diff --git a/Android.mk b/Android.mk
index aef731f..9c20640 100644
--- a/Android.mk
+++ b/Android.mk
@@ -99,6 +99,7 @@
 include $(art_path)/dex2oat/Android.mk
 include $(art_path)/disassembler/Android.mk
 include $(art_path)/oatdump/Android.mk
+include $(art_path)/patchoat/Android.mk
 include $(art_path)/dalvikvm/Android.mk
 include $(art_path)/tools/Android.mk
 include $(art_path)/build/Android.oat.mk
@@ -364,13 +365,13 @@
 # "m art-host" for just building the files needed to run the art script
 .PHONY: art-host
 ifeq ($(HOST_PREFER_32_BIT),true)
-art-host:   $(HOST_OUT_EXECUTABLES)/art $(HOST_OUT)/bin/dalvikvm32 $(HOST_OUT)/lib/libart.so $(HOST_OUT)/bin/dex2oat $(HOST_CORE_IMG_OUT) $(HOST_OUT)/lib/libjavacore.so $(HOST_OUT)/bin/dalvikvm
+art-host:   $(HOST_OUT_EXECUTABLES)/art $(HOST_OUT)/bin/dalvikvm32 $(HOST_OUT)/lib/libart.so $(HOST_OUT)/bin/dex2oat $(HOST_OUT)/bin/patchoat $(HOST_CORE_IMG_OUT) $(HOST_OUT)/lib/libjavacore.so $(HOST_OUT)/bin/dalvikvm
 else
-art-host:   $(HOST_OUT_EXECUTABLES)/art $(HOST_OUT)/bin/dalvikvm64 $(HOST_OUT)/bin/dalvikvm32 $(HOST_OUT)/lib/libart.so $(HOST_OUT)/bin/dex2oat $(HOST_CORE_IMG_OUT) $(HOST_OUT)/lib/libjavacore.so $(HOST_OUT)/lib64/libjavacore.so $(HOST_OUT)/bin/dalvikvm
+art-host:   $(HOST_OUT_EXECUTABLES)/art $(HOST_OUT)/bin/dalvikvm64 $(HOST_OUT)/bin/dalvikvm32 $(HOST_OUT)/lib/libart.so $(HOST_OUT)/bin/dex2oat $(HOST_OUT)/bin/patchoat $(HOST_CORE_IMG_OUT) $(HOST_OUT)/lib/libjavacore.so $(HOST_OUT)/lib64/libjavacore.so $(HOST_OUT)/bin/dalvikvm
 endif
 
 .PHONY: art-host-debug
-art-host-debug:   art-host $(HOST_OUT)/lib/libartd.so $(HOST_OUT)/bin/dex2oatd
+art-host-debug:   art-host $(HOST_OUT)/lib/libartd.so $(HOST_OUT)/bin/dex2oatd $(HOST_OUT)/bin/patchoatd
 
 ########################################################################
 # targets to switch back and forth from libdvm to libart
diff --git a/build/Android.common_test.mk b/build/Android.common_test.mk
index 542e888..ed07129 100644
--- a/build/Android.common_test.mk
+++ b/build/Android.common_test.mk
@@ -87,7 +87,8 @@
 # $(2): input test directory in art/test, e.g. HelloWorld
 # $(3): target output module path (default module path is used on host)
 # $(4): additional dependencies
-# $(5): a make variable used to collate dependencies
+# $(5): a make variable used to collate target dependencies, e.g ART_TEST_TARGET_OAT_HelloWorld_DEX
+# $(6): a make variable used to collate host dependencies, e.g ART_TEST_HOST_OAT_HelloWorld_DEX
 define build-art-test-dex
   ifeq ($(ART_BUILD_TARGET),true)
     include $(CLEAR_VARS)
@@ -113,7 +114,7 @@
     LOCAL_JAVA_LIBRARIES := $(HOST_CORE_JARS)
     LOCAL_DEX_PREOPT_IMAGE := $(HOST_CORE_IMG_LOCATION)
     include $(BUILD_HOST_DALVIK_JAVA_LIBRARY)
-    $(5)-host := $$(LOCAL_INSTALLED_MODULE)
+    $(6) := $$(LOCAL_INSTALLED_MODULE)
   endif
 endef
 
diff --git a/build/Android.gtest.mk b/build/Android.gtest.mk
index e467656..183ec37 100644
--- a/build/Android.gtest.mk
+++ b/build/Android.gtest.mk
@@ -42,7 +42,8 @@
 
 # Create build rules for each dex file recording the dependency.
 $(foreach dir,$(GTEST_DEX_DIRECTORIES), $(eval $(call build-art-test-dex,art-gtest,$(dir), \
-  $(ART_TARGET_NATIVETEST_OUT),art/build/Android.gtest.mk,ART_GTEST_$(dir)_DEX)))
+  $(ART_TARGET_NATIVETEST_OUT),art/build/Android.gtest.mk,ART_TEST_TARGET_GTEST_$(dir)_DEX, \
+  ART_TEST_HOST_GTEST_$(dir)_DEX)))
 
 # Dex file dependencies for each gtest.
 ART_GTEST_class_linker_test_DEX_DEPS := Interfaces MyClass Nested Statics StaticsFromCode
@@ -196,7 +197,7 @@
   # to ensure files are pushed to the device.
   TEST_ART_TARGET_SYNC_DEPS += \
     $$(ART_GTEST_$(1)_TARGET_DEPS) \
-    $(foreach file,$(ART_GTEST_$(1)_DEX_DEPS),$(ART_GTEST_$(file)_DEX)) \
+    $(foreach file,$(ART_GTEST_$(1)_DEX_DEPS),$(ART_TEST_TARGET_GTEST_$(file)_DEX)) \
     $$(ART_TARGET_NATIVETEST_OUT)/$$(TARGET_$(2)ARCH)/$(1) \
     $$($(2)TARGET_OUT_SHARED_LIBRARIES)/libjavacore.so
 
@@ -232,7 +233,7 @@
 
 
 .PHONY: $$(gtest_rule)
-$$(gtest_rule): $$(gtest_exe) $$(ART_GTEST_$(1)_HOST_DEPS) $(foreach file,$(ART_GTEST_$(1)_DEX_DEPS),$(ART_GTEST_$(file)_DEX-host)) $$(gtest_deps)
+$$(gtest_rule): $$(gtest_exe) $$(ART_GTEST_$(1)_HOST_DEPS) $(foreach file,$(ART_GTEST_$(1)_DEX_DEPS),$(ART_TEST_HOST_GTEST_$(file)_DEX)) $$(gtest_deps)
 	$(hide) ($$(call ART_TEST_SKIP,$$@) && $$< && $$(call ART_TEST_PASSED,$$@)) \
 	  || $$(call ART_TEST_FAILED,$$@)
 
@@ -241,7 +242,7 @@
   ART_TEST_HOST_GTEST_$(1)_RULES += $$(gtest_rule)
 
 .PHONY: valgrind-$$(gtest_rule)
-valgrind-$$(gtest_rule): $$(gtest_exe) $$(ART_GTEST_$(1)_HOST_DEPS) $(foreach file,$(ART_GTEST_$(1)_DEX_DEPS),$(ART_GTEST_$(file)_DEX-host)) $$(gtest_deps)
+valgrind-$$(gtest_rule): $$(gtest_exe) $$(ART_GTEST_$(1)_HOST_DEPS) $(foreach file,$(ART_GTEST_$(1)_DEX_DEPS),$(ART_TEST_HOST_GTEST_$(file)_DEX)) $$(gtest_deps)
 	$(hide) $$(call ART_TEST_SKIP,$$@) && \
 	  valgrind --leak-check=full --error-exitcode=1 $$< && $$(call ART_TEST_PASSED,$$@) \
 	    || $$(call ART_TEST_FAILED,$$@)
@@ -459,6 +460,7 @@
 ART_GTEST_reflection_test_DEX_DEPS :=
 ART_GTEST_stub_test_DEX_DEPS :=
 ART_GTEST_transaction_test_DEX_DEPS :=
-$(foreach dir,$(GTEST_DEX_DIRECTORIES), $(eval ART_GTEST_TEST_$(dir)_DEX :=))
+$(foreach dir,$(GTEST_DEX_DIRECTORIES), $(eval ART_TEST_TARGET_GTEST_$(dir)_DEX :=))
+$(foreach dir,$(GTEST_DEX_DIRECTORIES), $(eval ART_TEST_HOST_GTEST_$(dir)_DEX :=))
 GTEST_DEX_DIRECTORIES :=
 LOCAL_PATH :=
diff --git a/build/Android.oat.mk b/build/Android.oat.mk
index 916fd58..d3c8d7e 100644
--- a/build/Android.oat.mk
+++ b/build/Android.oat.mk
@@ -35,7 +35,7 @@
 	  --oat-location=$$($(1)HOST_CORE_OAT) --image=$$($(1)HOST_CORE_IMG_OUT) \
 	  --base=$$(LIBART_IMG_HOST_BASE_ADDRESS) --instruction-set=$$($(1)ART_HOST_ARCH) \
 	  --instruction-set-features=$$($(1)HOST_INSTRUCTION_SET_FEATURES) \
-	  --host --android-root=$$(HOST_OUT)
+	  --host --android-root=$$(HOST_OUT) --include-patch-information
 
 # This "renaming" eases declaration in art/Android.mk
 HOST_CORE_IMG_OUT$($(1)ART_PHONY_TEST_HOST_SUFFIX) := $($(1)HOST_CORE_IMG_OUT)
@@ -64,7 +64,7 @@
 	  --base=$$(LIBART_IMG_TARGET_BASE_ADDRESS) --instruction-set=$$($(1)TARGET_ARCH) \
 	  --instruction-set-features=$$($(1)TARGET_INSTRUCTION_SET_FEATURES) \
 	  --implicit-checks=$(IMPLICIT_CHECKS_$($(1)TARGET_ARCH)) \
-	  --android-root=$$(PRODUCT_OUT)/system
+	  --android-root=$$(PRODUCT_OUT)/system --include-patch-information
 
 # This "renaming" eases declaration in art/Android.mk
 TARGET_CORE_IMG_OUT$($(1)ART_PHONY_TEST_TARGET_SUFFIX) := $($(1)TARGET_CORE_IMG_OUT)
diff --git a/compiler/common_compiler_test.h b/compiler/common_compiler_test.h
index 45cf2fb..e11f61a 100644
--- a/compiler/common_compiler_test.h
+++ b/compiler/common_compiler_test.h
@@ -293,16 +293,12 @@
       ASSERT_LE(instruction_set_features, runtime_features);
 #elif defined(__aarch64__)
       instruction_set = kArm64;
-      // TODO: arm64 compilation support.
-      compiler_options_->SetCompilerFilter(CompilerOptions::kInterpretOnly);
 #elif defined(__mips__)
       instruction_set = kMips;
 #elif defined(__i386__)
       instruction_set = kX86;
 #elif defined(__x86_64__)
       instruction_set = kX86_64;
-      // TODO: x86_64 compilation support.
-      compiler_options_->SetCompilerFilter(CompilerOptions::kInterpretOnly);
 #endif
 
       runtime_->SetInstructionSet(instruction_set);
diff --git a/compiler/dex/frontend.cc b/compiler/dex/frontend.cc
index 8021fa4..dc6043d 100644
--- a/compiler/dex/frontend.cc
+++ b/compiler/dex/frontend.cc
@@ -869,7 +869,8 @@
   } else if (cu.instruction_set == kArm64) {
     // TODO(Arm64): enable optimizations once backend is mature enough.
     cu.disable_opt = ~((1 << kSuppressMethodInlining) |
-                       (1 << kNullCheckElimination));
+                       (1 << kNullCheckElimination) |
+                       (1 << kPromoteRegs));
   }
 
   cu.StartTimingSplit("BuildMIRGraph");
diff --git a/compiler/dex/quick/arm64/codegen_arm64.h b/compiler/dex/quick/arm64/codegen_arm64.h
index 294b9ea..7d75da9 100644
--- a/compiler/dex/quick/arm64/codegen_arm64.h
+++ b/compiler/dex/quick/arm64/codegen_arm64.h
@@ -78,7 +78,8 @@
         OVERRIDE;
     LIR* LoadBaseIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest, int scale,
                          OpSize size) OVERRIDE;
-    LIR* LoadRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest) OVERRIDE;
+    LIR* LoadRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest, int scale)
+        OVERRIDE;
     LIR* LoadBaseIndexedDisp(RegStorage r_base, RegStorage r_index, int scale, int displacement,
                              RegStorage r_dest, OpSize size) OVERRIDE;
     LIR* LoadConstantNoClobber(RegStorage r_dest, int value);
@@ -89,7 +90,8 @@
                       VolatileKind is_volatile) OVERRIDE;
     LIR* StoreBaseIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src, int scale,
                           OpSize size) OVERRIDE;
-    LIR* StoreRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src) OVERRIDE;
+    LIR* StoreRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src, int scale)
+        OVERRIDE;
     LIR* StoreBaseIndexedDisp(RegStorage r_base, RegStorage r_index, int scale, int displacement,
                               RegStorage r_src, OpSize size) OVERRIDE;
     void MarkGCCard(RegStorage val_reg, RegStorage tgt_addr_reg) OVERRIDE;
diff --git a/compiler/dex/quick/arm64/int_arm64.cc b/compiler/dex/quick/arm64/int_arm64.cc
index 86dddae..e8f5cb9 100644
--- a/compiler/dex/quick/arm64/int_arm64.cc
+++ b/compiler/dex/quick/arm64/int_arm64.cc
@@ -823,7 +823,7 @@
       FreeTemp(reg_len);
     }
     if (rl_result.ref) {
-      LoadRefIndexed(reg_ptr, As64BitReg(rl_index.reg), rl_result.reg);
+      LoadRefIndexed(reg_ptr, As64BitReg(rl_index.reg), rl_result.reg, scale);
     } else {
       LoadBaseIndexed(reg_ptr, As64BitReg(rl_index.reg), rl_result.reg, scale, size);
     }
@@ -920,7 +920,7 @@
       FreeTemp(reg_len);
     }
     if (rl_src.ref) {
-      StoreRefIndexed(reg_ptr, As64BitReg(rl_index.reg), rl_src.reg);
+      StoreRefIndexed(reg_ptr, As64BitReg(rl_index.reg), rl_src.reg, scale);
     } else {
       StoreBaseIndexed(reg_ptr, As64BitReg(rl_index.reg), rl_src.reg, scale, size);
     }
diff --git a/compiler/dex/quick/arm64/target_arm64.cc b/compiler/dex/quick/arm64/target_arm64.cc
index 6985de6..ef9dbdd 100644
--- a/compiler/dex/quick/arm64/target_arm64.cc
+++ b/compiler/dex/quick/arm64/target_arm64.cc
@@ -1056,8 +1056,8 @@
   const int last_mapped_in = in_to_reg_storage_mapping.GetMaxMappedIn();
   int regs_left_to_pass_via_stack = info->num_arg_words - (last_mapped_in + 1);
 
-  // Fisrt of all, check whether it make sense to use bulk copying
-  // Optimization is aplicable only for range case
+  // First of all, check whether it makes sense to use bulk copying.
+  // Bulk copying is done only for the range case.
   // TODO: make a constant instead of 2
   if (info->is_range && regs_left_to_pass_via_stack >= 2) {
     // Scan the rest of the args - if in phys_reg flush to memory
@@ -1141,7 +1141,6 @@
               LoadValueDirectWideFixed(rl_arg, regWide);
               StoreBaseDisp(TargetReg(kSp), out_offset, regWide, k64, kNotVolatile);
             }
-            i++;
           } else {
             if (rl_arg.location == kLocPhysReg) {
               if (rl_arg.ref) {
@@ -1163,6 +1162,9 @@
         call_state = next_call_insn(cu_, info, call_state, target_method,
                                     vtable_idx, direct_code, direct_method, type);
       }
+      if (rl_arg.wide) {
+        i++;
+      }
     }
   }
 
@@ -1174,12 +1176,14 @@
     if (reg.Valid()) {
       if (rl_arg.wide) {
         LoadValueDirectWideFixed(rl_arg, reg);
-        i++;
       } else {
         LoadValueDirectFixed(rl_arg, reg);
       }
       call_state = next_call_insn(cu_, info, call_state, target_method, vtable_idx,
-                               direct_code, direct_method, type);
+                                  direct_code, direct_method, type);
+    }
+    if (rl_arg.wide) {
+      i++;
     }
   }
 
diff --git a/compiler/dex/quick/arm64/utility_arm64.cc b/compiler/dex/quick/arm64/utility_arm64.cc
index eb08404..22a4ec4 100644
--- a/compiler/dex/quick/arm64/utility_arm64.cc
+++ b/compiler/dex/quick/arm64/utility_arm64.cc
@@ -927,11 +927,9 @@
       opcode = WIDE(kA64Ldr4rXxG);
       expected_scale = 3;
       break;
+    case kSingle:     // Intentional fall-through.
+    case k32:         // Intentional fall-through.
     case kReference:
-      // TODO(Arm64): r_dest must be 64-bit below. Remove the hack below.
-      r_dest = (r_dest.Is64Bit()) ? As32BitReg(r_dest) : r_dest;
-    case kSingle:
-    case k32:
       r_dest = Check32BitReg(r_dest);
       opcode = kA64Ldr4rXxG;
       expected_scale = 2;
@@ -972,8 +970,9 @@
   return load;
 }
 
