diff --git a/CleanSpec.mk b/CleanSpec.mk
index 23eba4f..3ba1f45 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -442,6 +442,8 @@
 $(call add-clean-step, rm -rf $(OUT_DIR)/host/common/obj/*/*_intermediates/src)
 $(call add-clean-step, rm -f $(OUT_DIR)/host/common/obj/*/*_intermediates/java-source-list)
 
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/APPS/*/flat-res)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/Makefile b/core/Makefile
index 558183e..090bd90 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -40,7 +40,9 @@
         $(eval _fulldest := $(call append-path,$(PRODUCT_OUT),$(_dest))) \
         $(if $(filter %.xml,$(_dest)),\
             $(eval $(call copy-xml-file-checked,$(_src),$(_fulldest))),\
-            $(eval $(call copy-one-file,$(_src),$(_fulldest)))) \
+            $(if $(and $(filter %.jar,$(_dest)),$(filter $(basename $(notdir $(_dest))),$(PRODUCT_LOADED_BY_PRIVILEGED_MODULES))),\
+                $(eval $(call copy-and-uncompress-dexs,$(_src),$(_fulldest))), \
+                $(eval $(call copy-one-file,$(_src),$(_fulldest))))) \
         $(eval ALL_DEFAULT_INSTALLED_MODULES += $(_fulldest)) \
         $(eval unique_product_copy_files_destinations += $(_dest))))
 unique_product_copy_files_pairs :=
@@ -111,7 +113,8 @@
 endif
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_DEFAULT_PROP_TARGET)
 FINAL_DEFAULT_PROPERTIES := \
-    $(call collapse-pairs, $(ADDITIONAL_DEFAULT_PROPERTIES))
+    $(call collapse-pairs, $(ADDITIONAL_DEFAULT_PROPERTIES)) \
+    $(call collapse-pairs, $(PRODUCT_SYSTEM_DEFAULT_PROPERTIES))
 ifndef property_overrides_split_enabled
   FINAL_DEFAULT_PROPERTIES += \
       $(call collapse-pairs, $(PRODUCT_DEFAULT_PROPERTY_OVERRIDES))
@@ -149,6 +152,11 @@
 INSTALLED_VENDOR_DEFAULT_PROP_TARGET := $(TARGET_OUT_VENDOR)/default.prop
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_VENDOR_DEFAULT_PROP_TARGET)
 
+ifdef BOARD_VNDK_VERSION
+FINAL_VENDOR_DEFAULT_PROPERTIES := ro.vndk.version=${BOARD_VNDK_VERSION}
+else
+FINAL_VENDOR_DEFAULT_PROPERTIES :=
+endif
 FINAL_VENDOR_DEFAULT_PROPERTIES += \
     $(call collapse-pairs, $(PRODUCT_DEFAULT_PROPERTY_OVERRIDES))
 FINAL_VENDOR_DEFAULT_PROPERTIES := $(call uniq-pairs-by-first-component, \
@@ -273,7 +281,7 @@
 else
 system_prop_file := $(wildcard $(TARGET_DEVICE_DIR)/system.prop)
 endif
-$(intermediate_system_build_prop): $(VENDOR_BUILDINFO_SH) $(BUILDINFO_SH) $(INTERNAL_BUILD_ID_MAKEFILE) $(BUILD_SYSTEM)/version_defaults.mk $(system_prop_file) $(INSTALLED_ANDROID_INFO_TXT_TARGET)
+$(intermediate_system_build_prop): $(BUILDINFO_SH) $(INTERNAL_BUILD_ID_MAKEFILE) $(BUILD_SYSTEM)/version_defaults.mk $(system_prop_file) $(INSTALLED_ANDROID_INFO_TXT_TARGET)
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
@@ -317,16 +325,6 @@
 			TARGET_CPU_ABI2="$(TARGET_CPU_ABI2)" \
 			TARGET_AAPT_CHARACTERISTICS="$(TARGET_AAPT_CHARACTERISTICS)" \
 	        bash $(BUILDINFO_SH) >> $@
-ifndef property_overrides_split_enabled
-	$(hide) TARGET_DEVICE="$(TARGET_DEVICE)" \
-			PRODUCT_NAME="$(TARGET_PRODUCT)" \
-			PRODUCT_BRAND="$(PRODUCT_BRAND)" \
-			PRODUCT_MODEL="$(PRODUCT_MODEL)" \
-			PRODUCT_MANUFACTURER="$(PRODUCT_MANUFACTURER)" \
-			TARGET_BOOTLOADER_BOARD_NAME="$(TARGET_BOOTLOADER_BOARD_NAME)" \
-			TARGET_BOARD_PLATFORM="$(TARGET_BOARD_PLATFORM)" \
-	        bash $(VENDOR_BUILDINFO_SH) >> $@
-endif
 	$(hide) $(foreach file,$(system_prop_file), \
 		if [ -f "$(file)" ]; then \
 			echo "#" >> $@; \
@@ -355,7 +353,7 @@
 
 $(INSTALLED_BUILD_PROP_TARGET): $(intermediate_system_build_prop) $(INSTALLED_RECOVERYIMAGE_TARGET)
 	@echo "Target build info: $@"
-	$(hide) cat $(intermediate_system_build_prop) > $@
+	$(hide) grep -v 'ro.product.first_api_level' $(intermediate_system_build_prop) > $@
 ifdef INSTALLED_RECOVERYIMAGE_TARGET
 	$(hide) echo ro.expect.recovery_id=`cat $(RECOVERYIMAGE_ID_FILE)` >> $@
 endif
@@ -364,7 +362,6 @@
 # vendor build.prop
 #
 # For verifying that the vendor build is what we think it is
-ifdef BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE
 INSTALLED_VENDOR_BUILD_PROP_TARGET := $(TARGET_OUT_VENDOR)/build.prop
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_VENDOR_BUILD_PROP_TARGET)
 
@@ -375,14 +372,14 @@
     $(FINAL_VENDOR_BUILD_PROPERTIES),=)
 endif  # property_overrides_split_enabled
 
-$(INSTALLED_VENDOR_BUILD_PROP_TARGET): $(VENDOR_BUILDINFO_SH)
+$(INSTALLED_VENDOR_BUILD_PROP_TARGET): $(VENDOR_BUILDINFO_SH) $(intermediate_system_build_prop)
 	@echo Target vendor buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
+	$(hide) grep 'ro.product.first_api_level' $(intermediate_system_build_prop) >> $@ || true
 	$(hide) echo ro.vendor.build.date=`$(DATE_FROM_FILE)`>>$@
 	$(hide) echo ro.vendor.build.date.utc=`$(DATE_FROM_FILE) +%s`>>$@
 	$(hide) echo ro.vendor.build.fingerprint="$(BUILD_FINGERPRINT_FROM_FILE)">>$@
-ifdef property_overrides_split_enabled
 	$(hide) TARGET_DEVICE="$(TARGET_DEVICE)" \
 			PRODUCT_NAME="$(TARGET_PRODUCT)" \
 			PRODUCT_BRAND="$(PRODUCT_BRAND)" \
@@ -391,6 +388,7 @@
 			TARGET_BOOTLOADER_BOARD_NAME="$(TARGET_BOOTLOADER_BOARD_NAME)" \
 			TARGET_BOARD_PLATFORM="$(TARGET_BOARD_PLATFORM)" \
 	        bash $(VENDOR_BUILDINFO_SH) >> $@
+ifdef property_overrides_split_enabled
 	$(hide) echo "#" >> $@; \
 	        echo "# ADDITIONAL VENDOR BUILD PROPERTIES" >> $@; \
 	        echo "#" >> $@;
@@ -398,7 +396,6 @@
 		echo "$(line)" >> $@;)
 	$(hide) build/tools/post_process_props.py $@
 endif  # property_overrides_split_enabled
-endif  # BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE
 
 # ----------------------------------------------------------------
 
@@ -2100,6 +2097,7 @@
 ifeq ($(build_ota_package),true)
 OTATOOLS :=  $(HOST_OUT_EXECUTABLES)/minigzip \
   $(HOST_OUT_EXECUTABLES)/aapt \
+  $(HOST_OUT_EXECUTABLES)/checkvintf \
   $(HOST_OUT_EXECUTABLES)/mkbootfs \
   $(HOST_OUT_EXECUTABLES)/mkbootimg \
   $(HOST_OUT_EXECUTABLES)/fs_config \
@@ -2110,8 +2108,6 @@
   $(HOST_OUT_JAVA_LIBRARIES)/signapk.jar \
   $(HOST_OUT_JAVA_LIBRARIES)/BootSignature.jar \
   $(HOST_OUT_JAVA_LIBRARIES)/VeritySigner.jar \
-  $(HOST_OUT_EXECUTABLES)/make_ext4fs \
-  $(HOST_OUT_EXECUTABLES)/mkuserimg.sh \
   $(HOST_OUT_EXECUTABLES)/mke2fs \
   $(HOST_OUT_EXECUTABLES)/mkuserimg_mke2fs.sh \
   $(HOST_OUT_EXECUTABLES)/e2fsdroid \
@@ -2133,7 +2129,7 @@
   $(HOST_OUT_EXECUTABLES)/delta_generator \
   $(AVBTOOL) \
   $(BLK_ALLOC_TO_BASE_FS) \
-  $(BRO)
+  $(BROTLI)
 
 ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
 OTATOOLS += \
@@ -2629,7 +2625,7 @@
 ifeq ($(AB_OTA_UPDATER),true)
 $(INTERNAL_OTA_PACKAGE_TARGET): $(BRILLO_UPDATE_PAYLOAD)
 else
-$(INTERNAL_OTA_PACKAGE_TARGET): $(BRO)
+$(INTERNAL_OTA_PACKAGE_TARGET): $(BROTLI)
 endif
 
 $(INTERNAL_OTA_PACKAGE_TARGET): $(BUILT_TARGET_FILES_PACKAGE) \
@@ -2679,7 +2675,7 @@
 name := $(name)-symbols-$(FILE_NAME_TAG)
 
 SYMBOLS_ZIP := $(PRODUCT_OUT)/$(name).zip
-# For apps_only build we'll establish the dependency later in build/core/main.mk.
+# For apps_only build we'll establish the dependency later in build/make/core/main.mk.
 ifndef TARGET_BUILD_APPS
 $(SYMBOLS_ZIP): $(INSTALLED_SYSTEMIMAGE) \
 		$(INSTALLED_BOOTIMAGE_TARGET) \
@@ -2745,7 +2741,7 @@
 # An archive of classes for use in generating code-coverage reports
 # These are the uninstrumented versions of any classes that were
 # to be instrumented.
-# Any dependencies are set up later in build/core/main.mk.
+# Any dependencies are set up later in build/make/core/main.mk.
 
 JACOCO_REPORT_CLASSES_ALL := $(PRODUCT_OUT)/jacoco-report-classes-all.jar
 $(JACOCO_REPORT_CLASSES_ALL) :
@@ -2767,7 +2763,7 @@
 #
 ifdef TARGET_BUILD_APPS
 PROGUARD_DICT_ZIP := $(PRODUCT_OUT)/$(TARGET_PRODUCT)-proguard-dict-$(FILE_NAME_TAG).zip
-# the dependency will be set up later in build/core/main.mk.
+# the dependency will be set up later in build/make/core/main.mk.
 $(PROGUARD_DICT_ZIP) :
 	@echo "Packaging Proguard obfuscation dictionary files."
 	$(hide) dict_files=`find $(TARGET_OUT_COMMON_INTERMEDIATES)/APPS -name proguard_dictionary`; \
diff --git a/core/aapt2.mk b/core/aapt2.mk
index c7cae44..8bb2d4b 100644
--- a/core/aapt2.mk
+++ b/core/aapt2.mk
@@ -47,8 +47,10 @@
 my_generated_resources_flata += $(my_generated_resources_flata)
 endif
 
+# Always set --pseudo-localize, it will be stripped out later for release
+# builds that don't want it.
 $(my_res_resources_flat) $(my_overlay_resources_flat) $(my_generated_resources_flata): \
-  PRIVATE_AAPT2_CFLAGS := $(PRODUCT_AAPT2_CFLAGS)
+  PRIVATE_AAPT2_CFLAGS := --pseudo-localize
 
 my_static_library_resources := $(foreach l, $(call reverse-list,$(LOCAL_STATIC_ANDROID_LIBRARIES)),\
   $(call intermediates-dir-for,JAVA_LIBRARIES,$(l),,COMMON)/package-res.apk)
diff --git a/core/base_rules.mk b/core/base_rules.mk
index a178b55..b501fbd 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -96,6 +96,13 @@
 # base_rules.mk, but it will fix the most common ones.
 LOCAL_ADDITIONAL_DEPENDENCIES := $(filter-out %.mk,$(LOCAL_ADDITIONAL_DEPENDENCIES))
 
+my_bad_deps := $(strip $(foreach dep,$(filter-out | ||,$(LOCAL_ADDITIONAL_DEPENDENCIES)),\
+                 $(if $(findstring /,$(dep)),,$(dep))))
+ifneq ($(my_bad_deps),)
+$(call pretty-warning,"Bad LOCAL_ADDITIONAL_DEPENDENCIES: $(my_bad_deps)")
+$(call pretty-error,"LOCAL_ADDITIONAL_DEPENDENCIES must only contain paths (not module names)")
+endif
+
 ###########################################################
 ## Validate and define fallbacks for input LOCAL_* variables.
 ###########################################################
@@ -131,7 +138,7 @@
 # makefiles. Anything else is either a typo or a source of unexpected
 # behaviors.
 ifneq ($(filter-out debug eng tests optional samples,$(my_module_tags)),)
-$(call pretty-warning,unusual tags $(my_module_tags))
+$(call pretty-error,unusual tags: $(filter-out debug eng tests optional samples,$(my_module_tags)))
 endif
 
 # Add implicit tags.
diff --git a/core/binary.mk b/core/binary.mk
index 3e31d9a..bd1e601 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -62,8 +62,8 @@
 my_export_c_include_deps := $(LOCAL_EXPORT_C_INCLUDE_DEPS)
 my_arflags :=
 
-ifneq (,$(strip $(foreach dir,$(subst $(comma),$(space),$(COVERAGE_PATHS)),$(filter $(dir)%,$(LOCAL_PATH)))))
-ifeq (,$(strip $(foreach dir,$(subst $(comma),$(space),$(COVERAGE_EXCLUDE_PATHS)),$(filter $(dir)%,$(LOCAL_PATH)))))
+ifneq (,$(strip $(foreach dir,$(COVERAGE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
+ifeq (,$(strip $(foreach dir,$(COVERAGE_EXCLUDE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
   my_native_coverage := true
 else
   my_native_coverage := false
diff --git a/core/clang/versions.mk b/core/clang/versions.mk
index c2473cd..f3a206a 100644
--- a/core/clang/versions.mk
+++ b/core/clang/versions.mk
@@ -1,4 +1,4 @@
 ## Clang/LLVM release versions.
 
-LLVM_PREBUILTS_VERSION ?= clang-4053586
+LLVM_PREBUILTS_VERSION ?= clang-4393122
 LLVM_PREBUILTS_BASE ?= prebuilts/clang/host
diff --git a/core/cleanbuild.mk b/core/cleanbuild.mk
index 64c5ae1..5576785 100644
--- a/core/cleanbuild.mk
+++ b/core/cleanbuild.mk
@@ -21,7 +21,7 @@
 TOP := .
 TOPDIR :=
 
-BUILD_SYSTEM := $(TOPDIR)build/core
+BUILD_SYSTEM := $(TOPDIR)build/make/core
 
 # Set up various standard variables based on configuration
 # and host information.
@@ -48,7 +48,7 @@
 #
 # $(1): shell command to run
 # $(2): indicate to not use makefile path as part of step id if not empty.
-#       $(2) should only be used in build/core/cleanspec.mk: just for compatibility.
+#       $(2) should only be used in build/make/core/cleanspec.mk: just for compatibility.
 define _add-clean-step
   $(if $(strip $(INTERNAL_CLEAN_BUILD_VERSION)),, \
       $(error INTERNAL_CLEAN_BUILD_VERSION not set))
@@ -67,7 +67,7 @@
   $(eval _acs_makefile_prefix :=)
 endef
 define add-clean-step
-$(eval # for build/core/cleanspec.mk, dont use makefile path as part of step id) \
+$(eval # for build/make/core/cleanspec.mk, dont use makefile path as part of step id) \
 $(if $(filter %/cleanspec.mk,$(lastword $(MAKEFILE_LIST))),\
     $(eval $(call _add-clean-step,$(1),true)),\
     $(eval $(call _add-clean-step,$(1))))
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 6db731b..dc3c5f2 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -201,6 +201,7 @@
 # lite(default),micro,nano,stream,full,nanopb-c,nanopb-c-enable_malloc
 LOCAL_PROTOC_OPTIMIZE_TYPE:=
 LOCAL_PROTO_JAVA_OUTPUT_PARAMS:=
+LOCAL_R8_FLAG_FILES:=
 LOCAL_RECORDED_MODULE_TYPE:=
 LOCAL_RENDERSCRIPT_CC:=
 LOCAL_RENDERSCRIPT_COMPATIBILITY:=
diff --git a/core/combo/arch/x86/atom.mk b/core/combo/arch/x86/atom.mk
index d313a9a..43a170c 100644
--- a/core/combo/arch/x86/atom.mk
+++ b/core/combo/arch/x86/atom.mk
@@ -2,7 +2,7 @@
 # 'x86-atom' arch variant. This is an extension of the 'x86' base variant
 # that adds Atom-specific features.
 #
-# See build/core/combo/arch/x86/x86.mk for differences.
+# See build/make/core/combo/arch/x86/x86.mk for differences.
 #
 ARCH_X86_HAVE_SSSE3 := true
 ARCH_X86_HAVE_MOVBE := true
diff --git a/core/combo/arch/x86/silvermont.mk b/core/combo/arch/x86/silvermont.mk
index 70b718c..cba1079 100644
--- a/core/combo/arch/x86/silvermont.mk
+++ b/core/combo/arch/x86/silvermont.mk
@@ -1,7 +1,7 @@
 # This file contains feature macro definitions specific to the
 # silvermont arch variant.
 #
-# See build/core/combo/arch/x86/x86-atom.mk for differences.
+# See build/make/core/combo/arch/x86/x86-atom.mk for differences.
 #
 
 ARCH_X86_HAVE_SSSE3  := true
diff --git a/core/combo/arch/x86_64/silvermont.mk b/core/combo/arch/x86_64/silvermont.mk
index 70b718c..cba1079 100644
--- a/core/combo/arch/x86_64/silvermont.mk
+++ b/core/combo/arch/x86_64/silvermont.mk
@@ -1,7 +1,7 @@
 # This file contains feature macro definitions specific to the
 # silvermont arch variant.
 #
-# See build/core/combo/arch/x86/x86-atom.mk for differences.
+# See build/make/core/combo/arch/x86/x86-atom.mk for differences.
 #
 
 ARCH_X86_HAVE_SSSE3  := true
diff --git a/core/combo/javac.mk b/core/combo/javac.mk
index 122d8bc..dac2628 100644
--- a/core/combo/javac.mk
+++ b/core/combo/javac.mk
@@ -1,10 +1,6 @@
 # Selects a Java compiler.
 #
-# Inputs:
-#   OVERRIDE_ANDROID_JAVA_HOME -- alternate location to use for jdk
-#
 # Outputs:
-#   ANDROID_JAVA_HOME -- Directory that contains JDK
 #   ANDROID_JAVA_TOOLCHAIN -- Directory that contains javac and other java tools
 #
 
@@ -16,19 +12,7 @@
   endif
 endif
 
-ifneq ($(OVERRIDE_ANDROID_JAVA_HOME),)
-  # Use this build toolchain instead of the bundled one.
-  ANDROID_JAVA_HOME := $(OVERRIDE_ANDROID_JAVA_HOME)
-else # !OVERRIDE_ANDROID_JAVA_HOME
-  ifneq ($(EXPERIMENTAL_USE_OPENJDK9),)
-    ANDROID_JAVA_HOME := prebuilts/jdk/jdk9/$(HOST_PREBUILT_TAG)
-  else
-    ANDROID_JAVA_HOME := prebuilts/jdk/jdk8/$(HOST_PREBUILT_TAG)
-  endif
-endif
-
 ANDROID_JAVA_TOOLCHAIN := $(ANDROID_JAVA_HOME)/bin
-export JAVA_HOME := $(abspath $(ANDROID_JAVA_HOME))
 
 # TODO(ccross): remove this, it is needed for now because it is used by
 # config.mk before makevars from soong are loaded
diff --git a/core/config.mk b/core/config.mk
index f21ae38..96cc7b7 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -3,6 +3,20 @@
 # current configuration and platform, which
 # are not specific to what is being built.
 
