diff --git a/adb/Android.bp b/adb/Android.bp
index 2a9a579..07f052f 100644
--- a/adb/Android.bp
+++ b/adb/Android.bp
@@ -292,7 +292,6 @@
 
     static_libs: [
         "libasyncio",
-        "libbootloader_message",
         "libcrypto_utils",
         "libcrypto",
         "libdiagnose_usb",
@@ -318,6 +317,7 @@
         "daemon/framebuffer_service.cpp",
         "daemon/remount_service.cpp",
         "daemon/set_verity_enable_state_service.cpp",
+        "daemon/services.cpp",
         "daemon/shell_service.cpp",
         "shell_service_protocol.cpp",
     ],
@@ -359,6 +359,7 @@
     name: "adbd_test",
     defaults: ["adb_defaults"],
     srcs: libadb_test_srcs + [
+        "daemon/services.cpp",
         "daemon/shell_service.cpp",
         "daemon/shell_service_test.cpp",
         "shell_service_protocol.cpp",
@@ -368,6 +369,7 @@
     static_libs: [
         "libadbd",
         "libbase",
+        "libbootloader_message",
         "libcutils",
         "libcrypto_utils",
         "libcrypto",
diff --git a/adb/adb.h b/adb/adb.h
index 26b5fa1..13ca4d7 100644
--- a/adb/adb.h
+++ b/adb/adb.h
@@ -143,6 +143,10 @@
 #endif
 
 int service_to_fd(const char* name, atransport* transport);
+#if !ADB_HOST
+unique_fd daemon_service_to_fd(const char* name, atransport* transport);
+#endif
+
 #if ADB_HOST
 asocket* host_service_to_socket(const char* name, const char* serial, TransportId transport_id);
 #endif
@@ -151,7 +155,7 @@
 int init_jdwp(void);
 asocket* create_jdwp_service_socket();
 asocket* create_jdwp_tracker_service_socket();
-int create_jdwp_connection_fd(int jdwp_pid);
+unique_fd create_jdwp_connection_fd(int jdwp_pid);
 #endif
 
 int handle_forward_request(const char* service, atransport* transport, int reply_fd);
diff --git a/adb/daemon/jdwp_service.cpp b/adb/daemon/jdwp_service.cpp
index 175e82e..b40faee 100644
--- a/adb/daemon/jdwp_service.cpp
+++ b/adb/daemon/jdwp_service.cpp
@@ -311,7 +311,7 @@
     jdwp_process_list_updated();
 }
 
-int create_jdwp_connection_fd(int pid) {
+unique_fd create_jdwp_connection_fd(int pid) {
     D("looking for pid %d in JDWP process list", pid);
 
     for (auto& proc : _jdwp_list) {
@@ -320,7 +320,7 @@
 
             if (adb_socketpair(fds) < 0) {
                 D("%s: socket pair creation failed: %s", __FUNCTION__, strerror(errno));
-                return -1;
+                return unique_fd{};
             }
             D("socketpair: (%d,%d)", fds[0], fds[1]);
 
@@ -329,11 +329,11 @@
                 fdevent_add(proc->fde, FDE_WRITE);
             }
 
-            return fds[0];
+            return unique_fd{fds[0]};
         }
     }
     D("search failed !!");
-    return -1;
+    return unique_fd{};
 }
 
 /**  VM DEBUG CONTROL SOCKET
diff --git a/adb/daemon/remount_service.cpp b/adb/daemon/remount_service.cpp
index 76a1452..6588587 100644
--- a/adb/daemon/remount_service.cpp
+++ b/adb/daemon/remount_service.cpp
@@ -216,7 +216,7 @@
 }
 
 void remount_service(unique_fd fd, const std::string& cmd) {
-    bool user_requested_reboot = cmd != "-R";
+    bool user_requested_reboot = cmd == "-R";
 
