diff --git a/Android.mk b/Android.mk
index a1455d4..5053e7d 100644
--- a/Android.mk
+++ b/Android.mk
@@ -1,8 +1 @@
-LOCAL_PATH := $(call my-dir)
-
-# We're relocating the build project to a subdirectory, then using symlinks
-# to expose the subdirectories where they used to be. If the manifest hasn't
-# been updated, we need to include all the subdirectories.
-ifeq ($(LOCAL_PATH),build)
-include $(call first-makefiles-under,$(LOCAL_PATH))
-endif
+include $(call all-subdir-makefiles)
diff --git a/CleanSpec.mk b/CleanSpec.mk
index fff622f..63d6f66 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -424,6 +424,10 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/vendor/nativetest*)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/nativetest*)
 
+# Jack is no longer the default compiler, remove the intermediates
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/*/*/classes*.jack)
+$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/*/*/jack*)
+
 # Move adbd from $(PRODUCT_OUT)/root/sbin to $(PRODUCT_OUT)/system/bin
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/root/sbin/adbd)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/symbols/sbin/adbd)
diff --git a/README.txt b/README.txt
new file mode 100644
index 0000000..004210b
--- /dev/null
+++ b/README.txt
@@ -0,0 +1,85 @@
+Android build system usage:
+
+m [-j] [<targets>] [<variable>=<value>...]
+
+
+Ways to specify what to build:
+  The common way to specify what to build is to set that information in the
+  environment via:
+
+    # Set up the shell environment.
+    source build/envsetup.sh # Run "hmm" after sourcing for more info
+    # Select the device and variant to target. If no argument is given, it
+    # will list choices and prompt.
+    lunch [<product>-<variant>] # Selects the device and variant to target.
+    # Invoke the configured build.
+    m [<options>] [<targets>] [<variable>=<value>...]
+
+      <product> is the device that the created image is intended to be run on.
+        This is saved in the shell environment as $TARGET_PRODUCT by `lunch`.
+      <variant> is one of "user", "userdebug", or "eng", and controls the
+        amount of debugging to be added into the generated image.
+        This gets saved in the shell environment as $TARGET_BUILD_VARIANT by
+          `lunch`.
+
+    Each of <options>, <targets>, and <variable>=<value> is optional.
+      If no targets are specified, the build system will build the images
+      for the configured product and variant.
+
+  An alternative to setting $TARGET_PRODUCT and $TARGET_BUILD_VARIANT,
+  which you may see in build servers, is to execute:
+
+    make PRODUCT-<product>-<variant>
+
+
+  A target may be a file path. For example, out/host/linux-x86/bin/adb .
+    Note that when giving a relative file path as a target, that path is
+    interpreted relative to the root of the source tree (rather than relative
+    to the current working directory).
+
+  A target may also be any other target defined within a Makefile. Run
+    `m help` to view the names of some common targets.
+
+  To view the modules and targets defined in a particular directory, look for:
+    files named *.mk (most commonly Android.mk)
+      these files are defined in Make syntax
+    files named Android.bp
+      these files are defined in Blueprint syntax
+
+  For now, the full (extremely large) compiled list of targets can be found
+    (after running the build once), split among these two files:
+
+    ${OUT}/build-<product>*.ninja
+    ${OUT}/soong/build.ninja
+
+    If you find yourself interacting with these files, you are encouraged to
+    provide a more convenient tool for browsing targets, and to mention the
+    tool here.
+
+Targets that adjust an existing build:
+  showcommands              Display the individual commands run to implement
+                            the build
+  dist                      Copy into ${DIST_DIR} the portion of the build
+                            that must be distributed
+
+Flags
+  -j <N>                    Run <N> processes at once
+  -j                        Autodetect the number of processes to run at once,
+                            and run that many
+
+Variables
+  Variables can either be set in the surrounding shell environment or can be
+    passed as command-line arguments. For example:
+      export I_AM_A_SHELL_VAR=1
+      I_AM_ANOTHER_SHELL_VAR=2 make droid I_AM_A_MAKE_VAR=3
+  Here are some common variables and their meanings:
+    TARGET_PRODUCT          The <product> to build # as described above
+    TARGET_BUILD_VARIANT    The <variant> to build # as described above
+    DIST_DIR                The directory in which to place the distribution
+                            artifacts.
+    OUT_DIR                 The directory in which to place non-distribution
+                            artifacts.
+
+  There is not yet known a convenient method by which to discover the full
+  list of supported variables. Please mention it here when there is.
+
diff --git a/core/Makefile b/core/Makefile
index 7f0e1cd..0b341be 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -243,7 +243,7 @@
 # if it isn't already a part of the flavor (via a dedicated lunch
 # config for example).
 TARGET_BUILD_FLAVOR := $(TARGET_PRODUCT)-$(TARGET_BUILD_VARIANT)
-ifdef SANITIZE_TARGET
+ifneq (, $(filter address, $(SANITIZE_TARGET)))
 ifeq (,$(findstring _asan,$(TARGET_BUILD_FLAVOR)))
 TARGET_BUILD_FLAVOR := $(TARGET_BUILD_FLAVOR)_asan
 endif
@@ -1034,6 +1034,23 @@
 $(if $(2),$(hide) $(foreach kv,$(2),echo "$(kv)" >> $(1);))
 endef
 
+# $(1): modules list
+# $(2): output dir
+# $(3): mount point
+# $(4): staging dir
+# Depmod requires a well-formed kernel version so 0.0 is used as a placeholder.
+define build-image-kernel-modules
+    $(hide) rm -rf $(2)/lib/modules
+    $(hide) mkdir -p $(2)/lib/modules
+    $(hide) cp $(1) $(2)/lib/modules/
+    $(hide) rm -rf $(4)
+    $(hide) mkdir -p $(4)/lib/modules/0.0/$(3)lib/modules
+    $(hide) cp $(1) $(4)/lib/modules/0.0/$(3)lib/modules
+    $(hide) $(DEPMOD) -b $(4) 0.0
+    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' $(4)/lib/modules/0.0/modules.dep > $(2)/lib/modules/modules.dep
+    $(hide) cp $(4)/lib/modules/0.0/modules.alias $(2)/lib/modules
+endef
+
 # -----------------------------------------------------------------
 # Recovery image
 
@@ -1168,23 +1185,6 @@
 
 RECOVERYIMAGE_ID_FILE := $(PRODUCT_OUT)/recovery.id
 
-# $(1): modules list
-# $(2): output dir
-# $(3): mount point
-# $(4): staging dir
-# Depmod requires a well-formed kernel version so 0.0 is used as a placeholder.
-define build-image-kernel-modules
-    $(hide) rm -rf $(2)/lib/modules
-    $(hide) mkdir -p $(2)/lib/modules
-    $(hide) cp $(1) $(2)/lib/modules/
-    $(hide) rm -rf $(4)
-    $(hide) mkdir -p $(4)/lib/modules/0.0/$(3)lib/modules
-    $(hide) cp $(1) $(4)/lib/modules/0.0/$(3)lib/modules
-    $(hide) $(DEPMOD) -b $(4) 0.0
-    $(hide) sed -e 's/\(.*modules.*\):/\/\1:/g' -e 's/ \([^ ]*modules[^ ]*\)/ \/\1/g' $(4)/lib/modules/0.0/modules.dep > $(2)/lib/modules/modules.dep
-    $(hide) cp $(4)/lib/modules/0.0/modules.alias $(2)/lib/modules
-endef
-
 # $(1): output file
 define build-recoveryimage-target
   @echo ----- Making recovery image ------
@@ -1783,8 +1783,11 @@
 
 # We just build this directly to the install location.
 INSTALLED_SYSTEMOTHERIMAGE_TARGET := $(BUILT_SYSTEMOTHERIMAGE_TARGET)
+ifneq (true,$(SANITIZE_LITE))
+# Only create system_other when not building the second stage of a SANITIZE_LITE build.
 $(INSTALLED_SYSTEMOTHERIMAGE_TARGET): $(INTERNAL_USERIMAGES_DEPS) $(INTERNAL_SYSTEMOTHERIMAGE_FILES) $(INSTALLED_FILES_FILE_SYSTEMOTHER)
 	$(build-systemotherimage-target)
+endif
 
 .PHONY: systemotherimage-nodeps
 systemotherimage-nodeps: | $(INTERNAL_USERIMAGES_DEPS)
@@ -2147,6 +2150,7 @@
   system/extras/verity/build_verity_metadata.py \
   system/extras/ext4_utils/mke2fs.conf \
   external/avb/test/data/testkey_rsa4096.pem \
+  $(shell find system/update_engine/scripts -name \*.pyc -prune -o -type f -print | sort) \
   $(shell find build/target/product/security -type f -name \*.x509.pem -o -name \*.pk8 -o \
       -name verity_key | sort) \
   $(shell find device vendor -type f -name \*.pk8 -o -name verifiedboot\* -o \
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 07d1cd9..57ac23c 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -579,6 +579,9 @@
 ALL_MODULES.$(my_register_name).EXPLICITLY_REQUIRED := \
     $(strip $(ALL_MODULES.$(my_register_name).EXPLICITLY_REQUIRED)\
         $(my_required_modules))
+ALL_MODULES.$(my_register_name).TARGET_REQUIRED := \
+    $(strip $(ALL_MODULES.$(my_register_name).TARGET_REQUIRED)\
+        $(LOCAL_TARGET_REQUIRED_MODULES))
 ALL_MODULES.$(my_register_name).EVENT_LOG_TAGS := \
     $(ALL_MODULES.$(my_register_name).EVENT_LOG_TAGS) $(event_log_tags)
 ALL_MODULES.$(my_register_name).MAKEFILE := \
diff --git a/core/binary.mk b/core/binary.mk
index 7dd9a13..6a58c6c 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -105,7 +105,7 @@
   ifneq (,$(filter arm64 mips64 x86_64,$(my_arch)))
     my_min_sdk_version := 21
   else
-    my_min_sdk_version := 9
+    my_min_sdk_version := $(MIN_SUPPORTED_SDK_VERSION)
   endif
 
   # Historically we've just set up a bunch of symlinks in prebuilts/ndk to map
@@ -290,6 +290,15 @@
 # Move other ldlibs back to shared libraries
 my_shared_libraries += $(patsubst -l%,lib%,$(filter-out $(my_allowed_ldlibs),$(my_ldlibs)))
 my_ldlibs := $(filter $(my_allowed_ldlibs),$(my_ldlibs))
+else # LOCAL_IS_HOST_MODULE
+  # Add -ldl, -lpthread and -lrt to host builds to match the default behavior of
+  # device builds
+  ifneq ($($(my_prefix)OS),windows)
+    my_ldlibs += -ldl -lpthread
+    ifneq ($(HOST_OS),darwin)
+      my_ldlibs += -lrt
+    endif
+  endif
 endif
 
 ifneq ($(LOCAL_SDK_VERSION),)
diff --git a/core/clang/config.mk b/core/clang/config.mk
index 0e59930..408f688 100644
--- a/core/clang/config.mk
+++ b/core/clang/config.mk
@@ -72,6 +72,7 @@
 # INTERNAL_LOCAL_CLANG_EXCEPTION_PROJECTS is defined later in other config.mk.
 LOCAL_CLANG_EXCEPTION_PROJECTS = \
   bionic/tests/ \
+  device/google/contexthub/ \
   device/huawei/angler/ \
   device/lge/bullhead/ \
   external/gentoo/integration/ \
diff --git a/core/cleanbuild.mk b/core/cleanbuild.mk
index 0e1c88d..64c5ae1 100644
--- a/core/cleanbuild.mk
+++ b/core/cleanbuild.mk
@@ -13,8 +13,32 @@
 # limitations under the License.
 #
 
-# Don't bother with the cleanspecs if you are running mm/mmm
-ifeq ($(ONE_SHOT_MAKEFILE)$(dont_bother)$(NO_ANDROID_CLEANSPEC),)
+# Absolute path of the present working direcotry.
+# This overrides the shell variable $PWD, which does not necessarily points to
+# the top of the source tree, for example when "make -C" is used in m/mm/mmm.
+PWD := $(shell pwd)
+
+TOP := .
+TOPDIR :=
+
+BUILD_SYSTEM := $(TOPDIR)build/core
+
+# Set up various standard variables based on configuration
+# and host information.
+include $(BUILD_SYSTEM)/config.mk
+
+include $(SOONG_MAKEVARS_MK)
+
+include $(BUILD_SYSTEM)/clang/config.mk
+
+# CTS-specific config.
+-include cts/build/config.mk
+# VTS-specific config.
+-include test/vts/tools/vts-tradefed/build/config.mk
+# device-tests-specific-config.
+-include tools/tradefederation/build/suites/device-tests/config.mk
+# general-tests-specific-config.
+-include tools/tradefederation/build/suites/general-tests/config.mk
 
 INTERNAL_CLEAN_STEPS :=
 
@@ -58,7 +82,7 @@
 
 # If the clean_steps.mk file is missing (usually after a clean build)
 # then we won't do anything.
-CURRENT_CLEAN_BUILD_VERSION := $(INTERNAL_CLEAN_BUILD_VERSION)
+CURRENT_CLEAN_BUILD_VERSION := MISSING
 CURRENT_CLEAN_STEPS := $(INTERNAL_CLEAN_STEPS)
 
 # Read the current state from the file, if present.
@@ -67,7 +91,9 @@
 clean_steps_file := $(PRODUCT_OUT)/clean_steps.mk
 -include $(clean_steps_file)
 
-ifneq ($(CURRENT_CLEAN_BUILD_VERSION),$(INTERNAL_CLEAN_BUILD_VERSION))
+ifeq ($(CURRENT_CLEAN_BUILD_VERSION),MISSING)
+  # Do nothing
+else ifneq ($(CURRENT_CLEAN_BUILD_VERSION),$(INTERNAL_CLEAN_BUILD_VERSION))
   # The major clean version is out-of-date.  Do a full clean, and
   # don't even bother with the clean steps.
   $(info *** A clean build is required because of a recent change.)
@@ -109,57 +135,18 @@
 
 # Write the new state to the file.
 #
-rewrite_clean_steps_file :=
 ifneq ($(CURRENT_CLEAN_BUILD_VERSION)-$(CURRENT_CLEAN_STEPS),$(INTERNAL_CLEAN_BUILD_VERSION)-$(INTERNAL_CLEAN_STEPS))
-rewrite_clean_steps_file := true
-endif
-ifeq ($(wildcard $(clean_steps_file)),)
-# This is the first build.
-rewrite_clean_steps_file := true
-endif
-ifeq ($(rewrite_clean_steps_file),true)
-$(shell \
-  mkdir -p $(dir $(clean_steps_file)) && \
-  echo "CURRENT_CLEAN_BUILD_VERSION := $(INTERNAL_CLEAN_BUILD_VERSION)" > \
-      $(clean_steps_file) ;\
-  echo "CURRENT_CLEAN_STEPS := $(wordlist 1,500,$(INTERNAL_CLEAN_STEPS))" >> $(clean_steps_file) \
- )
-define -cs-write-clean-steps-if-arg1-not-empty
-$(if $(1),$(shell echo "CURRENT_CLEAN_STEPS += $(1)" >> $(clean_steps_file)))
-endef
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 501,1000,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 1001,1500,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 1501,2000,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 2001,2500,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 2501,3000,$(INTERNAL_CLEAN_STEPS)))
-$(call -cs-write-clean-steps-if-arg1-not-empty,$(wordlist 3001,99999,$(INTERNAL_CLEAN_STEPS)))
+$(shell mkdir -p $(dir $(clean_steps_file)))
+$(file >$(clean_steps_file).tmp,CURRENT_CLEAN_BUILD_VERSION := $(INTERNAL_CLEAN_BUILD_VERSION)$(newline)CURRENT_CLEAN_STEPS := $(INTERNAL_CLEAN_STEPS)$(newline))
+$(shell if ! cmp -s $(clean_steps_file).tmp $(clean_steps_file); then \
+          mv $(clean_steps_file).tmp $(clean_steps_file); \
+        else \
+          rm $(clean_steps_file).tmp; \
+        fi)
 endif
 
 CURRENT_CLEAN_BUILD_VERSION :=
 CURRENT_CLEAN_STEPS :=
 clean_steps_file :=
-rewrite_clean_steps_file :=
 INTERNAL_CLEAN_STEPS :=
 INTERNAL_CLEAN_BUILD_VERSION :=
-
-endif  # if not ONE_SHOT_MAKEFILE dont_bother NO_ANDROID_CLEANSPEC
-
-###########################################################
-
-.PHONY: clean-jack-files
-clean-jack-files: clean-dex-files
-	$(hide) find $(OUT_DIR) -name "*.jack" | xargs rm -f
-	$(hide) find $(OUT_DIR) -type d -name "jack" | xargs rm -rf
-	@echo "All jack files have been removed."
-
-.PHONY: clean-dex-files
-clean-dex-files:
-	$(hide) find $(OUT_DIR) -name "*.dex" ! -path "*/jack-incremental/*" | xargs rm -f
-	$(hide) for i in `find $(OUT_DIR) -name "*.jar" -o -name "*.apk"` ; do ((unzip -l $$i 2> /dev/null | \
-				grep -q "\.dex$$" && rm -f $$i) || continue ) ; done
-	@echo "All dex files and archives containing dex files have been removed."
-
-.PHONY: clean-jack-incremental
-clean-jack-incremental:
-	$(hide) find $(OUT_DIR) -name "jack-incremental" -type d | xargs rm -rf
-	@echo "All jack incremental dirs have been removed."
diff --git a/core/cleanspec.mk b/core/cleanspec.mk
index 4441e2a..af28954 100644
--- a/core/cleanspec.mk
+++ b/core/cleanspec.mk
@@ -64,6 +64,6 @@
 # ************************************************
 
 subdir_cleanspecs := \
-    $(shell build/tools/findleaves.py $(FIND_LEAVES_EXCLUDES) . CleanSpec.mk)
+    $(file <$(OUT_DIR)/.module_paths/CleanSpec.mk.list)
 include $(subdir_cleanspecs)
 subdir_cleanspecs :=
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index a687866..bdac5dc 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -234,6 +234,7 @@
 LOCAL_STATIC_LIBRARIES:=
 LOCAL_STRIP_MODULE:=
 LOCAL_SYSTEM_SHARED_LIBRARIES:=none
+LOCAL_TARGET_REQUIRED_MODULES:=
 LOCAL_TEST_DATA:=
 LOCAL_TEST_MODULE_TO_PROGUARD_WITH:=
 LOCAL_TIDY:=
diff --git a/core/combo/TARGET_linux-arm.mk b/core/combo/TARGET_linux-arm.mk
index 2e179f6..73b1c04 100644
--- a/core/combo/TARGET_linux-arm.mk
+++ b/core/combo/TARGET_linux-arm.mk
@@ -29,6 +29,26 @@
 # include defines, and compiler settings for the given architecture
 # version.
 #
+ifeq ($(strip $(TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT)),)
+TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT := generic
+endif
+
+KNOWN_ARMv8_CORES := cortex-a53 cortex-a53.a57 cortex-a73
+KNOWN_ARMv8_CORES += kryo denver64 exynos-m1 exynos-m2
+
+# Many devices (incorrectly) use armv7-a-neon as the 2nd architecture variant
+# for cores that implement armv8-a ISAs. The following sets it to armv8-a.
+ifneq (,$(filter $(TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT), $(KNOWN_ARMv8_CORES)))
+  ifneq ($(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT),armv8-a)
+    $(warning $(TARGET_$(combo_2nd_arch_prefix)CPU_VARIANT) is armv8-a.)
+    ifneq (,$(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT))
+      $(warning TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT, $(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT), ignored! Use armv8-a instead.)
+    endif
+    # Overwrite TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT
+    TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT := armv8-a
+  endif
+endif
+
 ifeq ($(strip $(TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT)),)
 TARGET_$(combo_2nd_arch_prefix)ARCH_VARIANT := armv5te
 endif
diff --git a/core/combo/arch/arm/armv8-a.mk b/core/combo/arch/arm/armv8-a.mk
new file mode 100644
index 0000000..9ef5c49
--- /dev/null
+++ b/core/combo/arch/arm/armv8-a.mk
@@ -0,0 +1,9 @@
+# Configuration for Linux on ARM.
+# Generating binaries for the ARMv8-a architecture
+#
+# Many libraries are not aware of armv8-a, and AArch32 is (almost) a superset
+# of armv7-a-neon. So just let them think we are just like v7.
+ARCH_ARM_HAVE_ARMV7A            := true
+ARCH_ARM_HAVE_VFP               := true
+ARCH_ARM_HAVE_VFP_D32           := true
+ARCH_ARM_HAVE_NEON              := true
diff --git a/core/combo/javac.mk b/core/combo/javac.mk
index 5c2668c..835ee82 100644
--- a/core/combo/javac.mk
+++ b/core/combo/javac.mk
@@ -1,53 +1,36 @@
 # Selects a Java compiler.
 #
 # Inputs:
-#	CUSTOM_JAVA_COMPILER -- "eclipse", "openjdk". or nothing for the system
-#                           default
-#	ALTERNATE_JAVAC -- the alternate java compiler to use
+#   OVERRIDE_ANDROID_JAVA_HOME -- alternate location to use for jdk
 #
 # Outputs:
-#   COMMON_JAVAC -- Java compiler command with common arguments
+#   ANDROID_JAVA_HOME -- Directory that contains JDK
+#   ANDROID_JAVA_TOOLCHAIN -- Directory that contains javac and other java tools
 #
 
 ifndef ANDROID_COMPILE_WITH_JACK
-# Defines if compilation with jack is enabled by default.
-ANDROID_COMPILE_WITH_JACK := true
-endif
-
-common_jdk_flags := -Xmaxerrs 9999999
-
-# Use the indexer wrapper to index the codebase instead of the javac compiler
-ifeq ($(ALTERNATE_JAVAC),)
-JAVACC := javac
-else
-JAVACC := $(ALTERNATE_JAVAC)
-endif
-
-JAVA := java
-JAVADOC := javadoc
-JAR := jar
-
-# The actual compiler can be wrapped by setting the JAVAC_WRAPPER var.
-ifdef JAVAC_WRAPPER
-    ifneq ($(JAVAC_WRAPPER),$(firstword $(JAVACC)))
-        JAVACC := $(JAVAC_WRAPPER) $(JAVACC)
+    # TODO(b/64113890, b/35788202): remove PRODUCT_COMPILE_WITH_JACK
+    ifdef PRODUCT_COMPILE_WITH_JACK
+        ANDROID_COMPILE_WITH_JACK := $(PRODUCT_COMPILE_WITH_JACK)
+    else
+        # TODO(b/62038127): remove TARGET_BUILD_APPS check
+        ifdef TARGET_BUILD_APPS
+            ANDROID_COMPILE_WITH_JACK := true
+        else
+            ANDROID_COMPILE_WITH_JACK := false
+        endif
     endif
 endif
 
