, uid, gid, mode, selabel, capabilities):
     """Set file ownership and permissions."""
-    self.script.append('set_perm(%d, %d, 0%o, "%s");' % (uid, gid, mode, fn))
+    if not self.info.get("use_set_metadata", False):
+      self.script.append('set_perm(%d, %d, 0%o, "%s");' % (uid, gid, mode, fn))
+    else:
+      if capabilities is None: capabilities = "0x0"
+      cmd = 'set_metadata("%s", "uid", %d, "gid", %d, "mode", 0%o, ' \
+          '"capabilities", %s' % (fn, uid, gid, mode, capabilities)
+      if selabel is not None:
+        cmd += ', "selabel", "%s"' % ( selabel )
+      cmd += ');'
+      self.script.append(cmd)
 
-  def SetPermissionsRecursive(self, fn, uid, gid, dmode, fmode):
+  def SetPermissionsRecursive(self, fn, uid, gid, dmode, fmode, selabel, capabilities):
     """Recursively set path ownership and permissions."""
-    self.script.append('set_perm_recursive(%d, %d, 0%o, 0%o, "%s");'
-                       % (uid, gid, dmode, fmode, fn))
+    if not self.info.get("use_set_metadata", False):
+      self.script.append('set_perm_recursive(%d, %d, 0%o, 0%o, "%s");'
+                         % (uid, gid, dmode, fmode, fn))
+    else:
+      if capabilities is None: capabilities = "0x0"
+      cmd = 'set_metadata_recursive("%s", "uid", %d, "gid", %d, ' \
+          '"dmode", 0%o, "fmode", 0%o, "capabilities", %s' \
+          % (fn, uid, gid, dmode, fmode, capabilities)
+      if selabel is not None:
+        cmd += ', "selabel", "%s"' % ( selabel )
+      cmd += ');'
+      self.script.append(cmd)
 
   def MakeSymlinks(self, symlink_list):
     """Create symlinks, given a list of (dest, link) pairs."""
diff --git a/tools/releasetools/ota_from_target_files b/tools/releasetools/ota_from_target_files
index 1e1d04e..a6b9b69 100755
--- a/tools/releasetools/ota_from_target_files
+++ b/tools/releasetools/ota_from_target_files
@@ -117,6 +117,8 @@
     self.uid = None
     self.gid = None
     self.mode = None
+    self.selabel = None
+    self.capabilities = None
     self.dir = dir
 
     if name:
@@ -147,82 +149,88 @@
   @classmethod
   def GetMetadata(cls, input_zip):
 
-    try:
-      # See if the target_files contains a record of what the uid,
-      # gid, and mode is supposed to be.
-      output = input_zip.read("META/filesystem_config.txt")
-    except KeyError:
-      # Run the external 'fs_config' program to determine the desired
-      # uid, gid, and mode for every Item object.  Note this uses the
-      # one in the client now, which might not be the same as the one
-      # used when this target_files was built.
-      p = common.Run(["fs_config"], stdin=subprocess.PIPE,
-                     stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-      suffix = { False: "", True: "/" }
-      input = "".join(["%s%s\n" % (i.name, suffix[i.dir])
-                       for i in cls.ITEMS.itervalues() if i.name])
-      output, error = p.communicate(input)
-      assert not error
+    # The target_files contains a record of what the uid,
+    # gid, and mode are supposed to be.
+    output = input_zip.read("META/filesystem_config.txt")
 
     for line in output.split("\n"):
       if not line: continue
-      name, uid, gid, mode = line.split()
+      columns = line.split()
+      name, uid, gid, mode = columns[:4]
+      selabel = None
+      capabilities = None
+
+      # After the first 4 columns, there are a series of key=value
+      # pairs. Extract out the fields we care about.
+      for element in columns[4:]:
+        key, value = element.split("=")
+        if key == "selabel":
+          selabel = value
+        if key == "capabilities":
+          capabilities = value
+
       i = cls.ITEMS.get(name, None)
       if i is not None:
         i.uid = int(uid)
         i.gid = int(gid)
         i.mode = int(mode, 8)
+        i.selabel = selabel
+        i.capabilities = capabilities
         if i.dir:
           i.children.sort(key=lambda i: i.name)
 
     # set metadata for the files generated by this script.
     i = cls.ITEMS.get("system/recovery-from-boot.p", None)
-    if i: i.uid, i.gid, i.mode = 0, 0, 0644
+    if i: i.uid, i.gid, i.mode, i.selabel, i.capabilities = 0, 0, 0644, None, None
     i = cls.ITEMS.get("system/etc/install-recovery.sh", None)
-    if i: i.uid, i.gid, i.mode = 0, 0, 0544
+    if i: i.uid, i.gid, i.mode, i.selabel, i.capabilities = 0, 0, 0544, None, None
 
   def CountChildMetadata(self):
-    """Count up the (uid, gid, mode) tuples for all children and
-    determine the best strategy for using set_perm_recursive and
+    """Count up the (uid, gid, mode, selabel, capabilities) tuples for
+    all children and determine the best strategy for using set_perm_recursive and
     set_perm to correctly chown/chmod all the files to their desired
     values.  Recursively calls itself for all descendants.
 
