diff --git a/OWNERS b/OWNERS
index 313a00c..004d638 100644
--- a/OWNERS
+++ b/OWNERS
@@ -2,6 +2,6 @@
 dwillemsen@google.com
 
 per-file * = ccross@android.com
-per-file * = dwillimsen@google.com
+per-file * = dwillemsen@google.com
 per-file *gen_stub_libs.py = danalbert@google.com
 per-file ndk_*.go = danalbert@google.com
diff --git a/android/config.go b/android/config.go
index bf8edca..56e9525 100644
--- a/android/config.go
+++ b/android/config.go
@@ -511,12 +511,13 @@
 	}
 }
 
-func (c *config) DefaultAppCertificate(ctx PathContext) SourcePath {
+func (c *config) DefaultAppCertificate(ctx PathContext) (pem, key SourcePath) {
 	defaultCert := String(c.ProductVariables.DefaultAppCertificate)
 	if defaultCert != "" {
-		return PathForSource(ctx, defaultCert)
+		return PathForSource(ctx, defaultCert+".x509.pem"), PathForSource(ctx, defaultCert+".pk8")
 	} else {
-		return c.DefaultAppCertificateDir(ctx).Join(ctx, "testkey")
+		defaultDir := c.DefaultAppCertificateDir(ctx)
+		return defaultDir.Join(ctx, "testkey.x509.pem"), defaultDir.Join(ctx, "testkey.pk8")
 	}
 }
 
diff --git a/androidmk/cmd/androidmk/android.go b/androidmk/cmd/androidmk/android.go
index 4022a5e..c6e90f0 100644
--- a/androidmk/cmd/androidmk/android.go
+++ b/androidmk/cmd/androidmk/android.go
@@ -153,6 +153,7 @@
 			"LOCAL_PROPRIETARY_MODULE":       "proprietary",
 			"LOCAL_VENDOR_MODULE":            "vendor",
 			"LOCAL_EXPORT_PACKAGE_RESOURCES": "export_package_resources",
+			"LOCAL_PRIVILEGED_MODULE":        "privileged",
 
 			"LOCAL_DEX_PREOPT":                  "dex_preopt.enabled",
 			"LOCAL_DEX_PREOPT_APP_IMAGE":        "dex_preopt.app_image",
@@ -636,22 +637,15 @@
 	return "."
 }
 
-func allJavaFilesUnder(args []string) string {
-	dir := ""
-	if len(args) > 0 {
-		dir = strings.TrimSpace(args[0])
+func allFilesUnder(wildcard string) func(args []string) string {
+	return func(args []string) string {
+		dir := ""
+		if len(args) > 0 {
+			dir = strings.TrimSpace(args[0])
+		}
+
+		return fmt.Sprintf("%s/**/"+wildcard, dir)
 	}
-
-	return fmt.Sprintf("%s/**/*.java", dir)
-}
-
-func allProtoFilesUnder(args []string) string {
-	dir := ""
-	if len(args) > 0 {
-		dir = strings.TrimSpace(args[0])
-	}
-
-	return fmt.Sprintf("%s/**/*.proto", dir)
 }
 
 func allSubdirJavaFiles(args []string) string {
@@ -695,8 +689,11 @@
 	globalScope := mkparser.NewScope(nil)
 	globalScope.Set("CLEAR_VARS", clear_vars)
 	globalScope.SetFunc("my-dir", mydir)
-	globalScope.SetFunc("all-java-files-under", allJavaFilesUnder)
-	globalScope.SetFunc("all-proto-files-under", allProtoFilesUnder)
+	globalScope.SetFunc("all-java-files-under", allFilesUnder("*.java"))
+	globalScope.SetFunc("all-proto-files-under", allFilesUnder("*.proto"))
+	globalScope.SetFunc("all-aidl-files-under", allFilesUnder("*.aidl"))
+	globalScope.SetFunc("all-Iaidl-files-under", allFilesUnder("I*.aidl"))
+	globalScope.SetFunc("all-logtags-files-under", allFilesUnder("*.logtags"))
 	globalScope.SetFunc("all-subdir-java-files", allSubdirJavaFiles)
 	globalScope.SetFunc("all-makefiles-under", includeIgnored)
 	globalScope.SetFunc("first-makefiles-under", includeIgnored)
diff --git a/cc/config/global.go b/cc/config/global.go
index bfb53e9..6f4b3e2 100644
--- a/cc/config/global.go
+++ b/cc/config/global.go
@@ -120,18 +120,14 @@
 	ClangDefaultShortVersion = "5.0.1"
 
