diff --git a/cmds/atrace/atrace.cpp b/cmds/atrace/atrace.cpp
index d276696..443f885 100644
--- a/cmds/atrace/atrace.cpp
+++ b/cmds/atrace/atrace.cpp
@@ -62,7 +62,7 @@
 
 using std::string;
 
-#define MAX_SYS_FILES 10
+#define MAX_SYS_FILES 11
 
 const char* k_traceTagsProperty = "debug.atrace.tags.enableflags";
 const char* k_userInitiatedTraceProperty = "debug.atrace.user_initiated";
@@ -132,7 +132,11 @@
         { OPT,      "events/sched/sched_blocked_reason/enable" },
         { OPT,      "events/sched/sched_cpu_hotplug/enable" },
         { OPT,      "events/sched/sched_pi_setprio/enable" },
+        { OPT,      "events/sched/sched_process_exit/enable" },
         { OPT,      "events/cgroup/enable" },
+        { OPT,      "events/oom/oom_score_adj_update/enable" },
+        { OPT,      "events/task/task_rename/enable" },
+        { OPT,      "events/task/task_newtask/enable" },
     } },
     { "irq",        "IRQ Events",   0, {
         { REQ,      "events/irq/enable" },
@@ -230,10 +234,6 @@
         { OPT,      "events/kmem/rss_stat/enable" },
         { OPT,      "events/kmem/ion_heap_grow/enable" },
         { OPT,      "events/kmem/ion_heap_shrink/enable" },
-        { OPT,      "events/oom/oom_score_adj_update/enable" },
-        { OPT,      "events/sched/sched_process_exit/enable" },
-        { OPT,      "events/task/task_rename/enable" },
-        { OPT,      "events/task/task_newtask/enable" },
     } },
 };
 
diff --git a/cmds/atrace/atrace.rc b/cmds/atrace/atrace.rc
index 66c9cc6..032d072 100644
--- a/cmds/atrace/atrace.rc
+++ b/cmds/atrace/atrace.rc
@@ -33,6 +33,10 @@
     chmod 0666 /sys/kernel/tracing/events/sched/sched_cpu_hotplug/enable
     chmod 0666 /sys/kernel/debug/tracing/events/sched/sched_pi_setprio/enable
     chmod 0666 /sys/kernel/tracing/events/sched/sched_pi_setprio/enable
+    chmod 0666 /sys/kernel/debug/tracing/events/sched/sched_process_exit/enable
+    chmod 0666 /sys/kernel/tracing/events/sched/sched_process_exit/enable
+    chmod 0666 /sys/kernel/debug/tracing/events/sched/sched_waking/enable
+    chmod 0666 /sys/kernel/tracing/events/sched/sched_waking/enable
     chmod 0666 /sys/kernel/debug/tracing/events/cgroup/enable
     chmod 0666 /sys/kernel/tracing/events/cgroup/enable
     chmod 0666 /sys/kernel/debug/tracing/events/power/cpu_frequency/enable
diff --git a/cmds/bugreport/bugreport.cpp b/cmds/bugreport/bugreport.cpp
index 917c813..840ae47 100644
--- a/cmds/bugreport/bugreport.cpp
+++ b/cmds/bugreport/bugreport.cpp
@@ -37,7 +37,7 @@
   property_set("ctl.start", "dumpstate");
 
   // Socket will not be available until service starts.
-  int s;
+  int s = -1;
   for (int i = 0; i < 20; i++) {
     s = socket_local_client("dumpstate", ANDROID_SOCKET_NAMESPACE_RESERVED,
                             SOCK_STREAM);
diff --git a/cmds/bugreportz/main.cpp b/cmds/bugreportz/main.cpp
index a3ae1ff..945eae5 100644
--- a/cmds/bugreportz/main.cpp
+++ b/cmds/bugreportz/main.cpp
@@ -72,7 +72,7 @@
     property_set("ctl.start", "dumpstatez");
 
     // Socket will not be available until service starts.
-    int s;
+    int s = -1;
     for (int i = 0; i < 20; i++) {
         s = socket_local_client("dumpstate", ANDROID_SOCKET_NAMESPACE_RESERVED, SOCK_STREAM);
         if (s >= 0) break;
diff --git a/cmds/dumpstate/dumpstate.cpp b/cmds/dumpstate/dumpstate.cpp
index 0ac3e93..32f7e6d 100644
--- a/cmds/dumpstate/dumpstate.cpp
+++ b/cmds/dumpstate/dumpstate.cpp
@@ -91,7 +91,6 @@
 using android::os::dumpstate::CommandOptions;
 using android::os::dumpstate::DumpFileToFd;
 using android::os::dumpstate::DumpstateSectionReporter;
-using android::os::dumpstate::GetPidByName;
 using android::os::dumpstate::PropertiesHelper;
 
 typedef Dumpstate::ConsentCallback::ConsentResult UserConsentResult;
@@ -394,108 +393,6 @@
     closedir(d);
 }
 