-    Returns a dict of {(uid, gid, dmode, fmode): count} counting up
+    Returns a dict of {(uid, gid, dmode, fmode, selabel, capabilities): count} counting up
     all descendants of this node.  (dmode or fmode may be None.)  Also
     sets the best_subtree of each directory Item to the (uid, gid,
-    dmode, fmode) tuple that will match the most descendants of that
-    Item.
+    dmode, fmode, selabel, capabilities) tuple that will match the most
+    descendants of that Item.
     """
 
     assert self.dir
-    d = self.descendants = {(self.uid, self.gid, self.mode, None): 1}
+    d = self.descendants = {(self.uid, self.gid, self.mode, None, self.selabel, self.capabilities): 1}
     for i in self.children:
       if i.dir:
         for k, v in i.CountChildMetadata().iteritems():
           d[k] = d.get(k, 0) + v
       else:
-        k = (i.uid, i.gid, None, i.mode)
+        k = (i.uid, i.gid, None, i.mode, i.selabel, i.capabilities)
         d[k] = d.get(k, 0) + 1
 
-    # Find the (uid, gid, dmode, fmode) tuple that matches the most
-    # descendants.
+    # Find the (uid, gid, dmode, fmode, selabel, capabilities)
+    # tuple that matches the most descendants.
 
     # First, find the (uid, gid) pair that matches the most
     # descendants.
     ug = {}
-    for (uid, gid, _, _), count in d.iteritems():
+    for (uid, gid, _, _, _, _), count in d.iteritems():
       ug[(uid, gid)] = ug.get((uid, gid), 0) + count
     ug = MostPopularKey(ug, (0, 0))
 
-    # Now find the dmode and fmode that match the most descendants
-    # with that (uid, gid), and choose those.
+    # Now find the dmode, fmode, selabel, and capabilities that match
+    # the most descendants with that (uid, gid), and choose those.
     best_dmode = (0, 0755)
     best_fmode = (0, 0644)
+    best_selabel = (0, None)
+    best_capabilities = (0, None)
     for k, count in d.iteritems():
       if k[:2] != ug: continue
       if k[2] is not None and count >= best_dmode[0]: best_dmode = (count, k[2])
       if k[3] is not None and count >= best_fmode[0]: best_fmode = (count, k[3])
-    self.best_subtree = ug + (best_dmode[1], best_fmode[1])
+      if k[4] is not None and count >= best_selabel[0]: best_selabel = (count, k[4])
+      if k[5] is not None and count >= best_capabilities[0]: best_capabilities = (count, k[5])
+    self.best_subtree = ug + (best_dmode[1], best_fmode[1], best_selabel[1], best_capabilities[1])
 
     return d
 
@@ -234,7 +242,7 @@
     self.CountChildMetadata()
 
     def recurse(item, current):
-      # current is the (uid, gid, dmode, fmode) tuple that the current
+      # current is the (uid, gid, dmode, fmode, selabel, capabilities) tuple that the current
       # item (and all its children) have already been set to.  We only
       # need to issue set_perm/set_perm_recursive commands if we're
       # supposed to be something different.
@@ -244,17 +252,21 @@
           current = item.best_subtree
 
         if item.uid != current[0] or item.gid != current[1] or \
-           item.mode != current[2]:
-          script.SetPermissions("/"+item.name, item.uid, item.gid, item.mode)
+           item.mode != current[2] or item.selabel != current[4] or \
+           item.capabilities != current[5]:
+          script.SetPermissions("/"+item.name, item.uid, item.gid,
+                                item.mode, item.selabel, item.capabilities)
 
         for i in item.children:
           recurse(i, current)
       else:
         if item.uid != current[0] or item.gid != current[1] or \
-               item.mode != current[3]:
-          script.SetPermissions("/"+item.name, item.uid, item.gid, item.mode)
+               item.mode != current[3] or item.selabel != current[4] or \
+               item.capabilities != current[5]:
+          script.SetPermissions("/"+item.name, item.uid, item.gid,
+                                item.mode, item.selabel, item.capabilities)
 
-    recurse(self, (-1, -1, -1, -1))
+    recurse(self, (-1, -1, -1, -1, None, None))
 
 
 def CopySystemFiles(input_zip, output_zip=None,
@@ -733,7 +745,7 @@
   for item in deferred_patch_list:
     fn, tf, sf, size, _ = item
     script.ApplyPatch("/"+fn, "-", tf.size, tf.sha1, sf.sha1, "patch/"+fn+".p")
-  script.SetPermissions("/system/build.prop", 0, 0, 0644)
+  script.SetPermissions("/system/build.prop", 0, 0, 0644, None, None)
 
   script.AddToZip(target_zip, output_zip)
   WriteMetadata(metadata, output_zip)