diff --git a/core/base_rules.mk b/core/base_rules.mk
index dbd8930..4fd8baa 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -996,6 +996,7 @@
 ifndef LOCAL_IS_HOST_MODULE
 ALL_MODULES.$(my_register_name).FILE_CONTEXTS := $(LOCAL_FILE_CONTEXTS)
 endif
+ALL_MODULES.$(my_register_name).IS_UNIT_TEST := $(LOCAL_IS_UNIT_TEST)
 test_config :=
 
 INSTALLABLE_FILES.$(LOCAL_INSTALLED_MODULE).MODULE := $(my_register_name)
diff --git a/core/binary.mk b/core/binary.mk
index be008e6..fa36d64 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -1333,11 +1333,6 @@
 
 my_c_includes += $(TOPDIR)$(LOCAL_PATH) $(intermediates) $(generated_sources_dir)
 
-# The platform JNI header is for platform modules only.
-ifeq ($(LOCAL_SDK_VERSION)$(LOCAL_USE_VNDK),)
-  my_c_includes += $(JNI_H_INCLUDE)
-endif
-
 my_c_includes := $(foreach inc,$(my_c_includes),$(call clean-path,$(inc)))
 
 my_outside_includes := $(filter-out $(OUT_DIR)/%,$(filter /%,$(my_c_includes)) $(filter ../%,$(my_c_includes)))
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 6909275..5f16363 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -159,6 +159,10 @@
 LOCAL_CERTIFICATE_LINEAGE:=
 LOCAL_LDFLAGS:=
 LOCAL_LDLIBS:=
+LOCAL_LICENSE_CONDITIONS:=
+LOCAL_LICENSE_KINDS:=
+LOCAL_LICENSE_INSTALL_MAP:=
+LOCAL_LICENSE_PACKAGE_NAME:=
 LOCAL_LOGTAGS_FILES:=
 LOCAL_MANIFEST_FILE:=
 LOCAL_MANIFEST_INSTRUMENTATION_FOR:=
@@ -170,6 +174,7 @@
 LOCAL_MODULE_HOST_ARCH_WARN:=
 LOCAL_MODULE_HOST_CROSS_ARCH:=
 LOCAL_MODULE_HOST_OS:=
+LOCAL_MODULE_IS_CONTAINER:=
 LOCAL_MODULE_OWNER:=
 LOCAL_MODULE_PATH:=
 LOCAL_MODULE_RELATIVE_PATH :=
diff --git a/core/definitions.mk b/core/definitions.mk
index 0230340..4300efe 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -525,6 +525,96 @@
 endef
 
 ###########################################################
+## Sometimes a notice dependency will reference an unadorned
+## module name that only appears in ALL_MODULES adorned with
+## an ARCH suffix or a `host_cross_` prefix.
+##
+## After all of the modules are processed in base_rules.mk,
+## replace all such dependencies with every matching adorned
+## module name.
+###########################################################
+
+define fix-notice-deps
+$(strip \
+  $(eval _all_module_refs := \
+    $(sort \
+      $(foreach m,$(sort $(ALL_MODULES)), \
+        $(ALL_MODULES.$(m).NOTICE_DEPS) \
+      ) \
+    ) \
+  ) \
+  $(foreach m, $(_all_module_refs), \
+    $(eval _lookup.$(m) := \
+      $(sort \
+        $(if $(strip $(ALL_MODULES.$(m).PATH)), \
+          $(m), \
+          $(filter $(m)_32 $(m)_64 host_cross_$(m) host_cross_$(m)_32 host_cross_$(m)_64, $(ALL_MODULES)) \
+        ) \
+      ) \
+    ) \
+  ) \
+  $(foreach m, $(ALL_MODULES), \
+    $(eval ALL_MODULES.$(m).NOTICE_DEPS := \
+      $(sort \
+         $(foreach d,$(ALL_MODULES.$(m).NOTICE_DEPS), \
+           $(_lookup.$(d)) \
+        ) \
+      ) \
+    ) \
+  ) \
+)
+endef
+
+###########################################################
+## Target directory for license metadata files.
+###########################################################
+define license-metadata-dir
+$(call generated-sources-dir-for,META,lic,)
+endef
+
+###########################################################
+## License metadata build rule for my_register_name $1
+###########################################################
+define license-metadata-rule
+$(strip $(eval _dir := $(call license-metadata-dir)))
+$(strip $(eval _deps := $(sort $(filter-out $(_dir)/$(1).meta_lic,$(foreach d,$(ALL_MODULES.$(1).NOTICE_DEPS), $(_dir)/$(d).meta_lic)))))
+$(foreach b,$(sort $(ALL_MODULES.$(1).BUILT) $(ALL_MODULES.$(1).INSTALLED)),
+$(_dir)/$(b).meta_module ::
+	mkdir -p $$(dir $$@)
+	echo $(_dir)/$(1).meta_lic >> $$@
+	sort -u $$@ -o $$@
+
+)
+$(_dir)/$(1).meta_lic: PRIVATE_KINDS := $(sort $(ALL_MODULES.$(1).LICENSE_KINDS))
+$(_dir)/$(1).meta_lic: PRIVATE_CONDITIONS := $(sort $(ALL_MODULES.$(1).LICENSE_CONDITIONS))
+$(_dir)/$(1).meta_lic: PRIVATE_NOTICES := $(sort $(ALL_MODULES.$(1).NOTICES))
+$(_dir)/$(1).meta_lic: PRIVATE_NOTICE_DEPS := $(_deps)
+$(_dir)/$(1).meta_lic: PRIVATE_TARGETS := $(sort $(ALL_MODULES.$(1).BUILT) $(ALL_MODULES.$(1).INSTALLED))
+$(_dir)/$(1).meta_lic: PRIVATE_IS_CONTAINER := $(sort $(ALL_MODULES.$(1).IS_CONTAINER))
+$(_dir)/$(1).meta_lic: PRIVATE_PACKAGE_NAME := $(ALL_MODULES.$(1).LICENSE_PACKAGE_NAME)
+$(_dir)/$(1).meta_lic: PRIVATE_INSTALL_MAP := $(sort $(ALL_MODULES.$(1).LICENSE_INSTALL_MAP))
+$(_dir)/$(1).meta_lic : $(_deps) $(ALL_MODULES.$(1).NOTICES) $(foreach b,$(sort $(ALL_MODULES.$(1).BUILT) $(ALL_MODULES.$(1).INSTALLED)), $(_dir)/$(b).meta_module) build/make/tools/build-license-metadata.sh
+	rm -f $$@
+	mkdir -p $$(dir $$@)
+	build/make/tools/build-license-metadata.sh -k $$(PRIVATE_KINDS) -c $$(PRIVATE_CONDITIONS) -n $$(PRIVATE_NOTICES) -d $$(PRIVATE_NOTICE_DEPS) -m $$(PRIVATE_INSTALL_MAP) -t $$(PRIVATE_TARGETS) $$(if $$(filter-out false,$$(PRIVATE_IS_CONTAINER)),-is_container) -p $$(PRIVATE_PACKAGE_NAME) -o $$@
+
+$(1) : $(_dir)/$(1).meta_lic
+
+$(if $(ALL_MODULES.$(1).INSTALLED_NOTICE_FILE),$(ALL_MODULES.$(1).INSTALLED_NOTICE_FILE) : $(_dir)/$(1).meta_lic)
+
+.PHONY: $(1).meta_lic
+$(1).meta_lic : $(_dir)/$(1).meta_lic
+
+endef
+
+###########################################################
+## Declares a license metadata build rule for ALL_MODULES
+###########################################################
+define build-license-metadata
+$(foreach m,$(ALL_MODULES),$(eval $(call license-metadata-rule,$(m))))
+endef
+
+###########################################################
 ## Returns correct _idfPrefix from the list:
 ##   { HOST, HOST_CROSS, TARGET }
 ###########################################################
diff --git a/core/dex_preopt_config.mk b/core/dex_preopt_config.mk
index f72752c..1223694 100644
--- a/core/dex_preopt_config.mk
+++ b/core/dex_preopt_config.mk
@@ -10,7 +10,7 @@
 endif
 
