diff --git a/adb/Android.bp b/adb/Android.bp
index 41e752f..3685687 100644
--- a/adb/Android.bp
+++ b/adb/Android.bp
@@ -138,6 +138,8 @@
         "client/usb_libusb.cpp",
         "client/usb_dispatch.cpp",
         "client/transport_mdns.cpp",
+        "client/fastdeploy.cpp",
+        "client/fastdeploycallbacks.cpp",
     ],
 
     target: {
@@ -170,6 +172,12 @@
         "libdiagnose_usb",
         "libmdnssd",
         "libusb",
+        "libandroidfw",
+        "libziparchive",
+        "libz",
+        "libutils",
+        "liblog",
+        "libcutils",
     ],
 }
 
@@ -237,6 +245,7 @@
         "client/file_sync_client.cpp",
         "client/main.cpp",
         "client/console.cpp",
+        "client/adb_install.cpp",
         "client/line_printer.cpp",
         "shell_service_protocol.cpp",
     ],
@@ -251,6 +260,12 @@
         "liblog",
         "libmdnssd",
         "libusb",
+        "libandroidfw",
+        "libziparchive",
+        "libz",
+        "libutils",
+        "liblog",
+        "libcutils",
     ],
 
     stl: "libc++_static",
diff --git a/adb/client/adb_client.h b/adb/client/adb_client.h
index fca435e..d467539 100644
--- a/adb/client/adb_client.h
+++ b/adb/client/adb_client.h
@@ -14,8 +14,7 @@
  * limitations under the License.
  */
 
-#ifndef _ADB_CLIENT_H_
-#define _ADB_CLIENT_H_
+#pragma once
 
 #include "adb.h"
 #include "sysdeps.h"
@@ -63,5 +62,3 @@
 
 // Get the feature set of the current preferred transport.
 bool adb_get_feature_set(FeatureSet* _Nonnull feature_set, std::string* _Nonnull error);
-
-#endif
diff --git a/adb/client/adb_install.cpp b/adb/client/adb_install.cpp
new file mode 100644
index 0000000..95574ed
--- /dev/null
+++ b/adb/client/adb_install.cpp
@@ -0,0 +1,554 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define TRACE_TAG ADB
+
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "adb.h"
+#include "adb_client.h"
+#include "adb_install.h"
+#include "adb_utils.h"
+#include "client/file_sync_client.h"
+#include "commandline.h"
+#include "fastdeploy.h"
+#include "sysdeps.h"
+
+#include <algorithm>
+#include <iostream>
+#include <string>
+#include <vector>
+
+#include <unistd.h>
+
+#include <android-base/file.h>
+#include <android-base/stringprintf.h>
+#include <android-base/strings.h>
+#include <android-base/test_utils.h>
+
+static bool _use_legacy_install() {
+    FeatureSet features;
+    std::string error;
+    if (!adb_get_feature_set(&features, &error)) {
+        fprintf(stderr, "error: %s\n", error.c_str());
+        return true;
+    }
+    return !CanUseFeature(features, kFeatureCmd);
+}
+
+static int pm_command(int argc, const char** argv) {
+    std::string cmd = "pm";
+
+    while (argc-- > 0) {
+        cmd += " " + escape_arg(*argv++);
+    }
+
+    return send_shell_command(cmd);
+}
+
+static int uninstall_app_streamed(int argc, const char** argv) {
+    // 'adb uninstall' takes the same arguments as 'cmd package uninstall' on device
+    std::string cmd = "cmd package";
+    while (argc-- > 0) {
+        // deny the '-k' option until the remaining data/cache can be removed with adb/UI
+        if (strcmp(*argv, "-k") == 0) {
+            printf("The -k option uninstalls the application while retaining the "
+                   "data/cache.\n"
+                   "At the moment, there is no way to remove the remaining data.\n"
+                   "You will have to reinstall the application with the same "
+                   "signature, and fully "
+                   "uninstall it.\n"
+                   "If you truly wish to continue, execute 'adb shell cmd package "
+                   "uninstall -k'.\n");
+            return EXIT_FAILURE;
+        }
+        cmd += " " + escape_arg(*argv++);
+    }
+
+    return send_shell_command(cmd);
+}
+
+static int uninstall_app_legacy(int argc, const char** argv) {
+    /* if the user choose the -k option, we refuse to do it until devices are
+       out with the option to uninstall the remaining data somehow (adb/ui) */
+    for (int i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "-k")) {
+            printf("The -k option uninstalls the application while retaining the "
+                   "data/cache.\n"
+                   "At the moment, there is no way to remove the remaining data.\n"
+                   "You will have to reinstall the application with the same "
+                   "signature, and fully "
+                   "uninstall it.\n"
+                   "If you truly wish to continue, execute 'adb shell pm uninstall "
+                   "-k'\n.");
+            return EXIT_FAILURE;
+        }
+    }
+
+    /* 'adb uninstall' takes the same arguments as 'pm uninstall' on device */
+    return pm_command(argc, argv);
+}
+
+int uninstall_app(int argc, const char** argv) {
+    if (_use_legacy_install()) {
+        return uninstall_app_legacy(argc, argv);
+    }
+    return uninstall_app_streamed(argc, argv);
+}
+
+static void read_status_line(int fd, char* buf, size_t count) {
+    count--;
+    while (count > 0) {
+        int len = adb_read(fd, buf, count);
+        if (len <= 0) {
+            break;
+        }
+
+        buf += len;
+        count -= len;
+    }
+    *buf = '\0';
+}
+
+static int delete_device_patch_file(const char* apkPath) {
+    std::string patchDevicePath = get_patch_path(apkPath);
+    return delete_device_file(patchDevicePath);
+}
+
+static int install_app_streamed(int argc, const char** argv, bool use_fastdeploy,
+                                bool use_localagent, const char* adb_path) {
+    printf("Performing Streamed Install\n");
+
+    // The last argument must be the APK file
+    const char* file = argv[argc - 1];
+    if (!android::base::EndsWithIgnoreCase(file, ".apk")) {
+        return syntax_error("filename doesn't end .apk: %s", file);
+    }
+
+    if (use_fastdeploy == true) {
+        TemporaryFile metadataTmpFile;
+        TemporaryFile patchTmpFile;
+
+        FILE* metadataFile = fopen(metadataTmpFile.path, "wb");
+        int metadata_len = extract_metadata(file, metadataFile);
+        fclose(metadataFile);
+
+        int result = -1;
+        if (metadata_len <= 0) {
+            printf("failed to extract metadata %d\n", metadata_len);
+            return 1;
+        } else {
+            int create_patch_result = create_patch(file, metadataTmpFile.path, patchTmpFile.path,
+                                                   use_localagent, adb_path);
+            if (create_patch_result != 0) {
+                printf("Patch creation failure, error code: %d\n", create_patch_result);
+                result = create_patch_result;
+                goto cleanup_streamed_apk;
+            } else {
+                std::vector<const char*> pm_args;
+                // pass all but 1st (command) and last (apk path) parameters through to pm for
+                // session creation
+                for (int i = 1; i < argc - 1; i++) {
+                    pm_args.push_back(argv[i]);
+                }
+                int apply_patch_result =
+                        install_patch(file, patchTmpFile.path, pm_args.size(), pm_args.data());
+                if (apply_patch_result != 0) {
+                    printf("Patch application failure, error code: %d\n", apply_patch_result);
+                    result = apply_patch_result;
+                    goto cleanup_streamed_apk;
+                }
+            }
+        }
+
+    cleanup_streamed_apk:
+        delete_device_patch_file(file);
+        return result;
+    } else {
+        struct stat sb;
+        if (stat(file, &sb) == -1) {
+            fprintf(stderr, "adb: failed to stat %s: %s\n", file, strerror(errno));
+            return 1;
+        }
+
+        int localFd = adb_open(file, O_RDONLY);
+        if (localFd < 0) {
+            fprintf(stderr, "adb: failed to open %s: %s\n", file, strerror(errno));
+            return 1;
+        }
+
+        std::string error;
+        std::string cmd = "exec:cmd package";
+
+        // don't copy the APK name, but, copy the rest of the arguments as-is
+        while (argc-- > 1) {
+            cmd += " " + escape_arg(std::string(*argv++));
+        }
+
+        // add size parameter [required for streaming installs]
+        // do last to override any user specified value
+        cmd += " " + android::base::StringPrintf("-S %" PRIu64, static_cast<uint64_t>(sb.st_size));
+
+        int remoteFd = adb_connect(cmd, &error);
+        if (remoteFd < 0) {
+            fprintf(stderr, "adb: connect error for write: %s\n", error.c_str());
+            adb_close(localFd);
+            return 1;
+        }
+
+        char buf[BUFSIZ];
+        copy_to_file(localFd, remoteFd);
+        read_status_line(remoteFd, buf, sizeof(buf));
+
+        adb_close(localFd);
+        adb_close(remoteFd);
+
+        if (!strncmp("Success", buf, 7)) {
+            fputs(buf, stdout);
+            return 0;
+        }
+        fprintf(stderr, "adb: failed to install %s: %s", file, buf);
+        return 1;
+    }
+}
+
+static int install_app_legacy(int argc, const char** argv, bool use_fastdeploy, bool use_localagent,
+                              const char* adb_path) {
+    static const char* const DATA_DEST = "/data/local/tmp/%s";
+    static const char* const SD_DEST = "/sdcard/tmp/%s";
+    const char* where = DATA_DEST;
+
+    printf("Performing Push Install\n");
+
+    for (int i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "-s")) {
+            where = SD_DEST;
+        }
+    }
+
+    // Find last APK argument.
+    // All other arguments passed through verbatim.
+    int last_apk = -1;
+    for (int i = argc - 1; i >= 0; i--) {
+        if (android::base::EndsWithIgnoreCase(argv[i], ".apk")) {
+            last_apk = i;
+            break;
+        }
+    }
+
+    if (last_apk == -1) return syntax_error("need APK file on command line");
+
+    int result = -1;
+    std::vector<const char*> apk_file = {argv[last_apk]};
+    std::string apk_dest =
+            android::base::StringPrintf(where, android::base::Basename(argv[last_apk]).c_str());
+
+    TemporaryFile metadataTmpFile;
+    TemporaryFile patchTmpFile;
+
+    if (use_fastdeploy == true) {
+        FILE* metadataFile = fopen(metadataTmpFile.path, "wb");
+        int metadata_len = extract_metadata(apk_file[0], metadataFile);
+        fclose(metadataFile);
+
+        if (metadata_len <= 0) {
+            printf("failed to extract metadata %d\n", metadata_len);
+            return 1;
+        } else {
+            int create_patch_result = create_patch(apk_file[0], metadataTmpFile.path,
+                                                   patchTmpFile.path, use_localagent, adb_path);
+            if (create_patch_result != 0) {
+                printf("Patch creation failure, error code: %d\n", create_patch_result);
+                result = create_patch_result;
+                goto cleanup_apk;
+            } else {
+                int apply_patch_result =
+                        apply_patch_on_device(apk_file[0], patchTmpFile.path, apk_dest.c_str());
+                if (apply_patch_result != 0) {
+                    printf("Patch application failure, error code: %d\n", apply_patch_result);
+                    result = apply_patch_result;
+                    goto cleanup_apk;
+                }
+            }
+        }
+    } else {
+        if (!do_sync_push(apk_file, apk_dest.c_str(), false)) goto cleanup_apk;
+    }
+
+    argv[last_apk] = apk_dest.c_str(); /* destination name, not source location */
+    result = pm_command(argc, argv);
+
+cleanup_apk:
+    delete_device_patch_file(apk_file[0]);
+    delete_device_file(apk_dest);
+    return result;
+}
+
+int install_app(int argc, const char** argv) {
+    std::vector<int> processedArgIndicies;
+    enum installMode {
+        INSTALL_DEFAULT,
+        INSTALL_PUSH,
+        INSTALL_STREAM
+    } installMode = INSTALL_DEFAULT;
+    bool use_fastdeploy = false;
+    bool is_reinstall = false;
+    bool use_localagent = false;
+    FastDeploy_AgentUpdateStrategy agent_update_strategy = FastDeploy_AgentUpdateDifferentVersion;
+
+    for (int i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "--streaming")) {
+            processedArgIndicies.push_back(i);
+            installMode = INSTALL_STREAM;
+        } else if (!strcmp(argv[i], "--no-streaming")) {
+            processedArgIndicies.push_back(i);
+            installMode = INSTALL_PUSH;
+        } else if (!strcmp(argv[i], "-r")) {
+            // Note that this argument is not added to processedArgIndicies because it
+            // must be passed through to pm
+            is_reinstall = true;
+        } else if (!strcmp(argv[i], "--fastdeploy")) {
+            processedArgIndicies.push_back(i);
+            use_fastdeploy = true;
+        } else if (!strcmp(argv[i], "--no-fastdeploy")) {
+            processedArgIndicies.push_back(i);
+            use_fastdeploy = false;
+        } else if (!strcmp(argv[i], "-f")) {
+            processedArgIndicies.push_back(i);
+            use_fastdeploy = true;
+        } else if (!strcmp(argv[i], "--force-agent")) {
+            processedArgIndicies.push_back(i);
+            agent_update_strategy = FastDeploy_AgentUpdateAlways;
+        } else if (!strcmp(argv[i], "--date-check-agent")) {
+            processedArgIndicies.push_back(i);
+            agent_update_strategy = FastDeploy_AgentUpdateNewerTimeStamp;
+        } else if (!strcmp(argv[i], "--version-check-agent")) {
+            processedArgIndicies.push_back(i);
+            agent_update_strategy = FastDeploy_AgentUpdateDifferentVersion;
+#ifndef _WIN32
+        } else if (!strcmp(argv[i], "--local-agent")) {
+            processedArgIndicies.push_back(i);
+            use_localagent = true;
+#endif
+        }
+        // TODO: --installlog <filename>
+    }
+
+    if (installMode == INSTALL_DEFAULT) {
+        if (_use_legacy_install()) {
+            installMode = INSTALL_PUSH;
+        } else {
+            installMode = INSTALL_STREAM;
+        }
+    }
+
+    if (installMode == INSTALL_STREAM && _use_legacy_install() == true) {
+        return syntax_error("Attempting to use streaming install on unsupported deivce.");
+    }
+
+    if (use_fastdeploy == true && is_reinstall == false) {
+        printf("Fast Deploy is only available with -r.\n");
+        use_fastdeploy = false;
+    }
+
+    if (use_fastdeploy == true && get_device_api_level() < kFastDeployMinApi) {
+        printf("Fast Deploy is only compatible with devices of API version %d or higher, "
+               "ignoring.\n",
+               kFastDeployMinApi);
+        use_fastdeploy = false;
+    }
+
+    std::vector<const char*> passthrough_argv;
+    for (int i = 0; i < argc; i++) {
+        if (std::find(processedArgIndicies.begin(), processedArgIndicies.end(), i) ==
+            processedArgIndicies.end()) {
+            passthrough_argv.push_back(argv[i]);
+        }
+    }
+
+    std::string adb_path = android::base::GetExecutablePath();
+
+    if (adb_path.length() == 0) {
+        return 1;
+    }
+    if (use_fastdeploy == true) {
+        bool agent_up_to_date =
+                update_agent(agent_update_strategy, use_localagent, adb_path.c_str());
+        if (agent_up_to_date == false) {
+            printf("Failed to update agent, exiting\n");
+            return 1;
+        }
+    }
+
+    switch (installMode) {
+        case INSTALL_PUSH:
+            return install_app_legacy(passthrough_argv.size(), passthrough_argv.data(),
+                                      use_fastdeploy, use_localagent, adb_path.c_str());
+        case INSTALL_STREAM:
+            return install_app_streamed(passthrough_argv.size(), passthrough_argv.data(),
+                                        use_fastdeploy, use_localagent, adb_path.c_str());
+        case INSTALL_DEFAULT:
+        default:
+            return 1;
+    }
+}
+
+int install_multiple_app(int argc, const char** argv) {
+    // Find all APK arguments starting at end.
+    // All other arguments passed through verbatim.
+    int first_apk = -1;
+    uint64_t total_size = 0;
+    for (int i = argc - 1; i >= 0; i--) {
+        const char* file = argv[i];
+
+        if (android::base::EndsWithIgnoreCase(file, ".apk")) {
+            struct stat sb;
+            if (stat(file, &sb) != -1) total_size += sb.st_size;
+            first_apk = i;
+        } else {
+            break;
+        }
+    }
+
+    if (first_apk == -1) return syntax_error("need APK file on command line");
+
+    std::string install_cmd;
+    if (_use_legacy_install()) {
+        install_cmd = "exec:pm";
+    } else {
+        install_cmd = "exec:cmd package";
+    }
+
+    std::string cmd = android::base::StringPrintf("%s install-create -S %" PRIu64,
+                                                  install_cmd.c_str(), total_size);
+    for (int i = 1; i < first_apk; i++) {
+        cmd += " " + escape_arg(argv[i]);
+    }
+
+    // Create install session
+    std::string error;
+    int fd = adb_connect(cmd, &error);
+    if (fd < 0) {
+        fprintf(stderr, "adb: connect error for create: %s\n", error.c_str());
+        return EXIT_FAILURE;
+    }
+    char buf[BUFSIZ];
+    read_status_line(fd, buf, sizeof(buf));
+    adb_close(fd);
+
+    int session_id = -1;
+    if (!strncmp("Success", buf, 7)) {
+        char* start = strrchr(buf, '[');
+        char* end = strrchr(buf, ']');
+        if (start && end) {
+            *end = '\0';
+            session_id = strtol(start + 1, nullptr, 10);
+        }
+    }
+    if (session_id < 0) {
+        fprintf(stderr, "adb: failed to create session\n");
+        fputs(buf, stderr);
+        return EXIT_FAILURE;
+    }
+
+    // Valid session, now stream the APKs
+    int success = 1;
+    for (int i = first_apk; i < argc; i++) {
+        const char* file = argv[i];
+        struct stat sb;
+        if (stat(file, &sb) == -1) {
+            fprintf(stderr, "adb: failed to stat %s: %s\n", file, strerror(errno));
+            success = 0;
+            goto finalize_session;
+        }
+
+        std::string cmd =
+                android::base::StringPrintf("%s install-write -S %" PRIu64 " %d %d_%s -",
+                                            install_cmd.c_str(), static_cast<uint64_t>(sb.st_size),
+                                            session_id, i, android::base::Basename(file).c_str());
+
+        int localFd = adb_open(file, O_RDONLY);
+        if (localFd < 0) {
+            fprintf(stderr, "adb: failed to open %s: %s\n", file, strerror(errno));
+            success = 0;
+            goto finalize_session;
+        }
+
+        std::string error;
+        int remoteFd = adb_connect(cmd, &error);
+        if (remoteFd < 0) {
+            fprintf(stderr, "adb: connect error for write: %s\n", error.c_str());
+            adb_close(localFd);
+            success = 0;
+            goto finalize_session;
+        }
+
+        copy_to_file(localFd, remoteFd);
+        read_status_line(remoteFd, buf, sizeof(buf));
+
+        adb_close(localFd);
+        adb_close(remoteFd);
+
+        if (strncmp("Success", buf, 7)) {
+            fprintf(stderr, "adb: failed to write %s\n", file);
+            fputs(buf, stderr);
+            success = 0;
+            goto finalize_session;
+        }
+    }
+
+finalize_session:
+    // Commit session if we streamed everything okay; otherwise abandon
+    std::string service = android::base::StringPrintf("%s install-%s %d", install_cmd.c_str(),
+                                                      success ? "commit" : "abandon", session_id);
+    fd = adb_connect(service, &error);
+    if (fd < 0) {
+        fprintf(stderr, "adb: connect error for finalize: %s\n", error.c_str());
+        return EXIT_FAILURE;
+    }
+    read_status_line(fd, buf, sizeof(buf));
+    adb_close(fd);
+
+    if (!strncmp("Success", buf, 7)) {
+        fputs(buf, stdout);
+        return 0;
+    }
+    fprintf(stderr, "adb: failed to finalize session\n");
+    fputs(buf, stderr);
+    return EXIT_FAILURE;
+}
+
+int delete_device_file(const std::string& filename) {
+    std::string cmd = "rm -f " + escape_arg(filename);
+    return send_shell_command(cmd);
+}
+
+int delete_host_file(const std::string& filename) {
+#ifdef _WIN32
+    BOOL delete_return = DeleteFileA(filename.c_str());
+    if (delete_return != 0) {
+        return 0;
+    } else {
+        DWORD last_error = GetLastError();
+        printf("Error [%ld] deleting: %s\n", last_error, filename.c_str());
+        return delete_return;
+    }
+#else
+    std::string cmd = "rm -f " + escape_arg(filename);
+    return system(cmd.c_str());
+#endif
+}
diff --git a/adb/client/adb_install.h b/adb/client/adb_install.h
new file mode 100644
index 0000000..e9410a9
--- /dev/null
+++ b/adb/client/adb_install.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ADB_INSTALL_H
+#define ADB_INSTALL_H
+
+#include "fastdeploy.h"
+
+int install_app(int argc, const char** argv);
+int install_multiple_app(int argc, const char** argv);
+int uninstall_app(int argc, const char** argv);
+
+int delete_device_file(const std::string& filename);
+int delete_host_file(const std::string& filename);
+
+#endif
diff --git a/adb/client/commandline.cpp b/adb/client/commandline.cpp
index 41ac663..b55ae95 100644
--- a/adb/client/commandline.cpp
+++ b/adb/client/commandline.cpp
@@ -52,23 +52,19 @@
 #include "adb.h"
 #include "adb_auth.h"
 #include "adb_client.h"
+#include "adb_install.h"
 #include "adb_io.h"
 #include "adb_unique_fd.h"
 #include "adb_utils.h"
 #include "bugreport.h"
 #include "client/file_sync_client.h"
 #include "commandline.h"
+#include "fastdeploy.h"
 #include "services.h"
 #include "shell_protocol.h"
 #include "sysdeps/chrono.h"
 #include "sysdeps/memory.h"
 
-static int install_app(int argc, const char** argv);
-static int install_multiple_app(int argc, const char** argv);
-static int uninstall_app(int argc, const char** argv);
-static int install_app_legacy(int argc, const char** argv);
-static int uninstall_app_legacy(int argc, const char** argv);
-
 extern int gListenAll;
 
 DefaultStandardStreamsCallback DEFAULT_STANDARD_STREAMS_CALLBACK(nullptr, nullptr);
@@ -160,6 +156,17 @@
         "     -p: partial application install (install-multiple only)\n"
         "     -g: grant all runtime permissions\n"
         "     --instant: cause the app to be installed as an ephemeral install app\n"
+        "     --no-streaming: always push APK to device and invoke Package Manager as separate steps\n"
+        "     --streaming: force streaming APK directly into Package Manager\n"
+        "     -f/--fastdeploy: use fast deploy (only valid with -r)\n"
+        "     --no-fastdeploy: prevent use of fast deploy (only valid with -r)\n"
+        "     --force-agent: force update of deployment agent when using fast deploy\n"
+        "     --date-check-agent: update deployment agent when local version is newer and using fast deploy\n"
+        "     --version-check-agent: update deployment agent when local version has different version code and using fast deploy\n"
+#ifndef _WIN32
+        "     --local-agent: locate agent files from local source build (instead of SDK location)\n"
+#endif
+        //TODO--installlog <filename>
         " uninstall [-k] PACKAGE\n"
         "     remove this app package from the device\n"
         "     '-k': keep the data and cache directories\n"
@@ -306,21 +313,6 @@
     return callback->Done(exit_code);
 }
 
-static void read_status_line(int fd, char* buf, size_t count)
-{
-    count--;
-    while (count > 0) {
-        int len = adb_read(fd, buf, count);
-        if (len <= 0) {
-            break;
-        }
-
-        buf += len;
-        count -= len;
-    }
-    *buf = '\0';
-}
-
 static void stdinout_raw_prologue(int inFd, int outFd, int& old_stdin_mode, int& old_stdout_mode) {
     if (inFd == STDIN_FILENO) {
         stdin_raw_init();
@@ -361,7 +353,7 @@
 #endif
 }
 
-static void copy_to_file(int inFd, int outFd) {
+void copy_to_file(int inFd, int outFd) {
     constexpr size_t BUFSIZE = 32 * 1024;
     std::vector<char> buf(BUFSIZE);
     int len;
@@ -1315,16 +1307,6 @@
 #endif
 }
 
-static bool _use_legacy_install() {
-    FeatureSet features;
-    std::string error;
-    if (!adb_get_feature_set(&features, &error)) {
-        fprintf(stderr, "error: %s\n", error.c_str());
-        return true;
-    }
-    return !CanUseFeature(features, kFeatureCmd);
-}
-
 int adb_commandline(int argc, const char** argv) {
     bool no_daemon = false;
     bool is_daemon = false;
@@ -1706,9 +1688,6 @@
     }
     else if (!strcmp(argv[0], "install")) {
         if (argc < 2) return syntax_error("install requires an argument");
-        if (_use_legacy_install()) {
-            return install_app_legacy(argc, argv);
-        }
         return install_app(argc, argv);
     }
     else if (!strcmp(argv[0], "install-multiple")) {
@@ -1717,9 +1696,6 @@
     }
     else if (!strcmp(argv[0], "uninstall")) {
         if (argc < 2) return syntax_error("uninstall requires an argument");
-        if (_use_legacy_install()) {
-            return uninstall_app_legacy(argc, argv);
-        }
         return uninstall_app(argc, argv);
     }
     else if (!strcmp(argv[0], "sync")) {
@@ -1844,270 +1820,3 @@
     syntax_error("unknown command %s", argv[0]);
     return 1;
 }
-
-static int uninstall_app(int argc, const char** argv) {
-    // 'adb uninstall' takes the same arguments as 'cmd package uninstall' on device
-    std::string cmd = "cmd package";
-    while (argc-- > 0) {
-        // deny the '-k' option until the remaining data/cache can be removed with adb/UI
-        if (strcmp(*argv, "-k") == 0) {
-            printf(
-                "The -k option uninstalls the application while retaining the data/cache.\n"
-                "At the moment, there is no way to remove the remaining data.\n"
-                "You will have to reinstall the application with the same signature, and fully uninstall it.\n"
-                "If you truly wish to continue, execute 'adb shell cmd package uninstall -k'.\n");
-            return EXIT_FAILURE;
-        }
-        cmd += " " + escape_arg(*argv++);
-    }
-
-    return send_shell_command(cmd);
-}
-
-static int install_app(int argc, const char** argv) {
-    // The last argument must be the APK file
-    const char* file = argv[argc - 1];
-    if (!android::base::EndsWithIgnoreCase(file, ".apk")) {
-        return syntax_error("filename doesn't end .apk: %s", file);
-    }
-
-    struct stat sb;
-    if (stat(file, &sb) == -1) {
-        fprintf(stderr, "adb: failed to stat %s: %s\n", file, strerror(errno));
-        return 1;
-    }
-
-    int localFd = adb_open(file, O_RDONLY);
-    if (localFd < 0) {
-        fprintf(stderr, "adb: failed to open %s: %s\n", file, strerror(errno));
-        return 1;
-    }
-
-    std::string error;
-    std::string cmd = "exec:cmd package";
-
-    // don't copy the APK name, but, copy the rest of the arguments as-is
-    while (argc-- > 1) {
-        cmd += " " + escape_arg(std::string(*argv++));
-    }
-
-    // add size parameter [required for streaming installs]
-    // do last to override any user specified value
-    cmd += " " + android::base::StringPrintf("-S %" PRIu64, static_cast<uint64_t>(sb.st_size));
-
-    int remoteFd = adb_connect(cmd, &error);
-    if (remoteFd < 0) {
-        fprintf(stderr, "adb: connect error for write: %s\n", error.c_str());
-        adb_close(localFd);
-        return 1;
-    }
-
-    char buf[BUFSIZ];
-    copy_to_file(localFd, remoteFd);
-    read_status_line(remoteFd, buf, sizeof(buf));
-
-    adb_close(localFd);
-    adb_close(remoteFd);
-
-    if (!strncmp("Success", buf, 7)) {
-        fputs(buf, stdout);
-        return 0;
-    }
-    fprintf(stderr, "adb: failed to install %s: %s", file, buf);
-    return 1;
-}
-
-static int install_multiple_app(int argc, const char** argv) {
-    // Find all APK arguments starting at end.
-    // All other arguments passed through verbatim.
-    int first_apk = -1;
-    uint64_t total_size = 0;
-    for (int i = argc - 1; i >= 0; i--) {
-        const char* file = argv[i];
-
-        if (android::base::EndsWithIgnoreCase(file, ".apk") ||
-            android::base::EndsWithIgnoreCase(file, ".dm")) {
-            struct stat sb;
-            if (stat(file, &sb) != -1) total_size += sb.st_size;
-            first_apk = i;
-        } else {
-            break;
-        }
-    }
-
-    if (first_apk == -1) return syntax_error("need APK file on command line");
-
-    std::string install_cmd;
-    if (_use_legacy_install()) {
-        install_cmd = "exec:pm";
-    } else {
-        install_cmd = "exec:cmd package";
-    }
-
-    std::string cmd = android::base::StringPrintf("%s install-create -S %" PRIu64, install_cmd.c_str(), total_size);
-    for (int i = 1; i < first_apk; i++) {
-        cmd += " " + escape_arg(argv[i]);
-    }
-
-    // Create install session
-    std::string error;
-    int fd = adb_connect(cmd, &error);
-    if (fd < 0) {
-        fprintf(stderr, "adb: connect error for create: %s\n", error.c_str());
-        return EXIT_FAILURE;
-    }
-    char buf[BUFSIZ];
-    read_status_line(fd, buf, sizeof(buf));
-    adb_close(fd);
-
-    int session_id = -1;
-    if (!strncmp("Success", buf, 7)) {
-        char* start = strrchr(buf, '[');
-        char* end = strrchr(buf, ']');
-        if (start && end) {
-            *end = '\0';
-            session_id = strtol(start + 1, nullptr, 10);
-        }
-    }
-    if (session_id < 0) {
-        fprintf(stderr, "adb: failed to create session\n");
-        fputs(buf, stderr);
-        return EXIT_FAILURE;
-    }
-
-    // Valid session, now stream the APKs
-    int success = 1;
-    for (int i = first_apk; i < argc; i++) {
-        const char* file = argv[i];
-        struct stat sb;
-        if (stat(file, &sb) == -1) {
-            fprintf(stderr, "adb: failed to stat %s: %s\n", file, strerror(errno));
-            success = 0;
-            goto finalize_session;
-        }
-
-        std::string cmd = android::base::StringPrintf(
-            "%s install-write -S %" PRIu64 " %d %s -", install_cmd.c_str(),
-            static_cast<uint64_t>(sb.st_size), session_id, android::base::Basename(file).c_str());
-
-        int localFd = adb_open(file, O_RDONLY);
-        if (localFd < 0) {
-            fprintf(stderr, "adb: failed to open %s: %s\n", file, strerror(errno));
-            success = 0;
-            goto finalize_session;
-        }
-
-        std::string error;
-        int remoteFd = adb_connect(cmd, &error);
-        if (remoteFd < 0) {
-            fprintf(stderr, "adb: connect error for write: %s\n", error.c_str());
-            adb_close(localFd);
-            success = 0;
-            goto finalize_session;
-        }
-
-        copy_to_file(localFd, remoteFd);
-        read_status_line(remoteFd, buf, sizeof(buf));
-
-        adb_close(localFd);
-        adb_close(remoteFd);
-
-        if (strncmp("Success", buf, 7)) {
-            fprintf(stderr, "adb: failed to write %s\n", file);
-            fputs(buf, stderr);
-            success = 0;
-            goto finalize_session;
-        }
-    }
-
-finalize_session:
-    // Commit session if we streamed everything okay; otherwise abandon
-    std::string service =
-            android::base::StringPrintf("%s install-%s %d",
-                                        install_cmd.c_str(), success ? "commit" : "abandon", session_id);
-    fd = adb_connect(service, &error);
-    if (fd < 0) {
-        fprintf(stderr, "adb: connect error for finalize: %s\n", error.c_str());
-        return EXIT_FAILURE;
-    }
-    read_status_line(fd, buf, sizeof(buf));
-    adb_close(fd);
-
-    if (!strncmp("Success", buf, 7)) {
-        fputs(buf, stdout);
-        return 0;
-    }
-    fprintf(stderr, "adb: failed to finalize session\n");
-    fputs(buf, stderr);
-    return EXIT_FAILURE;
-}
-
-static int pm_command(int argc, const char** argv) {
-    std::string cmd = "pm";
-
-    while (argc-- > 0) {
-        cmd += " " + escape_arg(*argv++);
-    }
-
-    return send_shell_command(cmd);
-}
-
-static int uninstall_app_legacy(int argc, const char** argv) {
-    /* if the user choose the -k option, we refuse to do it until devices are
-       out with the option to uninstall the remaining data somehow (adb/ui) */
-    int i;
-    for (i = 1; i < argc; i++) {
-        if (!strcmp(argv[i], "-k")) {
-            printf(
-                "The -k option uninstalls the application while retaining the data/cache.\n"
-                "At the moment, there is no way to remove the remaining data.\n"
-                "You will have to reinstall the application with the same signature, and fully uninstall it.\n"
-                "If you truly wish to continue, execute 'adb shell pm uninstall -k'\n.");
-            return EXIT_FAILURE;
-        }
-    }
-
-    /* 'adb uninstall' takes the same arguments as 'pm uninstall' on device */
-    return pm_command(argc, argv);
-}
-
-static int delete_file(const std::string& filename) {
-    std::string cmd = "rm -f " + escape_arg(filename);
-    return send_shell_command(cmd);
-}
-
-static int install_app_legacy(int argc, const char** argv) {
-    static const char *const DATA_DEST = "/data/local/tmp/%s";
-    static const char *const SD_DEST = "/sdcard/tmp/%s";
-    const char* where = DATA_DEST;
-
-    for (int i = 1; i < argc; i++) {
-        if (!strcmp(argv[i], "-s")) {
-            where = SD_DEST;
-        }
-    }
-
-    // Find last APK argument.
-    // All other arguments passed through verbatim.
-    int last_apk = -1;
-    for (int i = argc - 1; i >= 0; i--) {
-        if (android::base::EndsWithIgnoreCase(argv[i], ".apk")) {
-            last_apk = i;
-            break;
-        }
-    }
-
-    if (last_apk == -1) return syntax_error("need APK file on command line");
-
-    int result = -1;
-    std::vector<const char*> apk_file = {argv[last_apk]};
-    std::string apk_dest = android::base::StringPrintf(
-        where, android::base::Basename(argv[last_apk]).c_str());
-    if (!do_sync_push(apk_file, apk_dest.c_str(), false)) goto cleanup_apk;
-    argv[last_apk] = apk_dest.c_str(); /* destination name, not source location */
-    result = pm_command(argc, argv);
-
-cleanup_apk:
-    delete_file(apk_dest);
-    return result;
-}
diff --git a/adb/client/commandline.h b/adb/client/commandline.h
index 3aa03a7..6cfd4f7 100644
--- a/adb/client/commandline.h
+++ b/adb/client/commandline.h
@@ -96,6 +96,8 @@
 
 int adb_commandline(int argc, const char** argv);
 
