Merge "Always start jack server before first call to jack"
diff --git a/core/Makefile b/core/Makefile
index c930708..19b70a8 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -122,7 +122,7 @@
   ifneq ($(filter eng.%,$(BUILD_NUMBER)),)
     # Trim down BUILD_FINGERPRINT: the default BUILD_NUMBER makes it easily exceed
     # the Android system property length limit (PROPERTY_VALUE_MAX=92).
-    BF_BUILD_NUMBER := $(USER)$(shell $(DATE) +%m%d%H%M)
+    BF_BUILD_NUMBER := $(shell echo $${USER:0:6})$(shell $(DATE) +%m%d%H%M)
   else
     BF_BUILD_NUMBER := $(BUILD_NUMBER)
   endif
@@ -517,6 +517,15 @@
 
 INSTALLED_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot.img
 
+# BOARD_USES_RECOVERY_AS_BOOT = true must have BOARD_BUILD_SYSTEM_ROOT_IMAGE = true.
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+ifneq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
+  $(error BOARD_BUILD_SYSTEM_ROOT_IMAGE must be enabled for BOARD_USES_RECOVERY_AS_BOOT.)
+endif
+endif
+
+# We build recovery as boot image if BOARD_USES_RECOVERY_AS_BOOT is true.
+ifneq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
 ifeq ($(TARGET_BOOTIMAGE_USE_EXT2),true)
 $(error TARGET_BOOTIMAGE_USE_EXT2 is not supported anymore)
 else ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER)) # TARGET_BOOTIMAGE_USE_EXT2 != true
@@ -563,6 +572,7 @@
 	$(hide) $(call assert-max-image-size,$(INSTALLED_BOOTIMAGE_TARGET),$(BOARD_BOOTIMAGE_PARTITION_SIZE))
 
 endif # TARGET_BOOTIMAGE_USE_EXT2
+endif # BOARD_USES_RECOVERY_AS_BOOT
 
 else	# TARGET_NO_KERNEL
 # HACK: The top-level targets depend on the bootimage.  Not all targets
@@ -728,6 +738,9 @@
 endif
 endif
 
+ifneq (true,$(TARGET_USERIMAGES_SPARSE_SQUASHFS_DISABLED))
+  INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG := -s
+endif
 ifeq ($(BOARD_SYSTEMIMAGE_FILE_SYSTEM_TYPE),squashfs)
 INTERNAL_USERIMAGES_DEPS += $(MAKE_SQUASHFS) $(MKSQUASHFSUSERIMG) $(IMG2SIMG)
 endif
@@ -764,6 +777,7 @@
 $(if $(BOARD_OEMIMAGE_PARTITION_SIZE),$(hide) echo "oem_size=$(BOARD_OEMIMAGE_PARTITION_SIZE)" >> $(1))
 $(if $(BOARD_OEMIMAGE_JOURNAL_SIZE),$(hide) echo "oem_journal_size=$(BOARD_OEMIMAGE_JOURNAL_SIZE)" >> $(1))
 $(if $(INTERNAL_USERIMAGES_SPARSE_EXT_FLAG),$(hide) echo "extfs_sparse_flag=$(INTERNAL_USERIMAGES_SPARSE_EXT_FLAG)" >> $(1))
+$(if $(INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG),$(hide) echo "squashfs_sparse_flag=$(INTERNAL_USERIMAGES_SPARSE_SQUASHFS_FLAG)" >> $(1))
 $(hide) echo "selinux_fc=$(SELINUX_FC)" >> $(1)
 $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER),$(hide) echo "boot_signer=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER)" >> $(1))
 $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY)" >> $(1))
@@ -777,6 +791,8 @@
 $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_subkey=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_SUBKEY)" >> $(1))
 $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "futility=$(FUTILITY)" >> $(1))
 $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_signer_cmd=$(VBOOT_SIGNER)" >> $(1))
+$(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)),\
+    $(hide) echo "recovery_as_boot=true" >> $(1))
 $(if $(filter true,$(BOARD_BUILD_SYSTEM_ROOT_IMAGE)),\
     $(hide) echo "system_root_image=true" >> $(1);\
     echo "ramdisk_dir=$(TARGET_ROOT_OUT)" >> $(1))
@@ -786,7 +802,8 @@
 # -----------------------------------------------------------------
 # Recovery image
 
-ifdef INSTALLED_RECOVERYIMAGE_TARGET
+# Recovery image exists if we are building recovery, or building recovery as boot.
+ifneq (,$(INSTALLED_RECOVERYIMAGE_TARGET)$(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)))
 
 INTERNAL_RECOVERYIMAGE_FILES := $(filter $(TARGET_RECOVERY_OUT)/%, \
     $(ALL_DEFAULT_INSTALLED_MODULES))
@@ -836,12 +853,22 @@
 recovery_fstab := $(strip $(wildcard $(TARGET_DEVICE_DIR)/recovery.fstab))
 endif
 
-ifneq ($(BOARD_USES_FULL_RECOVERY_IMAGE),true)
+# Prior to A/B update, we used to have:
+#   boot.img + recovery-from-boot.p + recovery-resource.dat = recovery.img.
+# recovery-resource.dat is needed only if we carry a patch of the boot and
+# recovery images and invoke install-recovery.sh on the first boot post an
+# OTA update.
+#
+# We no longer need that if one of the following conditions holds:
+#   a) We carry a full copy of the recovery image
+#      (BOARD_USES_FULL_RECOVERY_IMAGE = true);
+#   b) We build a single image that contains boot and recovery both
+#      (BOARD_USES_RECOVERY_AS_BOOT = true).
+
+ifeq (,$(filter true, $(BOARD_USES_FULL_RECOVERY_IMAGE) $(BOARD_USES_RECOVERY_AS_BOOT)))
 # Named '.dat' so we don't attempt to use imgdiff for patching it.
 RECOVERY_RESOURCE_ZIP := $(TARGET_OUT)/etc/recovery-resource.dat
 else
-# We carry a full copy of the recovery image. recovery-resource.dat is no
-# longer needed.
 RECOVERY_RESOURCE_ZIP :=
 endif
 
@@ -925,10 +952,25 @@
     $(BOOT_SIGNER) /recovery $(1) $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).x509.pem $(1))
   $(if $(filter true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT)), \
     $(VBOOT_SIGNER) $(FUTILITY) $(1).unsigned $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $(1).keyblock $(1))
-  $(hide) $(call assert-max-image-size,$(1),$(BOARD_RECOVERYIMAGE_PARTITION_SIZE))
+  $(if $(filter true,BOARD_USES_RECOVERY_AS_BOOT), \
+    $(hide) $(call assert-max-image-size,$(1),$(BOARD_BOOTIMAGE_PARTITION_SIZE)), \
+    $(hide) $(call assert-max-image-size,$(1),$(BOARD_RECOVERYIMAGE_PARTITION_SIZE)))
   @echo ----- Made recovery image: $(1) --------
 endef
 
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+$(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
+		$(INSTALLED_RAMDISK_TARGET) \
+		$(INTERNAL_RECOVERYIMAGE_FILES) \
+		$(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
+		$(INSTALLED_2NDBOOTLOADER_TARGET) \
+		$(recovery_build_prop) $(recovery_resource_deps) \
+		$(recovery_fstab) \
+		$(RECOVERY_INSTALL_OTA_KEYS)
+		$(call pretty,"Target boot image from recovery: $@")
+		$(call build-recoveryimage-target, $@)
+endif
+
 $(INSTALLED_RECOVERYIMAGE_TARGET): $(MKBOOTFS) $(MKBOOTIMG) $(MINIGZIP) \
 		$(INSTALLED_RAMDISK_TARGET) \
 		$(INSTALLED_BOOTIMAGE_TARGET) \
@@ -940,7 +982,7 @@
 		$(RECOVERY_INSTALL_OTA_KEYS)
 		$(call build-recoveryimage-target, $@)
 
-ifneq ($(BOARD_USES_FULL_RECOVERY_IMAGE),true)
+ifeq (,$(filter true, $(BOARD_USES_FULL_RECOVERY_IMAGE) $(BOARD_USES_RECOVERY_AS_BOOT)))
 $(RECOVERY_RESOURCE_ZIP): $(INSTALLED_RECOVERYIMAGE_TARGET) | $(ZIPTIME)
 	$(hide) mkdir -p $(dir $@)
 	$(hide) find $(TARGET_RECOVERY_ROOT_OUT)/res -type f | sort | zip -0qrjX $@ -@
@@ -1393,13 +1435,14 @@
   $(HOST_LIBRARY_PATH)/libcrypto-host$(HOST_SHLIB_SUFFIX) \
   $(HOST_LIBRARY_PATH)/libdivsufsort$(HOST_SHLIB_SUFFIX) \
   $(HOST_LIBRARY_PATH)/libdivsufsort64$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2fs_host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_blkid_host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_com_err_host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_e2p_host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_profile_host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_quota_host$(HOST_SHLIB_SUFFIX) \
-  $(HOST_LIBRARY_PATH)/libext2_uuid_host$(HOST_SHLIB_SUFFIX)
+  $(HOST_LIBRARY_PATH)/libext2fs-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libext2_blkid-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libext2_com_err-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libext2_e2p-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libext2_profile-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libext2_quota-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libext2_uuid-host$(HOST_SHLIB_SUFFIX) \
+  $(HOST_LIBRARY_PATH)/libconscrypt_openjdk_jni$(HOST_SHLIB_SUFFIX)
 
 .PHONY: otatools
 otatools: $(OTATOOLS)
@@ -1452,14 +1495,11 @@
   fi
 endef
 
-built_ota_tools := \
-    $(call intermediates-dir-for,EXECUTABLES,applypatch,,,$(TARGET_PREFER_32_BIT))/applypatch \
-    $(call intermediates-dir-for,EXECUTABLES,sqlite3,,,$(TARGET_PREFER_32_BIT))/sqlite3
+built_ota_tools :=
 
 # We can't build static executables when SANITIZE_TARGET=address
 ifeq ($(strip $(SANITIZE_TARGET)),)
 built_ota_tools += \
-    $(call intermediates-dir-for,EXECUTABLES,applypatch_static,,,$(TARGET_PREFER_32_BIT))/applypatch_static \
     $(call intermediates-dir-for,EXECUTABLES,updater,,,$(TARGET_PREFER_32_BIT))/updater
 endif
 
@@ -1480,6 +1520,13 @@
 $(BUILT_TARGET_FILES_PACKAGE): $(built_ota_tools)
 endif
 
+# If we are using recovery as boot, output recovery files to BOOT/.
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
+$(BUILT_TARGET_FILES_PACKAGE): PRIVATE_RECOVERY_OUT := BOOT
+else
+$(BUILT_TARGET_FILES_PACKAGE): PRIVATE_RECOVERY_OUT := RECOVERY
+endif
+
 # Depending on the various images guarantees that the underlying
 # directories are up-to-date.
 $(BUILT_TARGET_FILES_PACKAGE): \
@@ -1498,28 +1545,28 @@
 	@echo "Package target files: $@"
 	$(hide) rm -rf $@ $(zip_root)
 	$(hide) mkdir -p $(dir $@) $(zip_root)
-ifneq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
+ifneq (,$(INSTALLED_RECOVERYIMAGE_TARGET)$(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)))
 	@# Components of the recovery image
-	$(hide) mkdir -p $(zip_root)/RECOVERY
+	$(hide) mkdir -p $(zip_root)/$(PRIVATE_RECOVERY_OUT)
 	$(hide) $(call package_files-copy-root, \
-		$(TARGET_RECOVERY_ROOT_OUT),$(zip_root)/RECOVERY/RAMDISK)
+		$(TARGET_RECOVERY_ROOT_OUT),$(zip_root)/$(PRIVATE_RECOVERY_OUT)/RAMDISK)
 ifdef INSTALLED_KERNEL_TARGET
-	$(hide) $(ACP) $(INSTALLED_KERNEL_TARGET) $(zip_root)/RECOVERY/kernel
+	$(hide) $(ACP) $(INSTALLED_KERNEL_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/kernel
 endif
 ifdef INSTALLED_2NDBOOTLOADER_TARGET
 	$(hide) $(ACP) \
-		$(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/RECOVERY/second
+		$(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/second
 endif
 ifdef BOARD_KERNEL_CMDLINE
-	$(hide) echo "$(BOARD_KERNEL_CMDLINE)" > $(zip_root)/RECOVERY/cmdline
+	$(hide) echo "$(BOARD_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
 endif
 ifdef BOARD_KERNEL_BASE
-	$(hide) echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/RECOVERY/base
+	$(hide) echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/base
 endif
 ifdef BOARD_KERNEL_PAGESIZE
-	$(hide) echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/RECOVERY/pagesize
+	$(hide) echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/pagesize
 endif
-endif
+endif # INSTALLED_RECOVERYIMAGE_TARGET defined or BOARD_USES_RECOVERY_AS_BOOT is true
 	@# Components of the boot image
 	$(hide) mkdir -p $(zip_root)/BOOT
 ifeq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
@@ -1530,6 +1577,8 @@
 	$(hide) $(call package_files-copy-root, \
 		$(TARGET_ROOT_OUT),$(zip_root)/BOOT/RAMDISK)
 endif
+	@# If we are using recovery as boot, this is already done when processing recovery.
+ifneq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
 ifdef INSTALLED_KERNEL_TARGET
 	$(hide) $(ACP) $(INSTALLED_KERNEL_TARGET) $(zip_root)/BOOT/kernel
 endif
@@ -1546,6 +1595,7 @@
 ifdef BOARD_KERNEL_PAGESIZE
 	$(hide) echo "$(BOARD_KERNEL_PAGESIZE)" > $(zip_root)/BOOT/pagesize
 endif
+endif # BOARD_USES_RECOVERY_AS_BOOT
 	$(hide) $(foreach t,$(INSTALLED_RADIOIMAGE_TARGET),\
 	            mkdir -p $(zip_root)/RADIO; \
 	            $(ACP) $(t) $(zip_root)/RADIO/$(notdir $(t));)
@@ -1564,9 +1614,11 @@
 	$(hide) mkdir -p $(zip_root)/OTA
 	$(hide) $(ACP) $(INSTALLED_ANDROID_INFO_TXT_TARGET) $(zip_root)/OTA/
 ifneq ($(AB_OTA_UPDATER),true)
+ifneq ($(built_ota_tools),)
 	$(hide) mkdir -p $(zip_root)/OTA/bin
 	$(hide) $(ACP) $(PRIVATE_OTA_TOOLS) $(zip_root)/OTA/bin/
 endif
+endif
 	@# Files that do not end up in any images, but are necessary to
 	@# build them.
 	$(hide) mkdir -p $(zip_root)/META
@@ -1582,6 +1634,9 @@
 ifdef BOARD_BOOTIMAGE_PARTITION_SIZE
 	$(hide) echo "boot_size=$(BOARD_BOOTIMAGE_PARTITION_SIZE)" >> $(zip_root)/META/misc_info.txt
 endif
+ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),)
+	$(hide) echo "recovery_as_boot=$(BOARD_USES_RECOVERY_AS_BOOT)" >> $(zip_root)/META/misc_info.txt
+endif
 ifeq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
 	$(hide) echo "no_recovery=true" >> $(zip_root)/META/misc_info.txt
 endif
@@ -1634,6 +1689,7 @@
 	done
 	@# Include the build type in META/misc_info.txt so the server can easily differentiate production builds.
 	$(hide) echo "build_type=$(TARGET_BUILD_VARIANT)" >> $(zip_root)/META/misc_info.txt
+	$(hide) echo "ab_update=true" >> $(zip_root)/META/misc_info.txt
 ifdef OSRELEASED_DIRECTORY
 	$(hide) $(ACP) $(TARGET_OUT_ETC)/$(OSRELEASED_DIRECTORY)/product_id $(zip_root)/META/product_id.txt
 	$(hide) $(ACP) $(TARGET_OUT_ETC)/$(OSRELEASED_DIRECTORY)/product_version $(zip_root)/META/product_version.txt
@@ -1651,9 +1707,8 @@
 	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="VENDOR/" } /^VENDOR\// {print "vendor/" $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) > $(zip_root)/META/vendor_filesystem_config.txt
 ifeq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
 	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="ROOT/" } /^ROOT\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) > $(zip_root)/META/root_filesystem_config.txt
-else
-	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="BOOT/RAMDISK/" } /^BOOT\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) > $(zip_root)/META/boot_filesystem_config.txt
 endif
+	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="BOOT/RAMDISK/" } /^BOOT\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) > $(zip_root)/META/boot_filesystem_config.txt
 ifneq ($(INSTALLED_RECOVERYIMAGE_TARGET),)
 	$(hide) zipinfo -1 $@ | awk 'BEGIN { FS="RECOVERY/RAMDISK/" } /^RECOVERY\/RAMDISK\// {print $$2}' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) > $(zip_root)/META/recovery_filesystem_config.txt
 endif
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 42dfc1b..7e33660 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -223,29 +223,23 @@
 ###########################################################
 ## Create .toc files from shared objects to reduce unnecessary rebuild
 # .toc files have the list of external dynamic symbols without their addresses.
-# For ninja build, .toc files will be updated only when the content of .toc
-# files are changed. As .KATI_RESTAT is specified to .toc files, dependent
-# binaries of a .toc file will be rebuilt only when the content of
+# As .KATI_RESTAT is specified to .toc files and commit-change-for-toc is used,
+# dependent binaries of a .toc file will be rebuilt only when the content of
 # the .toc file is changed.
 ###########################################################
+ifndef LOCAL_IS_HOST_MODULE
+# Disable .toc optimization for host modules: we may run the host binaries during the build process
+# and the libraries' implementation matters.
 ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
 LOCAL_INTERMEDIATE_TARGETS += $(LOCAL_BUILT_MODULE).toc
 $(LOCAL_BUILT_MODULE).toc: $(LOCAL_BUILT_MODULE)
-ifeq ($(BUILDING_WITH_NINJA),true)
 	$(call $(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)transform-shared-lib-to-toc,$<,$@.tmp)
-	$(hide) if cmp -s $@.tmp $@ ; then \
-		  rm $@.tmp ; \
-		else \
-		  mv $@.tmp $@ ; \
-		fi
-else
-	@# make doesn't support restat. We always update .toc files so the dependents will always be updated too.
-	$(call $(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)transform-shared-lib-to-toc,$<,$@)
-endif
+	$(call commit-change-for-toc,$@)
 
 # Kati adds restat=1 to ninja. GNU make does nothing for this.
 .KATI_RESTAT: $(LOCAL_BUILT_MODULE).toc
 endif
+endif
 
 ###########################################################
 ## logtags: Add .logtags files to global list
diff --git a/core/binary.mk b/core/binary.mk
index d3b536d..4cb62b3 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -75,7 +75,15 @@
   my_ndk_source_root := $(HISTORICAL_NDK_VERSIONS_ROOT)/current/sources
   my_ndk_sysroot := $(HISTORICAL_NDK_VERSIONS_ROOT)/current/platforms/android-$(LOCAL_SDK_VERSION)/arch-$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)
   my_ndk_sysroot_include := $(my_ndk_sysroot)/usr/include
-  ifeq (x86_64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
+
+  # x86_64 and and mips64 are both multilib toolchains, so their libraries are
+  # installed in /usr/lib64. Aarch64, on the other hand, is not a multilib
+  # compiler, so its libraries are in /usr/lib.
+  #
+  # Mips32r6 is yet another variation, with libraries installed in libr6.
+  #
+  # For the rest, the libraries are installed simply to /usr/lib.
+  ifneq (,$(filter x86_64 mips64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)))
     my_ndk_sysroot_lib := $(my_ndk_sysroot)/usr/lib64
   else ifeq (mips32r6,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH_VARIANT))
     my_ndk_sysroot_lib := $(my_ndk_sysroot)/usr/libr6
@@ -85,11 +93,16 @@
 
   # The bionic linker now has support for packed relocations and gnu style
   # hashes (which are much faster!), but shipping to older devices requires
-  # the old style hash and disabling packed relocations.
-  #ifeq ($(shell expr $(LOCAL_SDK_VERSION) >= FIRST_SUPPORTED_VERSION),0)
-    my_ldflags += -Wl,--hash-style=sysv
-    LOCAL_PACK_MODULE_RELOCATIONS := false
-  #endif
+  # the old style hash. Fortunately, we can build with both and it'll work
+  # anywhere.
+  #
+  # This is not currently supported on MIPS architectures.
+  ifeq (,$(filter mips mips64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)))
+    my_ldflags += -Wl,--hash-style=both
+  endif
+
+  # We don't want to expose the relocation packer to the NDK just yet.
+  LOCAL_PACK_MODULE_RELOCATIONS := false
 
   # Set up the NDK stl variant. Starting from NDK-r5 the c++ stl resides in a separate location.
   # See ndk/docs/CPLUSPLUS-SUPPORT.html
@@ -106,15 +119,16 @@
   ifeq (,$(LOCAL_NDK_STL_VARIANT))
     LOCAL_NDK_STL_VARIANT := system
   endif
-  ifneq (1,$(words $(filter system stlport_static stlport_shared c++_static c++_shared gnustl_static, $(LOCAL_NDK_STL_VARIANT))))
+  ifneq (1,$(words $(filter none system stlport_static stlport_shared c++_static c++_shared gnustl_static, $(LOCAL_NDK_STL_VARIANT))))
     $(error $(LOCAL_PATH): Unknown LOCAL_NDK_STL_VARIANT $(LOCAL_NDK_STL_VARIANT))
   endif
   ifeq (system,$(LOCAL_NDK_STL_VARIANT))
     my_ndk_stl_include_path := $(my_ndk_source_root)/cxx-stl/system/include
-    # for "system" variant, the shared library exists in the system library and -lstdc++ is added by default.
+    my_system_shared_libraries += libstdc++
   else # LOCAL_NDK_STL_VARIANT is not system
   ifneq (,$(filter stlport_%, $(LOCAL_NDK_STL_VARIANT)))
     my_ndk_stl_include_path := $(my_ndk_source_root)/cxx-stl/stlport/stlport
+    my_system_shared_libraries += libstdc++
     ifeq (stlport_static,$(LOCAL_NDK_STL_VARIANT))
       my_ndk_stl_static_lib := $(my_ndk_source_root)/cxx-stl/stlport/libs/$(my_cpu_variant)/libstlport_static.a
     else
@@ -133,11 +147,14 @@
       my_ndk_stl_shared_lib := -lc++_shared
     endif
     my_ndk_stl_cppflags := -std=c++11
-  else
-    # LOCAL_NDK_STL_VARIANT is gnustl_static
+  else # LOCAL_NDK_STL_VARIANT is not c++_* either
+  ifneq (,$(filter gnustl_%, $(LOCAL_NDK_STL_VARIANT)))
     my_ndk_stl_include_path := $(my_ndk_source_root)/cxx-stl/gnu-libstdc++/$($(LOCAL_2ND_ARCH_VAR_PREFIX)TARGET_NDK_GCC_VERSION)/libs/$(my_cpu_variant)/include \
                                $(my_ndk_source_root)/cxx-stl/gnu-libstdc++/$($(LOCAL_2ND_ARCH_VAR_PREFIX)TARGET_NDK_GCC_VERSION)/include
     my_ndk_stl_static_lib := $(my_ndk_source_root)/cxx-stl/gnu-libstdc++/$($(LOCAL_2ND_ARCH_VAR_PREFIX)TARGET_NDK_GCC_VERSION)/libs/$(my_cpu_variant)/libgnustl_static.a
+  else # LOCAL_NDK_STL_VARIANT must be none
+    # Do nothing.
+  endif
   endif
   endif
   endif
@@ -177,6 +194,11 @@
 my_c_includes += $(LOCAL_C_INCLUDES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)) $(LOCAL_C_INCLUDES_$(my_32_64_bit_suffix))
 my_generated_sources += $(LOCAL_GENERATED_SOURCES_$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)) $(LOCAL_GENERATED_SOURCES_$(my_32_64_bit_suffix))
 
+my_missing_exclude_files := $(filter-out $(my_src_files),$(my_src_files_exclude))
+ifneq ($(my_missing_exclude_files),)
+$(warning Files are listed in LOCAL_SRC_FILES_EXCLUDE but not LOCAL_SRC_FILES)
+$(error $(my_missing_exclude_files))
+endif
 my_src_files := $(filter-out $(my_src_files_exclude),$(my_src_files))
 
 my_clang := $(strip $(LOCAL_CLANG))
@@ -730,8 +752,9 @@
 	$(transform-aidl-to-cpp)
 -include $(addsuffix .P,$(basename $(aidl_gen_cpp)))
 
-# Add generated headers to include path.
+# Add generated headers to include paths.
 my_c_includes += $(aidl_gen_include_root)
+my_export_c_include_dirs += $(aidl_gen_include_root)
 # Pick up the generated C++ files later for transformation to .o files.
 my_generated_sources += $(aidl_gen_cpp)
 
@@ -1133,7 +1156,11 @@
 # that custom build rules which generate .o files don't consume other generated
 # sources as input (or if they do they take care of that dependency themselves).
 $(normal_objects) : | $(my_generated_sources)
+ifeq ($(BUILDING_WITH_NINJA),true)
+$(all_objects) : $(import_includes)
+else
 $(all_objects) : | $(import_includes)
+endif
 ALL_C_CPP_ETC_OBJECTS += $(all_objects)
 
 
@@ -1175,7 +1202,7 @@
     $(addprefix $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_INTERMEDIATE_LIBRARIES)/, \
       $(addsuffix $(so_suffix), \
         $(my_shared_libraries)))
-built_shared_library_tocs := $(addsuffix .toc, $(built_shared_libraries))
+built_shared_library_deps := $(addsuffix .toc, $(built_shared_libraries))
 
 # Add the NDK libraries to the built module dependency
 my_system_shared_libraries_fullpath := \
@@ -1189,7 +1216,13 @@
     $(addprefix $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_INTERMEDIATE_LIBRARIES)/, \
       $(addsuffix $(so_suffix), \
         $(installed_shared_library_module_names)))
-built_shared_library_tocs := $(addsuffix .toc, $(built_shared_libraries))
+ifdef LOCAL_IS_HOST_MODULE
+# Disable .toc optimization for host modules: we may run the host binaries during the build process
+# and the libraries' implementation matters.
+built_shared_library_deps := $(built_shared_libraries)
+else
+built_shared_library_deps := $(addsuffix .toc, $(built_shared_libraries))
+endif
 my_system_shared_libraries_fullpath :=
 endif
 
@@ -1285,7 +1318,7 @@
 ###########################################################
 # all_libraries is used for the dependencies on LOCAL_BUILT_MODULE.
 all_libraries := \
-    $(built_shared_library_tocs) \
+    $(built_shared_library_deps) \
     $(my_system_shared_libraries_fullpath) \
     $(built_static_libraries) \
     $(built_whole_libraries)
@@ -1301,16 +1334,31 @@
 export_includes := $(intermediates)/export_includes
 $(export_includes): PRIVATE_EXPORT_C_INCLUDE_DIRS := $(my_export_c_include_dirs)
 # Make sure .pb.h are already generated before any dependent source files get compiled.
-$(export_includes) : $(LOCAL_MODULE_MAKEFILE_DEP) $(proto_generated_headers) $(dbus_generated_headers)
+# Similarly, the generated DBus headers need to exist before we export their location.
+# People are not going to consume the aidl generated cpp file, but the cpp file is
+# generated after the headers, so this is a convenient way to ensure the headers exist.
+$(export_includes) : $(LOCAL_MODULE_MAKEFILE_DEP) $(proto_generated_headers) $(dbus_generated_headers) $(aidl_gen_cpp)
 	@echo Export includes file: $< -- $@
-	$(hide) mkdir -p $(dir $@) && rm -f $@
+	$(hide) mkdir -p $(dir $@) && rm -f $@.tmp
 ifdef my_export_c_include_dirs
 	$(hide) for d in $(PRIVATE_EXPORT_C_INCLUDE_DIRS); do \
-	        echo "-I $$d" >> $@; \
+	        echo "-I $$d" >> $@.tmp; \
 	        done
 else
-	$(hide) touch $@
+	$(hide) touch $@.tmp
 endif
+ifeq ($(BUILDING_WITH_NINJA),true)
+	$(hide) if cmp -s $@.tmp $@ ; then \
+	  rm $@.tmp ; \
+	else \
+	  mv $@.tmp $@ ; \
+	fi
+else
+	mv $@.tmp $@ ;
+endif
+
+# Kati adds restat=1 to ninja. GNU make does nothing for this.
+.KATI_RESTAT: $(export_includes)
 
 # Make sure export_includes gets generated when you are running mm/mmm
 $(LOCAL_BUILT_MODULE) : | $(export_includes)
diff --git a/core/ccache.mk b/core/ccache.mk
index c99d933..5c2ae23 100644
--- a/core/ccache.mk
+++ b/core/ccache.mk
@@ -14,7 +14,7 @@
 # limitations under the License.
 #
 
-ifneq ($(USE_CCACHE),)
+ifneq ($(filter-out false,$(USE_CCACHE)),)
   # The default check uses size and modification time, causing false misses
   # since the mtime depends when the repo was checked out
   export CCACHE_COMPILERCHECK := content
diff --git a/core/clang/HOST_x86_common.mk b/core/clang/HOST_x86_common.mk
index fc98dd5..8b94209 100644
--- a/core/clang/HOST_x86_common.mk
+++ b/core/clang/HOST_x86_common.mk
@@ -6,6 +6,8 @@
 
 CLANG_CONFIG_x86_DARWIN_HOST_EXTRA_CFLAGS := \
   -integrated-as
+
+CLANG_CONFIG_x86_DARWIN_HOST_EXTRA_CFLAGS += -fstack-protector-strong
 endif
 
 ifeq ($(HOST_OS),linux)
@@ -16,6 +18,8 @@
 CLANG_CONFIG_x86_LINUX_HOST_EXTRA_CFLAGS := \
   --gcc-toolchain=$($(clang_2nd_arch_prefix)HOST_TOOLCHAIN_FOR_CLANG)
 
+CLANG_CONFIG_x86_LINUX_HOST_EXTRA_CFLAGS += -fstack-protector-strong
+
 ifneq ($(strip $($(clang_2nd_arch_prefix)HOST_IS_64_BIT)),)
 CLANG_CONFIG_x86_LINUX_HOST_EXTRA_CPPFLAGS := \
   --gcc-toolchain=$($(clang_2nd_arch_prefix)HOST_TOOLCHAIN_FOR_CLANG) \
diff --git a/core/clang/TARGET_arm.mk b/core/clang/TARGET_arm.mk
index 5ac5477..eeffa51 100644
--- a/core/clang/TARGET_arm.mk
+++ b/core/clang/TARGET_arm.mk
@@ -69,5 +69,4 @@
 
 # Address sanitizer clang config
 $(clang_2nd_arch_prefix)ADDRESS_SANITIZER_RUNTIME_LIBRARY := libclang_rt.asan-arm-android
-$(clang_2nd_arch_prefix)ADDRESS_SANITIZER_RPATH := /data/vendor/lib:/$(TARGET_COPY_OUT_VENDOR)/lib:/data/lib
 $(clang_2nd_arch_prefix)ADDRESS_SANITIZER_LINKER := /system/bin/linker_asan
diff --git a/core/clang/TARGET_arm64.mk b/core/clang/TARGET_arm64.mk
index 5120a6d..15b0172 100644
--- a/core/clang/TARGET_arm64.mk
+++ b/core/clang/TARGET_arm64.mk
@@ -66,6 +66,5 @@
 TARGET_LIBPROFILE_RT := $(LLVM_RTLIB_PATH)/libclang_rt.profile-aarch64-android.a
 
 # Address sanitizer clang config
-ADDRESS_SANITIZER_RUNTIME_LIBRARY := libclang_rt.asan-arm64-android
-ADDRESS_SANITIZER_RPATH := /data/vendor/lib64:/$(TARGET_COPY_OUT_VENDOR)/lib64:/data/lib64
+ADDRESS_SANITIZER_RUNTIME_LIBRARY := libclang_rt.asan-aarch64-android
 ADDRESS_SANITIZER_LINKER := /system/bin/linker_asan64
diff --git a/core/clang/TARGET_x86.mk b/core/clang/TARGET_x86.mk
index f982439..9ca86a1 100644
--- a/core/clang/TARGET_x86.mk
+++ b/core/clang/TARGET_x86.mk
@@ -74,5 +74,4 @@
 
 # Address sanitizer clang config
 $(clang_2nd_arch_prefix)ADDRESS_SANITIZER_RUNTIME_LIBRARY := libclang_rt.asan-i686-android
-$(clang_2nd_arch_prefix)ADDRESS_SANITIZER_RPATH := /data/vendor/lib:/$(TARGET_COPY_OUT_VENDOR)/lib:/data/lib
 $(clang_2nd_arch_prefix)ADDRESS_SANITIZER_LINKER := /system/bin/linker_asan
diff --git a/core/clang/config.mk b/core/clang/config.mk
index 00815e4..756bf49 100644
--- a/core/clang/config.mk
+++ b/core/clang/config.mk
@@ -1,7 +1,7 @@
 ## Clang configurations.
 