-
-
-// dump anrd's trace and add to the zip file.
-// 1. check if anrd is running on this device.
-// 2. send a SIGUSR1 to its pid which will dump anrd's trace.
-// 3. wait until the trace generation completes and add to the zip file.
-static bool dump_anrd_trace() {
-    unsigned int pid;
-    char buf[50], path[PATH_MAX];
-    struct dirent *trace;
-    struct stat st;
-    DIR *trace_dir;
-    int retry = 5;
-    long max_ctime = 0, old_mtime;
-    long long cur_size = 0;
-    const char *trace_path = "/data/misc/anrd/";
-
-    if (!ds.IsZipping()) {
-        MYLOGE("Not dumping anrd trace because it's not a zipped bugreport\n");
-        return false;
-    }
-
-    // find anrd's pid if it is running.
-    pid = GetPidByName("/system/bin/anrd");
-
-    if (pid > 0) {
-        if (stat(trace_path, &st) == 0) {
-            old_mtime = st.st_mtime;
-        } else {
-            MYLOGE("Failed to find: %s\n", trace_path);
-            return false;
-        }
-
-        // send SIGUSR1 to the anrd to generate a trace.
-        sprintf(buf, "%u", pid);
-        if (RunCommand("ANRD_DUMP", {"kill", "-SIGUSR1", buf},
-                       CommandOptions::WithTimeout(1).Build())) {
-            MYLOGE("anrd signal timed out. Please manually collect trace\n");
-            return false;
-        }
-
-        while (retry-- > 0 && old_mtime == st.st_mtime) {
-            sleep(1);
-            stat(trace_path, &st);
-        }
-
-        if (retry < 0 && old_mtime == st.st_mtime) {
-            MYLOGE("Failed to stat %s or trace creation timeout\n", trace_path);
-            return false;
-        }
-
-        // identify the trace file by its creation time.
-        if (!(trace_dir = opendir(trace_path))) {
-            MYLOGE("Can't open trace file under %s\n", trace_path);
-        }
-        while ((trace = readdir(trace_dir))) {
-            if (strcmp(trace->d_name, ".") == 0
-                    || strcmp(trace->d_name, "..") == 0) {
-                continue;
-            }
-            sprintf(path, "%s%s", trace_path, trace->d_name);
-            if (stat(path, &st) == 0) {
-                if (st.st_ctime > max_ctime) {
-                    max_ctime = st.st_ctime;
-                    sprintf(buf, "%s", trace->d_name);
-                }
-            }
-        }
-        closedir(trace_dir);
-
-        // Wait until the dump completes by checking the size of the trace.
-        if (max_ctime > 0) {
-            sprintf(path, "%s%s", trace_path, buf);
-            while(true) {
-                sleep(1);
-                if (stat(path, &st) == 0) {
-                    if (st.st_size == cur_size) {
-                        break;
-                    } else if (st.st_size > cur_size) {
-                        cur_size = st.st_size;
-                    } else {
-                        return false;
-                    }
-                } else {
-                    MYLOGE("Cant stat() %s anymore\n", path);
-                    return false;
-                }
-            }
-            // Add to the zip file.
-            if (!ds.AddZipEntry("anrd_trace.txt", path)) {
-                MYLOGE("Unable to add anrd_trace file %s to zip file\n", path);
-            } else {
-                android::os::UnlinkAndLogOnError(path);
-                return true;
-            }
-        } else {
-            MYLOGE("Can't stats any trace file under %s\n", trace_path);
-        }
-    }
-    return false;
-}
-
 static bool skip_not_stat(const char *path) {
     static const char stat[] = "/stat";
     size_t len = strlen(path);
@@ -1232,7 +1129,7 @@
     }
     DurationReporter duration_reporter("DUMP HALS");
     RunCommand("HARDWARE HALS", {"lshal", "-lVSietrpc", "--types=b,c,l,z"},
-               CommandOptions::WithTimeout(2).AsRootIfAvailable().Build());
+               CommandOptions::WithTimeout(10).AsRootIfAvailable().Build());
 
     using android::hidl::manager::V1_0::IServiceManager;
     using android::hardware::defaultServiceManager;
@@ -1349,7 +1246,7 @@
     /* Dump Bluetooth HCI logs */
     ds.AddDir("/data/misc/bluetooth/logs", true);
 
-    if (!ds.do_early_screenshot_) {
+    if (ds.options_->do_fb && !ds.do_early_screenshot_) {
         MYLOGI("taking late screenshot\n");
         ds.TakeScreenshot();
     }
@@ -1501,9 +1398,6 @@
  * with the caller.
  */
 static Dumpstate::RunStatus DumpstateDefault() {
-    // Try to dump anrd trace if the daemon is running.
-    dump_anrd_trace();
-
     // Invoking the following dumpsys calls before DumpTraces() to try and
     // keep the system stats as close to its initial state as possible.
     RUN_SLOW_FUNCTION_WITH_CONSENT_CHECK(RunDumpsysCritical);
@@ -2588,13 +2482,8 @@
     }
 
     if (options_->do_fb && do_early_screenshot_) {
-        if (screenshot_path_.empty()) {
-            // should not have happened
-            MYLOGE("INTERNAL ERROR: skipping early screenshot because path was not set\n");
-        } else {
-            MYLOGI("taking early screenshot\n");
-            TakeScreenshot();
-        }
+        MYLOGI("taking early screenshot\n");
+        TakeScreenshot();
     }
 
