diff --git a/adb/adbd_auth.cpp b/adb/adbd_auth.cpp
index b5f87be..3488ad1 100644
--- a/adb/adbd_auth.cpp
+++ b/adb/adbd_auth.cpp
@@ -217,8 +217,8 @@
     send_packet(p, t);
 }
 
-void adbd_auth_verified(atransport *t)
-{
+void adbd_auth_verified(atransport* t) {
+    LOG(INFO) << "adb client authorized";
     handle_online(t);
     send_connect(t);
 }
diff --git a/adb/daemon/usb.cpp b/adb/daemon/usb.cpp
index d3b2f3d..0f92282 100644
--- a/adb/daemon/usb.cpp
+++ b/adb/daemon/usb.cpp
@@ -235,6 +235,8 @@
 };
 
 bool init_functionfs(struct usb_handle* h) {
+    LOG(INFO) << "initializing functionfs";
+
     ssize_t ret;
     struct desc_v1 v1_descriptor;
     struct desc_v2 v2_descriptor;
@@ -255,10 +257,10 @@
     v2_descriptor.os_desc = os_desc_compat;
 
     if (h->control < 0) { // might have already done this before
-        D("OPENING %s", USB_FFS_ADB_EP0);
+        LOG(INFO) << "opening control endpoint " << USB_FFS_ADB_EP0;
         h->control = adb_open(USB_FFS_ADB_EP0, O_RDWR);
         if (h->control < 0) {
-            D("[ %s: cannot open control endpoint: errno=%d]", USB_FFS_ADB_EP0, errno);
+            PLOG(ERROR) << "cannot open control endpoint " << USB_FFS_ADB_EP0;
             goto err;
         }
 
@@ -289,13 +291,13 @@
 
     h->bulk_out = adb_open(USB_FFS_ADB_OUT, O_RDWR);
     if (h->bulk_out < 0) {
-        D("[ %s: cannot open bulk-out ep: errno=%d ]", USB_FFS_ADB_OUT, errno);
+        PLOG(ERROR) << "cannot open bulk-out endpoint " << USB_FFS_ADB_OUT;
         goto err;
     }
 
     h->bulk_in = adb_open(USB_FFS_ADB_IN, O_RDWR);
     if (h->bulk_in < 0) {
-        D("[ %s: cannot open bulk-in ep: errno=%d ]", USB_FFS_ADB_IN, errno);
+        PLOG(ERROR) << "cannot open bulk-in endpoint " << USB_FFS_ADB_IN;
         goto err;
     }
 
@@ -356,12 +358,13 @@
 
         while (true) {
             if (init_functionfs(usb)) {
+                LOG(INFO) << "functionfs successfully initialized";
                 break;
             }
             std::this_thread::sleep_for(1s);
         }
 
-        D("[ usb_thread - registering device ]");
+        LOG(INFO) << "registering usb transport";
         register_usb_transport(usb, 0, 0, 1);
     }
 
@@ -430,6 +433,8 @@
 }
 
 static void usb_ffs_close(usb_handle* h) {
+    LOG(INFO) << "closing functionfs transport";
+
     h->kicked = false;
     adb_close(h->bulk_out);
     adb_close(h->bulk_in);
diff --git a/adb/transport_usb.cpp b/adb/transport_usb.cpp
index 2f46920..7e8ae67 100644
--- a/adb/transport_usb.cpp
+++ b/adb/transport_usb.cpp
@@ -120,24 +120,24 @@
 static int remote_read(apacket *p, atransport *t)
 {
     if (usb_read(t->usb, &p->msg, sizeof(amessage))) {
-        D("remote usb: read terminated (message)");
+        PLOG(ERROR) << "remote usb: read terminated (message)";
         return -1;
     }
 
     if (!check_header(p, t)) {
-        D("remote usb: check_header failed");
+        LOG(ERROR) << "remote usb: check_header failed";
         return -1;
     }
 
     if (p->msg.data_length) {
         if (usb_read(t->usb, p->data, p->msg.data_length)) {
-            D("remote usb: terminated (data)");
+            PLOG(ERROR) << "remote usb: terminated (data)";
             return -1;
         }
     }
 
     if (!check_data(p)) {
-        D("remote usb: check_data failed");
+        LOG(ERROR) << "remote usb: check_data failed";
         return -1;
     }
 