-# Whatever compiler is on this system.
-COMMON_JAVAC := $(JAVACC) -J-Xmx2048M $(common_jdk_flags)
-
-# Eclipse.
-ifeq ($(CUSTOM_JAVA_COMPILER), eclipse)
-    COMMON_JAVAC := java -Xmx256m -jar prebuilt/common/ecj/ecj.jar -5 \
-        -maxProblems 9999999 -nowarn
-    $(info CUSTOM_JAVA_COMPILER=eclipse)
+ifeq ($(OVERRIDE_ANDROID_JAVA_HOME),)
+ANDROID_JAVA_HOME := prebuilts/jdk/jdk8/$(HOST_PREBUILT_TAG)
+else
+# Use this build toolchain instead of the bundled one.
+ANDROID_JAVA_HOME := $(OVERRIDE_ANDROID_JAVA_HOME)
 endif
+ANDROID_JAVA_TOOLCHAIN := $(ANDROID_JAVA_HOME)/bin
+export JAVA_HOME := $(abspath $(ANDROID_JAVA_HOME))
 
-GLOBAL_JAVAC_DEBUG_FLAGS := -g
-
-HOST_JAVAC ?= $(COMMON_JAVAC)
-TARGET_JAVAC ?= $(COMMON_JAVAC)
-
-#$(info HOST_JAVAC=$(HOST_JAVAC))
-#$(info TARGET_JAVAC=$(TARGET_JAVAC))
+# TODO(ccross): remove this, it is needed for now because it is used by
+# config.mk before makevars from soong are loaded
+JAVA := $(ANDROID_JAVA_TOOLCHAIN)/java
diff --git a/core/config.mk b/core/config.mk
index 94277de..868c356 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -71,6 +71,8 @@
 $(error Please remove --color=always from your  $$GREP_OPTIONS)
 endif
 
+UNAME := $(shell uname -sm)
+
 SRC_TARGET_DIR := $(TOPDIR)build/target
 SRC_API_DIR := $(TOPDIR)prebuilts/sdk/api
 SRC_SYSTEM_API_DIR := $(TOPDIR)prebuilts/sdk/system-api
@@ -648,6 +650,7 @@
 DEFAULT_JACK_EXTRA_ARGS := @$(JACK_DEFAULT_ARGS)
 endif
 
+TURBINE := $(HOST_OUT_JAVA_LIBRARIES)/turbine$(COMMON_JAVA_PACKAGE_SUFFIX)
 PROGUARD := external/proguard/bin/proguard.sh
 JAVATAGS := build/tools/java-event-log-tags.py
 MERGETAGS := build/tools/merge-event-log-tags.py
@@ -676,31 +679,15 @@
 
 COLUMN:= column
 
-# We may not have the right JAVA_HOME/PATH set up yet when this is run from envsetup.sh.
-ifneq ($(CALLED_FROM_SETUP),true)
-
 # Path to tools.jar, or empty if EXPERIMENTAL_USE_OPENJDK9 is set
 HOST_JDK_TOOLS_JAR :=
 # TODO: Remove HOST_JDK_TOOLS_JAR and all references to it once OpenJDK 8
 # toolchains are no longer supported (i.e. when what is now
 # EXPERIMENTAL_USE_OPENJDK9 becomes the standard). http://b/38418220
 ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
-HOST_JDK_TOOLS_JAR := $(shell $(BUILD_SYSTEM)/find-jdk-tools-jar.sh)
-
-ifneq ($(HOST_JDK_TOOLS_JAR),)
-ifeq ($(wildcard $(HOST_JDK_TOOLS_JAR)),)
-$(error Error: could not find jdk tools.jar at $(HOST_JDK_TOOLS_JAR), please check if your JDK was installed correctly)
-endif
-endif
+HOST_JDK_TOOLS_JAR := $(ANDROID_JAVA_TOOLCHAIN)/../lib/tools.jar
 endif # ifeq ($(EXPERIMENTAL_USE_OPENJDK9),)
 
-# Is the host JDK 64-bit version?
-HOST_JDK_IS_64BIT_VERSION :=
-ifneq ($(filter 64-Bit, $(shell $(JAVA) -version 2>&1)),)
-HOST_JDK_IS_64BIT_VERSION := true
-endif
-endif  # CALLED_FROM_SETUP not true
-
 # It's called md5 on Mac OS and md5sum on Linux
 ifeq ($(HOST_OS),darwin)
 MD5SUM:=md5 -q
@@ -891,6 +878,17 @@
 unexport JAVA_HOME
 export ANDROID_BUILD_PATHS:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(ANDROID_BUILD_PATHS)
 export PATH:=$(abspath $(BUILD_SYSTEM)/no_java_path):$(PATH)
+else
+  # Put java first on the path
+  # TODO(ccross): remove this once tools run during the build no longer depend on
+  # finding java in the path
+  ifeq (,$(strip $(CALLED_FROM_SETUP)))
+    ifneq ($(shell which java),$(abspath $(ANDROID_JAVA_TOOLCHAIN)/java))
+      $(warning Found incorrect java $(shell which java) in $$PATH)
+      $(warning Adding $(abspath $(ANDROID_JAVA_TOOLCHAIN)) to $$PATH)
+      export PATH:=$(abspath $(ANDROID_JAVA_TOOLCHAIN)):$(PATH)
+    endif
+  endif
 endif
 
 # Projects clean of compiler warnings should be compiled with -Werror.
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index 0d182e9..e02f03a 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -22,6 +22,18 @@
   endif
 endif
 
+# Disable global integer_overflow in excluded paths.
+ifneq ($(filter integer_overflow, $(my_global_sanitize)),)
+  combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
+                            $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
+
+  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
+         $(filter $(dir)%,$(LOCAL_PATH)))),)
+    my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize))
+    my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag))
+  endif
+endif
+
 ifneq ($(my_global_sanitize),)
   my_sanitize := $(my_global_sanitize) $(my_sanitize)
 endif
@@ -103,17 +115,8 @@
   endif
 endif
 
+# Disable integer_overflow if LOCAL_NOSANITIZE=integer.
 ifneq ($(filter integer_overflow, $(my_global_sanitize) $(my_sanitize)),)
-  # Disable integer_overflow in excluded paths.
-  combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
-                            $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
-
-  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
-         $(filter $(dir)%,$(LOCAL_PATH)))),)
-    my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
-    my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
-  endif
-  # Disable integer_overflow if LOCAL_NOSANITIZE=integer.
   ifneq ($(filter integer, $(strip $(LOCAL_NOSANITIZE))),)
     my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
     my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
@@ -172,7 +175,7 @@
   ifeq ($(filter address,$(my_sanitize)),)
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): Use of 'coverage' also requires 'address')
   endif
-  my_cflags += -fsanitize-coverage=trace-pc-guard
+  my_cflags += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
   my_sanitize := $(filter-out coverage,$(my_sanitize))
 endif
 
@@ -284,12 +287,6 @@
   endif
 endif
 
-ifneq ($(filter undefined,$(my_sanitize)),)
-  ifndef LOCAL_IS_HOST_MODULE
-    $(error ubsan is not yet supported on the target)
-  endif
-endif
-
 ifneq ($(strip $(LOCAL_SANITIZE_RECOVER)),)
   recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_RECOVER)),
   my_cflags += -fsanitize-recover=$(recover_arg)
diff --git a/core/definitions.mk b/core/definitions.mk
index 95e9a02..b27c69e 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -692,6 +692,14 @@
 $(foreach lib,$(1),$(call _java-lib-full-classes.jar,$(lib),$(2)))
 endef
 
+# Get the header jar files (you can pass to "javac -classpath") of static or shared
+# Java libraries that you want to link against.
+# $(1): library name list
+# $(2): Non-empty if IS_HOST_MODULE
+define java-lib-header-files
+$(foreach lib,$(1),$(call intermediates-dir-for, JAVA_LIBRARIES,$(lib),$(2),COMMON)/classes-header.jar)
+endef
+
 # Get the dependency files (you can put on the right side of "|" of a build rule)
 # of the Java libraries.
 # $(1): library name list
@@ -2184,6 +2192,7 @@
       exit 1; \
     fi; \
     unzip -qo $$f -d $(2); \
+    rm -f $(2)/module-info.class; \
   done
   $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,$(hide) rm -rf $(2)/META-INF)
 endef
@@ -2194,48 +2203,61 @@
  JACK_VERSION=$(PRIVATE_JACK_VERSION) $(JACK) $(DEFAULT_JACK_EXTRA_ARGS)
 endef
 
-# Common definition to invoke javac on the host and target.
+# Return jar arguments to compress files in a given directory
+# $(1): directory
 #
+# Returns an @-file argument that contains the output of a subshell
+# that looks like -C $(1) path/to/file1 -C $(1) path/to/file2
+# Also adds "-C out/empty ." which avoids errors in jar when
+# there are no files in the directory.
+define jar-args-sorted-files-in-directory
+    @<(find $(1) -type f | sort | $(JAR_ARGS) $(1); echo "-C $(EMPTY_DIRECTORY) .")
+endef
+
 # Some historical notes:
 # - below we write the list of java files to java-source-list to avoid argument
 #   list length problems with Cygwin
 # - we filter out duplicate java file names because eclipse's compiler
 #   doesn't like them.
+define write-java-source-list
+@echo "$($(PRIVATE_PREFIX)DISPLAY) Java source list: $(PRIVATE_MODULE)"
+$(hide) rm -f $@
+$(call dump-words-to-file,$(sort $(PRIVATE_JAVA_SOURCES)),$@.tmp)
+$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
+    find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $@.tmp; \
+fi
+$(if $(PRIVATE_HAS_PROTO_SOURCES), \
+    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $@.tmp)
+$(if $(PRIVATE_HAS_RS_SOURCES), \
+    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $@.tmp)
+$(hide) tr ' ' '\n' < $@.tmp | $(NORMALIZE_PATH) | sort -u > $@
+endef
+
+# Common definition to invoke javac on the host and target.
 #
 # $(1): javac
 # $(2): bootclasspath
+# $(3): classpath_libs
 define compile-java
 $(hide) rm -f $@
 $(hide) rm -rf $(PRIVATE_CLASS_INTERMEDIATES_DIR) $(PRIVATE_ANNO_INTERMEDIATES_DIR)
 $(hide) mkdir -p $(dir $@)
 $(hide) mkdir -p $(PRIVATE_CLASS_INTERMEDIATES_DIR) $(PRIVATE_ANNO_INTERMEDIATES_DIR)
 $(call unzip-jar-files,$(PRIVATE_STATIC_JAVA_LIBRARIES),$(PRIVATE_CLASS_INTERMEDIATES_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list)
-$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-          find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list; \
-fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' -and -not -name '.*' >> $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list )
-$(hide) tr ' ' '\n' < $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list \
-    | $(NORMALIZE_PATH) | sort -u > $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq
-$(hide) if [ -s $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
     $(SOONG_JAVAC_WRAPPER) $(1) -encoding UTF-8 \
     $(if $(findstring true,$(PRIVATE_WARNINGS_ENABLE)),$(xlint_unchecked),) \
     $(2) \
     $(addprefix -classpath ,$(strip \
-        $(call normalize-path-list,$(PRIVATE_ALL_JAVA_LIBRARIES)))) \
+        $(call normalize-path-list,$(3)))) \
     $(if $(findstring true,$(PRIVATE_WARNINGS_ENABLE)),$(xlint_unchecked),) \
-    -extdirs "" -d $(PRIVATE_CLASS_INTERMEDIATES_DIR) -s $(PRIVATE_ANNO_INTERMEDIATES_DIR) \
+    -d $(PRIVATE_CLASS_INTERMEDIATES_DIR) -s $(PRIVATE_ANNO_INTERMEDIATES_DIR) \
     $(PRIVATE_JAVACFLAGS) \
-    \@$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq \
+    \@$(PRIVATE_JAVA_SOURCE_LIST) \
     || ( rm -rf $(PRIVATE_CLASS_INTERMEDIATES_DIR) ; exit 41 ) \
 fi
 $(if $(PRIVATE_JAVA_LAYERS_FILE), $(hide) build/tools/java-layers.py \
-    $(PRIVATE_JAVA_LAYERS_FILE) \@$(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq,)
-$(hide) rm -f $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list
-$(hide) rm -f $(PRIVATE_CLASS_INTERMEDIATES_DIR)/java-source-list-uniq
+    $(PRIVATE_JAVA_LAYERS_FILE) @$(PRIVATE_JAVA_SOURCE_LIST),)
 $(if $(PRIVATE_JAR_EXCLUDE_FILES), $(hide) find $(PRIVATE_CLASS_INTERMEDIATES_DIR) \
     -name $(word 1, $(PRIVATE_JAR_EXCLUDE_FILES)) \
     $(addprefix -o -name , $(wordlist 2, 999, $(PRIVATE_JAR_EXCLUDE_FILES))) \
@@ -2251,23 +2273,42 @@
 $(if $(PRIVATE_JAR_MANIFEST), \
     $(hide) sed -e "s/%BUILD_NUMBER%/$(BUILD_NUMBER_FROM_FILE)/" \
             $(PRIVATE_JAR_MANIFEST) > $(dir $@)/manifest.mf && \
-        $(JAR) -cfm $@ $(dir $@)/manifest.mf \
-            -C $(PRIVATE_CLASS_INTERMEDIATES_DIR) ., \
-    $(hide) $(JAR) -cf $@ -C $(PRIVATE_CLASS_INTERMEDIATES_DIR) .)
+        $(JAR) -cfm $@ $(dir $@)/manifest.mf, \
+    $(hide) $(JAR) -cf $@) \
+        $(call jar-args-sorted-files-in-directory,$(PRIVATE_CLASS_INTERMEDIATES_DIR))
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(call add-java-resources-to,$@))
 endef
 
 define transform-java-to-classes.jar
 @echo "$($(PRIVATE_PREFIX)DISPLAY) Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
-$(call compile-java,$(TARGET_JAVAC),$(PRIVATE_BOOTCLASSPATH))
+$(call compile-java,$(TARGET_JAVAC),$(PRIVATE_BOOTCLASSPATH),$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))
+endef
+
+define transform-java-to-header.jar
+@echo "$($(PRIVATE_PREFIX)DISPLAY) Turbine: $(PRIVATE_MODULE)"
+@mkdir -p $(dir $@)
+@rm -rf $(dir $@)/classes-turbine
+@mkdir $(dir $@)/classes-turbine
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
+    $(JAVA) -jar $(TURBINE) \
+    --output $@.tmp --temp_dir $(dir $@)/classes-turbine -$(PRIVATE_BOOTCLASSPATH) \
+    --sources \@$(PRIVATE_JAVA_SOURCE_LIST) \
+    --javacopts $(PRIVATE_JAVACFLAGS) $(COMMON_JDK_FLAGS) \
+    $(addprefix --classpath ,$(strip \
+        $(call normalize-path-list,$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)))) \
+    || ( rm -rf $(dir $@)/classes-turbine ; exit 41 ) \
+fi
+$(hide) $(call unzip-jar-files,$(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES),$(dir $@)/classes-turbine)
+$(hide) if [ -s $@.tmp ] ; then \
+    unzip -qo $@.tmp -d $(dir $@)/classes-turbine; rm -f $(dir $@)/classes-turbine/module-info.class; \
+fi
+$(hide) $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,$(hide) rm -rf $(dir $@)/classes-turbine/META-INF)
+$(hide) $(JAR) -cf $@.tmp $(call jar-args-sorted-files-in-directory,$(dir $@)/classes-turbine)
+$(hide) $(ZIPTIME) $@.tmp
+$(hide) $(call commit-change-for-toc,$@)
 endef
 
 # Invoke Jack to compile java from source to dex and jack files.
-#
-# Some historical notes:
-# - below we write the list of java files to java-source-list to avoid argument
-#   list length problems with Cygwin
-# - we filter out duplicate java file names because Jack doesn't like them.
 define jack-java-to-dex
 $(hide) rm -f $@
 $(hide) rm -f $(PRIVATE_CLASSES_JACK)
@@ -2276,17 +2317,6 @@
 $(hide) mkdir -p $(dir $(PRIVATE_CLASSES_JACK))
 $(hide) mkdir -p $(PRIVATE_JACK_INTERMEDIATES_DIR)
 $(if $(PRIVATE_JACK_INCREMENTAL_DIR),$(hide) mkdir -p $(PRIVATE_JACK_INCREMENTAL_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list)
-$(if $(PRIVATE_SOURCE_INTERMEDIATES_DIR), \
-    $(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-            find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list; \
-    fi)
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(hide) tr ' ' '\n' < $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list \
-    | $(NORMALIZE_PATH) | sort -u > $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq
 $(if $(PRIVATE_JACK_PROGUARD_FLAGS), \
     $(hide) echo -basedirectory $(CURDIR) > $@.flags; \
     echo $(PRIVATE_JACK_PROGUARD_FLAGS) >> $@.flags; \
@@ -2301,8 +2331,8 @@
     $(hide) mkdir -p $@.tmpjill.res
     $(hide) unzip -qo $(PRIVATE_JACK_IMPORT_JAR) -d $@.tmpjill.res
     $(hide) find $@.tmpjill.res -iname "*.class" -delete)
-$(hide) if [ -s $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
-    export tmpEcjArg="@$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq"; \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
+    export tmpEcjArg="@$(PRIVATE_JAVA_SOURCE_LIST)"; \
 else \
     export tmpEcjArg=""; \
 fi; \
@@ -2333,37 +2363,18 @@
     $$tmpEcjArg \
     || ( rm -rf $(PRIVATE_CLASSES_JACK); exit 41 )
 $(hide) mv $(PRIVATE_JACK_INTERMEDIATES_DIR)/classes*.dex $(dir $@)
-$(hide) rm -f $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(hide) rm -rf $@.res.tmp)
-$(hide) mv $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq $(PRIVATE_JACK_INTERMEDIATES_DIR).java-source-list
 $(if $(PRIVATE_JAR_PACKAGES), $(hide) echo unsupported options PRIVATE_JAR_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_EXCLUDE_PACKAGES), $(hide) echo unsupported options JAR_EXCLUDE_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_MANIFEST), $(hide) echo unsupported options JAR_MANIFEST in $@; exit 53)
 endef
 
