diff --git a/fastboot/Android.bp b/fastboot/Android.bp
index 50d18ed..faed376 100644
--- a/fastboot/Android.bp
+++ b/fastboot/Android.bp
@@ -43,6 +43,7 @@
         "libgtest_main",
         "libbase",
         "libadb_host",
+        "liblp",
     ],
 
     header_libs: [
@@ -173,6 +174,11 @@
 
             host_ldlibs: ["-lws2_32"],
         },
+        not_windows: {
+            static_libs: [
+                "libext4_utils",
+            ],
+        },
     },
 
     stl: "libc++_static",
@@ -193,6 +199,8 @@
         "libbase",
         "libcutils",
         "libgtest_host",
+        "liblp",
+        "libcrypto",
     ],
 }
 
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index 3e090d7..e066bff 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -58,6 +58,7 @@
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
 #include <build/version.h>
+#include <liblp/liblp.h>
 #include <platform_tools_version.h>
 #include <sparse/sparse.h>
 #include <ziparchive/zip_archive.h>
@@ -407,6 +408,7 @@
             " -s SERIAL                  Specify a USB device.\n"
             " -s tcp|udp:HOST[:PORT]     Specify a network device.\n"
             " -S SIZE[K|M|G]             Break into sparse files no larger than SIZE.\n"
+            " --force                    Force a flash operation that may be unsafe.\n"
             " --slot SLOT                Use SLOT; 'all' for both slots, 'other' for\n"
             "                            non-current slot (default: current active slot).\n"
             " --set-active[=SLOT]        Sets the active slot before rebooting.\n"
@@ -1505,6 +1507,31 @@
     fprintf(stderr, "FAILED (%s)\n", fb->Error().c_str());
 }
 
+static bool should_flash_in_userspace(const std::string& partition_name) {
+    auto path = find_item_given_name("super_empty.img");
+    if (path.empty()) {
+        return false;
+    }
+    auto metadata = android::fs_mgr::ReadFromImageFile(path);
+    if (!metadata) {
+        return false;
+    }
+    for (const auto& partition : metadata->partitions) {
+        auto candidate = android::fs_mgr::GetPartitionName(partition);
+        if (partition.attributes & LP_PARTITION_ATTR_SLOT_SUFFIXED) {
+            // On retrofit devices, we don't know if, or whether, the A or B
+            // slot has been flashed for dynamic partitions. Instead we add
+            // both names to the list as a conservative guess.
+            if (candidate + "_a" == partition_name || candidate + "_b" == partition_name) {
+                return true;
+            }
+        } else if (candidate == partition_name) {
+            return true;
+        }
+    }
+    return false;
+}
+
 int FastBootTool::Main(int argc, char* argv[]) {
     bool wants_wipe = false;
     bool wants_reboot = false;
@@ -1515,6 +1542,7 @@
     bool wants_set_active = false;
     bool skip_secondary = false;
     bool set_fbe_marker = false;
+    bool force_flash = false;
     int longindex;
     std::string slot_override;
     std::string next_active;
@@ -1530,6 +1558,7 @@
         {"cmdline", required_argument, 0, 0},
         {"disable-verification", no_argument, 0, 0},
         {"disable-verity", no_argument, 0, 0},
+        {"force", no_argument, 0, 0},
         {"header-version", required_argument, 0, 0},
         {"help", no_argument, 0, 'h'},
         {"kernel-offset", required_argument, 0, 0},
@@ -1565,6 +1594,8 @@
                 g_disable_verification = true;
             } else if (name == "disable-verity") {
                 g_disable_verity = true;
+            } else if (name == "force") {
+                force_flash = true;
             } else if (name == "header-version") {
                 g_boot_img_hdr.header_version = strtoul(optarg, nullptr, 0);
             } else if (name == "kernel-offset") {
@@ -1779,6 +1810,16 @@
             if (fname.empty()) die("cannot determine image filename for '%s'", pname.c_str());
 