-LIR* Arm64Mir2Lir::LoadRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest) {
-  return LoadBaseIndexed(r_base, r_index, As32BitReg(r_dest), 2, kReference);
+LIR* Arm64Mir2Lir::LoadRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest,
+                                  int scale) {
+  return LoadBaseIndexed(r_base, r_index, As32BitReg(r_dest), scale, kReference);
 }
 
 LIR* Arm64Mir2Lir::StoreBaseIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src,
@@ -1016,11 +1015,9 @@
       opcode = WIDE(kA64Str4rXxG);
       expected_scale = 3;
       break;
-    case kReference:
-      // TODO(Arm64): r_src must be 64-bit below. Remove the hack below.
-      r_src = (r_src.Is64Bit()) ? As32BitReg(r_src) : r_src;
     case kSingle:     // Intentional fall-trough.
     case k32:         // Intentional fall-trough.
+    case kReference:
       r_src = Check32BitReg(r_src);
       opcode = kA64Str4rXxG;
       expected_scale = 2;
@@ -1053,8 +1050,9 @@
   return store;
 }
 
-LIR* Arm64Mir2Lir::StoreRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src) {
-  return StoreBaseIndexed(r_base, r_index, As32BitReg(r_src), 2, kReference);
+LIR* Arm64Mir2Lir::StoreRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src,
+                                   int scale) {
+  return StoreBaseIndexed(r_base, r_index, As32BitReg(r_src), scale, kReference);
 }
 
 /*
@@ -1084,11 +1082,9 @@
         alt_opcode = WIDE(kA64Ldur3rXd);
       }
       break;
-    case kReference:
-      // TODO(Arm64): r_dest must be 64-bit below. Remove the hack below.
-      r_dest = (r_dest.Is64Bit()) ? As32BitReg(r_dest) : r_dest;
     case kSingle:     // Intentional fall-through.
     case k32:         // Intentional fall-trough.
+    case kReference:
       r_dest = Check32BitReg(r_dest);
       scale = 2;
       if (r_dest.IsFloat()) {
@@ -1185,11 +1181,9 @@
         alt_opcode = FWIDE(kA64Stur3rXd);
       }
       break;
-    case kReference:
-      // TODO(Arm64): r_src must be 64-bit below. Remove the hack below.
-      r_src = (r_src.Is64Bit()) ? As32BitReg(r_src) : r_src;
     case kSingle:     // Intentional fall-through.
     case k32:         // Intentional fall-trough.
+    case kReference:
       r_src = Check32BitReg(r_src);
       scale = 2;
       if (r_src.IsFloat()) {
diff --git a/compiler/dex/quick/dex_file_method_inliner.cc b/compiler/dex/quick/dex_file_method_inliner.cc
index 149a971..6c0291d 100644
--- a/compiler/dex/quick/dex_file_method_inliner.cc
+++ b/compiler/dex/quick/dex_file_method_inliner.cc
@@ -134,6 +134,8 @@
     "Ljava/lang/Thread;",      // kClassCacheJavaLangThread
     "Llibcore/io/Memory;",     // kClassCacheLibcoreIoMemory
     "Lsun/misc/Unsafe;",       // kClassCacheSunMiscUnsafe
+    "Ljava/lang/System;",      // kClassCacheJavaLangSystem
+    "[C"                       // kClassCacheJavaLangCharArray
 };
 
 const char* const DexFileMethodInliner::kNameCacheNames[] = {
@@ -179,6 +181,7 @@
     "putObject",             // kNameCachePutObject
     "putObjectVolatile",     // kNameCachePutObjectVolatile
     "putOrderedObject",      // kNameCachePutOrderedObject
+    "arraycopy",             // kNameCacheArrayCopy
 };
 
 const DexFileMethodInliner::ProtoDef DexFileMethodInliner::kProtoCacheDefs[] = {
@@ -254,6 +257,9 @@
     // kProtoCacheObjectJObject_V
     { kClassCacheVoid, 3, { kClassCacheJavaLangObject, kClassCacheLong,
         kClassCacheJavaLangObject } },
+    // kProtoCacheCharArrayICharArrayII_V
+    { kClassCacheVoid, 5, {kClassCacheJavaLangCharArray, kClassCacheInt,
+                kClassCacheJavaLangCharArray, kClassCacheInt, kClassCacheInt}}
 };
 
 const DexFileMethodInliner::IntrinsicDef DexFileMethodInliner::kIntrinsicMethods[] = {
@@ -341,6 +347,10 @@
     UNSAFE_GET_PUT(Object, Object, kIntrinsicFlagIsObject),
 #undef UNSAFE_GET_PUT
 
+    INTRINSIC(JavaLangSystem, ArrayCopy, CharArrayICharArrayII_V , kIntrinsicSystemArrayCopyCharArray,
+              0),
+
+
 #undef INTRINSIC
 };
 
@@ -441,6 +451,8 @@
                                           intrinsic.d.data & kIntrinsicFlagIsObject,
                                           intrinsic.d.data & kIntrinsicFlagIsVolatile,
                                           intrinsic.d.data & kIntrinsicFlagIsOrdered);
+    case kIntrinsicSystemArrayCopyCharArray:
+      return backend->GenInlinedArrayCopyCharArray(info);
     default:
       LOG(FATAL) << "Unexpected intrinsic opcode: " << intrinsic.opcode;
       return false;  // avoid warning "control reaches end of non-void function"
diff --git a/compiler/dex/quick/dex_file_method_inliner.h b/compiler/dex/quick/dex_file_method_inliner.h
index c7a3b83..5b3b104 100644
--- a/compiler/dex/quick/dex_file_method_inliner.h
+++ b/compiler/dex/quick/dex_file_method_inliner.h
@@ -118,6 +118,8 @@
       kClassCacheJavaLangThread,
       kClassCacheLibcoreIoMemory,
       kClassCacheSunMiscUnsafe,
+      kClassCacheJavaLangSystem,
+      kClassCacheJavaLangCharArray,
       kClassCacheLast
     };
 
@@ -170,6 +172,7 @@
       kNameCachePutObject,
       kNameCachePutObjectVolatile,
       kNameCachePutOrderedObject,
+      kNameCacheArrayCopy,
       kNameCacheLast
     };
 
@@ -214,6 +217,7 @@
       kProtoCacheObjectJJ_V,
       kProtoCacheObjectJ_Object,
       kProtoCacheObjectJObject_V,
+      kProtoCacheCharArrayICharArrayII_V,
       kProtoCacheLast
     };
 
diff --git a/compiler/dex/quick/gen_invoke.cc b/compiler/dex/quick/gen_invoke.cc
index e262703..02f39ac 100755
--- a/compiler/dex/quick/gen_invoke.cc
+++ b/compiler/dex/quick/gen_invoke.cc
@@ -1527,6 +1527,11 @@
   return true;
 }
 
+bool Mir2Lir::GenInlinedArrayCopyCharArray(CallInfo* info) {
+  return false;
+}
+
+
 /*
  * Fast String.indexOf(I) & (II).  Tests for simple case of char <= 0xFFFF,
  * otherwise bails to standard library code.
@@ -1692,8 +1697,11 @@
       FreeTemp(rl_temp_offset);
     }
   } else {
-    LoadBaseIndexed(rl_object.reg, rl_offset.reg, rl_result.reg, 0,
-                    (rl_result.ref) ? kReference : k32);
+    if (rl_result.ref) {
+      LoadRefIndexed(rl_object.reg, rl_offset.reg, rl_result.reg, 0);
+    } else {
+      LoadBaseIndexed(rl_object.reg, rl_offset.reg, rl_result.reg, 0, k32);
+    }
   }
 
   if (is_volatile) {
@@ -1742,8 +1750,11 @@
     }
   } else {
     rl_value = LoadValue(rl_src_value);
-    StoreBaseIndexed(rl_object.reg, rl_offset.reg, rl_value.reg, 0,
-                     (rl_value.ref) ? kReference : k32);
+    if (rl_value.ref) {
+      StoreRefIndexed(rl_object.reg, rl_offset.reg, rl_value.reg, 0);
+    } else {
+      StoreBaseIndexed(rl_object.reg, rl_offset.reg, rl_value.reg, 0, k32);
+    }
   }
 
   // Free up the temp early, to ensure x86 doesn't run out of temporaries in MarkGCCard.
diff --git a/compiler/dex/quick/mir_to_lir.h b/compiler/dex/quick/mir_to_lir.h
index 6768790..4885501 100644
--- a/compiler/dex/quick/mir_to_lir.h
+++ b/compiler/dex/quick/mir_to_lir.h
@@ -992,6 +992,7 @@
     virtual bool GenInlinedAbsDouble(CallInfo* info);
     bool GenInlinedFloatCvt(CallInfo* info);
     bool GenInlinedDoubleCvt(CallInfo* info);
+    virtual bool GenInlinedArrayCopyCharArray(CallInfo* info);
     virtual bool GenInlinedIndexOf(CallInfo* info, bool zero_based);
     bool GenInlinedStringCompareTo(CallInfo* info);
     bool GenInlinedCurrentThread(CallInfo* info);
@@ -1023,8 +1024,9 @@
       return LoadBaseDisp(r_base, displacement, r_dest, kReference, is_volatile);
     }
     // Load a reference at base + index and decompress into register.
-    virtual LIR* LoadRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest) {
-      return LoadBaseIndexed(r_base, r_index, r_dest, 2, kReference);
+    virtual LIR* LoadRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_dest,
+                                int scale) {
+      return LoadBaseIndexed(r_base, r_index, r_dest, scale, kReference);
     }
     // Load Dalvik value with 32-bit memory storage.  If compressed object reference, decompress.
     virtual RegLocation LoadValue(RegLocation rl_src, RegisterClass op_kind);
@@ -1050,8 +1052,9 @@
       return StoreBaseDisp(r_base, displacement, r_src, kReference, is_volatile);
     }
     // Store an uncompressed reference into a compressed 32-bit container by index.
-    virtual LIR* StoreRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src) {
-      return StoreBaseIndexed(r_base, r_index, r_src, 2, kReference);
+    virtual LIR* StoreRefIndexed(RegStorage r_base, RegStorage r_index, RegStorage r_src,
+                                 int scale) {
+      return StoreBaseIndexed(r_base, r_index, r_src, scale, kReference);
     }
     // Store 32 bits, regardless of target.
     virtual LIR* Store32Disp(RegStorage r_base, int displacement, RegStorage r_src) {
diff --git a/compiler/dex/quick/x86/assemble_x86.cc b/compiler/dex/quick/x86/assemble_x86.cc
index 1470e8c..7baf2d9 100644
--- a/compiler/dex/quick/x86/assemble_x86.cc
+++ b/compiler/dex/quick/x86/assemble_x86.cc
@@ -402,6 +402,8 @@
   EXT_0F_ENCODING_MAP(Pxor,      0x66, 0xEF, REG_DEF0_USE0),
   EXT_0F_ENCODING2_MAP(Phaddw,   0x66, 0x38, 0x01, REG_DEF0_USE0),
   EXT_0F_ENCODING2_MAP(Phaddd,   0x66, 0x38, 0x02, REG_DEF0_USE0),
+  EXT_0F_ENCODING_MAP(Haddpd,    0x66, 0x7C, REG_DEF0_USE0),
+  EXT_0F_ENCODING_MAP(Haddps,    0xF2, 0x7C, REG_DEF0_USE0),
 
   { kX86PextrbRRI, kRegRegImm, IS_TERTIARY_OP | REG_DEF0 | REG_USE1, { 0x66, 0, 0x0F, 0x3A, 0x14, 0, 0, 1, false }, "PextbRRI", "!0r,!1r,!2d" },
   { kX86PextrwRRI, kRegRegImm, IS_TERTIARY_OP | REG_DEF0 | REG_USE1, { 0x66, 0, 0x0F, 0xC5, 0x00, 0, 0, 1, false }, "PextwRRI", "!0r,!1r,!2d" },
@@ -410,6 +412,9 @@
   { kX86PshuflwRRI, kRegRegImm, IS_TERTIARY_OP | REG_DEF0 | REG_USE1, { 0xF2, 0, 0x0F, 0x70, 0, 0, 0, 1, false }, "PshuflwRRI", "!0r,!1r,!2d" },
   { kX86PshufdRRI,  kRegRegImm, IS_TERTIARY_OP | REG_DEF0 | REG_USE1, { 0x66, 0, 0x0F, 0x70, 0, 0, 0, 1, false }, "PshuffRRI", "!0r,!1r,!2d" },
 
+  { kX86ShufpsRRI, kRegRegImm, IS_TERTIARY_OP | REG_DEF0 | REG_USE1, { 0x00, 0, 0x0F, 0xC6, 0, 0, 0, 1, false }, "kX86ShufpsRRI", "!0r,!1r,!2d" },
+  { kX86ShufpdRRI, kRegRegImm, IS_TERTIARY_OP | REG_DEF0 | REG_USE1, { 0x66, 0, 0x0F, 0xC6, 0, 0, 0, 1, false }, "kX86ShufpdRRI", "!0r,!1r,!2d" },
+
   { kX86PsrawRI, kRegImm, IS_BINARY_OP | REG_DEF0_USE0, { 0x66, 0, 0x0F, 0x71, 0, 4, 0, 1, false }, "PsrawRI", "!0r,!1d" },
   { kX86PsradRI, kRegImm, IS_BINARY_OP | REG_DEF0_USE0, { 0x66, 0, 0x0F, 0x72, 0, 4, 0, 1, false }, "PsradRI", "!0r,!1d" },
   { kX86PsrlwRI, kRegImm, IS_BINARY_OP | REG_DEF0_USE0, { 0x66, 0, 0x0F, 0x71, 0, 2, 0, 1, false }, "PsrlwRI", "!0r,!1d" },
diff --git a/compiler/dex/quick/x86/codegen_x86.h b/compiler/dex/quick/x86/codegen_x86.h
index 123fe90..55e5993 100644
--- a/compiler/dex/quick/x86/codegen_x86.h
+++ b/compiler/dex/quick/x86/codegen_x86.h
@@ -517,6 +517,7 @@
    * @returns true if a register is byte addressable.
    */
   bool IsByteRegister(RegStorage reg);
+  bool GenInlinedArrayCopyCharArray(CallInfo* info) OVERRIDE;
 
   /*
    * @brief generate inline code for fast case of Strng.indexOf.
diff --git a/compiler/dex/quick/x86/target_x86.cc b/compiler/dex/quick/x86/target_x86.cc
index 72e47d0..43882c2 100755
--- a/compiler/dex/quick/x86/target_x86.cc
+++ b/compiler/dex/quick/x86/target_x86.cc
@@ -1023,6 +1023,123 @@
   Mir2Lir::InstallLiteralPools();
 }
 