 	WarningAllowedProjects = []string{
-		"external/libese/third_party/NXPNFC_P61_JCOP_Kit/",
 		"external/skia/",
 		"device/",
-		"frameworks/av/media/libeffects/factory/",
-		"frameworks/av/media/libstagefright/codecs/",
 		"vendor/",
 	}
 
 	// Some Android.mk files still have warnings.
 	WarningAllowedOldProjects = []string{
 		"frameworks/av/drm/mediacas/plugins/",
-		"frameworks/av/services/mediaextractor/",
 		"hardware/libhardware/modules/",
 		"hardware/qcom/",
 		"tools/adt/idea/android/ultimate/get_modification_time/jni/",
diff --git a/java/androidmk.go b/java/androidmk.go
index af91a33..40ebe5b 100644
--- a/java/androidmk.go
+++ b/java/androidmk.go
@@ -152,30 +152,36 @@
 		Include:    "$(BUILD_SYSTEM)/soong_app_prebuilt.mk",
 		Extra: []android.AndroidMkExtraFunc{
 			func(w io.Writer, outputFile android.Path) {
-				if Bool(app.appProperties.Export_package_resources) {
-					if app.dexJarFile != nil {
-						fmt.Fprintln(w, "LOCAL_SOONG_DEX_JAR :=", app.dexJarFile.String())
-					}
-					fmt.Fprintln(w, "LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE :=", app.exportPackage.String())
-
-					if app.jacocoReportClassesFile != nil {
-						fmt.Fprintln(w, "LOCAL_SOONG_JACOCO_REPORT_CLASSES_JAR :=", app.jacocoReportClassesFile.String())
-					}
-
-					if app.Name() == "framework-res" {
-						fmt.Fprintln(w, "LOCAL_MODULE_PATH := $(TARGET_OUT_JAVA_LIBRARIES)")
-						// Make base_rules.mk not put framework-res in a subdirectory called
-						// framework_res.
-						fmt.Fprintln(w, "LOCAL_NO_STANDARD_LIBRARIES := true")
-					}
-
-					if len(app.rroDirs) > 0 {
-						fmt.Fprintln(w, "LOCAL_SOONG_RRO_DIRS :=", strings.Join(app.rroDirs.Strings(), " "))
-					}
-					fmt.Fprintln(w, "LOCAL_EXPORT_PACKAGE_RESOURCES :=",
-						Bool(app.appProperties.Export_package_resources))
-					fmt.Fprintln(w, "LOCAL_FULL_MANIFEST_FILE :=", app.manifestPath.String())
+				fmt.Fprintln(w, "LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE :=", app.exportPackage.String())
+				if app.dexJarFile != nil {
+					fmt.Fprintln(w, "LOCAL_SOONG_DEX_JAR :=", app.dexJarFile.String())
 				}
+				if app.jacocoReportClassesFile != nil {
+					fmt.Fprintln(w, "LOCAL_SOONG_JACOCO_REPORT_CLASSES_JAR :=", app.jacocoReportClassesFile.String())
+				}
+
+				if app.Name() == "framework-res" {
+					fmt.Fprintln(w, "LOCAL_MODULE_PATH := $(TARGET_OUT_JAVA_LIBRARIES)")
+					// Make base_rules.mk not put framework-res in a subdirectory called
+					// framework_res.
+					fmt.Fprintln(w, "LOCAL_NO_STANDARD_LIBRARIES := true")
+				}
+
+				if len(app.rroDirs) > 0 {
+					fmt.Fprintln(w, "LOCAL_SOONG_RRO_DIRS :=", strings.Join(app.rroDirs.Strings(), " "))
+				}
+
+				if Bool(app.appProperties.Export_package_resources) {
+					fmt.Fprintln(w, "LOCAL_EXPORT_PACKAGE_RESOURCES := true")
+				}
+
+				fmt.Fprintln(w, "LOCAL_FULL_MANIFEST_FILE :=", app.manifestPath.String())
+
+				if Bool(app.appProperties.Privileged) {
+					fmt.Fprintln(w, "LOCAL_PRIVILEGED_MODULE := true")
+				}
+
+				fmt.Fprintln(w, "LOCAL_CERTIFICATE :=", app.certificate.pem.String())
 			},
 		},
 	}
diff --git a/java/app.go b/java/app.go
index ed6a9db..df53375 100644
--- a/java/app.go
+++ b/java/app.go
@@ -61,6 +61,11 @@
 	Resource_dirs []string
 