-LLVM_PREBUILTS_VERSION := 3.8
-LLVM_PREBUILTS_BASE := prebuilts/clang/host
+LLVM_PREBUILTS_VERSION ?= 3.8
+LLVM_PREBUILTS_BASE ?= prebuilts/clang/host
 LLVM_PREBUILTS_PATH := $(LLVM_PREBUILTS_BASE)/$(BUILD_OS)-x86/$(LLVM_PREBUILTS_VERSION)/bin
 LLVM_RTLIB_PATH := $(LLVM_PREBUILTS_PATH)/../lib/clang/$(LLVM_PREBUILTS_VERSION)/lib/linux/
 
diff --git a/core/cleanbuild.mk b/core/cleanbuild.mk
index 7885644..06ceecb 100644
--- a/core/cleanbuild.mk
+++ b/core/cleanbuild.mk
@@ -301,48 +301,6 @@
 force_objclean :=
 
 ###########################################################
-# Clean build tools when swithcing between prebuilt host tools (such as in
-# apps_only build) and tools built from source (platform build).
-previous_prebuilt_tools_config_file := $(HOST_OUT)/previous_prebuilt_tools_config.mk
-ifneq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
-current_prebuilt_tools := true
-else
-current_prebuilt_tools := false
-endif
-PREVIOUS_PREBUILT_TOOLS :=
--include $(previous_prebuilt_tools_config_file)
-force_tools_clean :=
-ifdef PREVIOUS_PREBUILT_TOOLS
-ifneq ($(PREVIOUS_PREBUILT_TOOLS),$(current_prebuilt_tools))
-force_tools_clean := true
-endif
-endif # else, this is the first build, so no need to clean.
-
-# Write the new state to the file.
-ifneq ($(PREVIOUS_PREBUILT_TOOLS),$(current_prebuilt_tools))
-$(shell \
-  mkdir -p $(dir $(previous_prebuilt_tools_config_file)) && \
-  echo "PREVIOUS_PREBUILT_TOOLS:=$(current_prebuilt_tools)" > \
-    $(previous_prebuilt_tools_config_file))
-endif
-
-ifeq ($(force_tools_clean),true)
-# For this list of prebuilt tools, see prebuilts/sdk/tools/Android.mk.
-tools_clean_files := \
-  $(HOST_OUT_COMMON_INTERMEDIATES)/JAVA_LIBRARIES/signapk_intermediates \
-  $(HOST_OUT_COMMON_INTERMEDIATES)/JAVA_LIBRARIES/dx_intermediates \
-  $(HOST_OUT_COMMON_INTERMEDIATES)/JAVA_LIBRARIES/shrinkedAndroid_intermediates \
-  $(HOST_OUT)/obj*/EXECUTABLES/aapt_intermediates \
-  $(HOST_OUT)/obj*/EXECUTABLES/aidl_intermediates \
-  $(HOST_OUT)/obj*/EXECUTABLES/zipalign_intermediates \
-  $(HOST_OUT)/obj*/lib/libc++$(HOST_SHLIB_SUFFIX) \
-
-$(info *** build type changed, clean host tools...)
-$(info *** rm -rf $(tools_clean_files))
-$(shell rm -rf $(tools_clean_files))
-endif
-
-###########################################################
 
 .PHONY: clean-jack-files
 clean-jack-files: clean-dex-files
diff --git a/core/combo/HOST_linux-x86.mk b/core/combo/HOST_linux-x86.mk
index b5efc71..169e2d2 100644
--- a/core/combo/HOST_linux-x86.mk
+++ b/core/combo/HOST_linux-x86.mk
@@ -35,7 +35,7 @@
 
 # We expect SSE3 floating point math.
 $(combo_2nd_arch_prefix)HOST_GLOBAL_CFLAGS += -msse3 -mfpmath=sse -m32 -Wa,--noexecstack -march=prescott
-$(combo_2nd_arch_prefix)HOST_GLOBAL_LDFLAGS += -m32 -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now
+$(combo_2nd_arch_prefix)HOST_GLOBAL_LDFLAGS += -m32 -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now -Wl,--no-undefined-version
 
 ifneq ($(strip $(BUILD_HOST_static)),)
 # Statically-linked binaries are desirable for sandboxed environment
diff --git a/core/combo/HOST_linux-x86_64.mk b/core/combo/HOST_linux-x86_64.mk
index 9a77324..9766f2b 100644
--- a/core/combo/HOST_linux-x86_64.mk
+++ b/core/combo/HOST_linux-x86_64.mk
@@ -34,7 +34,7 @@
 HOST_TOOLCHAIN_FOR_CLANG := prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.15-4.8
 
 HOST_GLOBAL_CFLAGS += -m64 -Wa,--noexecstack
-HOST_GLOBAL_LDFLAGS += -m64 -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now
+HOST_GLOBAL_LDFLAGS += -m64 -Wl,-z,noexecstack -Wl,-z,relro -Wl,-z,now -Wl,--no-undefined-version
 
 ifneq ($(strip $(BUILD_HOST_static)),)
 # Statically-linked binaries are desirable for sandboxed environment
diff --git a/core/combo/TARGET_linux-arm.mk b/core/combo/TARGET_linux-arm.mk
index 485e48c..510aae5 100644
--- a/core/combo/TARGET_linux-arm.mk
+++ b/core/combo/TARGET_linux-arm.mk
@@ -101,7 +101,7 @@
 			-ffunction-sections \
 			-fdata-sections \
 			-funwind-tables \
-			-fstack-protector \
+			-fstack-protector-strong \
 			-Wa,--noexecstack \
 			-Werror=format-security \
 			-D_FORTIFY_SOURCE=2 \
@@ -138,6 +138,7 @@
 			-Wl,--fatal-warnings \
 			-Wl,--icf=safe \
 			-Wl,--hash-style=gnu \
+			-Wl,--no-undefined-version \
 			$(arch_variant_ldflags)
 
 $(combo_2nd_arch_prefix)TARGET_GLOBAL_CFLAGS += -mthumb-interwork
diff --git a/core/combo/TARGET_linux-arm64.mk b/core/combo/TARGET_linux-arm64.mk
index 1eb3240..6a1d861 100644
--- a/core/combo/TARGET_linux-arm64.mk
+++ b/core/combo/TARGET_linux-arm64.mk
@@ -75,7 +75,7 @@
     -fno-strict-aliasing \
 
 TARGET_GLOBAL_CFLAGS += \
-			-fstack-protector \
+			-fstack-protector-strong \
 			-ffunction-sections \
 			-fdata-sections \
 			-funwind-tables \
@@ -115,6 +115,9 @@
 			-Wl,-maarch64linux \
 			-Wl,--hash-style=gnu \
 			-Wl,--fix-cortex-a53-843419 \
+			-fuse-ld=gold \
+			-Wl,--icf=safe \
+			-Wl,--no-undefined-version \
 			$(arch_variant_ldflags)
 
 # Disable transitive dependency library symbol resolving.
diff --git a/core/combo/TARGET_linux-mips.mk b/core/combo/TARGET_linux-mips.mk
index be05302..186d88f 100644
--- a/core/combo/TARGET_linux-mips.mk
+++ b/core/combo/TARGET_linux-mips.mk
@@ -89,6 +89,7 @@
 			-ffunction-sections \
 			-fdata-sections \
 			-funwind-tables \
+			-fstack-protector-strong \
 			-Wa,--noexecstack \
 			-Werror=format-security \
 			-D_FORTIFY_SOURCE=2 \
@@ -107,6 +108,7 @@
 			-Wl,--build-id=md5 \
 			-Wl,--warn-shared-textrel \
 			-Wl,--fatal-warnings \
+			-Wl,--no-undefined-version \
 			$(arch_variant_ldflags)
 
 # Disable transitive dependency library symbol resolving.
diff --git a/core/combo/TARGET_linux-mips64.mk b/core/combo/TARGET_linux-mips64.mk
index 9704b6b..3e1f61a 100644
--- a/core/combo/TARGET_linux-mips64.mk
+++ b/core/combo/TARGET_linux-mips64.mk
@@ -89,6 +89,7 @@
 			-ffunction-sections \
 			-fdata-sections \
 			-funwind-tables \
+			-fstack-protector-strong \
 			-Wa,--noexecstack \
 			-Werror=format-security \
 			-D_FORTIFY_SOURCE=2 \
@@ -113,6 +114,7 @@
 			-Wl,--build-id=md5 \
 			-Wl,--warn-shared-textrel \
 			-Wl,--fatal-warnings \
+			-Wl,--no-undefined-version \
 			$(arch_variant_ldflags)
 
 # Disable transitive dependency library symbol resolving.
diff --git a/core/combo/TARGET_linux-x86.mk b/core/combo/TARGET_linux-x86.mk
index c4cb0f8..558ec3b 100644
--- a/core/combo/TARGET_linux-x86.mk
+++ b/core/combo/TARGET_linux-x86.mk
@@ -94,7 +94,7 @@
 			-fstrict-aliasing \
 			-funswitch-loops \
 			-funwind-tables \
-			-fstack-protector \
+			-fstack-protector-strong \
 			-m32 \
 			-no-canonical-prefixes \
 			-fno-canonical-system-headers \
@@ -129,6 +129,7 @@
 $(combo_2nd_arch_prefix)TARGET_GLOBAL_LDFLAGS += -Wl,--fatal-warnings
 $(combo_2nd_arch_prefix)TARGET_GLOBAL_LDFLAGS += -Wl,--gc-sections
 $(combo_2nd_arch_prefix)TARGET_GLOBAL_LDFLAGS += -Wl,--hash-style=gnu
+$(combo_2nd_arch_prefix)TARGET_GLOBAL_LDFLAGS += -Wl,--no-undefined-version
 
 $(combo_2nd_arch_prefix)TARGET_C_INCLUDES := \
 	$(libc_root)/arch-x86/include \
diff --git a/core/combo/TARGET_linux-x86_64.mk b/core/combo/TARGET_linux-x86_64.mk
index b7ec50b..12166ec 100644
--- a/core/combo/TARGET_linux-x86_64.mk
+++ b/core/combo/TARGET_linux-x86_64.mk
@@ -94,7 +94,7 @@
 			-fstrict-aliasing \
 			-funswitch-loops \
 			-funwind-tables \
-			-fstack-protector \
+			-fstack-protector-strong \
 			-m64 \
 			-no-canonical-prefixes \
 			-fno-canonical-system-headers
@@ -138,6 +138,7 @@
 TARGET_GLOBAL_LDFLAGS += -Wl,--fatal-warnings
 TARGET_GLOBAL_LDFLAGS += -Wl,--gc-sections
 TARGET_GLOBAL_LDFLAGS += -Wl,--hash-style=gnu
+TARGET_GLOBAL_LDFLAGS += -Wl,--no-undefined-version
 
 TARGET_C_INCLUDES := \
 	$(libc_root)/arch-x86_64/include \
diff --git a/core/config.mk b/core/config.mk
index 49810ee..556d52b 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -444,6 +444,45 @@
 endif
 endif
 
+#
+# Tools that are prebuilts for TARGET_BUILD_APPS
+#
+
+ACP := $(HOST_OUT_EXECUTABLES)/acp
+AIDL := $(HOST_OUT_EXECUTABLES)/aidl
+AAPT := $(HOST_OUT_EXECUTABLES)/aapt
+ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign
+SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
+SIGNAPK_JNI_LIBRARY_PATH := $(HOST_OUT_SHARED_LIBRARIES)
+LLVM_RS_CC := $(HOST_OUT_EXECUTABLES)/llvm-rs-cc
+BCC_COMPAT := $(HOST_OUT_EXECUTABLES)/bcc_compat
+
+DX := $(HOST_OUT_EXECUTABLES)/dx
+MAINDEXCLASSES := $(HOST_OUT_EXECUTABLES)/mainDexClasses
+
+# Override the definitions above for unbundled and PDK builds
+ifneq (,$(TARGET_BUILD_APPS)$(filter true,$(TARGET_BUILD_PDK)))
+prebuilt_sdk_tools := prebuilts/sdk/tools
+prebuilt_sdk_tools_bin := $(prebuilt_sdk_tools)/$(HOST_OS)/bin
+
+ACP := $(prebuilt_sdk_tools_bin)/acp
+AIDL := $(prebuilt_sdk_tools_bin)/aidl
+AAPT := $(prebuilt_sdk_tools_bin)/aapt
+ZIPALIGN := $(prebuilt_sdk_tools_bin)/zipalign
+SIGNAPK_JAR := $(prebuilt_sdk_tools)/lib/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
+# Use 64-bit libraries unconditionally because 32-bit JVMs are no longer supported
+SIGNAPK_JNI_LIBRARY_PATH := $(prebuilt_sdk_tools)/$(HOST_OS)/lib64
+
+DX := $(prebuilt_sdk_tools)/dx
+MAINDEXCLASSES := $(prebuilt_sdk_tools)/mainDexClasses
+
+# Don't use prebuilts in PDK
+ifneq ($(TARGET_BUILD_PDK),true)
+LLVM_RS_CC := $(prebuilt_sdk_tools_bin)/llvm-rs-cc
+BCC_COMPAT := $(prebuilt_sdk_tools_bin)/bcc_compat
+endif # TARGET_BUILD_PDK
+endif # TARGET_BUILD_APPS || TARGET_BUILD_PDK
+
 
 # ---------------------------------------------------------------
 # Generic tools.
@@ -463,8 +502,6 @@
 YASM := prebuilts/misc/$(BUILD_OS)-$(HOST_PREBUILT_ARCH)/yasm/yasm
 
 DOXYGEN:= doxygen
-AAPT := $(HOST_OUT_EXECUTABLES)/aapt$(HOST_EXECUTABLE_SUFFIX)
-AIDL := $(HOST_OUT_EXECUTABLES)/aidl$(HOST_EXECUTABLE_SUFFIX)
 AIDL_CPP := $(HOST_OUT_EXECUTABLES)/aidl-cpp$(HOST_EXECUTABLE_SUFFIX)
 ifeq ($(HOST_OS),linux)
 BREAKPAD_DUMP_SYMS := $(HOST_OUT_EXECUTABLES)/dump_syms
@@ -474,7 +511,6 @@
 endif
 PROTOC := $(HOST_OUT_EXECUTABLES)/aprotoc$(HOST_EXECUTABLE_SUFFIX)
 DBUS_GENERATOR := $(HOST_OUT_EXECUTABLES)/dbus-binding-generator
-SIGNAPK_JAR := $(HOST_OUT_JAVA_LIBRARIES)/signapk$(COMMON_JAVA_PACKAGE_SUFFIX)
 MKBOOTFS := $(HOST_OUT_EXECUTABLES)/mkbootfs$(HOST_EXECUTABLE_SUFFIX)
 MINIGZIP := $(HOST_OUT_EXECUTABLES)/minigzip$(HOST_EXECUTABLE_SUFFIX)
 ifeq (,$(strip $(BOARD_CUSTOM_MKBOOTIMG)))
@@ -519,8 +555,6 @@
 JILL := java -Xmx3500m -jar $(JILL_JAR)
 PROGUARD := external/proguard/bin/proguard.sh
 JAVATAGS := build/tools/java-event-log-tags.py
-LLVM_RS_CC := $(HOST_OUT_EXECUTABLES)/llvm-rs-cc$(HOST_EXECUTABLE_SUFFIX)
-BCC_COMPAT := $(HOST_OUT_EXECUTABLES)/bcc_compat$(HOST_EXECUTABLE_SUFFIX)
 RMTYPEDEFS := $(HOST_OUT_EXECUTABLES)/rmtypedefs
 APPEND2SIMG := $(HOST_OUT_EXECUTABLES)/append2simg
 VERITY_SIGNER := $(HOST_OUT_EXECUTABLES)/verity_signer
@@ -530,16 +564,15 @@
 VBOOT_SIGNER := prebuilts/misc/scripts/vboot_signer/vboot_signer.sh
 FEC := $(HOST_OUT_EXECUTABLES)/fec
 
-# ACP is always for the build OS, not for the host OS
-ACP := $(BUILD_OUT_EXECUTABLES)/acp$(BUILD_EXECUTABLE_SUFFIX)
-
-# dx is java behind a shell script; no .exe necessary.
-DX := $(HOST_OUT_EXECUTABLES)/dx
-ZIPALIGN := $(HOST_OUT_EXECUTABLES)/zipalign$(HOST_EXECUTABLE_SUFFIX)
 ifndef TARGET_BUILD_APPS
 ZIPTIME := $(HOST_OUT_EXECUTABLES)/ziptime$(HOST_EXECUTABLE_SUFFIX)
 endif
 
+# ijar converts a .jar file to a smaller .jar file which only has its
+# interfaces.
+IJAR := $(HOST_OUT_EXECUTABLES)/ijar$(BUILD_EXECUTABLE_SUFFIX)
+DEXDUMP := $(HOST_OUT_EXECUTABLES)/dexdump2$(BUILD_EXECUTABLE_SUFFIX)
+
 # relocation packer
 RELOCATION_PACKER := prebuilts/misc/$(BUILD_OS)-$(HOST_PREBUILT_ARCH)/relocation_packer/relocation_packer
 
@@ -659,6 +692,18 @@
 HOST_CROSS_GLOBAL_CPPFLAGS += $(HOST_CROSS_RELEASE_CPPFLAGS)
 endif
 
+ifdef BRILLO
+# Add a C define that identifies Brillo targets. __BRILLO__ should only be used
+# to differentiate between Brillo and non-Brillo-but-Android environments. Use
+# __ANDROID__ instead to test if something is being built in an Android-derived
+# environment (including Brillo) as opposed to an entirely different
+# environment (e.g. Chrome OS).
+TARGET_GLOBAL_CFLAGS += -D__BRILLO__
+ifdef TARGET_2ND_ARCH
+$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_GLOBAL_CFLAGS += -D__BRILLO__
+endif
+endif
+
 # allow overriding default Java libraries on a per-target basis
 ifeq ($(TARGET_DEFAULT_JAVA_LIBRARIES),)
   TARGET_DEFAULT_JAVA_LIBRARIES := core-libart core-junit ext framework okhttp
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index df52e72..6e96880 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -117,7 +117,6 @@
                            $(my_shared_libraries) \
                            $(ADDRESS_SANITIZER_CONFIG_EXTRA_SHARED_LIBRARIES)
     my_static_libraries += $(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES)
-    my_ldflags += -Wl,-rpath,$($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_RPATH)
 
     my_linker := $($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_LINKER)
     # Make sure linker_asan get installed.
diff --git a/core/cxx_stl_setup.mk b/core/cxx_stl_setup.mk
index be8a711..37be1f7 100644
--- a/core/cxx_stl_setup.mk
+++ b/core/cxx_stl_setup.mk
@@ -104,9 +104,6 @@
     endif
 else ifeq ($(my_cxx_stl),ndk)
     # Using an NDK STL. Handled in binary.mk.
-    ifndef LOCAL_IS_HOST_MODULE
-        my_system_shared_libraries += libstdc++
-    endif
 else ifeq ($(my_cxx_stl),libstdc++)
     # Using bionic's basic libstdc++. Not actually an STL. Only around until the
     # tree is in good enough shape to not need it.
diff --git a/core/definitions.mk b/core/definitions.mk
index 0089865..5be109e 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -530,7 +530,7 @@
         $(error $(LOCAL_PATH): Name not defined in call to generated-sources-dir-for)) \
     $(eval _idfPrefix := $(if $(strip $(3)),HOST,TARGET)) \
     $(if $(filter $(_idfPrefix)-$(_idfClass),$(COMMON_MODULE_CLASSES))$(4), \
-        $(eval _idfIntBase := $($(_idfPrefix)_OUT_GEN_COMMON)) \
+        $(eval _idfIntBase := $($(_idfPrefix)_OUT_COMMON_GEN)) \
       , \
         $(eval _idfIntBase := $($(_idfPrefix)_OUT_GEN)) \
      ) \
@@ -1760,7 +1760,8 @@
 endef
 
 # For a list of jar files, unzip them to a specified directory,
-# but make sure that no META-INF files come along for the ride.
+# but make sure that no META-INF files come along for the ride,
+# unless PRIVATE_DONT_DELETE_JAR_META_INF is set.
 #
 # $(1): files to unzip
 # $(2): destination directory
@@ -1772,8 +1773,8 @@
       exit 1; \
     fi; \
     unzip -qo $$f -d $(2); \
-  done \
-  $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,;rm -rf $(2)/META-INF)
+  done
+  $(if $(PRIVATE_DONT_DELETE_JAR_META_INF),,$(hide) rm -rf $(2)/META-INF)
 endef
 
 # Call jack
@@ -1875,7 +1876,7 @@
     $(hide) mkdir -p $@.res.tmp
     $(hide) $(call create-empty-package-at,$@.res.tmp.zip)
     $(hide) $(call add-java-resources-to,$@.res.tmp.zip)
-    $(hide) $(call unzip-jar-files,$@.res.tmp.zip,$@.res.tmp)
+    $(hide) unzip -qo $@.res.tmp.zip -d $@.res.tmp
     $(hide) rm $@.res.tmp.zip)
 $(hide) if [ -s $(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq ] ; then \
     export tmpEcjArg="@$(PRIVATE_JACK_INTERMEDIATES_DIR)/java-source-list-uniq"; \
@@ -1895,7 +1896,6 @@
     -D jack.import.resource.policy=keep-first \
     -D jack.import.type.policy=keep-first \
     --output-jack $(PRIVATE_CLASSES_JACK) \
-    -D jack.java.source.version=1.7 \
     $(if $(PRIVATE_JACK_INCREMENTAL_DIR),--incremental-folder $(PRIVATE_JACK_INCREMENTAL_DIR)) \
     --output-dex $(PRIVATE_JACK_INTERMEDIATES_DIR) \
     $(addprefix --config-jarjar ,$(strip $(PRIVATE_JARJAR_RULES))) \
@@ -1915,7 +1915,7 @@
 	$(hide) mkdir -p $(dir $@)
 	$(JILL) $(PRIVATE_JILL_FLAGS) --output $@.tmpjill.jack $<
 	$(hide) mkdir -p $@.tmpjill.res
-	$(hide) $(call unzip-jar-files,$<,$@.tmpjill.res)
+	$(hide) unzip -qo $< -d $@.tmpjill.res
 	$(hide) find $@.tmpjill.res -iname "*.class" -delete
 	$(hide) $(call call-jack) \
         -D jack.import.resource.policy=keep-first \
@@ -1927,6 +1927,71 @@
 	$(hide) rm $@.tmpjill.jack
 endef
 
+# Moves $1.tmp to $1 if necessary. This is designed to be used with
+# .KATI_RESTAT. For kati, this function doesn't update the timestamp
+# of $1 when $1.tmp is identical to $1 so that ninja won't rebuild
+# targets which depend on $1. For GNU make, this function simply
+# copies $1.tmp to $1.
+ifeq ($(BUILDING_WITH_NINJA),true)
+define commit-change-for-toc
+$(hide) if cmp -s $1.tmp $1 ; then \
+ rm $1.tmp ; \
+else \
+ mv $1.tmp $1 ; \
+fi
+endef
+else
+define commit-change-for-toc
+@# make doesn't support restat. We always update .toc files so the dependents will always be updated too.
+$(hide) mv $1.tmp $1
+endef
+endif
+
+## Rule to create a table of contents from a .jar file.
+## Must be called with $(eval).
+# $(1): A .jar file
+define _transform-jar-to-toc
+$1.toc: $1 | $(IJAR)
+	@echo Generating TOC: $$@
+	$(hide) $(IJAR) $$< $$@.tmp
+	$$(call commit-change-for-toc,$$@)
+endef
+
+## Define a rule which generates .jar.toc and mark it as .KATI_RESTAT.
+# $(1): A .jar file
+define define-jar-to-toc-rule
+$(eval $(call _transform-jar-to-toc,$1))\
+$(eval .KATI_RESTAT: $1.toc)
+endef
+
+ifeq (,$(TARGET_BUILD_APPS))
+
+## Rule to create a table of contents from a .dex file.
+## Must be called with $(eval).
+# $(1): The directory which contains classes*.dex files
+define _transform-dex-to-toc
+$1/classes.dex.toc: PRIVATE_INPUT_DEX_FILES := $1/classes*.dex
+$1/classes.dex.toc: $1/classes.dex $(DEXDUMP)
+	@echo Generating TOC: $$@
+	$(hide) $(DEXDUMP) -l xml $$(PRIVATE_INPUT_DEX_FILES) > $$@.tmp
+	$$(call commit-change-for-toc,$$@)
+endef
+
+## Define a rule which generates .dex.toc and mark it as .KATI_RESTAT.
+# $(1): The directory which contains classes*.dex files
+define define-dex-to-toc-rule
+$(eval $(call _transform-dex-to-toc,$1))\
+$(eval .KATI_RESTAT: $1/classes.dex.toc)
+endef
+
+else
+
+# Turn off .toc optimization for apps build as we cannot build dexdump.
+define define-dex-to-toc-rule
+endef
+
+endif  # TARGET_BUILD_APPS
+
 
 # Invoke Jack to compile java from source to jack files without shrink or obfuscation.
 #
@@ -1971,7 +2036,6 @@
     $(if $(PRIVATE_EXTRA_JAR_ARGS),--import-resource $@.res.tmp) \
     -D jack.import.resource.policy=keep-first \
     -D jack.import.type.policy=keep-first \
-    -D jack.java.source.version=1.7 \
     $(if $(PRIVATE_JACK_INCREMENTAL_DIR),--incremental-folder $(PRIVATE_JACK_INCREMENTAL_DIR)) \
     --output-jack $@ \
     $(addprefix --config-jarjar ,$(strip $(PRIVATE_JARJAR_RULES))) \
@@ -2128,7 +2192,7 @@
 #
 define sign-package
 $(hide) mv $@ $@.unsigned
-$(hide) java -jar $(SIGNAPK_JAR) \
+$(hide) java -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) -jar $(SIGNAPK_JAR) \
     $(PRIVATE_CERTIFICATE) $(PRIVATE_PRIVATE_KEY) \
     $(PRIVATE_ADDITIONAL_CERTIFICATES) $@.unsigned $@.signed
 $(hide) mv $@.signed $@
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index 1bd0bd7..3f52876 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -11,11 +11,6 @@
 DEX2OAT := $(HOST_OUT_EXECUTABLES)/dex2oatd$(HOST_EXECUTABLE_SUFFIX)
 endif
 
-# By default, do not run rerun dex2oat if the tool changes.
-# Comment out the | to force dex2oat to rerun on after all changes.
-DEX2OAT_DEPENDENCY := art/runtime/oat.cc # dependency on oat version number
-DEX2OAT_DEPENDENCY += art/runtime/image.cc # dependency on image version number
-DEX2OAT_DEPENDENCY += |
 DEX2OAT_DEPENDENCY += $(DEX2OAT)
 
 # Use the first preloaded-classes file in PRODUCT_COPY_FILES.
diff --git a/core/dex_preopt_libart_boot.mk b/core/dex_preopt_libart_boot.mk
index afd61eb..253afe2 100644
--- a/core/dex_preopt_libart_boot.mk
+++ b/core/dex_preopt_libart_boot.mk
@@ -48,7 +48,7 @@
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME): PRIVATE_2ND_ARCH_VAR_PREFIX := $(my_2nd_arch_prefix)
 # Use dex2oat debug version for better error reporting
 $($(my_2nd_arch_prefix)DEFAULT_DEX_PREOPT_BUILT_IMAGE_FILENAME) : $(LIBART_TARGET_BOOT_DEX_FILES) $(DEX2OAT_DEPENDENCY)
-	@echo "target dex2oat: $@ ($?)"
+	@echo "target dex2oat: $@"
 	@mkdir -p $(dir $@)
 	@mkdir -p $(dir $($(PRIVATE_2ND_ARCH_VAR_PREFIX)LIBART_TARGET_BOOT_OAT_UNSTRIPPED))
 	$(hide) $(DEX2OAT) --runtime-arg -Xms$(DEX2OAT_IMAGE_XMS) --runtime-arg -Xmx$(DEX2OAT_IMAGE_XMX) \
diff --git a/core/dpi_specific_apk.mk b/core/dpi_specific_apk.mk
index 5d0b5bf..b2a3d64 100644
--- a/core/dpi_specific_apk.mk
+++ b/core/dpi_specific_apk.mk
@@ -48,7 +48,7 @@
 $(built_dpi_apk) : $(R_file_stamp)
 $(built_dpi_apk) : $(all_library_res_package_export_deps)
 $(built_dpi_apk) : $(private_key) $(certificate) $(SIGNAPK_JAR)
-$(built_dpi_apk) : $(AAPT) | $(ZIPALIGN)
+$(built_dpi_apk) : $(AAPT)
 $(built_dpi_apk) : $(all_res_assets) $(jni_shared_libraries) $(full_android_manifest)
 	@echo "target Package: $(PRIVATE_MODULE) ($@)"
 	$(if $(PRIVATE_SOURCE_ARCHIVE),\
@@ -68,7 +68,6 @@
 endif
 endif
 	$(sign-package)
-	$(align-package)
 
 # Set up global variables to register this apk to the higher-level dependency graph.
 ALL_MODULES += $(dpi_apk_name)
diff --git a/core/droiddoc.mk b/core/droiddoc.mk
index 74f7d8b..1421761 100644
--- a/core/droiddoc.mk
+++ b/core/droiddoc.mk
@@ -171,7 +171,7 @@
 		javadoc \
                 -encoding UTF-8 \
                 \@$(PRIVATE_SRC_LIST_FILE) \
-                -J-Xmx1280m \
+                -J-Xmx1600m \
                 -XDignore.symbol.file \
                 $(PRIVATE_PROFILING_OPTIONS) \
                 -quiet \
@@ -209,6 +209,7 @@
                 \@$(PRIVATE_SRC_LIST_FILE) \
                 -J-Xmx1024m \
                 -XDignore.symbol.file \
+                $(if $(EXPERIMENTAL_USE_JAVA8),-Xdoclint:none) \
                 $(PRIVATE_PROFILING_OPTIONS) \
                 $(addprefix -classpath ,$(PRIVATE_CLASSPATH)) \
                 $(addprefix -bootclasspath ,$(PRIVATE_BOOTCLASSPATH)) \
diff --git a/core/goma.mk b/core/goma.mk
index 01a1d81..6535b3e 100644
--- a/core/goma.mk
+++ b/core/goma.mk
@@ -15,7 +15,7 @@
 #
 
 # Notice: this works only with Google's Goma build infrastructure.
-ifneq ($(USE_GOMA),)
+ifneq ($(filter-out false,$(USE_GOMA)),)
   # Check if USE_NINJA is not false because GNU make won't work well
   # with goma. Note this file is evaluated twice, once by GNU make and
   # once by kati with USE_NINJA=false. We do this check in the former
diff --git a/core/java.mk b/core/java.mk
index a6ff6f5..a0ab4c5 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -456,6 +456,8 @@
 	@echo Copying: $@
 	$(hide) $(ACP) -fp $< $@
 
+$(call define-jar-to-toc-rule, $(full_classes_jar))
+
 # Run proguard if necessary, otherwise just copy the file.
 ifdef LOCAL_PROGUARD_ENABLED
 ifneq ($(filter-out full custom nosystem obfuscation optimization shrinktests,$(LOCAL_PROGUARD_ENABLED)),)
@@ -656,6 +658,11 @@
 	@echo Building with Jack: $@
 	$(java-to-jack)
 
+# Update timestamps of .toc files for static java libraries so
+# dependents will be always rebuilt.
+$(built_dex).toc: $(full_classes_jack)
+	touch $@
+
 else #LOCAL_IS_STATIC_JAVA_LIBRARY
 $(built_dex_intermediate): PRIVATE_CLASSES_JACK := $(full_classes_jack)
 