     if (options_->do_zip_file && zip_file != nullptr) {
diff --git a/cmds/dumpstate/tests/dumpstate_smoke_test.cpp b/cmds/dumpstate/tests/dumpstate_smoke_test.cpp
index fc3642c..5bde7db 100644
--- a/cmds/dumpstate/tests/dumpstate_smoke_test.cpp
+++ b/cmds/dumpstate/tests/dumpstate_smoke_test.cpp
@@ -208,7 +208,7 @@
 
     void FileExists(const char* filename, uint32_t minsize, uint32_t maxsize) {
         ZipEntry entry;
-        EXPECT_EQ(FindEntry(handle, ZipString(filename), &entry), 0);
+        EXPECT_EQ(FindEntry(handle, filename, &entry), 0);
         EXPECT_GT(entry.uncompressed_length, minsize);
         EXPECT_LT(entry.uncompressed_length, maxsize);
     }
@@ -217,7 +217,7 @@
 TEST_F(ZippedBugReportContentsTest, ContainsMainEntry) {
     ZipEntry mainEntryLoc;
     // contains main entry name file
-    EXPECT_EQ(FindEntry(handle, ZipString("main_entry.txt"), &mainEntryLoc), 0);
+    EXPECT_EQ(FindEntry(handle, "main_entry.txt", &mainEntryLoc), 0);
 
     char* buf = new char[mainEntryLoc.uncompressed_length];
     ExtractToMemory(handle, &mainEntryLoc, (uint8_t*)buf, mainEntryLoc.uncompressed_length);
@@ -230,7 +230,7 @@
 TEST_F(ZippedBugReportContentsTest, ContainsVersion) {
     ZipEntry entry;
     // contains main entry name file
-    EXPECT_EQ(FindEntry(handle, ZipString("version.txt"), &entry), 0);
+    EXPECT_EQ(FindEntry(handle, "version.txt", &entry), 0);
 
     char* buf = new char[entry.uncompressed_length + 1];
     ExtractToMemory(handle, &entry, (uint8_t*)buf, entry.uncompressed_length);
diff --git a/cmds/dumpstate/tests/dumpstate_test.cpp b/cmds/dumpstate/tests/dumpstate_test.cpp
index 71d15f4..c5d01fd 100644
--- a/cmds/dumpstate/tests/dumpstate_test.cpp
+++ b/cmds/dumpstate/tests/dumpstate_test.cpp
@@ -664,7 +664,8 @@
 TEST_F(DumpstateTest, RunCommandWithTitle) {
     EXPECT_EQ(0, RunCommand("I AM GROOT", {kSimpleCommand}));
     EXPECT_THAT(err, StrEq("stderr\n"));
-    // We don't know the exact duration, so we check the prefix and suffix
+    // The duration may not get output, depending on how long it takes,
+    // so we just check the prefix.
     EXPECT_THAT(out,
                 StartsWith("------ I AM GROOT (" + kSimpleCommand + ") ------\nstdout\n"));
 }
@@ -699,7 +700,8 @@
 TEST_F(DumpstateTest, RunCommandDryRun) {
     SetDryRun(true);
     EXPECT_EQ(0, RunCommand("I AM GROOT", {kSimpleCommand}));
-    // We don't know the exact duration, so we check the prefix and suffix
+    // The duration may not get output, depending on how long it takes,
+    // so we just check the prefix.
     EXPECT_THAT(out, StartsWith("------ I AM GROOT (" + kSimpleCommand +
                                 ") ------\n\t(skipped on dry run)\n"));
     EXPECT_THAT(err, IsEmpty());
@@ -1037,7 +1039,8 @@
 TEST_F(DumpstateTest, DumpFileNotFoundWithTitle) {
     EXPECT_EQ(-1, DumpFile("Y U NO EXIST?", "/I/cant/believe/I/exist"));
     EXPECT_THAT(err, IsEmpty());
-    // We don't know the exact duration, so we check the prefix and suffix
+    // The duration may not get output, depending on how long it takes,
+    // so we just check the prefix.
     EXPECT_THAT(out, StartsWith("*** Error dumping /I/cant/believe/I/exist (Y U NO EXIST?): No "
                                 "such file or directory\n"));
 }
diff --git a/cmds/installd/Android.bp b/cmds/installd/Android.bp
index 4619427..8b860bc 100644
--- a/cmds/installd/Android.bp
+++ b/cmds/installd/Android.bp
@@ -167,6 +167,7 @@
     srcs: [
         "binder/android/os/IInstalld.aidl",
     ],
+    path: "binder",
 }
 
 //
diff --git a/data/etc/android.software.ipsec_tunnels.xml b/data/etc/android.software.ipsec_tunnels.xml
new file mode 100644
index 0000000..f7ffc02
--- /dev/null
+++ b/data/etc/android.software.ipsec_tunnels.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2018 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+
+<!--
+     This is the feature indicating that the device has support for multinetworking-capable IPsec
+     tunnels
+-->
+
+<permissions>
+    <feature name="android.software.ipsec_tunnels" />
+</permissions>
diff --git a/include/audiomanager/OWNERS b/include/audiomanager/OWNERS
new file mode 100644
index 0000000..2bd527c
--- /dev/null
+++ b/include/audiomanager/OWNERS
@@ -0,0 +1,2 @@
+elaurent@google.com
+jmtrivi@google.com
diff --git a/libs/binder/Android.bp b/libs/binder/Android.bp
index da10687..c02b88a 100644
--- a/libs/binder/Android.bp
+++ b/libs/binder/Android.bp
@@ -142,6 +142,7 @@
     srcs: [
         "aidl/android/content/pm/IPackageManagerNative.aidl",
     ],
+    path: "aidl",
 }
 