             auto flash = [&](const std::string &partition) {
+                if (should_flash_in_userspace(partition) && !is_userspace_fastboot() &&
+                    !force_flash) {
+                    die("The partition you are trying to flash is dynamic, and "
+                        "should be flashed via fastbootd. Please run:\n"
+                        "\n"
+                        "    fastboot reboot fastboot\n"
+                        "\n"
+                        "And try again. If you are intentionally trying to "
+                        "overwrite a fixed partition, use --force.");
+                }
                 do_flash(partition.c_str(), fname.c_str());
             };
             do_for_partitions(pname.c_str(), slot_override, flash, true);
diff --git a/fastboot/fuzzy_fastboot/Android.bp b/fastboot/fuzzy_fastboot/Android.bp
index 301534b..277cc3a 100644
--- a/fastboot/fuzzy_fastboot/Android.bp
+++ b/fastboot/fuzzy_fastboot/Android.bp
@@ -26,6 +26,9 @@
     "libadb_host",
     "libtinyxml2",
     "libsparse",
+    "liblp",
+    "libcrypto",
+    "libext4_utils",
   ],
 
   // Static libs (libfastboot2) shared library dependencies are not transitively included
diff --git a/fs_mgr/liblp/Android.bp b/fs_mgr/liblp/Android.bp
index 5689bdf..355b7a1 100644
--- a/fs_mgr/liblp/Android.bp
+++ b/fs_mgr/liblp/Android.bp
@@ -39,6 +39,11 @@
         "libext4_utils",
         "libz",
     ],
+    target: {
+        windows: {
+            enabled: true,
+        },
+    },
     export_include_dirs: ["include"],
 }
 
diff --git a/fs_mgr/liblp/builder.cpp b/fs_mgr/liblp/builder.cpp
index 222113c..da86d75 100644
--- a/fs_mgr/liblp/builder.cpp
+++ b/fs_mgr/liblp/builder.cpp
@@ -162,39 +162,48 @@
         return nullptr;
     }
 
-    // Get the list of devices we already have.
-    std::set<std::string> block_devices;
-    for (const auto& block_device : metadata->block_devices) {
-        block_devices.emplace(GetBlockDevicePartitionName(block_device));
+    // On non-retrofit devices there is only one location for metadata: the
+    // super partition. update_engine will remove and resize partitions as
+    // needed. On the other hand, for retrofit devices, we'll need to
+    // translate block device and group names to update their slot suffixes.
+    auto super_device = GetMetadataSuperBlockDevice(*metadata.get());
+    if (GetBlockDevicePartitionName(*super_device) == "super") {
+        return New(*metadata.get(), &opener);
     }
 
-    auto new_block_devices = metadata->block_devices;
+    // Clear partitions and extents, since they have no meaning on the target
+    // slot. We also clear groups since they are re-added during OTA.
+    metadata->partitions.clear();
+    metadata->extents.clear();
+    metadata->groups.clear();
 
-    // Add missing block devices.
     std::string source_slot_suffix = SlotSuffixForSlotNumber(source_slot_number);
     std::string target_slot_suffix = SlotSuffixForSlotNumber(target_slot_number);
-    for (const auto& block_device : metadata->block_devices) {
-        std::string partition_name = GetBlockDevicePartitionName(block_device);
+
+    // Translate block devices.
+    auto source_block_devices = std::move(metadata->block_devices);
+    for (const auto& source_block_device : source_block_devices) {
+        std::string partition_name = GetBlockDevicePartitionName(source_block_device);
         std::string slot_suffix = GetPartitionSlotSuffix(partition_name);
         if (slot_suffix.empty() || slot_suffix != source_slot_suffix) {
-            continue;
+            // This should never happen. It means that the source metadata
+            // refers to a target or unknown block device.
+            LERROR << "Invalid block device for slot " << source_slot_suffix << ": "
+                   << partition_name;
+            return nullptr;
         }
         std::string new_name =
                 partition_name.substr(0, partition_name.size() - slot_suffix.size()) +
                 target_slot_suffix;
-        if (block_devices.find(new_name) != block_devices.end()) {
-            continue;
-        }
 