+bool X86Mir2Lir::GenInlinedArrayCopyCharArray(CallInfo* info) {
+  if (cu_->target64) {
+    // TODO: Implement ArrayCOpy intrinsic for x86_64
+    return false;
+  }
+
+  RegLocation rl_src = info->args[0];
+  RegLocation rl_srcPos = info->args[1];
+  RegLocation rl_dst = info->args[2];
+  RegLocation rl_dstPos = info->args[3];
+  RegLocation rl_length = info->args[4];
+  if (rl_srcPos.is_const && (mir_graph_->ConstantValue(rl_srcPos) < 0)) {
+    return false;
+  }
+  if (rl_dstPos.is_const && (mir_graph_->ConstantValue(rl_dstPos) < 0)) {
+    return false;
+  }
+  ClobberCallerSave();
+  LockCallTemps();  // Using fixed registers
+  LoadValueDirectFixed(rl_src , rs_rAX);
+  LoadValueDirectFixed(rl_dst , rs_rCX);
+  LIR* src_dst_same  = OpCmpBranch(kCondEq, rs_rAX , rs_rCX, nullptr);
+  LIR* src_null_branch = OpCmpImmBranch(kCondEq, rs_rAX , 0, nullptr);
+  LIR* dst_null_branch = OpCmpImmBranch(kCondEq, rs_rCX , 0, nullptr);
+  LoadValueDirectFixed(rl_length , rs_rDX);
+  LIR* len_negative  = OpCmpImmBranch(kCondLt, rs_rDX , 0, nullptr);
+  LIR* len_too_big  = OpCmpImmBranch(kCondGt, rs_rDX , 128, nullptr);
+  LoadValueDirectFixed(rl_src , rs_rAX);
+  LoadWordDisp(rs_rAX , mirror::Array::LengthOffset().Int32Value(), rs_rAX);
+  LIR* src_bad_len  = nullptr;
+  LIR* srcPos_negative  = nullptr;
+  if (!rl_srcPos.is_const) {
+    LoadValueDirectFixed(rl_srcPos , rs_rBX);
+    srcPos_negative  = OpCmpImmBranch(kCondLt, rs_rBX , 0, nullptr);
+    OpRegReg(kOpAdd, rs_rBX, rs_rDX);
+    src_bad_len  = OpCmpBranch(kCondLt, rs_rAX , rs_rBX, nullptr);
+  } else {
+    int pos_val = mir_graph_->ConstantValue(rl_srcPos.orig_sreg);
+    if (pos_val == 0) {
+      src_bad_len  = OpCmpBranch(kCondLt, rs_rAX , rs_rDX, nullptr);
+    } else {
+      OpRegRegImm(kOpAdd, rs_rBX,  rs_rDX, pos_val);
+      src_bad_len  = OpCmpBranch(kCondLt, rs_rAX , rs_rBX, nullptr);
+    }
+  }
+  LIR* dstPos_negative = nullptr;
+  LIR* dst_bad_len = nullptr;
+  LoadValueDirectFixed(rl_dst, rs_rAX);
+  LoadWordDisp(rs_rAX, mirror::Array::LengthOffset().Int32Value(), rs_rAX);
+  if (!rl_dstPos.is_const) {
+    LoadValueDirectFixed(rl_dstPos , rs_rBX);
+    dstPos_negative = OpCmpImmBranch(kCondLt, rs_rBX , 0, nullptr);
+    OpRegRegReg(kOpAdd, rs_rBX, rs_rBX, rs_rDX);
+    dst_bad_len = OpCmpBranch(kCondLt, rs_rAX , rs_rBX, nullptr);
+  } else {
+    int pos_val = mir_graph_->ConstantValue(rl_dstPos.orig_sreg);
+    if (pos_val == 0) {
+      dst_bad_len = OpCmpBranch(kCondLt, rs_rAX , rs_rDX, nullptr);
+    } else {
+      OpRegRegImm(kOpAdd, rs_rBX,  rs_rDX, pos_val);
+      dst_bad_len = OpCmpBranch(kCondLt, rs_rAX , rs_rBX, nullptr);
+    }
+  }
+  // everything is checked now
+  LoadValueDirectFixed(rl_src , rs_rAX);
+  LoadValueDirectFixed(rl_dst , rs_rBX);
+  LoadValueDirectFixed(rl_srcPos , rs_rCX);
+  NewLIR5(kX86Lea32RA, rs_rAX.GetReg(), rs_rAX.GetReg(),
+       rs_rCX.GetReg() , 1, mirror::Array::DataOffset(2).Int32Value());
+  // RAX now holds the address of the first src element to be copied
+
+  LoadValueDirectFixed(rl_dstPos , rs_rCX);
+  NewLIR5(kX86Lea32RA, rs_rBX.GetReg(), rs_rBX.GetReg(),
+       rs_rCX.GetReg() , 1, mirror::Array::DataOffset(2).Int32Value() );
+  // RBX now holds the address of the first dst element to be copied
+
+  // check if the number of elements to be copied is odd or even. If odd
+  // then copy the first element (so that the remaining number of elements
+  // is even).
+  LoadValueDirectFixed(rl_length , rs_rCX);
+  OpRegImm(kOpAnd, rs_rCX, 1);
+  LIR* jmp_to_begin_loop  = OpCmpImmBranch(kCondEq, rs_rCX, 0, nullptr);
+  OpRegImm(kOpSub, rs_rDX, 1);
+  LoadBaseIndexedDisp(rs_rAX, rs_rDX, 1, 0, rs_rCX, kSignedHalf);
+  StoreBaseIndexedDisp(rs_rBX, rs_rDX, 1, 0, rs_rCX, kSignedHalf);
+
+  // since the remaining number of elements is even, we will copy by
+  // two elements at a time.
+  LIR *beginLoop = NewLIR0(kPseudoTargetLabel);
+  LIR* jmp_to_ret  = OpCmpImmBranch(kCondEq, rs_rDX , 0, nullptr);
+  OpRegImm(kOpSub, rs_rDX, 2);
+  LoadBaseIndexedDisp(rs_rAX, rs_rDX, 1, 0, rs_rCX, kSingle);
+  StoreBaseIndexedDisp(rs_rBX, rs_rDX, 1, 0, rs_rCX, kSingle);
+  OpUnconditionalBranch(beginLoop);
+  LIR *check_failed = NewLIR0(kPseudoTargetLabel);
+  LIR* launchpad_branch  = OpUnconditionalBranch(nullptr);
+  LIR *return_point = NewLIR0(kPseudoTargetLabel);
+  jmp_to_ret->target = return_point;
+  jmp_to_begin_loop->target = beginLoop;
+  src_dst_same->target = check_failed;
+  len_negative->target = check_failed;
+  len_too_big->target = check_failed;
+  src_null_branch->target = check_failed;
+  if (srcPos_negative != nullptr)
+    srcPos_negative ->target = check_failed;
+  if (src_bad_len != nullptr)
+    src_bad_len->target = check_failed;
+  dst_null_branch->target = check_failed;
+  if (dstPos_negative != nullptr)
+    dstPos_negative->target = check_failed;
+  if (dst_bad_len != nullptr)
+    dst_bad_len->target = check_failed;
+  AddIntrinsicSlowPath(info, launchpad_branch, return_point);
+  return true;
+}
+
+
 /*
  * Fast string.index_of(I) & (II).  Inline check for simple case of char <= 0xffff,
  * otherwise bails to standard library code.
diff --git a/compiler/dex/quick/x86/x86_lir.h b/compiler/dex/quick/x86/x86_lir.h
index ff243ce..e271e9d 100644
--- a/compiler/dex/quick/x86/x86_lir.h
+++ b/compiler/dex/quick/x86/x86_lir.h
@@ -564,11 +564,15 @@
   Binary0fOpCode(kX86Pxor),     // parallel XOR 128 bits x 1
   Binary0fOpCode(kX86Phaddw),   // parallel horizontal addition 16 bits x 8
   Binary0fOpCode(kX86Phaddd),   // parallel horizontal addition 32 bits x 4
+  Binary0fOpCode(kX86Haddpd),   // parallel FP horizontal addition 64 bits x 2
+  Binary0fOpCode(kX86Haddps),   // parallel FP horizontal addition 32 bits x 4
   kX86PextrbRRI,                // Extract 8 bits from XMM into GPR
   kX86PextrwRRI,                // Extract 16 bits from XMM into GPR
   kX86PextrdRRI,                // Extract 32 bits from XMM into GPR
   kX86PshuflwRRI,               // Shuffle 16 bits in lower 64 bits of XMM.
   kX86PshufdRRI,                // Shuffle 32 bits in XMM.
+  kX86ShufpsRRI,                // FP Shuffle 32 bits in XMM.
+  kX86ShufpdRRI,                // FP Shuffle 64 bits in XMM.
   kX86PsrawRI,                  // signed right shift of floating point registers 16 bits x 8
   kX86PsradRI,                  // signed right shift of floating point registers 32 bits x 4
   kX86PsrlwRI,                  // logical right shift of floating point registers 16 bits x 8
diff --git a/compiler/driver/compiler_driver.cc b/compiler/driver/compiler_driver.cc
index 96625c5..770ae89 100644
--- a/compiler/driver/compiler_driver.cc
+++ b/compiler/driver/compiler_driver.cc
@@ -1461,6 +1461,18 @@
   return false;
 }
 
+static void CheckAndClearResolveException(Thread* self)
+    SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
+  CHECK(self->IsExceptionPending());
+  mirror::Throwable* exception = self->GetException(nullptr);
+  std::string descriptor = exception->GetClass()->GetDescriptor();
+  if (descriptor != "Ljava/lang/IncompatibleClassChangeError;" &&
+      descriptor != "Ljava/lang/NoClassDefFoundError;") {
+    LOG(FATAL) << "Unexpected exeption " << exception->Dump();
+  }
+  self->ClearException();
+}
+
 static void ResolveClassFieldsAndMethods(const ParallelCompilationManager* manager,
                                          size_t class_def_index)
     LOCKS_EXCLUDED(Locks::mutator_lock_) {
@@ -1496,8 +1508,7 @@
     if (klass == NULL) {
       // Class couldn't be resolved, for example, super-class is in a different dex file. Don't
       // attempt to resolve methods and fields when there is no declaring class.
-      CHECK(soa.Self()->IsExceptionPending());
-      soa.Self()->ClearException();
+      CheckAndClearResolveException(soa.Self());
       resolve_fields_and_methods = false;
     } else {
       resolve_fields_and_methods = manager->GetCompiler()->IsImage();
@@ -1516,8 +1527,7 @@
           mirror::ArtField* field = class_linker->ResolveField(dex_file, it.GetMemberIndex(),
                                                                dex_cache, class_loader, true);
           if (field == NULL) {
-            CHECK(soa.Self()->IsExceptionPending());
-            soa.Self()->ClearException();
+            CheckAndClearResolveException(soa.Self());
           }
         }
         it.Next();
@@ -1532,8 +1542,7 @@
           mirror::ArtField* field = class_linker->ResolveField(dex_file, it.GetMemberIndex(),
                                                                dex_cache, class_loader, false);
           if (field == NULL) {
-            CHECK(soa.Self()->IsExceptionPending());
-            soa.Self()->ClearException();
+            CheckAndClearResolveException(soa.Self());
           }
         }
         it.Next();
@@ -1545,8 +1554,7 @@
                                                                   NullHandle<mirror::ArtMethod>(),
                                                                   it.GetMethodInvokeType(class_def));
           if (method == NULL) {
-            CHECK(soa.Self()->IsExceptionPending());
-            soa.Self()->ClearException();
+            CheckAndClearResolveException(soa.Self());
           }
           it.Next();
         }
@@ -1556,8 +1564,7 @@
                                                                   NullHandle<mirror::ArtMethod>(),
                                                                   it.GetMethodInvokeType(class_def));
           if (method == NULL) {
-            CHECK(soa.Self()->IsExceptionPending());
-            soa.Self()->ClearException();
+            CheckAndClearResolveException(soa.Self());
           }
           it.Next();
         }
diff --git a/compiler/driver/compiler_options.h b/compiler/driver/compiler_options.h
index fb3341b..92b2fee 100644
--- a/compiler/driver/compiler_options.h
+++ b/compiler/driver/compiler_options.h
@@ -43,6 +43,7 @@
   static const size_t kDefaultNumDexMethodsThreshold = 900;
   static constexpr double kDefaultTopKProfileThreshold = 90.0;
   static const bool kDefaultIncludeDebugSymbols = kIsDebugBuild;
+  static const bool kDefaultIncludePatchInformation = false;
 
   CompilerOptions() :
     compiler_filter_(kDefaultCompilerFilter),
@@ -52,6 +53,7 @@
     tiny_method_threshold_(kDefaultTinyMethodThreshold),
     num_dex_methods_threshold_(kDefaultNumDexMethodsThreshold),
     generate_gdb_information_(false),
+    include_patch_information_(kDefaultIncludePatchInformation),
     top_k_profile_threshold_(kDefaultTopKProfileThreshold),
     include_debug_symbols_(kDefaultIncludeDebugSymbols),
     explicit_null_checks_(true),
@@ -69,6 +71,7 @@
                   size_t tiny_method_threshold,
                   size_t num_dex_methods_threshold,
                   bool generate_gdb_information,
+                  bool include_patch_information,
                   double top_k_profile_threshold,
                   bool include_debug_symbols,
                   bool explicit_null_checks,
@@ -85,6 +88,7 @@
     tiny_method_threshold_(tiny_method_threshold),
     num_dex_methods_threshold_(num_dex_methods_threshold),
     generate_gdb_information_(generate_gdb_information),
+    include_patch_information_(include_patch_information),
     top_k_profile_threshold_(top_k_profile_threshold),
     include_debug_symbols_(include_debug_symbols),
     explicit_null_checks_(explicit_null_checks),
@@ -188,6 +192,10 @@
     return generate_gdb_information_;
   }
 
+  bool GetIncludePatchInformation() const {
+    return include_patch_information_;
+  }
+
  private:
   CompilerFilter compiler_filter_;
   size_t huge_method_threshold_;
@@ -196,6 +204,7 @@
   size_t tiny_method_threshold_;
   size_t num_dex_methods_threshold_;
   bool generate_gdb_information_;
+  bool include_patch_information_;
   // When using a profile file only the top K% of the profiled samples will be compiled.
   double top_k_profile_threshold_;
   bool include_debug_symbols_;
diff --git a/compiler/elf_fixup.cc b/compiler/elf_fixup.cc
index 404e3f8..60f76ef 100644
--- a/compiler/elf_fixup.cc
+++ b/compiler/elf_fixup.cc
@@ -69,97 +69,7 @@
   for (Elf32_Word i = 0; i < elf_file.GetDynamicNum(); i++) {
     Elf32_Dyn& elf_dyn = elf_file.GetDynamic(i);
     Elf32_Word d_tag = elf_dyn.d_tag;
-    bool elf_dyn_needs_fixup = false;
-    switch (d_tag) {
-      // case 1: well known d_tag values that imply Elf32_Dyn.d_un contains an address in d_ptr
-      case DT_PLTGOT:
-      case DT_HASH:
-      case DT_STRTAB:
-      case DT_SYMTAB:
-      case DT_RELA:
-      case DT_INIT:
-      case DT_FINI:
-      case DT_REL:
-      case DT_DEBUG:
-      case DT_JMPREL: {
-        elf_dyn_needs_fixup = true;
-        break;
-      }
-      // d_val or ignored values
-      case DT_NULL:
-      case DT_NEEDED:
-      case DT_PLTRELSZ:
-      case DT_RELASZ:
-      case DT_RELAENT:
-      case DT_STRSZ:
-      case DT_SYMENT:
-      case DT_SONAME:
-      case DT_RPATH:
-      case DT_SYMBOLIC:
-      case DT_RELSZ:
-      case DT_RELENT:
-      case DT_PLTREL:
-      case DT_TEXTREL:
-      case DT_BIND_NOW:
-      case DT_INIT_ARRAYSZ:
-      case DT_FINI_ARRAYSZ:
-      case DT_RUNPATH:
-      case DT_FLAGS: {
-        break;
-      }
-      // boundary values that should not be used
-      case DT_ENCODING:
-      case DT_LOOS:
-      case DT_HIOS:
-      case DT_LOPROC:
-      case DT_HIPROC: {
-        LOG(FATAL) << "Illegal d_tag value 0x" << std::hex << d_tag;
-        break;
-      }
-      default: {
-        // case 2: "regular" DT_* ranges where even d_tag values imply an address in d_ptr
-        if ((DT_ENCODING  < d_tag && d_tag < DT_LOOS)
-            || (DT_LOOS   < d_tag && d_tag < DT_HIOS)
-            || (DT_LOPROC < d_tag && d_tag < DT_HIPROC)) {
-          // Special case for MIPS which breaks the regular rules between DT_LOPROC and DT_HIPROC
-          if (elf_file.GetHeader().e_machine == EM_MIPS) {
-            switch (d_tag) {
-              case DT_MIPS_RLD_VERSION:
-              case DT_MIPS_TIME_STAMP:
-              case DT_MIPS_ICHECKSUM:
-              case DT_MIPS_IVERSION:
-              case DT_MIPS_FLAGS:
-              case DT_MIPS_LOCAL_GOTNO:
-              case DT_MIPS_CONFLICTNO:
-              case DT_MIPS_LIBLISTNO:
-              case DT_MIPS_SYMTABNO:
-              case DT_MIPS_UNREFEXTNO:
-              case DT_MIPS_GOTSYM:
-              case DT_MIPS_HIPAGENO: {
-                break;
-              }
-              case DT_MIPS_BASE_ADDRESS:
-              case DT_MIPS_CONFLICT:
-              case DT_MIPS_LIBLIST:
-              case DT_MIPS_RLD_MAP: {
-                elf_dyn_needs_fixup = true;
-                break;
-              }
-              default: {
-                LOG(FATAL) << "Unknown MIPS d_tag value 0x" << std::hex << d_tag;
-                break;
-              }
-            }
-          } else if ((elf_dyn.d_tag % 2) == 0) {
-            elf_dyn_needs_fixup = true;
-          }
-        } else {
-          LOG(FATAL) << "Unknown d_tag value 0x" << std::hex << d_tag;
-        }
-        break;
-      }
-    }
-    if (elf_dyn_needs_fixup) {
+    if (IsDynamicSectionPointer(d_tag, elf_file.GetHeader().e_machine)) {
       uint32_t d_ptr = elf_dyn.d_un.d_ptr;
       if (DEBUG_FIXUP) {
         LOG(INFO) << StringPrintf("In %s moving Elf32_Dyn[%d] from 0x%08x to 0x%08" PRIxPTR,
diff --git a/compiler/elf_writer_quick.cc b/compiler/elf_writer_quick.cc
index e4dcaa7..06f6e89 100644
--- a/compiler/elf_writer_quick.cc
+++ b/compiler/elf_writer_quick.cc
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include <unordered_set>
+
 #include "elf_writer_quick.h"
 
 #include "base/logging.h"
@@ -803,6 +805,25 @@
   return elf_writer.Write(oat_writer, dex_files, android_root, is_host);
 }
 
+// Add patch information to this section. Each patch is a Elf32_Word that
+// identifies an offset from the start of the text section
+void ElfWriterQuick::ReservePatchSpace(std::vector<uint8_t>* buffer, bool debug) {
+  size_t size =
+      compiler_driver_->GetCodeToPatch().size() +
+      compiler_driver_->GetMethodsToPatch().size() +
+      compiler_driver_->GetClassesToPatch().size();
+  if (size == 0) {
+    if (debug) {
+      LOG(INFO) << "No patches to record";
+    }
+    return;
+  }
+  buffer->resize(size * sizeof(uintptr_t));
+  if (debug) {
+    LOG(INFO) << "Patches reserved for " << size;
+  }
+}
+
 bool ElfWriterQuick::Write(OatWriter* oat_writer,
                            const std::vector<const DexFile*>& dex_files_unused,
                            const std::string& android_root_unused,
@@ -836,6 +857,13 @@
     builder.RegisterRawSection(debug_str);
   }
 