     if (getuid() != 0) {
         WriteFdExactly(fd.get(), "Not running as root. Try \"adb root\" first.\n");
diff --git a/adb/daemon/services.cpp b/adb/daemon/services.cpp
new file mode 100644
index 0000000..25024b0
--- /dev/null
+++ b/adb/daemon/services.cpp
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define TRACE_TAG SERVICES
+
+#include "sysdeps.h"
+
+#include <errno.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+#include <thread>
+
+#include <android-base/file.h>
+#include <android-base/parsenetaddress.h>
+#include <android-base/properties.h>
+#include <android-base/stringprintf.h>
+#include <android-base/strings.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/android_reboot.h>
+#include <cutils/sockets.h>
+#include <log/log_properties.h>
+
+#include "adb.h"
+#include "adb_io.h"
+#include "adb_unique_fd.h"
+#include "adb_utils.h"
+#include "services.h"
+#include "socket_spec.h"
+#include "sysdeps.h"
+#include "transport.h"
+
+#include "daemon/file_sync_service.h"
+#include "daemon/framebuffer_service.h"
+#include "daemon/remount_service.h"
+#include "daemon/set_verity_enable_state_service.h"
+#include "daemon/shell_service.h"
+
+void restart_root_service(unique_fd fd) {
+    if (getuid() == 0) {
+        WriteFdExactly(fd.get(), "adbd is already running as root\n");
+        return;
+    }
+    if (!__android_log_is_debuggable()) {
+        WriteFdExactly(fd.get(), "adbd cannot run as root in production builds\n");
+        return;
+    }
+
+    android::base::SetProperty("service.adb.root", "1");
+    WriteFdExactly(fd.get(), "restarting adbd as root\n");
+}
+
+void restart_unroot_service(unique_fd fd) {
+    if (getuid() != 0) {
+        WriteFdExactly(fd.get(), "adbd not running as root\n");
+        return;
+    }
+    android::base::SetProperty("service.adb.root", "0");
+    WriteFdExactly(fd.get(), "restarting adbd as non root\n");
+}
+
+void restart_tcp_service(unique_fd fd, int port) {
+    if (port <= 0) {
+        WriteFdFmt(fd.get(), "invalid port %d\n", port);
+        return;
+    }
+
+    android::base::SetProperty("service.adb.tcp.port", android::base::StringPrintf("%d", port));
+    WriteFdFmt(fd.get(), "restarting in TCP mode port: %d\n", port);
+}
+
+void restart_usb_service(unique_fd fd) {
+    android::base::SetProperty("service.adb.tcp.port", "0");
+    WriteFdExactly(fd.get(), "restarting in USB mode\n");
+}
+
+bool reboot_service_impl(unique_fd fd, const std::string& arg) {
+    std::string reboot_arg = arg;
+    bool auto_reboot = false;
+
+    if (reboot_arg == "sideload-auto-reboot") {
+        auto_reboot = true;
+        reboot_arg = "sideload";
+    }
+
+    // It reboots into sideload mode by setting "--sideload" or "--sideload_auto_reboot"
+    // in the command file.
+    if (reboot_arg == "sideload") {
+        if (getuid() != 0) {
+            WriteFdExactly(fd.get(), "'adb root' is required for 'adb reboot sideload'.\n");
+            return false;
+        }
+
+        const std::vector<std::string> options = {auto_reboot ? "--sideload_auto_reboot"
+                                                              : "--sideload"};
+        std::string err;
+        if (!write_bootloader_message(options, &err)) {
+            D("Failed to set bootloader message: %s", err.c_str());
+            return false;
+        }
+
+        reboot_arg = "recovery";
+    }
+
+    sync();
+
+    if (reboot_arg.empty()) reboot_arg = "adb";
+    std::string reboot_string = android::base::StringPrintf("reboot,%s", reboot_arg.c_str());
+    if (!android::base::SetProperty(ANDROID_RB_PROPERTY, reboot_string)) {
+        WriteFdFmt(fd.get(), "reboot (%s) failed\n", reboot_string.c_str());
+        return false;
+    }
+
+    return true;
+}
+
+void reboot_service(unique_fd fd, const std::string& arg) {
+    if (!reboot_service_impl(std::move(fd), arg)) {
+        return;
+    }
+    // Don't return early. Give the reboot command time to take effect
+    // to avoid messing up scripts which do "adb reboot && adb wait-for-device"
+    while (true) {
+        pause();
+    }
+}
+
+void reconnect_service(unique_fd fd, atransport* t) {
+    WriteFdExactly(fd.get(), "done");
+    kick_transport(t);
+}
+
+unique_fd reverse_service(const char* command, atransport* transport) {
+    int s[2];
+    if (adb_socketpair(s)) {
+        PLOG(ERROR) << "cannot create service socket pair.";
+        return unique_fd{};
+    }
+    VLOG(SERVICES) << "service socketpair: " << s[0] << ", " << s[1];
+    if (handle_forward_request(command, transport, s[1]) < 0) {
+        SendFail(s[1], "not a reverse forwarding command");
+    }
+    adb_close(s[1]);
+    return unique_fd{s[0]};
+}
+
+// Shell service string can look like:
+//   shell[,arg1,arg2,...]:[command]
+unique_fd ShellService(const std::string& args, const atransport* transport) {
+    size_t delimiter_index = args.find(':');
+    if (delimiter_index == std::string::npos) {
+        LOG(ERROR) << "No ':' found in shell service arguments: " << args;
+        return unique_fd{};
+    }
+
+    const std::string service_args = args.substr(0, delimiter_index);
+    const std::string command = args.substr(delimiter_index + 1);
+
+    // Defaults:
+    //   PTY for interactive, raw for non-interactive.
+    //   No protocol.
+    //   $TERM set to "dumb".
+    SubprocessType type(command.empty() ? SubprocessType::kPty : SubprocessType::kRaw);
+    SubprocessProtocol protocol = SubprocessProtocol::kNone;
+    std::string terminal_type = "dumb";
+
+    for (const std::string& arg : android::base::Split(service_args, ",")) {
+        if (arg == kShellServiceArgRaw) {
+            type = SubprocessType::kRaw;
+        } else if (arg == kShellServiceArgPty) {
+            type = SubprocessType::kPty;
+        } else if (arg == kShellServiceArgShellProtocol) {
+            protocol = SubprocessProtocol::kShell;
+        } else if (android::base::StartsWith(arg, "TERM=")) {
+            terminal_type = arg.substr(5);
+        } else if (!arg.empty()) {
+            // This is not an error to allow for future expansion.
+            LOG(WARNING) << "Ignoring unknown shell service argument: " << arg;
+        }
+    }
+
+    return StartSubprocess(command.c_str(), terminal_type.c_str(), type, protocol);
+}
+
+unique_fd daemon_service_to_fd(const char* name, atransport* transport) {
+    if (!strncmp("dev:", name, 4)) {
+        return unique_fd{unix_open(name + 4, O_RDWR | O_CLOEXEC)};
+    } else if (!strncmp(name, "framebuffer:", 12)) {
+        return create_service_thread("fb", framebuffer_service);
+    } else if (!strncmp(name, "jdwp:", 5)) {
+        return create_jdwp_connection_fd(atoi(name + 5));
+    } else if (!strncmp(name, "shell", 5)) {
+        return ShellService(name + 5, transport);
+    } else if (!strncmp(name, "exec:", 5)) {
+        return StartSubprocess(name + 5, nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
+    } else if (!strncmp(name, "sync:", 5)) {
+        return create_service_thread("sync", file_sync_service);
+    } else if (!strncmp(name, "remount:", 8)) {
+        std::string options(name + strlen("remount:"));
+        return create_service_thread("remount",
+                                     std::bind(remount_service, std::placeholders::_1, options));
+    } else if (!strncmp(name, "reboot:", 7)) {
+        std::string arg(name + strlen("reboot:"));
+        return create_service_thread("reboot",
+                                     std::bind(reboot_service, std::placeholders::_1, arg));
+    } else if (!strncmp(name, "root:", 5)) {
+        return create_service_thread("root", restart_root_service);
+    } else if (!strncmp(name, "unroot:", 7)) {
+        return create_service_thread("unroot", restart_unroot_service);
+    } else if (!strncmp(name, "backup:", 7)) {
+        return StartSubprocess(
+                android::base::StringPrintf("/system/bin/bu backup %s", (name + 7)).c_str(),
+                nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
+    } else if (!strncmp(name, "restore:", 8)) {
+        return StartSubprocess("/system/bin/bu restore", nullptr, SubprocessType::kRaw,
+                               SubprocessProtocol::kNone);
+    } else if (!strncmp(name, "tcpip:", 6)) {
+        int port;
+        if (sscanf(name + 6, "%d", &port) != 1) {
+            return unique_fd{};
+        }
+        return create_service_thread("tcp",
+                                     std::bind(restart_tcp_service, std::placeholders::_1, port));
+    } else if (!strncmp(name, "usb:", 4)) {
+        return create_service_thread("usb", restart_usb_service);
+    } else if (!strncmp(name, "reverse:", 8)) {
+        return reverse_service(name + 8, transport);
+    } else if (!strncmp(name, "disable-verity:", 15)) {
+        return create_service_thread("verity-on", std::bind(set_verity_enabled_state_service,
+                                                            std::placeholders::_1, false));
+    } else if (!strncmp(name, "enable-verity:", 15)) {
+        return create_service_thread("verity-off", std::bind(set_verity_enabled_state_service,
+                                                             std::placeholders::_1, true));
+    } else if (!strcmp(name, "reconnect")) {
+        return create_service_thread(
+                "reconnect", std::bind(reconnect_service, std::placeholders::_1, transport));
+    }
+    return unique_fd{};
+}
diff --git a/adb/daemon/set_verity_enable_state_service.cpp b/adb/daemon/set_verity_enable_state_service.cpp
index 8c98c2d..2b6ec21 100644
--- a/adb/daemon/set_verity_enable_state_service.cpp
+++ b/adb/daemon/set_verity_enable_state_service.cpp
@@ -66,7 +66,7 @@
     fec_verity_metadata metadata;
 