+ifndef KATI
+$(warning Directly using config.mk from make is no longer supported.)
+$(warning )
+$(warning If you are just attempting to build, you probably need to re-source envsetup.sh:)
+$(warning )
+$(warning $$ source build/envsetup.sh)
+$(warning )
+$(warning If you are attempting to emulate get_build_var, use one of the following:)
+$(warning $$ build/soong/soong_ui.bash --dumpvar-mode)
+$(warning $$ build/soong/soong_ui.bash --dumpvars-mode)
+$(warning )
+$(error done)
+endif
+
 # Only use ANDROID_BUILD_SHELL to wrap around bash.
 # DO NOT use other shells such as zsh.
 ifdef ANDROID_BUILD_SHELL
@@ -44,17 +58,8 @@
 # If a rule fails, delete $@.
 .DELETE_ON_ERROR:
 
-# Check for broken versions of make.
-ifndef KATI
-ifneq (1,$(strip $(shell expr $(MAKE_VERSION) \>= 3.81)))
-$(warning ********************************************************************************)
-$(warning *  You are using version $(MAKE_VERSION) of make.)
-$(warning *  Android can only be built by versions 3.81 and higher.)
-$(warning *  see https://source.android.com/source/download.html)
-$(warning ********************************************************************************)
-$(error stopping)
-endif
-endif
+# Mark variables deprecated/obsolete
+$(KATI_deprecated_var PATH,Do not use PATH directly)
 
 # Used to force goals to build.  Only use for conditionally defined goals.
 .PHONY: FORCE
@@ -511,10 +516,10 @@
 
 USE_PREBUILT_SDK_TOOLS_IN_PLACE := true
 
-# USE_D8_BY_DEFAULT is the default behavior, use USE_D8 to override.
-USE_D8_BY_DEFAULT := false
+# Work around for b/68406220
+# This should match the soong version.
 ifndef USE_D8
-  USE_D8 := $(USE_D8_BY_DEFAULT)
+  USE_D8 := true
 endif
 
 #
@@ -530,12 +535,6 @@
   SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
   ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
 
-  ifeq ($(USE_D8),true)
-    DX := $(HOST_OUT_EXECUTABLES)/d8
-  else
-    DX := $(HOST_OUT_EXECUTABLES)/dx
-  endif
-
 else # TARGET_BUILD_APPS || TARGET_BUILD_PDK
   AIDL := $(prebuilt_sdk_tools_bin)/aidl
   AAPT := $(prebuilt_sdk_tools_bin)/aapt
@@ -545,15 +544,9 @@
   SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
   SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
   ZIPALIGN := $(prebuilt_sdk_tools_bin)/zipalign
-
-  ifeq ($(USE_D8),true)
-    DX := $(prebuilt_build_tools_wrappers)/d8
-  else
-    DX := $(prebuilt_build_tools_wrappers)/dx
-  endif
 endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
 
-DX_COMMAND := $(DX) -JXms16M -JXmx2048M
+R8_COMPAT_PROGUARD_JAR := prebuilts/r8/compatproguard-master.jar
 
 ifeq (,$(TARGET_BUILD_APPS))
   # Use RenderScript prebuilts for unbundled builds but not PDK builds
@@ -608,7 +601,7 @@
 VTSC := $(HOST_OUT_EXECUTABLES)/vtsc$(HOST_EXECUTABLE_SUFFIX)
 MKBOOTFS := $(HOST_OUT_EXECUTABLES)/mkbootfs$(HOST_EXECUTABLE_SUFFIX)
 MINIGZIP := $(HOST_OUT_EXECUTABLES)/minigzip$(HOST_EXECUTABLE_SUFFIX)
-BRO := $(HOST_OUT_EXECUTABLES)/bro$(HOST_EXECUTABLE_SUFFIX)
+BROTLI := $(HOST_OUT_EXECUTABLES)/brotli$(HOST_EXECUTABLE_SUFFIX)
 ifeq (,$(strip $(BOARD_CUSTOM_MKBOOTIMG)))
 MKBOOTIMG := $(HOST_OUT_EXECUTABLES)/mkbootimg$(HOST_EXECUTABLE_SUFFIX)
 else
@@ -626,15 +619,9 @@
 endif
 APICHECK := $(HOST_OUT_EXECUTABLES)/apicheck$(HOST_EXECUTABLE_SUFFIX)
 FS_GET_STATS := $(HOST_OUT_EXECUTABLES)/fs_get_stats$(HOST_EXECUTABLE_SUFFIX)
-ifeq ($(TARGET_USES_MKE2FS),true)
 MAKE_EXT4FS := $(HOST_OUT_EXECUTABLES)/mke2fs$(HOST_EXECUTABLE_SUFFIX)
 MKEXTUSERIMG := $(HOST_OUT_EXECUTABLES)/mkuserimg_mke2fs.sh
 MKE2FS_CONF := system/extras/ext4_utils/mke2fs.conf
-else
-MAKE_EXT4FS := $(HOST_OUT_EXECUTABLES)/make_ext4fs$(HOST_EXECUTABLE_SUFFIX)
-MKEXTUSERIMG := $(HOST_OUT_EXECUTABLES)/mkuserimg.sh
-MKE2FS_CONF :=
-endif
 BLK_ALLOC_TO_BASE_FS := $(HOST_OUT_EXECUTABLES)/blk_alloc_to_base_fs$(HOST_EXECUTABLE_SUFFIX)
 MAKE_SQUASHFS := $(HOST_OUT_EXECUTABLES)/mksquashfs$(HOST_EXECUTABLE_SUFFIX)
 MKSQUASHFSUSERIMG := $(HOST_OUT_EXECUTABLES)/mksquashfsimage.sh
@@ -650,7 +637,6 @@
 FAT16COPY := build/tools/fat16copy.py
 CHECK_LINK_TYPE := build/tools/check_link_type.py
 
-TURBINE := $(HOST_OUT_JAVA_LIBRARIES)/turbine$(COMMON_JAVA_PACKAGE_SUFFIX)
 PROGUARD := external/proguard/bin/proguard.sh
 JAVATAGS := build/tools/java-event-log-tags.py
 MERGETAGS := build/tools/merge-event-log-tags.py
@@ -721,6 +707,25 @@
   PRODUCT_FULL_TREBLE := true
 endif
 
+requirements := \
+    PRODUCT_TREBLE_LINKER_NAMESPACES \
+    PRODUCT_SEPOLICY_SPLIT \
+    PRODUCT_ENFORCE_VINTF_MANIFEST \
+
+# If it is overriden, then the requirement override is taken, otherwise it's
+# PRODUCT_FULL_TREBLE
+$(foreach req,$(requirements),$(eval \
+    $(req) := $(if $($(req)_OVERRIDE),$($(req)_OVERRIDE),$(PRODUCT_FULL_TREBLE))))
+# If the requirement is false for any reason, then it's not PRODUCT_FULL_TREBLE
+$(foreach req,$(requirements),$(eval \
+    PRODUCT_FULL_TREBLE := $(if $(filter false,$($(req))),false,$(PRODUCT_FULL_TREBLE))))
+
+.KATI_READONLY := \
+    $(requirements) \
+    PRODUCT_FULL_TREBLE
+
+requirements :=
+
 ifdef PRODUCT_SHIPPING_API_LEVEL
   ifneq ($(call math_gt_or_eq,$(PRODUCT_SHIPPING_API_LEVEL),27),)
     ifneq ($(TARGET_USES_MKE2FS),true)
@@ -776,6 +781,9 @@
   FRAMEWORK_COMPATIBILITY_MATRIX_FILE := hardware/interfaces/compatibility_matrix.current.xml
 endif
 
+BUILD_NUMBER_FROM_FILE := $$(cat $(OUT_DIR)/build_number.txt)
+BUILD_DATETIME_FROM_FILE := $$(cat $(OUT_DIR)/build_date.txt)
+
 # ###############################################################
 # Set up final options.
 # ###############################################################
@@ -884,23 +892,15 @@
 RSCOMPAT_32BIT_ONLY_API_LEVELS := 8 9 10 11 12 13 14 15 16 17 18 19 20
 RSCOMPAT_NO_USAGEIO_API_LEVELS := 8 9 10 11 12 13
 
-ifeq ($(JAVA_NOT_REQUIRED),true)
-# Remove java and tools from our path so that we make sure nobody uses them.
-unexport ANDROID_JAVA_HOME
-unexport JAVA_HOME
-export ANDROID_BUILD_PATHS:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(ANDROID_BUILD_PATHS)
-export PATH:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(PATH)
+# Add BUILD_NUMBER to apps default version name if it's unbundled build.
+ifdef TARGET_BUILD_APPS
+TARGET_BUILD_WITH_APPS_VERSION_NAME := true
+endif
+
+ifdef TARGET_BUILD_WITH_APPS_VERSION_NAME
+APPS_DEFAULT_VERSION_NAME := $(PLATFORM_VERSION)-$(BUILD_NUMBER_FROM_FILE)
 else
-  # Put java first on the path
-  # TODO(ccross): remove this once tools run during the build no longer depend on
-  # finding java in the path
-  ifeq (,$(strip $(CALLED_FROM_SETUP)))
-    ifneq ($(shell which java),$(abspath $(ANDROID_JAVA_TOOLCHAIN)/java))
-      $(warning Found incorrect java $(shell which java) in $$PATH)
-      $(warning Adding $(abspath $(ANDROID_JAVA_TOOLCHAIN)) to $$PATH)
-      export PATH:=$(abspath $(ANDROID_JAVA_TOOLCHAIN)):$(PATH)
-    endif
-  endif
+APPS_DEFAULT_VERSION_NAME := $(PLATFORM_VERSION)
 endif
 
 # Projects clean of compiler warnings should be compiled with -Werror.
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index e01fbbf..8bd9248 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -34,6 +34,18 @@
   endif
 endif
 
+# Disable global CFI in excluded paths
+ifneq ($(filter cfi, $(my_global_sanitize)),)
+  combined_exclude_paths := $(CFI_EXCLUDE_PATHS) \
+                            $(PRODUCT_CFI_EXCLUDE_PATHS)
+
+  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
+         $(filter $(dir)%,$(LOCAL_PATH)))),)
+    my_global_sanitize := $(filter-out cfi,$(my_global_sanitize))
+    my_global_sanitize_diag := $(filter-out cfi,$(my_global_sanitize_diag))
+  endif
+endif
+
 ifneq ($(my_global_sanitize),)
   my_sanitize := $(my_global_sanitize) $(my_sanitize)
 endif
@@ -84,6 +96,18 @@
   my_sanitize_diag :=
 endif
 
+# Enable CFI in included paths.
+ifeq ($(filter cfi, $(my_sanitize)),)
+  combined_include_paths := $(CFI_INCLUDE_PATHS) \
+                            $(PRODUCT_CFI_INCLUDE_PATHS)
+
+  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_include_paths)),\
+         $(filter $(dir)%,$(LOCAL_PATH)))),)
+    my_sanitize := cfi $(my_sanitize)
+    my_sanitize_diag := cfi $(my_sanitize_diag)
+  endif
+endif
+
 # If CFI is disabled globally, remove it from my_sanitize.
 ifeq ($(strip $(ENABLE_CFI)),false)
   my_sanitize := $(filter-out cfi,$(my_sanitize))
@@ -137,6 +161,8 @@
     else
         $(error $(LOCAL_PATH): $(LOCAL_MODULE): TSAN cannot be used for 32-bit modules.)
     endif
+  else
+    my_shared_libraries += $(TSAN_RUNTIME_LIBRARY)
   endif
 endif
 
@@ -233,12 +259,21 @@
   # entire module.
   LOCAL_ARM_MODE := thumb
   my_cflags += $(CFI_EXTRA_CFLAGS)
+  # Only append the default visibility flag if -fvisibility has not already been
+  # set to hidden.
+  ifeq ($(filter -fvisibility=hidden,$(LOCAL_CFLAGS)),)
+    my_cflags += -fvisibility=default
+  endif
   my_ldflags += $(CFI_EXTRA_LDFLAGS)
   my_arflags += --plugin $(LLVM_PREBUILTS_PATH)/../lib64/LLVMgold.so
-  # Workaround for b/33678192. CFI jumptables need Thumb2 codegen.  Revert when
-  # Clang is updated past r290384.
-  ifneq ($(filter arm,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
-    my_ldflags += -march=armv7-a
+
+  ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
+        my_ldflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_ldflags))
+        my_cflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_cflags))
+  else
+        # Apply the version script to non-static executables
+        my_ldflags += -Wl,--version-script,build/soong/cc/config/cfi_exports.map
+        LOCAL_ADDITIONAL_DEPENDENCIES += build/soong/cc/config/cfi_exports.map
   endif
 endif
 
@@ -291,11 +326,16 @@
 endif
 
 ifneq ($(my_sanitize_diag),)
-  notrap_arg := $(subst $(space),$(comma),$(my_sanitize_diag)),
-  my_cflags += -fno-sanitize-trap=$(notrap_arg)
-  # Diagnostic requires a runtime library, unless ASan or TSan are also enabled.
-  ifeq ($(filter address thread,$(my_sanitize)),)
-    # Does not have to be the first DT_NEEDED unlike ASan.
-    my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY)
+  # TODO(vishwath): Add diagnostic support for static executables once
+  # we switch to clang-4393122 (which adds the static ubsan runtime
+  # that this depends on)
+  ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
+    notrap_arg := $(subst $(space),$(comma),$(my_sanitize_diag)),
+    my_cflags += -fno-sanitize-trap=$(notrap_arg)
+    # Diagnostic requires a runtime library, unless ASan or TSan are also enabled.
+    ifeq ($(filter address thread,$(my_sanitize)),)
+      # Does not have to be the first DT_NEEDED unlike ASan.
+      my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY)
+    endif
   endif
 endif
diff --git a/core/definitions.mk b/core/definitions.mk
index 974da64..9ddbd17 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -1556,7 +1556,7 @@
         filelist="$$filelist $$ldir/$$ext$$f"; \
     done ; \
     $($(PRIVATE_2ND_ARCH_VAR_PREFIX)TARGET_AR) $($(PRIVATE_2ND_ARCH_VAR_PREFIX)TARGET_GLOBAL_ARFLAGS) \
-        $(2) $$filelist
+        $(PRIVATE_ARFLAGS) $(2) $$filelist
 
 endef
 
@@ -2002,17 +2002,6 @@
 ## Commands for running javac to make .class files
 ###########################################################
 
-# Add BUILD_NUMBER to apps default version name if it's unbundled build.
-ifdef TARGET_BUILD_APPS
-TARGET_BUILD_WITH_APPS_VERSION_NAME := true
-endif
-
-ifdef TARGET_BUILD_WITH_APPS_VERSION_NAME
-APPS_DEFAULT_VERSION_NAME := $(PLATFORM_VERSION)-$(BUILD_NUMBER_FROM_FILE)
-else
-APPS_DEFAULT_VERSION_NAME := $(PLATFORM_VERSION)
-endif
-
 # b/37750224
 AAPT_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
 
@@ -2385,7 +2374,6 @@
 endef
 
 # --add-opens is required because desugar reflects via java.lang.invoke.MethodHandles.Lookup
-# --desugar_try_with_resources_if_needed=false is needed due to b/63180735, b/63901645, b/63900665
 define desugar-classes-jar
 @echo Desugar: $@
 @mkdir -p $(dir $@)
@@ -2397,9 +2385,8 @@
     -Djdk.internal.lambda.dumpProxyClasses=$(abspath $(dir $@))/desugar_dumped_classes \
     -jar $(DESUGAR) \
     $(addprefix --bootclasspath_entry ,$(PRIVATE_BOOTCLASSPATH)) \
-    $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)) \
-    --min_sdk_version $(call codename-or-sdk-to-sdk,$(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
-    --desugar_try_with_resources_if_needed=false \
+    $(addprefix --classpath_entry ,$(PRIVATE_SHARED_JAVA_HEADER_LIBRARIES)) \
+    --min_sdk_version $(call codename-or-sdk-to-sdk,$(PRIVATE_MIN_SDK_VERSION)) \
     --allow_empty_bootclasspath \
     $(if $(filter --core-library,$(PRIVATE_DX_FLAGS)),--core_library) \
     -i $< -o $@.tmp
@@ -2650,6 +2637,14 @@
 	$$(copy-file-to-target)
 endef
 
+define copy-and-uncompress-dexs
+$(2): $(1) $(ZIPALIGN)
+	@echo "Uncompress dexs in: $$@"
+	$$(copy-file-to-target)
+	$$(uncompress-dexs)
+	$$(align-package)
+endef
+
 # Copies many files.
 # $(1): The files to copy.  Each entry is a ':' separated src:dst pair
 # Evaluates to the list of the dst files (ie suitable for a dependency list)
@@ -2689,7 +2684,7 @@
 define copy-file-to-target
 @mkdir -p $(dir $@)
 $(hide) rm -f $@
-$(hide) cp $< $@
+$(hide) cp "$<" "$@"
 endef
 
 # The same as copy-file-to-target, but use the local
@@ -2697,7 +2692,7 @@
 define copy-file-to-target-with-cp
 @mkdir -p $(dir $@)
 $(hide) rm -f $@
-$(hide) cp -p $< $@
+$(hide) cp -p "$<" "$@"
 endef
 
 # The same as copy-file-to-target, but strip out "# comment"-style
@@ -2788,6 +2783,12 @@
 ###########################################################
 ## Commands to call Proguard
 ###########################################################
+ifeq ($(EXPERIMENTAL_USE_OPENJDK9),true)
+define transform-jar-to-proguard
+@echo Skipping Proguard: $<$(PRIVATE_PROGUARD_INJAR_FILTERS) $@
+$(hide) cp '$<' $@
+endef
+else
 define transform-jar-to-proguard
 @echo Proguard: $@
 $(hide) $(PROGUARD) -injars '$<$(PRIVATE_PROGUARD_INJAR_FILTERS)' \
@@ -2795,6 +2796,21 @@
     $(PRIVATE_PROGUARD_FLAGS) \
     $(addprefix -injars , $(PRIVATE_EXTRA_INPUT_JAR))
 endef
+endif
+
+
+###########################################################
+## Commands to call R8
+###########################################################
+define transform-jar-to-dex-r8
+@echo R8: $@
+$(hide) $(JAVA) -jar $(R8_COMPAT_PROGUARD_JAR) -injars '$<$(PRIVATE_PROGUARD_INJAR_FILTERS)' \
+    --min-api $(PRIVATE_MIN_SDK_VERSION) \
+    --force-proguard-compatibility --output $(subst classes.dex,,$@) \
+    $(PRIVATE_PROGUARD_FLAGS) \
+    $(addprefix -injars , $(PRIVATE_EXTRA_INPUT_JAR)) \
+    $(PRIVATE_DX_FLAGS)
+endef
 
 ###########################################################
 ## Stuff source generated from one-off tools
@@ -2823,7 +2839,7 @@
   size=$$(for i in $(1); do $(call get-file-size,$$i); echo +; done; echo 0); \
   total=$$(( $$( echo "$$size" ) )); \
   printname=$$(echo -n "$(1)" | tr " " +); \
-  maxsize=$(2); \
+  maxsize=$$(($(2))); \
   if [ "$$total" -gt "$$maxsize" ]; then \
     echo "error: $$printname too large ($$total > $$maxsize)"; \
     false; \
@@ -3184,6 +3200,98 @@
 endif
 