 	Instrumentation_for *string
+
+	// Specifies that this app should be installed to the priv-app directory,
+	// where the system will grant it additional privileges not available to
+	// normal apps.
+	Privileged *bool
 }
 
 type AndroidApp struct {
@@ -72,6 +77,11 @@
 	exportPackage android.Path
 	rroDirs       android.Paths
 	manifestPath  android.Path
+	certificate   certificate
+}
+
+type certificate struct {
+	pem, key android.Path
 }
 
 func (a *AndroidApp) DepsMutator(ctx android.BottomUpMutatorContext) {
@@ -127,18 +137,30 @@
 		a.Module.compile(ctx, a.aaptSrcJar)
 	}
 
-	certificate := String(a.appProperties.Certificate)
-	if certificate == "" {
-		certificate = ctx.Config().DefaultAppCertificate(ctx).String()
-	} else if dir, _ := filepath.Split(certificate); dir == "" {
-		certificate = filepath.Join(ctx.Config().DefaultAppCertificateDir(ctx).String(), certificate)
-	} else {
-		certificate = filepath.Join(android.PathForSource(ctx).String(), certificate)
+	c := String(a.appProperties.Certificate)
+	switch {
+	case c == "":
+		pem, key := ctx.Config().DefaultAppCertificate(ctx)
+		a.certificate = certificate{pem, key}
+	case strings.ContainsRune(c, '/'):
+		a.certificate = certificate{
+			android.PathForSource(ctx, c+".x509.pem"),
+			android.PathForSource(ctx, c+".pk8"),
+		}
+	default:
+		defaultDir := ctx.Config().DefaultAppCertificateDir(ctx)
+		a.certificate = certificate{
+			defaultDir.Join(ctx, c+".x509.pem"),
+			defaultDir.Join(ctx, c+".pk8"),
+		}
 	}
 
-	certificates := []string{certificate}
+	certificates := []certificate{a.certificate}
 	for _, c := range a.appProperties.Additional_certificates {
-		certificates = append(certificates, filepath.Join(android.PathForSource(ctx).String(), c))
+		certificates = append(certificates, certificate{
+			android.PathForSource(ctx, c+".x509.pem"),
+			android.PathForSource(ctx, c+".pk8"),
+		})
 	}
 
 	packageFile := android.PathForModuleOut(ctx, "package.apk")
@@ -152,6 +174,8 @@
 	if ctx.ModuleName() == "framework-res" {
 		// framework-res.apk is installed as system/framework/framework-res.apk
 		ctx.InstallFile(android.PathForModuleInstall(ctx, "framework"), ctx.ModuleName()+".apk", a.outputFile)
+	} else if Bool(a.appProperties.Privileged) {
+		ctx.InstallFile(android.PathForModuleInstall(ctx, "priv-app"), ctx.ModuleName()+".apk", a.outputFile)
 	} else {
 		ctx.InstallFile(android.PathForModuleInstall(ctx, "app"), ctx.ModuleName()+".apk", a.outputFile)
 	}
diff --git a/java/app_builder.go b/java/app_builder.go
index 676ed58..945d7bd 100644
--- a/java/app_builder.go
+++ b/java/app_builder.go
@@ -61,7 +61,7 @@
 	})
 
 func CreateAppPackage(ctx android.ModuleContext, outputFile android.WritablePath,
-	resJarFile, dexJarFile android.Path, certificates []string) {
+	resJarFile, dexJarFile android.Path, certificates []certificate) {
 
 	// TODO(ccross): JNI libs
 
@@ -80,7 +80,7 @@
 
 	var certificateArgs []string
 	for _, c := range certificates {
-		certificateArgs = append(certificateArgs, c+".x509.pem", c+".pk8")
+		certificateArgs = append(certificateArgs, c.pem.String(), c.key.String())
 	}
 
 	// TODO(ccross): sometimes uncompress dex