 # Invoke Jack to compile java source just to check it compiles correctly.
-#
-# Some historical notes:
-# - below we write the list of java files to java-source-list to avoid argument
-#   list length problems with Cygwin
-# - we filter out duplicate java file names because Jack doesn't like them.
 define jack-check-java
 $(hide) rm -f $@
-$(hide) rm -f $@.java-source-list
-$(hide) rm -f $@.java-source-list-uniq
 $(hide) mkdir -p $(dir $@)
 $(if $(PRIVATE_JACK_INCREMENTAL_DIR),$(hide) mkdir -p $(PRIVATE_JACK_INCREMENTAL_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$@.java-source-list)
-$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-          find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $@.java-source-list; \
-fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $@.java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $@.java-source-list )
-$(hide) tr ' ' '\n' < $@.java-source-list \
-    | sort -u > $@.java-source-list-uniq
-$(hide) if [ -s $@.java-source-list-uniq ] ; then \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
 	$(call call-jack,$(PRIVATE_JACK_EXTRA_ARGS)) \
 	    $(strip $(PRIVATE_JACK_FLAGS)) \
 	    $(strip $(PRIVATE_JACK_DEBUG_FLAGS)) \
@@ -2373,7 +2384,7 @@
 	    -D jack.android.min-api-level=$(PRIVATE_JACK_MIN_SDK_VERSION) \
 	    -D jack.import.type.policy=keep-first \
 	    $(if $(PRIVATE_JACK_INCREMENTAL_DIR),--incremental-folder $(PRIVATE_JACK_INCREMENTAL_DIR)) \
-	    @$@.java-source-list-uniq; \
+	    @$(PRIVATE_JAVA_SOURCE_LIST); \
 fi
 touch $@
 endef
@@ -2409,26 +2420,6 @@
 fi
 endef
 
-# b/37756495
-IJAR_ASAN_OPTIONS := ASAN_OPTIONS=detect_leaks=0
-
-## Rule to create a table of contents from a .jar file.
-## Must be called with $(eval).
-# $(1): A .jar file
-define _transform-jar-to-toc
-$1.toc: $1 | $(IJAR)
-	@echo Generating TOC: $$@
-	$(hide) $(IJAR_ASAN_OPTIONS) $(IJAR) $$< $$@.tmp
-	$$(call commit-change-for-toc,$$@)
-endef
-
-## Define a rule which generates .jar.toc and mark it as .KATI_RESTAT.
-# $(1): A .jar file
-define define-jar-to-toc-rule
-$(eval $(call _transform-jar-to-toc,$1))\
-$(eval .KATI_RESTAT: $1.toc)
-endef
-
 ifeq (,$(TARGET_BUILD_APPS))
 
 ## Rule to create a table of contents from a .dex file.
@@ -2459,27 +2450,12 @@
 
 
 # Invoke Jack to compile java from source to jack files without shrink or obfuscation.
-#
-# Some historical notes:
-# - below we write the list of java files to java-source-list to avoid argument
-#   list length problems with Cygwin
-# - we filter out duplicate java file names because Jack doesn't like them.
 define java-to-jack
 $(hide) rm -f $@
 $(hide) rm -rf $(PRIVATE_JACK_INTERMEDIATES_DIR)
 $(hide) mkdir -p $(dir $@)
 $(hide) mkdir -p $(PRIVATE_JACK_INTERMEDIATES_DIR)
 $(if $(PRIVATE_JACK_INCREMENTAL_DIR),$(hide) mkdir -p $(PRIVATE_JACK_INCREMENTAL_DIR))
-$(call dump-words-to-file,$(PRIVATE_JAVA_SOURCES),$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list)
-$(hide) if [ -d "$(PRIVATE_SOURCE_INTERMEDIATES_DIR)" ]; then \
-          find $(PRIVATE_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list; \
-fi
-$(if $(PRIVATE_HAS_PROTO_SOURCES), \
-    $(hide) find $(PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(if $(PRIVATE_HAS_RS_SOURCES), \
-    $(hide) find $(PRIVATE_RS_SOURCE_INTERMEDIATES_DIR) -name '*.java' >> $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list )
-$(hide) tr ' ' '\n' < $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list \
-    | $(NORMALIZE_PATH) | sort -u > $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq
 $(if $(PRIVATE_JACK_PROGUARD_FLAGS), \
     $(hide) echo -basedirectory $(CURDIR) > $@.flags; \
     echo $(PRIVATE_JACK_PROGUARD_FLAGS) >> $@.flags; \
@@ -2490,8 +2466,8 @@
 	$(hide) $(call add-java-resources-to,$@.res.tmp.zip)
 	$(hide) unzip -qo $@.res.tmp.zip -d $@.res.tmp
 	$(hide) rm $@.res.tmp.zip)
-$(hide) if [ -s $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
-    export tmpEcjArg="@$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq"; \
+$(hide) if [ -s $(PRIVATE_JAVA_SOURCE_LIST) ] ; then \
+    export tmpEcjArg="@$(PRIVATE_JAVA_SOURCE_LIST)"; \
 else \
     export tmpEcjArg=""; \
 fi; \
@@ -2515,15 +2491,13 @@
     $(if $(PRIVATE_JACK_PROGUARD_FLAGS),--config-proguard $@.flags) \
     $$tmpEcjArg \
     || ( rm -f $@ ; exit 41 )
-$(hide) rm -f $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(hide) rm -rf $@.res.tmp)
-$(hide) mv $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq $(PRIVATE_JACK_INTERMEDIATES_DIR).java-source-list
 $(if $(PRIVATE_JAR_PACKAGES), $(hide) echo unsupported options PRIVATE_JAR_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_EXCLUDE_PACKAGES), $(hide) echo unsupported options JAR_EXCLUDE_PACKAGES in $@; exit 53)
 $(if $(PRIVATE_JAR_MANIFEST), $(hide) echo unsupported options JAR_MANIFEST in $@; exit 53)
 endef
 
-define desugar-classpath
+define desugar-bootclasspath
 $(filter-out -classpath -bootclasspath "",$(subst :,$(space),$(1)))
 endef
 
@@ -2535,6 +2509,7 @@
 endef
 
 # --add-opens is required because desugar reflects via java.lang.invoke.MethodHandles.Lookup
+# --desugar_try_with_resources_if_needed=false is needed due to b/63180735, b/63901645, b/63900665
 define desugar-classes-jar
 @echo Desugar: $@
 @mkdir -p $(dir $@)
@@ -2546,8 +2521,9 @@
     -Djdk.internal.lambda.dumpProxyClasses=$(abspath $(dir $@))/desugar_dumped_classes \
     -jar $(DESUGAR) \
     $(addprefix --bootclasspath_entry ,$(call desugar-bootclasspath,$(PRIVATE_BOOTCLASSPATH))) \
-    $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_LIBRARIES)) \
+    $(addprefix --classpath_entry ,$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)) \
     --min_sdk_version $(call codename-or-sdk-to-sdk,$(PRIVATE_DEFAULT_APP_TARGET_SDK)) \
+    --desugar_try_with_resources_if_needed=false \
     --allow_empty_bootclasspath \
     $(if $(filter --core-library,$(PRIVATE_DX_FLAGS)),--core_library) \
     -i $< -o $@.tmp
@@ -2680,30 +2656,42 @@
 # Add resources carried by static Jack libraries.
 #
 define add-carried-jack-resources
+$(call add-carried-jack-resources-to,$@)
+endef
+
+# $(1) the target jar.
+define add-carried-jack-resources-to
  $(hide) if [ -d $(PRIVATE_JACK_INTERMEDIATES_DIR) ] ; then \
     find $(PRIVATE_JACK_INTERMEDIATES_DIR) -type f | sort \
         | sed -e "s?^$(PRIVATE_JACK_INTERMEDIATES_DIR)/? -C \"$(PRIVATE_JACK_INTERMEDIATES_DIR)\" \"?" -e "s/$$/\"/" \
-        > $(dir $@)jack_res_jar_flags; \
-    if [ -s $(dir $@)jack_res_jar_flags ] ; then \
-        $(JAR) uf $@ @$(dir $@)jack_res_jar_flags; \
+        > $(dir $(1))jack_res_jar_flags; \
+    if [ -s $(dir $(1))jack_res_jar_flags ] ; then \
+        $(JAR) uf $(1) @$(dir $(1))jack_res_jar_flags; \
     fi; \
 fi
 endef
 
+# Add resources (non .class files) from a jar to a package
+# $(1): the package file
+# $(2): the jar file
+# $(3): temporary directory
+define add-jar-resources-to-package
+  rm -rf $(3)
+  mkdir -p $(3)
+  unzip -qo $(2) -d $(3) $$(zipinfo -1 $(2) | grep -v -E "\.class$$")
+  $(JAR) uf $(1) $(call jar-args-sorted-files-in-directory,$(3))
+endef
+
 # Sign a package using the specified key/cert.
 #
 define sign-package
 $(call sign-package-arg,$@)
 endef
 
-# signapk uses internal APIs from sun.security.{pkcs,x509}; see http://b/37137869
 # $(1): the package file we are signing.
 define sign-package-arg
 $(hide) mv $(1) $(1).unsigned
-$(hide) $(JAVA) -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) \
-    $(if $(EXPERIMENTAL_USE_OPENJDK9),--add-exports java.base/sun.security.pkcs=ALL-UNNAMED,) \
-    $(if $(EXPERIMENTAL_USE_OPENJDK9),--add-exports java.base/sun.security.x509=ALL-UNNAMED,) \
-    -jar $(SIGNAPK_JAR) \
+$(hide) $(JAVA) -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) -jar $(SIGNAPK_JAR) \
     $(PRIVATE_CERTIFICATE) $(PRIVATE_PRIVATE_KEY) \
     $(PRIVATE_ADDITIONAL_CERTIFICATES) $(1).unsigned $(1).signed
 $(hide) mv $(1).signed $(1)
@@ -2757,8 +2745,15 @@
 # Note: we intentionally don't clean PRIVATE_CLASS_INTERMEDIATES_DIR
 # in transform-java-to-classes for the sake of vm-tests.
 define transform-host-java-to-package
-@echo "$($(PRIVATE_PREFIX)DISPLAY) Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
-$(call compile-java,$(HOST_JAVAC),$(PRIVATE_BOOTCLASSPATH))
+@echo "Host Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
+$(call compile-java,$(HOST_JAVAC),$(PRIVATE_BOOTCLASSPATH),$(PRIVATE_ALL_JAVA_LIBRARIES))
+endef
+
+# Note: we intentionally don't clean PRIVATE_CLASS_INTERMEDIATES_DIR
+# in transform-java-to-classes for the sake of vm-tests.
+define transform-host-java-to-dalvik-package
+@echo "Dalvik Java: $(PRIVATE_MODULE) ($(PRIVATE_CLASS_INTERMEDIATES_DIR))"
+$(call compile-java,$(HOST_JAVAC),$(PRIVATE_BOOTCLASSPATH),$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))
 endef
 
 ###########################################################
diff --git a/core/dex_preopt.mk b/core/dex_preopt.mk
index 8e496a7..09c8311 100644
--- a/core/dex_preopt.mk
+++ b/core/dex_preopt.mk
@@ -24,7 +24,12 @@
 SYSTEM_OTHER_ODEX_FILTER ?= app/% priv-app/%
 
 # Method returning whether the install path $(1) should be for system_other.
+# Under SANITIZE_LITE, we do not want system_other. Just put things under /data/asan.
+ifeq ($(SANITIZE_LITE),true)
+install-on-system-other =
+else
 install-on-system-other = $(filter-out $(PRODUCT_DEXPREOPT_SPEED_APPS) $(PRODUCT_SYSTEM_SERVER_APPS),$(basename $(notdir $(filter $(foreach f,$(SYSTEM_OTHER_ODEX_FILTER),$(TARGET_OUT)/$(f)),$(1)))))
+endif
 
 # The default values for pre-opting: always preopt PIC.
 # Conditional to building on linux, as dex2oat currently does not work on darwin.
diff --git a/core/dex_preopt_libart_boot.mk b/core/dex_preopt_libart_boot.mk
index e3eb9ef..a06aaca 100644
--- a/core/dex_preopt_libart_boot.mk
+++ b/core/dex_preopt_libart_boot.mk
@@ -65,6 +65,12 @@
 my_boot_image_flags += --profile-file=$(my_out_boot_image_profile_location)
 endif
 
+ifneq (addresstrue,$(SANITIZE_TARGET)$(SANITIZE_LITE))
+# Skip recompiling the boot image for the second sanitization phase. We'll get separate paths
+# and invalidate first-stage artifacts which are crucial to SANITIZE_LITE builds.
+# Note: this is technically incorrect. Compiled code contains stack checks which may depend
+#       on ASAN settings.
+
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_BOOT_IMAGE_FLAGS := $(my_boot_image_flags)
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_2ND_ARCH_VAR_PREFIX := $(my_2nd_arch_prefix)
 # Use dex2oat debug version for better error reporting
@@ -92,3 +98,5 @@
 		--no-generate-debug-info --generate-build-id \
 		--multi-image --no-inline-from=core-oj.jar \
 		$(PRODUCT_DEX_PREOPT_BOOT_FLAGS) $(GLOBAL_DEXPREOPT_FLAGS) $(ART_BOOT_IMAGE_EXTRA_ARGS)
+
+endif
diff --git a/core/droiddoc.mk b/core/droiddoc.mk
index 94e282d..2676b44 100644
--- a/core/droiddoc.mk
+++ b/core/droiddoc.mk
@@ -86,8 +86,7 @@
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES)) $(LOCAL_CLASSPATH)
 endif # !LOCAL_IS_HOST_MODULE
 
-$(full_target): PRIVATE_CLASSPATH := $(subst $(space),:,$(full_java_libs))
-
+$(full_target): PRIVATE_CLASSPATH := $(call normalize-path-list,$(full_java_libs))
 
 intermediates.COMMON := $(call local-intermediates-dir,COMMON)
 
diff --git a/core/dynamic_binary.mk b/core/dynamic_binary.mk
index 949793b..f44b8a8 100644
--- a/core/dynamic_binary.mk
+++ b/core/dynamic_binary.mk
@@ -99,10 +99,15 @@
 my_breakpad_path := $(TARGET_OUT_BREAKPAD)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
 breakpad_input := $(relocation_packer_output)
 breakpad_output := $(my_breakpad_path)/$(my_installed_module_stem).sym
-$(breakpad_output) : $(breakpad_input) | $(BREAKPAD_DUMP_SYMS)
+$(breakpad_output) : $(breakpad_input) | $(BREAKPAD_DUMP_SYMS) $(PRIVATE_READELF)
 	@echo "target breakpad: $(PRIVATE_MODULE) ($@)"
 	@mkdir -p $(dir $@)
-	$(hide) $(BREAKPAD_DUMP_SYMS) -c $< > $@
+	$(hide) if $(PRIVATE_READELF) -S $< > /dev/null 2>&1 ; then \
+	  $(BREAKPAD_DUMP_SYMS) -c $< > $@ ; \
+	else \
+	  echo "skipped for non-elf file."; \
+	  touch $@; \
+	fi
 $(LOCAL_BUILT_MODULE) : $(breakpad_output)
 endif
 
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 46066e3..db6ddd4 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -97,8 +97,6 @@
 # compiles except for arm/mips, so the HOST is whatever we are
 # running on
 
-UNAME := $(shell uname -sm)
-
 # HOST_OS
 ifneq (,$(findstring Linux,$(UNAME)))
   HOST_OS := linux
@@ -110,7 +108,15 @@
   HOST_OS := darwin
 endif
 
-HOST_OS_EXTRA:=$(shell python -c "import platform; print(platform.platform())")
+HOST_OS_EXTRA := $(shell uname -rsm)
+ifeq ($(HOST_OS),linux)
+  ifneq ($(wildcard /etc/os-release),)
+    HOST_OS_EXTRA += $(shell source /etc/os-release; echo $$PRETTY_NAME)
+  endif
+else ifeq ($(HOST_OS),darwin)
+  HOST_OS_EXTRA += $(shell sw_vers -productVersion)
+endif
+HOST_OS_EXTRA := $(subst $(space),-,$(HOST_OS_EXTRA))
 
 # BUILD_OS is the real host doing the build.
 BUILD_OS := $(HOST_OS)
@@ -309,29 +315,17 @@
 
 SOONG_OUT_DIR := $(OUT_DIR)/soong
 
-DEBUG_OUT_DIR := $(OUT_DIR)/debug
+TARGET_OUT_ROOT := $(OUT_DIR)/target
 
-# Move the host or target under the debug/ directory
-# if necessary.
-TARGET_OUT_ROOT_release := $(OUT_DIR)/target
-TARGET_OUT_ROOT_debug := $(DEBUG_OUT_DIR)/target
-TARGET_OUT_ROOT := $(TARGET_OUT_ROOT_$(TARGET_BUILD_TYPE))
-
-HOST_OUT_ROOT_release := $(OUT_DIR)/host
-HOST_OUT_ROOT_debug := $(DEBUG_OUT_DIR)/host
-HOST_OUT_ROOT := $(HOST_OUT_ROOT_$(HOST_BUILD_TYPE))
+HOST_OUT_ROOT := $(OUT_DIR)/host
 
 # We want to avoid two host bin directories in multilib build.
-HOST_OUT_release := $(HOST_OUT_ROOT_release)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
-HOST_OUT_debug := $(HOST_OUT_ROOT_debug)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
-HOST_OUT := $(HOST_OUT_$(HOST_BUILD_TYPE))
+HOST_OUT := $(HOST_OUT_ROOT)/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
 SOONG_HOST_OUT := $(SOONG_OUT_DIR)/host/$(HOST_OS)-$(HOST_PREBUILT_ARCH)
 # TODO: remove
 BUILD_OUT := $(HOST_OUT)
 
-HOST_CROSS_OUT_release := $(HOST_OUT_ROOT_release)/windows-$(HOST_PREBUILT_ARCH)
-HOST_CROSS_OUT_debug := $(HOST_OUT_ROOT_debug)/windows-$(HOST_PREBUILT_ARCH)
-HOST_CROSS_OUT := $(HOST_CROSS_OUT_$(HOST_BUILD_TYPE))
+HOST_CROSS_OUT := $(HOST_OUT_ROOT)/windows-$(HOST_PREBUILT_ARCH)
 
 TARGET_PRODUCT_OUT_ROOT := $(TARGET_OUT_ROOT)/product
 
@@ -421,8 +415,16 @@
 TARGET_OUT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_SYSTEM)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
 target_out_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/system
+ifeq ($(SANITIZE_LITE),true)
+# When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
+# work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
+target_out_app_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/system
+else
+target_out_app_base := $(TARGET_OUT)
+endif
 else
 target_out_shared_libraries_base := $(TARGET_OUT)
+target_out_app_base := $(TARGET_OUT)
 endif
 
 TARGET_OUT_EXECUTABLES := $(TARGET_OUT)/bin
@@ -436,8 +438,8 @@
 endif
 TARGET_OUT_RENDERSCRIPT_BITCODE := $(TARGET_OUT_SHARED_LIBRARIES)
 TARGET_OUT_JAVA_LIBRARIES := $(TARGET_OUT)/framework
-TARGET_OUT_APPS := $(TARGET_OUT)/app
-TARGET_OUT_APPS_PRIVILEGED := $(TARGET_OUT)/priv-app
+TARGET_OUT_APPS := $(target_out_app_base)/app
+TARGET_OUT_APPS_PRIVILEGED := $(target_out_app_base)/priv-app
 TARGET_OUT_KEYLAYOUT := $(TARGET_OUT)/usr/keylayout
 TARGET_OUT_KEYCHARS := $(TARGET_OUT)/usr/keychars
 TARGET_OUT_ETC := $(TARGET_OUT)/etc
@@ -445,7 +447,13 @@
 TARGET_OUT_FAKE := $(PRODUCT_OUT)/fake_packages
 TARGET_OUT_TESTCASES := $(PRODUCT_OUT)/testcases
 
+ifeq ($(SANITIZE_LITE),true)
+# When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
+# work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
+TARGET_OUT_SYSTEM_OTHER := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/$(TARGET_COPY_OUT_SYSTEM_OTHER)
+else
 TARGET_OUT_SYSTEM_OTHER := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_SYSTEM_OTHER)
+endif
 