     if (!fh.get_verity_metadata(metadata)) {
-        WriteFdFmt(fd, "Couldn't find verity metadata!\n");
+        WriteFdExactly(fd, "Couldn't find verity metadata!\n");
         return false;
     }
 
@@ -109,12 +109,12 @@
     bool verity_enabled;
 
     if (is_avb_device_locked()) {
-        WriteFdFmt(fd, "Device is locked. Please unlock the device first\n");
+        WriteFdExactly(fd, "Device is locked. Please unlock the device first\n");
         return false;
     }
 
     if (!avb_user_verity_get(ops, ab_suffix.c_str(), &verity_enabled)) {
-        WriteFdFmt(fd, "Error getting verity state. Try adb root first?\n");
+        WriteFdExactly(fd, "Error getting verity state. Try adb root first?\n");
         return false;
     }
 
@@ -124,7 +124,7 @@
     }
 
     if (!avb_user_verity_set(ops, ab_suffix.c_str(), enable_verity)) {
-        WriteFdFmt(fd, "Error setting verity\n");
+        WriteFdExactly(fd, "Error setting verity\n");
         return false;
     }
 
@@ -150,7 +150,7 @@
         }
 
         if (!android::base::GetBoolProperty("ro.secure", false)) {
-            WriteFdFmt(fd.get(), "verity not enabled - ENG build\n");
+            WriteFdExactly(fd.get(), "verity not enabled - ENG build\n");
             return;
         }
     }
@@ -158,7 +158,7 @@
     // Should never be possible to disable dm-verity on a USER build
     // regardless of using AVB or VB1.0.
     if (!__android_log_is_debuggable()) {
-        WriteFdFmt(fd.get(), "verity cannot be disabled/enabled - USER build\n");
+        WriteFdExactly(fd.get(), "verity cannot be disabled/enabled - USER build\n");
         return;
     }
 