@@ -669,6 +676,8 @@
 $(full_classes_jack): $(built_dex_intermediate)
 	$(hide) touch $@
 
+$(call define-dex-to-toc-rule, $(intermediates.COMMON))
+
 endif #LOCAL_IS_STATIC_JAVA_LIBRARY
 
 $(noshrob_classes_jack): PRIVATE_JACK_INTERMEDIATES_DIR := $(intermediates.COMMON)/jack-noshrob-rsc
diff --git a/core/java_common.mk b/core/java_common.mk
index 9d81096..f11e723 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -133,25 +133,37 @@
 #                 be up-to-date.
 ifndef LOCAL_IS_HOST_MODULE
 ifeq ($(LOCAL_SDK_VERSION),)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,core-libart)
+ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+# No bootclasspath. But we still need "" to prevent javac from using default host bootclasspath.
+my_bootclasspath := ""
+else  # LOCAL_NO_STANDARD_LIBRARIES
+my_bootclasspath := $(call java-lib-files,core-libart)
+endif  # LOCAL_NO_STANDARD_LIBRARIES
 else
 ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
 # LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,android_stubs_current)
+my_bootclasspath := $(call java-lib-files,android_stubs_current)
 else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),system_current)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,android_system_stubs_current)
+my_bootclasspath := $(call java-lib-files,android_system_stubs_current)
 else
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,sdk_v$(LOCAL_SDK_VERSION))
+my_bootclasspath := $(call java-lib-files,sdk_v$(LOCAL_SDK_VERSION))
 endif # current or system_current
 endif # LOCAL_SDK_VERSION
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(my_bootclasspath)
 
 full_shared_java_libs := $(call java-lib-files,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
+full_java_lib_deps := $(addsuffix .toc, $(full_java_lib_deps))
 
 else # LOCAL_IS_HOST_MODULE
 
 ifeq ($(USE_CORE_LIB_BOOTCLASSPATH),true)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(call java-lib-files,core-libart-hostdex,$(LOCAL_IS_HOST_MODULE))
+ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+my_bootclasspath := ""
+else
+my_bootclasspath := $(call java-lib-files,core-libart-hostdex,$(LOCAL_IS_HOST_MODULE))
+endif
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH := -bootclasspath $(my_bootclasspath)
 
 full_shared_java_libs := $(call java-lib-files,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
 full_java_lib_deps := $(call java-lib-deps,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE)) \
@@ -262,25 +274,39 @@
 
 ifndef LOCAL_IS_HOST_MODULE
 ifeq ($(LOCAL_SDK_VERSION),)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(call jack-lib-files,core-libart)
+ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+my_bootclasspath :=
 else
+my_bootclasspath := $(call jack-lib-files,core-libart)
+endif
+else  # LOCAL_SDK_VERSION
 ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
 # LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(call jack-lib-files,android_stubs_current)
+my_bootclasspath := $(call jack-lib-files,android_stubs_current)
 else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),system_current)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(call jack-lib-files,android_system_stubs_current)
+my_bootclasspath := $(call jack-lib-files,android_system_stubs_current)
 else
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(call jack-lib-files,sdk_v$(LOCAL_SDK_VERSION))
+my_bootclasspath :=$(call jack-lib-files,sdk_v$(LOCAL_SDK_VERSION))
 endif # current or system_current
 endif # LOCAL_SDK_VERSION
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(my_bootclasspath)
 
 full_shared_jack_libs := $(call jack-lib-files,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
 full_jack_lib_deps := $(call jack-lib-deps,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
+# Turn off .toc optimization for apps build as we cannot build dexdump.
+ifeq (,$(TARGET_BUILD_APPS))
+full_jack_lib_deps := $(patsubst %.jack, %.dex.toc, $(full_jack_lib_deps))
+endif
 
 else # LOCAL_IS_HOST_MODULE
 
 ifeq ($(USE_CORE_LIB_BOOTCLASSPATH),true)
-$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(call jack-lib-files,core-libart-hostdex,$(LOCAL_IS_HOST_MODULE))
+ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+my_bootclasspath :=
+else
+my_bootclasspath := $(call jack-lib-files,core-libart-hostdex,$(LOCAL_IS_HOST_MODULE))
+endif
+$(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_BOOTCLASSPATH_JAVA_LIBRARIES := $(my_bootclasspath)
 full_shared_jack_libs := $(call jack-lib-files,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
 full_jack_lib_deps := $(call jack-lib-deps,$(LOCAL_JAVA_LIBRARIES),$(LOCAL_IS_HOST_MODULE))
 else
diff --git a/core/main.mk b/core/main.mk
index 004a376..2ca52c7 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -113,6 +113,11 @@
 $(shell rm -f $(OUT_DIR)/ninja_build)
 endif
 
+# With these files findleaves.py won't be unnecessarily slower even if
+# there is a user creates a copy of $(OUT_DIR).
+$(shell echo '# This file prevents findleaves.py from traversing this directory further' > $(OUT_DIR)/Android.mk)
+$(shell echo '# This file prevents findleaves.py from traversing this directory further' > $(OUT_DIR)/CleanSpec.mk)
+
 # Write the build number to a file so it can be read back in
 # without changing the command line every time.  Avoids rebuilds
 # when using ninja.
@@ -525,6 +530,9 @@
 # --mindepth=2 makes the prunes not work.
 subdir_makefiles := \
 	$(shell build/tools/findleaves.py $(FIND_LEAVES_EXCLUDES) $(subdirs) Android.mk)
+ifeq ($(USE_SOONG),true)
+subdir_makefiles := $(SOONG_ANDROID_MK) $(subdir_makefiles)
+endif
 
 $(foreach mk, $(subdir_makefiles), $(info including $(mk) ...)$(eval include $(mk)))
 
@@ -866,6 +874,9 @@
 
 .PHONY: checkbuild
 checkbuild: $(modules_to_check) droid_targets
+ifeq ($(USE_SOONG),true)
+checkbuild: checkbuild-soong
+endif
 ifeq (true,$(ANDROID_BUILD_EVERYTHING_BY_DEFAULT))
 droid: checkbuild
 endif
diff --git a/core/ninja.mk b/core/ninja.mk
index 2e8f3c8..750aae5 100644
--- a/core/ninja.mk
+++ b/core/ninja.mk
@@ -1,5 +1,6 @@
 KATI ?= $(HOST_OUT_EXECUTABLES)/ckati
 MAKEPARALLEL ?= $(HOST_OUT_EXECUTABLES)/makeparallel
+NINJA ?= prebuilts/ninja/$(HOST_PREBUILT_TAG)/ninja
 
 KATI_OUTPUT_PATTERNS := $(OUT_DIR)/build%.ninja $(OUT_DIR)/ninja%.sh
 
@@ -89,7 +90,7 @@
 endif
 
 KATI_BUILD_NINJA := $(OUT_DIR)/build$(KATI_NINJA_SUFFIX).ninja
-KATI_NINJA_SH := $(OUT_DIR)/ninja$(KATI_NINJA_SUFFIX).sh
+KATI_ENV_SH := $(OUT_DIR)/env$(KATI_NINJA_SUFFIX).sh
 
 # Write out a file mapping checksum to the real suffix.
 ifneq ($(my_checksum_suffix),)
@@ -117,21 +118,34 @@
 NINJA_MAKEPARALLEL := $(MAKEPARALLEL) --ninja
 endif
 
+ifeq ($(USE_SOONG),true)
+include $(BUILD_SYSTEM)/soong.mk
+
+COMBINED_BUILD_NINJA := $(OUT_DIR)/combined$(KATI_NINJA_SUFFIX).ninja
+
+$(COMBINED_BUILD_NINJA): $(KATI_BUILD_NINJA) $(SOONG_ANDROID_MK)
+	$(hide) echo "builddir = $(OUT_DIR)" > $(COMBINED_BUILD_NINJA)
+	$(hide) echo "subninja $(SOONG_BUILD_NINJA)" >> $(COMBINED_BUILD_NINJA)
+	$(hide) echo "subninja $(KATI_BUILD_NINJA)" >> $(COMBINED_BUILD_NINJA)
+else
+COMBINED_BUILD_NINJA := $(KATI_BUILD_NINJA)
+endif
+
 $(sort $(DEFAULT_GOAL) $(ANDROID_GOALS)) : ninja_wrapper
 	@#empty
 
 .PHONY: ninja_wrapper
-ninja_wrapper: $(KATI_BUILD_NINJA) $(MAKEPARALLEL)
+ninja_wrapper: $(COMBINED_BUILD_NINJA) $(MAKEPARALLEL)
 	@echo Starting build with ninja
-	+$(hide) PATH=prebuilts/ninja/$(HOST_PREBUILT_TAG)/:$$PATH NINJA_STATUS="$(NINJA_STATUS)" $(NINJA_MAKEPARALLEL) $(KATI_NINJA_SH) $(NINJA_GOALS) -C $(TOP) $(NINJA_ARGS)
+	+$(hide) export NINJA_STATUS="$(NINJA_STATUS)" && source $(KATI_ENV_SH) && $(NINJA_MAKEPARALLEL) $(NINJA) $(NINJA_GOALS) -C $(TOP) -f $(COMBINED_BUILD_NINJA) $(NINJA_ARGS)
 
 KATI_FIND_EMULATOR := --use_find_emulator
 ifeq ($(KATI_EMULATE_FIND),false)
   KATI_FIND_EMULATOR :=
 endif
-$(KATI_BUILD_NINJA): $(KATI) $(MAKEPARALLEL) FORCE
+$(KATI_BUILD_NINJA): $(KATI) $(MAKEPARALLEL) $(SOONG_ANDROID_MK) FORCE
 	@echo Running kati to generate build$(KATI_NINJA_SUFFIX).ninja...
-	+$(hide) $(KATI_MAKEPARALLEL) $(KATI) --ninja --ninja_dir=$(OUT_DIR) --ninja_suffix=$(KATI_NINJA_SUFFIX) --regen --ignore_dirty=$(OUT_DIR)/% --ignore_optional_include=$(OUT_DIR)/%.P --detect_android_echo $(KATI_FIND_EMULATOR) -f build/core/main.mk $(KATI_GOALS) --gen_all_targets BUILDING_WITH_NINJA=true
+	+$(hide) $(KATI_MAKEPARALLEL) $(KATI) --ninja --ninja_dir=$(OUT_DIR) --ninja_suffix=$(KATI_NINJA_SUFFIX) --regen --ignore_dirty=$(OUT_DIR)/% --no_ignore_dirty=$(SOONG_ANDROID_MK) --ignore_optional_include=$(OUT_DIR)/%.P --detect_android_echo $(KATI_FIND_EMULATOR) -f build/core/main.mk $(KATI_GOALS) --gen_all_targets BUILDING_WITH_NINJA=true SOONG_ANDROID_MK=$(SOONG_ANDROID_MK)
 
 KATI_CXX := $(CLANG_CXX) $(CLANG_HOST_GLOBAL_CFLAGS) $(CLANG_HOST_GLOBAL_CPPFLAGS)
 KATI_LD := $(CLANG_CXX) $(CLANG_HOST_GLOBAL_LDFLAGS)
diff --git a/core/package_internal.mk b/core/package_internal.mk
index cb77e76..f5a00e5 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -390,7 +390,7 @@
     $(LOCAL_ADDITIONAL_CERTIFICATES), $(c).x509.pem $(c).pk8)
 
 # Define the rule to build the actual package.
-$(LOCAL_BUILT_MODULE): $(AAPT) | $(ZIPALIGN)
+$(LOCAL_BUILT_MODULE): $(AAPT)
 # PRIVATE_JNI_SHARED_LIBRARIES is a list of <abi>:<path_of_built_lib>.
 $(LOCAL_BUILT_MODULE): PRIVATE_JNI_SHARED_LIBRARIES := $(jni_shared_libraries_with_abis)
 # PRIVATE_JNI_SHARED_LIBRARIES_ABI is a list of ABI names.
@@ -439,8 +439,6 @@
 endif
 endif
 	$(sign-package)
-	@# Alignment must happen after all other zip operations.
-	$(align-package)
 
 ###############################
 ## Build dpi-specific apks, if it's apps_only build.
@@ -475,7 +473,7 @@
 installed_apk_splits := $(foreach s,$(my_split_suffixes),$(my_module_path)/$(LOCAL_MODULE)_$(s).apk)
 
 # The splits should have been built in the same command building the base apk.
-# This rule just runs signing and zipalign etc.
+# This rule just runs signing.
 # Note that we explicily check the existence of the split apk and remove the
 # built base apk if the split apk isn't there.
 # That way the build system will rerun the aapt after the user changes the splitting parameters.
@@ -487,7 +485,6 @@
 	  rm $<; exit 1; \
 	fi
 	$(sign-package)
-	$(align-package)
 
 # Rules to install the splits
 $(installed_apk_splits) : $(my_module_path)/$(LOCAL_MODULE)_%.apk : $(built_module_path)/package_%.apk | $(ACP)
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index 2dd392b..601a79c 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -224,8 +224,10 @@
 endif
 endif
 	$(sign-package)
-endif
+	# No need for align-package because sign-package takes care of alignment
+else
 	$(align-package)
+endif
 
 ###############################
 ## Rule to build the odex file
@@ -241,7 +243,7 @@
 built_apk_splits := $(addprefix $(built_module_path)/,$(notdir $(LOCAL_PACKAGE_SPLITS)))
 installed_apk_splits := $(addprefix $(my_module_path)/,$(notdir $(LOCAL_PACKAGE_SPLITS)))
 
-# Rules to sign and zipalign the split apks.
+# Rules to sign the split apks.
 my_src_dir := $(sort $(dir $(LOCAL_PACKAGE_SPLITS)))
 ifneq (1,$(words $(my_src_dir)))
 $(error You must put all the split source apks in the same folder: $(LOCAL_PACKAGE_SPLITS))
@@ -253,7 +255,6 @@
 $(built_apk_splits) : $(built_module_path)/%.apk : $(my_src_dir)/%.apk | $(ACP)
 	$(copy-file-to-new-target)
 	$(sign-package)
-	$(align-package)
 
 # Rules to install the split apks.
 $(installed_apk_splits) : $(my_module_path)/%.apk : $(built_module_path)/%.apk | $(ACP)
@@ -315,6 +316,8 @@
 $(common_javalib_jar) : $(common_classes_jar) | $(ACP)
 	$(transform-prebuilt-to-target)
 
+$(call define-jar-to-toc-rule, $(common_classes_jar))
+
 # make sure the classes.jar and javalib.jar are built before $(LOCAL_BUILT_MODULE)
 $(built_module) : $(common_javalib_jar)
 endif # TARGET JAVA_LIBRARIES
@@ -325,6 +328,11 @@
         $(LOCAL_ADDITIONAL_DEPENDENCIES) $(JILL_JAR) $(JACK) | setup-jack-server
 	$(transform-jar-to-jack)
 
+# Update timestamps of .toc files for prebuilts so dependents will be
+# always rebuilt.
+$(intermediates.COMMON)/classes.dex.toc: $(intermediates.COMMON)/classes.jack
+	touch $@
+
 endif # JAVA_LIBRARIES
 
 $(built_module) : $(LOCAL_MODULE_MAKEFILE_DEP) $(LOCAL_ADDITIONAL_DEPENDENCIES)
diff --git a/core/soong.mk b/core/soong.mk
new file mode 100644
index 0000000..c464ba8
--- /dev/null
+++ b/core/soong.mk
@@ -0,0 +1,61 @@
+SOONG_OUT_DIR := $(OUT_DIR)/soong
+SOONG := $(SOONG_OUT_DIR)/soong
+SOONG_BUILD_NINJA := $(SOONG_OUT_DIR)/build.ninja
+SOONG_ANDROID_MK := $(SOONG_OUT_DIR)/Android.mk
+SOONG_VARIABLES := $(SOONG_OUT_DIR)/soong.variables
+SOONG_IN_MAKE := $(SOONG_OUT_DIR)/.soong.in_make
+
+ifeq (,$(filter /%,$(SOONG_OUT_DIR)))
+SOONG_TOP_RELPATH := $(shell python -c "import os; print os.path.relpath('$(TOP)', '$(SOONG_OUT_DIR)')")
+else
+SOONG_TOP_RELPATH := $(realpath $(TOP))
+endif
+
+# Bootstrap soong.  Run only the first time for clean builds
+$(SOONG):
+	$(hide) mkdir -p $(dir $@)
+	$(hide) cd $(dir $@) && $(SOONG_TOP_RELPATH)/bootstrap.bash
+
+# Create soong.variables with copies of makefile settings.  Runs every build,
+# but only updates soong.variables if it changes
+SOONG_VARIABLES_TMP := $(SOONG_VARIABLES).$$$$
+$(SOONG_VARIABLES): FORCE
+	$(hide) mkdir -p $(dir $@)
+	$(hide) (\
+	echo '{'; \
+	echo '    "Device_uses_jemalloc": $(if $(filter dlmalloc,$(MALLOC_IMPL)),false,true),'; \
+	echo '    "Device_uses_dlmalloc": $(if $(filter dlmalloc,$(MALLOC_IMPL)),true,false),'; \
+	echo '    $(if $(BOARD_MALLOC_ALIGNMENT),"Dlmalloc_alignment": $(BOARD_MALLOC_ALIGNMENT)$(comma),)'; \
+	echo '    "Platform_sdk_version": $(PLATFORM_SDK_VERSION),'; \
+	echo '    "Unbundled_build": $(if $(TARGET_BUILD_APPS),true,false),'; \
+	echo '    "Brillo": $(if $(BRILLO),true,false),'; \
+	echo ''; \
+	echo '    "DeviceName": "$(TARGET_DEVICE)",'; \
+	echo '    "DeviceArch": "$(TARGET_ARCH)",'; \
+	echo '    "DeviceArchVariant": "$(TARGET_ARCH_VARIANT)",'; \
+	echo '    "DeviceCpuVariant": "$(TARGET_CPU_VARIANT)",'; \
+	echo '    "DeviceAbi": ["$(TARGET_CPU_ABI)", "$(TARGET_CPU_ABI2)"],'; \
+	echo '    "DeviceUsesClang": $(if $(USE_CLANG_PLATFORM_BUILD),$(USE_CLANG_PLATFORM_BUILD),false),'; \
+	echo ''; \
+	echo '    "DeviceSecondaryArch": "$(TARGET_2ND_ARCH)",'; \
+	echo '    "DeviceSecondaryArchVariant": "$(TARGET_2ND_ARCH_VARIANT)",'; \
+	echo '    "DeviceSecondaryCpuVariant": "$(TARGET_2ND_CPU_VARIANT)",'; \
+	echo '    "DeviceSecondaryAbi": ["$(TARGET_2ND_CPU_ABI)", "$(TARGET_2ND_CPU_ABI2)"],'; \
+	echo ''; \
+	echo '    "HostArch": "$(HOST_ARCH)",'; \
+	echo '    "HostSecondaryArch": "$(HOST_2ND_ARCH)"'; \
+	echo '}') > $(SOONG_VARIABLES_TMP); \
+	if ! cmp -s $(SOONG_VARIABLES_TMP) $(SOONG_VARIABLES); then \
+	  mv $(SOONG_VARIABLES_TMP) $(SOONG_VARIABLES); \
+	else \
+	  rm $(SOONG_VARIABLES_TMP); \
+	fi
+
+# Tell soong that it is embedded in make
+$(SOONG_IN_MAKE):
+	$(hide) mkdir -p $(dir $@)
+	$(hide) touch $@
+
+# Build an Android.mk listing all soong outputs as prebuilts
+$(SOONG_ANDROID_MK): $(SOONG) $(SOONG_VARIABLES) $(SOONG_IN_MAKE) FORCE
+	$(hide) $(SOONG) $(SOONG_BUILD_NINJA) $(NINJA_ARGS)
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index dcc1e18..8b9bdba 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -43,7 +43,7 @@
   # which is the version that we reveal to the end user.
   # Update this value when the platform version changes (rather
   # than overriding it somewhere else).  Can be an arbitrary string.
-  PLATFORM_VERSION := 6.0
+  PLATFORM_VERSION := 6.0.1
 endif
 
 ifeq "" "$(PLATFORM_SDK_VERSION)"
@@ -104,7 +104,7 @@
   # Can be an arbitrary string, but must be a single word.
   #
   # If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-  PLATFORM_SECURITY_PATCH := 2015-10-01
+  PLATFORM_SECURITY_PATCH := 2015-12-01
 endif
 
 ifeq "" "$(PLATFORM_BASE_OS)"
@@ -146,5 +146,5 @@
   # If no BUILD_NUMBER is set, create a useful "I am an engineering build
   # from this date/time" value.  Make it start with a non-digit so that
   # anyone trying to parse it as an integer will probably get "0".
-  BUILD_NUMBER := eng.$(USER).$(shell $(DATE) +%Y%m%d.%H%M%S)
+  BUILD_NUMBER := eng.$(shell echo $${USER:0:6}).$(shell $(DATE) +%Y%m%d.%H%M%S)
 endif
diff --git a/envsetup.sh b/envsetup.sh
index 45f70b3..f266f1a 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -1413,11 +1413,7 @@
     \cd $T/$pathname
 }
 
-# Force JAVA_HOME to point to java 1.7 if it isn't already set.
-#
-# Note that the MacOS path for java 1.7 includes a minor revision number (sigh).
-# For some reason, installing the JDK doesn't make it show up in the
-# JavaVM.framework/Versions/1.7/ folder.
+# Force JAVA_HOME to point to java 1.7/1.8 if it isn't already set.
 function set_java_home() {
     # Clear the existing JAVA_HOME value if we set it ourselves, so that
     # we can reset it later, depending on the version of java the build
@@ -1430,14 +1426,25 @@
     fi
 
     if [ ! "$JAVA_HOME" ]; then
-      case `uname -s` in
-          Darwin)
-              export JAVA_HOME=$(/usr/libexec/java_home -v 1.7)
-              ;;
-          *)
-              export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64
-              ;;
-      esac
+      if [ ! "$EXPERIMENTAL_USE_JAVA8" ]; then
+        case `uname -s` in
+            Darwin)
+                export JAVA_HOME=$(/usr/libexec/java_home -v 1.7)
+                ;;
+            *)
+                export JAVA_HOME=/usr/lib/jvm/java-7-openjdk-amd64
+                ;;
+        esac
+      else
+        case `uname -s` in
+            Darwin)
+                export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
+                ;;
+            *)
+                export JAVA_HOME=/usr/lib/jvm/java-8-openjdk-amd64
+                ;;
+        esac
+      fi
 
       # Keep track of the fact that we set JAVA_HOME ourselves, so that
       # we can change it on the next envsetup.sh, if required.
diff --git a/target/board/generic/sepolicy/domain.te b/target/board/generic/sepolicy/domain.te
index c28ca74..201fa86 100644
--- a/target/board/generic/sepolicy/domain.te
+++ b/target/board/generic/sepolicy/domain.te
@@ -1,3 +1,5 @@
 # For /sys/qemu_trace files in the emulator.
 allow domain sysfs_writable:file rw_file_perms;
 allow domain qemu_device:chr_file rw_file_perms;
+
+get_prop(domain, qemu_prop)
diff --git a/target/board/generic/sepolicy/file_contexts b/target/board/generic/sepolicy/file_contexts
index e626d9d..e704a8e 100644
--- a/target/board/generic/sepolicy/file_contexts
+++ b/target/board/generic/sepolicy/file_contexts
@@ -7,6 +7,6 @@
 /dev/ttyGF[0-9]*             u:object_r:serial_device:s0
 /dev/ttyS2                   u:object_r:console_device:s0
 /system/bin/qemud            u:object_r:qemud_exec:s0
-/sys/qemu_trace(/.*)?   --   u:object_r:sysfs_writable:s0
+/sys/qemu_trace(/.*)?        u:object_r:sysfs_writable:s0
 /system/etc/init.goldfish.sh u:object_r:goldfish_setup_exec:s0
 /system/bin/qemu-props       u:object_r:qemu_props_exec:s0
diff --git a/target/board/generic/sepolicy/goldfish_setup.te b/target/board/generic/sepolicy/goldfish_setup.te
index b472d2a..bce196a 100644
--- a/target/board/generic/sepolicy/goldfish_setup.te
+++ b/target/board/generic/sepolicy/goldfish_setup.te
@@ -13,6 +13,8 @@
 allow goldfish_setup self:capability { net_admin net_raw };
 allow goldfish_setup self:udp_socket create_socket_perms;
 
+net_domain(goldfish_setup)
+
 # Set net.eth0.dns*, debug.sf.nobootanimation
 set_prop(goldfish_setup, system_prop)
 set_prop(goldfish_setup, debug_prop)
diff --git a/target/board/generic/sepolicy/netd.te b/target/board/generic/sepolicy/netd.te
new file mode 100644
index 0000000..2b002ec
--- /dev/null
+++ b/target/board/generic/sepolicy/netd.te
@@ -0,0 +1 @@
+dontaudit netd self:capability sys_module;
diff --git a/target/board/generic_mips/BoardConfig.mk b/target/board/generic_mips/BoardConfig.mk
index 76a2ef4..50924f8 100644
--- a/target/board/generic_mips/BoardConfig.mk
+++ b/target/board/generic_mips/BoardConfig.mk
@@ -61,3 +61,5 @@
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
 
 BOARD_SEPOLICY_DIRS += build/target/board/generic/sepolicy
+
+USE_CLANG_PLATFORM_BUILD := true
diff --git a/target/board/generic_mips64/BoardConfig.mk b/target/board/generic_mips64/BoardConfig.mk
index 8e8a68b..d5430cd 100644
--- a/target/board/generic_mips64/BoardConfig.mk
+++ b/target/board/generic_mips64/BoardConfig.mk
@@ -75,3 +75,5 @@
 BOARD_SEPOLICY_DIRS += build/target/board/generic/sepolicy
 
 DEX_PREOPT_DEFAULT := nostripping
+
+USE_CLANG_PLATFORM_BUILD := true
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 0f92a1c..2428585 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -38,6 +38,7 @@
     libFFTEm \
     libGLESv1_CM \
     libGLESv2 \
+    libGLESv3 \
     libbinder \
     libc \
     libcutils \
diff --git a/tools/Android.mk b/tools/Android.mk
index 30febd6..9073ac3 100644
--- a/tools/Android.mk
+++ b/tools/Android.mk
@@ -16,17 +16,4 @@
 
 LOCAL_PATH := $(call my-dir)
 
-ifeq (,$(TARGET_BUILD_APPS))
-
-ifeq ($(TARGET_BUILD_PDK),true)
-include $(filter-out %/acp/Android.mk %/signapk/Android.mk %/zipalign/Android.mk,\
-  $(call all-makefiles-under,$(LOCAL_PATH)))
-else # !PDK
 include $(call all-makefiles-under,$(LOCAL_PATH))
-endif # PDK
-
-else # TARGET_BUILD_APPS
-
-include $(LOCAL_PATH)/apicheck/Android.mk
-
-endif
diff --git a/tools/droiddoc/templates-sac/assets/css/default.css b/tools/droiddoc/templates-sac/assets/css/default.css
index c349c89..9b1fe5a 100644
--- a/tools/droiddoc/templates-sac/assets/css/default.css
+++ b/tools/droiddoc/templates-sac/assets/css/default.css
@@ -2208,6 +2208,7 @@
 #nav-swap {
   height:30px;
   border-top:1px solid #ccc;
+  display: none;
 }
 #nav-swap a {
   display:inline-block;
@@ -2242,6 +2243,10 @@
   margin-left:0;
 }
 
+#nav-tree, #swapper {
+  display: none;
+}
+
 #nav-tree ul {
   list-style:none;
   padding:0;
@@ -2336,11 +2341,13 @@
   border-bottom: 1px solid #CCC;
   background:#e9e9e9;
   background: rgba(0, 0, 0, 0.05); /* matches #nav li.expanded */
+  display: none;
 
 }
 #api-nav-title {
   padding:0 5px;
   white-space:nowrap;
+  display: none;
 }
 
 #api-level-toggle {
@@ -3580,8 +3587,9 @@
   border-color: #33b5e5;
 }
 
+// Fudging this so SAC looks OK
 .develop #header .wrap {
-  border-color: #F80;
+  border-color: #CCC;
 }
 
 .distribute #header .wrap {
@@ -4568,3 +4576,83 @@
 .annotation-message {
   display: block;
 }
+
+.dac-custom-search {
+  background: #fff;
+  margin: 0 -10px;
+  padding: 20px 10px;
+  z-index: 1;
+}
+
+.dac-custom-search .dac-fab, .dac-custom-search .dac-button-social {
+  top: -48px;
+}
+
+.dac-custom-search-section-title {
+  color: #505050;
+}
+
+.dac-custom-search-entry {
+  margin-bottom: 36px;
+  margin-top: 24px;
+  margin-left: 0em;
+}
+
+.dac-custom-search-image {
+  background-size: cover;
+  height: 112px;
+}
+
+.dac-custom-search-title {
+  color: #333;
+  font-size: 14px;
+  font-weight: 700;
+  line-height: 0px;
+  padding: 0;
+  margin: 1em 0em 1em 0em;
+}
+
+.dac-custom-search-title a {
+  color: inherit;
+}
+
+.dac-custom-search-section {
+  color: #999;
+  font-size: 16px;
+  font-variant: small-caps;
+  font-weight: 700;
+  margin: -5px 0 0 0;
+}
+
+.dac-custom-search-snippet {
+  color: #666;
+  margin: 0em 0em .25em 0em;
+}
+
+.dac-custom-search-link {
+  font-weight: 500;
+  word-wrap: break-word;
+  width: 100%;
+}
+
+.dac-custom-search-load-more {
+  background: none;
+  border: none;
+  color: #333;
+  cursor: pointer;
+  display: block;
+  font-size: 14px;
+  font-weight: 700;
+  margin: 75px auto;
+  outline: none;
+  padding: 10px;
+}
+
+.dac-custom-search-load-more:hover {
+  opacity: 0.7;
+}
+
+.dac-custom-search-no-results {
+  color: #999;
+}
+
diff --git a/tools/droiddoc/templates-sac/assets/js/docs.js b/tools/droiddoc/templates-sac/assets/js/docs.js
index 0c93780..195c9e5 100644
--- a/tools/droiddoc/templates-sac/assets/js/docs.js
+++ b/tools/droiddoc/templates-sac/assets/js/docs.js
@@ -1630,7 +1630,10 @@
             } else {
               // otherwise, results are already showing, so allow ajax to auto refresh the results
               // and ignore this Enter press to avoid the reload.
-              return false;
+              // return false;
+              //
+              // For now, we're not using AJAX so we respond to every Enter.
+              return true;
             }
         } else if (kd && gSelectedIndex >= 0) {
             window.location = $("a",$('#search_filtered li')[gSelectedIndex]).attr("href");
@@ -1691,6 +1694,11 @@
 
 
         // Search for Google matches
+        /*
+         *  Commented this out because GOOGLE_DATA not defined for us and code
+         *  causes an error.  This probably has to do with the missing
+         *  gms_lists.js file in SAC. TODO figure it all out.
+         *
         for (var i=0; i<GOOGLE_DATA.length; i++) {
             var s = GOOGLE_DATA[i];
             if (text.length != 0 &&
@@ -1703,6 +1711,7 @@
         for (var i=0; i<gGoogleMatches.length; i++) {
             var s = gGoogleMatches[i];
         }
+        */
 
         highlight_autocomplete_result_labels(text);
         sync_selection_table(toroot);
@@ -1830,81 +1839,138 @@
   $("#search_autocomplete").val("").blur();
 
   // reset the ajax search callback to nothing, so results don't appear unless ENTER
-  searchControl.setSearchStartingCallback(this, function(control, searcher, query) {});
+  //  searchControl.setSearchStartingCallback(this, function(control, searcher, query) {});
   return false;
 }
 
 
-
 /* ########################################################## */
 /* ################  CUSTOM SEARCH ENGINE  ################## */
 /* ########################################################## */
 
