diff --git a/adb/client/main.cpp b/adb/client/main.cpp
index 27b7109..b0722ef 100644
--- a/adb/client/main.cpp
+++ b/adb/client/main.cpp
@@ -23,11 +23,6 @@
 #include <stdlib.h>
 #include <unistd.h>
 
-// We only build the affinity WAR code for Linux.
-#if defined(__linux__)
-#include <sched.h>
-#endif
-
 #include <android-base/errors.h>
 #include <android-base/file.h>
 #include <android-base/logging.h>
@@ -39,21 +34,14 @@
 #include "adb_utils.h"
 #include "transport.h"
 
-#if defined(_WIN32)
-static BOOL WINAPI ctrlc_handler(DWORD type) {
-    // TODO: Consider trying to kill a starting up adb server (if we're in
-    // launch_server) by calling GenerateConsoleCtrlEvent().
-    exit(STATUS_CONTROL_C_EXIT);
-    return TRUE;
-}
-
 static std::string GetLogFilePath() {
+#if defined(_WIN32)
     const char log_name[] = "adb.log";
     WCHAR temp_path[MAX_PATH];
 
     // https://msdn.microsoft.com/en-us/library/windows/desktop/aa364992%28v=vs.85%29.aspx
     DWORD nchars = GetTempPathW(arraysize(temp_path), temp_path);
-    if ((nchars >= arraysize(temp_path)) || (nchars == 0)) {
+    if (nchars >= arraysize(temp_path) || nchars == 0) {
         // If string truncation or some other error.
         fatal("cannot retrieve temporary file path: %s\n",
               android::base::SystemErrorCodeToString(GetLastError()).c_str());
@@ -65,12 +53,12 @@
     }
 
     return temp_path_utf8 + log_name;
-}
 #else
-static std::string GetLogFilePath() {
-    return std::string("/tmp/adb.log");
-}
+    const char* tmp_dir = getenv("TMPDIR");
+    if (tmp_dir == nullptr) tmp_dir = "/tmp";
+    return android::base::StringPrintf("%s/adb.%u.log", tmp_dir, getuid());
 #endif
+}
 
 static void setup_daemon_logging(void) {
     const std::string log_file_path(GetLogFilePath());
@@ -90,6 +78,15 @@
     LOG(INFO) << adb_version();
 }
 
+#if defined(_WIN32)
+static BOOL WINAPI ctrlc_handler(DWORD type) {
+    // TODO: Consider trying to kill a starting up adb server (if we're in
+    // launch_server) by calling GenerateConsoleCtrlEvent().
+    exit(STATUS_CONTROL_C_EXIT);
+    return TRUE;
+}
+#endif
+
 int adb_server_main(int is_daemon, int server_port, int ack_reply_fd) {
 #if defined(_WIN32)
     // adb start-server starts us up with stdout and stderr hooked up to
diff --git a/adb/commandline.cpp b/adb/commandline.cpp
index 2edfd0a..78b49f8 100644
--- a/adb/commandline.cpp
+++ b/adb/commandline.cpp
@@ -292,11 +292,16 @@
 // stdout/stderr are routed independently and the remote exit code will be
 // returned.
 // if |output| is non-null, stdout will be appended to it instead.
-static int read_and_dump(int fd, bool use_shell_protocol=false, std::string* output=nullptr) {
+// if |err| is non-null, stderr will be appended to it instead.
+static int read_and_dump(int fd, bool use_shell_protocol=false, std::string* output=nullptr,
+                         std::string* err=nullptr) {
     int exit_code = 0;
+    if (fd < 0) return exit_code;
+
     std::unique_ptr<ShellProtocol> protocol;
     int length = 0;
     FILE* outfile = stdout;
+    std::string* outstring = output;
 
     char raw_buffer[BUFSIZ];
     char* buffer_ptr = raw_buffer;
@@ -309,7 +314,7 @@
         buffer_ptr = protocol->data();
     }
 
-    while (fd >= 0) {
+    while (true) {
         if (use_shell_protocol) {
             if (!protocol->Read()) {
                 break;
@@ -317,9 +322,11 @@
             switch (protocol->id()) {
                 case ShellProtocol::kIdStdout:
                     outfile = stdout;
+                    outstring = output;
                     break;
                 case ShellProtocol::kIdStderr:
                     outfile = stderr;
+                    outstring = err;
                     break;
                 case ShellProtocol::kIdExit:
                     exit_code = protocol->data()[0];
@@ -337,11 +344,11 @@
             }
         }
 
-        if (output == nullptr) {
+        if (outstring == nullptr) {
             fwrite(buffer_ptr, 1, length, outfile);
             fflush(outfile);
         } else {
-            output->append(buffer_ptr, length);
+            outstring->append(buffer_ptr, length);
         }
     }
 
@@ -1123,7 +1130,8 @@
 static int send_shell_command(TransportType transport_type, const char* serial,
                               const std::string& command,
                               bool disable_shell_protocol,
-                              std::string* output=nullptr) {
+                              std::string* output=nullptr,
+                              std::string* err=nullptr) {
     int fd;
     bool use_shell_protocol = false;
 
@@ -1158,7 +1166,7 @@
         }
     }
 
-    int exit_code = read_and_dump(fd, use_shell_protocol, output);
+    int exit_code = read_and_dump(fd, use_shell_protocol, output, err);
 
     if (adb_close(fd) < 0) {
         PLOG(ERROR) << "failure closing FD " << fd;
@@ -1169,8 +1177,7 @@
 
 static int bugreport(TransportType transport_type, const char* serial, int argc,
                      const char** argv) {
-    // No need for shell protocol with bugreport, always disable for simplicity.
-    if (argc == 1) return send_shell_command(transport_type, serial, "bugreport", true);
+    if (argc == 1) return send_shell_command(transport_type, serial, "bugreport", false);
     if (argc != 2) return usage();
 