@@ -166,7 +166,7 @@
         // Yep, the system is using AVB.
         AvbOps* ops = avb_ops_user_new();
         if (ops == nullptr) {
-            WriteFdFmt(fd.get(), "Error getting AVB ops\n");
+            WriteFdExactly(fd.get(), "Error getting AVB ops\n");
             return;
         }
         if (set_avb_verity_enabled_state(fd.get(), ops, enable)) {
@@ -179,7 +179,7 @@
         // read all fstab entries at once from all sources
         fstab = fs_mgr_read_fstab_default();
         if (!fstab) {
-            WriteFdFmt(fd.get(), "Failed to read fstab\nMaybe run adb root?\n");
+            WriteFdExactly(fd.get(), "Failed to read fstab\nMaybe run adb root?\n");
             return;
         }
 
@@ -195,6 +195,6 @@
     }
 
     if (any_changed) {
-        WriteFdFmt(fd.get(), "Now reboot your device for settings to take effect\n");
+        WriteFdExactly(fd.get(), "Now reboot your device for settings to take effect\n");
     }
 }
diff --git a/adb/daemon/shell_service.cpp b/adb/daemon/shell_service.cpp
index b042e5f..01097ac 100644
--- a/adb/daemon/shell_service.cpp
+++ b/adb/daemon/shell_service.cpp
@@ -716,38 +716,37 @@
 }  // namespace
 
 // Create a pipe containing the error.
-static int ReportError(SubprocessProtocol protocol, const std::string& message) {
-    int pipefd[2];
-    if (pipe(pipefd) != 0) {
-        LOG(ERROR) << "failed to create pipe to report error";
-        return -1;
+static unique_fd ReportError(SubprocessProtocol protocol, const std::string& message) {
+    unique_fd read, write;
+    if (!Pipe(&read, &write)) {
+        PLOG(ERROR) << "failed to create pipe to report error";
+        return unique_fd{};
     }
 
     std::string buf = android::base::StringPrintf("error: %s\n", message.c_str());
     if (protocol == SubprocessProtocol::kShell) {
         ShellProtocol::Id id = ShellProtocol::kIdStderr;
         uint32_t length = buf.length();
-        WriteFdExactly(pipefd[1], &id, sizeof(id));
-        WriteFdExactly(pipefd[1], &length, sizeof(length));
+        WriteFdExactly(write.get(), &id, sizeof(id));
+        WriteFdExactly(write.get(), &length, sizeof(length));
     }
 
-    WriteFdExactly(pipefd[1], buf.data(), buf.length());
+    WriteFdExactly(write.get(), buf.data(), buf.length());
 
     if (protocol == SubprocessProtocol::kShell) {
         ShellProtocol::Id id = ShellProtocol::kIdExit;
         uint32_t length = 1;
         char exit_code = 126;
-        WriteFdExactly(pipefd[1], &id, sizeof(id));
-        WriteFdExactly(pipefd[1], &length, sizeof(length));
-        WriteFdExactly(pipefd[1], &exit_code, sizeof(exit_code));
+        WriteFdExactly(write.get(), &id, sizeof(id));
+        WriteFdExactly(write.get(), &length, sizeof(length));
+        WriteFdExactly(write.get(), &exit_code, sizeof(exit_code));
     }
 
-    adb_close(pipefd[1]);
-    return pipefd[0];
+    return read;
 }
 
-int StartSubprocess(const char* name, const char* terminal_type,
-                    SubprocessType type, SubprocessProtocol protocol) {
+unique_fd StartSubprocess(const char* name, const char* terminal_type, SubprocessType type,
+                          SubprocessProtocol protocol) {
     D("starting %s subprocess (protocol=%s, TERM=%s): '%s'",
       type == SubprocessType::kRaw ? "raw" : "PTY",
       protocol == SubprocessProtocol::kNone ? "none" : "shell",
@@ -774,5 +773,5 @@
         return ReportError(protocol, error);
     }
 
-    return local_socket.release();
+    return local_socket;
 }
diff --git a/adb/daemon/shell_service.h b/adb/daemon/shell_service.h
index 3ffffa7..2a48923 100644
--- a/adb/daemon/shell_service.h
+++ b/adb/daemon/shell_service.h
@@ -16,6 +16,8 @@
 
 #pragma once
 
+#include "adb_unique_fd.h"
+
 enum class SubprocessType {
     kPty,
     kRaw,
@@ -30,5 +32,5 @@
 // shell is started, otherwise |name| is executed non-interactively.
 //
 // Returns an open FD connected to the subprocess or -1 on failure.
-int StartSubprocess(const char* name, const char* terminal_type, SubprocessType type,
-                    SubprocessProtocol protocol);
+unique_fd StartSubprocess(const char* name, const char* terminal_type, SubprocessType type,
+                          SubprocessProtocol protocol);
diff --git a/adb/daemon/shell_service_test.cpp b/adb/daemon/shell_service_test.cpp
index d073537..323bcec 100644
--- a/adb/daemon/shell_service_test.cpp
+++ b/adb/daemon/shell_service_test.cpp
@@ -55,7 +55,7 @@
 
     static sighandler_t saved_sigpipe_handler_;
 
