diff --git a/CleanSpec.mk b/CleanSpec.mk
index 9627093..4a0ac62 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -704,6 +704,15 @@
 # again, as the original change removing them was reverted.
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/framework/*.jar)
 
+# Remove cas@1.1 from the vendor partition
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.cas@1.1*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.cas@1.1*)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/vintf/manifest/android.hardware.cas@1.1*)
+
+# Remove com.android.cellbroadcast apex for Go devices
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/apex/com.android.cellbroadcast.apex)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/apex/com.android.cellbroadcast)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/Makefile b/core/Makefile
index 96dc613..bec8cfc 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -1733,7 +1733,6 @@
 	$(hide) $(FILESLIST) $(TARGET_RECOVERY_ROOT_OUT) > $(@:.txt=.json)
 	$(hide) $(FILESLIST_UTIL) -c $(@:.txt=.json) > $@
 
-recovery_initrc := $(call include-path-for, recovery)/etc/init.rc
 recovery_sepolicy := \
     $(TARGET_RECOVERY_ROOT_OUT)/sepolicy \
     $(TARGET_RECOVERY_ROOT_OUT)/plat_file_contexts \
@@ -2027,7 +2026,6 @@
     $(hide) ln -sf /system/bin/init $(TARGET_RECOVERY_ROOT_OUT)/init)
   # Removes $(TARGET_RECOVERY_ROOT_OUT)/init*.rc EXCEPT init.recovery*.rc.
   $(hide) find $(TARGET_RECOVERY_ROOT_OUT) -maxdepth 1 -name 'init*.rc' -type f -not -name "init.recovery.*.rc" | xargs rm -f
-  $(hide) cp -f $(recovery_initrc) $(TARGET_RECOVERY_ROOT_OUT)/
   $(hide) cp $(TARGET_ROOT_OUT)/init.recovery.*.rc $(TARGET_RECOVERY_ROOT_OUT)/ 2> /dev/null || true # Ignore error when the src file doesn't exist.
   $(hide) mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/res
   $(hide) rm -rf $(TARGET_RECOVERY_ROOT_OUT)/res/*
@@ -2092,7 +2090,7 @@
 	    $(INTERNAL_ROOT_FILES) \
 	    $(INSTALLED_RAMDISK_TARGET) \
 	    $(INTERNAL_RECOVERYIMAGE_FILES) \
-	    $(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
+	    $(recovery_sepolicy) $(recovery_kernel) \
 	    $(INSTALLED_2NDBOOTLOADER_TARGET) \
 	    $(INSTALLED_RECOVERY_BUILD_PROP_TARGET) \
 	    $(recovery_resource_deps) \
@@ -2120,7 +2118,7 @@
 	    $(INSTALLED_RAMDISK_TARGET) \
 	    $(INSTALLED_BOOTIMAGE_TARGET) \
 	    $(INTERNAL_RECOVERYIMAGE_FILES) \
-	    $(recovery_initrc) $(recovery_sepolicy) $(recovery_kernel) \
+	    $(recovery_sepolicy) $(recovery_kernel) \
 	    $(INSTALLED_2NDBOOTLOADER_TARGET) \
 	    $(INSTALLED_RECOVERY_BUILD_PROP_TARGET) \
 	    $(recovery_resource_deps) \
@@ -4056,6 +4054,15 @@
 (cd $(1); find . -type d | sed 's,$$,/,'; find . \! -type d) | cut -c 3- | sort | sed 's,^,$(2),' | $(HOST_OUT_EXECUTABLES)/fs_config -C -D $(TARGET_OUT) -S $(SELINUX_FC) -R "$(2)"
 endef
 
+# Filter out vendor from the list for AOSP targets.
+# $(1): list
+define filter-out-missing-vendor
+$(if $(INSTALLED_VENDORIMAGE_TARGET),$(1),$(filter-out vendor,$(1)))
+endef
+
+# Information related to dynamic partitions and virtual A/B. This information
+# is needed for building the super image (see dump-super-image-info) and
+# building OTA packages.
 # $(1): file
 define dump-dynamic-partitions-info
   $(if $(filter true,$(PRODUCT_USE_DYNAMIC_PARTITIONS)), \
@@ -4073,13 +4080,13 @@
   $(foreach device,$(BOARD_SUPER_PARTITION_BLOCK_DEVICES), \
     echo "super_$(device)_device_size=$(BOARD_SUPER_PARTITION_$(call to-upper,$(device))_DEVICE_SIZE)" >> $(1);)
   $(if $(BOARD_SUPER_PARTITION_PARTITION_LIST), \
-    echo "dynamic_partition_list=$(BOARD_SUPER_PARTITION_PARTITION_LIST)" >> $(1))
+    echo "dynamic_partition_list=$(call filter-out-missing-vendor, $(BOARD_SUPER_PARTITION_PARTITION_LIST))" >> $(1))
   $(if $(BOARD_SUPER_PARTITION_GROUPS),
     echo "super_partition_groups=$(BOARD_SUPER_PARTITION_GROUPS)" >> $(1))
   $(foreach group,$(BOARD_SUPER_PARTITION_GROUPS), \
     echo "super_$(group)_group_size=$(BOARD_$(call to-upper,$(group))_SIZE)" >> $(1); \
     $(if $(BOARD_$(call to-upper,$(group))_PARTITION_LIST), \
-      echo "super_$(group)_partition_list=$(BOARD_$(call to-upper,$(group))_PARTITION_LIST)" >> $(1);))
+      echo "super_$(group)_partition_list=$(call filter-out-missing-vendor, $(BOARD_$(call to-upper,$(group))_PARTITION_LIST))" >> $(1);))
   $(if $(filter true,$(TARGET_USERIMAGES_SPARSE_EXT_DISABLED)), \
     echo "build_non_sparse_super_partition=true" >> $(1))
   $(if $(filter true,$(BOARD_SUPER_IMAGE_IN_UPDATE_PACKAGE)), \
@@ -4092,6 +4099,10 @@
     echo "super_partition_warn_limit=$(BOARD_SUPER_PARTITION_WARN_LIMIT)" >> $(1))
   $(if $(BOARD_SUPER_PARTITION_ERROR_LIMIT), \
     echo "super_partition_error_limit=$(BOARD_SUPER_PARTITION_ERROR_LIMIT)" >> $(1))
+  $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA)), \
+    echo "virtual_ab=true" >> $(1))
+  $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA_RETROFIT)), \
+    echo "virtual_ab_retrofit=true" >> $(1))
 endef
 
 # By conditionally including the dependency of the target files package on the
@@ -4412,21 +4423,10 @@
 ifdef BUILT_KERNEL_VERSION_FILE
 	$(hide) cp $(BUILT_KERNEL_VERSION_FILE) $(zip_root)/META/kernel_version.txt
 endif
-ifneq ($(BOARD_SUPER_PARTITION_GROUPS),)
-	$(hide) echo "super_partition_groups=$(BOARD_SUPER_PARTITION_GROUPS)" > $(zip_root)/META/dynamic_partitions_info.txt
-	@# Remove 'vendor' from the group partition list if the image is not available. This should only
-	@# happen to AOSP targets built without vendor.img. We can't remove the partition from the
-	@# BoardConfig file, as it's still needed elsewhere (e.g. when creating super_empty.img).
-	$(foreach group,$(BOARD_SUPER_PARTITION_GROUPS), \
-	    $(eval _group_partition_list := $(BOARD_$(call to-upper,$(group))_PARTITION_LIST)) \
-	    $(if $(INSTALLED_VENDORIMAGE_TARGET),,$(eval _group_partition_list := $(filter-out vendor,$(_group_partition_list)))) \
-	    echo "$(group)_size=$(BOARD_$(call to-upper,$(group))_SIZE)" >> $(zip_root)/META/dynamic_partitions_info.txt; \
-	    $(if $(_group_partition_list), \
-	        echo "$(group)_partition_list=$(_group_partition_list)" >> $(zip_root)/META/dynamic_partitions_info.txt;))
-endif # BOARD_SUPER_PARTITION_GROUPS
-ifeq ($(PRODUCT_VIRTUAL_AB_OTA),true)
-	echo "virtual_ab=true" >> $(zip_root)/META/dynamic_partitions_info.txt
-endif # PRODUCT_VIRTUAL_AB_OTA
+	rm -rf $(zip_root)/META/dynamic_partitions_info.txt
+ifeq (true,$(PRODUCT_USE_DYNAMIC_PARTITIONS))
+	$(call dump-dynamic-partitions-info, $(zip_root)/META/dynamic_partitions_info.txt)
+endif
 	PATH=$(INTERNAL_USERIMAGES_BINARY_PATHS):$$PATH MKBOOTIMG=$(MKBOOTIMG) \
 	    $(ADD_IMG_TO_TARGET_FILES) -a -v -p $(HOST_OUT) $(zip_root)
 ifeq ($(BUILD_QEMU_IMAGES),true)
@@ -4668,10 +4668,6 @@
   $(call dump-dynamic-partitions-info,$(1))
   $(if $(filter true,$(AB_OTA_UPDATER)), \
     echo "ab_update=true" >> $(1))
-  $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA)), \
-    echo "virtual_ab=true" >> $(1))
-  $(if $(filter true,$(PRODUCT_VIRTUAL_AB_OTA_RETROFIT)), \
-    echo "virtual_ab_retrofit=true" >> $(1))
 endef
 
 endif # PRODUCT_USE_DYNAMIC_PARTITIONS
@@ -5099,6 +5095,19 @@
 endif
 
 # -----------------------------------------------------------------
+# Soong generates the list of all shared libraries that are depended on by fuzz
+# targets. It saves this list as a source:destination pair to
+# FUZZ_TARGET_SHARED_DEPS_INSTALL_PAIRS, where the source is the path to the
+# build of the unstripped shared library, and the destination is the
+# /data/fuzz/$ARCH/lib (for device) or /fuzz/$ARCH/lib (for host) directory
+# where fuzz target shared libraries are to be "reinstalled". The
+# copy-many-files below generates the rules to copy the unstripped shared
+# libraries to the device or host "reinstallation" directory. These rules are
+# depended on by each module in soong_cc_prebuilt.mk, where the module will have
+# a dependency on each shared library that it needs to be "reinstalled".
+FUZZ_SHARED_DEPS := $(call copy-many-files,$(strip $(FUZZ_TARGET_SHARED_DEPS_INSTALL_PAIRS)))
+
+# -----------------------------------------------------------------
 # The rule to build all fuzz targets, and package them.
 # Note: The packages are created in Soong, and in a perfect world,
 # we'd be able to create the phony rule there. But, if we want to
@@ -5109,5 +5118,5 @@
 # directory`, because kati will see 'fuzz' as being a file, not a
 # phony target.
 .PHONY: fuzz
-fuzz: $(SOONG_FUZZ_PACKAGING_ARCH_MODULES)
+fuzz: $(SOONG_FUZZ_PACKAGING_ARCH_MODULES) $(ALL_FUZZ_TARGETS)
 $(call dist-for-goals,fuzz,$(SOONG_FUZZ_PACKAGING_ARCH_MODULES))
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 32c5807..6b80a15 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -321,6 +321,8 @@
       EXECUTABLES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
     else ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
       SHARED_LIBRARIES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
+    else ifeq ($(LOCAL_MODULE_CLASS),ETC)
+      ETC.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_MODULES))
     else
       $(call pretty-error,LOCAL_MODULE_CLASS := $(LOCAL_MODULE_CLASS) cannot use LOCAL_OVERRIDES_MODULES)
     endif
diff --git a/core/binary.mk b/core/binary.mk
index 51259b2..604315e 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -64,6 +64,13 @@
 my_export_c_include_deps := $(LOCAL_EXPORT_C_INCLUDE_DEPS)
 my_arflags :=
 