 subdirs = ["tests"]
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index 7eec245..bf107d0 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -632,11 +632,11 @@
     if ((flags & TF_ONE_WAY) == 0) {
         if (UNLIKELY(mCallRestriction != ProcessState::CallRestriction::NONE)) {
             if (mCallRestriction == ProcessState::CallRestriction::ERROR_IF_NOT_ONEWAY) {
-                ALOGE("Process making non-oneway call but is restricted.");
+                ALOGE("Process making non-oneway call (code: %u) but is restricted.", code);
                 CallStack::logStack("non-oneway call", CallStack::getCurrent(10).get(),
                     ANDROID_LOG_ERROR);
             } else /* FATAL_IF_NOT_ONEWAY */ {
-                LOG_ALWAYS_FATAL("Process may not make oneway calls.");
+                LOG_ALWAYS_FATAL("Process may not make oneway calls (code: %u).", code);
             }
         }
 
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp
index 9f8c408..764e6c3 100644
--- a/libs/binder/Parcel.cpp
+++ b/libs/binder/Parcel.cpp
@@ -93,7 +93,7 @@
     BLOB_ASHMEM_MUTABLE = 2,
 };
 
-void acquire_object(const sp<ProcessState>& proc,
+static void acquire_object(const sp<ProcessState>& proc,
     const flat_binder_object& obj, const void* who, size_t* outAshmemSize)
 {
     switch (obj.hdr.type) {
@@ -135,12 +135,6 @@
     ALOGD("Invalid object type 0x%08x", obj.hdr.type);
 }
 
-void acquire_object(const sp<ProcessState>& proc,
-    const flat_binder_object& obj, const void* who)
-{
-    acquire_object(proc, obj, who, nullptr);
-}
-
 static void release_object(const sp<ProcessState>& proc,
     const flat_binder_object& obj, const void* who, size_t* outAshmemSize)
 {
@@ -189,19 +183,13 @@
     ALOGE("Invalid object type 0x%08x", obj.hdr.type);
 }
 
-void release_object(const sp<ProcessState>& proc,
-    const flat_binder_object& obj, const void* who)
-{
-    release_object(proc, obj, who, nullptr);
-}
-
 inline static status_t finish_flatten_binder(
     const sp<IBinder>& /*binder*/, const flat_binder_object& flat, Parcel* out)
 {
     return out->writeObject(flat, false);
 }
 
-status_t flatten_binder(const sp<ProcessState>& /*proc*/,
+static status_t flatten_binder(const sp<ProcessState>& /*proc*/,
     const sp<IBinder>& binder, Parcel* out)
 {
     flat_binder_object obj;
@@ -243,7 +231,7 @@
     return finish_flatten_binder(binder, obj, out);
 }
 
-status_t flatten_binder(const sp<ProcessState>& /*proc*/,
+static status_t flatten_binder(const sp<ProcessState>& /*proc*/,
     const wp<IBinder>& binder, Parcel* out)
 {
     flat_binder_object obj;
@@ -299,7 +287,7 @@
     return NO_ERROR;
 }
 
-status_t unflatten_binder(const sp<ProcessState>& proc,
+static status_t unflatten_binder(const sp<ProcessState>& proc,
     const Parcel& in, sp<IBinder>* out)
 {
     const flat_binder_object* flat = in.readObject(false);
@@ -318,7 +306,7 @@
     return BAD_TYPE;
 }
 
-status_t unflatten_binder(const sp<ProcessState>& proc,
+static status_t unflatten_binder(const sp<ProcessState>& proc,
     const Parcel& in, wp<IBinder>* out)
 {
     const flat_binder_object* flat = in.readObject(false);
diff --git a/libs/binder/include/binder/Parcel.h b/libs/binder/include/binder/Parcel.h
index f6560a7..496f839 100644
--- a/libs/binder/include/binder/Parcel.h
+++ b/libs/binder/include/binder/Parcel.h
@@ -918,23 +918,6 @@
     return to;
 }
 
-// ---------------------------------------------------------------------------
-
-// Generic acquire and release of objects.
-void acquire_object(const sp<ProcessState>& proc,
-                    const flat_binder_object& obj, const void* who);
-void release_object(const sp<ProcessState>& proc,
-                    const flat_binder_object& obj, const void* who);
-
-void flatten_binder(const sp<ProcessState>& proc,
-                    const sp<IBinder>& binder, flat_binder_object* out);
-void flatten_binder(const sp<ProcessState>& proc,
-                    const wp<IBinder>& binder, flat_binder_object* out);
-status_t unflatten_binder(const sp<ProcessState>& proc,
-                          const flat_binder_object& flat, sp<IBinder>* out);
-status_t unflatten_binder(const sp<ProcessState>& proc,
-                          const flat_binder_object& flat, wp<IBinder>* out);
-
 }; // namespace android
 
