diff --git a/core/Makefile b/core/Makefile
index 706b371..aba4680 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -12,9 +12,11 @@
 # The filter part means "only eval the copy-one-file rule if this
 # src:dest pair is the first one to match the same dest"
 #$(1): the src:dest pair
+#$(2): the dest
 define check-product-copy-files
-$(if $(filter %.apk, $(call word-colon, 2, $(1))),$(error \
-    Prebuilt apk found in PRODUCT_COPY_FILES: $(1), use BUILD_PREBUILT instead!))
+$(if $(filter-out $(TARGET_COPY_OUT_SYSTEM_OTHER)/%,$(2)), \
+  $(if $(filter %.apk, $(2)),$(error \
+     Prebuilt apk found in PRODUCT_COPY_FILES: $(1), use BUILD_PREBUILT instead!)))
 endef
 # filter out the duplicate <source file>:<dest file> pairs.
 unique_product_copy_files_pairs :=
@@ -26,7 +28,7 @@
 $(foreach cf,$(unique_product_copy_files_pairs), \
     $(eval _src := $(call word-colon,1,$(cf))) \
     $(eval _dest := $(call word-colon,2,$(cf))) \
-    $(call check-product-copy-files,$(cf)) \
+    $(call check-product-copy-files,$(cf),$(_dest)) \
     $(if $(filter $(unique_product_copy_files_destinations),$(_dest)), \
         $(eval product_copy_files_ignored += $(cf)), \
         $(eval _fulldest := $(call append-path,$(PRODUCT_OUT),$(_dest))) \
@@ -2404,14 +2406,14 @@
   external/avb/test/data/atx_metadata.bin \
   external/avb/test/data/testkey_atx_psk.pem \
   external/avb/test/data/testkey_rsa4096.pem \
-  $(sort $(shell find system/update_engine/scripts -name \*.pyc -prune -o -type f -print)) \
-  $(sort $(shell find build/target/product/security -type f -name \*.x509.pem -o -name \*.pk8 -o \
+  $(sort $(shell find system/update_engine/scripts -name "*.pyc" -prune -o -type f -print)) \
+  $(sort $(shell find build/target/product/security -type f -name "*.x509.pem" -o -name "*.pk8" -o \
       -name verity_key)) \
-  $(sort $(shell find device $(wildcard vendor) -type f -name \*.pk8 -o -name verifiedboot\* -o \
-      -name \*.x509.pem -o -name oem\*.prop))
+  $(sort $(shell find device $(wildcard vendor) -type f -name "*.pk8" -o -name "verifiedboot*" -o \
+      -name "*.x509.pem" -o -name "oem*.prop"))
 
 OTATOOLS_RELEASETOOLS := \
-  $(sort $(shell find build/make/tools/releasetools -name \*.pyc -prune -o -type f))
+  $(sort $(shell find build/make/tools/releasetools -name "*.pyc" -prune -o -type f))
 
 ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
 OTATOOLS_DEPS += \
diff --git a/core/dex_preopt_libart.mk b/core/dex_preopt_libart.mk
index d8ab416..10522ac 100644
--- a/core/dex_preopt_libart.mk
+++ b/core/dex_preopt_libart.mk
@@ -118,7 +118,6 @@
 	@mkdir -p $(dir $@)
 	ANDROID_LOG_TAGS="*:e" $(PROFMAN) \
 		--create-profile-from=$(PRIVATE_PROFILE_INPUT_LOCATION) \
-		--skip-apk-verification \
 		$(addprefix --apk=,$(LIBART_TARGET_BOOT_DEX_FILES)) \
 		$(addprefix --dex-location=,$(LIBART_TARGET_BOOT_DEX_LOCATIONS)) \
 		--reference-profile-file=$@
diff --git a/core/dex_preopt_odex_install.mk b/core/dex_preopt_odex_install.mk
index c257f93..089df6f 100644
--- a/core/dex_preopt_odex_install.mk
+++ b/core/dex_preopt_odex_install.mk
@@ -91,23 +91,32 @@
 built_installed_odex :=
 built_installed_vdex :=
 built_installed_art :=
+my_process_profile :=
+my_profile_is_text_listing :=
 
 ifeq (false,$(WITH_DEX_PREOPT_GENERATE_PROFILE))
 LOCAL_DEX_PREOPT_GENERATE_PROFILE := false
 endif
 
