diff --git a/CleanSpec.mk b/CleanSpec.mk
new file mode 100644
index 0000000..039f955
--- /dev/null
+++ b/CleanSpec.mk
@@ -0,0 +1,51 @@
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# If you don't need to do a full clean build but would like to touch
+# a file or delete some intermediate files, add a clean step to the end
+# of the list.  These steps will only be run once, if they haven't been
+# run before.
+#
+# E.g.:
+#     $(call add-clean-step, touch -c external/sqlite/sqlite3.h)
+#     $(call add-clean-step, rm -rf $(PRODUCT_OUT)/obj/STATIC_LIBRARIES/libz_intermediates)
+#
+# Always use "touch -c" and "rm -f" or "rm -rf" to gracefully deal with
+# files that are missing or have been moved.
+#
+# Use $(PRODUCT_OUT) to get to the "out/target/product/blah/" directory.
+# Use $(OUT_DIR) to refer to the "out" directory.
+#
+# If you need to re-do something that's already mentioned, just copy
+# the command and add it to the bottom of the list.  E.g., if a change
+# that you made last week required touching a file and a change you
+# made today requires touching the same file, just copy the old
+# touch step and add it to the end of the list.
+#
+# ************************************************
+# NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
+# ************************************************
+
+# For example:
+#$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/APPS/AndroidTests_intermediates)
+#$(call add-clean-step, rm -rf $(OUT_DIR)/target/common/obj/JAVA_LIBRARIES/core_intermediates)
+#$(call add-clean-step, find $(OUT_DIR) -type f -name "IGTalkSession*" -print0 | xargs -0 rm -f)
+#$(call add-clean-step, rm -rf $(PRODUCT_OUT)/data/*)
+
+$(call add-clean-step, rm -rf $(TARGET_OUT_INTERMEDIATES)/UBOOT_OBJ)
+
+# ************************************************
+# NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
+# ************************************************
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index f61885a..9fa007c 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -117,6 +117,10 @@ struct fastboot_device_info fastboot_firmwareinfo;
 #define AT_OEM_PART_SIZE	17
 #define AT_OEM_DEV_SIZE	6
 
+/* Offset (in u32's) of start and end fields in the zImage header. */
+#define ZIMAGE_START_ADDR	10
+#define ZIMAGE_END_ADDR	11
+
 /* common variables of fastboot getvar command */
 char *fastboot_common_var[FASTBOOT_COMMON_VAR_NUM] = {
 	"version",
@@ -1871,7 +1875,8 @@ bootimg_print_image_hdr(struct andr_img_hdr *hdr)
 }
 
 #ifdef CONFIG_ANDROID_THINGS_SUPPORT
-static int android_things_load_fdt(const char *slot, struct andr_img_hdr *hdrload) {
+static int android_things_load_fdt(const char *slot,
+		struct andr_img_hdr *hdrload, u32 *fdt_size) {
 	/* check for kernel.dtb in oem_bootloader */
 	char oem_bootloader[AT_OEM_PART_SIZE];
 	snprintf(oem_bootloader, AT_OEM_PART_SIZE, AT_OEM_PART_NAME "%s", slot);
@@ -1887,9 +1892,9 @@ static int android_things_load_fdt(const char *slot, struct andr_img_hdr *hdrloa
 	if (fs_set_blk_dev("mmc", dev_part, FS_TYPE_EXT) != 0)
 		return -1;
 
-	loff_t dtb_size;
-	if (!fs_read(AT_OEM_DTB, hdrload->second_addr, 0, 0, &dtb_size) && dtb_size) {
-		hdrload->second_size = dtb_size;
+	loff_t size;
+	if (!fs_read(AT_OEM_DTB, hdrload->second_addr, 0, 0, &size) && size) {
+		*fdt_size = size;
 		return 0;
 	}
 
