diff --git a/adb/Android.bp b/adb/Android.bp
index dabc5ce..a18dc1a 100644
--- a/adb/Android.bp
+++ b/adb/Android.bp
@@ -455,17 +455,14 @@
     srcs: [
         "test_adb.py",
     ],
-    libs: [
-        "adb_py",
-    ],
     test_config: "adb_integration_test_adb.xml",
     test_suites: ["general-tests"],
     version: {
         py2: {
-            enabled: true,
+            enabled: false,
         },
         py3: {
-            enabled: false,
+            enabled: true,
         },
     },
 }
diff --git a/adb/client/auth.cpp b/adb/client/auth.cpp
index 5fbef09..71c19b8 100644
--- a/adb/client/auth.cpp
+++ b/adb/client/auth.cpp
@@ -465,6 +465,7 @@
     if (key == nullptr) {
         // No more private keys to try, send the public key.
         t->SetConnectionState(kCsUnauthorized);
+        t->SetConnectionEstablished(true);
         send_auth_publickey(t);
         return;
     }
diff --git a/adb/daemon/remount_service.cpp b/adb/daemon/remount_service.cpp
index 0e79d82..f7017dd 100644
--- a/adb/daemon/remount_service.cpp
+++ b/adb/daemon/remount_service.cpp
@@ -30,6 +30,7 @@
 #include <sys/vfs.h>
 #include <unistd.h>
 
+#include <memory>
 #include <set>
 #include <string>
 #include <vector>
@@ -38,28 +39,30 @@
 #include <bootloader_message/bootloader_message.h>
 #include <cutils/android_reboot.h>
 #include <ext4_utils/ext4_utils.h>
+#include <fs_mgr.h>
+#include <fs_mgr_overlayfs.h>
 
 #include "adb.h"
 #include "adb_io.h"
 #include "adb_unique_fd.h"
 #include "adb_utils.h"
-#include "fs_mgr.h"
 #include "set_verity_enable_state_service.h"
 
-// Returns the device used to mount a directory in /proc/mounts.
+// Returns the last device used to mount a directory in /proc/mounts.
+// This will find overlayfs entry where upperdir=lowerdir, to make sure
+// remount is associated with the correct directory.
 static std::string find_proc_mount(const char* dir) {
     std::unique_ptr<FILE, int(*)(FILE*)> fp(setmntent("/proc/mounts", "r"), endmntent);
-    if (!fp) {
-        return "";
-    }
+    std::string mnt_fsname;
+    if (!fp) return mnt_fsname;
 
     mntent* e;
     while ((e = getmntent(fp.get())) != nullptr) {
         if (strcmp(dir, e->mnt_dir) == 0) {
-            return e->mnt_fsname;
+            mnt_fsname = e->mnt_fsname;
         }
     }
-    return "";
+    return mnt_fsname;
 }
 
 // Returns the device used to mount a directory in the fstab.
@@ -81,6 +84,7 @@
 }
 
 bool make_block_device_writable(const std::string& dev) {
+    if ((dev == "overlay") || (dev == "overlayfs")) return true;
     int fd = unix_open(dev.c_str(), O_RDONLY | O_CLOEXEC);
     if (fd == -1) {
         return false;
@@ -234,6 +238,14 @@
         partitions.push_back("/system");
     }
 
+    bool verity_enabled = (system_verified || vendor_verified);
+
+    // If we can use overlayfs, lets get it in place first
+    // before we struggle with determining deduplication operations.
+    if (!verity_enabled && fs_mgr_overlayfs_setup() && fs_mgr_overlayfs_mount_all()) {
+        WriteFdExactly(fd.get(), "overlayfs mounted\n");
+    }
+
     // Find partitions that are deduplicated, and can be un-deduplicated.
     std::set<std::string> dedup;
     for (const auto& partition : partitions) {
@@ -246,8 +258,6 @@
         }
     }
 
-    bool verity_enabled = (system_verified || vendor_verified);
-
     // Reboot now if the user requested it (and an operation needs a reboot).
     if (user_requested_reboot) {
         if (!dedup.empty() || verity_enabled) {
diff --git a/adb/daemon/set_verity_enable_state_service.cpp b/adb/daemon/set_verity_enable_state_service.cpp
index 2b6ec21..3676de5 100644
--- a/adb/daemon/set_verity_enable_state_service.cpp
+++ b/adb/daemon/set_verity_enable_state_service.cpp
@@ -19,6 +19,7 @@
 #include "set_verity_enable_state_service.h"
 #include "sysdeps.h"
 
+#include <errno.h>
 #include <fcntl.h>
 #include <inttypes.h>
 #include <libavb_user/libavb_user.h>
@@ -28,12 +29,14 @@
 
 #include <android-base/properties.h>
 #include <android-base/stringprintf.h>
+#include <fs_mgr.h>
+#include <fs_mgr_overlayfs.h>
+#include <fstab/fstab.h>
 #include <log/log_properties.h>
 
 #include "adb.h"
 #include "adb_io.h"
 #include "adb_unique_fd.h"
-#include "fs_mgr.h"
 #include "remount_service.h"
 
 #include "fec/io.h"
@@ -46,6 +49,10 @@
 static const bool kAllowDisableVerity = false;
 #endif
 
+void suggest_run_adb_root(int fd) {
+    if (getuid() != 0) WriteFdExactly(fd, "Maybe run adb root?\n");
+}
+
 /* Turn verity on/off */
 static bool set_verity_enabled_state(int fd, const char* block_device, const char* mount_point,
                                      bool enable) {
@@ -59,7 +66,7 @@
 
     if (!fh) {
         WriteFdFmt(fd, "Could not open block device %s (%s).\n", block_device, strerror(errno));
-        WriteFdFmt(fd, "Maybe run adb root?\n");
+        suggest_run_adb_root(fd);
         return false;
     }
 
@@ -87,6 +94,17 @@
         return false;
     }
 
+    auto change = false;
+    errno = 0;
+    if (enable ? fs_mgr_overlayfs_teardown(mount_point, &change)
+               : fs_mgr_overlayfs_setup(nullptr, mount_point, &change)) {
+        if (change) {
+            WriteFdFmt(fd, "%s overlayfs for %s\n", enable ? "disabling" : "using", mount_point);
+        }
+    } else if (errno) {
+        WriteFdFmt(fd, "Overlayfs %s for %s failed with error %s\n", enable ? "teardown" : "setup",
+                   mount_point, strerror(errno));
+    }
     WriteFdFmt(fd, "Verity %s on %s\n", enable ? "enabled" : "disabled", mount_point);
     return true;
 }
@@ -103,6 +121,22 @@
     return android::base::GetProperty("ro.boot.vbmeta.device_state", "") == "locked";
 }
 
+static bool overlayfs_setup(int fd, bool enable) {
+    auto change = false;
+    errno = 0;
+    if (enable ? fs_mgr_overlayfs_teardown(nullptr, &change)
+               : fs_mgr_overlayfs_setup(nullptr, nullptr, &change)) {
+        if (change) {
+            WriteFdFmt(fd, "%s overlayfs\n", enable ? "disabling" : "using");
+        }
+    } else if (errno) {
+        WriteFdFmt(fd, "Overlayfs %s failed with error %s\n", enable ? "teardown" : "setup",
+                   strerror(errno));
+        suggest_run_adb_root(fd);
+    }
+    return change;
+}
+
 /* Use AVB to turn verity on/off */
 static bool set_avb_verity_enabled_state(int fd, AvbOps* ops, bool enable_verity) {
     std::string ab_suffix = get_ab_suffix();
@@ -128,6 +162,7 @@
         return false;
     }
 
+    overlayfs_setup(fd, enable_verity);
     WriteFdFmt(fd, "Successfully %s verity\n", enable_verity ? "enabled" : "disabled");
     return true;
 }
@@ -150,6 +185,7 @@
         }
 
         if (!android::base::GetBoolProperty("ro.secure", false)) {
+            overlayfs_setup(fd, enable);
             WriteFdExactly(fd.get(), "verity not enabled - ENG build\n");
             return;
         }
@@ -177,13 +213,14 @@
         // Not using AVB - assume VB1.0.
 
         // read all fstab entries at once from all sources
-        fstab = fs_mgr_read_fstab_default();
+        if (!fstab) fstab = fs_mgr_read_fstab_default();
         if (!fstab) {
-            WriteFdExactly(fd.get(), "Failed to read fstab\nMaybe run adb root?\n");
+            WriteFdExactly(fd.get(), "Failed to read fstab\n");
+            suggest_run_adb_root(fd.get());
             return;
         }
 
-        // Loop through entries looking for ones that vold manages.
+        // Loop through entries looking for ones that verity manages.
         for (int i = 0; i < fstab->num_entries; i++) {
             if (fs_mgr_is_verified(&fstab->recs[i])) {
                 if (set_verity_enabled_state(fd.get(), fstab->recs[i].blk_device,
@@ -193,6 +230,7 @@
             }
         }
     }
+    if (!any_changed) any_changed = overlayfs_setup(fd, enable);
 
     if (any_changed) {
         WriteFdExactly(fd.get(), "Now reboot your device for settings to take effect\n");
diff --git a/adb/test_adb.py b/adb/test_adb.py
old mode 100644
new mode 100755
index ddd3ff0..d4c98e4
--- a/adb/test_adb.py
+++ b/adb/test_adb.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Copyright (C) 2015 The Android Open Source Project
 #
@@ -19,9 +19,7 @@
 This differs from things in test_device.py in that there is no API for these
 things. Most of these tests involve specific error messages or the help text.
 """
-from __future__ import print_function
 
-import binascii
 import contextlib
 import os
 import random
@@ -32,8 +30,6 @@
 import threading
 import unittest
 
-import adb
-
 
 @contextlib.contextmanager
 def fake_adbd(protocol=socket.AF_INET, port=0):
@@ -42,61 +38,61 @@
     serversock = socket.socket(protocol, socket.SOCK_STREAM)
     serversock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
     if protocol == socket.AF_INET:
-        serversock.bind(('127.0.0.1', port))
+        serversock.bind(("127.0.0.1", port))
     else:
-        serversock.bind(('::1', port))
+        serversock.bind(("::1", port))
     serversock.listen(1)
 
     # A pipe that is used to signal the thread that it should terminate.
-    readpipe, writepipe = os.pipe()
+    readsock, writesock = socket.socketpair()
 
-    def _adb_packet(command, arg0, arg1, data):
-        bin_command = struct.unpack('I', command)[0]
-        buf = struct.pack('IIIIII', bin_command, arg0, arg1, len(data), 0,
+    def _adb_packet(command: bytes, arg0: int, arg1: int, data: bytes) -> bytes:
+        bin_command = struct.unpack("I", command)[0]
+        buf = struct.pack("IIIIII", bin_command, arg0, arg1, len(data), 0,
                           bin_command ^ 0xffffffff)
         buf += data
         return buf
 
-    def _handle():
-        rlist = [readpipe, serversock]
-        cnxn_sent = {}
-        while True:
-            read_ready, _, _ = select.select(rlist, [], [])
-            for ready in read_ready:
-                if ready == readpipe:
-                    # Closure pipe
-                    os.close(ready)
-                    serversock.shutdown(socket.SHUT_RDWR)
-                    serversock.close()
-                    return
-                elif ready == serversock:
-                    # Server socket
-                    conn, _ = ready.accept()
-                    rlist.append(conn)
-                else:
-                    # Client socket
-                    data = ready.recv(1024)
-                    if not data or data.startswith('OPEN'):
+    def _handle(sock):
+        with contextlib.closing(sock) as serversock:
+            rlist = [readsock, serversock]
+            cnxn_sent = {}
+            while True:
+                read_ready, _, _ = select.select(rlist, [], [])
+                for ready in read_ready:
+                    if ready == readsock:
+                        # Closure pipe
+                        for f in rlist:
+                            f.close()
+                        return
+                    elif ready == serversock:
+                        # Server socket
+                        conn, _ = ready.accept()
+                        rlist.append(conn)
+                    else:
+                        # Client socket
+                        data = ready.recv(1024)
+                        if not data or data.startswith(b"OPEN"):
+                            if ready in cnxn_sent:
+                                del cnxn_sent[ready]
+                            ready.shutdown(socket.SHUT_RDWR)
+                            ready.close()
+                            rlist.remove(ready)
+                            continue
                         if ready in cnxn_sent:
-                            del cnxn_sent[ready]
-                        ready.shutdown(socket.SHUT_RDWR)
-                        ready.close()
-                        rlist.remove(ready)
-                        continue
-                    if ready in cnxn_sent:
-                        continue
-                    cnxn_sent[ready] = True
-                    ready.sendall(_adb_packet('CNXN', 0x01000001, 1024 * 1024,
-                                              'device::ro.product.name=fakeadb'))
+                            continue
+                        cnxn_sent[ready] = True
+                        ready.sendall(_adb_packet(b"CNXN", 0x01000001, 1024 * 1024,
+                                                  b"device::ro.product.name=fakeadb"))
 
     port = serversock.getsockname()[1]
-    server_thread = threading.Thread(target=_handle)
+    server_thread = threading.Thread(target=_handle, args=(serversock,))
     server_thread.start()
 
     try:
         yield port
     finally:
-        os.close(writepipe)
+        writesock.close()
         server_thread.join()
 
 
@@ -107,14 +103,15 @@
     This automatically disconnects when done with the connection.
     """
 
-    output = subprocess.check_output(['adb', 'connect', serial])
-    unittest.assertEqual(output.strip(), 'connected to {}'.format(serial))
+    output = subprocess.check_output(["adb", "connect", serial])
+    unittest.assertEqual(output.strip(),
+                        "connected to {}".format(serial).encode("utf8"))
 
     try:
         yield
     finally:
         # Perform best-effort disconnection. Discard the output.
-        subprocess.Popen(['adb', 'disconnect', serial],
+        subprocess.Popen(["adb", "disconnect", serial],
                          stdout=subprocess.PIPE,
                          stderr=subprocess.PIPE).communicate()
 
@@ -123,21 +120,22 @@
 def adb_server():
     """Context manager for an ADB server.
 