 ###########################################################
+## Given a filepath, returns nonempty if the path cannot be
+## validated to be contained in the current directory
+## This is, this function checks for '/' and '..'
+##
+## $(1): path to validate
+define try-validate-path-is-subdir
+$(strip 
+    $(if $(filter /%,$(1)),
+        $(1) starts with a slash
+    )
+    $(if $(filter ../%,$(call clean-path,$(1))),
+        $(1) escapes its parent using '..'
+    )
+    $(if $(strip $(1)),
+    ,
+        '$(1)' is empty
+    )
+)
+endef
+
+define validate-path-is-subdir
+$(if $(call try-validate-path-is-subdir,$(1)),
+  $(call pretty-error, Illegal path: $(call try-validate-path-is-subdir,$(1)))
+)
+endef
+
+###########################################################
+## Given a space-delimited list of filepaths, returns
+## nonempty if any cannot be validated to be contained in
+## the current directory
+##
+## $(1): path list to validate
+define try-validate-paths-are-subdirs
+$(strip \
+  $(foreach my_path,$(1),\
+    $(call try-validate-path-is-subdir,$(my_path))\
+  )
+)
+endef
+
+define validate-paths-are-subdirs
+$(if $(call try-validate-paths-are-subdirs,$(1)),
+    $(call pretty-error,Illegal paths:\'$(call try-validate-paths-are-subdirs,$(1))\')
+)
+endef
+
+###########################################################
+## Tests of try-validate-path-is-subdir
+##     and  try-validate-paths-are-subdirs
+define test-validate-paths-are-subdirs
+$(eval my_error := $(call try-validate-path-is-subdir,/tmp)) \
+$(if $(call streq,$(my_error),/tmp starts with a slash),
+,
+  $(error incorrect error message for path /tmp. Got '$(my_error)')
+) \
+$(eval my_error := $(call try-validate-path-is-subdir,../sibling)) \
+$(if $(call streq,$(my_error),../sibling escapes its parent using '..'),
+,
+  $(error incorrect error message for path ../sibling. Got '$(my_error)')
+) \
+$(eval my_error := $(call try-validate-path-is-subdir,child/../../sibling)) \
+$(if $(call streq,$(my_error),child/../../sibling escapes its parent using '..'),
+,
+  $(error incorrect error message for path child/../../sibling. Got '$(my_error)')
+) \
+$(eval my_error := $(call try-validate-path-is-subdir,)) \
+$(if $(call streq,$(my_error),'' is empty),
+,
+  $(error incorrect error message for empty path ''. Got '$(my_error)')
+) \
+$(eval my_error := $(call try-validate-path-is-subdir,subdir/subsubdir)) \
+$(if $(call streq,$(my_error),),
+,
+  $(error rejected valid path 'subdir/subsubdir'. Got '$(my_error)')
+)
+
+$(eval my_error := $(call try-validate-paths-are-subdirs,a/b /c/d e/f))
+$(if $(call streq,$(my_error),/c/d starts with a slash),
+,
+  $(error incorrect error message for path list 'a/b /c/d e/f'. Got '$(my_error)')
+)
+$(eval my_error := $(call try-validate-paths-are-subdirs,a/b c/d))
+$(if $(call streq,$(my_error),),
+,
+  $(error rejected valid path list 'a/b c/d'. Got '$(my_error)')
+)
+endef
+# run test
+$(strip $(call test-validate-paths-are-subdirs))
+
+
+###########################################################
 ## Other includes
 ###########################################################
 
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index 9616036..79e72c1 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -11,10 +11,6 @@
 DEX2OAT := $(HOST_OUT_EXECUTABLES)/dex2oatd$(HOST_EXECUTABLE_SUFFIX)
 endif
 
-# Pass special class loader context to skip the classpath and collision check.
-# Should modify build system to pass used libraries properly later.
-DEX2OAT_CLASS_LOADER_CONTEXT := "&"
-
 DEX2OAT_DEPENDENCY += $(DEX2OAT)
 
 # Use the first preloaded-classes file in PRODUCT_COPY_FILES.
@@ -30,7 +26,9 @@
     $(filter %system/etc/dirty-image-objects,$(PRODUCT_COPY_FILES))))
 
 define get-product-default-property
-$(strip $(patsubst $(1)=%,%,$(filter $(1)=%,$(PRODUCT_DEFAULT_PROPERTY_OVERRIDES))))
+$(strip \
+  $(eval _prop := $(patsubst $(1)=%,%,$(filter $(1)=%,$(PRODUCT_DEFAULT_PROPERTY_OVERRIDES))))\
+  $(if $(_prop),$(_prop),$(patsubst $(1)=%,%,$(filter $(1)=%,$(PRODUCT_SYSTEM_DEFAULT_PROPERTIES)))))
 endef
 
 DEX2OAT_IMAGE_XMS := $(call get-product-default-property,dalvik.vm.image-dex2oat-Xms)
@@ -150,7 +148,7 @@
 $(hide) mkdir -p $(dir $(2))
 $(hide) ANDROID_LOG_TAGS="*:e" $(DEX2OAT) \
 	--runtime-arg -Xms$(DEX2OAT_XMS) --runtime-arg -Xmx$(DEX2OAT_XMX) \
-	--class-loader-context=$(DEX2OAT_CLASS_LOADER_CONTEXT) \
+	--class-loader-context=$(PRIVATE_DEX2OAT_CLASS_LOADER_CONTEXT) \
 	--boot-image=$(PRIVATE_DEX_PREOPT_IMAGE_LOCATION) \
 	--dex-file=$(1) \
 	--dex-location=$(PRIVATE_DEX_LOCATION) \
diff --git a/core/dpi_specific_apk.mk b/core/dpi_specific_apk.mk
index 18c8d6e..ac5c4a9 100644
--- a/core/dpi_specific_apk.mk
+++ b/core/dpi_specific_apk.mk
@@ -9,7 +9,7 @@
 
 # Set up all the target-specific variables.
 $(built_dpi_apk): PRIVATE_MODULE := $(dpi_apk_name)
-$(built_dpi_apk): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) $(PRODUCT_AAPT_FLAGS) $($(LOCAL_PACKAGE_NAME)_aapt_flags_$(my_dpi))
+$(built_dpi_apk): PRIVATE_AAPT_FLAGS := $(LOCAL_AAPT_FLAGS) --pseudo-localize $($(LOCAL_PACKAGE_NAME)_aapt_flags_$(my_dpi))
 # Clear PRIVATE_PRODUCT_AAPT_CONFIG to include everything by default.
 $(built_dpi_apk): PRIVATE_PRODUCT_AAPT_CONFIG :=
 $(built_dpi_apk): PRIVATE_PRODUCT_AAPT_PREF_CONFIG := $(my_dpi)
diff --git a/core/dumpvar.mk b/core/dumpvar.mk
index acae48e..59efb04 100644
--- a/core/dumpvar.mk
+++ b/core/dumpvar.mk
@@ -1,37 +1,3 @@
-
-# List of variables we want to print in the build banner.
-print_build_config_vars := \
-  PLATFORM_VERSION_CODENAME \
-  PLATFORM_VERSION \
-  TARGET_PRODUCT \
-  TARGET_BUILD_VARIANT \
-  TARGET_BUILD_TYPE \
-  TARGET_PLATFORM_VERSION \
-  TARGET_BUILD_APPS \
-  TARGET_ARCH \
-  TARGET_ARCH_VARIANT \
-  TARGET_CPU_VARIANT \
-  TARGET_2ND_ARCH \
-  TARGET_2ND_ARCH_VARIANT \
-  TARGET_2ND_CPU_VARIANT \
-  HOST_ARCH \
-  HOST_2ND_ARCH \
-  HOST_OS \
-  HOST_OS_EXTRA \
-  HOST_CROSS_OS \
-  HOST_CROSS_ARCH \
-  HOST_CROSS_2ND_ARCH \
-  HOST_BUILD_TYPE \
-  BUILD_ID \
-  OUT_DIR \
-  AUX_OS_VARIANT_LIST
-
-ifeq ($(TARGET_BUILD_PDK),true)
-print_build_config_vars += \
-  TARGET_BUILD_PDK \
-  PDK_FUSION_PLATFORM_ZIP
-endif
-
 # ---------------------------------------------------------------
 # the setpath shell function in envsetup.sh uses this to figure out
 # what to add to the path given the config we have chosen.
@@ -52,79 +18,14 @@
 ANDROID_PREBUILTS := prebuilt/$(HOST_PREBUILT_TAG)
 ANDROID_GCC_PREBUILTS := prebuilts/gcc/$(HOST_PREBUILT_TAG)
 
-# The "dumpvar" stuff lets you say something like
-#
-#     CALLED_FROM_SETUP=true \
-#       make -f config/envsetup.make dumpvar-TARGET_OUT
-# or
-#     CALLED_FROM_SETUP=true \
-#       make -f config/envsetup.make dumpvar-abs-HOST_OUT_EXECUTABLES
-#
-# The plain (non-abs) version just dumps the value of the named variable.
-# The "abs" version will treat the variable as a path, and dumps an
-# absolute path to it.
-#
-dumpvar_goals := \
-	$(strip $(patsubst dumpvar-%,%,$(filter dumpvar-%,$(MAKECMDGOALS))))
-ifdef dumpvar_goals
-
-  ifneq ($(words $(dumpvar_goals)),1)
-    $(error Only one "dumpvar-" goal allowed. Saw "$(MAKECMDGOALS)")
-  endif
-
-  # If the goal is of the form "dumpvar-abs-VARNAME", then
-  # treat VARNAME as a path and return the absolute path to it.
-  absolute_dumpvar := $(strip $(filter abs-%,$(dumpvar_goals)))
-  ifdef absolute_dumpvar
-    dumpvar_goals := $(patsubst abs-%,%,$(dumpvar_goals))
-    DUMPVAR_VALUE := $(abspath $($(dumpvar_goals)))
-    dumpvar_target := dumpvar-abs-$(dumpvar_goals)
-  else
-    DUMPVAR_VALUE := $($(dumpvar_goals))
-    dumpvar_target := dumpvar-$(dumpvar_goals)
-  endif
-
-.PHONY: $(dumpvar_target)
-$(dumpvar_target):
-	@echo $(DUMPVAR_VALUE)
-
-endif # dumpvar_goals
-
-ifneq ($(dumpvar_goals),report_config)
-PRINT_BUILD_CONFIG:=
-endif
-
-ifneq ($(filter report_config,$(DUMP_MANY_VARS)),)
-# Construct the shell commands that print the config banner.
-report_config_sh := echo '============================================';
-report_config_sh += $(foreach v,$(print_build_config_vars),echo '$v=$($(v))';)
-report_config_sh += echo '============================================';
-endif
-
 # Dump mulitple variables to "<var>=<value>" pairs, one per line.
 # The output may be executed as bash script.
 # Input variables:
 #   DUMP_MANY_VARS: the list of variable names.
 #   DUMP_VAR_PREFIX: an optional prefix of the variable name added to the output.
-#   DUMP_MANY_ABS_VARS: the list of abs variable names.
-#   DUMP_ABS_VAR_PREFIX: an optional prefix of the abs variable name added to the output.
 .PHONY: dump-many-vars
 dump-many-vars :
-	@$(foreach v, $(filter-out report_config, $(DUMP_MANY_VARS)),\
+	@$(foreach v, $(DUMP_MANY_VARS),\
 	  echo "$(DUMP_VAR_PREFIX)$(v)='$($(v))'";)
-ifneq ($(filter report_config, $(DUMP_MANY_VARS)),)
-	@# Construct a special variable for report_config.
-	@# Escape \` to defer the execution of report_config_sh to preserve the line breaks.
-	@echo "$(DUMP_VAR_PREFIX)report_config=\`$(report_config_sh)\`"
-endif
-	@$(foreach v, $(sort $(DUMP_MANY_ABS_VARS)),\
-	  echo "$(DUMP_ABS_VAR_PREFIX)$(v)='$(abspath $($(v)))'";)
 
 endif # CALLED_FROM_SETUP
-
-ifneq ($(PRINT_BUILD_CONFIG),)
-$(info ============================================)
-$(foreach v, $(print_build_config_vars),\
-  $(info $v=$($(v))))
-$(info ============================================)
-endif
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 8749a32..ddf903c 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -124,11 +124,13 @@
 HOST_CROSS_OS :=
 # We can cross-build Windows binaries on Linux
 ifeq ($(HOST_OS),linux)
+ifeq ($(BUILD_HOST_static),)
 HOST_CROSS_OS := windows
 HOST_CROSS_ARCH := x86
 HOST_CROSS_2ND_ARCH := x86_64
 2ND_HOST_CROSS_IS_64_BIT := true
 endif
+endif
 
 ifeq ($(HOST_OS),)
 $(error Unable to determine HOST_OS from uname -sm: $(UNAME)!)
diff --git a/core/executable_internal.mk b/core/executable_internal.mk
index 3509bd2..0aec275 100644
--- a/core/executable_internal.mk
+++ b/core/executable_internal.mk
@@ -76,4 +76,39 @@
 	$(PRIVATE_POST_LINK_CMD)
 endif
 
+ifeq ($(my_native_coverage),true)
+gcno_suffix := .gcnodir
+
+built_whole_gcno_libraries := \
+    $(foreach lib,$(my_whole_static_libraries), \
+      $(call intermediates-dir-for, \
+        STATIC_LIBRARIES,$(lib),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX), \
+        $(my_host_cross))/$(lib)$(gcno_suffix))
+
+built_static_gcno_libraries := \
+    $(foreach lib,$(my_static_libraries), \
+      $(call intermediates-dir-for, \
+        STATIC_LIBRARIES,$(lib),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX), \
+        $(my_host_cross))/$(lib)$(gcno_suffix))
+
+ifdef LOCAL_IS_HOST_MODULE
+my_coverage_path := $($(my_prefix)OUT_COVERAGE)/$(patsubst $($(my_prefix)OUT)/%,%,$(my_module_path))
+else
+my_coverage_path := $(TARGET_OUT_COVERAGE)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
+endif
+
+GCNO_ARCHIVE := $(my_installed_module_stem)$(gcno_suffix)
+
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_OBJECTS := $(strip $(LOCAL_GCNO_FILES))
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_WHOLE_STATIC_LIBRARIES := $(strip $(built_whole_gcno_libraries)) $(strip $(built_static_gcno_libraries))
+$(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_INTERMEDIATES_DIR := $(intermediates)
+$(intermediates)/$(GCNO_ARCHIVE) : $(LOCAL_GCNO_FILES) $(built_whole_gcno_libraries) $(built_static_gcno_libraries)
+	$(transform-o-to-static-lib)
+
+$(my_coverage_path)/$(GCNO_ARCHIVE) : $(intermediates)/$(GCNO_ARCHIVE)
+	$(copy-file-to-target)
+
+$(LOCAL_BUILT_MODULE): $(my_coverage_path)/$(GCNO_ARCHIVE)
+endif
+
 endif  # skip_build_from_source
diff --git a/core/host_dalvik_java_library.mk b/core/host_dalvik_java_library.mk
index 4bfe288..a522f0b 100644
--- a/core/host_dalvik_java_library.mk
+++ b/core/host_dalvik_java_library.mk
@@ -28,10 +28,6 @@
 include $(BUILD_SYSTEM)/host_java_library_common.mk
 #######################################
 
-ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
-  LOCAL_JAVA_LIBRARIES :=  core-oj-hostdex core-libart-hostdex $(LOCAL_JAVA_LIBRARIES)
-endif
-
 full_classes_turbine_jar := $(intermediates.COMMON)/classes-turbine.jar
 full_classes_header_jarjar := $(intermediates.COMMON)/classes-header-jarjar.jar
 full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index c9499ea..9bead3f 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -122,6 +122,6 @@
 $(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
 $(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
 
-ifneq ($(TURBINE_DISABLED),false)
+ifeq ($(TURBINE_ENABLED),false)
 $(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_header_jar)))
 endif
diff --git a/core/jacoco.mk b/core/jacoco.mk
index 8915443..9e6fd07 100644
--- a/core/jacoco.mk
+++ b/core/jacoco.mk
@@ -39,24 +39,21 @@
     my_include_args :=
   endif
 
-  # replace '.' with '/' and ',' with ' ', and quote each arg
+  # replace '.' with '/' and ',' with ' '
   ifneq ($(strip $(my_exclude_filter)),)
     my_exclude_args := $(my_exclude_filter)
 
     my_exclude_args := $(subst .,/,$(my_exclude_args))
     my_exclude_args := $(subst $(comma)$(comma),$(comma),$(my_exclude_args))
-    my_exclude_args := '$(subst $(comma),' ', $(my_exclude_args))'
+    my_exclude_args := $(subst $(comma), ,$(my_exclude_args))
   else
     my_exclude_args :=
   endif
-endif # LOCAL_EMMA_INSTRUMENT == true
-
-# determine whether to run the instrumenter based on whether there is any work
-# for it to do
-ifneq ($(my_include_filter),)
 
   my_files := $(intermediates.COMMON)/jacoco
 
+  $(call validate-paths-are-subdirs,$(my_exclude_args))
+
   # make a task that unzips the classes that we want to instrument from the
   # input jar
   my_unzipped_path := $(my_files)/work/classes-to-instrument/classes
@@ -72,7 +69,8 @@
 	unzip -q $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) \
 	  -d $(PRIVATE_UNZIPPED_PATH) \
 	  $(PRIVATE_INCLUDE_ARGS)
-	rm -rf $(PRIVATE_EXCLUDE_ARGS)
+	(cd $(PRIVATE_UNZIPPED_PATH) && rm -rf $(PRIVATE_EXCLUDE_ARGS))
+	(cd $(PRIVATE_UNZIPPED_PATH) && find -not -name "*.class" -type f | xargs --no-run-if-empty rm)
 	touch $(PRIVATE_UNZIPPED_TIMESTAMP_PATH)
 # Unfortunately in the previous task above,
 # 'rm -rf $(PRIVATE_EXCLUDE_ARGS)' needs to be a separate
@@ -132,8 +130,8 @@
   # dependency.
 $(LOCAL_FULL_CLASSES_JACOCO_JAR): $(my_classes_to_report_on_path)
 
-else # my_include_filter == ''
+else # LOCAL_EMMA_INSTRUMENT != true
   LOCAL_FULL_CLASSES_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
-endif # my_include_filter != ''
+endif # LOCAL_EMMA_INSTRUMENT == true
 
 LOCAL_INTERMEDIATE_TARGETS += $(LOCAL_FULL_CLASSES_JACOCO_JAR)
diff --git a/core/java.mk b/core/java.mk
index 006a660..717e02d 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -18,25 +18,6 @@
 LOCAL_NO_STANDARD_LIBRARIES:=$(strip $(LOCAL_NO_STANDARD_LIBRARIES))
 LOCAL_SDK_VERSION:=$(strip $(LOCAL_SDK_VERSION))
 
-ifneq ($(LOCAL_MODULE),jacocoagent)
-  ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
-    ifeq ($(EMMA_INSTRUMENT),true)
-      ifneq ($(EMMA_INSTRUMENT_STATIC),true)
-        # For instrumented build, if Jacoco is not being included statically
-        # in instrumented packages then include Jacoco classes into the
-        # bootclasspath.
-        LOCAL_JAVA_LIBRARIES := jacocoagent $(LOCAL_JAVA_LIBRARIES)
-      endif # EMMA_INSTRUMENT_STATIC
-    endif # EMMA_INSTRUMENT
-  endif # !LOCAL_NO_STANDARD_LIBRARIES
-endif # LOCAL_MODULE == jacocoagent
-
-ifndef LOCAL_SDK_VERSION
-  ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
-    LOCAL_JAVA_LIBRARIES := $(TARGET_DEFAULT_JAVA_LIBRARIES) $(LOCAL_JAVA_LIBRARIES)
-  endif
-endif
-
 proto_sources := $(filter %.proto,$(LOCAL_SRC_FILES))
 ifneq ($(proto_sources),)
 ifeq ($(LOCAL_PROTOC_OPTIMIZE_TYPE),micro)
@@ -587,6 +568,10 @@
 