+# Configure the pool to use for clang rules.
+# If LOCAL_CC or LOCAL_CXX is set don't use goma or RBE.
+my_pool :=
+ifeq (,$(strip $(my_cc))$(strip $(my_cxx)))
+  my_pool := $(GOMA_OR_RBE_POOL)
+endif
+
 ifneq (,$(strip $(foreach dir,$(COVERAGE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
 ifeq (,$(strip $(foreach dir,$(COVERAGE_EXCLUDE_PATHS),$(filter $(dir)%,$(LOCAL_PATH)))))
   my_native_coverage := true
@@ -469,8 +476,8 @@
   endif
   # Disable ccache (or other compiler wrapper) except gomacc, which
   # can handle -fprofile-use properly.
-  my_cc_wrapper := $(filter $(GOMA_CC),$(my_cc_wrapper))
-  my_cxx_wrapper := $(filter $(GOMA_CC),$(my_cxx_wrapper))
+  my_cc_wrapper := $(filter $(GOMA_CC) $(RBE_WRAPPER),$(my_cc_wrapper))
+  my_cxx_wrapper := $(filter $(GOMA_CC) $(RBE_WRAPPER),$(my_cxx_wrapper))
 endif
 
 ###########################################################
@@ -874,7 +881,8 @@
 $(foreach s,$(dotdot_sources),\
   $(eval $(call compile-dotdot-cpp-file,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects)))
+    dotdot_objects,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects))
 
 cpp_normal_sources := $(filter-out ../%,$(filter %$(LOCAL_CPP_EXTENSION),$(my_src_files)))
@@ -885,6 +893,7 @@
 $(dotdot_objects) $(cpp_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 
 ifneq ($(strip $(cpp_objects)),)
+$(cpp_objects): .KATI_NINJA_POOL := $(my_pool)
 $(cpp_objects): $(intermediates)/%.o: \
     $(TOPDIR)$(LOCAL_PATH)/%$(LOCAL_CPP_EXTENSION) \
     $(my_additional_dependencies) $(CLANG_CXX)
@@ -904,6 +913,7 @@
 
 ifneq ($(strip $(gen_cpp_objects)),)
 # Compile all generated files as thumb.
+$(gen_cpp_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_cpp_objects): PRIVATE_ARM_MODE := $(normal_objects_mode)
 $(gen_cpp_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 $(gen_cpp_objects): $(intermediates)/%.o: \
@@ -922,6 +932,7 @@
 $(call track-gen-file-obj,$(gen_S_sources),$(gen_S_objects))
 
 ifneq ($(strip $(gen_S_sources)),)
+$(gen_S_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_S_objects): $(intermediates)/%.o: $(intermediates)/%.S \
     $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
@@ -933,6 +944,7 @@
 $(call track-gen-file-obj,$(gen_s_sources),$(gen_s_objects))
 
 ifneq ($(strip $(gen_s_objects)),)
+$(gen_s_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_s_objects): $(intermediates)/%.o: $(intermediates)/%.s \
     $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
@@ -960,7 +972,8 @@
 $(foreach s, $(dotdot_sources),\
   $(eval $(call compile-dotdot-c-file,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects)))
+    dotdot_objects,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects))
 
 c_normal_sources := $(filter-out ../%,$(filter %.c,$(my_src_files)))
@@ -971,6 +984,7 @@
 $(dotdot_objects) $(c_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 
 ifneq ($(strip $(c_objects)),)
+$(c_objects): .KATI_NINJA_POOL := $(my_pool)
 $(c_objects): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.c \
     $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)c-to-o)
@@ -989,6 +1003,7 @@
 
 ifneq ($(strip $(gen_c_objects)),)
 # Compile all generated files as thumb.
+$(gen_c_objects): .KATI_NINJA_POOL := $(my_pool)
 $(gen_c_objects): PRIVATE_ARM_MODE := $(normal_objects_mode)
 $(gen_c_objects): PRIVATE_ARM_CFLAGS := $(normal_objects_cflags)
 $(gen_c_objects): $(intermediates)/%.o: $(intermediates)/%.c \
@@ -1007,6 +1022,7 @@
 
 ifneq ($(strip $(objc_objects)),)
 my_soong_problems += objc
+$(objc_objects): .KATI_NINJA_POOL := $(my_pool)
 $(objc_objects): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.m \
     $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)m-to-o)
@@ -1022,6 +1038,7 @@
 $(call track-src-file-obj,$(objcpp_sources),$(objcpp_objects))
 
 ifneq ($(strip $(objcpp_objects)),)
+$(objcpp_objects): .KATI_NINJA_POOL := $(my_pool)
 $(objcpp_objects): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.mm \
     $(my_additional_dependencies) $(CLANG_CXX)
 	$(transform-$(PRIVATE_HOST)mm-to-o)
@@ -1042,10 +1059,12 @@
 $(foreach s,$(dotdot_sources),\
   $(eval $(call compile-dotdot-s-file,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects_S)))
+    dotdot_objects_S,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects_S))
 
 ifneq ($(strip $(asm_objects_S)),)
+$(asm_objects_S): .KATI_NINJA_POOL := $(my_pool)
 $(asm_objects_S): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.S \
     $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
@@ -1062,10 +1081,12 @@
 $(foreach s,$(dotdot_sources),\
   $(eval $(call compile-dotdot-s-file-no-deps,$(s),\
     $(my_additional_dependencies),\
-    dotdot_objects_s)))
+    dotdot_objects_s,\
+    $(my_pool))))
 $(call track-src-file-obj,$(dotdot_sources),$(dotdot_objects_s))
 
 ifneq ($(strip $(asm_objects_s)),)
+$(asm_objects_s): .KATI_NINJA_POOL := $(my_pool)
 $(asm_objects_s): $(intermediates)/%.o: $(TOPDIR)$(LOCAL_PATH)/%.s \
     $(my_additional_dependencies) $(CLANG)
 	$(transform-$(PRIVATE_HOST)s-to-o)
@@ -1441,10 +1462,10 @@
 
 # Check if -Werror or -Wno-error is used in C compiler flags.
 # Header libraries do not need cflags.
+my_all_cflags := $(my_cflags) $(my_cppflags) $(my_cflags_no_override)
 ifneq (HEADER_LIBRARIES,$(LOCAL_MODULE_CLASS))
   # Prebuilt modules do not need cflags.
   ifeq (,$(LOCAL_PREBUILT_MODULE_FILE))
-    my_all_cflags := $(my_cflags) $(my_cppflags) $(my_cflags_no_override)
     # Issue warning if -Wno-error is used.
     ifneq (,$(filter -Wno-error,$(my_all_cflags)))
       $(eval MODULES_USING_WNO_ERROR := $(MODULES_USING_WNO_ERROR) $(LOCAL_MODULE_MAKEFILE):$(LOCAL_MODULE))
@@ -1463,6 +1484,13 @@
   endif
 endif
 
+ifneq (,$(filter -Weverything,$(my_all_cflags)))
+  ifeq (,$(ANDROID_TEMPORARILY_ALLOW_WEVERYTHING))
+    $(call pretty-error, -Weverything is not allowed in Android.mk files.\
+      Build with `m ANDROID_TEMPORARILY_ALLOW_WEVERYTHING=true` to experiment locally with -Weverything.)
+  endif
+endif
+
 # Disable clang-tidy if it is not found.
 ifeq ($(PATH_TO_CLANG_TIDY),)
   my_tidy_enabled := false
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 4818c01..9ff978b 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -106,6 +106,7 @@
 LOCAL_FULL_MANIFEST_FILE:=
 LOCAL_FULL_TEST_CONFIG:=
 LOCAL_FUZZ_ENGINE:=
+LOCAL_FUZZ_INSTALLED_SHARED_DEPS:=
 LOCAL_GCNO_FILES:=
 LOCAL_GENERATED_SOURCES:=
 # Group static libraries with "-Wl,--start-group" and "-Wl,--end-group" when linking.
diff --git a/core/config.mk b/core/config.mk
index a1bbe18..9ab3fff 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -1150,6 +1150,21 @@
     $(filter $(ANDROID_WARNING_ALLOWED_PROJECTS),$(1)/)
 endef
 