+void copy_to_file(int inFd, int outFd);
+
 // Connects to the device "shell" service with |command| and prints the
 // resulting output.
 // if |callback| is non-null, stdout/stderr output will be handled by it.
diff --git a/adb/client/fastdeploy.cpp b/adb/client/fastdeploy.cpp
new file mode 100644
index 0000000..fda3889
--- /dev/null
+++ b/adb/client/fastdeploy.cpp
@@ -0,0 +1,365 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <androidfw/ResourceTypes.h>
+#include <androidfw/ZipFileRO.h>
+#include <libgen.h>
+#include <algorithm>
+
+#include "client/file_sync_client.h"
+#include "commandline.h"
+#include "fastdeploy.h"
+#include "fastdeploycallbacks.h"
+#include "utils/String16.h"
+
+const long kRequiredAgentVersion = 0x00000001;
+
+const char* kDeviceAgentPath = "/data/local/tmp/";
+
+long get_agent_version() {
+    std::vector<char> versionOutputBuffer;
+    std::vector<char> versionErrorBuffer;
+
+    int statusCode = capture_shell_command("/data/local/tmp/deployagent.sh version",
+                                           &versionOutputBuffer, &versionErrorBuffer);
+    long version = -1;
+
+    if (statusCode == 0 && versionOutputBuffer.size() > 0) {
+        version = strtol((char*)versionOutputBuffer.data(), NULL, 16);
+    }
+
+    return version;
+}
+
+int get_device_api_level() {
+    std::vector<char> sdkVersionOutputBuffer;
+    std::vector<char> sdkVersionErrorBuffer;
+    int api_level = -1;
+
+    int statusCode = capture_shell_command("getprop ro.build.version.sdk", &sdkVersionOutputBuffer,
+                                           &sdkVersionErrorBuffer);
+    if (statusCode == 0 && sdkVersionOutputBuffer.size() > 0) {
+        api_level = strtol((char*)sdkVersionOutputBuffer.data(), NULL, 10);
+    }
+
+    return api_level;
+}
+
+// local_path - must start with a '/' and be relative to $ANDROID_PRODUCT_OUT
+static bool get_agent_component_host_path(bool use_localagent, const char* adb_path,
+                                          const char* local_path, const char* sdk_path,
+                                          std::string* output_path) {
+    std::string mutable_adb_path = adb_path;
+    const char* adb_dir = dirname(&mutable_adb_path[0]);
+    if (adb_dir == nullptr) {
+        return false;
+    }
+
+    if (use_localagent) {
+        const char* product_out = getenv("ANDROID_PRODUCT_OUT");
+        if (product_out == nullptr) {
+            return false;
+        }
+        *output_path = android::base::StringPrintf("%s%s", product_out, local_path);
+        return true;
+    } else {
+        *output_path = android::base::StringPrintf("%s%s", adb_dir, sdk_path);
+        return true;
+    }
+    return false;
+}
+
+static bool deploy_agent(bool checkTimeStamps, bool use_localagent, const char* adb_path) {
+    std::vector<const char*> srcs;
+
+    std::string agent_jar_path;
+    if (get_agent_component_host_path(use_localagent, adb_path, "/system/framework/deployagent.jar",
+                                      "/deployagent.jar", &agent_jar_path)) {
+        srcs.push_back(agent_jar_path.c_str());
+    } else {
+        return false;
+    }
+
+    std::string agent_sh_path;
+    if (get_agent_component_host_path(use_localagent, adb_path, "/system/bin/deployagent.sh",
+                                      "/deployagent.sh", &agent_sh_path)) {
+        srcs.push_back(agent_sh_path.c_str());
+    } else {
+        return false;
+    }
+
+    if (do_sync_push(srcs, kDeviceAgentPath, checkTimeStamps)) {
+        // on windows the shell script might have lost execute permission
+        // so need to set this explicitly
+        const char* kChmodCommandPattern = "chmod 777 %sdeployagent.sh";
+        std::string chmodCommand =
+                android::base::StringPrintf(kChmodCommandPattern, kDeviceAgentPath);
+        int ret = send_shell_command(chmodCommand);
+        return (ret == 0);
+    } else {
+        return false;
+    }
+}
+
+bool update_agent(FastDeploy_AgentUpdateStrategy agentUpdateStrategy, bool use_localagent,
+                  const char* adb_path) {
+    long agent_version = get_agent_version();
+    switch (agentUpdateStrategy) {
+        case FastDeploy_AgentUpdateAlways:
+            if (deploy_agent(false, use_localagent, adb_path) == false) {
+                return false;
+            }
+            break;
+        case FastDeploy_AgentUpdateNewerTimeStamp:
+            if (deploy_agent(true, use_localagent, adb_path) == false) {
+                return false;
+            }
+            break;
+        case FastDeploy_AgentUpdateDifferentVersion:
+            if (agent_version != kRequiredAgentVersion) {
+                if (agent_version < 0) {
+                    printf("Could not detect agent on device, deploying\n");
+                } else {
+                    printf("Device agent version is (%ld), (%ld) is required, re-deploying\n",
+                           agent_version, kRequiredAgentVersion);
+                }
+                if (deploy_agent(false, use_localagent, adb_path) == false) {
+                    return false;
+                }
+            }
+            break;
+    }
+
+    agent_version = get_agent_version();
+    return (agent_version == kRequiredAgentVersion);
+}
+
+static std::string get_string_from_utf16(const char16_t* input, int input_len) {
+    ssize_t utf8_length = utf16_to_utf8_length(input, input_len);
+    if (utf8_length <= 0) {
+        return {};
+    }
+
+    std::string utf8;
+    utf8.resize(utf8_length);
+    utf16_to_utf8(input, input_len, &*utf8.begin(), utf8_length + 1);
+    return utf8;
+}
+
+// output is required to point to a valid output string (non-null)
+static bool get_packagename_from_apk(const char* apkPath, std::string* output) {
+    using namespace android;
+
+    ZipFileRO* zipFile = ZipFileRO::open(apkPath);
+    if (zipFile == nullptr) {
+        return false;
+    }
+
+    ZipEntryRO entry = zipFile->findEntryByName("AndroidManifest.xml");
+    if (entry == nullptr) {
+        return false;
+    }
+
+    uint32_t manifest_len = 0;
+    if (!zipFile->getEntryInfo(entry, NULL, &manifest_len, NULL, NULL, NULL, NULL)) {
+        return false;
+    }
+
+    std::vector<char> manifest_data(manifest_len);
+    if (!zipFile->uncompressEntry(entry, manifest_data.data(), manifest_len)) {
+        return false;
+    }
+
+    ResXMLTree tree;
+    status_t setto_status = tree.setTo(manifest_data.data(), manifest_len, true);
+    if (setto_status != NO_ERROR) {
+        return false;
+    }
+
+    ResXMLParser::event_code_t code;
+    while ((code = tree.next()) != ResXMLParser::BAD_DOCUMENT &&
+           code != ResXMLParser::END_DOCUMENT) {
+        switch (code) {
+            case ResXMLParser::START_TAG: {
+                size_t element_name_length;
+                const char16_t* element_name = tree.getElementName(&element_name_length);
+                if (element_name == nullptr) {
+                    continue;
+                }
+
+                std::u16string element_name_string(element_name, element_name_length);
+                if (element_name_string == u"manifest") {
+                    for (int i = 0; i < (int)tree.getAttributeCount(); i++) {
+                        size_t attribute_name_length;
+                        const char16_t* attribute_name_text =
+                                tree.getAttributeName(i, &attribute_name_length);
+                        if (attribute_name_text == nullptr) {
+                            continue;
+                        }
+                        std::u16string attribute_name_string(attribute_name_text,
+                                                             attribute_name_length);
+
+                        if (attribute_name_string == u"package") {
+                            size_t attribute_value_length;
+                            const char16_t* attribute_value_text =
+                                    tree.getAttributeStringValue(i, &attribute_value_length);
+                            if (attribute_value_text == nullptr) {
+                                continue;
+                            }
+                            *output = get_string_from_utf16(attribute_value_text,
+                                                            attribute_value_length);
+                            return true;
+                        }
+                    }
+                }
+                break;
+            }
+            default:
+                break;
+        }
+    }
+
+    return false;
+}
+
+int extract_metadata(const char* apkPath, FILE* outputFp) {
+    std::string packageName;
+    if (get_packagename_from_apk(apkPath, &packageName) == false) {
+        return -1;
+    }
+
+    const char* kAgentExtractCommandPattern = "/data/local/tmp/deployagent.sh extract %s";
+    std::string extractCommand =
+            android::base::StringPrintf(kAgentExtractCommandPattern, packageName.c_str());
+
+    std::vector<char> extractErrorBuffer;
+    int statusCode;
+    DeployAgentFileCallback cb(outputFp, &extractErrorBuffer, &statusCode);
+    int ret = send_shell_command(extractCommand, false, &cb);
+
+    if (ret == 0) {
+        return cb.getBytesWritten();
+    }
+
+    return ret;
+}
+
+// output is required to point to a valid output string (non-null)
+static bool patch_generator_command(bool use_localagent, const char* adb_path,
+                                    std::string* output) {
+    if (use_localagent) {
+        // This should never happen on a Windows machine
+        const char* kGeneratorCommandPattern = "java -jar %s/framework/deploypatchgenerator.jar";
+        const char* host_out = getenv("ANDROID_HOST_OUT");
+        if (host_out == nullptr) {
+            return false;
+        }
+        *output = android::base::StringPrintf(kGeneratorCommandPattern, host_out, host_out);
+        return true;
+    } else {
+        const char* kGeneratorCommandPattern = R"(java -jar "%s/deploypatchgenerator.jar")";
+        std::string mutable_adb_path = adb_path;
+        const char* adb_dir = dirname(&mutable_adb_path[0]);
+        if (adb_dir == nullptr) {
+            return false;
+        }
+
+        *output = android::base::StringPrintf(kGeneratorCommandPattern, adb_dir, adb_dir);
+        return true;
+    }
+    return false;
+}
+
+int create_patch(const char* apkPath, const char* metadataPath, const char* patchPath,
+                 bool use_localagent, const char* adb_path) {
+    const char* kGeneratePatchCommandPattern = R"(%s "%s" "%s" > "%s")";
+    std::string patch_generator_command_string;
+    if (patch_generator_command(use_localagent, adb_path, &patch_generator_command_string) ==
+        false) {
+        return 1;
+    }
+    std::string generatePatchCommand = android::base::StringPrintf(
+            kGeneratePatchCommandPattern, patch_generator_command_string.c_str(), apkPath,
+            metadataPath, patchPath);
+    return system(generatePatchCommand.c_str());
+}
+
+std::string get_patch_path(const char* apkPath) {
+    std::string packageName;
+    if (get_packagename_from_apk(apkPath, &packageName) == false) {
+        return "";
+    }
+    std::string patchDevicePath =
+            android::base::StringPrintf("%s%s.patch", kDeviceAgentPath, packageName.c_str());
+    return patchDevicePath;
+}
+
+int apply_patch_on_device(const char* apkPath, const char* patchPath, const char* outputPath) {
+    const std::string kAgentApplyCommandPattern =
+            "/data/local/tmp/deployagent.sh apply %s %s -o %s";
+
+    std::string packageName;
+    if (get_packagename_from_apk(apkPath, &packageName) == false) {
+        return -1;
+    }
+    std::string patchDevicePath = get_patch_path(apkPath);
+
+    std::vector<const char*> srcs = {patchPath};
+    bool push_ok = do_sync_push(srcs, patchDevicePath.c_str(), false);
+
+    if (!push_ok) {
+        return -1;
+    }
+
+    std::string applyPatchCommand =
+            android::base::StringPrintf(kAgentApplyCommandPattern.c_str(), packageName.c_str(),
+                                        patchDevicePath.c_str(), outputPath);
+    return send_shell_command(applyPatchCommand);
+}
+
+int install_patch(const char* apkPath, const char* patchPath, int argc, const char** argv) {
+    const std::string kAgentApplyCommandPattern =
+            "/data/local/tmp/deployagent.sh apply %s %s -pm %s";
+
+    std::string packageName;
+    if (get_packagename_from_apk(apkPath, &packageName) == false) {
+        return -1;
+    }
+
+    std::vector<const char*> srcs;
+    std::string patchDevicePath =
+            android::base::StringPrintf("%s%s.patch", kDeviceAgentPath, packageName.c_str());
+    srcs.push_back(patchPath);
+    bool push_ok = do_sync_push(srcs, patchDevicePath.c_str(), false);
+
+    if (!push_ok) {
+        return -1;
+    }
+
+    std::vector<unsigned char> applyOutputBuffer;
+    std::vector<unsigned char> applyErrorBuffer;
+    std::string argsString;
+
+    for (int i = 0; i < argc; i++) {
+        argsString.append(argv[i]);
+        argsString.append(" ");
+    }
+
+    std::string applyPatchCommand =
+            android::base::StringPrintf(kAgentApplyCommandPattern.c_str(), packageName.c_str(),
+                                        patchDevicePath.c_str(), argsString.c_str());
+    return send_shell_command(applyPatchCommand);
+}
diff --git a/adb/client/fastdeploy.h b/adb/client/fastdeploy.h
new file mode 100644
index 0000000..d8acd30
--- /dev/null
+++ b/adb/client/fastdeploy.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "adb.h"
+
+typedef enum EFastDeploy_AgentUpdateStrategy {
+    FastDeploy_AgentUpdateAlways,
+    FastDeploy_AgentUpdateNewerTimeStamp,
+    FastDeploy_AgentUpdateDifferentVersion
+} FastDeploy_AgentUpdateStrategy;
+
+static constexpr int kFastDeployMinApi = 24;
+
+int get_device_api_level();
+bool update_agent(FastDeploy_AgentUpdateStrategy agentUpdateStrategy, bool use_localagent,
+                  const char* adb_path);
+int extract_metadata(const char* apkPath, FILE* outputFp);
+int create_patch(const char* apkPath, const char* metadataPath, const char* patchPath,
+                 bool use_localagent, const char* adb_path);
+int apply_patch_on_device(const char* apkPath, const char* patchPath, const char* outputPath);
+int install_patch(const char* apkPath, const char* patchPath, int argc, const char** argv);
+std::string get_patch_path(const char* apkPath);
diff --git a/adb/client/fastdeploycallbacks.cpp b/adb/client/fastdeploycallbacks.cpp
new file mode 100644
index 0000000..6c9a21f
--- /dev/null
+++ b/adb/client/fastdeploycallbacks.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define TRACE_TAG ADB
+
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/stat.h>
+
+#include "client/file_sync_client.h"
+#include "commandline.h"
+#include "sysdeps.h"
+
+#include "fastdeploycallbacks.h"
+
+static void appendBuffer(std::vector<char>* buffer, const char* input, int length) {
+    if (buffer != NULL) {
+        buffer->insert(buffer->end(), input, input + length);
+    }
+}
+
+class DeployAgentBufferCallback : public StandardStreamsCallbackInterface {
+  public:
+    DeployAgentBufferCallback(std::vector<char>* outBuffer, std::vector<char>* errBuffer,
+                              int* statusCode);
+
+    virtual void OnStdout(const char* buffer, int length);
+    virtual void OnStderr(const char* buffer, int length);
+    virtual int Done(int status);
+
+  private:
+    std::vector<char>* mpOutBuffer;
+    std::vector<char>* mpErrBuffer;
+    int* mpStatusCode;
+};
+
+int capture_shell_command(const char* command, std::vector<char>* outBuffer,
+                          std::vector<char>* errBuffer) {
+    int statusCode;
+    DeployAgentBufferCallback cb(outBuffer, errBuffer, &statusCode);
+    int ret = send_shell_command(command, false, &cb);
+
+    if (ret == 0) {
+        return statusCode;
+    } else {
+        return ret;
+    }
+}
+
+DeployAgentFileCallback::DeployAgentFileCallback(FILE* outputFile, std::vector<char>* errBuffer,
+                                                 int* statusCode) {
+    mpOutFile = outputFile;
+    mpErrBuffer = errBuffer;
+    mpStatusCode = statusCode;
+    mBytesWritten = 0;
+}
+
+void DeployAgentFileCallback::OnStdout(const char* buffer, int length) {
+    if (mpOutFile != NULL) {
+        int bytes_written = fwrite(buffer, 1, length, mpOutFile);
+        if (bytes_written != length) {
+            printf("Write error %d\n", bytes_written);
+        }
+        mBytesWritten += bytes_written;
+    }
+}
+
+void DeployAgentFileCallback::OnStderr(const char* buffer, int length) {
+    appendBuffer(mpErrBuffer, buffer, length);
+}
+
+int DeployAgentFileCallback::Done(int status) {
+    if (mpStatusCode != NULL) {
+        *mpStatusCode = status;
+    }
+    return 0;
+}
+
+int DeployAgentFileCallback::getBytesWritten() {
+    return mBytesWritten;
+}
+
+DeployAgentBufferCallback::DeployAgentBufferCallback(std::vector<char>* outBuffer,
+                                                     std::vector<char>* errBuffer,
+                                                     int* statusCode) {
+    mpOutBuffer = outBuffer;
+    mpErrBuffer = errBuffer;
+    mpStatusCode = statusCode;
+}
+
+void DeployAgentBufferCallback::OnStdout(const char* buffer, int length) {
+    appendBuffer(mpOutBuffer, buffer, length);
+}
+
+void DeployAgentBufferCallback::OnStderr(const char* buffer, int length) {
+    appendBuffer(mpErrBuffer, buffer, length);
+}
+
+int DeployAgentBufferCallback::Done(int status) {
+    if (mpStatusCode != NULL) {
+        *mpStatusCode = status;
+    }
+    return 0;
+}
diff --git a/adb/client/fastdeploycallbacks.h b/adb/client/fastdeploycallbacks.h
new file mode 100644
index 0000000..b428b50
--- /dev/null
+++ b/adb/client/fastdeploycallbacks.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <vector>
+#include "commandline.h"
+
+class DeployAgentFileCallback : public StandardStreamsCallbackInterface {
+  public:
+    DeployAgentFileCallback(FILE* outputFile, std::vector<char>* errBuffer, int* statusCode);
+
+    virtual void OnStdout(const char* buffer, int length);
+    virtual void OnStderr(const char* buffer, int length);
+    virtual int Done(int status);
+
+    int getBytesWritten();
+
+  private:
+    FILE* mpOutFile;
+    std::vector<char>* mpErrBuffer;
+    int mBytesWritten;
+    int* mpStatusCode;
+};
+
+int capture_shell_command(const char* command, std::vector<char>* outBuffer,
+                          std::vector<char>* errBuffer);
diff --git a/adb/client/line_printer.cpp b/adb/client/line_printer.cpp
index 9758526..4dc2d28 100644
--- a/adb/client/line_printer.cpp
+++ b/adb/client/line_printer.cpp
@@ -67,7 +67,11 @@
 
 void LinePrinter::Print(string to_print, LineType type) {
   if (!smart_terminal_) {
-    Out(to_print + "\n");
+    if (type == LineType::INFO) {
+        info_line_ = to_print + "\n";
+    } else {
+        Out(to_print + "\n");
+    }
     return;
   }
 
@@ -123,6 +127,11 @@
 }
 
 void LinePrinter::KeepInfoLine() {
-  if (!have_blank_line_) Out("\n");
-  have_blank_line_ = true;
+  if (smart_terminal_) {
+      if (!have_blank_line_) Out("\n");
+      have_blank_line_ = true;
+  } else {
+      Out(info_line_);
+      info_line_.clear();
+  }
 }
diff --git a/adb/client/line_printer.h b/adb/client/line_printer.h
index 42345e2..4c4c7c6 100644
--- a/adb/client/line_printer.h
+++ b/adb/client/line_printer.h
@@ -42,6 +42,9 @@
   /// Whether the caret is at the beginning of a blank line.
   bool have_blank_line_;
 
+  /// The last printed info line when printing to a dumb terminal.
+  std::string info_line_;
+
 #ifdef _WIN32
   void* console_;
 #endif
diff --git a/adb/client/usb_windows.cpp b/adb/client/usb_windows.cpp
index e928377..00aeb9b 100644
--- a/adb/client/usb_windows.cpp
+++ b/adb/client/usb_windows.cpp
@@ -357,7 +357,8 @@
 
     if (handle->zero_mask && (len & handle->zero_mask) == 0) {
         // Send a zero length packet
-        if (!AdbWriteEndpointSync(handle->adb_write_pipe, (void*)data, 0, &written, time_out)) {
+        unsigned long dummy;
+        if (!AdbWriteEndpointSync(handle->adb_write_pipe, (void*)data, 0, &dummy, time_out)) {
             D("AdbWriteEndpointSync of zero length packet failed: %s",
               android::base::SystemErrorCodeToString(GetLastError()).c_str());
             err = EIO;
diff --git a/adb/daemon/include/adbd/usb.h b/adb/daemon/include/adbd/usb.h
index 7905d9d..78e4cd5 100644
--- a/adb/daemon/include/adbd/usb.h
+++ b/adb/daemon/include/adbd/usb.h
@@ -21,6 +21,7 @@
 #include <mutex>
 #include <vector>
 
+#include <android-base/unique_fd.h>
 #include <asyncio/AsyncIO.h>
 
 struct aio_block {
@@ -47,11 +48,11 @@
     void (*close)(usb_handle* h);
 
     // FunctionFS
-    int control = -1;
-    int bulk_out = -1; /* "out" from the host's perspective => source for adbd */
-    int bulk_in = -1;  /* "in" from the host's perspective => sink for adbd */
+    android::base::unique_fd control;
+    android::base::unique_fd bulk_out;  // "out" from the host's perspective => source for adbd
+    android::base::unique_fd bulk_in;   // "in" from the host's perspective => sink for adbd
 
-    // Access to these blocks is very not thread safe. Have one block for both the
+    // Access to these blocks is very not thread safe. Have one block for each of the
     // read and write threads.
     struct aio_block read_aiob;
     struct aio_block write_aiob;
diff --git a/adb/daemon/usb.cpp b/adb/daemon/usb.cpp
index c79d6fc..9d495b0 100644
--- a/adb/daemon/usb.cpp
+++ b/adb/daemon/usb.cpp
@@ -58,7 +58,7 @@
 #define cpu_to_le16(x) htole16(x)
 #define cpu_to_le32(x) htole32(x)
 
-static int dummy_fd = -1;
+static unique_fd& dummy_fd = *new unique_fd();
 
 struct func_desc {
     struct usb_interface_descriptor intf;
@@ -273,13 +273,13 @@
 
     if (h->control < 0) { // might have already done this before
         LOG(INFO) << "opening control endpoint " << USB_FFS_ADB_EP0;
-        h->control = adb_open(USB_FFS_ADB_EP0, O_WRONLY);
+        h->control.reset(adb_open(USB_FFS_ADB_EP0, O_WRONLY));
         if (h->control < 0) {
             PLOG(ERROR) << "cannot open control endpoint " << USB_FFS_ADB_EP0;
             goto err;
         }
 
-        ret = adb_write(h->control, &v2_descriptor, sizeof(v2_descriptor));
+        ret = adb_write(h->control.get(), &v2_descriptor, sizeof(v2_descriptor));
         if (ret < 0) {
             v1_descriptor.header.magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC);
             v1_descriptor.header.length = cpu_to_le32(sizeof(v1_descriptor));
@@ -288,14 +288,14 @@
             v1_descriptor.fs_descs = fs_descriptors;
             v1_descriptor.hs_descs = hs_descriptors;
             D("[ %s: Switching to V1_descriptor format errno=%d ]", USB_FFS_ADB_EP0, errno);
-            ret = adb_write(h->control, &v1_descriptor, sizeof(v1_descriptor));
+            ret = adb_write(h->control.get(), &v1_descriptor, sizeof(v1_descriptor));
             if (ret < 0) {
                 D("[ %s: write descriptors failed: errno=%d ]", USB_FFS_ADB_EP0, errno);
                 goto err;
             }
         }
 
-        ret = adb_write(h->control, &strings, sizeof(strings));
+        ret = adb_write(h->control.get(), &strings, sizeof(strings));
         if (ret < 0) {
             D("[ %s: writing strings failed: errno=%d]", USB_FFS_ADB_EP0, errno);
             goto err;
@@ -304,13 +304,13 @@
         android::base::SetProperty("sys.usb.ffs.ready", "1");
     }
 
-    h->bulk_out = adb_open(USB_FFS_ADB_OUT, O_RDONLY);
+    h->bulk_out.reset(adb_open(USB_FFS_ADB_OUT, O_RDONLY));
     if (h->bulk_out < 0) {
         PLOG(ERROR) << "cannot open bulk-out endpoint " << USB_FFS_ADB_OUT;
         goto err;
     }
 
-    h->bulk_in = adb_open(USB_FFS_ADB_IN, O_WRONLY);
+    h->bulk_in.reset(adb_open(USB_FFS_ADB_IN, O_WRONLY));
     if (h->bulk_in < 0) {
         PLOG(ERROR) << "cannot open bulk-in endpoint " << USB_FFS_ADB_IN;
         goto err;
@@ -322,18 +322,9 @@
     return true;
 
 err:
-    if (h->bulk_in > 0) {
-        adb_close(h->bulk_in);
-        h->bulk_in = -1;
-    }
-    if (h->bulk_out > 0) {
-        adb_close(h->bulk_out);
-        h->bulk_out = -1;
-    }
-    if (h->control > 0) {
-        adb_close(h->control);
-        h->control = -1;
-    }
+    h->bulk_in.reset();
+    h->bulk_out.reset();
+    h->control.reset();
     return false;
 }
 
@@ -366,7 +357,7 @@
 }
 
 static int usb_ffs_write(usb_handle* h, const void* data, int len) {
-    D("about to write (fd=%d, len=%d)", h->bulk_in, len);
+    D("about to write (fd=%d, len=%d)", h->bulk_in.get(), len);
 
     const char* buf = static_cast<const char*>(data);
     int orig_len = len;
@@ -374,19 +365,19 @@
         int write_len = std::min(USB_FFS_BULK_SIZE, len);
         int n = adb_write(h->bulk_in, buf, write_len);
         if (n < 0) {
-            D("ERROR: fd = %d, n = %d: %s", h->bulk_in, n, strerror(errno));
+            D("ERROR: fd = %d, n = %d: %s", h->bulk_in.get(), n, strerror(errno));
             return -1;
         }
         buf += n;
         len -= n;
     }
 
-    D("[ done fd=%d ]", h->bulk_in);
+    D("[ done fd=%d ]", h->bulk_in.get());
     return orig_len;
 }
 
 static int usb_ffs_read(usb_handle* h, void* data, int len) {
-    D("about to read (fd=%d, len=%d)", h->bulk_out, len);
+    D("about to read (fd=%d, len=%d)", h->bulk_out.get(), len);
 
     char* buf = static_cast<char*>(data);
     int orig_len = len;
@@ -394,14 +385,14 @@
         int read_len = std::min(USB_FFS_BULK_SIZE, len);
         int n = adb_read(h->bulk_out, buf, read_len);
         if (n < 0) {
-            D("ERROR: fd = %d, n = %d: %s", h->bulk_out, n, strerror(errno));
+            D("ERROR: fd = %d, n = %d: %s", h->bulk_out.get(), n, strerror(errno));
             return -1;
         }
         buf += n;
         len -= n;
     }
 
-    D("[ done fd=%d ]", h->bulk_out);
+    D("[ done fd=%d ]", h->bulk_out.get());
     return orig_len;
 }
 
@@ -475,14 +466,14 @@
 static void usb_ffs_kick(usb_handle* h) {
     int err;
 
-    err = ioctl(h->bulk_in, FUNCTIONFS_CLEAR_HALT);
+    err = ioctl(h->bulk_in.get(), FUNCTIONFS_CLEAR_HALT);
     if (err < 0) {
-        D("[ kick: source (fd=%d) clear halt failed (%d) ]", h->bulk_in, errno);
+        D("[ kick: source (fd=%d) clear halt failed (%d) ]", h->bulk_in.get(), errno);
     }
 
-    err = ioctl(h->bulk_out, FUNCTIONFS_CLEAR_HALT);
+    err = ioctl(h->bulk_out.get(), FUNCTIONFS_CLEAR_HALT);
     if (err < 0) {
-        D("[ kick: sink (fd=%d) clear halt failed (%d) ]", h->bulk_out, errno);
+        D("[ kick: sink (fd=%d) clear halt failed (%d) ]", h->bulk_out.get(), errno);
     }
 
     // don't close ep0 here, since we may not need to reinitialize it with
@@ -490,16 +481,16 @@
     // init_functionfs, only then would we close and open ep0 again.
     // Ditto the comment in usb_adb_kick.
     h->kicked = true;
-    TEMP_FAILURE_RETRY(dup2(dummy_fd, h->bulk_out));
-    TEMP_FAILURE_RETRY(dup2(dummy_fd, h->bulk_in));
+    TEMP_FAILURE_RETRY(dup2(dummy_fd.get(), h->bulk_out.get()));
+    TEMP_FAILURE_RETRY(dup2(dummy_fd.get(), h->bulk_in.get()));
 }
 
 static void usb_ffs_close(usb_handle* h) {
     LOG(INFO) << "closing functionfs transport";
 
     h->kicked = false;
-    adb_close(h->bulk_out);
-    adb_close(h->bulk_in);
+    h->bulk_out.reset();
+    h->bulk_in.reset();
 
     // Notify usb_adb_open_thread to open a new connection.
     h->lock.lock();
@@ -530,8 +521,8 @@
 
 void usb_init() {
     D("[ usb_init - using FunctionFS ]");
-    dummy_fd = adb_open("/dev/null", O_WRONLY);
-    CHECK_NE(dummy_fd, -1);
+    dummy_fd.reset(adb_open("/dev/null", O_WRONLY | O_CLOEXEC));
+    CHECK_NE(-1, dummy_fd.get());
 
     std::thread(usb_ffs_open_thread, create_usb_handle(USB_FFS_NUM_BUFS, USB_FFS_BULK_SIZE)).detach();
 }
diff --git a/adb/fastdeploy/Android.bp b/adb/fastdeploy/Android.bp
new file mode 100644
index 0000000..30f4730
--- /dev/null
+++ b/adb/fastdeploy/Android.bp
@@ -0,0 +1,43 @@
+//
+// Copyright (C) 2018 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+java_library {
+    name: "deployagent",
+    sdk_version: "24",
+    srcs: ["deployagent/src/**/*.java", "deploylib/src/**/*.java", "proto/**/*.proto"],
+    static_libs: ["apkzlib_zip"],
+    proto: {
+        type: "lite",
+    }
+}
+
+cc_prebuilt_binary {
+    name: "deployagent.sh",
+
+    srcs: ["deployagent/deployagent.sh"],
+    required: ["deployagent"],
+    device_supported: true,
+}
+
+java_binary_host {
+    name: "deploypatchgenerator",
+    srcs: ["deploypatchgenerator/src/**/*.java", "deploylib/src/**/*.java", "proto/**/*.proto"],
+    static_libs: ["apkzlib"],
+    manifest: "deploypatchgenerator/manifest.txt",
+    proto: {
+        type: "full",
+    }
+}
diff --git a/adb/fastdeploy/deployagent/deployagent.sh b/adb/fastdeploy/deployagent/deployagent.sh
new file mode 100755
index 0000000..4f17eb7
--- /dev/null
+++ b/adb/fastdeploy/deployagent/deployagent.sh
@@ -0,0 +1,7 @@
+# Script to start "deployagent" on the device, which has a very rudimentary
+# shell.
+#
+base=/data/local/tmp
+export CLASSPATH=$base/deployagent.jar
+exec app_process $base com.android.fastdeploy.DeployAgent "$@"
+
diff --git a/adb/fastdeploy/deployagent/src/com/android/fastdeploy/DeployAgent.java b/adb/fastdeploy/deployagent/src/com/android/fastdeploy/DeployAgent.java
new file mode 100644
index 0000000..cd6f168
--- /dev/null
+++ b/adb/fastdeploy/deployagent/src/com/android/fastdeploy/DeployAgent.java
@@ -0,0 +1,295 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.fastdeploy;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.util.concurrent.SynchronousQueue;
+import java.util.concurrent.TimeUnit;
+import java.io.OutputStream;
+import java.io.RandomAccessFile;
+import java.util.Set;
+
+import com.android.fastdeploy.APKMetaData;
+import com.android.fastdeploy.PatchUtils;
+
+public final class DeployAgent {
+    private static final int BUFFER_SIZE = 128 * 1024;
+    private static final int AGENT_VERSION = 0x00000001;
+
+    public static void main(String[] args) {
+        int exitCode = 0;
+        try {
+            if (args.length < 1) {
+                showUsage(0);
+            }
+
+            String commandString = args[0];
+
+            if (commandString.equals("extract")) {
+                if (args.length != 2) {
+                    showUsage(1);
+                }
+
+                String packageName = args[1];
+                extractMetaData(packageName);
+            } else if (commandString.equals("apply")) {
+                if (args.length < 4) {
+                    showUsage(1);
+                }
+
+                String packageName = args[1];
+                String patchPath = args[2];
+                String outputParam = args[3];
+
+                InputStream deltaInputStream = null;
+                if (patchPath.compareTo("-") == 0) {
+                    deltaInputStream = System.in;
+                } else {
+                    deltaInputStream = new FileInputStream(patchPath);
+                }
+
+                if (outputParam.equals("-o")) {
+                    OutputStream outputStream = null;
+                    if (args.length > 4) {
+                        String outputPath = args[4];
+                        if (!outputPath.equals("-")) {
+                            outputStream = new FileOutputStream(outputPath);
+                        }
+                    }
+                    if (outputStream == null) {
+                        outputStream = System.out;
+                    }
+                    File deviceFile = getFileFromPackageName(packageName);
+                    writePatchToStream(
+                            new RandomAccessFile(deviceFile, "r"), deltaInputStream, outputStream);
+                } else if (outputParam.equals("-pm")) {
+                    String[] sessionArgs = null;
+                    if (args.length > 4) {
+                        int numSessionArgs = args.length-4;
+                        sessionArgs = new String[numSessionArgs];
+                        for (int i=0 ; i<numSessionArgs ; i++) {
+                            sessionArgs[i] = args[i+4];
+                        }
+                    }
+                    exitCode = applyPatch(packageName, deltaInputStream, sessionArgs);
+                }
+            } else if (commandString.equals("version")) {
+                System.out.printf("0x%08X\n", AGENT_VERSION);
+            } else {
+                showUsage(1);
+            }
+        } catch (Exception e) {
+            System.err.println("Error: " + e);
+            e.printStackTrace();
+            System.exit(2);
+        }
+        System.exit(exitCode);
+    }
+
+    private static void showUsage(int exitCode) {
+        System.err.println(
+            "usage: deployagent <command> [<args>]\n\n" +
+            "commands:\n" +
+            "version                             get the version\n" +
+            "extract PKGNAME                     extract an installed package's metadata\n" +
+            "apply PKGNAME PATCHFILE [-o|-pm]    apply a patch from PATCHFILE (- for stdin) to an installed package\n" +
+            " -o <FILE> directs output to FILE, default or - for stdout\n" +
+            " -pm <ARGS> directs output to package manager, passes <ARGS> to 'pm install-create'\n"
+            );
+
+        System.exit(exitCode);
+    }
+
+    private static Process executeCommand(String command) throws IOException {
+        try {
+            Process p;
+            p = Runtime.getRuntime().exec(command);
+            p.waitFor();
+            return p;
+        } catch (InterruptedException e) {
+            e.printStackTrace();
+        }
+
+        return null;
+    }
+
+    private static File getFileFromPackageName(String packageName) throws IOException {
+        StringBuilder commandBuilder = new StringBuilder();
+        commandBuilder.append("pm list packages -f " + packageName);
+
+        Process p = executeCommand(commandBuilder.toString());
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+
+        String packagePrefix = "package:";
+        String line = "";
+        while ((line = reader.readLine()) != null) {
+            int packageIndex = line.indexOf(packagePrefix);
+            int equalsIndex = line.indexOf("=" + packageName);
+            return new File(line.substring(packageIndex + packagePrefix.length(), equalsIndex));
+        }
+
+        return null;
+    }
+
+    private static void extractMetaData(String packageName) throws IOException {
+        File apkFile = getFileFromPackageName(packageName);
+        APKMetaData apkMetaData = PatchUtils.getAPKMetaData(apkFile);
+        apkMetaData.writeDelimitedTo(System.out);
+    }
+
+    private static int createInstallSession(String[] args) throws IOException {
+        StringBuilder commandBuilder = new StringBuilder();
+        commandBuilder.append("pm install-create ");
+        for (int i=0 ; args != null && i<args.length ; i++) {
+            commandBuilder.append(args[i] + " ");
+        }
+
+        Process p = executeCommand(commandBuilder.toString());
+
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        String line = "";
+        String successLineStart = "Success: created install session [";
+        String successLineEnd = "]";
+        while ((line = reader.readLine()) != null) {
+            if (line.startsWith(successLineStart) && line.endsWith(successLineEnd)) {
+                return Integer.parseInt(line.substring(successLineStart.length(), line.lastIndexOf(successLineEnd)));
+            }
+        }
+
+        return -1;
+    }
+
+    private static int commitInstallSession(int sessionId) throws IOException {
+        StringBuilder commandBuilder = new StringBuilder();
+        commandBuilder.append(String.format("pm install-commit %d -- - ", sessionId));
+        Process p = executeCommand(commandBuilder.toString());
+        return p.exitValue();
+    }
+
+    private static int applyPatch(String packageName, InputStream deltaStream, String[] sessionArgs)
+            throws IOException, PatchFormatException {
+        File deviceFile = getFileFromPackageName(packageName);
+        int sessionId = createInstallSession(sessionArgs);
+        if (sessionId < 0) {
+            System.err.println("PM Create Session Failed");
+            return -1;
+        }
+
+        int writeExitCode = writePatchedDataToSession(new RandomAccessFile(deviceFile, "r"), deltaStream, sessionId);
+
+        if (writeExitCode == 0) {
+            return commitInstallSession(sessionId);
+        } else {
+            return -1;
+        }
+    }
+
+    private static long writePatchToStream(RandomAccessFile oldData, InputStream patchData,
+        OutputStream outputStream) throws IOException, PatchFormatException {
+        long newSize = readPatchHeader(patchData);
+        long bytesWritten = writePatchedDataToStream(oldData, newSize, patchData, outputStream);
+        outputStream.flush();
+        if (bytesWritten != newSize) {
+            throw new PatchFormatException(String.format(
+                "output size mismatch (expected %ld but wrote %ld)", newSize, bytesWritten));
+        }
+        return bytesWritten;
+    }
+
+    private static long readPatchHeader(InputStream patchData)
+        throws IOException, PatchFormatException {
+        byte[] signatureBuffer = new byte[PatchUtils.SIGNATURE.length()];
+        try {
+            PatchUtils.readFully(patchData, signatureBuffer, 0, signatureBuffer.length);
+        } catch (IOException e) {
+            throw new PatchFormatException("truncated signature");
+        }
+
+        String signature = new String(signatureBuffer, 0, signatureBuffer.length, "US-ASCII");
+        if (!PatchUtils.SIGNATURE.equals(signature)) {
+            throw new PatchFormatException("bad signature");
+        }
+
+        long newSize = PatchUtils.readBsdiffLong(patchData);
+        if (newSize < 0 || newSize > Integer.MAX_VALUE) {
+            throw new PatchFormatException("bad newSize");
+        }
+
+        return newSize;
+    }
+
+    // Note that this function assumes patchData has been seek'ed to the start of the delta stream
+    // (i.e. the signature has already been read by readPatchHeader). For a stream that points to the
+    // start of a patch file call writePatchToStream
+    private static long writePatchedDataToStream(RandomAccessFile oldData, long newSize,
+        InputStream patchData, OutputStream outputStream) throws IOException {
+        long newDataBytesWritten = 0;
+        byte[] buffer = new byte[BUFFER_SIZE];
+
+        while (newDataBytesWritten < newSize) {
+            long copyLen = PatchUtils.readFormattedLong(patchData);
+            if (copyLen > 0) {
+                PatchUtils.pipe(patchData, outputStream, buffer, (int) copyLen);
+            }
+
+            long oldDataOffset = PatchUtils.readFormattedLong(patchData);
+            long oldDataLen = PatchUtils.readFormattedLong(patchData);
+            oldData.seek(oldDataOffset);
+            if (oldDataLen > 0) {
+                PatchUtils.pipe(oldData, outputStream, buffer, (int) oldDataLen);
+            }
+
+            newDataBytesWritten += copyLen + oldDataLen;
+        }
+
+        return newDataBytesWritten;
+    }
+
+    private static int writePatchedDataToSession(RandomAccessFile oldData, InputStream patchData, int sessionId)
+            throws IOException, PatchFormatException {
+        try {
+            Process p;
+            long newSize = readPatchHeader(patchData);
+            StringBuilder commandBuilder = new StringBuilder();
+            commandBuilder.append(String.format("pm install-write -S %d %d -- -", newSize, sessionId));
+
+            String command = commandBuilder.toString();
+            p = Runtime.getRuntime().exec(command);
+
+            OutputStream sessionOutputStream = p.getOutputStream();
+            long bytesWritten = writePatchedDataToStream(oldData, newSize, patchData, sessionOutputStream);
+            sessionOutputStream.flush();
+            p.waitFor();
+            if (bytesWritten != newSize) {
+                throw new PatchFormatException(
+                        String.format("output size mismatch (expected %d but wrote %)", newSize, bytesWritten));
+            }
+            return p.exitValue();
+        } catch (InterruptedException e) {
+            e.printStackTrace();
+        }
+
+        return -1;
+    }
+}
diff --git a/adb/fastdeploy/deploylib/src/com/android/fastdeploy/PatchFormatException.java b/adb/fastdeploy/deploylib/src/com/android/fastdeploy/PatchFormatException.java
new file mode 100644
index 0000000..f0655f3
--- /dev/null
+++ b/adb/fastdeploy/deploylib/src/com/android/fastdeploy/PatchFormatException.java
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.fastdeploy;
+
+class PatchFormatException extends Exception {
+    /**
+     * Constructs a new exception with the specified message.
+     * @param message the message
+     */
+    public PatchFormatException(String message) { super(message); }
+
+    /**
+     * Constructs a new exception with the specified message and cause.
+     * @param message the message
+     * @param cause the cause of the error
+     */
+    public PatchFormatException(String message, Throwable cause) {
+        super(message);
+        initCause(cause);
+    }
+}
diff --git a/adb/fastdeploy/deploylib/src/com/android/fastdeploy/PatchUtils.java b/adb/fastdeploy/deploylib/src/com/android/fastdeploy/PatchUtils.java
new file mode 100644
index 0000000..f0f00e1
--- /dev/null
+++ b/adb/fastdeploy/deploylib/src/com/android/fastdeploy/PatchUtils.java
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.fastdeploy;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.RandomAccessFile;
+import java.util.Arrays;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+
+import com.android.tools.build.apkzlib.zip.ZFile;
+import com.android.tools.build.apkzlib.zip.ZFileOptions;
+import com.android.tools.build.apkzlib.zip.StoredEntry;
+import com.android.tools.build.apkzlib.zip.StoredEntryType;
+import com.android.tools.build.apkzlib.zip.CentralDirectoryHeaderCompressInfo;
+import com.android.tools.build.apkzlib.zip.CentralDirectoryHeader;
+
+import com.android.fastdeploy.APKMetaData;
+import com.android.fastdeploy.APKEntry;
+
+class PatchUtils {
+    private static final long NEGATIVE_MASK = 1L << 63;
+    private static final long NEGATIVE_LONG_SIGN_MASK = 1L << 63;
+    public static final String SIGNATURE = "HAMADI/IHD";
+
+    private static long getOffsetFromEntry(StoredEntry entry) {
+        return entry.getCentralDirectoryHeader().getOffset() + entry.getLocalHeaderSize();
+    }
+
+    public static APKMetaData getAPKMetaData(File apkFile) throws IOException {
+        APKMetaData.Builder apkEntriesBuilder = APKMetaData.newBuilder();
+        ZFileOptions options = new ZFileOptions();
+        ZFile zFile = new ZFile(apkFile, options);
+
+        ArrayList<StoredEntry> metaDataEntries = new ArrayList<StoredEntry>();
+
+        for (StoredEntry entry : zFile.entries()) {
+            if (entry.getType() != StoredEntryType.FILE) {
+                continue;
+            }
+            metaDataEntries.add(entry);
+        }
+
+        Collections.sort(metaDataEntries, new Comparator<StoredEntry>() {
+            private long getOffsetFromEntry(StoredEntry entry) {
+                return PatchUtils.getOffsetFromEntry(entry);
+            }
+
+            @Override
+            public int compare(StoredEntry lhs, StoredEntry rhs) {
+                // -1 - less than, 1 - greater than, 0 - equal, all inversed for descending
+                return Long.compare(getOffsetFromEntry(lhs), getOffsetFromEntry(rhs));
+            }
+        });
+
+        for (StoredEntry entry : metaDataEntries) {
+            CentralDirectoryHeader cdh = entry.getCentralDirectoryHeader();
+            CentralDirectoryHeaderCompressInfo cdhci = cdh.getCompressionInfoWithWait();
+
+            APKEntry.Builder entryBuilder = APKEntry.newBuilder();
+            entryBuilder.setCrc32(cdh.getCrc32());
+            entryBuilder.setFileName(cdh.getName());
+            entryBuilder.setCompressedSize(cdhci.getCompressedSize());
+            entryBuilder.setUncompressedSize(cdh.getUncompressedSize());
+            entryBuilder.setDataOffset(getOffsetFromEntry(entry));
+
+            apkEntriesBuilder.addEntries(entryBuilder);
+            apkEntriesBuilder.build();
+        }
+        return apkEntriesBuilder.build();
+    }
+
+    /**
+     * Writes a 64-bit signed integer to the specified {@link OutputStream}. The least significant
+     * byte is written first and the most significant byte is written last.
+     * @param value the value to write
+     * @param outputStream the stream to write to
+     */
+    static void writeFormattedLong(final long value, OutputStream outputStream) throws IOException {
+        long y = value;
+        if (y < 0) {
+            y = (-y) | NEGATIVE_MASK;
+        }
+
+        for (int i = 0; i < 8; ++i) {
+            outputStream.write((byte) (y & 0xff));
+            y >>>= 8;
+        }
+    }
+
+    /**
+     * Reads a 64-bit signed integer written by {@link #writeFormattedLong(long, OutputStream)} from
+     * the specified {@link InputStream}.
+     * @param inputStream the stream to read from
+     */
+    static long readFormattedLong(InputStream inputStream) throws IOException {
+        long result = 0;
+        for (int bitshift = 0; bitshift < 64; bitshift += 8) {
+            result |= ((long) inputStream.read()) << bitshift;
+        }
+
+        if ((result - NEGATIVE_MASK) > 0) {
+            result = (result & ~NEGATIVE_MASK) * -1;
+        }
+        return result;
+    }
+
+    static final long readBsdiffLong(InputStream in) throws PatchFormatException, IOException {
+        long result = 0;
+        for (int bitshift = 0; bitshift < 64; bitshift += 8) {
+            result |= ((long) in.read()) << bitshift;
+        }
+
+        if (result == NEGATIVE_LONG_SIGN_MASK) {
+            // "Negative zero", which is valid in signed-magnitude format.
+            // NB: No sane patch generator should ever produce such a value.
+            throw new PatchFormatException("read negative zero");
+        }
+
+        if ((result & NEGATIVE_LONG_SIGN_MASK) != 0) {
+            result = -(result & ~NEGATIVE_LONG_SIGN_MASK);
+        }
+
+        return result;
+    }
+
+    static void readFully(final InputStream in, final byte[] destination, final int startAt,
+        final int numBytes) throws IOException {
+        int numRead = 0;
+        while (numRead < numBytes) {
+            int readNow = in.read(destination, startAt + numRead, numBytes - numRead);
+            if (readNow == -1) {
+                throw new IOException("truncated input stream");
+            }
+            numRead += readNow;
+        }
+    }
+
+    static void pipe(final InputStream in, final OutputStream out, final byte[] buffer,
+        long copyLength) throws IOException {
+        while (copyLength > 0) {
+            int maxCopy = Math.min(buffer.length, (int) copyLength);
+            readFully(in, buffer, 0, maxCopy);
+            out.write(buffer, 0, maxCopy);
+            copyLength -= maxCopy;
+        }
+    }
+
+    static void pipe(final RandomAccessFile in, final OutputStream out, final byte[] buffer,
+        long copyLength) throws IOException {
+        while (copyLength > 0) {
+            int maxCopy = Math.min(buffer.length, (int) copyLength);
+            in.readFully(buffer, 0, maxCopy);
+            out.write(buffer, 0, maxCopy);
+            copyLength -= maxCopy;
+        }
+    }
+
+    static void fill(byte value, final OutputStream out, final byte[] buffer, long fillLength)
+        throws IOException {
+        while (fillLength > 0) {
+            int maxCopy = Math.min(buffer.length, (int) fillLength);
+            Arrays.fill(buffer, 0, maxCopy, value);
+            out.write(buffer, 0, maxCopy);
+            fillLength -= maxCopy;
+        }
+    }
+}
diff --git a/adb/fastdeploy/deploypatchgenerator/manifest.txt b/adb/fastdeploy/deploypatchgenerator/manifest.txt
new file mode 100644
index 0000000..5c00505
--- /dev/null
+++ b/adb/fastdeploy/deploypatchgenerator/manifest.txt
@@ -0,0 +1 @@
+Main-Class: com.android.fastdeploy.DeployPatchGenerator
diff --git a/adb/fastdeploy/deploypatchgenerator/src/com/android/fastdeploy/DeployPatchGenerator.java b/adb/fastdeploy/deploypatchgenerator/src/com/android/fastdeploy/DeployPatchGenerator.java
new file mode 100644
index 0000000..5577364
--- /dev/null
+++ b/adb/fastdeploy/deploypatchgenerator/src/com/android/fastdeploy/DeployPatchGenerator.java
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.fastdeploy;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.lang.StringBuilder;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
+import java.util.ArrayList;
+
+import java.nio.charset.StandardCharsets;
+import static java.nio.charset.StandardCharsets.UTF_8;
+
+import java.util.Comparator;
+import java.util.Iterator;
+import java.util.List;
+import java.util.AbstractMap.SimpleEntry;
+
+import com.android.fastdeploy.APKMetaData;
+import com.android.fastdeploy.APKEntry;
+
+public final class DeployPatchGenerator {
+    private static final int BUFFER_SIZE = 128 * 1024;
+
+    public static void main(String[] args) {
+        try {
+            if (args.length < 2) {
+                showUsage(0);
+            }
+
+            boolean verbose = false;
+            if (args.length > 2) {
+                String verboseFlag = args[2];
+                if (verboseFlag.compareTo("--verbose") == 0) {
+                    verbose = true;
+                }
+            }
+
+            StringBuilder sb = null;
+            String apkPath = args[0];
+            String deviceMetadataPath = args[1];
+            File hostFile = new File(apkPath);
+
+            List<APKEntry> deviceZipEntries = getMetadataFromFile(deviceMetadataPath);
+            if (verbose) {
+                sb = new StringBuilder();
+                for (APKEntry entry : deviceZipEntries) {
+                    APKEntryToString(entry, sb);
+                }
+                System.err.println("Device Entries (" + deviceZipEntries.size() + ")");
+                System.err.println(sb.toString());
+            }
+
+            List<APKEntry> hostFileEntries = PatchUtils.getAPKMetaData(hostFile).getEntriesList();
+            if (verbose) {
+                sb = new StringBuilder();
+                for (APKEntry entry : hostFileEntries) {
+                    APKEntryToString(entry, sb);
+                }
+                System.err.println("Host Entries (" + hostFileEntries.size() + ")");
+                System.err.println(sb.toString());
+            }
+
+            List<SimpleEntry<APKEntry, APKEntry>> identicalContentsEntrySet =
+                getIdenticalContents(deviceZipEntries, hostFileEntries);
+            reportIdenticalContents(identicalContentsEntrySet, hostFile);
+
+            if (verbose) {
+                sb = new StringBuilder();
+                for (SimpleEntry<APKEntry, APKEntry> identicalEntry : identicalContentsEntrySet) {
+                    APKEntry entry = identicalEntry.getValue();
+                    APKEntryToString(entry, sb);
+                }
+                System.err.println("Identical Entries (" + identicalContentsEntrySet.size() + ")");
+                System.err.println(sb.toString());
+            }
+
+            createPatch(identicalContentsEntrySet, hostFile, System.out);
+        } catch (Exception e) {
+            System.err.println("Error: " + e);
+            e.printStackTrace();
+            System.exit(2);
+        }
+        System.exit(0);
+    }
+
+    private static void showUsage(int exitCode) {
+        System.err.println("usage: deploypatchgenerator <apkpath> <deviceapkmetadata> [--verbose]");
+        System.err.println("");
+        System.exit(exitCode);
+    }
+
+    private static void APKEntryToString(APKEntry entry, StringBuilder outputString) {
+        outputString.append(String.format("Filename: %s\n", entry.getFileName()));
+        outputString.append(String.format("CRC32: 0x%08X\n", entry.getCrc32()));
+        outputString.append(String.format("Data Offset: %d\n", entry.getDataOffset()));
+        outputString.append(String.format("Compressed Size: %d\n", entry.getCompressedSize()));
+        outputString.append(String.format("Uncompressed Size: %d\n", entry.getUncompressedSize()));
+    }
+
+    private static List<APKEntry> getMetadataFromFile(String deviceMetadataPath) throws IOException {
+        InputStream is = new FileInputStream(new File(deviceMetadataPath));
+        APKMetaData apkMetaData = APKMetaData.parseDelimitedFrom(is);
+        return apkMetaData.getEntriesList();
+    }
+
+    private static List<SimpleEntry<APKEntry, APKEntry>> getIdenticalContents(
+        List<APKEntry> deviceZipEntries, List<APKEntry> hostZipEntries) throws IOException {
+        List<SimpleEntry<APKEntry, APKEntry>> identicalContents =
+            new ArrayList<SimpleEntry<APKEntry, APKEntry>>();
+
+        for (APKEntry deviceZipEntry : deviceZipEntries) {
+            for (APKEntry hostZipEntry : hostZipEntries) {
+                if (deviceZipEntry.getCrc32() == hostZipEntry.getCrc32()) {
+                    identicalContents.add(new SimpleEntry(deviceZipEntry, hostZipEntry));
+                }
+            }
+        }
+
+        Collections.sort(identicalContents, new Comparator<SimpleEntry<APKEntry, APKEntry>>() {
+            @Override
+            public int compare(
+                SimpleEntry<APKEntry, APKEntry> p1, SimpleEntry<APKEntry, APKEntry> p2) {
+                return Long.compare(p1.getValue().getDataOffset(), p2.getValue().getDataOffset());
+            }
+        });
+
+        return identicalContents;
+    }
+
+    private static void reportIdenticalContents(
+        List<SimpleEntry<APKEntry, APKEntry>> identicalContentsEntrySet, File hostFile)
+        throws IOException {
+        long totalEqualBytes = 0;
+        int totalEqualFiles = 0;
+        for (SimpleEntry<APKEntry, APKEntry> entries : identicalContentsEntrySet) {
+            APKEntry hostAPKEntry = entries.getValue();
+            totalEqualBytes += hostAPKEntry.getCompressedSize();
+            totalEqualFiles++;
+        }
+
+        float savingPercent = (float) (totalEqualBytes * 100) / hostFile.length();
+
+        System.err.println("Detected " + totalEqualFiles + " equal APK entries");
+        System.err.println(totalEqualBytes + " bytes are equal out of " + hostFile.length() + " ("
+            + savingPercent + "%)");
+    }
+
+    static void createPatch(List<SimpleEntry<APKEntry, APKEntry>> zipEntrySimpleEntrys,
+        File hostFile, OutputStream patchStream) throws IOException, PatchFormatException {
+        FileInputStream hostFileInputStream = new FileInputStream(hostFile);
+
+        patchStream.write(PatchUtils.SIGNATURE.getBytes(StandardCharsets.US_ASCII));
+        PatchUtils.writeFormattedLong(hostFile.length(), patchStream);
+
+        byte[] buffer = new byte[BUFFER_SIZE];
+        long totalBytesWritten = 0;
+        Iterator<SimpleEntry<APKEntry, APKEntry>> entrySimpleEntryIterator =
+            zipEntrySimpleEntrys.iterator();
+        while (entrySimpleEntryIterator.hasNext()) {
+            SimpleEntry<APKEntry, APKEntry> entrySimpleEntry = entrySimpleEntryIterator.next();
+            APKEntry deviceAPKEntry = entrySimpleEntry.getKey();
+            APKEntry hostAPKEntry = entrySimpleEntry.getValue();
+
+            long newDataLen = hostAPKEntry.getDataOffset() - totalBytesWritten;
+            long oldDataOffset = deviceAPKEntry.getDataOffset();
+            long oldDataLen = deviceAPKEntry.getCompressedSize();
+
+            PatchUtils.writeFormattedLong(newDataLen, patchStream);
+            PatchUtils.pipe(hostFileInputStream, patchStream, buffer, newDataLen);
+            PatchUtils.writeFormattedLong(oldDataOffset, patchStream);
+            PatchUtils.writeFormattedLong(oldDataLen, patchStream);
+
+            long skip = hostFileInputStream.skip(oldDataLen);
+            if (skip != oldDataLen) {
+                throw new PatchFormatException("skip error: attempted to skip " + oldDataLen
+                    + " bytes but return code was " + skip);
+            }
+            totalBytesWritten += oldDataLen + newDataLen;
+        }
+        long remainderLen = hostFile.length() - totalBytesWritten;
+        PatchUtils.writeFormattedLong(remainderLen, patchStream);
+        PatchUtils.pipe(hostFileInputStream, patchStream, buffer, remainderLen);
+        PatchUtils.writeFormattedLong(0, patchStream);
+        PatchUtils.writeFormattedLong(0, patchStream);
+        patchStream.flush();
+    }
+}
diff --git a/adb/fastdeploy/proto/ApkEntry.proto b/adb/fastdeploy/proto/ApkEntry.proto
new file mode 100644
index 0000000..9460d15
--- /dev/null
+++ b/adb/fastdeploy/proto/ApkEntry.proto
@@ -0,0 +1,18 @@
+syntax = "proto2";
+
+package com.android.fastdeploy;
+
+option java_package = "com.android.fastdeploy";
+option java_multiple_files = true;
+
+message APKEntry {
+    required int64 crc32 = 1;
+    required string fileName = 2;
+    required int64 dataOffset = 3;
+    required int64 compressedSize = 4;
+    required int64 uncompressedSize = 5;
+}
+
+message APKMetaData {
+    repeated APKEntry entries = 1;
+}
diff --git a/adb/sysdeps.h b/adb/sysdeps.h
index f2911e0..0c2e45c 100644
--- a/adb/sysdeps.h
+++ b/adb/sysdeps.h
@@ -493,21 +493,7 @@
     return _fd_set_error_str(socket_local_server(name, namespace_id, type), error);
 }
 