 $(eval $(call copy-one-file,$(full_classes_jarjar_jar),$(full_classes_jar)))
 
+ifeq ($(EXPERIMENTAL_USE_OPENJDK9),true)
+LOCAL_DX_FLAGS := $(filter-out --multi-dex,$(LOCAL_DX_FLAGS)) --multi-dex
+endif
+
 my_desugaring :=
 ifndef LOCAL_IS_STATIC_JAVA_LIBRARY
 my_desugaring := true
@@ -618,33 +603,33 @@
 endif
 proguard_dictionary := $(intermediates.COMMON)/proguard_dictionary
 
-# Hack: see b/20667396
-# When an app's LOCAL_SDK_VERSION is lower than the support library's LOCAL_SDK_VERSION,
-# we artifically raises the "SDK version" "linked" by ProGuard, to
+# When an app contains references to APIs that are not in the SDK specified by
+# its LOCAL_SDK_VERSION for example added by support library or by runtime 
+# classes added by desugar, we artifically raise the "SDK version" "linked" by
+# ProGuard, to
 # - suppress ProGuard warnings of referencing symbols unknown to the lower SDK version.
 # - prevent ProGuard stripping subclass in the support library that extends class added in the higher SDK version.
-my_support_library_sdk_raise :=
-ifneq (,$(filter android-support-%,$(LOCAL_STATIC_JAVA_LIBRARIES)))
+# See b/20667396
+my_proguard_sdk_raise :=
 ifdef LOCAL_SDK_VERSION
 ifdef TARGET_BUILD_APPS
 ifeq (,$(filter current system_current test_current, $(LOCAL_SDK_VERSION)))
-  my_support_library_sdk_raise := $(call java-lib-header-files, sdk_vcurrent)
+  my_proguard_sdk_raise := $(call java-lib-header-files, sdk_vcurrent)
 endif
 else
   # For platform build, we can't just raise to the "current" SDK,
   # that would break apps that use APIs removed from the current SDK.
-  my_support_library_sdk_raise := $(call java-lib-header-files,$(TARGET_DEFAULT_BOOTCLASSPATH_LIBRARIES) $(TARGET_DEFAULT_JAVA_LIBRARIES))
-endif
+  my_proguard_sdk_raise := $(call java-lib-header-files,$(TARGET_DEFAULT_BOOTCLASSPATH_LIBRARIES) $(TARGET_DEFAULT_JAVA_LIBRARIES))
 endif
 endif
 
-legacy_proguard_flags := $(addprefix -libraryjars ,$(my_support_library_sdk_raise) \
-  $(filter-out $(my_support_library_sdk_raise), \
+legacy_proguard_flags := $(addprefix -libraryjars ,$(my_proguard_sdk_raise) \
+  $(filter-out $(my_proguard_sdk_raise), \
     $(full_java_bootclasspath_libs) \
     $(full_shared_java_header_libs)))
 
-legacy_proguard_lib_deps := $(my_support_library_sdk_raise) \
-  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_header_libs))
+legacy_proguard_lib_deps := $(my_proguard_sdk_raise) \
+  $(filter-out $(my_proguard_sdk_raise),$(full_shared_java_header_libs))
 
 legacy_proguard_flags += -printmapping $(proguard_dictionary)
 
@@ -707,6 +692,9 @@
 endif  # LOCAL_PROGUARD_ENABLED is not nosystem
 
 proguard_flag_files := $(addprefix $(LOCAL_PATH)/, $(LOCAL_PROGUARD_FLAG_FILES))
+ifeq ($(USE_R8),true)
+proguard_flag_files += $(addprefix $(LOCAL_PATH)/, $(LOCAL_R8_FLAG_FILES))
+endif # USE_R8
 LOCAL_PROGUARD_FLAGS += $(addprefix -include , $(proguard_flag_files))
 
 ifdef LOCAL_TEST_MODULE_TO_PROGUARD_WITH
@@ -729,15 +717,29 @@
 endif
 
 ifneq ($(filter obfuscation,$(LOCAL_PROGUARD_ENABLED)),)
+ifneq ($(USE_R8),true)
   $(full_classes_proguard_jar): .KATI_IMPLICIT_OUTPUTS := $(proguard_dictionary)
+else
+  $(built_dex_intermediate): .KATI_IMPLICIT_OUTPUTS := $(proguard_dictionary)
 endif
+endif
+
+# If R8 is not enabled run Proguard.
+ifneq ($(USE_R8),true)
+# Changes to these dependencies need to be replicated below when using R8
+# instead of Proguard + dx.
 $(full_classes_proguard_jar): PRIVATE_PROGUARD_INJAR_FILTERS := $(proguard_injar_filters)
 $(full_classes_proguard_jar): PRIVATE_EXTRA_INPUT_JAR := $(extra_input_jar)
 $(full_classes_proguard_jar): PRIVATE_PROGUARD_FLAGS := $(legacy_proguard_flags) $(common_proguard_flags) $(LOCAL_PROGUARD_FLAGS)
-$(full_classes_proguard_jar) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_support_library_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) $(legacy_proguard_lib_deps) | $(PROGUARD)
+$(full_classes_proguard_jar) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_proguard_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) $(legacy_proguard_lib_deps) | $(PROGUARD)
 	$(call transform-jar-to-proguard)
+else # !USE_R8
+# Running R8 instead of Proguard, proguarded jar is actually the pre-Proguarded jar.
+full_classes_proguard_jar := $(full_classes_pre_proguard_jar)
+endif # !USE_R8
 
 else  # LOCAL_PROGUARD_ENABLED not defined
+proguard_flag_files :=
 full_classes_proguard_jar := $(full_classes_pre_proguard_jar)
 endif # LOCAL_PROGUARD_ENABLED defined
 
@@ -752,8 +754,26 @@
 ifeq ($(LOCAL_EMMA_INSTRUMENT),true)
 $(built_dex_intermediate): PRIVATE_DX_FLAGS += --no-locals
 endif
+
+my_r8 :=
+ifdef LOCAL_PROGUARD_ENABLED
+ifeq ($(USE_R8),true)
+# These are the dependencies for the proguarded jar when running
+# Proguard + dx. They are used for the generated dex when using R8, as
+# R8 does Proguard + dx
+my_r8 := true
+$(built_dex_intermediate): PRIVATE_PROGUARD_INJAR_FILTERS := $(proguard_injar_filters)
+$(built_dex_intermediate): PRIVATE_EXTRA_INPUT_JAR := $(extra_input_jar)
+$(built_dex_intermediate): PRIVATE_PROGUARD_FLAGS := $(legacy_proguard_flags) $(common_proguard_flags) $(LOCAL_PROGUARD_FLAGS)
+$(built_dex_intermediate) : $(full_classes_proguard_jar) $(extra_input_jar) $(my_support_library_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) $(legacy_proguard_lib_deps) $(R8_COMPAT_PROGUARD_JAR)
+	$(transform-jar-to-dex-r8)
+endif # USE_R8
+endif # LOCAL_PROGUARD_ENABLED
+
+ifndef my_r8
 $(built_dex_intermediate): $(full_classes_proguard_jar) $(DX)
 	$(transform-classes.jar-to-dex)
+endif
 
 $(built_dex): $(built_dex_intermediate)
 	@echo Copying: $@
diff --git a/core/java_common.mk b/core/java_common.mk
index a73c6db..37de700 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -200,8 +200,6 @@
 empty_bootclasspath :=
 my_system_modules :=
 
-# full_java_libs: The list of files that should be used as the classpath.
-#                 Using this list as a dependency list WILL NOT WORK.
 ifndef LOCAL_IS_HOST_MODULE
   ifeq ($(LOCAL_SDK_VERSION),)
     ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
@@ -212,7 +210,8 @@
       # now, so just always assume that they want the default system modules
       my_system_modules := $(DEFAULT_SYSTEM_MODULES)
     else  # LOCAL_NO_STANDARD_LIBRARIES
-      full_java_bootclasspath_libs := $(call java-lib-header-files,$(TARGET_DEFAULT_BOOTCLASSPATH_LIBRARIES))
+      full_java_bootclasspath_libs := $(call java-lib-header-files,$(TARGET_DEFAULT_BOOTCLASSPATH_LIBRARIES) $(TARGET_DEFAULT_JAVA_LIBRARIES))
+      LOCAL_JAVA_LIBRARIES := $(filter-out $(TARGET_DEFAULT_BOOTCLASSPATH_LIBRARIES) $(TARGET_DEFAULT_JAVA_LIBRARIES),$(LOCAL_JAVA_LIBRARIES))
       my_system_modules := $(DEFAULT_SYSTEM_MODULES)
     endif  # LOCAL_NO_STANDARD_LIBRARIES
   else
@@ -235,6 +234,19 @@
     endif # current, system_current, or test_current
   endif # LOCAL_SDK_VERSION
 
+  ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+    ifneq ($(LOCAL_MODULE),jacocoagent)
+      ifeq ($(EMMA_INSTRUMENT),true)
+        ifneq ($(EMMA_INSTRUMENT_STATIC),true)
+          # For instrumented build, if Jacoco is not being included statically
+          # in instrumented packages then include Jacoco classes into the
+          # bootclasspath.
+          full_java_bootclasspath_libs += $(call java-lib-header-files,jacocoagent)
+        endif # EMMA_INSTRUMENT_STATIC
+      endif # EMMA_INSTRUMENT
+    endif # LOCAL_MODULE == jacocoagent
+  endif # LOCAL_NO_STANDARD_LIBRARIES
+
   # In order to compile lambda code javac requires various invokedynamic-
   # related classes to be present. This change adds stubs needed for
   # javac to compile lambdas.
@@ -265,6 +277,7 @@
 
     full_shared_java_libs := $(addprefix $(HOST_OUT_JAVA_LIBRARIES)/,\
       $(addsuffix $(COMMON_JAVA_PACKAGE_SUFFIX),$(LOCAL_JAVA_LIBRARIES)))
+    full_shared_java_header_libs := $(full_shared_java_libs)
   endif # USE_CORE_LIB_BOOTCLASSPATH
 endif # !LOCAL_IS_HOST_MODULE
 
@@ -294,9 +307,6 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_EMPTY_BOOTCLASSPATH := $(empty_bootclasspath)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_SYSTEM_MODULES := $(my_system_modules_dir)
 
-full_java_libs := $(full_shared_java_libs) $(full_static_java_libs) $(LOCAL_CLASSPATH)
-full_java_header_libs := $(full_shared_java_header_libs) $(full_static_java_header_libs)
-
 ifndef LOCAL_IS_HOST_MODULE
 # This is set by packages that are linking to other packages that export
 # shared libraries, allowing them to make use of the code in the linked apk.
@@ -307,8 +317,7 @@
 
   # link against the jar with full original names (before proguard processing).
   full_shared_java_libs += $(link_apk_libraries)
-  full_java_libs += $(link_apk_libraries)
-  full_java_header_libs += $(link_apk_header_libs)
+  full_shared_java_header_libs += $(link_apk_header_libs)
 endif
 
 # This is set by packages that contain instrumentation, allowing them to
@@ -330,8 +339,8 @@
   else
     link_instr_classes_header_jar := $(link_instr_intermediates_dir.COMMON)/classes.jar
   endif
-  full_java_libs += $(link_instr_classes_jar)
-  full_java_header_libs += $(link_instr_classes_header_jar)
+  full_shared_java_libs += $(link_instr_classes_jar)
+  full_shared_java_header_libs += $(link_instr_classes_header_jar)
 endif  # LOCAL_INSTRUMENTATION_FOR
 endif  # LOCAL_IS_HOST_MODULE
 
@@ -378,8 +387,12 @@
 endif
 endif  # !LOCAL_IS_HOST_MODULE
 
+full_java_libs := $(full_shared_java_libs) $(full_static_java_libs) $(LOCAL_CLASSPATH)
+full_java_header_libs := $(full_shared_java_header_libs) $(full_static_java_header_libs)
+
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ALL_JAVA_LIBRARIES := $(full_java_libs)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ALL_JAVA_HEADER_LIBRARIES := $(full_java_header_libs)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_SHARED_JAVA_HEADER_LIBRARIES := $(full_shared_java_header_libs)
 
 ALL_MODULES.$(my_register_name).INTERMEDIATE_SOURCE_DIR := \
     $(ALL_MODULES.$(my_register_name).INTERMEDIATE_SOURCE_DIR) $(LOCAL_INTERMEDIATE_SOURCE_DIR)
diff --git a/core/java_library.mk b/core/java_library.mk
index 45512b8..e4916b8 100644
--- a/core/java_library.mk
+++ b/core/java_library.mk
@@ -64,12 +64,16 @@
 $(common_javalib.jar): PRIVATE_DEX_FILE := $(built_dex)
 $(common_javalib.jar): PRIVATE_SOURCE_ARCHIVE := $(full_classes_pre_proguard_jar)
 $(common_javalib.jar): PRIVATE_DONT_DELETE_JAR_DIRS := $(LOCAL_DONT_DELETE_JAR_DIRS)
-$(common_javalib.jar) : $(built_dex) $(java_resource_sources) | $(ZIPTIME)
+$(common_javalib.jar) : $(built_dex) $(java_resource_sources) | $(ZIPTIME) $(ZIPALIGN)
 	@echo "target Jar: $(PRIVATE_MODULE) ($@)"
 	$(call initialize-package-file,$(PRIVATE_SOURCE_ARCHIVE),$@.tmp)
 	$(call add-dex-to-package-arg,$@.tmp)
 	$(hide) $(ZIPTIME) $@.tmp
 	$(call commit-change-for-toc,$@)
+ifneq (,$(filter $(PRODUCT_LOADED_BY_PRIVILEGED_MODULES), $(LOCAL_MODULE)))
+	$(uncompress-dexs)
+	$(align-package)
+endif  # PRODUCT_LOADED_BY_PRIVILEGED_MODULES
 
 .KATI_RESTAT: $(common_javalib.jar)
 
diff --git a/core/main.mk b/core/main.mk
index 7f49006..90e365f 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -34,7 +34,7 @@
 TOP := .
 TOPDIR :=
 
-BUILD_SYSTEM := $(TOPDIR)build/core
+BUILD_SYSTEM := $(TOPDIR)build/make/core
 
 # This is the default target.  It must be the first declared target.
 .PHONY: droid
@@ -62,8 +62,6 @@
 $(shell mkdir -p $(OUT_DIR) && \
     echo -n $(BUILD_NUMBER) > $(OUT_DIR)/build_number.txt && \
     echo -n $(BUILD_DATETIME) > $(OUT_DIR)/build_date.txt)
-BUILD_NUMBER_FROM_FILE := $$(cat $(OUT_DIR)/build_number.txt)
-BUILD_DATETIME_FROM_FILE := $$(cat $(OUT_DIR)/build_date.txt)
 ifeq ($(HOST_OS),darwin)
 DATE_FROM_FILE := date -r $(BUILD_DATETIME_FROM_FILE)
 else
@@ -173,7 +171,7 @@
 
 # -----------------------------------------------------------------
 # The pdk (Platform Development Kit) build
-include build/core/pdk_config.mk
+include build/make/core/pdk_config.mk
 
 #
 # -----------------------------------------------------------------
@@ -940,7 +938,7 @@
       $(warning $(ALL_MODULES.$(m).MAKEFILE): Module '$(m)' in PRODUCT_PACKAGES_TESTS has nothing to install!)))
 endif
 
-# build/core/Makefile contains extra stuff that we don't want to pollute this
+# build/make/core/Makefile contains extra stuff that we don't want to pollute this
 # top-level makefile with.  It expects that ALL_DEFAULT_INSTALLED_MODULES
 # contains everything that's built during the current make, but it also further
 # extends ALL_DEFAULT_INSTALLED_MODULES.
diff --git a/core/no_java_path/jar b/core/no_java_path/jar
deleted file mode 120000
index 8586397..0000000
--- a/core/no_java_path/jar
+++ /dev/null
@@ -1 +0,0 @@
-java
\ No newline at end of file
diff --git a/core/no_java_path/jarsigner b/core/no_java_path/jarsigner
deleted file mode 120000
index 8586397..0000000
--- a/core/no_java_path/jarsigner
+++ /dev/null
@@ -1 +0,0 @@
-java
\ No newline at end of file
diff --git a/core/no_java_path/java b/core/no_java_path/java
deleted file mode 100755
index f3422f3..0000000
--- a/core/no_java_path/java
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/bash
-
-echo "Error: JAVA_NOT_REQUIRED=true, $(basename $0) is unavailable." 1>&2
-exit 1
diff --git a/core/no_java_path/javac b/core/no_java_path/javac
deleted file mode 120000
index 8586397..0000000
--- a/core/no_java_path/javac
+++ /dev/null
@@ -1 +0,0 @@
-java
\ No newline at end of file
diff --git a/core/no_java_path/keytool b/core/no_java_path/keytool
deleted file mode 120000
index 8586397..0000000
--- a/core/no_java_path/keytool
+++ /dev/null
@@ -1 +0,0 @@
-java
\ No newline at end of file
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 3a57f6c..0401699 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -377,7 +377,7 @@
 endif
 
 ifdef LOCAL_USE_AAPT2
-my_compiled_res_base_dir := $(intermediates)/flat-res
+my_compiled_res_base_dir := $(intermediates.COMMON)/flat-res
 renderscript_target_api :=
 ifneq (,$(LOCAL_RENDERSCRIPT_TARGET_API))
 renderscript_target_api := $(LOCAL_RENDERSCRIPT_TARGET_API)
@@ -572,7 +572,7 @@
 $(LOCAL_BUILT_MODULE) : $(my_res_package) $(AAPT2) | $(ACP)
 else
 $(LOCAL_BUILT_MODULE): PRIVATE_RESOURCE_LIST := $(all_res_assets)
-$(LOCAL_BUILT_MODULE) : $(all_res_assets) $(full_android_manifest) $(AAPT)
+$(LOCAL_BUILT_MODULE) : $(all_res_assets) $(full_android_manifest) $(AAPT) $(ZIPALIGN)
 endif
 ifdef LOCAL_COMPRESSED_MODULE
 $(LOCAL_BUILT_MODULE) : $(MINIGZIP)
@@ -613,6 +613,9 @@
 	$(call dexpreopt-remove-classes.dex,$@)
 endif
 endif
+ifneq (,$(filter $(PRODUCT_LOADED_BY_PRIVILEGED_MODULES), $(LOCAL_MODULE)))
+	$(uncompress-dexs)
+endif  # PRODUCT_LOADED_BY_PRIVILEGED_MODULES
 	$(sign-package)
 ifdef LOCAL_COMPRESSED_MODULE
 	$(compress-package)
diff --git a/core/pdk_config.mk b/core/pdk_config.mk
index 6ef8182..c2f8b0a 100644
--- a/core/pdk_config.mk
+++ b/core/pdk_config.mk
@@ -13,6 +13,9 @@
 # all paths under out dir
 PDK_PLATFORM_JAVA_ZIP_JAVA_TARGET_LIB_DIR += \
   target/common/obj/JAVA_LIBRARIES/android.test.runner_intermediates \
+  target/common/obj/JAVA_LIBRARIES/android.hidl.base-V1.0-java_intermediates \
+  target/common/obj/JAVA_LIBRARIES/android.hidl.base-V1.0-java-static_intermediates \
+  target/common/obj/JAVA_LIBRARIES/android.hidl.manager-V1.0-java_intermediates \
   target/common/obj/JAVA_LIBRARIES/android-common_intermediates \
   target/common/obj/JAVA_LIBRARIES/android-ex-camera2_intermediates \
   target/common/obj/JAVA_LIBRARIES/android_stubs_current_intermediates \
@@ -24,6 +27,7 @@
   target/common/obj/JAVA_LIBRARIES/legacy-android-test_intermediates \
   target/common/obj/JAVA_LIBRARIES/ext_intermediates \
   target/common/obj/JAVA_LIBRARIES/framework_intermediates \
+  target/common/obj/JAVA_LIBRARIES/hwbinder_intermediates \
   target/common/obj/JAVA_LIBRARIES/ims-common_intermediates \
   target/common/obj/JAVA_LIBRARIES/okhttp_intermediates \
   target/common/obj/JAVA_LIBRARIES/telephony-common_intermediates \
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index cc0d1f8..8be8ad6 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -391,6 +391,10 @@
 ifneq (true,$(DONT_UNCOMPRESS_PRIV_APPS_DEXS))
 ifeq (true,$(LOCAL_PRIVILEGED_MODULE))
 	$(uncompress-dexs)
+else
+  ifneq (,$(filter $(PRODUCT_LOADED_BY_PRIVILEGED_MODULES), $(LOCAL_MODULE)))
+	  $(uncompress-dexs)
+  endif  # PRODUCT_LOADED_BY_PRIVILEGED_MODULES
 endif  # LOCAL_PRIVILEGED_MODULE
 endif  # DONT_UNCOMPRESS_PRIV_APPS_DEXS
 ifdef LOCAL_DEX_PREOPT
diff --git a/core/product-graph.mk b/core/product-graph.mk
index 36e9037..268688a 100644
--- a/core/product-graph.mk
+++ b/core/product-graph.mk
@@ -34,7 +34,7 @@
 endef
 