+GOMA_POOL :=
+RBE_POOL :=
+GOMA_OR_RBE_POOL :=
+# When goma or RBE are enabled, kati will be passed --default_pool=local_pool to put
+# most rules into the local pool.  Explicitly set the pool to "none" for rules that
+# should be run outside the local pool, i.e. with -j500.
+ifneq (,$(filter-out false,$(USE_GOMA)))
+  GOMA_POOL := none
+  GOMA_OR_RBE_POOL := none
+else ifneq (,$(filter-out false,$(USE_RBE)))
+  RBE_POOL := none
+  GOMA_OR_RBE_POOL := none
+endif
+.KATI_READONLY := GOMA_POOL RBE_POOL GOMA_OR_RBE_POOL
+
 # These goals don't need to collect and include Android.mks/CleanSpec.mks
 # in the source tree.
 dont_bother_goals := out \
diff --git a/core/definitions.mk b/core/definitions.mk
index 1bf7fa9..63e609e 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -1363,8 +1363,10 @@
 # $(1): the C++ source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-cpp-file
 o := $(intermediates)/$(patsubst %$(LOCAL_CPP_EXTENSION),%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
+$$(o) : .KATI_NINJA_POOL := $(4)
 $$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG_CXX)
 	$$(transform-$$(PRIVATE_HOST)cpp-to-o)
 $$(call include-depfiles-for-objs, $$(o))
@@ -1376,8 +1378,10 @@
 # $(1): the C source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-c-file
 o := $(intermediates)/$(patsubst %.c,%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
+$$(o) : .KATI_NINJA_POOL := $(4)
 $$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG)
 	$$(transform-$$(PRIVATE_HOST)c-to-o)
 $$(call include-depfiles-for-objs, $$(o))
@@ -1389,8 +1393,10 @@
 # $(1): the .S source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-s-file
 o := $(intermediates)/$(patsubst %.S,%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
+$$(o) : .KATI_NINJA_POOL := $(4)
 $$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG)
 	$$(transform-$$(PRIVATE_HOST)s-to-o)
 $$(call include-depfiles-for-objs, $$(o))
@@ -1402,8 +1408,10 @@
 # $(1): the .s source file in LOCAL_SRC_FILES.
 # $(2): the additional dependencies.
 # $(3): the variable name to collect the output object file.
+# $(4): the ninja pool to use for the rule
 define compile-dotdot-s-file-no-deps
 o := $(intermediates)/$(patsubst %.s,%.o,$(subst ../,$(DOTDOT_REPLACEMENT),$(1)))
+$$(o) : .KATI_NINJA_POOL := $(4)
 $$(o) : $(TOPDIR)$(LOCAL_PATH)/$(1) $(2) $(CLANG)
 	$$(transform-$$(PRIVATE_HOST)s-to-o)
 $(3) += $$(o)
@@ -2099,8 +2107,12 @@
     --output $@.premerged --temp_dir $(dir $@)/classes-turbine \
     --sources \@$(PRIVATE_JAVA_SOURCE_LIST) --source_jars $(PRIVATE_SRCJARS) \
     --javacopts $(PRIVATE_JAVACFLAGS) $(COMMON_JDK_FLAGS) -- \
-    $(addprefix --bootclasspath ,$(strip $(PRIVATE_BOOTCLASSPATH))) \
-    $(addprefix --classpath ,$(strip $(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))) \
+    $(if $(PRIVATE_USE_SYSTEM_MODULES), \
+      --system $(PRIVATE_SYSTEM_MODULES_DIR), \
+      --bootclasspath $(strip $(PRIVATE_BOOTCLASSPATH))) \
+    --classpath $(strip $(if $(PRIVATE_USE_SYSTEM_MODULES), \
+        $(filter-out $(PRIVATE_SYSTEM_MODULES_LIBS),$(PRIVATE_BOOTCLASSPATH))) \
+      $(PRIVATE_ALL_JAVA_HEADER_LIBRARIES)) \
     || ( rm -rf $(dir $@)/classes-turbine ; exit 41 ) && \
     $(MERGE_ZIPS) -j --ignore-duplicates -stripDir META-INF $@.tmp $@.premerged $(PRIVATE_STATIC_JAVA_HEADER_LIBRARIES) ; \
 else \
@@ -2457,12 +2469,22 @@
 	$(call intermediates-dir-for,ETC,passwd_system)/passwd_system \
 	$(call intermediates-dir-for,ETC,passwd_vendor)/passwd_vendor \
 	$(call intermediates-dir-for,ETC,passwd_odm)/passwd_odm \
-	$(call intermediates-dir-for,ETC,passwd_product)/passwd_product
+	$(call intermediates-dir-for,ETC,passwd_product)/passwd_product \
+	$(call intermediates-dir-for,ETC,plat_property_contexts)/plat_property_contexts \
+	$(call intermediates-dir-for,ETC,system_ext_property_contexts)/system_ext_property_contexts \
+	$(call intermediates-dir-for,ETC,product_property_contexts)/product_property_contexts \
+	$(call intermediates-dir-for,ETC,vendor_property_contexts)/vendor_property_contexts \
+	$(call intermediates-dir-for,ETC,odm_property_contexts)/odm_property_contexts
 	$(hide) $(HOST_INIT_VERIFIER) \
 	  -p $(call intermediates-dir-for,ETC,passwd_system)/passwd_system \
 	  -p $(call intermediates-dir-for,ETC,passwd_vendor)/passwd_vendor \
 	  -p $(call intermediates-dir-for,ETC,passwd_odm)/passwd_odm \
 	  -p $(call intermediates-dir-for,ETC,passwd_product)/passwd_product \
+	  --property-contexts=$(call intermediates-dir-for,ETC,plat_property_contexts)/plat_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,system_ext_property_contexts)/system_ext_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,product_property_contexts)/product_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,vendor_property_contexts)/vendor_property_contexts \
+	  --property-contexts=$(call intermediates-dir-for,ETC,odm_property_contexts)/odm_property_contexts \
 	  $$<
 else
 $(2): $(1)
diff --git a/core/dex_preopt_config.mk b/core/dex_preopt_config.mk
index 3875815..64ad8d9 100644
--- a/core/dex_preopt_config.mk
+++ b/core/dex_preopt_config.mk
@@ -80,7 +80,7 @@
 
   $(call json_start)
 
-  $(call add_json_bool, DisablePreopt,                      $(call invert_bool,$(filter true,$(WITH_DEXPREOPT))))
+  $(call add_json_bool, DisablePreopt,                      $(call invert_bool,$(and $(filter true,$(PRODUCT_USES_DEFAULT_ART_CONFIG)),$(filter true,$(WITH_DEXPREOPT)))))
   $(call add_json_list, DisablePreoptModules,               $(DEXPREOPT_DISABLED_MODULES))
   $(call add_json_bool, OnlyPreoptBootImageAndSystemServer, $(filter true,$(WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY)))
   $(call add_json_bool, GenerateApexImage,                  $(filter true,$(DEXPREOPT_GENERATE_APEX_IMAGE)))
diff --git a/core/host_dalvik_java_library.mk b/core/host_dalvik_java_library.mk
index 8e655ff..882fe3a 100644
--- a/core/host_dalvik_java_library.mk
+++ b/core/host_dalvik_java_library.mk
@@ -79,6 +79,7 @@
 $(java_source_list_file): $(java_sources_deps)
 	$(write-java-source-list)
 
+$(full_classes_compiled_jar): .KATI_NINJA_POOL := $(GOMA_POOL)
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index 6c23789..beaea2a 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -70,6 +70,7 @@
 $(java_source_list_file): $(java_sources_deps)
 	$(write-java-source-list)
 
+$(full_classes_compiled_jar): .KATI_NINJA_POOL := $(GOMA_POOL)
 $(full_classes_compiled_jar): PRIVATE_JAVA_LAYERS_FILE := $(layers_file)
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES :=
diff --git a/core/java.mk b/core/java.mk
index 99774cf..cbcd1b5 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -274,6 +274,7 @@
 
 endif # TURBINE_ENABLED != false
 
+$(full_classes_compiled_jar): .KATI_NINJA_POOL := $(GOMA_POOL)
 $(full_classes_compiled_jar): PRIVATE_JAVACFLAGS := $(LOCAL_JAVACFLAGS) $(annotation_processor_flags)
 $(full_classes_compiled_jar): PRIVATE_JAR_EXCLUDE_FILES := $(LOCAL_JAR_EXCLUDE_FILES)
 $(full_classes_compiled_jar): PRIVATE_JAR_PACKAGES := $(LOCAL_JAR_PACKAGES)
diff --git a/core/local_systemsdk.mk b/core/local_systemsdk.mk
index 6c022f2..2b73f93 100644
--- a/core/local_systemsdk.mk
+++ b/core/local_systemsdk.mk
@@ -16,16 +16,20 @@
 
 ifdef BOARD_SYSTEMSDK_VERSIONS
   # Apps and jars in vendor or odm partition are forced to build against System SDK.
-  _is_vendor_app :=
+  _cannot_use_platform_apis :=
   ifneq (,$(filter true,$(LOCAL_VENDOR_MODULE) $(LOCAL_ODM_MODULE) $(LOCAL_PROPRIETARY_MODULE)))
     # Note: no need to check LOCAL_MODULE_PATH* since LOCAL_[VENDOR|ODM|OEM]_MODULE is already
     # set correctly before this is included.
-    _is_vendor_app := true
+    _cannot_use_platform_apis := true
+  else ifeq ($(LOCAL_PRODUCT_MODULE),true)
+    ifeq ($(PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE),true)
+      _cannot_use_platform_apis := true
+    endif
   endif
   ifneq (,$(filter JAVA_LIBRARIES APPS,$(LOCAL_MODULE_CLASS)))
     ifndef LOCAL_SDK_VERSION
-      ifeq ($(_is_vendor_app),true)
-        ifeq (,$(filter %__auto_generated_rro_vendor,$(LOCAL_MODULE)))
+      ifeq ($(_cannot_use_platform_apis),true)
+        ifeq (,$(findstring __auto_generated_rro_,$(LOCAL_MODULE)))
           # Runtime resource overlays are exempted from building against System SDK.
           # TODO(b/35859726): remove this exception
           LOCAL_SDK_VERSION := system_current
@@ -39,7 +43,7 @@
 # The range of support versions becomes narrower when BOARD_SYSTEMSDK_VERSIONS
 # is set, which is a subset of PLATFORM_SYSTEMSDK_VERSIONS.
 ifneq (,$(call has-system-sdk-version,$(LOCAL_SDK_VERSION)))
-  ifneq ($(_is_vendor_app),true)
+  ifneq ($(_cannot_use_platform_apis),true)
     # apps bundled in system partition can use all system sdk versions provided by the platform
     _supported_systemsdk_versions := $(PLATFORM_SYSTEMSDK_VERSIONS)
   else ifdef BOARD_SYSTEMSDK_VERSIONS
diff --git a/core/main.mk b/core/main.mk
index 68f658a..520ff13 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -969,7 +969,7 @@
 # Expand a list of modules to the modules that they override (if any)
 # $(1): The list of modules.
 define module-overrides
-$(foreach m,$(1),$(PACKAGES.$(m).OVERRIDES) $(EXECUTABLES.$(m).OVERRIDES) $(SHARED_LIBRARIES.$(m).OVERRIDES))
+$(foreach m,$(1),$(PACKAGES.$(m).OVERRIDES) $(EXECUTABLES.$(m).OVERRIDES) $(SHARED_LIBRARIES.$(m).OVERRIDES) $(ETC.$(m).OVERRIDES))
 endef
 
 ###########################################################
@@ -1044,14 +1044,13 @@
 #   32-bit variant, if it exits. See the select-bitness-of-required-modules definition.
 # $(1): product makefile
 define product-installed-files
-  $(eval _mk := $(strip $(1))) \
   $(eval _pif_modules := \
-    $(PRODUCTS.$(_mk).PRODUCT_PACKAGES) \
-    $(if $(filter eng,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_ENG)) \
-    $(if $(filter debug,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_DEBUG)) \
-    $(if $(filter tests,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_TESTS)) \
-    $(if $(filter asan,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_DEBUG_ASAN)) \
-    $(if $(filter java_coverage,$(tags_to_install)),$(PRODUCTS.$(_mk).PRODUCT_PACKAGES_DEBUG_JAVA_COVERAGE)) \
+    $(call get-product-var,$(1),PRODUCT_PACKAGES) \
+    $(if $(filter eng,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_ENG)) \
+    $(if $(filter debug,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_DEBUG)) \
+    $(if $(filter tests,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_TESTS)) \
+    $(if $(filter asan,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_DEBUG_ASAN)) \
+    $(if $(filter java_coverage,$(tags_to_install)),$(call get-product-var,$(1),PRODUCT_PACKAGES_DEBUG_JAVA_COVERAGE)) \
     $(call auto-included-modules) \
   ) \
   $(eval ### Filter out the overridden packages and executables before doing expansion) \
@@ -1070,13 +1069,13 @@
   $(call expand-required-modules,_pif_modules,$(_pif_modules),$(_pif_overrides)) \
   $(filter-out $(HOST_OUT_ROOT)/%,$(call module-installed-files, $(_pif_modules))) \
   $(call resolve-product-relative-paths,\
-    $(foreach cf,$(PRODUCTS.$(_mk).PRODUCT_COPY_FILES),$(call word-colon,2,$(cf))))
+    $(foreach cf,$(call get-product-var,$(1),PRODUCT_COPY_FILES),$(call word-colon,2,$(cf))))
 endef
 