 // ---------------------------------------------------------------------------
diff --git a/libs/dumputils/dump_utils.cpp b/libs/dumputils/dump_utils.cpp
index d0cea0b..f924863 100644
--- a/libs/dumputils/dump_utils.cpp
+++ b/libs/dumputils/dump_utils.cpp
@@ -32,6 +32,7 @@
         "/system/bin/mediametrics", // media.metrics
         "/system/bin/mediaserver",
         "/system/bin/netd",
+        "/system/bin/vold",
         "/system/bin/sdcard",
         "/system/bin/statsd",
         "/system/bin/surfaceflinger",
diff --git a/opengl/libs/Android.bp b/opengl/libs/Android.bp
index d43c164..75dda6d 100644
--- a/opengl/libs/Android.bp
+++ b/opengl/libs/Android.bp
@@ -201,6 +201,10 @@
     defaults: ["gles_libs_defaults"],
     srcs: ["GLES2/gl2.cpp"],
     cflags: ["-DLOG_TAG=\"libGLESv2\""],
+
+    // Bug: http://b/133874658  Disable native_coverage as we investigate a
+    // crash in surfaceflinger on coverage-enabled cuttlefish builds.
+    native_coverage: false,
 }
 
 //##############################################################################
diff --git a/opengl/libs/ETC1/etc1.cpp b/opengl/libs/ETC1/etc1.cpp
index 97d1085..19d428a 100644
--- a/opengl/libs/ETC1/etc1.cpp
+++ b/opengl/libs/ETC1/etc1.cpp
@@ -378,34 +378,30 @@
         const etc1_byte* pColors, etc_compressed* pCompressed) {
     int r1, g1, b1, r2, g2, b2; // 8 bit base colors for sub-blocks
     bool differential;
-    {
-        int r51 = convert8To5(pColors[0]);
-        int g51 = convert8To5(pColors[1]);
-        int b51 = convert8To5(pColors[2]);
-        int r52 = convert8To5(pColors[3]);
-        int g52 = convert8To5(pColors[4]);
-        int b52 = convert8To5(pColors[5]);
+    int r51 = convert8To5(pColors[0]);
+    int g51 = convert8To5(pColors[1]);
+    int b51 = convert8To5(pColors[2]);
+    int r52 = convert8To5(pColors[3]);
+    int g52 = convert8To5(pColors[4]);
+    int b52 = convert8To5(pColors[5]);
 
-        r1 = convert5To8(r51);
-        g1 = convert5To8(g51);
-        b1 = convert5To8(b51);
+    r1 = convert5To8(r51);
+    g1 = convert5To8(g51);
+    b1 = convert5To8(b51);
 
-        int dr = r52 - r51;
-        int dg = g52 - g51;
-        int db = b52 - b51;
+    int dr = r52 - r51;
+    int dg = g52 - g51;
+    int db = b52 - b51;
 
-        differential = inRange4bitSigned(dr) && inRange4bitSigned(dg)
-                && inRange4bitSigned(db);
-        if (differential) {
-            r2 = convert5To8(r51 + dr);
-            g2 = convert5To8(g51 + dg);
-            b2 = convert5To8(b51 + db);
-            pCompressed->high |= (r51 << 27) | ((7 & dr) << 24) | (g51 << 19)
-                    | ((7 & dg) << 16) | (b51 << 11) | ((7 & db) << 8) | 2;
-        }
-    }
-
-    if (!differential) {
+    differential = inRange4bitSigned(dr) && inRange4bitSigned(dg)
+            && inRange4bitSigned(db);
+    if (differential) {
+        r2 = convert5To8(r51 + dr);
+        g2 = convert5To8(g51 + dg);
+        b2 = convert5To8(b51 + db);
+        pCompressed->high |= (r51 << 27) | ((7 & dr) << 24) | (g51 << 19)
+                | ((7 & dg) << 16) | (b51 << 11) | ((7 & db) << 8) | 2;
+    } else {
         int r41 = convert8To4(pColors[0]);
         int g41 = convert8To4(pColors[1]);
         int b41 = convert8To4(pColors[2]);
diff --git a/services/surfaceflinger/Android.bp b/services/surfaceflinger/Android.bp
index 5d4ac23..c8b2d91 100644
--- a/services/surfaceflinger/Android.bp
+++ b/services/surfaceflinger/Android.bp
@@ -152,6 +152,10 @@
     lto: {
         thin: true,
     },
+    // TODO(b/131771163): Fix broken fuzzer support with LTO.
+    sanitize: {
+        fuzzer: false,
+    },
 }
 
 cc_binary {
diff --git a/services/surfaceflinger/RenderEngine/ProgramCache.cpp b/services/surfaceflinger/RenderEngine/ProgramCache.cpp
index fe992f1..2073b05 100644
--- a/services/surfaceflinger/RenderEngine/ProgramCache.cpp
+++ b/services/surfaceflinger/RenderEngine/ProgramCache.cpp
@@ -220,7 +220,7 @@
                     const highp float c2 = (2413.0 / 4096.0) * 32.0;
                     const highp float c3 = (2392.0 / 4096.0) * 32.0;
 
-                    highp vec3 tmp = pow(color, 1.0 / vec3(m2));
+                    highp vec3 tmp = pow(clamp(color, 0.0, 1.0), 1.0 / vec3(m2));
                     tmp = max(tmp - c1, 0.0) / (c2 - c3 * tmp);
                     return pow(tmp, 1.0 / vec3(m1));
                 }
diff --git a/services/surfaceflinger/tests/fakehwc/SFFakeHwc_test.cpp b/services/surfaceflinger/tests/fakehwc/SFFakeHwc_test.cpp
index 9b31985..28cac2e 100644
--- a/services/surfaceflinger/tests/fakehwc/SFFakeHwc_test.cpp
+++ b/services/surfaceflinger/tests/fakehwc/SFFakeHwc_test.cpp
@@ -54,10 +54,11 @@
 namespace {
 