-    int subprocess_fd_ = -1;
+    unique_fd subprocess_fd_;
 };
 
 sighandler_t ShellServiceTest::saved_sigpipe_handler_ = nullptr;
@@ -67,10 +67,6 @@
 }
 
 void ShellServiceTest::CleanupTestSubprocess() {
-    if (subprocess_fd_ >= 0) {
-        adb_close(subprocess_fd_);
-        subprocess_fd_ = -1;
-    }
 }
 
 namespace {
diff --git a/adb/services.cpp b/adb/services.cpp
index 639bb46..4b033bd 100644
--- a/adb/services.cpp
+++ b/adb/services.cpp
@@ -24,39 +24,15 @@
 #include <stdlib.h>
 #include <string.h>
 
-#ifndef _WIN32
-#include <netdb.h>
-#include <netinet/in.h>
-#include <sys/ioctl.h>
-#include <unistd.h>
-#endif
-
 #include <thread>
-
-#include <android-base/file.h>
-#include <android-base/parsenetaddress.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
 #include <cutils/sockets.h>
 
-#if !ADB_HOST
-#include <android-base/properties.h>
-#include <bootloader_message/bootloader_message.h>
-#include <cutils/android_reboot.h>
-#include <log/log_properties.h>
-#endif
-
 #include "adb.h"
 #include "adb_io.h"
 #include "adb_unique_fd.h"
 #include "adb_utils.h"
-#if !ADB_HOST
-#include "daemon/file_sync_service.h"
-#include "daemon/framebuffer_service.h"
-#include "daemon/remount_service.h"
-#include "daemon/set_verity_enable_state_service.h"
-#include "daemon/shell_service.h"
-#endif
 #include "services.h"
 #include "socket_spec.h"
 #include "sysdeps.h"
@@ -70,157 +46,7 @@
     func(std::move(fd));
 }
 
-#if !ADB_HOST
-
-void restart_root_service(unique_fd fd) {
-    if (getuid() == 0) {
-        WriteFdExactly(fd.get(), "adbd is already running as root\n");
-        return;
-    }
-    if (!__android_log_is_debuggable()) {
-        WriteFdExactly(fd.get(), "adbd cannot run as root in production builds\n");
-        return;
-    }
-
-    android::base::SetProperty("service.adb.root", "1");
-    WriteFdExactly(fd.get(), "restarting adbd as root\n");
-}
-
-void restart_unroot_service(unique_fd fd) {
-    if (getuid() != 0) {
-        WriteFdExactly(fd.get(), "adbd not running as root\n");
-        return;
-    }
-    android::base::SetProperty("service.adb.root", "0");
-    WriteFdExactly(fd.get(), "restarting adbd as non root\n");
-}
-
-void restart_tcp_service(unique_fd fd, int port) {
-    if (port <= 0) {
-        WriteFdFmt(fd.get(), "invalid port %d\n", port);
-        return;
-    }
-
-    android::base::SetProperty("service.adb.tcp.port", android::base::StringPrintf("%d", port));
-    WriteFdFmt(fd.get(), "restarting in TCP mode port: %d\n", port);
-}
-
-void restart_usb_service(unique_fd fd) {
-    android::base::SetProperty("service.adb.tcp.port", "0");
-    WriteFdExactly(fd.get(), "restarting in USB mode\n");
-}
-
-bool reboot_service_impl(unique_fd fd, const std::string& arg) {
-    std::string reboot_arg = arg;
-    bool auto_reboot = false;
-
-    if (reboot_arg == "sideload-auto-reboot") {
-        auto_reboot = true;
-        reboot_arg = "sideload";
-    }
-
-    // It reboots into sideload mode by setting "--sideload" or "--sideload_auto_reboot"
-    // in the command file.
-    if (reboot_arg == "sideload") {
-        if (getuid() != 0) {
-            WriteFdExactly(fd, "'adb root' is required for 'adb reboot sideload'.\n");
-            return false;
-        }
-
-        const std::vector<std::string> options = {
-            auto_reboot ? "--sideload_auto_reboot" : "--sideload"
-        };
-        std::string err;
-        if (!write_bootloader_message(options, &err)) {
-            D("Failed to set bootloader message: %s", err.c_str());
-            return false;
-        }
-
-        reboot_arg = "recovery";
-    }
-
-    sync();
-
-    if (reboot_arg.empty()) reboot_arg = "adb";
-    std::string reboot_string = android::base::StringPrintf("reboot,%s", reboot_arg.c_str());
-    if (!android::base::SetProperty(ANDROID_RB_PROPERTY, reboot_string)) {
-        WriteFdFmt(fd, "reboot (%s) failed\n", reboot_string.c_str());
-        return false;
-    }
-
-    return true;
-}
-
-void reboot_service(unique_fd fd, const std::string& arg) {
-    if (!reboot_service_impl(std::move(fd), arg)) {
-        return;
-    }
-    // Don't return early. Give the reboot command time to take effect
-    // to avoid messing up scripts which do "adb reboot && adb wait-for-device"
-    while (true) {
-        pause();
-    }
-}
-
-void reconnect_service(unique_fd fd, atransport* t) {
-    WriteFdExactly(fd, "done");
-    kick_transport(t);
-}
-
-int reverse_service(const char* command, atransport* transport) {
-    int s[2];
-    if (adb_socketpair(s)) {
-        PLOG(ERROR) << "cannot create service socket pair.";
-        return -1;
-    }
-    VLOG(SERVICES) << "service socketpair: " << s[0] << ", " << s[1];
-    if (handle_forward_request(command, transport, s[1]) < 0) {
-        SendFail(s[1], "not a reverse forwarding command");
-    }
-    adb_close(s[1]);
-    return s[0];
-}
-
-// Shell service string can look like:
-//   shell[,arg1,arg2,...]:[command]
-int ShellService(const std::string& args, const atransport* transport) {
-    size_t delimiter_index = args.find(':');
-    if (delimiter_index == std::string::npos) {
-        LOG(ERROR) << "No ':' found in shell service arguments: " << args;
-        return -1;
-    }
-
-    const std::string service_args = args.substr(0, delimiter_index);
-    const std::string command = args.substr(delimiter_index + 1);
-
-    // Defaults:
-    //   PTY for interactive, raw for non-interactive.
-    //   No protocol.
-    //   $TERM set to "dumb".
-    SubprocessType type(command.empty() ? SubprocessType::kPty
-                                        : SubprocessType::kRaw);
-    SubprocessProtocol protocol = SubprocessProtocol::kNone;
-    std::string terminal_type = "dumb";
-
-    for (const std::string& arg : android::base::Split(service_args, ",")) {
-        if (arg == kShellServiceArgRaw) {
-            type = SubprocessType::kRaw;
-        } else if (arg == kShellServiceArgPty) {
-            type = SubprocessType::kPty;
-        } else if (arg == kShellServiceArgShellProtocol) {
-            protocol = SubprocessProtocol::kShell;
-        } else if (android::base::StartsWith(arg, "TERM=")) {
-            terminal_type = arg.substr(5);
-        } else if (!arg.empty()) {
-            // This is not an error to allow for future expansion.
-            LOG(WARNING) << "Ignoring unknown shell service argument: " << arg;
-        }
-    }
-
-    return StartSubprocess(command.c_str(), terminal_type.c_str(), type, protocol);
-}
-
-#endif  // !ADB_HOST
+}  // namespace
 