 # Similar to product-installed-files above, but handles PRODUCT_HOST_PACKAGES instead
 # This does support the :32 / :64 syntax, but does not support module overrides.
 define host-installed-files
-  $(eval _hif_modules := $(PRODUCTS.$(strip $(1)).PRODUCT_HOST_PACKAGES)) \
+  $(eval _hif_modules := $(call get-product-var,$(1),PRODUCT_HOST_PACKAGES)) \
   $(eval ### Resolve the :32 :64 module name) \
   $(eval _hif_modules_32 := $(patsubst %:32,%,$(filter %:32, $(_hif_modules)))) \
   $(eval _hif_modules_64 := $(patsubst %:64,%,$(filter %:64, $(_hif_modules)))) \
@@ -1317,11 +1316,11 @@
 
   # Some modules produce only host installed files when building with TARGET_BUILD_APPS
   ifeq ($(TARGET_BUILD_APPS),)
-    _modules := $(foreach m,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG_ASAN) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_ENG) \
-                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_TESTS),\
+    _modules := $(foreach m,$(PRODUCT_PACKAGES) \
+                            $(PRODUCT_PACKAGES_DEBUG) \
+                            $(PRODUCT_PACKAGES_DEBUG_ASAN) \
+                            $(PRODUCT_PACKAGES_ENG) \
+                            $(PRODUCT_PACKAGES_TESTS),\
                   $(if $(ALL_MODULES.$(m).INSTALLED),\
                     $(if $(filter-out $(HOST_OUT_ROOT)/%,$(ALL_MODULES.$(m).INSTALLED)),,\
                       $(m))))
diff --git a/core/misc_prebuilt_internal.mk b/core/misc_prebuilt_internal.mk
index a52b9e5..921ea52 100644
--- a/core/misc_prebuilt_internal.mk
+++ b/core/misc_prebuilt_internal.mk
@@ -18,7 +18,7 @@
 # Internal build rules for misc prebuilt modules that don't need additional processing
 ############################################################
 
-prebuilt_module_classes := SCRIPT ETC DATA
+prebuilt_module_classes := SCRIPT ETC DATA RENDERSCRIPT_BITCODE
 ifeq ($(filter $(prebuilt_module_classes),$(LOCAL_MODULE_CLASS)),)
 $(call pretty-error,misc_prebuilt_internal.mk is for $(prebuilt_module_classes) modules only)
 endif
diff --git a/core/notice_files.mk b/core/notice_files.mk
index 680a0b1..9df1c11 100644
--- a/core/notice_files.mk
+++ b/core/notice_files.mk
@@ -71,8 +71,11 @@
       # javalib.jar is the default name for the build module (and isn't meaningful)
       # If that's what we have, substitute the module name instead.  These files
       # aren't included on the device, so this name is synthetic anyway.
+      # Extra path "static" is added to try to avoid name conflict between the notice file of
+      # this 'uninstallable' Java module and the notice file for another 'installable' Java module
+      # whose stem is the same as this module's name.
       ifneq ($(filter javalib.jar,$(module_leaf)),)
-        module_leaf := $(LOCAL_MODULE).jar
+        module_leaf := static/$(LOCAL_MODULE).jar
       endif
       module_installed_filename := \
           $(patsubst $(PRODUCT_OUT)/%,%,$($(my_prefix)OUT_JAVA_LIBRARIES))/$(module_leaf)
diff --git a/core/prebuilt_internal.mk b/core/prebuilt_internal.mk
index 7006667..ef1471d 100644
--- a/core/prebuilt_internal.mk
+++ b/core/prebuilt_internal.mk
@@ -51,7 +51,7 @@
   include $(BUILD_SYSTEM)/java_prebuilt_internal.mk
 else ifneq ($(filter STATIC_LIBRARIES SHARED_LIBRARIES EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
   include $(BUILD_SYSTEM)/cc_prebuilt_internal.mk
-else ifneq ($(filter SCRIPT ETC DATA,$(LOCAL_MODULE_CLASS)),)
+else ifneq ($(filter SCRIPT ETC DATA RENDERSCRIPT_BITCODE,$(LOCAL_MODULE_CLASS)),)
   include $(BUILD_SYSTEM)/misc_prebuilt_internal.mk
 else
   $(error $(LOCAL_MODULE) : unexpected LOCAL_MODULE_CLASS for prebuilts: $(LOCAL_MODULE_CLASS))
diff --git a/core/product-graph.mk b/core/product-graph.mk
index b97a69d..968d01b 100644
--- a/core/product-graph.mk
+++ b/core/product-graph.mk
@@ -33,7 +33,6 @@
 	)
 endef
 
-
 this_makefile := build/make/core/product-graph.mk
 
 products_graph := $(OUT_DIR)/products.dot
@@ -71,7 +70,7 @@
 # $(2) the output file
 define emit-product-node-props
 $(hide) echo \"$(1)\" [ \
-label=\"$(dir $(1))\\n$(notdir $(1))\\n\\n$(subst $(close_parenthesis),,$(subst $(open_parethesis),,$(PRODUCTS.$(strip $(1)).PRODUCT_MODEL)))\\n$(PRODUCTS.$(strip $(1)).PRODUCT_DEVICE)\" \
+label=\"$(dir $(1))\\n$(notdir $(1))\\n\\n$(subst $(close_parenthesis),,$(subst $(open_parethesis),,$(call get-product-var,$(1),PRODUCT_MODEL)))\\n$(call get-product-var,$(1),PRODUCT_DEVICE)\" \
 style=\"filled\" fillcolor=\"$(strip $(call node-color,$(1)))\" \
 colorscheme=\"svg\" fontcolor=\"darkblue\" href=\"products/$(1).html\" \
 ] >> $(2)
@@ -105,35 +104,35 @@
 	$(hide) rm -f $$@
 	$(hide) mkdir -p $$(dir $$@)
 	$(hide) echo 'FILE=$(strip $(1))' >> $$@
-	$(hide) echo 'PRODUCT_NAME=$$(PRODUCTS.$(strip $(1)).PRODUCT_NAME)' >> $$@
-	$(hide) echo 'PRODUCT_MODEL=$$(PRODUCTS.$(strip $(1)).PRODUCT_MODEL)' >> $$@
-	$(hide) echo 'PRODUCT_LOCALES=$$(PRODUCTS.$(strip $(1)).PRODUCT_LOCALES)' >> $$@
-	$(hide) echo 'PRODUCT_AAPT_CONFIG=$$(PRODUCTS.$(strip $(1)).PRODUCT_AAPT_CONFIG)' >> $$@
-	$(hide) echo 'PRODUCT_AAPT_PREF_CONFIG=$$(PRODUCTS.$(strip $(1)).PRODUCT_AAPT_PREF_CONFIG)' >> $$@
-	$(hide) echo 'PRODUCT_PACKAGES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PACKAGES)' >> $$@
-	$(hide) echo 'PRODUCT_DEVICE=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEVICE)' >> $$@
-	$(hide) echo 'PRODUCT_MANUFACTURER=$$(PRODUCTS.$(strip $(1)).PRODUCT_MANUFACTURER)' >> $$@
-	$(hide) echo 'PRODUCT_PROPERTY_OVERRIDES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PROPERTY_OVERRIDES)' >> $$@
-	$(hide) echo 'PRODUCT_DEFAULT_PROPERTY_OVERRIDES=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_PROPERTY_OVERRIDES)' >> $$@
-	$(hide) echo 'PRODUCT_SYSTEM_DEFAULT_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SYSTEM_DEFAULT_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_PRODUCT_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_PRODUCT_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_SYSTEM_EXT_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SYSTEM_EXT_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_ODM_PROPERTIES=$$(PRODUCTS.$(strip $(1)).PRODUCT_ODM_PROPERTIES)' >> $$@
-	$(hide) echo 'PRODUCT_CHARACTERISTICS=$$(PRODUCTS.$(strip $(1)).PRODUCT_CHARACTERISTICS)' >> $$@
-	$(hide) echo 'PRODUCT_COPY_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_COPY_FILES)' >> $$@
-	$(hide) echo 'PRODUCT_OTA_PUBLIC_KEYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_OTA_PUBLIC_KEYS)' >> $$@
-	$(hide) echo 'PRODUCT_EXTRA_RECOVERY_KEYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_EXTRA_RECOVERY_KEYS)' >> $$@
-	$(hide) echo 'PRODUCT_PACKAGE_OVERLAYS=$$(PRODUCTS.$(strip $(1)).PRODUCT_PACKAGE_OVERLAYS)' >> $$@
-	$(hide) echo 'DEVICE_PACKAGE_OVERLAYS=$$(PRODUCTS.$(strip $(1)).DEVICE_PACKAGE_OVERLAYS)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_NAME=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_NAME)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_COPY_FILES)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_MODULES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_COPY_MODULES)' >> $$@
-	$(hide) echo 'PRODUCT_SDK_ADDON_DOC_MODULES=$$(PRODUCTS.$(strip $(1)).PRODUCT_SDK_ADDON_DOC_MODULES)' >> $$@
-	$(hide) echo 'PRODUCT_DEFAULT_WIFI_CHANNELS=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_WIFI_CHANNELS)' >> $$@
-	$(hide) echo 'PRODUCT_DEFAULT_DEV_CERTIFICATE=$$(PRODUCTS.$(strip $(1)).PRODUCT_DEFAULT_DEV_CERTIFICATE)' >> $$@
-	$(hide) echo 'PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES=$$(PRODUCTS.$(strip $(1)).PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES)' >> $$@
-	$(hide) echo 'PRODUCT_RESTRICT_VENDOR_FILES=$$(PRODUCTS.$(strip $(1)).PRODUCT_RESTRICT_VENDOR_FILES)' >> $$@
-	$(hide) echo 'PRODUCT_VENDOR_KERNEL_HEADERS=$$(PRODUCTS.$(strip $(1)).PRODUCT_VENDOR_KERNEL_HEADERS)' >> $$@
+	$(hide) echo 'PRODUCT_NAME=$(call get-product-var,$(1),PRODUCT_NAME)' >> $$@
+	$(hide) echo 'PRODUCT_MODEL=$(call get-product-var,$(1),PRODUCT_MODEL)' >> $$@
+	$(hide) echo 'PRODUCT_LOCALES=$(call get-product-var,$(1),PRODUCT_LOCALES)' >> $$@
+	$(hide) echo 'PRODUCT_AAPT_CONFIG=$(call get-product-var,$(1),PRODUCT_AAPT_CONFIG)' >> $$@
+	$(hide) echo 'PRODUCT_AAPT_PREF_CONFIG=$(call get-product-var,$(1),PRODUCT_AAPT_PREF_CONFIG)' >> $$@
+	$(hide) echo 'PRODUCT_PACKAGES=$(call get-product-var,$(1),PRODUCT_PACKAGES)' >> $$@
+	$(hide) echo 'PRODUCT_DEVICE=$(call get-product-var,$(1),PRODUCT_DEVICE)' >> $$@
+	$(hide) echo 'PRODUCT_MANUFACTURER=$(call get-product-var,$(1),PRODUCT_MANUFACTURER)' >> $$@
+	$(hide) echo 'PRODUCT_PROPERTY_OVERRIDES=$(call get-product-var,$(1),PRODUCT_PROPERTY_OVERRIDES)' >> $$@
+	$(hide) echo 'PRODUCT_DEFAULT_PROPERTY_OVERRIDES=$(call get-product-var,$(1),PRODUCT_DEFAULT_PROPERTY_OVERRIDES)' >> $$@
+	$(hide) echo 'PRODUCT_SYSTEM_DEFAULT_PROPERTIES=$(call get-product-var,$(1),PRODUCT_SYSTEM_DEFAULT_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_PRODUCT_PROPERTIES=$(call get-product-var,$(1),PRODUCT_PRODUCT_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_SYSTEM_EXT_PROPERTIES=$(call get-product-var,$(1),PRODUCT_SYSTEM_EXT_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_ODM_PROPERTIES=$(call get-product-var,$(1),PRODUCT_ODM_PROPERTIES)' >> $$@
+	$(hide) echo 'PRODUCT_CHARACTERISTICS=$(call get-product-var,$(1),PRODUCT_CHARACTERISTICS)' >> $$@
+	$(hide) echo 'PRODUCT_COPY_FILES=$(call get-product-var,$(1),PRODUCT_COPY_FILES)' >> $$@
+	$(hide) echo 'PRODUCT_OTA_PUBLIC_KEYS=$(call get-product-var,$(1),PRODUCT_OTA_PUBLIC_KEYS)' >> $$@
+	$(hide) echo 'PRODUCT_EXTRA_RECOVERY_KEYS=$(call get-product-var,$(1),PRODUCT_EXTRA_RECOVERY_KEYS)' >> $$@
+	$(hide) echo 'PRODUCT_PACKAGE_OVERLAYS=$(call get-product-var,$(1),PRODUCT_PACKAGE_OVERLAYS)' >> $$@
+	$(hide) echo 'DEVICE_PACKAGE_OVERLAYS=$(call get-product-var,$(1),DEVICE_PACKAGE_OVERLAYS)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_NAME=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_NAME)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_FILES=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_COPY_FILES)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_COPY_MODULES=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_COPY_MODULES)' >> $$@
+	$(hide) echo 'PRODUCT_SDK_ADDON_DOC_MODULES=$(call get-product-var,$(1),PRODUCT_SDK_ADDON_DOC_MODULES)' >> $$@
+	$(hide) echo 'PRODUCT_DEFAULT_WIFI_CHANNELS=$(call get-product-var,$(1),PRODUCT_DEFAULT_WIFI_CHANNELS)' >> $$@
+	$(hide) echo 'PRODUCT_DEFAULT_DEV_CERTIFICATE=$(call get-product-var,$(1),PRODUCT_DEFAULT_DEV_CERTIFICATE)' >> $$@
+	$(hide) echo 'PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES=$(call get-product-var,$(1),PRODUCT_MAINLINE_SEPOLICY_DEV_CERTIFICATES)' >> $$@
+	$(hide) echo 'PRODUCT_RESTRICT_VENDOR_FILES=$(call get-product-var,$(1),PRODUCT_RESTRICT_VENDOR_FILES)' >> $$@
+	$(hide) echo 'PRODUCT_VENDOR_KERNEL_HEADERS=$(call get-product-var,$(1),PRODUCT_VENDOR_KERNEL_HEADERS)' >> $$@
 