 # Out for TARGET_2ND_ARCH
 TARGET_2ND_ARCH_VAR_PREFIX := $(HOST_2ND_ARCH_VAR_PREFIX)
@@ -514,8 +522,16 @@
 TARGET_OUT_VENDOR := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_VENDOR)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
 target_out_vendor_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/vendor
+ifeq ($(SANITIZE_LITE),true)
+# When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
+# work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
+target_out_vendor_app_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/vendor
+else
+target_out_vendor_app_base := $(TARGET_OUT_VENDOR)
+endif
 else
 target_out_vendor_shared_libraries_base := $(TARGET_OUT_VENDOR)
+target_out_vendor_app_base := $(TARGET_OUT_VENDOR)
 endif
 
 TARGET_OUT_VENDOR_EXECUTABLES := $(TARGET_OUT_VENDOR)/bin
@@ -527,8 +543,8 @@
 endif
 TARGET_OUT_VENDOR_RENDERSCRIPT_BITCODE := $(TARGET_OUT_VENDOR_SHARED_LIBRARIES)
 TARGET_OUT_VENDOR_JAVA_LIBRARIES := $(TARGET_OUT_VENDOR)/framework
-TARGET_OUT_VENDOR_APPS := $(TARGET_OUT_VENDOR)/app
-TARGET_OUT_VENDOR_APPS_PRIVILEGED := $(TARGET_OUT_VENDOR)/priv-app
+TARGET_OUT_VENDOR_APPS := $(target_out_vendor_app_base)/app
+TARGET_OUT_VENDOR_APPS_PRIVILEGED := $(target_out_vendor_app_base)/priv-app
 TARGET_OUT_VENDOR_ETC := $(TARGET_OUT_VENDOR)/etc
 
 $(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_VENDOR_EXECUTABLES := $(TARGET_OUT_VENDOR_EXECUTABLES)
diff --git a/core/find-jdk-tools-jar.sh b/core/find-jdk-tools-jar.sh
deleted file mode 100755
index ac0b3b6..0000000
--- a/core/find-jdk-tools-jar.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/bin/sh
-if [ "x$ANDROID_JAVA_HOME" != x ] && [ -e "$ANDROID_JAVA_HOME/lib/tools.jar" ] ; then
-    echo $ANDROID_JAVA_HOME/lib/tools.jar
-else
-    JAVAC=$(realpath $(which javac) 2>/dev/null)
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(readlink -f $(which javac) 2>/dev/null)
-    fi
-    if [ -z "$JAVAC" ]; then
-        JAVAC=$(which javac)
-    fi
-    if [ -z "$JAVAC" ] ; then
-        exit 1
-    fi
-    while [ -L "$JAVAC" ] ; do
-        LSLINE=$(ls -l "$JAVAC")
-        JAVAC=$(echo -n "$LSLINE" | sed -e "s/.* -> //")
-    done
-    echo $JAVAC | sed -e 's:\(.*\)/javac$:\1/../lib/tools.jar:'
-fi
diff --git a/core/fuzz_test.mk b/core/fuzz_test.mk
index 4d41871..7e3995a 100644
--- a/core/fuzz_test.mk
+++ b/core/fuzz_test.mk
@@ -8,7 +8,7 @@
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): NDK fuzz tests are not supported.)
 endif
 
-LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard
+LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
 LOCAL_STATIC_LIBRARIES += libFuzzer
 
 ifdef LOCAL_MODULE_PATH
diff --git a/core/help.mk b/core/help.mk
deleted file mode 100644
index c034e79..0000000
--- a/core/help.mk
+++ /dev/null
@@ -1,35 +0,0 @@
-#
-# Copyright (C) 2010 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-.PHONY: help
-help:
-	@echo
-	@echo "Common make targets:"
-	@echo "----------------------------------------------------------------------------------"
-	@echo "droid                   Default target"
-	@echo "clean                   (aka clobber) equivalent to rm -rf out/"
-	@echo "snod                    Quickly rebuild the system image from built packages"
-	@echo "vnod                    Quickly rebuild the vendor image from built packages"
-	@echo "offline-sdk-docs        Generate the HTML for the developer SDK docs"
-	@echo "doc-comment-check-docs  Check HTML doc links & validity, without generating HTML"
-	@echo "libandroid_runtime      All the JNI framework stuff"
-	@echo "framework               All the java framework stuff"
-	@echo "services                The system server (Java) and friends"
-	@echo "help                    You're reading it right now"
-
-.PHONY: out
-out:
-	@echo "I'm sure you're nice and all, but no thanks."
diff --git a/core/host_dalvik_java_library.mk b/core/host_dalvik_java_library.mk
index 4f3069f..241cf6e 100644
--- a/core/host_dalvik_java_library.mk
+++ b/core/host_dalvik_java_library.mk
@@ -42,6 +42,9 @@
   LOCAL_JAVA_LIBRARIES :=  core-oj-hostdex core-libart-hostdex $(LOCAL_JAVA_LIBRARIES)
 endif
 
+full_classes_turbine_jar := $(intermediates.COMMON)/classes-turbine.jar
+full_classes_header_jarjar := $(intermediates.COMMON)/classes-header-jarjar.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
 full_classes_compiled_jar := $(intermediates.COMMON)/classes-full-debug.jar
 full_classes_desugar_jar := $(intermediates.COMMON)/desugar.classes.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/classes-jarjar.jar
@@ -49,15 +52,18 @@
 full_classes_jack := $(intermediates.COMMON)/classes.jack
 jack_check_timestamp := $(intermediates.COMMON)/jack.check.timestamp
 built_dex := $(intermediates.COMMON)/classes.dex
+java_source_list_file := $(intermediates.COMMON)/java-source-list
 
 LOCAL_INTERMEDIATE_TARGETS += \
+    $(full_classes_turbine_jar) \
     $(full_classes_compiled_jar) \
     $(full_classes_desugar_jar) \
     $(full_classes_jarjar_jar) \
     $(full_classes_jack) \
     $(full_classes_jar) \
     $(jack_check_timestamp) \
-    $(built_dex)
+    $(built_dex) \
+    $(java_source_list_file)
 
 # See comment in java.mk
 ifndef LOCAL_CHECKED_MODULE
@@ -83,30 +89,67 @@
 
 $(cleantarget): PRIVATE_CLEAN_FILES += $(intermediates.COMMON)
 
+# List of dependencies for anything that needs all java sources in place
+java_sources_deps := \
+    $(java_sources) \
+    $(java_resource_sources) \
+    $(proto_java_sources_file_stamp) \
+    $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+$(java_source_list_file): $(java_sources_deps)
+	$(write-java-source-list)
+
 ifndef LOCAL_JACK_ENABLED
 
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
-$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES :=
 $(full_classes_compiled_jar): \
-        $(java_sources) \
-        $(java_resource_sources) \
-        $(full_java_lib_deps) \
-        $(jar_manifest_file) \
-        $(proto_java_sources_file_stamp) \
-        $(annotation_processor_deps) \
-        $(NORMALIZE_PATH) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) \
-        | $(SOONG_JAVAC_WRAPPER)
-	$(transform-host-java-to-package)
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(full_static_java_libs) \
+    $(jar_manifest_file) \
+    $(annotation_processor_deps) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    | $(SOONG_JAVAC_WRAPPER)
+	$(transform-host-java-to-dalvik-package)
+
+$(full_classes_turbine_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_turbine_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
+$(full_classes_turbine_jar): \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(jar_manifest_file) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    $(ZIPTIME) \
+    | $(TURBINE)
+	$(transform-java-to-header.jar)
+
+.KATI_RESTAT: $(full_classes_turbine_jar)
+
+# Run jarjar before generate classes-header.jar if necessary.
+ifneq ($(strip $(LOCAL_JARJAR_RULES)),)
+$(full_classes_header_jarjar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
+$(full_classes_header_jarjar): $(full_classes_turbine_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
+	@echo Header JarJar: $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+else
+full_classes_header_jarjar := $(full_classes_turbine_jar)
+endif
+
+$(eval $(call copy-one-file,$(full_classes_header_jarjar),$(full_classes_header_jar)))
 
 my_desugaring :=
 ifeq ($(LOCAL_JAVA_LANGUAGE_VERSION),1.8)
 my_desugaring := true
 $(full_classes_desugar_jar): PRIVATE_DX_FLAGS := $(LOCAL_DX_FLAGS)
-$(full_classes_desugar_jar): $(full_classes_compiled_jar) $(DESUGAR)
+$(full_classes_desugar_jar): $(full_classes_compiled_jar) $(full_java_header_libs) $(DESUGAR)
 	$(desugar-classes-jar)
 endif
 
@@ -168,13 +211,18 @@
 $(LOCAL_INTERMEDIATE_TARGETS): \
   PRIVATE_JACK_INCREMENTAL_DIR :=
 endif
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JACK_FLAGS)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := -g $(LOCAL_JACK_FLAGS)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_VERSION := $(LOCAL_JACK_VERSION)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_MIN_SDK_VERSION := $(PLATFORM_JACK_MIN_SDK_VERSION)
 
-jack_all_deps := $(java_sources) $(java_resource_sources) $(full_jack_deps) \
-        $(jar_manifest_file) $(proto_java_sources_file_stamp) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) $(NORMALIZE_PATH) $(JACK_DEFAULT_ARGS) $(JACK)
+jack_all_deps := \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_jack_deps) \
+    $(jar_manifest_file) \
+    $(NORMALIZE_PATH) \
+    $(JACK_DEFAULT_ARGS) \
+    $(JACK)
 
 ifneq ($(LOCAL_IS_STATIC_JAVA_LIBRARY),true)
 $(built_dex): PRIVATE_CLASSES_JACK := $(full_classes_jack)
diff --git a/core/host_fuzz_test.mk b/core/host_fuzz_test.mk
index 8622911..556e02f 100644
--- a/core/host_fuzz_test.mk
+++ b/core/host_fuzz_test.mk
@@ -4,7 +4,7 @@
 ################################################
 $(call record-module-type,HOST_FUZZ_TEST)
 
-LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard
+LOCAL_CFLAGS += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
 LOCAL_STATIC_LIBRARIES += libLLVMFuzzer
 
 include $(BUILD_HOST_EXECUTABLE)
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index a68be6a..adc30dd 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -34,10 +34,13 @@
 full_classes_compiled_jar := $(intermediates.COMMON)/classes-full-debug.jar
 full_classes_jarjar_jar := $(intermediates.COMMON)/classes-jarjar.jar
 full_classes_jar := $(intermediates.COMMON)/classes.jar
+java_source_list_file := $(intermediates.COMMON)/java-source-list
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
 
 LOCAL_INTERMEDIATE_TARGETS += \
     $(full_classes_compiled_jar) \
     $(full_classes_jarjar_jar) \
+    $(java_source_list_file)
 
 #######################################
 include $(BUILD_SYSTEM)/base_rules.mk
@@ -58,22 +61,31 @@
 LOCAL_JAVACFLAGS += $(LOCAL_ERROR_PRONE_FLAGS)
 endif
 
+# List of dependencies for anything that needs all java sources in place
+java_sources_deps := \
+    $(java_sources) \
+    $(java_resource_sources) \
+    $(proto_java_sources_file_stamp) \
+    $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+$(java_source_list_file): $(java_sources_deps)
+	$(write-java-source-list)
+
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
-$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES :=
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES :=
 $(full_classes_compiled_jar): \
-        $(java_sources) \
-        $(java_resource_sources) \
-        $(full_java_lib_deps) \
-        $(jar_manifest_file) \
-        $(proto_java_sources_file_stamp) \
-        $(annotation_processor_deps) \
-        $(NORMALIZE_PATH) \
-        $(ZIPTIME) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) \
-        | $(SOONG_JAVAC_WRAPPER)
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_lib_deps) \
+    $(jar_manifest_file) \
+    $(annotation_processor_deps) \
+    $(NORMALIZE_PATH) \
+    $(ZIPTIME) \
+    $(JAR_ARGS) \
+    | $(SOONG_JAVAC_WRAPPER)
 	$(transform-host-java-to-package)
 	$(remove-timestamps-from-package)
 
@@ -100,3 +112,4 @@
 $(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
 $(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
 
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_header_jar)))
diff --git a/core/host_shared_library_internal.mk b/core/host_shared_library_internal.mk
index bfbde21..5e199cc 100644
--- a/core/host_shared_library_internal.mk
+++ b/core/host_shared_library_internal.mk
@@ -39,7 +39,7 @@
 include $(BUILD_SYSTEM)/binary.mk
 
 my_host_libprofile_rt := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LIBPROFILE_RT)
-$(LOCAL_BUILD_MODULE): PRIVATE_HOST_LIBPROFILE_RT := $(my_host_libprofile_rt)
+$(LOCAL_BUILT_MODULE): PRIVATE_HOST_LIBPROFILE_RT := $(my_host_libprofile_rt)
 
 $(LOCAL_BUILT_MODULE): \
         $(all_objects) \
diff --git a/core/jacoco.mk b/core/jacoco.mk
index a04d25e..f4788bf 100644
--- a/core/jacoco.mk
+++ b/core/jacoco.mk
@@ -120,12 +120,13 @@
 $(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_TEMP_JAR_PATH := $(my_temp_jar_path)
 $(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_INSTRUMENTED_PATH := $(my_instrumented_path)
 $(LOCAL_FULL_CLASSES_JACOCO_JAR): PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
+$(LOCAL_FULL_CLASSES_JACOCO_JAR): $(JAR_ARGS)
 $(LOCAL_FULL_CLASSES_JACOCO_JAR): $(my_instrumented_timestamp_path) $(LOCAL_FULL_CLASSES_PRE_JACOCO_JAR)
 	rm -f $@ $(PRIVATE_TEMP_JAR_PATH)
 	# copy the pre-jacoco jar (containing files excluded from instrumentation)
 	cp $(PRIVATE_FULL_CLASSES_PRE_JACOCO_JAR) $(PRIVATE_TEMP_JAR_PATH)
 	# copy instrumented files back into the resultant jar
-	$(JAR) -uf $(PRIVATE_TEMP_JAR_PATH) -C $(PRIVATE_INSTRUMENTED_PATH) .
+	$(JAR) -uf $(PRIVATE_TEMP_JAR_PATH) $(call jar-args-sorted-files-in-directory,$(PRIVATE_INSTRUMENTED_PATH))
 	mv $(PRIVATE_TEMP_JAR_PATH) $@
 
   # this is used to trigger $(my_classes_to_report_on_path) to build
diff --git a/core/java.mk b/core/java.mk
index 3601292..4b4b1c9 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -113,6 +113,9 @@
 LOCAL_PROGUARD_ENABLED :=
 endif
 
+full_classes_turbine_jar := $(intermediates.COMMON)/classes-turbine.jar
+full_classes_header_jarjar := $(intermediates.COMMON)/classes-header-jarjar.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
 full_classes_compiled_jar := $(intermediates.COMMON)/$(full_classes_compiled_jar_leaf)
 full_classes_processed_jar := $(intermediates.COMMON)/classes-processed.jar
 full_classes_desugar_jar := $(intermediates.COMMON)/classes-desugar.jar
@@ -121,6 +124,8 @@
 full_classes_proguard_jar := $(intermediates.COMMON)/classes-proguard.jar
 built_dex_intermediate := $(intermediates.COMMON)/$(built_dex_intermediate_leaf)/classes.dex
 full_classes_stubs_jar := $(intermediates.COMMON)/stubs.jar
+java_source_list_file := $(intermediates.COMMON)/java-source-list
+
 
 ifeq ($(LOCAL_MODULE_CLASS)$(LOCAL_SRC_FILES)$(LOCAL_STATIC_JAVA_LIBRARIES)$(LOCAL_SOURCE_FILES_ALL_GENERATED),APPS)
 # If this is an apk without any Java code (e.g. framework-res), we should skip compiling Java.
@@ -137,6 +142,7 @@
 jack_check_timestamp := $(intermediates.COMMON)/jack.check.timestamp
 
 LOCAL_INTERMEDIATE_TARGETS += \
+    $(full_classes_turbine_jar) \
     $(full_classes_compiled_jar) \
     $(full_classes_desugar_jar) \
     $(full_classes_jarjar_jar) \
@@ -147,8 +153,8 @@
     $(noshrob_classes_jack) \
     $(jack_check_timestamp) \
     $(built_dex) \
-    $(full_classes_stubs_jar)
-
+    $(full_classes_stubs_jar) \
+    $(java_source_list_file)
 
 LOCAL_INTERMEDIATE_SOURCE_DIR := $(intermediates.COMMON)/src
 
@@ -447,25 +453,64 @@
 endif
 endif
 
-$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+# List of dependencies for anything that needs all java sources in place
+java_sources_deps := \
+    $(java_sources) \
+    $(java_resource_sources) \
+    $(RenderScript_file_stamp) \
+    $(proto_java_sources_file_stamp) \
+    $(LOCAL_ADDITIONAL_DEPENDENCIES)
+
+$(java_source_list_file): $(java_sources_deps)
+	$(write-java-source-list)
+
+$(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES := $(LOCAL_JAR_EXCLUDE_FILES)
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES := $(LOCAL_JAR_PACKAGES)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_PACKAGES := $(LOCAL_JAR_EXCLUDE_PACKAGES)
 $(full_classes_compiled_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
+$(full_classes_compiled_jar): PRIVATE_JAVA_SOURCE_LIST := $(java_source_list_file)
 $(full_classes_compiled_jar): \
-        $(java_sources) \
-        $(java_resource_sources) \
-        $(full_java_lib_deps) \
-        $(jar_manifest_file) \
-        $(layers_file) \
-        $(RenderScript_file_stamp) \
-        $(proto_java_sources_file_stamp) \
-        $(annotation_processor_deps) \
-        $(NORMALIZE_PATH) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) \
-        | $(SOONG_JAVAC_WRAPPER)
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(full_static_java_libs) \
+    $(jar_manifest_file) \
+    $(layers_file) \
+    $(annotation_processor_deps) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    | $(SOONG_JAVAC_WRAPPER)
 	$(transform-java-to-classes.jar)
 
+$(full_classes_turbine_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
+$(full_classes_turbine_jar): PRIVATE_DONT_DELETE_JAR_META_INF := $(LOCAL_DONT_DELETE_JAR_META_INF)
+$(full_classes_turbine_jar): \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_java_header_libs) \
+    $(jar_manifest_file) \
+    $(layers_file) \
+    $(NORMALIZE_PATH) \
+    $(JAR_ARGS) \
+    $(ZIPTIME) \
+    | $(TURBINE)
+	$(transform-java-to-header.jar)
+
+.KATI_RESTAT: $(full_classes_turbine_jar)
+
+# Run jarjar before generate classes-header.jar if necessary.
+ifneq ($(strip $(LOCAL_JARJAR_RULES)),)
+$(full_classes_header_jarjar): PRIVATE_JARJAR_RULES := $(LOCAL_JARJAR_RULES)
+$(full_classes_header_jarjar): $(full_classes_turbine_jar) $(LOCAL_JARJAR_RULES) | $(JARJAR)
+	@echo Header JarJar: $@
+	$(hide) $(JAVA) -jar $(JARJAR) process $(PRIVATE_JARJAR_RULES) $< $@
+else
+full_classes_header_jarjar := $(full_classes_turbine_jar)
+endif
+
+$(eval $(call copy-one-file,$(full_classes_header_jarjar),$(full_classes_header_jar)))
+
 javac-check : $(full_classes_compiled_jar)
 javac-check-$(LOCAL_MODULE) : $(full_classes_compiled_jar)
 
@@ -500,7 +545,7 @@
 ifndef LOCAL_IS_STATIC_JAVA_LIBRARY
 my_desugaring := true
 $(full_classes_desugar_jar): PRIVATE_DX_FLAGS := $(LOCAL_DX_FLAGS)
-$(full_classes_desugar_jar): $(full_classes_processed_jar) $(DESUGAR)
+$(full_classes_desugar_jar): $(full_classes_processed_jar) $(full_java_header_libs) $(DESUGAR)
 	$(desugar-classes-jar)
 endif
 endif
@@ -549,19 +594,22 @@
 ifdef LOCAL_SDK_VERSION
 ifdef TARGET_BUILD_APPS
 ifeq (,$(filter current system_current test_current, $(LOCAL_SDK_VERSION)))
-  my_support_library_sdk_raise := $(call java-lib-files, sdk_vcurrent)
+  my_support_library_sdk_raise := $(call java-lib-header-files, sdk_vcurrent)
 endif
 else
   # For platform build, we can't just raise to the "current" SDK,
   # that would break apps that use APIs removed from the current SDK.
-  my_support_library_sdk_raise := $(call java-lib-files,$(TARGET_DEFAULT_JAVA_LIBRARIES))
+  my_support_library_sdk_raise := $(call java-lib-header-files,$(TARGET_DEFAULT_JAVA_LIBRARIES))
 endif
 endif
 endif
 