 unique_fd create_service_thread(const char* service_name, std::function<void(unique_fd)> func) {
     int s[2];
@@ -245,8 +71,6 @@
     return unique_fd(s[0]);
 }
 
-}  // namespace
-
 int service_to_fd(const char* name, atransport* transport) {
     int ret = -1;
 
@@ -256,65 +80,12 @@
         if (ret < 0) {
             LOG(ERROR) << "failed to connect to socket '" << name << "': " << error;
         }
+    } else {
 #if !ADB_HOST
-    } else if(!strncmp("dev:", name, 4)) {
-        ret = unix_open(name + 4, O_RDWR | O_CLOEXEC);
-    } else if (!strncmp(name, "framebuffer:", 12)) {
-        ret = create_service_thread("fb", framebuffer_service).release();
-    } else if (!strncmp(name, "jdwp:", 5)) {
-        ret = create_jdwp_connection_fd(atoi(name + 5));
-    } else if (!strncmp(name, "shell", 5)) {
-        ret = ShellService(name + 5, transport);
-    } else if (!strncmp(name, "exec:", 5)) {
-        ret = StartSubprocess(name + 5, nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
-    } else if (!strncmp(name, "sync:", 5)) {
-        ret = create_service_thread("sync", file_sync_service).release();
-    } else if (!strncmp(name, "remount:", 8)) {
-        std::string options(name + strlen("remount:"));
-        ret = create_service_thread("remount",
-                                    std::bind(remount_service, std::placeholders::_1, options))
-                      .release();
-    } else if (!strncmp(name, "reboot:", 7)) {
-        std::string arg(name + strlen("reboot:"));
-        ret = create_service_thread("reboot", std::bind(reboot_service, std::placeholders::_1, arg))
-                      .release();
-    } else if (!strncmp(name, "root:", 5)) {
-        ret = create_service_thread("root", restart_root_service).release();
-    } else if (!strncmp(name, "unroot:", 7)) {
-        ret = create_service_thread("unroot", restart_unroot_service).release();
-    } else if (!strncmp(name, "backup:", 7)) {
-        ret = StartSubprocess(
-                android::base::StringPrintf("/system/bin/bu backup %s", (name + 7)).c_str(),
-                nullptr, SubprocessType::kRaw, SubprocessProtocol::kNone);
-    } else if (!strncmp(name, "restore:", 8)) {
-        ret = StartSubprocess("/system/bin/bu restore", nullptr, SubprocessType::kRaw,
-                              SubprocessProtocol::kNone);
-    } else if (!strncmp(name, "tcpip:", 6)) {
-        int port;
-        if (sscanf(name + 6, "%d", &port) != 1) {
-            return -1;
-        }
-        ret = create_service_thread("tcp",
-                                    std::bind(restart_tcp_service, std::placeholders::_1, port))
-                      .release();
-    } else if (!strncmp(name, "usb:", 4)) {
-        ret = create_service_thread("usb", restart_usb_service).release();
-    } else if (!strncmp(name, "reverse:", 8)) {
-        ret = reverse_service(name + 8, transport);
-    } else if (!strncmp(name, "disable-verity:", 15)) {
-        ret = create_service_thread("verity-on", std::bind(set_verity_enabled_state_service,
-                                                           std::placeholders::_1, false))
-                      .release();
-    } else if (!strncmp(name, "enable-verity:", 15)) {
-        ret = create_service_thread("verity-off", std::bind(set_verity_enabled_state_service,
-                                                            std::placeholders::_1, true))
-                      .release();
-    } else if (!strcmp(name, "reconnect")) {
-        ret = create_service_thread("reconnect",
-                                    std::bind(reconnect_service, std::placeholders::_1, transport))
-                      .release();
+        ret = daemon_service_to_fd(name, transport).release();
 #endif
     }
+
     if (ret >= 0) {
         close_on_exec(ret);
     }
diff --git a/adb/services.h b/adb/services.h
index 0428ca4..0ce25ba 100644
--- a/adb/services.h
+++ b/adb/services.h
@@ -17,8 +17,11 @@
 #ifndef SERVICES_H_
 #define SERVICES_H_
 