 $(call product-debug-filename, $(p)): \
 			$(OUT_DIR)/products/$(strip $(1)).txt \
diff --git a/core/product.mk b/core/product.mk
index 2c89fab..102e6a5 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -376,13 +376,16 @@
 # If set, device retrofits virtual A/B.
 _product_single_value_vars += PRODUCT_VIRTUAL_AB_OTA_RETROFIT
 
+# If set, Java module in product partition cannot use hidden APIs.
+_product_single_value_vars += PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE
+
 .KATI_READONLY := _product_single_value_vars _product_list_vars
 _product_var_list :=$= $(_product_single_value_vars) $(_product_list_vars)
 
 define dump-product
 $(warning ==== $(1) ====)\
 $(foreach v,$(_product_var_list),\
-$(warning PRODUCTS.$(1).$(v) := $(PRODUCTS.$(1).$(v))))\
+$(warning PRODUCTS.$(1).$(v) := $(call get-product-var,$(1),$(v))))\
 $(warning --------)
 endef
 
@@ -547,6 +550,8 @@
 $(call readonly-variables,$(_readonly_late_variables))
 endef
 
+# Macro re-defined inside strip-product-vars.
+get-product-var = $(PRODUCTS.$(strip $(1)).$(2))
 #
 # Strip the variables in _product_var_list and a few build-system
 # internal variables, and assign the ones for the current product
@@ -558,6 +563,8 @@
     PRODUCT_ENFORCE_PACKAGES_EXIST \
     PRODUCT_ENFORCE_PACKAGES_EXIST_WHITELIST, \
   $(eval $(v) := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).$(v)))) \
+  $(eval get-product-var = $$(if $$(filter $$(1),$$(INTERNAL_PRODUCT)),$$($$(2)),$$(PRODUCTS.$$(strip $$(1)).$$(2)))) \
+  $(KATI_obsolete_var PRODUCTS.$(INTERNAL_PRODUCT).$(v),Use $(v) instead) \
 )
 endef
 
diff --git a/core/rust_host_test_config_template.xml b/core/rust_host_test_config_template.xml
new file mode 100644
index 0000000..fc23fbe
--- /dev/null
+++ b/core/rust_host_test_config_template.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<configuration description="Config to run {MODULE} host tests">
+    <test class="com.android.tradefed.testtype.rust.RustBinaryHostTest" >
+        <option name="test-file" value="{MODULE}" />
+        <option name="test-timeout" value="5m" />
+    </test>
+</configuration>
diff --git a/core/soong_cc_prebuilt.mk b/core/soong_cc_prebuilt.mk
index 20950ca..2d5089d 100644
--- a/core/soong_cc_prebuilt.mk
+++ b/core/soong_cc_prebuilt.mk
@@ -220,3 +220,9 @@
 
 $(notice_target): | $(installed_static_library_notice_file_targets)
 $(LOCAL_INSTALLED_MODULE): | $(notice_target)
+
+# Reinstall shared library dependencies of fuzz targets to /data/fuzz/ (for
+# target) or /data/ (for host).
+ifdef LOCAL_IS_FUZZ_TARGET
+$(LOCAL_INSTALLED_MODULE): $(LOCAL_FUZZ_INSTALLED_SHARED_DEPS)
+endif
diff --git a/core/soong_config.mk b/core/soong_config.mk
index bcd025b..7ce59f1 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -105,6 +105,8 @@
 $(call add_json_list, XOMExcludePaths,                   $(XOM_EXCLUDE_PATHS) $(PRODUCT_XOM_EXCLUDE_PATHS))
 $(call add_json_list, IntegerOverflowExcludePaths,       $(INTEGER_OVERFLOW_EXCLUDE_PATHS) $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
 
+$(call add_json_bool, Experimental_mte,                  $(filter true,$(TARGET_EXPERIMENTAL_MTE)))
+
 $(call add_json_bool, DisableScudo,                      $(filter true,$(PRODUCT_DISABLE_SCUDO)))
 
 $(call add_json_bool, ClangTidy,                         $(filter 1 true,$(WITH_TIDY)))
@@ -195,6 +197,8 @@
   $(call end_json_map))
 $(call end_json_map)
 
+$(call add_json_bool, EnforceProductPartitionInterface,  $(PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE))
+
 $(call json_end)
 
 $(file >$(SOONG_VARIABLES).tmp,$(json_contents))
diff --git a/core/soong_rust_prebuilt.mk b/core/soong_rust_prebuilt.mk
index 23d18c4..4a9eb4a 100644
--- a/core/soong_rust_prebuilt.mk
+++ b/core/soong_rust_prebuilt.mk
@@ -58,7 +58,7 @@
 
 $(LOCAL_BUILT_MODULE): $(LOCAL_PREBUILT_MODULE_FILE)
 	$(transform-prebuilt-to-target)
-ifneq ($(filter EXECUTABLES,$(LOCAL_MODULE_CLASS)),)
+ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
 	$(hide) chmod +x $@
 endif
 
diff --git a/core/tasks/vndk.mk b/core/tasks/vndk.mk
index 3c4d942..dccb5f6 100644
--- a/core/tasks/vndk.mk
+++ b/core/tasks/vndk.mk
@@ -23,88 +23,10 @@
 # BOARD_VNDK_RUNTIME_DISABLE must not be set to 'true'.
 ifneq ($(BOARD_VNDK_RUNTIME_DISABLE),true)
 