 
-this_makefile := build/core/product-graph.mk
+this_makefile := build/make/core/product-graph.mk
 
 products_svg := $(OUT_DIR)/products.svg
 products_pdf := $(OUT_DIR)/products.pdf
@@ -103,6 +103,7 @@
 	$(hide) echo 'PRODUCT_MANUFACTURER=$$(PRODUCTS.$(strip $(1)).PRODUCT_MANUFACTURER)' >> $$@
 	$(hide) echo 'PRODUCT_PROPERTY_OVERRIDES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PROPERTY_OVERRIDES)' >> $$@
 	$(hide) echo 'PRODUCT_DEFAULT_PROPERTY_OVERRIDES=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_PROPERTY_OVERRIDES)' >> $$@
+	$(hide) echo 'PRODUCT_SYSTEM_DEFAULT_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SYSTEM_DEFAULT_PROPERTIES)' >> $$@
 	$(hide) echo 'PRODUCT_CHARACTERISTICS=$$(PRODUCTS.$(strip $(1)).PRODUCT_CHARACTERISTICS)' >> $$@
 	$(hide) echo 'PRODUCT_COPY_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_COPY_FILES)' >> $$@
 	$(hide) echo 'PRODUCT_OTA_PUBLIC_KEYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_OTA_PUBLIC_KEYS)' >> $$@
diff --git a/core/product.mk b/core/product.mk
index 4682dac..c01a856 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -112,11 +112,13 @@
     PRODUCT_SUPPORTS_VERITY \
     PRODUCT_SUPPORTS_VERITY_FEC \
     PRODUCT_OEM_PROPERTIES \
+    PRODUCT_SYSTEM_DEFAULT_PROPERTIES \
     PRODUCT_SYSTEM_PROPERTY_BLACKLIST \
     PRODUCT_SYSTEM_SERVER_APPS \
     PRODUCT_SYSTEM_SERVER_JARS \
     PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK \
     PRODUCT_DEXPREOPT_SPEED_APPS \
+    PRODUCT_LOADED_BY_PRIVILEGED_MODULES \
     PRODUCT_VBOOT_SIGNING_KEY \
     PRODUCT_VBOOT_SIGNING_SUBKEY \
     PRODUCT_VERITY_SIGNING_KEY \
@@ -143,8 +145,9 @@
     PRODUCT_SYSTEM_HEADROOM \
     PRODUCT_MINIMIZE_JAVA_DEBUG_INFO \
     PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS \
-
-
+    PRODUCT_ADB_KEYS \
+    PRODUCT_CFI_INCLUDE_PATHS \
+    PRODUCT_CFI_EXCLUDE_PATHS \
 
 define dump-product
 $(info ==== $(1) ====)\
diff --git a/core/product_config.mk b/core/product_config.mk
index be5ec54..4e2d5ae 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -151,6 +151,13 @@
 endif # unbundled_goals
 endif
 
+# Now that we've parsed APP-* and PRODUCT-*, mark these as readonly
+TARGET_BUILD_APPS ?=
+.KATI_READONLY := \
+  TARGET_PRODUCT \
+  TARGET_BUILD_VARIANT \
+  TARGET_BUILD_APPS
+
 # Default to building dalvikvm on hosts that support it...
 ifeq ($(HOST_OS),linux)
 # ... or if the if the option is already set
@@ -259,6 +266,7 @@
 PRODUCT_SYSTEM_SERVER_JARS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_JARS))
 PRODUCT_SYSTEM_SERVER_APPS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_APPS))
 PRODUCT_DEXPREOPT_SPEED_APPS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEXPREOPT_SPEED_APPS))
+PRODUCT_LOADED_BY_PRIVILEGED_MODULES := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_LOADED_BY_PRIVILEGED_MODULES))
 
 # All of the apps that we force preopt, this overrides WITH_DEXPREOPT.
 PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK))
@@ -295,15 +303,6 @@
 PRODUCT_AAPT_CONFIG := \
     $(subst $(space),$(comma),$(strip $(PRODUCT_AAPT_CONFIG)))
 
-# product-scoped aapt flags
-PRODUCT_AAPT_FLAGS :=
-PRODUCT_AAPT2_CFLAGS :=
-ifneq ($(filter en_XA ar_XB,$(PRODUCT_LOCALES)),)
-  # Force generating resources for pseudo-locales.
-  PRODUCT_AAPT2_CFLAGS += --pseudo-localize
-  PRODUCT_AAPT_FLAGS += --pseudo-localize
-endif
-
 PRODUCT_BRAND := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_BRAND))
 
 PRODUCT_MODEL := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MODEL))
@@ -339,7 +338,7 @@
 # The file at the source path should be copied to the destination path
 # when building  this product.  <destination path> is relative to
 # $(PRODUCT_OUT), so it should look like, e.g., "system/etc/file.xml".
-# The rules for these copy steps are defined in build/core/Makefile.
+# The rules for these copy steps are defined in build/make/core/Makefile.
 # The optional :<owner> is used to indicate the owner of a vendor file.
 PRODUCT_COPY_FILES := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_COPY_FILES))
@@ -359,6 +358,13 @@
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEFAULT_PROPERTY_OVERRIDES))
 .KATI_READONLY := PRODUCT_DEFAULT_PROPERTY_OVERRIDES
 
+# A list of property assignments, like "key = value", with zero or more
+# whitespace characters on either side of the '='.
+# used for adding properties to default.prop of system partition
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_DEFAULT_PROPERTIES))
+.KATI_READONLY := PRODUCT_SYSTEM_DEFAULT_PROPERTIES
+
 # Should we use the default resources or add any product specific overlays
 PRODUCT_PACKAGE_OVERLAYS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGE_OVERLAYS))
@@ -456,3 +462,21 @@
 # Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
 PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
+
+# ADB keys for debuggable builds
+PRODUCT_ADB_KEYS :=
+ifneq ($(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
+  PRODUCT_ADB_KEYS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ADB_KEYS))
+endif
+ifneq ($(filter-out 0 1,$(words $(PRODUCT_ADB_KEYS))),)
+  $(error Only one file may be in PRODUCT_ADB_KEYS: $(PRODUCT_ADB_KEYS))
+endif
+.KATI_READONLY := PRODUCT_ADB_KEYS
+
+# Whether any paths are excluded from sanitization when SANITIZE_TARGET=cfi
+PRODUCT_CFI_EXCLUDE_PATHS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CFI_EXCLUDE_PATHS))
+
+# Whether any paths should have CFI enabled for components
+PRODUCT_CFI_INCLUDE_PATHS := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CFI_INCLUDE_PATHS))
diff --git a/core/root.mk b/core/root.mk
index 6c8f795..1ef9aca 100644
--- a/core/root.mk
+++ b/core/root.mk
@@ -1,3 +1,3 @@
 ### DO NOT EDIT THIS FILE ###
-include build/core/main.mk
+include build/make/core/main.mk
 ### DO NOT EDIT THIS FILE ###
diff --git a/core/setup_one_odex.mk b/core/setup_one_odex.mk
index f0ffe81..e0d9926 100644
--- a/core/setup_one_odex.mk
+++ b/core/setup_one_odex.mk
@@ -32,6 +32,10 @@
     $(DEXPREOPT_ONE_FILE_DEPENDENCY_TOOLS) \
     $(my_dex_preopt_image_filename)
 
+# Pass special class loader context to skip the classpath and collision check.
+# Should modify build system to pass used libraries properly later.
+$(my_built_odex): PRIVATE_DEX2OAT_CLASS_LOADER_CONTEXT := \&
+
 my_installed_odex := $(call get-odex-installed-file-path,$($(my_2nd_arch_prefix)DEX2OAT_TARGET_ARCH),$(LOCAL_INSTALLED_MODULE))
 
 my_built_vdex := $(patsubst %.odex,%.vdex,$(my_built_odex))
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 629edfc..5ebd123 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -72,6 +72,17 @@
 $(call add_json_str,  CrossHostArch,                     $(HOST_CROSS_ARCH))
 $(call add_json_str,  CrossHostSecondaryArch,            $(HOST_CROSS_2ND_ARCH))
 
+$(call add_json_list, ResourceOverlays,                  $(PRODUCT_PACKAGE_OVERLAYS) $(DEVICE_PACKAGE_OVERLAYS))
+$(call add_json_list, EnforceRROTargets,                 $(PRODUCT_ENFORCE_RRO_TARGETS))
+$(call add_json_list, EnforceRROExcludedOverlays,        $(PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS))
+
+$(call add_json_str,  AAPTCharacteristics,               $(TARGET_AAPT_CHARACTERISTICS))
+$(call add_json_list, AAPTConfig,                        $(PRODUCT_AAPT_CONFIG))
+$(call add_json_str,  AAPTPreferredConfig,               $(PRODUCT_AAPT_PREF_CONFIG))
+$(call add_json_list, AAPTPrebuiltDPI,                   $(PRODUCT_AAPT_PREBUILT_DPI))
+
+$(call add_json_str,  AppsDefaultVersionName,            $(APPS_DEFAULT_VERSION_NAME))
+
 $(call add_json_list, SanitizeHost,                      $(SANITIZE_HOST))
 $(call add_json_list, SanitizeDevice,                    $(SANITIZE_TARGET))
 $(call add_json_list, SanitizeDeviceDiag,                $(SANITIZE_TARGET_DIAG))
@@ -79,14 +90,16 @@
 
 $(call add_json_bool, Safestack,                         $(filter true,$(USE_SAFESTACK)))
 $(call add_json_bool, EnableCFI,                         $(call invert_bool,$(filter false,$(ENABLE_CFI))))
+$(call add_json_list, CFIExcludePaths,                   $(CFI_EXCLUDE_PATHS) $(PRODUCT_CFI_EXCLUDE_PATHS))
+$(call add_json_list, CFIIncludePaths,                   $(CFI_INCLUDE_PATHS) $(PRODUCT_CFI_INCLUDE_PATHS))
 $(call add_json_list, IntegerOverflowExcludePaths,       $(INTEGER_OVERFLOW_EXCLUDE_PATHS) $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
 
 $(call add_json_bool, ClangTidy,                         $(filter 1 true,$(WITH_TIDY)))
 $(call add_json_str,  TidyChecks,                        $(WITH_TIDY_CHECKS))
 
 $(call add_json_bool, NativeCoverage,                    $(filter true,$(NATIVE_COVERAGE)))
-$(call add_json_csv,  CoveragePaths,                     $(COVERAGE_PATHS))
-$(call add_json_csv,  CoverageExcludePaths,              $(COVERAGE_EXCLUDE_PATHS))
+$(call add_json_list, CoveragePaths,                     $(COVERAGE_PATHS))
+$(call add_json_list, CoverageExcludePaths,              $(COVERAGE_EXCLUDE_PATHS))
 
 $(call add_json_bool, ArtUseReadBarrier,                 $(call invert_bool,$(filter false,$(PRODUCT_ART_USE_READ_BARRIER))))
 $(call add_json_bool, Binder32bit,                       $(BINDER32BIT))
@@ -102,6 +115,7 @@
 $(call add_json_bool, Treble,                            $(filter true,$(PRODUCT_FULL_TREBLE)))
 $(call add_json_bool, Uml,                               $(filter true,$(TARGET_USER_MODE_LINUX)))
 $(call add_json_str,  VendorPath,                        $(TARGET_COPY_OUT_VENDOR))
+$(call add_json_bool, MinimizeJavaDebugInfo,             $(filter true,$(PRODUCT_MINIMIZE_JAVA_DEBUG_INFO)))
 
 $(call add_json_bool, UseGoma,                           $(filter-out false,$(USE_GOMA)))
 
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
index b251d7c..53ad50d 100644
--- a/core/soong_java_prebuilt.mk
+++ b/core/soong_java_prebuilt.mk
@@ -37,6 +37,7 @@
 ifdef LOCAL_SOONG_DEX_JAR
   ifndef LOCAL_IS_HOST_MODULE
     $(eval $(call copy-one-file,$(LOCAL_SOONG_DEX_JAR),$(common_javalib.jar)))
+    $(eval $(call add-dependency,$(common_javalib.jar),$(full_classes_jar) $(full_classes_header_jar)))
 
     # defines built_odex along with rule to install odex
     include $(BUILD_SYSTEM)/dex_preopt_odex_install.mk
@@ -62,6 +63,7 @@
     endif # LOCAL_DEX_PREOPT
   else # LOCAL_IS_HOST_MODULE
     $(eval $(call copy-one-file,$(LOCAL_SOONG_DEX_JAR),$(LOCAL_BUILT_MODULE)))
+    $(eval $(call add-dependency,$(LOCAL_BUILT_MODULE),$(full_classes_jar) $(full_classes_header_jar)))
   endif
 
   java-dex : $(LOCAL_BUILT_MODULE)
diff --git a/core/tasks/boot_jars_package_check.mk b/core/tasks/boot_jars_package_check.mk
index 188c267..dc79e23 100644
--- a/core/tasks/boot_jars_package_check.mk
+++ b/core/tasks/boot_jars_package_check.mk
@@ -24,8 +24,8 @@
 stamp := $(intermediates)/stamp
 built_boot_jars := $(foreach j, $(PRODUCT_BOOT_JARS), \
   $(call intermediates-dir-for, JAVA_LIBRARIES, $(j),,COMMON)/classes.jar)
-script := build/core/tasks/check_boot_jars/check_boot_jars.py
-whitelist_file := build/core/tasks/check_boot_jars/package_whitelist.txt
+script := build/make/core/tasks/check_boot_jars/check_boot_jars.py
+whitelist_file := build/make/core/tasks/check_boot_jars/package_whitelist.txt
 
 $(stamp): PRIVATE_BOOT_JARS := $(built_boot_jars)
 $(stamp): PRIVATE_SCRIPT := $(script)
diff --git a/envsetup.sh b/envsetup.sh
index e4ff0f9..9a616ef 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -237,7 +237,12 @@
             ;;
     esac
 
-    export ANDROID_BUILD_PATHS=$(get_build_var ANDROID_BUILD_PATHS):$ANDROID_TOOLCHAIN:$ANDROID_TOOLCHAIN_2ND_ARCH:$ANDROID_DEV_SCRIPTS:
+    ANDROID_BUILD_PATHS=$(get_build_var ANDROID_BUILD_PATHS):$ANDROID_TOOLCHAIN
+    if [ -n "$ANDROID_TOOLCHAIN_2ND_ARCH" ]; then
+        ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_TOOLCHAIN_2ND_ARCH
+    fi
+    ANDROID_BUILD_PATHS=$ANDROID_BUILD_PATHS:$ANDROID_DEV_SCRIPTS:
+    export ANDROID_BUILD_PATHS
 
     # If prebuilts/android-emulator/<system>/ exists, prepend it to our PATH
     # to ensure that the corresponding 'emulator' binaries are used.
@@ -650,11 +655,17 @@
 # Run tapas with one or more app names (from LOCAL_PACKAGE_NAME)
 function tapas()
 {
+    local showHelp="$(echo $* | xargs -n 1 echo | \grep -E '^(help)$' | xargs)"
     local arch="$(echo $* | xargs -n 1 echo | \grep -E '^(arm|x86|mips|armv5|arm64|x86_64|mips64)$' | xargs)"
     local variant="$(echo $* | xargs -n 1 echo | \grep -E '^(user|userdebug|eng)$' | xargs)"
     local density="$(echo $* | xargs -n 1 echo | \grep -E '^(ldpi|mdpi|tvdpi|hdpi|xhdpi|xxhdpi|xxxhdpi|alldpi)$' | xargs)"
     local apps="$(echo $* | xargs -n 1 echo | \grep -E -v '^(user|userdebug|eng|arm|x86|mips|armv5|arm64|x86_64|mips64|ldpi|mdpi|tvdpi|hdpi|xhdpi|xxhdpi|xxxhdpi|alldpi)$' | xargs)"
 
+    if [ "$showHelp" != "" ]; then
+      $(gettop)/build/make/tapasHelp.sh
+      return
+    fi
+
     if [ $(echo $arch | wc -w) -gt 1 ]; then
         echo "tapas: Error: Multiple build archs supplied: $arch"
         return
@@ -701,7 +712,7 @@
 
 function gettop
 {
-    local TOPFILE=build/core/envsetup.mk
+    local TOPFILE=build/make/core/envsetup.mk
     if [ -n "$TOP" -a -f "$TOP/$TOPFILE" ] ; then
         # The following circumlocution ensures we remove symlinks from TOP.
         (cd $TOP; PWD= /bin/pwd)
@@ -735,7 +746,7 @@
         # Use scan-build to collect all static analyzer reports into directory
         # /tmp/scan-build-yyyy-mm-dd-hhmmss-*
         # The clang compiler passed by --use-analyzer here is not important.
-        # build/core/binary.mk will set CLANG_CXX and CLANG before calling
+        # build/make/core/binary.mk will set CLANG_CXX and CLANG before calling
         # c++-analyzer and ccc-analyzer.
         local CLANG_VERSION=$(get_build_var LLVM_PREBUILTS_VERSION)
         local BUILD_OS=$(get_build_var BUILD_OS)
@@ -761,7 +772,7 @@
 
 function findmakefile()
 {
-    local TOPFILE=build/core/envsetup.mk
+    local TOPFILE=build/make/core/envsetup.mk
     local HERE=$PWD
     local T=
     while [ \( ! \( -f $TOPFILE \) \) -a \( $PWD != "/" \) ]; do
@@ -971,7 +982,7 @@
 
 function cproj()
 {
-    local TOPFILE=build/core/envsetup.mk
+    local TOPFILE=build/make/core/envsetup.mk
     local HERE=$PWD
     local T=
     while [ \( ! \( -f $TOPFILE \) \) -a \( $PWD != "/" \) ]; do
diff --git a/tapasHelp.sh b/tapasHelp.sh
new file mode 100755
index 0000000..058ac1d
--- /dev/null
+++ b/tapasHelp.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# locate some directories
+cd "$(dirname $0)"
+SCRIPT_DIR="${PWD}"
+cd ../..
+TOP="${PWD}"
+
+message='usage: tapas [<App1> <App2> ...] [arm|x86|mips|armv5|arm64|x86_64|mips64] [eng|userdebug|user]
+
+tapas selects individual apps to be built by the Android build system. Unlike
+"lunch", "tapas" does not request the building of images for a device.
+Additionally, an app built with "tapas" will have its dex file inside its apk,
+which should cause it to be suitable for installing on any api-compatible
+device. In other words, "tapas" configures the build of unbundled apps.
+
+The names <App1> <App2> ... should match LOCAL_PACKAGE_NAME as defined in an
+Android.mk
+
+The usage of the other arguments matches that of the rest of the platform
+build system and can be found by running `m help`'
+
+echo "$message"
diff --git a/target/board/Android.mk b/target/board/Android.mk
index c5678d1..4b5af3c 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -78,9 +78,7 @@
 
