diff --git a/core/Makefile b/core/Makefile
index 42d42bb..9a6ced4 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -522,12 +522,10 @@
 
 INTERNAL_BOOTIMAGE_FILES := $(filter-out --%,$(INTERNAL_BOOTIMAGE_ARGS))
 
-BOARD_KERNEL_BASE := $(strip $(BOARD_KERNEL_BASE))
 ifdef BOARD_KERNEL_BASE
   INTERNAL_BOOTIMAGE_ARGS += --base $(BOARD_KERNEL_BASE)
 endif
 
-BOARD_KERNEL_PAGESIZE := $(strip $(BOARD_KERNEL_PAGESIZE))
 ifdef BOARD_KERNEL_PAGESIZE
   INTERNAL_BOOTIMAGE_ARGS += --pagesize $(BOARD_KERNEL_PAGESIZE)
 endif
@@ -539,9 +537,9 @@
 endif
 endif
 
-BOARD_KERNEL_CMDLINE := $(strip $(BOARD_KERNEL_CMDLINE) buildvariant=$(TARGET_BUILD_VARIANT) $(VERITY_KEYID))
-ifdef BOARD_KERNEL_CMDLINE
-INTERNAL_BOOTIMAGE_ARGS += --cmdline "$(BOARD_KERNEL_CMDLINE)"
+INTERNAL_KERNEL_CMDLINE := $(strip $(BOARD_KERNEL_CMDLINE) buildvariant=$(TARGET_BUILD_VARIANT) $(VERITY_KEYID))
+ifdef INTERNAL_KERNEL_CMDLINE
+INTERNAL_BOOTIMAGE_ARGS += --cmdline "$(INTERNAL_KERNEL_CMDLINE)"
 endif
 
 INTERNAL_MKBOOTIMG_VERSION_ARGS := \
@@ -632,6 +630,7 @@
 endif # BOARD_USES_RECOVERY_AS_BOOT
 
 else	# TARGET_NO_KERNEL
+INTERNAL_KERNEL_CMDLINE := $(strip $(BOARD_KERNEL_CMDLINE))
 # HACK: The top-level targets depend on the bootimage.  Not all targets
 # can produce a bootimage, though, and emulator targets need the ramdisk
 # instead.  Fake it out by calling the ramdisk the bootimage.
@@ -977,13 +976,12 @@
 	--ramdisk $(recovery_ramdisk)
 
 # Assumes this has already been stripped
-ifdef BOARD_KERNEL_CMDLINE
-  INTERNAL_RECOVERYIMAGE_ARGS += --cmdline "$(BOARD_KERNEL_CMDLINE)"
+ifdef INTERNAL_KERNEL_CMDLINE
+  INTERNAL_RECOVERYIMAGE_ARGS += --cmdline "$(INTERNAL_KERNEL_CMDLINE)"
 endif
 ifdef BOARD_KERNEL_BASE
   INTERNAL_RECOVERYIMAGE_ARGS += --base $(BOARD_KERNEL_BASE)
 endif
-BOARD_KERNEL_PAGESIZE := $(strip $(BOARD_KERNEL_PAGESIZE))
 ifdef BOARD_KERNEL_PAGESIZE
   INTERNAL_RECOVERYIMAGE_ARGS += --pagesize $(BOARD_KERNEL_PAGESIZE)
 endif
@@ -1346,7 +1344,7 @@
     $(hide) echo "Target boot fs tarball: $(INSTALLED_BOOTTARBALL_TARGET)"
     $(hide) mkdir -p $(PRODUCT_OUT)/boot
     $(hide) cp -f $(INTERNAL_BOOTIMAGE_FILES) $(PRODUCT_OUT)/boot/.
-    $(hide) echo $(BOARD_KERNEL_CMDLINE) > $(PRODUCT_OUT)/boot/cmdline
+    $(hide) echo $(INTERNAL_KERNEL_CMDLINE) > $(PRODUCT_OUT)/boot/cmdline
     $(hide) $(MKTARBALL) $(FS_GET_STATS) \
                  $(PRODUCT_OUT) boot $(PRIVATE_BOOT_TAR) \
                  $(INSTALLED_BOOTTARBALL_TARGET) $(TARGET_OUT)
@@ -1812,8 +1810,8 @@
 	$(hide) $(ACP) \
 		$(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/second
 endif
-ifdef BOARD_KERNEL_CMDLINE
-	$(hide) echo "$(BOARD_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
+ifdef INTERNAL_KERNEL_CMDLINE
+	$(hide) echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
 endif
 ifdef BOARD_KERNEL_BASE
 	$(hide) echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/base
@@ -1841,8 +1839,8 @@
 	$(hide) $(ACP) \
 		$(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/BOOT/second
 endif
-ifdef BOARD_KERNEL_CMDLINE
-	$(hide) echo "$(BOARD_KERNEL_CMDLINE)" > $(zip_root)/BOOT/cmdline
+ifdef INTERNAL_KERNEL_CMDLINE
+	$(hide) echo "$(INTERNAL_KERNEL_CMDLINE)" > $(zip_root)/BOOT/cmdline
 endif
 ifdef BOARD_KERNEL_BASE
 	$(hide) echo "$(BOARD_KERNEL_BASE)" > $(zip_root)/BOOT/base
diff --git a/core/config.mk b/core/config.mk
index d46e5de..17fb82c 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -216,6 +216,9 @@
 endif
 TARGET_CPU_ABI2 := $(strip $(TARGET_CPU_ABI2))
 