-inline int network_connect(const std::string& host, int port, int type,
-                           int timeout, std::string* error) {
-  int getaddrinfo_error = 0;
-  int fd = socket_network_client_timeout(host.c_str(), port, type, timeout,
-                                         &getaddrinfo_error);
-  if (fd != -1) {
-    return fd;
-  }
-  if (getaddrinfo_error != 0) {
-    *error = gai_strerror(getaddrinfo_error);
-  } else {
-    *error = strerror(errno);
-  }
-  return -1;
-}
+int network_connect(const std::string& host, int port, int type, int timeout, std::string* error);
 
 static __inline__ int  adb_socket_accept(int  serverfd, struct sockaddr*  addr, socklen_t  *addrlen)
 {
diff --git a/adb/sysdeps/posix/network.cpp b/adb/sysdeps/posix/network.cpp
index ecd1fd2..33ddb4e 100644
--- a/adb/sysdeps/posix/network.cpp
+++ b/adb/sysdeps/posix/network.cpp
@@ -17,11 +17,15 @@
 #include "sysdeps/network.h"
 
 #include <errno.h>
+#include <netdb.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 
 #include <string>
 
+#include <android-base/logging.h>
+#include <cutils/sockets.h>
+
 #include "adb_unique_fd.h"
 
 static void set_error(std::string* error) {
@@ -124,3 +128,19 @@
     }
     return rc;
 }
+
+int network_connect(const std::string& host, int port, int type, int timeout, std::string* error) {
+    int getaddrinfo_error = 0;
+    int fd = socket_network_client_timeout(host.c_str(), port, type, timeout, &getaddrinfo_error);
+    if (fd != -1) {
+        return fd;
+    }
+    if (getaddrinfo_error != 0) {
+        *error = gai_strerror(getaddrinfo_error);
+        LOG(WARNING) << "failed to resolve host '" << host << "': " << *error;
+    } else {
+        *error = strerror(errno);
+        LOG(WARNING) << "failed to connect to '" << host << "': " << *error;
+    }
+    return -1;
+}
diff --git a/adb/test_adb.py b/adb/test_adb.py
index 86c13d0..cde2b22 100755
--- a/adb/test_adb.py
+++ b/adb/test_adb.py
@@ -27,6 +27,7 @@
 import socket
 import struct
 import subprocess
+import sys
 import threading
 import time
 import unittest
@@ -129,10 +130,19 @@
     subprocess.check_output(["adb", "-P", str(port), "kill-server"],
                             stderr=subprocess.STDOUT)
     read_pipe, write_pipe = os.pipe()
-    os.set_inheritable(write_pipe, True)
+
+    if sys.platform == "win32":
+        import msvcrt
+        write_handle = msvcrt.get_osfhandle(write_pipe)
+        os.set_handle_inheritable(write_handle, True)
+        reply_fd = str(write_handle)
+    else:
+        os.set_inheritable(write_pipe, True)
+        reply_fd = str(write_pipe)
+
     proc = subprocess.Popen(["adb", "-L", "tcp:localhost:{}".format(port),
                              "fork-server", "server",
-                             "--reply-fd", str(write_pipe)], close_fds=False)
+                             "--reply-fd", reply_fd], close_fds=False)
     try:
         os.close(write_pipe)
         greeting = os.read(read_pipe, 1024)
diff --git a/adb/test_device.py b/adb/test_device.py
index 42aadc4..20f224a 100644
--- a/adb/test_device.py
+++ b/adb/test_device.py
@@ -1302,6 +1302,37 @@
                 self.assertEqual(length, len(stdout) - 4)
                 self.assertEqual(stdout, "\0" * length + "foo\n")
 
+    def test_zero_packet(self):
+        """Test for http://b/113070258
+
+        Make sure that we don't blow up when sending USB transfers that line up
+        exactly with the USB packet size.
+        """
+
+        local_port = int(self.device.forward("tcp:0", "tcp:12345"))
+        try:
+            for size in [512, 1024]:
+                def listener():
+                    cmd = ["echo foo | nc -l -p 12345; echo done"]
+                    rc, stdout, stderr = self.device.shell_nocheck(cmd)
+
+                thread = threading.Thread(target=listener)
+                thread.start()
+
+                # Wait a bit to let the shell command start.
+                time.sleep(0.25)
+
+                sock = socket.create_connection(("localhost", local_port))
+                with contextlib.closing(sock):
+                    bytesWritten = sock.send("a" * size)
+                    self.assertEqual(size, bytesWritten)
+                    readBytes = sock.recv(4096)
+                    self.assertEqual("foo\n", readBytes)
+
+                thread.join()
+        finally:
+            self.device.forward_remove("tcp:{}".format(local_port))
+
 
 def main():
     random.seed(0)
diff --git a/adb/transport_local.cpp b/adb/transport_local.cpp
index 1431252..8b8fd51 100644
--- a/adb/transport_local.cpp
+++ b/adb/transport_local.cpp
@@ -74,6 +74,7 @@
     std::string host;
     int port = DEFAULT_ADB_LOCAL_TRANSPORT_PORT;
     if (!android::base::ParseNetAddress(address, &host, &port, &serial, response)) {
+        D("failed to parse address: '%s'", address.c_str());
         return std::make_tuple(unique_fd(), port, serial);
     }
 
@@ -103,6 +104,7 @@
         return;
     }
 
+    D("connection requested to '%s'", address.c_str());
     unique_fd fd;
     int port;
     std::string serial;
diff --git a/base/include/android-base/parseint.h b/base/include/android-base/parseint.h
index 55f1ed3..5bfa47e 100644
--- a/base/include/android-base/parseint.h
+++ b/base/include/android-base/parseint.h
@@ -33,6 +33,14 @@
 template <typename T>
 bool ParseUint(const char* s, T* out, T max = std::numeric_limits<T>::max(),
                bool allow_suffixes = false) {
+  while (isspace(*s)) {
+    s++;
+  }
+
+  if (s[0] == '-') {
+    return false;
+  }
+
   int base = (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) ? 16 : 10;
   errno = 0;
   char* end;
@@ -79,6 +87,10 @@
 bool ParseInt(const char* s, T* out,
               T min = std::numeric_limits<T>::min(),
               T max = std::numeric_limits<T>::max()) {
+  while (isspace(*s)) {
+    s++;
+  }
+
   int base = (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) ? 16 : 10;
   errno = 0;
   char* end;
diff --git a/base/parseint_test.cpp b/base/parseint_test.cpp
index 8f9ed77..b8cf654 100644
--- a/base/parseint_test.cpp
+++ b/base/parseint_test.cpp
@@ -25,8 +25,14 @@
 
   ASSERT_TRUE(android::base::ParseInt("123", &i));
   ASSERT_EQ(123, i);
+  i = 0;
+  EXPECT_TRUE(android::base::ParseInt("  123", &i));
+  EXPECT_EQ(123, i);
   ASSERT_TRUE(android::base::ParseInt("-123", &i));
   ASSERT_EQ(-123, i);
+  i = 0;
+  EXPECT_TRUE(android::base::ParseInt("  -123", &i));
+  EXPECT_EQ(-123, i);
 
   short s = 0;
   ASSERT_TRUE(android::base::ParseInt("1234", &s));
@@ -49,7 +55,11 @@
 
   ASSERT_TRUE(android::base::ParseUint("123", &i));
   ASSERT_EQ(123u, i);
+  i = 0u;
+  EXPECT_TRUE(android::base::ParseUint("  123", &i));
+  EXPECT_EQ(123u, i);
   ASSERT_FALSE(android::base::ParseUint("-123", &i));
+  EXPECT_FALSE(android::base::ParseUint("  -123", &i));
 
   unsigned short s = 0u;
   ASSERT_TRUE(android::base::ParseUint("1234", &s));
@@ -63,6 +73,10 @@
   ASSERT_FALSE(android::base::ParseUint<unsigned short>("x", nullptr));
   ASSERT_FALSE(android::base::ParseUint<unsigned short>("123x", nullptr));
   ASSERT_TRUE(android::base::ParseUint<unsigned short>("1234", nullptr));
+
+  unsigned long long int lli;
+  EXPECT_FALSE(android::base::ParseUint("-123", &lli));
+  EXPECT_FALSE(android::base::ParseUint("  -123", &lli));
 }
 
 TEST(parseint, no_implicit_octal) {
@@ -79,10 +93,16 @@
   int i = 0;
   ASSERT_TRUE(android::base::ParseInt("0x123", &i));
   ASSERT_EQ(0x123, i);
+  i = 0;
+  EXPECT_TRUE(android::base::ParseInt("  0x123", &i));
+  EXPECT_EQ(0x123, i);
 
   unsigned int u = 0u;
   ASSERT_TRUE(android::base::ParseUint("0x123", &u));
   ASSERT_EQ(0x123u, u);
+  u = 0u;
+  EXPECT_TRUE(android::base::ParseUint("  0x123", &u));
+  EXPECT_EQ(0x123u, u);
 }
 
 TEST(parseint, string) {
@@ -101,7 +121,7 @@
   ASSERT_EQ(123, i);
 
   unsigned int u = 123u;
-  ASSERT_FALSE(android::base::ParseInt("456x", &u));
+  ASSERT_FALSE(android::base::ParseUint("456x", &u));
   ASSERT_EQ(123u, u);
 }
 
diff --git a/debuggerd/libdebuggerd/open_files_list.cpp b/debuggerd/libdebuggerd/open_files_list.cpp
index 1fdf236..03e4e8e 100644
--- a/debuggerd/libdebuggerd/open_files_list.cpp
+++ b/debuggerd/libdebuggerd/open_files_list.cpp
@@ -75,7 +75,6 @@
       ALOGE("failed to read fdsan table entry %zu: %s", i, strerror(errno));
       return;
     }
-    ALOGE("fd %zu = %#" PRIx64, i, entry.close_tag.load());
     if (entry.close_tag) {
       (*list)[i].fdsan_owner = entry.close_tag.load();
     }
diff --git a/fastboot/README.md b/fastboot/README.md
index ec7dcb4..15b5965 100644
--- a/fastboot/README.md
+++ b/fastboot/README.md
@@ -186,10 +186,45 @@
                         bootloader requiring a signature before
                         it will install or boot images.
 
+    is-userspace        If the value is "yes", the device is running
+                        fastbootd. Otherwise, it is running fastboot
+                        in the bootloader.
+
 Names starting with a lowercase character are reserved by this
 specification.  OEM-specific names should not start with lowercase
 characters.
 
+## Logical Partitions
+
+There are a number of commands to interact with logical partitions:
+
+    update-super:%s:%s  Write the previously downloaded image to a super
+                        partition. Unlike the "flash" command, this has
+                        special rules. The image must have been created by
+                        the lpmake command, and must not be a sparse image.
+                        If the last argument is "wipe", then all existing
+                        logical partitions are deleted. If no final argument
+                        is specified, the partition tables are merged. Any
+                        partition in the new image that does not exist in the
+                        old image is created with a zero size.
+
+                        In all cases, this will cause the temporary "scratch"
+                        partition to be deleted if it exists.
+
+    create-logical-partition:%s:%d
+                        Create a logical partition with the given name and
+                        size, in the super partition.
+
+    delete-logical-partition:%s
+                        Delete a logical partition with the given name.
+
+    resize-logical-partition:%s:%d
+                        Change the size of the named logical partition.
+
+In addition, there is a variable to test whether a partition is logical:
+
+    is-logical:%s       If the value is "yes", the partition is logical.
+                        Otherwise the partition is physical.
 
 ## TCP Protocol v1
 
diff --git a/fastboot/constants.h b/fastboot/constants.h
index 43daab0..6542b83 100644
--- a/fastboot/constants.h
+++ b/fastboot/constants.h
@@ -33,6 +33,7 @@
 #define FB_CMD_CREATE_PARTITION "create-logical-partition"
 #define FB_CMD_DELETE_PARTITION "delete-logical-partition"
 #define FB_CMD_RESIZE_PARTITION "resize-logical-partition"
+#define FB_CMD_UPDATE_SUPER "update-super"
 
 #define RESPONSE_OKAY "OKAY"
 #define RESPONSE_FAIL "FAIL"
diff --git a/fastboot/device/commands.cpp b/fastboot/device/commands.cpp
index 690bfa8..1e853bf 100644
--- a/fastboot/device/commands.cpp
+++ b/fastboot/device/commands.cpp
@@ -336,3 +336,11 @@
     }
     return device->WriteOkay("Partition resized");
 }
+
+bool UpdateSuperHandler(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 2) {
+        return device->WriteFail("Invalid arguments");
+    }
+    bool wipe = (args.size() >= 3 && args[2] == "wipe");
+    return UpdateSuper(device, args[1], wipe);
+}
diff --git a/fastboot/device/commands.h b/fastboot/device/commands.h
index f67df91..4778d23 100644
--- a/fastboot/device/commands.h
+++ b/fastboot/device/commands.h
@@ -44,3 +44,4 @@
 bool CreatePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args);
 bool DeletePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args);
 bool ResizePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args);
+bool UpdateSuperHandler(FastbootDevice* device, const std::vector<std::string>& args);
diff --git a/fastboot/device/fastboot_device.cpp b/fastboot/device/fastboot_device.cpp
index c306e67..6ed6d32 100644
--- a/fastboot/device/fastboot_device.cpp
+++ b/fastboot/device/fastboot_device.cpp
@@ -46,6 +46,7 @@
               {FB_CMD_CREATE_PARTITION, CreatePartitionHandler},
               {FB_CMD_DELETE_PARTITION, DeletePartitionHandler},
               {FB_CMD_RESIZE_PARTITION, ResizePartitionHandler},
+              {FB_CMD_UPDATE_SUPER, UpdateSuperHandler},
       }),
       transport_(std::make_unique<ClientUsbTransport>()),
       boot_control_hal_(IBootControl::getService()) {}
diff --git a/fastboot/device/flashing.cpp b/fastboot/device/flashing.cpp
index b5ed170..e3efbcb 100644
--- a/fastboot/device/flashing.cpp
+++ b/fastboot/device/flashing.cpp
@@ -25,6 +25,8 @@
 #include <android-base/logging.h>
 #include <android-base/strings.h>
 #include <ext4_utils/ext4_utils.h>
+#include <liblp/builder.h>
+#include <liblp/liblp.h>
 #include <sparse/sparse.h>
 
 #include "fastboot_device.h"
@@ -36,6 +38,8 @@
 
 }  // namespace
 
+using namespace android::fs_mgr;
+
 int FlashRawDataChunk(int fd, const char* data, size_t len) {
     size_t ret = 0;
     while (ret < len) {
@@ -99,3 +103,74 @@
     }
     return FlashBlockDevice(handle.fd(), data);
 }
+
+bool UpdateSuper(FastbootDevice* device, const std::string& partition_name, bool wipe) {
+    std::optional<std::string> super = FindPhysicalPartition(partition_name);
+    if (!super) {
+        return device->WriteFail("Could not find partition: " + partition_name);
+    }
+
+    std::vector<char> data = std::move(device->download_data());
+    if (data.empty()) {
+        return device->WriteFail("No data available");
+    }
+
+    std::unique_ptr<LpMetadata> new_metadata = ReadFromImageBlob(data.data(), data.size());
+    if (!new_metadata) {
+        return device->WriteFail("Data is not a valid logical partition metadata image");
+    }
+
+    // If we are unable to read the existing metadata, then the super partition
+    // is corrupt. In this case we reflash the whole thing using the provided
+    // image.
+    std::string slot_suffix = device->GetCurrentSlot();
+    uint32_t slot_number = SlotNumberForSlotSuffix(slot_suffix);
+    std::unique_ptr<LpMetadata> metadata = ReadMetadata(super->c_str(), slot_number);
+    if (!metadata || wipe) {
+        if (!FlashPartitionTable(super.value(), *new_metadata.get())) {
+            return device->WriteFail("Unable to flash new partition table");
+        }
+        return device->WriteOkay("Successfully flashed partition table");
+    }
+
+    // There's a working super partition, and we don't want to wipe it - it may
+    // may contain partitions created for the user. Instead, we create a zero-
+    // sized partition for each entry in the new partition table. It is then
+    // the host's responsibility to size it correctly via resize-logical-partition.
+    std::unique_ptr<MetadataBuilder> builder = MetadataBuilder::New(*metadata.get());
+    if (!builder) {
+        return device->WriteFail("Unable to create a metadata builder");
+    }
+    for (const auto& partition : new_metadata->partitions) {
+        std::string name = GetPartitionName(partition);
+        if (builder->FindPartition(name)) {
+            continue;
+        }
+        std::string guid = GetPartitionGuid(partition);
+        if (!builder->AddPartition(name, guid, partition.attributes)) {
+            return device->WriteFail("Unable to add partition: " + name);
+        }
+    }
+
+    // The scratch partition may exist as temporary storage, created for
+    // use by adb remount for overlayfs. If we're performing a flashall
+    // operation then we want to start over with a clean slate, so we
+    // remove the scratch partition until it is requested again.
+    builder->RemovePartition("scratch");
+
+    new_metadata = builder->Export();
+    if (!new_metadata) {
+        return device->WriteFail("Unable to export new partition table");
+    }
+
+    // Write the new table to every metadata slot.
+    bool ok = true;
+    for (size_t i = 0; i < new_metadata->geometry.metadata_slot_count; i++) {
+        ok &= UpdatePartitionTable(super.value(), *new_metadata.get(), i);
+    }
+
+    if (!ok) {
+        return device->WriteFail("Unable to write new partition table");
+    }
+    return device->WriteOkay("Successfully updated partition table");
+}
diff --git a/fastboot/device/flashing.h b/fastboot/device/flashing.h
index 206a407..89e20fc 100644
--- a/fastboot/device/flashing.h
+++ b/fastboot/device/flashing.h
@@ -22,3 +22,4 @@
 class FastbootDevice;
 
 int Flash(FastbootDevice* device, const std::string& partition_name);
+bool UpdateSuper(FastbootDevice* device, const std::string& partition_name, bool wipe);
diff --git a/fastboot/device/usb_client.cpp b/fastboot/device/usb_client.cpp
index 215f99a..fb51a90 100644
--- a/fastboot/device/usb_client.cpp
+++ b/fastboot/device/usb_client.cpp
@@ -187,18 +187,9 @@
 
 // Reimplementing since usb_ffs_close() does not close the control FD.
 static void CloseFunctionFs(usb_handle* h) {
-    if (h->bulk_in > 0) {
-        close(h->bulk_in);
-        h->bulk_in = -1;
-    }
-    if (h->bulk_out > 0) {
-        close(h->bulk_out);
-        h->bulk_out = -1;
-    }
-    if (h->control > 0) {
-        close(h->control);
-        h->control = -1;
-    }
+    h->bulk_in.reset();
+    h->bulk_out.reset();
+    h->control.reset();
 }
 
 static bool InitFunctionFs(usb_handle* h) {
@@ -206,19 +197,19 @@
 
     if (h->control < 0) {  // might have already done this before
         LOG(INFO) << "opening control endpoint " << kUsbFfsFastbootEp0;
-        h->control = open(kUsbFfsFastbootEp0, O_RDWR);
+        h->control.reset(open(kUsbFfsFastbootEp0, O_RDWR));
         if (h->control < 0) {
             PLOG(ERROR) << "cannot open control endpoint " << kUsbFfsFastbootEp0;
             goto err;
         }
 
-        auto ret = write(h->control, &v2_descriptor, sizeof(v2_descriptor));
+        auto ret = write(h->control.get(), &v2_descriptor, sizeof(v2_descriptor));
         if (ret < 0) {
             PLOG(ERROR) << "cannot write descriptors " << kUsbFfsFastbootEp0;
             goto err;
         }
 
-        ret = write(h->control, &strings, sizeof(strings));
+        ret = write(h->control.get(), &strings, sizeof(strings));
         if (ret < 0) {
             PLOG(ERROR) << "cannot write strings " << kUsbFfsFastbootEp0;
             goto err;
@@ -227,20 +218,20 @@
         android::base::SetProperty("sys.usb.ffs.ready", "1");
     }
 
-    h->bulk_out = open(kUsbFfsFastbootOut, O_RDONLY);
+    h->bulk_out.reset(open(kUsbFfsFastbootOut, O_RDONLY));
     if (h->bulk_out < 0) {
         PLOG(ERROR) << "cannot open bulk-out endpoint " << kUsbFfsFastbootOut;
         goto err;
     }
 
-    h->bulk_in = open(kUsbFfsFastbootIn, O_WRONLY);
+    h->bulk_in.reset(open(kUsbFfsFastbootIn, O_WRONLY));
     if (h->bulk_in < 0) {
         PLOG(ERROR) << "cannot open bulk-in endpoint " << kUsbFfsFastbootIn;
         goto err;
     }
 
-    h->read_aiob.fd = h->bulk_out;
-    h->write_aiob.fd = h->bulk_in;
+    h->read_aiob.fd = h->bulk_out.get();
+    h->write_aiob.fd = h->bulk_in.get();
     h->reads_zero_packets = false;
     return true;
 
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index 8623666..20c3359 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -125,9 +125,9 @@
     { "dts",      "dt.img",           "dt.sig",       "dts",      true,  false },
     { "odm",      "odm.img",          "odm.sig",      "odm",      true,  false },
     { "product",  "product.img",      "product.sig",  "product",  true,  false },
-    { "product-services",
-                  "product-services.img",
-                                      "product-services.sig",
+    { "product_services",
+                  "product_services.img",
+                                      "product_services.sig",
                                                       "product_services",
                                                                   true,  true  },
     { "recovery", "recovery.img",     "recovery.sig", "recovery", true,  false },
diff --git a/fastboot/fastboot_driver.cpp b/fastboot/fastboot_driver.cpp
index 55ca65d..c508abe 100644
--- a/fastboot/fastboot_driver.cpp
+++ b/fastboot/fastboot_driver.cpp
@@ -220,10 +220,10 @@
     return HandleResponse(response, info);
 }
 
-RetCode FastBootDriver::Download(sparse_file* s, std::string* response,
+RetCode FastBootDriver::Download(sparse_file* s, bool use_crc, std::string* response,
                                  std::vector<std::string>* info) {
     error_ = "";
-    int64_t size = sparse_file_len(s, true, false);
+    int64_t size = sparse_file_len(s, true, use_crc);
     if (size <= 0 || size > MAX_DOWNLOAD_SIZE) {
         error_ = "Sparse file is too large or invalid";
         return BAD_ARG;
@@ -247,7 +247,7 @@
         return data->self->SparseWriteCallback(data->tpbuf, cbuf, len);
     };
 
-    if (sparse_file_callback(s, true, false, cb, &cb_priv) < 0) {
+    if (sparse_file_callback(s, true, use_crc, cb, &cb_priv) < 0) {
         error_ = "Error reading sparse file";
         return IO_ERROR;
     }
diff --git a/fastboot/fastboot_driver.h b/fastboot/fastboot_driver.h
index dd199c0..51be3db 100644
--- a/fastboot/fastboot_driver.h
+++ b/fastboot/fastboot_driver.h
@@ -56,6 +56,8 @@
 };
 