-# Returns list of src:dest paths of the intermediate objs
-#
-# Args:
-#   $(1): list of module and filename pairs (e.g., ld.config.txt:ld.config.27.txt ...)
-define paths-of-intermediates
-$(strip \
-  $(foreach pair,$(1), \
-    $(eval module := $(call word-colon,1,$(pair))) \
-    $(eval built := $(ALL_MODULES.$(module).BUILT_INSTALLED)) \
-    $(eval filename := $(call word-colon,2,$(pair))) \
-    $(if $(wordlist 2,100,$(built)), \
-      $(error Unable to handle multiple built files ($(module)): $(built))) \
-    $(if $(built),$(call word-colon,1,$(built)):$(filename)) \
-  ) \
-)
-endef
-
-vndk_prebuilt_txts := \
-  ld.config.txt \
-  vndksp.libraries.txt \
-  llndk.libraries.txt
-
-vndk_snapshot_top := $(call intermediates-dir-for,PACKAGING,vndk-snapshot)
-vndk_snapshot_out := $(vndk_snapshot_top)/vndk-snapshot
-vndk_snapshot_soong_dir := $(call intermediates-dir-for,PACKAGING,vndk-snapshot-soong)
-
-#######################################
-# vndk_snapshot_zip
-vndk_snapshot_variant := $(vndk_snapshot_out)/$(TARGET_ARCH)
-vndk_snapshot_zip := $(PRODUCT_OUT)/android-vndk-$(TARGET_PRODUCT).zip
-
-$(vndk_snapshot_zip): PRIVATE_VNDK_SNAPSHOT_OUT := $(vndk_snapshot_out)
-
-deps := $(call paths-of-intermediates,$(foreach txt,$(vndk_prebuilt_txts), \
-          $(txt):$(patsubst %.txt,%.$(PLATFORM_VNDK_VERSION).txt,$(txt))))
-$(vndk_snapshot_zip): PRIVATE_CONFIGS_OUT := $(vndk_snapshot_variant)/configs
-$(vndk_snapshot_zip): PRIVATE_CONFIGS_INTERMEDIATES := $(deps)
-$(vndk_snapshot_zip): $(foreach d,$(deps),$(call word-colon,1,$(d)))
-deps :=
-
-vndk_snapshot_soong_files := $(call copy-many-files, $(SOONG_VNDK_SNAPSHOT_FILES), $(vndk_snapshot_soong_dir))
-
-$(vndk_snapshot_zip): PRIVATE_VNDK_SNAPSHOT_SOONG_DIR := $(vndk_snapshot_soong_dir)
-$(vndk_snapshot_zip): PRIVATE_VNDK_SNAPSHOT_SOONG_FILES := $(sort $(vndk_snapshot_soong_files))
-$(vndk_snapshot_zip): $(vndk_snapshot_soong_files)
-
-# Args
-#   $(1): destination directory
-#   $(2): list of files (src:dest) to copy
-$(vndk_snapshot_zip): private-copy-intermediates = \
-  $(if $(2),$(strip \
-    @mkdir -p $(1) && \
-    $(foreach file,$(2), \
-      cp $(call word-colon,1,$(file)) $(call append-path,$(1),$(call word-colon,2,$(file))) && \
-    ) \
-    true \
-  ))
-
-$(vndk_snapshot_zip): $(SOONG_ZIP)
-	@echo 'Generating VNDK snapshot: $@'
-	@rm -f $@
-	@rm -rf $(PRIVATE_VNDK_SNAPSHOT_OUT)
-	@mkdir -p $(PRIVATE_VNDK_SNAPSHOT_OUT)
-	$(call private-copy-intermediates, \
-		$(PRIVATE_CONFIGS_OUT),$(PRIVATE_CONFIGS_INTERMEDIATES))
-	$(hide) $(SOONG_ZIP) -o $@ -C $(PRIVATE_VNDK_SNAPSHOT_OUT) -D $(PRIVATE_VNDK_SNAPSHOT_OUT) \
-		-C $(PRIVATE_VNDK_SNAPSHOT_SOONG_DIR) $(foreach f,$(PRIVATE_VNDK_SNAPSHOT_SOONG_FILES),-f $(f))
-
 .PHONY: vndk
-vndk: $(vndk_snapshot_zip)
+vndk: $(SOONG_VNDK_SNAPSHOT_ZIP)
 
-$(call dist-for-goals, vndk, $(vndk_snapshot_zip))
-
-# clear global vars
-clang-ubsan-vndk-core :=
-paths-of-intermediates :=
-vndk_prebuilt_txts :=
-vndk_snapshot_top :=
-vndk_snapshot_out :=
-vndk_snapshot_soong_dir :=
-vndk_snapshot_soong_files :=
-vndk_snapshot_variant :=
+$(call dist-for-goals, vndk, $(SOONG_VNDK_SNAPSHOT_ZIP))
 
 else # BOARD_VNDK_RUNTIME_DISABLE is set to 'true'
 error_msg := "CANNOT generate VNDK snapshot. BOARD_VNDK_RUNTIME_DISABLE must not be set to 'true'."
diff --git a/core/tasks/with-license.mk b/core/tasks/with-license.mk
new file mode 100644
index 0000000..daa6897
--- /dev/null
+++ b/core/tasks/with-license.mk
@@ -0,0 +1,51 @@
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+.PHONY: with-license
+
+name := $(TARGET_PRODUCT)
+ifeq ($(TARGET_BUILD_TYPE),debug)
+	name := $(name)_debug
+endif
+
+name := $(name)-img-$(FILE_NAME_TAG)-with-license
+
+with_license_intermediates := \
+	$(call intermediates-dir-for,PACKAGING,with_license)
+
+# Create a with-license artifact target
+license_image_input_zip := $(with_license_intermediates)/$(name).zip
+$(license_image_input_zip) : $(BUILT_TARGET_FILES_PACKAGE) $(ZIP2ZIP)
+# DO NOT PROCEED without a license file.
+ifndef VENDOR_BLOBS_LICENSE
+	@echo "with-license requires VENDOR_BLOBS_LICENSE to be set."
+	exit 1
+else
+	$(ZIP2ZIP) -i $(BUILT_TARGET_FILES_PACKAGE) -o $@ \
+		RADIO/bootloader.img:bootloader.img RADIO/radio.img:radio.img \
+		IMAGES/system.img:system.img IMAGES/vendor.img:vendor.img \
+		IMAGES/boot.img:boot.img OTA/android-info.txt:android-info.txt
+endif
+with_license_zip := $(PRODUCT_OUT)/$(name).sh
+$(with_license_zip): PRIVATE_NAME := $(name)
+$(with_license_zip): PRIVATE_INPUT_ZIP := $(license_image_input_zip)
+$(with_license_zip): PRIVATE_VENDOR_BLOBS_LICENSE := $(VENDOR_BLOBS_LICENSE)
+$(with_license_zip): $(license_image_input_zip) $(VENDOR_BLOBS_LICENSE)
+$(with_license_zip): $(HOST_OUT_EXECUTABLES)/generate-self-extracting-archive
+	# Args: <output> <input archive> <comment> <license file>
+	$(HOST_OUT_EXECUTABLES)/generate-self-extracting-archive $@ \
+		$(PRIVATE_INPUT_ZIP) $(PRIVATE_NAME) $(PRIVATE_VENDOR_BLOBS_LICENSE)
+with-license : $(with_license_zip)
+$(call dist-for-goals, with-license, $(with_license_zip))
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 8095212..a41c1ae 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -250,7 +250,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2019-12-05
+      PLATFORM_SECURITY_PATCH := 2020-01-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/envsetup.sh b/envsetup.sh
index 25f55e8..a44cd50 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -11,11 +11,13 @@
 - tapas:      tapas [<App1> <App2> ...] [arm|x86|mips|arm64|x86_64|mips64] [eng|userdebug|user]
 - croot:      Changes directory to the top of the tree, or a subdirectory thereof.
 - m:          Makes from the top of the tree.
-- mm:         Builds all of the modules in the current directory, but not their dependencies.
-- mmm:        Builds all of the modules in the supplied directories, but not their dependencies.
+- mm:         Builds and installs all of the modules in the current directory, and their
+              dependencies.
+- mmm:        Builds and installs all of the modules in the supplied directories, and their
+              dependencies.
               To limit the modules being built use the syntax: mmm dir/:target1,target2.
-- mma:        Builds all of the modules in the current directory, and their dependencies.
-- mmma:       Builds all of the modules in the supplied directories, and their dependencies.
+- mma:        Same as 'mm'
+- mmma:       Same as 'mmm'
 - provision:  Flash device with all required partitions. Options will be passed on to fastboot.
 - cgrep:      Greps on all local C/C++ files.
 - ggrep:      Greps on all local Gradle files.
diff --git a/target/board/mainline_arm64/BoardConfig.mk b/target/board/mainline_arm64/BoardConfig.mk
index 7cb2609..c53da9e 100644
--- a/target/board/mainline_arm64/BoardConfig.mk
+++ b/target/board/mainline_arm64/BoardConfig.mk
@@ -26,6 +26,11 @@
 
 include build/make/target/board/BoardConfigMainlineCommon.mk
 
+# TODO(b/143732851): Remove this after replacing /persit with
+# /mnt/vendor/persist
+BOARD_ROOT_EXTRA_SYMLINKS += /mnt/vendor/persist:/persist
+BOARD_SEPOLICY_DIRS += build/make/target/board/mainline_arm64/sepolicy
+
 TARGET_NO_KERNEL := true
 
 # Build generic A/B format system-only OTA.
diff --git a/target/board/mainline_arm64/sepolicy/OWNERS b/target/board/mainline_arm64/sepolicy/OWNERS
new file mode 100644
index 0000000..ff29677
--- /dev/null
+++ b/target/board/mainline_arm64/sepolicy/OWNERS
@@ -0,0 +1,8 @@
+alanstokes@google.com
+bowgotsai@google.com
+jbires@google.com
+jeffv@google.com
+jgalenson@google.com
+sspatil@google.com
+tomcherry@google.com
+trong@google.com
diff --git a/target/board/mainline_arm64/sepolicy/file.te b/target/board/mainline_arm64/sepolicy/file.te
new file mode 100644
index 0000000..36baabd
--- /dev/null
+++ b/target/board/mainline_arm64/sepolicy/file.te
@@ -0,0 +1,3 @@
+# TODO(b/143732851): remove this file when the mainline system image
+# no longer need these SoC specific directory
+type persist_file, file_type;
diff --git a/target/board/mainline_arm64/sepolicy/file_contexts b/target/board/mainline_arm64/sepolicy/file_contexts
new file mode 100644
index 0000000..4d02edc
--- /dev/null
+++ b/target/board/mainline_arm64/sepolicy/file_contexts
@@ -0,0 +1,5 @@
+# TODO(b/143732851): remove this file when the mainline system image
+# no longer need these SoC specific directory
+
+# /persist
+/persist(/.*)?          u:object_r:persist_file:s0
diff --git a/target/product/base.mk b/target/product/base.mk
index 804a2ee..d3250d4 100644
--- a/target/product/base.mk
+++ b/target/product/base.mk
@@ -17,5 +17,6 @@
 # This makefile is suitable to inherit by products that don't need to be split
 # up by partition.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/base_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_product.mk)
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 8e3c202..6c9b26c 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -16,7 +16,6 @@
 
 # Base modules and settings for the system partition.
 PRODUCT_PACKAGES += \
-    adbd \
     adbd_system_binaries \
     am \
     android.hidl.allocator@1.0-service \
@@ -38,6 +37,7 @@
     bcc \
     blank_screen \
     blkid \
+    blobstore-service \
     bmgr \
     bootanimation \
     bootstat \
@@ -48,6 +48,7 @@
     cgroups.json \
     charger \
     cmd \
+    com.android.adbd \
     com.android.apex.cts.shim.v1_prebuilt \
     com.android.conscrypt \
     com.android.i18n \
@@ -99,7 +100,6 @@
     incidentd \
     incident_helper \
     init.environ.rc \
-    init.rc \
     init_system \
     input \
     installd \
@@ -194,7 +194,6 @@
     mdnsd \
     media \
     mediacodec.policy \
-    mediadrmserver \
     mediaextractor \
     mediametrics \
     media_profiles_V1_0.dtd \
@@ -205,7 +204,7 @@
     mtpd \
     ndc \
     netd \
-    NetworkStack \
+    NetworkStackNext \
     org.apache.http.legacy \
     otacerts \
     PackageInstaller \
@@ -331,9 +330,8 @@
 