 $(GEN): PRIVATE_FLAGS :=
 
-# TODO(b/37954458), (b/37321309) remove check of PRODUCT_FULL_TREBLE after
-# putting device compatibility matrices for non-treble devices.
-ifeq ($(PRODUCT_FULL_TREBLE),true)
+ifeq ($(PRODUCT_ENFORCE_VINTF_MANIFEST),true)
 ifdef BUILT_VENDOR_MATRIX
 $(GEN): $(BUILT_VENDOR_MATRIX)
 $(GEN): PRIVATE_FLAGS += -c "$(BUILT_VENDOR_MATRIX)"
@@ -105,9 +103,7 @@
 
 $(GEN): PRIVATE_FLAGS :=
 
-# TODO(b/37954458), (b/37321309) remove check of PRODUCT_FULL_TREBLE after
-# putting complete HAL manifests on non-treble devices.
-ifeq ($(PRODUCT_FULL_TREBLE),true)
+ifeq ($(PRODUCT_ENFORCE_VINTF_MANIFEST),true)
 ifdef BUILT_VENDOR_MANIFEST
 $(GEN): $(BUILT_VENDOR_MANIFEST)
 $(GEN): PRIVATE_FLAGS += -c "$(BUILT_VENDOR_MANIFEST)"
diff --git a/target/board/generic/sepolicy/genfs_contexts b/target/board/generic/sepolicy/genfs_contexts
new file mode 100644
index 0000000..bdcead1
--- /dev/null
+++ b/target/board/generic/sepolicy/genfs_contexts
@@ -0,0 +1,4 @@
+# On the emulator, device tree dir is configured to be
+# /sys/bus/platform/devices/ANDR0001:00/properties/android/ which is a symlink to
+# /sys/devices/platform/ANDR0001:00/properties/android/
+genfscon sysfs /devices/platform/ANDR0001:00/properties/android u:object_r:sysfs_dt_firmware_android:s0
diff --git a/target/board/generic/sepolicy/hal_gnss_default.te b/target/board/generic/sepolicy/hal_gnss_default.te
index 0dd3d03..ddc68cc 100644
--- a/target/board/generic/sepolicy/hal_gnss_default.te
+++ b/target/board/generic/sepolicy/hal_gnss_default.te
@@ -1,3 +1 @@
-#============= hal_gnss_default ==============
-allow hal_gnss_default vndbinder_device:chr_file { ioctl open read write };
-
+vndbinder_use(hal_gnss_default);
diff --git a/target/board/generic/sepolicy/hal_graphics_composer_default.te b/target/board/generic/sepolicy/hal_graphics_composer_default.te
index 034bdef..40ecda6 100644
--- a/target/board/generic/sepolicy/hal_graphics_composer_default.te
+++ b/target/board/generic/sepolicy/hal_graphics_composer_default.te
@@ -1,3 +1 @@
-#============= hal_graphics_composer_default ==============
-allow hal_graphics_composer_default vndbinder_device:chr_file { ioctl open read write };
-
+vndbinder_use(hal_graphics_composer_default);
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index d6df2cf..9beb9a3 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -25,7 +25,7 @@
 TARGET_2ND_CPU_ABI := armeabi-v7a
 TARGET_2ND_CPU_ABI2 := armeabi
 
-ifneq ($(TARGET_BUILD_APPS)$(filter cts,$(MAKECMDGOALS)),)
+ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk,$(MAKECMDGOALS)),)
 # DO NOT USE
 # DO NOT USE
 #
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 7df5920..1b512a3 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -76,7 +76,7 @@
     libwebviewchromium_plat_support \
     libwilhelm \
     logd \
-    make_ext4fs \
+    mke2fs \
     e2fsck \
     resize2fs \
     tune2fs \
@@ -134,7 +134,7 @@
 # Adoptable external storage supports both ext4 and f2fs
 PRODUCT_PACKAGES += \
     e2fsck \
-    make_ext4fs \
+    mke2fs \
     fsck.f2fs \
     make_f2fs \
 
@@ -156,7 +156,7 @@
 
 # On userdebug builds, collect more tombstones by default.
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
-PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     tombstoned.max_tombstone_count=50
 endif
 
diff --git a/target/product/core_tiny.mk b/target/product/core_tiny.mk
index 944be74..c86b862 100644
--- a/target/product/core_tiny.mk
+++ b/target/product/core_tiny.mk
@@ -70,7 +70,7 @@
     libwilhelm \
     libdrmframework_jni \
     libdrmframework \
-    make_ext4fs \
+    mke2fs \
     e2fsck \
     resize2fs \
     tune2fs \
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 0a56c99..246a553 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -99,9 +99,14 @@
     fs_config_files \
     fs_config_dirs
 
+# If there are product-specific adb keys defined, install them on debuggable
+# builds.
+PRODUCT_PACKAGES_DEBUG += \
+    adb_keys
+
 # Ensure that this property is always defined so that bionic_systrace.cpp
 # can rely on it being initially set by init.
-PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     debug.atrace.tags.enableflags=0
 
 PRODUCT_COPY_FILES += \
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index 0e1e581..58245cb 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -107,44 +107,20 @@
 # need this for gles libraries to load properly
 # after moving to /vendor/lib/
 PRODUCT_PACKAGES += \
-    android.hardware.renderscript@1.0.vndk-sp\
-    android.hardware.graphics.allocator@2.0.vndk-sp\
-    android.hardware.graphics.mapper@2.0.vndk-sp\
-    android.hardware.graphics.common@1.0.vndk-sp\
-    libhwbinder.vndk-sp\
-    libbase.vndk-sp\
-    libcutils.vndk-sp\
-    libhardware.vndk-sp\
-    libhidlbase.vndk-sp\
-    libhidltransport.vndk-sp\
-    libutils.vndk-sp\
-    libc++.vndk-sp\
-    libRS_internal.vndk-sp\
-    libRSDriver.vndk-sp\
-    libRSCpuRef.vndk-sp\
-    libbcinfo.vndk-sp\
-    libblas.vndk-sp\
-    libft2.vndk-sp\
-    libpng.vndk-sp\
-    libcompiler_rt.vndk-sp\
-    libbacktrace.vndk-sp\
-    libunwind.vndk-sp\
-    liblzma.vndk-sp\
-    libz.vndk-sp\
-
+    vndk-sp
 
 PRODUCT_COPY_FILES += \
-    device/generic/goldfish/init.ranchu-core.sh:vendor/bin/init.ranchu-core.sh \
-    device/generic/goldfish/init.ranchu-net.sh:vendor/bin/init.ranchu-net.sh \
+    device/generic/goldfish/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
+    device/generic/goldfish/init.ranchu-net.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-net.sh \
     device/generic/goldfish/init.ranchu.rc:root/init.ranchu.rc \
     device/generic/goldfish/fstab.ranchu:root/fstab.ranchu \
     device/generic/goldfish/fstab.ranchu.early:root/fstab.ranchu.early \
     device/generic/goldfish/ueventd.ranchu.rc:root/ueventd.ranchu.rc \
-    device/generic/goldfish/input/goldfish_rotary.idc:system/usr/idc/goldfish_rotary.idc \
+    device/generic/goldfish/input/goldfish_rotary.idc:$(TARGET_COPY_OUT_VENDOR)/usr/idc/goldfish_rotary.idc \
     device/generic/goldfish/manifest.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
-    device/generic/goldfish/data/etc/permissions/privapp-permissions-goldfish.xml:system/etc/permissions/privapp-permissions-goldfish.xml \
+    device/generic/goldfish/data/etc/permissions/privapp-permissions-goldfish.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/privapp-permissions-goldfish.xml \
     device/generic/goldfish/data/etc/config.ini:config.ini \
-    frameworks/native/data/etc/android.hardware.usb.accessory.xml:system/etc/permissions/android.hardware.usb.accessory.xml
+    frameworks/native/data/etc/android.hardware.usb.accessory.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.usb.accessory.xml
 
 PRODUCT_PACKAGE_OVERLAYS := device/generic/goldfish/overlay
 
diff --git a/target/product/full_base.mk b/target/product/full_base.mk
index f2652eb..7aac435 100644
--- a/target/product/full_base.mk
+++ b/target/product/full_base.mk
@@ -53,3 +53,6 @@
 
 # Get everything else from the parent package
 $(call inherit-product, $(SRC_TARGET_DIR)/product/generic_no_telephony.mk)
+
+# Add adb keys to debuggable AOSP builds (if they exist)
+$(call inherit-product-if-exists, vendor/google/security/adb/vendor_key.mk)
diff --git a/target/product/full_base_telephony.mk b/target/product/full_base_telephony.mk
index 9a2c63a..375c679 100644
--- a/target/product/full_base_telephony.mk
+++ b/target/product/full_base_telephony.mk
@@ -25,7 +25,7 @@
 
 PRODUCT_COPY_FILES := \
     device/generic/goldfish/data/etc/apns-conf.xml:system/etc/apns-conf.xml \
-    frameworks/native/data/etc/handheld_core_hardware.xml:system/etc/permissions/handheld_core_hardware.xml
+    frameworks/native/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony.mk)
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index 829601c..6e7038e 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -56,7 +56,7 @@
 PRODUCT_PACKAGES += \
     cacerts \
 
-PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     dalvik.vm.image-dex2oat-Xms=64m \
     dalvik.vm.image-dex2oat-Xmx=64m \
     dalvik.vm.dex2oat-Xms=64m \
@@ -72,18 +72,22 @@
 # Different dexopt types for different package update/install times.
 # On eng builds, make "boot" reasons only extract for faster turnaround.
 ifeq (eng,$(TARGET_BUILD_VARIANT))
-    PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
         pm.dexopt.first-boot=extract \
         pm.dexopt.boot=extract
 else
-    PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
         pm.dexopt.first-boot=quicken \
         pm.dexopt.boot=verify
 endif
 
-PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     pm.dexopt.install=quicken \
     pm.dexopt.bg-dexopt=speed-profile \
     pm.dexopt.ab-ota=speed-profile \
     pm.dexopt.inactive=verify \
     pm.dexopt.shared=speed
+
+# Enable minidebuginfo generation unless overridden.
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+    dalvik.vm.dex2oat-minidebuginfo=true
diff --git a/target/product/sdk_base.mk b/target/product/sdk_base.mk
index 703da9b..a641be3 100644
--- a/target/product/sdk_base.mk
+++ b/target/product/sdk_base.mk
@@ -91,19 +91,19 @@
 	frameworks/base/data/sounds/effects/camera_click.ogg:system/media/audio/ui/camera_click.ogg \
 	frameworks/base/data/sounds/effects/VideoRecord.ogg:system/media/audio/ui/VideoRecord.ogg \
 	frameworks/base/data/sounds/effects/VideoStop.ogg:system/media/audio/ui/VideoStop.ogg \
-	device/generic/goldfish/data/etc/handheld_core_hardware.xml:system/etc/permissions/handheld_core_hardware.xml \
-	device/generic/goldfish/camera/media_profiles.xml:system/etc/media_profiles.xml \
-	frameworks/av/media/libstagefright/data/media_codecs_google_audio.xml:system/etc/media_codecs_google_audio.xml \
-	frameworks/av/media/libstagefright/data/media_codecs_google_telephony.xml:system/etc/media_codecs_google_telephony.xml \
-	device/generic/goldfish/camera/media_codecs_google_video.xml:system/etc/media_codecs_google_video.xml \
-	device/generic/goldfish/camera/media_codecs.xml:system/etc/media_codecs.xml \
-	device/generic/goldfish/camera/media_codecs_performance.xml:system/etc/media_codecs_performance.xml \
-	frameworks/native/data/etc/android.hardware.touchscreen.multitouch.jazzhand.xml:system/etc/permissions/android.hardware.touchscreen.multitouch.jazzhand.xml \
-	frameworks/native/data/etc/android.hardware.camera.xml:system/etc/permissions/android.hardware.camera.xml \
-	frameworks/native/data/etc/android.hardware.fingerprint.xml:system/etc/permissions/android.hardware.fingerprint.xml \
-	frameworks/native/data/etc/android.software.autofill.xml:system/etc/permissions/android.software.autofill.xml \
-	frameworks/av/media/libeffects/data/audio_effects.conf:system/etc/audio_effects.conf \
-	device/generic/goldfish/audio_policy.conf:system/etc/audio_policy.conf
+	device/generic/goldfish/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
+	device/generic/goldfish/camera/media_profiles.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_profiles.xml \
+	frameworks/av/media/libstagefright/data/media_codecs_google_audio.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_audio.xml \
+	frameworks/av/media/libstagefright/data/media_codecs_google_telephony.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_telephony.xml \
+	device/generic/goldfish/camera/media_codecs_google_video.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_video.xml \
+	device/generic/goldfish/camera/media_codecs.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs.xml \
+	device/generic/goldfish/camera/media_codecs_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_performance.xml \
+	frameworks/native/data/etc/android.hardware.touchscreen.multitouch.jazzhand.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.touchscreen.multitouch.jazzhand.xml \
+	frameworks/native/data/etc/android.hardware.camera.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.camera.xml \
+	frameworks/native/data/etc/android.hardware.fingerprint.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.fingerprint.xml \
+	frameworks/native/data/etc/android.software.autofill.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.autofill.xml \
+	frameworks/av/media/libeffects/data/audio_effects.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_effects.conf \
+	device/generic/goldfish/audio_policy.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy.conf
 
 include $(SRC_TARGET_DIR)/product/emulator.mk
 
diff --git a/target/product/security/Android.mk b/target/product/security/Android.mk
index 5a40397..4142ea9 100644
--- a/target/product/security/Android.mk
+++ b/target/product/security/Android.mk
@@ -10,3 +10,16 @@
 LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
 
 include $(BUILD_PREBUILT)
+
+#######################################
+# adb key, if configured via PRODUCT_ADB_KEYS
+ifdef PRODUCT_ADB_KEYS
+  ifneq ($(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
+    include $(CLEAR_VARS)
+    LOCAL_MODULE := adb_keys
+    LOCAL_MODULE_CLASS := ETC
+    LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
+    LOCAL_PREBUILT_MODULE_FILE := $(PRODUCT_ADB_KEYS)
+    include $(BUILD_PREBUILT)
+  endif
+endif
diff --git a/target/product/security/README b/target/product/security/README
index 15f2e93..6a6e62d 100644
--- a/target/product/security/README
+++ b/target/product/security/README
@@ -34,5 +34,5 @@
     $ java -jar out/host/linux-x86/framework/dumpkey.jar build/target/product/security/testkey.x509.pem
     {64,0xc926ad21,{1795090719,2141396315,950055447,2581568430,4268923165,1920809988,546586521,3498997798,1776797858,3740060814,1805317999,1429410244,129622599,1422441418,1783893377,1222374759,2563319927,323993566,28517732,609753416,1826472888,215237850,4261642700,4049082591,3228462402,774857746,154822455,2497198897,2758199418,3019015328,2794777644,87251430,2534927978,120774784,571297800,3695899472,2479925187,3811625450,3401832990,2394869647,3267246207,950095497,555058928,414729973,1136544882,3044590084,465547824,4058146728,2731796054,1689838846,3890756939,1048029507,895090649,247140249,178744550,3547885223,3165179243,109881576,3944604415,1044303212,3772373029,2985150306,3737520932,3599964420},{3437017481,3784475129,2800224972,3086222688,251333580,2131931323,512774938,325948880,2657486437,2102694287,3820568226,792812816,1026422502,2053275343,2800889200,3113586810,165549746,4273519969,4065247892,1902789247,772932719,3941848426,3652744109,216871947,3164400649,1942378755,3996765851,1055777370,964047799,629391717,2232744317,3910558992,191868569,2758883837,3682816752,2997714732,2702529250,3570700455,3776873832,3924067546,3555689545,2758825434,1323144535,61311905,1997411085,376844204,213777604,4077323584,9135381,1625809335,2804742137,2952293945,1117190829,4237312782,1825108855,3013147971,1111251351,2568837572,1684324211,2520978805,367251975,810756730,2353784344,1175080310}}
 
-This is called by build/core/Makefile to incorporate the OTA signing keys
+This is called by build/make/core/Makefile to incorporate the OTA signing keys
 into the recovery image.
diff --git a/target/product/vndk/Android.mk b/target/product/vndk/Android.mk
index c8ed873..6e8a85f 100644
--- a/target/product/vndk/Android.mk
+++ b/target/product/vndk/Android.mk
@@ -1,7 +1,101 @@
+ifneq ($(BOARD_VNDK_VERSION),)
 LOCAL_PATH:= $(call my-dir)
 
-include $(CLEAR_VARS)
+#####################################################################
+# Setting the VNDK version. Version is 10000.0 for not-yet-published
+# platform and xx.y for released platform.
+vndk_major_ver := 10000
+vndk_minor_ver := 0
 
+#TODO(b/68027291): Revive this check when we have stable VNDK in P or later.
+#ifneq ($(vndk_major_ver), $(PLATFORM_SDK_VERSION))
+#$(error vndk_major_version does not match PLATFORM_SDK_VERSION, please update.)
+#endif
+
+ifneq (REL,$(PLATFORM_VERSION_CODENAME))
+    vndk_major_ver := 10000
+    vndk_minor_ver := 0
+endif
+PLATFORM_VNDK_VERSION := $(vndk_major_ver).$(vndk_minor_ver)
+vndk_major_ver :=
+vndk_minor_ver :=
+
+#####################################################################
+# Create the list of vndk libraries from the source code.
+INTERNAL_VNDK_LIB_LIST := $(call intermediates-dir-for,PACKAGING,vndk)/libs.txt
+$(INTERNAL_VNDK_LIB_LIST):
+	@echo "Generate: $@"
+	@mkdir -p $(dir $@)
+	$(hide) echo -n > $@
+	$(hide) $(foreach lib, $(LLNDK_LIBRARIES), \
+	  echo LLNDK: $(lib).so >> $@;)
+	$(hide) $(foreach lib, $(VNDK_SAMEPROCESS_LIBRARIES), \
+	  echo VNDK-SP: $(lib).so >> $@;)
+	$(hide) $(foreach lib, $(VNDK_CORE_LIBRARIES), \
+	  echo VNDK-core: $(lib).so >> $@;)
+	$(hide) $(foreach lib, $(VNDK_PRIVATE_LIBRARIES), \
+	  echo VNDK-private: $(lib).so >> $@;)
+
+#####################################################################
+# This is the up-to-date list of vndk libs.
+# TODO(b/62012285): the lib list should be stored somewhere under
+# /prebuilts/vndk
+LATEST_VNDK_LIB_LIST := $(LOCAL_PATH)/$(PLATFORM_VNDK_VERSION).txt
+
+#####################################################################
+# Check the generate list against the latest list stored in the
+# source tree
+.PHONY: check-vndk-list
+
+ifeq (REL,$(PLATFORM_VERSION_CODENAME))
+# The check is enforced in release branches
+droidcore: check-vndk-list
+endif
+
+check-vndk-list-timestamp := $(call intermediates-dir-for,PACKAGING,vndk)/check-list-timestamp
+check-vndk-list: $(check-vndk-list-timestamp)
+
+_vndk_check_failure_message := "VNDK library list has changed."
+ifeq (REL,$(PLATFORM_VERSION_CODENAME)
+_vndk_check_failure_message += "This isn't allowed in API locked branches."
+else
+_vndk_check_failure_message += "Run update-vndk-list.sh to update the list."
+endif
+
+$(check-vndk-list-timestamp): $(INTERNAL_VNDK_LIB_LIST) $(LATEST_VNDK_LIB_LIST) $(HOST_OUT_EXECUTABLES)/update-vndk-list.sh
+	$(hide) ( diff --old-line-format="Removed %L" \
+	  --new-line-format="Added %L" \
+	  --unchanged-line-format="" \
+	  $(LATEST_VNDK_LIB_LIST) $(INTERNAL_VNDK_LIB_LIST) \
+	  || ( echo $(_vndk_check_failure_message); exit 1 ))
+	$(hide) mkdir -p $(dir $@)
+	$(hide) touch $@
+
+#####################################################################
+# Script to update the latest VNDK lib list
+include $(CLEAR_VARS)
+LOCAL_MODULE := update-vndk-list.sh
+LOCAL_MODULE_CLASS := EXECUTABLES
+LOCAL_MODULE_STEM := $(LOCAL_MODULE)
+LOCAL_IS_HOST_MODULE := true
+include $(BUILD_SYSTEM)/base_rules.mk
+$(LOCAL_BUILT_MODULE): PRIVATE_INTERNAL_VNDK_LIB_LIST := $(INTERNAL_VNDK_LIB_LIST)
+$(LOCAL_BUILT_MODULE): PRIVATE_LATEST_VNDK_LIB_LIST := $(LATEST_VNDK_LIB_LIST)
+$(LOCAL_BUILT_MODULE):
+	@echo "Generate: $@"
+	@mkdir -p $(dir $@)
+	@rm -f $@
+	$(hide) echo "#!/bin/bash" > $@
+ifeq (REL,$(PLATFORM_VERSION_CODENAME))
+	$(hide) echo "echo Updating VNDK library list is NOT allowed in API locked branches." >> $@; \
+	        echo "exit 1" >> $@
+else
+	$(hide) echo "cp $(PRIVATE_INTERNAL_VNDK_LIB_LIST) $(PRIVATE_LATEST_VNDK_LIB_LIST)" >> $@; \
+	        echo "echo $(PRIVATE_LATEST_VNDK_LIB_LIST) updated." >> $@
+endif
+	@chmod a+x $@
+
+include $(CLEAR_VARS)
 LOCAL_MODULE := vndk_package
 LOCAL_REQUIRED_MODULES := \
     $(addsuffix .vendor,$(VNDK_CORE_LIBRARIES)) \
@@ -11,3 +105,4 @@
     vndksp.libraries.txt
 
 include $(BUILD_PHONY_PACKAGE)
+endif # BOARD_VNDK_VERSION is set
diff --git a/tools/apicheck/Android.mk b/tools/apicheck/Android.mk
index b547058..ab3493d 100644
--- a/tools/apicheck/Android.mk
+++ b/tools/apicheck/Android.mk
@@ -12,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ifneq ($(TARGET_BUILD_PDK),true)
 LOCAL_PATH := $(call my-dir)
 