 # The default value for LOCAL_DEX_PREOPT
-DEX_PREOPT_DEFAULT ?= true
+DEX_PREOPT_DEFAULT ?= $(ENABLE_PREOPT)
 
 # The default filter for which files go into the system_other image (if it is
 # being used). Note that each pattern p here matches both '/<p>' and /system/<p>'.
diff --git a/core/main.mk b/core/main.mk
index 8857b5d..09105d9 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1120,7 +1120,11 @@
 # Expand a list of modules to the modules that they override (if any)
 # $(1): The list of modules.
 define module-overrides
-$(foreach m,$(1),$(PACKAGES.$(m).OVERRIDES) $(EXECUTABLES.$(m).OVERRIDES) $(SHARED_LIBRARIES.$(m).OVERRIDES) $(ETC.$(m).OVERRIDES))
+$(foreach m,$(1),\
+  $(eval _mo_overrides := $(PACKAGES.$(m).OVERRIDES) $(EXECUTABLES.$(m).OVERRIDES) $(SHARED_LIBRARIES.$(m).OVERRIDES) $(ETC.$(m).OVERRIDES))\
+  $(if $(filter $(m),$(_mo_overrides)),\
+    $(error Module $(m) cannot override itself),\
+    $(_mo_overrides)))
 endef
 
 ###########################################################
@@ -1404,6 +1408,17 @@
 ALL_DEFAULT_INSTALLED_MODULES :=
 
 
+# Some notice deps refer to module names without prefix or arch suffix where
+# only the variants with them get built.
+# fix-notice-deps replaces those unadorned module names with every built variant.
+$(call fix-notice-deps)
+
+# Create a license metadata rule per module. Could happen in base_rules.mk or
+# notice_files.mk; except, it has to happen after fix-notice-deps to avoid
+# missing dependency errors.
+$(call build-license-metadata)
+
+
 # These are additional goals that we build, in order to make sure that there
 # is as little code as possible in the tree that doesn't build.
 modules_to_check := $(foreach m,$(ALL_MODULES),$(ALL_MODULES.$(m).CHECKED))
@@ -1739,7 +1754,7 @@
   endif
 
   ifeq ($(EMMA_INSTRUMENT),true)
-    $(JACOCO_REPORT_CLASSES_ALL) : $(modules_to_install)
+    $(JACOCO_REPORT_CLASSES_ALL) : $(filter-out $(TARGET_OUT_FAKE)/%,$(modules_to_install))
     $(call dist-for-goals, dist_files, $(JACOCO_REPORT_CLASSES_ALL))
   endif
 
diff --git a/core/notice_files.mk b/core/notice_files.mk
index 0430007..89f822b 100644
--- a/core/notice_files.mk
+++ b/core/notice_files.mk
@@ -9,6 +9,32 @@
 notice_file:=$(strip $(wildcard $(LOCAL_PATH)/LICENSE $(LOCAL_PATH)/LICENCE $(LOCAL_PATH)/NOTICE))
 endif
 
