diff --git a/core/binary.mk b/core/binary.mk
index 848bba9..b37ef80 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -1805,6 +1805,10 @@
 $(LOCAL_BUILT_MODULE) : | $(export_includes) $(my_link_type)
 
 ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
+ifneq (,$(filter-out $(LOCAL_PATH)/%,$(my_export_c_include_dirs)))
+my_soong_problems += non_local__export_c_include_dirs
+endif
+
 SOONG_CONV.$(LOCAL_MODULE).PROBLEMS := \
     $(SOONG_CONV.$(LOCAL_MODULE).PROBLEMS) $(my_soong_problems)
 SOONG_CONV.$(LOCAL_MODULE).DEPS := \
diff --git a/core/clang/config.mk b/core/clang/config.mk
index 60e0641..b4fe708 100644
--- a/core/clang/config.mk
+++ b/core/clang/config.mk
@@ -1,14 +1,7 @@
 ## Clang configurations.
 
-LLVM_PREBUILTS_PATH := $(LLVM_PREBUILTS_BASE)/$(BUILD_OS)-x86/$(LLVM_PREBUILTS_VERSION)/bin
 LLVM_RTLIB_PATH := $(LLVM_PREBUILTS_PATH)/../lib64/clang/$(LLVM_RELEASE_VERSION)/lib/linux/
 
-# These will come from Soong, drop the environment versions
-unexport CLANG
-unexport CLANG_CXX
-unexport CCC_CC
-unexport CCC_CXX
-
 CLANG_TBLGEN := $(BUILD_OUT_EXECUTABLES)/clang-tblgen$(BUILD_EXECUTABLE_SUFFIX)
 LLVM_TBLGEN := $(BUILD_OUT_EXECUTABLES)/llvm-tblgen$(BUILD_EXECUTABLE_SUFFIX)
 
diff --git a/core/clang/versions.mk b/core/clang/versions.mk
index 03341d9..d9c8aab 100644
--- a/core/clang/versions.mk
+++ b/core/clang/versions.mk
@@ -1,5 +1,3 @@
 ## Clang/LLVM release versions.
 
-LLVM_RELEASE_VERSION := 3.8
 LLVM_PREBUILTS_VERSION ?= clang-3289846
-LLVM_PREBUILTS_BASE ?= prebuilts/clang/host
diff --git a/core/config.mk b/core/config.mk
index 9a35b2f..2f43f46 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -716,8 +716,11 @@
 $(TARGET_2ND_ARCH_VAR_PREFIX)DEX2OAT_TARGET_INSTRUCTION_SET_FEATURES := default
 endif
 
-# define clang/llvm tools and global flags
-include $(BUILD_SYSTEM)/clang/config.mk
+# These will come from Soong, drop the environment versions
+unexport CLANG
+unexport CLANG_CXX
+unexport CCC_CC
+unexport CCC_CXX
 
 # ###############################################################
 # Collect a list of the SDK versions that we could compile against
diff --git a/core/definitions.mk b/core/definitions.mk
index 969260b..13cec0f 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -2596,21 +2596,6 @@
 fi
 endef
 