+BOARD_KERNEL_BASE := $(strip $(BOARD_KERNEL_BASE))
+BOARD_KERNEL_PAGESIZE := $(strip $(BOARD_KERNEL_PAGESIZE))
+
 # Commands to generate .toc file common to ELF .so files.
 define _gen_toc_command_for_elf
 $(hide) ($($(PRIVATE_2ND_ARCH_VAR_PREFIX)$(PRIVATE_PREFIX)READELF) -d $(1) | grep SONAME || echo "No SONAME for $1") > $(2)
diff --git a/core/main.mk b/core/main.mk
index de77927..dabe093 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -504,12 +504,9 @@
 
 FULL_BUILD := true
 
-# Before we go and include all of the module makefiles, stash away
-# the PRODUCT_* values so that later we can verify they are not modified.
-stash_product_vars:=true
-ifeq ($(stash_product_vars),true)
-  $(call stash-product-vars, __STASHED)
-endif
+# Before we go and include all of the module makefiles, mark the PRODUCT_*
+# values readonly so that they won't be modified.
+$(call readonly-product-vars)
 
 ifneq ($(ONE_SHOT_MAKEFILE),)
 # We've probably been invoked by the "mm" shell function
@@ -574,10 +571,6 @@
 # Now with all Android.mks loaded we can do post cleaning steps.
 include $(BUILD_SYSTEM)/post_clean.mk
 
-ifeq ($(stash_product_vars),true)
-  $(call assert-product-vars, __STASHED)
-endif
-
 # -------------------------------------------------------------------
 # All module makefiles have been included at this point.
 # -------------------------------------------------------------------
diff --git a/core/product.mk b/core/product.mk
index 7193cf7..d4790d5 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -296,33 +296,15 @@
 	GLOBAL_CLANG_CFLAGS_NO_OVERRIDE \
 
 #
-# Stash values of the variables in _product_stash_var_list.
-# $(1): Renamed prefix
+# Mark the variables in _product_stash_var_list as readonly
 #
-define stash-product-vars
+define readonly-product-vars
 $(foreach v,$(_product_stash_var_list), \
-        $(eval $(strip $(1))_rot26_$(v):=$$($$(v))) \
+	$(eval $(v) ?=) \
+	$(eval .KATI_READONLY := $(v)) \
  )
 endef
 
-#
-# Assert that the the variable stashed by stash-product-vars remains untouched.
-# $(1): The prefix as supplied to stash-product-vars
-#
-define assert-product-vars
-$(strip \
-  $(eval changed_variables:=)
-  $(foreach v,$(_product_stash_var_list), \
-    $(if $(call streq,$($(v)),$($(strip $(1))_rot26_$(v))),, \
-        $(eval $(warning $(v) has been modified: $($(v)))) \
-        $(eval $(warning previous value: $($(strip $(1))_$(call rot13,$(v))))) \
-        $(eval changed_variables := $(changed_variables) $(v))) \
-   ) \
-  $(if $(changed_variables),\
-    $(eval $(error The following variables have been changed: $(changed_variables))),)
-)
-endef
-
 define add-to-product-copy-files-if-exists
 $(if $(wildcard $(word 1,$(subst :, ,$(1)))),$(1))
 endef
diff --git a/core/shared_library_internal.mk b/core/shared_library_internal.mk
index 05886fa..1a8975a 100644
--- a/core/shared_library_internal.mk
+++ b/core/shared_library_internal.mk
@@ -96,17 +96,23 @@
         STATIC_LIBRARIES,$(lib),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX), \
         $(my_host_cross))/$(lib)$(gcno_suffix))
 
-GCNO_ARCHIVE := $(LOCAL_MODULE)$(gcno_suffix)
+ifdef LOCAL_IS_HOST_MODULE
+my_coverage_path := $($(my_prefix)OUT_COVERAGE)/$(patsubst $($(my_prefix)OUT)/%,%,$(my_module_path))
+else
+my_coverage_path := $(TARGET_OUT_COVERAGE)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
+endif
+
+GCNO_ARCHIVE := $(basename $(my_installed_module_stem))$(gcno_suffix)
 
 $(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_OBJECTS := $(strip $(LOCAL_GCNO_FILES))
 $(intermediates)/$(GCNO_ARCHIVE) : PRIVATE_ALL_WHOLE_STATIC_LIBRARIES := $(strip $(built_whole_gcno_libraries)) $(strip $(built_static_gcno_libraries))
 $(intermediates)/$(GCNO_ARCHIVE) : $(LOCAL_GCNO_FILES) $(built_whole_gcno_libraries) $(built_static_gcno_libraries)
 	$(transform-o-to-static-lib)
 