+ifneq (,$(strip $(LOCAL_LICENSE_PACKAGE_NAME)))
+license_package_name:=$(strip $(LOCAL_LICENSE_PACKAGE_NAME))
+else ifdef my_register_name
+license_package_name:=$(my_register_name)
+else
+license_package_name:=$(strip $(LOCAL_MODULE))
+endif
+
+ifneq (,$(strip $(LOCAL_LICENSE_INSTALL_MAP)))
+install_map:=$(strip $(LOCAL_LICENSE_INSTALL_MAP))
+else
+install_map:=
+endif
+
+ifneq (,$(strip $(LOCAL_LICENSE_KINDS)))
+license_kinds:=$(strip $(LOCAL_LICENSE_KINDS))
+else
+license_kinds:=legacy_by_exception_only
+endif
+
+ifneq (,$(strip $(LOCAL_LICENSE_CONDITIONS)))
+license_conditions:=$(strip $(LOCAL_LICENSE_CONDITIONS))
+else
+license_conditions:=by_exception_only
+endif
+
 ifeq ($(LOCAL_MODULE_CLASS),GYP)
   # We ignore NOTICE files for modules of type GYP.
   notice_file :=
@@ -40,10 +66,64 @@
 
 installed_notice_file :=
 
+is_container:=$(strip $(LOCAL_MODULE_IS_CONTAINER))
+ifeq (,$(is_container))
+ifneq (,$(strip $(filter %.zip %.tar %.tgz %.tar.gz %.apk %.img %.srcszip %.apex, $(LOCAL_BUILT_MODULE))))
+is_container:=true
+else
+is_container:=false
+endif
+else ifneq (,$(strip $(filter-out true false,$(is_container))))
+$(error Unrecognized value '$(is_container)' for LOCAL_MODULE_IS_CONTAINER)
+endif
+
+ifeq (true,$(is_container))
+# Include shared libraries' notices for "container" types, but not for binaries etc.
+notice_deps := \
+    $(sort \
+        $(LOCAL_REQUIRED_MODULES) \
+        $(LOCAL_STATIC_LIBRARIES) \
+        $(LOCAL_WHOLE_STATIC_LIBRARIES) \
+        $(LOCAL_SHARED_LIBRARIES) \
+        $(LOCAL_DYLIB_LIBRARIES) \
+        $(LOCAL_RLIB_LIBRARIES) \
+        $(LOCAL_PROC_MACRO_LIBRARIES) \
+        $(LOCAL_HEADER_LIBRARIES) \
+        $(LOCAL_STATIC_JAVA_LIBRARIES) \
+        $(LOCAL_JAVA_LIBRARIES) \
+        $(LOCAL_JNI_SHARED_LIBRARIES) \
+    )
+else
+notice_deps := \
+    $(sort \
+        $(LOCAL_REQUIRED_MODULES) \
+        $(LOCAL_STATIC_LIBRARIES) \
+        $(LOCAL_WHOLE_STATIC_LIBRARIES) \
+        $(LOCAL_RLIB_LIBRARIES) \
+        $(LOCAL_PROC_MACRO_LIBRARIES) \
+        $(LOCAL_HEADER_LIBRARIES) \
+        $(LOCAL_STATIC_JAVA_LIBRARIES) \
+    )
+endif
+ifeq ($(LOCAL_IS_HOST_MODULE),true)
+notice_deps := $(sort $(notice_deps) $(LOCAL_HOST_REQUIRED_MODULES))
+else
+notice_deps := $(sort $(notice_deps) $(LOCAL_TARGET_REQUIRED_MODULES))
+endif
+
+ifdef my_register_name
+ALL_MODULES.$(my_register_name).LICENSE_PACKAGE_NAME := $(strip $(license_package_name))
+ALL_MODULES.$(my_register_name).LICENSE_KINDS := $(sort $(ALL_MODULES.$(my_register_name).LICENSE_KINDS) $(license_kinds))
+ALL_MODULES.$(my_register_name).LICENSE_CONDITIONS := $(sort $(ALL_MODULES.$(my_register_name).LICENSE_CONDITIONS) $(license_conditions))
+ALL_MODULES.$(my_register_name).LICENSE_INSTALL_MAP := $(sort $(ALL_MODULES.$(my_register_name).LICENSE_INSTALL_MAP) $(install_map))
+ALL_MODULES.$(my_register_name).NOTICE_DEPS := $(sort $(ALL_MODULES.$(my_register_name).NOTICE_DEPS) $(notice_deps))
+ALL_MODULES.$(my_register_name).IS_CONTAINER := $(sort $(ALL_MODULES.$(my_register_name).IS_CONTAINER) $(is_container))
+endif
+
 ifdef notice_file
 
 ifdef my_register_name
-ALL_MODULES.$(my_register_name).NOTICES := $(ALL_MODULES.$(my_register_name).NOTICES) $(notice_file)
+ALL_MODULES.$(my_register_name).NOTICES := $(sort $(ALL_MODULES.$(my_register_name).NOTICES) $(notice_file))
 endif
 
 # This relies on the name of the directory in PRODUCT_OUT matching where
@@ -87,8 +167,6 @@
       # Soong produces uninstallable *.sdk shared libraries for embedding in APKs.
       module_installed_filename := \
           $(patsubst $(PRODUCT_OUT)/%,%,$($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_SHARED_LIBRARIES))/$(notdir $(LOCAL_BUILT_MODULE))
-    else
-      $(error Cannot determine where to install NOTICE file for $(LOCAL_MODULE))
     endif # JAVA_LIBRARIES
   endif # STATIC_LIBRARIES
 endif
@@ -101,12 +179,17 @@
 
 installed_notice_file := $($(my_prefix)OUT_NOTICE_FILES)/src/$(module_installed_filename).txt
 
+ifdef my_register_name
+ALL_MODULES.$(my_register_name).INSTALLED_NOTICE_FILE := $(installed_notice_file)
+endif
+
 $(installed_notice_file): PRIVATE_INSTALLED_MODULE := $(module_installed_filename)
+$(installed_notice_file) : PRIVATE_NOTICES := $(notice_file)
 