@@ -150,12 +150,12 @@
     unsigned size = p->msg.data_length;
 
     if (usb_write(t->usb, &p->msg, sizeof(amessage))) {
-        D("remote usb: 1 - write terminated");
+        PLOG(ERROR) << "remote usb: 1 - write terminated";
         return -1;
     }
-    if(p->msg.data_length == 0) return 0;
+    if (p->msg.data_length == 0) return 0;
     if (usb_write(t->usb, &p->data, size)) {
-        D("remote usb: 2 - write terminated");
+        PLOG(ERROR) << "remote usb: 2 - write terminated";
         return -1;
     }
 
diff --git a/bootstat/bootstat.cpp b/bootstat/bootstat.cpp
index 344fa9a..bd611f0 100644
--- a/bootstat/bootstat.cpp
+++ b/bootstat/bootstat.cpp
@@ -169,6 +169,13 @@
   {"wdog_bark", 42},
   {"wdog_bite", 43},
   {"wdog_reset", 44},
+  {"shutdown,", 45},  // Trailing comma is intentional.
+  {"shutdown,userrequested", 46},
+  {"reboot,bootloader", 47},
+  {"reboot,cold", 48},
+  {"reboot,recovery", 49},
+  {"thermal_shutdown", 50},
+  {"s3_wakeup", 51}
 };
 
 // Converts a string value representing the reason the system booted to an
diff --git a/fs_mgr/fs_mgr_boot_config.cpp b/fs_mgr/fs_mgr_boot_config.cpp
index 9117667..9c5d3f3 100644
--- a/fs_mgr/fs_mgr_boot_config.cpp
+++ b/fs_mgr/fs_mgr_boot_config.cpp
@@ -23,19 +23,11 @@
 
 #include "fs_mgr_priv.h"
 
-// Tries to get the boot config value in properties, kernel cmdline and
-// device tree (in that order).  returns 'true' if successfully found, 'false'
-// otherwise
-bool fs_mgr_get_boot_config(const std::string& key, std::string* out_val) {
+// Tries to get the given boot config value from kernel cmdline.
+// Returns true if successfully found, false otherwise.
+bool fs_mgr_get_boot_config_from_kernel_cmdline(const std::string& key, std::string* out_val) {
     FS_MGR_CHECK(out_val != nullptr);
 
-    // first check if we have "ro.boot" property already
-    *out_val = android::base::GetProperty("ro.boot." + key, "");
-    if (!out_val->empty()) {
-        return true;
-    }
-
-    // fallback to kernel cmdline, properties may not be ready yet
     std::string cmdline;
     std::string cmdline_key("androidboot." + key);
     if (android::base::ReadFileToString("/proc/cmdline", &cmdline)) {
@@ -50,9 +42,29 @@
         }
     }
 
+    return false;
+}
+
+// Tries to get the boot config value in properties, kernel cmdline and
+// device tree (in that order).  returns 'true' if successfully found, 'false'
+// otherwise
+bool fs_mgr_get_boot_config(const std::string& key, std::string* out_val) {
+    FS_MGR_CHECK(out_val != nullptr);
+
+    // first check if we have "ro.boot" property already
+    *out_val = android::base::GetProperty("ro.boot." + key, "");
+    if (!out_val->empty()) {
+        return true;
+    }
+
+    // fallback to kernel cmdline, properties may not be ready yet
+    if (fs_mgr_get_boot_config_from_kernel_cmdline(key, out_val)) {
+        return true;
+    }
+
     // lastly, check the device tree
     if (is_dt_compatible()) {
-        std::string file_name = kAndroidDtDir + "/" + key;
+        std::string file_name = get_android_dt_dir() + "/" + key;
         if (android::base::ReadFileToString(file_name, out_val)) {
             if (!out_val->empty()) {
                 out_val->pop_back();  // Trims the trailing '\0' out.
diff --git a/fs_mgr/fs_mgr_fstab.cpp b/fs_mgr/fs_mgr_fstab.cpp
index 6dcbded..eeac697 100644
--- a/fs_mgr/fs_mgr_fstab.cpp
+++ b/fs_mgr/fs_mgr_fstab.cpp
@@ -29,6 +29,8 @@
 
 #include "fs_mgr_priv.h"
 