-# Returns the minSdkVersion of the specified APK as a decimal number. If the
-# version is a codename, returns the current platform SDK version (always a
-# decimal number) instead. If the APK does not specify a minSdkVersion, returns
-# 0 to match how the Android platform interprets this situation at runtime.
-#
-# This currently substitutes any version which contains characters other than
-# digits with the current platform's API Level number. This is because I
-# couldn't figure out an easy way to perform the substitution only for the
-# version codes listed in PLATFORM_VERSION_ALL_CODENAMES.
-define get-package-min-sdk-version-int
-$$(($(AAPT) dump badging $(1) 2>&1 | grep '^sdkVersion' || echo "sdkVersion:'0'") \
-    | cut -d"'" -f2 | \
-    sed -e s/^.*[^0-9].*$$/$(PLATFORM_SDK_VERSION)/)
-endef
-
 # Sign a package using the specified key/cert.
 #
 define sign-package
@@ -2621,7 +2606,6 @@
 define sign-package-arg
 $(hide) mv $(1) $(1).unsigned
 $(hide) java -Djava.library.path=$(SIGNAPK_JNI_LIBRARY_PATH) -jar $(SIGNAPK_JAR) \
-    --min-sdk-version $(call get-package-min-sdk-version-int,$@.unsigned) \
     $(PRIVATE_CERTIFICATE) $(PRIVATE_PRIVATE_KEY) \
     $(PRIVATE_ADDITIONAL_CERTIFICATES) $(1).unsigned $(1).signed
 $(hide) mv $(1).signed $(1)
diff --git a/core/main.mk b/core/main.mk
index 5a3042a..77b213c 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -50,6 +50,8 @@
 
 include $(SOONG_MAKEVARS_MK)
 
+include $(BUILD_SYSTEM)/clang/config.mk
+
 # Write the build number to a file so it can be read back in
 # without changing the command line every time.  Avoids rebuilds
 # when using ninja.
diff --git a/core/post_clean.mk b/core/post_clean.mk
index d7e8322..553f728 100644
--- a/core/post_clean.mk
+++ b/core/post_clean.mk
@@ -17,7 +17,7 @@
 
 #######################################################
 # Check if we need to delete obsolete generated java files.
-# When an aidl/proto/etc file gets deleted (or renamed), the generated java file is obsolete.
+# When an proto/etc file gets deleted (or renamed), the generated java file is obsolete.
 previous_gen_java_config := $(TARGET_OUT_COMMON_INTERMEDIATES)/previous_gen_java_config.mk
 current_gen_java_config := $(TARGET_OUT_COMMON_INTERMEDIATES)/current_gen_java_config.mk
 
@@ -29,8 +29,7 @@
 intermediates_to_clean :=
 modules_with_gen_java_files :=
 $(foreach p, $(ALL_MODULES), \
-  $(eval gs := $(strip $(ALL_MODULES.$(p).AIDL_FILES)\
-                       $(ALL_MODULES.$(p).PROTO_FILES)\
+  $(eval gs := $(strip $(ALL_MODULES.$(p).PROTO_FILES)\
                        $(ALL_MODULES.$(p).RS_FILES)))\
   $(if $(gs),\
     $(eval modules_with_gen_java_files += $(p))\
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index d9f9ea8..10512ff 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -299,7 +299,7 @@
 endif
 $(built_module): PRIVATE_EMBEDDED_JNI_LIBS := $(embedded_prebuilt_jni_libs)
 
-$(built_module) : $(my_prebuilt_src_file) | $(ZIPALIGN) $(SIGNAPK_JAR) $(AAPT)
+$(built_module) : $(my_prebuilt_src_file) | $(ZIPALIGN) $(SIGNAPK_JAR)
 	$(transform-prebuilt-to-target)
 	$(uncompress-shared-libs)
 ifdef LOCAL_DEX_PREOPT
@@ -346,7 +346,7 @@
 $(built_apk_splits) : $(LOCAL_CERTIFICATE).pk8 $(LOCAL_CERTIFICATE).x509.pem
 $(built_apk_splits) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8
 $(built_apk_splits) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem
-$(built_apk_splits) : $(built_module_path)/%.apk : $(my_src_dir)/%.apk | $(AAPT)
+$(built_apk_splits) : $(built_module_path)/%.apk : $(my_src_dir)/%.apk
 	$(copy-file-to-new-target)
 	$(sign-package)
 