 class FastBootDriver {
+    friend class FastBootTest;
+
   public:
     static constexpr int RESP_TIMEOUT = 30;  // 30 seconds
     static constexpr uint32_t MAX_DOWNLOAD_SIZE = std::numeric_limits<uint32_t>::max();
@@ -74,7 +76,7 @@
     // This will be removed after fastboot is modified to use a vector
     RetCode Download(const char* buf, uint32_t size, std::string* response = nullptr,
                      std::vector<std::string>* info = nullptr);
-    RetCode Download(sparse_file* s, std::string* response = nullptr,
+    RetCode Download(sparse_file* s, bool use_crc = false, std::string* response = nullptr,
                      std::vector<std::string>* info = nullptr);
     RetCode Erase(const std::string& part, std::string* response = nullptr,
                   std::vector<std::string>* info = nullptr);
diff --git a/fastboot/fuzzy_fastboot/Android.bp b/fastboot/fuzzy_fastboot/Android.bp
new file mode 100644
index 0000000..9a68ff3
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/Android.bp
@@ -0,0 +1,31 @@
+cc_test_host {
+  name: "fuzzy_fastboot",
+  compile_multilib: "first",
+
+  srcs: [
+    "main.cpp",
+    "extensions.cpp",
+    "usb_transport_sniffer.cpp",
+    "fixtures.cpp",
+    "test_utils.cpp",
+  ],
+
+  static_libs: [
+    "libfastboot2",
+    "libziparchive",
+    "libsparse",
+    "libutils",
+    "liblog",
+    "libz",
+    "libdiagnose_usb",
+    "libbase",
+    "libcutils",
+    "libgtest",
+    "libgtest_main",
+    "libbase",
+    "libadb_host",
+    "libtinyxml2",
+    "libsparse",
+  ],
+
+}
diff --git a/fastboot/fuzzy_fastboot/README.md b/fastboot/fuzzy_fastboot/README.md
new file mode 100644
index 0000000..72967c5
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/README.md
@@ -0,0 +1,394 @@
+# Fuzzy Fastboot
+
+Fuzzy Fastboot (FF) is a standalone automated conformance and penetration tester for
+validating device-side fastboot protocol implementations.
+The tool is completely generic, and uses a simple extensible XML
+configuration file to auto-generate device-specific tests for any device.
+Any Android device that uses the fastboot protocol should have fuzzy fastboot run on it prior to
+release to find implementation bugs, make sure it conforms to the fastboot spec,
+and that it safely handles malicious inputs.
+
+
+## Background
+The [fastboot protocol](../README.md) provides an easy way to manage low level
+aspects of the device directly from bootloader. However, with great power comes
+great responsibility. An improper or insecure fastboot implementation can
+open the possibility for critical security exploits on the bootloader via fastboot
+commands. Furthermore, an untrustworthy or insecure bootloader means nothing that is
+either directly or indirectly bootstrapped by the bootloader can be trusted (including Android).
+By checking a bootloader's conformance to the fastboot spec, as well as make sure
+nefarious/malformed input is properly and gracefully handled, easy exploits of a
+device's bootloaders can be mitigated.
+
+Additionally, since the fastboot tool itself must support a myriad of fastboot
+implementations, it is important to make sure an implementation is conforming to
+avoid potential incompatibilities with the fastboot command line tool itself.
+Thus, Fuzzy Fastboot also checks for proper conformance to the spec.
+
+## Overview
+Fuzzy Fastboot is written in C++ and uses [Google Test](https://github.com/google/googletest)
+for the underlying test framework. This means that Fuzzy Fastboot supports all of
+gtest's command line flags and options.
+
+Additionally, by using gtest it makes it extremely easy to add additional C++ based
+tests to Fuzzy Fastboot. However, in most cases the optional device specific
+XML configuration file that is provided to Fuzzy Fastboot supports the necessary
+features and hooks for testing device specific commands/features
+without touching the underlying C++.
+
+### Generic Tests
+Without a provided device XML configuration, Fuzzy Fastboot can only perform
+some basic tests that are generic to any fastboot device. These generic tests are
+divided into several test suite categories:
+
+1. **USBFunctionality** - Test USB communication
+2. **Conformance** - Test the device properly handles well-formed fastboot commands
+3. **UnlockPermissions** - Test commands only allowed in the unlocked state work
+4. **LockPermissions** - Test commands only not allowed in the locked state are rejected
+5. **Fuzz** - Test malicious and/or ill-formed commands are properly and gracefully handled
+
+
+### XML Generated Tests
+With a provided XML device configuration, Fuzzy Fastboot will be able to generate
+many more additional tests cases.
+
+The device config XML has five element pairs all inside a root level `<config>`:
+
+#### `<getvar>` Element
+Inside the `<getvar></getvar>` element pairs, one should list all the device's getvar
+variables, with an associated ECMAScript regex you wish the returned variable to match on.
+Each tested variable should appear in a `<var key="key" assert="regex"/>` format.
+For example:
+```xml
+<getvar>
+  <var key="product" assert="superphone2000"/>
+  <var key="secure" assert="no|yes"/>
+  <var key="battery-voltage" assert="[34][[:digit:]]{3}"/>
+  <!-- etc...  -->
+</getvar>
+```
+
+#### `<partitions>` Element
+Inside the `<partitions></partitions>` element pairs, one should list all the device's
+partitions. Each device partition has should be put inside a `<part/>` element.
+The `<part/>` element supports the following attributes:
+
+
+| Attribute | Value          | Purpose                                                                                     | Default  |
+|-----------|----------------|---------------------------------------------------------------------------------------------|----------|
+| value     | Partition name | The name of the partition                                                                   | Required |
+| slots     | "yes" or "no"  | Is this partition is slotted                                                                | "no"     |
+| test      | "yes" or "no"  | Is Fuzzy Fastboot is allowed to generate tests that overwrite this partition                | Required |
+| hashable  | "yes" or "no"  | Is this partition hashable with the hash command specified in `<checksum>`                  | "yes"    |
+| parsed    | "yes" or "no"  | Does the bootloader parse this partition, such as look for a header, look for magic, etc... | "no"     |
+
+For example:
+```xml
+<!-- All the device partitions should be listed here -->
+<partitions>
+  <part value="boot" slots="yes" test="yes" hashable="yes" parsed="yes"/>
+  <part value="modem" slots="yes" test="yes" hashable="yes"/>
+  <part value="userdata" slots="no" test="yes" hashable="no"/>
+  <!-- etc...  -->
+</partitions>
+```
+
+#### `<packed>` Element
+Most devices have pseudo partitions, such as a `bootloader` partition,
+that in reality is composed of several real partitions.
+When one of these pseudo partitions is flashed, the bootloader
+will internally expand the image into the individual images for each underlying
+partition. These pseudo partitions should be listed inside a `<part></part>`
+element pair. Each element `<part>` has a mandatory attribute `value`,
+which lists the name of this pseudo partition, and a `slots` attribute,
+which can be yes or no if this pseudo partition is slotted.
+Additionally, inside the `<part></part>` element pair, one should list
+all the real partition that make up this pseudo partition inside of
+`<child>PART_NAME</child>` element pairs.
+An example is should below:
+
+```xml
+<!-- All the device packed partitions should be listed here -->
+<packed>
+	<part value="bootloader" slots="yes">
+		<!-- We list the real partitions it is composed of -->
+		<child>foo1</child>
+		<child>foo2</child>
+		<child>bar3</child>
+		<!-- We list tests, expect defaults to 'okay' -->
+		<test packed="bootloader.img" unpacked="unpacked"/>
+		<test packed="bootloader_garbage.img" expect="fail"/>
+	</part>
+</packed>
+```
+
+You might notice there are additional `<test/>` elements as well contained inside of
+a `<part></part>` pair. This is because Fuzzy Fastboot allows (and recommends) one to specify
+valid and invalid test packed images for flashing this particular pseudo partition.
+Additionally, one should specify a folder with all the partitions' images
+that the packed image unpacks to. If your device supports hashing partitions, this
+will allow Fuzzy Fastboot to validate the images are unpacking correctly, and
+the correct slots are being flashed.
+
+Each `<test/>` element has the following supported attributes:
+
+| Attribute | Value | Purpose | Default |
+|-----------|---------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------|
+| packed | The name of the packed test image | The image uploaded to the device. It is searched for in dir if --search_path=dir | Required |
+| unpacked | The name of the directory containing the unpacked version of packed | Searched for in dir if --search_path=dir. This folder should have the all the images that packed unpacks to. The name of each of the images should be the name of the real partition it is flashed to. | Required if expect != "fail" |
+| expect | "okay" or "fail" | If uploading a invalid or garbage image the bootloader should reject use "fail" otherwise "okay" | "okay" |
+
+
+#### `<oem>` Element
+Vendors can extend the fastboot protocol with oem commands. This allows vendors
+to support device/vendor specific features/commands over the fastboot protocol.
+Fuzzy Fastboot allows testing these oem commands as well.
+
+Oem commands are specefied in `<command></command>` element pairs. Each command
+element supports the following attributes:
+
+
+| Attribute   | Value                | Purpose                                                       | Default  |
+|-------------|----------------------|---------------------------------------------------------------|----------|
+| value       | The oem command name | Ex: if value="foo", the oem command will start with "oem foo" | Required |
+| permissions | "none" or "unlocked" | Whether the bootloader must be "unlocked" to perform command  | "none"   |
+
+An example is should below:
+```xml
+<oem>
+  <command value="self_destruct" permissions="unlocked">
+    <!-- This will test that "oem self_destruct now" returns 'okay' -->
+    <test value="now" expect="okay"/>
+    <!-- This will test that "oem self_destruct yesterday" returns 'fail' -->
+    <test value="yesterday" expect="fail" />
+  </command>
+
+  <command value="foobar" permissions="unlocked">
+    <!-- FF will first stage test_image.img before running 'oem foobar use_staged' -->
+    <test value="use_staged" expect="okay" input="test_image.img" />
+    <!-- FF will run 'oem foobar send_response', upload data from device, then run the validator script -->
+    <test value="send_response" expect="fail" validate="python validator.py"/>
+  </command>
+<oem/>
+```
+
+Again you will notice that one can, and should, specify tests to run with `<test/>` elements.
+The test elements support the following attributes:
+
+
+| Attribute | Value                                            | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                            | Default                    |
+|-----------|--------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|
+| value     | The oem command argument                         | Ex: if value="bar", and the oem command name was "foo", the full command will be "oem foo bar"                                                                                                                                                                                                                                                                                                                                                     | Empty String (no argument) |
+| expect    | "okay" or "fail"                                 | Whether the bootloader should accept or reject this command                                                                                                                                                                                                                                                                                                                                                                                        | "okay"                     |
+| input     | A image filename                                 | Some oem commands require staging files before the command is executed                                                                                                                                                                                                                                                                                                                                                                             | Empty String (no argument) |
+| validate  | A program/script to run to validate the response | Some oem commands will stage data that can be downloaded afterwards and should be validated to be correct. Fuzzy Fastboot will launch the validation program with the first arg the oem command executed, the second arg  the path to the downloaded image. Ex: "python validate.py'. If the program has a non-zero  return code, the validation is marked as failed and anything from the launched programs stderr is logged in the test failure. | Empty String (no argument) |
+| assert    | A Regular expression                             | In the "okay" or "fail" response, Fuzzy Fastboot will assert the  response matches this regular expression.                                                                                                                                                                                                                                                                                                                                        | Empty String (no argument) |
+| output    | The name of the saved file                       | This is the name of the saved output file passed to the validation script. It is saved in whatever location is specified by the --output_path argument                                                                                                                                                                                                                                                                                             | out.img                    |
+
+
+#### `<checksum/>` Element
+If the bootloader supports hashing partitions (implementing this is strongly recommended), Fuzzy Fastboot can
+use it to do a bunch more testing. Make sure this hash is a cryptographically secure hash, as a non-secure one
+might reveal secrets about the partitions' contents.
+
+The checksum element has no children and only two required attributes:
+
+- **value** - The command that hashes a partition. Note that the name of the partition will be appended to the end of the command. For example, if `value="oem hash"`, hashing the partition `bar` would be issued with `oem hash bar`.
+- **parser** - How the hash is returned is up to the vendor's implementation. It could be part of the `OKAY` response, or be encoded in `INFO` responses. Thus, the parser attribute is used to specify a program/script that will extract the hash. The first argument to the program will be the be the response from `OKAY`, the second argument will be all the `INFO` responses joined by newlines. The extracted hash should be sent back to Fuzzy Fastboot as a string written to stderr, and a return code of 0 to signal the parsing was successful. In the case of failure, return a non-zero return code, an optionally an associated error message written to stderr.
+
+
+
+## Full Example XML Configuration
+Here is a basic example configuration. This can also be found in the 'example' folder
+as well as the associated python scripts 'checksum_parser.py' (used to extract partition hash),
+and 'validator.py' (used to validate an oem command that returns data).
+```xml
+<?xml version="1.0"?>
+<config>
+<!-- All the device getvar variables should be listed here -->
+<getvar>
+	<var key="product" assert="superphone2000"/>
+	<var key="secure" assert="no|yes"/>
+</getvar>
+
+<!-- All the device partitions should be listed here -->
+<partitions>
+	<part value="boot" slots="yes" test="yes" hashable="yes" parsed="yes"/>
+	<part value="modem" slots="yes" test="yes" hashable="yes"/>
+	<part value="userdata" slots="no" test="yes" hashable="no"/>
+
+	<!-- Bootloader partitions -->
+	<part value="foo1" slots="yes" test="no" hashable="yes"/>
+	<part value="foo2" slots="yes" test="no" hashable="yes"/>
+	<part value="bar3" slots="yes" test="no" hashable="yes"/>
+</partitions>
+
+<!-- All the device packed partitions should be listed here -->
+<packed>
+	<part value="bootloader" slots="yes">
+		<!-- We list the real partitions it is composed of -->
+		<child>foo1</child>
+		<child>foo2</child>
+		<child>bar3</child>
+		<!-- We list tests, expect defaults to 'okay' -->
+		<test packed="bootloader.img" unpacked="unpacked"/>
+		<test packed="bootloader_garbage.img" expect="fail"/>
+	</part>
+</packed>
+
+<!-- All the oem commands should be listed here -->
+<oem>
+	<!-- The 'oem self_destruct' command requires an unlocked bootloader -->
+	<command value="self_destruct" permissions="unlocked">
+		<!-- This will test that "oem self_destruct now" returns 'okay' -->
+		<test value="now" expect="okay"/>
+		<test value="yesterday" expect="fail" />
+	</command>
+
+	<!-- Test a fictional 'oem get' command -->
+	<command value="get" permissions="none">
+		<test value="batch_id" expect="okay" assert="[[:digit:]]+"/>
+		<test value="device_color" expect="okay" assert="green|blue"/>
+		<test value="build_num" expect="okay" assert="[\w\-.]+"/>
+		<test value="garbage" expect="fail" assert="Invalid var '[\w ]+'"/>
+	</command>
+
+	<!-- Some oem commands might require staging or downloading data, or both -->
+	<command value="foobar" permissions="unlocked">
+		<!-- FF will first stage test_image.img before running 'oem foobar use_staged' -->
+		<test value="use_staged" expect="okay" input="test_image.img" />
+		<!-- FF will run 'oem foobar send_response', upload data from device, then run the validator script -->
+		<test value="send_response" expect="fail" validate="python validator.py"/>
+	</command>
+</oem>
+
+<!-- If there is a custom oem checksum command to hash partitions, add it here -->
+<checksum value="oem sha1sum"/>
+</config>
+
+```
+
+## Running Fuzzy Fastboot
+Fuzzy Fastboot is built with the fastboot tool itself. It will appear in `out/host/linux-x86/testcases/fuzzy_fastboot/x86_64`.
+
+### Command Line Arguments
+- **--config=**: Specify the name of the configuration XML file. If omitted, only the generic tests will be available.
+- **--search_path=**: Specify the path where Fuzzy Fastboot will look for files referenced in the XML. This includes all the test images and the referenced programs/scripts. This is also where the --config is searched for. If this argument is omitted it defaults to the current directory.
+- **--output_path**: Some oem tests can download an image to the host for validation. This is the location where that image is stored. This deafults to '/tmp'.
+- **--serial_port**: Many devices have a UART or serial log, that reports logging information. Fuzzy Fastboot can include this logging information in the backtraces it generates. This can make debugging far easier. If your device has this, it can be specified with the path to the tty device. Ex: "/dev/ttyUSB0".
+- **--gtest_***: Any valid gtest argument (they all start with 'gtest_')
+- **-h**: Print gtest's help message
+
+
+## Using Fuzzy Fastboot on my Device
+All Fuzzy Fastboot tests should pass on your device. No test should be able to
+crash the bootloader. Invalid input MUST be handled gracefully. Using "asserts"
+or panicking on invalid or malformed input is not an acceptable way to handle
+these tests, as ungraceful forced termination of the bootloader can expose
+vulnerabilities and leave the device in a bad state.
+
+The following is the recommended workflow for using Fuzzy Fastboot on a new device:
+
+### Step 1: Pass the generic Conformance tests
+Begin with just the generic tests (i.e. no XML file). In particular, make sure all
+the conformance tests are passing before you move on. All other tests require that
+the basic generic conformance tests all pass for them to be valid. The conformance
+tests can be run with `./fuzzy_fastboot --gtests_filter=Conformance.*`.
+
+#### Understanding and Fixing Failed Tests
+Whenever a test fails, it will print out to the console the reason for failure
+and the lines and file where the error happened. At the end of each failure
+block, there will usually be a message that Fuzzy Fastboot reports to gtest
+explaining what went wrong. An example is shown below:
+
+```
+Expected equality of these values:
+  resp
+    Which is: "no"
+  unlock ? "yes" : "no"
+    Which is: "yes"
+getvar:unlocked response was not 'no' or 'yes': no
+system/core/fastboot/fuzzy_fastboot/fixtures.cpp:227: Failure
+Expected: SetLockState(UNLOCKED) doesn't generate new fatal failures in the current thread.
+  Actual: it does.
+[THERE WILL BE A MESSAGE HERE EXPLAINING WHY IT FAILED]
+```
+
+In most cases this message at the bottom is all that is needed to figure out why it failed.
+If this is not enough information, below this, gtest will also print out a human readable
+backtrace of the underlying fastboot commands leading up the failure in this test.
+Here is an example:
+```
+<<<<<<<< TRACE BEGIN >>>>>>>>>
+[WRITE 0ms](15 bytes): "getvar:unlocked"
+[READ 20ms](6 bytes): "OKAYno"
+<<<<<<<< TRACE END >>>>>>>>>
+```
+One can easily see the reason for the failure was the test expected the device to
+be unlocked.
+
+If it is still unclear why the failure is happening, the last thing to do is look
+at what line number and file is generating the error. Gtest will always print this out.
+You can then manually look through Fuzzy Fastboot's test source code, and figure out
+what went wrong.
+
+
+### Step 2: Pass all the other generic tests
+Run all the other generic tests (still no XML file). A list of all of them can be
+printed out with: "./fuzzy_fastboot --gtest_list_tests". As before, "--gtest_filter"
+can be used to select certain tests to run, once you figure out which ones failed.
+
+One particular set of tests to watch out for are the ones that involve USB resets.
+USB resets effectively unplug and replug the device in software. Fuzzy Fastboot,
+expects USB resets to cancel whatever transaction is currently going on.
+This is also how Fuzzy Fastboot attempts to recover from errors when the device is
+unresponsive.
+
+### Step 3: Create a device XML configuration
+Without a device specific configuration file, Fuzzy Fastboot will have poor test
+coverage of your device. The vast majority of tests are auto-generated via the XML
+configuration file. Use the guide above to generate a configuration for your device.
+Make sure to be as thorough as possible, and list everything in the configuration
+that can be tested. Finally, make sure that the packed pseudo partitions and
+oem commands all have provided test cases. Be sure to test both the positive case
+(i.e. with valid input), as well as the opposite. Make sure the failure tests
+have good coverage by thinking about all the ways invalid and malicious inputs
+could be formed. These means creating images with malformed headers, illegal chars,
+and other evil inputs.
+
+Now run fuzzy_fastboot with the supplied configuration file. If you do "--gtest_list_tests",
+you should see a ton more tests that were autogenerated by Fuzzy Fastboot.
+As before, run these tests till everything passes. Again, use "--gtest_filter"
+to select specific tests to run once you know what fail,
+as running the whole things with a large configuration can take over 30 minutes.
+See the gtest documentation, for nifty tricks and command line options.
+
+### Step 4: Figure out what Fuzzy Fastboot can't/isn't testing
+While Fuzzy Fastboot with a XML configuration file, should provide good test coverage.
+Think about what device specific things are not being tested, and test them manually.
+In particular, things that if not handled carefully could create security exploits.
+Don't be lazy here, as you already put in the time to get this far.
+
+### Step 5: Celebrate
+You're done :). Now you can be more confident that your implementation is sound, and
+have piece of mind knowing you are protecting the users' security and data by
+running these tests. Don't get too complacent. If the bootloader's source code
+is modified in a way that could introduce bugs or security issues. Make sure to
+test again. You might have to add to your existing configuration file.
+
+## Limitations and Warnings
+- Currently this only works on Linux (even if it builds on Mac)
+- Only fastboot over USB is currently supported
+- Passing these tests does not mean there are not bugs/security issues. For example, a buffer overrun might not always trigger a crash or have any noticeable side effects.
+- **Be extremely careful of the Fuzzy Fastboot tests you are running. Know exactly what the tests do you are about to run before you run them. It is very possible to brick a device with many of these tests.**
+
+## Fuzzy Fastboot Missing Features TODO's
+The following are missing features that should eventually be added
+- *Sparse Image Tests*: Currently there are no tests that tests sparse images. Both well-formed and malicious images need to be tested.
+- *Unlocking/Locking Critical*: Currently there are no tests that tests that locking/unlocking critical functionality.
+- *Saved Test Log*: Fuzzy Fastboot should be able to create a failure log for every failing test and save it to a file. This file should include the test information, the reason it failed, and the fastboot command trace (with the serial console logs). Currently it just prints it to the console at the end of every test.
+- *Host Side Hashing*: One should be able to provide the hashing algorithm to the Fuzzy Fastboot, so it can be checked to agree with what the device is reporting.
+
+
+## Author
+Aaron Wisner - awisner@google.com
diff --git a/fastboot/fuzzy_fastboot/example/checksum_parser.py b/fastboot/fuzzy_fastboot/example/checksum_parser.py
new file mode 100644
index 0000000..1a890e6
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/example/checksum_parser.py
@@ -0,0 +1,37 @@
+'''
+Some bootloader's support hashing partitions. This is a great feature for testing
+correctness. However, the format for the way the hash is returned depends on the
+implementation. The hash could be send through an INFO response, or be as part
+of the OKAY response itself. This script is called with the first argument
+as the string mesage from the okay response. The second argument is each
+info response joined by newlines into one argument.
+'''
+
+import sys
+
+
+def main():
+  '''
+  Data is sent back to the parent fuzzy_fastboot process through the stderr pipe.
+  There are two interpretations of this data by FF.
+
+  0 return code:
+    Anything written to STDERR will be interpreted as part of the hash.
+
+  non-zero return code:
+    Anything written to STDERR is part of the error message that will logged by FF
+    to explain why hash extraction failed.
+
+  Feel free to print to to STDOUT with print() as usual to print info to console
+  '''
+  script, response, info = sys.argv
+  # the info responses are concated by newlines
+  infos = [s.strip() for s in info.splitlines()]
+  sys.stderr.write(infos[-1])
+  print("Extracted checksum: '%s'" % infos[-1])
+  # non-zero return code signals error
+  return 0
+
+
+if __name__ == "__main__":
+  sys.exit(main())
diff --git a/fastboot/fuzzy_fastboot/example/config.xml b/fastboot/fuzzy_fastboot/example/config.xml
new file mode 100644
index 0000000..af2a3b9
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/example/config.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0"?>
+<config>
+<!-- All the device getvar variables should be listed here -->
+<getvar>
+	<var key="product" assert="superphone2000"/>
+	<var key="secure" assert="no|yes"/>
+</getvar>
+
+<!-- All the device partitions should be listed here -->
+<partitions>
+	<part value="boot" slots="yes" test="yes" hashable="yes" parsed="yes"/>
+	<part value="modem" slots="yes" test="yes" hashable="yes"/>
+	<part value="userdata" slots="no" test="yes" hashable="no"/>
+
+	<!-- Bootloader partitions -->
+	<part value="foo1" slots="yes" test="no" hashable="yes"/>
+	<part value="foo2" slots="yes" test="no" hashable="yes"/>
+	<part value="bar3" slots="yes" test="no" hashable="yes"/>
+</partitions>
+
+<!-- All the device packed partitions should be listed here -->
+<packed>
+	<part value="bootloader" slots="yes">
+		<!-- We list the real partitions it is composed of -->
+		<child>foo1</child>
+		<child>foo2</child>
+		<child>bar3</child>
+		<!-- We list tests, expect defaults to 'okay' -->
+		<test packed="bootloader.img" unpacked="unpacked"/>
+		<test packed="bootloader_garbage.img" expect="fail"/>
+	</part>
+</packed>
+
+<!-- All the oem commands should be listed here -->
+<oem>
+	<!-- The 'oem self_destruct' command requires an unlocked bootloader -->
+	<command value="self_destruct" permissions="unlocked">
+		<!-- This will test that "oem self_destruct now" returns 'okay' -->
+		<test value="now" expect="okay"/>
+		<test value="yesterday" expect="fail" />
+	</command>
+
+	<!-- Test a fictional 'oem get' command -->
+	<command value="get" permissions="none">
+		<test value="batch_id" expect="okay" assert="[[:digit:]]+"/>
+		<test value="device_color" expect="okay" assert="green|blue"/>
+		<test value="build_num" expect="okay" assert="[\w\-.]+"/>
+		<test value="garbage" expect="fail" assert="Invalid var '[\w ]+'"/>
+	</command>
+
+	<!-- Some oem commands might require staging or downloading data, or both -->
+	<command value="foobar" permissions="unlocked">
+		<!-- FF will first stage test_image.img before running 'oem foobar use_staged' -->
+		<test value="use_staged" expect="okay" input="test_image.img" />
+		<!-- FF will run 'oem foobar send_response', upload data from device, then run the validator script -->
+		<test value="send_response" expect="fail" validate="python validator.py"/>
+	</command>
+</oem>
+
+<!-- If there is a custom oem checksum command to hash partitions, add it here -->
+<checksum value="oem sha1sum"/>
+</config>
diff --git a/fastboot/fuzzy_fastboot/example/validator.py b/fastboot/fuzzy_fastboot/example/validator.py
new file mode 100644
index 0000000..9c5081f
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/example/validator.py
@@ -0,0 +1,37 @@
+'''
+This is an example validator to be used with oem commands that allow you to
+upload data afterwards that you wish to validate locally.
+'''
+import sys
+
+def eprint(msg):
+  '''
+  A helper function for logging error messages to fuzzy_fastboot
+  Use this function as you would "print()"
+  '''
+  sys.stderr.write(msg + '\n')
+
+
+def main():
+  '''
+  Data is sent back to the parent fuzzy_fastboot process through the stderr pipe.
+
+  If this script has a non-zero return code, anything written to STDERR is part of
+  the error message that will logged by FF to explain why this validation failed.
+
+  Feel free to print to to STDOUT with print() as usual to print info to console
+  '''
+  script, command, fname = sys.argv
+  eprint("Messages here will go to the parent testers logs")
+  eprint("Hello world")
+  print("This goes to stdout as expected")
+  with open(fname, "rb") as fd:
+    # Do some validation on the buffer
+    pass
+
+  # non-zero return code signals error
+  return -1
+
+
+if __name__ == "__main__":
+  sys.exit(main())
diff --git a/fastboot/fuzzy_fastboot/extensions.cpp b/fastboot/fuzzy_fastboot/extensions.cpp
new file mode 100644
index 0000000..62ef5ba
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/extensions.cpp
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <csignal>
+#include <cstdlib>
+#include <fstream>
+
+#include "extensions.h"
+#include "test_utils.h"
+#include "tinyxml2.h"
+
+namespace fastboot {
+namespace extension {
+
+namespace {  // private to this file
+
+// Since exceptions are disabled, a bad regex will trigger an abort in the constructor
+// We at least need to print something out
+std::regex MakeRegex(const std::string& regex_str, int line_num,
+                     std::regex_constants::syntax_option_type type = std::regex::ECMAScript) {
+    // The signal handler can only access static vars
+    static std::string err_str;
+    err_str = android::base::StringPrintf("'%s' is not a valid regex string (line %d)\n",
+                                          regex_str.c_str(), line_num);
+    const auto sighandler = [](int) {
+        int nbytes = write(fileno(stderr), err_str.c_str(), err_str.length());
+        static_cast<void>(nbytes);  // need to supress the unused nbytes/ or unused result
+    };
+    std::signal(SIGABRT, sighandler);
+    // Now attempt to create the regex
+    std::regex ret(regex_str, type);
+    // unregister
+    std::signal(SIGABRT, SIG_DFL);
+
+    return ret;
+}
+
+bool XMLAssert(bool cond, const tinyxml2::XMLElement* elem, const char* msg) {
+    if (!cond) {
+        printf("%s (line %d)\n", msg, elem->GetLineNum());
+    }
+    return !cond;
+}
+
+const std::string XMLAttribute(const tinyxml2::XMLElement* elem, const std::string key,
+                               const std::string key_default = "") {
+    if (!elem->Attribute(key.c_str())) {
+        return key_default;
+    }
+
+    return elem->Attribute(key.c_str());
+}
+
+bool XMLYesNo(const tinyxml2::XMLElement* elem, const std::string key, bool* res,
+              bool def = false) {
+    if (!elem->Attribute(key.c_str())) {
+        *res = def;
+        return true;
+    }
+    const std::string val = elem->Attribute(key.c_str());
+    if (val != "yes" && val != "no") {
+        return false;
+    }
+    *res = (val == "yes");
+    return true;
+}
+
+bool ExtractPartitions(tinyxml2::XMLConstHandle handle, Configuration* config) {
+    // Extract partitions
+    const tinyxml2::XMLElement* part = handle.FirstChildElement("part").ToElement();
+    while (part) {
+        Configuration::PartitionInfo part_info;
+        const std::string name = XMLAttribute(part, "value");
+        const std::string test = XMLAttribute(part, "test");
+        if (XMLAssert(!name.empty(), part, "The name of a partition can not be empty") ||
+            XMLAssert(XMLYesNo(part, "slots", &part_info.slots), part,
+                      "Slots attribute must be 'yes' or 'no'") ||
+            XMLAssert(XMLYesNo(part, "hashable", &part_info.hashable, true), part,
+                      "Hashable attribute must be 'yes' or 'no'") ||
+            XMLAssert(XMLYesNo(part, "parsed", &part_info.parsed), part,
+                      "Parsed attribute must be 'yes' or 'no'"))
+            return false;
+
+        bool allowed = test == "yes" || test == "no-writes" || test == "no";
+        if (XMLAssert(allowed, part, "The test attribute must be 'yes' 'no-writes' or 'no'"))
+            return false;
+        if (XMLAssert(config->partitions.find(name) == config->partitions.end(), part,
+                      "The same partition name is listed twice"))
+            return false;
+        part_info.test = (test == "yes")
+                                 ? Configuration::PartitionInfo::YES
+                                 : (test == "no-writes") ? Configuration::PartitionInfo::NO_WRITES
+                                                         : Configuration::PartitionInfo::NO;
+        config->partitions[name] = part_info;
+        part = part->NextSiblingElement("part");
+    }
+    return true;
+}
+
+bool ExtractPacked(tinyxml2::XMLConstHandle handle, Configuration* config) {
+    // Extract partitions
+    const tinyxml2::XMLElement* part = handle.FirstChildElement("part").ToElement();
+    while (part) {
+        Configuration::PackedInfo packed_info;
+        const std::string name = XMLAttribute(part, "value");
+
+        if (XMLAssert(!name.empty(), part, "The name of a packed partition can not be empty") ||
+            XMLAssert(XMLYesNo(part, "slots", &packed_info.slots), part,
+                      "Slots attribute must be 'yes' or 'no'") ||
+            XMLAssert(config->partitions.find(name) == config->partitions.end(), part,
+                      "A packed partition can not have same name as a real one") ||
+            XMLAssert(config->partitions.find(name) == config->partitions.end(), part,
+                      "The same partition name is listed twice"))
+            return false;
+
+        // Extract children partitions
+        const tinyxml2::XMLElement* child = part->FirstChildElement("child")
+                                                    ? part->FirstChildElement("child")->ToElement()
+                                                    : nullptr;
+        while (child) {
+            const std::string text(child->GetText());
+            // Make sure child exists
+            if (XMLAssert(config->partitions.find(text) != config->partitions.end(), child,
+                          "The child partition was not listed in <partitions>"))
+                return false;
+            packed_info.children.insert(text);
+            child = child->NextSiblingElement("child");
+        }
+
+        // Extract tests
+        const tinyxml2::XMLElement* test = part->FirstChildElement("test")
+                                                   ? part->FirstChildElement("test")->ToElement()
+                                                   : nullptr;
+        while (test) {
+            Configuration::PackedInfoTest packed_test;
+            packed_test.packed_img = XMLAttribute(test, "packed");
+            packed_test.unpacked_dir = XMLAttribute(test, "unpacked");
+            const std::string expect = XMLAttribute(test, "expect", "okay");
+
+            if (XMLAssert(!packed_test.packed_img.empty(), test,
+                          "The packed image location must be specified") ||
+                XMLAssert(CMD_EXPECTS.find(expect) != CMD_EXPECTS.end(), test,
+                          "Expect attribute must be 'okay' or 'fail'"))
+                return false;
+
+            packed_test.expect = CMD_EXPECTS.at(expect);
+            // The expect is only unpacked directory is only needed if success
+            if (packed_test.expect == OKAY &&
+                XMLAssert(!packed_test.unpacked_dir.empty(), test,
+                          "The unpacked image folder location must be specified"))
+                return false;
+
+            packed_info.tests.push_back(packed_test);
+            test = test->NextSiblingElement("test");
+        }
+
+        config->packed[name] = packed_info;
+        part = part->NextSiblingElement("part");
+    }
+    return true;
+}
+
+bool ExtractGetVars(tinyxml2::XMLConstHandle handle, Configuration* config) {
+    // Extract getvars
+    const tinyxml2::XMLElement* var = handle.FirstChildElement("var").ToElement();
+    while (var) {
+        const std::string key = XMLAttribute(var, "key");
+        const std::string reg = XMLAttribute(var, "assert");
+        if (XMLAssert(key.size(), var, "The var key name is empty")) return false;
+        if (XMLAssert(config->getvars.find(key) == config->getvars.end(), var,
+                      "The same getvar variable name is listed twice"))
+            return false;
+        Configuration::GetVar getvar{reg, MakeRegex(reg, var->GetLineNum()), var->GetLineNum()};
+        config->getvars[key] = std::move(getvar);
+        var = var->NextSiblingElement("var");
+    }
+    return true;
+}
+
+bool ExtractOem(tinyxml2::XMLConstHandle handle, Configuration* config) {
+    // Extract getvars
+    // Extract oem commands
+    const tinyxml2::XMLElement* command = handle.FirstChildElement("command").ToElement();
+    while (command) {
+        const std::string cmd = XMLAttribute(command, "value");
+        const std::string permissions = XMLAttribute(command, "permissions");
+        if (XMLAssert(cmd.size(), command, "Empty command value")) return false;
+        if (XMLAssert(permissions == "none" || permissions == "unlocked", command,
+                      "Permissions attribute must be 'none' or 'unlocked'"))
+            return false;
+
+        // Each command has tests
+        std::vector<Configuration::CommandTest> tests;
+        const tinyxml2::XMLElement* test = command->FirstChildElement("test");
+        while (test) {  // iterate through tests
+            Configuration::CommandTest ctest;
+
+            ctest.line_num = test->GetLineNum();
+            const std::string default_name = "XMLTest-line-" + std::to_string(test->GetLineNum());
+            ctest.name = XMLAttribute(test, "name", default_name);
+            ctest.arg = XMLAttribute(test, "value");
+            ctest.input = XMLAttribute(test, "input");
+            ctest.output = XMLAttribute(test, "output");
+            ctest.validator = XMLAttribute(test, "validate");
+            ctest.regex_str = XMLAttribute(test, "assert");
+
+            const std::string expect = XMLAttribute(test, "expect");
+
+            if (XMLAssert(CMD_EXPECTS.find(expect) != CMD_EXPECTS.end(), test,
+                          "Expect attribute must be 'okay' or 'fail'"))
+                return false;
+            ctest.expect = CMD_EXPECTS.at(expect);
+            std::regex regex;
+            if (expect == "okay" && ctest.regex_str.size()) {
+                ctest.regex = MakeRegex(ctest.regex_str, test->GetLineNum());
+            }
+            tests.push_back(std::move(ctest));
+            test = test->NextSiblingElement("test");
+        }
+
+        // Build the command struct
+        const Configuration::OemCommand oem_cmd{permissions == "unlocked", std::move(tests)};
+        config->oem[cmd] = std::move(oem_cmd);
+
+        command = command->NextSiblingElement("command");
+    }
+    return true;
+}
+
+bool ExtractChecksum(tinyxml2::XMLConstHandle handle, Configuration* config) {
+    const tinyxml2::XMLElement* checksum = handle.ToElement();
+    if (checksum && checksum->Attribute("value")) {
+        config->checksum = XMLAttribute(checksum, "value");
+        config->checksum_parser = XMLAttribute(checksum, "parser");
+        if (XMLAssert(config->checksum_parser != "", checksum,
+                      "A checksum parser attribute is mandatory"))
+            return false;
+    }
+    return true;
+}
+
+}  // anonymous namespace
+
+bool ParseXml(const std::string& file, Configuration* config) {
+    tinyxml2::XMLDocument doc;
+    if (doc.LoadFile(file.c_str())) {
+        printf("Failed to open/parse XML file '%s'\nXMLError: %s\n", file.c_str(), doc.ErrorStr());
+        return false;
+    }
+
+    tinyxml2::XMLConstHandle handle(&doc);
+    tinyxml2::XMLConstHandle root(handle.FirstChildElement("config"));
+
+    // Extract the getvars
+    if (!ExtractGetVars(root.FirstChildElement("getvar"), config)) {
+        return false;
+    }
+    // Extract the partition info
+    if (!ExtractPartitions(root.FirstChildElement("partitions"), config)) {
+        return false;
+    }
+
+    // Extract packed
+    if (!ExtractPacked(root.FirstChildElement("packed"), config)) {
+        return false;
+    }
+
+    // Extract oem commands
+    if (!ExtractOem(root.FirstChildElement("oem"), config)) {
+        return false;
+    }
+
+    // Extract checksum
+    if (!ExtractChecksum(root.FirstChildElement("checksum"), config)) {
+        return false;
+    }
+
+    return true;
+}
+
+}  // namespace extension
+}  // namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/extensions.h b/fastboot/fuzzy_fastboot/extensions.h
new file mode 100644
index 0000000..58312e5
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/extensions.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#pragma once
+
+#include <regex>
+#include <string>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+namespace fastboot {
+namespace extension {
+
+enum Expect { OKAY = 0, FAIL, DATA };
+
+static const std::unordered_map<std::string, Expect> CMD_EXPECTS = {
+        {"okay", OKAY},
+        {"fail", FAIL},
+        {"data", DATA},
+};
+
+static const std::unordered_map<Expect, std::string> EXPECTS_STR = {
+        {OKAY, "okay"},
+        {FAIL, "fail"},
+        {DATA, "data"},
+};
+
+struct Configuration {
+    struct GetVar {
+        std::string regex_str;
+        std::regex regex;
+        int line_num;
+
+        // So gtest can print me
+        friend ::std::ostream& operator<<(::std::ostream& os, const GetVar& self) {
+            return os << "<regex='" << self.regex_str << "' line_num=" << self.line_num << ">";
+        }
+    };
+    struct PartitionInfo {
+        enum TestConfig { NO = 0, NO_WRITES, YES };
+        bool hashable;
+        bool slots;   // Does it have slots
+        bool parsed;  // Does the bootloader do parsing on the img?
+        TestConfig test;
+
+        // So gtest can print me
+        friend ::std::ostream& operator<<(::std::ostream& os, const PartitionInfo& pinfo) {
+            return os << "<hashable=" << pinfo.hashable << " slots=" << pinfo.slots
+                      << " parsed=" << pinfo.parsed << ">";
+        }
+    };
+
+    struct PackedInfoTest {
+        Expect expect;  // Does it have slots
+        std::string packed_img;
+        std::string unpacked_dir;
+
+        // So gtest can print me
+        friend ::std::ostream& operator<<(::std::ostream& os, const PackedInfoTest& pinfo) {
+            return os << "<"
+                      << "expect=" << EXPECTS_STR.at(pinfo.expect)
+                      << " packed_img=" << pinfo.packed_img
+                      << " unpacked_dir=" << pinfo.unpacked_dir << ">";
+        }
+    };
+
+    struct PackedInfo {
+        bool slots;  // Does it have slots
+        std::unordered_set<std::string> children;
+        std::vector<PackedInfoTest> tests;
+    };
+
+    struct CommandTest {
+        std::string name;
+        int line_num;
+        std::string arg;
+        Expect expect;
+        std::string regex_str;
+        std::regex regex;
+        std::string input;
+        std::string output;
+        std::string validator;
+
+        // So gtest can print me
+        friend ::std::ostream& operator<<(::std::ostream& os, const CommandTest& self) {
+            return os << "test: " << self.name << " (line: " << self.line_num << ")";
+        }
+    };
+
+    struct OemCommand {
+        bool restricted;  // Does device need to be unlocked?
+        std::vector<CommandTest> tests;
+    };
+
+    std::unordered_map<std::string, GetVar> getvars;