-    This creates an ADB server and returns the port it's listening on.
+    This creates an ADB server and returns the port it"s listening on.
     """
 
     port = 5038
     # Kill any existing server on this non-default port.
-    subprocess.check_output(['adb', '-P', str(port), 'kill-server'],
+    subprocess.check_output(["adb", "-P", str(port), "kill-server"],
                             stderr=subprocess.STDOUT)
     read_pipe, write_pipe = os.pipe()
-    proc = subprocess.Popen(['adb', '-L', 'tcp:localhost:{}'.format(port),
-                             'fork-server', 'server',
-                             '--reply-fd', str(write_pipe)])
+    os.set_inheritable(write_pipe, True)
+    proc = subprocess.Popen(["adb", "-L", "tcp:localhost:{}".format(port),
+                             "fork-server", "server",
+                             "--reply-fd", str(write_pipe)], close_fds=False)
     try:
         os.close(write_pipe)
         greeting = os.read(read_pipe, 1024)
-        assert greeting == 'OK\n', repr(greeting)
+        assert greeting == b"OK\n", repr(greeting)
         yield port
     finally:
         proc.terminate()
@@ -150,35 +148,37 @@
     def test_help(self):
         """Make sure we get _something_ out of help."""
         out = subprocess.check_output(
-            ['adb', 'help'], stderr=subprocess.STDOUT)
+            ["adb", "help"], stderr=subprocess.STDOUT)
         self.assertGreater(len(out), 0)
 
     def test_version(self):
         """Get a version number out of the output of adb."""
-        lines = subprocess.check_output(['adb', 'version']).splitlines()
+        lines = subprocess.check_output(["adb", "version"]).splitlines()
         version_line = lines[0]
-        self.assertRegexpMatches(
-            version_line, r'^Android Debug Bridge version \d+\.\d+\.\d+$')
+        self.assertRegex(
+            version_line, rb"^Android Debug Bridge version \d+\.\d+\.\d+$")
         if len(lines) == 2:
             # Newer versions of ADB have a second line of output for the
             # version that includes a specific revision (git SHA).
             revision_line = lines[1]
-            self.assertRegexpMatches(
-                revision_line, r'^Revision [0-9a-f]{12}-android$')
+            self.assertRegex(
+                revision_line, rb"^Revision [0-9a-f]{12}-android$")
 
     def test_tcpip_error_messages(self):
         """Make sure 'adb tcpip' parsing is sane."""
-        proc = subprocess.Popen(['adb', 'tcpip'], stdout=subprocess.PIPE,
+        proc = subprocess.Popen(["adb", "tcpip"],
+                                stdout=subprocess.PIPE,
                                 stderr=subprocess.STDOUT)
         out, _ = proc.communicate()
         self.assertEqual(1, proc.returncode)
-        self.assertIn('requires an argument', out)
+        self.assertIn(b"requires an argument", out)
 
-        proc = subprocess.Popen(['adb', 'tcpip', 'foo'], stdout=subprocess.PIPE,
+        proc = subprocess.Popen(["adb", "tcpip", "foo"],
+                                stdout=subprocess.PIPE,
                                 stderr=subprocess.STDOUT)
         out, _ = proc.communicate()
         self.assertEqual(1, proc.returncode)
-        self.assertIn('invalid port', out)
+        self.assertIn(b"invalid port", out)
 
 
 class ServerTest(unittest.TestCase):
@@ -214,12 +214,12 @@
 
         port = 5038
         # Kill any existing server on this non-default port.
-        subprocess.check_output(['adb', '-P', str(port), 'kill-server'],
+        subprocess.check_output(["adb", "-P", str(port), "kill-server"],
                                 stderr=subprocess.STDOUT)
 
         try:
             # Run the adb client and have it start the adb server.
-            proc = subprocess.Popen(['adb', '-P', str(port), 'start-server'],
+            proc = subprocess.Popen(["adb", "-P", str(port), "start-server"],
                                     stdin=subprocess.PIPE,
                                     stdout=subprocess.PIPE,
                                     stderr=subprocess.PIPE)
@@ -229,14 +229,12 @@
             stdout_thread = threading.Thread(
                 target=ServerTest._read_pipe_and_set_event,
                 args=(proc.stdout, stdout_event))
-            stdout_thread.daemon = True
             stdout_thread.start()
 
             stderr_event = threading.Event()
             stderr_thread = threading.Thread(
                 target=ServerTest._read_pipe_and_set_event,
                 args=(proc.stderr, stderr_event))
-            stderr_thread.daemon = True
             stderr_thread.start()
 
             # Wait for the adb client to finish. Once that has occurred, if
@@ -250,7 +248,8 @@
             # probably letting the adb server inherit stdin which would be
             # wrong.
             with self.assertRaises(IOError):
-                proc.stdin.write('x')
+                proc.stdin.write(b"x")
+                proc.stdin.flush()
 
             # Wait a few seconds for stdout/stderr to be closed (in the success
             # case, this won't wait at all). If there is a timeout, that means
@@ -259,9 +258,11 @@
             # inherit stdout/stderr which would be wrong.
             self.assertTrue(stdout_event.wait(5), "adb stdout not closed")
             self.assertTrue(stderr_event.wait(5), "adb stderr not closed")
+            stdout_thread.join()
+            stderr_thread.join()
         finally:
             # If we started a server, kill it.
-            subprocess.check_output(['adb', '-P', str(port), 'kill-server'],
+            subprocess.check_output(["adb", "-P", str(port), "kill-server"],
                                     stderr=subprocess.STDOUT)
 
 
@@ -271,7 +272,7 @@
     def _reset_socket_on_close(self, sock):
         """Use SO_LINGER to cause TCP RST segment to be sent on socket close."""
         # The linger structure is two shorts on Windows, but two ints on Unix.
-        linger_format = 'hh' if os.name == 'nt' else 'ii'
+        linger_format = "hh" if os.name == "nt" else "ii"
         l_onoff = 1
         l_linger = 0
 
@@ -292,33 +293,33 @@
             # Use SO_REUSEADDR so subsequent runs of the test can grab the port
             # even if it is in TIME_WAIT.
             listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            listener.bind(('127.0.0.1', 0))
+            listener.bind(("127.0.0.1", 0))
             listener.listen(4)
             port = listener.getsockname()[1]
 
             # Now that listening has started, start adb emu kill, telling it to
             # connect to our mock emulator.
             proc = subprocess.Popen(
-                ['adb', '-s', 'emulator-' + str(port), 'emu', 'kill'],
+                ["adb", "-s", "emulator-" + str(port), "emu", "kill"],
                 stderr=subprocess.STDOUT)
 
             accepted_connection, addr = listener.accept()
             with contextlib.closing(accepted_connection) as conn:
                 # If WSAECONNABORTED (10053) is raised by any socket calls,
                 # then adb probably isn't reading the data that we sent it.
-                conn.sendall('Android Console: type \'help\' for a list ' +
-                             'of commands\r\n')
-                conn.sendall('OK\r\n')
+                conn.sendall(("Android Console: type 'help' for a list "
+                             "of commands\r\n").encode("utf8"))
+                conn.sendall(b"OK\r\n")
 
                 with contextlib.closing(conn.makefile()) as connf:
                     line = connf.readline()
-                    if line.startswith('auth'):
+                    if line.startswith("auth"):
                         # Ignore the first auth line.
                         line = connf.readline()
-                    self.assertEqual('kill\n', line)
-                    self.assertEqual('quit\n', connf.readline())
+                    self.assertEqual("kill\n", line)
+                    self.assertEqual("quit\n", connf.readline())
 
-                conn.sendall('OK: killing emulator, bye bye\r\n')
+                conn.sendall(b"OK: killing emulator, bye bye\r\n")
 
                 # Use SO_LINGER to send TCP RST segment to test whether adb
                 # ignores WSAECONNRESET on Windows. This happens with the
@@ -342,31 +343,31 @@
         """
         with adb_server() as server_port:
             with fake_adbd() as port:
-                serial = 'emulator-{}'.format(port - 1)
+                serial = "emulator-{}".format(port - 1)
                 # Ensure that the emulator is not there.
                 try:
-                    subprocess.check_output(['adb', '-P', str(server_port),
-                                             '-s', serial, 'get-state'],
+                    subprocess.check_output(["adb", "-P", str(server_port),
+                                             "-s", serial, "get-state"],
                                             stderr=subprocess.STDOUT)
-                    self.fail('Device should not be available')
+                    self.fail("Device should not be available")
                 except subprocess.CalledProcessError as err:
                     self.assertEqual(
                         err.output.strip(),
-                        'error: device \'{}\' not found'.format(serial))
+                        "error: device '{}' not found".format(serial).encode("utf8"))
 
                 # Let the ADB server know that the emulator has started.
                 with contextlib.closing(
-                    socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
-                    sock.connect(('localhost', server_port))
-                    command = 'host:emulator:{}'.format(port)
-                    sock.sendall('%04x%s' % (len(command), command))
+                        socket.socket(socket.AF_INET, socket.SOCK_STREAM)) as sock:
+                    sock.connect(("localhost", server_port))
+                    command = "host:emulator:{}".format(port).encode("utf8")
+                    sock.sendall(b"%04x%s" % (len(command), command))
 
                 # Ensure the emulator is there.
-                subprocess.check_call(['adb', '-P', str(server_port),
-                                       '-s', serial, 'wait-for-device'])
-                output = subprocess.check_output(['adb', '-P', str(server_port),
-                                                  '-s', serial, 'get-state'])
-                self.assertEqual(output.strip(), 'device')
+                subprocess.check_call(["adb", "-P", str(server_port),
+                                       "-s", serial, "wait-for-device"])
+                output = subprocess.check_output(["adb", "-P", str(server_port),
+                                                  "-s", serial, "get-state"])
+                self.assertEqual(output.strip(), b"device")
 
 
 class ConnectionTest(unittest.TestCase):
@@ -380,7 +381,7 @@
         for protocol in (socket.AF_INET, socket.AF_INET6):
             try:
                 with fake_adbd(protocol=protocol) as port:
-                    serial = 'localhost:{}'.format(port)
+                    serial = "localhost:{}".format(port)
                     with adb_connect(self, serial):
                         pass
             except socket.error:
@@ -391,49 +392,51 @@
         """Ensure that an already-connected device stays connected."""
 
         with fake_adbd() as port:
-            serial = 'localhost:{}'.format(port)
+            serial = "localhost:{}".format(port)
             with adb_connect(self, serial):
                 # b/31250450: this always returns 0 but probably shouldn't.
-                output = subprocess.check_output(['adb', 'connect', serial])
+                output = subprocess.check_output(["adb", "connect", serial])
                 self.assertEqual(
-                    output.strip(), 'already connected to {}'.format(serial))
+                    output.strip(),
+                    "already connected to {}".format(serial).encode("utf8"))
 
     def test_reconnect(self):
         """Ensure that a disconnected device reconnects."""
 
         with fake_adbd() as port:
-            serial = 'localhost:{}'.format(port)
+            serial = "localhost:{}".format(port)
             with adb_connect(self, serial):
-                output = subprocess.check_output(['adb', '-s', serial,
-                                                  'get-state'])
-                self.assertEqual(output.strip(), 'device')
+                output = subprocess.check_output(["adb", "-s", serial,
+                                                  "get-state"])
+                self.assertEqual(output.strip(), b"device")
 
                 # This will fail.
-                proc = subprocess.Popen(['adb', '-s', serial, 'shell', 'true'],
+                proc = subprocess.Popen(["adb", "-s", serial, "shell", "true"],
                                         stdout=subprocess.PIPE,
                                         stderr=subprocess.STDOUT)
                 output, _ = proc.communicate()
-                self.assertEqual(output.strip(), 'error: closed')
+                self.assertEqual(output.strip(), b"error: closed")
 
-                subprocess.check_call(['adb', '-s', serial, 'wait-for-device'])
+                subprocess.check_call(["adb", "-s", serial, "wait-for-device"])
 
-                output = subprocess.check_output(['adb', '-s', serial,
-                                                  'get-state'])
-                self.assertEqual(output.strip(), 'device')
+                output = subprocess.check_output(["adb", "-s", serial,
+                                                  "get-state"])
+                self.assertEqual(output.strip(), b"device")
 
                 # Once we explicitly kick a device, it won't attempt to
                 # reconnect.
-                output = subprocess.check_output(['adb', 'disconnect', serial])
+                output = subprocess.check_output(["adb", "disconnect", serial])
                 self.assertEqual(
-                    output.strip(), 'disconnected {}'.format(serial))
+                    output.strip(),
+                    "disconnected {}".format(serial).encode("utf8"))
                 try:
-                    subprocess.check_output(['adb', '-s', serial, 'get-state'],
+                    subprocess.check_output(["adb", "-s", serial, "get-state"],
                                             stderr=subprocess.STDOUT)
-                    self.fail('Device should not be available')
+                    self.fail("Device should not be available")
                 except subprocess.CalledProcessError as err:
                     self.assertEqual(
                         err.output.strip(),
-                        'error: device \'{}\' not found'.format(serial))
+                        "error: device '{}' not found".format(serial).encode("utf8"))
 
 
 def main():
@@ -442,5 +445,5 @@
     unittest.main(verbosity=3)
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     main()
diff --git a/adb/test_device.py b/adb/test_device.py
index 4abe7a7..42aadc4 100644
--- a/adb/test_device.py
+++ b/adb/test_device.py
@@ -762,9 +762,10 @@
             os.chmod(host_dir, 0o700)
 
             # Create an empty directory.
-            os.mkdir(os.path.join(host_dir, 'empty'))
+            empty_dir_path = os.path.join(host_dir, 'empty')
+            os.mkdir(empty_dir_path);
 
-            self.device.push(host_dir, self.DEVICE_TEMP_DIR)
+            self.device.push(empty_dir_path, self.DEVICE_TEMP_DIR)
 
             test_empty_cmd = ['[', '-d',
                               os.path.join(self.DEVICE_TEMP_DIR, 'empty')]
@@ -1032,7 +1033,8 @@
             if host_dir is not None:
                 shutil.rmtree(host_dir)
 
-    def test_pull_symlink_dir(self):
+    # selinux prevents adbd from accessing symlinks on /data/local/tmp.
+    def disabled_test_pull_symlink_dir(self):
         """Pull a symlink to a directory of symlinks to files."""
         try:
             host_dir = tempfile.mkdtemp()
diff --git a/adb/transport.cpp b/adb/transport.cpp
index 3c74c75..0e8db04 100644
--- a/adb/transport.cpp
+++ b/adb/transport.cpp
@@ -1190,14 +1190,15 @@
 }
 #endif  // ADB_HOST
 