 // Mock test helpers
+using ::testing::_;
+using ::testing::DoAll;
 using ::testing::Invoke;
 using ::testing::Return;
 using ::testing::SetArgPointee;
-using ::testing::_;
 
 using Transaction = SurfaceComposerClient::Transaction;
 
diff --git a/services/thermalservice/Android.bp b/services/thermalservice/Android.bp
index d754560..1519618 100644
--- a/services/thermalservice/Android.bp
+++ b/services/thermalservice/Android.bp
@@ -1,34 +1,3 @@
-subdirs = [
-    "libthermalcallback"
-]
-
-cc_library {
-    name: "libthermalservice",
-
-    srcs: [
-        "aidl/android/os/IThermalEventListener.aidl",
-        "aidl/android/os/IThermalService.aidl",
-        "aidl/android/os/Temperature.cpp",
-    ],
-    aidl: {
-      include_dirs: ["frameworks/native/services/thermalservice/aidl"],
-      export_aidl_headers: true,
-    },
-    export_include_dirs: ["aidl"],
-
-    shared_libs: [
-        "libbinder",
-        "libutils",
-    ],
-
-    cflags: [
-        "-Wall",
-        "-Werror",
-        "-Wunused",
-        "-Wunreachable-code",
-    ],
-}
-
 cc_binary {
     name: "thermalserviced",
 
diff --git a/services/thermalservice/aidl/Android.bp b/services/thermalservice/aidl/Android.bp
new file mode 100644
index 0000000..f1ec656
--- /dev/null
+++ b/services/thermalservice/aidl/Android.bp
@@ -0,0 +1,26 @@
+cc_library {
+    name: "libthermalservice",
+
+    srcs: [
+        "android/os/IThermalEventListener.aidl",
+        "android/os/IThermalService.aidl",
+        "android/os/Temperature.cpp",
+    ],
+    aidl: {
+        local_include_dirs: ["."],
+        export_aidl_headers: true,
+    },
+    export_include_dirs: ["."],
+
+    shared_libs: [
+        "libbinder",
+        "libutils",
+    ],
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-Wunused",
+        "-Wunreachable-code",
+    ],
+}
diff --git a/services/vr/hardware_composer/Android.bp b/services/vr/hardware_composer/Android.bp
index 90edf69..4478f77 100644
--- a/services/vr/hardware_composer/Android.bp
+++ b/services/vr/hardware_composer/Android.bp
@@ -1,174 +1,146 @@
 cc_library_shared {
-  name: "libvr_hwc-hal",
+    name: "libvr_hwc-hal",
 
-  srcs: [
-    "impl/vr_hwc.cpp",
-    "impl/vr_composer_client.cpp",
-  ],
+    srcs: [
+        "impl/vr_hwc.cpp",
+        "impl/vr_composer_client.cpp",
+    ],
 
-  static_libs: [
-    "libbroadcastring",
-    "libdisplay",
-  ],
+    static_libs: [
+        "libbroadcastring",
+        "libdisplay",
+    ],
 
-  shared_libs: [
-    "android.frameworks.vr.composer@1.0",
-    "android.hardware.graphics.composer@2.1",
-    "android.hardware.graphics.mapper@2.0",
-    "libbase",
-    "libbufferhubqueue",
-    "libbinder",
-    "libcutils",
-    "libfmq",
-    "libhardware",
-    "libhidlbase",
-    "libhidltransport",
-    "liblog",
-    "libsync",
-    "libui",
-    "libutils",
-    "libpdx_default_transport",
-  ],
+    shared_libs: [
+        "android.frameworks.vr.composer@1.0",
+        "android.hardware.graphics.composer@2.1",
+        "android.hardware.graphics.mapper@2.0",
+        "libbase",
+        "libbufferhubqueue",
+        "libbinder",
+        "libcutils",
+        "libfmq",
+        "libhardware",
+        "libhidlbase",
+        "libhidltransport",
+        "liblog",
+        "libsync",
+        "libui",
+        "libutils",
+        "libpdx_default_transport",
+    ],
 
-  header_libs: [
-    "android.hardware.graphics.composer@2.1-command-buffer",
-    "android.hardware.graphics.composer@2.1-hal",
-  ],
+    header_libs: [
+        "android.hardware.graphics.composer@2.1-command-buffer",
+        "android.hardware.graphics.composer@2.1-hal",
+    ],
 
-  export_header_lib_headers: [
-    "android.hardware.graphics.composer@2.1-hal",
-  ],
+    export_header_lib_headers: [
+        "android.hardware.graphics.composer@2.1-hal",
+    ],
 
-  export_shared_lib_headers: [
-    "android.frameworks.vr.composer@1.0",
-    "android.hardware.graphics.composer@2.1",
-  ],
+    export_shared_lib_headers: [
+        "android.frameworks.vr.composer@1.0",
+        "android.hardware.graphics.composer@2.1",
+    ],
 