-        auto new_device = block_device;
+        auto new_device = source_block_device;
         if (!UpdateBlockDevicePartitionName(&new_device, new_name)) {
             LERROR << "Partition name too long: " << new_name;
             return nullptr;
         }
-        new_block_devices.emplace_back(new_device);
+        metadata->block_devices.emplace_back(new_device);
     }
 
-    metadata->block_devices = new_block_devices;
     return New(*metadata.get(), &opener);
 }
 
diff --git a/fs_mgr/liblp/images.cpp b/fs_mgr/liblp/images.cpp
index 9e64de1..5a498f9 100644
--- a/fs_mgr/liblp/images.cpp
+++ b/fs_mgr/liblp/images.cpp
@@ -27,6 +27,12 @@
 namespace android {
 namespace fs_mgr {
 
+using android::base::unique_fd;
+
+#if defined(_WIN32)
+static const int O_NOFOLLOW = 0;
+#endif
+
 std::unique_ptr<LpMetadata> ReadFromImageFile(int fd) {
     std::unique_ptr<uint8_t[]> buffer = std::make_unique<uint8_t[]>(LP_METADATA_GEOMETRY_SIZE);
     if (SeekFile64(fd, 0, SEEK_SET) < 0) {
@@ -61,10 +67,10 @@
     return ParseMetadata(geometry, metadata_buffer, metadata_buffer_size);
 }
 
-std::unique_ptr<LpMetadata> ReadFromImageFile(const char* file) {
-    android::base::unique_fd fd(open(file, O_RDONLY | O_CLOEXEC));
+std::unique_ptr<LpMetadata> ReadFromImageFile(const std::string& image_file) {
+    unique_fd fd(open(image_file.c_str(), O_RDONLY | O_CLOEXEC));
     if (fd < 0) {
-        PERROR << __PRETTY_FUNCTION__ << " open failed: " << file;
+        PERROR << __PRETTY_FUNCTION__ << " open failed: " << image_file;
         return nullptr;
     }
     return ReadFromImageFile(fd);
@@ -84,7 +90,7 @@
 }
 
 bool WriteToImageFile(const char* file, const LpMetadata& input) {
-    android::base::unique_fd fd(open(file, O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC, 0644));
+    unique_fd fd(open(file, O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC, 0644));
     if (fd < 0) {
         PERROR << __PRETTY_FUNCTION__ << " open failed: " << file;
         return false;
@@ -143,7 +149,7 @@
 }
 
 bool SparseBuilder::Export(const char* file) {
-    android::base::unique_fd fd(open(file, O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC, 0644));
+    unique_fd fd(open(file, O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC, 0644));
     if (fd < 0) {
         PERROR << "open failed: " << file;
         return false;
@@ -162,19 +168,15 @@
 }
 
 bool SparseBuilder::ExportFiles(const std::string& output_dir) {
-    android::base::unique_fd dir(open(output_dir.c_str(), O_CLOEXEC | O_DIRECTORY | O_NOFOLLOW));
-    if (dir < 0) {
-        PERROR << "open dir failed: " << output_dir;
-        return false;
-    }
-
     for (size_t i = 0; i < device_images_.size(); i++) {
         std::string name = GetBlockDevicePartitionName(metadata_.block_devices[i]);
-        std::string path = output_dir + "/super_" + name + ".img";
-        android::base::unique_fd fd(openat(
-                dir, path.c_str(), O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC | O_NOFOLLOW, 0644));
+        std::string file_name = "super_" + name + ".img";
+        std::string file_path = output_dir + "/" + file_name;
+
+        static const int kOpenFlags = O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC | O_NOFOLLOW;
+        unique_fd fd(open(file_path.c_str(), kOpenFlags, 0644));
         if (fd < 0) {
-            PERROR << "open failed: " << path;
+            PERROR << "open failed: " << file_path;
             return false;
         }
         // No gzip compression; sparseify; no checksum.
diff --git a/fs_mgr/liblp/include/liblp/liblp.h b/fs_mgr/liblp/include/liblp/liblp.h
index 1af1e80..6348f55 100644
--- a/fs_mgr/liblp/include/liblp/liblp.h
+++ b/fs_mgr/liblp/include/liblp/liblp.h
@@ -75,7 +75,7 @@
 bool WriteToSparseFile(const char* file, const LpMetadata& metadata, uint32_t block_size,
                        const std::map<std::string, std::string>& images);
 bool WriteToImageFile(const char* file, const LpMetadata& metadata);
-std::unique_ptr<LpMetadata> ReadFromImageFile(const char* file);
+std::unique_ptr<LpMetadata> ReadFromImageFile(const std::string& image_file);
 std::unique_ptr<LpMetadata> ReadFromImageBlob(const void* data, size_t bytes);
 