diff --git a/target/product/core.mk b/target/product/core.mk
index 0a4e0fd..10b2c9e 100644
--- a/target/product/core.mk
+++ b/target/product/core.mk
@@ -44,6 +44,7 @@
     Launcher2 \
     ManagedProvisioning \
     MtpDocumentsProvider \
+    NetworkRecommendation \
     PicoTts \
     PacProcessor \
     libpac \
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 78b61a6..48916b2 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -80,7 +80,8 @@
 # SELinux packages
 PRODUCT_PACKAGES += \
     file_contexts.bin \
-    mac_permissions.xml \
+    nonplat_mac_permissions.xml \
+    plat_mac_permissions.xml \
     property_contexts \
     seapp_contexts \
     selinux_version \
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 10e220c..3b00599 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -37,6 +37,7 @@
 import com.android.apksig.ApkSignerEngine;
 import com.android.apksig.DefaultApkSignerEngine;
 import com.android.apksig.apk.ApkUtils;
+import com.android.apksig.apk.MinSdkVersionException;
 import com.android.apksig.util.DataSink;
 import com.android.apksig.util.DataSources;
 import com.android.apksig.zip.ZipFormatException;
@@ -890,6 +891,37 @@
         return result;
     }
 
+    /**
+     * Returns the API Level corresponding to the APK's minSdkVersion.
+     *
+     * @throws MinSdkVersionException if the API Level cannot be determined from the APK.
+     */
+    private static final int getMinSdkVersion(JarFile apk) throws MinSdkVersionException {
+        JarEntry manifestEntry = apk.getJarEntry("AndroidManifest.xml");
+        if (manifestEntry == null) {
+            throw new MinSdkVersionException("No AndroidManifest.xml in APK");
+        }
+        byte[] manifestBytes;
+        try {
+            try (InputStream manifestIn = apk.getInputStream(manifestEntry)) {
+                manifestBytes = toByteArray(manifestIn);
+            }
+        } catch (IOException e) {
+            throw new MinSdkVersionException("Failed to read AndroidManifest.xml", e);
+        }
+        return ApkUtils.getMinSdkVersionFromBinaryAndroidManifest(ByteBuffer.wrap(manifestBytes));
+    }
+
+    private static byte[] toByteArray(InputStream in) throws IOException {
+        ByteArrayOutputStream result = new ByteArrayOutputStream();
+        byte[] buf = new byte[65536];
+        int chunkSize;
+        while ((chunkSize = in.read(buf)) != -1) {
+            result.write(buf, 0, chunkSize);
+        }
+        return result.toByteArray();
+    }
+
     private static void usage() {
         System.err.println("Usage: signapk [-w] " +
                            "[-a <alignment>] " +
@@ -916,7 +948,7 @@
         boolean signWholeFile = false;
         String providerClass = null;
         int alignment = 4;
-        int minSdkVersion = 0;
+        Integer minSdkVersionOverride = null;
         boolean signUsingApkSignatureSchemeV2 = true;
 
         int argstart = 0;
@@ -936,7 +968,7 @@
             } else if ("--min-sdk-version".equals(args[argstart])) {
                 String minSdkVersionString = args[++argstart];
                 try {
-                    minSdkVersion = Integer.parseInt(minSdkVersionString);
+                    minSdkVersionOverride = Integer.parseInt(minSdkVersionString);
                 } catch (NumberFormatException e) {
                     throw new IllegalArgumentException(
                             "--min-sdk-version must be a decimal number: " + minSdkVersionString);
@@ -1004,6 +1036,20 @@
                         timestamp,
                         outputFile);
             } else {
+                // Determine the value to use as minSdkVersion of the APK being signed
+                int minSdkVersion;
+                if (minSdkVersionOverride != null) {
+                    minSdkVersion = minSdkVersionOverride;
+                } else {
+                    try {
+                        minSdkVersion = getMinSdkVersion(inputJar);
+                    } catch (MinSdkVersionException e) {
+                        throw new IllegalArgumentException(
+                                "Cannot detect minSdkVersion. Use --min-sdk-version to override",
+                                e);
+                    }
+                }
+
                 try (ApkSignerEngine apkSigner =
                         new DefaultApkSignerEngine.Builder(
                                 createSignerConfigs(privateKey, publicKey), minSdkVersion)