-  export_include_dirs: ["."],
+    export_include_dirs: ["."],
 
-  cflags: [
-    "-DLOG_TAG=\"vr_hwc\"",
-    "-Wall",
-    "-Werror",
-    // mVrClient unused in vr_composer_client.cpp
-    "-Wno-error=unused-private-field",
-    // Warnings in vr_hwc.cpp to be fixed after sync of goog/master.
-    "-Wno-sign-compare",
-    "-Wno-unused-parameter",
-  ],
+    cflags: [
+        "-DLOG_TAG=\"vr_hwc\"",
+        "-Wall",
+        "-Werror",
+        // mVrClient unused in vr_composer_client.cpp
+        "-Wno-error=unused-private-field",
+        // Warnings in vr_hwc.cpp to be fixed after sync of goog/master.
+        "-Wno-sign-compare",
+        "-Wno-unused-parameter",
+    ],
 
 }
 
 cc_library_static {
-  name: "libvr_hwc-binder",
-  srcs: [
-    "aidl/android/dvr/IVrComposer.aidl",
-    "aidl/android/dvr/IVrComposerCallback.aidl",
-    "aidl/android/dvr/parcelable_composer_frame.cpp",
-    "aidl/android/dvr/parcelable_composer_layer.cpp",
-    "aidl/android/dvr/parcelable_unique_fd.cpp",
-  ],
-  aidl: {
-    include_dirs: ["frameworks/native/services/vr/hardware_composer/aidl"],
-    export_aidl_headers: true,
-  },
-  export_include_dirs: ["aidl"],
-
-  cflags: [
-    "-Wall",
-    "-Werror",
-  ],
-
-  shared_libs: [
-    "libbinder",
-    "libui",
-    "libutils",
-    "libvr_hwc-hal",
-  ],
-}
-
-cc_library_static {
-  name: "libvr_hwc-impl",
-  srcs: [
-    "vr_composer.cpp",
-  ],
-  static_libs: [
-    "libvr_hwc-binder",
-  ],
-  shared_libs: [
-    "libbase",
-    "libbinder",
-    "liblog",
-    "libui",
-    "libutils",
-    "libvr_hwc-hal",
-  ],
-  export_shared_lib_headers: [
-    "libvr_hwc-hal",
-  ],
-  cflags: [
-    "-DLOG_TAG=\"vr_hwc\"",
-    "-Wall",
-    "-Werror",
-  ],
+    name: "libvr_hwc-impl",
+    srcs: [
+        "vr_composer.cpp",
+    ],
+    static_libs: [
+        "libvr_hwc-binder",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder",
+        "liblog",
+        "libui",
+        "libutils",
+        "libvr_hwc-hal",
+    ],
+    export_shared_lib_headers: [
+        "libvr_hwc-hal",
+    ],
+    cflags: [
+        "-DLOG_TAG=\"vr_hwc\"",
+        "-Wall",
+        "-Werror",
+    ],
 }
 
 cc_binary {
-  name: "vr_hwc",
-  srcs: [
-    "vr_hardware_composer_service.cpp"
-  ],
-  static_libs: [
-    "libvr_hwc-impl",
-    // NOTE: This needs to be included after the *-impl lib otherwise the
-    // symbols in the *-binder library get optimized out.
-    "libvr_hwc-binder",
-  ],
-  shared_libs: [
-    "android.frameworks.vr.composer@1.0",
-    "android.hardware.graphics.composer@2.1",
-    "libbase",
-    "libbinder",
-    "liblog",
-    "libhardware",
-    "libhwbinder",
-    "libui",
-    "libutils",
-    "libvr_hwc-hal",
-  ],
-  cflags: [
-    "-DLOG_TAG=\"vr_hwc\"",
-    "-Wall",
-    "-Werror",
-  ],
-  init_rc: [
-    "vr_hwc.rc",
-  ],
+    name: "vr_hwc",
+    srcs: [
+        "vr_hardware_composer_service.cpp",
+    ],
+    static_libs: [
+        "libvr_hwc-impl",
+        // NOTE: This needs to be included after the *-impl lib otherwise the
+        // symbols in the *-binder library get optimized out.
+        "libvr_hwc-binder",
+    ],
+    shared_libs: [
+        "android.frameworks.vr.composer@1.0",
+        "android.hardware.graphics.composer@2.1",
+        "libbase",
+        "libbinder",
+        "liblog",
+        "libhardware",
+        "libhwbinder",
+        "libui",
+        "libutils",
+        "libvr_hwc-hal",
+    ],
+    cflags: [
+        "-DLOG_TAG=\"vr_hwc\"",
+        "-Wall",
+        "-Werror",
+    ],
+    init_rc: [
+        "vr_hwc.rc",
+    ],
 }
 