+  if (compiler_driver_->GetCompilerOptions().GetIncludePatchInformation()) {
+    ElfRawSectionBuilder oat_patches(".oat_patches", SHT_OAT_PATCH, 0, NULL, 0,
+                                     sizeof(size_t), sizeof(size_t));
+    ReservePatchSpace(oat_patches.GetBuffer(), debug);
+    builder.RegisterRawSection(oat_patches);
+  }
+
   return builder.Write();
 }
 
diff --git a/compiler/elf_writer_quick.h b/compiler/elf_writer_quick.h
index 6eb5d68..a0d36df 100644
--- a/compiler/elf_writer_quick.h
+++ b/compiler/elf_writer_quick.h
@@ -51,6 +51,7 @@
   void AddDebugSymbols(ElfBuilder& builder,
                        OatWriter* oat_writer,
                        bool debug);
+  void ReservePatchSpace(std::vector<uint8_t>* buffer, bool debug);
 
   class ElfSectionBuilder {
    public:
diff --git a/compiler/image_writer.cc b/compiler/image_writer.cc
index 6e5f19a..2d25b7a 100644
--- a/compiler/image_writer.cc
+++ b/compiler/image_writer.cc
@@ -27,6 +27,8 @@
 #include "compiled_method.h"
 #include "dex_file-inl.h"
 #include "driver/compiler_driver.h"
+#include "elf_file.h"
+#include "elf_utils.h"
 #include "elf_writer.h"
 #include "gc/accounting/card_table-inl.h"
 #include "gc/accounting/heap_bitmap.h"
@@ -138,7 +140,8 @@
   ElfWriter::GetOatElfInformation(oat_file.get(), oat_loaded_size, oat_data_offset);
   CalculateNewObjectOffsets(oat_loaded_size, oat_data_offset);
   CopyAndFixupObjects();
-  PatchOatCodeAndMethods();
+
+  PatchOatCodeAndMethods(oat_file.get());
   Thread::Current()->TransitionFromRunnableToSuspended(kNative);
 
   std::unique_ptr<File> image_file(OS::CreateEmptyFile(image_filename.c_str()));
@@ -782,7 +785,25 @@
   return klass;
 }
 
-void ImageWriter::PatchOatCodeAndMethods() {
+void ImageWriter::PatchOatCodeAndMethods(File* elf_file) {
+  std::vector<uintptr_t> patches;
+  std::set<uintptr_t> patches_set;
+  auto maybe_push = [&patches, &patches_set] (uintptr_t p) {
+    if (patches_set.find(p) == patches_set.end()) {
+      patches.push_back(p);
+      patches_set.insert(p);
+    }
+  };
+  const bool add_patches = compiler_driver_.GetCompilerOptions().GetIncludePatchInformation();
+  if (add_patches) {
+    // TODO if we are adding patches the resulting ELF file might have a
+    // potentially rather large amount of free space where patches might have been
+    // placed. We should adjust the ELF file to get rid of this excess space.
+    patches.reserve(compiler_driver_.GetCodeToPatch().size() +
+                    compiler_driver_.GetMethodsToPatch().size() +
+                    compiler_driver_.GetClassesToPatch().size());
+  }
+  uintptr_t loc = 0;
   Thread* self = Thread::Current();
   ClassLinker* class_linker = Runtime::Current()->GetClassLinker();
   const char* old_cause = self->StartAssertNoThreadSuspension("ImageWriter");
@@ -828,14 +849,20 @@
     } else {
       value = PointerToLowMemUInt32(GetOatAddress(code_offset));
     }
-    SetPatchLocation(patch, value);
+    SetPatchLocation(patch, value, &loc);
+    if (add_patches && !patch->AsCall()->IsRelative()) {
+      maybe_push(loc);
+    }
   }
 
   const CallPatches& methods_to_patch = compiler_driver_.GetMethodsToPatch();
   for (size_t i = 0; i < methods_to_patch.size(); i++) {
     const CompilerDriver::CallPatchInformation* patch = methods_to_patch[i];
     ArtMethod* target = GetTargetMethod(patch);
-    SetPatchLocation(patch, PointerToLowMemUInt32(GetImageAddress(target)));
+    SetPatchLocation(patch, PointerToLowMemUInt32(GetImageAddress(target)), &loc);
+    if (add_patches && !patch->AsCall()->IsRelative()) {
+      maybe_push(loc);
+    }
   }
 
   const std::vector<const CompilerDriver::TypePatchInformation*>& classes_to_patch =
@@ -843,16 +870,51 @@
   for (size_t i = 0; i < classes_to_patch.size(); i++) {
     const CompilerDriver::TypePatchInformation* patch = classes_to_patch[i];
     Class* target = GetTargetType(patch);
-    SetPatchLocation(patch, PointerToLowMemUInt32(GetImageAddress(target)));
+    SetPatchLocation(patch, PointerToLowMemUInt32(GetImageAddress(target)), &loc);
+    if (add_patches) {
+      maybe_push(loc);
+    }
   }
 
   // Update the image header with the new checksum after patching
   ImageHeader* image_header = reinterpret_cast<ImageHeader*>(image_->Begin());
   image_header->SetOatChecksum(oat_file_->GetOatHeader().GetChecksum());
   self->EndAssertNoThreadSuspension(old_cause);
+
+  // Update the ElfFiles SHT_OAT_PATCH section to include the patches.
+  if (add_patches) {
+    std::string err;
+    // TODO we are mapping in the contents of this file twice. We should be able
+    // to do it only once, which would be better.
+    std::unique_ptr<ElfFile> file(ElfFile::Open(elf_file, true, false, &err));
+    if (file == nullptr) {
+      LOG(ERROR) << err;
+    }
+    Elf32_Shdr* shdr = file->FindSectionByName(".oat_patches");
+    if (shdr != nullptr) {
+      DCHECK_EQ(shdr, file->FindSectionByType(SHT_OAT_PATCH))
+          << "Incorrect type for .oat_patches section";
+      CHECK_LE(patches.size() * sizeof(uintptr_t), shdr->sh_size)
+          << "We got more patches than anticipated";
+      CHECK_LE(reinterpret_cast<uintptr_t>(file->Begin()) + shdr->sh_offset + shdr->sh_size,
+               reinterpret_cast<uintptr_t>(file->End())) << "section is too large";
+      CHECK(shdr == &file->GetSectionHeader(file->GetSectionHeaderNum() - 1) ||
+            shdr->sh_offset + shdr->sh_size <= (shdr + 1)->sh_offset)
+          << "Section overlaps onto next section";
+      // It's mmap'd so we can just memcpy.
+      memcpy(file->Begin() + shdr->sh_offset, patches.data(), patches.size()*sizeof(uintptr_t));
+      // TODO We should fill in the newly empty space between the last patch and
+      // the start of the next section by moving the following sections down if
+      // possible.
+      shdr->sh_size = patches.size() * sizeof(uintptr_t);
+    } else {
+      LOG(ERROR) << "Unable to find section header for SHT_OAT_PATCH";
+    }
+  }
 }
 
-void ImageWriter::SetPatchLocation(const CompilerDriver::PatchInformation* patch, uint32_t value) {
+void ImageWriter::SetPatchLocation(const CompilerDriver::PatchInformation* patch, uint32_t value,
+                                   uintptr_t* patched_ptr) {
   ClassLinker* class_linker = Runtime::Current()->GetClassLinker();
   const void* quick_oat_code = class_linker->GetQuickOatCodeFor(patch->GetDexFile(),
                                                                 patch->GetReferrerClassDefIdx(),
@@ -885,6 +947,14 @@
   }
   *patch_location = value;
   oat_header.UpdateChecksum(patch_location, sizeof(value));
+
+  uintptr_t loc = reinterpret_cast<uintptr_t>(patch_location) -
+      (reinterpret_cast<uintptr_t>(oat_file_->Begin()) + oat_header.GetExecutableOffset());
+  CHECK_GT(reinterpret_cast<uintptr_t>(patch_location),
+            reinterpret_cast<uintptr_t>(oat_file_->Begin()) + oat_header.GetExecutableOffset());
+  CHECK_LT(loc, oat_file_->Size() - oat_header.GetExecutableOffset());
+
+  *patched_ptr = loc;
 }
 
 }  // namespace art
diff --git a/compiler/image_writer.h b/compiler/image_writer.h
index aff155a..2bcb41e 100644
--- a/compiler/image_writer.h
+++ b/compiler/image_writer.h
@@ -150,9 +150,10 @@
       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
 
   // Patches references in OatFile to expect runtime addresses.
-  void PatchOatCodeAndMethods()
+  void PatchOatCodeAndMethods(File* elf_file)
       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
-  void SetPatchLocation(const CompilerDriver::PatchInformation* patch, uint32_t value)
+  void SetPatchLocation(const CompilerDriver::PatchInformation* patch, uint32_t value,
+                        uintptr_t* patched_location)
       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
 
   const CompilerDriver& compiler_driver_;
diff --git a/compiler/jni/jni_compiler_test.cc b/compiler/jni/jni_compiler_test.cc
index 25b489b..b4d863b 100644
--- a/compiler/jni/jni_compiler_test.cc
+++ b/compiler/jni/jni_compiler_test.cc
@@ -61,8 +61,8 @@
       method = c->FindVirtualMethod(method_name, method_sig);
     }
     ASSERT_TRUE(method != nullptr) << method_name << " " << method_sig;
-    if (method->GetEntryPointFromQuickCompiledCode() == nullptr) {
-      ASSERT_TRUE(method->GetEntryPointFromPortableCompiledCode() == nullptr);
+    if (method->GetEntryPointFromQuickCompiledCode() == nullptr ||
+        method->GetEntryPointFromQuickCompiledCode() == class_linker_->GetQuickGenericJniTrampoline()) {
       CompileMethod(method);
       ASSERT_TRUE(method->GetEntryPointFromQuickCompiledCode() != nullptr)
           << method_name << " " << method_sig;
diff --git a/dex2oat/dex2oat.cc b/dex2oat/dex2oat.cc
index 3387f91..80e7724 100644
--- a/dex2oat/dex2oat.cc
+++ b/dex2oat/dex2oat.cc
@@ -60,6 +60,7 @@
 #include "runtime.h"
 #include "ScopedLocalRef.h"
 #include "scoped_thread_state_change.h"
+#include "utils.h"
 #include "vector_output_stream.h"
 #include "well_known_classes.h"
 #include "zip_archive.h"
@@ -144,8 +145,8 @@
   UsageError("      Example: --android-root=out/host/linux-x86");
   UsageError("      Default: $ANDROID_ROOT");
   UsageError("");
-  UsageError("  --instruction-set=(arm|arm64|mips|x86|x86_64): compile for a particular instruction");
-  UsageError("      set.");
+  UsageError("  --instruction-set=(arm|arm64|mips|x86|x86_64): compile for a particular");
+  UsageError("      instruction set.");
   UsageError("      Example: --instruction-set=x86");
   UsageError("      Default: arm");
   UsageError("");
@@ -203,6 +204,11 @@
   UsageError("");
   UsageError("  --dump-timing: display a breakdown of where time was spent");
   UsageError("");
+  UsageError("  --include-patch-information: Include patching information so the generated code");
+  UsageError("      can have its base address moved without full recompilation.");
+  UsageError("");
+  UsageError("  --no-include-patch-information: Do not include patching information.");
+  UsageError("");
   UsageError("  --include-debug-symbols: Include ELF symbols in this oat file");
   UsageError("");
   UsageError("  --no-include-debug-symbols: Do not include ELF symbols in this oat file");
@@ -271,7 +277,7 @@
       LOG(ERROR) << "Failed to open image classes file " << image_classes_filename;
       return nullptr;
     }
-    std::unique_ptr<CompilerDriver::DescriptorSet> result(ReadImageClasses(*image_classes_file.get()));
+    std::unique_ptr<CompilerDriver::DescriptorSet> result(ReadImageClasses(*image_classes_file));
     image_classes_file->close();
     return result.release();
   }
@@ -510,16 +516,6 @@
   DISALLOW_IMPLICIT_CONSTRUCTORS(Dex2Oat);
 };
 
-static bool ParseInt(const char* in, int* out) {
-  char* end;
-  int result = strtol(in, &end, 10);
-  if (in == end || *end != '\0') {
-    return false;
-  }
-  *out = result;
-  return true;
-}
-
 static size_t OpenDexFiles(const std::vector<const char*>& dex_filenames,
                            const std::vector<const char*>& dex_locations,
                            std::vector<const DexFile*>& dex_files) {
@@ -827,6 +823,8 @@
   bool dump_stats = false;
   bool dump_timing = false;
   bool dump_passes = false;
+  bool include_patch_information = CompilerOptions::kDefaultIncludePatchInformation;
+  bool explicit_include_patch_information = false;
   bool include_debug_symbols = kIsDebugBuild;
   bool dump_slow_timing = kIsDebugBuild;
   bool watch_dog_enabled = !kIsTargetBuild;
@@ -1037,6 +1035,12 @@
         }
       }
       has_explicit_checks_options = true;
+    } else if (option == "--include-patch-information") {
+      include_patch_information = true;
+      explicit_include_patch_information = true;
+    } else if (option == "--no-include-patch-information") {
+      include_patch_information = false;
+      explicit_include_patch_information = true;
     } else {
       Usage("Unknown argument %s", option.data());
     }
@@ -1166,6 +1170,11 @@
   CheckExplicitCheckOptions(instruction_set, &explicit_null_checks, &explicit_so_checks,
                             &explicit_suspend_checks);
 