 # jack already has the libraries in its classpath and doesn't support jars
 legacy_proguard_flags := $(addprefix -libraryjars ,$(my_support_library_sdk_raise) \
-  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_libs)))
+  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_header_libs)))
+
+legacy_proguard_lib_deps := $(my_support_library_sdk_raise) \
+  $(filter-out $(my_support_library_sdk_raise),$(full_shared_java_header_libs))
 
 legacy_proguard_flags += -printmapping $(proguard_dictionary)
 jack_proguard_flags := -printmapping $(jack_dictionary)
@@ -606,6 +654,7 @@
 # link_instr_classes_jar is defined in base_rule.mk
 # jack already has this library in its classpath and doesn't support jars
 legacy_proguard_flags += -libraryjars $(link_instr_classes_jar)
+legacy_proguard_lib_deps += $(link_instr_classes_jar)
 else # obfuscation
 # If obfuscation is enabled, the main app must be obfuscated too.
 # We need to run obfuscation using the main app's dictionary,
@@ -659,7 +708,7 @@
 $(full_classes_proguard_jar): PRIVATE_PROGUARD_INJAR_FILTERS := $(proguard_injar_filters)
 $(full_classes_proguard_jar): PRIVATE_EXTRA_INPUT_JAR := $(extra_input_jar)
 $(full_classes_proguard_jar): PRIVATE_PROGUARD_FLAGS := $(legacy_proguard_flags) $(common_proguard_flags) $(LOCAL_PROGUARD_FLAGS)
-$(full_classes_proguard_jar) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_support_library_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) | $(PROGUARD)
+$(full_classes_proguard_jar) : $(full_classes_pre_proguard_jar) $(extra_input_jar) $(my_support_library_sdk_raise) $(common_proguard_flag_files) $(proguard_flag_files) $(legacy_proguard_lib_deps) | $(PROGUARD)
 	$(call transform-jar-to-proguard)
 
 else  # LOCAL_PROGUARD_ENABLED not defined
@@ -668,8 +717,6 @@
 
 $(eval $(call copy-one-file,$(full_classes_proguard_jar),$(full_classes_jar)))
 
-$(call define-jar-to-toc-rule, $(full_classes_jar))
-
 ifneq ($(LOCAL_IS_STATIC_JAVA_LIBRARY),true)
 ifndef LOCAL_JACK_ENABLED
 $(built_dex_intermediate): PRIVATE_DX_FLAGS := $(LOCAL_DX_FLAGS)
@@ -767,15 +814,22 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_PROGUARD_FLAGS :=
 endif # LOCAL_PROGUARD_ENABLED defined
 
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := $(GLOBAL_JAVAC_DEBUG_FLAGS) $(LOCAL_JACK_FLAGS) $(annotation_processor_flags)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_FLAGS := -g $(LOCAL_JACK_FLAGS) $(annotation_processor_flags)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JACK_VERSION := $(LOCAL_JACK_VERSION)
 
-jack_all_deps := $(java_sources) $(java_resource_sources) $(full_jack_deps) \
-        $(jar_manifest_file) $(layers_file) $(RenderScript_file_stamp) \
-        $(common_proguard_flag_files) $(proguard_flag_files) \
-        $(proto_java_sources_file_stamp) $(annotation_processor_deps) \
-        $(LOCAL_ADDITIONAL_DEPENDENCIES) $(LOCAL_JARJAR_RULES) \
-        $(NORMALIZE_PATH) $(JACK_DEFAULT_ARGS) $(JACK)
+jack_all_deps := \
+    $(java_source_list_file) \
+    $(java_sources_deps) \
+    $(full_jack_deps) \
+    $(jar_manifest_file) \
+    $(layers_file) \
+    $(common_proguard_flag_files) \
+    $(proguard_flag_files) \
+    $(annotation_processor_deps) \
+    $(LOCAL_JARJAR_RULES) \
+    $(NORMALIZE_PATH) \
+    $(JACK_DEFAULT_ARGS) \
+    $(JACK)
 
 $(jack_check_timestamp): $(jack_all_deps) | setup-jack-server
 	@echo Checking build with Jack: $@
diff --git a/core/java_common.mk b/core/java_common.mk
index 0859a46..17803f8 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -19,7 +19,11 @@
   ifneq (,$(filter $(LOCAL_SDK_VERSION), $(private_sdk_versions_without_any_java_18_support)))
     LOCAL_JAVA_LANGUAGE_VERSION := 1.7
   else
-    LOCAL_JAVA_LANGUAGE_VERSION := 1.8
+    ifneq ($(EXPERIMENTAL_USE_OPENJDK9),true)
+      LOCAL_JAVA_LANGUAGE_VERSION := 1.8
+    else
+      LOCAL_JAVA_LANGUAGE_VERSION := 1.9
+    endif
   endif
 endif
 LOCAL_JAVACFLAGS += -source $(LOCAL_JAVA_LANGUAGE_VERSION) -target $(LOCAL_JAVA_LANGUAGE_VERSION)
@@ -167,7 +171,13 @@
       $(call intermediates-dir-for, \
         JAVA_LIBRARIES,$(lib),$(LOCAL_IS_HOST_MODULE),COMMON)/classes.jar)
 
+full_static_java_header_libs := \
+    $(foreach lib,$(LOCAL_STATIC_JAVA_LIBRARIES), \
+      $(call intermediates-dir-for, \
+        JAVA_LIBRARIES,$(lib),$(LOCAL_IS_HOST_MODULE),COMMON)/classes-header.jar)
+
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_STATIC_JAVA_LIBRARIES := $(full_static_java_libs)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_STATIC_JAVA_HEADER_LIBRARIES := $(full_static_java_header_libs)
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RESOURCE_DIR := $(LOCAL_RESOURCE_DIR)
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ASSET_DIR := $(LOCAL_ASSET_DIR)
@@ -179,6 +189,7 @@
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_PROTO_SOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/proto
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_HAS_RS_SOURCES :=
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JAVA_SOURCES := $(all_java_sources)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_JAVA_SOURCE_LIST := $(java_source_list_file)
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RMTYPEDEFS := $(LOCAL_RMTYPEDEFS)
 
@@ -193,18 +204,18 @@
 # No bootclasspath. But we still need "" to prevent javac from using default host bootclasspath.
 my_bootclasspath := ""
 else  # LOCAL_NO_STANDARD_LIBRARIES
-my_bootclasspath := $(call java-lib-files,core-oj):$(call java-lib-files,core-libart)
+my_bootclasspath := $(call java-lib-header-files,core-oj):$(call java-lib-header-files,core-libart)
 endif  # LOCAL_NO_STANDARD_LIBRARIES
 else
 ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
 # LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
-my_bootclasspath := $(call java-lib-files,android_stubs_current)
+my_bootclasspath := $(call java-lib-header-files,android_stubs_current)
 else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),system_current)
-my_bootclasspath := $(call java-lib-files,android_system_stubs_current)
+my_bootclasspath := $(call java-lib-header-files,android_system_stubs_current)
 else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),test_current)
-my_bootclasspath := $(call java-lib-files,android_test_stubs_current)
+my_bootclasspath := $(call java-lib-header-files,android_test_stubs_current)
 else
-my_bootclasspath := $(call java-lib-files,sdk_v$(LOCAL_SDK_VERSION))
+my_bootclasspath := $(call java-lib-header-files,sdk_v$(LOCAL_SDK_VERSION))
 endif # current, system_current, or test_current
 endif # LOCAL_SDK_VERSION
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(my_bootclasspath)
@@ -222,6 +233,7 @@
 endif
 
 full_shared_java_libs := $(call java-lib-files,$(LOCAL_JAVA_LIBRARIES) $(my_additional_javac_libs),$(LOCAL_IS_HOST_MODULE))
+full_shared_java_header_libs := $(call java-lib-header-files,$(LOCAL_JAVA_LIBRARIES) $(my_additional_javac_libs),$(LOCAL_IS_HOST_MODULE))
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES) $(my_additional_javac_libs),$(LOCAL_IS_HOST_MODULE))
 full_java_lib_deps := $(addsuffix .toc, $(full_java_lib_deps))
 
@@ -231,11 +243,12 @@
 ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
 my_bootclasspath := ""
 else
-my_bootclasspath := $(call normalize-path-list,$(call java-lib-files,core-oj-hostdex core-libart-hostdex,true))
+my_bootclasspath := $(call normalize-path-list,$(call java-lib-header-files,core-oj-hostdex core-libart-hostdex,true))
 endif
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(my_bootclasspath)
 
 full_shared_java_libs := $(call java-lib-files,$(LOCAL_JAVA_LIBRARIES),true)
+full_shared_java_header_libs := $(call java-lib-header-files,$(LOCAL_JAVA_LIBRARIES),true)
 full_java_lib_deps := $(full_shared_java_libs)
 else # !USE_CORE_LIB_BOOTCLASSPATH
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH :=
@@ -246,7 +259,10 @@
 endif # USE_CORE_LIB_BOOTCLASSPATH
 endif # !LOCAL_IS_HOST_MODULE
 
+# Only host java libraries use LOCAL_CLASSPATH.
 full_java_libs := $(full_shared_java_libs) $(full_static_java_libs) $(LOCAL_CLASSPATH)
+full_java_header_libs := $(full_shared_java_header_libs) $(full_static_java_header_libs)
+
 full_java_lib_deps := $(full_java_lib_deps) $(full_static_java_libs) $(LOCAL_CLASSPATH)
 
 ifndef LOCAL_IS_HOST_MODULE
@@ -262,6 +278,7 @@
   # link against the jar with full original names (before proguard processing).
   full_shared_java_libs += $(link_apk_libraries)
   full_java_libs += $(link_apk_libraries)
+  full_java_header_libs += $(link_apk_libraries)
   full_java_lib_deps += $(link_apk_libraries)
 endif
 
@@ -280,6 +297,7 @@
   # link against the jar with full original names (before proguard processing).
   link_instr_classes_jar := $(link_instr_intermediates_dir.COMMON)/classes-pre-proguard.jar
   full_java_libs += $(link_instr_classes_jar)
+  full_java_header_libs += $(link_instr_classes_jar)
   full_java_lib_deps += $(link_instr_classes_jar)
 endif  # LOCAL_INSTRUMENTATION_FOR
 endif  # LOCAL_IS_HOST_MODULE
@@ -328,6 +346,7 @@
 endif  # !LOCAL_IS_HOST_MODULE
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ALL_JAVA_LIBRARIES := $(full_java_libs)
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_ALL_JAVA_HEADER_LIBRARIES := $(full_java_header_libs)
 
 ALL_MODULES.$(my_register_name).INTERMEDIATE_SOURCE_DIR := \
     $(ALL_MODULES.$(my_register_name).INTERMEDIATE_SOURCE_DIR) $(LOCAL_INTERMEDIATE_SOURCE_DIR)
diff --git a/core/java_library.mk b/core/java_library.mk
index 84f4419..76710a2 100644
--- a/core/java_library.mk
+++ b/core/java_library.mk
@@ -84,15 +84,18 @@
 $(common_javalib.jar) : $(built_dex) $(java_resource_sources) | $(ZIPTIME)
 	@echo "target Jar: $(PRIVATE_MODULE) ($@)"
 ifdef LOCAL_JACK_ENABLED
-	$(create-empty-package)
+	$(call create-empty-package-at,$@.tmp)
 else
-	$(call initialize-package-file,$(PRIVATE_SOURCE_ARCHIVE),$@)
+	$(call initialize-package-file,$(PRIVATE_SOURCE_ARCHIVE),$@.tmp)
 endif
-	$(add-dex-to-package)
+	$(call add-dex-to-package-arg,$@.tmp)
 ifdef LOCAL_JACK_ENABLED
-	$(add-carried-jack-resources)
+	$(call add-carried-jack-resources-to,$@.tmp)
 endif
-	$(remove-timestamps-from-package)
+	$(hide) $(ZIPTIME) $@.tmp
+	$(call commit-change-for-toc,$@)
+
+.KATI_RESTAT: $(common_javalib.jar)
 
 ifdef LOCAL_DEX_PREOPT
 ifneq ($(dexpreopt_boot_jar_module),) # boot jar
diff --git a/core/main.mk b/core/main.mk
index 3d42c8f..2488aeb 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -70,6 +70,10 @@
 DATE_FROM_FILE := date -d @$(BUILD_DATETIME_FROM_FILE)
 endif
 
+# Make an empty directory, which can be used to make empty jars
+EMPTY_DIRECTORY := $(OUT_DIR)/empty
+$(shell mkdir -p $(EMPTY_DIRECTORY) && rm -rf $(EMPTY_DIRECTORY)/*)
+
 # CTS-specific config.
 -include cts/build/config.mk
 # VTS-specific config.
@@ -79,11 +83,24 @@
 # general-tests-specific-config.
 -include tools/tradefederation/build/suites/general-tests/config.mk
 
-# This allows us to force a clean build - included after the config.mk
-# environment setup is done, but before we generate any dependencies.  This
-# file does the rm -rf inline so the deps which are all done below will
-# be generated correctly
-include $(BUILD_SYSTEM)/cleanbuild.mk
+# Clean rules
+.PHONY: clean-jack-files
+clean-jack-files: clean-dex-files
+	$(hide) find $(OUT_DIR) -name "*.jack" | xargs rm -f
+	$(hide) find $(OUT_DIR) -type d -name "jack" | xargs rm -rf
+	@echo "All jack files have been removed."
+
+.PHONY: clean-dex-files
+clean-dex-files:
+	$(hide) find $(OUT_DIR) -name "*.dex" ! -path "*/jack-incremental/*" | xargs rm -f
+	$(hide) for i in `find $(OUT_DIR) -name "*.jar" -o -name "*.apk"` ; do ((unzip -l $$i 2> /dev/null | \
+				grep -q "\.dex$$" && rm -f $$i) || continue ) ; done
+	@echo "All dex files and archives containing dex files have been removed."
+
+.PHONY: clean-jack-incremental
+clean-jack-incremental:
+	$(hide) find $(OUT_DIR) -name "jack-incremental" -type d | xargs rm -rf
+	@echo "All jack incremental dirs have been removed."
 
 # Include the google-specific config
 -include vendor/google/build/config.mk
@@ -416,7 +433,7 @@
 # Include all of the makefiles in the system
 #
 
-subdir_makefiles := $(SOONG_ANDROID_MK) $(call first-makefiles-under,$(TOP))
+subdir_makefiles := $(SOONG_ANDROID_MK) $(file <$(OUT_DIR)/.module_paths/Android.mk.list)
 subdir_makefiles_total := $(words $(subdir_makefiles))
 .KATI_READONLY := subdir_makefiles_total
 
@@ -498,9 +515,10 @@
 # If a module is for a cross host os, the required modules must be for
 # that OS too.
 # If a module is built for 32-bit, the required modules must be 32-bit too;
-# Otherwise if the module is an exectuable or shared library,
+# Otherwise if the module is an executable or shared library,
 #   the required modules must be 64-bit;
 #   otherwise we require both 64-bit and 32-bit variant, if one exists.
+define select-bitness-of-required-modules
 $(foreach m,$(ALL_MODULES),\
   $(eval r := $(ALL_MODULES.$(m).REQUIRED))\
   $(if $(r),\
@@ -516,6 +534,8 @@
      $(eval ALL_MODULES.$(m).REQUIRED := $(strip $(r_r)))\
   )\
 )
+endef
+$(call select-bitness-of-required-modules)
 r_r :=
 
 define add-required-deps
@@ -530,24 +550,68 @@
 $(1): $(2)
 endef
 
+# Sets up dependencies such that whenever a host module is installed,
+# any other host modules listed in $(ALL_MODULES.$(m).REQUIRED) will also be installed
+define add-all-host-to-host-required-modules-deps
+$(foreach m,$(ALL_MODULES), \
+  $(eval r := $(ALL_MODULES.$(m).REQUIRED)) \
+  $(if $(r), \
+    $(eval r := $(call module-installed-files,$(r))) \
+    $(eval h_m := $(filter $(HOST_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
+    $(eval hc_m := $(filter $(HOST_CROSS_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
+    $(eval h_r := $(filter $(HOST_OUT)/%, $(r))) \
+    $(eval hc_r := $(filter $(HOST_CROSS_OUT)/%, $(r))) \
+    $(eval h_m := $(filter-out $(h_r), $(h_m))) \
+    $(eval hc_m := $(filter-out $(hc_r), $(hc_m))) \
+    $(if $(h_m), $(eval $(call add-required-deps, $(h_m),$(h_r)))) \
+    $(if $(hc_m), $(eval $(call add-required-deps, $(hc_m),$(hc_r)))) \
+  ) \
+)
+endef
+$(call add-all-host-to-host-required-modules-deps)
+
+# Sets up dependencies such that whenever a target module is installed,
+# any other target modules listed in $(ALL_MODULES.$(m).REQUIRED) will also be installed
+define add-all-target-to-target-required-modules-deps
 $(foreach m,$(ALL_MODULES), \
   $(eval r := $(ALL_MODULES.$(m).REQUIRED)) \
   $(if $(r), \
     $(eval r := $(call module-installed-files,$(r))) \
     $(eval t_m := $(filter $(TARGET_OUT_ROOT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
-    $(eval h_m := $(filter $(HOST_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
-    $(eval hc_m := $(filter $(HOST_CROSS_OUT)/%, $(ALL_MODULES.$(m).INSTALLED))) \
     $(eval t_r := $(filter $(TARGET_OUT_ROOT)/%, $(r))) \
-    $(eval h_r := $(filter $(HOST_OUT)/%, $(r))) \
-    $(eval hc_r := $(filter $(HOST_CROSS_OUT)/%, $(r))) \
     $(eval t_m := $(filter-out $(t_r), $(t_m))) \
-    $(eval h_m := $(filter-out $(h_r), $(h_m))) \
-    $(eval hc_m := $(filter-out $(hc_r), $(hc_m))) \
     $(if $(t_m), $(eval $(call add-required-deps, $(t_m),$(t_r)))) \
-    $(if $(h_m), $(eval $(call add-required-deps, $(h_m),$(h_r)))) \
-    $(if $(hc_m), $(eval $(call add-required-deps, $(hc_m),$(hc_r)))) \
-   ) \
- )
+  ) \
+)
+endef
+$(call add-all-target-to-target-required-modules-deps)
+
+# Sets up dependencies such that whenever a host module is installed,
+# any target modules listed in $(ALL_MODULES.$(m).TARGET_REQUIRED) will also be installed
+define add-all-host-to-target-required-modules-deps
+$(foreach m,$(ALL_MODULES), \
+  $(eval req_mods := $(ALL_MODULES.$(m).TARGET_REQUIRED))\
+  $(if $(req_mods), \
+    $(eval req_files := )\
+    $(foreach req_mod,$(req_mods), \
+      $(eval req_file := $(filter $(TARGET_OUT_ROOT)/%, $(call module-installed-files,$(req_mod)))) \
+      $(if $(strip $(req_file)),\
+        ,\
+        $(error $(m).LOCAL_TARGET_REQUIRED_MODULES : illegal value $(req_mod) : not a device module. If you want to specify host modules to be required to be installed along with your host module, add those module names to LOCAL_REQUIRED_MODULES instead)\
+      )\
+      $(eval req_files := $(req_files)$(space)$(req_file))\
+    )\
+    $(eval req_files := $(strip $(req_files)))\
+    $(eval mod_files := $(filter $(HOST_OUT)/%, $(call module-installed-files,$(m)))) \
+    $(eval mod_files := $(filter-out $(req_files),$(mod_files)))\
+    $(if $(mod_files),\
+      $(eval $(call add-required-deps, $(mod_files),$(req_files))) \
+    )\
+  )\
+)
+endef
+$(call add-all-host-to-target-required-modules-deps)
+
 
 t_m :=
 h_m :=
@@ -556,7 +620,7 @@
 h_r :=
 hc_r :=
 
-# Establish the dependecies on the shared libraries.
+# Establish the dependencies on the shared libraries.
 # It also adds the shared library module names to ALL_MODULES.$(m).REQUIRED,
 # so they can be expanded to product_MODULES later.
 # $(1): TARGET_ or HOST_ or HOST_CROSS_.
diff --git a/core/package_internal.mk b/core/package_internal.mk
index 5c4ad28..254179c 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -375,7 +375,9 @@
 	$(hide) touch $@
 