 $(installed_notice_file): $(notice_file)
 	@echo Notice file: $< -- $@
 	$(hide) mkdir -p $(dir $@)
-	$(hide) awk 'FNR==1 && NR > 1 {print "\n"} {print}' $^ > $@
+	$(hide) awk 'FNR==1 && NR > 1 {print "\n"} {print}' $(PRIVATE_NOTICES) > $@
 
 ifdef LOCAL_INSTALLED_MODULE
 # Make LOCAL_INSTALLED_MODULE depend on NOTICE files if they exist
diff --git a/core/package_internal.mk b/core/package_internal.mk
index a97e401..1b40624 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -552,6 +552,10 @@
 ifeq (true, $(LOCAL_UNCOMPRESS_DEX))
 $(LOCAL_BUILT_MODULE) : $(ZIP2ZIP)
 endif
+ifeq ($(full_classes_jar),)
+  # We don't build jar, need to add the Java resources here.
+  $(LOCAL_BUILT_MODULE): $(java_resource_sources)
+endif
 $(LOCAL_BUILT_MODULE): PRIVATE_USE_EMBEDDED_NATIVE_LIBS := $(LOCAL_USE_EMBEDDED_NATIVE_LIBS)
 $(LOCAL_BUILT_MODULE):
 	@echo "target Package: $(PRIVATE_MODULE) ($@)"
@@ -603,6 +607,8 @@
 else
   $(my_bundle_module): PRIVATE_DEX_FILE :=
   $(my_bundle_module): PRIVATE_SOURCE_ARCHIVE :=
+  # We don't build jar, need to add the Java resources here.
+  $(my_bundle_module): $(java_resource_sources)
 endif # full_classes_jar
 
 $(my_bundle_module): $(MERGE_ZIPS) $(SOONG_ZIP) $(ZIP2ZIP)
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 5b2d1dc..5ca1d10 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -103,7 +103,9 @@
 $(call add_json_list, CFIIncludePaths,                   $(CFI_INCLUDE_PATHS) $(PRODUCT_CFI_INCLUDE_PATHS))
 $(call add_json_list, IntegerOverflowExcludePaths,       $(INTEGER_OVERFLOW_EXCLUDE_PATHS) $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
 
-$(call add_json_bool, Experimental_mte,                  $(filter true,$(TARGET_EXPERIMENTAL_MTE)))
+$(call add_json_list, MemtagHeapExcludePaths,            $(MEMTAG_HEAP_EXCLUDE_PATHS) $(PRODUCT_MEMTAG_HEAP_EXCLUDE_PATHS))
+$(call add_json_list, MemtagHeapAsyncIncludePaths,       $(MEMTAG_HEAP_ASYNC_INCLUDE_PATHS) $(PRODUCT_MEMTAG_HEAP_ASYNC_INCLUDE_PATHS))
+$(call add_json_list, MemtagHeapSyncIncludePaths,        $(MEMTAG_HEAP_SYNC_INCLUDE_PATHS) $(PRODUCT_MEMTAG_HEAP_SYNC_INCLUDE_PATHS))
 
 $(call add_json_bool, DisableScudo,                      $(filter true,$(PRODUCT_DISABLE_SCUDO)))
 
diff --git a/core/sysprop.mk b/core/sysprop.mk
index bb19dc5..1540736 100644
--- a/core/sysprop.mk
+++ b/core/sysprop.mk
@@ -71,6 +71,7 @@
 #       $(3) and (4) are affected
 # $(6): optional list of files to append at the end. The content of each file is emitted
 #       to the output
+# $(7): optional flag to skip common properties generation
 define build-properties
 ALL_DEFAULT_INSTALLED_MODULES += $(2)
 
@@ -96,7 +97,9 @@
 	$(hide) echo Building $$@
 	$(hide) mkdir -p $$(dir $$@)
 	$(hide) rm -f $$@ && touch $$@
+ifneq ($(strip $(7)), true)
 	$(hide) $$(call generate-common-build-props,$(call to-lower,$(strip $(1))),$$@)
+endif
 	$(hide) $(foreach file,$(strip $(3)),\
 	    if [ -f "$(file)" ]; then\
 	        echo "" >> $$@;\
@@ -309,6 +312,7 @@
     $(_prop_files_),\
     $(_prop_vars_),\
     $(_blacklist_names_),\
+    $(empty),\
     $(empty)))
 
 # -----------------------------------------------------------------
@@ -346,6 +350,7 @@
     $(_prop_files_),\
     $(_prop_vars_),\
     $(PRODUCT_VENDOR_PROPERTY_BLACKLIST),\
+    $(empty),\
     $(empty)))
 
 # -----------------------------------------------------------------
@@ -379,13 +384,28 @@
 _footers_ :=
 endif
 
+# Skip common /product properties generation if device released before R and
+# has no product partition. This is the first part of the check.
+ifeq ($(call math_lt,$(if $(PRODUCT_SHIPPING_API_LEVEL),$(PRODUCT_SHIPPING_API_LEVEL),30),30), true)
+  _skip_common_properties := true
+endif
+
+# The second part of the check - always generate common properties for the
+# devices with product partition regardless of shipping level.
+ifneq ($(BOARD_USES_PRODUCTIMAGE),)
+  _skip_common_properties :=
+endif
+
 $(eval $(call build-properties,\
     product,\
     $(INSTALLED_PRODUCT_BUILD_PROP_TARGET),\
     $(_prop_files_),\
     $(_prop_vars_),\
     $(empty),\
-    $(_footers_)))
+    $(_footers_),\
+    $(_skip_common_properties)))
+
+_skip_common_properties :=
 
 # ----------------------------------------------------------------
 # odm/etc/build.prop
@@ -407,6 +427,7 @@
     $(_prop_files),\
     $(_prop_vars_),\
     $(empty),\
+    $(empty),\
     $(empty)))
 