-google.load('search', '1');
-var searchControl;
+// TODO, add localized search.
+function getLangPref() {
+  return "en";
+}
+
+// Package of functions that does custom search, from DAC redesign.
+(function($) {
+  var LANG;
+
+  function getSearchLang() {
+    if (!LANG) {
+      LANG = getLangPref();
+
+      // Fix zh-cn to be zh-CN.
+      LANG = LANG.replace(/-\w+/, function(m) { return m.toUpperCase(); });
+    }
+    return LANG;
+  }
+
+  function customSearch(query, start) {
+    var searchParams = {
+      // Keys for SAC
+      cx:'016258643462168859875:qqpm8fiwgc0',
+      key: 'AIzaSyBOWHD3JAF6Q9LIJ4NiahGAF70W7iDAI9M',
+
+      // Keys for DAC
+      // cx: '000521750095050289010:zpcpi1ea4s8',
+      // key: 'AIzaSyCFhbGnjW06dYwvRCU8h_zjdpS4PYYbEe8',
+
+      q: query,
+      start: start || 1,
+      num: 6,
+      hl: getSearchLang(),
+      fields: 'queries,items(pagemap,link,title,htmlSnippet,formattedUrl)'
+    };
+
+    return $.get('https://content.googleapis.com/customsearch/v1?' +  $.param(searchParams));
+  }
+
+  function renderResults(el, results) {
+    if (!results.items) {
+      el.append($('<div>').text('No results'));
+      return;
+    }
+
+    for (var i = 0; i < results.items.length; i++) {
+      var item = results.items[i];
+      // No thumbnail images in SAC.
+      // var hasImage = item.pagemap && item.pagemap.cse_thumbnail;
+      var sectionMatch = item.link.match(/source\.android\.com\/(\w*)/);
+      var section = (sectionMatch && sectionMatch[1]) || 'blog';
+
+      var entry = $('<div>').addClass('dac-custom-search-entry cols');
+
+// No thumbnail images in SAC.
+//      if (hasImage) {
+//        var image = item.pagemap.cse_thumbnail[0];
+//        entry.append($('<div>').addClass('col-1of6')
+//          .append($('<div>').addClass('dac-custom-search-image').css('background-image', 'url(' + image.src + ')')));
+//      }
+// entry.append($('<div>').addClass(hasImage ? 'col-5of6' : 'col-6of6')
+      entry.append($('<div>')
+        .append($('<p>').addClass('dac-custom-search-section').text(section))
+        .append(
+          $('<a>').text(item.title).attr('href', item.link).wrap('<h2>').parent().addClass('dac-custom-search-title')
+        )
+        .append($('<p>').addClass('dac-custom-search-snippet').html(item.htmlSnippet.replace(/<br>/g, '')))
+        .append($('<a>').addClass('dac-custom-search-link').text(item.formattedUrl).attr('href', item.link)));
+
+      el.append(entry);
+    }
+
+    if (results.queries.nextPage) {
+      var loadMoreButton = $('<button id="dac-custom-search-load-more">')
+        .addClass('dac-custom-search-load-more')
+        .text('Load more')
+        .click(function() {
+          loadMoreResults(el, results);
+        });
+
+      el.append(loadMoreButton);
+    }
+  }
+
+  function loadMoreResults(el, results) {
+    var query = results.queries.request.searchTerms;
+    var start = results.queries.nextPage.startIndex;
+    var loadMoreButton = el.find('#dac-custom-search-load-more');
+
+    loadMoreButton.text('Loading more...');
+
+    customSearch(query, start).then(function(results) {
+      loadMoreButton.remove();
+      renderResults(el, results);
+    });
+  }
+
+  $.fn.customSearch = function(query) {
+    var el = $(this);
+
+    customSearch(query).then(function(results) {
+      el.empty();
+      renderResults(el, results);
+    });
+  };
+})(jQuery);
+
 
 function loadSearchResults() {
-  document.getElementById("search_autocomplete").style.color = "#000";
 
-  // create search control
-  searchControl = new google.search.SearchControl();
-
-  // use our existing search form and use tabs when multiple searchers are used
-  drawOptions = new google.search.DrawOptions();
-  drawOptions.setDrawMode(google.search.SearchControl.DRAW_MODE_TABBED);
-  drawOptions.setInput(document.getElementById("search_autocomplete"));
-
-  // configure search result options
-  searchOptions = new google.search.SearcherOptions();
-  searchOptions.setExpandMode(GSearchControl.EXPAND_MODE_OPEN);
-
-  // Configure s.a.c searchers
-  sacSiteSearcher = new google.search.WebSearch();
-  sacSiteSearcher.setUserDefinedLabel("All");
-  sacSiteSearcher.setSiteRestriction("http://source.android.com/");
-
-  sourceSearcher = new google.search.WebSearch();
-  sourceSearcher.setUserDefinedLabel("Source");
-  sourceSearcher.setSiteRestriction("http://source.android.com/source/");
-
-  devicesSearcher = new google.search.WebSearch();
-  devicesSearcher.setUserDefinedLabel("Devices");
-  devicesSearcher.setSiteRestriction("http://source.android.com/devices/");
-
-  securitySearcher = new google.search.WebSearch();
-  securitySearcher.setUserDefinedLabel("Security");
-  securitySearcher.setSiteRestriction("http://source.android.com/security/");
-
-  compatibilitySearcher = new google.search.WebSearch();
-  compatibilitySearcher.setUserDefinedLabel("Compatibility");
-  compatibilitySearcher.setSiteRestriction("http://source.android.com/compatibility/");
-
-  // add each searcher to the search control
-  searchControl.addSearcher(sacSiteSearcher, searchOptions);
-  searchControl.addSearcher(sourceSearcher, searchOptions);
-  searchControl.addSearcher(devicesSearcher, searchOptions);
-  searchControl.addSearcher(securitySearcher, searchOptions);
-  searchControl.addSearcher(compatibilitySearcher, searchOptions);
+  // Draw the search results box
+  //searchControl.draw(document.getElementById("leftSearchControl"), drawOptions);
+  $(searchResults).append('<div class="leftSearchControl"></div>');
 
 
-  // configure result options
-  searchControl.setResultSetSize(google.search.Search.LARGE_RESULTSET);
-  searchControl.setLinkTarget(google.search.Search.LINK_TARGET_SELF);
-  searchControl.setTimeoutInterval(google.search.SearchControl.TIMEOUT_SHORT);
-  searchControl.setNoResultsString(google.search.SearchControl.NO_RESULTS_DEFAULT_STRING);
-
-  // upon ajax search, refresh the url and search title
-  searchControl.setSearchStartingCallback(this, function(control, searcher, query) {
-    updateResultTitle(query);
-    var query = document.getElementById('search_autocomplete').value;
-    location.hash = 'q=' + query;
-  });
-
-  // draw the search results box
-  searchControl.draw(document.getElementById("leftSearchControl"), drawOptions);
+  // Refresh the url and search title
+  var query = document.getElementById('search_autocomplete').value || getQuery(location.hash);
+  updateResultTitle(query);
+  location.hash = 'q=' + query;
 
   // get query and execute the search
-  searchControl.execute(decodeURI(getQuery(location.hash)));
+  //searchControl.execute(decodeURI(getQuery(location.hash)));
+  $(leftSearchControl).customSearch(getQuery(location.hash));
 
   document.getElementById("search_autocomplete").focus();
   addTabListeners();
@@ -1912,7 +1978,9 @@
 // End of loadSearchResults
 
 google.setOnLoadCallback(function(){
-  if (location.hash.indexOf("q=") == -1) {
+
+  var query = decodeURI(getQuery(location.hash));
+  if (location.hash.indexOf("q=") == -1 || query == '') {
     // if there's no query in the url, don't search and make sure results are hidden
     $('#searchResults').hide();
     return;
@@ -1937,7 +2005,8 @@
 
   // Otherwise, we have a search to do
   var query = decodeURI(getQuery(location.hash));
-  searchControl.execute(query);
+  //searchControl.execute(query);
+  $('#leftSearchControl').customSearch(query);
   $('#searchResults').slideDown('slow');
   $("#search_autocomplete").focus();
   $(".search .close").removeClass("hide");
@@ -1946,7 +2015,10 @@
 });
 
 function updateResultTitle(query) {
-  $("#searchTitle").html("Results for <em>" + escapeHTML(query) + "</em>");
+  $("#searchTitle").html("Results for <em>" + (query) + "</em>");
+// For some reason, the escapeHTML function wasn't working for me.  TODO fix
+// this by copying in a comparable library function.
+//  $("#searchTitle").html("Results for <em>" + escapeHTML(query) + "</em>");
 }
 
 // forcefully regain key-up event control (previously jacked by search api)
@@ -1991,11 +2063,6 @@
 }
 
 
-
-
-
-
-
 /* ######################################################## */
 /* #################  JAVADOC REFERENCE ################### */
 /* ######################################################## */
@@ -2077,7 +2144,9 @@
 
   // get the DOM element and use setAttribute cuz IE6 fails when using jquery .attr('selected',true)
   var selectedLevelItem = $("#apiLevelSelector option[value='"+userApiLevel+"']").get(0);
-  selectedLevelItem.setAttribute('selected',true);
+//  Another piece of functionality that we don't use that produces an error.
+//  TODO figure it all out.
+//  selectedLevelItem.setAttribute('selected',true);
 }
 
