Merge "Add NativeBridgeRelativePath config variables"
diff --git a/core/Makefile b/core/Makefile
index b2da68b..575ab36 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -659,6 +659,7 @@
   $(eval $(call build-image-kernel-modules-depmod,$(1),$(3),$(4),$(5),$(6))) \
   $(4)/$(DEPMOD_STAGING_SUBDIR)/modules.dep:$(2)/lib/modules/modules.dep \
   $(4)/$(DEPMOD_STAGING_SUBDIR)/modules.alias:$(2)/lib/modules/modules.alias \
+  $(4)/$(DEPMOD_STAGING_SUBDIR)/modules.softdep:$(2)/lib/modules/modules.softdep \
   $(4)/$(DEPMOD_STAGING_SUBDIR)/$(6):$(2)/lib/modules/$(6)
 endef
 
@@ -668,7 +669,7 @@
 # $(4): module load list
 # $(5): module load list filename
 define build-image-kernel-modules-depmod
-$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: .KATI_IMPLICIT_OUTPUTS := $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.alias $(3)/$(DEPMOD_STAGING_SUBDIR)/$(5)
+$(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: .KATI_IMPLICIT_OUTPUTS := $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.alias $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.softdep $(3)/$(DEPMOD_STAGING_SUBDIR)/$(5)
 $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: $(DEPMOD)
 $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_MODULES := $(1)
 $(3)/$(DEPMOD_STAGING_SUBDIR)/modules.dep: PRIVATE_MOUNT_POINT := $(2)
@@ -709,32 +710,40 @@
 	(for MODULE in $$(PRIVATE_LOAD_MODULES); do basename $$$$MODULE >> $$@; done)
 endef
 
+# Until support for a vendor-boot/vendor-ramdisk is added, store vendor ramdisk
+# kernel modules on the generic ramdisk as a stopgap.
+ifneq ($(BOARD_VENDOR_RAMDISK_KERNEL_MODULES),)
+  BOARD_GENERIC_RAMDISK_KERNEL_MODULES += $(BOARD_VENDOR_RAMDISK_KERNEL_MODULES)
+endif
+ifneq ($(BOARD_VENDOR_RAMDISK_KERNEL_MODULES_LOAD),)
+  BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD += $(BOARD_VENDOR_RAMDISK_KERNEL_MODULES_LOAD)
+endif
 
 ifeq ($(BOARD_RECOVERY_KERNEL_MODULES_LOAD),)
   BOARD_RECOVERY_KERNEL_MODULES_LOAD := $(BOARD_RECOVERY_KERNEL_MODULES)
 endif
-ifeq ($(BOARD_RAMDISK_KERNEL_MODULES_LOAD),)
-  BOARD_RAMDISK_KERNEL_MODULES_LOAD := $(BOARD_RAMDISK_KERNEL_MODULES)
+ifeq ($(BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD),)
+  BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD := $(BOARD_GENERIC_RAMDISK_KERNEL_MODULES)
 endif
 
-ifdef BOARD_RAMDISK_KERNEL_MODULES
+ifdef BOARD_GENERIC_RAMDISK_KERNEL_MODULES
   ifeq ($(BOARD_USES_RECOVERY_AS_BOOT), true)
-    BOARD_RECOVERY_KERNEL_MODULES += $(BOARD_RAMDISK_KERNEL_MODULES)
+    BOARD_RECOVERY_KERNEL_MODULES += $(BOARD_GENERIC_RAMDISK_KERNEL_MODULES)
   endif
 endif
 