+const std::string kDefaultAndroidDtDir("/proc/device-tree/firmware/android");
+
 struct fs_mgr_flag_values {
     char *key_loc;
     char* key_dir;
@@ -365,9 +367,26 @@
     return f;
 }
 
+static std::string init_android_dt_dir() {
+    std::string android_dt_dir;
+    // The platform may specify a custom Android DT path in kernel cmdline
+    if (!fs_mgr_get_boot_config_from_kernel_cmdline("android_dt_dir", &android_dt_dir)) {
+        // Fall back to the standard procfs-based path
+        android_dt_dir = kDefaultAndroidDtDir;
+    }
+    return android_dt_dir;
+}
+
+// FIXME: The same logic is duplicated in system/core/init/
+const std::string& get_android_dt_dir() {
+    // Set once and saves time for subsequent calls to this function
+    static const std::string kAndroidDtDir = init_android_dt_dir();
+    return kAndroidDtDir;
+}
+
 static bool is_dt_fstab_compatible() {
     std::string dt_value;
-    std::string file_name = kAndroidDtDir + "/fstab/compatible";
+    std::string file_name = get_android_dt_dir() + "/fstab/compatible";
     if (read_dt_file(file_name, &dt_value)) {
         if (dt_value == "android,fstab") {
             return true;
@@ -383,7 +402,7 @@
         return fstab;
     }
 
-    std::string fstabdir_name = kAndroidDtDir + "/fstab";
+    std::string fstabdir_name = get_android_dt_dir() + "/fstab";
     std::unique_ptr<DIR, int (*)(DIR*)> fstabdir(opendir(fstabdir_name.c_str()), closedir);
     if (!fstabdir) return fstab;
 
@@ -446,7 +465,7 @@
 }
 
 bool is_dt_compatible() {
-    std::string file_name = kAndroidDtDir + "/compatible";
+    std::string file_name = get_android_dt_dir() + "/compatible";
     std::string dt_value;
     if (read_dt_file(file_name, &dt_value)) {
         if (dt_value == "android,firmware") {
diff --git a/fs_mgr/fs_mgr_priv.h b/fs_mgr/fs_mgr_priv.h
index a5d172b..0f62e18 100644
--- a/fs_mgr/fs_mgr_priv.h
+++ b/fs_mgr/fs_mgr_priv.h
@@ -120,6 +120,7 @@
                           const std::chrono::milliseconds relative_timeout);
 bool fs_mgr_update_for_slotselect(struct fstab *fstab);
 bool fs_mgr_is_device_unlocked();
+const std::string& get_android_dt_dir();
 bool is_dt_compatible();
 bool is_device_secure();
 int load_verity_state(struct fstab_rec* fstab, int* mode);
diff --git a/fs_mgr/fs_mgr_priv_boot_config.h b/fs_mgr/fs_mgr_priv_boot_config.h
index 8773d33..d98dc02 100644
--- a/fs_mgr/fs_mgr_priv_boot_config.h
+++ b/fs_mgr/fs_mgr_priv_boot_config.h
@@ -20,8 +20,7 @@
 #include <sys/cdefs.h>
 #include <string>
 
-const std::string kAndroidDtDir("/proc/device-tree/firmware/android");
-
+bool fs_mgr_get_boot_config_from_kernel_cmdline(const std::string& key, std::string* out_val);
 bool fs_mgr_get_boot_config(const std::string& key, std::string* out_val);
 
 #endif /* __CORE_FS_MGR_PRIV_BOOTCONFIG_H */
diff --git a/init/Android.bp b/init/Android.bp
index 8294598..aaef7e9 100644
--- a/init/Android.bp
+++ b/init/Android.bp
@@ -18,7 +18,7 @@
     name: "init_defaults",
     cpp_std: "experimental",
     sanitize: {
-        misc_undefined: ["integer"],
+        misc_undefined: ["signed-integer-overflow"],
     },
     cppflags: [
         "-DLOG_UEVENTS=0",
diff --git a/init/Android.mk b/init/Android.mk
index c0c4905..161256e 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -96,6 +96,6 @@
     ln -sf ../init $(TARGET_ROOT_OUT)/sbin/ueventd; \
     ln -sf ../init $(TARGET_ROOT_OUT)/sbin/watchdogd
 