 # Make sure the data-binding process happens before javac and generation of R.java.
-$(R_file_stamp) $(full_classes_compiled_jar) : $(data_binding_stamp)
+$(R_file_stamp): $(data_binding_stamp)
+$(java_source_list_file): $(data_binding_stamp)
+$(full_classes_compiled_jar): $(data_binding_stamp)
 # The dependency path when jack is enabled
 $(built_dex_intermediate) : $(data_binding_stamp)
 endif  # LOCAL_DATA_BINDING
@@ -469,26 +471,9 @@
 # they want to use this module's R.java file.
 $(LOCAL_BUILT_MODULE): $(R_file_stamp)
 
-ifdef LOCAL_JACK_ENABLED
-ifneq ($(built_dex_intermediate),)
-$(built_dex_intermediate): $(R_file_stamp)
-endif
-ifneq ($(noshrob_classes_jack),)
-$(noshrob_classes_jack): $(R_file_stamp)
-endif
-ifneq ($(full_classes_jack),)
-$(full_classes_jack): $(R_file_stamp)
-$(jack_check_timestamp): $(R_file_stamp)
-endif
-endif # LOCAL_JACK_ENABLED
-
-ifneq ($(full_classes_jar),)
-# If full_classes_jar is non-empty, we're building sources.
-# If we're building sources, the initial javac step (which
-# produces full_classes_compiled_jar) needs to ensure the
-# R.java and Manifest.java files have been generated first.
-$(full_classes_compiled_jar): $(R_file_stamp)
-endif
+# The R.java file must exist by the time the java source
+# list is generated
+$(java_source_list_file): $(R_file_stamp)
 
 endif  # need_compile_res
 
@@ -598,8 +583,12 @@
     $(my_res_package) $(LOCAL_BUILT_MODULE): PRIVATE_PRODUCT_AAPT_PREF_CONFIG := $(PRODUCT_AAPT_PREF_CONFIG)
 endif
 endif
+
 $(LOCAL_BUILT_MODULE): PRIVATE_DONT_DELETE_JAR_DIRS := $(LOCAL_DONT_DELETE_JAR_DIRS)
+$(LOCAL_BUILT_MODULE): PRIVATE_RESOURCE_INTERMEDIATES_DIR := $(intermediates.COMMON)/resources
+$(LOCAL_BUILT_MODULE): PRIVATE_FULL_CLASSES_JAR := $(full_classes_jar)
 $(LOCAL_BUILT_MODULE) : $(jni_shared_libraries)
+$(LOCAL_BUILT_MODULE) : $(JAR_ARGS)
 ifdef LOCAL_USE_AAPT2
 $(LOCAL_BUILT_MODULE): PRIVATE_RES_PACKAGE := $(my_res_package)
 $(LOCAL_BUILT_MODULE) : $(my_res_package) $(AAPT2) | $(ACP)
@@ -630,6 +619,11 @@
 	$(if $(PRIVATE_EXTRA_JAR_ARGS),$(call add-java-resources-to,$@))
 else  # full_classes_jar
 	$(add-dex-to-package)
+ifdef LOCAL_USE_AAPT2
+ifndef LOCAL_JACK_ENABLED
+	$(call add-jar-resources-to-package,$@,$(PRIVATE_FULL_CLASSES_JAR),$(PRIVATE_RESOURCE_INTERMEDIATES_DIR))
+endif
+endif
 endif  # full_classes_jar
 ifdef LOCAL_JACK_ENABLED
 	$(add-carried-jack-resources)
diff --git a/core/pdk_config.mk b/core/pdk_config.mk
index e12be29..d002529 100644
--- a/core/pdk_config.mk
+++ b/core/pdk_config.mk
@@ -103,9 +103,6 @@
 ifeq (true,$(TARGET_BUILD_PDK_JAVA_PLATFORM))
 
 PDK_FUSION_OUT_DIR := $(OUT_DIR)
-ifeq (debug,$(TARGET_BUILD_TYPE))
-PDK_FUSION_OUT_DIR := $(DEBUG_OUT_DIR)
-endif
 
 define JAVA_dependency_template
 $(call add-dependency,$(PDK_FUSION_OUT_DIR)/$(strip $(1)),\
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index a9c0bc2..8caf0ee 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -495,6 +495,7 @@
 # for host java libraries deps should be in the common dir, so we make a copy in
 # the common dir.
 common_classes_jar := $(intermediates.COMMON)/classes.jar
+common_header_jar := $(intermediates.COMMON)/classes-header.jar
 
 $(common_classes_jar): PRIVATE_MODULE := $(LOCAL_MODULE)
 $(common_classes_jar): PRIVATE_PREFIX := $(my_prefix)
@@ -502,10 +503,14 @@
 $(common_classes_jar) : $(my_src_jar)
 	$(transform-prebuilt-to-target)
 
+$(common_header_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
 else # !LOCAL_IS_HOST_MODULE
 # for target java libraries, the LOCAL_BUILT_MODULE is in a product-specific dir,
 # while the deps should be in the common dir, so we make a copy in the common dir.
 common_classes_jar := $(intermediates.COMMON)/classes.jar
+common_header_jar := $(intermediates.COMMON)/classes-header.jar
 common_classes_pre_proguard_jar := $(intermediates.COMMON)/classes-pre-proguard.jar
 common_javalib_jar := $(intermediates.COMMON)/javalib.jar
 
@@ -550,14 +555,15 @@
 $(common_classes_jar) : $(my_src_jar)
 	$(transform-prebuilt-to-target)
 
+$(common_header_jar) : $(my_src_jar)
+	$(transform-prebuilt-to-target)
+
 $(common_classes_pre_proguard_jar) : $(my_src_jar)
 	$(transform-prebuilt-to-target)
 
 $(common_javalib_jar) : $(common_classes_jar)
 	$(transform-prebuilt-to-target)
 
-$(call define-jar-to-toc-rule, $(common_classes_jar))
-
 ifdef LOCAL_USE_AAPT2
 ifneq ($(my_src_aar),)
 LOCAL_SDK_RES_VERSION:=$(strip $(LOCAL_SDK_RES_VERSION))
diff --git a/core/product.mk b/core/product.mk
index c955ccc..800b49a 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -142,6 +142,7 @@
     PRODUCT_SYSTEM_HEADROOM \
     PRODUCT_MINIMIZE_JAVA_DEBUG_INFO \
     PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS \
+    PRODUCT_COMPILE_WITH_JACK \
 
 
 
diff --git a/core/product_config.mk b/core/product_config.mk
index cd62fb2..6ab40c0 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -453,3 +453,7 @@
 # Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
 PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS := \
     $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
+
+# Temporarily force Jack back on for a product
+PRODUCT_COMPILE_WITH_JACK := \
+    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_COMPILE_WITH_JACK))
diff --git a/core/soong_config.mk b/core/soong_config.mk
index cdd2896..ae0a0b2 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -34,7 +34,8 @@
 	echo '    "Make_suffix": "-$(TARGET_PRODUCT)",'; \
 	echo ''; \
 	echo '    "Platform_sdk_version": $(PLATFORM_SDK_VERSION),'; \
-	echo '    "Platform_version_all_codenames": $(call csv_to_json_list,$(PLATFORM_VERSION_ALL_CODENAMES)),'; \
+	echo '    "Platform_version_active_codenames": $(call csv_to_json_list,$(PLATFORM_VERSION_ALL_CODENAMES)),'; \
+	echo '    "Platform_version_future_codenames": $(call csv_to_json_list,$(PLATFORM_VERSION_FUTURE_CODENAMES)),'; \
 	echo '    "Unbundled_build": $(if $(TARGET_BUILD_APPS),true,false),'; \
 	echo '    "Brillo": $(if $(BRILLO),true,false),'; \
 	echo '    "Malloc_not_svelte": $(if $(filter true,$(MALLOC_SVELTE)),false,true),'; \
@@ -84,6 +85,7 @@
 	echo '    "Override_rs_driver": "$(OVERRIDE_RS_DRIVER)",'; \
 	echo '    "Treble": $(if $(filter true,$(PRODUCT_FULL_TREBLE)),true,false),'; \
 	echo '    "Pdk": $(if $(filter true,$(TARGET_BUILD_PDK)),true,false),'; \
+	echo '    "Uml": $(if $(filter true,$(TARGET_USER_MODE_LINUX)),true,false),'; \
 	echo ''; \
 	echo '    "ArtUseReadBarrier": $(if $(filter false,$(PRODUCT_ART_USE_READ_BARRIER)),false,true),'; \
 	echo ''; \
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
new file mode 100644
index 0000000..ee8b199
--- /dev/null
+++ b/core/soong_java_prebuilt.mk
@@ -0,0 +1,45 @@
+# Java prebuilt coming from Soong.
+# Extra inputs:
+# LOCAL_SOONG_HEADER_JAR
+# LOCAL_SOONG_DEX
+
+ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+  $(call pretty-error,soong_java_prebuilt.mk may only be used from Soong)
+endif
+
+# TODO: device support
+ifndef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,exporting soong device jars to make not supported yet)
+endif
+
+LOCAL_MODULE_SUFFIX := .jar
+LOCAL_BUILT_MODULE_STEM := javalib.jar
+
+#######################################
+include $(BUILD_SYSTEM)/base_rules.mk
+#######################################
+
+full_classes_jar := $(intermediates.COMMON)/classes.jar
+full_classes_header_jar := $(intermediates.COMMON)/classes-header.jar
+
+LOCAL_FULL_CLASSES_PRE_JACOCO_JAR := $(LOCAL_PREBUILT_MODULE_FILE)
+
+#######################################
+include $(BUILD_SYSTEM)/jacoco.mk
+#######################################
+
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(LOCAL_BUILT_MODULE)))
+$(eval $(call copy-one-file,$(LOCAL_FULL_CLASSES_JACOCO_JAR),$(full_classes_jar)))
+
+ifdef LOCAL_SOONG_HEADER_JAR
+$(eval $(call copy-one-file,$(LOCAL_SOONG_HEADER_JAR),$(full_classes_header_jar)))
+else
+$(eval $(call copy-one-file,$(full_classes_jar),$(full_classes_header_jar)))
+endif
+
+javac-check : $(full_classes_jar)
+javac-check-$(LOCAL_MODULE) : $(full_classes_jar)
+
+# Built in equivalent to include $(CLEAR_VARS)
+LOCAL_SOONG_HEADER_JAR :=
+LOCAL_SOONG_DEX :=
diff --git a/core/static_java_library.mk b/core/static_java_library.mk
index 1373011..c39c40a 100644
--- a/core/static_java_library.mk
+++ b/core/static_java_library.mk
@@ -177,12 +177,14 @@
 endif  # LOCAL_USE_AAPT2
 
 $(LOCAL_BUILT_MODULE): $(R_file_stamp)
+$(java_source_list_file): $(R_file_stamp)
 ifdef LOCAL_JACK_ENABLED
 $(noshrob_classes_jack): $(R_file_stamp)
 $(full_classes_jack): $(R_file_stamp)
 $(jack_check_timestamp): $(R_file_stamp)
 endif # LOCAL_JACK_ENABLED
 $(full_classes_compiled_jar): $(R_file_stamp)
+$(full_classes_turbine_jar): $(R_file_stamp)
 
 
 # if we have custom proguarding done use the proguarded classes jar instead of the normal classes jar
@@ -199,6 +201,7 @@
 $(built_aar): PRIVATE_CLASSES_JAR := $(aar_classes_jar)
 $(built_aar): PRIVATE_RESOURCE_DIR := $(LOCAL_RESOURCE_DIR)
 $(built_aar): PRIVATE_R_TXT := $(LOCAL_INTERMEDIATE_SOURCE_DIR)/R.txt
+$(built_aar): $(JAR_ARGS)
 $(built_aar) : $(aar_classes_jar) $(full_android_manifest)
 	@echo "target AAR:  $(PRIVATE_MODULE) ($@)"
 	$(hide) rm -rf $(dir $@)aar && mkdir -p $(dir $@)aar/res
@@ -208,7 +211,7 @@
 	$(hide) $(foreach res,$(PRIVATE_RESOURCE_DIR),cp -Rfn $(res)/* $(dir $@)aar/res;)
 	$(hide) cp $(PRIVATE_R_TXT) $(dir $@)aar/R.txt
 	$(hide) $(JAR) -cMf $@ \
-	  -C $(dir $@)aar .
+	  $(call jar-args-sorted-files-in-directory,$(dir $@)aar)
 
 # Register the aar file.
 ALL_MODULES.$(LOCAL_MODULE).AAR := $(built_aar)
diff --git a/core/tasks/device-tests.mk b/core/tasks/device-tests.mk
index b1b936a..d679c59 100644
--- a/core/tasks/device-tests.mk
+++ b/core/tasks/device-tests.mk
@@ -17,11 +17,11 @@
 
 device-tests-zip := $(PRODUCT_OUT)/device-tests.zip
 $(device-tests-zip): $(COMPATIBILITY.device-tests.FILES) $(SOONG_ZIP)
-	echo $(sort $(COMPATIBILITY.device-tests.FILES)) > $@.list
-	sed -i -e 's/\s\+/\n/g' $@.list
+	echo $(sort $(COMPATIBILITY.device-tests.FILES)) | tr " " "\n" > $@.list
 	grep $(HOST_OUT_TESTCASES) $@.list > $@-host.list || true
 	grep $(TARGET_OUT_TESTCASES) $@.list > $@-target.list || true
 	$(hide) $(SOONG_ZIP) -d -o $@ -P host -C $(HOST_OUT) -l $@-host.list -P target -C $(PRODUCT_OUT) -l $@-target.list
+	rm -f $@.list $@-host.list $@-target.list
 
 device-tests: $(device-tests-zip)
 $(call dist-for-goals, device-tests, $(device-tests-zip))
diff --git a/core/tasks/general-tests.mk b/core/tasks/general-tests.mk
index 763dd51..bf4eb1d 100644
--- a/core/tasks/general-tests.mk
+++ b/core/tasks/general-tests.mk
@@ -16,11 +16,11 @@
 
 general-tests-zip := $(PRODUCT_OUT)/general-tests.zip
 $(general-tests-zip): $(COMPATIBILITY.general-tests.FILES) $(SOONG_ZIP)
-	echo $(sort $(COMPATIBILITY.general-tests.FILES)) > $@.list
-	sed -i -e 's/\s\+/\n/g' $@.list
+	echo $(sort $(COMPATIBILITY.general-tests.FILES)) | tr " " "\n" > $@.list
 	grep $(HOST_OUT_TESTCASES) $@.list > $@-host.list || true
 	grep $(TARGET_OUT_TESTCASES) $@.list > $@-target.list || true
 	$(hide) $(SOONG_ZIP) -d -o $@ -P host -C $(HOST_OUT) -l $@-host.list -P target -C $(PRODUCT_OUT) -l $@-target.list
+	rm -f $@.list $@-host.list $@-target.list
 
 general-tests: $(general-tests-zip)
 $(call dist-for-goals, general-tests, $(general-tests-zip))
diff --git a/core/tasks/tools/build_custom_image.mk b/core/tasks/tools/build_custom_image.mk
index 719279c..370934b 100644
--- a/core/tasks/tools/build_custom_image.mk
+++ b/core/tasks/tools/build_custom_image.mk
@@ -62,12 +62,16 @@
   $(eval my_image_copy_files += $(src))\
   $(eval my_copy_pairs += $(src):$(my_staging_dir)/$(word 2,$(pair))))
 
-ifndef CUSTOM_IMAGE_AVB_KEY_PATH
-# If key path isn't specified, use the default signing args.
-my_avb_signing_args := $(INTERNAL_AVB_SIGNING_ARGS)
-else
-my_avb_signing_args := \
-  --algorithm $(CUSTOM_IMAGE_AVB_ALGORITHM) --key $(CUSTOM_IMAGE_AVB_KEY_PATH)
+ifdef CUSTOM_IMAGE_AVB_KEY_PATH
+ifndef CUSTOM_IMAGE_AVB_ALGORITHM
+  $(error CUSTOM_IMAGE_AVB_ALGORITHM is not defined)
+endif
+ifndef CUSTOM_IMAGE_AVB_ROLLBACK_INDEX
+  $(error CUSTOM_IMAGE_AVB_ROLLBACK_INDEX is not defined)
+endif
+# set rollback_index via footer args
+CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS += --rollback_index $(CUSTOM_IMAGE_AVB_ROLLBACK_INDEX)
+CUSTOM_IMAGE_AVB_ADD_HASHTREE_FOOTER_ARGS += --rollback_index $(CUSTOM_IMAGE_AVB_ROLLBACK_INDEX)
 endif
 
 $(my_built_custom_image): PRIVATE_INTERMEDIATES := $(intermediates)
@@ -84,7 +88,8 @@
 $(my_built_custom_image): PRIVATE_VERITY_BLOCK_DEVICE := $(CUSTOM_IMAGE_VERITY_BLOCK_DEVICE)
 $(my_built_custom_image): PRIVATE_DICT_FILE := $(CUSTOM_IMAGE_DICT_FILE)
 $(my_built_custom_image): PRIVATE_AVB_AVBTOOL := $(AVBTOOL)
-$(my_built_custom_image): PRIVATE_AVB_SIGNING_ARGS := $(my_avb_signing_args)
+$(my_built_custom_image): PRIVATE_AVB_KEY_PATH := $(CUSTOM_IMAGE_AVB_KEY_PATH)
+$(my_built_custom_image): PRIVATE_AVB_ALGORITHM:= $(CUSTOM_IMAGE_AVB_ALGORITHM)
 $(my_built_custom_image): PRIVATE_AVB_HASH_ENABLE := $(CUSTOM_IMAGE_AVB_HASH_ENABLE)
 $(my_built_custom_image): PRIVATE_AVB_ADD_HASH_FOOTER_ARGS := $(CUSTOM_IMAGE_AVB_ADD_HASH_FOOTER_ARGS)
 $(my_built_custom_image): PRIVATE_AVB_HASHTREE_ENABLE := $(CUSTOM_IMAGE_AVB_HASHTREE_ENABLE)
@@ -131,7 +136,9 @@
 	$(if $(PRIVATE_SUPPORT_VERITY_FEC),\
 	  $(hide) echo "verity_fec=$(PRIVATE_SUPPORT_VERITY_FEC)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
 	$(hide) echo "avb_avbtool=$(PRIVATE_AVB_AVBTOOL)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt
-	$(hide) echo "avb_signing_args=$(PRIVATE_AVB_SIGNING_ARGS)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt
+	$(if $(PRIVATE_AVB_KEY_PATH),\
+	  $(hide) echo "avb_key_path=$(PRIVATE_AVB_KEY_PATH)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
+	    echo "avb_algorithm=$(PRIVATE_AVB_ALGORITHM)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
 	$(if $(PRIVATE_AVB_HASH_ENABLE),\
 	  $(hide) echo "avb_hash_enable=$(PRIVATE_AVB_HASH_ENABLE)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt;\
 	    echo "avb_add_hash_footer_args=$(PRIVATE_AVB_ADD_HASH_FOOTER_ARGS)" >> $(PRIVATE_INTERMEDIATES)/image_info.txt)
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 7b45d28..22eea8d 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -124,14 +124,17 @@
     PLATFORM_VERSION_CODENAME := $(TARGET_PLATFORM_VERSION)
   endif
 
-  # This is all of the development codenames that are active.  Should be either
-  # the same as PLATFORM_VERSION_CODENAME or a comma-separated list of additional
-  # codenames after PLATFORM_VERSION_CODENAME.
+  # This is all of the *active* development codenames. There are future
+  # codenames not included in this list. This confusing name is needed because
+  # all_codenames has been baked into build.prop for ages.
+  #
+  # Should be either the same as PLATFORM_VERSION_CODENAME or a comma-separated
+  # list of additional codenames after PLATFORM_VERSION_CODENAME.
   PLATFORM_VERSION_ALL_CODENAMES :=
 
-  # Build a list of all possible code names. Avoid duplicates, and stop when we
+  # Build a list of all active code names. Avoid duplicates, and stop when we
   # reach a codename that matches PLATFORM_VERSION_CODENAME (anything beyond
-  # that is not included in our build.
+  # that is not included in our build).
   _versions_in_target := \
     $(call find_and_earlier,$(ALL_VERSIONS),$(TARGET_PLATFORM_VERSION))
   $(foreach version,$(_versions_in_target),\
@@ -139,9 +142,23 @@
     $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_CODENAMES)),,\
       $(eval PLATFORM_VERSION_ALL_CODENAMES += $(_codename))))
 