 ifdef BOARD_RECOVERY_KERNEL_MODULES
   ifeq ($(BOARD_USES_RECOVERY_AS_BOOT), true)
-    ifdef BOARD_RAMDISK_KERNEL_MODULES_LOAD
-      ALL_DEFAULT_INSTALLED_MODULES += $(call copy-many-files,$(call module-load-list-copy-paths,$(call intermediates-dir-for,PACKAGING,ramdisk_modules),$(BOARD_RAMDISK_KERNEL_MODULES_LOAD),modules.load,$(TARGET_RECOVERY_ROOT_OUT)))
+    ifdef BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD
+      ALL_DEFAULT_INSTALLED_MODULES += $(call copy-many-files,$(call module-load-list-copy-paths,$(call intermediates-dir-for,PACKAGING,ramdisk_modules),$(BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD),modules.load,$(TARGET_RECOVERY_ROOT_OUT)))
     endif
   endif
   ALL_DEFAULT_INSTALLED_MODULES += $(call copy-many-files,$(call build-image-kernel-modules,$(BOARD_RECOVERY_KERNEL_MODULES),$(TARGET_RECOVERY_ROOT_OUT),,$(call intermediates-dir-for,PACKAGING,depmod_recovery),$(BOARD_RECOVERY_KERNEL_MODULES_LOAD),modules.load.recovery))
 endif
 
 ifneq ($(BOARD_USES_RECOVERY_AS_BOOT), true)
-  ifdef BOARD_RAMDISK_KERNEL_MODULES
-    ALL_DEFAULT_INSTALLED_MODULES += $(call copy-many-files,$(call build-image-kernel-modules,$(BOARD_RAMDISK_KERNEL_MODULES),$(TARGET_RAMDISK_OUT),,$(call intermediates-dir-for,PACKAGING,depmod_ramdisk),$(BOARD_RAMDISK_KERNEL_MODULES_LOAD),modules.load))
+  ifdef BOARD_GENERIC_RAMDISK_KERNEL_MODULES
+    ALL_DEFAULT_INSTALLED_MODULES += $(call copy-many-files,$(call build-image-kernel-modules,$(BOARD_GENERIC_RAMDISK_KERNEL_MODULES),$(TARGET_RAMDISK_OUT),,$(call intermediates-dir-for,PACKAGING,depmod_ramdisk),$(BOARD_GENERIC_RAMDISK_KERNEL_MODULES_LOAD),modules.load))
   endif
 endif
 
@@ -2362,36 +2371,6 @@
 .PHONY: sync syncsys
 sync syncsys: $(INTERNAL_SYSTEMIMAGE_FILES)
 
-#######
-## system tarball
-define build-systemtarball-target
-  $(call pretty,"Target system fs tarball: $(INSTALLED_SYSTEMTARBALL_TARGET)")
-  $(call create-system-vendor-symlink)
-  $(call create-system-product-symlink)
-  $(call create-system-system_ext-symlink)
-  $(MKTARBALL) $(FS_GET_STATS) \
-    $(PRODUCT_OUT) system $(PRIVATE_SYSTEM_TAR) \
-    $(INSTALLED_SYSTEMTARBALL_TARGET) $(TARGET_OUT)
-endef
-
-ifndef SYSTEM_TARBALL_FORMAT
-    SYSTEM_TARBALL_FORMAT := bz2
-endif
-
-system_tar := $(PRODUCT_OUT)/system.tar
-INSTALLED_SYSTEMTARBALL_TARGET := $(system_tar).$(SYSTEM_TARBALL_FORMAT)
-$(INSTALLED_SYSTEMTARBALL_TARGET): PRIVATE_SYSTEM_TAR := $(system_tar)
-$(INSTALLED_SYSTEMTARBALL_TARGET): $(FS_GET_STATS) $(INTERNAL_SYSTEMIMAGE_FILES)
-	$(build-systemtarball-target)
-
-.PHONY: systemtarball-nodeps
-systemtarball-nodeps: $(FS_GET_STATS) \
-                      $(filter-out systemtarball-nodeps stnod,$(MAKECMDGOALS))
-	$(build-systemtarball-target)
-
-.PHONY: stnod
-stnod: systemtarball-nodeps
-
 # -----------------------------------------------------------------
 ## platform.zip: system, plus other files to be used in PDK fusion build,
 ## in a zip file
@@ -2494,34 +2473,6 @@
 endif # BUILD_PLATFORM_ZIP
 