 // Similar to WriteToSparseFile, this will generate an image that can be
diff --git a/fs_mgr/liblp/io_test.cpp b/fs_mgr/liblp/io_test.cpp
index b539d77..9f3314d 100644
--- a/fs_mgr/liblp/io_test.cpp
+++ b/fs_mgr/liblp/io_test.cpp
@@ -665,6 +665,7 @@
     unique_ptr<MetadataBuilder> builder = CreateDefaultBuilder();
     ASSERT_NE(builder, nullptr);
     ASSERT_TRUE(AddDefaultPartitions(builder.get()));
+    ASSERT_TRUE(builder->AddGroup("example", 0));
     builder->SetAutoSlotSuffixing();
 
     auto fd = CreateFakeDisk();
@@ -682,9 +683,11 @@
     ASSERT_NE(builder, nullptr);
     auto updated = builder->Export();
     ASSERT_NE(updated, nullptr);
-    ASSERT_EQ(updated->block_devices.size(), static_cast<size_t>(2));
-    EXPECT_EQ(GetBlockDevicePartitionName(updated->block_devices[0]), "super_a");
-    EXPECT_EQ(GetBlockDevicePartitionName(updated->block_devices[1]), "super_b");
+    ASSERT_EQ(updated->block_devices.size(), static_cast<size_t>(1));
+    EXPECT_EQ(GetBlockDevicePartitionName(updated->block_devices[0]), "super_b");
+    ASSERT_TRUE(updated->groups.empty());
+    ASSERT_TRUE(updated->partitions.empty());
+    ASSERT_TRUE(updated->extents.empty());
 }
 
 TEST(liblp, UpdateNonRetrofit) {
diff --git a/fs_mgr/liblp/partition_opener.cpp b/fs_mgr/liblp/partition_opener.cpp
index 416f87f..898f241 100644
--- a/fs_mgr/liblp/partition_opener.cpp
+++ b/fs_mgr/liblp/partition_opener.cpp
@@ -19,8 +19,9 @@
 #if defined(__linux__)
 #include <linux/fs.h>
 #endif
+#if !defined(_WIN32)
 #include <sys/ioctl.h>
-#include <sys/stat.h>
+#endif
 #include <sys/types.h>
 #include <unistd.h>
 
@@ -84,7 +85,7 @@
 
 unique_fd PartitionOpener::Open(const std::string& partition_name, int flags) const {
     std::string path = GetPartitionAbsolutePath(partition_name);
-    return unique_fd{open(path.c_str(), flags)};
+    return unique_fd{open(path.c_str(), flags | O_CLOEXEC)};
 }
 
 bool PartitionOpener::GetInfo(const std::string& partition_name, BlockDeviceInfo* info) const {
diff --git a/fs_mgr/liblp/reader.cpp b/fs_mgr/liblp/reader.cpp
index 305e6c7..24c6b2c 100644
--- a/fs_mgr/liblp/reader.cpp
+++ b/fs_mgr/liblp/reader.cpp
@@ -380,11 +380,10 @@
             continue;
         }
         std::string group_name = GetPartitionGroupName(group) + slot_suffix;
-        if (group_name.size() > sizeof(group.name)) {
+        if (!UpdatePartitionGroupName(&group, group_name)) {
             LERROR << __PRETTY_FUNCTION__ << " group name too long: " << group_name;
             return false;
         }
-        strncpy(group.name, group_name.c_str(), sizeof(group.name));
         group.flags &= ~LP_GROUP_SLOT_SUFFIXED;
     }
     return true;
diff --git a/fs_mgr/liblp/utility.cpp b/fs_mgr/liblp/utility.cpp
index 4f20b6b..9ccabe9 100644
--- a/fs_mgr/liblp/utility.cpp
+++ b/fs_mgr/liblp/utility.cpp
@@ -29,6 +29,7 @@
 namespace fs_mgr {
 