-int register_socket_transport(unique_fd s, std::string serial, int port, int local,
-                              atransport::ReconnectCallback reconnect) {
+bool register_socket_transport(unique_fd s, std::string serial, int port, int local,
+                               atransport::ReconnectCallback reconnect, int* error) {
     atransport* t = new atransport(std::move(reconnect), kCsOffline);
 
     D("transport: %s init'ing for socket %d, on port %d", serial.c_str(), s.get(), port);
     if (init_socket_transport(t, std::move(s), port, local) < 0) {
         delete t;
-        return -1;
+        if (error) *error = errno;
+        return false;
     }
 
     std::unique_lock<std::recursive_mutex> lock(transport_lock);
@@ -1206,7 +1207,8 @@
             VLOG(TRANSPORT) << "socket transport " << transport->serial
                             << " is already in pending_list and fails to register";
             delete t;
-            return -EALREADY;
+            if (error) *error = EALREADY;
+            return false;
         }
     }
 
@@ -1215,7 +1217,8 @@
             VLOG(TRANSPORT) << "socket transport " << transport->serial
                             << " is already in transport_list and fails to register";
             delete t;
-            return -EALREADY;
+            if (error) *error = EALREADY;
+            return false;
         }
     }
 
@@ -1229,10 +1232,20 @@
 
     if (local == 1) {
         // Do not wait for emulator transports.
-        return 0;
+        return true;
     }
 
-    return waitable->WaitForConnection(std::chrono::seconds(10)) ? 0 : -1;
+    if (!waitable->WaitForConnection(std::chrono::seconds(10))) {
+        if (error) *error = ETIMEDOUT;
+        return false;
+    }
+
+    if (t->GetConnectionState() == kCsUnauthorized) {
+        if (error) *error = EPERM;
+        return false;
+    }
+
+    return true;
 }
 
 #if ADB_HOST
diff --git a/adb/transport.h b/adb/transport.h
index 4bfc2ce..f362f24 100644
--- a/adb/transport.h
+++ b/adb/transport.h
@@ -364,8 +364,8 @@
 void connect_device(const std::string& address, std::string* response);
 
 /* cause new transports to be init'd and added to the list */
-int register_socket_transport(unique_fd s, std::string serial, int port, int local,
-                              atransport::ReconnectCallback reconnect);
+bool register_socket_transport(unique_fd s, std::string serial, int port, int local,
+                               atransport::ReconnectCallback reconnect, int* error = nullptr);
 
 // This should only be used for transports with connection_state == kCsNoPerm.
 void unregister_usb_transport(usb_handle* usb);
diff --git a/adb/transport_local.cpp b/adb/transport_local.cpp
index b20dee9..1431252 100644
--- a/adb/transport_local.cpp
+++ b/adb/transport_local.cpp
@@ -125,10 +125,12 @@
         return init_socket_transport(t, std::move(fd), port, 0) >= 0;
     };
 
-    int ret = register_socket_transport(std::move(fd), serial, port, 0, std::move(reconnect));
-    if (ret < 0) {
-        if (ret == -EALREADY) {
+    int error;
+    if (!register_socket_transport(std::move(fd), serial, port, 0, std::move(reconnect), &error)) {
+        if (error == EALREADY) {
             *response = android::base::StringPrintf("already connected to %s", serial.c_str());
+        } else if (error == EPERM) {
+            *response = android::base::StringPrintf("failed to authenticate to %s", serial.c_str());
         } else {
             *response = android::base::StringPrintf("failed to connect to %s", serial.c_str());
         }
@@ -162,7 +164,7 @@
         disable_tcp_nagle(fd.get());
         std::string serial = getEmulatorSerialString(console_port);
         if (register_socket_transport(std::move(fd), std::move(serial), adb_port, 1,
-                                      [](atransport*) { return false; }) == 0) {
+                                      [](atransport*) { return false; })) {
             return 0;
         }
     }
diff --git a/base/Android.bp b/base/Android.bp
index 46a0233..3d80d97 100644
--- a/base/Android.bp
+++ b/base/Android.bp
@@ -135,7 +135,6 @@
         "strings_test.cpp",
         "test_main.cpp",
         "test_utils_test.cpp",
-        "unique_fd_test.cpp",
     ],
     target: {
         android: {
diff --git a/base/include/android-base/parsedouble.h b/base/include/android-base/parsedouble.h
index c273c61..ccffba2 100644
--- a/base/include/android-base/parsedouble.h
+++ b/base/include/android-base/parsedouble.h
@@ -20,28 +20,58 @@
 #include <stdlib.h>
 
 #include <limits>
+#include <string>
 
 namespace android {
 namespace base {
 
-// Parse double value in the string 's' and sets 'out' to that value.
+// Parse floating value in the string 's' and sets 'out' to that value if it exists.
 // Optionally allows the caller to define a 'min' and 'max' beyond which
 // otherwise valid values will be rejected. Returns boolean success.
-static inline bool ParseDouble(const char* s, double* out,
-                               double min = std::numeric_limits<double>::lowest(),
-                               double max = std::numeric_limits<double>::max()) {
+template <typename T, T (*strtox)(const char* str, char** endptr)>
+static inline bool ParseFloatingPoint(const char* s, T* out, T min, T max) {
   errno = 0;
   char* end;
-  double result = strtod(s, &end);
+  T result = strtox(s, &end);
   if (errno != 0 || s == end || *end != '\0') {
     return false;
   }
   if (result < min || max < result) {
     return false;
   }
-  *out = result;
+  if (out != nullptr) {
+    *out = result;
+  }
   return true;
 }
 
+// Parse double value in the string 's' and sets 'out' to that value if it exists.
+// Optionally allows the caller to define a 'min' and 'max' beyond which
+// otherwise valid values will be rejected. Returns boolean success.
+static inline bool ParseDouble(const char* s, double* out,
+                               double min = std::numeric_limits<double>::lowest(),
+                               double max = std::numeric_limits<double>::max()) {
+  return ParseFloatingPoint<double, strtod>(s, out, min, max);
+}
+static inline bool ParseDouble(const std::string& s, double* out,
+                               double min = std::numeric_limits<double>::lowest(),
+                               double max = std::numeric_limits<double>::max()) {
+  return ParseFloatingPoint<double, strtod>(s.c_str(), out, min, max);
+}
+
+// Parse float value in the string 's' and sets 'out' to that value if it exists.
+// Optionally allows the caller to define a 'min' and 'max' beyond which
+// otherwise valid values will be rejected. Returns boolean success.
+static inline bool ParseFloat(const char* s, float* out,
+                              float min = std::numeric_limits<float>::lowest(),
+                              float max = std::numeric_limits<float>::max()) {
+  return ParseFloatingPoint<float, strtof>(s, out, min, max);
+}
+static inline bool ParseFloat(const std::string& s, float* out,
+                              float min = std::numeric_limits<float>::lowest(),
+                              float max = std::numeric_limits<float>::max()) {
+  return ParseFloatingPoint<float, strtof>(s.c_str(), out, min, max);
+}
+
 }  // namespace base
 }  // namespace android
diff --git a/base/include/android-base/parseint.h b/base/include/android-base/parseint.h
index bb54c99..55f1ed3 100644
--- a/base/include/android-base/parseint.h
+++ b/base/include/android-base/parseint.h
@@ -27,9 +27,9 @@
 namespace base {
 
 // Parses the unsigned decimal or hexadecimal integer in the string 's' and sets
-// 'out' to that value. Optionally allows the caller to define a 'max' beyond
-// which otherwise valid values will be rejected. Returns boolean success; 'out'
-// is untouched if parsing fails.
+// 'out' to that value if it is specified. Optionally allows the caller to define
+// a 'max' beyond which otherwise valid values will be rejected. Returns boolean
+// success; 'out' is untouched if parsing fails.
 template <typename T>
 bool ParseUint(const char* s, T* out, T max = std::numeric_limits<T>::max(),
                bool allow_suffixes = false) {
@@ -72,9 +72,9 @@
 }
 
 // Parses the signed decimal or hexadecimal integer in the string 's' and sets
-// 'out' to that value. Optionally allows the caller to define a 'min' and 'max'
-// beyond which otherwise valid values will be rejected. Returns boolean
-// success; 'out' is untouched if parsing fails.
+// 'out' to that value if it is specified. Optionally allows the caller to define
+// a 'min' and 'max' beyond which otherwise valid values will be rejected. Returns
+// boolean success; 'out' is untouched if parsing fails.
 template <typename T>
 bool ParseInt(const char* s, T* out,
               T min = std::numeric_limits<T>::min(),
diff --git a/base/parsedouble_test.cpp b/base/parsedouble_test.cpp
index 8734c42..ec3c10c 100644
--- a/base/parsedouble_test.cpp
+++ b/base/parsedouble_test.cpp
@@ -18,7 +18,7 @@
 
 #include <gtest/gtest.h>
 
-TEST(parsedouble, smoke) {
+TEST(parsedouble, double_smoke) {
   double d;
   ASSERT_FALSE(android::base::ParseDouble("", &d));
   ASSERT_FALSE(android::base::ParseDouble("x", &d));
@@ -35,4 +35,33 @@
   ASSERT_FALSE(android::base::ParseDouble("3.0", &d, -1.0, 2.0));
   ASSERT_TRUE(android::base::ParseDouble("1.0", &d, 0.0, 2.0));
   ASSERT_DOUBLE_EQ(1.0, d);
+
+  ASSERT_FALSE(android::base::ParseDouble("123.4x", nullptr));
+  ASSERT_TRUE(android::base::ParseDouble("-123.4", nullptr));
+  ASSERT_FALSE(android::base::ParseDouble("3.0", nullptr, -1.0, 2.0));
+  ASSERT_TRUE(android::base::ParseDouble("1.0", nullptr, 0.0, 2.0));
+}
+
+TEST(parsedouble, float_smoke) {
+  float f;
+  ASSERT_FALSE(android::base::ParseFloat("", &f));
+  ASSERT_FALSE(android::base::ParseFloat("x", &f));
+  ASSERT_FALSE(android::base::ParseFloat("123.4x", &f));
+
+  ASSERT_TRUE(android::base::ParseFloat("123.4", &f));
+  ASSERT_FLOAT_EQ(123.4, f);
+  ASSERT_TRUE(android::base::ParseFloat("-123.4", &f));
+  ASSERT_FLOAT_EQ(-123.4, f);
+
+  ASSERT_TRUE(android::base::ParseFloat("0", &f, 0.0));
+  ASSERT_FLOAT_EQ(0.0, f);
+  ASSERT_FALSE(android::base::ParseFloat("0", &f, 1e-9));
+  ASSERT_FALSE(android::base::ParseFloat("3.0", &f, -1.0, 2.0));
+  ASSERT_TRUE(android::base::ParseFloat("1.0", &f, 0.0, 2.0));
+  ASSERT_FLOAT_EQ(1.0, f);
+
+  ASSERT_FALSE(android::base::ParseFloat("123.4x", nullptr));
+  ASSERT_TRUE(android::base::ParseFloat("-123.4", nullptr));
+  ASSERT_FALSE(android::base::ParseFloat("3.0", nullptr, -1.0, 2.0));
+  ASSERT_TRUE(android::base::ParseFloat("1.0", nullptr, 0.0, 2.0));
 }
diff --git a/base/unique_fd_test.cpp b/base/unique_fd_test.cpp
deleted file mode 100644
index 3fdf12a..0000000
--- a/base/unique_fd_test.cpp
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "android-base/unique_fd.h"
-
-#include <gtest/gtest.h>
-
-#include <errno.h>
-#include <fcntl.h>
-#include <unistd.h>
-
-using android::base::unique_fd;
-
-TEST(unique_fd, unowned_close) {
-#if defined(__BIONIC__)
-  unique_fd fd(open("/dev/null", O_RDONLY));
-  EXPECT_DEATH(close(fd.get()), "incorrect tag");
-#endif
-}
-
-TEST(unique_fd, untag_on_release) {
-  unique_fd fd(open("/dev/null", O_RDONLY));
-  close(fd.release());
-}
-
-TEST(unique_fd, move) {
-  unique_fd fd(open("/dev/null", O_RDONLY));
-  unique_fd fd_moved = std::move(fd);
-  ASSERT_EQ(-1, fd.get());
-  ASSERT_GT(fd_moved.get(), -1);
-}
-
-TEST(unique_fd, unowned_close_after_move) {
-#if defined(__BIONIC__)
-  unique_fd fd(open("/dev/null", O_RDONLY));
-  unique_fd fd_moved = std::move(fd);
-  ASSERT_EQ(-1, fd.get());
-  ASSERT_GT(fd_moved.get(), -1);
-  EXPECT_DEATH(close(fd_moved.get()), "incorrect tag");
-#endif
-}
diff --git a/fastboot/Android.bp b/fastboot/Android.bp
index aa88a8a..3414d53 100644
--- a/fastboot/Android.bp
+++ b/fastboot/Android.bp
@@ -94,6 +94,7 @@
     srcs: [
         "device/commands.cpp",
         "device/fastboot_device.cpp",
+        "device/flashing.cpp",
         "device/main.cpp",
         "device/usb_client.cpp",
         "device/utility.cpp",
@@ -101,23 +102,22 @@
     ],
 
     shared_libs: [
-        "libasyncio",
-        "libext4_utils",
-        "libsparse",
-        "liblog",
         "android.hardware.boot@1.0",
-        "libbootloader_message",
-        "libhidltransport",
-        "libhidlbase",
-        "libhwbinder",
-        "libbase",
-        "libutils",
-        "libcutils",
-        "libfs_mgr",
-    ],
-
-    static_libs: [
         "libadbd",
+        "libasyncio",
+        "libbase",
+        "libbootloader_message",
+        "libcutils",
+        "libext2_uuid",
+        "libext4_utils",
+        "libfs_mgr",
+        "libhidlbase",
+        "libhidltransport",
+        "libhwbinder",
+        "liblog",
+        "liblp",
+        "libsparse",
+        "libutils",
     ],
 
     cpp_std: "c++17",
diff --git a/fastboot/constants.h b/fastboot/constants.h
index fa17070..43daab0 100644
--- a/fastboot/constants.h
+++ b/fastboot/constants.h
@@ -30,6 +30,9 @@
 #define FB_CMD_REBOOT_RECOVERY "reboot-recovery"
 #define FB_CMD_REBOOT_FASTBOOT "reboot-fastboot"
 #define FB_CMD_POWERDOWN "powerdown"
+#define FB_CMD_CREATE_PARTITION "create-logical-partition"
+#define FB_CMD_DELETE_PARTITION "delete-logical-partition"
+#define FB_CMD_RESIZE_PARTITION "resize-logical-partition"
 