 # -----------------------------------------------------------------
-## boot tarball
-define build-boottarball-target
-    $(hide) echo "Target boot fs tarball: $(INSTALLED_BOOTTARBALL_TARGET)"
-    $(hide) mkdir -p $(PRODUCT_OUT)/boot
-    $(hide) cp -f $(INTERNAL_BOOTIMAGE_FILES) $(PRODUCT_OUT)/boot/.
-    $(hide) echo $(INTERNAL_KERNEL_CMDLINE) > $(PRODUCT_OUT)/boot/cmdline
-    $(hide) $(MKTARBALL) $(FS_GET_STATS) \
-                 $(PRODUCT_OUT) boot $(PRIVATE_BOOT_TAR) \
-                 $(INSTALLED_BOOTTARBALL_TARGET) $(TARGET_OUT)
-endef
-
-ifndef BOOT_TARBALL_FORMAT
-    BOOT_TARBALL_FORMAT := bz2
-endif
-
-boot_tar := $(PRODUCT_OUT)/boot.tar
-INSTALLED_BOOTTARBALL_TARGET := $(boot_tar).$(BOOT_TARBALL_FORMAT)
-$(INSTALLED_BOOTTARBALL_TARGET): PRIVATE_BOOT_TAR := $(boot_tar)
-$(INSTALLED_BOOTTARBALL_TARGET): $(FS_GET_STATS) $(INTERNAL_BOOTIMAGE_FILES)
-	$(build-boottarball-target)
-
-.PHONY: boottarball-nodeps btnod
-boottarball-nodeps btnod: $(FS_GET_STATS) \
-                      $(filter-out boottarball-nodeps btnod,$(MAKECMDGOALS))
-	$(build-boottarball-target)
-
-
-# -----------------------------------------------------------------
 # data partition image
 INTERNAL_USERDATAIMAGE_FILES := \
     $(filter $(TARGET_OUT_DATA)/%,$(ALL_DEFAULT_INSTALLED_MODULES))
@@ -2570,29 +2521,6 @@
 $(ASAN_IN_SYSTEM_INSTALLED): $(INSTALLED_USERDATAIMAGE_TARGET_DEPS)
 	tar cfj $(ASAN_IN_SYSTEM_INSTALLED) $(ASAN_SYSTEM_INSTALL_OPTIONS) -C $(TARGET_OUT_DATA)/.. $(ASAN_OUT_DIRS_FOR_SYSTEM_INSTALL) >/dev/null
 
-#######
-## data partition tarball
-define build-userdatatarball-target
-    $(call pretty,"Target userdata fs tarball: " \
-                  "$(INSTALLED_USERDATATARBALL_TARGET)")
-    $(MKTARBALL) $(FS_GET_STATS) \
-	    $(PRODUCT_OUT) data $(PRIVATE_USERDATA_TAR) \
-	    $(INSTALLED_USERDATATARBALL_TARGET) $(TARGET_OUT)
-endef
-
-userdata_tar := $(PRODUCT_OUT)/userdata.tar
-INSTALLED_USERDATATARBALL_TARGET := $(userdata_tar).bz2
-$(INSTALLED_USERDATATARBALL_TARGET): PRIVATE_USERDATA_TAR := $(userdata_tar)
-$(INSTALLED_USERDATATARBALL_TARGET): $(FS_GET_STATS) $(INTERNAL_USERDATAIMAGE_FILES)
-	$(build-userdatatarball-target)
-
-$(call dist-for-goals,userdatatarball,$(INSTALLED_USERDATATARBALL_TARGET))
-
-.PHONY: userdatatarball-nodeps
-userdatatarball-nodeps: $(FS_GET_STATS)
-	$(build-userdatatarball-target)
-
-
 # -----------------------------------------------------------------
 # partition table image
 ifdef BOARD_BPT_INPUT_FILES
@@ -3684,6 +3612,7 @@
   simg2img \
   sload_f2fs \
   tune2fs \
+  update_host_simulator \
   verity_signer \
   verity_verifier \
   zipalign \
diff --git a/core/cc_prebuilt_internal.mk b/core/cc_prebuilt_internal.mk
index 2bf4fdc..0c87151 100644
--- a/core/cc_prebuilt_internal.mk
+++ b/core/cc_prebuilt_internal.mk
@@ -135,21 +135,23 @@
     endif
 endif
 