 ifndef LOCAL_DEX_PREOPT_GENERATE_PROFILE
+
+
 # If LOCAL_DEX_PREOPT_GENERATE_PROFILE is not defined, default it based on the existence of the
 # profile class listing. TODO: Use product specific directory here.
 my_classes_directory := $(PRODUCT_DEX_PREOPT_PROFILE_DIR)
-LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING := $(my_classes_directory)/$(LOCAL_MODULE).prof.txt
-ifneq (,$(wildcard $(LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING)))
-# Profile listing exists, use it to generate the profile.
-LOCAL_DEX_PREOPT_GENERATE_PROFILE := true
+LOCAL_DEX_PREOPT_PROFILE := $(my_classes_directory)/$(LOCAL_MODULE).prof
+
+ifneq (,$(wildcard $(LOCAL_DEX_PREOPT_PROFILE)))
+my_process_profile := true
+my_profile_is_text_listing := false
 endif
+else
+my_process_profile := $(LOCAL_DEX_PREOPT_GENERATE_PROFILE)
+my_profile_is_text_listing := true
+LOCAL_DEX_PREOPT_PROFILE := $(LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING)
 endif
 
-ifeq (true,$(LOCAL_DEX_PREOPT_GENERATE_PROFILE))
+ifeq (true,$(my_process_profile))
 
 ifdef LOCAL_VENDOR_MODULE
 $(call pretty-error, Internal error: profiles are not supported for vendor modules)
@@ -117,8 +126,8 @@
 endif
 endif
 
-ifndef LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING
-$(call pretty-error,Must have specified class listing (LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING))
+ifndef LOCAL_DEX_PREOPT_PROFILE
+$(call pretty-error,Must have specified class listing (LOCAL_DEX_PREOPT_PROFILE))
 endif
 ifeq (,$(dex_preopt_profile_src_file))
 $(call pretty-error, Internal error: dex_preopt_profile_src_file must be set)
@@ -129,18 +138,36 @@
 my_dex_location := $(patsubst %.gz,%,$(my_dex_location))
 $(my_built_profile): PRIVATE_BUILT_MODULE := $(dex_preopt_profile_src_file)
 $(my_built_profile): PRIVATE_DEX_LOCATION := $(my_dex_location)
-$(my_built_profile): PRIVATE_SOURCE_CLASSES := $(LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING)
-$(my_built_profile): $(LOCAL_DEX_PREOPT_PROFILE_CLASS_LISTING)
+$(my_built_profile): PRIVATE_SOURCE_CLASSES := $(LOCAL_DEX_PREOPT_PROFILE)
+$(my_built_profile): $(LOCAL_DEX_PREOPT_PROFILE)
 $(my_built_profile): $(PROFMAN)
 $(my_built_profile): $(dex_preopt_profile_src_file)
-$(my_built_profile):
+ifeq (true,$(my_profile_is_text_listing))
+# The profile is a test listing of classes (used for framework jars).
+# We need to generate the actual binary profile before being able to compile.
 	$(hide) mkdir -p $(dir $@)
 	ANDROID_LOG_TAGS="*:e" $(PROFMAN) \
 		--create-profile-from=$(PRIVATE_SOURCE_CLASSES) \
 		--apk=$(PRIVATE_BUILT_MODULE) \
 		--dex-location=$(PRIVATE_DEX_LOCATION) \
 		--reference-profile-file=$@
-dex_preopt_profile_src_file:=
+else
+# The profile is binary profile (used for apps). Run it through profman to
+# ensure the profile keys match the apk.
+$(my_built_profile):
+	$(hide) mkdir -p $(dir $@)
+	touch $@
+	ANDROID_LOG_TAGS="*:i" $(PROFMAN) \
+	  --copy-and-update-profile-key \
+		--profile-file=$(PRIVATE_SOURCE_CLASSES) \
+		--apk=$(PRIVATE_BUILT_MODULE) \
+		--dex-location=$(PRIVATE_DEX_LOCATION) \
+		--reference-profile-file=$@ \
+	|| echo "Profile out of date for $(PRIVATE_BUILT_MODULE)"
+endif
+
+my_profile_is_text_listing :=
+dex_preopt_profile_src_file :=
 
 # Remove compressed APK extension.
 my_installed_profile := $(patsubst %.gz,%,$(LOCAL_INSTALLED_MODULE)).prof
@@ -209,7 +236,7 @@
 installed_art := $(strip $(installed_art))
 
 ifdef built_odex
-ifeq (true,$(LOCAL_DEX_PREOPT_GENERATE_PROFILE))
+ifeq (true,$(my_process_profile))
 $(built_odex): $(my_built_profile)
 $(built_odex): PRIVATE_PROFILE_PREOPT_FLAGS := --profile-file=$(my_built_profile)
 else
@@ -244,7 +271,7 @@
       # 'speed' compiler filter.
       LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=speed
     else
-      ifeq (true,$(LOCAL_DEX_PREOPT_GENERATE_PROFILE))
+      ifeq (true,$(my_process_profile))
         # For non system server jars, use speed-profile when we have a profile.
         LOCAL_DEX_PREOPT_FLAGS += --compiler-filter=speed-profile
       else
@@ -364,4 +391,6 @@
 ALL_MODULES.$(my_register_name).INSTALLED += $(my_installed_profile)
 ALL_MODULES.$(my_register_name).BUILT_INSTALLED += $(build_installed_profile)
 