 function changeApiLevel() {
diff --git a/tools/droiddoc/templates-sdk/sdkpage.cs b/tools/droiddoc/templates-sdk/sdkpage.cs
index 3a3a9a3..47c2992 100644
--- a/tools/droiddoc/templates-sdk/sdkpage.cs
+++ b/tools/droiddoc/templates-sdk/sdkpage.cs
@@ -353,7 +353,7 @@
   <tr>
     <!-- blank TD from Windows rowspan -->
     <td>
-  <a onclick="return onDownload(this,false,true)"
+  <a onclick="return onDownload(this,false,true)" id="win-bundle-notools"
     href="https://dl.google.com/dl/android/studio/install/<?cs var:studio.version ?>/<?cs var:studio.win_notools_exe_download ?>"
     ><?cs var:studio.win_notools_exe_download ?></a><br>(No SDK tools included)
     </td>
@@ -364,7 +364,7 @@
   <tr>
     <!-- blank TD from Windows rowspan -->
     <td>
-  <a onclick="return onDownload(this,false,true)"
+  <a onclick="return onDownload(this,false,true)" id="win-bundle-zip"
     href="https://dl.google.com/dl/android/studio/ide-zips/<?cs var:studio.version ?>/<?cs var:studio.win_bundle_download ?>"
     ><?cs var:studio.win_bundle_download ?></a>
     </td>
diff --git a/tools/ijar/Android.mk b/tools/ijar/Android.mk
new file mode 100644
index 0000000..8b2a02c
--- /dev/null
+++ b/tools/ijar/Android.mk
@@ -0,0 +1,16 @@
+# Copyright 2015 The Android Open Source Project
+#
+# The rest of files in this directory comes from
+# https://github.com/bazelbuild/bazel/tree/master/third_party/ijar
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_CPP_EXTENSION := .cc
+LOCAL_SRC_FILES := classfile.cc ijar.cc zip.cc
+LOCAL_CFLAGS += -Wall -Werror
+LOCAL_SHARED_LIBRARIES := libz-host
+LOCAL_MODULE := ijar
+# libc++ is not supported for TARGET_BUILD_APPS builds
+LOCAL_CXX_STL := libstdc++
+include $(BUILD_HOST_EXECUTABLE)
diff --git a/tools/ijar/LICENSE b/tools/ijar/LICENSE
new file mode 100644
index 0000000..6b0b127
--- /dev/null
+++ b/tools/ijar/LICENSE
@@ -0,0 +1,203 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/tools/ijar/README.txt b/tools/ijar/README.txt
new file mode 100644
index 0000000..d5a6a0f
--- /dev/null
+++ b/tools/ijar/README.txt
@@ -0,0 +1,120 @@
+
+ijar: A tool for generating interface .jars from normal .jars
+=============================================================
+
+Alan Donovan, 26 May 2007.
+
+Rationale:
+
+  In order to improve the speed of compilation of Java programs in
+  Bazel, the output of build steps is cached.
+
+  This works very nicely for C++ compilation: a compilation unit
+  includes a .cc source file and typically dozens of header files.
+  Header files change relatively infrequently, so the need for a
+  rebuild is usually driven by a change in the .cc file.  Even after
+  syncing a slightly newer version of the tree and doing a rebuild,
+  many hits in the cache are still observed.
+
+  In Java, by contrast, a compilation unit involves a set of .java
+  source files, plus a set of .jar files containing already-compiled
+  JVM .class files.  Class files serve a dual purpose: from the JVM's
+  perspective, they are containers of executable code, but from the
+  compiler's perspective, they are interface definitions.  The problem
+  here is that .jar files are very much more sensitive to change than
+  C++ header files, so even a change that is insignificant to the
+  compiler (such as the addition of a print statement to a method in a
+  prerequisite class) will cause the jar to change, and any code that
+  depends on this jar's interface will be recompiled unnecessarily.
+
+  The purpose of ijar is to produce, from a .jar file, a much smaller,
+  simpler .jar file containing only the parts that are significant for
+  the purposes of compilation.  In other words, an interface .jar
+  file.  By changing ones compilation dependencies to be the interface
+  jar files, unnecessary recompilation is avoided when upstream
+  changes don't affect the interface.
+
+Details:
+
+  ijar is a tool that reads a .jar file and emits a .jar file
+  containing only the parts that are relevant to Java compilation.
+  For example, it throws away:
+
+  - Files whose name does not end in ".class".
+  - All executable method code.
+  - All private methods and fields.
+  - All constants and attributes except the minimal set necessary to
+    describe the class interface.
+  - All debugging information
+    (LineNumberTable, SourceFile, LocalVariableTables attributes).
+
+  It also sets to zero the file modification times in the index of the
+  .jar file.
+
+Implementation:
+
+  ijar is implemented in C++, and runs very quickly.  For example
+  (when optimized) it takes only 530ms to process a 42MB
+  .jar file containing 5878 classe, resulting in an interface .jar
+  file of only 11.4MB in size.  For more usual .jar sizes of a few
+  megabytes, a runtime of 50ms is typical.
+
+  The implementation strategy is to mmap both the input jar and the
+  newly-created _interface.jar, and to scan through the former and
+  emit the latter in a single pass. There are a couple of locations
+  where some kind of "backpatching" is required:
+
+  - in the .zip file format, for each file, the size field precedes
+    the data.  We emit a zero but note its location, generate and emit
+    the stripped classfile, then poke the correct size into the
+    location.
+
+  - for JVM .class files, the header (including the constant table)
+    precedes the body, but cannot be emitted before it because it's
+    not until we emit the body that we know which constants are
+    referenced and which are garbage.  So we emit the body into a
+    temporary buffer, then emit the header to the output jar, followed
+    by the contents of the temp buffer.
+
+  Also note that the zip file format has unnecessary duplication of
+  the index metadata: it has header+data for each file, then another
+  set of (similar) headers at the end.  Rather than save the metadata
+  explicitly in some datastructure, we just record the addresses of
+  the already-emitted zip metadata entries in the output file, and
+  then read from there as necessary.
+
+Notes:
+
+  This code has no dependency except on the STL and on zlib.
+
+  Almost all of the getX/putX/ReadX/WriteX functions in the code
+  advance their first argument pointer, which is passed by reference.
+
+  It's tempting to discard package-private classes and class members.
+  However, this would be incorrect because they are a necessary part
+  of the package interface, as a Java package is often compiled in
+  multiple stages.  For example: in Bazel, both java tests and java
+  code inhabit the same Java package but are compiled separately.
+
+Assumptions:
+
+  We assume that jar files are uncompressed v1.0 zip files (created
+  with 'jar c0f') with a zero general_purpose_bit_flag.
+
+  We assume that javap/javac don't need the correct CRC checksums in
+  the .jar file.
+
+  We assume that it's better simply to abort in the face of unknown
+  input than to risk leaving out something important from the output
+  (although in the case of annotations, it should be safe to ignore
+  ones we don't understand).
+
+TODO:
+  Maybe: ensure a canonical sort order is used for every list (jar
+  entries, class members, attributes, etc.)  This isn't essential
+  because we can assume the compiler is deterministic and the order in
+  the source files changes little.  Also, it would require two passes. :(
+
+  Maybe: delete dynamically-allocated memory.
+
+  Add (a lot) more tests.  Include a test of idempotency.
diff --git a/tools/ijar/classfile.cc b/tools/ijar/classfile.cc
new file mode 100644
index 0000000..e0cf42e
--- /dev/null
+++ b/tools/ijar/classfile.cc
@@ -0,0 +1,1788 @@
+// Copyright 2001,2007 Alan Donovan. All rights reserved.
+//
+// Author: Alan Donovan <adonovan@google.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// classfile.cc -- classfile parsing and stripping.
+//
+
+// TODO(adonovan) don't pass pointers by reference; this is not
+// compatible with Google C++ style.
+
+// See README.txt for details.
+//
+// For definition of JVM class file format, see:
+// Java SE 8 Edition:
+// http://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4
+
+#define __STDC_FORMAT_MACROS 1
+#define __STDC_LIMIT_MACROS 1
+#include <inttypes.h> // for PRIx32
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <set>
+#include <string>
+#include <vector>
+
+#include "common.h"
+
+namespace devtools_ijar {
+
+// See Table 4.3 in JVM Spec.
+enum CONSTANT {
+  CONSTANT_Class              = 7,
+  CONSTANT_FieldRef           = 9,
+  CONSTANT_Methodref          = 10,
+  CONSTANT_Interfacemethodref = 11,
+  CONSTANT_String             = 8,
+  CONSTANT_Integer            = 3,
+  CONSTANT_Float              = 4,
+  CONSTANT_Long               = 5,
+  CONSTANT_Double             = 6,
+  CONSTANT_NameAndType        = 12,
+  CONSTANT_Utf8               = 1,
+  CONSTANT_MethodHandle       = 15,
+  CONSTANT_MethodType         = 16,
+  CONSTANT_InvokeDynamic      = 18
+};
+
+// See Tables 4.1, 4.4, 4.5 in JVM Spec.
+enum ACCESS  {
+  ACC_PUBLIC          = 0x0001,
+  ACC_PRIVATE         = 0x0002,
+  ACC_PROTECTED       = 0x0004,
+  ACC_STATIC          = 0x0008,
+  ACC_FINAL           = 0x0010,
+  ACC_SYNCHRONIZED    = 0x0020,
+  ACC_VOLATILE        = 0x0040,
+  ACC_TRANSIENT       = 0x0080,
+  ACC_INTERFACE       = 0x0200,
+  ACC_ABSTRACT        = 0x0400
+};
+
+// See Table 4.7.20-A in Java 8 JVM Spec.
+enum TARGET_TYPE {
+  // Targets for type parameter declarations (ElementType.TYPE_PARAMETER):
+  CLASS_TYPE_PARAMETER        = 0x00,
+  METHOD_TYPE_PARAMETER       = 0x01,
+
+  // Targets for type uses that may be externally visible in classes and members
+  // (ElementType.TYPE_USE):
+  CLASS_EXTENDS               = 0x10,
+  CLASS_TYPE_PARAMETER_BOUND  = 0x11,
+  METHOD_TYPE_PARAMETER_BOUND = 0x12,
+  FIELD                       = 0x13,
+  METHOD_RETURN               = 0x14,
+  METHOD_RECEIVER             = 0x15,
+  METHOD_FORMAL_PARAMETER     = 0x16,
+  THROWS                      = 0x17,
+
+  // TARGET_TYPE >= 0x40 is reserved for type uses that occur only within code
+  // blocks. Ijar doesn't need to know about these.
+};
+
+struct Constant;
+
+// TODO(adonovan) these globals are unfortunate
+static std::vector<Constant*>        const_pool_in; // input constant pool
+static std::vector<Constant*>        const_pool_out; // output constant_pool
+static std::set<std::string>         used_class_names;
+static Constant *                    class_name;
+
+// Returns the Constant object, given an index into the input constant pool.
+// Note: constant(0) == NULL; this invariant is exploited by the
+// InnerClassesAttribute, inter alia.
+inline Constant *constant(int idx) {
+  if (idx < 0 || (unsigned)idx >= const_pool_in.size()) {
+    fprintf(stderr, "Illegal constant pool index: %d\n", idx);
+    abort();
+  }
+  return const_pool_in[idx];
+}
+
+/**********************************************************************
+ *                                                                    *
+ *                             Constants                              *
+ *                                                                    *
+ **********************************************************************/
+
+// See sec.4.4 of JVM spec.
+struct Constant {
+
+  Constant(u1 tag) :
+      slot_(0),
+      tag_(tag) {}
+
+  virtual ~Constant() {}
+
+  // For UTF-8 string constants, returns the encoded string.
+  // Otherwise, returns an undefined string value suitable for debugging.
+  virtual std::string Display() = 0;
+
+  virtual void Write(u1 *&p) = 0;
+
+  // Called by slot() when a constant has been identified as required
+  // in the output classfile's constant pool.  This is a hook allowing
+  // constants to register their dependency on other constants, by
+  // calling slot() on them in turn.
+  virtual void Keep() {}
+
+  bool Kept() {
+    return slot_ != 0;
+  }
+
+  // Returns the index of this constant in the output class's constant
+  // pool, assigning a slot if not already done.
+  u2 slot() {
+    if (slot_ == 0) {
+      Keep();
+      slot_ = const_pool_out.size(); // BugBot's "narrowing" warning
+                                     // is bogus.  The number of
+                                     // output constants can't exceed
+                                     // the number of input constants.
+      if (slot_ == 0) {
+        fprintf(stderr, "Constant::slot() called before output phase.\n");
+        abort();
+      }
+      const_pool_out.push_back(this);
+      if (tag_ == CONSTANT_Long || tag_ == CONSTANT_Double) {
+        const_pool_out.push_back(NULL);
+      }
+    }
+    return slot_;
+  }
+
+  u2 slot_; // zero => "this constant is unreachable garbage"
+  u1 tag_;
+};
+
+// Extracts class names from a signature and puts them into the global
+// variable used_class_names.
+//
+// desc: the descriptor class names should be extracted from.
+// p: the position where the extraction should tart.
+void ExtractClassNames(const std::string& desc, size_t* p);
+
+// See sec.4.4.1 of JVM spec.
+struct Constant_Class : Constant
+{
+  Constant_Class(u2 name_index) :
+      Constant(CONSTANT_Class),
+      name_index_(name_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, constant(name_index_)->slot());
+  }
+
+  std::string Display() {
+    return constant(name_index_)->Display();
+  }
+
+  void Keep() { constant(name_index_)->slot(); }
+
+  u2 name_index_;
+};
+
+// See sec.4.4.2 of JVM spec.
+struct Constant_FMIref : Constant
+{
+  Constant_FMIref(u1 tag,
+                  u2 class_index,
+                  u2 name_type_index) :
+      Constant(tag),
+      class_index_(class_index),
+      name_type_index_(name_type_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, constant(class_index_)->slot());
+    put_u2be(p, constant(name_type_index_)->slot());
+  }
+
+  std::string Display() {
+    return constant(class_index_)->Display() + "::" +
+        constant(name_type_index_)->Display();
+  }
+
+  void Keep() {
+    constant(class_index_)->slot();
+    constant(name_type_index_)->slot();
+  }
+
+  u2 class_index_;
+  u2 name_type_index_;
+};
+
+// See sec.4.4.3 of JVM spec.
+struct Constant_String : Constant
+{
+  Constant_String(u2 string_index) :
+      Constant(CONSTANT_String),
+      string_index_(string_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, constant(string_index_)->slot());
+  }
+
+  std::string Display() {
+    return "\"" + constant(string_index_)->Display() + "\"";
+  }
+
+  void Keep() { constant(string_index_)->slot(); }
+
+  u2 string_index_;
+};
+
+// See sec.4.4.4 of JVM spec.
+struct Constant_IntegerOrFloat : Constant
+{
+  Constant_IntegerOrFloat(u1 tag, u4 bytes) :
+      Constant(tag),
+      bytes_(bytes) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u4be(p, bytes_);
+  }
+
+  std::string Display() { return "int/float"; }
+
+  u4 bytes_;
+};
+
+// See sec.4.4.5 of JVM spec.
+struct Constant_LongOrDouble : Constant_IntegerOrFloat
+{
+  Constant_LongOrDouble(u1 tag, u4 high_bytes, u4 low_bytes) :
+      Constant_IntegerOrFloat(tag, high_bytes),
+      low_bytes_(low_bytes) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u4be(p, bytes_);
+    put_u4be(p, low_bytes_);
+  }
+
+  std::string Display() { return "long/double"; }
+
+  u4 low_bytes_;
+};
+
+// See sec.4.4.6 of JVM spec.
+struct Constant_NameAndType : Constant
+{
+  Constant_NameAndType(u2 name_index, u2 descr_index) :
+      Constant(CONSTANT_NameAndType),
+      name_index_(name_index),
+      descr_index_(descr_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, constant(name_index_)->slot());
+    put_u2be(p, constant(descr_index_)->slot());
+  }
+
+  std::string Display() {
+    return constant(name_index_)->Display() + "::" +
+        constant(descr_index_)->Display();
+  }
+
+  void Keep() {
+    constant(name_index_)->slot();
+    constant(descr_index_)->slot();
+  }
+
+  u2 name_index_;
+  u2 descr_index_;
+};
+
+// See sec.4.4.7 of JVM spec.
+struct Constant_Utf8 : Constant
+{
+  Constant_Utf8(u4 length, const u1 *utf8) :
+      Constant(CONSTANT_Utf8),
+      length_(length),
+      utf8_(utf8) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, length_);
+    put_n(p, utf8_, length_);
+  }
+
+  std::string Display() {
+    return std::string((const char*) utf8_, length_);
+  }
+
+  u4 length_;
+  const u1 *utf8_;
+};
+
+// See sec.4.4.8 of JVM spec.
+struct Constant_MethodHandle : Constant
+{
+  Constant_MethodHandle(u1 reference_kind, u2 reference_index) :
+      Constant(CONSTANT_MethodHandle),
+      reference_kind_(reference_kind),
+      reference_index_(reference_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u1(p, reference_kind_);
+    put_u2be(p, reference_index_);
+  }
+
+  std::string Display() {
+    return "Constant_MethodHandle::" + std::to_string(reference_kind_) + "::"
+        + constant(reference_index_)->Display();
+  }
+
+  u1 reference_kind_;
+  u2 reference_index_;
+};
+
+// See sec.4.4.9 of JVM spec.
+struct Constant_MethodType : Constant
+{
+  Constant_MethodType(u2 descriptor_index) :
+      Constant(CONSTANT_MethodType),
+      descriptor_index_(descriptor_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, descriptor_index_);
+  }
+
+  std::string Display() {
+    return  "Constant_MethodType::" + constant(descriptor_index_)->Display();
+  }
+
+  u2 descriptor_index_;
+};
+
+// See sec.4.4.10 of JVM spec.
+struct Constant_InvokeDynamic : Constant
+{
+  Constant_InvokeDynamic(u2 bootstrap_method_attr_index, u2 name_and_type_index) :
+      Constant(CONSTANT_InvokeDynamic),
+      bootstrap_method_attr_index_(bootstrap_method_attr_index),
+      name_and_type_index_(name_and_type_index) {}
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, bootstrap_method_attr_index_);
+    put_u2be(p, name_and_type_index_);
+  }
+
+  std::string Display() {
+    return  "Constant_InvokeDynamic::"
+        + std::to_string(bootstrap_method_attr_index_) + "::"
+        + constant(name_and_type_index_)->Display();
+  }
+
+  u2 bootstrap_method_attr_index_;
+  u2 name_and_type_index_;
+};
+
+/**********************************************************************
+ *                                                                    *
+ *                             Attributes                             *
+ *                                                                    *
+ **********************************************************************/
+
+// See sec.4.7 of JVM spec.
+struct Attribute {
+
+  virtual ~Attribute() {}
+  virtual void Write(u1 *&p) = 0;
+  virtual void ExtractClassNames() {}
+
+  void WriteProlog(u1 *&p, u2 length) {
+    put_u2be(p, attribute_name_->slot());
+    put_u4be(p, length);
+  }
+
+  Constant *attribute_name_;
+};
+
+// See sec.4.7.5 of JVM spec.
+struct ExceptionsAttribute : Attribute {
+
+  static ExceptionsAttribute* Read(const u1 *&p, Constant *attribute_name) {
+    ExceptionsAttribute *attr = new ExceptionsAttribute;
+    attr->attribute_name_ = attribute_name;
+    u2 number_of_exceptions = get_u2be(p);
+    for (int ii = 0; ii < number_of_exceptions; ++ii) {
+      attr->exceptions_.push_back(constant(get_u2be(p)));
+    }
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, exceptions_.size() * 2 + 2);
+    put_u2be(p, exceptions_.size());
+    for (size_t ii = 0; ii < exceptions_.size(); ++ii) {
+      put_u2be(p, exceptions_[ii]->slot());
+    }
+  }
+
+  std::vector<Constant*> exceptions_;
+};
+
+// See sec.4.7.6 of JVM spec.
+struct InnerClassesAttribute : Attribute {
+
+  struct Entry {
+    Constant *inner_class_info;
+    Constant *outer_class_info;
+    Constant *inner_name;
+    u2 inner_class_access_flags;
+  };
+
+  virtual ~InnerClassesAttribute() {
+    for (size_t i = 0; i < entries_.size(); i++) {
+      delete entries_[i];
+    }
+  }
+
+  static InnerClassesAttribute* Read(const u1 *&p, Constant *attribute_name) {
+    InnerClassesAttribute *attr = new InnerClassesAttribute;
+    attr->attribute_name_ = attribute_name;
+
+    u2 number_of_classes = get_u2be(p);
+    for (int ii = 0; ii < number_of_classes; ++ii) {
+      Entry *entry = new Entry;
+      entry->inner_class_info = constant(get_u2be(p));
+      entry->outer_class_info = constant(get_u2be(p));
+      entry->inner_name = constant(get_u2be(p));
+      entry->inner_class_access_flags = get_u2be(p);
+
+      attr->entries_.push_back(entry);
+    }
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    std::set<int> kept_entries;
+    // We keep an entry if the constant referring to the inner class is already
+    // kept. Then we mark its outer class and its class name as kept, too, then
+    // iterate until a fixed point is reached.
+    size_t entry_count;
+    int iteration = 0;
+
+    do {
+      entry_count = kept_entries.size();
+      for (size_t i_entry = 0; i_entry < entries_.size(); ++i_entry) {
+        Entry* entry = entries_[i_entry];
+        if (entry->inner_class_info->Kept() ||
+            used_class_names.find(entry->inner_class_info->Display())
+                != used_class_names.end() ||
+            entry->outer_class_info == class_name ||
+            entry->outer_class_info == NULL ||
+            entry->inner_name == NULL) {
+          kept_entries.insert(i_entry);
+
+          // These are zero for anonymous inner classes
+          if (entry->outer_class_info != NULL) {
+            entry->outer_class_info->slot();
+          }
+
+          if (entry->inner_name != NULL) {
+            entry->inner_name->slot();
+          }
+        }
+      }
+      iteration += 1;
+    } while (entry_count != kept_entries.size());
+
+    if (kept_entries.size() == 0) {
+      return;
+    }
+
+    WriteProlog(p, 2 + kept_entries.size() * 8);
+    put_u2be(p, kept_entries.size());
+
+    for (std::set<int>::iterator it = kept_entries.begin();
+         it != kept_entries.end();
+         ++it) {
+      Entry *entry = entries_[*it];
+      put_u2be(p, entry->inner_class_info == NULL
+               ? 0
+               : entry->inner_class_info->slot());
+      put_u2be(p, entry->outer_class_info == NULL
+               ? 0
+               : entry->outer_class_info->slot());
+      put_u2be(p, entry->inner_name == NULL
+               ? 0
+               : entry->inner_name->slot());
+      put_u2be(p, entry->inner_class_access_flags);
+    }
+  }
+
+  std::vector<Entry*> entries_;
+};
+
+// See sec.4.7.7 of JVM spec.
+// We preserve EnclosingMethod attributes to be able to identify local and
+// anonymous classes. These classes will be stripped of most content, as they
+// represent implementation details that shoudn't leak into the ijars. Omitting
+// EnclosingMethod attributes can lead to type-checking failures in the presence
+// of generics (see b/9070939).
+struct EnclosingMethodAttribute : Attribute {
+
+  static EnclosingMethodAttribute* Read(const u1 *&p,
+                                        Constant *attribute_name) {
+    EnclosingMethodAttribute *attr = new EnclosingMethodAttribute;
+    attr->attribute_name_ = attribute_name;
+    attr->class_ = constant(get_u2be(p));
+    attr->method_ = constant(get_u2be(p));
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, 4);
+    put_u2be(p, class_->slot());
+    put_u2be(p, method_ == NULL ? 0 : method_->slot());
+  }
+
+  Constant *class_;
+  Constant *method_;
+};
+
+// See sec.4.7.16.1 of JVM spec.
+// Used by AnnotationDefault and other attributes.
+struct ElementValue {
+  virtual ~ElementValue() {}
+  virtual void Write(u1 *&p) = 0;
+  virtual void ExtractClassNames() {}
+  static ElementValue* Read(const u1 *&p);
+  u1 tag_;
+  u4 length_;
+};
+
+struct BaseTypeElementValue : ElementValue {
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, const_value_->slot());
+  }
+  static BaseTypeElementValue *Read(const u1 *&p) {
+    BaseTypeElementValue *value = new BaseTypeElementValue;
+    value->const_value_ = constant(get_u2be(p));
+    return value;
+  }
+  Constant *const_value_;
+};
+
+struct EnumTypeElementValue : ElementValue {
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, type_name_->slot());
+    put_u2be(p, const_name_->slot());
+  }
+  static EnumTypeElementValue *Read(const u1 *&p) {
+    EnumTypeElementValue *value = new EnumTypeElementValue;
+    value->type_name_ = constant(get_u2be(p));
+    value->const_name_ = constant(get_u2be(p));
+    return value;
+  }
+  Constant *type_name_;
+  Constant *const_name_;
+};
+
+struct ClassTypeElementValue : ElementValue {
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, class_info_->slot());
+  }
+
+  virtual void ExtractClassNames() {
+    size_t idx = 0;
+    devtools_ijar::ExtractClassNames(class_info_->Display(), &idx);
+  }
+
+  static ClassTypeElementValue *Read(const u1 *&p) {
+    ClassTypeElementValue *value = new ClassTypeElementValue;
+    value->class_info_ = constant(get_u2be(p));
+    return value;
+  }
+  Constant *class_info_;
+};
+
+struct ArrayTypeElementValue : ElementValue {
+  virtual ~ArrayTypeElementValue() {
+    for (size_t i = 0; i < values_.size(); i++) {
+      delete values_[i];
+    }
+  }
+
+  virtual void ExtractClassNames() {
+    for (size_t i = 0; i < values_.size(); i++) {
+      values_[i]->ExtractClassNames();
+    }
+  }
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    put_u2be(p, values_.size());
+    for (size_t ii = 0; ii < values_.size(); ++ii) {
+      values_[ii]->Write(p);
+    }
+  }
+  static ArrayTypeElementValue *Read(const u1 *&p) {
+    ArrayTypeElementValue *value = new ArrayTypeElementValue;
+    u2 num_values = get_u2be(p);
+    for (int ii = 0; ii < num_values; ++ii) {
+      value->values_.push_back(ElementValue::Read(p));
+    }
+    return value;
+  }
+  std::vector<ElementValue*> values_;
+};
+
+// See sec.4.7.16 of JVM spec.
+struct Annotation {
+  virtual ~Annotation() {
+    for (size_t i = 0; i < element_value_pairs_.size(); i++) {
+      delete element_value_pairs_[i]->element_value_;
+      delete element_value_pairs_[i];
+    }
+  }
+
+  void ExtractClassNames() {
+    for (size_t i = 0; i < element_value_pairs_.size(); i++) {
+      element_value_pairs_[i]->element_value_->ExtractClassNames();
+    }
+  }
+
+  void Write(u1 *&p) {
+    put_u2be(p, type_->slot());
+    put_u2be(p, element_value_pairs_.size());
+    for (size_t ii = 0; ii < element_value_pairs_.size(); ++ii) {
+      put_u2be(p, element_value_pairs_[ii]->element_name_->slot());
+      element_value_pairs_[ii]->element_value_->Write(p);
+    }
+  }
+  static Annotation *Read(const u1 *&p) {
+    Annotation *value = new Annotation;
+    value->type_ = constant(get_u2be(p));
+    u2 num_element_value_pairs = get_u2be(p);
+    for (int ii = 0; ii < num_element_value_pairs; ++ii) {
+      ElementValuePair *pair = new ElementValuePair;
+      pair->element_name_ = constant(get_u2be(p));
+      pair->element_value_ = ElementValue::Read(p);
+      value->element_value_pairs_.push_back(pair);
+    }
+    return value;
+  }
+  Constant *type_;
+  struct ElementValuePair {
+    Constant *element_name_;
+    ElementValue *element_value_;
+  };
+  std::vector<ElementValuePair*> element_value_pairs_;
+};
+
+// See sec 4.7.20 of Java 8 JVM Spec
+//
+// Each entry in the annotations table represents a single run-time visible
+// annotation on a type used in a declaration or expression. The type_annotation
+// structure has the following format:
+//
+// type_annotation {
+//   u1 target_type;
+//   union {
+//     type_parameter_target;
+//     supertype_target;
+//     type_parameter_bound_target;
+//     empty_target;
+//     method_formal_parameter_target;
+//     throws_target;
+//     localvar_target;
+//     catch_target;
+//     offset_target;
+//     type_argument_target;
+//   } target_info;
+//   type_path target_path;
+//   u2        type_index;
+//   u2        num_element_value_pairs;
+//   {
+//     u2            element_name_index;
+//     element_value value;
+//   }
+//   element_value_pairs[num_element_value_pairs];
+// }
+//
+struct TypeAnnotation {
+  virtual ~TypeAnnotation() {
+    delete target_info_;
+    delete type_path_;
+    delete annotation_;
+  }
+
+  void ExtractClassNames() {
+    annotation_->ExtractClassNames();
+  }
+
+  void Write(u1 *&p) {
+    put_u1(p, target_type_);
+    target_info_->Write(p);
+    type_path_->Write(p);
+    annotation_->Write(p);
+  }
+
+  static TypeAnnotation *Read(const u1 *&p) {
+    TypeAnnotation *value = new TypeAnnotation;
+    value->target_type_ = get_u1(p);
+    value->target_info_ = ReadTargetInfo(p, value->target_type_);
+    value->type_path_ = TypePath::Read(p);
+    value->annotation_ = Annotation::Read(p);
+    return value;
+  }
+
+  struct TargetInfo {
+    virtual ~TargetInfo() {}
+    virtual void Write(u1 *&p) = 0;
+  };
+
+  struct TypeParameterTargetInfo : TargetInfo {
+    void Write(u1 *&p) {
+      put_u1(p, type_parameter_index_);
+    }
+    static TypeParameterTargetInfo *Read(const u1 *&p) {
+      TypeParameterTargetInfo *value = new TypeParameterTargetInfo;
+      value->type_parameter_index_ = get_u1(p);
+      return value;
+    }
+    u1 type_parameter_index_;
+  };
+
+  struct ClassExtendsInfo : TargetInfo {
+    void Write(u1 *&p) {
+      put_u2be(p, supertype_index_);
+    }
+    static ClassExtendsInfo *Read(const u1 *&p) {
+      ClassExtendsInfo *value = new ClassExtendsInfo;
+      value->supertype_index_ = get_u2be(p);
+      return value;
+    }
+    u2 supertype_index_;
+  };
+
+  struct TypeParameterBoundInfo : TargetInfo {
+    void Write(u1 *&p) {
+      put_u1(p, type_parameter_index_);
+      put_u1(p, bound_index_);
+    }
+    static TypeParameterBoundInfo *Read(const u1 *&p) {
+      TypeParameterBoundInfo *value = new TypeParameterBoundInfo;
+      value->type_parameter_index_ = get_u1(p);
+      value->bound_index_ = get_u1(p);
+      return value;
+    }
+    u1 type_parameter_index_;
+    u1 bound_index_;
+  };
+
+  struct EmptyInfo : TargetInfo {
+    void Write(u1 *&) {}
+    static EmptyInfo *Read(const u1 *&) {
+      return new EmptyInfo;
+    }
+  };
+
+  struct MethodFormalParameterInfo : TargetInfo {
+    void Write(u1 *&p) {
+      put_u1(p, method_formal_parameter_index_);
+    }
+    static MethodFormalParameterInfo *Read(const u1 *&p) {
+      MethodFormalParameterInfo *value = new MethodFormalParameterInfo;
+      value->method_formal_parameter_index_ = get_u1(p);
+      return value;
+    }
+    u1 method_formal_parameter_index_;
+  };
+
+  struct ThrowsTypeInfo : TargetInfo {
+    void Write(u1 *&p) {
+      put_u2be(p, throws_type_index_);
+    }
+    static ThrowsTypeInfo *Read(const u1 *&p) {
+      ThrowsTypeInfo *value = new ThrowsTypeInfo;
+      value->throws_type_index_ = get_u2be(p);
+      return value;
+    }
+    u2 throws_type_index_;
+  };
+
+  static TargetInfo *ReadTargetInfo(const u1 *&p, u1 target_type) {
+    switch (target_type) {
+      case CLASS_TYPE_PARAMETER:
+      case METHOD_TYPE_PARAMETER:
+        return TypeParameterTargetInfo::Read(p);
+      case CLASS_EXTENDS:
+        return ClassExtendsInfo::Read(p);
+      case CLASS_TYPE_PARAMETER_BOUND:
+      case METHOD_TYPE_PARAMETER_BOUND:
+        return TypeParameterBoundInfo::Read(p);
+      case FIELD:
+      case METHOD_RETURN:
+      case METHOD_RECEIVER:
+        return new EmptyInfo;
+      case METHOD_FORMAL_PARAMETER:
+        return MethodFormalParameterInfo::Read(p);
+      case THROWS:
+        return ThrowsTypeInfo::Read(p);
+      default:
+        fprintf(stderr, "Illegal type annotation target type: %d\n",
+                target_type);
+        abort();
+    }
+  }
+
+  struct TypePath {
+    void Write(u1 *&p) {
+      put_u1(p, path_.size());
+      for (TypePathEntry entry : path_) {
+        put_u1(p, entry.type_path_kind_);
+        put_u1(p, entry.type_argument_index_);
+      }
+    }
+    static TypePath *Read(const u1 *&p) {
+      TypePath *value = new TypePath;
+      u1 path_length = get_u1(p);
+      for (int ii = 0; ii < path_length; ++ii) {
+        TypePathEntry entry;
+        entry.type_path_kind_ = get_u1(p);
+        entry.type_argument_index_ = get_u1(p);
+        value->path_.push_back(entry);
+      }
+      return value;
+    }
+
+    struct TypePathEntry {
+      u1 type_path_kind_;
+      u1 type_argument_index_;
+    };
+    std::vector<TypePathEntry> path_;
+  };
+
+  u1 target_type_;
+  TargetInfo *target_info_;
+  TypePath *type_path_;
+  Annotation *annotation_;
+};
+
+struct AnnotationTypeElementValue : ElementValue {
+  virtual ~AnnotationTypeElementValue() {
+    delete annotation_;
+  }
+
+  void Write(u1 *&p) {
+    put_u1(p, tag_);
+    annotation_->Write(p);
+  }
+  static AnnotationTypeElementValue *Read(const u1 *&p) {
+    AnnotationTypeElementValue *value = new AnnotationTypeElementValue;
+    value->annotation_ = Annotation::Read(p);
+    return value;
+  }
+
+  Annotation *annotation_;
+};
+
+ElementValue* ElementValue::Read(const u1 *&p) {
+  const u1* start = p;
+  ElementValue *result;
+  u1 tag = get_u1(p);
+  if (tag != 0 && strchr("BCDFIJSZs", (char) tag) != NULL) {
+    result = BaseTypeElementValue::Read(p);
+  } else if ((char) tag == 'e') {
+    result = EnumTypeElementValue::Read(p);
+  } else if ((char) tag == 'c') {
+    result = ClassTypeElementValue::Read(p);
+  } else if ((char) tag == '[') {
+    result = ArrayTypeElementValue::Read(p);
+  } else if ((char) tag == '@') {
+    result = AnnotationTypeElementValue::Read(p);
+  } else {
+    fprintf(stderr, "Illegal element_value::tag: %d\n", tag);
+    abort();
+  }
+  result->tag_ = tag;
+  result->length_ = p - start;
+  return result;
+}
+
+// See sec.4.7.20 of JVM spec.
+// We preserve AnnotationDefault attributes because they are required
+// in order to make use of an annotation in new code.
+struct AnnotationDefaultAttribute : Attribute {
+  virtual ~AnnotationDefaultAttribute() {
+    delete default_value_;
+  }
+
+  static AnnotationDefaultAttribute* Read(const u1 *&p,
+                                          Constant *attribute_name) {
+    AnnotationDefaultAttribute *attr = new AnnotationDefaultAttribute;
+    attr->attribute_name_ = attribute_name;
+    attr->default_value_ = ElementValue::Read(p);
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, default_value_->length_);
+    default_value_->Write(p);
+  }
+
+  virtual void ExtractClassNames() {
+    default_value_->ExtractClassNames();
+  }
+
+  ElementValue *default_value_;
+};
+
+// See sec.4.7.2 of JVM spec.
+// We preserve ConstantValue attributes because they are required for
+// compile-time constant propagation.
+struct ConstantValueAttribute : Attribute {
+
+  static ConstantValueAttribute* Read(const u1 *&p, Constant *attribute_name) {
+    ConstantValueAttribute *attr = new ConstantValueAttribute;
+    attr->attribute_name_ = attribute_name;
+    attr->constantvalue_ = constant(get_u2be(p));
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, 2);
+    put_u2be(p, constantvalue_->slot());
+  }
+
+  Constant *constantvalue_;
+};
+
+// See sec.4.7.9 of JVM spec.
+// We preserve Signature attributes because they are required by the
+// compiler for type-checking of generics.
+struct SignatureAttribute : Attribute {
+
+  static SignatureAttribute* Read(const u1 *&p, Constant *attribute_name) {
+    SignatureAttribute *attr = new SignatureAttribute;
+    attr->attribute_name_ = attribute_name;
+    attr->signature_  = constant(get_u2be(p));
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, 2);
+    put_u2be(p, signature_->slot());
+  }
+
+  virtual void ExtractClassNames() {
+    size_t signature_idx = 0;
+    devtools_ijar::ExtractClassNames(signature_->Display(), &signature_idx);
+  }
+
+  Constant *signature_;
+};
+
+// See sec.4.7.15 of JVM spec.
+// We preserve Deprecated attributes because they are required by the
+// compiler to generate warning messages.
+struct DeprecatedAttribute : Attribute {
+
+  static DeprecatedAttribute* Read(const u1 *&, Constant *attribute_name) {
+    DeprecatedAttribute *attr = new DeprecatedAttribute;
+    attr->attribute_name_ = attribute_name;
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, 0);
+  }
+};
+
+// See sec.4.7.16-17 of JVM spec v3.  Includes RuntimeVisible and
+// RuntimeInvisible.
+//
+// We preserve all annotations.
+struct AnnotationsAttribute : Attribute {
+  virtual ~AnnotationsAttribute() {
+    for (size_t i = 0; i < annotations_.size(); i++) {
+      delete annotations_[i];
+    }
+  }
+
+  static AnnotationsAttribute* Read(const u1 *&p, Constant *attribute_name) {
+    AnnotationsAttribute *attr = new AnnotationsAttribute;
+    attr->attribute_name_ = attribute_name;
+    u2 num_annotations = get_u2be(p);
+    for (int ii = 0; ii < num_annotations; ++ii) {
+      Annotation *annotation = Annotation::Read(p);
+      attr->annotations_.push_back(annotation);
+    }
+    return attr;
+  }
+
+  virtual void ExtractClassNames() {
+    for (size_t i = 0; i < annotations_.size(); i++) {
+      annotations_[i]->ExtractClassNames();
+    }
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, -1);
+    u1 *payload_start = p - 4;
+    put_u2be(p, annotations_.size());
+    for (size_t ii = 0; ii < annotations_.size(); ++ii) {
+      annotations_[ii]->Write(p);
+    }
+    put_u4be(payload_start, p - 4 - payload_start);  // backpatch length
+  }
+
+  std::vector<Annotation*> annotations_;
+};
+
+// See sec.4.7.18-19 of JVM spec.  Includes RuntimeVisible and
+// RuntimeInvisible.
+//
+// We preserve all annotations.
+struct ParameterAnnotationsAttribute : Attribute {
+
+  static ParameterAnnotationsAttribute* Read(const u1 *&p,
+                                             Constant *attribute_name) {
+    ParameterAnnotationsAttribute *attr = new ParameterAnnotationsAttribute;
+    attr->attribute_name_ = attribute_name;
+    u1 num_parameters = get_u1(p);
+    for (int ii = 0; ii < num_parameters; ++ii) {
+      std::vector<Annotation*> annotations;
+      u2 num_annotations = get_u2be(p);
+      for (int ii = 0; ii < num_annotations; ++ii) {
+        Annotation *annotation = Annotation::Read(p);
+        annotations.push_back(annotation);
+      }
+      attr->parameter_annotations_.push_back(annotations);
+    }
+    return attr;
+  }
+
+  virtual void ExtractClassNames() {
+    for (size_t i = 0; i < parameter_annotations_.size(); i++) {
+      const std::vector<Annotation*>& annotations = parameter_annotations_[i];
+      for (size_t j = 0; j < annotations.size(); j++) {
+        annotations[j]->ExtractClassNames();
+      }
+    }
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, -1);
+    u1 *payload_start = p - 4;
+    put_u1(p, parameter_annotations_.size());
+    for (size_t ii = 0; ii < parameter_annotations_.size(); ++ii) {
+      std::vector<Annotation *> &annotations = parameter_annotations_[ii];