-my_shared_libraries := \
+my_shared_libraries := $(strip \
     $(filter-out $(my_system_shared_libraries),$(LOCAL_SHARED_LIBRARIES)) \
-    $(my_system_shared_libraries)
+    $(my_system_shared_libraries))
+
+# Extra shared libraries introduced by LOCAL_CXX_STL (may append some libraries to
+# my_shared_libraries).
+include $(BUILD_SYSTEM)/cxx_stl_setup.mk
 
 ifdef my_shared_libraries
-# Extra shared libraries introduced by LOCAL_CXX_STL.
-include $(BUILD_SYSTEM)/cxx_stl_setup.mk
 ifdef LOCAL_USE_VNDK
   my_shared_libraries := $(foreach l,$(my_shared_libraries),\
     $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
 endif
 $(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
   $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(my_shared_libraries))
-endif
 endif  # my_shared_libraries
+endif  # LOCAL_INSTALLED_MODULE
 
 # We need to enclose the above export_includes and my_built_shared_libraries in
 # "my_strip_module not true" because otherwise the rules are defined in dynamic_binary.mk.
diff --git a/core/config.mk b/core/config.mk
index d92b891..5016ff2 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -584,7 +584,6 @@
 MKF2FSUSERIMG := $(HOST_OUT_EXECUTABLES)/mkf2fsuserimg.sh
 SIMG2IMG := $(HOST_OUT_EXECUTABLES)/simg2img$(HOST_EXECUTABLE_SUFFIX)
 E2FSCK := $(HOST_OUT_EXECUTABLES)/e2fsck$(HOST_EXECUTABLE_SUFFIX)
-MKTARBALL := build/make/tools/mktarball.sh
 TUNE2FS := $(HOST_OUT_EXECUTABLES)/tune2fs$(HOST_EXECUTABLE_SUFFIX)
 JARJAR := $(HOST_OUT_JAVA_LIBRARIES)/jarjar.jar
 DATA_BINDING_COMPILER := $(HOST_OUT_JAVA_LIBRARIES)/databinding-compiler.jar
@@ -1154,8 +1153,7 @@
 # in the source tree.
 dont_bother_goals := out \
     snod systemimage-nodeps \
-    stnod systemtarball-nodeps \
-    userdataimage-nodeps userdatatarball-nodeps \
+    userdataimage-nodeps \
     cacheimage-nodeps \
     bptimage-nodeps \
     vnod vendorimage-nodeps \
diff --git a/core/definitions.mk b/core/definitions.mk
index 431231d..d26c445 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2315,13 +2315,14 @@
   echo "Install path on $(TARGET_PRODUCT)-$(TARGET_BUILD_VARIANT): $(PRIVATE_INSTALLED_MODULE)" >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
   echo >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log
 endef
+ART_VERIDEX_APPCOMPAT_SCRIPT:=$(HOST_OUT)/bin/appcompat.sh
 define run-appcompat
 $(hide) \
   echo "appcompat.sh output:" >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log && \
-  PACKAGING=$(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING ANDROID_LOG_TAGS="*:e" art/tools/veridex/appcompat.sh --dex-file=$@ --api-flags=$(INTERNAL_PLATFORM_HIDDENAPI_FLAGS) 2>&1 >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log
+  PACKAGING=$(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING ANDROID_LOG_TAGS="*:e" $(ART_VERIDEX_APPCOMPAT_SCRIPT) --dex-file=$@ --api-flags=$(INTERNAL_PLATFORM_HIDDENAPI_FLAGS) 2>&1 >> $(PRODUCT_OUT)/appcompat/$(PRIVATE_MODULE).log
 endef
 appcompat-files = \
-  art/tools/veridex/appcompat.sh \
+  $(ART_VERIDEX_APPCOMPAT_SCRIPT) \
   $(INTERNAL_PLATFORM_HIDDENAPI_FLAGS) \
   $(HOST_OUT_EXECUTABLES)/veridex \
   $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/core_dex_intermediates/classes.dex \
@@ -2442,9 +2443,9 @@
 $(2): \
 	$(1) \
 	$(HOST_INIT_VERIFIER) \
-	$(KNOWN_HIDL_INTERFACES) \
+	$(HIDL_INHERITANCE_HIERARCHY) \
 	$(call intermediates-dir-for,ETC,passwd)/passwd
-	$(hide) $(HOST_INIT_VERIFIER) -p $(call intermediates-dir-for,ETC,passwd)/passwd -k $(KNOWN_HIDL_INTERFACES) $$<
+	$(hide) $(HOST_INIT_VERIFIER) -p $(call intermediates-dir-for,ETC,passwd)/passwd -i $(HIDL_INHERITANCE_HIERARCHY) $$<
 else
 $(2): $(1)
 endif
diff --git a/core/main.mk b/core/main.mk
index d13d793..9182fa7 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1581,12 +1581,6 @@
 .PHONY: ramdisk_debug
 ramdisk_debug: $(INSTALLED_DEBUG_RAMDISK_TARGET)
 