+my_process_profile :=
+
 $(my_all_targets): $(my_installed_profile)
diff --git a/core/java_common.mk b/core/java_common.mk
index 0de8e92..2695aff 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -225,12 +225,27 @@
 
 $(LOCAL_INTERMEDIATE_TARGETS): PRIVATE_RMTYPEDEFS := $(LOCAL_RMTYPEDEFS)
 
+# Sanity check class path vars.
+disallowed_deps := $(foreach sdk,$(TARGET_AVAILABLE_SDK_VERSIONS),$(call resolve-prebuilt-sdk-module,$(sdk)))
+disallowed_deps += $(foreach sdk,$(TARGET_AVAILABLE_SDK_VERSIONS),\
+  $(foreach sdk_lib,$(JAVA_SDK_LIBRARIES),$(call resolve-prebuilt-sdk-module,$(sdk),$(sdk_lib))))
+bad_deps := $(filter $(disallowed_deps),$(LOCAL_JAVA_LIBRARIES) $(LOCAL_STATIC_JAVA_LIBRARIES))
+ifneq (,$(bad_deps))
+  $(call pretty-error,SDK modules should not be depended on directly. Please use LOCAL_SDK_VERSION for $(bad_deps))
+endif
+
 full_java_bootclasspath_libs :=
 empty_bootclasspath :=
 my_system_modules :=
 
 ifndef LOCAL_IS_HOST_MODULE
   sdk_libs :=
+
+  # When an sdk lib name is listed in LOCAL_JAVA_LIBRARIES, move it to LOCAL_SDK_LIBRARIES, so that
+  # it is correctly redirected to the stubs library.
+  LOCAL_SDK_LIBRARIES += $(filter $(JAVA_SDK_LIBRARIES),$(LOCAL_JAVA_LIBRARIES))
+  LOCAL_JAVA_LIBRARIES := $(filter-out $(JAVA_SDK_LIBRARIES),$(LOCAL_JAVA_LIBRARIES))
+
   ifeq ($(LOCAL_SDK_VERSION),)
     ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
       # No bootclasspath. But we still need "" to prevent javac from using default host bootclasspath.
@@ -244,6 +259,9 @@
       LOCAL_JAVA_LIBRARIES := $(filter-out $(TARGET_DEFAULT_BOOTCLASSPATH_LIBRARIES) $(TARGET_DEFAULT_JAVA_LIBRARIES),$(LOCAL_JAVA_LIBRARIES))
       my_system_modules := $(DEFAULT_SYSTEM_MODULES)
     endif  # LOCAL_NO_STANDARD_LIBRARIES
+    # When SDK libraries are referenced from modules built without SDK, provide the system stub to them
+    # because it has the largest API surface.
+    sdk_libs := $(foreach lib_name,$(LOCAL_SDK_LIBRARIES),$(lib_name).stubs.system)
   else
     ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
       $(call pretty-error,Must not define both LOCAL_NO_STANDARD_LIBRARIES and LOCAL_SDK_VERSION)
@@ -252,22 +270,30 @@
       $(call pretty-error,Invalid LOCAL_SDK_VERSION '$(LOCAL_SDK_VERSION)' \
              Choices are: $(TARGET_AVAILABLE_SDK_VERSIONS))
     endif
-    ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),current)
-      # LOCAL_SDK_VERSION is current and no TARGET_BUILD_APPS.
-      full_java_bootclasspath_libs := $(call java-lib-header-files,android_stubs_current)
-    else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),system_current)
-      full_java_bootclasspath_libs := $(call java-lib-header-files,android_system_stubs_current)
-    else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),test_current)
-      full_java_bootclasspath_libs := $(call java-lib-header-files,android_test_stubs_current)
-    else ifeq ($(LOCAL_SDK_VERSION)$(TARGET_BUILD_APPS),core_current)
-      full_java_bootclasspath_libs := $(call java-lib-header-files,core.current.stubs)
-    else
-      # TARGET_BUILD_APPS or numbered SDK. Use the modules defined in prebuilts/sdk/Android.mk.
-      _module_name := $(call resolve-prebuilt-sdk-module,$(LOCAL_SDK_VERSION))
-      full_java_bootclasspath_libs := $(call java-lib-header-files,$(_module_name))
+
+    ifneq (,$(TARGET_BUILD_APPS)$(filter-out %current,$(LOCAL_SDK_VERSION)))
+      # TARGET_BUILD_APPS mode or numbered SDK. Use prebuilt modules.
+      sdk_module := $(call resolve-prebuilt-sdk-module,$(LOCAL_SDK_VERSION))
       sdk_libs := $(foreach lib_name,$(LOCAL_SDK_LIBRARIES),$(call resolve-prebuilt-sdk-module,$(LOCAL_SDK_VERSION),$(lib_name)))
-      _module_name :=
-    endif # current, system_current, system_${VER}, test_current or core_current
+    else
+      # Note: the lib naming scheme must be kept in sync with build/soong/java/sdk_library.go.
+      sdk_lib_suffix = $(call pretty-error,sdk_lib_suffix was not set correctly)
+      ifeq (current,$(LOCAL_SDK_VERSION))
+        sdk_module := android_stubs_current
+        sdk_lib_suffix := .stubs
+      else ifeq (system_current,$(LOCAL_SDK_VERSION))
+        sdk_module := android_system_stubs_current
+        sdk_lib_suffix := .stubs.system
+      else ifeq (test_current,$(LOCAL_SDK_VERSION))
+        sdk_module := android_test_stubs_current
+        sdk_lib_suffix := .stubs.test
+      else ifeq (core_current,$(LOCAL_SDK_VERSION))
+        sdk_module := core.current.stubs
+        sdk_lib_suffix = $(call pretty-error,LOCAL_SDK_LIBRARIES not supported for LOCAL_SDK_VERSION = core_current)
+      endif
+      sdk_libs := $(foreach lib_name,$(LOCAL_SDK_LIBRARIES),$(lib_name)$(sdk_lib_suffix))
+    endif
+    full_java_bootclasspath_libs := $(call java-lib-header-files,$(sdk_module))
   endif # LOCAL_SDK_VERSION
 