+#include "adb_unique_fd.h"
+
 constexpr char kShellServiceArgRaw[] = "raw";
 constexpr char kShellServiceArgPty[] = "pty";
 constexpr char kShellServiceArgShellProtocol[] = "v2";
 
+unique_fd create_service_thread(const char* service_name, std::function<void(unique_fd)> func);
 #endif  // SERVICES_H_
diff --git a/fs_mgr/Android.bp b/fs_mgr/Android.bp
index bf69096..196321c 100644
--- a/fs_mgr/Android.bp
+++ b/fs_mgr/Android.bp
@@ -56,20 +56,21 @@
         "liblog",
         "libsquashfs_utils",
         "libselinux",
+        "liblp",
     ],
     static_libs: [
         "libavb",
         "libfstab",
         "libdm",
-        "liblp",
     ],
     export_static_lib_headers: [
         "libfstab",
         "libdm",
+    ],
+    export_shared_lib_headers: [
         "liblp",
     ],
     whole_static_libs: [
-        "liblp",
         "liblogwrap",
         "libdm",
         "libfstab",
diff --git a/fs_mgr/fs_mgr_fstab.cpp b/fs_mgr/fs_mgr_fstab.cpp
index a5b3fe8..8b46d64 100644
--- a/fs_mgr/fs_mgr_fstab.cpp
+++ b/fs_mgr/fs_mgr_fstab.cpp
@@ -811,7 +811,7 @@
     std::string default_fstab;
 
     // Use different fstab paths for normal boot and recovery boot, respectively
-    if (access("/sbin/recovery", F_OK) == 0) {
+    if (access("/system/bin/recovery", F_OK) == 0) {
         default_fstab = "/etc/recovery.fstab";
     } else {  // normal boot
         default_fstab = get_fstab_path();
diff --git a/fs_mgr/liblp/Android.bp b/fs_mgr/liblp/Android.bp
index 1434b21..89282db 100644
--- a/fs_mgr/liblp/Android.bp
+++ b/fs_mgr/liblp/Android.bp
@@ -14,7 +14,7 @@
 // limitations under the License.
 //
 
-cc_library_static {
+cc_library {
     name: "liblp",
     host_supported: true,
     recovery_available: true,
@@ -29,17 +29,14 @@
         "utility.cpp",
         "writer.cpp",
     ],
-    static_libs: [
+    shared_libs: [
         "libbase",
         "liblog",
         "libcrypto",
         "libcrypto_utils",
         "libsparse",
-    ],
-    whole_static_libs: [
         "libext2_uuid",
         "libext4_utils",
-        "libsparse",
         "libz",
     ],
     export_include_dirs: ["include"],
@@ -51,12 +48,9 @@
     cppflags: [
         "-Wno-unused-parameter",
     ],
-    static_libs: [
-        "libbase",
-        "liblog",
-        "libcrypto",
-        "libcrypto_utils",
+    shared_libs: [
         "liblp",
+        "libbase",
         "libfs_mgr",
     ],
     srcs: [
diff --git a/healthd/healthd_mode_charger.cpp b/healthd/healthd_mode_charger.cpp
index 4f77e7a..f1fe5cd 100644
--- a/healthd/healthd_mode_charger.cpp
+++ b/healthd/healthd_mode_charger.cpp
@@ -307,6 +307,9 @@
 
     disp_time = batt_anim->frames[batt_anim->cur_frame].disp_time;
 
+    /* unblank the screen on first cycle and first frame */
+    if (batt_anim->cur_cycle == 0 && batt_anim->cur_frame == 0) healthd_draw->blank_screen(false);
+
     /* animation starting, set up the animation */
     if (batt_anim->cur_frame == 0) {
         LOGV("[%" PRId64 "] animation starting\n", now);
@@ -330,9 +333,6 @@
         }
     }
 
-    /* unblank the screen  on first cycle */
-    if (batt_anim->cur_cycle == 0) healthd_draw->blank_screen(false);
-
     /* draw the new frame (@ cur_frame) */
     healthd_draw->redraw_screen(charger->batt_anim, charger->surf_unknown);
 