 # ----------------------------------------------------------------
@@ -420,6 +441,7 @@
     $(empty),\
     $(empty),\
     $(empty),\
+    $(empty),\
     $(empty)))
 
 # ----------------------------------------------------------------
@@ -433,6 +455,7 @@
     $(empty),\
     $(empty),\
     $(empty),\
+    $(empty),\
     $(empty)))
 
 # -----------------------------------------------------------------
@@ -453,6 +476,7 @@
     $(_prop_files_),\
     $(_prop_vars_),\
     $(empty),\
+    $(empty),\
     $(empty)))
 
 # ----------------------------------------------------------------
@@ -467,4 +491,5 @@
     $(empty),\
     $(empty),\
     $(empty),\
+    $(empty),\
     $(empty)))
diff --git a/core/tasks/module-info.mk b/core/tasks/module-info.mk
index cf32d65..4bbfd39 100644
--- a/core/tasks/module-info.mk
+++ b/core/tasks/module-info.mk
@@ -20,6 +20,7 @@
 			'"srcjars": [$(foreach w,$(sort $(ALL_MODULES.$(m).SRCJARS)),"$(w)", )], ' \
 			'"classes_jar": [$(foreach w,$(sort $(ALL_MODULES.$(m).CLASSES_JAR)),"$(w)", )], ' \
 			'"test_mainline_modules": [$(foreach w,$(sort $(ALL_MODULES.$(m).TEST_MAINLINE_MODULES)),"$(w)", )], ' \
+			'"is_unit_test": "$(ALL_MODULES.$(m).IS_UNIT_TEST)", ' \
 			'},\n' \
 	 ) | sed -e 's/, *\]/]/g' -e 's/, *\}/ }/g' -e '$$s/,$$//' >> $@
 	$(hide) echo '}' >> $@
diff --git a/core/tasks/vendor_snapshot.mk b/core/tasks/vendor_snapshot.mk
index 8234e3f..83c1379 100644
--- a/core/tasks/vendor_snapshot.mk
+++ b/core/tasks/vendor_snapshot.mk
@@ -22,6 +22,11 @@
 
 $(call dist-for-goals, vendor-snapshot, $(SOONG_VENDOR_SNAPSHOT_ZIP))
 
+.PHONY: vendor-fake-snapshot
+vendor-fake-snapshot: $(SOONG_VENDOR_FAKE_SNAPSHOT_ZIP)
+
+$(call dist-for-goals, vendor-fake-snapshot, $(SOONG_VENDOR_FAKE_SNAPSHOT_ZIP):fake/$(notdir $(SOONG_VENDOR_FAKE_SNAPSHOT_ZIP)))
+
 else # BOARD_VNDK_VERSION is NOT set to 'current'
 
 .PHONY: vendor-snapshot
@@ -31,4 +36,11 @@
 		"CANNOT generate Vendor snapshot. BOARD_VNDK_VERSION must be set to 'current'.")
 	exit 1
 
+.PHONY: vendor-fake-snapshot
+vendor-fake-snapshot: PRIVATE_MAKEFILE := $(current_makefile)
+vendor-fake-snapshot:
+	$(call echo-error,$(PRIVATE_MAKEFILE),\
+		"CANNOT generate Vendor snapshot. BOARD_VNDK_VERSION must be set to 'current'.")
+	exit 1
+
 endif # BOARD_VNDK_VERSION
diff --git a/target/board/BoardConfigModuleCommon.mk b/target/board/BoardConfigModuleCommon.mk
new file mode 100644
index 0000000..24c01a5
--- /dev/null
+++ b/target/board/BoardConfigModuleCommon.mk
@@ -0,0 +1,6 @@
+# BoardConfigModuleCommon.mk
+#
+# Common compile-time settings for module builds.
+
+# Required for all module devices.
+TARGET_USES_64_BIT_BINDER := true
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index 414e032..30c033d 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -61,6 +61,12 @@
 BOARD_KERNEL-5.4-GZ-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 47185920
 BOARD_KERNEL-5.4-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
 BOARD_KERNEL-5.4-LZ4-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 53477376
+BOARD_KERNEL-5.10_BOOTIMAGE_PARTITION_SIZE := 67108864
+BOARD_KERNEL-5.10-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 67108864
+BOARD_KERNEL-5.10-GZ_BOOTIMAGE_PARTITION_SIZE := 47185920
+BOARD_KERNEL-5.10-GZ-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 47185920
+BOARD_KERNEL-5.10-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
+BOARD_KERNEL-5.10-LZ4-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 53477376
 BOARD_KERNEL-MAINLINE_BOOTIMAGE_PARTITION_SIZE := 67108864
 BOARD_KERNEL-MAINLINE-GZ_BOOTIMAGE_PARTITION_SIZE := 47185920
 BOARD_KERNEL-MAINLINE-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
@@ -71,17 +77,27 @@
 BOARD_BOOT_HEADER_VERSION := 3
 BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
 
-BOARD_KERNEL_BINARIES := kernel-4.19-gz kernel-5.4 kernel-5.4-gz kernel-5.4-lz4 \
-    kernel-mainline kernel-mainline-gz kernel-mainline-lz4
+BOARD_KERNEL_BINARIES := \
+    kernel-4.19-gz \
+    kernel-5.4 kernel-5.4-gz kernel-5.4-lz4 \
+    kernel-5.10 kernel-5.10-gz kernel-5.10-lz4 \
+    kernel-mainline kernel-mainline-gz kernel-mainline-lz4 \
+
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
-BOARD_KERNEL_BINARIES += kernel-5.4-allsyms kernel-5.4-gz-allsyms kernel-5.4-lz4-allsyms
+BOARD_KERNEL_BINARIES += \
+    kernel-5.4-allsyms kernel-5.4-gz-allsyms kernel-5.4-lz4-allsyms \
+    kernel-5.10-allsyms kernel-5.10-gz-allsyms kernel-5.10-lz4-allsyms \
+
 endif
 