 cc_test {
-  name: "vr_hwc_test",
-  gtest: true,
-  srcs: ["tests/vr_composer_test.cpp"],
-  static_libs: [
-    "libgtest",
-    "libvr_hwc-impl",
-    // NOTE: This needs to be included after the *-impl lib otherwise the
-    // symbols in the *-binder library get optimized out.
-    "libvr_hwc-binder",
-  ],
-  cflags: [
-    "-Wall",
-    "-Werror",
-    // warnings in vr_composer_test.cpp to be fixed after merge of goog/master
-    "-Wno-sign-compare",
-    "-Wno-unused-parameter",
-  ],
-  shared_libs: [
-    "libbase",
-    "libbinder",
-    "liblog",
-    "libui",
-    "libutils",
-  ],
+    name: "vr_hwc_test",
+    gtest: true,
+    srcs: ["tests/vr_composer_test.cpp"],
+    static_libs: [
+        "libgtest",
+        "libvr_hwc-impl",
+        // NOTE: This needs to be included after the *-impl lib otherwise the
+        // symbols in the *-binder library get optimized out.
+        "libvr_hwc-binder",
+    ],
+    cflags: [
+        "-Wall",
+        "-Werror",
+        // warnings in vr_composer_test.cpp to be fixed after merge of goog/master
+        "-Wno-sign-compare",
+        "-Wno-unused-parameter",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder",
+        "liblog",
+        "libui",
+        "libutils",
+    ],
 }
diff --git a/services/vr/hardware_composer/aidl/Android.bp b/services/vr/hardware_composer/aidl/Android.bp
new file mode 100644
index 0000000..a1d5392
--- /dev/null
+++ b/services/vr/hardware_composer/aidl/Android.bp
@@ -0,0 +1,27 @@
+cc_library_static {
+    name: "libvr_hwc-binder",
+    srcs: [
+        "android/dvr/IVrComposer.aidl",
+        "android/dvr/IVrComposerCallback.aidl",
+        "android/dvr/parcelable_composer_frame.cpp",
+        "android/dvr/parcelable_composer_layer.cpp",
+        "android/dvr/parcelable_unique_fd.cpp",
+    ],
+    aidl: {
+        local_include_dirs: ["."],
+        export_aidl_headers: true,
+    },
+    export_include_dirs: ["."],
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+
+    shared_libs: [
+        "libbinder",
+        "libui",
+        "libutils",
+        "libvr_hwc-hal",
+    ],
+}
diff --git a/services/vr/virtual_touchpad/Android.bp b/services/vr/virtual_touchpad/Android.bp
index 131a306..dcaa663 100644
--- a/services/vr/virtual_touchpad/Android.bp
+++ b/services/vr/virtual_touchpad/Android.bp
@@ -62,7 +62,7 @@
 service_src = [
     "main.cpp",
     "VirtualTouchpadService.cpp",
-    "aidl/android/dvr/IVirtualTouchpadService.aidl",
+    ":virtualtouchpad_aidl",
 ]
 
 service_static_libs = [
@@ -99,7 +99,7 @@
 client_src = [
     "VirtualTouchpadClient.cpp",
     "DvrVirtualTouchpadClient.cpp",
-    "aidl/android/dvr/IVirtualTouchpadService.aidl",
+    ":virtualtouchpad_aidl",
 ]
 
 client_shared_libs = [
@@ -122,3 +122,9 @@
     name: "libvirtualtouchpadclient",
     export_include_dirs: ["include"],
 }
+
+filegroup {
+    name: "virtualtouchpad_aidl",
+    srcs: ["aidl/android/dvr/IVirtualTouchpadService.aidl"],
+    path: "aidl",
+}
diff --git a/services/vr/virtual_touchpad/include/VirtualTouchpadClient.h b/services/vr/virtual_touchpad/include/VirtualTouchpadClient.h
index 7d73f06..268e4bd 100644
--- a/services/vr/virtual_touchpad/include/VirtualTouchpadClient.h
+++ b/services/vr/virtual_touchpad/include/VirtualTouchpadClient.h
@@ -13,12 +13,6 @@
  public:
   // VirtualTouchpad implementation:
   static std::unique_ptr<VirtualTouchpad> Create();
-  status_t Attach() override;
-  status_t Detach() override;
-  status_t Touch(int touchpad, float x, float y, float pressure) override;
-  status_t ButtonState(int touchpad, int buttons) override;
-  status_t Scroll(int touchpad, float x, float y) override;
-  void dumpInternal(String8& result) override;
 
  protected:
   VirtualTouchpadClient() {}
diff --git a/vulkan/libvulkan/layers_extensions.cpp b/vulkan/libvulkan/layers_extensions.cpp
index ba4cf00..a7b7a6f 100644
--- a/vulkan/libvulkan/layers_extensions.cpp
+++ b/vulkan/libvulkan/layers_extensions.cpp
@@ -385,9 +385,8 @@
         return;
     }
     std::string prefix(dir_in_zip + "/");
-    const ZipString prefix_str(prefix.c_str());
     void* iter_cookie = nullptr;
-    if ((err = StartIteration(zip, &iter_cookie, &prefix_str, nullptr)) != 0) {
+    if ((err = StartIteration(zip, &iter_cookie, prefix, "")) != 0) {
         ALOGE("failed to iterate entries in apk '%s': %d", zipname.c_str(),
               err);
         CloseArchive(zip);
@@ -396,11 +395,9 @@
     ALOGD("searching for layers in '%s!/%s'", zipname.c_str(),
           dir_in_zip.c_str());
     ZipEntry entry;
-    ZipString name;
+    std::string name;
     while (Next(iter_cookie, &entry, &name) == 0) {
-        std::string filename(
-            reinterpret_cast<const char*>(name.name) + prefix.length(),
-            name.name_length - prefix.length());
+        std::string filename(name.substr(prefix.length()));
         // only enumerate direct entries of the directory, not subdirectories
         if (filename.find('/') != filename.npos)
             continue;