@@ -632,7 +632,7 @@
 
     ret = res_create_display_surface(anim->fail_file.c_str(), &charger->surf_unknown);
     if (ret < 0) {
-        LOGE("Cannot load custom battery_fail image. Reverting to built in.\n");
+        LOGE("Cannot load custom battery_fail image. Reverting to built in: %d\n", ret);
         ret = res_create_display_surface("charger/battery_fail", &charger->surf_unknown);
         if (ret < 0) {
             LOGE("Cannot load built in battery_fail image\n");
diff --git a/init/Android.mk b/init/Android.mk
index a81a0f6..d0cb820 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -67,6 +67,7 @@
     libprotobuf-cpp-lite \
     libpropertyinfoserializer \
     libpropertyinfoparser \
+    liblp \
 
 shared_libs := \
     libcutils \
diff --git a/init/first_stage_mount.cpp b/init/first_stage_mount.cpp
index 8ded873..43075b2 100644
--- a/init/first_stage_mount.cpp
+++ b/init/first_stage_mount.cpp
@@ -116,7 +116,7 @@
 }
 
 static bool inline IsRecoveryMode() {
-    return access("/sbin/recovery", F_OK) == 0;
+    return access("/system/bin/recovery", F_OK) == 0;
 }
 
 static inline bool IsDmLinearEnabled() {
diff --git a/init/reboot.cpp b/init/reboot.cpp
index 6f6e39f..11507f4 100644
--- a/init/reboot.cpp
+++ b/init/reboot.cpp
@@ -443,6 +443,7 @@
     for (const auto& s : ServiceList::GetInstance().services_in_shutdown_order()) {
         if (!s->IsShutdownCritical()) s->Stop();
     }
+    SubcontextTerminate();
     ReapAnyOutstandingChildren();
 
     // 3. send volume shutdown to vold
diff --git a/init/subcontext.cpp b/init/subcontext.cpp
index 267d530..ee72513 100644
--- a/init/subcontext.cpp
+++ b/init/subcontext.cpp
@@ -352,6 +352,7 @@
 }
 
 static std::vector<Subcontext> subcontexts;
+static bool shutting_down;
 
 std::vector<Subcontext>* InitializeSubcontexts() {
     if (SelinuxHasVendorInit()) {
@@ -365,12 +366,21 @@
 bool SubcontextChildReap(pid_t pid) {
     for (auto& subcontext : subcontexts) {
         if (subcontext.pid() == pid) {
-            subcontext.Restart();
+            if (!shutting_down) {
+                subcontext.Restart();
+            }
             return true;
         }
     }
     return false;
 }
 
+void SubcontextTerminate() {
+    shutting_down = true;
+    for (auto& subcontext : subcontexts) {
+        kill(subcontext.pid(), SIGTERM);
+    }
+}
+
 }  // namespace init
 }  // namespace android
diff --git a/init/subcontext.h b/init/subcontext.h
index 22d7d43..628fd50 100644
--- a/init/subcontext.h
+++ b/init/subcontext.h
@@ -63,6 +63,7 @@
 int SubcontextMain(int argc, char** argv, const KeywordFunctionMap* function_map);
 std::vector<Subcontext>* InitializeSubcontexts();
 bool SubcontextChildReap(pid_t pid);
+void SubcontextTerminate();
 
 }  // namespace init
 }  // namespace android
diff --git a/libsync/include/ndk/sync.h b/libsync/include/ndk/sync.h
index ba7d8c4..2a59e35 100644
--- a/libsync/include/ndk/sync.h
+++ b/libsync/include/ndk/sync.h
@@ -63,6 +63,8 @@
  *
  * The original fences remain valid, and the caller is responsible for closing
  * them.
+ *
+ * Available since API level 26.
  */
 int32_t sync_merge(const char* name, int32_t fd1, int32_t fd2) __INTRODUCED_IN(26);
 
@@ -70,6 +72,8 @@
  * Retrieve detailed information about a sync file and its fences.
  *
  * The returned sync_file_info must be freed by calling sync_file_info_free().
+ *
+ * Available since API level 26.
  */
 struct sync_file_info* sync_file_info(int32_t fd) __INTRODUCED_IN(26);
 
@@ -78,6 +82,8 @@
  *
  * The returned array is owned by the parent sync file info, and has
  * info->num_fences entries.
+ *
+ * Available since API level 26.
  */
 static inline struct sync_fence_info* sync_get_fence_info(const struct sync_file_info* info) {
 // This header should compile in C, but some C++ projects enable
@@ -88,7 +94,11 @@
 #pragma GCC diagnostic pop
 }
 
-/** Free a struct sync_file_info structure */
+/**
+ * Free a struct sync_file_info structure
+ *
+ * Available since API level 26.
+ */
 void sync_file_info_free(struct sync_file_info* info) __INTRODUCED_IN(26);
 
 #endif /* __ANDROID_API__ >= 26 */
diff --git a/shell_and_utilities/Android.bp b/shell_and_utilities/Android.bp
index 7834dd5..0586381 100644
--- a/shell_and_utilities/Android.bp
+++ b/shell_and_utilities/Android.bp
@@ -18,6 +18,7 @@
         "newfs_msdos",
         "reboot",
         "sh",
+        "tcpdump",
         "toolbox",
         "toybox",
     ],