-LOCAL_SANITIZE := integer
+LOCAL_SANITIZE := signed-integer-overflow
 LOCAL_CLANG := true
 include $(BUILD_EXECUTABLE)
diff --git a/init/init.cpp b/init/init.cpp
index 55d5fa8..715dd72 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -513,7 +513,7 @@
         return;
     }
 
-    std::unique_ptr<DIR, int (*)(DIR*)> dir(opendir(kAndroidDtDir.c_str()), closedir);
+    std::unique_ptr<DIR, int (*)(DIR*)> dir(opendir(get_android_dt_dir().c_str()), closedir);
     if (!dir) return;
 
     std::string dt_file;
@@ -523,7 +523,7 @@
             continue;
         }
 
-        std::string file_name = kAndroidDtDir + dp->d_name;
+        std::string file_name = get_android_dt_dir() + dp->d_name;
 
         android::base::ReadFileToString(file_name, &dt_file);
         std::replace(dt_file.begin(), dt_file.end(), ',', '.');
diff --git a/init/reboot.cpp b/init/reboot.cpp
index d096b0d..17e3576 100644
--- a/init/reboot.cpp
+++ b/init/reboot.cpp
@@ -237,7 +237,8 @@
             std::string mount_dir(mentry->mnt_dir);
             // These are R/O partitions changed to R/W after adb remount.
             // Do not umount them as shutdown critical services may rely on them.
-            if (mount_dir != "/system" && mount_dir != "/vendor" && mount_dir != "/oem") {
+            if (mount_dir != "/" && mount_dir != "/system" && mount_dir != "/vendor" &&
+                mount_dir != "/oem") {
                 blockDevPartitions->emplace(blockDevPartitions->begin(), *mentry);
             }
         } else if (MountEntry::IsEmulatedDevice(*mentry)) {
@@ -498,10 +499,8 @@
             }
         }
     } else if (command == "thermal-shutdown") {  // no additional parameter allowed
+        // run_fsck is false to avoid delay
         cmd = ANDROID_RB_THERMOFF;
-        // Do not queue "shutdown" trigger since we want to shutdown immediately
-        DoReboot(cmd, command, reboot_target, run_fsck);
-        return true;
     } else {
         command_invalid = true;
     }
diff --git a/init/service.cpp b/init/service.cpp
index 82dd9b1..fe38ee2 100644
--- a/init/service.cpp
+++ b/init/service.cpp
@@ -245,8 +245,8 @@
     if (capabilities_.any() && uid_) {
         // If Android is running in a container, some securebits might already
         // be locked, so don't change those.
-        int64_t securebits = prctl(PR_GET_SECUREBITS);
-        if (securebits == -1) {
+        unsigned long securebits = prctl(PR_GET_SECUREBITS);
+        if (securebits == -1UL) {
             PLOG(FATAL) << "prctl(PR_GET_SECUREBITS) failed for " << name_;
         }
         securebits |= SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED;
diff --git a/init/util.cpp b/init/util.cpp
index 2792794..fdcb22d 100644
--- a/init/util.cpp
+++ b/init/util.cpp
@@ -53,6 +53,8 @@
 namespace android {
 namespace init {
 
+const std::string kDefaultAndroidDtDir("/proc/device-tree/firmware/android/");
+
 // DecodeUid() - decodes and returns the given string, which can be either the
 // numeric or name representation, into the integer uid or gid. Returns
 // UINT_MAX on error.
@@ -374,10 +376,31 @@
     DoReboot(ANDROID_RB_RESTART2, "reboot", "bootloader", false);
 }
 
-// Reads the content of device tree file under kAndroidDtDir directory.
+static std::string init_android_dt_dir() {
+    // Use the standard procfs-based path by default
+    std::string android_dt_dir = kDefaultAndroidDtDir;
+    // The platform may specify a custom Android DT path in kernel cmdline
+    import_kernel_cmdline(false,
+                          [&](const std::string& key, const std::string& value, bool in_qemu) {
+                              if (key == "androidboot.android_dt_dir") {
+                                  android_dt_dir = value;
+                              }
+                          });
+    LOG(INFO) << "Using Android DT directory " << android_dt_dir;
+    return android_dt_dir;
+}
+
+// FIXME: The same logic is duplicated in system/core/fs_mgr/
+const std::string& get_android_dt_dir() {
+    // Set once and saves time for subsequent calls to this function
+    static const std::string kAndroidDtDir = init_android_dt_dir();
+    return kAndroidDtDir;
+}
+
+// Reads the content of device tree file under the platform's Android DT directory.
 // Returns true if the read is success, false otherwise.
 bool read_android_dt_file(const std::string& sub_path, std::string* dt_content) {
-    const std::string file_name = kAndroidDtDir + sub_path;
+    const std::string file_name = get_android_dt_dir() + sub_path;
     if (android::base::ReadFileToString(file_name, dt_content)) {
         if (!dt_content->empty()) {
             dt_content->pop_back();  // Trims the trailing '\0' out.
diff --git a/init/util.h b/init/util.h
index 452df2d..29c10cb 100644
--- a/init/util.h
+++ b/init/util.h
@@ -30,8 +30,6 @@
 