-.PHONY: systemtarball
-systemtarball: $(INSTALLED_SYSTEMTARBALL_TARGET)
-
-.PHONY: boottarball
-boottarball: $(INSTALLED_BOOTTARBALL_TARGET)
-
 .PHONY: userdataimage
 userdataimage: $(INSTALLED_USERDATAIMAGE_TARGET)
 
@@ -1594,9 +1588,6 @@
 $(call dist-for-goals, userdataimage, $(BUILT_USERDATAIMAGE_TARGET))
 endif
 
-.PHONY: userdatatarball
-userdatatarball: $(INSTALLED_USERDATATARBALL_TARGET)
-
 .PHONY: cacheimage
 cacheimage: $(INSTALLED_CACHEIMAGE_TARGET)
 
diff --git a/core/ninja_config.mk b/core/ninja_config.mk
index e9e89c3..694c696 100644
--- a/core/ninja_config.mk
+++ b/core/ninja_config.mk
@@ -16,7 +16,6 @@
 	all \
 	ECLIPSE-% \
 	AUX-% \
-	boottarball-nodeps \
 	brillo_tests \
 	btnod \
 	build-art% \
@@ -44,7 +43,6 @@
 	snod \
 	stnod \
 	systemimage-nodeps \
-	systemtarball-nodeps \
 	target-files-package \
 	test-art% \
 	user \
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 0a798d5..efaacf5 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -252,7 +252,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2019-06-05
+      PLATFORM_SECURITY_PATCH := 2019-07-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/tools/extract_kernel.py b/tools/extract_kernel.py
index 16ccb22..42561cf 100755
--- a/tools/extract_kernel.py
+++ b/tools/extract_kernel.py
@@ -47,7 +47,10 @@
   null_idx = input_bytes.find('\x00', start_idx)
   if null_idx < 0:
     return None
-  linux_banner = input_bytes[start_idx:null_idx].decode()
+  try:
+    linux_banner = input_bytes[start_idx:null_idx].decode()
+  except UnicodeDecodeError:
+    return None
   mo = re.match(LINUX_BANNER_REGEX, linux_banner)
   if mo:
     return mo.group(1)
diff --git a/tools/mktarball.sh b/tools/mktarball.sh
deleted file mode 100755
index ced7e17..0000000
--- a/tools/mktarball.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/bin/bash
-
-# $1: path to fs_get_stats program
-# $2: start dir
-# $3: subdir to tar up (from $2)
-# $4: target tar name
-# $5: target tarball name (usually $(3).bz2)
-# $6: TARGET_OUT path to query device specific FS configs
-
-if [ $# -ne 6 ]; then
-    echo "Error: wrong number of arguments in cmd: $0 $* "
-    exit 1
-fi
-
-fs_get_stats=`readlink -f $1`
-start_dir=`readlink -f $2`
-dir_to_tar=$3
-target_tar=`readlink -f $4`
-target_tarball=`readlink -f $5`
-target_out=`readlink -f $6`
-
-cd $2
-
-#tar --no-recursion -cvf ${target_tar} ${dir_to_tar}
-rm ${target_tar} > /dev/null 2>&1
-
-# do dirs first
-subdirs=`find ${dir_to_tar} -type d -print`
-files=`find ${dir_to_tar} \! -type d -print`
-for f in ${subdirs} ${files} ; do
-    curr_perms=`stat -c 0%a $f`
-    [ -d "$f" ] && is_dir=1 || is_dir=0
-    new_info=`${fs_get_stats} ${curr_perms} ${is_dir} ${f} ${target_out}`