+  # This is all of the inactive development codenames. Available to be targeted
+  # in this branch but in the future relative to our current target.
+  PLATFORM_VERSION_FUTURE_CODENAMES :=
+
+  # Build a list of all untargeted code names. Avoid duplicates.
+  _versions_not_in_target := \
+    $(filter-out $(PLATFORM_VERSION_ALL_CODENAMES),$(ALL_VERSIONS))
+  $(foreach version,$(_versions_not_in_target),\
+    $(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
+    $(if $(filter $(_codename),$(PLATFORM_VERSION_FUTURE_CODENAMES)),,\
+      $(eval PLATFORM_VERSION_FUTURE_CODENAMES += $(_codename))))
+
   # And convert from space separated to comma separated.
   PLATFORM_VERSION_ALL_CODENAMES := \
     $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_ALL_CODENAMES)))
+  PLATFORM_VERSION_FUTURE_CODENAMES := \
+    $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_FUTURE_CODENAMES)))
 
 endif
 
@@ -207,7 +224,7 @@
   BUILD_DATETIME := $(shell date +%s)
 endif
 
-ifneq (,$(findstring Darwin,$(shell uname -sm)))
+ifneq (,$(findstring Darwin,$(UNAME)))
 DATE := date -r $(BUILD_DATETIME)
 else
 DATE := date -d @$(BUILD_DATETIME)
diff --git a/envsetup.sh b/envsetup.sh
index 4cbe3e7..3f718bd 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -1,7 +1,13 @@
 function hmm() {
 cat <<EOF
+
+Run "m help" for help with the build system itself.
+
 Invoke ". build/envsetup.sh" from your shell to add the following functions to your environment:
 - lunch:     lunch <product_name>-<build_variant>
+             Selects <product_name> as the product to build, and <build_variant> as the variant to
+             build, and stores those selections in the environment to be read by subsequent
+             invocations of 'm' etc.
 - tapas:     tapas [<App1> <App2> ...] [arm|x86|mips|armv5|arm64|x86_64|mips64] [eng|userdebug|user]
 - croot:     Changes directory to the top of the tree.
 - m:         Makes from the top of the tree.
@@ -258,13 +264,11 @@
     export PATH=$ANDROID_BUILD_PATHS$PATH
     export PYTHONPATH=$T/development/python-packages:$PYTHONPATH
 
-    unset ANDROID_JAVA_TOOLCHAIN
-    unset ANDROID_PRE_BUILD_PATHS
-    if [ -n "$JAVA_HOME" ]; then
-        export ANDROID_JAVA_TOOLCHAIN=$JAVA_HOME/bin
-        export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
-        export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
-    fi
+    export ANDROID_JAVA_HOME=$(get_abs_build_var ANDROID_JAVA_HOME)
+    export JAVA_HOME=$ANDROID_JAVA_HOME
+    export ANDROID_JAVA_TOOLCHAIN=$(get_abs_build_var ANDROID_JAVA_TOOLCHAIN)
+    export ANDROID_PRE_BUILD_PATHS=$ANDROID_JAVA_TOOLCHAIN:
+    export PATH=$ANDROID_PRE_BUILD_PATHS$PATH
 
     unset ANDROID_PRODUCT_OUT
     export ANDROID_PRODUCT_OUT=$(get_abs_build_var PRODUCT_OUT)
@@ -297,7 +301,6 @@
 function set_stuff_for_environment()
 {
     settitle
-    set_java_home
     setpaths
     set_sequence_number
 
@@ -1540,46 +1543,6 @@
     \cd $T/$pathname
 }
 
-# Force JAVA_HOME to point to java 1.7/1.8 if it isn't already set.
-function set_java_home() {
-    # Clear the existing JAVA_HOME value if we set it ourselves, so that
-    # we can reset it later, depending on the version of java the build
-    # system needs.
-    #
-    # If we don't do this, the JAVA_HOME value set by the first call to
-    # build/envsetup.sh will persist forever.
-    if [ -n "$ANDROID_SET_JAVA_HOME" ]; then
-      export JAVA_HOME=""
-    fi
-
-    if [ ! "$JAVA_HOME" ]; then
-      if [ -n "$LEGACY_USE_JAVA7" ]; then
-        echo Warning: Support for JDK 7 will be dropped. Switch to JDK 8.
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.7)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64
-                ;;
-        esac
-      else
-        case `uname -s` in
-            Darwin)
-                export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
-                ;;
-            *)
-                export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
-                ;;
-        esac
-      fi
-
-      # Keep track of the fact that we set JAVA_HOME ourselves, so that
-      # we can change it on the next envsetup.sh, if required.
-      export ANDROID_SET_JAVA_HOME=true
-    fi
-}
-
 # Print colored exit condition
 function pez {
     "$@"
@@ -1597,6 +1560,13 @@
 {
     # If we're in the top of an Android tree, use soong_ui.bash instead of make
     if [ -f build/soong/soong_ui.bash ]; then
+        # Always use the real make if -C is passed in
+        for arg in "$@"; do
+            if [[ $arg == -C* ]]; then
+                echo command make
+                return
+            fi
+        done
         echo build/soong/soong_ui.bash --make-mode
     else
         echo command make
@@ -1643,7 +1613,7 @@
 
 function make()
 {
-    _wrap_build $(get_make_command) "$@"
+    _wrap_build $(get_make_command "$@") "$@"
 }
 
 function provision()
@@ -1675,6 +1645,14 @@
     "$ANDROID_PRODUCT_OUT/provision-device" "$@"
 }
 
+function atest()
+{
+    # TODO (sbasi): Replace this to be a destination in the build out when & if
+    # atest is built by the build system. (This will be necessary if it ever
+    # depends on external pip projects).
+    "$(gettop)"/tools/tradefederation/core/atest/atest.py "$@"
+}
+
 if [ "x$SHELL" != "x/bin/bash" ]; then
     case `ps -o command -p $$` in
         *bash*)
diff --git a/help.sh b/help.sh
new file mode 100755
index 0000000..c031dcc
--- /dev/null
+++ b/help.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# locate some directories
+cd "$(dirname $0)"
+SCRIPT_DIR="${PWD}"
+cd ../..
+TOP="${PWD}"
+
+message='The basic Android build process is:
+
+cd '"${TOP}"'
+source build/envsetup.sh    # Add "lunch" (and other utilities and variables)
+                            # to the shell environment.
+lunch [<product>-<variant>] # Choose the device to target.
+m -j [<goals>]              # Execute the configured build.
+
+Usage of "m" imitates usage of the program "make".
+See '"${SCRIPT_DIR}"'/README.txt for more info about build usage and concepts.
+
+Common goals are:
+
+    clean                   (aka clobber) equivalent to rm -rf out/
+    checkbuild              Build every module defined in the source tree
+    droid                   Default target
+    nothing                 Do not build anything, just parse and validate the build structure
+
+    java                    Build all the java code in the source tree
+    native                  Build all the native code in the source tree
+
+    host                    Build all the host code (not to be run on a device) in the source tree
+    target                  Build all the target code (to be run on the device) in the source tree
+
+    (java|native)-(host|target)
+    (host|target)-(java|native)
+                            Build the intersection of the two given arguments
+
+    snod                    Quickly rebuild the system image from built packages
+                            Stands for "System, NO Dependencies"
+    vnod                    Quickly rebuild the vendor image from built packages
+                            Stands for "Vendor, NO Dependencies"
+
+
+So, for example, you could run:
+
+cd '"${TOP}"'
+source build/envsetup.sh
+lunch aosp_arm-userdebug
+m -j java
+
+to build all of the java code for the userdebug variant of the aosp_arm device.
+'
+
+echo "$message"
diff --git a/target/Android.mk b/target/Android.mk
new file mode 100644
index 0000000..9929b00
--- /dev/null
+++ b/target/Android.mk
@@ -0,0 +1,23 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+# Only if this Android.mk was included not by a symlink should it be used.
+# This facilitates the transition away from symlinks: b/64397960
+ifeq ($(LOCAL_PATH),build/make/target)
+include $(call first-makefiles-under,$(LOCAL_PATH))
+endif
diff --git a/target/board/Android.mk b/target/board/Android.mk
index 5504c52..c5678d1 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -132,7 +132,7 @@
 
 # All kernel versions that the system image works with.
 KERNEL_VERSIONS := 3.18 4.4 4.9
-KERNEL_CONFIG_DATA := test/vts-testcase/kernel/config/data
+KERNEL_CONFIG_DATA := kernel/configs
 
 $(GEN): $(foreach version,$(KERNEL_VERSIONS),\
 	$(wildcard $(KERNEL_CONFIG_DATA)/android-$(version)/android-base*.cfg))
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index 46c8865..d6df2cf 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -35,11 +35,11 @@
 # platforms.
 #
 # If you're building a 64 bit platform (and not an application) the
-# ARM-v8 specification allows you to assume NEON and all the features
-# available in a cortex-A15 CPU. You should be able to set :
+# ARM-v8 specification allows you to assume all the features available in an
+# armv7-a-neon CPU. You should set the following as 2nd arch/cpu variant:
 #
-# TARGET_2ND_ARCH_VARIANT := armv7-a-neon
-# TARGET_2ND_CPU_VARIANT := cortex-a15
+# TARGET_2ND_ARCH_VARIANT := armv8-a
+# TARGET_2ND_CPU_VARIANT := generic
 #
 # DO NOT USE
 # DO NOT USE
@@ -50,8 +50,8 @@
 # DO NOT USE
 # DO NOT USE
 else
-TARGET_2ND_ARCH_VARIANT := armv7-a-neon
-TARGET_2ND_CPU_VARIANT := cortex-a15
+TARGET_2ND_ARCH_VARIANT := armv8-a
+TARGET_2ND_CPU_VARIANT := generic
 endif
 
 
diff --git a/target/board/generic_arm64_ab/BoardConfig.mk b/target/board/generic_arm64_ab/BoardConfig.mk
index 22b9f42..f41b39b 100644
--- a/target/board/generic_arm64_ab/BoardConfig.mk
+++ b/target/board/generic_arm64_ab/BoardConfig.mk
@@ -39,3 +39,5 @@
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
 BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
+
+BOARD_VNDK_VERSION := current
diff --git a/target/product/base.mk b/target/product/base.mk
index 9e38623..252929f 100644
--- a/target/product/base.mk
+++ b/target/product/base.mk
@@ -147,6 +147,7 @@
 
 # Packages included only for eng or userdebug builds, previously debug tagged
 PRODUCT_PACKAGES_DEBUG := \
+    logpersist.start \
     perfprofd \
     sqlite3
 
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 7efa686..0a56c99 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -86,20 +86,10 @@
     system_manifest.xml \
     system_compatibility_matrix.xml \
 
-# SELinux packages
+# SELinux packages are added as dependencies of the selinux_policy
+# phony package.
 PRODUCT_PACKAGES += \
-    nonplat_mac_permissions.xml \
-    nonplat_property_contexts \
-    nonplat_seapp_contexts \
-    nonplat_service_contexts \
-    nonplat_hwservice_contexts \
-    plat_mac_permissions.xml \
-    plat_property_contexts \
-    plat_seapp_contexts \
-    plat_service_contexts \
-    plat_hwservice_contexts \
     selinux_policy \
-    vndservice_contexts
 
 # AID Generation for
 # <pwd.h> and <grp.h>
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index ed68c78..aaa1c78 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -61,12 +61,14 @@
     dalvik.vm.image-dex2oat-Xmx=64m \
     dalvik.vm.dex2oat-Xms=64m \
     dalvik.vm.dex2oat-Xmx=512m \
-    ro.dalvik.vm.native.bridge=0 \
     dalvik.vm.usejit=true \
     dalvik.vm.usejitprofiles=true \
     dalvik.vm.dexopt.secondary=true \
     dalvik.vm.appimageformat=lz4
 
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.dalvik.vm.native.bridge=0
+
 # Different dexopt types for different package update/install times.
 # On eng builds, make "boot" reasons only extract for faster turnaround.
 ifeq (eng,$(TARGET_BUILD_VARIANT))
diff --git a/tools/Android.mk b/tools/Android.mk
index 9073ac3..c05d681 100644
--- a/tools/Android.mk
+++ b/tools/Android.mk
@@ -16,4 +16,8 @@
 
 LOCAL_PATH := $(call my-dir)
 
+# Only if this Android.mk was included not by a symlink should it be used.
+# This facilitates the transition away from symlinks: b/64397960
+ifeq ($(LOCAL_PATH),build/make/tools)
 include $(call all-makefiles-under,$(LOCAL_PATH))
+endif
diff --git a/tools/atree/Android.bp b/tools/atree/Android.bp
new file mode 100644
index 0000000..3c3a8ef
--- /dev/null
+++ b/tools/atree/Android.bp
@@ -0,0 +1,13 @@
+// Copyright 2007 The Android Open Source Project
+//
+// Copies files into the directory structure described by a manifest
+
+cc_binary_host {
+    name: "atree",
+    srcs: [
+        "atree.cpp",
+        "files.cpp",
+        "fs.cpp",
+    ],
+    static_libs: ["libhost"],
+}
diff --git a/tools/atree/Android.mk b/tools/atree/Android.mk
deleted file mode 100644
index f598db5..0000000
--- a/tools/atree/Android.mk
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright 2007 The Android Open Source Project
-#
-# Copies files into the directory structure described by a manifest
-
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := \
-	atree.cpp \
-	files.cpp \
-	fs.cpp
-
-LOCAL_STATIC_LIBRARIES := \
-	libhost
-
-LOCAL_MODULE := atree
-
-include $(BUILD_HOST_EXECUTABLE)
-
diff --git a/tools/checkowners.py b/tools/checkowners.py
index b874955..1190d30 100755
--- a/tools/checkowners.py
+++ b/tools/checkowners.py
@@ -34,8 +34,8 @@
                + urllib.quote(address))
     echo('Checking email address: ' + address)
     result = urllib2.urlopen(request).read()
-    expected = '"email": "' + address + '"'
-    checked_addresses[address] = (result.find(expected) >= 0)
+    checked_addresses[address] = (
+        result.find('"email":') >= 0 and result.find('"_account_id":') >= 0)
   return checked_addresses[address]
 
 
diff --git a/tools/fs_config/Android.bp b/tools/fs_config/Android.bp
new file mode 100644
index 0000000..797cfe2
--- /dev/null
+++ b/tools/fs_config/Android.bp
@@ -0,0 +1,63 @@
+// Copyright (C) 2008 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_binary_host {
+    name: "fs_config",
+    srcs: ["fs_config.c"],
+    shared_libs: [
+        "libcutils",
+        "libselinux",
+    ],
+    cflags: ["-Werror"],
+}
+
+// -----------------------------------------------------------------------------
+// Unit tests.
+// -----------------------------------------------------------------------------
+
+test_c_flags = [
+    "-fstack-protector-all",
+    "-g",
+    "-Wall",
+    "-Wextra",
+    "-Werror",
+    "-fno-builtin",
+    "-DANDROID_FILESYSTEM_CONFIG=\"android_filesystem_config_test_data.h\"",
+]
+
+//#################################
+// test executable
+cc_test_host {
+    name: "fs_config_generate_test",
+    srcs: ["fs_config_generate.c"],
+    shared_libs: ["libcutils"],
+    cflags: test_c_flags,
+    relative_install_path: "fs_config-unit-tests",
+    no_named_install_directory: true,
+    gtest: false,
+
+}
+
+//#################################
+// gTest tool
+cc_test_host {
+    name: "fs_config-unit-tests",
+    cflags: test_c_flags + ["-DHOST"],
+    shared_libs: [
+        "liblog",
+        "libcutils",
+        "libbase",
+    ],
+    srcs: ["fs_config_test.cpp"],
+}
diff --git a/tools/fs_config/Android.mk b/tools/fs_config/Android.mk
index ab7f92d..3773d38 100644
--- a/tools/fs_config/Android.mk
+++ b/tools/fs_config/Android.mk
@@ -14,15 +14,6 @@
 
 LOCAL_PATH := $(call my-dir)
 
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := fs_config.c
-LOCAL_MODULE := fs_config
-LOCAL_SHARED_LIBRARIES := libcutils libselinux
-LOCAL_CFLAGS := -Werror
-
-include $(BUILD_HOST_EXECUTABLE)
-
 # One can override the default android_filesystem_config.h file in one of two ways:
 #
 # 1. The old way:
@@ -306,36 +297,3 @@
 fs_config_generate_bin :=
 my_gen_oem_aid :=
 fs_config_generate_extra_partition_list :=
-
-# -----------------------------------------------------------------------------
-# Unit tests.
-# -----------------------------------------------------------------------------
-
-test_c_flags := \
-    -fstack-protector-all \
-    -g \
-    -Wall \
-    -Wextra \
-    -Werror \
-    -fno-builtin \
-    -DANDROID_FILESYSTEM_CONFIG='"android_filesystem_config_test_data.h"'
-
-##################################
-# test executable
-include $(CLEAR_VARS)
-LOCAL_MODULE := fs_config_generate_test
-LOCAL_SRC_FILES := fs_config_generate.c
-LOCAL_SHARED_LIBRARIES := libcutils
-LOCAL_CFLAGS := $(test_c_flags)
-LOCAL_MODULE_RELATIVE_PATH := fs_config-unit-tests
-LOCAL_GTEST := false
-include $(BUILD_HOST_NATIVE_TEST)
-
-##################################
-# gTest tool
-include $(CLEAR_VARS)
-LOCAL_MODULE := fs_config-unit-tests
-LOCAL_CFLAGS += $(test_c_flags) -DHOST
-LOCAL_SHARED_LIBRARIES := liblog libcutils libbase
-LOCAL_SRC_FILES := fs_config_test.cpp
-include $(BUILD_HOST_NATIVE_TEST)
diff --git a/tools/fs_get_stats/Android.bp b/tools/fs_get_stats/Android.bp
new file mode 100644
index 0000000..6684319
--- /dev/null
+++ b/tools/fs_get_stats/Android.bp
@@ -0,0 +1,8 @@
+cc_binary_host {
+    name: "fs_get_stats",
+    srcs: ["fs_get_stats.c"],
+    shared_libs: [
+        "libcutils",
+        "liblog",
+    ],
+}
diff --git a/tools/fs_get_stats/Android.mk b/tools/fs_get_stats/Android.mk
deleted file mode 100644
index 4501c1f..0000000
--- a/tools/fs_get_stats/Android.mk
+++ /dev/null
@@ -1,11 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := fs_get_stats.c
-
-LOCAL_MODULE := fs_get_stats
-
-LOCAL_SHARED_LIBRARIES := libcutils liblog
-
-include $(BUILD_HOST_EXECUTABLE)
diff --git a/tools/releasetools/add_img_to_target_files.py b/tools/releasetools/add_img_to_target_files.py
index 1ce22e7..52d3918 100755
--- a/tools/releasetools/add_img_to_target_files.py
+++ b/tools/releasetools/add_img_to_target_files.py
@@ -505,7 +505,13 @@
       print("target_files appears to already contain images.")
       sys.exit(1)
 
-  has_vendor = os.path.isdir(os.path.join(OPTIONS.input_tmp, "VENDOR"))
+  # vendor.img is unlike system.img or system_other.img. Because it could be
+  # built from source, or dropped into target_files.zip as a prebuilt blob. We
+  # consider either of them as vendor.img being available, which could be used
+  # when generating vbmeta.img for AVB.
+  has_vendor = (os.path.isdir(os.path.join(OPTIONS.input_tmp, "VENDOR")) or
+                os.path.exists(os.path.join(OPTIONS.input_tmp, "IMAGES",
+                                            "vendor.img")))
   has_system_other = os.path.isdir(os.path.join(OPTIONS.input_tmp,
                                                 "SYSTEM_OTHER"))
 
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 6de9763..d2c9f59 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -36,30 +36,36 @@
 FIXED_SALT = "aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7"
 BLOCK_SIZE = 4096
 
-def RunCommand(cmd):
+def RunCommand(cmd, verbose=None):
   """Echo and run the given command.
 