+  if (!explicit_include_patch_information) {
+    include_patch_information =
+        (compiler_kind == Compiler::kQuick && CompilerOptions::kDefaultIncludePatchInformation);
+  }
+
   CompilerOptions compiler_options(compiler_filter,
                                    huge_method_threshold,
                                    large_method_threshold,
@@ -1173,6 +1182,7 @@
                                    tiny_method_threshold,
                                    num_dex_methods_threshold,
                                    generate_gdb_information,
+                                   include_patch_information,
                                    top_k_profile_threshold,
                                    include_debug_symbols,
                                    explicit_null_checks,
diff --git a/disassembler/disassembler_x86.cc b/disassembler/disassembler_x86.cc
index 14a5b5f..e6cbf05 100644
--- a/disassembler/disassembler_x86.cc
+++ b/disassembler/disassembler_x86.cc
@@ -641,6 +641,21 @@
         store = true;
         immediate_bytes = 1;
         break;
+      case 0x7C:
+        if (prefix[0] == 0xF2) {
+          opcode << "haddps";
+          prefix[0] = 0;  // clear prefix now it's served its purpose as part of the opcode
+        } else if (prefix[2] == 0x66) {
+          opcode << "haddpd";
+          prefix[2] = 0;  // clear prefix now it's served its purpose as part of the opcode
+        } else {
+          opcode << StringPrintf("unknown opcode '0F %02X'", *instr);
+          break;
+        }
+        src_reg_file = dst_reg_file = SSE;
+        has_modrm = true;
+        load = true;
+        break;
       case 0x7E:
         if (prefix[2] == 0x66) {
           src_reg_file = SSE;
@@ -733,6 +748,18 @@
           opcode << StringPrintf("unknown opcode '0F %02X'", *instr);
         }
         break;
+      case 0xC6:
+        if (prefix[2] == 0x66) {
+          opcode << "shufpd";
+          prefix[2] = 0;
+        } else {
+          opcode << "shufps";
+        }
+        has_modrm = true;
+        store = true;
+        src_reg_file = dst_reg_file = SSE;
+        immediate_bytes = 1;
+        break;
       case 0xC7:
         static const char* x0FxC7_opcodes[] = { "unknown-0f-c7", "cmpxchg8b", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7", "unknown-0f-c7" };
         modrm_opcodes = x0FxC7_opcodes;
diff --git a/patchoat/Android.mk b/patchoat/Android.mk
new file mode 100644
index 0000000..8b6b9ad
--- /dev/null
+++ b/patchoat/Android.mk
@@ -0,0 +1,45 @@
+#
+# Copyright (C) 2014 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+include art/build/Android.executable.mk
+
+PATCHOAT_SRC_FILES := \
+	patchoat.cc
+
+# TODO: Remove this when the framework (installd) supports pushing the
+# right instruction-set parameter for the primary architecture.
+ifneq ($(filter ro.zygote=zygote64,$(PRODUCT_DEFAULT_PROPERTY_OVERRIDES)),)
+  patchoat_arch := 64
+else
+  patchoat_arch := 32
+endif
+
+ifeq ($(ART_BUILD_TARGET_NDEBUG),true)
+  $(eval $(call build-art-executable,patchoat,$(PATCHOAT_SRC_FILES),libcutils,art/compiler,target,ndebug,$(patchoat_arch)))
+endif
+ifeq ($(ART_BUILD_TARGET_DEBUG),true)
+  $(eval $(call build-art-executable,patchoat,$(PATCHOAT_SRC_FILES),libcutils,art/compiler,target,debug,$(patchoat_arch)))
+endif
+
+# We always build patchoat and dependencies, even if the host build is otherwise disabled, since they are used to cross compile for the target.
+ifeq ($(ART_BUILD_NDEBUG),true)
+  $(eval $(call build-art-executable,patchoat,$(PATCHOAT_SRC_FILES),,art/compiler,host,ndebug))
+endif
+ifeq ($(ART_BUILD_DEBUG),true)
+  $(eval $(call build-art-executable,patchoat,$(PATCHOAT_SRC_FILES),,art/compiler,host,debug))
+endif
diff --git a/patchoat/patchoat.cc b/patchoat/patchoat.cc
new file mode 100644
index 0000000..ea4b880
--- /dev/null
+++ b/patchoat/patchoat.cc
@@ -0,0 +1,1020 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "patchoat.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/stat.h>
+
+#include <string>
+#include <vector>
+
+#include "base/stringpiece.h"
+#include "base/stringprintf.h"
+#include "elf_utils.h"
+#include "elf_file.h"
+#include "image.h"
+#include "instruction_set.h"
+#include "mirror/art_field.h"
+#include "mirror/art_field-inl.h"
+#include "mirror/art_method.h"
+#include "mirror/art_method-inl.h"
+#include "mirror/object.h"
+#include "mirror/object-inl.h"
+#include "mirror/reference.h"
+#include "noop_compiler_callbacks.h"
+#include "offsets.h"
+#include "os.h"
+#include "runtime.h"
+#include "scoped_thread_state_change.h"
+#include "thread.h"
+#include "utils.h"
+
+namespace art {
+
+static InstructionSet ElfISAToInstructionSet(Elf32_Word isa) {
+  switch (isa) {
+    case EM_ARM:
+      return kArm;
+    case EM_AARCH64:
+      return kArm64;
+    case EM_386:
+      return kX86;
+    case EM_X86_64:
+      return kX86_64;
+    case EM_MIPS:
+      return kMips;
+    default:
+      return kNone;
+  }
+}
+
+bool PatchOat::Patch(const std::string& image_location, off_t delta,
+                     File* output_image, InstructionSet isa,
+                     TimingLogger& timings) {
+  std::string error_msg;
+  CHECK(Runtime::Current() == nullptr);
+  CHECK(output_image != nullptr);
+  CHECK_GE(output_image->Fd(), 0);
+  CHECK(!image_location.empty()) << "image file must have a filename.";
+  CHECK_NE(isa, kNone);
+
+  TimingLogger::ScopedTiming t("Runtime Setup", &timings);
+  const char *isa_name = GetInstructionSetString(isa);
+  std::string image_filename(GetSystemImageFilename(image_location.c_str(), isa));
+  std::unique_ptr<File> input_image(OS::OpenFileForReading(image_filename.c_str()));
+  if (input_image.get() == nullptr) {
+    LOG(ERROR) << "unable to open input image file.";
+    return false;
+  }
+  int64_t image_len = input_image->GetLength();
+  if (image_len < 0) {
+    LOG(ERROR) << "Error while getting image length";
+    return false;
+  }
+  ImageHeader image_header;
+  if (sizeof(image_header) != input_image->Read(reinterpret_cast<char*>(&image_header),
+                                              sizeof(image_header), 0)) {
+    LOG(ERROR) << "Unable to read image header from image file " << input_image->GetPath();
+    return false;
+  }
+
+  // Set up the runtime
+  Runtime::Options options;
+  NoopCompilerCallbacks callbacks;
+  options.push_back(std::make_pair("compilercallbacks", &callbacks));
+  std::string img = "-Ximage:" + image_location;
+  options.push_back(std::make_pair(img.c_str(), nullptr));
+  options.push_back(std::make_pair("imageinstructionset", reinterpret_cast<const void*>(isa_name)));
+  if (!Runtime::Create(options, false)) {
+    LOG(ERROR) << "Unable to initialize runtime";
+    return false;
+  }
+  // Runtime::Create acquired the mutator_lock_ that is normally given away when we Runtime::Start,
+  // give it away now and then switch to a more manageable ScopedObjectAccess.
+  Thread::Current()->TransitionFromRunnableToSuspended(kNative);
+  ScopedObjectAccess soa(Thread::Current());
+
+  t.NewTiming("Image and oat Patching setup");
+  // Create the map where we will write the image patches to.
+  std::unique_ptr<MemMap> image(MemMap::MapFile(image_len, PROT_READ | PROT_WRITE, MAP_PRIVATE,
+                                                input_image->Fd(), 0,
+                                                input_image->GetPath().c_str(),
+                                                &error_msg));
+  if (image.get() == nullptr) {
+    LOG(ERROR) << "unable to map image file " << input_image->GetPath() << " : " << error_msg;
+    return false;
+  }
+  gc::space::ImageSpace* ispc = Runtime::Current()->GetHeap()->GetImageSpace();
+
+  PatchOat p(image.release(), ispc->GetLiveBitmap(), ispc->GetMemMap(),
+             delta, timings);
+  t.NewTiming("Patching files");
+  if (!p.PatchImage()) {
+    LOG(INFO) << "Failed to patch image file " << input_image->GetPath();
+    return false;
+  }
+
+  t.NewTiming("Writing files");
+  if (!p.WriteImage(output_image)) {
+    return false;
+  }
+  return true;
+}
+
+bool PatchOat::Patch(const File* input_oat, const std::string& image_location, off_t delta,
+                     File* output_oat, File* output_image, InstructionSet isa,
+                     TimingLogger& timings) {
+  std::string error_msg;
+  CHECK(Runtime::Current() == nullptr);
+  CHECK(output_image != nullptr);
+  CHECK_GE(output_image->Fd(), 0);
+  CHECK(input_oat != nullptr);
+  CHECK(output_oat != nullptr);
+  CHECK_GE(input_oat->Fd(), 0);
+  CHECK_GE(output_oat->Fd(), 0);
+  CHECK(!image_location.empty()) << "image file must have a filename.";
+
+  TimingLogger::ScopedTiming t("Runtime Setup", &timings);
+
+  if (isa == kNone) {
+    Elf32_Ehdr elf_hdr;
+    if (sizeof(elf_hdr) != input_oat->Read(reinterpret_cast<char*>(&elf_hdr), sizeof(elf_hdr), 0)) {
+      LOG(ERROR) << "unable to read elf header";
+      return false;
+    }
+    isa = ElfISAToInstructionSet(elf_hdr.e_machine);
+  }
+  const char* isa_name = GetInstructionSetString(isa);
+  std::string image_filename(GetSystemImageFilename(image_location.c_str(), isa));
+  std::unique_ptr<File> input_image(OS::OpenFileForReading(image_filename.c_str()));
+  if (input_image.get() == nullptr) {
+    LOG(ERROR) << "unable to open input image file.";
+    return false;
+  }
+  int64_t image_len = input_image->GetLength();
+  if (image_len < 0) {
+    LOG(ERROR) << "Error while getting image length";
+    return false;
+  }
+  ImageHeader image_header;
+  if (sizeof(image_header) != input_image->Read(reinterpret_cast<char*>(&image_header),
+                                              sizeof(image_header), 0)) {
+    LOG(ERROR) << "Unable to read image header from image file " << input_image->GetPath();
+  }
+
+  // Set up the runtime
+  Runtime::Options options;
+  NoopCompilerCallbacks callbacks;
+  options.push_back(std::make_pair("compilercallbacks", &callbacks));
+  std::string img = "-Ximage:" + image_location;
+  options.push_back(std::make_pair(img.c_str(), nullptr));
+  options.push_back(std::make_pair("imageinstructionset", reinterpret_cast<const void*>(isa_name)));
+  if (!Runtime::Create(options, false)) {
+    LOG(ERROR) << "Unable to initialize runtime";
+    return false;
+  }
+  // Runtime::Create acquired the mutator_lock_ that is normally given away when we Runtime::Start,
+  // give it away now and then switch to a more manageable ScopedObjectAccess.
+  Thread::Current()->TransitionFromRunnableToSuspended(kNative);
+  ScopedObjectAccess soa(Thread::Current());
+
+  t.NewTiming("Image and oat Patching setup");
+  // Create the map where we will write the image patches to.
+  std::unique_ptr<MemMap> image(MemMap::MapFile(image_len, PROT_READ | PROT_WRITE, MAP_PRIVATE,
+                                                input_image->Fd(), 0,
+                                                input_image->GetPath().c_str(),
+                                                &error_msg));
+  if (image.get() == nullptr) {
+    LOG(ERROR) << "unable to map image file " << input_image->GetPath() << " : " << error_msg;
+    return false;
+  }
+  gc::space::ImageSpace* ispc = Runtime::Current()->GetHeap()->GetImageSpace();
+
+  std::unique_ptr<ElfFile> elf(ElfFile::Open(const_cast<File*>(input_oat),
+                                             PROT_READ | PROT_WRITE, MAP_PRIVATE, &error_msg));
+  if (elf.get() == nullptr) {
+    LOG(ERROR) << "unable to open oat file " << input_oat->GetPath() << " : " << error_msg;
+    return false;
+  }
+
+  PatchOat p(elf.release(), image.release(), ispc->GetLiveBitmap(), ispc->GetMemMap(),
+             delta, timings);
+  t.NewTiming("Patching files");
+  if (!p.PatchElf()) {
+    LOG(INFO) << "Failed to patch oat file " << input_oat->GetPath();
+    return false;
+  }
+  if (!p.PatchImage()) {
+    LOG(INFO) << "Failed to patch image file " << input_image->GetPath();
+    return false;
+  }
+
+  t.NewTiming("Writing files");
+  if (!p.WriteElf(output_oat)) {
+    return false;
+  }
+  if (!p.WriteImage(output_image)) {
+    return false;
+  }
+  return true;
+}
+
+bool PatchOat::WriteElf(File* out) {
+  TimingLogger::ScopedTiming t("Writing Elf File", &timings_);
+  CHECK(oat_file_.get() != nullptr);
+  CHECK(out != nullptr);
+  size_t expect = oat_file_->Size();
+  if (out->WriteFully(reinterpret_cast<char*>(oat_file_->Begin()), expect) &&
+      out->SetLength(expect) == 0) {
+    return true;
+  } else {
+    LOG(ERROR) << "Writing to oat file " << out->GetPath() << " failed.";
+    return false;
+  }
+}
+
+bool PatchOat::WriteImage(File* out) {
+  TimingLogger::ScopedTiming t("Writing image File", &timings_);
+  CHECK(image_ != nullptr);
+  CHECK(out != nullptr);
+  size_t expect = image_->Size();
+  if (out->WriteFully(reinterpret_cast<char*>(image_->Begin()), expect) &&
+      out->SetLength(expect) == 0) {
+    return true;
+  } else {
+    LOG(ERROR) << "Writing to image file " << out->GetPath() << " failed.";
+    return false;
+  }
+}
+
+bool PatchOat::PatchImage() {
+  ImageHeader* image_header = reinterpret_cast<ImageHeader*>(image_->Begin());
+  CHECK_GT(image_->Size(), sizeof(ImageHeader));
+  // These are the roots from the original file.
+  mirror::Object* img_roots = image_header->GetImageRoots();
+  image_header->RelocateImage(delta_);
+
+  VisitObject(img_roots);
+  if (!image_header->IsValid()) {
+    LOG(ERROR) << "reloction renders image header invalid";
+    return false;
+  }
+
+  {
+    TimingLogger::ScopedTiming t("Walk Bitmap", &timings_);
+    // Walk the bitmap.
+    WriterMutexLock mu(Thread::Current(), *Locks::heap_bitmap_lock_);
+    bitmap_->Walk(PatchOat::BitmapCallback, this);
+  }
+  return true;
+}
+
+bool PatchOat::InHeap(mirror::Object* o) {
+  uintptr_t begin = reinterpret_cast<uintptr_t>(heap_->Begin());
+  uintptr_t end = reinterpret_cast<uintptr_t>(heap_->End());
+  uintptr_t obj = reinterpret_cast<uintptr_t>(o);
+  return o == nullptr || (begin <= obj && obj < end);
+}
+
+void PatchOat::PatchVisitor::operator() (mirror::Object* obj, MemberOffset off,
+                                         bool is_static_unused) const {
+  mirror::Object* referent = obj->GetFieldObject<mirror::Object, kVerifyNone>(off);
+  DCHECK(patcher_->InHeap(referent)) << "Referent is not in the heap.";
+  mirror::Object* moved_object = patcher_->RelocatedAddressOf(referent);
+  copy_->SetFieldObjectWithoutWriteBarrier<false, true, kVerifyNone>(off, moved_object);
+}
+
+void PatchOat::PatchVisitor::operator() (mirror::Class* cls, mirror::Reference* ref) const {
+  MemberOffset off = mirror::Reference::ReferentOffset();
+  mirror::Object* referent = ref->GetReferent();
+  DCHECK(patcher_->InHeap(referent)) << "Referent is not in the heap.";
+  mirror::Object* moved_object = patcher_->RelocatedAddressOf(referent);
+  copy_->SetFieldObjectWithoutWriteBarrier<false, true, kVerifyNone>(off, moved_object);
+}
+
+mirror::Object* PatchOat::RelocatedCopyOf(mirror::Object* obj) {
+  if (obj == nullptr) {
+    return nullptr;
+  }
+  DCHECK_GT(reinterpret_cast<uintptr_t>(obj), reinterpret_cast<uintptr_t>(heap_->Begin()));
+  DCHECK_LT(reinterpret_cast<uintptr_t>(obj), reinterpret_cast<uintptr_t>(heap_->End()));
+  uintptr_t heap_off =
+      reinterpret_cast<uintptr_t>(obj) - reinterpret_cast<uintptr_t>(heap_->Begin());
+  DCHECK_LT(heap_off, image_->Size());
+  return reinterpret_cast<mirror::Object*>(image_->Begin() + heap_off);
+}
+
+mirror::Object* PatchOat::RelocatedAddressOf(mirror::Object* obj) {
+  if (obj == nullptr) {
+    return nullptr;
+  } else {
+    return reinterpret_cast<mirror::Object*>(reinterpret_cast<byte*>(obj) + delta_);
+  }
+}
+
+// Called by BitmapCallback
+void PatchOat::VisitObject(mirror::Object* object) {
+  mirror::Object* copy = RelocatedCopyOf(object);
+  CHECK(copy != nullptr);
+  if (kUseBakerOrBrooksReadBarrier) {
+    object->AssertReadBarrierPointer();
+    if (kUseBrooksReadBarrier) {
+      mirror::Object* moved_to = RelocatedAddressOf(object);
+      copy->SetReadBarrierPointer(moved_to);
+      DCHECK_EQ(copy->GetReadBarrierPointer(), moved_to);
+    }
+  }
+  PatchOat::PatchVisitor visitor(this, copy);
+  object->VisitReferences<true, kVerifyNone>(visitor, visitor);
+  if (object->IsArtMethod<kVerifyNone>()) {
+    FixupMethod(static_cast<mirror::ArtMethod*>(object),
+                static_cast<mirror::ArtMethod*>(copy));
+  }
+}
+
+void PatchOat::FixupMethod(mirror::ArtMethod* object, mirror::ArtMethod* copy) {
+  // Just update the entry points if it looks like we should.
+  // TODO sanity check all the pointers' values
+  uintptr_t portable = reinterpret_cast<uintptr_t>(
+      object->GetEntryPointFromPortableCompiledCode<kVerifyNone>());
+  if (portable != 0) {
+    copy->SetEntryPointFromPortableCompiledCode(reinterpret_cast<void*>(portable + delta_));
+  }
+  uintptr_t quick= reinterpret_cast<uintptr_t>(
+      object->GetEntryPointFromQuickCompiledCode<kVerifyNone>());
+  if (quick != 0) {
+    copy->SetEntryPointFromQuickCompiledCode(reinterpret_cast<void*>(quick + delta_));
+  }
+  uintptr_t interpreter = reinterpret_cast<uintptr_t>(
+      object->GetEntryPointFromInterpreter<kVerifyNone>());
+  if (interpreter != 0) {
+    copy->SetEntryPointFromInterpreter(
+        reinterpret_cast<mirror::EntryPointFromInterpreter*>(interpreter + delta_));
+  }
+
+  uintptr_t native_method = reinterpret_cast<uintptr_t>(object->GetNativeMethod());
+  if (native_method != 0) {
+    copy->SetNativeMethod(reinterpret_cast<void*>(native_method + delta_));
+  }
+
+  uintptr_t native_gc_map = reinterpret_cast<uintptr_t>(object->GetNativeGcMap());
+  if (native_gc_map != 0) {
+    copy->SetNativeGcMap(reinterpret_cast<uint8_t*>(native_gc_map + delta_));
+  }
+}
+
+bool PatchOat::Patch(File* input_oat, off_t delta, File* output_oat, TimingLogger& timings) {
+  CHECK(input_oat != nullptr);
+  CHECK(output_oat != nullptr);
+  CHECK_GE(input_oat->Fd(), 0);
+  CHECK_GE(output_oat->Fd(), 0);
+  TimingLogger::ScopedTiming t("Setup Oat File Patching", &timings);
+
+  std::string error_msg;
+  std::unique_ptr<ElfFile> elf(ElfFile::Open(const_cast<File*>(input_oat),
+                                             PROT_READ | PROT_WRITE, MAP_PRIVATE, &error_msg));
+  if (elf.get() == nullptr) {
+    LOG(ERROR) << "unable to open oat file " << input_oat->GetPath() << " : " << error_msg;
+    return false;
+  }
+
+  PatchOat p(elf.release(), delta, timings);
+  t.NewTiming("Patch Oat file");
+  if (!p.PatchElf()) {
+    return false;
+  }
+
+  t.NewTiming("Writing oat file");
+  if (!p.WriteElf(output_oat)) {
+    return false;
+  }
+  return true;
+}
+
+bool PatchOat::CheckOatFile() {
+  Elf32_Shdr* patches_sec = oat_file_->FindSectionByName(".oat_patches");
+  if (patches_sec == nullptr) {
+    return false;
+  }
+  if (patches_sec->sh_type != SHT_OAT_PATCH) {
+    return false;
+  }
+  uintptr_t* patches = reinterpret_cast<uintptr_t*>(oat_file_->Begin() + patches_sec->sh_offset);
+  uintptr_t* patches_end = patches + (patches_sec->sh_size/sizeof(uintptr_t));
+  Elf32_Shdr* oat_data_sec = oat_file_->FindSectionByName(".rodata");
+  Elf32_Shdr* oat_text_sec = oat_file_->FindSectionByName(".text");
+  if (oat_data_sec == nullptr) {
+    return false;
+  }
+  if (oat_text_sec == nullptr) {
+    return false;
+  }
+  if (oat_text_sec->sh_offset <= oat_data_sec->sh_offset) {
+    return false;
+  }
+
+  for (; patches < patches_end; patches++) {
+    if (oat_text_sec->sh_size <= *patches) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+bool PatchOat::PatchElf() {
+  TimingLogger::ScopedTiming t("Fixup Elf Headers", &timings_);
+  // Fixup Phdr's
+  for (unsigned int i = 0; i < oat_file_->GetProgramHeaderNum(); i++) {
+    Elf32_Phdr& hdr = oat_file_->GetProgramHeader(i);
+    if (hdr.p_vaddr != 0) {
+      hdr.p_vaddr += delta_;
+    }
+    if (hdr.p_paddr != 0) {
+      hdr.p_paddr += delta_;
+    }
+  }
+  // Fixup Shdr's
+  for (unsigned int i = 0; i < oat_file_->GetSectionHeaderNum(); i++) {
+    Elf32_Shdr& hdr = oat_file_->GetSectionHeader(i);
+    if (hdr.sh_addr != 0) {
+      hdr.sh_addr += delta_;
+    }
+  }
+
+  // Fixup Dynamics.
+  for (Elf32_Word i = 0; i < oat_file_->GetDynamicNum(); i++) {
+    Elf32_Dyn& dyn = oat_file_->GetDynamic(i);
+    if (IsDynamicSectionPointer(dyn.d_tag, oat_file_->GetHeader().e_machine)) {
+      dyn.d_un.d_ptr += delta_;
+    }
+  }
+
+  t.NewTiming("Fixup Elf Symbols");
+  // Fixup dynsym
+  Elf32_Shdr* dynsym_sec = oat_file_->FindSectionByName(".dynsym");
+  CHECK(dynsym_sec != nullptr);
+  if (!PatchSymbols(dynsym_sec)) {
+    return false;
+  }
+
+  // Fixup symtab
+  Elf32_Shdr* symtab_sec = oat_file_->FindSectionByName(".symtab");
+  if (symtab_sec != nullptr) {
+    if (!PatchSymbols(symtab_sec)) {
+      return false;
+    }
+  }
+
+  t.NewTiming("Fixup Elf Text Section");
+  // Fixup text
+  if (!PatchTextSection()) {
+    return false;
+  }
+
+  return true;
+}
+
+bool PatchOat::PatchSymbols(Elf32_Shdr* section) {
+  Elf32_Sym* syms = reinterpret_cast<Elf32_Sym*>(oat_file_->Begin() + section->sh_offset);
+  const Elf32_Sym* last_sym =
+      reinterpret_cast<Elf32_Sym*>(oat_file_->Begin() + section->sh_offset + section->sh_size);
+  CHECK_EQ(section->sh_size % sizeof(Elf32_Sym), 0u)
+      << "Symtab section size is not multiple of symbol size";
+  for (; syms < last_sym; syms++) {
+    uint8_t sttype = ELF32_ST_TYPE(syms->st_info);
+    Elf32_Word shndx = syms->st_shndx;
+    if (shndx != SHN_ABS && shndx != SHN_COMMON && shndx != SHN_UNDEF &&
+        (sttype == STT_FUNC || sttype == STT_OBJECT)) {
+      CHECK_NE(syms->st_value, 0u);
+      syms->st_value += delta_;
+    }
+  }
+  return true;
+}
+
+bool PatchOat::PatchTextSection() {
+  Elf32_Shdr* patches_sec = oat_file_->FindSectionByName(".oat_patches");
+  if (patches_sec == nullptr) {
+    LOG(INFO) << ".oat_patches section not found. Aborting patch";
+    return false;
+  }
+  DCHECK(CheckOatFile()) << "Oat file invalid";
+  CHECK_EQ(patches_sec->sh_type, SHT_OAT_PATCH) << "Unexpected type of .oat_patches";
+  uintptr_t* patches = reinterpret_cast<uintptr_t*>(oat_file_->Begin() + patches_sec->sh_offset);
+  uintptr_t* patches_end = patches + (patches_sec->sh_size/sizeof(uintptr_t));
+  Elf32_Shdr* oat_text_sec = oat_file_->FindSectionByName(".text");
+  CHECK(oat_text_sec != nullptr);
+  byte* to_patch = oat_file_->Begin() + oat_text_sec->sh_offset;
+  uintptr_t to_patch_end = reinterpret_cast<uintptr_t>(to_patch) + oat_text_sec->sh_size;
+
+  for (; patches < patches_end; patches++) {
+    CHECK_LT(*patches, oat_text_sec->sh_size) << "Bad Patch";
+    uint32_t* patch_loc = reinterpret_cast<uint32_t*>(to_patch + *patches);
+    CHECK_LT(reinterpret_cast<uintptr_t>(patch_loc), to_patch_end);
+    *patch_loc += delta_;
+  }
+
+  return true;
+}
+
+static int orig_argc;
+static char** orig_argv;
+
+static std::string CommandLine() {
+  std::vector<std::string> command;
+  for (int i = 0; i < orig_argc; ++i) {
+    command.push_back(orig_argv[i]);
+  }
+  return Join(command, ' ');
+}
+
+static void UsageErrorV(const char* fmt, va_list ap) {
+  std::string error;
+  StringAppendV(&error, fmt, ap);
+  LOG(ERROR) << error;
+}
+
+static void UsageError(const char* fmt, ...) {
+  va_list ap;
+  va_start(ap, fmt);
+  UsageErrorV(fmt, ap);
+  va_end(ap);
+}
+
+static void Usage(const char *fmt, ...) {
+  va_list ap;
+  va_start(ap, fmt);
+  UsageErrorV(fmt, ap);
+  va_end(ap);
+
+  UsageError("Command: %s", CommandLine().c_str());
+  UsageError("Usage: patchoat [options]...");
+  UsageError("");
+  UsageError("  --instruction-set=<isa>: Specifies the instruction set the patched code is");
+  UsageError("      compiled for. Required if you use --input-oat-location");
+  UsageError("");