 # Boot image
 BOARD_USES_RECOVERY_AS_BOOT :=
 TARGET_NO_KERNEL := false
 BOARD_USES_GENERIC_KERNEL_IMAGE := true
-BOARD_KERNEL_MODULE_INTERFACE_VERSIONS := 5.4-android12-0
+BOARD_KERNEL_MODULE_INTERFACE_VERSIONS := \
+    5.4-android12-0 \
+    5.10-android12-0 \
+
 # Copy boot image in $OUT to target files. This is defined for targets where
 # the installed GKI APEXes are built from source.
 BOARD_COPY_BOOT_IMAGE_TO_TARGET_FILES := true
diff --git a/target/board/generic_arm64/device.mk b/target/board/generic_arm64/device.mk
index e64014b..37c0f25 100644
--- a/target/board/generic_arm64/device.mk
+++ b/target/board/generic_arm64/device.mk
@@ -19,6 +19,9 @@
     kernel/prebuilts/5.4/arm64/kernel-5.4:kernel-5.4 \
     kernel/prebuilts/5.4/arm64/kernel-5.4-gz:kernel-5.4-gz \
     kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4 \
+    kernel/prebuilts/5.10/arm64/kernel-5.10:kernel-5.10 \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-gz:kernel-5.10-gz \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-lz4:kernel-5.10-lz4 \
     kernel/prebuilts/mainline/arm64/kernel-mainline-allsyms:kernel-mainline \
     kernel/prebuilts/mainline/arm64/kernel-mainline-gz-allsyms:kernel-mainline-gz \
     kernel/prebuilts/mainline/arm64/kernel-mainline-lz4-allsyms:kernel-mainline-lz4
@@ -27,7 +30,11 @@
 PRODUCT_COPY_FILES += \
     kernel/prebuilts/5.4/arm64/kernel-5.4:kernel-5.4-allsyms \
     kernel/prebuilts/5.4/arm64/kernel-5.4-gz:kernel-5.4-gz-allsyms \
-    kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4-allsyms
+    kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4-allsyms \
+    kernel/prebuilts/5.10/arm64/kernel-5.10:kernel-5.10-allsyms \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-gz:kernel-5.10-gz-allsyms \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-lz4:kernel-5.10-lz4-allsyms \
+
 endif
 
 PRODUCT_BUILD_VENDOR_BOOT_IMAGE := false
diff --git a/target/board/module_arm/BoardConfig.mk b/target/board/module_arm/BoardConfig.mk
index 565efc8..3f35c06 100644
--- a/target/board/module_arm/BoardConfig.mk
+++ b/target/board/module_arm/BoardConfig.mk
@@ -13,6 +13,8 @@
 # limitations under the License.
 #
 
+include build/make/target/board/BoardConfigModuleCommon.mk
+
 TARGET_ARCH := arm
 TARGET_ARCH_VARIANT := armv7-a-neon
 TARGET_CPU_VARIANT := generic
diff --git a/target/board/module_arm64/BoardConfig.mk b/target/board/module_arm64/BoardConfig.mk
index 66e3792..3700056 100644
--- a/target/board/module_arm64/BoardConfig.mk
+++ b/target/board/module_arm64/BoardConfig.mk
@@ -13,6 +13,8 @@
 # limitations under the License.
 #
 
+include build/make/target/board/BoardConfigModuleCommon.mk
+
 TARGET_ARCH := arm64
 TARGET_ARCH_VARIANT := armv8-a
 TARGET_CPU_VARIANT := generic
diff --git a/target/board/module_x86/BoardConfig.mk b/target/board/module_x86/BoardConfig.mk
index af3fffd..a93ac97 100644
--- a/target/board/module_x86/BoardConfig.mk
+++ b/target/board/module_x86/BoardConfig.mk
@@ -13,6 +13,8 @@
 # limitations under the License.
 #
 
+include build/make/target/board/BoardConfigModuleCommon.mk
+
 TARGET_CPU_ABI := x86
 TARGET_ARCH := x86
 TARGET_ARCH_VARIANT := x86
diff --git a/target/board/module_x86_64/BoardConfig.mk b/target/board/module_x86_64/BoardConfig.mk
index 1ada027..1ed3be0 100644
--- a/target/board/module_x86_64/BoardConfig.mk
+++ b/target/board/module_x86_64/BoardConfig.mk
@@ -13,6 +13,8 @@
 # limitations under the License.
 #
 