 # the hat script
@@ -26,4 +25,3 @@
 include $(BUILD_PREBUILT)
 
 # Apicheck is now part of Doclava -- See external/doclava.
-endif
diff --git a/tools/apicheck/etc/apicheck b/tools/apicheck/etc/apicheck
index c710c46..e4ffb77 100644
--- a/tools/apicheck/etc/apicheck
+++ b/tools/apicheck/etc/apicheck
@@ -18,7 +18,7 @@
 # and set up progdir to be the fully-qualified pathname of its directory.
 #
 # The classpath and other java options used in apicheck are specified in
-# build/core/tasks/apicheck.mk.
+# build/make/core/tasks/apicheck.mk.
 
 prog="$0"
 while [ -h "${prog}" ]; do
diff --git a/tools/releasetools/blockimgdiff.py b/tools/releasetools/blockimgdiff.py
index b8123c0..6bca99e 100644
--- a/tools/releasetools/blockimgdiff.py
+++ b/tools/releasetools/blockimgdiff.py
@@ -16,6 +16,7 @@
 
 import array
 import common
+import copy
 import functools
 import heapq
 import itertools
@@ -204,6 +205,18 @@
     self.id = len(by_id)
     by_id.append(self)
 
+    self._patch = None
+
+  @property
+  def patch(self):
+    return self._patch
+
+  @patch.setter
+  def patch(self, patch):
+    if patch:
+      assert self.style == "diff"
+    self._patch = patch
+
   def NetStashChange(self):
     return (sum(sr.size() for (_, sr) in self.stash_before) -
             sum(sr.size() for (_, sr) in self.use_stash))
@@ -213,6 +226,7 @@
     self.use_stash = []
     self.style = "new"
     self.src_ranges = RangeSet()
+    self.patch = None
 
   def __str__(self):
     return (str(self.id) + ": <" + str(self.src_ranges) + " " + self.style +
@@ -675,6 +689,7 @@
             # These are identical; we don't need to generate a patch,
             # just issue copy commands on the device.
             xf.style = "move"
+            xf.patch = None
             tgt_size = xf.tgt_ranges.size() * self.tgt.blocksize
             if xf.src_ranges != xf.tgt_ranges:
               print("%10d %10d (%6.2f%%) %7s %s %s (from %s)" % (
@@ -683,24 +698,33 @@
                       xf.tgt_name + " (from " + xf.src_name + ")"),
                   str(xf.tgt_ranges), str(xf.src_ranges)))
           else:
-            # For files in zip format (eg, APKs, JARs, etc.) we would
-            # like to use imgdiff -z if possible (because it usually
-            # produces significantly smaller patches than bsdiff).
-            # This is permissible if:
-            #
-            #  - imgdiff is not disabled, and
-            #  - the source and target files are monotonic (ie, the
-            #    data is stored with blocks in increasing order), and
-            #  - we haven't removed any blocks from the source set.
-            #
-            # If these conditions are satisfied then appending all the
-            # blocks in the set together in order will produce a valid
-            # zip file (plus possibly extra zeros in the last block),
-            # which is what imgdiff needs to operate.  (imgdiff is
-            # fine with extra zeros at the end of the file.)
-            imgdiff = (not self.disable_imgdiff and xf.intact and
-                       xf.tgt_name.split(".")[-1].lower()
-                       in ("apk", "jar", "zip"))
+            if xf.patch:
+              # We have already generated the patch with imgdiff. Check if the
+              # transfer is intact.
+              assert not self.disable_imgdiff
+              imgdiff = True
+              if not xf.intact:
+                imgdiff = False
+                xf.patch = None
+            else:
+              # For files in zip format (eg, APKs, JARs, etc.) we would
+              # like to use imgdiff -z if possible (because it usually
+              # produces significantly smaller patches than bsdiff).
+              # This is permissible if:
+              #
+              #  - imgdiff is not disabled, and
+              #  - the source and target files are monotonic (ie, the
+              #    data is stored with blocks in increasing order), and
+              #  - we haven't removed any blocks from the source set.
+              #
+              # If these conditions are satisfied then appending all the
+              # blocks in the set together in order will produce a valid
+              # zip file (plus possibly extra zeros in the last block),
+              # which is what imgdiff needs to operate.  (imgdiff is
+              # fine with extra zeros at the end of the file.)
+              imgdiff = (not self.disable_imgdiff and xf.intact and
+                         xf.tgt_name.split(".")[-1].lower()
+                         in ("apk", "jar", "zip"))
             xf.style = "imgdiff" if imgdiff else "bsdiff"
             diff_queue.append((index, imgdiff, patch_num))
             patch_num += 1
@@ -717,6 +741,7 @@
       diff_total = len(diff_queue)
       patches = [None] * diff_total
       error_messages = []
+      warning_messages = []
       if sys.stdout.isatty():
         global diff_done
         diff_done = 0
@@ -737,29 +762,51 @@
             xf_index, imgdiff, patch_index = diff_queue.pop()
 
           xf = self.transfers[xf_index]
-          src_ranges = xf.src_ranges
-          tgt_ranges = xf.tgt_ranges
+          patch = xf.patch
+          if not patch:
+            src_ranges = xf.src_ranges
+            tgt_ranges = xf.tgt_ranges
 
-          # Needs lock since WriteRangeDataToFd() is stateful (calling seek).
-          with lock:
-            src_file = common.MakeTempFile(prefix="src-")
-            with open(src_file, "wb") as fd:
-              self.src.WriteRangeDataToFd(src_ranges, fd)
-
-            tgt_file = common.MakeTempFile(prefix="tgt-")
-            with open(tgt_file, "wb") as fd:
-              self.tgt.WriteRangeDataToFd(tgt_ranges, fd)
-
-          try:
-            patch = compute_patch(src_file, tgt_file, imgdiff)
-          except ValueError as e:
+            # Needs lock since WriteRangeDataToFd() is stateful (calling seek).
             with lock:
-              error_messages.append(
+              src_file = common.MakeTempFile(prefix="src-")
+              with open(src_file, "wb") as fd:
+                self.src.WriteRangeDataToFd(src_ranges, fd)
+
+              tgt_file = common.MakeTempFile(prefix="tgt-")
+              with open(tgt_file, "wb") as fd:
+                self.tgt.WriteRangeDataToFd(tgt_ranges, fd)
+
+            message = []
+            try:
+              patch = compute_patch(src_file, tgt_file, imgdiff)
+            except ValueError as e:
+              message.append(
                   "Failed to generate %s for %s: tgt=%s, src=%s:\n%s" % (
-                      "imgdiff" if imgdiff else "bsdiff",
-                      xf.tgt_name if xf.tgt_name == xf.src_name else
-                          xf.tgt_name + " (from " + xf.src_name + ")",
-                      xf.tgt_ranges, xf.src_ranges, e.message))
+                  "imgdiff" if imgdiff else "bsdiff",
+                  xf.tgt_name if xf.tgt_name == xf.src_name else
+                      xf.tgt_name + " (from " + xf.src_name + ")",
+                  xf.tgt_ranges, xf.src_ranges, e.message))
+              # TODO(b/68016761): Better handle the holes in mke2fs created
+              # images.
+              if imgdiff:
+                try:
+                  patch = compute_patch(src_file, tgt_file, imgdiff=False)
+                  message.append(
+                      "Fell back and generated with bsdiff instead for %s" % (
+                      xf.tgt_name,))
+                  xf.style = "bsdiff"
+                  with lock:
+                    warning_messages.extend(message)
+                  del message[:]
+                except ValueError as e:
+                  message.append(
+                      "Also failed to generate with bsdiff for %s:\n%s" % (
+                      xf.tgt_name, e.message))
+
+            if message:
+              with lock:
+                error_messages.extend(message)
 
           with lock:
             patches[patch_index] = (xf_index, patch)
@@ -781,8 +828,15 @@
       if sys.stdout.isatty():
         print('\n')
 
+      if warning_messages:
+        print('WARNING:')
+        print('\n'.join(warning_messages))
+        print('\n\n\n')
+
       if error_messages:
+        print('ERROR:')
         print('\n'.join(error_messages))
+        print('\n\n\n')
         sys.exit(1)
     else:
       patches = []
@@ -1140,12 +1194,9 @@
       Compared to the fixed 1024-block limit, it reduces the overall package
       size by 30% for volantis, and 20% for angler and bullhead."""
 
+      assert style == "diff"
       # Possibly split large files into smaller chunks.
       pieces = 0
-      cache_size = common.OPTIONS.cache_size
-      split_threshold = 0.125
-      max_blocks_per_transfer = int(cache_size * split_threshold /
-                                    self.tgt.blocksize)
 
       # Change nothing for small files.
       if (tgt_ranges.size() <= max_blocks_per_transfer and
@@ -1155,6 +1206,14 @@
                  style, by_id)
         return
 
+      if tgt_name.split(".")[-1].lower() in ("apk", "jar", "zip"):
+        split_enable = (not self.disable_imgdiff and src_ranges.monotonic and
+                        tgt_ranges.monotonic)
+        if split_enable and (self.tgt.RangeSha1(tgt_ranges) !=
+                             self.src.RangeSha1(src_ranges)):
+          large_apks.append((tgt_name, src_name, tgt_ranges, src_ranges))
+          return
+
       while (tgt_ranges.size() > max_blocks_per_transfer and
              src_ranges.size() > max_blocks_per_transfer):
         tgt_split_name = "%s-%d" % (tgt_name, pieces)
@@ -1248,8 +1307,136 @@
       AddSplitTransfers(
           tgt_name, src_name, tgt_ranges, src_ranges, style, by_id)
 
+    def ParseAndValidateSplitInfo(patch_size, tgt_ranges, src_ranges,
+                                  split_info):
+      """Parse the split_info and return a list of info tuples.
+
+      Args:
+        patch_size: total size of the patch file.
+        tgt_ranges: Ranges of the target file within the original image.
+        src_ranges: Ranges of the source file within the original image.
+        split_info format:
+          imgdiff version#
+          count of pieces
+          <patch_size_1> <tgt_size_1> <src_ranges_1>
+          ...
+          <patch_size_n> <tgt_size_n> <src_ranges_n>
+
+      Returns:
+        [patch_start, patch_len, split_tgt_ranges, split_src_ranges]
+      """
+
+      version = int(split_info[0])
+      assert version == 2
+      count = int(split_info[1])
+      assert len(split_info) - 2 == count
+
+      split_info_list = []
+      patch_start = 0
+      tgt_remain = copy.deepcopy(tgt_ranges)
+      # each line has the format <patch_size>, <tgt_size>, <src_ranges>
+      for line in split_info[2:]:
+        info = line.split()
+        assert len(info) == 3
+        patch_length = int(info[0])
+
+        split_tgt_size = int(info[1])
+        assert split_tgt_size % 4096 == 0
+        assert split_tgt_size / 4096 <= tgt_remain.size()
+        split_tgt_ranges = tgt_remain.first(split_tgt_size / 4096)
+        tgt_remain = tgt_remain.subtract(split_tgt_ranges)
+
+        # Find the split_src_ranges within the image file from its relative
+        # position in file.
+        split_src_indices = RangeSet.parse_raw(info[2])
+        split_src_ranges = RangeSet()
+        for r in split_src_indices:
+          curr_range = src_ranges.first(r[1]).subtract(src_ranges.first(r[0]))
+          assert not split_src_ranges.overlaps(curr_range)
+          split_src_ranges = split_src_ranges.union(curr_range)
+
+        split_info_list.append((patch_start, patch_length,
+                                split_tgt_ranges, split_src_ranges))
+        patch_start += patch_length
+
+      # Check that the sizes of all the split pieces add up to the final file
+      # size for patch and target.
+      assert tgt_remain.size() == 0
+      assert patch_start == patch_size
+      return split_info_list
+
+    def AddSplitTransferForLargeApks():
+      """Create split transfers for large apk files.
+
+      Example: Chrome.apk will be split into
+        src-0: Chrome.apk-0, tgt-0: Chrome.apk-0
+        src-1: Chrome.apk-1, tgt-1: Chrome.apk-1
+        ...
+
+      After the split, the target pieces are continuous and block aligned; and
+      the source pieces are mutually exclusive. During the split, we also
+      generate and save the image patch between src-X & tgt-X. This patch will
+      be valid because the block ranges of src-X & tgt-X will always stay the
+      same afterwards; but there's a chance we don't use the patch if we
+      convert the "diff" command into "new" or "move" later.
+      """
+
+      while True:
+        with transfer_lock:
+          if not large_apks:
+            return
+          tgt_name, src_name, tgt_ranges, src_ranges = large_apks.pop(0)
+
+        src_file = common.MakeTempFile(prefix="src-")
+        tgt_file = common.MakeTempFile(prefix="tgt-")
+        with transfer_lock:
+          with open(src_file, "wb") as src_fd:
+            self.src.WriteRangeDataToFd(src_ranges, src_fd)
+          with open(tgt_file, "wb") as tgt_fd:
+            self.tgt.WriteRangeDataToFd(tgt_ranges, tgt_fd)
+
+        patch_file = common.MakeTempFile(prefix="patch-")
+        patch_info_file = common.MakeTempFile(prefix="split_info-")
+        cmd = ["imgdiff", "-z",
+               "--block-limit={}".format(max_blocks_per_transfer),
+               "--split-info=" + patch_info_file,
+               src_file, tgt_file, patch_file]
+        p = common.Run(cmd, stdout=subprocess.PIPE)
+        p.communicate()
+        # TODO(xunchang) fall back to the normal split if imgdiff fails.
+        if p.returncode != 0:
+          raise ValueError("Failed to create patch between {} and {}".format(
+              src_name, tgt_name))
+
+        with open(patch_info_file) as patch_info:
+          lines = patch_info.readlines()
+
+        patch_size_total = os.path.getsize(patch_file)
+        split_info_list = ParseAndValidateSplitInfo(patch_size_total,
+                                                    tgt_ranges, src_ranges,
+                                                    lines)
+        for index, (patch_start, patch_length, split_tgt_ranges,
+            split_src_ranges) in enumerate(split_info_list):
+          with open(patch_file) as f:
+            f.seek(patch_start)
+            patch_content = f.read(patch_length)
+
+          split_src_name = "{}-{}".format(src_name, index)
+          split_tgt_name = "{}-{}".format(tgt_name, index)
+          transfer_split = Transfer(split_tgt_name, split_src_name,
+                                    split_tgt_ranges, split_src_ranges,
+                                    self.tgt.RangeSha1(split_tgt_ranges),
+                                    self.src.RangeSha1(split_src_ranges),
+                                    "diff", self.transfers)
+          transfer_split.patch = patch_content
+
     print("Finding transfers...")
 
+    large_apks = []
+    cache_size = common.OPTIONS.cache_size
+    split_threshold = 0.125
+    max_blocks_per_transfer = int(cache_size * split_threshold /
+                                  self.tgt.blocksize)
     empty = RangeSet()
     for tgt_fn, tgt_ranges in self.tgt.file_map.items():
       if tgt_fn == "__ZERO":
@@ -1294,6 +1481,14 @@
 
       AddTransfer(tgt_fn, None, tgt_ranges, empty, "new", self.transfers)
 
+    transfer_lock = threading.Lock()
+    threads = [threading.Thread(target=AddSplitTransferForLargeApks)
+               for _ in range(self.threads)]
+    for th in threads:
+      th.start()
+    while threads:
+      threads.pop().join()
+
   def AbbreviateSourceNames(self):
     for k in self.src.file_map.keys():
       b = os.path.basename(k)
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 3e58651..9acbf88 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -1571,11 +1571,11 @@
     #   decompression_time: 15s  | 25s                | 25s
 
     if not self.src:
-      bro_cmd = ['bro', '--quality', '6',
-                 '--input', '{}.new.dat'.format(self.path),
-                 '--output', '{}.new.dat.br'.format(self.path)]
+      brotli_cmd = ['brotli', '--quality=6',
+                    '--output={}.new.dat.br'.format(self.path),
+                    '{}.new.dat'.format(self.path)]
       print("Compressing {}.new.dat with brotli".format(self.partition))
-      p = Run(bro_cmd, stdout=subprocess.PIPE)
+      p = Run(brotli_cmd, stdout=subprocess.PIPE)
       p.communicate()
       assert p.returncode == 0,\
           'compression of {}.new.dat failed'.format(self.partition)
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index a9e1606..60aa84e 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -21,9 +21,6 @@
 
 Usage:  ota_from_target_files [flags] input_target_files output_ota_package
 
-  --board_config  <file>
-      Deprecated.
-
   -k (--package_key) <key> Key to use to sign the package (default is
       the value of default_system_dev_certificate from the input
       target-files's META/misc_info.txt, or
@@ -46,9 +43,9 @@
       Similar to --full_radio. When generating an incremental OTA, always
       include a full copy of bootloader image.
 
-  -v  (--verify)
-      Remount and verify the checksums of the files written to the
-      system and vendor (if used) partitions.  Incremental builds only.
+  --verify
+      Remount and verify the checksums of the files written to the system and
+      vendor (if used) partitions. Non-A/B incremental OTAs only.
 