+    std::unordered_map<std::string, PartitionInfo> partitions;
+    std::unordered_map<std::string, PackedInfo> packed;
+    std::unordered_map<std::string, OemCommand> oem;
+
+    std::string checksum;
+    std::string checksum_parser;
+};
+
+bool ParseXml(const std::string& file, Configuration* config);
+
+}  // namespace extension
+}  // namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/fixtures.cpp b/fastboot/fuzzy_fastboot/fixtures.cpp
new file mode 100644
index 0000000..0a87598
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/fixtures.cpp
@@ -0,0 +1,288 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <errno.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <termios.h>
+#include <unistd.h>
+#include <chrono>
+#include <cstdlib>
+#include <fstream>
+#include <map>
+#include <random>
+#include <regex>
+#include <set>
+#include <thread>
+#include <vector>
+
+#include <android-base/stringprintf.h>
+#include <gtest/gtest.h>
+
+#include "fastboot_driver.h"
+#include "usb.h"
+
+#include "extensions.h"
+#include "fixtures.h"
+#include "test_utils.h"
+#include "usb_transport_sniffer.h"
+
+namespace fastboot {
+
+int FastBootTest::MatchFastboot(usb_ifc_info* info, const char* local_serial) {
+    if (info->ifc_class != 0xff || info->ifc_subclass != 0x42 || info->ifc_protocol != 0x03) {
+        return -1;
+    }
+
+    cb_scratch = info->device_path;
+
+    // require matching serial number or device path if requested
+    // at the command line with the -s option.
+    if (local_serial && (strcmp(local_serial, info->serial_number) != 0 &&
+                         strcmp(local_serial, info->device_path) != 0))
+        return -1;
+    return 0;
+}
+
+bool FastBootTest::UsbStillAvailible() {
+    // For some reason someone decided to prefix the path with "usb:"
+    std::string prefix("usb:");
+    if (std::equal(prefix.begin(), prefix.end(), device_path.begin())) {
+        std::string fname(device_path.begin() + prefix.size(), device_path.end());
+        std::string real_path =
+                android::base::StringPrintf("/sys/bus/usb/devices/%s/serial", fname.c_str());
+        std::ifstream f(real_path.c_str());
+        return f.good();
+    }
+    exit(-1);  // This should never happen
+    return true;
+}
+
+RetCode FastBootTest::DownloadCommand(uint32_t size, std::string* response,
+                                      std::vector<std::string>* info) {
+    return fb->DownloadCommand(size, response, info);
+}
+
+RetCode FastBootTest::SendBuffer(const std::vector<char>& buf) {
+    return fb->SendBuffer(buf);
+}
+
+RetCode FastBootTest::HandleResponse(std::string* response, std::vector<std::string>* info,
+                                     int* dsize) {
+    return fb->HandleResponse(response, info, dsize);
+}
+
+void FastBootTest::SetUp() {
+    if (device_path != "") {               // make sure the device is still connected
+        ASSERT_TRUE(UsbStillAvailible());  // The device disconnected
+    }
+
+    const auto matcher = [](usb_ifc_info* info) -> int { return MatchFastboot(info, nullptr); };
+    for (int i = 0; i < MAX_USB_TRIES && !transport; i++) {
+        std::unique_ptr<UsbTransport> usb(usb_open(matcher, USB_TIMEOUT));
+        if (usb)
+            transport = std::unique_ptr<UsbTransportSniffer>(
+                    new UsbTransportSniffer(std::move(usb), serial_port));
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+
+    ASSERT_TRUE(transport);  // no nullptr
+
+    if (device_path == "") {  // We set it the first time, then make sure it never changes
+        device_path = cb_scratch;
+    } else {
+        ASSERT_EQ(device_path, cb_scratch);  // The path can not change
+    }
+    fb = std::unique_ptr<FastBootDriver>(
+            new FastBootDriver(transport.get(), [](std::string&) {}, true));
+}
+
+void FastBootTest::TearDown() {
+    EXPECT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+
+    TearDownSerial();
+
+    fb.reset();
+
+    if (transport) {
+        transport->Close();
+        transport.reset();
+    }
+
+    ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+}
+
+// TODO, this should eventually be piped to a file instead of stdout
+void FastBootTest::TearDownSerial() {
+    if (!transport) return;
+    // One last read from serial
+    transport->ProcessSerial();
+    if (HasFailure()) {
+        // TODO, print commands leading up
+        printf("<<<<<<<< TRACE BEGIN >>>>>>>>>\n");
+        printf("%s", transport->CreateTrace().c_str());
+        printf("<<<<<<<< TRACE END >>>>>>>>>\n");
+        // std::vector<std::pair<const TransferType, const std::vector<char>>>  prev =
+        // transport->Transfers();
+    }
+}
+
+void FastBootTest::SetLockState(bool unlock, bool assert_change) {
+    if (!fb) {
+        return;
+    }
+
+    std::string resp;
+    std::vector<std::string> info;
+    // To avoid risk of bricking device, make sure unlock ability is set to 1
+    ASSERT_EQ(fb->RawCommand("flashing get_unlock_ability", &resp, &info), SUCCESS)
+            << "'flashing get_unlock_ability' failed";
+
+    // There are two ways this can be reported, through info or the actual response
+    if (!resp.empty()) {  // must be in the info response
+        ASSERT_EQ(resp.back(), '1')
+                << "Unlock ability must be set to 1 to avoid bricking device, see "
+                   "'https://source.android.com/devices/bootloader/unlock-trusty'";
+    } else {
+        ASSERT_FALSE(info.empty()) << "'flashing get_unlock_ability' returned empty response";
+        ASSERT_FALSE(info.back().empty()) << "Expected non-empty info response";
+        ASSERT_EQ(info.back().back(), '1')
+                << "Unlock ability must be set to 1 to avoid bricking device, see "
+                   "'https://source.android.com/devices/bootloader/unlock-trusty'";
+    }
+
+    EXPECT_EQ(fb->GetVar("unlocked", &resp), SUCCESS) << "getvar:unlocked failed";
+    ASSERT_TRUE(resp == "no" || resp == "yes")
+            << "getvar:unlocked response was not 'no' or 'yes': " + resp;
+
+    if ((unlock && resp == "no") || (!unlock && resp == "yes")) {
+        std::string cmd = unlock ? "unlock" : "lock";
+        ASSERT_EQ(fb->RawCommand("flashing " + cmd, &resp), SUCCESS)
+                << "Attempting to change locked state, but 'flashing" + cmd + "' command failed";
+        fb.reset();
+        transport->Close();
+        transport.reset();
+        printf("PLEASE RESPOND TO PROMPT FOR '%sing' BOOTLOADER ON DEVICE\n", cmd.c_str());
+        while (UsbStillAvailible())
+            ;  // Wait for disconnect
+        printf("WAITING FOR DEVICE");
+        // Need to wait for device
+        const auto matcher = [](usb_ifc_info* info) -> int { return MatchFastboot(info, nullptr); };
+        while (!transport) {
+            std::unique_ptr<UsbTransport> usb(usb_open(matcher, USB_TIMEOUT));
+            if (usb) {
+                transport = std::unique_ptr<UsbTransportSniffer>(
+                        new UsbTransportSniffer(std::move(usb), serial_port));
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(1000));
+            putchar('.');
+        }
+        device_path = cb_scratch;
+        fb = std::unique_ptr<FastBootDriver>(
+                new FastBootDriver(transport.get(), [](std::string&) {}, true));
+        if (assert_change) {
+            ASSERT_EQ(fb->GetVar("unlocked", &resp), SUCCESS) << "getvar:unlocked failed";
+            ASSERT_EQ(resp, unlock ? "yes" : "no")
+                    << "getvar:unlocked response was not 'no' or 'yes': " + resp;
+        }
+        printf("SUCCESS\n");
+    }
+}
+
+std::string FastBootTest::device_path = "";
+std::string FastBootTest::cb_scratch = "";
+int FastBootTest::serial_port = 0;
+
+template <bool UNLOCKED>
+void ModeTest<UNLOCKED>::SetUp() {
+    ASSERT_NO_FATAL_FAILURE(FastBootTest::SetUp());
+    ASSERT_NO_FATAL_FAILURE(SetLockState(UNLOCKED));
+}
+// Need to instatiate it, so linker can find it later
+template class ModeTest<true>;
+template class ModeTest<false>;
+
+void Fuzz::TearDown() {
+    ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+
+    TearDownSerial();
+
+    std::string tmp;
+    if (fb->GetVar("product", &tmp) != SUCCESS) {
+        printf("DEVICE UNRESPONSE, attempting to recover...");
+        transport->Reset();
+        printf("issued USB reset...");
+
+        if (fb->GetVar("product", &tmp) != SUCCESS) {
+            printf("FAIL\n");
+            exit(-1);
+        }
+        printf("SUCCESS!\n");
+    }
+
+    if (transport) {
+        transport->Close();
+        transport.reset();
+    }
+
+    ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+}
+
+template <bool UNLOCKED>
+void ExtensionsPartition<UNLOCKED>::SetUp() {
+    ASSERT_NO_FATAL_FAILURE(FastBootTest::SetUp());
+    ASSERT_NO_FATAL_FAILURE(SetLockState(UNLOCKED));
+
+    if (!fb) {
+        return;
+    }
+    const std::string name = GetParam().first;
+
+    std::string var;
+    ASSERT_EQ(fb->GetVar("slot-count", &var), SUCCESS) << "Getting slot count failed";
+    int32_t num_slots = strtol(var.c_str(), nullptr, 10);
+    real_parts = GeneratePartitionNames(name, GetParam().second.slots ? num_slots : 0);
+
+    ASSERT_EQ(fb->GetVar("partition-size:" + real_parts.front(), &var), SUCCESS)
+            << "Getting partition size failed";
+    part_size = strtoll(var.c_str(), nullptr, 16);
+    ASSERT_GT(part_size, 0) << "Partition size reported was invalid";
+
+    ASSERT_EQ(fb->GetVar("max-download-size", &var), SUCCESS) << "Getting max download size failed";
+    max_dl = strtoll(var.c_str(), nullptr, 16);
+    ASSERT_GT(max_dl, 0) << "Max download size reported was invalid";
+
+    max_flash = std::min(part_size, max_dl);
+}
+template class ExtensionsPartition<true>;
+template class ExtensionsPartition<false>;
+
+}  // end namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/fixtures.h b/fastboot/fuzzy_fastboot/fixtures.h
new file mode 100644
index 0000000..efbf43c
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/fixtures.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#pragma once
+#include <gtest/gtest.h>
+
+#include "fastboot_driver.h"
+
+#include "extensions.h"
+#include "usb_transport_sniffer.h"
+
+namespace fastboot {
+
+const int USB_TIMEOUT = 30000;
+
+constexpr char USB_PORT_GONE[] =
+        "The USB port has disappeared, this is usually due to the bootloader crashing";
+
+class FastBootTest : public testing::Test {
+  public:
+    static int serial_port;
+    static constexpr int MAX_USB_TRIES = 10;
+
+    static int MatchFastboot(usb_ifc_info* info, const char* local_serial = nullptr);
+    bool UsbStillAvailible();
+
+  protected:
+    RetCode DownloadCommand(uint32_t size, std::string* response = nullptr,
+                            std::vector<std::string>* info = nullptr);
+
+    RetCode SendBuffer(const std::vector<char>& buf);
+    RetCode HandleResponse(std::string* response = nullptr,
+                           std::vector<std::string>* info = nullptr, int* dsize = nullptr);
+
+    void SetUp() override;
+    void TearDown() override;
+    void TearDownSerial();
+    void SetLockState(bool unlock, bool assert_change = true);
+
+    std::unique_ptr<UsbTransportSniffer> transport;
+    std::unique_ptr<FastBootDriver> fb;
+
+  private:
+    // This is an annoying hack
+    static std::string cb_scratch;
+    static std::string device_path;
+};
+
+template <bool UNLOCKED>
+class ModeTest : public FastBootTest {
+  protected:
+    void SetUp() override;
+};
+
+class Fuzz : public ModeTest<true> {
+  protected:
+    void TearDown() override;
+};
+
+// These derived classes without overrides serve no purpose other than to allow gtest to name them
+// differently
+class BasicFunctionality : public ModeTest<true> {};
+class Conformance : public ModeTest<true> {};
+class UnlockPermissions : public ModeTest<true> {};
+class LockPermissions : public ModeTest<false> {};
+
+// Magic C++ double inheritance
+class ExtensionsGetVarConformance
+    : public ModeTest<true>,
+      public ::testing::WithParamInterface<
+              std::pair<std::string, extension::Configuration::GetVar>> {};
+
+class ExtensionsOemConformance
+    : public ModeTest<true>,
+      public ::testing::WithParamInterface<
+              std::tuple<std::string, bool, extension::Configuration::CommandTest>> {};
+
+class ExtensionsPackedValid
+    : public ModeTest<true>,
+      public ::testing::WithParamInterface<
+              std::pair<std::string, extension::Configuration::PackedInfoTest>> {};
+
+class ExtensionsPackedInvalid
+    : public ModeTest<true>,
+      public ::testing::WithParamInterface<
+              std::pair<std::string, extension::Configuration::PackedInfoTest>> {};
+
+template <bool UNLOCKED>
+class ExtensionsPartition
+    : public FastBootTest,
+      public ::testing::WithParamInterface<
+              std::pair<std::string, extension::Configuration::PartitionInfo>> {
+  protected:
+    void SetUp() override;
+    int64_t part_size;
+    int64_t max_flash;
+    int64_t max_dl;
+    std::vector<std::string> real_parts;  // includes the slots
+};
+
+class AnyPartition : public ExtensionsPartition<true> {};
+class WriteablePartition : public ExtensionsPartition<true> {};
+class WriteHashablePartition : public ExtensionsPartition<true> {};
+class WriteHashNonParsedPartition : public ExtensionsPartition<true> {};
+
+class FuzzWriteablePartition : public ExtensionsPartition<true> {};
+class FuzzWriteableParsedPartition : public ExtensionsPartition<true> {};
+class FuzzAnyPartitionLocked : public ExtensionsPartition<false> {};
+
+class UserdataPartition : public ExtensionsPartition<true> {};
+
+}  // end namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/main.cpp b/fastboot/fuzzy_fastboot/main.cpp
new file mode 100644
index 0000000..8dd46bc
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/main.cpp
@@ -0,0 +1,1489 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include <errno.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <chrono>
+#include <cstdlib>
+#include <fstream>
+#include <map>
+#include <random>
+#include <regex>
+#include <set>
+#include <thread>
+#include <vector>
+
+#include <android-base/stringprintf.h>
+#include <gtest/gtest.h>
+#include <sparse/sparse.h>
+
+#include "fastboot_driver.h"
+#include "usb.h"
+
+#include "extensions.h"
+#include "fixtures.h"
+#include "test_utils.h"
+#include "usb_transport_sniffer.h"
+
+namespace fastboot {
+
+extension::Configuration config;  // The parsed XML config
+
+std::string SEARCH_PATH;
+std::string OUTPUT_PATH;
+
+// gtest's INSTANTIATE_TEST_CASE_P() must be at global scope,
+// so our autogenerated tests must be as well
+std::vector<std::pair<std::string, extension::Configuration::GetVar>> GETVAR_XML_TESTS;
+std::vector<std::tuple<std::string, bool, extension::Configuration::CommandTest>> OEM_XML_TESTS;
+std::vector<std::pair<std::string, extension::Configuration::PartitionInfo>> PARTITION_XML_TESTS;
+std::vector<std::pair<std::string, extension::Configuration::PartitionInfo>>
+        PARTITION_XML_WRITEABLE;
+std::vector<std::pair<std::string, extension::Configuration::PartitionInfo>>
+        PARTITION_XML_WRITE_HASHABLE;
+std::vector<std::pair<std::string, extension::Configuration::PartitionInfo>>
+        PARTITION_XML_WRITE_PARSED;
+std::vector<std::pair<std::string, extension::Configuration::PartitionInfo>>
+        PARTITION_XML_WRITE_HASH_NONPARSED;
+std::vector<std::pair<std::string, extension::Configuration::PartitionInfo>>
+        PARTITION_XML_USERDATA_CHECKSUM_WRITEABLE;
+std::vector<std::pair<std::string, extension::Configuration::PackedInfoTest>>
+        PACKED_XML_SUCCESS_TESTS;
+std::vector<std::pair<std::string, extension::Configuration::PackedInfoTest>> PACKED_XML_FAIL_TESTS;
+
+const std::string DEFAULT_OUPUT_NAME = "out.img";
+// const char scratch_partition[] = "userdata";
+const std::vector<std::string> CMDS{"boot",        "continue", "download:", "erase:",
+                                    "flash:",      "getvar:",  "powerdown", "reboot",
+                                    "set_active:", "upload",   "verify"};
+
+// For pretty printing we need all these overloads
+::std::ostream& operator<<(::std::ostream& os, const RetCode& ret) {
+    return os << FastBootDriver::RCString(ret);
+}
+
+bool PartitionHash(FastBootDriver* fb, const std::string& part, std::string* hash, int* retcode,
+                   std::string* err_msg) {
+    if (config.checksum.empty()) {
+        return -1;
+    }
+
+    std::string resp;
+    std::vector<std::string> info;
+    const std::string cmd = config.checksum + ' ' + part;
+    RetCode ret;
+    if ((ret = fb->RawCommand(cmd, &resp, &info)) != SUCCESS) {
+        *err_msg =
+                android::base::StringPrintf("Hashing partition with command '%s' failed with: %s",
+                                            cmd.c_str(), fb->RCString(ret).c_str());
+        return false;
+    }
+    std::stringstream imploded;
+    std::copy(info.begin(), info.end(), std::ostream_iterator<std::string>(imploded, "\n"));
+
+    // If payload, we validate that as well
+    const std::vector<std::string> args = SplitBySpace(config.checksum_parser);
+    std::vector<std::string> prog_args(args.begin() + 1, args.end());
+    prog_args.push_back(resp);                          // Pass in the full command
+    prog_args.push_back(SEARCH_PATH + imploded.str());  // Pass in the save location
+
+    int pipe;
+    pid_t pid = StartProgram(args[0], prog_args, &pipe);
+    if (pid <= 0) {
+        *err_msg = android::base::StringPrintf("Launching hash parser '%s' failed with: %s",
+                                               config.checksum_parser.c_str(), strerror(errno));
+        return false;
+    }
+    *retcode = WaitProgram(pid, pipe, hash);
+    if (*retcode) {
+        // In this case the stderr pipe is a log message
+        *err_msg = android::base::StringPrintf("Hash parser '%s' failed with: %s",
+                                               config.checksum_parser.c_str(), hash->c_str());
+        return false;
+    }
+
+    return true;
+}
+
+// Only allow alphanumeric, _, -, and .
+const auto not_allowed = [](char c) -> int {
+    return !(isalnum(c) || c == '_' || c == '-' || c == '.');
+};
+
+// Test that USB even works
+TEST(USBFunctionality, USBConnect) {
+    const auto matcher = [](usb_ifc_info* info) -> int {
+        return FastBootTest::MatchFastboot(info, nullptr);
+    };
+    Transport* transport = nullptr;
+    for (int i = 0; i < FastBootTest::MAX_USB_TRIES && !transport; i++) {
+        transport = usb_open(matcher);
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+    ASSERT_NE(transport, nullptr) << "Could not find the fastboot device after: "
+                                  << 10 * FastBootTest::MAX_USB_TRIES << "ms";
+    if (transport) {
+        transport->Close();
+        delete transport;
+    }
+}
+
+// Conformance tests
+TEST_F(Conformance, GetVar) {
+    std::string product;
+    EXPECT_EQ(fb->GetVar("product", &product), SUCCESS) << "getvar:product failed";
+    EXPECT_NE(product, "") << "getvar:product response was empty string";
+    EXPECT_EQ(std::count_if(product.begin(), product.end(), not_allowed), 0)
+            << "getvar:product response contained illegal chars";
+    EXPECT_LE(product.size(), FB_RESPONSE_SZ - 4) << "getvar:product response was too large";
+}
+
+TEST_F(Conformance, GetVarVersionBootloader) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("version-bootloader", &var), SUCCESS)
+            << "getvar:version-bootloader failed";
+    EXPECT_NE(var, "") << "getvar:version-bootloader response was empty string";
+    EXPECT_EQ(std::count_if(var.begin(), var.end(), not_allowed), 0)
+            << "getvar:version-bootloader response contained illegal chars";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4) << "getvar:version-bootloader response was too large";
+}
+
+TEST_F(Conformance, GetVarVersionBaseband) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("version-baseband", &var), SUCCESS) << "getvar:version-baseband failed";
+    EXPECT_NE(var, "") << "getvar:version-baseband response was empty string";
+    EXPECT_EQ(std::count_if(var.begin(), var.end(), not_allowed), 0)
+            << "getvar:version-baseband response contained illegal chars";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4) << "getvar:version-baseband response was too large";
+}
+
+TEST_F(Conformance, GetVarSerialNo) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("serialno", &var), SUCCESS) << "getvar:serialno failed";
+    EXPECT_NE(var, "") << "getvar:serialno can not be empty string";
+    EXPECT_EQ(std::count_if(var.begin(), var.end(), isalnum), var.size())
+            << "getvar:serialno must be alpha-numeric";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4) << "getvar:serialno response is too long";
+}
+
+TEST_F(Conformance, GetVarSecure) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("secure", &var), SUCCESS);
+    EXPECT_TRUE(var == "yes" || var == "no");
+}
+
+TEST_F(Conformance, GetVarOffModeCharge) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("off-mode-charge", &var), SUCCESS) << "getvar:off-mode-charge failed";
+    EXPECT_TRUE(var == "0" || var == "1") << "getvar:off-mode-charge response must be '0' or '1'";
+}
+
+TEST_F(Conformance, GetVarVariant) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("variant", &var), SUCCESS) << "getvar:variant failed";
+    EXPECT_NE(var, "") << "getvar:variant response can not be empty";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4) << "getvar:variant response is too large";
+}
+
+TEST_F(Conformance, GetVarRevision) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("hw-revision", &var), SUCCESS) << "getvar:hw-revision failed";
+    EXPECT_NE(var, "") << "getvar:battery-voltage response was empty";
+    EXPECT_EQ(std::count_if(var.begin(), var.end(), not_allowed), 0)
+            << "getvar:hw-revision contained illegal ASCII chars";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4) << "getvar:hw-revision response was too large";
+}
+
+TEST_F(Conformance, GetVarBattVoltage) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("battery-voltage", &var), SUCCESS) << "getvar:battery-voltage failed";
+    EXPECT_NE(var, "") << "getvar:battery-voltage response was empty";
+    EXPECT_EQ(std::count_if(var.begin(), var.end(), not_allowed), 0)
+            << "getvar:battery-voltage response contains illegal ASCII chars";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4)
+            << "getvar:battery-voltage response is too large: " + var;
+}
+
+TEST_F(Conformance, GetVarBattVoltageOk) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("battery-soc-ok", &var), SUCCESS) << "getvar:battery-soc-ok failed";
+    EXPECT_TRUE(var == "yes" || var == "no") << "getvar:battery-soc-ok must be 'yes' or 'no'";
+}
+
+TEST_F(Conformance, GetVarDownloadSize) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("max-download-size", &var), SUCCESS) << "getvar:max-download-size failed";
+    EXPECT_NE(var, "") << "getvar:max-download-size responded with empty string";
+    // This must start with 0x
+    EXPECT_FALSE(isspace(var.front()))
+            << "getvar:max-download-size responded with a string with leading whitespace";
+    EXPECT_FALSE(var.compare(0, 2, "0x"))
+            << "getvar:max-download-size responded with a string that does not start with 0x...";
+    int64_t size = strtoll(var.c_str(), nullptr, 16);
+    EXPECT_GT(size, 0) << "'" + var + "' is not a valid response from getvar:max-download-size";
+    // At most 32-bits
+    EXPECT_LE(size, std::numeric_limits<uint32_t>::max())
+            << "getvar:max-download-size must fit in a uint32_t";
+    EXPECT_LE(var.size(), FB_RESPONSE_SZ - 4)
+            << "getvar:max-download-size responded with too large of string: " + var;
+}
+
+TEST_F(Conformance, GetVarAll) {
+    std::vector<std::string> vars;
+    EXPECT_EQ(fb->GetVarAll(&vars), SUCCESS) << "getvar:all failed";
+    EXPECT_GT(vars.size(), 0) << "getvar:all did not respond with any INFO responses";
+    for (const auto s : vars) {
+        EXPECT_LE(s.size(), FB_RESPONSE_SZ - 4)
+                << "getvar:all included an INFO response: 'INFO" + s << "' which is too long";
+    }
+}
+
+TEST_F(Conformance, UnlockAbility) {
+    std::string resp;
+    std::vector<std::string> info;
+    EXPECT_EQ(fb->RawCommand("flashing get_unlock_ability", &resp, &info), SUCCESS)
+            << "'flashing get_unlock_ability' failed";
+    // There are two ways this can be reported, through info or the actual response
+    char last;
+    if (!resp.empty()) {  // must be in the response
+        last = resp.back();
+    } else {  // else must be in info
+        ASSERT_FALSE(info.empty()) << "'flashing get_unlock_ability' returned empty response";
+        ASSERT_FALSE(info.back().empty()) << "Expected non-empty info response";
+        last = info.back().back();
+    }
+    ASSERT_TRUE(last == '1' || last == '0') << "Unlock ability must report '0' or '1' in response";
+}
+
+TEST_F(Conformance, PartitionInfo) {
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    EXPECT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed";
+    EXPECT_GT(parts.size(), 0)
+            << "getvar:all did not report any partition-size: through INFO responses";
+    std::set<std::string> allowed{"ext4", "f2fs", "raw"};
+    for (const auto p : parts) {
+        EXPECT_GT(std::get<1>(p), 0);
+        std::string part(std::get<0>(p));
+        std::set<std::string> allowed{"ext4", "f2fs", "raw"};
+        std::string resp;
+        EXPECT_EQ(fb->GetVar("partition-type:" + part, &resp), SUCCESS);
+        EXPECT_NE(allowed.find(resp), allowed.end()) << "getvar:partition-type:" + part << " was '"
+                                                     << resp << "' this is not a valid type";
+        const std::string cmd = "partition-size:" + part;
+        EXPECT_EQ(fb->GetVar(cmd, &resp), SUCCESS);
+
+        // This must start with 0x
+        EXPECT_FALSE(isspace(resp.front()))
+                << cmd + " responded with a string with leading whitespace";
+        EXPECT_FALSE(resp.compare(0, 2, "0x"))
+                << cmd + "responded with a string that does not start with 0x...";
+        int64_t size = strtoll(resp.c_str(), nullptr, 16);
+        EXPECT_GT(size, 0) << "'" + resp + "' is not a valid response from " + cmd;
+    }
+}
+
+TEST_F(Conformance, Slots) {
+    std::string var;
+    ASSERT_EQ(fb->GetVar("slot-count", &var), SUCCESS) << "getvar:slot-count failed";
+    ASSERT_EQ(std::count_if(var.begin(), var.end(), isdigit), var.size())
+            << "'" << var << "' is not all digits which it should be for getvar:slot-count";
+    int32_t num_slots = strtol(var.c_str(), nullptr, 10);
+
+    // Can't run out of alphabet letters...
+    ASSERT_LE(num_slots, 26) << "What?! You can't have more than 26 slots";
+
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    EXPECT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed";
+
+    std::map<std::string, std::set<char>> part_slots;
+    if (num_slots > 0) {
+        EXPECT_EQ(fb->GetVar("current-slot", &var), SUCCESS) << "getvar:current-slot failed";
+
+        for (const auto p : parts) {
+            std::string part(std::get<0>(p));
+            std::regex reg("([[:graph:]]*)_([[:lower:]])");
+            std::smatch sm;
+
+            if (std::regex_match(part, sm, reg)) {  // This partition has slots
+                std::string part_base(sm[1]);
+                std::string slot(sm[2]);
+                EXPECT_EQ(fb->GetVar("has-slot:" + part_base, &var), SUCCESS)
+                        << "'getvar:has-slot:" << part_base << "' failed";
+                EXPECT_EQ(var, "yes") << "'getvar:has-slot:" << part_base << "' was not 'yes'";
+                EXPECT_TRUE(islower(slot.front()))
+                        << "'" << slot.front() << "' is an invalid slot-suffix for " << part_base;
+                std::set<char> tmp{slot.front()};
+                part_slots.emplace(part_base, tmp);
+                part_slots.at(part_base).insert(slot.front());
+            } else {
+                EXPECT_EQ(fb->GetVar("has-slot:" + part, &var), SUCCESS)
+                        << "'getvar:has-slot:" << part << "' failed";
+                EXPECT_EQ(var, "no") << "'getvar:has-slot:" << part << "' should be no";
+            }
+        }
+        // Ensure each partition has the correct slot suffix
+        for (const auto iter : part_slots) {
+            const std::set<char>& char_set = iter.second;
+            std::string chars;
+            for (char c : char_set) {
+                chars += c;
+                chars += ',';
+            }
+            EXPECT_EQ(char_set.size(), num_slots)
+                    << "There should only be slot suffixes from a to " << 'a' + num_slots - 1
+                    << " instead encountered: " << chars;
+            for (const char c : char_set) {
+                EXPECT_GE(c, 'a') << "Encountered invalid slot suffix of '" << c << "'";
+                EXPECT_LT(c, 'a' + num_slots) << "Encountered invalid slot suffix of '" << c << "'";
+            }
+        }
+    }
+}
+
+TEST_F(Conformance, SetActive) {
+    std::string var;
+    ASSERT_EQ(fb->GetVar("slot-count", &var), SUCCESS) << "getvar:slot-count failed";
+    ASSERT_EQ(std::count_if(var.begin(), var.end(), isdigit), var.size())
+            << "'" << var << "' is not all digits which it should be for getvar:slot-count";
+    int32_t num_slots = strtol(var.c_str(), nullptr, 10);
+
+    // Can't run out of alphabet letters...
+    ASSERT_LE(num_slots, 26) << "You can't have more than 26 slots";
+
+    for (char c = 'a'; c < 'a' + num_slots; c++) {
+        const std::string slot(&c, &c + 1);
+        ASSERT_EQ(fb->SetActive(slot), SUCCESS) << "Set active for slot '" << c << "' failed";
+        ASSERT_EQ(fb->GetVar("current-slot", &var), SUCCESS) << "getvar:current-slot failed";
+        EXPECT_EQ(var, slot) << "getvar:current-slot repots incorrect slot after setting it";
+    }
+}
+
+TEST_F(Conformance, LockAndUnlockPrompt) {
+    std::string resp;
+    ASSERT_EQ(fb->GetVar("unlocked", &resp), SUCCESS) << "getvar:unlocked failed";
+    ASSERT_TRUE(resp == "yes" || resp == "no")
+            << "Device did not respond with 'yes' or 'no' for getvar:unlocked";
+    bool curr = resp == "yes";
+
+    for (int i = 0; i < 2; i++) {
+        std::string action = !curr ? "unlock" : "lock";
+        printf("Device should prompt to '%s' bootloader, select 'no'\n", action.c_str());
+        SetLockState(!curr, false);
+        ASSERT_EQ(fb->GetVar("unlocked", &resp), SUCCESS) << "getvar:unlocked failed";
+        ASSERT_EQ(resp, curr ? "yes" : "no") << "The locked/unlocked state of the bootloader "
+                                                "incorrectly changed after selecting no";
+        printf("Device should prompt to '%s' bootloader, select 'yes'\n", action.c_str());
+        SetLockState(!curr, true);
+        ASSERT_EQ(fb->GetVar("unlocked", &resp), SUCCESS) << "getvar:unlocked failed";
+        ASSERT_EQ(resp, !curr ? "yes" : "no") << "The locked/unlocked state of the bootloader "
+                                                 "failed to change after selecting yes";
+        curr = !curr;
+    }
+}
+
+TEST_F(Conformance, SparseBlockSupport0) {
+    // The sparse block size can be any multiple of 4
+    std::string var;
+    EXPECT_EQ(fb->GetVar("max-download-size", &var), SUCCESS) << "getvar:max-download-size failed";
+    int64_t size = strtoll(var.c_str(), nullptr, 16);
+
+    // It is reasonable to expect it to handle a single dont care block equal to its DL size
+    for (int64_t bs = 4; bs < size; bs <<= 1) {
+        SparseWrapper sparse(bs, bs);
+        ASSERT_TRUE(*sparse) << "Sparse file creation failed on: " << bs;
+        EXPECT_EQ(fb->Download(*sparse), SUCCESS) << "Download sparse failed: " << sparse.Rep();
+        EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+        EXPECT_EQ(fb->Download(*sparse, true), SUCCESS)
+                << "Download sparse with crc failed: " << sparse.Rep();
+        EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+    }
+}
+
+TEST_F(Conformance, SparseBlockSupport1) {
+    // The sparse block size can be any multiple of 4
+    std::string var;
+    EXPECT_EQ(fb->GetVar("max-download-size", &var), SUCCESS) << "getvar:max-download-size failed";
+    int64_t size = strtoll(var.c_str(), nullptr, 16);
+
+    // handle a packed block to half its max download size block
+    for (int64_t bs = 4; bs < size / 2; bs <<= 1) {
+        SparseWrapper sparse(bs, bs);
+        ASSERT_TRUE(*sparse) << "Sparse file creation failed on: " << bs;
+        std::vector<char> buf = RandomBuf(bs);
+        ASSERT_EQ(sparse_file_add_data(*sparse, buf.data(), buf.size(), 0), 0)
+                << "Adding data failed to sparse file: " << sparse.Rep();
+        EXPECT_EQ(fb->Download(*sparse), SUCCESS) << "Download sparse failed: " << sparse.Rep();
+        EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+        EXPECT_EQ(fb->Download(*sparse, true), SUCCESS)
+                << "Download sparse with crc failed: " << sparse.Rep();
+        EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+    }
+}
+
+// A single don't care download
+TEST_F(Conformance, SparseDownload0) {
+    SparseWrapper sparse(4096, 4096);
+    ASSERT_TRUE(*sparse) << "Sparse image creation failed";
+    EXPECT_EQ(fb->Download(*sparse), SUCCESS) << "Download sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Download(*sparse, true), SUCCESS)
+            << "Download sparse with crc failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+}
+
+TEST_F(Conformance, SparseDownload1) {
+    SparseWrapper sparse(4096, 10 * 4096);
+    ASSERT_TRUE(*sparse) << "Sparse image creation failed";
+    std::vector<char> buf = RandomBuf(4096);
+    ASSERT_EQ(sparse_file_add_data(*sparse, buf.data(), buf.size(), 9), 0)
+            << "Adding data failed to sparse file: " << sparse.Rep();
+    EXPECT_EQ(fb->Download(*sparse), SUCCESS) << "Download sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Download(*sparse, true), SUCCESS)
+            << "Download sparse with crc failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+}
+
+TEST_F(Conformance, SparseDownload2) {
+    SparseWrapper sparse(4096, 4097);
+    ASSERT_TRUE(*sparse) << "Sparse image creation failed";
+    std::vector<char> buf = RandomBuf(4096);
+    ASSERT_EQ(sparse_file_add_data(*sparse, buf.data(), buf.size(), 0), 0)
+            << "Adding data failed to sparse file: " << sparse.Rep();
+    std::vector<char> buf2 = RandomBuf(1);
+    ASSERT_EQ(sparse_file_add_data(*sparse, buf.data(), buf.size(), 1), 0)
+            << "Adding data failed to sparse file: " << sparse.Rep();
+    EXPECT_EQ(fb->Download(*sparse), SUCCESS) << "Download sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Download(*sparse, true), SUCCESS)
+            << "Download sparse with crc failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+}
+
+TEST_F(Conformance, SparseDownload3) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("max-download-size", &var), SUCCESS) << "getvar:max-download-size failed";
+    int size = strtoll(var.c_str(), nullptr, 16);
+
+    SparseWrapper sparse(4096, size);
+    ASSERT_TRUE(*sparse) << "Sparse image creation failed";
+    // Don't want this to take forever
+    unsigned num_chunks = std::min(1000, size / (2 * 4096));
+    for (int i = 0; i < num_chunks; i++) {
+        std::vector<char> buf;
+        int r = random_int(0, 2);
+        // Three cases
+        switch (r) {
+            case 0:
+                break;  // Dont Care chunnk
+            case 1:     // Buffer
+                buf = RandomBuf(4096);
+                ASSERT_EQ(sparse_file_add_data(*sparse, buf.data(), buf.size(), i), 0)
+                        << "Adding data failed to sparse file: " << sparse.Rep();
+                break;
+            case 2:  // fill
+                ASSERT_EQ(sparse_file_add_fill(*sparse, 0xdeadbeef, 4096, i), 0)
+                        << "Adding fill to sparse file failed: " << sparse.Rep();
+                break;
+        }
+    }
+    EXPECT_EQ(fb->Download(*sparse), SUCCESS) << "Download sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Download(*sparse, true), SUCCESS)
+            << "Download sparse with crc failed: " << sparse.Rep();
+    EXPECT_EQ(fb->Flash("userdata"), SUCCESS) << "Flashing sparse failed: " << sparse.Rep();
+}
+
+TEST_F(UnlockPermissions, Download) {
+    std::vector<char> buf{'a', 'o', 's', 'p'};
+    EXPECT_EQ(fb->Download(buf), SUCCESS) << "Download 4-byte payload failed";
+}
+
+TEST_F(UnlockPermissions, DownloadFlash) {
+    std::vector<char> buf{'a', 'o', 's', 'p'};
+    EXPECT_EQ(fb->Download(buf), SUCCESS) << "Download failed in unlocked mode";
+    ;
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    EXPECT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed in unlocked mode";
+}
+
+TEST_F(LockPermissions, DownloadFlash) {
+    std::vector<char> buf{'a', 'o', 's', 'p'};
+    EXPECT_EQ(fb->Download(buf), SUCCESS) << "Download failed in locked mode";
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    EXPECT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed in locked mode";
+    std::string resp;
+    for (const auto tup : parts) {
+        EXPECT_EQ(fb->Flash(std::get<0>(tup), &resp), DEVICE_FAIL)
+                << "Device did not respond with FAIL when trying to flash '" << std::get<0>(tup)
+                << "' in locked mode";
+        EXPECT_GT(resp.size(), 0)
+                << "Device sent empty error message after FAIL";  // meaningful error message
+    }
+}
+
+TEST_F(LockPermissions, Erase) {
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    EXPECT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed";
+    std::string resp;
+    for (const auto tup : parts) {
+        EXPECT_EQ(fb->Erase(std::get<0>(tup), &resp), DEVICE_FAIL)
+                << "Device did not respond with FAIL when trying to erase '" << std::get<0>(tup)
+                << "' in locked mode";
+        EXPECT_GT(resp.size(), 0) << "Device sent empty error message after FAIL";
+    }
+}
+
+TEST_F(LockPermissions, SetActive) {
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    EXPECT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed";
+
+    std::string resp;
+    EXPECT_EQ(fb->GetVar("slot-count", &resp), SUCCESS) << "getvar:slot-count failed";
+    int32_t num_slots = strtol(resp.c_str(), nullptr, 10);
+
+    for (const auto tup : parts) {
+        std::string part(std::get<0>(tup));
+        std::regex reg("([[:graph:]]*)_([[:lower:]])");
+        std::smatch sm;
+
+        if (std::regex_match(part, sm, reg)) {  // This partition has slots
+            std::string part_base(sm[1]);
+            for (char c = 'a'; c < 'a' + num_slots; c++) {
+                // We should not be able to SetActive any of these
+                EXPECT_EQ(fb->SetActive(part_base + '_' + c, &resp), DEVICE_FAIL)
+                        << "set:active:" << part_base + '_' + c << " did not fail in locked mode";
+            }
+        }
+    }
+}
+
+TEST_F(LockPermissions, Boot) {
+    std::vector<char> buf;
+    buf.resize(1000);
+    EXPECT_EQ(fb->Download(buf), SUCCESS) << "A 1000 byte download failed";
+    std::string resp;
+    ASSERT_EQ(fb->Boot(&resp), DEVICE_FAIL)
+            << "The device did not respond with failure for 'boot' when locked";
+    EXPECT_GT(resp.size(), 0) << "No error message was returned by device after FAIL";
+}
+
+TEST_F(Fuzz, DownloadSize) {
+    std::string var;
+    EXPECT_EQ(fb->GetVar("max-download-size", &var), SUCCESS) << "getvar:max-download-size failed";
+    int64_t size = strtoll(var.c_str(), nullptr, 0);
+    EXPECT_GT(size, 0) << '\'' << var << "' is not a valid response for getvar:max-download-size";
+
+    EXPECT_EQ(DownloadCommand(size + 1), DEVICE_FAIL)
+            << "Device reported max-download-size as '" << size
+            << "' but did not reject a download of " << size + 1;
+
+    std::vector<char> buf(size);
+    EXPECT_EQ(fb->Download(buf), SUCCESS) << "Device reported max-download-size as '" << size
+                                          << "' but downloading a payload of this size failed";
+    ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+}
+
+TEST_F(Fuzz, DownloadPartialBuf) {
+    std::vector<char> buf{'a', 'o', 's', 'p'};
+    ASSERT_EQ(DownloadCommand(buf.size() + 1), SUCCESS)
+            << "Download command for " << buf.size() + 1 << " bytes failed";
+
+    std::string resp;
+    RetCode ret = SendBuffer(buf);
+    EXPECT_EQ(ret, SUCCESS) << "Device did not accept partial payload download";
+    // Send the partial buffer, then cancel it with a reset
+    EXPECT_EQ(transport->Reset(), 0) << "USB reset failed";
+
+    ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+    // The device better still work after all that if we unplug and replug
+    EXPECT_EQ(fb->GetVar("product", &resp), SUCCESS) << "getvar:product failed";
+}
+
+TEST_F(Fuzz, DownloadOverRun) {
+    std::vector<char> buf(1000, 'F');
+    ASSERT_EQ(DownloadCommand(10), SUCCESS) << "Device rejected download request for 10 bytes";
+    // There are two ways to handle this
+    // Accept download, but send error response
+    // Reject the download outright
+    std::string resp;
+    RetCode ret = SendBuffer(buf);
+    if (ret == SUCCESS) {
+        // If it accepts the buffer, it better send back an error response
+        EXPECT_EQ(HandleResponse(&resp), DEVICE_FAIL)
+                << "After sending too large of a payload for a download command, device accepted "
+                   "payload and did not respond with FAIL";
+    } else {
+        EXPECT_EQ(ret, IO_ERROR) << "After sending too large of a payload for a download command, "
+                                    "device did not return error";
+    }
+
+    ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+    // The device better still work after all that if we unplug and replug
+    EXPECT_EQ(transport->Reset(), 0) << "USB reset failed";
+    EXPECT_EQ(fb->GetVar("product", &resp), SUCCESS)
+            << "Device did not respond with SUCCESS to getvar:product.";
+}
+
+TEST_F(Fuzz, DownloadInvalid1) {
+    EXPECT_EQ(DownloadCommand(0), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command 'download:0'";
+}
+
+TEST_F(Fuzz, DownloadInvalid2) {
+    std::string cmd("download:1");
+    EXPECT_EQ(fb->RawCommand("download:1"), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, DownloadInvalid3) {
+    std::string cmd("download:-1");
+    EXPECT_EQ(fb->RawCommand("download:-1"), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, DownloadInvalid4) {
+    std::string cmd("download:-01000000");
+    EXPECT_EQ(fb->RawCommand(cmd), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, DownloadInvalid5) {
+    std::string cmd("download:-0100000");
+    EXPECT_EQ(fb->RawCommand(cmd), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, DownloadInvalid6) {
+    std::string cmd("download:");
+    EXPECT_EQ(fb->RawCommand(cmd), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, DownloadInvalid7) {
+    std::string cmd("download:01000000\0999", sizeof("download:01000000\0999"));
+    EXPECT_EQ(fb->RawCommand(cmd), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, DownloadInvalid8) {
+    std::string cmd("download:01000000\0dkjfvijafdaiuybgidabgybr",
+                    sizeof("download:01000000\0dkjfvijafdaiuybgidabgybr"));
+    EXPECT_EQ(fb->RawCommand(cmd), DEVICE_FAIL)
+            << "Device did not respond with FAIL for malformed download command '" << cmd << "'";
+}
+
+TEST_F(Fuzz, GetVarAllSpam) {
+    auto start = std::chrono::high_resolution_clock::now();
+    std::chrono::duration<double> elapsed;
+    unsigned i = 1;
+    do {
+        std::vector<std::string> vars;
+        ASSERT_EQ(fb->GetVarAll(&vars), SUCCESS) << "Device did not respond with success after "
+                                                 << i << "getvar:all commands in a row";
+        ASSERT_GT(vars.size(), 0)
+                << "Device did not send any INFO responses after getvar:all command";
+        elapsed = std::chrono::high_resolution_clock::now() - start;
+    } while (i++, elapsed.count() < 5);
+}
+
+TEST_F(Fuzz, BadCommandTooLarge) {
+    std::string s = RandomString(fastboot::FB_COMMAND_SZ + 1, rand_legal);
+    EXPECT_EQ(fb->RawCommand(s), DEVICE_FAIL)
+            << "Device did not respond with failure after sending length " << s.size()
+            << " string of random ASCII chars";
+    std::string s1 = RandomString(1000, rand_legal);
+    EXPECT_EQ(fb->RawCommand(s1), DEVICE_FAIL)
+            << "Device did not respond with failure after sending length " << s1.size()
+            << " string of random ASCII chars";
+    std::string s2 = RandomString(1000, rand_illegal);
+    EXPECT_EQ(fb->RawCommand(s2), DEVICE_FAIL)
+            << "Device did not respond with failure after sending length " << s1.size()
+            << " string of random non-ASCII chars";
+    std::string s3 = RandomString(1000, rand_char);
+    EXPECT_EQ(fb->RawCommand(s3), DEVICE_FAIL)
+            << "Device did not respond with failure after sending length " << s1.size()
+            << " string of random chars";
+}
+
+TEST_F(Fuzz, CommandTooLarge) {
+    for (const std::string& s : CMDS) {
+        std::string rs = RandomString(1000, rand_char);
+        EXPECT_EQ(fb->RawCommand(s + rs), DEVICE_FAIL)
+                << "Device did not respond with failure after '" << s + rs << "'";
+        ASSERT_TRUE(UsbStillAvailible()) << USB_PORT_GONE;
+        std::string resp;
+        EXPECT_EQ(fb->GetVar("product", &resp), SUCCESS)
+                << "Device is unresponsive to getvar command";
+    }
+}
+
+TEST_F(Fuzz, CommandMissingArgs) {
+    for (const std::string& s : CMDS) {
+        if (s.back() == ':') {
+            EXPECT_EQ(fb->RawCommand(s), DEVICE_FAIL)
+                    << "Device did not respond with failure after '" << s << "'";
+            std::string sub(s.begin(), s.end() - 1);
+            EXPECT_EQ(fb->RawCommand(sub), DEVICE_FAIL)
+                    << "Device did not respond with failure after '" << sub << "'";
+        } else {
+            std::string rs = RandomString(10, rand_illegal);
+            EXPECT_EQ(fb->RawCommand(rs + s), DEVICE_FAIL)
+                    << "Device did not respond with failure after '" << rs + s << "'";
+        }
+        std::string resp;
+        EXPECT_EQ(fb->GetVar("product", &resp), SUCCESS)
+                << "Device is unresponsive to getvar command";
+    }
+}
+
+TEST_F(Fuzz, USBResetSpam) {
+    auto start = std::chrono::high_resolution_clock::now();
+    std::chrono::duration<double> elapsed;
+    int i = 0;
+    do {
+        ASSERT_EQ(transport->Reset(), 0) << "USB Reset failed after " << i << " resets in a row";