+include build/make/target/board/BoardConfigModuleCommon.mk
+
 TARGET_CPU_ABI := x86_64
 TARGET_ARCH := x86_64
 TARGET_ARCH_VARIANT := x86_64
diff --git a/target/product/cfi-common.mk b/target/product/cfi-common.mk
index 82f53f6..925d70e 100644
--- a/target/product/cfi-common.mk
+++ b/target/product/cfi-common.mk
@@ -29,7 +29,7 @@
     hardware/interfaces/nfc \
     hardware/qcom/wlan/qcwcn/wpa_supplicant_8_lib \
     hardware/interfaces/keymaster \
-    hardware/interfaces/keymint \
+    hardware/interfaces/security \
     system/bt \
     system/chre \
     system/core/libnetutils \
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index 269ee23..d693c0f 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -57,6 +57,7 @@
 VNDK-SP: libutilscallstack.so
 VNDK-SP: libz.so
 VNDK-core: android.hardware.audio.common@2.0.so
+VNDK-core: android.hardware.authsecret-V1-ndk_platform.so
 VNDK-core: android.hardware.automotive.occupant_awareness-V1-ndk_platform.so
 VNDK-core: android.hardware.configstore-utils.so
 VNDK-core: android.hardware.configstore@1.0.so
@@ -75,6 +76,7 @@
 VNDK-core: android.hardware.media@1.0.so
 VNDK-core: android.hardware.memtrack-V1-ndk_platform.so
 VNDK-core: android.hardware.memtrack@1.0.so
+VNDK-core: android.hardware.oemlock-V1-ndk_platform.so
 VNDK-core: android.hardware.power-V1-ndk_platform.so
 VNDK-core: android.hardware.rebootescrow-V1-ndk_platform.so
 VNDK-core: android.hardware.security.keymint-V1-ndk_platform.so
diff --git a/tools/build-license-metadata.sh b/tools/build-license-metadata.sh
new file mode 100755
index 0000000..3bad358
--- /dev/null
+++ b/tools/build-license-metadata.sh
@@ -0,0 +1,312 @@
+#!/bin/sh
+
+set -u
+
+ME=$(basename $0)
+
+USAGE="Usage: ${ME} {options}
+
+Builds a license metadata specification and outputs it to stdout or {outfile}.
+
+The available options are:
+
+-k kind...              license kinds
+-c condition...         license conditions
+-p package...           license package name
+-n notice...            license notice file
+-d dependency...        license metadata file dependency
+-t target...            targets
+-m target:installed...  map dependent targets to their installed names
+-is_container           preserved dependent target name when given
+-o outfile              output file
+"
+
+# Global flag variables
+license_kinds=
+license_conditions=
+license_package_name=
+license_notice=
+license_deps=
+targets=
+installmap=
+is_container=false
+ofile=
+
+# Global variables
+depfiles=" "
+effective_conditions=
+
+
+# Exits with a message.
+#
+# When the exit status is 2, assumes a usage error and outputs the usage message
+# to stderr before outputting the specific error message to stderr.
+#
+# Parameters:
+#   Optional numeric exit status (defaults to 2, i.e. a usage error.)
+#   Remaining args treated as an error message sent to stderr.
+die() {
+  lstatus=2
+  case "${1:-}" in *[^0-9]*) ;; *) lstatus="$1"; shift ;; esac
+  case "${lstatus}" in 2) echo "${USAGE}" >&2; echo >&2 ;; esac
+  if [ -n "$*" ]; then
+    echo -e "$*\n" >&2
+  fi
+  exit $lstatus
+}
+
+
+# Sets the flag variables based on the command-line.
+#
+# invoke with: process_args "$@"
+process_args() {
+  lcurr_flag=
+  while [ "$#" -gt '0' ]; do
+    case "${1}" in
+      -h)
+        echo "${USAGE}"
+        exit 0
+        ;;
+      -k)
+        lcurr_flag=kind
+        ;;
+      -c)
+        lcurr_flag=condition
+        ;;
+      -p)
+        lcurr_flag=package
+        ;;
+      -n)
+        lcurr_flag=notice
+        ;;
+      -d)
+        lcurr_flag=dependency
+        ;;
+      -t)
+        lcurr_flag=target
+        ;;
+      -m)
+        lcurr_flag=installmap
+        ;;
+      -o)
+        lcurr_flag=ofile
+        ;;
+      -is_container)
+        lcurr_flag=
+        is_container=true
+        ;;
+      -*)
+        die "Unknown flag: \"${1}\""
+        ;;
+      *)
+        case "${lcurr_flag}" in
+          kind)
+            license_kinds="${license_kinds}${license_kinds:+ }${1}"
+            ;;
+          condition)
+            license_conditions="${license_conditions}${license_conditions:+ }${1}"
+            ;;
+          package)
+            license_package_name="${license_package_name}${license_package_name:+ }${1}"
+            ;;
+          notice)
+            license_notice="${license_notice}${license_notice:+ }${1}"
+            ;;
+          dependency)
+            license_deps="${license_deps}${license_deps:+ }${1}"
+            ;;
+          target)
+            targets="${targets}${targets:+ }${1}"
+            ;;
+          installmap)
+            installmap="${installmap}${installmap:+ }${1}"
+            ;;
+          ofile)
+            if [ -n "${ofile}" ]; then
+              die "Output file -o appears twice as \"${ofile}\" and \"${1}\""
+            fi
+            ofile="${1}"
+            ;;
+          *)
+            die "Must precede argument \"${1}\" with type flag."
+            ;;
+        esac
+        ;;
+    esac
+    shift
+  done
+}
+
+# Reads a license metadata file from stdin, and outputs the named dependencies.
+#
+# No parameters.
+extract_deps() {
+  awk '$1 == "dep_name:" { sub(/^"/, "", $2); sub(/"$/, "", $2); print $2; }'
+}
+
+# Populates the depfiles variable identifying dependency files.
+#
+# Starting with the dependencies enumerated in license_deps, calculates the
+# transitive closure of all dependencies.
+#
+# Dependency names ending in .meta_module indirectly reference license
+# metadata with 1 license metadata filename per line.
+#
+# No parameters; no output.
+read_deps() {
+  lnewdeps=
+  for d in ${license_deps}; do