+      put_u2be(p, annotations.size());
+      for (size_t jj = 0; jj < annotations.size(); ++jj) {
+        annotations[jj]->Write(p);
+      }
+    }
+    put_u4be(payload_start, p - 4 - payload_start);  // backpatch length
+  }
+
+  std::vector<std::vector<Annotation*> > parameter_annotations_;
+};
+
+// See sec.4.7.20 of Java 8 JVM spec. Includes RuntimeVisibleTypeAnnotations
+// and RuntimeInvisibleTypeAnnotations.
+struct TypeAnnotationsAttribute : Attribute {
+  static TypeAnnotationsAttribute* Read(const u1 *&p, Constant *attribute_name,
+                                        u4) {
+    auto attr = new TypeAnnotationsAttribute;
+    attr->attribute_name_ = attribute_name;
+    u2 num_annotations = get_u2be(p);
+    for (int ii = 0; ii < num_annotations; ++ii) {
+      TypeAnnotation *annotation = TypeAnnotation::Read(p);
+      attr->type_annotations_.push_back(annotation);
+    }
+    return attr;
+  }
+
+  virtual void ExtractClassNames() {
+    for (size_t i = 0; i < type_annotations_.size(); i++) {
+      type_annotations_[i]->ExtractClassNames();
+    }
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, -1);
+    u1 *payload_start = p - 4;
+    put_u2be(p, type_annotations_.size());
+    for (TypeAnnotation *annotation : type_annotations_) {
+      annotation->Write(p);
+    }
+    put_u4be(payload_start, p - 4 - payload_start);  // backpatch length
+  }
+
+  std::vector<TypeAnnotation*> type_annotations_;
+};
+
+struct GeneralAttribute : Attribute {
+  static GeneralAttribute* Read(const u1 *&p, Constant *attribute_name,
+                                u4 attribute_length) {
+    auto attr = new GeneralAttribute;
+    attr->attribute_name_ = attribute_name;
+    attr->attribute_length_ = attribute_length;
+    attr->attribute_content_ = p;
+    p += attribute_length;
+    return attr;
+  }
+
+  void Write(u1 *&p) {
+    WriteProlog(p, attribute_length_);
+    put_n(p, attribute_content_, attribute_length_);
+  }
+
+  u4 attribute_length_;
+  const u1 *attribute_content_;
+};
+
+/**********************************************************************
+ *                                                                    *
+ *                             ClassFile                              *
+ *                                                                    *
+ **********************************************************************/
+
+struct HasAttrs {
+  std::vector<Attribute*> attributes;
+
+  void WriteAttrs(u1 *&p);
+  void ReadAttrs(const u1 *&p);
+
+  virtual ~HasAttrs() {
+    for (size_t i = 0; i < attributes.size(); i++) {
+      delete attributes[i];
+    }
+  }
+
+  void ExtractClassNames() {
+    for (size_t i = 0; i < attributes.size(); i++) {
+      attributes[i]->ExtractClassNames();
+    }
+  }
+};
+
+// A field or method.
+// See sec.4.5 and 4.6 of JVM spec.
+struct Member : HasAttrs {
+  u2 access_flags;
+  Constant *name;
+  Constant *descriptor;
+
+  static Member* Read(const u1 *&p) {
+    Member *m = new Member;
+    m->access_flags = get_u2be(p);
+    m->name = constant(get_u2be(p));
+    m->descriptor = constant(get_u2be(p));
+    m->ReadAttrs(p);
+    return m;
+  }
+
+  void Write(u1 *&p) {
+    put_u2be(p, access_flags);
+    put_u2be(p, name->slot());
+    put_u2be(p, descriptor->slot());
+    WriteAttrs(p);
+  }
+};
+
+// See sec.4.1 of JVM spec.
+struct ClassFile : HasAttrs {
+
+  size_t length;
+
+  // Header:
+  u4 magic;
+  u2 major;
+  u2 minor;
+
+  // Body:
+  u2 access_flags;
+  Constant *this_class;
+  Constant *super_class;
+  std::vector<Constant*> interfaces;
+  std::vector<Member*> fields;
+  std::vector<Member*> methods;
+
+  virtual ~ClassFile() {
+    for (size_t i = 0; i < fields.size(); i++) {
+      delete fields[i];
+    }
+
+    for (size_t i = 0; i < methods.size(); i++) {
+      delete methods[i];
+    }
+
+    // Constants do not need to be deleted; they are owned by the constant pool.
+  }
+
+  void WriteClass(u1 *&p);
+
+  bool ReadConstantPool(const u1 *&p);
+
+  void StripIfAnonymous();
+
+  void WriteHeader(u1 *&p) {
+    put_u4be(p, magic);
+    put_u2be(p, major);
+    put_u2be(p, minor);
+
+    put_u2be(p, const_pool_out.size());
+    for (u2 ii = 1; ii < const_pool_out.size(); ++ii) {
+      if (const_pool_out[ii] != NULL) { // NB: NULLs appear after long/double.
+        const_pool_out[ii]->Write(p);
+      }
+    }
+  }
+
+  void WriteBody(u1 *&p) {
+    put_u2be(p, access_flags);
+    put_u2be(p, this_class->slot());
+    put_u2be(p, super_class == NULL ? 0 : super_class->slot());
+    put_u2be(p, interfaces.size());
+    for (size_t ii = 0; ii < interfaces.size(); ++ii) {
+      put_u2be(p, interfaces[ii]->slot());
+    }
+    put_u2be(p, fields.size());
+    for (size_t ii = 0; ii < fields.size(); ++ii) {
+      fields[ii]->Write(p);
+    }
+    put_u2be(p, methods.size());
+    for (size_t ii = 0; ii < methods.size(); ++ii) {
+      methods[ii]->Write(p);
+    }
+
+    Attribute* inner_classes = NULL;
+
+    // Make the inner classes attribute the last, so that it can know which
+    // constants were needed
+    for (size_t ii = 0; ii < attributes.size(); ii++) {
+      if (attributes[ii]->attribute_name_->Display() == "InnerClasses") {
+        inner_classes = attributes[ii];
+        attributes.erase(attributes.begin() + ii);
+        break;
+      }
+    }
+
+    if (inner_classes != NULL) {
+      attributes.push_back(inner_classes);
+    }
+
+    WriteAttrs(p);
+  }
+
+};
+
+void HasAttrs::ReadAttrs(const u1 *&p) {
+  u2 attributes_count = get_u2be(p);
+  for (int ii = 0; ii < attributes_count; ii++) {
+    Constant *attribute_name = constant(get_u2be(p));
+    u4 attribute_length = get_u4be(p);
+
+    std::string attr_name = attribute_name->Display();
+    if (attr_name == "SourceFile" ||
+        attr_name == "LineNumberTable" ||
+        attr_name == "LocalVariableTable" ||
+        attr_name == "LocalVariableTypeTable" ||
+        attr_name == "Code" ||
+        attr_name == "Synthetic" ||
+        attr_name == "BootstrapMethods") {
+      p += attribute_length; // drop these attributes
+    } else if (attr_name == "Exceptions") {
+      attributes.push_back(ExceptionsAttribute::Read(p, attribute_name));
+    } else if (attr_name == "Signature") {
+      attributes.push_back(SignatureAttribute::Read(p, attribute_name));
+    } else if (attr_name == "Deprecated") {
+      attributes.push_back(DeprecatedAttribute::Read(p, attribute_name));
+    } else if (attr_name == "EnclosingMethod") {
+      attributes.push_back(EnclosingMethodAttribute::Read(p, attribute_name));
+    } else if (attr_name == "InnerClasses") {
+      // TODO(bazel-team): omit private inner classes
+      attributes.push_back(InnerClassesAttribute::Read(p, attribute_name));
+    } else if (attr_name == "AnnotationDefault") {
+      attributes.push_back(AnnotationDefaultAttribute::Read(p, attribute_name));
+    } else if (attr_name == "ConstantValue") {
+      attributes.push_back(ConstantValueAttribute::Read(p, attribute_name));
+    } else if (attr_name == "RuntimeVisibleAnnotations" ||
+               attr_name == "RuntimeInvisibleAnnotations") {
+      attributes.push_back(AnnotationsAttribute::Read(p, attribute_name));
+    } else if (attr_name == "RuntimeVisibleParameterAnnotations" ||
+               attr_name == "RuntimeInvisibleParameterAnnotations") {
+      attributes.push_back(
+          ParameterAnnotationsAttribute::Read(p, attribute_name));
+    } else if (attr_name == "Scala" ||
+               attr_name == "ScalaSig" ||
+               attr_name == "ScalaInlineInfo") {
+      // These are opaque blobs, so can be handled with a general
+      // attribute handler
+      attributes.push_back(GeneralAttribute::Read(p, attribute_name,
+                                                  attribute_length));
+    } else if (attr_name == "RuntimeVisibleTypeAnnotations" ||
+               attr_name == "RuntimeInvisibleTypeAnnotations") {
+      // JSR 308: annotations on types. JDK 7 has no use for these yet, but the
+      // Checkers Framework relies on them.
+      attributes.push_back(TypeAnnotationsAttribute::Read(p, attribute_name,
+                                                          attribute_length));
+    } else {
+      // Skip over unknown attributes with a warning.  The JVM spec
+      // says this is ok, so long as we handle the mandatory attributes.
+      fprintf(stderr, "ijar: skipping unknown attribute: \"%s\".\n",
+              attr_name.c_str());
+      p += attribute_length;
+    }
+  }
+}
+
+void HasAttrs::WriteAttrs(u1 *&p) {
+  u1* p_size = p;
+
+  put_u2be(p, 0);
+  int n_written_attrs = 0;
+  for (size_t ii = 0; ii < attributes.size(); ii++) {
+    u1* before = p;
+    attributes[ii]->Write(p);
+    if (p != before) {
+      n_written_attrs++;
+    }
+  }
+
+  put_u2be(p_size, n_written_attrs);
+}
+
+// See sec.4.4 of JVM spec.
+bool ClassFile::ReadConstantPool(const u1 *&p) {
+
+  const_pool_in.clear();
+  const_pool_in.push_back(NULL); // dummy first item
+
+  u2 cp_count = get_u2be(p);
+  for (int ii = 1; ii < cp_count; ++ii) {
+    u1 tag = get_u1(p);
+
+    if (devtools_ijar::verbose) {
+      fprintf(stderr, "cp[%d/%d] = tag %d\n", ii, cp_count, tag);
+    }
+
+    switch(tag) {
+      case CONSTANT_Class: {
+        u2 name_index = get_u2be(p);
+        const_pool_in.push_back(new Constant_Class(name_index));
+        break;
+      }
+      case CONSTANT_FieldRef:
+      case CONSTANT_Methodref:
+      case CONSTANT_Interfacemethodref: {
+        u2 class_index = get_u2be(p);
+        u2 nti = get_u2be(p);
+        const_pool_in.push_back(new Constant_FMIref(tag, class_index, nti));
+        break;
+      }
+      case CONSTANT_String: {
+        u2 string_index = get_u2be(p);
+        const_pool_in.push_back(new Constant_String(string_index));
+        break;
+      }
+      case CONSTANT_NameAndType: {
+        u2 name_index = get_u2be(p);
+        u2 descriptor_index = get_u2be(p);
+        const_pool_in.push_back(
+            new Constant_NameAndType(name_index, descriptor_index));
+        break;
+      }
+      case CONSTANT_Utf8: {
+        u2 length = get_u2be(p);
+        if (devtools_ijar::verbose) {
+          fprintf(stderr, "Utf8: \"%s\" (%d)\n",
+                  std::string((const char*) p, length).c_str(), length);
+        }
+
+        const_pool_in.push_back(new Constant_Utf8(length, p));
+        p += length;
+        break;
+      }
+      case CONSTANT_Integer:
+      case CONSTANT_Float: {
+        u4 bytes = get_u4be(p);
+        const_pool_in.push_back(new Constant_IntegerOrFloat(tag, bytes));
+        break;
+      }
+      case CONSTANT_Long:
+      case CONSTANT_Double: {
+        u4 high_bytes = get_u4be(p);
+        u4 low_bytes = get_u4be(p);
+        const_pool_in.push_back(
+            new Constant_LongOrDouble(tag, high_bytes, low_bytes));
+        // Longs and doubles occupy two constant pool slots.
+        // ("In retrospect, making 8-byte constants take two "constant
+        // pool entries was a poor choice." --JVM Spec.)
+        const_pool_in.push_back(NULL);
+        ii++;
+        break;
+      }
+      case CONSTANT_MethodHandle: {
+        u1 reference_kind = get_u1(p);
+        u2 reference_index = get_u2be(p);
+        const_pool_in.push_back(
+            new Constant_MethodHandle(reference_kind, reference_index));
+        break;
+      }
+      case CONSTANT_MethodType: {
+        u2 descriptor_index = get_u2be(p);
+        const_pool_in.push_back(new Constant_MethodType(descriptor_index));
+        break;
+      }
+      case CONSTANT_InvokeDynamic: {
+        u2 bootstrap_method_attr = get_u2be(p);
+        u2 name_name_type_index = get_u2be(p);
+        const_pool_in.push_back(new Constant_InvokeDynamic(
+            bootstrap_method_attr, name_name_type_index));
+        break;
+      }
+      default: {
+        fprintf(stderr, "Unknown constant: %02x. Passing class through.\n",
+                tag);
+        return false;
+      }
+    }
+  }
+
+  return true;
+}
+
+// Anonymous inner classes are stripped to opaque classes that only extend
+// Object. None of their methods or fields are accessible anyway.
+void ClassFile::StripIfAnonymous() {
+  int enclosing_index = -1;
+  int inner_classes_index = -1;
+
+  for (size_t ii = 0; ii < attributes.size(); ++ii) {
+    if (attributes[ii]->attribute_name_->Display() == "EnclosingMethod") {
+      enclosing_index = ii;
+    } else if (attributes[ii]->attribute_name_->Display() == "InnerClasses") {
+      inner_classes_index = ii;
+    }
+  }
+
+  // Presence of an EnclosingMethod attribute indicates a local or anonymous
+  // class, which can be stripped.
+  if (enclosing_index > -1) {
+    // Clear the signature to only extend java.lang.Object.
+    super_class = NULL;
+    interfaces.clear();
+
+    // Clear away all fields (implementation details).
+    for (size_t ii = 0; ii < fields.size(); ++ii) {
+      delete fields[ii];
+    }
+    fields.clear();
+
+    // Clear away all methods (implementation details).
+    for (size_t ii = 0; ii < methods.size(); ++ii) {
+      delete methods[ii];
+    }
+    methods.clear();
+
+    // Only preserve the InnerClasses attribute to comply with the spec.
+    Attribute *attr = NULL;
+    for (size_t ii = 0; ii < attributes.size(); ++ii) {
+      if (static_cast<int>(ii) != inner_classes_index) {
+        delete attributes[ii];
+      } else {
+        attr = attributes[ii];
+      }
+    }
+    attributes.clear();
+    if (attr != NULL) {
+      attributes.push_back(attr);
+    }
+  }
+}
+
+static ClassFile *ReadClass(const void *classdata, size_t length) {
+  const u1 *p = (u1*) classdata;
+
+  ClassFile *clazz = new ClassFile;
+
+  clazz->length = length;
+
+  clazz->magic = get_u4be(p);
+  if (clazz->magic != 0xCAFEBABE) {
+    fprintf(stderr, "Bad magic %" PRIx32 "\n", clazz->magic);
+    abort();
+  }
+  clazz->major = get_u2be(p);
+  clazz->minor = get_u2be(p);
+
+  if (!clazz->ReadConstantPool(p)) {
+    delete clazz;
+    return NULL;
+  }
+
+  clazz->access_flags = get_u2be(p);
+  clazz->this_class = constant(get_u2be(p));
+  class_name = clazz->this_class;
+
+  u2 super_class_id = get_u2be(p);
+  clazz->super_class = super_class_id == 0 ? NULL : constant(super_class_id);
+
+  u2 interfaces_count = get_u2be(p);
+  for (int ii = 0; ii < interfaces_count; ++ii) {
+    clazz->interfaces.push_back(constant(get_u2be(p)));
+  }
+
+  u2 fields_count = get_u2be(p);
+  for (int ii = 0; ii < fields_count; ++ii) {
+    Member *field = Member::Read(p);
+
+    if (!(field->access_flags & ACC_PRIVATE)) { // drop private fields
+      clazz->fields.push_back(field);
+    }
+  }
+
+  u2 methods_count = get_u2be(p);
+  for (int ii = 0; ii < methods_count; ++ii) {
+    Member *method = Member::Read(p);
+
+    // drop class initializers
+    if (method->name->Display() == "<clinit>") continue;
+
+    if (!(method->access_flags & ACC_PRIVATE)) { // drop private methods
+      clazz->methods.push_back(method);
+    }
+  }
+
+  clazz->ReadAttrs(p);
+  clazz->StripIfAnonymous();
+
+  return clazz;
+}
+
+// In theory, '/' is also reserved, but it's okay if we just parse package
+// identifiers as part of the class name. Note that signatures are UTF-8, but
+// this works just as well as in plain ASCII.
+static const char *SIGNATURE_NON_IDENTIFIER_CHARS = ".;[<>:";
+
+void Expect(const std::string& desc, size_t* p, char expected) {
+  if (desc[*p] != expected) {
+    fprintf(stderr, "Expected '%c' in '%s' at %zd in signature\n",
+            expected, desc.substr(*p).c_str(), *p);
+    exit(1);
+  }
+
+  *p += 1;
+}
+
+// These functions form a crude recursive descent parser for descriptors and
+// signatures in class files (see JVM spec 4.3).
+//
+// This parser is a bit more liberal than the spec, but this should be fine,
+// because it accepts all valid class files and croaks only on invalid ones.
+void ParseFromClassTypeSignature(const std::string& desc, size_t* p);
+void ParseSimpleClassTypeSignature(const std::string& desc, size_t* p);
+void ParseClassTypeSignatureSuffix(const std::string& desc, size_t* p);
+void ParseIdentifier(const std::string& desc, size_t* p);
+void ParseTypeArgumentsOpt(const std::string& desc, size_t* p);
+void ParseMethodDescriptor(const std::string& desc, size_t* p);
+
+void ParseClassTypeSignature(const std::string& desc, size_t* p) {
+  Expect(desc, p, 'L');
+  ParseSimpleClassTypeSignature(desc, p);
+  ParseClassTypeSignatureSuffix(desc, p);
+  Expect(desc, p, ';');
+}
+
+void ParseSimpleClassTypeSignature(const std::string& desc, size_t* p) {
+  ParseIdentifier(desc, p);
+  ParseTypeArgumentsOpt(desc, p);
+}
+
+void ParseClassTypeSignatureSuffix(const std::string& desc, size_t* p) {
+  while (desc[*p] == '.') {
+    *p += 1;
+    ParseSimpleClassTypeSignature(desc, p);
+  }
+}
+
+void ParseIdentifier(const std::string& desc, size_t* p) {
+  size_t next = desc.find_first_of(SIGNATURE_NON_IDENTIFIER_CHARS, *p);
+  std::string id = desc.substr(*p, next - *p);
+  used_class_names.insert(id);
+  *p = next;
+}
+
+void ParseTypeArgumentsOpt(const std::string& desc, size_t* p) {
+  if (desc[*p] != '<') {
+    return;
+  }
+
+  *p += 1;
+  while (desc[*p] != '>') {
+    switch (desc[*p]) {
+      case '*':
+        *p += 1;
+        break;
+
+      case '+':
+      case '-':
+        *p += 1;
+        ExtractClassNames(desc, p);
+        break;
+
+      default:
+        ExtractClassNames(desc, p);
+        break;
+    }
+  }
+
+  *p += 1;
+}
+
+void ParseMethodDescriptor(const std::string& desc, size_t* p) {
+  Expect(desc, p, '(');
+  while (desc[*p] != ')') {
+    ExtractClassNames(desc, p);
+  }
+
+  Expect(desc, p, ')');
+  ExtractClassNames(desc, p);
+}
+
+void ParseFormalTypeParameters(const std::string& desc, size_t* p) {
+  Expect(desc, p, '<');
+  while (desc[*p] != '>') {
+    ParseIdentifier(desc, p);
+    Expect(desc, p, ':');
+    if (desc[*p] != ':' && desc[*p] != '>') {
+      ExtractClassNames(desc, p);
+    }
+
+    while (desc[*p] == ':') {
+      Expect(desc, p, ':');
+      ExtractClassNames(desc, p);
+    }
+  }
+
+  Expect(desc, p, '>');
+}
+
+void ExtractClassNames(const std::string& desc, size_t* p) {
+  switch (desc[*p]) {
+    case '<':
+      ParseFormalTypeParameters(desc, p);
+      ExtractClassNames(desc, p);
+      break;
+
+    case 'L':
+      ParseClassTypeSignature(desc, p);
+      break;
+
+    case '[':
+      *p += 1;
+      ExtractClassNames(desc, p);
+      break;
+
+    case 'T':
+      *p += 1;
+      ParseIdentifier(desc, p);
+      Expect(desc, p, ';');
+      break;
+
+    case '(':
+      ParseMethodDescriptor(desc, p);
+      break;
+
+    case 'B':
+    case 'C':
+    case 'D':
+    case 'F':
+    case 'I':
+    case 'J':
+    case 'S':
+    case 'Z':
+    case 'V':
+      *p += 1;
+      break;
+
+    default:
+      fprintf(stderr, "Invalid signature %s\n", desc.substr(*p).c_str());
+  }
+}
+
+void ClassFile::WriteClass(u1 *&p) {
+  used_class_names.clear();
+  std::vector<Member *> members;
+  members.insert(members.end(), fields.begin(), fields.end());
+  members.insert(members.end(), methods.begin(), methods.end());
+  ExtractClassNames();
+  for (size_t i = 0; i < members.size(); i++) {
+    Member *member = members[i];
+    size_t idx = 0;
+    devtools_ijar::ExtractClassNames(member->descriptor->Display(), &idx);
+    member->ExtractClassNames();
+  }
+
+  // We have to write the body out before the header in order to reference
+  // the essential constants and populate the output constant pool:
+  u1 *body = new u1[length];
+  u1 *q = body;
+  WriteBody(q); // advances q
+  u4 body_length = q - body;
+
+  WriteHeader(p); // advances p
+  put_n(p, body, body_length);
+  delete[] body;
+}
+
+
+void StripClass(u1 *&classdata_out, const u1 *classdata_in, size_t in_length) {
+  ClassFile *clazz = ReadClass(classdata_in, in_length);
+  if (clazz == NULL) {
+    // Class is invalid. Simply copy it to the output and call it a day.
+    put_n(classdata_out, classdata_in, in_length);
+  } else {
+
+    // Constant pool item zero is a dummy entry.  Setting it marks the
+    // beginning of the output phase; calls to Constant::slot() will
+    // fail if called prior to this.
+    const_pool_out.push_back(NULL);
+    clazz->WriteClass(classdata_out);
+
+    delete clazz;
+  }
+
+  // Now clean up all the mess we left behind.
+
+  for (size_t i = 0; i < const_pool_in.size(); i++) {
+    delete const_pool_in[i];
+  }
+
+  const_pool_in.clear();
+  const_pool_out.clear();
+}
+
+}  // namespace devtools_ijar
diff --git a/tools/ijar/common.h b/tools/ijar/common.h
new file mode 100644
index 0000000..118041b
--- /dev/null
+++ b/tools/ijar/common.h
@@ -0,0 +1,102 @@
+// Copyright 2001,2007 Alan Donovan. All rights reserved.
+//
+// Author: Alan Donovan <adonovan@google.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// common.h -- common definitions.
+//
+
+#ifndef INCLUDED_DEVTOOLS_IJAR_COMMON_H
+#define INCLUDED_DEVTOOLS_IJAR_COMMON_H
+
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+
+namespace devtools_ijar {
+
+typedef unsigned long long u8;
+typedef uint32_t u4;
+typedef uint16_t u2;
+typedef uint8_t  u1;
+
+// be = big endian, le = little endian
+
+inline u1 get_u1(const u1 *&p) {
+    return *p++;
+}
+
+inline u2 get_u2be(const u1 *&p) {
+    u4 x = (p[0] << 8) | p[1];
+    p += 2;
+    return x;
+}
+
+inline u2 get_u2le(const u1 *&p) {
+    u4 x = (p[1] << 8) | p[0];
+    p += 2;
+    return x;
+}
+
+inline u4 get_u4be(const u1 *&p) {
+    u4 x = (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
+    p += 4;
+    return x;
+}
+
+inline u4 get_u4le(const u1 *&p) {
+    u4 x = (p[3] << 24) | (p[2] << 16) | (p[1] << 8) | p[0];
+    p += 4;
+    return x;
+}
+
+inline void put_u1(u1 *&p, u1 x) {
+    *p++ = x;
+}
+
+inline void put_u2be(u1 *&p, u2 x) {
+    *p++ = x >> 8;
+    *p++ = x & 0xff;
+}
+
+inline void put_u2le(u1 *&p, u2 x) {
+    *p++ = x & 0xff;
+    *p++ = x >> 8;;
+}
+
+inline void put_u4be(u1 *&p, u4 x) {
+    *p++ = x >> 24;
+    *p++ = (x >> 16) & 0xff;
+    *p++ = (x >> 8) & 0xff;
+    *p++ = x & 0xff;
+}
+
+inline void put_u4le(u1 *&p, u4 x) {
+    *p++ = x & 0xff;
+    *p++ = (x >> 8) & 0xff;
+    *p++ = (x >> 16) & 0xff;
+    *p++ = x >> 24;
+}
+
+// Copy n bytes from src to p, and advance p.
+inline void put_n(u1 *&p, const u1 *src, size_t n) {
+  memcpy(p, src, n);
+  p += n;
+}
+
+extern bool verbose;
+
+}  // namespace devtools_ijar
+
+#endif // INCLUDED_DEVTOOLS_IJAR_COMMON_H
diff --git a/tools/ijar/ijar.cc b/tools/ijar/ijar.cc
new file mode 100644
index 0000000..1925b48
--- /dev/null
+++ b/tools/ijar/ijar.cc
@@ -0,0 +1,182 @@
+// Copyright 2001,2007 Alan Donovan. All rights reserved.
+//
+// Author: Alan Donovan <adonovan@google.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// ijar.cpp -- .jar -> _interface.jar tool.
+//
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <errno.h>
+#include <memory>
+
+#include "zip.h"
+
+namespace devtools_ijar {
+
+bool verbose = false;
+
+// Reads a JVM class from classdata_in (of the specified length), and
+// writes out a simplified class to classdata_out, advancing the
+// pointer.
+void StripClass(u1 *&classdata_out, const u1 *classdata_in, size_t in_length);
+
+const char* CLASS_EXTENSION = ".class";
+const size_t CLASS_EXTENSION_LENGTH = strlen(CLASS_EXTENSION);
+
+// ZipExtractorProcessor that select only .class file and use
+// StripClass to generate an interface class, storing as a new file
+// in the specified ZipBuilder.
+class JarStripperProcessor : public ZipExtractorProcessor {
+ public:
+  JarStripperProcessor() {}
+  virtual ~JarStripperProcessor() {}
+
+  virtual void Process(const char* filename, const u4 attr,
+                       const u1* data, const size_t size);
+  virtual bool Accept(const char* filename, const u4 attr);
+
+ private:
+  // Not owned by JarStripperProcessor, see SetZipBuilder().
+  ZipBuilder* builder;
+
+ public:
+  // Set the ZipBuilder to add the ijar class to the output zip file.
+  // This pointer should not be deleted while this class is still in use and
+  // it should be set before any call to the Process() method.
+  void SetZipBuilder(ZipBuilder* builder) {
+    this->builder = builder;
+  }
+};
+
+bool JarStripperProcessor::Accept(const char* filename, const u4) {
+  ssize_t offset = strlen(filename) - CLASS_EXTENSION_LENGTH;
+  if (offset >= 0) {
+    return strcmp(filename + offset, CLASS_EXTENSION) == 0;
+  }
+  return false;
+}
+
+void JarStripperProcessor::Process(const char* filename, const u4,
+                                   const u1* data, const size_t size) {
+  if (verbose) {
+    fprintf(stderr, "INFO: StripClass: %s\n", filename);
+  }
+  u1 *q = builder->NewFile(filename, 0);
+  u1 *classdata_out = q;
+  StripClass(q, data, size);  // actually process it
+  size_t out_length = q - classdata_out;
+  builder->FinishFile(out_length);
+}
+
+// Opens "file_in" (a .jar file) for reading, and writes an interface
+// .jar to "file_out".
+void OpenFilesAndProcessJar(const char *file_out, const char *file_in) {
+  JarStripperProcessor processor;
+  std::unique_ptr<ZipExtractor> in(ZipExtractor::Create(file_in, &processor));
+  if (in.get() == NULL) {
+    fprintf(stderr, "Unable to open Zip file %s: %s\n", file_in,
+            strerror(errno));
+    abort();
+  }
+  u8 output_length = in->CalculateOutputLength();
+  std::unique_ptr<ZipBuilder> out(ZipBuilder::Create(file_out, output_length));
+  if (out.get() == NULL) {
+    fprintf(stderr, "Unable to open output file %s: %s\n", file_out,
+            strerror(errno));
+    abort();
+  }
+  processor.SetZipBuilder(out.get());
+
+  // Process all files in the zip
+  if (in->ProcessAll() < 0) {
+    fprintf(stderr, "%s\n", in->GetError());
+    abort();
+  }
+
+  // Add dummy file, since javac doesn't like truly empty jars.
+  if (out->GetNumberFiles() == 0) {
+    out->WriteEmptyFile("dummy");
+  }
+  // Finish writing the output file
+  if (out->Finish() < 0) {
+    fprintf(stderr, "%s\n", out->GetError());
+    abort();
+  }
+  // Get all file size
+  size_t in_length = in->GetSize();
+  size_t out_length = out->GetSize();
+  if (verbose) {
+    fprintf(stderr, "INFO: produced interface jar: %s -> %s (%d%%).\n",
+            file_in, file_out,
+            static_cast<int>(100.0 * out_length / in_length));
+  }
+}
+
+}  // namespace devtools_ijar
+
+//
+// main method
+//
+static void usage() {
+  fprintf(stderr, "Usage: ijar [-v] x.jar [x_interface.jar>]\n");
+  fprintf(stderr, "Creates an interface jar from the specified jar file.\n");
+  exit(1);
+}
+
+int main(int argc, char **argv) {
+  const char *filename_in = NULL;
+  const char *filename_out = NULL;
+
+  for (int ii = 1; ii < argc; ++ii) {
+    if (strcmp(argv[ii], "-v") == 0) {
+      devtools_ijar::verbose = true;
+    } else if (filename_in == NULL) {
+      filename_in = argv[ii];
+    } else if (filename_out == NULL) {
+      filename_out = argv[ii];
+    } else {
+      usage();
+    }
+  }
+
+  if (filename_in == NULL) {
+    usage();
+  }
+
+  // Guess output filename from input:
+  char filename_out_buf[PATH_MAX];
+  if (filename_out == NULL) {
+    size_t len = strlen(filename_in);
+    if (len > 4 && strncmp(filename_in + len - 4, ".jar", 4) == 0) {
+      strcpy(filename_out_buf, filename_in);
+      strcpy(filename_out_buf + len - 4, "-interface.jar");
+      filename_out = filename_out_buf;
+    } else {
+      fprintf(stderr, "Can't determine output filename since input filename "
+              "doesn't end with '.jar'.\n");
+      return 1;
+    }
+  }
+
+  if (devtools_ijar::verbose) {
+    fprintf(stderr, "INFO: writing to '%s'.\n", filename_out);
+  }
+
+  devtools_ijar::OpenFilesAndProcessJar(filename_out, filename_in);
+  return 0;
+}
diff --git a/tools/ijar/zip.cc b/tools/ijar/zip.cc
new file mode 100644
index 0000000..ca5f396
--- /dev/null
+++ b/tools/ijar/zip.cc
@@ -0,0 +1,1031 @@
+// Copyright 2007 Alan Donovan. All rights reserved.
+//
+// Author: Alan Donovan <adonovan@google.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// zip.cc -- .zip (.jar) file reading/writing routines.
+//
+
+// See README.txt for details.
+//
+// See http://www.pkware.com/documents/casestudies/APPNOTE.TXT
+// for definition of PKZIP file format.
+
+#define _FILE_OFFSET_BITS 64  // Support zip files larger than 2GB
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <limits.h>
+#include <limits>
+#include <vector>
+
+#include "zip.h"
+#include <zlib.h>
+
+#define LOCAL_FILE_HEADER_SIGNATURE           0x04034b50
+#define CENTRAL_FILE_HEADER_SIGNATURE         0x02014b50
+#define END_OF_CENTRAL_DIR_SIGNATURE          0x06054b50
+#define DATA_DESCRIPTOR_SIGNATURE             0x08074b50
+
+// version to extract: 1.0 - default value from APPNOTE.TXT.
+// Output JAR files contain no extra ZIP features, so this is enough.
+#define ZIP_VERSION_TO_EXTRACT                10
+#define COMPRESSION_METHOD_STORED             0   // no compression
+#define COMPRESSION_METHOD_DEFLATED           8
+
+#define GENERAL_PURPOSE_BIT_FLAG_COMPRESSED (1 << 3)
+#define GENERAL_PURPOSE_BIT_FLAG_UTF8_ENCODED (1 << 11)
+#define GENERAL_PURPOSE_BIT_FLAG_COMPRESSION_SPEED ((1 << 2) | (1 << 1))
+#define GENERAL_PURPOSE_BIT_FLAG_SUPPORTED \
+  (GENERAL_PURPOSE_BIT_FLAG_COMPRESSED \
+  | GENERAL_PURPOSE_BIT_FLAG_UTF8_ENCODED \
+  | GENERAL_PURPOSE_BIT_FLAG_COMPRESSION_SPEED)
+
+namespace devtools_ijar {
+// In the absence of ZIP64 support, zip files are limited to 4GB.
+// http://www.info-zip.org/FAQ.html#limits
+static const u8 kMaximumOutputSize = std::numeric_limits<uint32_t>::max();
+
+static bool ProcessCentralDirEntry(const u1 *&p,
+                                   size_t *compressed_size,
+                                   size_t *uncompressed_size,
+                                   char *filename,
+                                   size_t filename_size,
+                                   u4 *attr,
+                                   u4 *offset);
+
+//
+// A class representing a ZipFile for reading. Its public API is exposed
+// using the ZipExtractor abstract class.
+//
+class InputZipFile : public ZipExtractor {
+ public:
+  InputZipFile(ZipExtractorProcessor *processor, int fd, off_t in_length,
+               off_t in_offset, const u1* zipdata_in, const u1* central_dir);
+  virtual ~InputZipFile();
+
+  virtual const char* GetError() {
+    if (errmsg[0] == 0) {
+      return NULL;
+    }
+    return errmsg;
+  }
+
+  virtual bool ProcessNext();
+  virtual void Reset();
+  virtual size_t GetSize() {
+    return in_length_;
+  }
+
+  virtual u8 CalculateOutputLength();
+
+ private:
+  ZipExtractorProcessor *processor;
+
+  int fd_in;  // Input file descripor
+
+  // InputZipFile is responsible for maintaining the following
+  // pointers. They are allocated by the Create() method before
+  // the object is actually created using mmap.
+  const u1 * const zipdata_in_;   // start of input file mmap
+  const u1 * zipdata_in_mapped_;  // start of still mapped region
+  const u1 * const central_dir_;  // central directory in input file
+
+  size_t in_length_;  // size of the input file
+  size_t in_offset_;  // offset  the input file
+
+  const u1 *p;  // input cursor
+
+  const u1* central_dir_current_;  // central dir input cursor
+
+  // Buffer size is initially INITIAL_BUFFER_SIZE. It doubles in size every
+  // time it is found too small, until it reaches MAX_BUFFER_SIZE. If that is
+  // not enough, we bail out. We only decompress class files, so they should
+  // be smaller than 64K anyway, but we give a little leeway.
+  // MAX_BUFFER_SIZE must be bigger than the size of the biggest file in the
+  // ZIP. It is set to 128M here so we can uncompress the Bazel server with
+  // this library.
+  static const size_t INITIAL_BUFFER_SIZE = 256 * 1024;  // 256K
+  static const size_t MAX_BUFFER_SIZE = 128 * 1024 * 1024;
+  static const size_t MAX_MAPPED_REGION = 32 * 1024 * 1024;
+
+  // These metadata fields are the fields of the ZIP header of the file being
+  // processed.
+  u2 extract_version_;
+  u2 general_purpose_bit_flag_;
+  u2 compression_method_;
+  u4 uncompressed_size_;
+  u4 compressed_size_;
+  u2 file_name_length_;
+  u2 extra_field_length_;
+  const u1 *file_name_;
+  const u1 *extra_field_;
+
+  // Administration of memory reserved for decompressed data. We use the same
+  // buffer for each file to avoid some malloc()/free() calls and free the
+  // memory only in the dtor. C-style memory management is used so that we
+  // can call realloc.
+  u1 *uncompressed_data_;
+  size_t uncompressed_data_allocated_;
+
+  // Copy of the last filename entry - Null-terminated.
+  char filename[PATH_MAX];
+  // The external file attribute field
+  u4 attr;
+
+  // last error
+  char errmsg[4*PATH_MAX];
+
+  int error(const char *fmt, ...) {
+    va_list ap;
+    va_start(ap, fmt);
+    vsnprintf(errmsg, 4*PATH_MAX, fmt, ap);
+    va_end(ap);
+    return -1;
+  }
+
+  // Check that at least n bytes remain in the input file, otherwise
+  // abort with an error message.  "state" is the name of the field
+  // we're about to read, for diagnostics.
+  int EnsureRemaining(size_t n, const char *state) {
+    size_t in_offset = p - zipdata_in_;
+    size_t remaining = in_length_ - in_offset;
+    if (n > remaining) {
+      return error("Premature end of file (at offset %zd, state=%s); "
+                   "expected %zd more bytes but found %zd.\n",
+                   in_offset, state, n, remaining);
+    }
+    return 0;
+  }
+
+  // Read one entry from input zip file
+  int ProcessLocalFileEntry(size_t compressed_size, size_t uncompressed_size);
+
+  // Uncompress a file from the archive using zlib. The pointer returned
+  // is owned by InputZipFile, so it must not be freed. Advances the input
+  // cursor to the first byte after the compressed data.
+  u1* UncompressFile();
+
+  // Skip a file
+  int SkipFile(const bool compressed);
+
+  // Process a file
+  int ProcessFile(const bool compressed);
+};
+
+//
+// A class implementing ZipBuilder that represent an open zip file for writing.
+//
+class OutputZipFile : public ZipBuilder {
+ public:
+  OutputZipFile(int fd, u1 * const zipdata_out) :
+      fd_out(fd),
+      zipdata_out_(zipdata_out),
+      q(zipdata_out) {
+    errmsg[0] = 0;
+  }
+
+  virtual const char* GetError() {
+    if (errmsg[0] == 0) {
+      return NULL;
+    }
+    return errmsg;
+  }
+
+  virtual ~OutputZipFile() { Finish(); }
+  virtual u1* NewFile(const char* filename, const u4 attr);
+  virtual int FinishFile(size_t filelength, bool compress = false,
+                         bool compute_crc = false);
+  virtual int WriteEmptyFile(const char *filename);
+  virtual size_t GetSize() {
+    return Offset(q);
+  }
+  virtual int GetNumberFiles() {
+    return entries_.size();
+  }
+  virtual int Finish();
+
+ private:
+  struct LocalFileEntry {
+    // Start of the local header (in the output buffer).
+    size_t local_header_offset;
+
+    // Sizes of the file entry
+    size_t uncompressed_length;
+    size_t compressed_length;
+
+    // Compression method
+    u2 compression_method;
+
+    // CRC32
+    u4 crc32;
+
+    // external attributes field
+    u4 external_attr;
+
+    // Start/length of the file_name in the local header.
+    u1 *file_name;
+    u2 file_name_length;
+
+    // Start/length of the extra_field in the local header.
+    const u1 *extra_field;
+    u2 extra_field_length;
+  };
+
+  int fd_out;  // file descriptor for the output file
+
+  // OutputZipFile is responsible for maintaining the following
+  // pointers. They are allocated by the Create() method before
+  // the object is actually created using mmap.
+  u1 * const zipdata_out_;        // start of output file mmap
+  u1 *q;  // output cursor
+
+  u1 *header_ptr;  // Current pointer to "compression method" entry.
+
+  // List of entries to write the central directory
+  std::vector<LocalFileEntry*> entries_;
+
+  // last error
+  char errmsg[4*PATH_MAX];
+
+  int error(const char *fmt, ...) {
+    va_list ap;
+    va_start(ap, fmt);
+    vsnprintf(errmsg, 4*PATH_MAX, fmt, ap);
+    va_end(ap);
+    return -1;
+  }
+
+  // Write the ZIP central directory structure for each local file
+  // entry in "entries".
+  void WriteCentralDirectory();
+
+  // Returns the offset of the pointer relative to the start of the
+  // output zip file.
+  size_t Offset(const u1 *const x) {
+    return x - zipdata_out_;
+  }
+
+  // Write ZIP file header in the output. Since the compressed size is not
+  // known in advance, it must be recorded later. This method returns a pointer
+  // to "compressed size" in the file header that should be passed to
+  // WriteFileSizeInLocalFileHeader() later.
+  u1* WriteLocalFileHeader(const char *filename, const u4 attr);
+
+  // Fill in the "compressed size" and "uncompressed size" fields in a local
+  // file header previously written by WriteLocalFileHeader().
+  size_t WriteFileSizeInLocalFileHeader(u1 *header_ptr,
+                                        size_t out_length,
+                                        bool compress = false,
+                                        const u4 crc = 0);
+};
+
+//
+// Implementation of InputZipFile
+//
+bool InputZipFile::ProcessNext() {
+  // Process the next entry in the central directory. Also make sure that the
+  // content pointer is in sync.
+  size_t compressed, uncompressed;
+  u4 offset;
+  if (!ProcessCentralDirEntry(central_dir_current_, &compressed, &uncompressed,
+                              filename, PATH_MAX, &attr, &offset)) {
+    return false;
+  }
+
+  // There might be an offset specified in the central directory that does
+  // not match the file offset, if so, correct the pointer.
+  if (offset != 0 && (p != (zipdata_in_ + in_offset_ + offset))) {
+    p = zipdata_in_ + offset;
+  }
+
+  if (EnsureRemaining(4, "signature") < 0) {
+    return false;
+  }
+  u4 signature = get_u4le(p);
+  if (signature == LOCAL_FILE_HEADER_SIGNATURE) {
+    if (ProcessLocalFileEntry(compressed, uncompressed) < 0) {
+      return false;
+    }
+  } else {
+    error("local file header signature for file %s not found\n", filename);
+    return false;
+  }
+
+  return true;
+}
+
+int InputZipFile::ProcessLocalFileEntry(
+    size_t compressed_size, size_t uncompressed_size) {
+  if (EnsureRemaining(26, "extract_version") < 0) {
+    return -1;
+  }
+  extract_version_ = get_u2le(p);
+  general_purpose_bit_flag_ = get_u2le(p);
+
+  if ((general_purpose_bit_flag_ & ~GENERAL_PURPOSE_BIT_FLAG_SUPPORTED) != 0) {
+    return error("Unsupported value (0x%04x) in general purpose bit flag.\n",
+                 general_purpose_bit_flag_);
+  }
+
+  compression_method_ = get_u2le(p);
+