+        elapsed = std::chrono::high_resolution_clock::now() - start;
+    } while (i++, elapsed.count() < 5);
+    std::string resp;
+    EXPECT_EQ(fb->GetVar("product", &resp), SUCCESS)
+            << "getvar failed after " << i << " USB reset(s) in a row";
+}
+
+TEST_F(Fuzz, USBResetCommandSpam) {
+    auto start = std::chrono::high_resolution_clock::now();
+    std::chrono::duration<double> elapsed;
+    do {
+        std::string resp;
+        std::vector<std::string> all;
+        ASSERT_EQ(transport->Reset(), 0) << "USB Reset failed";
+        EXPECT_EQ(fb->GetVarAll(&all), SUCCESS) << "getvar:all failed after USB reset";
+        EXPECT_EQ(fb->GetVar("product", &resp), SUCCESS) << "getvar:product failed";
+        elapsed = std::chrono::high_resolution_clock::now() - start;
+    } while (elapsed.count() < 10);
+}
+
+TEST_F(Fuzz, USBResetAfterDownload) {
+    std::vector<char> buf;
+    buf.resize(1000000);
+    EXPECT_EQ(DownloadCommand(buf.size()), SUCCESS) << "Download command failed";
+    EXPECT_EQ(transport->Reset(), 0) << "USB Reset failed";
+    std::vector<std::string> all;
+    EXPECT_EQ(fb->GetVarAll(&all), SUCCESS) << "getvar:all failed after USB reset.";
+}
+
+// Getvar XML tests
+TEST_P(ExtensionsGetVarConformance, VarExists) {
+    std::string resp;
+    EXPECT_EQ(fb->GetVar(GetParam().first, &resp), SUCCESS);
+}
+
+TEST_P(ExtensionsGetVarConformance, VarMatchesRegex) {
+    std::string resp;
+    ASSERT_EQ(fb->GetVar(GetParam().first, &resp), SUCCESS);
+    std::smatch sm;
+    std::regex_match(resp, sm, GetParam().second.regex);
+    EXPECT_FALSE(sm.empty()) << "The regex did not match";
+}
+
+INSTANTIATE_TEST_CASE_P(XMLGetVar, ExtensionsGetVarConformance,
+                        ::testing::ValuesIn(GETVAR_XML_TESTS));
+
+TEST_P(AnyPartition, ReportedGetVarAll) {
+    // As long as the partition is reported in INFO, it would be tested by generic Conformance
+    std::vector<std::tuple<std::string, uint32_t>> parts;
+    ASSERT_EQ(fb->Partitions(&parts), SUCCESS) << "getvar:all failed";
+    const std::string name = GetParam().first;
+    if (GetParam().second.slots) {
+        auto matcher = [&](const std::tuple<std::string, uint32_t>& tup) {
+            return std::get<0>(tup) == name + "_a";
+        };
+        EXPECT_NE(std::find_if(parts.begin(), parts.end(), matcher), parts.end())
+                << "partition '" + name + "_a' not reported in getvar:all";
+    } else {
+        auto matcher = [&](const std::tuple<std::string, uint32_t>& tup) {
+            return std::get<0>(tup) == name;
+        };
+        EXPECT_NE(std::find_if(parts.begin(), parts.end(), matcher), parts.end())
+                << "partition '" + name + "' not reported in getvar:all";
+    }
+}
+
+TEST_P(AnyPartition, Hashable) {
+    const std::string name = GetParam().first;
+    if (!config.checksum.empty()) {  // We can use hash to validate
+        for (const auto& part_name : real_parts) {
+            // Get hash
+            std::string hash;
+            int retcode;
+            std::string err_msg;
+            if (GetParam().second.hashable) {
+                ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash, &retcode, &err_msg))
+                        << err_msg;
+                EXPECT_EQ(retcode, 0) << err_msg;
+            } else {  // Make sure it fails
+                const std::string cmd = config.checksum + ' ' + part_name;
+                EXPECT_EQ(fb->RawCommand(cmd), DEVICE_FAIL)
+                        << part_name + " is marked as non-hashable, but hashing did not fail";
+            }
+        }
+    }
+}
+
+TEST_P(WriteablePartition, FlashCheck) {
+    const std::string name = GetParam().first;
+    auto part_info = GetParam().second;
+
+    for (const auto& part_name : real_parts) {
+        std::vector<char> buf = RandomBuf(max_flash, rand_char);
+        EXPECT_EQ(fb->FlashPartition(part_name, buf), part_info.parsed ? DEVICE_FAIL : SUCCESS)
+                << "A partition with an image parsed by the bootloader should reject random "
+                   "garbage "
+                   "otherwise it should succeed";
+    }
+}
+
+TEST_P(WriteablePartition, EraseCheck) {
+    const std::string name = GetParam().first;
+
+    for (const auto& part_name : real_parts) {
+        ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+    }
+}
+
+TEST_P(WriteHashNonParsedPartition, EraseZerosData) {
+    const std::string name = GetParam().first;
+
+    for (const auto& part_name : real_parts) {
+        std::string err_msg;
+        int retcode;
+        const std::vector<char> buf = RandomBuf(max_flash, rand_char);
+        // Partition is too big to write to entire thing
+        // This can eventually be supported by using sparse images if too large
+        if (max_flash < part_size) {
+            std::string hash_before, hash_after;
+            ASSERT_EQ(fb->FlashPartition(part_name, buf), SUCCESS);
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_before, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_NE(hash_before, hash_after)
+                    << "The partition hash for " + part_name +
+                               " did not change after erasing a known value";
+        } else {
+            std::string hash_zeros, hash_ones, hash_middle, hash_after;
+            const std::vector<char> buf_zeros(max_flash, 0);
+            const std::vector<char> buf_ones(max_flash, -1);  // All bits are set to 1
+            ASSERT_EQ(fb->FlashPartition(part_name, buf_zeros), SUCCESS);
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_zeros, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            ASSERT_EQ(fb->FlashPartition(part_name, buf_ones), SUCCESS);
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_ones, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            ASSERT_NE(hash_zeros, hash_ones)
+                    << "Hashes of partion should not be the same when all bytes are 0xFF or 0x00";
+            ASSERT_EQ(fb->FlashPartition(part_name, buf), SUCCESS);
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_middle, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            ASSERT_NE(hash_zeros, hash_middle)
+                    << "Hashes of partion are the same when all bytes are 0x00 or test payload";
+            ASSERT_NE(hash_ones, hash_middle)
+                    << "Hashes of partion are the same when all bytes are 0xFF or test payload";
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_TRUE(hash_zeros == hash_after || hash_ones == hash_after)
+                    << "Erasing " + part_name + " should set all the bytes to 0xFF or 0x00";
+        }
+    }
+}
+
+// Only partitions that we can write and hash (name, fixture), TEST_P is (Fixture, test_name)
+INSTANTIATE_TEST_CASE_P(XMLPartitionsWriteHashNonParsed, WriteHashNonParsedPartition,
+                        ::testing::ValuesIn(PARTITION_XML_WRITE_HASH_NONPARSED));
+
+INSTANTIATE_TEST_CASE_P(XMLPartitionsWriteHashable, WriteHashablePartition,
+                        ::testing::ValuesIn(PARTITION_XML_WRITE_HASHABLE));
+
+// only partitions writeable
+INSTANTIATE_TEST_CASE_P(XMLPartitionsWriteable, WriteablePartition,
+                        ::testing::ValuesIn(PARTITION_XML_WRITEABLE));
+
+// Every partition
+INSTANTIATE_TEST_CASE_P(XMLPartitionsAll, AnyPartition, ::testing::ValuesIn(PARTITION_XML_TESTS));
+
+// Partition Fuzz tests
+TEST_P(FuzzWriteablePartition, BoundsCheck) {
+    const std::string name = GetParam().first;
+    auto part_info = GetParam().second;
+
+    for (const auto& part_name : real_parts) {
+        // try and flash +1 too large, first erase and get a hash, make sure it does not change
+        std::vector<char> buf = RandomBuf(max_flash + 1);  // One too large
+        if (part_info.hashable) {
+            std::string hash_before, hash_after, err_msg;
+            int retcode;
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_before, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "Flashing an image 1 byte too large to " + part_name + " did not fail";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(hash_before, hash_after)
+                    << "Flashing too large of an image resulted in a changed partition hash for " +
+                               part_name;
+        } else {
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "Flashing an image 1 byte too large to " + part_name + " did not fail";
+        }
+    }
+}
+
+INSTANTIATE_TEST_CASE_P(XMLFuzzPartitionsWriteable, FuzzWriteablePartition,
+                        ::testing::ValuesIn(PARTITION_XML_WRITEABLE));
+
+// A parsed partition should have magic and such that is checked by the bootloader
+// Attempting to flash a random single byte should definately fail
+TEST_P(FuzzWriteableParsedPartition, FlashGarbageImageSmall) {
+    const std::string name = GetParam().first;
+    auto part_info = GetParam().second;
+
+    for (const auto& part_name : real_parts) {
+        std::vector<char> buf = RandomBuf(1);
+        if (part_info.hashable) {
+            std::string hash_before, hash_after, err_msg;
+            int retcode;
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_before, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should fail on a single byte";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(hash_before, hash_after)
+                    << "Flashing a single byte to parsed partition  " + part_name +
+                               " should fail and not change the partition hash";
+        } else {
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "Flashing a 1 byte image to a parsed partition should fail";
+        }
+    }
+}
+
+TEST_P(FuzzWriteableParsedPartition, FlashGarbageImageLarge) {
+    const std::string name = GetParam().first;
+    auto part_info = GetParam().second;
+
+    for (const auto& part_name : real_parts) {
+        std::vector<char> buf = RandomBuf(max_flash);
+        if (part_info.hashable) {
+            std::string hash_before, hash_after, err_msg;
+            int retcode;
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_before, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should not accept randomly generated images";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(hash_before, hash_after)
+                    << "The hash of the partition has changed after attempting to flash garbage to "
+                       "a parsed partition";
+        } else {
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should not accept randomly generated images";
+        }
+    }
+}
+
+TEST_P(FuzzWriteableParsedPartition, FlashGarbageImageLarge2) {
+    const std::string name = GetParam().first;
+    auto part_info = GetParam().second;
+
+    for (const auto& part_name : real_parts) {
+        std::vector<char> buf(max_flash, -1);  // All 1's
+        if (part_info.hashable) {
+            std::string hash_before, hash_after, err_msg;
+            int retcode;
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_before, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should not accept a image of all 0xFF";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(hash_before, hash_after)
+                    << "The hash of the partition has changed after attempting to flash garbage to "
+                       "a parsed partition";
+        } else {
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should not accept a image of all 0xFF";
+        }
+    }
+}
+
+TEST_P(FuzzWriteableParsedPartition, FlashGarbageImageLarge3) {
+    const std::string name = GetParam().first;
+    auto part_info = GetParam().second;
+
+    for (const auto& part_name : real_parts) {
+        std::vector<char> buf(max_flash, 0);  // All 0's
+        if (part_info.hashable) {
+            std::string hash_before, hash_after, err_msg;
+            int retcode;
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS) << "Erasing " + part_name + " failed";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_before, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should not accept a image of all 0x00";
+            ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash_after, &retcode, &err_msg))
+                    << err_msg;
+            ASSERT_EQ(retcode, 0) << err_msg;
+            EXPECT_EQ(hash_before, hash_after)
+                    << "The hash of the partition has changed after attempting to flash garbage to "
+                       "a parsed partition";
+        } else {
+            EXPECT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                    << "A parsed partition should not accept a image of all 0x00";
+        }
+    }
+}
+
+INSTANTIATE_TEST_CASE_P(XMLFuzzPartitionsWriteableParsed, FuzzWriteableParsedPartition,
+                        ::testing::ValuesIn(PARTITION_XML_WRITE_PARSED));
+
+// Make sure all attempts to flash things are rejected
+TEST_P(FuzzAnyPartitionLocked, RejectFlash) {
+    std::vector<char> buf = RandomBuf(5);
+    for (const auto& part_name : real_parts) {
+        ASSERT_EQ(fb->FlashPartition(part_name, buf), DEVICE_FAIL)
+                << "Flashing a partition should always fail in locked mode";
+    }
+}
+
+INSTANTIATE_TEST_CASE_P(XMLFuzzAnyPartitionLocked, FuzzAnyPartitionLocked,
+                        ::testing::ValuesIn(PARTITION_XML_TESTS));
+
+// Test flashing unlock erases userdata
+TEST_P(UserdataPartition, UnlockErases) {
+    // Get hash after an erase
+    int retcode;
+    std::string err_msg, hash_before, hash_buf, hash_after;
+    ASSERT_EQ(fb->Erase("userdata"), SUCCESS) << "Erasing uesrdata failed";
+    ASSERT_TRUE(PartitionHash(fb.get(), "userdata", &hash_before, &retcode, &err_msg)) << err_msg;
+    ASSERT_EQ(retcode, 0) << err_msg;
+
+    // Write garbage
+    std::vector<char> buf = RandomBuf(max_flash / 2);
+    ASSERT_EQ(fb->FlashPartition("userdata", buf), SUCCESS);
+    ASSERT_TRUE(PartitionHash(fb.get(), "userdata", &hash_buf, &retcode, &err_msg)) << err_msg;
+    ASSERT_EQ(retcode, 0) << err_msg;
+
+    // Sanity check of hash
+    EXPECT_NE(hash_before, hash_buf)
+            << "Writing a random buffer to 'userdata' had the same hash as after erasing it";
+    SetLockState(true);  // Lock the device
+
+    SetLockState(false);  // Unlock the device (should cause erase)
+    ASSERT_TRUE(PartitionHash(fb.get(), "userdata", &hash_after, &retcode, &err_msg)) << err_msg;
+    ASSERT_EQ(retcode, 0) << err_msg;
+
+    EXPECT_NE(hash_after, hash_buf) << "Unlocking the device did not cause the hash of userdata to "
+                                       "change (i.e. it was not erased as required)";
+    EXPECT_EQ(hash_after, hash_before) << "Unlocking the device did not produce the same hash of "
+                                          "userdata as after doing an erase to userdata";
+}
+
+// This is a hack to make this test disapeer if there is not a checsum, userdata is not hashable,
+// or userdata is not marked to be writeable in testing
+INSTANTIATE_TEST_CASE_P(XMLUserdataLocked, UserdataPartition,
+                        ::testing::ValuesIn(PARTITION_XML_USERDATA_CHECKSUM_WRITEABLE));
+
+// Packed images test
+TEST_P(ExtensionsPackedValid, TestDeviceUnpack) {
+    const std::string& packed_name = GetParam().first;
+    const std::string& packed_image = GetParam().second.packed_img;
+    const std::string& unpacked = GetParam().second.unpacked_dir;
+
+    // First we need to check for existence of images
+    const extension::Configuration::PackedInfo& info = config.packed[packed_name];
+
+    const auto flash_part = [&](const std::string fname, const std::string part_name) {
+        FILE* to_flash = fopen((SEARCH_PATH + fname).c_str(), "rb");
+        ASSERT_NE(to_flash, nullptr) << "'" << fname << "'"
+                                     << " failed to open for flashing";
+        int fd = fileno(to_flash);
+        size_t fsize = lseek(fd, 0, SEEK_END);
+        ASSERT_GT(fsize, 0) << fname + " appears to be an empty image";
+        ASSERT_EQ(fb->FlashPartition(part_name, fd, fsize), SUCCESS);
+        fclose(to_flash);
+    };
+
+    // We first need to set the slot count
+    std::string var;
+    int num_slots = 1;
+    if (info.slots) {
+        ASSERT_EQ(fb->GetVar("slot-count", &var), SUCCESS) << "Getting slot count failed";
+        num_slots = strtol(var.c_str(), nullptr, 10);
+    } else {
+        for (const auto& part : info.children) {
+            EXPECT_FALSE(config.partitions[part].slots)
+                    << "A partition can not have slots if the packed image does not";
+        }
+    }
+
+    for (int i = 0; i < num_slots; i++) {
+        std::unordered_map<std::string, std::string> initial_hashes;
+        const std::string packed_suffix =
+                info.slots ? android::base::StringPrintf("_%c", 'a' + i) : "";
+
+        // Flash the paritions manually and get hash
+        for (const auto& part : info.children) {
+            const extension::Configuration::PartitionInfo& part_info = config.partitions[part];
+            const std::string suffix = part_info.slots ? packed_suffix : "";
+            const std::string part_name = part + suffix;
+
+            ASSERT_EQ(fb->Erase(part_name), SUCCESS);
+            const std::string fpath = unpacked + '/' + part + ".img";
+            ASSERT_NO_FATAL_FAILURE(flash_part(fpath, part_name))
+                    << "Failed to flash '" + fpath + "'";
+            // If the partition is hashable we store it
+            if (part_info.hashable) {
+                std::string hash, err_msg;
+                int retcode;
+                ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash, &retcode, &err_msg))
+                        << err_msg;
+                ASSERT_EQ(retcode, 0) << err_msg;
+                initial_hashes[part] = hash;
+            }
+        }
+
+        // erase once at the end, to avoid false positives if flashing does nothing
+        for (const auto& part : info.children) {
+            const std::string suffix = config.partitions[part].slots ? packed_suffix : "";
+            ASSERT_EQ(fb->Erase(part + suffix), SUCCESS);
+        }
+
+        // Now we flash the packed image and compare our hashes
+        ASSERT_NO_FATAL_FAILURE(flash_part(packed_image, packed_name + packed_suffix));
+
+        for (const auto& part : info.children) {
+            const extension::Configuration::PartitionInfo& part_info = config.partitions[part];
+            // If the partition is hashable we check it
+            if (part_info.hashable) {
+                const std::string suffix = part_info.slots ? packed_suffix : "";
+                const std::string part_name = part + suffix;
+                std::string hash, err_msg;
+                int retcode;
+                ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash, &retcode, &err_msg))
+                        << err_msg;
+                ASSERT_EQ(retcode, 0) << err_msg;
+                std::string msg =
+                        "The hashes between flashing the packed image and directly flashing '" +
+                        part_name + "' does not match";
+                EXPECT_EQ(hash, initial_hashes[part]) << msg;
+            }
+        }
+    }
+}
+
+INSTANTIATE_TEST_CASE_P(XMLTestPacked, ExtensionsPackedValid,
+                        ::testing::ValuesIn(PACKED_XML_SUCCESS_TESTS));
+
+// Packed images test
+TEST_P(ExtensionsPackedInvalid, TestDeviceUnpack) {
+    const std::string& packed_name = GetParam().first;
+    const std::string& packed_image = GetParam().second.packed_img;
+
+    // First we need to check for existence of images
+    const extension::Configuration::PackedInfo& info = config.packed[packed_name];
+
+    // We first need to set the slot count
+    std::string var;
+    int num_slots = 1;
+    if (info.slots) {
+        ASSERT_EQ(fb->GetVar("slot-count", &var), SUCCESS) << "Getting slot count failed";
+        num_slots = strtol(var.c_str(), nullptr, 10);
+    } else {
+        for (const auto& part : info.children) {
+            EXPECT_FALSE(config.partitions[part].slots)
+                    << "A partition can not have slots if the packed image does not";
+        }
+    }
+
+    for (int i = 0; i < num_slots; i++) {
+        std::unordered_map<std::string, std::string> initial_hashes;
+        const std::string packed_suffix =
+                info.slots ? android::base::StringPrintf("_%c", 'a' + i) : "";
+
+        // manually and get hash
+        for (const auto& part : info.children) {
+            const extension::Configuration::PartitionInfo& part_info = config.partitions[part];
+            const std::string suffix = part_info.slots ? packed_suffix : "";
+            const std::string part_name = part + suffix;
+
+            // If the partition is hashable we store it
+            if (part_info.hashable) {
+                std::string hash, err_msg;
+                int retcode;
+                ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash, &retcode, &err_msg))
+                        << err_msg;
+                ASSERT_EQ(retcode, 0) << err_msg;
+                initial_hashes[part] = hash;
+            }
+        }
+
+        // Attempt to flash the invalid file
+        FILE* to_flash = fopen((SEARCH_PATH + packed_image).c_str(), "rb");
+        ASSERT_NE(to_flash, nullptr) << "'" << packed_image << "'"
+                                     << " failed to open for flashing";
+        int fd = fileno(to_flash);
+        size_t fsize = lseek(fd, 0, SEEK_END);
+        ASSERT_GT(fsize, 0) << packed_image + " appears to be an empty image";
+        ASSERT_EQ(fb->FlashPartition(packed_name + packed_suffix, fd, fsize), DEVICE_FAIL)
+                << "Expected flashing to fail for " + packed_image;
+        fclose(to_flash);
+
+        for (const auto& part : info.children) {
+            const extension::Configuration::PartitionInfo& part_info = config.partitions[part];
+            // If the partition is hashable we check it
+            if (part_info.hashable) {
+                const std::string suffix = part_info.slots ? packed_suffix : "";
+                const std::string part_name = part + suffix;
+                std::string hash, err_msg;
+                int retcode;
+                ASSERT_TRUE(PartitionHash(fb.get(), part_name, &hash, &retcode, &err_msg))
+                        << err_msg;
+                ASSERT_EQ(retcode, 0) << err_msg;
+                std::string msg = "Flashing an invalid image changed the hash of '" + part_name;
+                EXPECT_EQ(hash, initial_hashes[part]) << msg;
+            }
+        }
+    }
+}
+
+INSTANTIATE_TEST_CASE_P(XMLTestPacked, ExtensionsPackedInvalid,
+                        ::testing::ValuesIn(PACKED_XML_FAIL_TESTS));
+
+// OEM xml tests
+TEST_P(ExtensionsOemConformance, RunOEMTest) {
+    const std::string& cmd = std::get<0>(GetParam());
+    // bool restricted = std::get<1>(GetParam());
+    const extension::Configuration::CommandTest& test = std::get<2>(GetParam());
+
+    const RetCode expect = (test.expect == extension::FAIL) ? DEVICE_FAIL : SUCCESS;
+
+    // Does the test require staging something?
+    if (!test.input.empty()) {  // Non-empty string
+        FILE* to_stage = fopen((SEARCH_PATH + test.input).c_str(), "rb");
+        ASSERT_NE(to_stage, nullptr) << "'" << test.input << "'"
+                                     << " failed to open for staging";
+        int fd = fileno(to_stage);
+        size_t fsize = lseek(fd, 0, SEEK_END);
+        std::string var;
+        EXPECT_EQ(fb->GetVar("max-download-size", &var), SUCCESS);
+        int64_t size = strtoll(var.c_str(), nullptr, 16);
+        EXPECT_LT(fsize, size) << "'" << test.input << "'"
+                               << " is too large for staging";
+        ASSERT_EQ(fb->Download(fd, fsize), SUCCESS) << "'" << test.input << "'"
+                                                    << " failed to download for staging";
+        fclose(to_stage);
+    }
+    // Run the command
+    int dsize = -1;
+    std::string resp;
+    const std::string full_cmd = "oem " + cmd + " " + test.arg;
+    ASSERT_EQ(fb->RawCommand(full_cmd, &resp, nullptr, &dsize), expect);
+
+    // This is how we test if indeed data response
+    if (test.expect == extension::DATA) {
+        EXPECT_GT(dsize, 0);
+    }
+
+    // Validate response if neccesary
+    if (!test.regex_str.empty()) {
+        std::smatch sm;
+        std::regex_match(resp, sm, test.regex);
+        EXPECT_FALSE(sm.empty()) << "The oem regex did not match";
+    }
+
+    // If payload, we validate that as well
+    const std::vector<std::string> args = SplitBySpace(test.validator);
+    if (args.size()) {
+        // Save output
+        const std::string save_loc =
+                OUTPUT_PATH + (test.output.empty() ? DEFAULT_OUPUT_NAME : test.output);
+        std::string resp;
+        ASSERT_EQ(fb->Upload(save_loc, &resp), SUCCESS)
+                << "Saving output file failed with (" << fb->Error() << ") " << resp;
+        // Build the arguments to the validator
+        std::vector<std::string> prog_args(args.begin() + 1, args.end());
+        prog_args.push_back(full_cmd);  // Pass in the full command
+        prog_args.push_back(save_loc);  // Pass in the save location
+        // Run the validation program
+        int pipe;
+        const pid_t pid = StartProgram(args[0], prog_args, &pipe);
+        ASSERT_GT(pid, 0) << "Failed to launch validation program: " << args[0];
+        std::string error_msg;
+        int ret = WaitProgram(pid, pipe, &error_msg);
+        EXPECT_EQ(ret, 0) << error_msg;  // Program exited correctly
+    }
+}
+
+INSTANTIATE_TEST_CASE_P(XMLOEM, ExtensionsOemConformance, ::testing::ValuesIn(OEM_XML_TESTS));
+
+void GenerateXmlTests(const extension::Configuration& config) {
+    // Build the getvar tests
+    for (const auto it : config.getvars) {
+        GETVAR_XML_TESTS.push_back(std::make_pair(it.first, it.second));
+    }
+
+    // Build the partition tests, to interface with gtest we need to do it this way
+    for (const auto it : config.partitions) {
+        const auto tup = std::make_tuple(it.first, it.second);
+        PARTITION_XML_TESTS.push_back(tup);  // All partitions
+
+        if (it.second.test == it.second.YES) {
+            PARTITION_XML_WRITEABLE.push_back(tup);  // All writeable partitions
+
+            if (it.second.hashable) {
+                PARTITION_XML_WRITE_HASHABLE.push_back(tup);  // All write and hashable
+                if (!it.second.parsed) {
+                    PARTITION_XML_WRITE_HASH_NONPARSED.push_back(
+                            tup);  // All write hashed and non-parsed
+                }
+            }
+            if (it.second.parsed) {
+                PARTITION_XML_WRITE_PARSED.push_back(tup);  // All write and parsed
+            }
+        }
+    }
+
+    // Build the packed tests, only useful if we have a hash
+    if (!config.checksum.empty()) {
+        for (const auto it : config.packed) {
+            for (const auto& test : it.second.tests) {
+                const auto tup = std::make_tuple(it.first, test);
+                if (test.expect == extension::OKAY) {  // only testing the success case
+                    PACKED_XML_SUCCESS_TESTS.push_back(tup);
+                } else {
+                    PACKED_XML_FAIL_TESTS.push_back(tup);
+                }
+            }
+        }
+    }
+
+    // This is a hack to make this test disapeer if there is not a checksum, userdata is not
+    // hashable, or userdata is not marked to be writeable in testing
+    const auto part_info = config.partitions.find("userdata");
+    if (!config.checksum.empty() && part_info != config.partitions.end() &&
+        part_info->second.hashable &&
+        part_info->second.test == extension::Configuration::PartitionInfo::YES) {
+        PARTITION_XML_USERDATA_CHECKSUM_WRITEABLE.push_back(
+                std::make_tuple(part_info->first, part_info->second));
+    }
+
+    // Build oem tests
+    for (const auto it : config.oem) {
+        auto oem_cmd = it.second;
+        for (const auto& t : oem_cmd.tests) {
+            OEM_XML_TESTS.push_back(std::make_tuple(it.first, oem_cmd.restricted, t));
+        }
+    }
+}
+
+}  // namespace fastboot
+
+int main(int argc, char** argv) {
+    std::string err;
+    // Parse the args
+    const std::unordered_map<std::string, std::string> args = fastboot::ParseArgs(argc, argv, &err);
+    if (!err.empty()) {
+        printf("%s\n", err.c_str());
+        return -1;
+    }
+
+    if (args.find("config") != args.end()) {
+        auto found = args.find("search_path");
+        fastboot::SEARCH_PATH = (found != args.end()) ? found->second + "/" : "";
+        found = args.find("output_path");
+        fastboot::OUTPUT_PATH = (found != args.end()) ? found->second + "/" : "/tmp/";
+        if (!fastboot::extension::ParseXml(fastboot::SEARCH_PATH + args.at("config"),
+                                           &fastboot::config)) {
+            printf("XML config parsing failed\n");
+            return -1;
+        }
+        // To interface with gtest, must set global scope test variables
+        fastboot::GenerateXmlTests(fastboot::config);
+    }
+
+    setbuf(stdout, NULL);  // no buffering
+    printf("<Waiting for Device>\n");
+    const auto matcher = [](usb_ifc_info* info) -> int {
+        return fastboot::FastBootTest::MatchFastboot(info, nullptr);
+    };
+    Transport* transport = nullptr;
+    while (!transport) {
+        transport = usb_open(matcher);
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+    transport->Close();
+
+    if (args.find("serial_port") != args.end()) {
+        fastboot::FastBootTest::serial_port = fastboot::ConfigureSerial(args.at("serial_port"));
+    }
+
+    ::testing::InitGoogleTest(&argc, argv);
+    auto ret = RUN_ALL_TESTS();
+    if (fastboot::FastBootTest::serial_port > 0) {
+        close(fastboot::FastBootTest::serial_port);
+    }
+    return ret;
+}
diff --git a/fastboot/fuzzy_fastboot/test_listeners.h b/fastboot/fuzzy_fastboot/test_listeners.h
new file mode 100644
index 0000000..ae5b0cb
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/test_listeners.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#pragma once
+
+// TODO, print out logs for each failed test with custom listner
+
+class MinimalistPrinter : public ::testing::EmptyTestEventListener {
+    // Called before a test starts.
+    virtual void OnTestStart(const ::testing::TestInfo& test_info) {
+        printf("*** Test %s.%s starting.\n", test_info.test_case_name(), test_info.name());
+    }
+
+    // Called after a failed assertion or a SUCCESS().
+    virtual void OnTestPartResult(const ::testing::TestPartResult& test_part_result) {
+        printf("%s in %s:%d\n%s\n", test_part_result.failed() ? "*** Failure" : "Success",
+               test_part_result.file_name(), test_part_result.line_number(),
+               test_part_result.summary());
+    }
+
+    // Called after a test ends.
+    virtual void OnTestEnd(const ::testing::TestInfo& test_info) {
+        printf("*** Test %s.%s ending.\n", test_info.test_case_name(), test_info.name());
+    }
+};
diff --git a/fastboot/fuzzy_fastboot/test_utils.cpp b/fastboot/fuzzy_fastboot/test_utils.cpp
new file mode 100644
index 0000000..9ad98be
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/test_utils.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#include "test_utils.h"
+#include <fcntl.h>
+#include <termios.h>
+#include <sstream>
+
+namespace fastboot {
+
+namespace {
+constexpr int rand_seed = 0;
+std::default_random_engine rnd(rand_seed);
+}  // namespace
+
+char rand_legal() {
+    return rnd() % 128;
+}
+
+char rand_illegal() {
+    return rand_legal() + 128;
+}
+
+char rand_char() {
+    return rnd() % 256;
+}
+
+int random_int(int start, int end) {
+    std::uniform_int_distribution<int> uni(start, end);
+    return uni(rnd);
+}
+
+std::string RandomString(size_t length, std::function<char(void)> provider) {
+    std::string str(length, 0);
+    std::generate_n(str.begin(), length, provider);
+    return str;
+}
+
+std::vector<char> RandomBuf(size_t length, std::function<char(void)> provider) {
+    std::vector<char> ret;
+    ret.resize(length);
+    std::generate_n(ret.begin(), length, provider);
+    return ret;
+}
+
+std::vector<std::string> SplitBySpace(const std::string& s) {
+    std::istringstream iss(s);
+    return std::vector<std::string>{std::istream_iterator<std::string>{iss},
+                                    std::istream_iterator<std::string>{}};
+}
+
+std::vector<std::string> GeneratePartitionNames(const std::string& base, int num_slots) {
+    if (!num_slots) {
+        return std::vector<std::string>{base};
+    }
+    std::vector<std::string> ret;
+    for (char c = 'a'; c < 'a' + num_slots; c++) {
+        ret.push_back(base + '_' + c);
+    }
+
+    return ret;
+}
+
+std::unordered_map<std::string, std::string> ParseArgs(int argc, char** argv,
+                                                       std::string* err_msg) {
+    // We ignore any gtest stuff
+    std::unordered_map<std::string, std::string> ret;
+
+    for (int i = 1; i < argc - 1; i++) {
+        std::string arg(argv[i]);
+
+        const std::string gtest_start("--gtest");
+        // We found a non gtest argument
+        if (!arg.find("-h") ||
+            (!arg.find("--") && arg.find("--gtest") && arg.find("=") != arg.npos)) {
+            const std::string start(arg.begin() + 2, arg.begin() + arg.find("="));
+            const std::string end(arg.begin() + arg.find("=") + 1, arg.end());
+            ret[start] = end;
+        } else if (arg.find("--gtest") != 0) {
+            *err_msg = android::base::StringPrintf("Illegal argument '%s'\n", arg.c_str());
+            return ret;
+        }
+    }
+
+    return ret;
+}
+
+int ConfigureSerial(const std::string& port) {
+    int fd = open(port.c_str(), O_RDONLY | O_NOCTTY | O_NONBLOCK);
+
+    if (fd <= 0) {
+        return fd;
+    }
+
+    struct termios tty;
+    tcgetattr(fd, &tty);
+
+    cfsetospeed(&tty, (speed_t)B115200);
+    cfsetispeed(&tty, (speed_t)B115200);
+
+    tty.c_cflag &= ~PARENB;
+    tty.c_cflag &= ~CSTOPB;
+    tty.c_cflag &= ~CSIZE;
+    tty.c_cflag |= CS8;
+
+    tty.c_cflag &= ~CRTSCTS;
+    tty.c_cc[VMIN] = 0;
+    tty.c_cc[VTIME] = 2;
+    tty.c_cflag &= ~(ICANON | ECHO | ECHOE | ISIG);
+
+    cfmakeraw(&tty);
+
+    tcflush(fd, TCIFLUSH);
+    if (tcsetattr(fd, TCSANOW, &tty) != 0) {
+        return -1;
+    }
+
+    return fd;
+}
+
+int StartProgram(const std::string program, const std::vector<std::string> args, int* rpipe) {
+    int link[2];
+    if (pipe(link) < 0) {
+        return -1;
+    }
+
+    pid_t pid = fork();
+    if (pid < 0) {  // error
+        return -1;
+    }
+
+    if (pid) {  // parent
+        close(link[1]);
+        *rpipe = link[0];
+        fcntl(*rpipe, F_SETFL, O_NONBLOCK);  // Non-blocking
+    } else {                                 // child
+        std::vector<const char*> argv(args.size() + 2, nullptr);
+        argv[0] = program.c_str();
+
+        for (int i = 0; i < args.size(); i++) {
+            argv[i + 1] = args[i].c_str();
+        }
+
+        // We pipe any stderr writes to the parent test process
+        dup2(link[1], STDERR_FILENO);  // close stdout and have it now be link[1]
+        // Close duplicates
+        close(link[0]);
+        close(link[1]);
+
+        execvp(program.c_str(), const_cast<char* const*>(argv.data()));
+        fprintf(stderr, "Launching validator process '%s' failed with: %s\n", program.c_str(),
+                strerror(errno));
+        exit(-1);
+    }
+
+    return pid;
+}
+
+int WaitProgram(const int pid, const int pipe, std::string* error_msg) {
+    int status;
+    if (waitpid(pid, &status, 0) != pid) {
+        close(pipe);
+        return -1;
+    }
+    // Read from pipe
+    char buf[1024];
+    int n;
+    while ((n = read(pipe, buf, sizeof(buf))) > 0) {
+        buf[n] = 0; /* terminate the string */
+        error_msg->append(buf, n);
+    }
+    close(pipe);
+
+    if (WIFEXITED(status)) {
+        // This WEXITSTATUS macro masks off lower bytes, with no sign extension
+        // casting it as a signed char fixes the sign extension issue
+        int retmask = WEXITSTATUS(status);
+        return reinterpret_cast<int8_t*>(&retmask)[0];
+    }
+
+    return -1;
+}
+
+}  // namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/test_utils.h b/fastboot/fuzzy_fastboot/test_utils.h
new file mode 100644
index 0000000..0b032e4
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/test_utils.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#pragma once
+
+#include <sparse/sparse.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <cstdlib>
+#include <fstream>
+#include <random>
+#include <string>
+#include <unordered_map>
+#include "fastboot_driver.h"
+
+namespace fastboot {
+
+char rand_legal();
+char rand_illegal();
+char rand_char();
+// start and end are inclusive
+int random_int(int start, int end);
+
+// I don't want to have to manage memory for this guy
+struct SparseWrapper {
+    SparseWrapper(unsigned int block_size, int64_t len) {
+        sparse = sparse_file_new(block_size, len);
+    }
+
+    SparseWrapper(struct sparse_file* sf) { sparse = sf; }
+
+    ~SparseWrapper() {
+        if (sparse) {
+            sparse_file_destroy(sparse);
+        }
+    }
+
+    const std::string Rep() {
+        unsigned bs = sparse_file_block_size(sparse);
+        unsigned len = sparse_file_len(sparse, true, false);
+        return android::base::StringPrintf("[block_size=%u, len=%u]", bs, len);
+    }
+
+    struct sparse_file* operator*() {
+        return sparse;
+    }
+
+    struct sparse_file* sparse;
+};
+
+std::string RandomString(size_t length, std::function<char(void)> provider);
+// RVO will avoid copy
+std::vector<char> RandomBuf(size_t length, std::function<char(void)> provider = rand_char);
+
+std::vector<std::string> SplitBySpace(const std::string& s);
+
+std::unordered_map<std::string, std::string> ParseArgs(int argc, char** argv, std::string* err_msg);
+
+std::vector<std::string> GeneratePartitionNames(const std::string& base, int num_slots = 0);
+
+int ConfigureSerial(const std::string& port);
+
+int StartProgram(const std::string program, const std::vector<std::string> args, int* pipe);
+int WaitProgram(const pid_t pid, const int pipe, std::string* error_msg);
+
+}  // namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/usb_transport_sniffer.cpp b/fastboot/fuzzy_fastboot/usb_transport_sniffer.cpp
new file mode 100644
index 0000000..ee510e9
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/usb_transport_sniffer.cpp
@@ -0,0 +1,189 @@
+#include "usb_transport_sniffer.h"
+#include <android-base/stringprintf.h>
+#include <sys/select.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <iomanip>
+#include <sstream>
+
+namespace fastboot {
+
+UsbTransportSniffer::UsbTransportSniffer(std::unique_ptr<UsbTransport> transport,
+                                         const int serial_fd)
+    : transport_(std::move(transport)), serial_fd_(serial_fd) {}
+
+ssize_t UsbTransportSniffer::Read(void* data, size_t len) {
+    ProcessSerial();
+
+    ssize_t ret = transport_->Read(data, len);
+    if (ret < 0) {
+        const char* err = strerror(errno);
+        std::vector<char> buf(err, err + strlen(err));
+        Event e(READ_ERROR, std::move(buf));
+        transfers_.push_back(e);
+        return ret;
+    }
+
+    char* cdata = static_cast<char*>(data);
+    std::vector<char> buf(cdata, cdata + ret);
+    Event e(READ, std::move(buf));
+    transfers_.push_back(e);
+
+    ProcessSerial();
+    return ret;
+}
+
+ssize_t UsbTransportSniffer::Write(const void* data, size_t len) {
+    ProcessSerial();
+
+    size_t ret = transport_->Write(data, len);
+    if (ret != len) {
+        const char* err = strerror(errno);
+        std::vector<char> buf(err, err + strlen(err));
+        Event e(WRITE_ERROR, std::move(buf));
+        transfers_.push_back(e);
+        return ret;
+    }
+
+    const char* cdata = static_cast<const char*>(data);
+    std::vector<char> buf(cdata, cdata + len);
+    Event e(WRITE, std::move(buf));
+    transfers_.push_back(e);
+
+    ProcessSerial();
+    return ret;
+}
+
+int UsbTransportSniffer::Close() {
+    return transport_->Close();
+}
+
+int UsbTransportSniffer::Reset() {
+    ProcessSerial();
+    int ret = transport_->Reset();
+    std::vector<char> buf;
+    Event e(RESET, std::move(buf));
+    transfers_.push_back(e);
+    ProcessSerial();
+    return ret;
+}
+
+const std::vector<UsbTransportSniffer::Event> UsbTransportSniffer::Transfers() {
+    return transfers_;
+}
+
+/*
+ * When a test fails, we want a human readable log of everything going on up until
+ * the failure. This method will look through its log of captured events, and
+ * create a clean printable string of everything that happened.
+ */
+std::string UsbTransportSniffer::CreateTrace() {
+    std::string ret;
+
+    const auto no_print = [](char c) -> bool { return !isprint(c); };
+    // This lambda creates a humand readable representation of a byte buffer
+    // It first attempts to figure out whether it should be interpreted as an ASCII buffer,
+    // and be printed as a string, or just a raw byte-buffer
+    const auto msg = [&ret, no_print](const std::vector<char>& buf) {
+        ret += android::base::StringPrintf("(%lu bytes): ", buf.size());
+        std::vector<const char>::iterator iter = buf.end();
+        const unsigned max_chars = 50;
+        if (buf.size() > max_chars) {
+            iter = buf.begin() + max_chars;
+        }
+        ret += '"';
+        if (std::count_if(buf.begin(), iter, no_print) == 0) {  // print as ascii
+            ret.insert(ret.end(), buf.begin(), iter);
+        } else {  // print as hex
+            std::stringstream ss;
+            for (auto c = buf.begin(); c < iter; c++) {
+                ss << std::hex << std::setw(2) << std::setfill('0')
+                   << static_cast<uint16_t>(static_cast<uint8_t>(*c));
+                ss << ',';
+            }
+            ret += ss.str();
+        }
+        if (buf.size() > max_chars) {
+            ret += android::base::StringPrintf("...\"(+%lu bytes)\n", buf.size() - max_chars);
+        } else {
+            ret += "\"\n";
+        }
+    };
+
+    // Now we just scan through the log of everything that happened and create a
+    // printable string for each one
+    for (const auto& event : transfers_) {
+        const std::vector<char>& cbuf = event.buf;
+        const std::string tmp(cbuf.begin(), cbuf.end());
+        auto start = transfers_.front().start;
+        auto durr = event.start - start;
+        auto millis = std::chrono::duration_cast<std::chrono::milliseconds>(durr).count();
+
+        switch (event.type) {
+            case READ:
+                ret += android::base::StringPrintf("[READ %lldms]", millis);
+                msg(cbuf);
+                break;
+
+            case WRITE:
+                ret += android::base::StringPrintf("[WRITE %lldms]", millis);
+                msg(cbuf);
+                break;
+
+            case RESET:
+                ret += android::base::StringPrintf("[RESET %lldms]\n", millis);
+                break;
+
+            case READ_ERROR:
+                ret += android::base::StringPrintf("[READ_ERROR %lldms] %s\n", millis, tmp.c_str());
+                break;
+
+            case WRITE_ERROR:
+                ret += android::base::StringPrintf("[WRITE_ERROR %lldms] %s\n", millis,
+                                                   tmp.c_str());
+                break;
+
+            case SERIAL:
+                ret += android::base::StringPrintf("[SERIAL %lldms] %s", millis, tmp.c_str());
+                if (ret.back() != '\n') ret += '\n';
+                break;
+        }
+    }
+    return ret;
+}
+
+// This is a quick call to flush any UART logs the device might have sent
+// to our internal event log. It will wait up to 10ms for data to appear
+void UsbTransportSniffer::ProcessSerial() {
+    if (serial_fd_ <= 0) return;
+
+    fd_set set;
+    struct timeval timeout;
+
+    FD_ZERO(&set);
+    FD_SET(serial_fd_, &set);
+    timeout.tv_sec = 0;
+    timeout.tv_usec = 10000;  // 10ms
+
+    int count = 0;
+    int n = 0;
+    std::vector<char> buf;
+    buf.resize(1000);
+    while (select(serial_fd_ + 1, &set, NULL, NULL, &timeout) > 0) {
+        n = read(serial_fd_, buf.data() + count, buf.size() - count);
+        if (n > 0) {
+            count += n;
+        } else {
+            break;
+        }
+    }
+
+    buf.resize(count);
+
+    if (count > 0) {
+        Event e(SERIAL, std::move(buf));
+        transfers_.push_back(e);
+    }
+}
+
+}  // namespace fastboot
diff --git a/fastboot/fuzzy_fastboot/usb_transport_sniffer.h b/fastboot/fuzzy_fastboot/usb_transport_sniffer.h
new file mode 100644
index 0000000..693f042
--- /dev/null
+++ b/fastboot/fuzzy_fastboot/usb_transport_sniffer.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+#pragma once
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <chrono>
+#include <cstdlib>
+#include <fstream>
+#include <string>
+#include <vector>
+
+#include "usb.h"
+
+namespace fastboot {
+
+/* A special class for sniffing reads and writes
+ *
+ * A useful debugging tool is to see the raw fastboot transactions going between
+ * the host and device. This class wraps the UsbTransport class, and snoops and saves
+ * all the transactions going on. Additionally, if there is a console serial port
+ * from the device, this class can monitor it as well and capture the interleaving of
+ * transport transactions and UART log messages.
+ */
+class UsbTransportSniffer : public UsbTransport {
+  public:
+    enum EventType {
+        READ,
+        WRITE,
+        RESET,
+        SERIAL,  // Serial log message from device
+        READ_ERROR,
+        WRITE_ERROR,
+    };
+
+    struct Event {
+        Event(EventType t, const std::vector<char> cbuf) : type(t), buf(cbuf) {
+            start = std::chrono::high_resolution_clock::now();
+        };
+        EventType type;
+        std::chrono::high_resolution_clock::time_point start;
+        const std::vector<char> buf;
+    };
+
+    UsbTransportSniffer(std::unique_ptr<UsbTransport> transport, const int serial_fd = 0);
+
+    virtual ssize_t Read(void* data, size_t len) override;
+    virtual ssize_t Write(const void* data, size_t len) override;
+    virtual int Close() override;
+    virtual int Reset() override;
+
+    const std::vector<Event> Transfers();
+    std::string CreateTrace();
+    void ProcessSerial();
+
+  private:
+    std::vector<Event> transfers_;
+    std::unique_ptr<UsbTransport> transport_;
+    const int serial_fd_;
+};
+
+}  // End namespace fastboot
diff --git a/fs_mgr/libdm/dm.cpp b/fs_mgr/libdm/dm.cpp
index ad3b6f4..8bcbec2 100644
--- a/fs_mgr/libdm/dm.cpp
+++ b/fs_mgr/libdm/dm.cpp
@@ -20,11 +20,19 @@
 #include <sys/sysmacros.h>
 #include <sys/types.h>
 