   ifneq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
diff --git a/core/product.mk b/core/product.mk
index 1a15c9f..976c939 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -23,21 +23,12 @@
 # and the .mk suffix) of the product makefile, "<product_name>:" can be
 # omitted.
 
-# Search for AndroidProducts.mks in the given dir.
-# $(1): the path to the dir
-define _search-android-products-files-in-dir
-$(sort $(shell test -d $(1) && find -L $(1) \
-  -maxdepth 6 \
-  -name .git -prune \
-  -o -name AndroidProducts.mk -print))
-endef
-
 #
 # Returns the list of all AndroidProducts.mk files.
 # $(call ) isn't necessary.
 #
 define _find-android-products-files
-$(foreach d, device vendor product,$(call _search-android-products-files-in-dir,$(d))) \
+$(file <$(OUT_DIR)/.module_paths/AndroidProducts.mk.list) \
   $(SRC_TARGET_DIR)/product/AndroidProducts.mk
 endef
 
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
index 96ff376..3773c07 100644
--- a/core/soong_java_prebuilt.mk
+++ b/core/soong_java_prebuilt.mk
@@ -40,21 +40,26 @@
     $(intermediates.COMMON)/jacoco-report-classes.jar)
 endif
 
-ifdef LOCAL_SOONG_EXPORT_PROGUARD_FLAGS
-  $(eval $(call copy-one-file,$(LOCAL_SOONG_EXPORT_PROGUARD_FLAGS),\
-    $(intermediates.COMMON)/export_proguard_flags))
-  $(call add-dependency,$(LOCAL_BUILT_MODULE),\
-    $(intermediates.COMMON)/export_proguard_flags)
-endif
-
 ifdef LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE
-my_res_package := $(intermediates.COMMON)/package-res.apk
+  my_res_package := $(intermediates.COMMON)/package-res.apk
 
-$(my_res_package): $(LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE)
+  $(my_res_package): $(LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE)
 	@echo "Copy: $@"
 	$(copy-file-to-target)
 
-$(call add-dependency,$(LOCAL_BUILT_MODULE),$(my_res_package))
+  $(call add-dependency,$(LOCAL_BUILT_MODULE),$(my_res_package))
+
+  my_proguard_flags := $(intermediates.COMMON)/export_proguard_flags
+  $(my_proguard_flags): $(LOCAL_SOONG_EXPORT_PROGUARD_FLAGS)
+	@echo "Export proguard flags: $@"
+	rm -f $@
+	touch $@
+	for f in $+; do \
+		echo -e "\n# including $$f" >>$@; \
+		cat $$f >>$@; \
+	done
+
+  $(call add-dependency,$(LOCAL_BUILT_MODULE),$(my_proguard_flags))
 
 endif # LOCAL_SOONG_RESOURCE_EXPORT_PACKAGE