   -o  (--oem_settings)  <main_file[,additional_files...]>
       Comma seperated list of files used to specify the expected OEM-specific
@@ -1290,9 +1287,7 @@
 def main(argv):
 
   def option_handler(o, a):
-    if o == "--board_config":
-      pass   # deprecated
-    elif o in ("-k", "--package_key"):
+    if o in ("-k", "--package_key"):
       OPTIONS.package_key = a
     elif o in ("-i", "--incremental_from"):
       OPTIONS.incremental_source = a
@@ -1354,7 +1349,6 @@
   args = common.ParseOptions(argv, __doc__,
                              extra_opts="b:k:i:d:we:t:2o:",
                              extra_long_opts=[
-                                 "board_config=",
                                  "package_key=",
                                  "incremental_from=",
                                  "full_radio",
diff --git a/tools/releasetools/rangelib.py b/tools/releasetools/rangelib.py
index fa6eec1..87380a5 100644
--- a/tools/releasetools/rangelib.py
+++ b/tools/releasetools/rangelib.py
@@ -320,7 +320,7 @@
     [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
     >>> list(RangeSet("10-19 3-5").next_item())
     [3, 4, 5, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19]
-    >>> list(rangelib.RangeSet("10-19 3 5 7").next_item())
+    >>> list(RangeSet("10-19 3 5 7").next_item())
     [3, 5, 7, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19]
     """
     for s, e in self:
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 83c2487..44977a4 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -444,7 +444,7 @@
   except KeyError:
     raise common.ExternalError("can't read META/otakeys.txt from input")
 
-  extra_recovery_keys = misc_info.get("extra_recovery_keys", None)
+  extra_recovery_keys = misc_info.get("extra_recovery_keys")
   if extra_recovery_keys:
     extra_recovery_keys = [OPTIONS.key_map.get(k, k) + ".x509.pem"
                            for k in extra_recovery_keys.split()]
@@ -468,8 +468,10 @@
   else:
     devkey = misc_info.get("default_system_dev_certificate",
                            "build/target/product/security/testkey")
-    mapped_keys.append(
-        OPTIONS.key_map.get(devkey, devkey) + ".x509.pem")
+    mapped_devkey = OPTIONS.key_map.get(devkey, devkey)
+    if mapped_devkey != devkey:
+      misc_info["default_system_dev_certificate"] = mapped_devkey
+    mapped_keys.append(mapped_devkey + ".x509.pem")
     print("META/otakeys.txt has no keys; using %s for OTA package"
           " verification." % (mapped_keys[0],))
 
diff --git a/tools/releasetools/test_common.py b/tools/releasetools/test_common.py
index 36f256d..10ec0d3 100644
--- a/tools/releasetools/test_common.py
+++ b/tools/releasetools/test_common.py
@@ -20,32 +20,27 @@
 import unittest
 import zipfile
 
+from hashlib import sha1
+
 import common
 import validate_target_files
 
-
-def random_string_with_holes(size, block_size, step_size):
-  data = ["\0"] * size
-  for begin in range(0, size, step_size):
-    end = begin + block_size
-    data[begin:end] = os.urandom(block_size)
-  return "".join(data)
+KiB = 1024
+MiB = 1024 * KiB
+GiB = 1024 * MiB
 
 def get_2gb_string():
-  kilobytes = 1024
-  megabytes = 1024 * kilobytes
-  gigabytes = 1024 * megabytes
-
-  size = int(2 * gigabytes + 1)
-  block_size = 4 * kilobytes
-  step_size = 4 * megabytes
-  two_gb_string = random_string_with_holes(
-        size, block_size, step_size)
-  return two_gb_string
+  size = int(2 * GiB + 1)
+  block_size = 4 * KiB
+  step_size = 4 * MiB
+  # Generate a long string with holes, e.g. 'xyz\x00abc\x00...'.
+  for _ in range(0, size, step_size):
+    yield os.urandom(block_size)
+    yield '\0' * (step_size - block_size)
 
 
 class CommonZipTest(unittest.TestCase):
-  def _verify(self, zip_file, zip_file_name, arcname, contents,
+  def _verify(self, zip_file, zip_file_name, arcname, expected_hash,
               test_file_name=None, expected_stat=None, expected_mode=0o644,
               expected_compress_type=zipfile.ZIP_STORED):
     # Verify the stat if present.
@@ -69,7 +64,11 @@
     self.assertEqual(info.compress_type, expected_compress_type)
 
     # Verify the zip contents.
-    self.assertEqual(zip_file.read(arcname), contents)
+    entry = zip_file.open(arcname)
+    sha1_hash = sha1()
+    for chunk in iter(lambda: entry.read(4 * MiB), ''):
+      sha1_hash.update(chunk)
+    self.assertEqual(expected_hash, sha1_hash.hexdigest())
     self.assertIsNone(zip_file.testzip())
 
   def _test_ZipWrite(self, contents, extra_zipwrite_args=None):
@@ -90,7 +89,10 @@
     zip_file = zipfile.ZipFile(zip_file_name, "w")
 
     try:
-      test_file.write(contents)
+      sha1_hash = sha1()
+      for data in contents:
+        sha1_hash.update(data)
+        test_file.write(data)
       test_file.close()
 
       expected_stat = os.stat(test_file_name)
@@ -102,8 +104,9 @@
       common.ZipWrite(zip_file, test_file_name, **extra_zipwrite_args)
       common.ZipClose(zip_file)
 
-      self._verify(zip_file, zip_file_name, arcname, contents, test_file_name,
-                   expected_stat, expected_mode, expected_compress_type)
+      self._verify(zip_file, zip_file_name, arcname, sha1_hash.hexdigest(),
+                   test_file_name, expected_stat, expected_mode,
+                   expected_compress_type)
     finally:
       os.remove(test_file_name)
       os.remove(zip_file_name)
@@ -133,7 +136,7 @@
       common.ZipWriteStr(zip_file, zinfo_or_arcname, contents, **extra_args)
       common.ZipClose(zip_file)
 
-      self._verify(zip_file, zip_file_name, arcname, contents,
+      self._verify(zip_file, zip_file_name, arcname, sha1(contents).hexdigest(),
                    expected_mode=expected_mode,
                    expected_compress_type=expected_compress_type)
     finally:
@@ -159,7 +162,10 @@
     zip_file = zipfile.ZipFile(zip_file_name, "w")
 
     try:
-      test_file.write(large)
+      sha1_hash = sha1()
+      for data in large:
+        sha1_hash.update(data)
+        test_file.write(data)
       test_file.close()
 
       expected_stat = os.stat(test_file_name)
@@ -173,12 +179,13 @@
       common.ZipClose(zip_file)
 
       # Verify the contents written by ZipWrite().
-      self._verify(zip_file, zip_file_name, arcname_large, large,
-                   test_file_name, expected_stat, expected_mode,
-                   expected_compress_type)
+      self._verify(zip_file, zip_file_name, arcname_large,
+                   sha1_hash.hexdigest(), test_file_name, expected_stat,
+                   expected_mode, expected_compress_type)
 
       # Verify the contents written by ZipWriteStr().
-      self._verify(zip_file, zip_file_name, arcname_small, small,
+      self._verify(zip_file, zip_file_name, arcname_small,
+                   sha1(small).hexdigest(),
                    expected_compress_type=expected_compress_type)
     finally:
       os.remove(zip_file_name)
@@ -287,13 +294,17 @@
       common.ZipWriteStr(zip_file, zinfo, random_string, perms=0o400)
       common.ZipClose(zip_file)
 
-      self._verify(zip_file, zip_file_name, "foo", random_string,
+      self._verify(zip_file, zip_file_name, "foo",
+                   sha1(random_string).hexdigest(),
                    expected_mode=0o644)
-      self._verify(zip_file, zip_file_name, "bar", random_string,
+      self._verify(zip_file, zip_file_name, "bar",
+                   sha1(random_string).hexdigest(),
                    expected_mode=0o755)
-      self._verify(zip_file, zip_file_name, "baz", random_string,
+      self._verify(zip_file, zip_file_name, "baz",
+                   sha1(random_string).hexdigest(),
                    expected_mode=0o740)
-      self._verify(zip_file, zip_file_name, "qux", random_string,
+      self._verify(zip_file, zip_file_name, "qux",
+                   sha1(random_string).hexdigest(),
                    expected_mode=0o400)
     finally:
       os.remove(zip_file_name)
@@ -310,8 +321,18 @@
     dummy_fstab = \
         ["/dev/soc.0/by-name/boot /boot emmc defaults defaults",
          "/dev/soc.0/by-name/recovery /recovery emmc defaults defaults"]
-    self._info["fstab"] = common.LoadRecoveryFSTab(lambda x : "\n".join(x),
-                                                   2, dummy_fstab)
+    self._info["fstab"] = common.LoadRecoveryFSTab("\n".join, 2, dummy_fstab)
+    # Construct the gzipped recovery.img and boot.img
+    self.recovery_data = bytearray([
+        0x1f, 0x8b, 0x08, 0x00, 0x81, 0x11, 0x02, 0x5a, 0x00, 0x03, 0x2b, 0x4a,
+        0x4d, 0xce, 0x2f, 0x4b, 0x2d, 0xaa, 0x04, 0x00, 0xc9, 0x93, 0x43, 0xf3,
+        0x08, 0x00, 0x00, 0x00
+    ])
+    # echo -n "boot" | gzip -f | hd
+    self.boot_data = bytearray([
+        0x1f, 0x8b, 0x08, 0x00, 0x8c, 0x12, 0x02, 0x5a, 0x00, 0x03, 0x4b, 0xca,
+        0xcf, 0x2f, 0x01, 0x00, 0xc4, 0xae, 0xed, 0x46, 0x04, 0x00, 0x00, 0x00
+    ])
 
   def _out_tmp_sink(self, name, data, prefix="SYSTEM"):
     loc = os.path.join(self._tempdir, prefix, name)
@@ -321,8 +342,8 @@
       f.write(data)
 
   def test_full_recovery(self):
-    recovery_image = common.File("recovery.img", "recovery");
-    boot_image = common.File("boot.img", "boot");
+    recovery_image = common.File("recovery.img", self.recovery_data)
+    boot_image = common.File("boot.img", self.boot_data)
     self._info["full_recovery_image"] = "true"
 
     common.MakeRecoveryPatch(self._tempdir, self._out_tmp_sink,
@@ -331,9 +352,9 @@
                                                         self._info)
 
   def test_recovery_from_boot(self):
-    recovery_image = common.File("recovery.img", "recovery");
+    recovery_image = common.File("recovery.img", self.recovery_data)
     self._out_tmp_sink("recovery.img", recovery_image.data, "IMAGES")
-    boot_image = common.File("boot.img", "boot");
+    boot_image = common.File("boot.img", self.boot_data)
     self._out_tmp_sink("boot.img", boot_image.data, "IMAGES")
 
     common.MakeRecoveryPatch(self._tempdir, self._out_tmp_sink,
diff --git a/tools/signapk/Android.bp b/tools/signapk/Android.bp
new file mode 100644
index 0000000..4954cf5
--- /dev/null
+++ b/tools/signapk/Android.bp
@@ -0,0 +1,31 @@
+//
+// Copyright (C) 2008 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+// the signapk tool (a .jar application used to sign packages)
+// ============================================================
+java_library_host {
+    name: "signapk",
+    srcs: ["src/**/*.java"],
+    manifest: "SignApk.mf",
+    static_libs: [
+        "apksig",
+        "bouncycastle",
+        "bouncycastle-bcpkix",
+        "conscrypt",
+    ],
+
+    required: ["libconscrypt_openjdk_jni"],
+}
diff --git a/tools/signapk/Android.mk b/tools/signapk/Android.mk
index 8082842..ff54d6d 100644
--- a/tools/signapk/Android.mk
+++ b/tools/signapk/Android.mk
@@ -15,24 +15,10 @@
 #
 LOCAL_PATH := $(call my-dir)
 
-# the signapk tool (a .jar application used to sign packages)
-# ============================================================
-include $(CLEAR_VARS)
-LOCAL_MODULE := signapk
-LOCAL_SRC_FILES := $(call all-java-files-under, src)
-LOCAL_JAR_MANIFEST := SignApk.mf
-LOCAL_STATIC_JAVA_LIBRARIES := \
-    apksig \
-    bouncycastle \
-    bouncycastle-bcpkix \
-    conscrypt
-LOCAL_REQUIRED_MODULES := libconscrypt_openjdk_jni
-include $(BUILD_HOST_JAVA_LIBRARY)
-
 ifeq ($(TARGET_BUILD_APPS),)
 # The post-build signing tools need signapk.jar and its shared libraries,
 # but we don't need this if we're just doing unbundled apps.
-my_dist_files := $(LOCAL_INSTALLED_MODULE) \
+my_dist_files := $(HOST_OUT_JAVA_LIBRARIES)/signapk.jar \
     $(HOST_OUT_SHARED_LIBRARIES)/libconscrypt_openjdk_jni$(HOST_SHLIB_SUFFIX)
 
 $(call dist-for-goals,droidcore,$(my_dist_files))
diff --git a/tools/signapk/OWNERS b/tools/signapk/OWNERS
new file mode 100644
index 0000000..0b8d398
--- /dev/null
+++ b/tools/signapk/OWNERS
@@ -0,0 +1,2 @@
+cbrubaker@google.com
+klyubin@google.com
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 3b00599..fdf6283 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -1082,14 +1082,15 @@
                     ByteBuffer[] outputChunks = new ByteBuffer[] {v1SignedApk};
 
                     ZipSections zipSections = findMainZipSections(v1SignedApk);
-                    ApkSignerEngine.OutputApkSigningBlockRequest addV2SignatureRequest =
-                            apkSigner.outputZipSections(
+                    ApkSignerEngine.OutputApkSigningBlockRequest2 addV2SignatureRequest =
+                            apkSigner.outputZipSections2(
                                     DataSources.asDataSource(zipSections.beforeCentralDir),
                                     DataSources.asDataSource(zipSections.centralDir),
                                     DataSources.asDataSource(zipSections.eocd));
                     if (addV2SignatureRequest != null) {
                         // Need to insert the returned APK Signing Block before ZIP Central
                         // Directory.
+                        int padding = addV2SignatureRequest.getPaddingSizeBeforeApkSigningBlock();
                         byte[] apkSigningBlock = addV2SignatureRequest.getApkSigningBlock();
                         // Because the APK Signing Block is inserted before the Central Directory,
                         // we need to adjust accordingly the offset of Central Directory inside the
@@ -1100,10 +1101,12 @@
                         modifiedEocd.order(ByteOrder.LITTLE_ENDIAN);
                         ApkUtils.setZipEocdCentralDirectoryOffset(
                                 modifiedEocd,
-                                zipSections.beforeCentralDir.remaining() + apkSigningBlock.length);
+                                zipSections.beforeCentralDir.remaining() + padding +
+                                apkSigningBlock.length);
                         outputChunks =
                                 new ByteBuffer[] {
                                         zipSections.beforeCentralDir,
+                                        ByteBuffer.allocate(padding),
                                         ByteBuffer.wrap(apkSigningBlock),
                                         zipSections.centralDir,
                                         modifiedEocd};
diff --git a/tools/vendor_buildinfo.sh b/tools/vendor_buildinfo.sh
index 485ada3..c12f7cb 100755
--- a/tools/vendor_buildinfo.sh
+++ b/tools/vendor_buildinfo.sh
@@ -6,10 +6,10 @@
 echo "ro.product.board=$TARGET_BOOTLOADER_BOARD_NAME"
 echo "ro.board.platform=$TARGET_BOARD_PLATFORM"
 
-echo "ro.vendor.product.manufacturer=$PRODUCT_MANUFACTURER"
-echo "ro.vendor.product.model=$PRODUCT_MODEL"
-echo "ro.vendor.product.brand=$PRODUCT_BRAND"
-echo "ro.vendor.product.name=$PRODUCT_NAME"
-echo "ro.vendor.product.device=$TARGET_DEVICE"
+echo "ro.product.vendor.manufacturer=$PRODUCT_MANUFACTURER"
+echo "ro.product.vendor.model=$PRODUCT_MODEL"
+echo "ro.product.vendor.brand=$PRODUCT_BRAND"
+echo "ro.product.vendor.name=$PRODUCT_NAME"
+echo "ro.product.vendor.device=$TARGET_DEVICE"
 
 echo "# end build properties"
diff --git a/tools/zipalign/Android.bp b/tools/zipalign/Android.bp
index 2aa6450..8e6196d 100644
--- a/tools/zipalign/Android.bp
+++ b/tools/zipalign/Android.bp
@@ -15,13 +15,16 @@
 
     cflags: ["-Wall", "-Werror"],
 
+    // NOTE: Do not add any shared_libs dependencies because they will break the
+    // static_sdk_tools target.
     static_libs: [
-        "libandroidfw",
         "libutils",
         "libcutils",
         "liblog",
-        "libzopfli",
+        "libziparchive",
         "libz",
+        "libbase",
+        "libzopfli",
     ],
 
     target: {
diff --git a/tools/zipalign/ZipFile.cpp b/tools/zipalign/ZipFile.cpp
index 719c6b9..43bc9bf 100644
--- a/tools/zipalign/ZipFile.cpp
+++ b/tools/zipalign/ZipFile.cpp
@@ -20,13 +20,12 @@
 
 #define LOG_TAG "zip"
 
-#include <androidfw/ZipUtils.h>
 #include <utils/Log.h>
+#include <ziparchive/zip_archive.h>
 
 #include "ZipFile.h"
 
 #include <zlib.h>
-#define DEF_MEM_LEVEL 8                // normally in zutil.h?
 
 #include "zopfli/deflate.h"
 
@@ -135,7 +134,7 @@
 /*
  * Return the Nth entry in the archive.
  */
-ZipEntry* ZipFile::getEntryByIndex(int idx) const
+android::ZipEntry* ZipFile::getEntryByIndex(int idx) const
 {
     if (idx < 0 || idx >= (int) mEntries.size())
         return NULL;
@@ -146,7 +145,7 @@
 /*
  * Find an entry by name.
  */
-ZipEntry* ZipFile::getEntryByName(const char* fileName) const
+android::ZipEntry* ZipFile::getEntryByName(const char* fileName) const
 {
     /*
      * Do a stupid linear string-compare search.
@@ -1196,6 +1195,58 @@
 }
 #endif
 
+class BufferWriter : public zip_archive::Writer {
+  public:
+    BufferWriter(void* buf, size_t size) : Writer(),
+        buf_(reinterpret_cast<uint8_t*>(buf)), size_(size), bytes_written_(0) {}
+
+    bool Append(uint8_t* buf, size_t buf_size) override {
+        if (bytes_written_ + buf_size > size_) {
+            return false;
+        }
+
+        memcpy(buf_ + bytes_written_, buf, buf_size);
+        bytes_written_ += buf_size;
+        return true;
+    }
+
+  private:
+    uint8_t* const buf_;
+    const size_t size_;
+    size_t bytes_written_;
+};
+
+class FileReader : public zip_archive::Reader {
+  public:
+    FileReader(FILE* fp) : Reader(), fp_(fp), current_offset_(0) {
+    }
+
+    bool ReadAtOffset(uint8_t* buf, size_t len, uint32_t offset) const {
+        // Data is usually requested sequentially, so this helps avoid pointless
+        // fseeks every time we perform a read. There's an impedence mismatch
+        // here because the original API was designed around pread and pwrite.
+        if (offset != current_offset_) {
+            if (fseek(fp_, offset, SEEK_SET) != 0) {
+                return false;
+            }
+
+            current_offset_ = offset;
+        }
+
+        size_t read = fread(buf, 1, len, fp_);
+        if (read != len) {
+            return false;
+        }
+
+        current_offset_ += read;
+        return true;
+    }
+
+  private:
+    FILE* fp_;
+    mutable uint32_t current_offset_;
+};
+
 // free the memory when you're done
 void* ZipFile::uncompress(const ZipEntry* entry) const
 {
@@ -1238,11 +1289,13 @@
             }
             break;
         case ZipEntry::kCompressDeflated: {
-            if (!ZipUtils::inflateToBuffer(mZipFp, buf, unlen, clen)) {
+            const FileReader reader(mZipFp);
+            BufferWriter writer(buf, unlen);
+            if (zip_archive::Inflate(reader, clen, unlen, &writer, nullptr) != 0) {
                 goto bail;
             }
-            }
             break;
+        }
         default:
             goto bail;
     }