+#include <android-base/logging.h>
 #include <android-base/macros.h>
 
 namespace android {
 namespace dm {
 
+DeviceMapper::DeviceMapper() : fd_(-1) {
+    fd_ = TEMP_FAILURE_RETRY(open("/dev/device-mapper", O_RDWR | O_CLOEXEC));
+    if (fd_ < 0) {
+        PLOG(ERROR) << "Failed to open device-mapper";
+    }
+}
+
 DeviceMapper& DeviceMapper::Instance() {
     static DeviceMapper instance;
     return instance;
diff --git a/fs_mgr/libdm/include/libdm/dm.h b/fs_mgr/libdm/include/libdm/dm.h
index e2bc729..9b61ddc 100644
--- a/fs_mgr/libdm/include/libdm/dm.h
+++ b/fs_mgr/libdm/include/libdm/dm.h
@@ -29,8 +29,6 @@
 #include <utility>
 #include <vector>
 
-#include <android-base/logging.h>
-
 #include "dm_table.h"
 
 // The minimum expected device mapper major.minor version
@@ -144,12 +142,7 @@
 
     void InitIo(struct dm_ioctl* io, const std::string& name = std::string()) const;
 
-    DeviceMapper() : fd_(-1) {
-        fd_ = TEMP_FAILURE_RETRY(open("/dev/device-mapper", O_RDWR | O_CLOEXEC));
-        if (fd_ < 0) {
-            PLOG(ERROR) << "Failed to open device-mapper";
-        }
-    }
+    DeviceMapper();
 
     // Creates a device mapper device with given name.
     // Return 'true' on success and 'false' on failure to
diff --git a/fs_mgr/libdm/include/libdm/dm_target.h b/fs_mgr/libdm/include/libdm/dm_target.h
index 31863c8..aab89e5 100644
--- a/fs_mgr/libdm/include/libdm/dm_target.h
+++ b/fs_mgr/libdm/include/libdm/dm_target.h
@@ -23,8 +23,6 @@
 #include <string>
 #include <vector>
 
-#include <android-base/logging.h>
-
 namespace android {
 namespace dm {
 
diff --git a/fs_mgr/liblp/images.cpp b/fs_mgr/liblp/images.cpp
index a361a5d..742b1d0 100644
--- a/fs_mgr/liblp/images.cpp
+++ b/fs_mgr/liblp/images.cpp
@@ -38,12 +38,24 @@
         PERROR << __PRETTY_FUNCTION__ << "lseek failed: offset " << LP_METADATA_GEOMETRY_SIZE;
         return nullptr;
     }
-    std::unique_ptr<LpMetadata> metadata = ParseMetadata(fd);
-    if (!metadata) {
+    return ParseMetadata(geometry, fd);
+}
+
+std::unique_ptr<LpMetadata> ReadFromImageBlob(const void* data, size_t bytes) {
+    if (bytes < LP_METADATA_GEOMETRY_SIZE) {
+        LERROR << __PRETTY_FUNCTION__ << ": " << bytes << " is smaller than geometry header";
         return nullptr;
     }
-    metadata->geometry = geometry;
-    return metadata;
+
+    LpMetadataGeometry geometry;
+    if (!ParseGeometry(data, &geometry)) {
+        return nullptr;
+    }
+
+    const uint8_t* metadata_buffer =
+            reinterpret_cast<const uint8_t*>(data) + LP_METADATA_GEOMETRY_SIZE;
+    size_t metadata_buffer_size = bytes - LP_METADATA_GEOMETRY_SIZE;
+    return ParseMetadata(geometry, metadata_buffer, metadata_buffer_size);
 }
 
 std::unique_ptr<LpMetadata> ReadFromImageFile(const char* file) {
diff --git a/fs_mgr/liblp/include/liblp/liblp.h b/fs_mgr/liblp/include/liblp/liblp.h
index 627aa8c..6da24f6 100644
--- a/fs_mgr/liblp/include/liblp/liblp.h
+++ b/fs_mgr/liblp/include/liblp/liblp.h
@@ -42,8 +42,7 @@
 // existing geometry, and should not be used for normal partition table
 // updates. False can be returned if the geometry is incompatible with the
 // block device or an I/O error occurs.
-bool FlashPartitionTable(const std::string& block_device, const LpMetadata& metadata,
-                         uint32_t slot_number);
+bool FlashPartitionTable(const std::string& block_device, const LpMetadata& metadata);
 
 // Update the partition table for a given metadata slot number. False is
 // returned if an error occurs, which can include:
@@ -64,6 +63,7 @@
                        const std::map<std::string, std::string>& images);
 bool WriteToImageFile(const char* file, const LpMetadata& metadata);
 std::unique_ptr<LpMetadata> ReadFromImageFile(const char* file);
+std::unique_ptr<LpMetadata> ReadFromImageBlob(const void* data, size_t bytes);
 
 // Helper to extract safe C++ strings from partition info.
 std::string GetPartitionName(const LpMetadataPartition& partition);
diff --git a/fs_mgr/liblp/io_test.cpp b/fs_mgr/liblp/io_test.cpp
index 638f4b3..329a901 100644
--- a/fs_mgr/liblp/io_test.cpp
+++ b/fs_mgr/liblp/io_test.cpp
@@ -103,7 +103,7 @@
     if (!exported) {
         return {};
     }
-    if (!FlashPartitionTable(fd, *exported.get(), 0)) {
+    if (!FlashPartitionTable(fd, *exported.get())) {
         return {};
     }
     return fd;
@@ -132,7 +132,7 @@
     unique_fd fd = CreateFakeDisk();
     ASSERT_GE(fd, 0);
 
-    EXPECT_FALSE(FlashPartitionTable(fd, *exported.get(), 0));
+    EXPECT_FALSE(FlashPartitionTable(fd, *exported.get()));
 }
 
 // Test the basics of flashing a partition and reading it back.
@@ -147,7 +147,7 @@
     // Export and flash.
     unique_ptr<LpMetadata> exported = builder->Export();
     ASSERT_NE(exported, nullptr);
-    ASSERT_TRUE(FlashPartitionTable(fd, *exported.get(), 0));
+    ASSERT_TRUE(FlashPartitionTable(fd, *exported.get()));
 
     // Read back. Note that some fields are only filled in during
     // serialization, so exported and imported will not be identical. For
@@ -354,8 +354,7 @@
     ASSERT_GE(fd, 0);
 
     // Check that we are able to write our table.
-    ASSERT_TRUE(FlashPartitionTable(fd, *exported.get(), 0));
-    ASSERT_TRUE(UpdatePartitionTable(fd, *exported.get(), 1));
+    ASSERT_TRUE(FlashPartitionTable(fd, *exported.get()));
 
     // Check that adding one more partition overflows the metadata allotment.
     partition = builder->AddPartition("final", TEST_GUID, LP_PARTITION_ATTR_NONE);
@@ -395,6 +394,27 @@
     ASSERT_NE(imported, nullptr);
 }
 
+// Test that we can read images from buffers.
+TEST(liblp, ImageFilesInMemory) {
+    unique_ptr<MetadataBuilder> builder = CreateDefaultBuilder();
+    ASSERT_NE(builder, nullptr);
+    ASSERT_TRUE(AddDefaultPartitions(builder.get()));
+    unique_ptr<LpMetadata> exported = builder->Export();
+
+    unique_fd fd(syscall(__NR_memfd_create, "image_file", 0));
+    ASSERT_GE(fd, 0);
+    ASSERT_TRUE(WriteToImageFile(fd, *exported.get()));
+
+    int64_t offset = SeekFile64(fd, 0, SEEK_CUR);
+    ASSERT_GE(offset, 0);
+    ASSERT_EQ(SeekFile64(fd, 0, SEEK_SET), 0);
+
+    size_t bytes = static_cast<size_t>(offset);
+    std::unique_ptr<char[]> buffer = std::make_unique<char[]>(bytes);
+    ASSERT_TRUE(android::base::ReadFully(fd, buffer.get(), bytes));
+    ASSERT_NE(ReadFromImageBlob(buffer.get(), bytes), nullptr);
+}
+
 class BadWriter {
   public:
     // When requested, write garbage instead of the requested bytes, then
diff --git a/fs_mgr/liblp/reader.cpp b/fs_mgr/liblp/reader.cpp
index 117da59..117f5d5 100644
--- a/fs_mgr/liblp/reader.cpp
+++ b/fs_mgr/liblp/reader.cpp
@@ -30,9 +30,45 @@
 namespace android {
 namespace fs_mgr {
 
-// Parse an LpMetadataGeometry from a buffer. The buffer must be at least
-// LP_METADATA_GEOMETRY_SIZE bytes in size.
-static bool ParseGeometry(const void* buffer, LpMetadataGeometry* geometry) {
+// Helper class for reading descriptors and memory buffers in the same manner.
+class Reader {
+  public:
+    virtual ~Reader(){};
+    virtual bool ReadFully(void* buffer, size_t length) = 0;
+};
+
+class FileReader final : public Reader {
+  public:
+    explicit FileReader(int fd) : fd_(fd) {}
+    bool ReadFully(void* buffer, size_t length) override {
+        return android::base::ReadFully(fd_, buffer, length);
+    }
+
+  private:
+    int fd_;
+};
+
+class MemoryReader final : public Reader {
+  public:
+    MemoryReader(const void* buffer, size_t size)
+        : buffer_(reinterpret_cast<const uint8_t*>(buffer)), size_(size), pos_(0) {}
+    bool ReadFully(void* out, size_t length) override {
+        if (size_ - pos_ < length) {
+            errno = EINVAL;
+            return false;
+        }
+        memcpy(out, buffer_ + pos_, length);
+        pos_ += length;
+        return true;
+    }
+
+  private:
+    const uint8_t* buffer_;
+    size_t size_;
+    size_t pos_;
+};
+
+bool ParseGeometry(const void* buffer, LpMetadataGeometry* geometry) {
     static_assert(sizeof(*geometry) <= LP_METADATA_GEOMETRY_SIZE);
     memcpy(geometry, buffer, sizeof(*geometry));
 
@@ -171,16 +207,18 @@
 
 // Parse and validate all metadata at the current position in the given file
 // descriptor.
-std::unique_ptr<LpMetadata> ParseMetadata(int fd) {
+static std::unique_ptr<LpMetadata> ParseMetadata(const LpMetadataGeometry& geometry,
+                                                 Reader* reader) {
     // First read and validate the header.
     std::unique_ptr<LpMetadata> metadata = std::make_unique<LpMetadata>();
-    if (!android::base::ReadFully(fd, &metadata->header, sizeof(metadata->header))) {
+    if (!reader->ReadFully(&metadata->header, sizeof(metadata->header))) {
         PERROR << __PRETTY_FUNCTION__ << "read " << sizeof(metadata->header) << "bytes failed";
         return nullptr;
     }
     if (!ValidateMetadataHeader(metadata->header)) {
         return nullptr;
     }
+    metadata->geometry = geometry;
 
     LpMetadataHeader& header = metadata->header;
 
@@ -191,7 +229,7 @@
         LERROR << "Out of memory reading logical partition tables.";
         return nullptr;
     }
-    if (!android::base::ReadFully(fd, buffer.get(), header.tables_size)) {
+    if (!reader->ReadFully(buffer.get(), header.tables_size)) {
         PERROR << __PRETTY_FUNCTION__ << "read " << header.tables_size << "bytes failed";
         return nullptr;
     }
@@ -231,10 +269,20 @@
 
         metadata->extents.push_back(extent);
     }
-
     return metadata;
 }
 
+std::unique_ptr<LpMetadata> ParseMetadata(const LpMetadataGeometry& geometry, const void* buffer,
+                                          size_t size) {
+    MemoryReader reader(buffer, size);
+    return ParseMetadata(geometry, &reader);
+}
+
+std::unique_ptr<LpMetadata> ParseMetadata(const LpMetadataGeometry& geometry, int fd) {
+    FileReader reader(fd);
+    return ParseMetadata(geometry, &reader);
+}
+
 std::unique_ptr<LpMetadata> ReadPrimaryMetadata(int fd, const LpMetadataGeometry& geometry,
                                                 uint32_t slot_number) {
     int64_t offset = GetPrimaryMetadataOffset(geometry, slot_number);
@@ -242,7 +290,7 @@
         PERROR << __PRETTY_FUNCTION__ << "lseek failed: offset " << offset;
         return nullptr;
     }
-    return ParseMetadata(fd);
+    return ParseMetadata(geometry, fd);
 }
 
 std::unique_ptr<LpMetadata> ReadBackupMetadata(int fd, const LpMetadataGeometry& geometry,
@@ -252,7 +300,7 @@
         PERROR << __PRETTY_FUNCTION__ << "lseek failed: offset " << offset;
         return nullptr;
     }
-    return ParseMetadata(fd);
+    return ParseMetadata(geometry, fd);
 }
 
 std::unique_ptr<LpMetadata> ReadMetadata(int fd, uint32_t slot_number) {
@@ -268,13 +316,10 @@
 
     // Read the priamry copy, and if that fails, try the backup.
     std::unique_ptr<LpMetadata> metadata = ReadPrimaryMetadata(fd, geometry, slot_number);
-    if (!metadata) {
-        metadata = ReadBackupMetadata(fd, geometry, slot_number);
-    }
     if (metadata) {
-        metadata->geometry = geometry;
+        return metadata;
     }
-    return metadata;
+    return ReadBackupMetadata(fd, geometry, slot_number);
 }
 
 std::unique_ptr<LpMetadata> ReadMetadata(const char* block_device, uint32_t slot_number) {
diff --git a/fs_mgr/liblp/reader.h b/fs_mgr/liblp/reader.h
index 843b2f2..9f6ca6e 100644
--- a/fs_mgr/liblp/reader.h
+++ b/fs_mgr/liblp/reader.h
@@ -26,11 +26,16 @@
 namespace android {
 namespace fs_mgr {
 
-std::unique_ptr<LpMetadata> ReadMetadata(int fd, uint32_t slot_number);
+// Parse an LpMetadataGeometry from a buffer. The buffer must be at least
+// LP_METADATA_GEOMETRY_SIZE bytes in size.
+bool ParseGeometry(const void* buffer, LpMetadataGeometry* geometry);
 
 // Helper functions for manually reading geometry and metadata.
+std::unique_ptr<LpMetadata> ReadMetadata(int fd, uint32_t slot_number);
+std::unique_ptr<LpMetadata> ParseMetadata(const LpMetadataGeometry& geometry, int fd);
+std::unique_ptr<LpMetadata> ParseMetadata(const LpMetadataGeometry& geometry, const void* buffer,
+                                          size_t size);
 bool ReadLogicalPartitionGeometry(int fd, LpMetadataGeometry* geometry);
-std::unique_ptr<LpMetadata> ParseMetadata(int fd);
 
 // These functions assume a valid geometry and slot number.
 std::unique_ptr<LpMetadata> ReadPrimaryMetadata(int fd, const LpMetadataGeometry& geometry,
diff --git a/fs_mgr/liblp/writer.cpp b/fs_mgr/liblp/writer.cpp
index fc9d83f..ad84b22 100644
--- a/fs_mgr/liblp/writer.cpp
+++ b/fs_mgr/liblp/writer.cpp
@@ -196,7 +196,7 @@
     return android::base::WriteFully(fd, blob.data(), blob.size());
 }
 
-bool FlashPartitionTable(int fd, const LpMetadata& metadata, uint32_t slot_number) {
+bool FlashPartitionTable(int fd, const LpMetadata& metadata) {
     // Before writing geometry and/or logical partition tables, perform some
     // basic checks that the geometry and tables are coherent, and will fit
     // on the given block device.
@@ -224,8 +224,11 @@
         return false;
     }
 
-    // Write metadata to the correct slot, now that geometry is in place.
-    return WriteMetadata(fd, metadata.geometry, slot_number, metadata_blob, DefaultWriter);
+    bool ok = true;
+    for (size_t i = 0; i < metadata.geometry.metadata_slot_count; i++) {
+        ok &= WriteMetadata(fd, metadata.geometry, i, metadata_blob, DefaultWriter);
+    }
+    return ok;
 }
 
 static bool CompareMetadata(const LpMetadata& a, const LpMetadata& b) {
@@ -297,14 +300,13 @@
     return WriteMetadata(fd, geometry, slot_number, blob, writer);
 }
 
-bool FlashPartitionTable(const std::string& block_device, const LpMetadata& metadata,
-                         uint32_t slot_number) {
+bool FlashPartitionTable(const std::string& block_device, const LpMetadata& metadata) {
     android::base::unique_fd fd(open(block_device.c_str(), O_RDWR | O_SYNC));
     if (fd < 0) {
         PERROR << __PRETTY_FUNCTION__ << "open failed: " << block_device;
         return false;
     }
-    if (!FlashPartitionTable(fd, metadata, slot_number)) {
+    if (!FlashPartitionTable(fd, metadata)) {
         return false;
     }
     LWARN << "Flashed new logical partition geometry to " << block_device;
diff --git a/fs_mgr/liblp/writer.h b/fs_mgr/liblp/writer.h
index adbbebf..ab18d45 100644
--- a/fs_mgr/liblp/writer.h
+++ b/fs_mgr/liblp/writer.h
@@ -30,7 +30,7 @@
 
 // These variants are for testing only. The path-based functions should be used
 // for actual operation, so that open() is called with the correct flags.
-bool FlashPartitionTable(int fd, const LpMetadata& metadata, uint32_t slot_number);
+bool FlashPartitionTable(int fd, const LpMetadata& metadata);
 bool UpdatePartitionTable(int fd, const LpMetadata& metadata, uint32_t slot_number);
 
 bool UpdatePartitionTable(int fd, const LpMetadata& metadata, uint32_t slot_number,
diff --git a/fs_mgr/tools/dmctl.cpp b/fs_mgr/tools/dmctl.cpp
index 45a81af..879ba21 100644
--- a/fs_mgr/tools/dmctl.cpp
+++ b/fs_mgr/tools/dmctl.cpp
@@ -22,6 +22,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include <android-base/logging.h>
 #include <android-base/parseint.h>
 #include <android-base/unique_fd.h>
 #include <libdm/dm.h>
diff --git a/healthd/healthd_draw.cpp b/healthd/healthd_draw.cpp
index 30f2cf3..706dc80 100644
--- a/healthd/healthd_draw.cpp
+++ b/healthd/healthd_draw.cpp
@@ -173,7 +173,7 @@
         cur_level = 100;
     }
 
-    if (cur_level <= 0) return;
+    if (cur_level < 0) return;
 
     const animation::text_field& field = anim->text_percent;
     if (field.font == nullptr || field.font->char_width == 0 || field.font->char_height == 0) {
diff --git a/healthd/healthd_mode_charger.cpp b/healthd/healthd_mode_charger.cpp
index 56a9f86..2eb5497 100644
--- a/healthd/healthd_mode_charger.cpp
+++ b/healthd/healthd_mode_charger.cpp
@@ -72,6 +72,7 @@
 #define BATTERY_UNKNOWN_TIME (2 * MSEC_PER_SEC)
 #define POWER_ON_KEY_TIME (2 * MSEC_PER_SEC)
 #define UNPLUGGED_SHUTDOWN_TIME (10 * MSEC_PER_SEC)
+#define UNPLUGGED_DISPLAY_TIME (3 * MSEC_PER_SEC)
 
 #define LAST_KMSG_MAX_SZ (32 * 1024)
 
@@ -91,6 +92,7 @@
 struct charger {
     bool have_battery_state;
     bool charger_connected;
+    bool screen_blanked;
     int64_t next_screen_transition;
     int64_t next_key_check;
     int64_t next_pwr_check;
@@ -293,6 +295,7 @@
 
 #ifndef CHARGER_DISABLE_INIT_BLANK
         healthd_draw->blank_screen(true);
+        charger->screen_blanked = true;
 #endif
     }
 
@@ -301,6 +304,7 @@
         reset_animation(batt_anim);
         charger->next_screen_transition = -1;
         healthd_draw->blank_screen(true);
+        charger->screen_blanked = true;
         LOGV("[%" PRId64 "] animation done\n", now);
         if (charger->charger_connected) request_suspend(true);
         return;
@@ -308,8 +312,10 @@
 
     disp_time = batt_anim->frames[batt_anim->cur_frame].disp_time;
 
-    /* unblank the screen on first cycle and first frame */
-    if (batt_anim->cur_cycle == 0 && batt_anim->cur_frame == 0) healthd_draw->blank_screen(false);
+    if (charger->screen_blanked) {
+        healthd_draw->blank_screen(false);
+        charger->screen_blanked = false;
+    }
 
     /* animation starting, set up the animation */
     if (batt_anim->cur_frame == 0) {
@@ -327,9 +333,15 @@
                     }
                 }
 
-                // repeat the first frame first_frame_repeats times
-                disp_time = batt_anim->frames[batt_anim->cur_frame].disp_time *
-                            batt_anim->first_frame_repeats;
+                if (charger->charger_connected) {
+                    // repeat the first frame first_frame_repeats times
+                    disp_time = batt_anim->frames[batt_anim->cur_frame].disp_time *
+                                batt_anim->first_frame_repeats;
+                } else {
+                    disp_time = UNPLUGGED_DISPLAY_TIME / batt_anim->num_cycles;
+                }
+
+                LOGV("cur_frame=%d disp_time=%d\n", batt_anim->cur_frame, disp_time);
             }
         }
     }
@@ -348,7 +360,7 @@
     }
 
     /* schedule next screen transition */
-    charger->next_screen_transition = now + disp_time;
+    charger->next_screen_transition = curr_time_ms() + disp_time;
 
     /* advance frame cntr to the next valid frame only if we are charging
      * if necessary, advance cycle cntr, and reset frame cntr
@@ -458,6 +470,7 @@
             /* if the power key got released, force screen state cycle */
             if (key->pending) {
                 kick_animation(charger->batt_anim);
+                request_suspend(false);
             }
         }
     }
@@ -476,12 +489,18 @@
     if (!charger->have_battery_state) return;
 
     if (!charger->charger_connected) {
-        /* Last cycle would have stopped at the extreme top of battery-icon
-         * Need to show the correct level corresponding to capacity.
-         */
-        kick_animation(charger->batt_anim);
         request_suspend(false);
         if (charger->next_pwr_check == -1) {
+            /* Last cycle would have stopped at the extreme top of battery-icon
+             * Need to show the correct level corresponding to capacity.
+             *
+             * Reset next_screen_transition to update screen immediately.
+             * Reset & kick animation to show complete animation cycles
+             * when charger disconnected.
+             */
+            charger->next_screen_transition = now - 1;
+            reset_animation(charger->batt_anim);
+            kick_animation(charger->batt_anim);
             charger->next_pwr_check = now + UNPLUGGED_SHUTDOWN_TIME;
             LOGW("[%" PRId64 "] device unplugged: shutting down in %" PRId64 " (@ %" PRId64 ")\n",
                  now, (int64_t)UNPLUGGED_SHUTDOWN_TIME, charger->next_pwr_check);
@@ -494,8 +513,15 @@
     } else {
         /* online supply present, reset shutdown timer if set */
         if (charger->next_pwr_check != -1) {
-            LOGW("[%" PRId64 "] device plugged in: shutdown cancelled\n", now);
+            /* Reset next_screen_transition to update screen immediately.
+             * Reset & kick animation to show complete animation cycles
+             * when charger connected again.
+             */
+            request_suspend(false);
+            charger->next_screen_transition = now - 1;
+            reset_animation(charger->batt_anim);
             kick_animation(charger->batt_anim);
+            LOGW("[%" PRId64 "] device plugged in: shutdown cancelled\n", now);
         }
         charger->next_pwr_check = -1;
     }
@@ -523,6 +549,7 @@
     if (!charger->have_battery_state) {
         charger->have_battery_state = true;
         charger->next_screen_transition = curr_time_ms() - 1;
+        request_suspend(false);
         reset_animation(charger->batt_anim);
         kick_animation(charger->batt_anim);
     }
diff --git a/init/Android.mk b/init/Android.mk
index d20509b..ada87b8 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -81,7 +81,6 @@
 
 LOCAL_REQUIRED_MODULES := \
     init_second_stage \
-    init_second_stage.recovery \
 
 LOCAL_SANITIZE := signed-integer-overflow
 include $(BUILD_EXECUTABLE)
diff --git a/init/README.md b/init/README.md
index b0a73b9..b45da21 100644
--- a/init/README.md
+++ b/init/README.md
@@ -506,6 +506,7 @@
   _resource_ is best specified using its text representation ('cpu', 'rtio', etc
   or 'RLIM_CPU', 'RLIM_RTIO', etc). It also may be specified as the int value
   that the resource enum corresponds to.
+  _cur_ and _max_ can be 'unlimited' or '-1' to indicate an infinite rlimit.
 
 `start <service>`
 > Start a service running if it is not already running.
diff --git a/init/init.cpp b/init/init.cpp
index b550f1b..16564f4 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -114,8 +114,8 @@
         if (!parser.ParseConfig("/product/etc/init")) {
             late_import_paths.emplace_back("/product/etc/init");
         }
-        if (!parser.ParseConfig("/product-services/etc/init")) {
-            late_import_paths.emplace_back("/product-services/etc/init");
+        if (!parser.ParseConfig("/product_services/etc/init")) {
+            late_import_paths.emplace_back("/product_services/etc/init");
         }
         if (!parser.ParseConfig("/odm/etc/init")) {
             late_import_paths.emplace_back("/odm/etc/init");
diff --git a/init/property_service.cpp b/init/property_service.cpp
index cd2f630..5c8b92a 100644
--- a/init/property_service.cpp
+++ b/init/property_service.cpp
@@ -692,7 +692,7 @@
         }
     }
     load_properties_from_file("/product/build.prop", NULL);
-    load_properties_from_file("/product-services/build.prop", NULL);
+    load_properties_from_file("/product_services/build.prop", NULL);
     load_properties_from_file("/odm/default.prop", NULL);
     load_properties_from_file("/vendor/default.prop", NULL);
 
diff --git a/init/property_type.cpp b/init/property_type.cpp
index 249b12b..7d80555 100644
--- a/init/property_type.cpp
+++ b/init/property_type.cpp
@@ -29,6 +29,11 @@
 namespace init {
 
 bool CheckType(const std::string& type_string, const std::string& value) {
+    // Always allow clearing a property such that the default value when it is not set takes over.
+    if (value.empty()) {
+        return true;
+    }
+
     auto type_strings = Split(type_string, " ");
     if (type_strings.empty()) {
         return false;
diff --git a/init/property_type_test.cpp b/init/property_type_test.cpp
index 068bccc..6d7f927 100644
--- a/init/property_type_test.cpp
+++ b/init/property_type_test.cpp
@@ -32,7 +32,7 @@
 }
 
 TEST(property_type, CheckType_int) {
-    EXPECT_FALSE(CheckType("int", ""));
+    EXPECT_TRUE(CheckType("int", ""));
     EXPECT_FALSE(CheckType("int", "abc"));
     EXPECT_FALSE(CheckType("int", "-abc"));
     EXPECT_TRUE(CheckType("int", "0"));
@@ -43,7 +43,7 @@
 }
 
 TEST(property_type, CheckType_uint) {
-    EXPECT_FALSE(CheckType("uint", ""));
+    EXPECT_TRUE(CheckType("uint", ""));
     EXPECT_FALSE(CheckType("uint", "abc"));
     EXPECT_FALSE(CheckType("uint", "-abc"));
     EXPECT_TRUE(CheckType("uint", "0"));
@@ -53,7 +53,7 @@
 }
 
 TEST(property_type, CheckType_double) {
-    EXPECT_FALSE(CheckType("double", ""));
+    EXPECT_TRUE(CheckType("double", ""));
     EXPECT_FALSE(CheckType("double", "abc"));
     EXPECT_FALSE(CheckType("double", "-abc"));
     EXPECT_TRUE(CheckType("double", "0.0"));
@@ -64,7 +64,7 @@
 }
 
 TEST(property_type, CheckType_size) {
-    EXPECT_FALSE(CheckType("size", ""));
+    EXPECT_TRUE(CheckType("size", ""));
     EXPECT_FALSE(CheckType("size", "ab"));
     EXPECT_FALSE(CheckType("size", "abcd"));
     EXPECT_FALSE(CheckType("size", "0"));
@@ -80,7 +80,7 @@
 }
 
 TEST(property_type, CheckType_enum) {
-    EXPECT_FALSE(CheckType("enum abc", ""));
+    EXPECT_TRUE(CheckType("enum abc", ""));
     EXPECT_FALSE(CheckType("enum abc", "ab"));
     EXPECT_FALSE(CheckType("enum abc", "abcd"));
     EXPECT_FALSE(CheckType("enum 123 456 789", "0"));
diff --git a/init/rlimit_parser.cpp b/init/rlimit_parser.cpp
index fe1d6a7..1e0754a 100644
--- a/init/rlimit_parser.cpp
+++ b/init/rlimit_parser.cpp
@@ -65,12 +65,18 @@
     }
 
     rlimit limit;
-    if (!ParseUint(args[2], &limit.rlim_cur)) {
+    if (args[2] == "-1" || args[2] == "unlimited") {
+        limit.rlim_cur = RLIM_INFINITY;
+    } else if (!ParseUint(args[2], &limit.rlim_cur)) {
         return Error() << "Could not parse soft limit '" << args[2] << "'";
     }
-    if (!ParseUint(args[3], &limit.rlim_max)) {
+
+    if (args[3] == "-1" || args[3] == "unlimited") {
+        limit.rlim_max = RLIM_INFINITY;
+    } else if (!ParseUint(args[3], &limit.rlim_max)) {
         return Error() << "Could not parse hard limit '" << args[3] << "'";
     }
+
     return {resource, limit};
 }
 
diff --git a/init/rlimit_parser_test.cpp b/init/rlimit_parser_test.cpp
index f3f9eb4..659ba8a 100644
--- a/init/rlimit_parser_test.cpp
+++ b/init/rlimit_parser_test.cpp
@@ -49,58 +49,58 @@
 
 TEST(rlimit, RlimitSuccess) {
     const std::vector<std::pair<std::vector<std::string>, std::pair<int, rlimit>>>
-        inputs_and_results = {
-            {{"cpu", "10", "10"}, {0, {10, 10}}},
-            {{"fsize", "10", "10"}, {1, {10, 10}}},
-            {{"data", "10", "10"}, {2, {10, 10}}},
-            {{"stack", "10", "10"}, {3, {10, 10}}},
-            {{"core", "10", "10"}, {4, {10, 10}}},
-            {{"rss", "10", "10"}, {5, {10, 10}}},
-            {{"nproc", "10", "10"}, {6, {10, 10}}},
-            {{"nofile", "10", "10"}, {7, {10, 10}}},
-            {{"memlock", "10", "10"}, {8, {10, 10}}},
-            {{"as", "10", "10"}, {9, {10, 10}}},
-            {{"locks", "10", "10"}, {10, {10, 10}}},
-            {{"sigpending", "10", "10"}, {11, {10, 10}}},
-            {{"msgqueue", "10", "10"}, {12, {10, 10}}},
-            {{"nice", "10", "10"}, {13, {10, 10}}},
-            {{"rtprio", "10", "10"}, {14, {10, 10}}},
-            {{"rttime", "10", "10"}, {15, {10, 10}}},
+            inputs_and_results = {
+                    {{"cpu", "10", "10"}, {0, {10, 10}}},
+                    {{"fsize", "10", "10"}, {1, {10, 10}}},
+                    {{"data", "10", "10"}, {2, {10, 10}}},
+                    {{"stack", "10", "10"}, {3, {10, 10}}},
+                    {{"core", "10", "10"}, {4, {10, 10}}},
+                    {{"rss", "10", "10"}, {5, {10, 10}}},
+                    {{"nproc", "10", "10"}, {6, {10, 10}}},
+                    {{"nofile", "10", "10"}, {7, {10, 10}}},
+                    {{"memlock", "10", "10"}, {8, {10, 10}}},
+                    {{"as", "10", "10"}, {9, {10, 10}}},
+                    {{"locks", "10", "10"}, {10, {10, 10}}},
+                    {{"sigpending", "10", "10"}, {11, {10, 10}}},
+                    {{"msgqueue", "10", "10"}, {12, {10, 10}}},
+                    {{"nice", "10", "10"}, {13, {10, 10}}},
+                    {{"rtprio", "10", "10"}, {14, {10, 10}}},
+                    {{"rttime", "10", "10"}, {15, {10, 10}}},
 
-            {{"RLIM_CPU", "10", "10"}, {0, {10, 10}}},
-            {{"RLIM_FSIZE", "10", "10"}, {1, {10, 10}}},
-            {{"RLIM_DATA", "10", "10"}, {2, {10, 10}}},
-            {{"RLIM_STACK", "10", "10"}, {3, {10, 10}}},
-            {{"RLIM_CORE", "10", "10"}, {4, {10, 10}}},
-            {{"RLIM_RSS", "10", "10"}, {5, {10, 10}}},
-            {{"RLIM_NPROC", "10", "10"}, {6, {10, 10}}},
-            {{"RLIM_NOFILE", "10", "10"}, {7, {10, 10}}},
-            {{"RLIM_MEMLOCK", "10", "10"}, {8, {10, 10}}},
-            {{"RLIM_AS", "10", "10"}, {9, {10, 10}}},
-            {{"RLIM_LOCKS", "10", "10"}, {10, {10, 10}}},
-            {{"RLIM_SIGPENDING", "10", "10"}, {11, {10, 10}}},
-            {{"RLIM_MSGQUEUE", "10", "10"}, {12, {10, 10}}},
-            {{"RLIM_NICE", "10", "10"}, {13, {10, 10}}},
-            {{"RLIM_RTPRIO", "10", "10"}, {14, {10, 10}}},
-            {{"RLIM_RTTIME", "10", "10"}, {15, {10, 10}}},
+                    {{"RLIM_CPU", "10", "10"}, {0, {10, 10}}},
+                    {{"RLIM_FSIZE", "10", "10"}, {1, {10, 10}}},
+                    {{"RLIM_DATA", "10", "10"}, {2, {10, 10}}},
+                    {{"RLIM_STACK", "10", "10"}, {3, {10, 10}}},
+                    {{"RLIM_CORE", "10", "10"}, {4, {10, 10}}},
+                    {{"RLIM_RSS", "10", "10"}, {5, {10, 10}}},
+                    {{"RLIM_NPROC", "10", "10"}, {6, {10, 10}}},
+                    {{"RLIM_NOFILE", "10", "10"}, {7, {10, 10}}},
+                    {{"RLIM_MEMLOCK", "10", "10"}, {8, {10, 10}}},
+                    {{"RLIM_AS", "10", "10"}, {9, {10, 10}}},
+                    {{"RLIM_LOCKS", "10", "10"}, {10, {10, 10}}},
+                    {{"RLIM_SIGPENDING", "10", "10"}, {11, {10, 10}}},
+                    {{"RLIM_MSGQUEUE", "10", "10"}, {12, {10, 10}}},
+                    {{"RLIM_NICE", "10", "10"}, {13, {10, 10}}},
+                    {{"RLIM_RTPRIO", "10", "10"}, {14, {10, 10}}},
+                    {{"RLIM_RTTIME", "10", "10"}, {15, {10, 10}}},
 
-            {{"0", "10", "10"}, {0, {10, 10}}},
-            {{"1", "10", "10"}, {1, {10, 10}}},
-            {{"2", "10", "10"}, {2, {10, 10}}},
-            {{"3", "10", "10"}, {3, {10, 10}}},
-            {{"4", "10", "10"}, {4, {10, 10}}},
-            {{"5", "10", "10"}, {5, {10, 10}}},
-            {{"6", "10", "10"}, {6, {10, 10}}},
-            {{"7", "10", "10"}, {7, {10, 10}}},
-            {{"8", "10", "10"}, {8, {10, 10}}},
-            {{"9", "10", "10"}, {9, {10, 10}}},
-            {{"10", "10", "10"}, {10, {10, 10}}},
-            {{"11", "10", "10"}, {11, {10, 10}}},
-            {{"12", "10", "10"}, {12, {10, 10}}},
-            {{"13", "10", "10"}, {13, {10, 10}}},
-            {{"14", "10", "10"}, {14, {10, 10}}},
-            {{"15", "10", "10"}, {15, {10, 10}}},
-        };
+                    {{"0", "10", "10"}, {0, {10, 10}}},
+                    {{"1", "10", "10"}, {1, {10, 10}}},
+                    {{"2", "10", "10"}, {2, {10, 10}}},
+                    {{"3", "10", "10"}, {3, {10, 10}}},
+                    {{"4", "10", "10"}, {4, {10, 10}}},
+                    {{"5", "10", "10"}, {5, {10, 10}}},
+                    {{"6", "10", "10"}, {6, {10, 10}}},
+                    {{"7", "10", "10"}, {7, {10, 10}}},
+                    {{"8", "10", "10"}, {8, {10, 10}}},
+                    {{"9", "10", "10"}, {9, {10, 10}}},
+                    {{"10", "10", "10"}, {10, {10, 10}}},
+                    {{"11", "10", "10"}, {11, {10, 10}}},
+                    {{"12", "unlimited", "10"}, {12, {RLIM_INFINITY, 10}}},
+                    {{"13", "-1", "10"}, {13, {RLIM_INFINITY, 10}}},
+                    {{"14", "10", "unlimited"}, {14, {10, RLIM_INFINITY}}},
+                    {{"15", "10", "-1"}, {15, {10, RLIM_INFINITY}}},
+            };
 
     for (const auto& [input, expected_result] : inputs_and_results) {
         TestRlimitSuccess(input, expected_result);
@@ -109,12 +109,16 @@
 