 #define COLDBOOT_DONE "/dev/.coldboot_done"
 
-const std::string kAndroidDtDir("/proc/device-tree/firmware/android/");
-
 using android::base::boot_clock;
 using namespace std::chrono_literals;
 
@@ -57,7 +55,10 @@
 
 void panic() __attribute__((__noreturn__));
 
-// Reads or compares the content of device tree file under kAndroidDtDir directory.
+// Returns the platform's Android DT directory as specified in the kernel cmdline.
+// If the platform does not configure a custom DT path, returns the standard one (based in procfs).
+const std::string& get_android_dt_dir();
+// Reads or compares the content of device tree file under the platform's Android DT directory.
 bool read_android_dt_file(const std::string& sub_path, std::string* dt_content);
 bool is_android_dt_value_expected(const std::string& sub_path, const std::string& expected_content);
 
diff --git a/rootdir/etc/ld.config.txt b/rootdir/etc/ld.config.txt
index 3cb5c1d..d041888 100644
--- a/rootdir/etc/ld.config.txt
+++ b/rootdir/etc/ld.config.txt
@@ -117,9 +117,9 @@
 ###############################################################################
 [vendor]
 namespace.default.isolated = false
-namespace.default.search.paths = /vendor/${LIB}:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/system/${LIB}
+namespace.default.search.paths = /vendor/${LIB}/hw:/vendor/${LIB}/egl:/vendor/${LIB}:/system/${LIB}/vndk:/vendor/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/system/${LIB}
 
-namespace.default.asan.search.paths = /data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/system/${LIB}:/system/${LIB}
+namespace.default.asan.search.paths = /data/asan/vendor/${LIB}/hw:/vendor/${LIB}/hw:/data/asan/vendor/${LIB}/egl:/vendor/${LIB}/egl:/data/asan/vendor/${LIB}:/vendor/${LIB}:/data/asan/system/${LIB}/vndk:/system/${LIB}/vndk:/data/asan/vendor/${LIB}/vndk-sp:/vendor/${LIB}/vndk-sp:/data/asan/system/${LIB}/vndk-sp:/system/${LIB}/vndk-sp:/data/asan/system/${LIB}:/system/${LIB}
 
 ###############################################################################
 # Namespace config for tests. No VNDK restriction is enforced for these tests.
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 901d066..df90403 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -387,12 +387,12 @@
     # create basic filesystem structure
     mkdir /data/misc 01771 system misc
     mkdir /data/misc/recovery 0770 system log
-    copy /data/misc/recovery/default.prop /data/misc/recovery/default.prop.1
-    chmod 0440 /data/misc/recovery/default.prop.1
-    chown system log /data/misc/recovery/default.prop.1
-    copy /default.prop /data/misc/recovery/default.prop
-    chmod 0440 /data/misc/recovery/default.prop
-    chown system log /data/misc/recovery/default.prop
+    copy /data/misc/recovery/ro.build.fingerprint /data/misc/recovery/ro.build.fingerprint.1
+    chmod 0440 /data/misc/recovery/ro.build.fingerprint.1
+    chown system log /data/misc/recovery/ro.build.fingerprint.1
+    write /data/misc/recovery/ro.build.fingerprint ${ro.build.fingerprint}
+    chmod 0440 /data/misc/recovery/ro.build.fingerprint
+    chown system log /data/misc/recovery/ro.build.fingerprint
     mkdir /data/misc/recovery/proc 0770 system log
     copy /data/misc/recovery/proc/version /data/misc/recovery/proc/version.1
     chmod 0440 /data/misc/recovery/proc/version.1