@@ -2156,15 +2161,21 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) {
 			+ ALIGN(hdr->kernel_size, hdr->page_size), hdr->ramdisk_size);
 #endif
 #ifdef CONFIG_OF_LIBFDT
+	u32 fdt_size = 0;
 	bool fdt_loaded = false;
 #ifdef CONFIG_ANDROID_THINGS_SUPPORT
-	fdt_loaded = !android_things_load_fdt(slot, hdr);
+	fdt_loaded = !android_things_load_fdt(slot, hdr, &fdt_size);
 #endif /* CONFIG_ANDROID_THINGS_SUPPORT */
 	/* load the dtb file */
-	if (!fdt_loaded && hdr->second_size && hdr->second_addr) {
-		memcpy((void *)(ulong)hdr->second_addr, (void *)(ulong)hdr->kernel_addr
-			+ ALIGN(hdr->kernel_size, hdr->page_size)
-			+ ALIGN(hdr->ramdisk_size, hdr->page_size), hdr->second_size);
+	if (!fdt_loaded && hdr->second_addr) {
+		/* The fdt is appended to the zImage. Use the address and size of the kernel
+		   section of the boot image and the kernel size from the zImage to
+		   calculate the address and size of the fdt. */
+		u32 zimage_size = ((u32 *)hdr->kernel_addr)[ZIMAGE_END_ADDR]
+				- ((u32 *)hdr->kernel_addr)[ZIMAGE_START_ADDR];
+		fdt_size = hdr->kernel_size - zimage_size;
+		memcpy((void *)(ulong)hdr->second_addr,
+				(void*)(ulong)hdr->kernel_addr + zimage_size, fdt_size);
 	}
 #endif /*CONFIG_OF_LIBFDT*/
 	if (check_image_arm64) {
@@ -2176,8 +2187,8 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) {
 	printf("kernel   @ %08x (%d)\n", hdr->kernel_addr, hdr->kernel_size);
 	printf("ramdisk  @ %08x (%d)\n", hdr->ramdisk_addr, hdr->ramdisk_size);
 #ifdef CONFIG_OF_LIBFDT
-	if (hdr->second_size)
-		printf("fdt      @ %08x (%d)\n", hdr->second_addr, hdr->second_size);
+	if (fdt_size)
+		printf("fdt      @ %08x (%d)\n", hdr->second_addr, fdt_size);
 #endif /*CONFIG_OF_LIBFDT*/
 
 	char boot_addr_start[12];
@@ -2206,7 +2217,7 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) {
 
 #ifdef CONFIG_IMX_TRUSTY_OS
 	/* Trusty keymaster needs some parameters before it work */
-	trusty_setbootparameter(hdrload, avb_result);
+	trusty_setbootparameter(hdr, avb_result);
 	/* put ql-tipc to release resource for Linux */
 	trusty_ipc_shutdown();
 #endif
@@ -2340,11 +2351,14 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 			+ ALIGN(hdr->kernel_size, hdr->page_size), hdr->ramdisk_size);
 
 #ifdef CONFIG_OF_LIBFDT
+		u32 fdt_size = 0;
 		/* load the dtb file */
-		if (hdr->second_size && hdr->second_addr) {
-			memcpy((void *)hdr->second_addr, (void *)hdr->kernel_addr
-				+ ALIGN(hdr->kernel_size, hdr->page_size)
-				+ ALIGN(hdr->ramdisk_size, hdr->page_size), hdr->second_size);
+		if (hdr->second_addr) {
+			u32 zimage_size = ((u32 *)hdrload->kernel_addr)[ZIMAGE_END_ADDR]
+					- ((u32 *)hdrload->kernel_addr)[ZIMAGE_START_ADDR];
+			fdt_size = hdrload->kernel_size - zimage_size;
+			memcpy((void *)(ulong)hdrload->second_addr,
+					(void*)(ulong)hdrload->kernel_addr + zimage_size, fdt_size);
 		}
 #endif /*CONFIG_OF_LIBFDT*/
 
@@ -2359,8 +2373,8 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 	printf("kernel   @ %08x (%d)\n", hdr->kernel_addr, hdr->kernel_size);
 	printf("ramdisk  @ %08x (%d)\n", hdr->ramdisk_addr, hdr->ramdisk_size);
 #ifdef CONFIG_OF_LIBFDT
-	if (hdr->second_size)
-		printf("fdt      @ %08x (%d)\n", hdr->second_addr, hdr->second_size);
+	if (fdt_size)
+		printf("fdt      @ %08x (%d)\n", hdr->second_addr, fdt_size);
 #endif /*CONFIG_OF_LIBFDT*/