     // Zipped bugreport option - will call 'bugreportz', which prints the location of the generated
@@ -1184,7 +1191,7 @@
 
     fprintf(stderr, "Bugreport is in progress and it could take minutes to complete.\n"
             "Please be patient and do not cancel or disconnect your device until it completes.\n");
-    int status = send_shell_command(transport_type, serial, "bugreportz", true, &output);
+    int status = send_shell_command(transport_type, serial, "bugreportz", false, &output, nullptr);
     if (status != 0 || output.empty()) return status;
     output = android::base::Trim(output);
 
@@ -1199,10 +1206,10 @@
     }
     if (android::base::StartsWith(output, BUGZ_FAIL_PREFIX)) {
         const char* error_message = &output[strlen(BUGZ_FAIL_PREFIX)];
-        fprintf(stderr, "device failed to take a zipped bugreport: %s\n", error_message);
+        fprintf(stderr, "Device failed to take a zipped bugreport: %s\n", error_message);
         return -1;
     }
-    fprintf(stderr, "unexpected string (%s) returned by bugreportz, "
+    fprintf(stderr, "Unexpected string (%s) returned by bugreportz, "
             "device probably does not support -z option\n", output.c_str());
     return -1;
 }
diff --git a/adb/shell_service.cpp b/adb/shell_service.cpp
index ce10708..f58af9f 100644
--- a/adb/shell_service.cpp
+++ b/adb/shell_service.cpp
@@ -479,6 +479,12 @@
                 // and only fall back on this for unexpected closures.
                 D("protocol FD died, sending SIGHUP to pid %d", pid_);
                 kill(pid_, SIGHUP);
+
+                // We also need to close the pipes connected to the child process
+                // so that if it ignores SIGHUP and continues to write data it
+                // won't fill up the pipe and block.
+                stdinout_sfd_.Reset();
+                stderr_sfd_.Reset();
             }
             dead_sfd->Reset();
         }
diff --git a/fs_mgr/fs_mgr_verity.cpp b/fs_mgr/fs_mgr_verity.cpp
index c73c1e0..4c6e071 100644
--- a/fs_mgr/fs_mgr_verity.cpp
+++ b/fs_mgr/fs_mgr_verity.cpp
@@ -150,6 +150,18 @@
     return retval;
 }
 
+static int verify_verity_signature(const struct fec_verity_metadata& verity)
+{
+    if (verify_table(verity.signature, verity.table,
+            verity.table_length) == 0 ||
+        verify_table(verity.ecc_signature, verity.table,
+            verity.table_length) == 0) {
+        return 0;
+    }
+
+    return -1;
+}
+
 static int invalidate_table(char *table, size_t table_length)
 {
     size_t n = 0;
@@ -955,8 +967,7 @@
     }
 
     // verify the signature on the table
-    if (verify_table(verity.signature, verity.table,
-            verity.table_length) < 0) {
+    if (verify_verity_signature(verity) < 0) {
         if (params.mode == VERITY_MODE_LOGGING) {
             // the user has been warned, allow mounting without dm-verity
             retval = FS_MGR_SETUP_VERITY_SUCCESS;
diff --git a/include/system/window.h b/include/system/window.h
index b8f33ff..44bfc9b 100644
--- a/include/system/window.h
+++ b/include/system/window.h
@@ -314,6 +314,7 @@
     NATIVE_WINDOW_SET_SURFACE_DAMAGE        = 20,   /* private */
     NATIVE_WINDOW_SET_SHARED_BUFFER_MODE    = 21,
     NATIVE_WINDOW_SET_AUTO_REFRESH          = 22,
+    NATIVE_WINDOW_GET_FRAME_TIMESTAMPS      = 23,
 };
 
 /* parameter for NATIVE_WINDOW_[API_][DIS]CONNECT */
@@ -976,6 +977,18 @@
     return window->perform(window, NATIVE_WINDOW_SET_AUTO_REFRESH, autoRefresh);
 }
 
+static inline int native_window_get_frame_timestamps(
+        struct ANativeWindow* window, uint32_t framesAgo,
+        int64_t* outPostedTime, int64_t* outAcquireTime,
+        int64_t* outRefreshStartTime, int64_t* outGlCompositionDoneTime,
+        int64_t* outDisplayRetireTime, int64_t* outReleaseTime)
+{
+    return window->perform(window, NATIVE_WINDOW_GET_FRAME_TIMESTAMPS,
+            framesAgo, outPostedTime, outAcquireTime, outRefreshStartTime,
+            outGlCompositionDoneTime, outDisplayRetireTime, outReleaseTime);
+}
+
+
 __END_DECLS
 
 #endif /* SYSTEM_CORE_INCLUDE_ANDROID_WINDOW_H */
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 3466dce..3da836c 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -396,6 +396,10 @@
     # create the A/B OTA directory, so as to enforce our permissions
     mkdir /data/ota 0771 root root
 
+    # create the OTA package directory. It will be accessed by GmsCore (cache
+    # group), update_engine and update_verifier.
+    mkdir /data/ota_package 0770 system cache
+
     # create resource-cache and double-check the perms
     mkdir /data/resource-cache 0771 system system
     chown system system /data/resource-cache