+  UsageError("  --input-oat-file=<file.oat>: Specifies the exact filename of the oat file to be");
+  UsageError("      patched.");
+  UsageError("");
+  UsageError("  --input-oat-fd=<file-descriptor>: Specifies the file-descriptor of the oat file");
+  UsageError("      to be patched.");
+  UsageError("");
+  UsageError("  --input-oat-location=<file.oat>: Specifies the 'location' to read the patched");
+  UsageError("      oat file from. If used one must also supply the --instruction-set");
+  UsageError("");
+  UsageError("  --input-image-location=<file.art>: Specifies the 'location' of the image file to");
+  UsageError("      be patched. If --instruction-set is not given it will use the instruction set");
+  UsageError("      extracted from the --input-oat-file.");
+  UsageError("");
+  UsageError("  --output-oat-file=<file.oat>: Specifies the exact file to write the patched oat");
+  UsageError("      file to.");
+  UsageError("");
+  UsageError("  --output-oat-location=<file.oat>: Specifies the 'location' to write the patched");
+  UsageError("      oat file to. If used one must also specify the --instruction-set");
+  UsageError("");
+  UsageError("  --output-oat-fd=<file-descriptor>: Specifies the file-descriptor to write the");
+  UsageError("      the patched oat file to.");
+  UsageError("");
+  UsageError("  --output-image-file=<file.art>: Specifies the exact file to write the patched");
+  UsageError("      image file to.");
+  UsageError("");
+  UsageError("  --output-image-fd=<file-descriptor>: Specifies the file-descriptor to write the");
+  UsageError("      the patched image file to.");
+  UsageError("");
+  UsageError("  --output-image-location=<file.art>: Specifies the 'location' to write the patched");
+  UsageError("      image file to. If used one must also specify the --instruction-set");
+  UsageError("");
+  UsageError("  --orig-base-offset=<original-base-offset>: Specify the base offset the input file");
+  UsageError("      was compiled with. This is needed if one is specifying a --base-offset");
+  UsageError("");
+  UsageError("  --base-offset=<new-base-offset>: Specify the base offset we will repatch the");
+  UsageError("      given files to use. This requires that --orig-base-offset is also given.");
+  UsageError("");
+  UsageError("  --base-offset-delta=<delta>: Specify the amount to change the old base-offset by.");
+  UsageError("      This value may be negative.");
+  UsageError("");
+  UsageError("  --patched-image-file=<file.art>: Use the same patch delta as was used to patch");
+  UsageError("      the given image file.");
+  UsageError("");
+  UsageError("  --patched-image-location=<file.art>: Use the same patch delta as was used to");
+  UsageError("      patch the given image location. If used one must also specify the");
+  UsageError("      --instruction-set flag.");
+  UsageError("");
+  UsageError("  --dump-timings: dump out patch timing information");
+  UsageError("");
+  UsageError("  --no-dump-timings: do not dump out patch timing information");
+  UsageError("");
+
+  exit(EXIT_FAILURE);
+}
+
+static bool ReadBaseDelta(const char* name, off_t* delta, std::string& error_msg) {
+  CHECK(name != nullptr);
+  CHECK(delta != nullptr);
+  std::unique_ptr<File> file;
+  if (OS::FileExists(name)) {
+    file.reset(OS::OpenFileForReading(name));
+    if (file.get() == nullptr) {
+      error_msg = "Failed to open file %s for reading";
+      return false;
+    }
+  } else {
+    error_msg = "File %s does not exist";
+    return false;
+  }
+  CHECK(file.get() != nullptr);
+  ImageHeader hdr;
+  if (sizeof(hdr) != file->Read(reinterpret_cast<char*>(&hdr), sizeof(hdr), 0)) {
+    error_msg = "Failed to read file %s";
+    return false;
+  }
+  if (!hdr.IsValid()) {
+    error_msg = "%s does not contain a valid image header.";
+    return false;
+  }
+  *delta = hdr.GetPatchDelta();
+  return true;
+}
+
+static File* CreateOrOpen(const char* name, bool* created) {
+  if (OS::FileExists(name)) {
+    *created = false;
+    return OS::OpenFileReadWrite(name);
+  } else {
+    *created = true;
+    return OS::CreateEmptyFile(name);
+  }
+}
+
+int patchoat(int argc, char **argv) {
+  InitLogging(argv);
+  const bool debug = kIsDebugBuild;
+  orig_argc = argc;
+  orig_argv = argv;
+  TimingLogger timings("patcher", false, false);
+
+  InitLogging(argv);
+
+  // Skip over the command name.
+  argv++;
+  argc--;
+
+  if (argc == 0) {
+    Usage("No arguments specified");
+  }
+
+  timings.StartTiming("Patchoat");
+
+  // cmd line args
+  bool isa_set = false;
+  InstructionSet isa = kNone;
+  std::string input_oat_filename;
+  std::string input_oat_location;
+  int input_oat_fd = -1;
+  bool have_input_oat = false;
+  std::string input_image_location;
+  std::string output_oat_filename;
+  std::string output_oat_location;
+  int output_oat_fd = -1;
+  bool have_output_oat = false;
+  std::string output_image_filename;
+  std::string output_image_location;
+  int output_image_fd = -1;
+  bool have_output_image = false;
+  uintptr_t base_offset = 0;
+  bool base_offset_set = false;
+  uintptr_t orig_base_offset = 0;
+  bool orig_base_offset_set = false;
+  off_t base_delta = 0;
+  bool base_delta_set = false;
+  std::string patched_image_filename;
+  std::string patched_image_location;
+  bool dump_timings = kIsDebugBuild;
+
+  for (int i = 0; i < argc; i++) {
+    const StringPiece option(argv[i]);
+    const bool log_options = false;
+    if (log_options) {
+      LOG(INFO) << "patchoat: option[" << i << "]=" << argv[i];
+    }
+    // TODO GetInstructionSetFromString shouldn't LOG(FATAL).
+    if (option.starts_with("--instruction-set=")) {
+      isa_set = true;
+      const char* isa_str = option.substr(strlen("--instruction-set=")).data();
+      if (!strcmp("arm", isa_str)) {
+        isa = kArm;
+      } else if (!strcmp("arm64", isa_str)) {
+        isa = kArm64;
+      } else if (!strcmp("x86", isa_str)) {
+        isa = kX86;
+      } else if (!strcmp("x86_64", isa_str)) {
+        isa = kX86_64;
+      } else if (!strcmp("mips", isa_str)) {
+        isa = kMips;
+      } else {
+        Usage("Unknown instruction set %s", isa_str);
+      }
+    } else if (option.starts_with("--input-oat-location=")) {
+      if (have_input_oat) {
+        Usage("Only one of --input-oat-file, --input-oat-location and --input-oat-fd may be used.");
+      }
+      have_input_oat = true;
+      input_oat_location = option.substr(strlen("--input-oat-location=")).data();
+    } else if (option.starts_with("--input-oat-file=")) {
+      if (have_input_oat) {
+        Usage("Only one of --input-oat-file, --input-oat-location and --input-oat-fd may be used.");
+      }
+      have_input_oat = true;
+      input_oat_filename = option.substr(strlen("--input-oat-file=")).data();
+    } else if (option.starts_with("--input-oat-fd=")) {
+      if (have_input_oat) {
+        Usage("Only one of --input-oat-file, --input-oat-location and --input-oat-fd may be used.");
+      }
+      have_input_oat = true;
+      const char* oat_fd_str = option.substr(strlen("--input-oat-fd=")).data();
+      if (!ParseInt(oat_fd_str, &input_oat_fd)) {
+        Usage("Failed to parse --input-oat-fd argument '%s' as an integer", oat_fd_str);
+      }
+      if (input_oat_fd < 0) {
+        Usage("--input-oat-fd pass a negative value %d", input_oat_fd);
+      }
+    } else if (option.starts_with("--input-image-location=")) {
+      input_image_location = option.substr(strlen("--input-image-location=")).data();
+    } else if (option.starts_with("--output-oat-location=")) {
+      if (have_output_oat) {
+        Usage("Only one of --output-oat-file, --output-oat-location and --output-oat-fd may "
+              "be used.");
+      }
+      have_output_oat = true;
+      output_oat_location = option.substr(strlen("--output-oat-location=")).data();
+    } else if (option.starts_with("--output-oat-file=")) {
+      if (have_output_oat) {
+        Usage("Only one of --output-oat-file, --output-oat-location and --output-oat-fd may "
+              "be used.");
+      }
+      have_output_oat = true;
+      output_oat_filename = option.substr(strlen("--output-oat-file=")).data();
+    } else if (option.starts_with("--output-oat-fd=")) {
+      if (have_output_oat) {
+        Usage("Only one of --output-oat-file, --output-oat-location and --output-oat-fd may "
+              "be used.");
+      }
+      have_output_oat = true;
+      const char* oat_fd_str = option.substr(strlen("--output-oat-fd=")).data();
+      if (!ParseInt(oat_fd_str, &output_oat_fd)) {
+        Usage("Failed to parse --output-oat-fd argument '%s' as an integer", oat_fd_str);
+      }
+      if (output_oat_fd < 0) {
+        Usage("--output-oat-fd pass a negative value %d", output_oat_fd);
+      }
+    } else if (option.starts_with("--output-image-location=")) {
+      if (have_output_image) {
+        Usage("Only one of --output-image-file, --output-image-location and --output-image-fd may "
+              "be used.");
+      }
+      have_output_image = true;
+      output_image_location= option.substr(strlen("--output-image-location=")).data();
+    } else if (option.starts_with("--output-image-file=")) {
+      if (have_output_image) {
+        Usage("Only one of --output-image-file, --output-image-location and --output-image-fd may "
+              "be used.");
+      }
+      have_output_image = true;
+      output_image_filename = option.substr(strlen("--output-image-file=")).data();
+    } else if (option.starts_with("--output-image-fd=")) {
+      if (have_output_image) {
+        Usage("Only one of --output-image-file, --output-image-location and --output-image-fd "
+              "may be used.");
+      }
+      have_output_image = true;
+      const char* image_fd_str = option.substr(strlen("--output-image-fd=")).data();
+      if (!ParseInt(image_fd_str, &output_image_fd)) {
+        Usage("Failed to parse --output-image-fd argument '%s' as an integer", image_fd_str);
+      }
+      if (output_image_fd < 0) {
+        Usage("--output-image-fd pass a negative value %d", output_image_fd);
+      }
+    } else if (option.starts_with("--orig-base-offset=")) {
+      const char* orig_base_offset_str = option.substr(strlen("--orig-base-offset=")).data();
+      orig_base_offset_set = true;
+      if (!ParseUint(orig_base_offset_str, &orig_base_offset)) {
+        Usage("Failed to parse --orig-base-offset argument '%s' as an uintptr_t",
+              orig_base_offset_str);
+      }
+    } else if (option.starts_with("--base-offset=")) {
+      const char* base_offset_str = option.substr(strlen("--base-offset=")).data();
+      base_offset_set = true;
+      if (!ParseUint(base_offset_str, &base_offset)) {
+        Usage("Failed to parse --base-offset argument '%s' as an uintptr_t", base_offset_str);
+      }
+    } else if (option.starts_with("--base-offset-delta=")) {
+      const char* base_delta_str = option.substr(strlen("--base-offset-delta=")).data();
+      base_delta_set = true;
+      if (!ParseInt(base_delta_str, &base_delta)) {
+        Usage("Failed to parse --base-offset-delta argument '%s' as an off_t", base_delta_str);
+      }
+    } else if (option.starts_with("--patched-image-location=")) {
+      patched_image_location = option.substr(strlen("--patched-image-location=")).data();
+    } else if (option.starts_with("--patched-image-file=")) {
+      patched_image_filename = option.substr(strlen("--patched-image-file=")).data();
+    } else if (option == "--dump-timings") {
+      dump_timings = true;
+    } else if (option == "--no-dump-timings") {
+      dump_timings = false;
+    } else {
+      Usage("Unknown argument %s", option.data());
+    }
+  }
+
+  {
+    // Only 1 of these may be set.
+    uint32_t cnt = 0;
+    cnt += (base_delta_set) ? 1 : 0;
+    cnt += (base_offset_set && orig_base_offset_set) ? 1 : 0;
+    cnt += (!patched_image_filename.empty()) ? 1 : 0;
+    cnt += (!patched_image_location.empty()) ? 1 : 0;
+    if (cnt > 1) {
+      Usage("Only one of --base-offset/--orig-base-offset, --base-offset-delta, "
+            "--patched-image-filename or --patched-image-location may be used.");
+    } else if (cnt == 0) {
+      Usage("Must specify --base-offset-delta, --base-offset and --orig-base-offset, "
+            "--patched-image-location or --patched-image-file");
+    }
+  }
+
+  if (have_input_oat != have_output_oat) {
+    Usage("Either both input and output oat must be supplied or niether must be.");
+  }
+
+  if ((!input_image_location.empty()) != have_output_image) {
+    Usage("Either both input and output image must be supplied or niether must be.");
+  }
+
+  // We know we have both the input and output so rename for clarity.
+  bool have_image_files = have_output_image;
+  bool have_oat_files = have_output_oat;
+
+  if (!have_oat_files && !have_image_files) {
+    Usage("Must be patching either an oat or an image file or both.");
+  }
+
+  if (!have_oat_files && !isa_set) {
+    Usage("Must include ISA if patching an image file without an oat file.");
+  }
+
+  if (!input_oat_location.empty()) {
+    if (!isa_set) {
+      Usage("specifying a location requires specifying an instruction set");
+    }
+    input_oat_filename = GetSystemImageFilename(input_oat_location.c_str(), isa);
+    if (debug) {
+      LOG(INFO) << "Using input-oat-file " << input_oat_filename;
+    }
+  }
+  if (!output_oat_location.empty()) {
+    if (!isa_set) {
+      Usage("specifying a location requires specifying an instruction set");
+    }
+    output_oat_filename = GetSystemImageFilename(output_oat_location.c_str(), isa);
+    if (debug) {
+      LOG(INFO) << "Using output-oat-file " << output_oat_filename;
+    }
+  }
+  if (!output_image_location.empty()) {
+    if (!isa_set) {
+      Usage("specifying a location requires specifying an instruction set");
+    }
+    output_image_filename = GetSystemImageFilename(output_image_location.c_str(), isa);
+    if (debug) {
+      LOG(INFO) << "Using output-image-file " << output_image_filename;
+    }
+  }
+  if (!patched_image_location.empty()) {
+    if (!isa_set) {
+      Usage("specifying a location requires specifying an instruction set");
+    }
+    patched_image_filename = GetSystemImageFilename(patched_image_location.c_str(), isa);
+    if (debug) {
+      LOG(INFO) << "Using patched-image-file " << patched_image_filename;
+    }
+  }
+
+  if (!base_delta_set) {
+    if (orig_base_offset_set && base_offset_set) {
+      base_delta_set = true;
+      base_delta = base_offset - orig_base_offset;
+    } else if (!patched_image_filename.empty()) {
+      base_delta_set = true;
+      std::string error_msg;
+      if (!ReadBaseDelta(patched_image_filename.c_str(), &base_delta, error_msg)) {
+        Usage(error_msg.c_str(), patched_image_filename.c_str());
+      }
+    } else {
+      if (base_offset_set) {
+        Usage("Unable to determine original base offset.");
+      } else {
+        Usage("Must supply a desired new offset or delta.");
+      }
+    }
+  }
+
+  if (!IsAligned<kPageSize>(base_delta)) {
+    Usage("Base offset/delta must be alligned to a pagesize (0x%08x) boundary.", kPageSize);
+  }
+
+  // Do we need to cleanup output files if we fail?
+  bool new_image_out = false;
+  bool new_oat_out = false;
+
+  std::unique_ptr<File> input_oat;
+  std::unique_ptr<File> output_oat;
+  std::unique_ptr<File> output_image;
+
+  if (have_image_files) {
+    CHECK(!input_image_location.empty());
+
+    if (output_image_fd != -1) {
+      output_image.reset(new File(output_image_fd, output_image_filename));
+    } else {
+      CHECK(!output_image_filename.empty());
+      output_image.reset(CreateOrOpen(output_image_filename.c_str(), &new_image_out));
+    }
+  } else {
+    CHECK(output_image_filename.empty() && output_image_fd == -1 && input_image_location.empty());
+  }
+
+  if (have_oat_files) {
+    if (input_oat_fd != -1) {
+      input_oat.reset(new File(input_oat_fd, input_oat_filename));
+    } else {
+      CHECK(!input_oat_filename.empty());
+      input_oat.reset(OS::OpenFileForReading(input_oat_filename.c_str()));
+    }
+
+    if (output_oat_fd != -1) {
+      output_oat.reset(new File(output_oat_fd, output_oat_filename));
+    } else {
+      CHECK(!output_oat_filename.empty());
+      output_oat.reset(CreateOrOpen(output_oat_filename.c_str(), &new_oat_out));
+    }
+  }
+
+  auto cleanup = [&output_image_filename, &output_oat_filename,
+                  &new_oat_out, &new_image_out, &timings, &dump_timings](bool success) {
+    timings.EndTiming();
+    if (!success) {
+      if (new_oat_out) {
+        CHECK(!output_oat_filename.empty());
+        unlink(output_oat_filename.c_str());
+      }
+      if (new_image_out) {
+        CHECK(!output_image_filename.empty());
+        unlink(output_image_filename.c_str());
+      }
+    }
+    if (dump_timings) {
+      LOG(INFO) << Dumpable<TimingLogger>(timings);
+    }
+  };
+
+  if (debug) {
+    LOG(INFO) << "moving offset by " << base_delta << " (0x" << std::hex << base_delta << ") bytes";
+  }
+
+  bool ret;
+  if (have_image_files && have_oat_files) {
+    TimingLogger::ScopedTiming pt("patch image and oat", &timings);
+    ret = PatchOat::Patch(input_oat.get(), input_image_location, base_delta,
+                          output_oat.get(), output_image.get(), isa, timings);
+  } else if (have_oat_files) {
+    TimingLogger::ScopedTiming pt("patch oat", &timings);
+    ret = PatchOat::Patch(input_oat.get(), base_delta, output_oat.get(), timings);
+  } else {
+    TimingLogger::ScopedTiming pt("patch image", &timings);
+    CHECK(have_image_files);
+    ret = PatchOat::Patch(input_image_location, base_delta, output_image.get(), isa, timings);
+  }
+  cleanup(ret);
+  return (ret) ? EXIT_SUCCESS : EXIT_FAILURE;
+}
+
+}  // namespace art
+
+int main(int argc, char **argv) {
+  return art::patchoat(argc, argv);
+}
diff --git a/patchoat/patchoat.h b/patchoat/patchoat.h
new file mode 100644
index 0000000..b9f36d4
--- /dev/null
+++ b/patchoat/patchoat.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2014 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef ART_PATCHOAT_PATCHOAT_H_
+#define ART_PATCHOAT_PATCHOAT_H_
+
+#include "base/macros.h"
+#include "base/mutex.h"
+#include "instruction_set.h"
+#include "os.h"
+#include "elf_file.h"
+#include "elf_utils.h"
+#include "gc/accounting/space_bitmap.h"
+#include "gc/heap.h"
+#include "utils.h"
+
+namespace art {
+
+class ImageHeader;
+
+namespace mirror {
+class Object;
+class Reference;
+class Class;
+class ArtMethod;
+};
+
+int patchoat(int argc, char** argv);
+
+class PatchOat {
+ public:
+  static bool Patch(File* oat_in, off_t delta, File* oat_out, TimingLogger& timings);
+
+  static bool Patch(const std::string& art_location, off_t delta, File* art_out, InstructionSet isa,
+                    TimingLogger& timings);
+
+  static bool Patch(const File* oat_in, const std::string& art_location,
+                    off_t delta, File* oat_out, File* art_out, InstructionSet isa,
+                    TimingLogger& timings);
+
+ private:
+  std::unique_ptr<ElfFile> oat_file_;
+  MemMap* image_;
+  gc::accounting::ContinuousSpaceBitmap* bitmap_;
+  MemMap* heap_;
+  off_t delta_;
+  TimingLogger& timings_;
+
+  // Takes ownership only of the ElfFile. All other pointers are only borrowed.
+  PatchOat(ElfFile* oat_file, off_t delta, TimingLogger& timings)
+      : oat_file_(oat_file), delta_(delta), timings_(timings) {}
+  PatchOat(MemMap* image, gc::accounting::ContinuousSpaceBitmap* bitmap,
+           MemMap* heap, off_t delta, TimingLogger& timings)
+      : image_(image), bitmap_(bitmap), heap_(heap),
+        delta_(delta), timings_(timings) {}
+  PatchOat(ElfFile* oat_file, MemMap* image, gc::accounting::ContinuousSpaceBitmap* bitmap,
+           MemMap* heap, off_t delta, TimingLogger& timings)
+      : oat_file_(oat_file), image_(image), bitmap_(bitmap), heap_(heap),
+        delta_(delta), timings_(timings) {}
+  ~PatchOat() {}
+
+  static void BitmapCallback(mirror::Object* obj, void* arg)
+      SHARED_LOCKS_REQUIRED(Locks::mutator_lock_) {
+    reinterpret_cast<PatchOat*>(arg)->VisitObject(obj);
+  }
+
+  void VisitObject(mirror::Object* obj)
+      SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
+  void FixupMethod(mirror::ArtMethod* object, mirror::ArtMethod* copy)
+      SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
+  bool InHeap(mirror::Object*);
+
+  bool CheckOatFile();
+
+  // Patches oat in place, modifying the oat_file given to the constructor.
+  bool PatchElf();
+  bool PatchTextSection();
+  bool PatchSymbols(Elf32_Shdr* section);
+
+  bool PatchImage() SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
+
+  bool WriteElf(File* out);
+  bool WriteImage(File* out);
+
+  mirror::Object* RelocatedCopyOf(mirror::Object*);
+  mirror::Object* RelocatedAddressOf(mirror::Object* obj);
+
+  class PatchVisitor {
+  public:
+    PatchVisitor(PatchOat* patcher, mirror::Object* copy) : patcher_(patcher), copy_(copy) {}
+    ~PatchVisitor() {}
+    void operator() (mirror::Object* obj, MemberOffset off, bool b) const
+      EXCLUSIVE_LOCKS_REQUIRED(Locks::mutator_lock_, Locks::heap_bitmap_lock_);
+    // For reference classes.
+    void operator() (mirror::Class* cls, mirror::Reference* ref) const
+      EXCLUSIVE_LOCKS_REQUIRED(Locks::mutator_lock_, Locks::heap_bitmap_lock_);
+  private:
+    PatchOat* patcher_;
+    mirror::Object* copy_;
+  };
+
+  DISALLOW_IMPLICIT_CONSTRUCTORS(PatchOat);
+};
+
+}  // namespace art
+#endif  // ART_PATCHOAT_PATCHOAT_H_
diff --git a/runtime/arch/x86/jni_entrypoints_x86.S b/runtime/arch/x86/jni_entrypoints_x86.S
index 45d7356..997a259 100644
--- a/runtime/arch/x86/jni_entrypoints_x86.S
+++ b/runtime/arch/x86/jni_entrypoints_x86.S
@@ -26,9 +26,11 @@
     pushl %fs:THREAD_SELF_OFFSET  // pass Thread::Current()
     CFI_ADJUST_CFA_OFFSET(4)
     call PLT_SYMBOL(artFindNativeMethod)  // (Thread*)
-    UNDO_SETUP_GOT
-    addl LITERAL(8), %esp         // restore the stack
-    CFI_ADJUST_CFA_OFFSET(-12)
+    addl LITERAL(4), %esp         // remove argument
+    CFI_ADJUST_CFA_OFFSET(-4)
+    UNDO_SETUP_GOT                // pop ebx
+    addl LITERAL(4), %esp         // remove padding
+    CFI_ADJUST_CFA_OFFSET(-4)
     testl %eax, %eax         // check if returned method code is null
     jz .Lno_native_code_found     // if null, jump to return to handle
     jmp *%eax                     // otherwise, tail call to intended method
diff --git a/runtime/arch/x86_64/jni_entrypoints_x86_64.S b/runtime/arch/x86_64/jni_entrypoints_x86_64.S
index 10f39b7..d668797 100644
--- a/runtime/arch/x86_64/jni_entrypoints_x86_64.S
+++ b/runtime/arch/x86_64/jni_entrypoints_x86_64.S
@@ -23,7 +23,7 @@
     // Save callee and GPR args, mixed together to agree with core spills bitmap.
     PUSH r9   // Arg.
     PUSH r8   // Arg.
-    PUSH rdi  //
+    PUSH rdi  // JniEnv.
     PUSH rsi  // Arg.
     PUSH rdx  // Arg.
     PUSH rcx  // Arg.
@@ -40,7 +40,7 @@
     movq %xmm6, 48(%rsp)
     movq %xmm7, 56(%rsp)
     // prepare call
-    movq %gs:THREAD_SELF_OFFSET, %rsi      // RSI := Thread::Current()
+    movq %gs:THREAD_SELF_OFFSET, %rdi      // RDI := Thread::Current()
     // call
     call PLT_SYMBOL(artFindNativeMethod)  // (Thread*)
     // restore arguments
@@ -57,7 +57,7 @@
     POP rcx  // Arg.
     POP rdx  // Arg.
     POP rsi  // Arg.
-    POP rdi  //
+    POP rdi  // JniEnv.
     POP r8   // Arg.
     POP r9   // Arg.
     testq %rax, %rax         // check if returned method code is null
diff --git a/runtime/elf_file.cc b/runtime/elf_file.cc
index bb33978..e5402e1 100644
--- a/runtime/elf_file.cc
+++ b/runtime/elf_file.cc
@@ -724,14 +724,23 @@
   return *(GetDynamicSectionStart() + i);
 }
 