 
 PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.usb.rc:root/init.usb.rc \
-    system/core/rootdir/init.usb.configfs.rc:root/init.usb.configfs.rc \
-    system/core/rootdir/ueventd.rc:root/ueventd.rc \
+    system/core/rootdir/init.usb.rc:system/etc/init/hw/init.usb.rc \
+    system/core/rootdir/init.usb.configfs.rc:system/etc/init/hw/init.usb.configfs.rc \
     system/core/rootdir/etc/hosts:system/etc/hosts
 
 # Add the compatibility library that is needed when android.test.base
@@ -346,7 +344,7 @@
 PRODUCT_BOOT_JARS += android.test.base
 endif
 
-PRODUCT_COPY_FILES += system/core/rootdir/init.zygote32.rc:root/init.zygote32.rc
+PRODUCT_COPY_FILES += system/core/rootdir/init.zygote32.rc:system/etc/init/hw/init.zygote32.rc
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.zygote=zygote32
 
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += debug.atrace.tags.enableflags=0
diff --git a/target/product/base_system_ext.mk b/target/product/base_system_ext.mk
new file mode 100644
index 0000000..df859cd
--- /dev/null
+++ b/target/product/base_system_ext.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Base modules and settings for the system_ext partition.
+PRODUCT_PACKAGES += \
diff --git a/target/product/base_vendor.mk b/target/product/base_vendor.mk
index 1657e71..7d1babf 100644
--- a/target/product/base_vendor.mk
+++ b/target/product/base_vendor.mk
@@ -40,7 +40,7 @@
 
 # Base modules and settings for the vendor partition.
 PRODUCT_PACKAGES += \
-    android.hardware.cas@1.1-service \
+    android.hardware.cas@1.2-service \
     android.hardware.configstore@1.1-service \
     android.hardware.media.omx@1.0-service \
     boringssl_self_test_vendor \
diff --git a/target/product/core_64_bit.mk b/target/product/core_64_bit.mk
index 76e2a36..f9baa27 100644
--- a/target/product/core_64_bit.mk
+++ b/target/product/core_64_bit.mk
@@ -23,7 +23,7 @@
 # for 32-bit only.
 
 # Copy the 64-bit primary, 32-bit secondary zygote startup script
-PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64_32.rc:root/init.zygote64_32.rc
+PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64_32.rc:system/etc/init/hw/init.zygote64_32.rc
 
 # Set the zygote property to select the 64-bit primary, 32-bit secondary script
 # This line must be parsed before the one in core_minimal.mk
diff --git a/target/product/core_64_bit_only.mk b/target/product/core_64_bit_only.mk
index 72d30f5..8901a50 100644
--- a/target/product/core_64_bit_only.mk
+++ b/target/product/core_64_bit_only.mk
@@ -20,7 +20,7 @@
 # to core_minimal.mk.
 
 # Copy the 64-bit zygote startup script
-PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64.rc:root/init.zygote64.rc
+PRODUCT_COPY_FILES += system/core/rootdir/init.zygote64.rc:system/etc/init/hw/init.zygote64.rc
 
 # Set the zygote property to select the 64-bit script.
 # This line must be parsed before the one in core_minimal.mk
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 9718dc6..6fb1173 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -22,6 +22,7 @@
 # handheld_<x>.mk.
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/media_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_product.mk)
 
diff --git a/target/product/generic_no_telephony.mk b/target/product/generic_no_telephony.mk
index 324d36f..eb12872 100644
--- a/target/product/generic_no_telephony.mk
+++ b/target/product/generic_no_telephony.mk
@@ -21,6 +21,7 @@
 # base_<x>.mk or media_<x>.mk.
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
 
diff --git a/target/product/go_defaults_common.mk b/target/product/go_defaults_common.mk
index 6bdcd60..5d4f5a5 100644
--- a/target/product/go_defaults_common.mk
+++ b/target/product/go_defaults_common.mk
@@ -41,6 +41,7 @@
 PRODUCT_PACKAGES += InProcessNetworkStack
 PRODUCT_PACKAGES += InProcessWifiStack
 PRODUCT_PACKAGES += CellBroadcastAppPlatform
+PRODUCT_PACKAGES += CellBroadcastServiceModulePlatform
 
 # Strip the local variable table and the local variable type table to reduce
 # the size of the system image. This has no bearing on stack traces, but will
diff --git a/target/product/gsi/Android.mk b/target/product/gsi/Android.mk
index f9402cb..536fe0c 100644
--- a/target/product/gsi/Android.mk
+++ b/target/product/gsi/Android.mk
@@ -2,7 +2,7 @@
 
 #####################################################################
 # list of vndk libraries from the source code.
-INTERNAL_VNDK_LIB_LIST := $(SOONG_OUT_DIR)/vndk/vndk.libraries.txt
+INTERNAL_VNDK_LIB_LIST := $(SOONG_VNDK_LIBRARIES_FILE)
 
 #####################################################################
 # This is the up-to-date list of vndk libs.
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index 120f32e..8a2731a 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -51,6 +51,7 @@
 VNDK-SP: libutils.so
 VNDK-SP: libutilscallstack.so
 VNDK-SP: libz.so
+VNDK-SP: vintf-graphics-common-V1-ndk_platform.so
 VNDK-core: android.frameworks.cameraservice.common@2.0.so
 VNDK-core: android.frameworks.cameraservice.device@2.0.so
 VNDK-core: android.frameworks.cameraservice.service@2.0.so
@@ -194,7 +195,6 @@
 VNDK-core: android.hardware.vibrator@1.1.so
 VNDK-core: android.hardware.vibrator@1.2.so
 VNDK-core: android.hardware.vibrator@1.3.so
-VNDK-core: android.hardware.vibrator@1.4.so
 VNDK-core: android.hardware.vr@1.0.so
 VNDK-core: android.hardware.weaver@1.0.so
 VNDK-core: android.hardware.wifi.hostapd@1.0.so
diff --git a/target/product/handheld_product.mk b/target/product/handheld_product.mk
index 54dcaf2..36b740a 100644
--- a/target/product/handheld_product.mk
+++ b/target/product/handheld_product.mk
@@ -17,7 +17,7 @@
 # This makefile contains the product partition contents for
 # a generic phone or tablet device. Only add something here if
 # it definitely doesn't belong on other types of devices (if it
-# does, use base_vendor.mk).
+# does, use base_product.mk).
 $(call inherit-product, $(SRC_TARGET_DIR)/product/media_product.mk)
 
 # /product packages
diff --git a/target/product/handheld_system_ext.mk b/target/product/handheld_system_ext.mk
new file mode 100644
index 0000000..bda4be6
--- /dev/null
+++ b/target/product/handheld_system_ext.mk
@@ -0,0 +1,24 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This makefile contains the system_ext partition contents for
+# a generic phone or tablet device. Only add something here if
+# it definitely doesn't belong on other types of devices (if it
+# does, use base_system_ext.mk).
+$(call inherit-product, $(SRC_TARGET_DIR)/product/media_system_ext.mk)
+
+# /system_ext packages
+PRODUCT_PACKAGES += \
diff --git a/target/product/mainline.mk b/target/product/mainline.mk
index 7900cdf..22436e6 100644
--- a/target/product/mainline.mk
+++ b/target/product/mainline.mk
@@ -16,11 +16,13 @@
 
 # This makefile is intended to serve as a base for completely AOSP based
 # mainline devices, It contain the mainline system partition and sensible
-# defaults for the product and vendor partition.
+# defaults for the system_ext, product and vendor partitions.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
 
diff --git a/target/product/mainline_system.mk b/target/product/mainline_system.mk
index f7eb8ad..5a5c17d 100644
--- a/target/product/mainline_system.mk
+++ b/target/product/mainline_system.mk
@@ -112,10 +112,10 @@
 
 # Include all zygote init scripts. "ro.zygote" will select one of them.
 PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32.rc:root/init.zygote32.rc \
-    system/core/rootdir/init.zygote64.rc:root/init.zygote64.rc \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc \
-    system/core/rootdir/init.zygote64_32.rc:root/init.zygote64_32.rc
+    system/core/rootdir/init.zygote32.rc:system/etc/init/hw/init.zygote32.rc \
+    system/core/rootdir/init.zygote64.rc:system/etc/init/hw/init.zygote64.rc \
+    system/core/rootdir/init.zygote32_64.rc:system/etc/init/hw/init.zygote32_64.rc \
+    system/core/rootdir/init.zygote64_32.rc:system/etc/init/hw/init.zygote64_32.rc \
 
 # Enable dynamic partition size
 PRODUCT_USE_DYNAMIC_PARTITION_SIZE := true
diff --git a/target/product/media_product.mk b/target/product/media_product.mk
index 17c24ee..76cb311 100644
--- a/target/product/media_product.mk
+++ b/target/product/media_product.mk
@@ -17,7 +17,7 @@
 # This makefile contains the product partition contents for
 # media-capable devices (non-wearables). Only add something here
 # if it definitely doesn't belong on wearables. Otherwise, choose
-# base_vendor.mk.
+# base_product.mk.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base_product.mk)
 
 # /product packages
diff --git a/target/product/media_system.mk b/target/product/media_system.mk
index 0bc5800..9d27dee 100644
--- a/target/product/media_system.mk
+++ b/target/product/media_system.mk
@@ -56,6 +56,7 @@
     com.android.location.provider \
     jobscheduler-service \
     statsd-service \
+    blobstore-service \
 
 PRODUCT_COPY_FILES += \
     system/core/rootdir/etc/public.libraries.android.txt:system/etc/public.libraries.txt
diff --git a/target/product/media_system_ext.mk b/target/product/media_system_ext.mk
new file mode 100644
index 0000000..78cc6aa
--- /dev/null
+++ b/target/product/media_system_ext.mk
@@ -0,0 +1,24 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This makefile contains the system_ext partition contents for
+# media-capable devices (non-wearables). Only add something here
+# if it definitely doesn't belong on wearables. Otherwise, choose
+# base_system_ext.mk.
+$(call inherit-product, $(SRC_TARGET_DIR)/product/base_system_ext.mk)
+
+# /system_ext packages
+PRODUCT_PACKAGES += \
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index 4a19ab4..b59feaf 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -93,7 +93,7 @@
     dalvik.vm.minidebuginfo=true \
     dalvik.vm.dex2oat-minidebuginfo=true
 