-$($(my_prefix)OUT_COVERAGE)/$(GCNO_ARCHIVE) : $(intermediates)/$(GCNO_ARCHIVE)
+$(my_coverage_path)/$(GCNO_ARCHIVE) : $(intermediates)/$(GCNO_ARCHIVE)
 	$(copy-file-to-target)
 
-$(LOCAL_BUILT_MODULE): $($(my_prefix)OUT_COVERAGE)/$(GCNO_ARCHIVE)
+$(LOCAL_BUILT_MODULE): $(my_coverage_path)/$(GCNO_ARCHIVE)
 endif
 
 endif  # skip_build_from_source
diff --git a/tools/warn.py b/tools/warn.py
index 4ed4952..ea1cd22 100755
--- a/tools/warn.py
+++ b/tools/warn.py
@@ -109,17 +109,19 @@
   HIGH = 1
   MEDIUM = 2
   LOW = 3
-  TIDY = 4
-  HARMLESS = 5
-  UNKNOWN = 6
-  SKIP = 7
-  range = range(8)
+  ANALYZER = 4
+  TIDY = 5
+  HARMLESS = 6
+  UNKNOWN = 7
+  SKIP = 8
+  range = range(SKIP + 1)
   attributes = [
       # pylint:disable=bad-whitespace
       ['fuchsia',   'FixNow',    'Critical warnings, fix me now'],
       ['red',       'High',      'High severity warnings'],
       ['orange',    'Medium',    'Medium severity warnings'],
       ['yellow',    'Low',       'Low severity warnings'],
+      ['hotpink',   'Analyzer',  'Clang-Analyzer warnings'],
       ['peachpuff', 'Tidy',      'Clang-Tidy warnings'],
       ['limegreen', 'Harmless',  'Harmless warnings'],
       ['lightblue', 'Unknown',   'Unknown warnings'],
@@ -131,6 +133,9 @@
 
 warn_patterns = [
     # pylint:disable=line-too-long,g-inconsistent-quotes
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
+     'description': 'clang-analyzer Security warning',
+     'patterns': [r".*: warning: .+\[clang-analyzer-security.*\]"]},
     {'category': 'make', 'severity': Severity.MEDIUM,
      'description': 'make: overriding commands/ignoring old commands',
      'patterns': [r".*: warning: overriding commands for target .+",
@@ -1283,8 +1288,8 @@
      'description': 'Comment inside comment',
      'patterns': [r".*: warning: "".+"" within comment"]},
     # Warning "value stored is never read" could be from clang-tidy or clang static analyzer.
-    {'category': 'C/C++', 'severity': Severity.TIDY,
-     'description': 'clang-tidy Value stored is never read',
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
+     'description': 'clang-analyzer Value stored is never read',
      'patterns': [r".*: warning: Value stored to .+ is never read.*clang-analyzer-deadcode.DeadStores"]},
     {'category': 'C/C++', 'severity': Severity.LOW,
      'description': 'Value stored is never read',
@@ -1601,46 +1606,46 @@
     {'category': 'C/C++', 'severity': Severity.TIDY,
      'description': 'clang-tidy performance-unnecessary-value-param',
      'patterns': [r".*: .+\[performance-unnecessary-value-param\]$"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Unreachable code',
      'patterns': [r".*: warning: This statement is never executed.*UnreachableCode"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Size of malloc may overflow',
      'patterns': [r".*: warning: .* size of .* may overflow .*MallocOverflow"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Stream pointer might be NULL',
      'patterns': [r".*: warning: Stream pointer might be NULL .*unix.Stream"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Opened file never closed',
      'patterns': [r".*: warning: Opened File never closed.*unix.Stream"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer sozeof() on a pointer type',
      'patterns': [r".*: warning: .*calls sizeof.* on a pointer type.*SizeofPtr"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Pointer arithmetic on non-array variables',
      'patterns': [r".*: warning: Pointer arithmetic on non-array variables .*PointerArithm"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Subtraction of pointers of different memory chunks',
      'patterns': [r".*: warning: Subtraction of two pointers .*PointerSub"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Access out-of-bound array element',
      'patterns': [r".*: warning: Access out-of-bound array element .*ArrayBound"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Out of bound memory access',
      'patterns': [r".*: warning: Out of bound memory access .*ArrayBoundV2"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Possible lock order reversal',
      'patterns': [r".*: warning: .* Possible lock order reversal.*PthreadLock"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer Argument is a pointer to uninitialized value',
      'patterns': [r".*: warning: .* argument is a pointer to uninitialized value .*CallAndMessage"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer cast to struct',
      'patterns': [r".*: warning: Casting a non-structure type to a structure type .*CastToStruct"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer call path problems',
      'patterns': [r".*: warning: Call Path : .+"]},
-    {'category': 'C/C++', 'severity': Severity.TIDY,
+    {'category': 'C/C++', 'severity': Severity.ANALYZER,
      'description': 'clang-analyzer other',
      'patterns': [r".*: .+\[clang-analyzer-.+\]$",
                   r".*: Call Path : .+$"]},