+  if (compression_method_ != COMPRESSION_METHOD_DEFLATED &&
+      compression_method_ != COMPRESSION_METHOD_STORED) {
+    return error("Unsupported compression method (%d).\n",
+                 compression_method_);
+  }
+
+  // skip over: last_mod_file_time, last_mod_file_date, crc32
+  p += 2 + 2 + 4;
+  compressed_size_ = get_u4le(p);
+  uncompressed_size_ = get_u4le(p);
+  file_name_length_ = get_u2le(p);
+  extra_field_length_ = get_u2le(p);
+
+  if (EnsureRemaining(file_name_length_, "file_name") < 0) {
+    return -1;
+  }
+  file_name_ = p;
+  p += file_name_length_;
+
+  if (EnsureRemaining(extra_field_length_, "extra_field") < 0) {
+    return -1;
+  }
+  extra_field_ = p;
+  p += extra_field_length_;
+
+  bool is_compressed = compression_method_ == COMPRESSION_METHOD_DEFLATED;
+
+  // If the zip is compressed, compressed and uncompressed size members are
+  // zero in the local file header. If not, check that they are the same as the
+  // lengths from the central directory, otherwise, just believe the central
+  // directory
+  if (compressed_size_ == 0) {
+    compressed_size_ = compressed_size;
+  } else {
+    if (compressed_size_ != compressed_size) {
+      return error("central directory and file header inconsistent\n");
+    }
+  }
+
+  if (uncompressed_size_ == 0) {
+    uncompressed_size_ = uncompressed_size;
+  } else {
+    if (uncompressed_size_ != uncompressed_size) {
+      return error("central directory and file header inconsistent\n");
+    }
+  }
+
+  if (processor->Accept(filename, attr)) {
+    if (ProcessFile(is_compressed) < 0) {
+      return -1;
+    }
+  } else {
+    if (SkipFile(is_compressed) < 0) {
+      return -1;
+    }
+  }
+
+  if (general_purpose_bit_flag_ & GENERAL_PURPOSE_BIT_FLAG_COMPRESSED) {
+    // Skip the data descriptor. Some implementations do not put the signature
+    // here, so check if the next 4 bytes are a signature, and if so, skip the
+    // next 12 bytes (for CRC, compressed/uncompressed size), otherwise skip
+    // the next 8 bytes (because the value just read was the CRC).
+    u4 signature = get_u4le(p);
+    if (signature == DATA_DESCRIPTOR_SIGNATURE) {
+      p += 4 * 3;
+    } else {
+      p += 4 * 2;
+    }
+  }
+
+  if (p > zipdata_in_mapped_ + MAX_MAPPED_REGION) {
+    munmap(const_cast<u1 *>(zipdata_in_mapped_), MAX_MAPPED_REGION);
+    zipdata_in_mapped_ += MAX_MAPPED_REGION;
+  }
+
+  return 0;
+}
+
+int InputZipFile::SkipFile(const bool compressed) {
+  if (!compressed) {
+    // In this case, compressed_size_ == uncompressed_size_ (since the file is
+    // uncompressed), so we can use either.
+    if (compressed_size_ != uncompressed_size_) {
+      return error("compressed size != uncompressed size, although the file "
+                   "is uncompressed.\n");
+    }
+  }
+
+  if (EnsureRemaining(compressed_size_, "file_data") < 0) {
+    return -1;
+  }
+  p += compressed_size_;
+  return 0;
+}
+
+u1* InputZipFile::UncompressFile() {
+  size_t in_offset = p - zipdata_in_;
+  size_t remaining = in_length_ - in_offset;
+  z_stream stream;
+
+  stream.zalloc = Z_NULL;
+  stream.zfree = Z_NULL;
+  stream.opaque = Z_NULL;
+  stream.avail_in = remaining;
+  stream.next_in = (Bytef *) p;
+
+  int ret = inflateInit2(&stream, -MAX_WBITS);
+  if (ret != Z_OK) {
+    error("inflateInit: %d\n", ret);
+    return NULL;
+  }
+
+  int uncompressed_until_now = 0;
+
+  while (true) {
+    stream.avail_out = uncompressed_data_allocated_ - uncompressed_until_now;
+    stream.next_out = uncompressed_data_ + uncompressed_until_now;
+    int old_avail_out = stream.avail_out;
+
+    ret = inflate(&stream, Z_SYNC_FLUSH);
+    int uncompressed_now = old_avail_out - stream.avail_out;
+    uncompressed_until_now += uncompressed_now;
+
+    switch (ret) {
+      case Z_STREAM_END: {
+        // zlib said that there is no more data to decompress.
+
+        u1 *new_p = reinterpret_cast<u1*>(stream.next_in);
+        compressed_size_ = new_p - p;
+        uncompressed_size_ = uncompressed_until_now;
+        p = new_p;
+        inflateEnd(&stream);
+        return uncompressed_data_;
+      }
+
+      case Z_OK: {
+        // zlib said that there is no more room in the buffer allocated for
+        // the decompressed data. Enlarge that buffer and try again.
+
+        if (uncompressed_data_allocated_ == MAX_BUFFER_SIZE) {
+          error("ijar does not support decompressing files "
+                "larger than %dMB.\n",
+                (int) (MAX_BUFFER_SIZE/(1024*1024)));
+          return NULL;
+        }
+
+        uncompressed_data_allocated_ *= 2;
+        if (uncompressed_data_allocated_ > MAX_BUFFER_SIZE) {
+          uncompressed_data_allocated_ = MAX_BUFFER_SIZE;
+        }
+
+        uncompressed_data_ = reinterpret_cast<u1*>(
+            realloc(uncompressed_data_, uncompressed_data_allocated_));
+        break;
+      }
+
+      case Z_DATA_ERROR:
+      case Z_BUF_ERROR:
+      case Z_STREAM_ERROR:
+      case Z_NEED_DICT:
+      default: {
+        error("zlib returned error code %d during inflate.\n", ret);
+        return NULL;
+      }
+    }
+  }
+}
+
+int InputZipFile::ProcessFile(const bool compressed) {
+  const u1 *file_data;
+  if (compressed) {
+    file_data = UncompressFile();
+    if (file_data == NULL) {
+      return -1;
+    }
+  } else {
+    // In this case, compressed_size_ == uncompressed_size_ (since the file is
+    // uncompressed), so we can use either.
+    if (compressed_size_ != uncompressed_size_) {
+      return error("compressed size != uncompressed size, although the file "
+                   "is uncompressed.\n");
+    }
+
+    if (EnsureRemaining(compressed_size_, "file_data") < 0) {
+      return -1;
+    }
+    file_data = p;
+    p += compressed_size_;
+  }
+  processor->Process(filename, attr, file_data, uncompressed_size_);
+  return 0;
+}
+
+
+// Reads and returns some metadata of the next file from the central directory:
+// - compressed size
+// - uncompressed size
+// - whether the entry is a class file (to be included in the output).
+// Precondition: p points to the beginning of an entry in the central dir
+// Postcondition: p points to the beginning of the next entry in the central dir
+// Returns true if the central directory contains another file and false if not.
+// Of course, in the latter case, the size output variables are not changed.
+// Note that the central directory is always followed by another data structure
+// that has a signature, so parsing it this way is safe.
+static bool ProcessCentralDirEntry(
+    const u1 *&p, size_t *compressed_size, size_t *uncompressed_size,
+    char *filename, size_t filename_size, u4 *attr, u4 *offset) {
+  u4 signature = get_u4le(p);
+  if (signature != CENTRAL_FILE_HEADER_SIGNATURE) {
+    return false;
+  }
+
+  p += 16;  // skip to 'compressed size' field
+  *compressed_size = get_u4le(p);
+  *uncompressed_size = get_u4le(p);
+  u2 file_name_length = get_u2le(p);
+  u2 extra_field_length = get_u2le(p);
+  u2 file_comment_length = get_u2le(p);
+  p += 4;  // skip to external file attributes field
+  *attr = get_u4le(p);
+  *offset = get_u4le(p);
+  {
+    size_t len = (file_name_length < filename_size)
+      ? file_name_length
+      : (filename_size - 1);
+    memcpy(reinterpret_cast<void*>(filename), p, len);
+    filename[len] = 0;
+  }
+  p += file_name_length;
+  p += extra_field_length;
+  p += file_comment_length;
+  return true;
+}
+
+// Gives a maximum bound on the size of the interface JAR. Basically, adds
+// the difference between the compressed and uncompressed sizes to the size
+// of the input file.
+u8 InputZipFile::CalculateOutputLength() {
+  const u1* current = central_dir_;
+
+  u8 compressed_size = 0;
+  u8 uncompressed_size = 0;
+  u8 skipped_compressed_size = 0;
+  u4 attr;
+  u4 offset;
+  char filename[PATH_MAX];
+
+  while (true) {
+    size_t file_compressed, file_uncompressed;
+    if (!ProcessCentralDirEntry(current,
+                                &file_compressed, &file_uncompressed,
+                                filename, PATH_MAX, &attr, &offset)) {
+      break;
+    }
+
+    if (processor->Accept(filename, attr)) {
+      compressed_size += (u8) file_compressed;
+      uncompressed_size += (u8) file_uncompressed;
+    } else {
+      skipped_compressed_size += file_compressed;
+    }
+  }
+
+  // The worst case is when the output is simply the input uncompressed. The
+  // metadata in the zip file will stay the same, so the file will grow by the
+  // difference between the compressed and uncompressed sizes.
+  return (u8) in_length_ - skipped_compressed_size
+      + (uncompressed_size - compressed_size);
+}
+
+// Given the data in the zip file, returns the offset of the central directory
+// and the number of files contained in it.
+bool FindZipCentralDirectory(const u1* bytes, size_t in_length,
+                             u4* offset, const u1** central_dir) {
+  static const int MAX_COMMENT_LENGTH = 0xffff;
+  static const int CENTRAL_DIR_LOCATOR_SIZE = 22;
+  // Maximum distance of start of central dir locator from end of file
+  static const int MAX_DELTA = MAX_COMMENT_LENGTH + CENTRAL_DIR_LOCATOR_SIZE;
+  const u1* last_pos_to_check = in_length < MAX_DELTA
+      ? bytes
+      : bytes + (in_length - MAX_DELTA);
+  const u1* current;
+  bool found = false;
+
+  for (current = bytes + in_length - CENTRAL_DIR_LOCATOR_SIZE;
+       current >= last_pos_to_check;
+       current-- ) {
+    const u1* p = current;
+    if (get_u4le(p) != END_OF_CENTRAL_DIR_SIGNATURE) {
+      continue;
+    }
+
+    p += 16;  // skip to comment length field
+    u2 comment_length = get_u2le(p);
+
+    // Does the comment go exactly till the end of the file?
+    if (current + comment_length + CENTRAL_DIR_LOCATOR_SIZE
+        != bytes + in_length) {
+      continue;
+    }
+
+    // Hooray, we found it!
+    found = true;
+    break;
+  }
+
+  if (!found) {
+    fprintf(stderr, "file is invalid or corrupted (missing end of central "
+                    "directory record)\n");
+    return false;
+  }
+
+  const u1* end_of_central_dir = current;
+  get_u4le(current);  // central directory locator signature, already checked
+  u2 number_of_this_disk = get_u2le(current);
+  u2 disk_with_central_dir = get_u2le(current);
+  u2 central_dir_entries_on_this_disk = get_u2le(current);
+  u2 central_dir_entries = get_u2le(current);
+  u4 central_dir_size = get_u4le(current);
+  u4 central_dir_offset = get_u4le(current);
+  u2 file_comment_length = get_u2le(current);
+  current += file_comment_length;  // set current to the end of the central dir
+
+  if (number_of_this_disk != 0
+    || disk_with_central_dir != 0
+    || central_dir_entries_on_this_disk != central_dir_entries) {
+    fprintf(stderr, "multi-disk JAR files are not supported\n");
+    return false;
+  }
+
+  // Do not change output values before determining that they are OK.
+  *offset = central_dir_offset;
+  // Central directory start can then be used to determine the actual
+  // starts of the zip file (which can be different in case of a non-zip
+  // header like for auto-extractable binaries).
+  *central_dir = end_of_central_dir - central_dir_size;
+  return true;
+}
+
+void InputZipFile::Reset() {
+  central_dir_current_ = central_dir_;
+  zipdata_in_mapped_ = zipdata_in_;
+  p = zipdata_in_ + in_offset_;
+}
+
+int ZipExtractor::ProcessAll() {
+  while (ProcessNext()) {}
+  if (GetError() != NULL) {
+    return -1;
+  }
+  return 0;
+}
+
+ZipExtractor* ZipExtractor::Create(const char* filename,
+                                   ZipExtractorProcessor *processor) {
+  int fd_in = open(filename, O_RDONLY);
+  if (fd_in < 0) {
+    return NULL;
+  }
+
+  off_t length = lseek(fd_in, 0, SEEK_END);
+  if (length < 0) {
+    return NULL;
+  }
+
+  void *zipdata_in = mmap(NULL, length, PROT_READ, MAP_PRIVATE, fd_in, 0);
+  if (zipdata_in == MAP_FAILED) {
+    return NULL;
+  }
+
+  u4 central_dir_offset;
+  const u1 *central_dir = NULL;
+
+  if (!devtools_ijar::FindZipCentralDirectory(
+          static_cast<const u1*>(zipdata_in), length,
+          &central_dir_offset, &central_dir)) {
+    errno = EIO;  // we don't really have a good error number
+    return NULL;
+  }
+  const u1 *zipdata_start = static_cast<const u1*>(zipdata_in);
+  off_t offset = - static_cast<off_t>(zipdata_start
+                                      + central_dir_offset
+                                      - central_dir);
+
+  return new InputZipFile(processor, fd_in, length, offset,
+                          zipdata_start, central_dir);
+}
+
+InputZipFile::InputZipFile(ZipExtractorProcessor *processor, int fd,
+                           off_t in_length, off_t in_offset,
+                           const u1* zipdata_in, const u1* central_dir)
+  : processor(processor), fd_in(fd),
+    zipdata_in_(zipdata_in), zipdata_in_mapped_(zipdata_in),
+    central_dir_(central_dir), in_length_(in_length), in_offset_(in_offset),
+    p(zipdata_in + in_offset), central_dir_current_(central_dir) {
+  uncompressed_data_allocated_ = INITIAL_BUFFER_SIZE;
+  uncompressed_data_ =
+    reinterpret_cast<u1*>(malloc(uncompressed_data_allocated_));
+  errmsg[0] = 0;
+}
+
+InputZipFile::~InputZipFile() {
+  free(uncompressed_data_);
+  close(fd_in);
+}
+
+
+//
+// Implementation of OutputZipFile
+//
+int OutputZipFile::WriteEmptyFile(const char *filename) {
+  const u1* file_name = (const u1*) filename;
+  size_t file_name_length = strlen(filename);
+
+  LocalFileEntry *entry = new LocalFileEntry;
+  entry->local_header_offset = Offset(q);
+  entry->external_attr = 0;
+  entry->crc32 = 0;
+
+  // Output the ZIP local_file_header:
+  put_u4le(q, LOCAL_FILE_HEADER_SIGNATURE);
+  put_u2le(q, 10);  // extract_version
+  put_u2le(q, 0);  // general_purpose_bit_flag
+  put_u2le(q, 0);  // compression_method
+  put_u2le(q, 0);  // last_mod_file_time
+  put_u2le(q, 0);  // last_mod_file_date
+  put_u4le(q, entry->crc32);  // crc32
+  put_u4le(q, 0);  // compressed_size
+  put_u4le(q, 0);  // uncompressed_size
+  put_u2le(q, file_name_length);
+  put_u2le(q, 0);  // extra_field_length
+  put_n(q, file_name, file_name_length);
+
+  entry->file_name_length = file_name_length;
+  entry->extra_field_length = 0;
+  entry->compressed_length = 0;
+  entry->uncompressed_length = 0;
+  entry->compression_method = 0;
+  entry->extra_field = (const u1 *)"";
+  entry->file_name = (u1*) strdup((const char *) file_name);
+  entries_.push_back(entry);
+
+  return 0;
+}
+
+void OutputZipFile::WriteCentralDirectory() {
+  // central directory:
+  const u1 *central_directory_start = q;
+  for (size_t ii = 0; ii < entries_.size(); ++ii) {
+    LocalFileEntry *entry = entries_[ii];
+    put_u4le(q, CENTRAL_FILE_HEADER_SIGNATURE);
+    put_u2le(q, 0);  // version made by
+
+    put_u2le(q, ZIP_VERSION_TO_EXTRACT);  // version to extract
+    put_u2le(q, 0);  // general purpose bit flag
+    put_u2le(q, entry->compression_method);  // compression method:
+    put_u2le(q, 0);                          // last_mod_file_time
+    put_u2le(q, 0);  // last_mod_file_date
+    put_u4le(q, entry->crc32);  // crc32
+    put_u4le(q, entry->compressed_length);    // compressed_size
+    put_u4le(q, entry->uncompressed_length);  // uncompressed_size
+    put_u2le(q, entry->file_name_length);
+    put_u2le(q, entry->extra_field_length);
+
+    put_u2le(q, 0);  // file comment length
+    put_u2le(q, 0);  // disk number start
+    put_u2le(q, 0);  // internal file attributes
+    put_u4le(q, entry->external_attr);  // external file attributes
+    // relative offset of local header:
+    put_u4le(q, entry->local_header_offset);
+
+    put_n(q, entry->file_name, entry->file_name_length);
+    put_n(q, entry->extra_field, entry->extra_field_length);
+  }
+  u4 central_directory_size = q - central_directory_start;
+
+  put_u4le(q, END_OF_CENTRAL_DIR_SIGNATURE);
+  put_u2le(q, 0);  // number of this disk
+  put_u2le(q, 0);  // number of the disk with the start of the central directory
+  put_u2le(q, entries_.size());  // # central dir entries on this disk
+  put_u2le(q, entries_.size());  // total # entries in the central directory
+  put_u4le(q, central_directory_size);  // size of the central directory
+  put_u4le(q, Offset(central_directory_start));  // offset of start of central
+                                                 // directory wrt starting disk
+  put_u2le(q, 0);  // .ZIP file comment length
+}
+
+u1* OutputZipFile::WriteLocalFileHeader(const char* filename, const u4 attr) {
+  off_t file_name_length_ = strlen(filename);
+  LocalFileEntry *entry = new LocalFileEntry;
+  entry->local_header_offset = Offset(q);
+  entry->file_name_length = file_name_length_;
+  entry->file_name = new u1[file_name_length_];
+  entry->external_attr = attr;
+  memcpy(entry->file_name, filename, file_name_length_);
+  entry->extra_field_length = 0;
+  entry->extra_field = (const u1 *)"";
+
+  // Output the ZIP local_file_header:
+  put_u4le(q, LOCAL_FILE_HEADER_SIGNATURE);
+  put_u2le(q, ZIP_VERSION_TO_EXTRACT);     // version to extract
+  put_u2le(q, 0);                          // general purpose bit flag
+  u1 *header_ptr = q;
+  put_u2le(q, COMPRESSION_METHOD_STORED);  // compression method = placeholder
+  put_u2le(q, 0);                          // last_mod_file_time
+  put_u2le(q, 0);                          // last_mod_file_date
+  put_u4le(q, entry->crc32);               // crc32
+  put_u4le(q, 0);  // compressed_size = placeholder
+  put_u4le(q, 0);  // uncompressed_size = placeholder
+  put_u2le(q, entry->file_name_length);
+  put_u2le(q, entry->extra_field_length);
+
+  put_n(q, entry->file_name, entry->file_name_length);
+  put_n(q, entry->extra_field, entry->extra_field_length);
+  entries_.push_back(entry);
+
+  return header_ptr;
+}
+
+// Try to compress a file entry in memory using the deflate algorithm.
+// It will compress buf (of size length) unless the compressed size is bigger
+// than the input size. The result will overwrite the content of buf and the
+// final size is returned.
+size_t TryDeflate(u1 *buf, size_t length) {
+  u1 *outbuf = reinterpret_cast<u1 *>(malloc(length));
+  z_stream stream;
+
+  // Initialize the z_stream strcut for reading from buf and wrinting in outbuf.
+  stream.zalloc = Z_NULL;
+  stream.zfree = Z_NULL;
+  stream.opaque = Z_NULL;
+  stream.total_in = length;
+  stream.avail_in = length;
+  stream.total_out = length;
+  stream.avail_out = length;
+  stream.next_in = buf;
+  stream.next_out = outbuf;
+
+  // deflateInit2 negative windows size prevent the zlib wrapper to be used.
+  if (deflateInit2(&stream, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
+                  -MAX_WBITS, 8, Z_DEFAULT_STRATEGY) != Z_OK) {
+    // Failure to compress => return the buffer uncompressed
+    free(outbuf);
+    return length;
+  }
+
+  if (deflate(&stream, Z_FINISH) == Z_STREAM_END) {
+    // Compression successful and fits in outbuf, let's copy the result in buf.
+    length = stream.total_out;
+    memcpy(buf, outbuf, length);
+  }
+
+  deflateEnd(&stream);
+  free(outbuf);
+
+  // Return the length of the resulting buffer
+  return length;
+}
+
+size_t OutputZipFile::WriteFileSizeInLocalFileHeader(u1 *header_ptr,
+                                                     size_t out_length,
+                                                     bool compress,
+                                                     const u4 crc) {
+  size_t compressed_size = out_length;
+  if (compress) {
+    compressed_size = TryDeflate(q, out_length);
+  }
+  // compression method
+  if (compressed_size < out_length) {
+    put_u2le(header_ptr, COMPRESSION_METHOD_DEFLATED);
+  } else {
+    put_u2le(header_ptr, COMPRESSION_METHOD_STORED);
+  }
+  header_ptr += 4;
+  put_u4le(header_ptr, crc);              // crc32
+  put_u4le(header_ptr, compressed_size);  // compressed_size
+  put_u4le(header_ptr, out_length);       // uncompressed_size
+  return compressed_size;
+}
+
+int OutputZipFile::Finish() {
+  if (fd_out > 0) {
+    WriteCentralDirectory();
+    if (ftruncate(fd_out, GetSize()) < 0) {
+      return error("ftruncate(fd_out, GetSize()): %s", strerror(errno));
+    }
+    if (close(fd_out) < 0) {
+      return error("close(fd_out): %s", strerror(errno));
+    }
+    fd_out = -1;
+  }
+  return 0;
+}
+
+u1* OutputZipFile::NewFile(const char* filename, const u4 attr) {
+  header_ptr = WriteLocalFileHeader(filename, attr);
+  return q;
+}
+
+int OutputZipFile::FinishFile(size_t filelength, bool compress,
+                              bool compute_crc) {
+  u4 crc = 0;
+  if (compute_crc) {
+    crc = crc32(crc, q, filelength);
+  }
+  size_t compressed_size =
+      WriteFileSizeInLocalFileHeader(header_ptr, filelength, compress, crc);
+  entries_.back()->crc32 = crc;
+  entries_.back()->compressed_length = compressed_size;
+  entries_.back()->uncompressed_length = filelength;
+  if (compressed_size < filelength) {
+    entries_.back()->compression_method = COMPRESSION_METHOD_DEFLATED;
+  } else {
+    entries_.back()->compression_method = COMPRESSION_METHOD_STORED;
+  }
+  q += compressed_size;
+  return 0;
+}
+
+ZipBuilder* ZipBuilder::Create(const char* zip_file, u8 estimated_size) {
+  if (estimated_size > kMaximumOutputSize) {
+    fprintf(stderr,
+            "Uncompressed input jar has size %llu, "
+            "which exceeds the maximum supported output size %llu.\n"
+            "Assuming that ijar will be smaller and hoping for the best.\n",
+            estimated_size, kMaximumOutputSize);
+    estimated_size = kMaximumOutputSize;
+  }
+
+  int fd_out = open(zip_file, O_CREAT|O_RDWR|O_TRUNC, 0644);
+  if (fd_out < 0) {
+    return NULL;
+  }
+
+  // Create mmap-able sparse file
+  if (ftruncate(fd_out, estimated_size) < 0) {
+    return NULL;
+  }
+
+  // Ensure that any buffer overflow in JarStripper will result in
+  // SIGSEGV or SIGBUS by over-allocating beyond the end of the file.
+  size_t mmap_length = std::min(estimated_size + sysconf(_SC_PAGESIZE),
+                                (u8) std::numeric_limits<size_t>::max());
+
+  void *zipdata_out = mmap(NULL, mmap_length, PROT_WRITE,
+                           MAP_SHARED, fd_out, 0);
+  if (zipdata_out == MAP_FAILED) {
+    fprintf(stderr, "output_length=%llu\n", estimated_size);
+    return NULL;
+  }
+
+  return new OutputZipFile(fd_out, (u1*) zipdata_out);
+}
+
+u8 ZipBuilder::EstimateSize(char **files) {
+  struct stat statst;
+  // Digital signature field size = 6, End of central directory = 22, Total = 28
+  u8 size = 28;
+  // Count the size of all the files in the input to estimate the size of the
+  // output.
+  for (int i = 0; files[i] != NULL; i++) {
+    if (stat(files[i], &statst) != 0) {
+      fprintf(stderr, "File %s does not seem to exist.", files[i]);
+      return 0;
+    }
+    size += statst.st_size;
+    // Add sizes of Zip meta data
+    // local file header = 30 bytes
+    // data descriptor = 12 bytes
+    // central directory descriptor = 46 bytes
+    //    Total: 88bytes
+    size += 88;
+    // The filename is stored twice (once in the central directory
+    // and once in the local file header).
+    size += strlen(files[i]) * 2;
+  }
+  return size;
+}
+
+}  // namespace devtools_ijar
diff --git a/tools/ijar/zip.h b/tools/ijar/zip.h
new file mode 100644
index 0000000..dda2c6e
--- /dev/null
+++ b/tools/ijar/zip.h
@@ -0,0 +1,173 @@
+// Copyright 2015 Google Inc. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// zip.h -- .zip (.jar) file reading/writing routines.
+//
+// This file specifies the interface to use the ZIP implementation of ijar.
+//
+
+#ifndef INCLUDED_THIRD_PARTY_IJAR_ZIP_H
+#define INCLUDED_THIRD_PARTY_IJAR_ZIP_H
+
+#include <sys/stat.h>
+
+#include "common.h"
+
+namespace devtools_ijar {
+
+// Tells if this is a directory entry from the mode. This method
+// is safer than zipattr_to_mode(attr) & S_IFDIR because the unix
+// mode might not be set in DOS zip files.
+inline bool zipattr_is_dir(u4 attr) { return (attr & 0x10) != 0; }
+
+// Convert a Unix file mode to a ZIP file attribute
+inline u4 mode_to_zipattr(mode_t m) {
+  return (((u4) m) << 16) + ((m & S_IFDIR) != 0 ? 0x10 : 0);
+}
+
+// Convert a ZIP file attribute to a Unix file mode
+inline mode_t zipattr_to_mode(u4 attr) {
+  return ((mode_t) ((attr >> 16) & 0xffff));
+}
+
+//
+// Class interface for building ZIP files
+//
+class ZipBuilder {
+ public:
+  virtual ~ZipBuilder() {}
+
+  // Returns the text for the last error, or null on no last error.
+  virtual const char* GetError() = 0;
+
+  // Add a new file to the ZIP, the file will have path "filename"
+  // and external attributes "attr". This function returns a pointer
+  // to a memory buffer to write the data of the file into. This buffer
+  // is owned by ZipBuilder and should not be free'd by the caller. The
+  // file length is then specified when the files is finished written
+  // using the FinishFile(size_t) function.
+  // On failure, returns NULL and GetError() will return an non-empty message.
+  virtual u1* NewFile(const char* filename, const u4 attr) = 0;
+
+  // Finish writing a file and specify its length. After calling this method
+  // one should not reuse the pointer given by NewFile. The file can be
+  // compressed using the deflate algorithm by setting `compress` to true.
+  // By default, CRC32 are not computed as java tooling doesn't care, but
+  // computing it can be activated by setting `compute_crc` to true.
+  // On failure, returns -1 and GetError() will return an non-empty message.
+  virtual int FinishFile(size_t filelength,
+                         bool compress = false,
+                         bool compute_crc = false) = 0;
+
+  // Write an empty file, it is equivalent to:
+  //   NewFile(filename, 0);
+  //   FinishFile(0);
+  // On failure, returns -1 and GetError() will return an non-empty message.
+  virtual int WriteEmptyFile(const char* filename) = 0;
+
+  // Finish writing the ZIP file. This method can be called only once
+  // (subsequent calls will do nothing) and none of
+  // NewFile/FinishFile/WriteEmptyFile should be called after calling Finish. If
+  // this method was not called when the object is destroyed, it will be called.
+  // It is here as a convenience to get information on the final generated ZIP
+  // file.
+  // On failure, returns -1 and GetError() will return an non-empty message.
+  virtual int Finish() = 0;
+
+  // Get the current size of the ZIP file. This size will not be matching the
+  // final ZIP file until Finish() has been called because Finish() is actually
+  // writing the central directory of the ZIP File.
+  virtual size_t GetSize() = 0;
+
+  // Returns the current number of files stored in the ZIP.
+  virtual int GetNumberFiles() = 0;
+
+  // Create a new ZipBuilder writing the file zip_file and the size of the
+  // output will be at most estimated_size. Use ZipBuilder::EstimateSize() or
+  // ZipExtractor::CalculateOuputLength() to have an estimated_size depending on
+  // a list of file to store.
+  // On failure, returns NULL. Refer to errno for error code.
+  static ZipBuilder* Create(const char* zip_file, u8 estimated_size);
+
+  // Estimate the maximum size of the ZIP files containing files in the "files"
+  // null-terminated array.
+  // Returns 0 on error.
+  static u8 EstimateSize(char **files);
+};
+
+//
+// An abstract class to process data from a ZipExtractor.
+// Derive from this class if you wish to process data from a ZipExtractor.
+//
+class ZipExtractorProcessor {
+ public:
+  virtual ~ZipExtractorProcessor() {}
+
+  // Tells whether to skip or process the file "filename". "attr" is the
+  // external file attributes and can be converted to unix mode using the
+  // zipattr_to_mode() function. This method is suppoed to returns true
+  // if the file should be processed and false if it should be skipped.
+  virtual bool Accept(const char* filename, const u4 attr) = 0;
+
+  // Process a file accepted by Accept. The file "filename" has external
+  // attributes "attr" and length "size". The file content is accessible
+  // in the buffer pointed by "data".
+  virtual void Process(const char* filename, const u4 attr,
+                       const u1* data, const size_t size) = 0;
+};
+
+//
+// Class interface for reading ZIP files
+//
+class ZipExtractor {
+ public:
+  virtual ~ZipExtractor() {}
+
+  // Returns the text for the last error, or null on no last error.
+  virtual const char* GetError() = 0;
+
+  // Process the next files, returns false if the end of ZIP file has been
+  // reached. The processor provided by the Create method will be called
+  // if a file is encountered. If false is returned, check the return value
+  // of GetError() for potential errors.
+  virtual bool ProcessNext() = 0;
+
+  // Process the all files, returns -1 on error (GetError() will be populated
+  // on error).
+  virtual int ProcessAll();
+
+  // Reset the file pointer to the beginning.
+  virtual void Reset() = 0;
+
+  // Return the size of the ZIP file.
+  virtual size_t GetSize() = 0;
+
+  // Return the size of the resulting zip file by keeping only file
+  // accepted by the processor and storing them uncompressed. This
+  // method can be used to create a ZipBuilder for storing a subset
+  // of the input files.
+  // On error, 0 is returned and GetError() returns a non-empty message.
+  virtual u8 CalculateOutputLength() = 0;
+
+  // Create a ZipExtractor that extract the zip file "filename" and process
+  // it with "processor".
+  // On error, a null pointer is returned and the value of errno should be
+  // checked.
+  static ZipExtractor* Create(const char* filename,
+                              ZipExtractorProcessor *processor);
+};
+
+}  // namespace devtools_ijar
+
+#endif  // INCLUDED_THIRD_PARTY_IJAR_ZIP_H
diff --git a/tools/ijar/zip_main.cc b/tools/ijar/zip_main.cc
new file mode 100644
index 0000000..3f4a50c
--- /dev/null
+++ b/tools/ijar/zip_main.cc
@@ -0,0 +1,312 @@
+// Copyright 2015 Google Inc. All rights reserved.
+//
+// Author: Alan Donovan <adonovan@google.com>
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//
+// Zip / Unzip file using ijar zip implementation.
+//
+// Note that this Zip implementation intentionally don't compute CRC-32
+// because it is useless computation for jar because Java doesn't care.
+// CRC-32 of all files in the zip file will be set to 0.
+//
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <errno.h>
+#include <memory>
+
+#include "zip.h"
+
+namespace devtools_ijar {
+
+#define SYSCALL(expr)  do { \
+                         if ((expr) < 0) { \
+                           perror(#expr); \
+                           abort(); \
+                         } \
+                       } while (0)
+
+//
+// A ZipExtractorProcessor that extract all files in the ZIP file.
+//
+class UnzipProcessor : public ZipExtractorProcessor {
+ public:
+  // Create a processor who will extract the files into output_root
+  // if "extract" is set to true and will print the list of files and
+  // their unix modes if "verbose" is set to true.
+  UnzipProcessor(const char *output_root, bool verbose, bool extract)
+    : output_root_(output_root), verbose_(verbose), extract_(extract) {}
+  virtual ~UnzipProcessor() {}
+
+  virtual void Process(const char* filename, const u4 attr,
+                       const u1* data, const size_t size);
+  virtual bool Accept(const char* filename, const u4 attr) {
+    return true;
+  }
+
+ private:
+  const char *output_root_;
+  const bool verbose_;
+  const bool extract_;
+};
+
+// Concatene 2 path, path1 and path2, using / as a directory separator and
+// puting the result in "out". "size" specify the size of the output buffer
+void concat_path(char* out, const size_t size,
+                 const char *path1, const char *path2) {
+  int len1 = strlen(path1);
+  size_t l = len1;
+  strncpy(out, path1, size - 1);
+  out[size-1] = 0;
+  if (l < size - 1 && path1[len1] != '/' && path2[0] != '/') {
+    out[l] = '/';
+    l++;
+    out[l] = 0;
+  }
+  if (l < size - 1) {
+    strncat(out, path2, size - 1 - l);
+  }
+}
+
+// Do a recursive mkdir of all folders of path except the last path
+// segment (if path ends with a / then the last path segment is empty).
+// All folders are created using "mode" for creation mode.
+void mkdirs(const char *path, mode_t mode) {
+  char path_[PATH_MAX];
+  struct stat statst;
+  strncpy(path_, path, PATH_MAX);
+  path_[PATH_MAX-1] = 0;
+  char *pointer = path_;
+  while ((pointer = strchr(pointer, '/')) != NULL) {
+    if (path_ != pointer) {  // skip leading slash
+      *pointer = 0;
+      if (stat(path_, &statst) != 0) {
+        if (mkdir(path_, mode) < 0) {
+          fprintf(stderr, "Cannot create folder %s: %s\n",
+                  path_, strerror(errno));
+          abort();
+        }
+      }
+      *pointer = '/';
+    }
+    pointer++;
+  }
+}
+
+void UnzipProcessor::Process(const char* filename, const u4 attr,
+                             const u1* data, const size_t size) {
+  mode_t mode = zipattr_to_mode(attr);
+  mode_t perm = mode & 0777;
+  bool isdir = (mode & S_IFDIR) != 0;
+  if (attr == 0) {
+    // Fallback when the external attribute is not set.
+    isdir = filename[strlen(filename)-1] == '/';
+    perm = 0777;
+  }
+  if (verbose_) {
+    printf("%c %o %s\n", isdir ? 'd' : 'f', perm, filename);
+  }
+  if (extract_) {
+    char path[PATH_MAX];
+    int fd;
+    concat_path(path, PATH_MAX, output_root_, filename);
+    mkdirs(path, perm);
+    if (!isdir) {
+      fd = open(path, O_CREAT | O_WRONLY, perm);
+      if (fd < 0) {
+        fprintf(stderr, "Cannot open file %s for writing: %s\n",
+                path, strerror(errno));
+        abort();
+      }
+      SYSCALL(write(fd, data, size));
+      SYSCALL(close(fd));
+    }
+  }
+}
+
+// Get the basename of path and store it in output. output_size
+// is the size of the output buffer.
+void basename(const char *path, char *output, size_t output_size) {
+  const char *pointer = strrchr(path, '/');
+  if (pointer == NULL) {
+    pointer = path;
+  } else {
+    pointer++;  // Skip the leading slash.
+  }
+  strncpy(output, pointer, output_size);
+  output[output_size-1] = 0;
+}
+
+
+// Execute the extraction (or just listing if just v is provided)
+int extract(char *zipfile, bool verbose, bool extract) {
+  char output_root[PATH_MAX];
+  getcwd(output_root, PATH_MAX);
+
+  UnzipProcessor processor(output_root, verbose, extract);
+  std::unique_ptr<ZipExtractor> extractor(ZipExtractor::Create(zipfile,
+                                                               &processor));
+  if (extractor.get() == NULL) {
+    fprintf(stderr, "Unable to open zip file %s: %s.\n", zipfile,
+            strerror(errno));
+    return -1;
+  }
+
+  if (extractor->ProcessAll() < 0) {
+    fprintf(stderr, "%s.\n", extractor->GetError());
+    return -1;
+  }
+  return 0;
+}
+
+// Execute the create operation
+int create(char *zipfile, char **files, bool flatten, bool verbose,
+           bool compress) {
+  struct stat statst;
+  u8 size = ZipBuilder::EstimateSize(files);
+  if (size == 0) {
+    return -1;
+  }
+  std::unique_ptr<ZipBuilder> builder(ZipBuilder::Create(zipfile, size));
+  if (builder.get() == NULL) {
+    fprintf(stderr, "Unable to create zip file %s: %s.\n",
+            zipfile, strerror(errno));
+    return -1;
+  }
+  for (int i = 0; files[i] != NULL; i++) {
+    stat(files[i], &statst);
+    char path[PATH_MAX];
+    bool isdir = (statst.st_mode & S_IFDIR) != 0;
+
+    if (flatten && isdir) {
+      continue;
+    }
+
+    // Compute the path, flattening it if requested
+    if (flatten) {
+      basename(files[i], path, PATH_MAX);
+    } else {
+      strncpy(path, files[i], PATH_MAX);
+      path[PATH_MAX-1] = 0;
+      size_t len = strlen(path);
+      if (isdir && len < PATH_MAX - 1) {
+        // Add the trailing slash for folders
+        path[len] = '/';
+        path[len+1] = 0;
+      }
+    }
+
+    if (verbose) {
+      mode_t perm = statst.st_mode & 0777;
+      printf("%c %o %s\n", isdir ? 'd' : 'f', perm, path);
+    }
+
+    u1 *buffer = builder->NewFile(path, mode_to_zipattr(statst.st_mode));
+    if (isdir || statst.st_size == 0) {
+      builder->FinishFile(0);
+    } else {
+      // mmap the input file and memcpy
+      int fd = open(files[i], O_RDONLY);
+      if (fd < 0) {
+        fprintf(stderr, "Can't open file %s for reading: %s.\n",
+                files[i], strerror(errno));
+        return -1;
+      }
+      void *data = mmap(NULL, statst.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+      if (data == MAP_FAILED) {
+        fprintf(stderr, "Can't mmap file %s for reading: %s.\n",
+                files[i], strerror(errno));
+        return -1;
+      }
+      memcpy(buffer, data, statst.st_size);
+      munmap(data, statst.st_size);
+      builder->FinishFile(statst.st_size, compress, true);
+    }
+  }
+  if (builder->Finish() < 0) {
+    fprintf(stderr, "%s\n", builder->GetError());
+    return -1;
+  }
+  return 0;
+}
+
+}  // namespace devtools_ijar
+
+//
+// main method
+//
+static void usage(char *progname) {
+  fprintf(stderr, "Usage: %s [vxc[fC]] x.zip [file1...filen]\n", progname);
+  fprintf(stderr, "  v verbose - list all file in x.zip\n");
+  fprintf(stderr, "  x extract - extract file in x.zip in current directory\n");
+  fprintf(stderr, "  c create  - add files to x.zip\n");
+  fprintf(stderr, "  f flatten - flatten files to use with create operation\n");
+  fprintf(stderr,
+          "  C compress - compress files when using the create operation\n");
+  fprintf(stderr, "x and c cannot be used in the same command-line.\n");
+  exit(1);
+}
+
+int main(int argc, char **argv) {
+  bool extract = false;
+  bool verbose = false;
+  bool create = false;
+  bool compress = false;
+  bool flatten = false;
+
+  if (argc < 3) {
+    usage(argv[0]);
+  }
+
+  for (int i = 0; argv[1][i] != 0; i++) {
+    switch (argv[1][i]) {
+    case 'x':
+      extract = true;
+      break;
+    case 'v':
+      verbose = true;
+      break;
+    case 'c':
+      create = true;
+      break;
+    case 'f':
+      flatten = true;
+      break;
+    case 'C':
+      compress = true;
+      break;
+    default:
+      usage(argv[0]);
+    }
+  }
+  if (create) {
+    if (extract) {
+      usage(argv[0]);
+    }
+    // Create a zip
+    return devtools_ijar::create(argv[2], argv + 3, flatten, verbose, compress);
+  } else {
+    if (flatten) {
+      usage(argv[0]);
+    }
+    // Extraction / list mode
+    return devtools_ijar::extract(argv[2], verbose, extract);
+  }
+}
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index cd750e8..e6ad18b 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -129,8 +129,8 @@
 