-# Disable iorapd by default
+# Enable iorapd by default
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     ro.iorapd.enable=true
 
diff --git a/target/product/security/com_google_android_permissioncontroller-container.x509.pem b/target/product/security/com_google_android_permissioncontroller-container.x509.pem
deleted file mode 100644
index 95f476f..0000000
--- a/target/product/security/com_google_android_permissioncontroller-container.x509.pem
+++ /dev/null
@@ -1,30 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGHDCCBASgAwIBAgIUQ6US4BMtEWcSr2vuqJ5tlHLrBuYwDQYJKoZIhvcNAQELBQAwgZ4xCzAJ
-BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQw
-EgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDE6MDgGA1UEAwwxY29tX2dvb2ds
-ZV9hbmRyb2lkX3Blcm1pc3Npb25jb250cm9sbGVyLWNvbnRhaW5lcjAeFw0xOTAyMDEwMzU2MDZa
-Fw00OTAyMDEwMzU2MDZaMIGeMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQG
-A1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLR29vZ2xlIEluYy4xEDAOBgNVBAsTB0FuZHJv
-aWQxOjA4BgNVBAMMMWNvbV9nb29nbGVfYW5kcm9pZF9wZXJtaXNzaW9uY29udHJvbGxlci1jb250
-YWluZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCFBJYVLl8bg+dW9nE2R7pnwPAA
-q6JpnMzYnQb4lycDxugACxiWRTZ7wUSpIv/QY3Mu/dv6GnWJhrRwJFhCq0jISzsmRwMMi7DFEujc
-osO80s6kVjaQ71yYqMRhw2IfSIphFU0YMEgcucNAUG/ELFBDsnqxHqVdLxGDQZAwJ/Iz30olEBS4
-26VuwlpZrbIku/k0IO0B5NdzvSAQJECo2uOzEhEgQFQlTE5Lku9MX1PsC+pkokIRcYiOkXoXT6Qk
-wSkP23bpvsjbjwNOgavPs8Pdx4tHfTs60ysOdbNpHl5dWlDKvKRelxxUPS9yjTRFd6U8MZN0Ldt1
-8k4bzuptQ1yXML4csFGjsbhapqzEEO267ULdrWz58L+C1Rx/fBIV1efZOkNfdrrgGTIfnD8kbI9j
-kLPPPhOuPgMl2huflB4CcLLGyk2h7BkTYn6tM16Q/+i/qHtph81GZqdeDZRG9dG/VFqR8vD6JwCS
-aVci28zmzBR1kUlWoSRk2xiQmv7/ZGtgKVXppipVVasR2XUr+z3AFJm41TPAqei9xqeA6eRUmBbs
-YS0q/zSBPef0zTyyrQQLhkSW/D5sELEg9lidbpMUwe+myE9yNXnvbsQbzJFHrPanVLLeY896opaV
-GSjiIMaJdWrcp9OOYZQHO7W05UWmDvQHKg7Un6OxdFL/TEaZAwIDAQABo1AwTjAMBgNVHRMEBTAD
-AQH/MB0GA1UdDgQWBBTuRKWeFsHYvfDR4eoKuuMEz3iJrTAfBgNVHSMEGDAWgBTuRKWeFsHYvfDR
-4eoKuuMEz3iJrTANBgkqhkiG9w0BAQsFAAOCAgEAY6ua1I9ERwbs6SXZFqMGe5oryg/3Kbhx5Q+z
-uL8B8Nr85Ez/DR6Lr9PNBqR4Mc0/Rb8f1lHlxx5DcKggT1YjbbM9aULdrGI+wpvDwHp6kCo1T58L
-xn97KeJbTMy5uogLiBabXIiScyDEzz2GpdajbgsI9Io1i+v9uDv/RFWnZV+C7l3ZEZ2klo8Elexo
-BFOD0WdAptxERyBF549URonUxq3UWLbUisg0j8P3yKe9lmhZwO2tUmxaKQGlL4LAGRsQ4kTgXCwN
-WWUMRIYcdmW4TxLZy/KDKwLc6ezik07Ifc5bHajY3OSzRtp17Hf3U+/LnQt5KZD6MuoQu7Rxh1Fv
-pbUAgsD4UPEjUcsEEa3BbIcSfN6l68mkbf7AioGaKvOKXx9DVrrQYfW4gy5vskFyRMbLw5iTQ3Od
-WdViiw3ZmrCtnZLnUQY29B/04Ma0ejrtSonEJBl2VIakpyM0g5gyOcg17vl9xrAoITkbMp26GcUd
-1DQOlyBI2Uct7KKM2d9nuIEJwHn6D2eboRBk0Y/XPeg8IDNDUMx6K2ArOL5RUkBz3oGCdPQkLT+b
-PIps1fAOCGbE6HEPB6OEcTZNv8XXnchEjdwocTUgjAtnDhuGqcooQnCFbPodXISJURNZb5QUH2Ic
-Q4BDiSNSs38AF9dzBaFoUowHUySA0wrVDjT5tC0=
------END CERTIFICATE-----
diff --git a/target/product/telephony.mk b/target/product/telephony.mk
index e0eb159..3ad7a1f 100644
--- a/target/product/telephony.mk
+++ b/target/product/telephony.mk
@@ -16,5 +16,6 @@
 
 # All modules for telephony
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
diff --git a/target/product/telephony_system.mk b/target/product/telephony_system.mk
index c306a04..9c585b3 100644
--- a/target/product/telephony_system.mk
+++ b/target/product/telephony_system.mk
@@ -21,7 +21,6 @@
     ONS \
     CarrierDefaultApp \
     CallLogBackup \
-    CellBroadcastApp \
-    CellBroadcastServiceModule \
+    com.android.cellbroadcast \
 
 PRODUCT_COPY_FILES := \
diff --git a/target/product/telephony_system_ext.mk b/target/product/telephony_system_ext.mk
new file mode 100644
index 0000000..1b9ee98
--- /dev/null
+++ b/target/product/telephony_system_ext.mk
@@ -0,0 +1,21 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# This is the list of modules that are specific to products that have telephony
+# hardware, and install to the system_ext partition.
+
+# /system_ext packages
+PRODUCT_PACKAGES += \
diff --git a/tools/Android.bp b/tools/Android.bp
new file mode 100644
index 0000000..8c7eb38
--- /dev/null
+++ b/tools/Android.bp
@@ -0,0 +1,26 @@
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+python_binary_host {
+  name: "generate-self-extracting-archive",
+  srcs: ["generate-self-extracting-archive.py"],
+  version: {
+    py2: {
+      enabled: true,
+    },
+    py3: {
+      enabled: false,
+    },
+  },
+}
diff --git a/tools/generate-self-extracting-archive.py b/tools/generate-self-extracting-archive.py
index f0b7568..5a193ab 100755
--- a/tools/generate-self-extracting-archive.py
+++ b/tools/generate-self-extracting-archive.py
@@ -91,7 +91,7 @@
       break
     dst.write(b)
 
-_MAX_OFFSET_WIDTH = 8
+_MAX_OFFSET_WIDTH = 20
 def _generate_extract_command(start, end, extract_name):
   """Generate the extract command.
 
@@ -119,6 +119,10 @@
 
 
 def main(argv):
+  if len(argv) != 5:
+    print 'generate-self-extracting-archive.py expects exactly 4 arguments'
+    sys.exit(1)
+
   output_filename = argv[1]
   input_archive_filename = argv[2]
   comment = argv[3]
@@ -129,6 +133,14 @@
   with open(license_filename, 'r') as license_file:
     license = license_file.read()
 
+  if not license:
+    print 'License file was empty'
+    sys.exit(1)
+
+  if 'SOFTWARE LICENSE AGREEMENT' not in license:
+    print 'License does not look like a license'
+    sys.exit(1)
+
   comment_line = '# %s\n' % comment
   extract_name = os.path.basename(input_archive_filename)
 
@@ -161,5 +173,9 @@
       trailing_zip.seek(0)
       _pipe_bytes(trailing_zip, output)
 
+  umask = os.umask(0)
+  os.umask(umask)
+  os.chmod(output_filename, 0o777 & ~umask)
+
 if __name__ == "__main__":
   main(sys.argv)
diff --git a/tools/releasetools/build_super_image.py b/tools/releasetools/build_super_image.py
index f63453d..6c4d6cb 100755
--- a/tools/releasetools/build_super_image.py
+++ b/tools/releasetools/build_super_image.py
@@ -55,7 +55,7 @@
 logger = logging.getLogger(__name__)
 
 
-UNZIP_PATTERN = ["IMAGES/*", "META/*"]
+UNZIP_PATTERN = ["IMAGES/*", "META/*", "*/build.prop"]
 
 
 def GetArgumentsForImage(partition, group, image=None):
diff --git a/tools/releasetools/check_partition_sizes.py b/tools/releasetools/check_partition_sizes.py
index 04d832c..745c136 100644
--- a/tools/releasetools/check_partition_sizes.py
+++ b/tools/releasetools/check_partition_sizes.py
@@ -76,11 +76,17 @@
 class DeviceType(object):
   NONE = 0
   AB = 1
+  RVAB = 2 # retrofit Virtual-A/B
+  VAB = 3
 
   @staticmethod
   def Get(info_dict):
     if info_dict.get("ab_update") != "true":
       return DeviceType.NONE
+    if info_dict.get("virtual_ab_retrofit") == "true":
+      return DeviceType.RVAB
+    if info_dict.get("virtual_ab") == "true":
+      return DeviceType.VAB
     return DeviceType.AB
 
 
@@ -175,6 +181,14 @@
     if slot == DeviceType.AB:
       return 2
 
+    # DAP + retrofit Virtual A/B: same as A/B
+    if slot == DeviceType.RVAB:
+      return 2
+
+    # DAP + Launch Virtual A/B: 1 *real* slot in super (2 virtual slots)
+    if slot == DeviceType.VAB:
+      return 1
+
     # DAP + non-A/B: 1 slot in super
     assert slot == DeviceType.NONE
     return 1
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index dfcfb49..7a0d994 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -1635,6 +1635,10 @@
         partitions = [partition for partition in partitions if partition
                       not in SECONDARY_PAYLOAD_SKIPPED_IMAGES]
         output_list.append('{}={}'.format(key, ' '.join(partitions)))
+      elif key == 'virtual_ab' or key == "virtual_ab_retrofit":
+        # Remove virtual_ab flag from secondary payload so that OTA client
+        # don't use snapshots for secondary update
+        pass
       else:
         output_list.append(line)
     return '\n'.join(output_list)
diff --git a/tools/releasetools/test_check_partition_sizes.py b/tools/releasetools/test_check_partition_sizes.py
index 5482b1c..ed20873 100644
--- a/tools/releasetools/test_check_partition_sizes.py
+++ b/tools/releasetools/test_check_partition_sizes.py
@@ -92,3 +92,37 @@
         """.split("\n")))
     with self.assertRaises(RuntimeError):
       CheckPartitionSizes(self.info_dict)
+
+  def test_retrofit_vab(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        virtual_ab_retrofit=true
+        """.split("\n")))
+    CheckPartitionSizes(self.info_dict)
+
+  def test_retrofit_vab_too_big(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        virtual_ab_retrofit=true
+        system_image_size=100
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)
+
+  def test_vab(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        super_partition_size=100
+        super_super_device_size=100
+        """.split("\n")))
+    CheckPartitionSizes(self.info_dict)
+
+  def test_vab_too_big(self):
+    self.info_dict.update(common.LoadDictionaryFromLines("""
+        virtual_ab=true
+        super_partition_size=100
+        super_super_device_size=100
+        system_image_size=100
+        """.split("\n")))
+    with self.assertRaises(RuntimeError):
+      CheckPartitionSizes(self.info_dict)