-    new_uid=`echo ${new_info} | awk '{print $1;}'`
-    new_gid=`echo ${new_info} | awk '{print $2;}'`
-    new_perms=`echo ${new_info} | awk '{print $3;}'`
-#    echo "$f: dir: $is_dir curr: $curr_perms uid: $new_uid gid: $new_gid "\
-#         "perms: $new_perms"
-    tar --no-recursion --numeric-owner --owner $new_uid \
-        --group $new_gid --mode $new_perms -rf ${target_tar} ${f}
-done
-
-if [ $? -eq 0 ] ; then
-    case "${target_tarball}" in
-    *.bz2 )
-        bzip2 -c ${target_tar} > ${target_tarball}
-        ;;
-    *.gz )
-        gzip -c ${target_tar} > ${target_tarball}
-        ;;
-    esac
-    success=$?
-    [ $success -eq 0 ] || rm -f ${target_tarball}
-    rm -f ${target_tar}
-    exit $success
-fi
-
-rm -f ${target_tar}
-exit 1
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 9998cd3..0030afa 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -1460,7 +1460,7 @@
     values.
     """
     result = {}
-    for k, v in sorted(current.iteritems()):
+    for k, v in sorted(current.items()):
       if v:
         result[k] = v
       else:
@@ -1481,7 +1481,7 @@
     f.write("# (Additional spaces are harmless.)\n\n")
 
     first_line = None
-    sorted_list = sorted([(not v, k, v) for (k, v) in current.iteritems()])
+    sorted_list = sorted([(not v, k, v) for (k, v) in current.items()])
     for i, (_, k, v) in enumerate(sorted_list):
       f.write("[[[  %s  ]]] %s\n" % (v, k))
       if not v and first_line is None:
@@ -1647,7 +1647,7 @@
     """Keyword arguments to the constructor become attributes of this
     object, which is passed to all functions in the device-specific
     module."""
-    for k, v in kwargs.iteritems():
+    for k, v in kwargs.items():
       setattr(self, k, v)
     self.extras = OPTIONS.extras
 
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 04b627b..4cb3a37 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -188,6 +188,9 @@
   for apex, key in OPTIONS.extra_apex_payload_keys.items():
     if not key:
       key = 'PRESIGNED'
+    if apex not in keys_info:
+      logger.warning('Failed to find %s in target_files; Ignored', apex)
+      continue
     keys_info[apex] = (key, keys_info[apex][1])
 
   # Apply the key remapping to container keys.
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 57973ec..9809ed4 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -381,9 +381,8 @@
         byte[] buffer = new byte[4096];
         int num;
 
-        List<Pattern> pinPatterns = extractPinPatterns(in);
+        List<Hints.PatternWithRange> pinPatterns = extractPinPatterns(in);
         ArrayList<Hints.ByteRange> pinByteRanges = pinPatterns == null ? null : new ArrayList<>();
-        HashSet<String> namesToPin = new HashSet<>();
 