   Args:
     cmd: the command represented as a list of strings.
+    verbose: show commands being executed.
   Returns:
     A tuple of the output and the exit code.
   """
-  print "Running: ", " ".join(cmd)
+  if verbose is None:
+    verbose = OPTIONS.verbose
+  if verbose:
+    print("Running: " + " ".join(cmd))
   p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
   output, _ = p.communicate()
-  print "%s" % (output.rstrip(),)
+
+  if verbose:
+    print(output.rstrip())
   return (output, p.returncode)
 
 def GetVerityFECSize(partition_size):
   cmd = ["fec", "-s", str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
 
 def GetVerityTreeSize(partition_size):
   cmd = ["build_verity_tree", "-s", str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
@@ -67,7 +73,7 @@
 def GetVerityMetadataSize(partition_size):
   cmd = ["system/extras/verity/build_verity_metadata.py", "size",
          str(partition_size)]
-  output, exit_code = RunCommand(cmd)
+  output, exit_code = RunCommand(cmd, False)
   if exit_code != 0:
     return False, 0
   return True, int(output)
@@ -186,6 +192,8 @@
     else:
       hi = i
 
+  print("Adjusted partition size for verity, partition_size: {},"
+        " verity_size: {}".format(result, verity_size))
   AdjustPartitionSizeForVerity.results[key] = (result, verity_size)
   return (result, verity_size)
 
@@ -513,9 +521,9 @@
 
   try:
     if fs_type.startswith("ext4"):
-      (ext4fs_output, exit_code) = RunCommand(build_command)
+      (ext4fs_output, exit_code) = RunCommand(build_command, True)
     else:
-      (_, exit_code) = RunCommand(build_command)
+      (_, exit_code) = RunCommand(build_command, True)
   finally:
     if in_dir != origin_in:
       # Clean up temporary directories and files.
diff --git a/tools/releasetools/check_ota_package_signature.py b/tools/releasetools/check_ota_package_signature.py
index 548b619..1f8b7bb 100755
--- a/tools/releasetools/check_ota_package_signature.py
+++ b/tools/releasetools/check_ota_package_signature.py
@@ -25,12 +25,19 @@
 import re
 import subprocess
 import sys
+import tempfile
+import zipfile
 
 from hashlib import sha1
 from hashlib import sha256
 
+# 'update_payload' package is under 'system/update_engine/scripts/', which
+# should to be included in PYTHONPATH.
+from update_payload.payload import Payload
+from update_payload.update_metadata_pb2 import Signatures
 
-def cert_uses_sha256(cert):
+
+def CertUsesSha256(cert):
   """Check if the cert uses SHA-256 hashing algorithm."""
 
   cmd = ['openssl', 'x509', '-text', '-noout', '-in', cert]
@@ -46,7 +53,7 @@
   return algorithm.group(1).startswith('sha256')
 
 
-def verify_package(cert, package):
+def VerifyPackage(cert, package):
   """Verify the given package with the certificate.
 
   (Comments from bootable/recovery/verifier.cpp:)
@@ -90,7 +97,7 @@
   print('Signed data length: %d' % (signed_len,))
   print('Signature start: %d' % (signature_start,))
 
-  use_sha256 = cert_uses_sha256(cert)
+  use_sha256 = CertUsesSha256(cert)
   print('Use SHA-256: %s' % (use_sha256,))
 
   if use_sha256:
@@ -100,7 +107,7 @@
   h.update(package_bytes[:signed_len])
   package_digest = h.hexdigest().lower()
 
-  print('Digest: %s\n' % (package_digest,))
+  print('Digest: %s' % (package_digest,))
 
   # Get the signature from the input package.
   signature = package_bytes[signature_start:-6]
@@ -141,7 +148,87 @@
   assert package_digest == digest_string, "Verification failed."
 
   # Verified successfully upon reaching here.
-  print('VERIFIED\n')
+  print('\nWhole package signature VERIFIED\n')
+
+
+def VerifyAbOtaPayload(cert, package):
+  """Verifies the payload and metadata signatures in an A/B OTA payload."""
+
+  def VerifySignatureBlob(hash_file, blob):
+    """Verifies the input hash_file against the signature blob."""
+    signatures = Signatures()
+    signatures.ParseFromString(blob)
+
+    extracted_sig_file = common.MakeTempFile(
+        prefix='extracted-sig-', suffix='.bin')
+    # In Android, we only expect one signature.
+    assert len(signatures.signatures) == 1, \
+        'Invalid number of signatures: %d' % len(signatures.signatures)
+    signature = signatures.signatures[0]
+    length = len(signature.data)
+    assert length == 256, 'Invalid signature length %d' % (length,)
+    with open(extracted_sig_file, 'w') as f:
+      f.write(signature.data)
+
+    # Verify the signature file extracted from the payload, by reversing the
+    # signing operation. Alternatively, this can be done by calling 'openssl
+    # rsautl -verify -certin -inkey <cert.pem> -in <extracted_sig_file> -out
+    # <output>', then to assert that
+    # <output> == SHA-256 DigestInfo prefix || <hash_file>.
+    cmd = ['openssl', 'pkeyutl', '-verify', '-certin', '-inkey', cert,
+           '-pkeyopt', 'digest:sha256', '-in', hash_file,
+           '-sigfile', extracted_sig_file]
+    p = common.Run(cmd, stdout=subprocess.PIPE)
+    result, _ = p.communicate()
+
+    # https://github.com/openssl/openssl/pull/3213
+    # 'openssl pkeyutl -verify' (prior to 1.1.0) returns non-zero return code,
+    # even on successful verification. To avoid the false alarm with older
+    # openssl, check the output directly.
+    assert result.strip() == 'Signature Verified Successfully', result.strip()
+
+  package_zip = zipfile.ZipFile(package, 'r')
+  if 'payload.bin' not in package_zip.namelist():
+    common.ZipClose(package_zip)
+    return
+
+  print('Verifying A/B OTA payload signatures...')
+
+  package_dir = tempfile.mkdtemp(prefix='package-')
+  common.OPTIONS.tempfiles.append(package_dir)
+
+  payload_file = package_zip.extract('payload.bin', package_dir)
+  payload = Payload(open(payload_file, 'rb'))
+  payload.Init()
+
+  # Extract the payload hash and metadata hash from the payload.bin.
+  payload_hash_file = common.MakeTempFile(prefix='hash-', suffix='.bin')
+  metadata_hash_file = common.MakeTempFile(prefix='hash-', suffix='.bin')
+  cmd = ['brillo_update_payload', 'hash',
+         '--unsigned_payload', payload_file,
+         '--signature_size', '256',
+         '--metadata_hash_file', metadata_hash_file,
+         '--payload_hash_file', payload_hash_file]
+  p = common.Run(cmd, stdout=subprocess.PIPE)
+  p.communicate()
+  assert p.returncode == 0, 'brillo_update_payload hash failed'
+
+  # Payload signature verification.
+  assert payload.manifest.HasField('signatures_offset')
+  payload_signature = payload.ReadDataBlob(
+      payload.manifest.signatures_offset, payload.manifest.signatures_size)
+  VerifySignatureBlob(payload_hash_file, payload_signature)
+
+  # Metadata signature verification.
+  metadata_signature = payload.ReadDataBlob(
+      -payload.header.metadata_signature_len,
+      payload.header.metadata_signature_len)
+  VerifySignatureBlob(metadata_hash_file, metadata_signature)
+
+  common.ZipClose(package_zip)
+
+  # Verified successfully upon reaching here.
+  print('\nPayload signatures VERIFIED\n\n')
 
 
 def main():
@@ -150,7 +237,8 @@
   parser.add_argument('package', help='The OTA package to be verified.')
   args = parser.parse_args()
 
-  verify_package(args.certificate, args.package)
+  VerifyPackage(args.certificate, args.package)
+  VerifyAbOtaPayload(args.certificate, args.package)
 
 
 if __name__ == '__main__':
@@ -159,3 +247,5 @@
   except AssertionError as err:
     print('\n    ERROR: %s\n' % (err,))
     sys.exit(1)
+  finally:
+    common.Cleanup()
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 34c334e..ab99e6a 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -252,15 +252,16 @@
   else:
     d["fstab"] = None
 
-  d["build.prop"] = LoadBuildProp(read_helper)
+  d["build.prop"] = LoadBuildProp(read_helper, 'SYSTEM/build.prop')
+  d["vendor.build.prop"] = LoadBuildProp(read_helper, 'VENDOR/build.prop')
   return d
 
 
-def LoadBuildProp(read_helper):
+def LoadBuildProp(read_helper, prop_file):
   try:
-    data = read_helper("SYSTEM/build.prop")
+    data = read_helper(prop_file)
   except KeyError:
-    print("Warning: could not find SYSTEM/build.prop in %s" % (zip,))
+    print("Warning: could not read %s" % (prop_file,))
     data = ""
   return LoadDictionaryFromLines(data.split("\n"))
 
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 1b0f68b..a9e1606 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -275,6 +275,11 @@
     return False
 
 
+def HasTrebleEnabled(target_files_zip, info_dict):
+  return (HasVendorPartition(target_files_zip) and
+          GetBuildProp("ro.treble.enabled", info_dict) == "true")
+
+
 def GetOemProperty(name, oem_props, oem_dict, info_dict):
   if oem_props is not None and name in oem_props:
     return oem_dict[name]
@@ -316,57 +321,93 @@
   return sparse_img.SparseImage(path, mappath, clobbered_blocks)
 
 
-def AddCompatibilityArchive(target_zip, output_zip, system_included=True,
-                            vendor_included=True):
-  """Adds compatibility info from target files into the output zip.
+def AddCompatibilityArchiveIfTrebleEnabled(target_zip, output_zip,
+                                           target_info_dict,
+                                           source_info_dict=None):
+  """Adds compatibility info into the output zip if it's Treble-enabled target.
 
   Metadata used for on-device compatibility verification is retrieved from
   target_zip then added to compatibility.zip which is added to the output_zip
   archive.
 
-  Compatibility archive should only be included for devices with a vendor
-  partition as checking provides value when system and vendor are independently
-  versioned.
+  Compatibility archive should only be included for devices that have enabled
+  Treble support.
 
   Args:
     target_zip: Zip file containing the source files to be included for OTA.
     output_zip: Zip file that will be sent for OTA.
-    system_included: If True, the system image will be updated and therefore
-        its metadata should be included.
-    vendor_included: If True, the vendor image will be updated and therefore
-        its metadata should be included.
+    target_info_dict: The dict that holds the target build info.
+    source_info_dict: The dict that holds the source build info, if generating
+        an incremental OTA; None otherwise.
   """
 
-  # Determine what metadata we need. Files are names relative to META/.
-  compatibility_files = []
-  vendor_metadata = ("vendor_manifest.xml", "vendor_matrix.xml")
-  system_metadata = ("system_manifest.xml", "system_matrix.xml")
-  if vendor_included:
-    compatibility_files += vendor_metadata
-  if system_included:
-    compatibility_files += system_metadata
+  def AddCompatibilityArchive(system_updated, vendor_updated):
+    """Adds compatibility info based on system/vendor update status.
 
-  # Create new archive.
-  compatibility_archive = tempfile.NamedTemporaryFile()
-  compatibility_archive_zip = zipfile.ZipFile(compatibility_archive, "w",
-      compression=zipfile.ZIP_DEFLATED)
+    Args:
+      system_updated: If True, the system image will be updated and therefore
+          its metadata should be included.
+      vendor_updated: If True, the vendor image will be updated and therefore
+          its metadata should be included.
+    """
+    # Determine what metadata we need. Files are names relative to META/.
+    compatibility_files = []
+    vendor_metadata = ("vendor_manifest.xml", "vendor_matrix.xml")
+    system_metadata = ("system_manifest.xml", "system_matrix.xml")
+    if vendor_updated:
+      compatibility_files += vendor_metadata
+    if system_updated:
+      compatibility_files += system_metadata
 
-  # Add metadata.
-  for file_name in compatibility_files:
-    target_file_name = "META/" + file_name
+    # Create new archive.
+    compatibility_archive = tempfile.NamedTemporaryFile()
+    compatibility_archive_zip = zipfile.ZipFile(compatibility_archive, "w",
+        compression=zipfile.ZIP_DEFLATED)
 
-    if target_file_name in target_zip.namelist():
-      data = target_zip.read(target_file_name)
-      common.ZipWriteStr(compatibility_archive_zip, file_name, data)
+    # Add metadata.
+    for file_name in compatibility_files:
+      target_file_name = "META/" + file_name
 
-  # Ensure files are written before we copy into output_zip.
-  compatibility_archive_zip.close()
+      if target_file_name in target_zip.namelist():
+        data = target_zip.read(target_file_name)
+        common.ZipWriteStr(compatibility_archive_zip, file_name, data)
 
-  # Only add the archive if we have any compatibility info.
-  if compatibility_archive_zip.namelist():
-    common.ZipWrite(output_zip, compatibility_archive.name,
-                    arcname="compatibility.zip",
-                    compress_type=zipfile.ZIP_STORED)
+    # Ensure files are written before we copy into output_zip.
+    compatibility_archive_zip.close()
+
+    # Only add the archive if we have any compatibility info.
+    if compatibility_archive_zip.namelist():
+      common.ZipWrite(output_zip, compatibility_archive.name,
+                      arcname="compatibility.zip",
+                      compress_type=zipfile.ZIP_STORED)
+
+  # Will only proceed if the target has enabled the Treble support (as well as
+  # having a /vendor partition).
+  if not HasTrebleEnabled(target_zip, target_info_dict):
+    return
+
+  # We don't support OEM thumbprint in Treble world (which calculates
+  # fingerprints in a different way as shown in CalculateFingerprint()).
+  assert not target_info_dict.get("oem_fingerprint_properties")
+
+  # Full OTA carries the info for system/vendor both.
+  if source_info_dict is None:
+    AddCompatibilityArchive(True, True)
+    return
+
+  assert not source_info_dict.get("oem_fingerprint_properties")
+
+  source_fp = GetBuildProp("ro.build.fingerprint", source_info_dict)
+  target_fp = GetBuildProp("ro.build.fingerprint", target_info_dict)
+  system_updated = source_fp != target_fp
+
+  source_fp_vendor = GetVendorBuildProp("ro.vendor.build.fingerprint",
+                                        source_info_dict)
+  target_fp_vendor = GetVendorBuildProp("ro.vendor.build.fingerprint",
+                                        target_info_dict)
+  vendor_updated = source_fp_vendor != target_fp_vendor
+
+  AddCompatibilityArchive(system_updated, vendor_updated)
 
 
 def WriteFullOTAPackage(input_zip, output_zip):
@@ -470,11 +511,6 @@
   if HasVendorPartition(input_zip):
     system_progress -= 0.1
 
-  # Place a copy of file_contexts.bin into the OTA package which will be used
-  # by the recovery program.
-  if "selinux_fc" in OPTIONS.info_dict:
-    WritePolicyConfig(OPTIONS.info_dict["selinux_fc"], output_zip)
-
   recovery_mount_options = OPTIONS.info_dict.get("recovery_mount_options")
 
   script.ShowProgress(system_progress, 0)
@@ -499,6 +535,9 @@
     vendor_diff = common.BlockDifference("vendor", vendor_tgt)
     vendor_diff.WriteScript(script, output_zip)
 
+  AddCompatibilityArchiveIfTrebleEnabled(input_zip, output_zip,
+                                         OPTIONS.info_dict)
+
   common.CheckSize(boot_img.data, "boot.img", OPTIONS.info_dict)
   common.ZipWriteStr(output_zip, "boot.img", boot_img.data)
 
@@ -540,10 +579,6 @@
   WriteMetadata(metadata, output_zip)
 
 
-def WritePolicyConfig(file_name, output_zip):
-  common.ZipWrite(output_zip, file_name, os.path.basename(file_name))
-
-
 def WriteMetadata(metadata, output_zip):
   value = "".join(["%s=%s\n" % kv for kv in sorted(metadata.iteritems())])
   common.ZipWriteStr(output_zip, METADATA_NAME, value,
@@ -551,13 +586,22 @@
 
 
 def GetBuildProp(prop, info_dict):
-  """Return the fingerprint of the build of a given target-files info_dict."""
+  """Returns the inquired build property from a given info_dict."""
   try:
     return info_dict.get("build.prop", {})[prop]
   except KeyError:
     raise common.ExternalError("couldn't find %s in build.prop" % (prop,))
 
 
+def GetVendorBuildProp(prop, info_dict):
+  """Returns the inquired vendor build property from a given info_dict."""
+  try:
+    return info_dict.get("vendor.build.prop", {})[prop]
+  except KeyError:
+    raise common.ExternalError(
+        "couldn't find %s in vendor.build.prop" % (prop,))
+
+
 def HandleDowngradeMetadata(metadata):
   # Only incremental OTAs are allowed to reach here.
   assert OPTIONS.incremental_source is not None
@@ -688,6 +732,10 @@
   else:
     vendor_diff = None
 
+  AddCompatibilityArchiveIfTrebleEnabled(
+      target_zip, output_zip, OPTIONS.target_info_dict,
+      OPTIONS.source_info_dict)
+
   AppendAssertions(script, OPTIONS.target_info_dict, oem_dicts)
   device_specific.IncrementalOTA_Assertions()
 
@@ -1178,32 +1226,13 @@
     else:
       print("Warning: cannot find care map file in target_file package")
 
-  if HasVendorPartition(target_zip):
-    update_vendor = True
-    update_system = True
+  # OPTIONS.source_info_dict must be None for incrementals.
+  if source_file is None:
+    assert OPTIONS.source_info_dict is None
 
-    # If incremental then figure out what is being updated so metadata only for
-    # the updated image is included.
-    if source_file is not None:
-      input_tmp, input_zip = common.UnzipTemp(
-          target_file, UNZIP_PATTERN)
-      source_tmp, source_zip = common.UnzipTemp(
-          source_file, UNZIP_PATTERN)
+  AddCompatibilityArchiveIfTrebleEnabled(
+      target_zip, output_zip, OPTIONS.info_dict, OPTIONS.source_info_dict)
 
-      vendor_src = GetImage("vendor", source_tmp)
-      vendor_tgt = GetImage("vendor", input_tmp)
-      system_src = GetImage("system", source_tmp)
-      system_tgt = GetImage("system", input_tmp)
-
-      update_system = system_src.TotalSha1() != system_tgt.TotalSha1()
-      update_vendor = vendor_src.TotalSha1() != vendor_tgt.TotalSha1()
-
-      input_zip.close()
-      source_zip.close()
-
-    target_zip = zipfile.ZipFile(target_file, "r")
-    AddCompatibilityArchive(target_zip, output_zip, update_system,
-                            update_vendor)
   common.ZipClose(target_zip)
 
   # Write the current metadata entry with placeholders.
diff --git a/tools/zipalign/Android.bp b/tools/zipalign/Android.bp
new file mode 100644
index 0000000..cfc6aec
--- /dev/null
+++ b/tools/zipalign/Android.bp
@@ -0,0 +1,31 @@
+//
+// Copyright 2008 The Android Open Source Project
+//
+// Zip alignment tool
+//
+
+cc_binary_host {
+    name: "zipalign",
+
+    srcs: [
+        "ZipAlign.cpp",
+        "ZipEntry.cpp",
+        "ZipFile.cpp",
+    ],
+
+    static_libs: [
+        "libandroidfw",
+        "libutils",
+        "libcutils",
+        "liblog",
+        "libzopfli",
+        "libz",
+    ],
+
+    target: {
+        windows: {
+            host_ldlibs: ["-lpthread"],
+            enabled: true,
+        },
+    },
+}
diff --git a/tools/zipalign/Android.mk b/tools/zipalign/Android.mk
deleted file mode 100644
index 8c0240a..0000000
--- a/tools/zipalign/Android.mk
+++ /dev/null
@@ -1,38 +0,0 @@
-# 
-# Copyright 2008 The Android Open Source Project
-#
-# Zip alignment tool
-#
-
-LOCAL_PATH:= $(call my-dir)
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := \
-	ZipAlign.cpp \
-	ZipEntry.cpp \
-	ZipFile.cpp
-
-LOCAL_C_INCLUDES += external/zlib \
-	external/zopfli/src
-
-LOCAL_STATIC_LIBRARIES := \
-	libandroidfw \
-	libutils \
-	libcutils \
-	liblog \
-	libzopfli
-
-LOCAL_LDLIBS_linux += -lrt
-
-LOCAL_STATIC_LIBRARIES_windows += libz
-LOCAL_LDLIBS_linux += -lz
-LOCAL_LDLIBS_darwin += -lz
-
-ifneq ($(strip $(BUILD_HOST_static)),)
-LOCAL_LDLIBS += -lpthread
-endif # BUILD_HOST_static
-
-LOCAL_MODULE := zipalign
-LOCAL_MODULE_HOST_OS := darwin linux windows
-
-include $(BUILD_HOST_EXECUTABLE)