-Elf32_Word ElfFile::FindDynamicValueByType(Elf32_Sword type) const {
+Elf32_Dyn* ElfFile::FindDynamicByType(Elf32_Sword type) const {
   for (Elf32_Word i = 0; i < GetDynamicNum(); i++) {
-    Elf32_Dyn& elf_dyn = GetDynamic(i);
-    if (elf_dyn.d_tag == type) {
-      return elf_dyn.d_un.d_val;
+    Elf32_Dyn* dyn = &GetDynamic(i);
+    if (dyn->d_tag == type) {
+      return dyn;
     }
   }
-  return 0;
+  return NULL;
+}
+
+Elf32_Word ElfFile::FindDynamicValueByType(Elf32_Sword type) const {
+  Elf32_Dyn* dyn = FindDynamicByType(type);
+  if (dyn == NULL) {
+    return 0;
+  } else {
+    return dyn->d_un.d_val;
+  }
 }
 
 Elf32_Rel* ElfFile::GetRelSectionStart(Elf32_Shdr& section_header) const {
diff --git a/runtime/elf_file.h b/runtime/elf_file.h
index 496690b..a966bd9 100644
--- a/runtime/elf_file.h
+++ b/runtime/elf_file.h
@@ -112,6 +112,7 @@
 
   Elf32_Word GetDynamicNum() const;
   Elf32_Dyn& GetDynamic(Elf32_Word) const;
+  Elf32_Dyn* FindDynamicByType(Elf32_Sword type) const;
   Elf32_Word FindDynamicValueByType(Elf32_Sword type) const;
 