         ArrayList<String> names = new ArrayList<String>();
         for (Enumeration<JarEntry> e = in.entries(); e.hasMoreElements();) {
@@ -399,13 +398,6 @@
             if (Hints.PIN_BYTE_RANGE_ZIP_ENTRY_NAME.equals(entryName)) {
                 continue;  // We regenerate it below.
             }
-            if (pinPatterns != null) {
-                for (Pattern pinPattern : pinPatterns) {
-                    if (pinPattern.matcher(entryName).matches()) {
-                        namesToPin.add(entryName);
-                    }
-                }
-            }
             names.add(entryName);
         }
         Collections.sort(names);
@@ -485,6 +477,7 @@
             DataSink entryDataSink =
                     (inspectEntryRequest != null) ? inspectEntryRequest.getDataSink() : null;
 
+            long entryDataStart = outCounter.getWrittenBytes();
             try (InputStream data = in.getInputStream(inEntry)) {
                 while ((num = data.read(buffer)) > 0) {
                     out.write(buffer, 0, num);
@@ -500,11 +493,27 @@
                 inspectEntryRequest.done();
             }
 
-            if (namesToPin.contains(name)) {
-                pinByteRanges.add(
-                    new Hints.ByteRange(
-                        entryHeaderStart,
-                        outCounter.getWrittenBytes()));
+            if (pinPatterns != null) {
+                boolean pinFileHeader = false;
+                for (Hints.PatternWithRange pinPattern : pinPatterns) {
+                    if (!pinPattern.matcher(name).matches()) {
+                        continue;
+                    }
+                    Hints.ByteRange dataRange =
+                        new Hints.ByteRange(
+                            entryDataStart,
+                            outCounter.getWrittenBytes());
+                    Hints.ByteRange pinRange =
+                        pinPattern.ClampToAbsoluteByteRange(dataRange);
+                    if (pinRange != null) {
+                        pinFileHeader = true;
+                        pinByteRanges.add(pinRange);
+                    }
+                }
+                if (pinFileHeader) {
+                    pinByteRanges.add(new Hints.ByteRange(entryHeaderStart,
+                                                          entryDataStart));
+                }
             }
         }
 
@@ -528,6 +537,7 @@
             DataSink entryDataSink =
                     (inspectEntryRequest != null) ? inspectEntryRequest.getDataSink() : null;
 
+            long entryDataStart = outCounter.getWrittenBytes();
             InputStream data = in.getInputStream(inEntry);
             while ((num = data.read(buffer)) > 0) {
                 out.write(buffer, 0, num);
@@ -541,11 +551,27 @@
                 inspectEntryRequest.done();
             }
 
-            if (namesToPin.contains(name)) {
-                pinByteRanges.add(
-                    new Hints.ByteRange(
-                        entryHeaderStart,
-                        outCounter.getWrittenBytes()));
+            if (pinPatterns != null) {
+                boolean pinFileHeader = false;
+                for (Hints.PatternWithRange pinPattern : pinPatterns) {
+                    if (!pinPattern.matcher(name).matches()) {
+                        continue;
+                    }
+                    Hints.ByteRange dataRange =
+                        new Hints.ByteRange(
+                            entryDataStart,
+                            outCounter.getWrittenBytes());
+                    Hints.ByteRange pinRange =
+                        pinPattern.ClampToAbsoluteByteRange(dataRange);
+                    if (pinRange != null) {
+                        pinFileHeader = true;
+                        pinByteRanges.add(pinRange);
+                    }
+                }
+                if (pinFileHeader) {
+                    pinByteRanges.add(new Hints.ByteRange(entryHeaderStart,
+                                                          entryDataStart));
+                }
             }
         }
 
@@ -558,7 +584,7 @@
         }
     }
 
-    private static List<Pattern> extractPinPatterns(JarFile in) throws IOException {
+    private static List<Hints.PatternWithRange> extractPinPatterns(JarFile in) throws IOException {
         ZipEntry pinMetaEntry = in.getEntry(Hints.PIN_HINT_ASSET_ZIP_ENTRY_NAME);
         if (pinMetaEntry == null) {
             return null;