 bool GetDescriptorSize(int fd, uint64_t* size) {
+#if !defined(_WIN32)
     struct stat s;
     if (fstat(fd, &s) < 0) {
         PERROR << __PRETTY_FUNCTION__ << "fstat failed";
@@ -39,6 +40,7 @@
         *size = get_block_device_size(fd);
         return *size != 0;
     }
+#endif
 
     int64_t result = SeekFile64(fd, 0, SEEK_END);
     if (result == -1) {
@@ -145,5 +147,13 @@
     return true;
 }
 
+bool UpdatePartitionGroupName(LpMetadataPartitionGroup* group, const std::string& name) {
+    if (name.size() > sizeof(group->name)) {
+        return false;
+    }
+    strncpy(group->name, name.c_str(), sizeof(group->name));
+    return true;
+}
+
 }  // namespace fs_mgr
 }  // namespace android
diff --git a/fs_mgr/liblp/utility.h b/fs_mgr/liblp/utility.h
index 55ecb5a..8b70919 100644
--- a/fs_mgr/liblp/utility.h
+++ b/fs_mgr/liblp/utility.h
@@ -86,6 +86,7 @@
 
 // Update names from C++ strings.
 bool UpdateBlockDevicePartitionName(LpMetadataBlockDevice* device, const std::string& name);
+bool UpdatePartitionGroupName(LpMetadataPartitionGroup* group, const std::string& name);
 
 }  // namespace fs_mgr
 }  // namespace android
diff --git a/fs_mgr/liblp/writer.cpp b/fs_mgr/liblp/writer.cpp
index e72cdfa..d8195ca 100644
--- a/fs_mgr/liblp/writer.cpp
+++ b/fs_mgr/liblp/writer.cpp
@@ -235,6 +235,10 @@
     return android::base::WriteFully(fd, blob.data(), blob.size());
 }
 
+#if defined(_WIN32)
+static const int O_SYNC = 0;
+#endif
+
 bool FlashPartitionTable(const IPartitionOpener& opener, const std::string& super_partition,
                          const LpMetadata& metadata) {
     android::base::unique_fd fd = opener.Open(super_partition, O_RDWR | O_SYNC);
diff --git a/llkd/libllkd.cpp b/llkd/libllkd.cpp
index 0827470..427dace 100644
--- a/llkd/libllkd.cpp
+++ b/llkd/libllkd.cpp
@@ -555,7 +555,9 @@
 }
 
 void llkAlarmHandler(int) {
-    llkPanicKernel(false, ::getpid(), "alarm");
+    LOG(FATAL) << "alarm";
+    // NOTREACHED
+    llkPanicKernel(true, ::getpid(), "alarm");
 }
 
 milliseconds GetUintProperty(const std::string& key, milliseconds def) {
diff --git a/storaged/storaged_info.cpp b/storaged/storaged_info.cpp
index 8c0b3d1..ca2421b 100644
--- a/storaged/storaged_info.cpp
+++ b/storaged/storaged_info.cpp
@@ -87,12 +87,21 @@
     day_start_tp += chrono::seconds(perf_history.day_start_sec());
 
     nr_samples = perf_history.nr_samples();
+    if (nr_samples < recent_perf.size()) {
+        recent_perf.erase(recent_perf.begin() + nr_samples, recent_perf.end());
+    }
+    size_t i = 0;
     for (auto bw : perf_history.recent_perf()) {
-        recent_perf.push_back(bw);
+        if (i < recent_perf.size()) {
+            recent_perf[i] = bw;
+        } else {
+            recent_perf.push_back(bw);
+        }
+        ++i;
     }
 
     nr_days = perf_history.nr_days();
-    int i = 0;
+    i = 0;
     for (auto bw : perf_history.daily_perf()) {
         daily_perf[i++] = bw;
     }