   Elf32_Word GetRelNum(Elf32_Shdr&) const;
diff --git a/runtime/elf_utils.h b/runtime/elf_utils.h
index 2c50047..5966d05 100644
--- a/runtime/elf_utils.h
+++ b/runtime/elf_utils.h
@@ -22,6 +22,8 @@
 // Explicitly include our own elf.h to avoid Linux and other dependencies.
 #include "./elf.h"
 
+#include "base/logging.h"
+
 // Architecture dependent flags for the ELF header.
 #define EF_ARM_EABI_VER5 0x05000000
 #define EF_MIPS_ABI_O32 0x00001000
@@ -62,8 +64,103 @@
 #define DT_MIPS_HIPAGENO     0x70000014 /* Number of GOT page table entries */
 #define DT_MIPS_RLD_MAP      0x70000016 /* Address of debug map pointer */
 
+// Patching section type
+#define SHT_OAT_PATCH        SHT_LOUSER
+
 inline void SetBindingAndType(Elf32_Sym* sym, unsigned char b, unsigned char t) {
   sym->st_info = (b << 4) + (t & 0x0f);
 }
 
+inline bool IsDynamicSectionPointer(Elf32_Word d_tag, Elf32_Word e_machine) {
+  switch (d_tag) {
+    // case 1: well known d_tag values that imply Elf32_Dyn.d_un contains an address in d_ptr
+    case DT_PLTGOT:
+    case DT_HASH:
+    case DT_STRTAB:
+    case DT_SYMTAB:
+    case DT_RELA:
+    case DT_INIT:
+    case DT_FINI:
+    case DT_REL:
+    case DT_DEBUG:
+    case DT_JMPREL: {
+      return true;
+    }
+    // d_val or ignored values
+    case DT_NULL:
+    case DT_NEEDED:
+    case DT_PLTRELSZ:
+    case DT_RELASZ:
+    case DT_RELAENT:
+    case DT_STRSZ:
+    case DT_SYMENT:
+    case DT_SONAME:
+    case DT_RPATH:
+    case DT_SYMBOLIC:
+    case DT_RELSZ:
+    case DT_RELENT:
+    case DT_PLTREL:
+    case DT_TEXTREL:
+    case DT_BIND_NOW:
+    case DT_INIT_ARRAYSZ:
+    case DT_FINI_ARRAYSZ:
+    case DT_RUNPATH:
+    case DT_FLAGS: {
+      return false;
+    }
+    // boundary values that should not be used
+    case DT_ENCODING:
+    case DT_LOOS:
+    case DT_HIOS:
+    case DT_LOPROC:
+    case DT_HIPROC: {
+      LOG(FATAL) << "Illegal d_tag value 0x" << std::hex << d_tag;
+      return false;
+    }
+    default: {
+      // case 2: "regular" DT_* ranges where even d_tag values imply an address in d_ptr
+      if ((DT_ENCODING  < d_tag && d_tag < DT_LOOS)
+          || (DT_LOOS   < d_tag && d_tag < DT_HIOS)
+          || (DT_LOPROC < d_tag && d_tag < DT_HIPROC)) {
+        // Special case for MIPS which breaks the regular rules between DT_LOPROC and DT_HIPROC
+        if (e_machine == EM_MIPS) {
+          switch (d_tag) {
+            case DT_MIPS_RLD_VERSION:
+            case DT_MIPS_TIME_STAMP:
+            case DT_MIPS_ICHECKSUM:
+            case DT_MIPS_IVERSION:
+            case DT_MIPS_FLAGS:
+            case DT_MIPS_LOCAL_GOTNO:
+            case DT_MIPS_CONFLICTNO:
+            case DT_MIPS_LIBLISTNO:
+            case DT_MIPS_SYMTABNO:
+            case DT_MIPS_UNREFEXTNO:
+            case DT_MIPS_GOTSYM:
+            case DT_MIPS_HIPAGENO: {
+              return false;
+            }
+            case DT_MIPS_BASE_ADDRESS:
+            case DT_MIPS_CONFLICT:
+            case DT_MIPS_LIBLIST:
+            case DT_MIPS_RLD_MAP: {
+              return true;
+            }
+            default: {
+              LOG(FATAL) << "Unknown MIPS d_tag value 0x" << std::hex << d_tag;
+              return false;
+            }
+          }
+        } else if ((d_tag % 2) == 0) {
+          return true;
+        } else {
+          return false;
+        }
+      } else {
+        LOG(FATAL) << "Unknown d_tag value 0x" << std::hex << d_tag;
+        return false;
+      }
+    }
+  }
+}
+
 #endif  // ART_RUNTIME_ELF_UTILS_H_
diff --git a/runtime/entrypoints/jni/jni_entrypoints.cc b/runtime/entrypoints/jni/jni_entrypoints.cc
index bea7d96..bae4023 100644
--- a/runtime/entrypoints/jni/jni_entrypoints.cc
+++ b/runtime/entrypoints/jni/jni_entrypoints.cc
@@ -25,8 +25,13 @@
 namespace art {
 
 // Used by the JNI dlsym stub to find the native method to invoke if none is registered.
+#if defined(__arm__) || defined(__aarch64__)
 extern "C" void* artFindNativeMethod() {
   Thread* self = Thread::Current();
+#else
+extern "C" void* artFindNativeMethod(Thread* self) {
+  DCHECK_EQ(self, Thread::Current());
+#endif
   Locks::mutator_lock_->AssertNotHeld(self);  // We come here as Native.
   ScopedObjectAccess soa(self);
 
diff --git a/runtime/entrypoints/quick/quick_trampoline_entrypoints.cc b/runtime/entrypoints/quick/quick_trampoline_entrypoints.cc
index 6fb9624..95cb85e 100644
--- a/runtime/entrypoints/quick/quick_trampoline_entrypoints.cc
+++ b/runtime/entrypoints/quick/quick_trampoline_entrypoints.cc
@@ -1565,7 +1565,11 @@
   self->PushHandleScope(handle_scope_);
 }
 
+#if defined(__arm__) || defined(__aarch64__)
 extern "C" void* artFindNativeMethod();
+#else
+extern "C" void* artFindNativeMethod(Thread* self);
+#endif
 
 uint64_t artQuickGenericJniEndJNIRef(Thread* self, uint32_t cookie, jobject l, jobject lock) {
   if (lock != nullptr) {
@@ -1638,7 +1642,11 @@
   // pointer.
   DCHECK(nativeCode != nullptr);
   if (nativeCode == GetJniDlsymLookupStub()) {
+#if defined(__arm__) || defined(__aarch64__)
     nativeCode = artFindNativeMethod();
+#else
+    nativeCode = artFindNativeMethod(self);
+#endif
 
     if (nativeCode == nullptr) {
       DCHECK(self->IsExceptionPending());    // There should be an exception pending now.
diff --git a/runtime/image.cc b/runtime/image.cc
index 528bfc6..93ec27d 100644
--- a/runtime/image.cc
+++ b/runtime/image.cc
@@ -24,7 +24,7 @@
 namespace art {
 
 const byte ImageHeader::kImageMagic[] = { 'a', 'r', 't', '\n' };
-const byte ImageHeader::kImageVersion[] = { '0', '0', '7', '\0' };
+const byte ImageHeader::kImageVersion[] = { '0', '0', '8', '\0' };
 
 ImageHeader::ImageHeader(uint32_t image_begin,
                          uint32_t image_size,
@@ -45,6 +45,7 @@
     oat_data_begin_(oat_data_begin),
     oat_data_end_(oat_data_end),
     oat_file_end_(oat_file_end),
+    patch_delta_(0),
     image_roots_(image_roots) {
   CHECK_EQ(image_begin, RoundUp(image_begin, kPageSize));
   CHECK_EQ(oat_file_begin, RoundUp(oat_file_begin, kPageSize));
@@ -58,6 +59,17 @@
   memcpy(version_, kImageVersion, sizeof(kImageVersion));
 }
 
+void ImageHeader::RelocateImage(off_t delta) {
+  CHECK_ALIGNED(delta, kPageSize) << " patch delta must be page aligned";
+  image_begin_ += delta;
+  oat_file_begin_ += delta;
+  oat_data_begin_ += delta;
+  oat_data_end_ += delta;
+  oat_file_end_ += delta;
+  image_roots_ += delta;
+  patch_delta_ += delta;
+}
+
 bool ImageHeader::IsValid() const {
   if (memcmp(magic_, kImageMagic, sizeof(kImageMagic)) != 0) {
     return false;
@@ -65,6 +77,25 @@
   if (memcmp(version_, kImageVersion, sizeof(kImageVersion)) != 0) {
     return false;
   }
+  // Unsigned so wraparound is well defined.
+  if (image_begin_ >= image_begin_ + image_size_) {
+    return false;
+  }
+  if (oat_file_begin_ > oat_file_end_) {
+    return false;
+  }
+  if (oat_data_begin_ > oat_data_end_) {
+    return false;
+  }
+  if (oat_file_begin_ >= oat_data_begin_) {
+    return false;
+  }
+  if (image_roots_ <= image_begin_ || oat_file_begin_ <= image_roots_) {
+    return false;
+  }
+  if (!IsAligned<kPageSize>(patch_delta_)) {
+    return false;
+  }
   return true;
 }
 
diff --git a/runtime/image.h b/runtime/image.h
index abe1ad8..424a40b 100644
--- a/runtime/image.h
+++ b/runtime/image.h
@@ -84,6 +84,10 @@
     return reinterpret_cast<byte*>(oat_file_end_);
   }
 
+  off_t GetPatchDelta() const {
+    return patch_delta_;
+  }
+
   size_t GetBitmapOffset() const {
     return RoundUp(image_size_, kPageSize);
   }
@@ -112,10 +116,11 @@
 
   mirror::Object* GetImageRoot(ImageRoot image_root) const
       SHARED_LOCKS_REQUIRED(Locks::mutator_lock_);
-
- private:
   mirror::ObjectArray<mirror::Object>* GetImageRoots() const;
 
+  void RelocateImage(off_t delta);
+
+ private:
   static const byte kImageMagic[4];
   static const byte kImageVersion[4];
 
@@ -150,11 +155,13 @@
   // .so files. Used for positioning a following alloc spaces.
   uint32_t oat_file_end_;
 
+  // The total delta that this image has been patched.
+  int32_t patch_delta_;
+
   // Absolute address of an Object[] of objects needed to reinitialize from an image.
   uint32_t image_roots_;
 
   friend class ImageWriter;
-  friend class ImageDumper;  // For GetImageRoots()
 };
 
 }  // namespace art
diff --git a/runtime/oat_file.h b/runtime/oat_file.h
index eae0418..70253af 100644
--- a/runtime/oat_file.h
+++ b/runtime/oat_file.h
@@ -60,6 +60,12 @@
 
   ~OatFile();
 
+  ElfFile* GetElfFile() const {
+    CHECK_NE(reinterpret_cast<uintptr_t>(elf_file_.get()), reinterpret_cast<uintptr_t>(nullptr))
+        << "Cannot get an elf file from " << GetLocation();
+    return elf_file_.get();
+  }
+
   const std::string& GetLocation() const {
     return location_;
   }
@@ -227,6 +233,9 @@
     return End() - Begin();
   }
 
+  const byte* Begin() const;
+  const byte* End() const;
+
  private:
   static void CheckLocation(const std::string& location);
 
@@ -248,9 +257,6 @@
                    std::string* error_msg);
   bool Setup(std::string* error_msg);
 
-  const byte* Begin() const;
-  const byte* End() const;
-
   // The oat file name.
   //
   // The image will embed this to link its associated oat file.
diff --git a/runtime/quick/inline_method_analyser.h b/runtime/quick/inline_method_analyser.h
index e1fbf01..5128b19 100644
--- a/runtime/quick/inline_method_analyser.h
+++ b/runtime/quick/inline_method_analyser.h
@@ -58,6 +58,7 @@
   kIntrinsicCas,
   kIntrinsicUnsafeGet,
   kIntrinsicUnsafePut,
+  kIntrinsicSystemArrayCopyCharArray,
 
   kInlineOpNop,
   kInlineOpReturnArg,
diff --git a/runtime/thread.cc b/runtime/thread.cc
index d3487d0..d60fb49 100644
--- a/runtime/thread.cc
+++ b/runtime/thread.cc
@@ -835,10 +835,9 @@
           os << " \"" << mutex->GetName() << "\"";
           if (mutex->IsReaderWriterMutex()) {
             ReaderWriterMutex* rw_mutex = down_cast<ReaderWriterMutex*>(mutex);
-            if (rw_mutex->IsExclusiveHeld(thread)) {
+            if (rw_mutex->GetExclusiveOwnerTid() == static_cast<uint64_t>(tid)) {
               os << "(exclusive held)";
             } else {
-              CHECK(rw_mutex->IsSharedHeld(thread));
               os << "(shared held)";
             }
           }
diff --git a/runtime/utils.h b/runtime/utils.h
index eb79968..448c591 100644
--- a/runtime/utils.h
+++ b/runtime/utils.h
@@ -19,6 +19,7 @@
 
 #include <pthread.h>
 
+#include <limits>
 #include <string>
 #include <vector>
 
@@ -50,6 +51,34 @@
   kTimeUnitSecond,
 };
 
+template <typename T>
+bool ParseUint(const char *in, T* out) {
+  char* end;
+  unsigned long long int result = strtoull(in, &end, 0);  // NOLINT(runtime/int)
+  if (in == end || *end != '\0') {
+    return false;
+  }
+  if (std::numeric_limits<T>::max() < result) {
+    return false;
+  }
+  *out = static_cast<T>(result);
+  return true;
+}
+
+template <typename T>
+bool ParseInt(const char* in, T* out) {
+  char* end;
+  long long int result = strtoll(in, &end, 0);  // NOLINT(runtime/int)
+  if (in == end || *end != '\0') {
+    return false;
+  }
+  if (result < std::numeric_limits<T>::min() || std::numeric_limits<T>::max() < result) {
+    return false;
+  }
+  *out = static_cast<T>(result);
+  return true;
+}
+
 template<typename T>
 static constexpr bool IsPowerOfTwo(T x) {
   return (x & (x - 1)) == 0;
diff --git a/test/Android.oat.mk b/test/Android.oat.mk
index a560a17..13d452c 100644
--- a/test/Android.oat.mk
+++ b/test/Android.oat.mk
@@ -40,7 +40,8 @@
 
 # Create build rules for each dex file recording the dependency.
 $(foreach dir,$(TEST_OAT_DIRECTORIES), $(eval $(call build-art-test-dex,art-oat-test,$(dir), \
-  $(ART_TARGET_TEST_OUT),$(LOCAL_PATH)/Android.oat.mk,ART_OAT_TEST_$(dir)_DEX)))
+  $(ART_TARGET_TEST_OUT),$(LOCAL_PATH)/Android.oat.mk,ART_TEST_TARGET_OAT_$(dir)_DEX, \
+  ART_TEST_HOST_OAT_$(dir)_DEX)))
 
 ########################################################################
 
@@ -77,7 +78,7 @@
 define define-test-art-oat-rule-target
   # Add the test dependencies to test-art-target-sync, which will be a prerequisite for the test
   # to ensure files are pushed to the device.
-  TEST_ART_TARGET_SYNC_DEPS += $$(ART_OAT_TEST_$(1)_DEX)
+  TEST_ART_TARGET_SYNC_DEPS += $$(ART_TEST_TARGET_OAT_$(1)_DEX)
 
 .PHONY: $(3)
 $(3): test-art-target-sync
@@ -189,7 +190,7 @@
 $(3): PRIVATE_DEX_FILE := /$$(dex_file)
 $(3): PRIVATE_OAT_FILE := $$(oat_file)
 .PHONY: $(3)
-$(3): $$(ART_OAT_TEST_$(1)_DEX) $(ART_TEST_HOST_OAT_DEPENDENCIES)
+$(3): $$(ART_TEST_HOST_OAT_$(1)_DEX) $(ART_TEST_HOST_OAT_DEPENDENCIES)
 	$(hide) mkdir -p $(ART_HOST_TEST_DIR)/android-data-$$@/dalvik-cache/$$($(2)HOST_ARCH)
 	$(hide) cp $$(realpath $$<) $(ART_HOST_TEST_DIR)/android-data-$$@/oat-test-dex-$(1).jar
 	$(hide) $(DEX2OATD) $(DEX2OAT_FLAGS) --runtime-arg -Xms16m --runtime-arg -Xmx16m $(4) \
@@ -447,7 +448,8 @@
 ART_TEST_HOST_OAT$(2ND_ART_PHONY_TEST_HOST_SUFFIX)_RULES :=
 ART_TEST_HOST_OAT_RULES :=
 ART_TEST_HOST_OAT_DEPENDENCIES :=
-$(foreach dir,$(TEST_OAT_DIRECTORIES), $(eval ART_OAT_TEST_$(dir)_DEX :=))
+$(foreach dir,$(TEST_OAT_DIRECTORIES), $(eval ART_TEST_TARGET_OAT_$(dir)_DEX :=))
+$(foreach dir,$(TEST_OAT_DIRECTORIES), $(eval ART_TEST_HOST_OAT_$(dir)_DEX :=))
 TEST_OAT_DIRECTORIES :=
 LOCAL_PID :=
 LOCAL_PATH :=