 #define RESPONSE_OKAY "OKAY"
 #define RESPONSE_FAIL "FAIL"
@@ -53,3 +56,5 @@
 #define FB_VAR_PARTITION_SIZE "partition-size"
 #define FB_VAR_SLOT_SUCCESSFUL "slot-successful"
 #define FB_VAR_SLOT_UNBOOTABLE "slot-unbootable"
+#define FB_VAR_IS_LOGICAL "is-logical"
+#define FB_VAR_IS_USERSPACE "is-userspace"
diff --git a/fastboot/device/commands.cpp b/fastboot/device/commands.cpp
index ac381fb..690bfa8 100644
--- a/fastboot/device/commands.cpp
+++ b/fastboot/device/commands.cpp
@@ -26,19 +26,24 @@
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
 #include <cutils/android_reboot.h>
+#include <ext4_utils/wipe.h>
+#include <liblp/builder.h>
+#include <liblp/liblp.h>
+#include <uuid/uuid.h>
 
 #include "constants.h"
 #include "fastboot_device.h"
+#include "flashing.h"
 #include "utility.h"
 
 using ::android::hardware::hidl_string;
 using ::android::hardware::boot::V1_0::BoolResult;
 using ::android::hardware::boot::V1_0::CommandResult;
 using ::android::hardware::boot::V1_0::Slot;
+using namespace android::fs_mgr;
 
 bool GetVarHandler(FastbootDevice* device, const std::vector<std::string>& args) {
-    using VariableHandler =
-            std::function<std::string(FastbootDevice*, const std::vector<std::string>&)>;
+    using VariableHandler = std::function<bool(FastbootDevice*, const std::vector<std::string>&)>;
     const std::unordered_map<std::string, VariableHandler> kVariableMap = {
             {FB_VAR_VERSION, GetVersion},
             {FB_VAR_VERSION_BOOTLOADER, GetBootloaderVersion},
@@ -52,7 +57,10 @@
             {FB_VAR_SLOT_COUNT, GetSlotCount},
             {FB_VAR_HAS_SLOT, GetHasSlot},
             {FB_VAR_SLOT_SUCCESSFUL, GetSlotSuccessful},
-            {FB_VAR_SLOT_UNBOOTABLE, GetSlotUnbootable}};
+            {FB_VAR_SLOT_UNBOOTABLE, GetSlotUnbootable},
+            {FB_VAR_PARTITION_SIZE, GetPartitionSize},
+            {FB_VAR_IS_LOGICAL, GetPartitionIsLogical},
+            {FB_VAR_IS_USERSPACE, GetIsUserspace}};
 
     // args[0] is command name, args[1] is variable.
     auto found_variable = kVariableMap.find(args[1]);
@@ -61,8 +69,21 @@
     }
 
     std::vector<std::string> getvar_args(args.begin() + 2, args.end());
-    auto result = found_variable->second(device, getvar_args);
-    return device->WriteStatus(FastbootResult::OKAY, result);
+    return found_variable->second(device, getvar_args);
+}
+
+bool EraseHandler(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 2) {
+        return device->WriteStatus(FastbootResult::FAIL, "Invalid arguments");
+    }
+    PartitionHandle handle;
+    if (!OpenPartition(device, args[1], &handle)) {
+        return device->WriteStatus(FastbootResult::FAIL, "Partition doesn't exist");
+    }
+    if (wipe_block_device(handle.fd(), get_block_device_size(handle.fd())) == 0) {
+        return device->WriteStatus(FastbootResult::OKAY, "Erasing succeeded");
+    }
+    return device->WriteStatus(FastbootResult::FAIL, "Erasing failed");
 }
 
 bool DownloadHandler(FastbootDevice* device, const std::vector<std::string>& args) {
@@ -74,12 +95,12 @@
     if (!android::base::ParseUint("0x" + args[1], &size, UINT_MAX)) {
         return device->WriteStatus(FastbootResult::FAIL, "Invalid size");
     }
-    device->get_download_data().resize(size);
+    device->download_data().resize(size);
     if (!device->WriteStatus(FastbootResult::DATA, android::base::StringPrintf("%08x", size))) {
         return false;
     }
 
-    if (device->HandleData(true, &device->get_download_data())) {
+    if (device->HandleData(true, &device->download_data())) {
         return device->WriteStatus(FastbootResult::OKAY, "");
     }
 
@@ -87,6 +108,17 @@
     return device->WriteStatus(FastbootResult::FAIL, "Couldn't download data");
 }
 
+bool FlashHandler(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 2) {
+        return device->WriteStatus(FastbootResult::FAIL, "Invalid arguments");
+    }
+    int ret = Flash(device, args[1]);
+    if (ret < 0) {
+        return device->WriteStatus(FastbootResult::FAIL, strerror(-ret));
+    }
+    return device->WriteStatus(FastbootResult::OKAY, "Flashing succeeded");
+}
+
 bool SetActiveHandler(FastbootDevice* device, const std::vector<std::string>& args) {
     if (args.size() < 2) {
         return device->WriteStatus(FastbootResult::FAIL, "Missing slot argument");
@@ -183,3 +215,124 @@
     TEMP_FAILURE_RETRY(pause());
     return status;
 }
+
+// Helper class for opening a handle to a MetadataBuilder and writing the new
+// partition table to the same place it was read.
+class PartitionBuilder {
+  public:
+    explicit PartitionBuilder(FastbootDevice* device);
+
+    bool Write();
+    bool Valid() const { return !!builder_; }
+    MetadataBuilder* operator->() const { return builder_.get(); }
+
+  private:
+    std::string super_device_;
+    uint32_t slot_number_;
+    std::unique_ptr<MetadataBuilder> builder_;
+};
+
+PartitionBuilder::PartitionBuilder(FastbootDevice* device) {
+    auto super_device = FindPhysicalPartition(LP_METADATA_PARTITION_NAME);
+    if (!super_device) {
+        return;
+    }
+    super_device_ = *super_device;
+
+    std::string slot = device->GetCurrentSlot();
+    slot_number_ = SlotNumberForSlotSuffix(slot);
+    builder_ = MetadataBuilder::New(super_device_, slot_number_);
+}
+
+bool PartitionBuilder::Write() {
+    std::unique_ptr<LpMetadata> metadata = builder_->Export();
+    if (!metadata) {
+        return false;
+    }
+    return UpdatePartitionTable(super_device_, *metadata.get(), slot_number_);
+}
+
+bool CreatePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 3) {
+        return device->WriteFail("Invalid partition name and size");
+    }
+
+    uint64_t partition_size;
+    std::string partition_name = args[1];
+    if (!android::base::ParseUint(args[2].c_str(), &partition_size)) {
+        return device->WriteFail("Invalid partition size");
+    }
+
+    PartitionBuilder builder(device);
+    if (!builder.Valid()) {
+        return device->WriteFail("Could not open super partition");
+    }
+    // TODO(112433293) Disallow if the name is in the physical table as well.
+    if (builder->FindPartition(partition_name)) {
+        return device->WriteFail("Partition already exists");
+    }
+
+    // Make a random UUID, since they're not currently used.
+    uuid_t uuid;
+    char uuid_str[37];
+    uuid_generate_random(uuid);
+    uuid_unparse(uuid, uuid_str);
+
+    Partition* partition = builder->AddPartition(partition_name, uuid_str, 0);
+    if (!partition) {
+        return device->WriteFail("Failed to add partition");
+    }
+    if (!builder->ResizePartition(partition, partition_size)) {
+        builder->RemovePartition(partition_name);
+        return device->WriteFail("Not enough space for partition");
+    }
+    if (!builder.Write()) {
+        return device->WriteFail("Failed to write partition table");
+    }
+    return device->WriteOkay("Partition created");
+}
+
+bool DeletePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 2) {
+        return device->WriteFail("Invalid partition name and size");
+    }
+
+    PartitionBuilder builder(device);
+    if (!builder.Valid()) {
+        return device->WriteFail("Could not open super partition");
+    }
+    builder->RemovePartition(args[1]);
+    if (!builder.Write()) {
+        return device->WriteFail("Failed to write partition table");
+    }
+    return device->WriteOkay("Partition deleted");
+}
+
+bool ResizePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 3) {
+        return device->WriteFail("Invalid partition name and size");
+    }
+
+    uint64_t partition_size;
+    std::string partition_name = args[1];
+    if (!android::base::ParseUint(args[2].c_str(), &partition_size)) {
+        return device->WriteFail("Invalid partition size");
+    }
+
+    PartitionBuilder builder(device);
+    if (!builder.Valid()) {
+        return device->WriteFail("Could not open super partition");
+    }
+
+    Partition* partition = builder->FindPartition(partition_name);
+    if (!partition) {
+        return device->WriteFail("Partition does not exist");
+    }
+    if (!builder->ResizePartition(partition, partition_size)) {
+        return device->WriteFail("Not enough space to resize partition");
+    }
+    if (!builder.Write()) {
+        return device->WriteFail("Failed to write partition table");
+    }
+    return device->WriteOkay("Partition resized");
+}
diff --git a/fastboot/device/commands.h b/fastboot/device/commands.h
index 8785b91..f67df91 100644
--- a/fastboot/device/commands.h
+++ b/fastboot/device/commands.h
@@ -39,3 +39,8 @@
 bool RebootFastbootHandler(FastbootDevice* device, const std::vector<std::string>& args);
 bool RebootRecoveryHandler(FastbootDevice* device, const std::vector<std::string>& args);
 bool GetVarHandler(FastbootDevice* device, const std::vector<std::string>& args);
+bool EraseHandler(FastbootDevice* device, const std::vector<std::string>& args);
+bool FlashHandler(FastbootDevice* device, const std::vector<std::string>& args);
+bool CreatePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args);
+bool DeletePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args);
+bool ResizePartitionHandler(FastbootDevice* device, const std::vector<std::string>& args);
diff --git a/fastboot/device/fastboot_device.cpp b/fastboot/device/fastboot_device.cpp
index f61e5c2..c306e67 100644
--- a/fastboot/device/fastboot_device.cpp
+++ b/fastboot/device/fastboot_device.cpp
@@ -23,6 +23,7 @@
 #include <algorithm>
 
 #include "constants.h"
+#include "flashing.h"
 #include "usb_client.h"
 
 using ::android::hardware::hidl_string;
@@ -40,6 +41,11 @@
               {FB_CMD_REBOOT_BOOTLOADER, RebootBootloaderHandler},
               {FB_CMD_REBOOT_FASTBOOT, RebootFastbootHandler},
               {FB_CMD_REBOOT_RECOVERY, RebootRecoveryHandler},
+              {FB_CMD_ERASE, EraseHandler},
+              {FB_CMD_FLASH, FlashHandler},
+              {FB_CMD_CREATE_PARTITION, CreatePartitionHandler},
+              {FB_CMD_DELETE_PARTITION, DeletePartitionHandler},
+              {FB_CMD_RESIZE_PARTITION, ResizePartitionHandler},
       }),
       transport_(std::make_unique<ClientUsbTransport>()),
       boot_control_hal_(IBootControl::getService()) {}
@@ -122,3 +128,11 @@
         }
     }
 }
+
+bool FastbootDevice::WriteOkay(const std::string& message) {
+    return WriteStatus(FastbootResult::OKAY, message);
+}
+
+bool FastbootDevice::WriteFail(const std::string& message) {
+    return WriteStatus(FastbootResult::FAIL, message);
+}
diff --git a/fastboot/device/fastboot_device.h b/fastboot/device/fastboot_device.h
index 1092499..addc2ef 100644
--- a/fastboot/device/fastboot_device.h
+++ b/fastboot/device/fastboot_device.h
@@ -39,9 +39,11 @@
     bool HandleData(bool read, std::vector<char>* data);
     std::string GetCurrentSlot();
 