 AdjustPartitionSizeForVerity.results = {}
 
-def BuildVerityFEC(sparse_image_path, verity_fec_path, prop_dict):
-  cmd = "fec -e %s %s" % (sparse_image_path, verity_fec_path)
+def BuildVerityFEC(sparse_image_path, verity_path, verity_fec_path):
+  cmd = "fec -e %s %s %s" % (sparse_image_path, verity_path, verity_fec_path)
   print cmd
   status, output = commands.getstatusoutput(cmd)
   if status:
@@ -182,13 +182,33 @@
     return False
   return True
 
-def BuildVerifiedImage(data_image_path, verity_image_path,
-                       verity_metadata_path):
-  if not Append2Simg(data_image_path, verity_image_path,
-                     "Could not append verity tree!"):
+def Append(target, file_to_append, error_message):
+  cmd = 'cat %s >> %s' % (file_to_append, target)
+  print cmd
+  status, output = commands.getstatusoutput(cmd)
+  if status:
+    print "%s: %s" % (error_message, output)
     return False
-  if not Append2Simg(data_image_path, verity_metadata_path,
-                     "Could not append verity metadata!"):
+  return True
+
+def BuildVerifiedImage(data_image_path, verity_image_path,
+                       verity_metadata_path, verity_fec_path,
+                       fec_supported):
+  if not Append(verity_image_path, verity_metadata_path,
+                "Could not append verity metadata!"):
+    return False
+
+  if fec_supported:
+    # build FEC for the entire partition, including metadata
+    if not BuildVerityFEC(data_image_path, verity_image_path,
+                          verity_fec_path):
+      return False
+
+    if not Append(verity_image_path, verity_fec_path, "Could not append FEC!"):
+      return False
+
+  if not Append2Simg(data_image_path, verity_image_path,
+                     "Could not append verity data!"):
     return False
   return True
 
@@ -252,20 +272,12 @@
   # build the full verified image
   if not BuildVerifiedImage(out_file,
                             verity_image_path,
-                            verity_metadata_path):
+                            verity_metadata_path,
+                            verity_fec_path,
+                            fec_supported):
     shutil.rmtree(tempdir_name, ignore_errors=True)
     return False
 
-  if fec_supported:
-    # build FEC for the entire partition, including metadata
-    if not BuildVerityFEC(out_file, verity_fec_path, prop_dict):
-      shutil.rmtree(tempdir_name, ignore_errors=True)
-      return False
-
-    if not Append2Simg(out_file, verity_fec_path, "Could not append FEC!"):
-      shutil.rmtree(tempdir_name, ignore_errors=True)
-      return False
-
   shutil.rmtree(tempdir_name, ignore_errors=True)
   return True
 
@@ -350,7 +362,8 @@
   elif fs_type.startswith("squash"):
     build_command = ["mksquashfsimage.sh"]
     build_command.extend([in_dir, out_file])
-    build_command.extend(["-s"])
+    if "squashfs_sparse_flag" in prop_dict:
+      build_command.extend([prop_dict["squashfs_sparse_flag"]])
     build_command.extend(["-m", prop_dict["mount_point"]])
     if target_out:
       build_command.extend(["-d", target_out])
@@ -478,6 +491,7 @@
 
   common_props = (
       "extfs_sparse_flag",
+      "squashfs_sparse_flag",
       "mkyaffs2_extra_flags",
       "selinux_fc",
       "skip_fsck",
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 872dd4c..aaf51e9 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -44,6 +44,7 @@
 
     self.search_path = platform_search_path.get(sys.platform, None)
     self.signapk_path = "framework/signapk.jar"  # Relative to search_path
+    self.signapk_shared_library_path = "lib64"   # Relative to search_path
     self.extra_signapk_args = []
     self.java_path = "java"  # Use the one on the path by default.
     self.java_args = "-Xmx2048m" # JVM Args
@@ -211,8 +212,11 @@
   makeint("boot_size")
   makeint("fstab_version")
 
-  d["fstab"] = LoadRecoveryFSTab(read_helper, d["fstab_version"],
-                                 d.get("system_root_image", False))
+  if d.get("no_recovery", False) == "true":
+    d["fstab"] = None
+  else:
+    d["fstab"] = LoadRecoveryFSTab(read_helper, d["fstab_version"],
+                                   d.get("system_root_image", False))
   d["build.prop"] = LoadBuildProp(read_helper)
   return d
 
@@ -490,8 +494,11 @@
     info_dict = OPTIONS.info_dict
 
   # With system_root_image == "true", we don't pack ramdisk into the boot image.
-  has_ramdisk = (info_dict.get("system_root_image", None) != "true" or
-                 prebuilt_name != "boot.img")
+  # Unless "recovery_as_boot" is specified, in which case we carry the ramdisk
+  # for recovery.
+  has_ramdisk = (info_dict.get("system_root_image") != "true" or
+                 prebuilt_name != "boot.img" or
+                 info_dict.get("recovery_as_boot") == "true")
 
   fs_config = "META/" + tree_subdir.lower() + "_filesystem_config.txt"
   data = _BuildBootableImage(os.path.join(unpack_dir, tree_subdir),
@@ -585,37 +592,29 @@
   return key_passwords
 
 
-def SignFile(input_name, output_name, key, password, align=None,
-             whole_file=False):
+def SignFile(input_name, output_name, key, password, whole_file=False):
   """Sign the input_name zip/jar/apk, producing output_name.  Use the
   given key and password (the latter may be None if the key does not
   have a password.
 
-  If align is an integer > 1, zipalign is run to align stored files in
-  the output zip on 'align'-byte boundaries.
-
   If whole_file is true, use the "-w" option to SignApk to embed a
   signature that covers the whole file in the archive comment of the
   zip file.
   """
 
-  if align == 0 or align == 1:
-    align = None
+  java_library_path = os.path.join(
+      OPTIONS.search_path, OPTIONS.signapk_shared_library_path)
 
-  if align:
-    temp = tempfile.NamedTemporaryFile()
-    sign_name = temp.name
-  else:
-    sign_name = output_name
-
-  cmd = [OPTIONS.java_path, OPTIONS.java_args, "-jar",
+  cmd = [OPTIONS.java_path, OPTIONS.java_args,
+         "-Djava.library.path=" + java_library_path,
+         "-jar",
          os.path.join(OPTIONS.search_path, OPTIONS.signapk_path)]
   cmd.extend(OPTIONS.extra_signapk_args)
   if whole_file:
     cmd.append("-w")
   cmd.extend([key + OPTIONS.public_key_suffix,
               key + OPTIONS.private_key_suffix,
-              input_name, sign_name])
+              input_name, output_name])
 
   p = Run(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
   if password is not None:
@@ -624,13 +623,6 @@
   if p.returncode != 0:
     raise ExternalError("signapk.jar failed: return code %s" % (p.returncode,))
 
-  if align:
-    p = Run(["zipalign", "-f", "-p", str(align), sign_name, output_name])
-    p.communicate()
-    if p.returncode != 0:
-      raise ExternalError("zipalign failed: return code %s" % (p.returncode,))
-    temp.close()
-
 
 def CheckSize(data, target, info_dict):
   """Check the data string passed against the max size limit, if
@@ -735,7 +727,8 @@
   try:
     opts, args = getopt.getopt(
         argv, "hvp:s:x:" + extra_opts,
-        ["help", "verbose", "path=", "signapk_path=", "extra_signapk_args=",
+        ["help", "verbose", "path=", "signapk_path=",
+         "signapk_shared_library_path=", "extra_signapk_args=",
          "java_path=", "java_args=", "public_key_suffix=",
          "private_key_suffix=", "boot_signer_path=", "boot_signer_args=",
          "verity_signer_path=", "verity_signer_args=", "device_specific=",
@@ -756,6 +749,8 @@
       OPTIONS.search_path = a
     elif o in ("--signapk_path",):
       OPTIONS.signapk_path = a
+    elif o in ("--signapk_shared_library_path",):
+      OPTIONS.signapk_shared_library_path = a
     elif o in ("--extra_signapk_args",):
       OPTIONS.extra_signapk_args = shlex.split(a)
     elif o in ("--java_path",):
diff --git a/tools/releasetools/edify_generator.py b/tools/releasetools/edify_generator.py
index b3785ac..d923cc8 100644
--- a/tools/releasetools/edify_generator.py
+++ b/tools/releasetools/edify_generator.py
@@ -284,8 +284,8 @@
     cmd = ['apply_patch("%s",\0"%s",\0%s,\0%d'
            % (srcfile, tgtfile, tgtsha1, tgtsize)]
     for i in range(0, len(patchpairs), 2):
-      cmd.append(',\0%s, package_extract_file("%s")' % patchpairs[i:i+2])
-    cmd.append(');')
+      cmd.append(',\0%s,\0package_extract_file("%s")' % patchpairs[i:i+2])
+    cmd.append(') ||\n    abort("Failed to apply patch to %s");' % (srcfile,))
     cmd = "".join(cmd)
     self.script.append(self.WordWrap(cmd))
 
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index fd57b93..a76eaa9 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -94,6 +94,11 @@
 
   --gen_verify
       Generate an OTA package that verifies the partitions.
+
+  --log_diff <file>
+      Generate a log file that shows the differences in the source and target
+      builds for an incremental package. This option is only meaningful when
+      -i is specified.
 """
 
 import sys
@@ -137,6 +142,7 @@
 OPTIONS.cache_size = None
 OPTIONS.stash_threshold = 0.8
 OPTIONS.gen_verify = False
+OPTIONS.log_diff = None
 
 def MostPopularKey(d, default):
   """Given a dict, return the key corresponding to the largest
@@ -1566,13 +1572,13 @@
   if OPTIONS.verify and system_diff:
     script.Print("Remounting and verifying system partition files...")
     script.Unmount("/system")
-    script.Mount("/system")
+    script.Mount("/system", recovery_mount_options)
     system_diff.EmitExplicitTargetVerification(script)
 
   if OPTIONS.verify and vendor_diff:
     script.Print("Remounting and verifying vendor partition files...")
     script.Unmount("/vendor")
-    script.Mount("/vendor")
+    script.Mount("/vendor", recovery_mount_options)
     vendor_diff.EmitExplicitTargetVerification(script)
   script.AddToZip(target_zip, output_zip, input_path=OPTIONS.updater_binary)
 
@@ -1631,6 +1637,8 @@
                          "a float" % (a, o))
     elif o == "--gen_verify":
       OPTIONS.gen_verify = True
+    elif o == "--log_diff":
+      OPTIONS.log_diff = a
     else:
       return False
     return True
@@ -1656,7 +1664,8 @@
                                  "verify",
                                  "no_fallback_to_full",
                                  "stash_threshold=",
-                                 "gen_verify"
+                                 "gen_verify",
+                                 "log_diff=",
                              ], extra_option_handler=option_handler)
 
   if len(args) != 2:
@@ -1694,7 +1703,9 @@
   if OPTIONS.device_specific is not None:
     OPTIONS.device_specific = os.path.abspath(OPTIONS.device_specific)
 
-  if OPTIONS.info_dict.get("no_recovery") == "true":
+  ab_update = OPTIONS.info_dict.get("ab_update") == "true"
+
+  if OPTIONS.info_dict.get("no_recovery") == "true" and not ab_update:
     raise common.ExternalError(
         "--- target build has specified no recovery ---")
 
@@ -1716,8 +1727,9 @@
     output_zip = zipfile.ZipFile(temp_zip_file, "w",
                                  compression=zipfile.ZIP_DEFLATED)
 
+  # Non A/B OTAs rely on /cache partition to store temporary files.
   cache_size = OPTIONS.info_dict.get("cache_size", None)
-  if cache_size is None:
+  if cache_size is None and not ab_update:
     print "--- can't determine the cache partition size ---"
   OPTIONS.cache_size = cache_size
 
@@ -1727,7 +1739,11 @@
 
   # Generate a full OTA.
   elif OPTIONS.incremental_source is None:
-    WriteFullOTAPackage(input_zip, output_zip)
+    if ab_update:
+      # TODO: Pending for b/25715402.
+      pass
+    else:
+      WriteFullOTAPackage(input_zip, output_zip)
 
   # Generate an incremental OTA. It will fall back to generate a full OTA on
   # failure unless no_fallback_to_full is specified.
@@ -1743,6 +1759,14 @@
       common.DumpInfoDict(OPTIONS.source_info_dict)
     try:
       WriteIncrementalOTAPackage(input_zip, source_zip, output_zip)
+      if OPTIONS.log_diff:
+        out_file = open(OPTIONS.log_diff, 'w')
+        import target_files_diff
+        target_files_diff.recursiveDiff('',
+                                        OPTIONS.source_tmp,
+                                        OPTIONS.input_tmp,
+                                        out_file)
+        out_file.close()
     except ValueError:
       if not OPTIONS.fallback_to_full:
         raise
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index cbf78a1..baf60f5 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -134,7 +134,7 @@
 
   signed = tempfile.NamedTemporaryFile()
 
-  common.SignFile(unsigned.name, signed.name, keyname, pw, align=4)
+  common.SignFile(unsigned.name, signed.name, keyname, pw)
 
   data = signed.read()
   unsigned.close()
diff --git a/tools/target_files_diff.py b/tools/releasetools/target_files_diff.py
similarity index 81%
rename from tools/target_files_diff.py
rename to tools/releasetools/target_files_diff.py
index 010ea84..405c42b 100755
--- a/tools/target_files_diff.py
+++ b/tools/releasetools/target_files_diff.py
@@ -26,6 +26,7 @@
 import os
 import re
 import subprocess
+import sys
 import tempfile
 
 def ignore(name):
@@ -94,14 +95,16 @@
 
 def trim_install_recovery(original, new):
   """
-  Rewrite the install-recovery script to remove the hash of the recovery partition.
+  Rewrite the install-recovery script to remove the hash of the recovery
+  partition.
   """
   for line in original:
     new.write(re.sub(r'[0-9a-f]{40}', '0'*40, line))
 
 def sort_file(original, new):
   """
-  Sort the file. Some OTA metadata files are not in a deterministic order currently.
+  Sort the file. Some OTA metadata files are not in a deterministic order
+  currently.
   """
   lines = original.readlines()
   lines.sort()
@@ -126,7 +129,8 @@
 @contextlib.contextmanager
 def preprocess(name, filename):
   """
-  Optionally rewrite files before diffing them, to remove known-variable information.
+  Optionally rewrite files before diffing them, to remove known-variable
+  information.
   """
   if name in REWRITE_RULES:
     with tempfile.NamedTemporaryFile() as newfp:
@@ -137,24 +141,25 @@
   else:
     yield filename
 
-def diff(name, file1, file2):
+def diff(name, file1, file2, out_file):
   """
   Diff a file pair with diff, running preprocess() on the arguments first.
   """
   with preprocess(name, file1) as f1:
     with preprocess(name, file2) as f2:
-      proc = subprocess.Popen(['diff', f1, f2], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-      (stdout, ignore) = proc.communicate()
+      proc = subprocess.Popen(['diff', f1, f2], stdout=subprocess.PIPE,
+                              stderr=subprocess.STDOUT)
+      (stdout, _) = proc.communicate()
       if proc.returncode == 0:
         return
       stdout = stdout.strip()
       if stdout == 'Binary files %s and %s differ' % (f1, f2):
-        print("%s: Binary files differ" % name)
+        print("%s: Binary files differ" % name, file=out_file)
       else:
         for line in stdout.strip().split('\n'):
-          print("%s: %s" % (name, line))
+          print("%s: %s" % (name, line), file=out_file)
 
-def recursiveDiff(prefix, dir1, dir2):
+def recursiveDiff(prefix, dir1, dir2, out_file):
   """
   Recursively diff two directories, checking metadata then calling diff()
   """
@@ -175,31 +180,34 @@
           link1 = os.readlink(name1)
           link2 = os.readlink(name2)
           if link1 != link2:
-            print("%s: Symlinks differ: %s vs %s" % (name, link1, link2))
+            print("%s: Symlinks differ: %s vs %s" % (name, link1, link2),
+                  file=out_file)
         else:
-          print("%s: File types differ, skipping compare" % name)
+          print("%s: File types differ, skipping compare" % name,
+                file=out_file)
         continue
 
       stat1 = os.stat(name1)
       stat2 = os.stat(name2)
-      type1 = stat1.st_mode & ~0777
-      type2 = stat2.st_mode & ~0777
+      type1 = stat1.st_mode & ~0o777
+      type2 = stat2.st_mode & ~0o777
 
       if type1 != type2:
-        print("%s: File types differ, skipping compare" % name)
+        print("%s: File types differ, skipping compare" % name, file=out_file)
         continue
 
       if stat1.st_mode != stat2.st_mode:
-        print("%s: Modes differ: %o vs %o" % (name, stat1.st_mode, stat2.st_mode))
+        print("%s: Modes differ: %o vs %o" %
+            (name, stat1.st_mode, stat2.st_mode), file=out_file)
 
       if os.path.isdir(name1):
-        recursiveDiff(name, name1, name2)
+        recursiveDiff(name, name1, name2, out_file)
       elif os.path.isfile(name1):
-        diff(name, name1, name2)
+        diff(name, name1, name2, out_file)
       else:
-        print("%s: Unknown file type, skipping compare" % name)
+        print("%s: Unknown file type, skipping compare" % name, file=out_file)
     else:
-      print("%s: Only in base package" % name)
+      print("%s: Only in base package" % name, file=out_file)
 
   for entry in list2:
     name = os.path.join(prefix, entry)
@@ -210,15 +218,25 @@
       continue
 
     if entry not in list1:
-      print("%s: Only in new package" % name)
+      print("%s: Only in new package" % name, file=out_file)
 
 def main():
   parser = argparse.ArgumentParser()
   parser.add_argument('dir1', help='The base target files package (extracted)')
   parser.add_argument('dir2', help='The new target files package (extracted)')
+  parser.add_argument('--output',
+      help='The output file, otherwise it prints to stdout')
   args = parser.parse_args()
 
-  recursiveDiff('', args.dir1, args.dir2)
+  if args.output:
+    out_file = open(args.output, 'w')
+  else:
+    out_file = sys.stdout
+
+  recursiveDiff('', args.dir1, args.dir2, out_file)
+
+  if args.output:
+    out_file.close()
 
 if __name__ == '__main__':
   main()
diff --git a/tools/signapk/Android.mk b/tools/signapk/Android.mk
index 620ccb1..c2cf572 100644
--- a/tools/signapk/Android.mk
+++ b/tools/signapk/Android.mk
@@ -19,13 +19,18 @@
 # ============================================================
 include $(CLEAR_VARS)
 LOCAL_MODULE := signapk
-LOCAL_SRC_FILES := SignApk.java
+LOCAL_SRC_FILES := $(call all-java-files-under, src)
 LOCAL_JAR_MANIFEST := SignApk.mf
-LOCAL_STATIC_JAVA_LIBRARIES := bouncycastle-host bouncycastle-bcpkix-host
+LOCAL_STATIC_JAVA_LIBRARIES := bouncycastle-host bouncycastle-bcpkix-host conscrypt-host
+LOCAL_REQUIRED_MODULES := libconscrypt_openjdk_jni
 include $(BUILD_HOST_JAVA_LIBRARY)
 
 ifeq ($(TARGET_BUILD_APPS),)
-# The post-build signing tools need signapk.jar, but we don't
-# need this if we're just doing unbundled apps.
-$(call dist-for-goals,droidcore,$(LOCAL_INSTALLED_MODULE))
+# The post-build signing tools need signapk.jar and its shared libraries,
+# but we don't need this if we're just doing unbundled apps.
+my_dist_files := $(LOCAL_INSTALLED_MODULE) \
+    $(HOST_OUT_SHARED_LIBRARIES)/libconscrypt_openjdk_jni$(HOST_SHLIB_SUFFIX)
+
+$(call dist-for-goals,droidcore,$(my_dist_files))
+my_dist_files :=
 endif
diff --git a/tools/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
similarity index 94%
rename from tools/signapk/SignApk.java
rename to tools/signapk/src/com/android/signapk/SignApk.java
index 3ddab11..5afb8d1 100644
--- a/tools/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -34,6 +34,7 @@
 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
 import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
 import org.bouncycastle.util.encoders.Base64;
+import org.conscrypt.OpenSSLProvider;
 
 import java.io.Console;
 import java.io.BufferedReader;
@@ -110,8 +111,6 @@
 
     private static final String OTACERT_NAME = "META-INF/com/android/otacert";
 
-    private static Provider sBouncyCastleProvider;
-
     // bitmasks for which hash algorithms we need the manifest to include.
     private static final int USE_SHA1 = 1;
     private static final int USE_SHA256 = 2;
@@ -135,7 +134,6 @@
 
     /** Returns the expected signature algorithm for this key type. */
     private static String getSignatureAlgorithm(X509Certificate cert) {
-        String sigAlg = cert.getSigAlgName().toUpperCase(Locale.US);
         String keyType = cert.getPublicKey().getAlgorithm().toUpperCase(Locale.US);
         if ("RSA".equalsIgnoreCase(keyType)) {
             if (getDigestAlgorithm(cert) == USE_SHA256) {
@@ -246,8 +244,11 @@
              * Now it's in a PKCS#8 PrivateKeyInfo structure. Read its Algorithm
              * OID and use that to construct a KeyFactory.
              */
-            ASN1InputStream bIn = new ASN1InputStream(new ByteArrayInputStream(spec.getEncoded()));
-            PrivateKeyInfo pki = PrivateKeyInfo.getInstance(bIn.readObject());
+            PrivateKeyInfo pki;
+            try (ASN1InputStream bIn =
+                    new ASN1InputStream(new ByteArrayInputStream(spec.getEncoded()))) {
+                pki = PrivateKeyInfo.getInstance(bIn.readObject());
+            }
             String algOid = pki.getPrivateKeyAlgorithm().getAlgorithm().getId();
 
             return KeyFactory.getInstance(algOid).generatePrivate(spec);
@@ -449,21 +450,20 @@
 
         CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
         ContentSigner signer = new JcaContentSignerBuilder(getSignatureAlgorithm(publicKey))
-            .setProvider(sBouncyCastleProvider)
             .build(privateKey);
         gen.addSignerInfoGenerator(
             new JcaSignerInfoGeneratorBuilder(
                 new JcaDigestCalculatorProviderBuilder()
-                .setProvider(sBouncyCastleProvider)
                 .build())
             .setDirectSignature(true)
             .build(signer, publicKey));
         gen.addCertificates(certs);
         CMSSignedData sigData = gen.generate(data, false);
 
-        ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded());
-        DEROutputStream dos = new DEROutputStream(out);
-        dos.writeObject(asn1.readObject());
+        try (ASN1InputStream asn1 = new ASN1InputStream(sigData.getEncoded())) {
+            DEROutputStream dos = new DEROutputStream(out);
+            dos.writeObject(asn1.readObject());
+        }
     }
 
     /**
@@ -473,7 +473,7 @@
      * more efficient.
      */
     private static void copyFiles(Manifest manifest, JarFile in, JarOutputStream out,
-                                  long timestamp, int alignment) throws IOException {
+                                  long timestamp, int defaultAlignment) throws IOException {
         byte[] buffer = new byte[4096];
         int num;
 
@@ -512,6 +512,7 @@
                 offset += 4;
                 firstEntry = false;
             }
+            int alignment = getStoredEntryDataAlignment(name, defaultAlignment);
             if (alignment > 0 && (offset % alignment != 0)) {
                 // Set the "extra data" of the entry to between 1 and
                 // alignment-1 bytes, to make the file data begin at
@@ -552,6 +553,24 @@
         }
     }
 
+    /**
+     * Returns the multiple (in bytes) at which the provided {@code STORED} entry's data must start
+     * relative to start of file or {@code 0} if alignment of this entry's data is not important.
+     */
+    private static int getStoredEntryDataAlignment(String entryName, int defaultAlignment) {
+        if (defaultAlignment <= 0) {
+            return 0;
+        }
+
+        if (entryName.endsWith(".so")) {
+            // Align .so contents to memory page boundary to enable memory-mapped
+            // execution.
+            return 4096;
+        } else {
+            return defaultAlignment;
+        }
+    }
+
     private static class WholeFileSignerOutputStream extends FilterOutputStream {
         private boolean closing = false;
         private ByteArrayOutputStream footer = new ByteArrayOutputStream();
@@ -616,7 +635,6 @@
         private File publicKeyFile;
         private X509Certificate publicKey;
         private PrivateKey privateKey;
-        private String outputFile;
         private OutputStream outputStream;
         private final ASN1ObjectIdentifier type;
         private WholeFileSignerOutputStream signer;
@@ -636,14 +654,17 @@
          * This should actually return byte[] or something similar, but nothing
          * actually checks it currently.
          */
+        @Override
         public Object getContent() {
             return this;
         }
 
+        @Override
         public ASN1ObjectIdentifier getContentType() {
             return type;
         }
 
+        @Override
         public void write(OutputStream out) throws IOException {
             try {
                 signer = new WholeFileSignerOutputStream(out, outputStream);
@@ -658,7 +679,7 @@
                 copyFiles(manifest, inputJar, outputJar, timestamp, 0);
                 addOtacert(outputJar, publicKeyFile, timestamp, manifest, hash);
 
-                signFile(manifest, inputJar,
+                signFile(manifest,
                          new X509Certificate[]{ publicKey },
                          new PrivateKey[]{ privateKey },
                          outputJar);
@@ -753,7 +774,7 @@
         temp.writeTo(outputStream);
     }
 
-    private static void signFile(Manifest manifest, JarFile inputJar,
+    private static void signFile(Manifest manifest,
                                  X509Certificate[] publicKey, PrivateKey[] privateKey,
                                  JarOutputStream outputJar)
         throws Exception {
@@ -855,12 +876,16 @@
     public static void main(String[] args) {
         if (args.length < 4) usage();
 
-        sBouncyCastleProvider = new BouncyCastleProvider();
-        Security.addProvider(sBouncyCastleProvider);
+        // Install Conscrypt as the highest-priority provider. Its crypto primitives are faster than
+        // the standard or Bouncy Castle ones.
+        Security.insertProviderAt(new OpenSSLProvider(), 1);
+        // Install Bouncy Castle (as the lowest-priority provider) because Conscrypt does not offer
+        // DSA which may still be needed.
+        // TODO: Stop installing Bouncy Castle provider once DSA is no longer needed.
+        Security.addProvider(new BouncyCastleProvider());
 
         boolean signWholeFile = false;
         String providerClass = null;
-        String providerArg = null;
         int alignment = 4;
 
         int argstart = 0;
@@ -944,7 +969,7 @@
 
                 Manifest manifest = addDigestsToManifest(inputJar, hashes);
                 copyFiles(manifest, inputJar, outputJar, timestamp, alignment);
-                signFile(manifest, inputJar, publicKey, privateKey, outputJar);
+                signFile(manifest, publicKey, privateKey, outputJar);
                 outputJar.close();
             }
         } catch (Exception e) {