 TEST(rlimit, RlimitFailure) {
     const std::vector<std::pair<std::vector<std::string>, std::string>> inputs_and_results = {
-        {{"-4", "10", "10"}, "Resource '-4' below the minimum resource value '0'"},
-        {{"100", "10", "10"}, "Resource '100' over the maximum resource value '16'"},
-        {{"bad_string", "10", "10"}, "Could not parse resource 'bad_string'"},
-        {{"RLIM_", "10", "10"}, "Could not parse resource 'RLIM_'"},
-        {{"cpu", "abc", "10"}, "Could not parse soft limit 'abc'"},
-        {{"cpu", "10", "abc"}, "Could not parse hard limit 'abc'"},
+            {{"-4", "10", "10"}, "Resource '-4' below the minimum resource value '0'"},
+            {{"100", "10", "10"}, "Resource '100' over the maximum resource value '16'"},
+            {{"bad_string", "10", "10"}, "Could not parse resource 'bad_string'"},
+            {{"RLIM_", "10", "10"}, "Could not parse resource 'RLIM_'"},
+            {{"cpu", "abc", "10"}, "Could not parse soft limit 'abc'"},
+            {{"cpu", "10", "abc"}, "Could not parse hard limit 'abc'"},
+            {{"cpu", "unlimit", "10"}, "Could not parse soft limit 'unlimit'"},
+            {{"cpu", "10", "unlimit"}, "Could not parse hard limit 'unlimit'"},
+            {{"cpu", "-2", "10"}, "Could not parse soft limit '-2'"},
+            {{"cpu", "10", "-2"}, "Could not parse hard limit '-2'"},
     };
 
     for (const auto& [input, expected_result] : inputs_and_results) {
diff --git a/libbacktrace/backtrace_benchmarks.cpp b/libbacktrace/backtrace_benchmarks.cpp
index 099ac60..a93a25e 100644
--- a/libbacktrace/backtrace_benchmarks.cpp
+++ b/libbacktrace/backtrace_benchmarks.cpp
@@ -35,10 +35,6 @@
 #include <backtrace/BacktraceMap.h>
 #include <unwindstack/Memory.h>
 
-// Definitions of prctl arguments to set a vma name in Android kernels.
-#define ANDROID_PR_SET_VMA 0x53564d41
-#define ANDROID_PR_SET_VMA_ANON_NAME 0
-
 constexpr size_t kNumMaps = 2000;
 
 static bool CountMaps(pid_t pid, size_t* num_maps) {
@@ -93,10 +89,11 @@
         exit(1);
       }
       memset(memory, 0x1, PAGE_SIZE);
-      if (prctl(ANDROID_PR_SET_VMA, ANDROID_PR_SET_VMA_ANON_NAME, memory, PAGE_SIZE, "test_map") ==
-          -1) {
+#if defined(PR_SET_VMA)
+      if (prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, memory, PAGE_SIZE, "test_map") == -1) {
         fprintf(stderr, "Failed: %s\n", strerror(errno));
       }
+#endif
       maps.push_back(memory);
     }
 
diff --git a/libcutils/fs_config.cpp b/libcutils/fs_config.cpp
index af8f0a2..bd5f26f 100644
--- a/libcutils/fs_config.cpp
+++ b/libcutils/fs_config.cpp
@@ -149,7 +149,7 @@
     { 00444, AID_ROOT,      AID_ROOT,      0, oem_conf_dir + 1 },
     { 00444, AID_ROOT,      AID_ROOT,      0, oem_conf_file + 1 },
     { 00600, AID_ROOT,      AID_ROOT,      0, "product/build.prop" },
-    { 00600, AID_ROOT,      AID_ROOT,      0, "product-services/build.prop" },
+    { 00600, AID_ROOT,      AID_ROOT,      0, "product_services/build.prop" },
     { 00750, AID_ROOT,      AID_SHELL,     0, "sbin/fs_mgr" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/crash_dump32" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/crash_dump64" },
diff --git a/libmemunreachable/Allocator.cpp b/libmemunreachable/Allocator.cpp
index 213be17..1eb7e98 100644
--- a/libmemunreachable/Allocator.cpp
+++ b/libmemunreachable/Allocator.cpp
@@ -24,6 +24,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/mman.h>
+#include <sys/prctl.h>
 
 #include <cmath>
 #include <cstddef>
@@ -35,7 +36,6 @@
 
 #include "Allocator.h"
 #include "LinkedList.h"
-#include "anon_vma_naming.h"
 
 namespace android {
 
@@ -153,10 +153,10 @@
     munmap(reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(ptr) + size), map_size - size);
   }
 
-#define PR_SET_VMA 0x53564d41
-#define PR_SET_VMA_ANON_NAME 0
+#if defined(PR_SET_VMA)
   prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, reinterpret_cast<uintptr_t>(ptr), size,
         "leak_detector_malloc");
+#endif
 
   return ptr;
 }
diff --git a/libmemunreachable/PtracerThread.cpp b/libmemunreachable/PtracerThread.cpp
index 61a1d24..d2fca49 100644
--- a/libmemunreachable/PtracerThread.cpp
+++ b/libmemunreachable/PtracerThread.cpp
@@ -24,6 +24,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
+#include <sys/prctl.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -32,7 +33,6 @@
 #include "android-base/macros.h"
 
 #include "PtracerThread.h"
-#include "anon_vma_naming.h"
 #include "log.h"
 
 namespace android {
diff --git a/libmemunreachable/anon_vma_naming.h b/libmemunreachable/anon_vma_naming.h
deleted file mode 100644
index fb31e41..0000000
--- a/libmemunreachable/anon_vma_naming.h
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * Copyright (C) 2016 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef LIBMEMUNREACHABLE_ANON_VMA_NAMING_H_
-#define LIBMEMUNREACHABLE_ANON_VMA_NAMING_H_
-
-#include <sys/prctl.h>
-
-#define PR_SET_VMA 0x53564d41
-#define PR_SET_VMA_ANON_NAME 0
-
-#endif  // LIBMEMUNREACHABLE_ANON_VMA_NAMING_H_
diff --git a/libutils/Unicode.cpp b/libutils/Unicode.cpp
index e00fb81..82f650d 100644
--- a/libutils/Unicode.cpp
+++ b/libutils/Unicode.cpp
@@ -340,27 +340,6 @@
            : 0);
 }
 
-int strzcmp16_h_n(const char16_t *s1H, size_t n1, const char16_t *s2N, size_t n2)
-{
-    const char16_t* e1 = s1H+n1;
-    const char16_t* e2 = s2N+n2;
-
-    while (s1H < e1 && s2N < e2) {
-        const char16_t c2 = ntohs(*s2N);
-        const int d = (int)*s1H++ - (int)c2;
-        s2N++;
-        if (d) {
-            return d;
-        }
-    }
-
-    return n1 < n2
-        ? (0 - (int)ntohs(*s2N))
-        : (n1 > n2
-           ? ((int)*s1H - 0)
-           : 0);
-}
-
 void utf16_to_utf8(const char16_t* src, size_t src_len, char* dst, size_t dst_len)
 {
     if (src == nullptr || src_len == 0 || dst == nullptr) {
diff --git a/libutils/include/utils/StrongPointer.h b/libutils/include/utils/StrongPointer.h
index 360fce5..3abce17 100644
--- a/libutils/include/utils/StrongPointer.h
+++ b/libutils/include/utils/StrongPointer.h
@@ -228,8 +228,10 @@
 
 template<typename T>
 void sp<T>::clear() {
-    if (m_ptr) {
-        m_ptr->decStrong(this);
+    T* oldPtr(*const_cast<T* volatile*>(&m_ptr));
+    if (oldPtr) {
+        oldPtr->decStrong(this);
+        if (oldPtr != *const_cast<T* volatile*>(&m_ptr)) sp_report_race();
         m_ptr = nullptr;
     }
 }
diff --git a/libutils/include/utils/Unicode.h b/libutils/include/utils/Unicode.h
index 666b70f..61a1b4f 100644
--- a/libutils/include/utils/Unicode.h
+++ b/libutils/include/utils/Unicode.h
@@ -40,9 +40,6 @@
 // equivalent result as strcmp16 (unlike strncmp16).
 int strzcmp16(const char16_t *s1, size_t n1, const char16_t *s2, size_t n2);
 
-// Version of strzcmp16 for comparing strings in different endianness.
-int strzcmp16_h_n(const char16_t *s1H, size_t n1, const char16_t *s2N, size_t n2);
-
 // Standard string functions on char32_t strings.
 size_t strlen32(const char32_t *);
 size_t strnlen32(const char32_t *, size_t);
diff --git a/logd/main.cpp b/logd/main.cpp
index b697d44..8c38d9a 100644
--- a/logd/main.cpp
+++ b/logd/main.cpp
@@ -104,7 +104,8 @@
         return -1;
     }
 
-    if (__android_logger_property_get_bool("ro.debuggable", BOOL_DEFAULT_FALSE) &&
+    if (!__android_logger_property_get_bool("ro.debuggable",
+                                            BOOL_DEFAULT_FALSE) &&
         prctl(PR_SET_DUMPABLE, 0) == -1) {
         android::prdebug("failed to clear PR_SET_DUMPABLE");
         return -1;
diff --git a/rootdir/Android.mk b/rootdir/Android.mk
index 2429b49..07f0797 100644
--- a/rootdir/Android.mk
+++ b/rootdir/Android.mk
@@ -94,9 +94,9 @@
   LOCAL_POST_INSTALL_CMD += ; ln -sf /system/product $(TARGET_ROOT_OUT)/product
 endif
 ifdef BOARD_USES_PRODUCT_SERVICESIMAGE
-  LOCAL_POST_INSTALL_CMD += ; mkdir -p $(TARGET_ROOT_OUT)/product-services
+  LOCAL_POST_INSTALL_CMD += ; mkdir -p $(TARGET_ROOT_OUT)/product_services
 else
-  LOCAL_POST_INSTALL_CMD += ; ln -sf /system/product-services $(TARGET_ROOT_OUT)/product-services
+  LOCAL_POST_INSTALL_CMD += ; ln -sf /system/product_services $(TARGET_ROOT_OUT)/product_services
 endif
 ifdef BOARD_USES_METADATA_PARTITION
   LOCAL_POST_INSTALL_CMD += ; mkdir -p $(TARGET_ROOT_OUT)/metadata
@@ -289,7 +289,7 @@
 LOCAL_MODULE := ld.config.recovery.txt
 LOCAL_MODULE_CLASS := ETC
 LOCAL_SRC_FILES := etc/ld.config.recovery.txt
-LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/etc
+LOCAL_MODULE_PATH := $(TARGET_RECOVERY_ROOT_OUT)/system/etc
 LOCAL_MODULE_STEM := ld.config.txt
 include $(BUILD_PREBUILT)
 
diff --git a/rootdir/etc/OWNERS b/rootdir/etc/OWNERS
new file mode 100644
index 0000000..8a65b23
--- /dev/null
+++ b/rootdir/etc/OWNERS
@@ -0,0 +1,4 @@
+danalbert@google.com
+enh@google.com
+jiyong@google.com
+rprichard@google.com
diff --git a/rootdir/etc/ld.config.txt b/rootdir/etc/ld.config.txt
index 7d22a3a..f2892f8 100644
--- a/rootdir/etc/ld.config.txt
+++ b/rootdir/etc/ld.config.txt
@@ -8,7 +8,7 @@
 dir.system = /system/bin/
 dir.system = /system/xbin/
 dir.system = /%PRODUCT%/bin/
-dir.system = /%PRODUCTSERVICES%/bin/
+dir.system = /%PRODUCT_SERVICES%/bin/
 
 dir.vendor = /odm/bin/
 dir.vendor = /vendor/bin/
@@ -41,7 +41,7 @@
 
 namespace.default.search.paths  = /system/${LIB}
 namespace.default.search.paths += /%PRODUCT%/${LIB}
-namespace.default.search.paths += /%PRODUCTSERVICES%/${LIB}
+namespace.default.search.paths += /%PRODUCT_SERVICES%/${LIB}
 
 # We can't have entire /system/${LIB} as permitted paths because doing so
 # makes it possible to load libs in /system/${LIB}/vndk* directories by
@@ -54,7 +54,7 @@
 namespace.default.permitted.paths += /system/${LIB}/extractors
 namespace.default.permitted.paths += /system/${LIB}/hw
 namespace.default.permitted.paths += /%PRODUCT%/${LIB}
-namespace.default.permitted.paths += /%PRODUCTSERVICES%/${LIB}
+namespace.default.permitted.paths += /%PRODUCT_SERVICES%/${LIB}
 # These are where odex files are located. libart has to be able to dlopen the files
 namespace.default.permitted.paths += /system/framework
 namespace.default.permitted.paths += /system/app
@@ -69,9 +69,9 @@
 namespace.default.permitted.paths += /%PRODUCT%/framework
 namespace.default.permitted.paths += /%PRODUCT%/app
 namespace.default.permitted.paths += /%PRODUCT%/priv-app
-namespace.default.permitted.paths += /%PRODUCTSERVICES%/framework
-namespace.default.permitted.paths += /%PRODUCTSERVICES%/app
-namespace.default.permitted.paths += /%PRODUCTSERVICES%/priv-app
+namespace.default.permitted.paths += /%PRODUCT_SERVICES%/framework
+namespace.default.permitted.paths += /%PRODUCT_SERVICES%/app
+namespace.default.permitted.paths += /%PRODUCT_SERVICES%/priv-app
 namespace.default.permitted.paths += /data
 namespace.default.permitted.paths += /mnt/expand
 
@@ -79,8 +79,8 @@
 namespace.default.asan.search.paths +=           /system/${LIB}
 namespace.default.asan.search.paths += /data/asan/product/${LIB}
 namespace.default.asan.search.paths +=           /product/${LIB}
-namespace.default.asan.search.paths += /data/asan/product-services/${LIB}
-namespace.default.asan.search.paths +=           /product-services/${LIB}
+namespace.default.asan.search.paths += /data/asan/product_services/${LIB}
+namespace.default.asan.search.paths +=           /product_services/${LIB}
 
 namespace.default.asan.permitted.paths  = /data
 namespace.default.asan.permitted.paths += /system/${LIB}/drm
@@ -100,10 +100,10 @@
 namespace.default.asan.permitted.paths += /%PRODUCT%/framework
 namespace.default.asan.permitted.paths += /%PRODUCT%/app
 namespace.default.asan.permitted.paths += /%PRODUCT%/priv-app
-namespace.default.asan.permitted.paths += /%PRODUCTSERVICES%/${LIB}
-namespace.default.asan.permitted.paths += /%PRODUCTSERVICES%/framework
-namespace.default.asan.permitted.paths += /%PRODUCTSERVICES%/app
-namespace.default.asan.permitted.paths += /%PRODUCTSERVICES%/priv-app
+namespace.default.asan.permitted.paths += /%PRODUCT_SERVICES%/${LIB}
+namespace.default.asan.permitted.paths += /%PRODUCT_SERVICES%/framework
+namespace.default.asan.permitted.paths += /%PRODUCT_SERVICES%/app
+namespace.default.asan.permitted.paths += /%PRODUCT_SERVICES%/priv-app
 namespace.default.asan.permitted.paths += /mnt/expand
 
 ###############################################################################
@@ -340,7 +340,7 @@
 
 namespace.system.search.paths  = /system/${LIB}
 namespace.system.search.paths += /%PRODUCT%/${LIB}
-namespace.system.search.paths += /%PRODUCTSERVICES%/${LIB}
+namespace.system.search.paths += /%PRODUCT_SERVICES%/${LIB}
 
 namespace.system.asan.search.paths  = /data/asan/system/${LIB}
 namespace.system.asan.search.paths +=           /system/${LIB}
@@ -359,4 +359,4 @@
 namespace.default.isolated = false
 namespace.default.search.paths  = /system/${LIB}
 namespace.default.search.paths += /%PRODUCT%/${LIB}
-namespace.default.search.paths += /%PRODUCTSERVICES%/${LIB}
+namespace.default.search.paths += /%PRODUCT_SERVICES%/${LIB}
diff --git a/rootdir/init.rc b/rootdir/init.rc
index bf22951..db89ea8 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -49,6 +49,10 @@
     copy /proc/cmdline /dev/urandom
     copy /default.prop /dev/urandom
 
+    symlink /proc/self/fd/0 /dev/stdin
+    symlink /proc/self/fd/1 /dev/stdout
+    symlink /proc/self/fd/2 /dev/stderr
+
     symlink /system/bin /bin
     symlink /system/etc /etc
 
diff --git a/rootdir/update_and_install_ld_config.mk b/rootdir/update_and_install_ld_config.mk
index 1b42c32..4d6df77 100644
--- a/rootdir/update_and_install_ld_config.mk
+++ b/rootdir/update_and_install_ld_config.mk
@@ -104,7 +104,7 @@
 	$(hide) sed -i.bak -e 's?%SANITIZER_RUNTIME_LIBRARIES%?$(PRIVATE_SANITIZER_RUNTIME_LIBRARIES)?g' $@
 	$(hide) sed -i.bak -e 's?%VNDK_VER%?$(PRIVATE_VNDK_VERSION_SUFFIX)?g' $@
 	$(hide) sed -i.bak -e 's?%PRODUCT%?$(TARGET_COPY_OUT_PRODUCT)?g' $@
-	$(hide) sed -i.bak -e 's?%PRODUCTSERVICES%?$(TARGET_COPY_OUT_PRODUCTSERVICES)?g' $@
+	$(hide) sed -i.bak -e 's?%PRODUCT_SERVICES%?$(TARGET_COPY_OUT_PRODUCT_SERVICES)?g' $@
 	$(hide) rm -f $@.bak
 
 ld_config_template :=
diff --git a/storaged/include/storaged_uid_monitor.h b/storaged/include/storaged_uid_monitor.h
index 3a718fa..fffb3d2 100644
--- a/storaged/include/storaged_uid_monitor.h
+++ b/storaged/include/storaged_uid_monitor.h
@@ -68,31 +68,33 @@
 
 struct uid_record {
     string name;
-    struct uid_io_usage ios;
+    uid_io_usage ios;
 };
 
 struct uid_records {
     uint64_t start_ts;
-    vector<struct uid_record> entries;
+    vector<uid_record> entries;
 };
 
 class uid_monitor {
 private:
     FRIEND_TEST(storaged_test, uid_monitor);
+    FRIEND_TEST(storaged_test, load_uid_io_proto);
+
     // last dump from /proc/uid_io/stats, uid -> uid_info
-    unordered_map<uint32_t, uid_info> last_uid_io_stats;
+    unordered_map<uint32_t, uid_info> last_uid_io_stats_;
     // current io usage for next report, app name -> uid_io_usage
-    unordered_map<string, struct uid_io_usage> curr_io_stats;
+    unordered_map<string, uid_io_usage> curr_io_stats_;
     // io usage records, end timestamp -> {start timestamp, vector of records}
-    map<uint64_t, struct uid_records> io_history;
+    map<uint64_t, uid_records> io_history_;
     // charger ON/OFF
-    charger_stat_t charger_stat;
+    charger_stat_t charger_stat_;
     // protects curr_io_stats, last_uid_io_stats, records and charger_stat
-    Mutex uidm_mutex;
+    Mutex uidm_mutex_;
     // start time for IO records
-    uint64_t start_ts;
+    uint64_t start_ts_;
     // true if UID_IO_STATS_PATH is accessible
-    const bool enable;
+    const bool enabled_;
 
     // reads from /proc/uid_io/stats
     unordered_map<uint32_t, uid_info> get_uid_io_stats_locked();
@@ -103,6 +105,10 @@
     // writes io_history to protobuf
     void update_uid_io_proto(unordered_map<int, StoragedProto>* protos);
 
+    // Ensure that io_history_ can append |n| items without exceeding
+    // MAX_UID_RECORDS_SIZE in size.
+    void maybe_shrink_history_for_items(size_t nitems);
+
 public:
     uid_monitor();
     // called by storaged main thread
@@ -110,16 +116,20 @@
     // called by storaged -u
     unordered_map<uint32_t, uid_info> get_uid_io_stats();
     // called by dumpsys
-    map<uint64_t, struct uid_records> dump(
+    map<uint64_t, uid_records> dump(
         double hours, uint64_t threshold, bool force_report);
     // called by battery properties listener
     void set_charger_state(charger_stat_t stat);
     // called by storaged periodic_chore or dump with force_report
-    bool enabled() { return enable; };
+    bool enabled() { return enabled_; };
     void report(unordered_map<int, StoragedProto>* protos);
     // restores io_history from protobuf
-    void load_uid_io_proto(const UidIOUsage& proto);
+    void load_uid_io_proto(userid_t user_id, const UidIOUsage& proto);
     void clear_user_history(userid_t user_id);
+
+    map<uint64_t, uid_records>& io_history() { return io_history_; }
+
+    static constexpr int MAX_UID_RECORDS_SIZE = 1000 * 48; // 1000 uids in 48 hours
 };
 
 #endif /* _STORAGED_UID_MONITOR_H_ */
diff --git a/storaged/storaged.cpp b/storaged/storaged.cpp
index f346c38..77c6167 100644
--- a/storaged/storaged.cpp
+++ b/storaged/storaged.cpp
@@ -194,7 +194,7 @@
         return;
     }
 
-    mUidm.load_uid_io_proto(proto.uid_io_usage());
+    mUidm.load_uid_io_proto(user_id, proto.uid_io_usage());
 
     if (user_id == USER_SYSTEM) {
         storage_info->load_perf_history_proto(proto.perf_history());
diff --git a/storaged/storaged_uid_monitor.cpp b/storaged/storaged_uid_monitor.cpp
index 5745782..55380ba 100644
--- a/storaged/storaged_uid_monitor.cpp
+++ b/storaged/storaged_uid_monitor.cpp
@@ -21,6 +21,7 @@
 
 #include <string>
 #include <unordered_map>
+#include <unordered_set>
 
 #include <android/content/pm/IPackageManagerNative.h>
 #include <android-base/file.h>
@@ -50,7 +51,7 @@
 
 std::unordered_map<uint32_t, uid_info> uid_monitor::get_uid_io_stats()
 {
-    Mutex::Autolock _l(uidm_mutex);
+    Mutex::Autolock _l(uidm_mutex_);
     return get_uid_io_stats_locked();
 };
 
@@ -178,10 +179,10 @@
             uid_io_stats[u.uid].name = std::to_string(u.uid);
             uids.push_back(u.uid);
             uid_names.push_back(&uid_io_stats[u.uid].name);
-            if (last_uid_io_stats.find(u.uid) == last_uid_io_stats.end()) {
+            if (last_uid_io_stats_.find(u.uid) == last_uid_io_stats_.end()) {
                 refresh_uid_names = true;
             } else {
-                uid_io_stats[u.uid].name = last_uid_io_stats[u.uid].name;
+                uid_io_stats[u.uid].name = last_uid_io_stats_[u.uid].name;
             }
         } else {
             task_info t;
@@ -200,8 +201,6 @@
 
 namespace {
 
-const int MAX_UID_RECORDS_SIZE = 1000 * 48; // 1000 uids in 48 hours
-
 inline size_t history_size(
     const std::map<uint64_t, struct uid_records>& history)
 {
@@ -218,12 +217,12 @@
 {
     // remove records more than 5 days old
     if (curr_ts > 5 * DAY_TO_SEC) {
-        auto it = io_history.lower_bound(curr_ts - 5 * DAY_TO_SEC);
-        io_history.erase(io_history.begin(), it);
+        auto it = io_history_.lower_bound(curr_ts - 5 * DAY_TO_SEC);
+        io_history_.erase(io_history_.begin(), it);
     }
 
     struct uid_records new_records;
-    for (const auto& p : curr_io_stats) {
+    for (const auto& p : curr_io_stats_) {
         struct uid_record record = {};
         record.name = p.first;
         if (!p.second.uid_ios.is_zero()) {
@@ -237,23 +236,26 @@
         }
     }
 
-    curr_io_stats.clear();
-    new_records.start_ts = start_ts;
-    start_ts = curr_ts;
+    curr_io_stats_.clear();
+    new_records.start_ts = start_ts_;
+    start_ts_ = curr_ts;
 
     if (new_records.entries.empty())
       return;
 
     // make some room for new records
-    ssize_t overflow = history_size(io_history) +
-        new_records.entries.size() - MAX_UID_RECORDS_SIZE;
-    while (overflow > 0 && io_history.size() > 0) {
-        auto del_it = io_history.begin();
-        overflow -= del_it->second.entries.size();
-        io_history.erase(io_history.begin());
-    }
+    maybe_shrink_history_for_items(new_records.entries.size());
 
-    io_history[curr_ts] = new_records;
+    io_history_[curr_ts] = new_records;
+}
+
+void uid_monitor::maybe_shrink_history_for_items(size_t nitems) {
+    ssize_t overflow = history_size(io_history_) + nitems - MAX_UID_RECORDS_SIZE;
+    while (overflow > 0 && io_history_.size() > 0) {
+        auto del_it = io_history_.begin();
+        overflow -= del_it->second.entries.size();
+        io_history_.erase(io_history_.begin());
+    }
 }
 
 std::map<uint64_t, struct uid_records> uid_monitor::dump(
@@ -263,7 +265,7 @@
         report(nullptr);
     }
 
-    Mutex::Autolock _l(uidm_mutex);
+    Mutex::Autolock _l(uidm_mutex_);
 
     std::map<uint64_t, struct uid_records> dump_records;
     uint64_t first_ts = 0;
@@ -272,7 +274,7 @@
         first_ts = time(NULL) - hours * HOUR_TO_SEC;
     }
 
-    for (auto it = io_history.lower_bound(first_ts); it != io_history.end(); ++it) {
+    for (auto it = io_history_.lower_bound(first_ts); it != io_history_.end(); ++it) {
         const std::vector<struct uid_record>& recs = it->second.entries;
         struct uid_records filtered;
 
@@ -311,29 +313,29 @@
 
     for (const auto& it : uid_io_stats) {
         const uid_info& uid = it.second;
-        if (curr_io_stats.find(uid.name) == curr_io_stats.end()) {
-            curr_io_stats[uid.name] = {};
+        if (curr_io_stats_.find(uid.name) == curr_io_stats_.end()) {
+            curr_io_stats_[uid.name] = {};
         }
 
-        struct uid_io_usage& usage = curr_io_stats[uid.name];
+        struct uid_io_usage& usage = curr_io_stats_[uid.name];
         usage.user_id = multiuser_get_user_id(uid.uid);
 
         int64_t fg_rd_delta = uid.io[FOREGROUND].read_bytes -
-            last_uid_io_stats[uid.uid].io[FOREGROUND].read_bytes;
+            last_uid_io_stats_[uid.uid].io[FOREGROUND].read_bytes;
         int64_t bg_rd_delta = uid.io[BACKGROUND].read_bytes -
-            last_uid_io_stats[uid.uid].io[BACKGROUND].read_bytes;
+            last_uid_io_stats_[uid.uid].io[BACKGROUND].read_bytes;
         int64_t fg_wr_delta = uid.io[FOREGROUND].write_bytes -
-            last_uid_io_stats[uid.uid].io[FOREGROUND].write_bytes;
+            last_uid_io_stats_[uid.uid].io[FOREGROUND].write_bytes;
         int64_t bg_wr_delta = uid.io[BACKGROUND].write_bytes -
-            last_uid_io_stats[uid.uid].io[BACKGROUND].write_bytes;
+            last_uid_io_stats_[uid.uid].io[BACKGROUND].write_bytes;
 
-        usage.uid_ios.bytes[READ][FOREGROUND][charger_stat] +=
+        usage.uid_ios.bytes[READ][FOREGROUND][charger_stat_] +=
             (fg_rd_delta < 0) ? 0 : fg_rd_delta;
-        usage.uid_ios.bytes[READ][BACKGROUND][charger_stat] +=
+        usage.uid_ios.bytes[READ][BACKGROUND][charger_stat_] +=
             (bg_rd_delta < 0) ? 0 : bg_rd_delta;
-        usage.uid_ios.bytes[WRITE][FOREGROUND][charger_stat] +=
+        usage.uid_ios.bytes[WRITE][FOREGROUND][charger_stat_] +=
             (fg_wr_delta < 0) ? 0 : fg_wr_delta;
-        usage.uid_ios.bytes[WRITE][BACKGROUND][charger_stat] +=
+        usage.uid_ios.bytes[WRITE][BACKGROUND][charger_stat_] +=
             (bg_wr_delta < 0) ? 0 : bg_wr_delta;
 
         for (const auto& task_it : uid.tasks) {
@@ -341,34 +343,34 @@
             const pid_t pid = task_it.first;
             const std::string& comm = task_it.second.comm;
             int64_t task_fg_rd_delta = task.io[FOREGROUND].read_bytes -
-                last_uid_io_stats[uid.uid].tasks[pid].io[FOREGROUND].read_bytes;
+                last_uid_io_stats_[uid.uid].tasks[pid].io[FOREGROUND].read_bytes;
             int64_t task_bg_rd_delta = task.io[BACKGROUND].read_bytes -
-                last_uid_io_stats[uid.uid].tasks[pid].io[BACKGROUND].read_bytes;
+                last_uid_io_stats_[uid.uid].tasks[pid].io[BACKGROUND].read_bytes;
             int64_t task_fg_wr_delta = task.io[FOREGROUND].write_bytes -
-                last_uid_io_stats[uid.uid].tasks[pid].io[FOREGROUND].write_bytes;
+                last_uid_io_stats_[uid.uid].tasks[pid].io[FOREGROUND].write_bytes;
             int64_t task_bg_wr_delta = task.io[BACKGROUND].write_bytes -
-                last_uid_io_stats[uid.uid].tasks[pid].io[BACKGROUND].write_bytes;
+                last_uid_io_stats_[uid.uid].tasks[pid].io[BACKGROUND].write_bytes;
 
             io_usage& task_usage = usage.task_ios[comm];
-            task_usage.bytes[READ][FOREGROUND][charger_stat] +=
+            task_usage.bytes[READ][FOREGROUND][charger_stat_] +=
                 (task_fg_rd_delta < 0) ? 0 : task_fg_rd_delta;
-            task_usage.bytes[READ][BACKGROUND][charger_stat] +=
+            task_usage.bytes[READ][BACKGROUND][charger_stat_] +=
                 (task_bg_rd_delta < 0) ? 0 : task_bg_rd_delta;
-            task_usage.bytes[WRITE][FOREGROUND][charger_stat] +=
+            task_usage.bytes[WRITE][FOREGROUND][charger_stat_] +=
                 (task_fg_wr_delta < 0) ? 0 : task_fg_wr_delta;
-            task_usage.bytes[WRITE][BACKGROUND][charger_stat] +=
+            task_usage.bytes[WRITE][BACKGROUND][charger_stat_] +=
                 (task_bg_wr_delta < 0) ? 0 : task_bg_wr_delta;
         }
     }
 
-    last_uid_io_stats = uid_io_stats;
+    last_uid_io_stats_ = uid_io_stats;
 }
 
 void uid_monitor::report(unordered_map<int, StoragedProto>* protos)
 {
     if (!enabled()) return;
 
-    Mutex::Autolock _l(uidm_mutex);
+    Mutex::Autolock _l(uidm_mutex_);
 
     update_curr_io_stats_locked();
     add_records_locked(time(NULL));
@@ -408,7 +410,7 @@
 
 void uid_monitor::update_uid_io_proto(unordered_map<int, StoragedProto>* protos)
 {
-    for (const auto& item : io_history) {
+    for (const auto& item : io_history_) {
         const uint64_t& end_ts = item.first;
         const struct uid_records& recs = item.second;
         unordered_map<userid_t, UidIOItem*> user_items;
@@ -448,9 +450,9 @@
 
 void uid_monitor::clear_user_history(userid_t user_id)
 {
-    Mutex::Autolock _l(uidm_mutex);
+    Mutex::Autolock _l(uidm_mutex_);
 
-    for (auto& item : io_history) {
+    for (auto& item : io_history_) {
         vector<uid_record>* entries = &item.second.entries;
         entries->erase(
             remove_if(entries->begin(), entries->end(),
@@ -459,27 +461,42 @@
             entries->end());
     }
 
-    for (auto it = io_history.begin(); it != io_history.end(); ) {
+    for (auto it = io_history_.begin(); it != io_history_.end(); ) {
         if (it->second.entries.empty()) {
-            it = io_history.erase(it);
+            it = io_history_.erase(it);
         } else {
             it++;
         }
     }
 }
 
-void uid_monitor::load_uid_io_proto(const UidIOUsage& uid_io_proto)
+void uid_monitor::load_uid_io_proto(userid_t user_id, const UidIOUsage& uid_io_proto)
 {
     if (!enabled()) return;
 
-    Mutex::Autolock _l(uidm_mutex);
+    Mutex::Autolock _l(uidm_mutex_);
 
     for (const auto& item_proto : uid_io_proto.uid_io_items()) {
         const UidIORecords& records_proto = item_proto.records();
-        struct uid_records* recs = &io_history[item_proto.end_ts()];
+        struct uid_records* recs = &io_history_[item_proto.end_ts()];
+
+        // It's possible that the same uid_io_proto file gets loaded more than
+        // once, for example, if system_server crashes. In this case we avoid
+        // adding duplicate entries, so we build a quick way to check for
+        // duplicates.
+        std::unordered_set<std::string> existing_uids;
+        for (const auto& rec : recs->entries) {
+            if (rec.ios.user_id == user_id) {
+                existing_uids.emplace(rec.name);
+            }
+        }
 
         recs->start_ts = records_proto.start_ts();
         for (const auto& rec_proto : records_proto.entries()) {
+            if (existing_uids.find(rec_proto.uid_name()) != existing_uids.end()) {
+                continue;
+            }
+
             struct uid_record record;
             record.name = rec_proto.uid_name();
             record.ios.user_id = rec_proto.user_id();
@@ -492,29 +509,35 @@
             }
             recs->entries.push_back(record);
         }
+
+        // We already added items, so this will just cull down to the maximum
+        // length. We do not remove anything if there is only one entry.
+        if (io_history_.size() > 1) {
+            maybe_shrink_history_for_items(0);
+        }
     }
 }
 
 void uid_monitor::set_charger_state(charger_stat_t stat)
 {
-    Mutex::Autolock _l(uidm_mutex);
+    Mutex::Autolock _l(uidm_mutex_);
 
-    if (charger_stat == stat) {
+    if (charger_stat_ == stat) {
         return;
     }
 
     update_curr_io_stats_locked();
-    charger_stat = stat;
+    charger_stat_ = stat;
 }
 
 void uid_monitor::init(charger_stat_t stat)
 {
-    charger_stat = stat;
+    charger_stat_ = stat;
 
-    start_ts = time(NULL);
-    last_uid_io_stats = get_uid_io_stats();
+    start_ts_ = time(NULL);
+    last_uid_io_stats_ = get_uid_io_stats();
 }
 
 uid_monitor::uid_monitor()
-    : enable(!access(UID_IO_STATS_PATH, R_OK)) {
+    : enabled_(!access(UID_IO_STATS_PATH, R_OK)) {
 }
diff --git a/storaged/tests/storaged_test.cpp b/storaged/tests/storaged_test.cpp
index ec47b65..64009c2 100644
--- a/storaged/tests/storaged_test.cpp
+++ b/storaged/tests/storaged_test.cpp
@@ -443,8 +443,9 @@
 
 TEST(storaged_test, uid_monitor) {
     uid_monitor uidm;
+    auto& io_history = uidm.io_history();
 
-    uidm.io_history[200] = {
+    io_history[200] = {
         .start_ts = 100,
         .entries = {
             { "app1", {
@@ -466,7 +467,7 @@
         },
     };
 
-    uidm.io_history[300] = {
+    io_history[300] = {
         .start_ts = 200,
         .entries = {
             { "app1", {
@@ -526,9 +527,9 @@
     EXPECT_EQ(user_1_item_1.records().entries(0).user_id(), 1UL);
     EXPECT_EQ(user_1_item_1.records().entries(0).uid_io().wr_fg_chg_off(), 1000UL);
 
-    uidm.io_history.clear();
+    io_history.clear();
 
-    uidm.io_history[300] = {
+    io_history[300] = {
         .start_ts = 200,
         .entries = {
             { "app1", {
@@ -539,7 +540,7 @@
         },
     };
 
-    uidm.io_history[400] = {
+    io_history[400] = {
         .start_ts = 300,
         .entries = {
             { "app1", {
@@ -550,16 +551,16 @@
         },
     };
 
-    uidm.load_uid_io_proto(protos[0].uid_io_usage());
-    uidm.load_uid_io_proto(protos[1].uid_io_usage());
+    uidm.load_uid_io_proto(0, protos[0].uid_io_usage());
+    uidm.load_uid_io_proto(1, protos[1].uid_io_usage());
 
-    EXPECT_EQ(uidm.io_history.size(), 3UL);
-    EXPECT_EQ(uidm.io_history.count(200), 1UL);
-    EXPECT_EQ(uidm.io_history.count(300), 1UL);
-    EXPECT_EQ(uidm.io_history.count(400), 1UL);
+    EXPECT_EQ(io_history.size(), 3UL);
+    EXPECT_EQ(io_history.count(200), 1UL);
+    EXPECT_EQ(io_history.count(300), 1UL);
+    EXPECT_EQ(io_history.count(400), 1UL);
 
-    EXPECT_EQ(uidm.io_history[200].start_ts, 100UL);
-    const vector<struct uid_record>& entries_0 = uidm.io_history[200].entries;
+    EXPECT_EQ(io_history[200].start_ts, 100UL);
+    const vector<struct uid_record>& entries_0 = io_history[200].entries;
     EXPECT_EQ(entries_0.size(), 3UL);
     EXPECT_EQ(entries_0[0].name, "app1");
     EXPECT_EQ(entries_0[0].ios.user_id, 0UL);
@@ -572,8 +573,8 @@
     EXPECT_EQ(entries_0[2].ios.uid_ios.bytes[WRITE][FOREGROUND][CHARGER_ON], 1000UL);
     EXPECT_EQ(entries_0[2].ios.uid_ios.bytes[READ][FOREGROUND][CHARGER_ON], 1000UL);
 
-    EXPECT_EQ(uidm.io_history[300].start_ts, 200UL);
-    const vector<struct uid_record>& entries_1 = uidm.io_history[300].entries;
+    EXPECT_EQ(io_history[300].start_ts, 200UL);
+    const vector<struct uid_record>& entries_1 = io_history[300].entries;
     EXPECT_EQ(entries_1.size(), 3UL);
     EXPECT_EQ(entries_1[0].name, "app1");
     EXPECT_EQ(entries_1[0].ios.user_id, 0UL);
@@ -585,8 +586,8 @@
     EXPECT_EQ(entries_1[2].ios.user_id, 1UL);
     EXPECT_EQ(entries_1[2].ios.uid_ios.bytes[WRITE][FOREGROUND][CHARGER_OFF], 1000UL);
 
-    EXPECT_EQ(uidm.io_history[400].start_ts, 300UL);
-    const vector<struct uid_record>& entries_2 = uidm.io_history[400].entries;
+    EXPECT_EQ(io_history[400].start_ts, 300UL);
+    const vector<struct uid_record>& entries_2 = io_history[400].entries;
     EXPECT_EQ(entries_2.size(), 1UL);
     EXPECT_EQ(entries_2[0].name, "app1");
     EXPECT_EQ(entries_2[0].ios.user_id, 0UL);
@@ -615,14 +616,71 @@
 
     uidm.clear_user_history(0);
 
-    EXPECT_EQ(uidm.io_history.size(), 2UL);
-    EXPECT_EQ(uidm.io_history.count(200), 1UL);
-    EXPECT_EQ(uidm.io_history.count(300), 1UL);
+    EXPECT_EQ(io_history.size(), 2UL);
+    EXPECT_EQ(io_history.count(200), 1UL);
+    EXPECT_EQ(io_history.count(300), 1UL);
 
-    EXPECT_EQ(uidm.io_history[200].entries.size(), 1UL);
-    EXPECT_EQ(uidm.io_history[300].entries.size(), 1UL);
+    EXPECT_EQ(io_history[200].entries.size(), 1UL);
+    EXPECT_EQ(io_history[300].entries.size(), 1UL);
 
     uidm.clear_user_history(1);
 
-    EXPECT_EQ(uidm.io_history.size(), 0UL);
+    EXPECT_EQ(io_history.size(), 0UL);
+}
+
+TEST(storaged_test, load_uid_io_proto) {
+    uid_monitor uidm;
+    auto& io_history = uidm.io_history();
+
+    static const uint64_t kProtoTime = 200;
+    io_history[kProtoTime] = {
+        .start_ts = 100,
+        .entries = {
+            { "app1", {
+                .user_id = 0,
+                .uid_ios.bytes[WRITE][FOREGROUND][CHARGER_ON] = 1000,
+              }
+            },
+            { "app2", {
+                .user_id = 0,
+                .uid_ios.bytes[READ][FOREGROUND][CHARGER_OFF] = 2000,
+              }
+            },
+            { "app3", {
+                .user_id = 0,
+                .uid_ios.bytes[READ][FOREGROUND][CHARGER_OFF] = 3000,
+              }
+            },
+        },
+    };
+
+    unordered_map<int, StoragedProto> protos;
+    uidm.update_uid_io_proto(&protos);
+    ASSERT_EQ(protos.size(), size_t(1));
+
+    // Loading the same proto many times should not add duplicate entries.
+    UidIOUsage user_0 = protos[0].uid_io_usage();
+    for (size_t i = 0; i < 10000; i++) {
+        uidm.load_uid_io_proto(0, user_0);
+    }
+    ASSERT_EQ(io_history.size(), size_t(1));
+    ASSERT_EQ(io_history[kProtoTime].entries.size(), size_t(3));
+
+    // Create duplicate entries until we go over the limit.
+    auto record = io_history[kProtoTime];
+    io_history.clear();
+    for (size_t i = 0; i < uid_monitor::MAX_UID_RECORDS_SIZE * 2; i++) {
+        if (i == kProtoTime) {
+            continue;
+        }
+        io_history[i] = record;
+    }
+    ASSERT_GT(io_history.size(), size_t(uid_monitor::MAX_UID_RECORDS_SIZE));
+
+    // After loading, the history should be truncated.
+    for (auto& item : *user_0.mutable_uid_io_items()) {
+        item.set_end_ts(io_history.size());
+    }
+    uidm.load_uid_io_proto(0, user_0);
+    ASSERT_LE(io_history.size(), size_t(uid_monitor::MAX_UID_RECORDS_SIZE));
 }