-    std::vector<char>& get_download_data() { return download_data_; }
-    void set_upload_data(const std::vector<char>& data) { upload_data_ = data; }
-    void set_upload_data(std::vector<char>&& data) { upload_data_ = std::move(data); }
+    // Shortcuts for writing OKAY and FAIL status results.
+    bool WriteOkay(const std::string& message);
+    bool WriteFail(const std::string& message);
+
+    std::vector<char>& download_data() { return download_data_; }
     Transport* get_transport() { return transport_.get(); }
     android::sp<android::hardware::boot::V1_0::IBootControl> boot_control_hal() {
         return boot_control_hal_;
@@ -53,5 +55,4 @@
     std::unique_ptr<Transport> transport_;
     android::sp<android::hardware::boot::V1_0::IBootControl> boot_control_hal_;
     std::vector<char> download_data_;
-    std::vector<char> upload_data_;
 };
diff --git a/fastboot/device/flashing.cpp b/fastboot/device/flashing.cpp
new file mode 100644
index 0000000..b5ed170
--- /dev/null
+++ b/fastboot/device/flashing.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "flashing.h"
+
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <memory>
+
+#include <android-base/logging.h>
+#include <android-base/strings.h>
+#include <ext4_utils/ext4_utils.h>
+#include <sparse/sparse.h>
+
+#include "fastboot_device.h"
+#include "utility.h"
+
+namespace {
+
+constexpr uint32_t SPARSE_HEADER_MAGIC = 0xed26ff3a;
+
+}  // namespace
+
+int FlashRawDataChunk(int fd, const char* data, size_t len) {
+    size_t ret = 0;
+    while (ret < len) {
+        int this_len = std::min(static_cast<size_t>(1048576UL * 8), len - ret);
+        int this_ret = write(fd, data, this_len);
+        if (this_ret < 0) {
+            PLOG(ERROR) << "Failed to flash data of len " << len;
+            return -1;
+        }
+        data += this_ret;
+        ret += this_ret;
+    }
+    return 0;
+}
+
+int FlashRawData(int fd, const std::vector<char>& downloaded_data) {
+    int ret = FlashRawDataChunk(fd, downloaded_data.data(), downloaded_data.size());
+    if (ret < 0) {
+        return -errno;
+    }
+    return ret;
+}
+
+int WriteCallback(void* priv, const void* data, size_t len) {
+    int fd = reinterpret_cast<long long>(priv);
+    if (!data) {
+        return lseek64(fd, len, SEEK_CUR) >= 0 ? 0 : -errno;
+    }
+    return FlashRawDataChunk(fd, reinterpret_cast<const char*>(data), len);
+}
+
+int FlashSparseData(int fd, std::vector<char>& downloaded_data) {
+    struct sparse_file* file = sparse_file_import_buf(downloaded_data.data(), true, false);
+    if (!file) {
+        return -ENOENT;
+    }
+    return sparse_file_callback(file, false, false, WriteCallback, reinterpret_cast<void*>(fd));
+}
+
+int FlashBlockDevice(int fd, std::vector<char>& downloaded_data) {
+    lseek64(fd, 0, SEEK_SET);
+    if (downloaded_data.size() >= sizeof(SPARSE_HEADER_MAGIC) &&
+        *reinterpret_cast<uint32_t*>(downloaded_data.data()) == SPARSE_HEADER_MAGIC) {
+        return FlashSparseData(fd, downloaded_data);
+    } else {
+        return FlashRawData(fd, downloaded_data);
+    }
+}
+
+int Flash(FastbootDevice* device, const std::string& partition_name) {
+    PartitionHandle handle;
+    if (!OpenPartition(device, partition_name, &handle)) {
+        return -ENOENT;
+    }
+
+    std::vector<char> data = std::move(device->download_data());
+    if (data.size() == 0) {
+        return -EINVAL;
+    } else if (data.size() > get_block_device_size(handle.fd())) {
+        return -EOVERFLOW;
+    }
+    return FlashBlockDevice(handle.fd(), data);
+}
diff --git a/fastboot/device/flashing.h b/fastboot/device/flashing.h
new file mode 100644
index 0000000..206a407
--- /dev/null
+++ b/fastboot/device/flashing.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <string>
+#include <vector>
+
+class FastbootDevice;
+
+int Flash(FastbootDevice* device, const std::string& partition_name);
diff --git a/fastboot/device/utility.cpp b/fastboot/device/utility.cpp
index c8d2b3e..ec84576 100644
--- a/fastboot/device/utility.cpp
+++ b/fastboot/device/utility.cpp
@@ -16,8 +16,103 @@
 
 #include "utility.h"
 
+#include <android-base/logging.h>
+#include <fs_mgr_dm_linear.h>
+#include <liblp/liblp.h>
+
+#include "fastboot_device.h"
+
+using namespace android::fs_mgr;
+using android::base::unique_fd;
 using android::hardware::boot::V1_0::Slot;
 
+static bool OpenPhysicalPartition(const std::string& name, PartitionHandle* handle) {
+    std::optional<std::string> path = FindPhysicalPartition(name);
+    if (!path) {
+        return false;
+    }
+    *handle = PartitionHandle(*path);
+    return true;
+}
+
+static bool OpenLogicalPartition(const std::string& name, const std::string& slot,
+                                 PartitionHandle* handle) {
+    std::optional<std::string> path = FindPhysicalPartition(LP_METADATA_PARTITION_NAME);
+    if (!path) {
+        return false;
+    }
+    uint32_t slot_number = SlotNumberForSlotSuffix(slot);
+    std::string dm_path;
+    if (!CreateLogicalPartition(path->c_str(), slot_number, name, true, &dm_path)) {
+        LOG(ERROR) << "Could not map partition: " << name;
+        return false;
+    }
+    auto closer = [name]() -> void { DestroyLogicalPartition(name); };
+    *handle = PartitionHandle(dm_path, std::move(closer));
+    return true;
+}
+
+bool OpenPartition(FastbootDevice* device, const std::string& name, PartitionHandle* handle) {
+    // We prioritize logical partitions over physical ones, and do this
+    // consistently for other partition operations (like getvar:partition-size).
+    if (LogicalPartitionExists(name, device->GetCurrentSlot())) {
+        if (!OpenLogicalPartition(name, device->GetCurrentSlot(), handle)) {
+            return false;
+        }
+    } else if (!OpenPhysicalPartition(name, handle)) {
+        LOG(ERROR) << "No such partition: " << name;
+        return false;
+    }
+
+    unique_fd fd(TEMP_FAILURE_RETRY(open(handle->path().c_str(), O_WRONLY | O_EXCL)));
+    if (fd < 0) {
+        PLOG(ERROR) << "Failed to open block device: " << handle->path();
+        return false;
+    }
+    handle->set_fd(std::move(fd));
+    return true;
+}
+
+std::optional<std::string> FindPhysicalPartition(const std::string& name) {
+    std::string path = "/dev/block/by-name/" + name;
+    if (access(path.c_str(), R_OK | W_OK) < 0) {
+        return {};
+    }
+    return path;
+}
+
+static const LpMetadataPartition* FindLogicalPartition(const LpMetadata& metadata,
+                                                       const std::string& name) {
+    for (const auto& partition : metadata.partitions) {
+        if (GetPartitionName(partition) == name) {
+            return &partition;
+        }
+    }
+    return nullptr;
+}
+
+bool LogicalPartitionExists(const std::string& name, const std::string& slot_suffix,
+                            bool* is_zero_length) {
+    auto path = FindPhysicalPartition(LP_METADATA_PARTITION_NAME);
+    if (!path) {
+        return false;
+    }
+
+    uint32_t slot_number = SlotNumberForSlotSuffix(slot_suffix);
+    std::unique_ptr<LpMetadata> metadata = ReadMetadata(path->c_str(), slot_number);
+    if (!metadata) {
+        return false;
+    }
+    const LpMetadataPartition* partition = FindLogicalPartition(*metadata.get(), name);
+    if (!partition) {
+        return false;
+    }
+    if (is_zero_length) {
+        *is_zero_length = (partition->num_extents == 0);
+    }
+    return true;
+}
+
 bool GetSlotNumber(const std::string& slot, Slot* number) {
     if (slot.size() != 1) {
         return false;
diff --git a/fastboot/device/utility.h b/fastboot/device/utility.h
index 867d693..0931fc3 100644
--- a/fastboot/device/utility.h
+++ b/fastboot/device/utility.h
@@ -15,8 +15,46 @@
  */
 #pragma once
 
+#include <optional>
 #include <string>
 
+#include <android-base/unique_fd.h>
 #include <android/hardware/boot/1.0/IBootControl.h>
 
+// Logical partitions are only mapped to a block device as needed, and
+// immediately unmapped when no longer needed. In order to enforce this we
+// require accessing partitions through a Handle abstraction, which may perform
+// additional operations after closing its file descriptor.
+class PartitionHandle {
+  public:
+    PartitionHandle() {}
+    explicit PartitionHandle(const std::string& path) : path_(path) {}
+    PartitionHandle(const std::string& path, std::function<void()>&& closer)
+        : path_(path), closer_(std::move(closer)) {}
+    PartitionHandle(PartitionHandle&& other) = default;
+    PartitionHandle& operator=(PartitionHandle&& other) = default;
+    ~PartitionHandle() {
+        if (closer_) {
+            // Make sure the device is closed first.
+            fd_ = {};
+            closer_();
+        }
+    }
+    const std::string& path() const { return path_; }
+    int fd() const { return fd_.get(); }
+    void set_fd(android::base::unique_fd&& fd) { fd_ = std::move(fd); }
+
+  private:
+    std::string path_;
+    android::base::unique_fd fd_;
+    std::function<void()> closer_;
+};
+
+class FastbootDevice;
+
+std::optional<std::string> FindPhysicalPartition(const std::string& name);
+bool LogicalPartitionExists(const std::string& name, const std::string& slot_suffix,
+                            bool* is_zero_length = nullptr);
+bool OpenPartition(FastbootDevice* device, const std::string& name, PartitionHandle* handle);
+
 bool GetSlotNumber(const std::string& slot, android::hardware::boot::V1_0::Slot* number);
diff --git a/fastboot/device/variables.cpp b/fastboot/device/variables.cpp
index 153ab92..a5dead2 100644
--- a/fastboot/device/variables.cpp
+++ b/fastboot/device/variables.cpp
@@ -16,6 +16,8 @@
 
 #include "variables.h"
 
+#include <inttypes.h>
+
 #include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/properties.h>
@@ -24,6 +26,7 @@
 #include <ext4_utils/ext4_utils.h>
 
 #include "fastboot_device.h"
+#include "flashing.h"
 #include "utility.h"
 
 using ::android::hardware::boot::V1_0::BoolResult;
@@ -32,91 +35,137 @@
 constexpr int kMaxDownloadSizeDefault = 0x20000000;
 constexpr char kFastbootProtocolVersion[] = "0.4";
 
-std::string GetVersion(FastbootDevice* /* device */, const std::vector<std::string>& /* args */) {
-    return kFastbootProtocolVersion;
+bool GetVersion(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(kFastbootProtocolVersion);
 }
 
-std::string GetBootloaderVersion(FastbootDevice* /* device */,
-                                 const std::vector<std::string>& /* args */) {
-    return android::base::GetProperty("ro.bootloader", "");
+bool GetBootloaderVersion(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(android::base::GetProperty("ro.bootloader", ""));
 }
 
-std::string GetBasebandVersion(FastbootDevice* /* device */,
-                               const std::vector<std::string>& /* args */) {
-    return android::base::GetProperty("ro.build.expect.baseband", "");
+bool GetBasebandVersion(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(android::base::GetProperty("ro.build.expect.baseband", ""));
 }
 
-std::string GetProduct(FastbootDevice* /* device */, const std::vector<std::string>& /* args */) {
-    return android::base::GetProperty("ro.product.device", "");
+bool GetProduct(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(android::base::GetProperty("ro.product.device", ""));
 }
 
-std::string GetSerial(FastbootDevice* /* device */, const std::vector<std::string>& /* args */) {
-    return android::base::GetProperty("ro.serialno", "");
+bool GetSerial(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(android::base::GetProperty("ro.serialno", ""));
 }
 
-std::string GetSecure(FastbootDevice* /* device */, const std::vector<std::string>& /* args */) {
-    return android::base::GetBoolProperty("ro.secure", "") ? "yes" : "no";
+bool GetSecure(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(android::base::GetBoolProperty("ro.secure", "") ? "yes" : "no");
 }
 
-std::string GetCurrentSlot(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+bool GetCurrentSlot(FastbootDevice* device, const std::vector<std::string>& /* args */) {
     std::string suffix = device->GetCurrentSlot();
-    return suffix.size() == 2 ? suffix.substr(1) : suffix;
+    std::string slot = suffix.size() == 2 ? suffix.substr(1) : suffix;
+    return device->WriteOkay(slot);
 }
 
-std::string GetSlotCount(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+bool GetSlotCount(FastbootDevice* device, const std::vector<std::string>& /* args */) {
     auto boot_control_hal = device->boot_control_hal();
     if (!boot_control_hal) {
         return "0";
     }
-    return std::to_string(boot_control_hal->getNumberSlots());
+    return device->WriteOkay(std::to_string(boot_control_hal->getNumberSlots()));
 }
 
-std::string GetSlotSuccessful(FastbootDevice* device, const std::vector<std::string>& args) {
+bool GetSlotSuccessful(FastbootDevice* device, const std::vector<std::string>& args) {
     if (args.empty()) {
-        return "no";
+        return device->WriteFail("Missing argument");
     }
     Slot slot;
     if (!GetSlotNumber(args[0], &slot)) {
-        return "no";
+        return device->WriteFail("Invalid slot");
     }
     auto boot_control_hal = device->boot_control_hal();
     if (!boot_control_hal) {
-        return "no";
+        return device->WriteFail("Device has no slots");
     }
-    return boot_control_hal->isSlotMarkedSuccessful(slot) == BoolResult::TRUE ? "yes" : "no";
+    if (boot_control_hal->isSlotMarkedSuccessful(slot) != BoolResult::TRUE) {
+        return device->WriteOkay("no");
+    }
+    return device->WriteOkay("yes");
 }
 
-std::string GetSlotUnbootable(FastbootDevice* device, const std::vector<std::string>& args) {
+bool GetSlotUnbootable(FastbootDevice* device, const std::vector<std::string>& args) {
     if (args.empty()) {
-        return "no";
+        return device->WriteFail("Missing argument");
     }
     Slot slot;
     if (!GetSlotNumber(args[0], &slot)) {
-        return "no";
+        return device->WriteFail("Invalid slot");
     }
     auto boot_control_hal = device->boot_control_hal();
     if (!boot_control_hal) {
-        return "no";
+        return device->WriteFail("Device has no slots");
     }
-    return boot_control_hal->isSlotBootable(slot) == BoolResult::TRUE ? "no" : "yes";
+    if (boot_control_hal->isSlotBootable(slot) != BoolResult::TRUE) {
+        return device->WriteOkay("yes");
+    }
+    return device->WriteOkay("no");
 }
 
-std::string GetMaxDownloadSize(FastbootDevice* /* device */,
-                               const std::vector<std::string>& /* args */) {
-    return std::to_string(kMaxDownloadSizeDefault);
+bool GetMaxDownloadSize(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay(std::to_string(kMaxDownloadSizeDefault));
 }
 
-std::string GetUnlocked(FastbootDevice* /* device */, const std::vector<std::string>& /* args */) {
-    return "yes";
+bool GetUnlocked(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay("yes");
 }
 
-std::string GetHasSlot(FastbootDevice* device, const std::vector<std::string>& args) {
+bool GetHasSlot(FastbootDevice* device, const std::vector<std::string>& args) {
     if (args.empty()) {
-        return "no";
+        return device->WriteFail("Missing argument");
     }
     std::string slot_suffix = device->GetCurrentSlot();
     if (slot_suffix.empty()) {
-        return "no";
+        return device->WriteFail("Invalid slot");
     }
-    return args[0] == "userdata" ? "no" : "yes";
+    std::string result = (args[0] == "userdata" ? "no" : "yes");
+    return device->WriteOkay(result);
+}
+
+bool GetPartitionSize(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 1) {
+        return device->WriteFail("Missing argument");
+    }
+    // Zero-length partitions cannot be created through device-mapper, so we
+    // special case them here.
+    bool is_zero_length;
+    if (LogicalPartitionExists(args[0], device->GetCurrentSlot(), &is_zero_length) &&
+        is_zero_length) {
+        return device->WriteOkay("0");
+    }
+    // Otherwise, open the partition as normal.
+    PartitionHandle handle;
+    if (!OpenPartition(device, args[0], &handle)) {
+        return device->WriteFail("Could not open partition");
+    }
+    uint64_t size = get_block_device_size(handle.fd());
+    return device->WriteOkay(android::base::StringPrintf("%" PRIX64, size));
+}
+
+bool GetPartitionIsLogical(FastbootDevice* device, const std::vector<std::string>& args) {
+    if (args.size() < 1) {
+        return device->WriteFail("Missing argument");
+    }
+    // Note: if a partition name is in both the GPT and the super partition, we
+    // return "true", to be consistent with prefering to flash logical partitions
+    // over physical ones.
+    std::string partition_name = args[0];
+    if (LogicalPartitionExists(partition_name, device->GetCurrentSlot())) {
+        return device->WriteOkay("yes");
+    }
+    if (FindPhysicalPartition(partition_name)) {
+        return device->WriteOkay("no");
+    }
+    return device->WriteFail("Partition not found");
+}
+
+bool GetIsUserspace(FastbootDevice* device, const std::vector<std::string>& /* args */) {
+    return device->WriteOkay("yes");
 }
diff --git a/fastboot/device/variables.h b/fastboot/device/variables.h
index 09ef8ec..554a080 100644
--- a/fastboot/device/variables.h
+++ b/fastboot/device/variables.h
@@ -21,16 +21,19 @@
 
 class FastbootDevice;
 
-std::string GetVersion(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetBootloaderVersion(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetBasebandVersion(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetProduct(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetSerial(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetSecure(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetCurrentSlot(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetSlotCount(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetSlotSuccessful(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetSlotUnbootable(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetMaxDownloadSize(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetUnlocked(FastbootDevice* device, const std::vector<std::string>& args);
-std::string GetHasSlot(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetVersion(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetBootloaderVersion(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetBasebandVersion(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetProduct(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetSerial(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetSecure(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetCurrentSlot(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetSlotCount(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetSlotSuccessful(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetSlotUnbootable(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetMaxDownloadSize(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetUnlocked(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetHasSlot(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetPartitionSize(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetPartitionIsLogical(FastbootDevice* device, const std::vector<std::string>& args);
+bool GetIsUserspace(FastbootDevice* device, const std::vector<std::string>& args);
diff --git a/fastboot/engine.cpp b/fastboot/engine.cpp
index 63ee2af..6890643 100644
--- a/fastboot/engine.cpp
+++ b/fastboot/engine.cpp
@@ -155,6 +155,21 @@
                                         total);
 }
 
+void fb_queue_create_partition(const std::string& partition, const std::string& size) {
+    Action& a = queue_action(OP_COMMAND, FB_CMD_CREATE_PARTITION ":" + partition + ":" + size);
+    a.msg = "Creating '" + partition + "'";
+}
+
+void fb_queue_delete_partition(const std::string& partition) {
+    Action& a = queue_action(OP_COMMAND, FB_CMD_DELETE_PARTITION ":" + partition);
+    a.msg = "Deleting '" + partition + "'";
+}
+
+void fb_queue_resize_partition(const std::string& partition, const std::string& size) {
+    Action& a = queue_action(OP_COMMAND, FB_CMD_RESIZE_PARTITION ":" + partition + ":" + size);
+    a.msg = "Resizing '" + partition + "'";
+}
+
 static int match(const char* str, const char** value, unsigned count) {
     unsigned n;
 
diff --git a/fastboot/engine.h b/fastboot/engine.h
index 74aaa6a..8aebdd7 100644
--- a/fastboot/engine.h
+++ b/fastboot/engine.h
@@ -69,6 +69,9 @@
 void fb_queue_upload(const std::string& outfile);
 void fb_queue_notice(const std::string& notice);
 void fb_queue_wait_for_disconnect(void);
+void fb_queue_create_partition(const std::string& partition, const std::string& size);
+void fb_queue_delete_partition(const std::string& partition);
+void fb_queue_resize_partition(const std::string& partition, const std::string& size);
 int64_t fb_execute_queue();
 void fb_set_active(const std::string& slot);
 
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index d652c0d..dc94952 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -1691,6 +1691,17 @@
             } else {
                 syntax_error("unknown 'flashing' command %s", args[0].c_str());
             }
+        } else if (command == "create-logical-partition") {
+            std::string partition = next_arg(&args);
+            std::string size = next_arg(&args);
+            fb_queue_create_partition(partition, size);
+        } else if (command == "delete-logical-partition") {
+            std::string partition = next_arg(&args);
+            fb_queue_delete_partition(partition);
+        } else if (command == "resize-logical-partition") {
+            std::string partition = next_arg(&args);
+            std::string size = next_arg(&args);
+            fb_queue_resize_partition(partition, size);
         } else {
             syntax_error("unknown command %s", command.c_str());
         }
diff --git a/fs_mgr/Android.bp b/fs_mgr/Android.bp
index 196321c..6329d54 100644
--- a/fs_mgr/Android.bp
+++ b/fs_mgr/Android.bp
@@ -43,6 +43,7 @@
         "fs_mgr_avb.cpp",
         "fs_mgr_avb_ops.cpp",
         "fs_mgr_dm_linear.cpp",
+        "fs_mgr_overlayfs.cpp",
     ],
     shared_libs: [
         "libfec",
diff --git a/fs_mgr/fs_mgr.cpp b/fs_mgr/fs_mgr.cpp
index 5f57182..99f2df8 100644
--- a/fs_mgr/fs_mgr.cpp
+++ b/fs_mgr/fs_mgr.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include "fs_mgr.h"
+
 #include <ctype.h>
 #include <dirent.h>
 #include <errno.h>
@@ -51,6 +53,7 @@
 #include <ext4_utils/ext4_sb.h>
 #include <ext4_utils/ext4_utils.h>
 #include <ext4_utils/wipe.h>
+#include <fs_mgr_overlayfs.h>
 #include <libdm/dm.h>
 #include <linux/fs.h>
 #include <linux/loop.h>
@@ -58,7 +61,6 @@
 #include <log/log_properties.h>
 #include <logwrap/logwrap.h>
 
-#include "fs_mgr.h"
 #include "fs_mgr_avb.h"
 #include "fs_mgr_priv.h"
 
@@ -1035,6 +1037,10 @@
         }
     }
 
+#if ALLOW_ADBD_DISABLE_VERITY == 1  // "userdebug" build
+    fs_mgr_overlayfs_mount_all();
+#endif
+
     if (error_count) {
         return FS_MGR_MNTALL_FAIL;
     } else {
diff --git a/fs_mgr/fs_mgr_overlayfs.cpp b/fs_mgr/fs_mgr_overlayfs.cpp
new file mode 100644
index 0000000..74dfc00
--- /dev/null
+++ b/fs_mgr/fs_mgr_overlayfs.cpp
@@ -0,0 +1,478 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dirent.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <selinux/selinux.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include <android-base/file.h>
+#include <android-base/macros.h>
+#include <android-base/properties.h>
+#include <android-base/strings.h>
+#include <fs_mgr_overlayfs.h>
+#include <fstab/fstab.h>
+
+#include "fs_mgr_priv.h"
+
+using namespace std::literals;
+
+#if ALLOW_ADBD_DISABLE_VERITY == 0  // If we are a user build, provide stubs
+
+bool fs_mgr_overlayfs_mount_all() {
+    return false;
+}
+
+bool fs_mgr_overlayfs_setup(const char*, const char*, bool* change) {
+    if (change) *change = false;
+    return false;
+}
+
+bool fs_mgr_overlayfs_teardown(const char*, bool* change) {
+    if (change) *change = false;
+    return false;
+}
+
+#else  // ALLOW_ADBD_DISABLE_VERITY == 0
+
+namespace {
+
+// acceptable overlayfs backing storage
+const auto kOverlayMountPoint = "/cache"s;
+
+// return true if everything is mounted, but before adb is started.  At
+// 'trigger firmware_mounts_complete' after 'trigger load_persist_props_action'.
+bool fs_mgr_boot_completed() {
+    return !android::base::GetProperty("ro.boottime.init", "").empty() &&
+           !!access("/dev/.booting", F_OK);
+}
+
+bool fs_mgr_is_dir(const std::string& path) {
+    struct stat st;
+    return !stat(path.c_str(), &st) && S_ISDIR(st.st_mode);
+}
+
+// Similar test as overlayfs workdir= validation in the kernel for read-write
+// validation, except we use fs_mgr_work.  Covers space and storage issues.
+bool fs_mgr_dir_is_writable(const std::string& path) {
+    auto test_directory = path + "/fs_mgr_work";
+    rmdir(test_directory.c_str());
+    auto ret = !mkdir(test_directory.c_str(), 0700);
+    return ret | !rmdir(test_directory.c_str());
+}
+
+std::string fs_mgr_get_context(const std::string& mount_point) {
+    char* ctx = nullptr;
+    auto len = getfilecon(mount_point.c_str(), &ctx);
+    if ((len > 0) && ctx) {
+        std::string context(ctx, len);
+        free(ctx);
+        return context;
+    }
+    return "";
+}
+
+bool fs_mgr_overlayfs_enabled(const struct fstab_rec* fsrec) {
+    // readonly filesystem, can not be mount -o remount,rw
+    return "squashfs"s == fsrec->fs_type;
+}
+
+constexpr char upper_name[] = "upper";
+constexpr char work_name[] = "work";
+
+std::string fs_mgr_get_overlayfs_candidate(const std::string& mount_point) {
+    if (!fs_mgr_is_dir(mount_point)) return "";
+    auto dir = kOverlayMountPoint + "/overlay/" + android::base::Basename(mount_point) + "/";
+    auto upper = dir + upper_name;
+    if (!fs_mgr_is_dir(upper)) return "";
+    auto work = dir + work_name;
+    if (!fs_mgr_is_dir(work)) return "";
+    if (!fs_mgr_dir_is_writable(work)) return "";
+    return dir;
+}
+
+constexpr char lowerdir_option[] = "lowerdir=";
+constexpr char upperdir_option[] = "upperdir=";
+
+// default options for mount_point, returns empty string for none available.
+std::string fs_mgr_get_overlayfs_options(const char* mount_point) {
+    auto fsrec_mount_point = std::string(mount_point);
+    auto candidate = fs_mgr_get_overlayfs_candidate(fsrec_mount_point);
+    if (candidate.empty()) return "";
+
+    auto context = fs_mgr_get_context(fsrec_mount_point);
+    if (!context.empty()) context = ",rootcontext="s + context;
+    return "override_creds=off,"s + lowerdir_option + fsrec_mount_point + "," + upperdir_option +
+           candidate + upper_name + ",workdir=" + candidate + work_name + context;
+}
+
+bool fs_mgr_system_root_image(const fstab* fstab) {
+    if (!fstab) {  // can not happen?
+        // This will return empty on init first_stage_mount,
+        // hence why we prefer checking the fstab instead.
+        return android::base::GetBoolProperty("ro.build.system_root_image", false);
+    }
+    for (auto i = 0; i < fstab->num_entries; i++) {
+        const auto fsrec = &fstab->recs[i];
+        auto fsrec_mount_point = fsrec->mount_point;
+        if (!fsrec_mount_point) continue;
+        if ("/system"s == fsrec_mount_point) return false;
+    }
+    return true;
+}
+
+std::string fs_mgr_get_overlayfs_options(const fstab* fstab, const char* mount_point) {
+    if (fs_mgr_system_root_image(fstab) && ("/"s == mount_point)) mount_point = "/system";
+
+    return fs_mgr_get_overlayfs_options(mount_point);
+}
+
+// return true if system supports overlayfs
+bool fs_mgr_wants_overlayfs() {
+    // This will return empty on init first_stage_mount, so speculative
+    // determination, empty (unset) _or_ "1" is true which differs from the
+    // official ro.debuggable policy.  ALLOW_ADBD_DISABLE_VERITY == 0 should
+    // protect us from false in any case, so this is insurance.
+    auto debuggable = android::base::GetProperty("ro.debuggable", "1");
+    if (debuggable != "1") return false;
+
+    // Overlayfs available in the kernel, and patched for override_creds?
+    static signed char overlayfs_in_kernel = -1;  // cache for constant condition
+    if (overlayfs_in_kernel == -1) {
+        overlayfs_in_kernel = !access("/sys/module/overlay/parameters/override_creds", F_OK);
+    }
+    return overlayfs_in_kernel;
+}
+
+bool fs_mgr_wants_overlayfs(const fstab_rec* fsrec) {
+    if (!fsrec) return false;
+
+    auto fsrec_mount_point = fsrec->mount_point;
+    if (!fsrec_mount_point) return false;
+
+    if (!fsrec->fs_type) return false;
+
+    // Don't check entries that are managed by vold.
+    if (fsrec->fs_mgr_flags & (MF_VOLDMANAGED | MF_RECOVERYONLY)) return false;
+
+    // Only concerned with readonly partitions.
+    if (!(fsrec->flags & MS_RDONLY)) return false;
+
+    // If unbindable, do not allow overlayfs as this could expose us to
+    // security issues.  On Android, this could also be used to turn off
+    // the ability to overlay an otherwise acceptable filesystem since
+    // /system and /vendor are never bound(sic) to.
+    if (fsrec->flags & MS_UNBINDABLE) return false;
+
+    if (!fs_mgr_overlayfs_enabled(fsrec)) return false;
+
+    // Verity enabled?
+    const auto basename_mount_point(android::base::Basename(fsrec_mount_point));
+    auto found = false;
+    fs_mgr_update_verity_state(
+            [&basename_mount_point, &found](fstab_rec*, const char* mount_point, int, int) {
+                if (mount_point && (basename_mount_point == mount_point)) found = true;
+            });
+    return !found;
+}
+
+bool fs_mgr_rm_all(const std::string& path, bool* change = nullptr) {
+    auto save_errno = errno;
+    std::unique_ptr<DIR, decltype(&closedir)> dir(opendir(path.c_str()), closedir);
+    if (!dir) {
+        if (errno == ENOENT) {
+            errno = save_errno;
+            return true;
+        }
+        PERROR << "overlayfs open " << path;
+        return false;
+    }
+    dirent* entry;
+    auto ret = true;
+    while ((entry = readdir(dir.get()))) {
+        if (("."s == entry->d_name) || (".."s == entry->d_name)) continue;
+        auto file = path + "/" + entry->d_name;
+        if (entry->d_type == DT_UNKNOWN) {
+            struct stat st;
+            if (!lstat(file.c_str(), &st) && (st.st_mode & S_IFDIR)) entry->d_type = DT_DIR;
+        }
+        if (entry->d_type == DT_DIR) {
+            ret &= fs_mgr_rm_all(file, change);
+            if (!rmdir(file.c_str())) {
+                if (change) *change = true;
+            } else {
+                ret = false;
+                PERROR << "overlayfs rmdir " << file;
+            }
+            continue;
+        }
+        if (!unlink(file.c_str())) {
+            if (change) *change = true;
+        } else {
+            ret = false;
+            PERROR << "overlayfs rm " << file;
+        }
+    }
+    return ret;
+}
+
+bool fs_mgr_overlayfs_setup_one(const std::string& overlay, const std::string& mount_point,
+                                bool* change) {
+    auto ret = true;
+    auto fsrec_mount_point = overlay + android::base::Basename(mount_point) + "/";
+    auto save_errno = errno;
+    if (!mkdir(fsrec_mount_point.c_str(), 0755)) {
+        if (change) *change = true;
+    } else if (errno != EEXIST) {
+        ret = false;
+        PERROR << "overlayfs mkdir " << fsrec_mount_point;
+    } else {
+        errno = save_errno;
+    }
+
+    save_errno = errno;
+    if (!mkdir((fsrec_mount_point + work_name).c_str(), 0755)) {
+        if (change) *change = true;
+    } else if (errno != EEXIST) {
+        ret = false;
+        PERROR << "overlayfs mkdir " << fsrec_mount_point << work_name;
+    } else {
+        errno = save_errno;
+    }
+
+    auto new_context = fs_mgr_get_context(mount_point);
+    if (!new_context.empty() && setfscreatecon(new_context.c_str())) {
+        ret = false;
+        PERROR << "overlayfs setfscreatecon " << new_context;
+    }
+    auto upper = fsrec_mount_point + upper_name;
+    save_errno = errno;
+    if (!mkdir(upper.c_str(), 0755)) {
+        if (change) *change = true;
+    } else if (errno != EEXIST) {
+        ret = false;
+        PERROR << "overlayfs mkdir " << upper;
+    } else {
+        errno = save_errno;
+    }
+    if (!new_context.empty()) setfscreatecon(nullptr);
+
+    return ret;
+}
+
+bool fs_mgr_overlayfs_mount(const fstab* fstab, const fstab_rec* fsrec) {
+    if (!fs_mgr_wants_overlayfs(fsrec)) return false;
+    auto fsrec_mount_point = fsrec->mount_point;
+    if (!fsrec_mount_point || !fsrec_mount_point[0]) return false;
+    auto options = fs_mgr_get_overlayfs_options(fstab, fsrec_mount_point);
+    if (options.empty()) return false;
+
+    // hijack __mount() report format to help triage
+    auto report = "__mount(source=overlay,target="s + fsrec_mount_point + ",type=overlay";
+    const auto opt_list = android::base::Split(options, ",");
+    for (const auto opt : opt_list) {
+        if (android::base::StartsWith(opt, upperdir_option)) {
+            report = report + "," + opt;
+            break;
+        }
+    }
+    report = report + ")=";
+
+    auto ret = mount("overlay", fsrec_mount_point, "overlay", MS_RDONLY | MS_RELATIME,
+                     options.c_str());
+    if (ret) {
+        PERROR << report << ret;
+        return false;
+    } else {
+        LINFO << report << ret;
+        return true;
+    }
+}
+
+bool fs_mgr_overlayfs_already_mounted(const char* mount_point) {
+    if (!mount_point) return false;
+    std::unique_ptr<struct fstab, decltype(&fs_mgr_free_fstab)> fstab(
+            fs_mgr_read_fstab("/proc/mounts"), fs_mgr_free_fstab);
+    if (!fstab) return false;
+    const auto lowerdir = std::string(lowerdir_option) + mount_point;
+    for (auto i = 0; i < fstab->num_entries; ++i) {
+        const auto fsrec = &fstab->recs[i];
+        const auto fs_type = fsrec->fs_type;
+        if (!fs_type) continue;
+        if (("overlay"s != fs_type) && ("overlayfs"s != fs_type)) continue;
+        auto fsrec_mount_point = fsrec->mount_point;
+        if (!fsrec_mount_point) continue;
+        if (strcmp(fsrec_mount_point, mount_point)) continue;
+        const auto fs_options = fsrec->fs_options;
+        if (!fs_options) continue;
+        const auto options = android::base::Split(fs_options, ",");
+        for (const auto opt : options) {
+            if (opt == lowerdir) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+
+}  // namespace
+
+bool fs_mgr_overlayfs_mount_all() {
+    auto ret = false;
+
+    if (!fs_mgr_wants_overlayfs()) return ret;
+
+    std::unique_ptr<struct fstab, decltype(&fs_mgr_free_fstab)> fstab(fs_mgr_read_fstab_default(),
+                                                                      fs_mgr_free_fstab);
+    if (!fstab) return ret;
+
+    for (auto i = 0; i < fstab->num_entries; i++) {
+        const auto fsrec = &fstab->recs[i];
+        auto fsrec_mount_point = fsrec->mount_point;
+        if (!fsrec_mount_point) continue;
+        if (fs_mgr_overlayfs_already_mounted(fsrec_mount_point)) continue;
+
+        if (fs_mgr_overlayfs_mount(fstab.get(), fsrec)) ret = true;
+    }
+    return ret;
+}
+
+// Returns false if setup not permitted, errno set to last error.
+// If something is altered, set *change.
+bool fs_mgr_overlayfs_setup(const char* backing, const char* mount_point, bool* change) {
+    if (change) *change = false;
+    auto ret = false;
+    if (backing && (kOverlayMountPoint != backing)) {
+        errno = EINVAL;
+        return ret;
+    }
+    if (!fs_mgr_wants_overlayfs()) return ret;
+    if (!fs_mgr_boot_completed()) {
+        errno = EBUSY;
+        PERROR << "overlayfs setup";
+        return ret;
+    }
+
+    std::unique_ptr<struct fstab, decltype(&fs_mgr_free_fstab)> fstab(fs_mgr_read_fstab_default(),
+                                                                      fs_mgr_free_fstab);
+    std::vector<std::string> mounts;
+    if (fstab) {
+        if (!fs_mgr_get_entry_for_mount_point(fstab.get(), kOverlayMountPoint)) return ret;
+        for (auto i = 0; i < fstab->num_entries; i++) {
+            const auto fsrec = &fstab->recs[i];
+            auto fsrec_mount_point = fsrec->mount_point;
+            if (!fsrec_mount_point) continue;
+            if (mount_point && strcmp(fsrec_mount_point, mount_point)) continue;
+            if (!fs_mgr_wants_overlayfs(fsrec)) continue;
+            mounts.emplace_back(fsrec_mount_point);
+        }
+        if (mounts.empty()) return ret;
+    }
+
+    if (mount_point && ("/"s == mount_point) && fs_mgr_system_root_image(fstab.get())) {
+        mount_point = "/system";
+    }
+    auto overlay = kOverlayMountPoint + "/overlay/";
+    auto save_errno = errno;
+    if (!mkdir(overlay.c_str(), 0755)) {
+        if (change) *change = true;
+    } else if (errno != EEXIST) {
+        PERROR << "overlayfs mkdir " << overlay;
+    } else {
+        errno = save_errno;
+    }
+    if (!fstab && mount_point && fs_mgr_overlayfs_setup_one(overlay, mount_point, change)) {
+        ret = true;
+    }
+    for (const auto& fsrec_mount_point : mounts) {
+        ret |= fs_mgr_overlayfs_setup_one(overlay, fsrec_mount_point, change);
+    }
+    return ret;
+}
+
+// Returns false if teardown not permitted, errno set to last error.
+// If something is altered, set *change.
+bool fs_mgr_overlayfs_teardown(const char* mount_point, bool* change) {
+    if (change) *change = false;
+    if (mount_point && ("/"s == mount_point)) {
+        std::unique_ptr<struct fstab, decltype(&fs_mgr_free_fstab)> fstab(
+                fs_mgr_read_fstab_default(), fs_mgr_free_fstab);
+        if (fs_mgr_system_root_image(fstab.get())) mount_point = "/system";
+    }
+    auto ret = true;
+    const auto overlay = kOverlayMountPoint + "/overlay";
+    const auto oldpath = overlay + (mount_point ?: "");
+    const auto newpath = oldpath + ".teardown";
+    ret &= fs_mgr_rm_all(newpath);
+    auto save_errno = errno;
+    if (rename(oldpath.c_str(), newpath.c_str())) {
+        if (change) *change = true;
+    } else if (errno != ENOENT) {
+        ret = false;
+        PERROR << "overlayfs mv " << oldpath << " " << newpath;
+    } else {
+        errno = save_errno;
+    }
+    ret &= fs_mgr_rm_all(newpath, change);
+    save_errno = errno;
+    if (!rmdir(newpath.c_str())) {
+        if (change) *change = true;
+    } else if (errno != ENOENT) {
+        ret = false;
+        PERROR << "overlayfs rmdir " << newpath;
+    } else {
+        errno = save_errno;
+    }
+    if (mount_point) {
+        save_errno = errno;
+        if (!rmdir(overlay.c_str())) {
+            if (change) *change = true;
+        } else if ((errno != ENOENT) && (errno != ENOTEMPTY)) {
+            ret = false;
+            PERROR << "overlayfs rmdir " << overlay;
+        } else {
+            errno = save_errno;
+        }
+    }
+    if (!fs_mgr_wants_overlayfs()) {
+        // After obligatory teardown to make sure everything is clean, but if
+        // we didn't want overlayfs in the the first place, we do not want to
+        // waste time on a reboot (or reboot request message).
+        if (change) *change = false;
+    }
+    // And now that we did what we could, lets inform
+    // caller that there may still be more to do.
+    if (!fs_mgr_boot_completed()) {
+        errno = EBUSY;
+        PERROR << "overlayfs teardown";
+        ret = false;
+    }
+    return ret;
+}
+
+#endif  // ALLOW_ADBD_DISABLE_VERITY != 0
diff --git a/fs_mgr/include/fs_mgr_overlayfs.h b/fs_mgr/include/fs_mgr_overlayfs.h
new file mode 100644
index 0000000..1d2ff03
--- /dev/null
+++ b/fs_mgr/include/fs_mgr_overlayfs.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <fstab/fstab.h>
+
+bool fs_mgr_overlayfs_mount_all();
+bool fs_mgr_overlayfs_setup(const char* backing = nullptr, const char* mount_point = nullptr,
+                            bool* change = nullptr);
+bool fs_mgr_overlayfs_teardown(const char* mount_point = nullptr, bool* change = nullptr);
diff --git a/init/first_stage_mount.cpp b/init/first_stage_mount.cpp
index 41e8fff..0c5cf76 100644
--- a/init/first_stage_mount.cpp
+++ b/init/first_stage_mount.cpp
@@ -35,6 +35,7 @@
 #include "fs_mgr.h"
 #include "fs_mgr_avb.h"
 #include "fs_mgr_dm_linear.h"
+#include "fs_mgr_overlayfs.h"
 #include "uevent.h"
 #include "uevent_listener.h"
 #include "util.h"
@@ -351,6 +352,7 @@
             return false;
         }
     }
+    fs_mgr_overlayfs_mount_all();
     return true;
 }
 
diff --git a/init/init_first_stage.cpp b/init/init_first_stage.cpp
index b367f2a..466cde3 100644
--- a/init/init_first_stage.cpp
+++ b/init/init_first_stage.cpp
@@ -138,9 +138,10 @@
     SelinuxSetupKernelLogging();
     SelinuxInitialize();
 
-    // Unneeded?  It's an ext4 file system so shouldn't it have the right domain already?
-    // We're in the kernel domain, so re-exec init to transition to the init domain now
-    // that the SELinux policy has been loaded.
+    // We're in the kernel domain and want to transition to the init domain when we exec second
+    // stage init.  File systems that store SELabels in their xattrs, such as ext4 do not need an
+    // explicit restorecon here, but other file systems do.  In particular, this is needed for
+    // ramdisks such as the recovery image for A/B devices.
     if (selinux_android_restorecon("/system/bin/init", 0) == -1) {
         PLOG(FATAL) << "restorecon failed of /system/bin/init failed";
     }
diff --git a/libbacktrace/include/backtrace/BacktraceMap.h b/libbacktrace/include/backtrace/BacktraceMap.h
index a9cfce4..c564271 100644
--- a/libbacktrace/include/backtrace/BacktraceMap.h
+++ b/libbacktrace/include/backtrace/BacktraceMap.h
@@ -31,6 +31,7 @@
 
 #include <deque>
 #include <iterator>
+#include <memory>
 #include <string>
 #include <vector>
 
diff --git a/libutils/CallStack.cpp b/libutils/CallStack.cpp
index bd6015e..fe6f33d 100644
--- a/libutils/CallStack.cpp
+++ b/libutils/CallStack.cpp
@@ -16,16 +16,15 @@
 
 #define LOG_TAG "CallStack"
 
-#include <utils/CallStack.h>
-
-#include <memory>
-
 #include <utils/Printer.h>
 #include <utils/Errors.h>
 #include <utils/Log.h>
 
 #include <backtrace/Backtrace.h>
 
+#define CALLSTACK_WEAK  // Don't generate weak definitions.
+#include <utils/CallStack.h>
+
 namespace android {
 
 CallStack::CallStack() {
@@ -76,4 +75,30 @@
     }
 }
 
+// The following four functions may be used via weak symbol references from libutils.
+// Clients assume that if any of these symbols are available, then deleteStack() is.
+
+#ifdef WEAKS_AVAILABLE
+
+CallStack::CallStackUPtr CallStack::getCurrentInternal(int ignoreDepth) {
+    CallStack::CallStackUPtr stack(new CallStack());
+    stack->update(ignoreDepth + 1);
+    return stack;
+}
+
+void CallStack::logStackInternal(const char* logtag, const CallStack* stack,
+                                 android_LogPriority priority) {
+    stack->log(logtag, priority);
+}
+
+String8 CallStack::stackToStringInternal(const char* prefix, const CallStack* stack) {
+    return stack->toString(prefix);
+}
+
+void CallStack::deleteStack(CallStack* stack) {
+    delete stack;
+}
+
+#endif // WEAKS_AVAILABLE
+
 }; // namespace android
diff --git a/libutils/RefBase.cpp b/libutils/RefBase.cpp
index 9074850..3f1e79a 100644
--- a/libutils/RefBase.cpp
+++ b/libutils/RefBase.cpp
@@ -17,30 +17,41 @@
 #define LOG_TAG "RefBase"
 // #define LOG_NDEBUG 0
 
+#include <memory>
+
 #include <utils/RefBase.h>
 
 #include <utils/CallStack.h>
 
+#include <utils/Mutex.h>
+
 #ifndef __unused
 #define __unused __attribute__((__unused__))
 #endif
 
-// compile with refcounting debugging enabled
-#define DEBUG_REFS                      0
+// Compile with refcounting debugging enabled.
+#define DEBUG_REFS 0
+
+// The following three are ignored unless DEBUG_REFS is set.
 
 // whether ref-tracking is enabled by default, if not, trackMe(true, false)
 // needs to be called explicitly
-#define DEBUG_REFS_ENABLED_BY_DEFAULT   0
+#define DEBUG_REFS_ENABLED_BY_DEFAULT 0
 
 // whether callstack are collected (significantly slows things down)
-#define DEBUG_REFS_CALLSTACK_ENABLED    1
+#define DEBUG_REFS_CALLSTACK_ENABLED 1
 
 // folder where stack traces are saved when DEBUG_REFS is enabled
 // this folder needs to exist and be writable
-#define DEBUG_REFS_CALLSTACK_PATH       "/data/debug"
+#define DEBUG_REFS_CALLSTACK_PATH "/data/debug"
 
 // log all reference counting operations
-#define PRINT_REFS                      0
+#define PRINT_REFS 0
+
+// Continue after logging a stack trace if ~RefBase discovers that reference
+// count has never been incremented. Normally we conspicuously crash in that
+// case.
+#define DEBUG_REFBASE_DESTRUCTION 1
 
 // ---------------------------------------------------------------------------
 
@@ -184,7 +195,7 @@
                 char inc = refs->ref >= 0 ? '+' : '-';
                 ALOGD("\t%c ID %p (ref %d):", inc, refs->id, refs->ref);
 #if DEBUG_REFS_CALLSTACK_ENABLED
-                refs->stack.log(LOG_TAG);
+                CallStack::logStack(LOG_TAG, refs->stack.get());
 #endif
                 refs = refs->next;
             }
@@ -198,14 +209,14 @@
                 char inc = refs->ref >= 0 ? '+' : '-';
                 ALOGD("\t%c ID %p (ref %d):", inc, refs->id, refs->ref);
 #if DEBUG_REFS_CALLSTACK_ENABLED
-                refs->stack.log(LOG_TAG);
+                CallStack::logStack(LOG_TAG, refs->stack.get());
 #endif
                 refs = refs->next;
             }
         }
         if (dumpStack) {
             ALOGE("above errors at:");
-            CallStack stack(LOG_TAG);
+            CallStack::logStack(LOG_TAG);
         }
     }
 
@@ -279,7 +290,7 @@
                      this);
             int rc = open(name, O_RDWR | O_CREAT | O_APPEND, 644);
             if (rc >= 0) {
-                write(rc, text.string(), text.length());
+                (void)write(rc, text.string(), text.length());
                 close(rc);
                 ALOGD("STACK TRACE for %p saved in %s", this, name);
             }
@@ -294,7 +305,7 @@
         ref_entry* next;
         const void* id;
 #if DEBUG_REFS_CALLSTACK_ENABLED
-        CallStack stack;
+        CallStack::CallStackUPtr stack;
 #endif
         int32_t ref;
     };
@@ -311,7 +322,7 @@
             ref->ref = mRef;
             ref->id = id;
 #if DEBUG_REFS_CALLSTACK_ENABLED
-            ref->stack.update(2);
+            ref->stack = CallStack::getCurrent(2);
 #endif
             ref->next = *refs;
             *refs = ref;
@@ -346,7 +357,7 @@
                 ref = ref->next;
             }
 
-            CallStack stack(LOG_TAG);
+            CallStack::logStack(LOG_TAG);
         }
     }
 
@@ -373,7 +384,7 @@
                      inc, refs->id, refs->ref);
             out->append(buf);
 #if DEBUG_REFS_CALLSTACK_ENABLED
-            out->append(refs->stack.toString("\t\t"));
+            out->append(CallStack::stackToString("\t\t", refs->stack.get()));
 #else
             out->append("\t\t(call stacks disabled)");
 #endif
@@ -700,16 +711,16 @@
         if (mRefs->mWeak.load(std::memory_order_relaxed) == 0) {
             delete mRefs;
         }
-    } else if (mRefs->mStrong.load(std::memory_order_relaxed)
-            == INITIAL_STRONG_VALUE) {
+    } else if (mRefs->mStrong.load(std::memory_order_relaxed) == INITIAL_STRONG_VALUE) {
         // We never acquired a strong reference on this object.
-        LOG_ALWAYS_FATAL_IF(mRefs->mWeak.load() != 0,
-                "RefBase: Explicit destruction with non-zero weak "
-                "reference count");
-        // TODO: Always report if we get here. Currently MediaMetadataRetriever
-        // C++ objects are inconsistently managed and sometimes get here.
-        // There may be other cases, but we believe they should all be fixed.
-        delete mRefs;
+#if DEBUG_REFBASE_DESTRUCTION
+        // Treating this as fatal is prone to causing boot loops. For debugging, it's
+        // better to treat as non-fatal.
+        ALOGD("RefBase: Explicit destruction, weak count = %d (in %p)", mRefs->mWeak.load(), this);
+        CallStack::logStack(LOG_TAG);
+#else
+        LOG_ALWAYS_FATAL("RefBase: Explicit destruction, weak count = %d", mRefs->mWeak.load());
+#endif
     }
     // For debugging purposes, clear mRefs.  Ineffective against outstanding wp's.
     const_cast<weakref_impl*&>(mRefs) = nullptr;
diff --git a/libutils/include/utils/CallStack.h b/libutils/include/utils/CallStack.h
index 0c1b875..56004fe 100644
--- a/libutils/include/utils/CallStack.h
+++ b/libutils/include/utils/CallStack.h
@@ -17,6 +17,8 @@
 #ifndef ANDROID_CALLSTACK_H
 #define ANDROID_CALLSTACK_H
 
+#include <memory>
+
 #include <android/log.h>
 #include <backtrace/backtrace_constants.h>
 #include <utils/String8.h>
@@ -25,6 +27,19 @@
 #include <stdint.h>
 #include <sys/types.h>
 
+#if !defined(__APPLE__) && !defined(_WIN32)
+# define WEAKS_AVAILABLE 1
+#endif
+#ifndef CALLSTACK_WEAK
+# ifdef WEAKS_AVAILABLE
+#   define CALLSTACK_WEAK __attribute__((weak))
+# else // !WEAKS_AVAILABLE
+#   define CALLSTACK_WEAK
+# endif // !WEAKS_AVAILABLE
+#endif // CALLSTACK_WEAK predefined
+
+#define ALWAYS_INLINE __attribute__((always_inline))
+
 namespace android {
 
 class Printer;
@@ -36,7 +51,7 @@
     CallStack();
     // Create a callstack with the current thread's stack trace.
     // Immediately dump it to logcat using the given logtag.
-    CallStack(const char* logtag, int32_t ignoreDepth=1);
+    CallStack(const char* logtag, int32_t ignoreDepth = 1);
     ~CallStack();
 
     // Reset the stack frames (same as creating an empty call stack).
@@ -44,7 +59,7 @@
 
     // Immediately collect the stack traces for the specified thread.
     // The default is to dump the stack of the current call.
-    void update(int32_t ignoreDepth=1, pid_t tid=BACKTRACE_CURRENT_THREAD);
+    void update(int32_t ignoreDepth = 1, pid_t tid = BACKTRACE_CURRENT_THREAD);
 
     // Dump a stack trace to the log using the supplied logtag.
     void log(const char* logtag,
@@ -63,7 +78,88 @@
     // Get the count of stack frames that are in this call stack.
     size_t size() const { return mFrameLines.size(); }
 
-private:
+    // DO NOT USE ANYTHING BELOW HERE. The following public members are expected
+    // to disappear again shortly, once a better replacement facility exists.
+    // The replacement facility will be incompatible!
+
+    // Debugging accesses to some basic functionality. These use weak symbols to
+    // avoid introducing a dependency on libutilscallstack. Such a dependency from
+    // libutils results in a cyclic build dependency. These routines can be called
+    // from within libutils. But if the actual library is unavailable, they do
+    // nothing.
+    //
+    // DO NOT USE THESE. They will disappear.
+    struct StackDeleter {
+#ifdef WEAKS_AVAILABLE
+        void operator()(CallStack* stack) {
+            deleteStack(stack);
+        }
+#else
+        void operator()(CallStack*) {}
+#endif
+    };
+
+    typedef std::unique_ptr<CallStack, StackDeleter> CallStackUPtr;
+
+    // Return current call stack if possible, nullptr otherwise.
+#ifdef WEAKS_AVAILABLE
+    static CallStackUPtr ALWAYS_INLINE getCurrent(int32_t ignoreDepth = 1) {
+        if (reinterpret_cast<uintptr_t>(getCurrentInternal) == 0) {
+            ALOGW("CallStack::getCurrentInternal not linked, returning null");
+            return CallStackUPtr(nullptr);
+        } else {
+            return getCurrentInternal(ignoreDepth);
+        }
+    }
+#else // !WEAKS_AVAILABLE
+    static CallStackUPtr ALWAYS_INLINE getCurrent(int32_t = 1) {
+        return CallStackUPtr(nullptr);
+    }
+#endif // !WEAKS_AVAILABLE
+
+#ifdef WEAKS_AVAILABLE
+    static void ALWAYS_INLINE logStack(const char* logtag, CallStack* stack = getCurrent().get(),
+                                       android_LogPriority priority = ANDROID_LOG_DEBUG) {
+        if (reinterpret_cast<uintptr_t>(logStackInternal) != 0 && stack != nullptr) {
+            logStackInternal(logtag, stack, priority);
+        } else {
+            ALOGW("CallStack::logStackInternal not linked");
+        }
+    }
+
+#else
+    static void ALWAYS_INLINE logStack(const char*, CallStack* = getCurrent().get(),
+                                       android_LogPriority = ANDROID_LOG_DEBUG) {
+    }
+#endif // !WEAKS_AVAILABLE
+
+#ifdef WEAKS_AVAILABLE
+    static String8 ALWAYS_INLINE stackToString(const char* prefix = nullptr,
+                                               const CallStack* stack = getCurrent().get()) {
+        if (reinterpret_cast<uintptr_t>(stackToStringInternal) != 0 && stack != nullptr) {
+            return stackToStringInternal(prefix, stack);
+        } else {
+            return String8("<CallStack package not linked>");
+        }
+    }
+#else // !WEAKS_AVAILABLE
+    static String8 ALWAYS_INLINE stackToString(const char* = nullptr,
+                                               const CallStack* = getCurrent().get()) {
+        return String8("<CallStack package not linked>");
+    }
+#endif // !WEAKS_AVAILABLE
+
+  private:
+#ifdef WEAKS_AVAILABLE
+    static CallStackUPtr CALLSTACK_WEAK getCurrentInternal(int32_t ignoreDepth);
+    static void CALLSTACK_WEAK logStackInternal(const char* logtag, const CallStack* stack,
+                                                android_LogPriority priority);
+    static String8 CALLSTACK_WEAK stackToStringInternal(const char* prefix, const CallStack* stack);
+    // The deleter is only invoked on non-null pointers. Hence it will never be
+    // invoked if CallStack is not linked.
+    static void CALLSTACK_WEAK deleteStack(CallStack* stack);
+#endif // WEAKS_AVAILABLE
+
     Vector<String8> mFrameLines;
 };
 
diff --git a/llkd/libllkd.cpp b/llkd/libllkd.cpp
index f357cc2..3b28775 100644
--- a/llkd/libllkd.cpp
+++ b/llkd/libllkd.cpp
@@ -55,6 +55,7 @@
 
 using namespace std::chrono_literals;
 using namespace std::chrono;
+using namespace std::literals;
 
 namespace {
 
@@ -497,8 +498,7 @@
         }
         ::usleep(200000);  // let everything settle
     }
-    llkWriteStringToFile(std::string("SysRq : Trigger a crash : 'livelock,") + state + "'\n",
-                         "/dev/kmsg");
+    llkWriteStringToFile("SysRq : Trigger a crash : 'livelock,"s + state + "'\n", "/dev/kmsg");
     android::base::WriteStringToFd("c", sysrqTriggerFd);
     // NOTREACHED
     // DYB
@@ -1070,7 +1070,7 @@
         std::to_string(kthreaddPid) + "," + std::to_string(::getpid()) + "," +
         std::to_string(::gettid()) + "," LLK_BLACKLIST_PROCESS_DEFAULT);
     if (threadname) {
-        defaultBlacklistProcess += std::string(",") + threadname;
+        defaultBlacklistProcess += ","s + threadname;
     }
     for (int cpu = 1; cpu < get_nprocs_conf(); ++cpu) {
         defaultBlacklistProcess += ",[watchdog/" + std::to_string(cpu) + "]";