+    case "${d}" in
+      *.meta_module)
+        lnewdeps="${lnewdeps}${lnewdeps:+ }"$(cat "${d}") ;;
+      *)
+        lnewdeps="${lnewdeps}${lnewdeps:+ }${d}" ;;
+    esac
+  done
+  lnewdeps=$(echo "${lnewdeps}" | tr ' ' '\n' | sort -u)
+  lalldeps=
+  ldeps=
+  lmod=
+  ldep=
+  while [ "${#lnewdeps}" -gt '0' ]; do
+    ldeps="${lnewdeps}"
+    lnewdeps=
+    for ldep in ${ldeps}; do
+      depfiles="${depfiles}${ldep} "
+      lalldeps="${lalldeps}${lalldeps:+ }"$(cat "${ldep}" | extract_deps)
+    done
+    lalldeps=$(for d in ${lalldeps}; do echo "${d}"; done | sort -u)
+    for d in ${lalldeps}; do
+      ldeps="${d}"
+      case "${d}" in *.meta_module) ldeps=$(cat "${d}") ;; esac
+      for lmod in ${ldeps}; do
+        if ! expr "${depfiles}" : ".* ${lmod} .*" >/dev/null 2>&1; then
+          lnewdeps="${lnewdeps}${lnewdeps:+ }${lmod}"
+        fi
+      done
+    done
+    lalldeps=
+  done
+}
+
+# Returns the effective license conditions for the current license metadata.
+#
+# If a module is restricted or links in a restricted module, the effective
+# license has a restricted condition.
+calculate_effective_conditions() {
+  lconditions="${license_conditions}"
+  case "${license_conditions}" in
+    *restricted*) : do nothing ;;
+    *)
+       for d in ${depfiles}; do
+         if cat "${d}" | egrep -q 'effective_condition\s*:.*restricted' ; then
+           lconditions="${lconditions}${lconditions:+ }restricted"
+         fi
+       done
+     ;;
+  esac
+  echo "${lconditions}"
+}
+
+
+process_args "$@"
+
+if [ -n "${ofile}" ]; then
+  # truncate the output file before appending results
+  : >"${ofile}"
+else
+  ofile=/dev/stdout
+fi
+
+# spit out the license metadata file content
+(
+  echo 'license_package_name: "'${license_package_name}'"'
+  for kind in ${license_kinds}; do
+    echo 'license_kind: "'${kind}'"'
+  done
+  for condition in ${license_conditions}; do
+    echo 'license_condition: "'${condition}'"'
+  done
+  for f in ${license_notice}; do
+    echo 'license_text: "'${f}'"'
+  done
+  echo "is_container: ${is_container}"
+  for t in ${targets}; do
+    echo 'target: "'${t}'"'
+  done
+  for m in ${installmap}; do
+    echo 'install_map: "'${m}'"'
+  done
+) >>"${ofile}"
+read_deps
+effective_conditions=$(calculate_effective_conditions)
+for condition in ${effective_conditions}; do
+  echo 'effective_condition: "'${condition}'"'
+done >>"${ofile}"
+for dep in ${depfiles}; do
+  echo 'dep {'
+  cat "${dep}" | \
+    awk -v name="${dep}" '
+      function strip_type() {
+        $1 = ""
+        sub(/^\s*/, "")
+      }
+      BEGIN {
+        print "  dep_name: " name
+      }
+      $1 == "license_package_name:" {
+        strip_type()
+        print "  dep_package_name: "$0
+      }
+      $1 == "dep_name:" {
+        print "  dep_sub_dep: "$2
+      }
+      $1 == "license_kind:" {
+        print "  dep_license_kind: "$2
+      }
+      $1 == "license_condition:" {
+        print "  dep_license_condition: "$2
+      }
+      $1 == "is_container:" {
+        print "  dep_is_container: "$2
+      }
+      $1 == "license_text:" {
+        strip_type()
+        print "  dep_license_text: "$0
+      }
+      $1 == "target:" {
+        print "  dep_target: "$2
+      }
+      $1 == "install_map:" {
+        print "  dep_install_map: "$2
+      }
+  '
+  # The restricted license kind is contagious to all linked dependencies.
+  dep_conditions=$(echo $(
+      cat "${dep}" | awk '
+        $1 == "effective_condition:" {
+          $1 = ""
+          sub(/^\s*/, "")
+          gsub(/"/, "")
+          print
+        }
+      '
+  ))
+  for condition in ${dep_conditions}; do
+    echo '  dep_effective_condition: "'${condition}'"'
+  done
+  if ! ${is_container}; then
+    case "${dep_conditions}" in
+      *restricted*) : already restricted -- nothing to inherit ;;
+      *)
+        case "${effective_conditions}" in
+          *restricted*)
+            # "contagious" restricted infects everything linked to restricted
+            echo '  dep_effective_condition: "restricted"'
+            ;;
+        esac
+        ;;
+    esac
+  fi
+  echo '}'
+done >>"${ofile}"
diff --git a/tools/releasetools/Android.bp b/tools/releasetools/Android.bp
index 5cb639a..bca70a9 100644
--- a/tools/releasetools/Android.bp
+++ b/tools/releasetools/Android.bp
@@ -219,6 +219,8 @@
         "lz4",
         "mkbootfs",
         "signapk",
+        "toybox",
+        "unpack_bootimg",
     ],
 }
 
@@ -279,6 +281,8 @@
         "lz4",
         "mkbootfs",
         "signapk",
+        "toybox",
+        "unpack_bootimg",
     ],
 }
 
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index dc6e3ca..c8a0dcc 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -300,13 +300,13 @@
   return payload_info
 
 
-def SignApex(avbtool, apex_data, payload_key, container_key, container_pw,
-             apk_keys, codename_to_api_level_map,
-             no_hashtree, signing_args=None):
-  """Signs the current APEX with the given payload/container keys.
+def SignUncompressedApex(avbtool, apex_data, payload_key, container_key,
+                         container_pw, apk_keys, codename_to_api_level_map,
+                         no_hashtree, signing_args=None):
+  """Signs the current uncompressed APEX with the given payload/container keys.
 
   Args:
-    apex_data: Raw APEX data.
+    apex_data: Raw uncompressed APEX data.
     payload_key: The path to payload signing key (w/ extension).
     container_key: The path to container signing key (w/o extension).
     container_pw: The matching password of the container_key, or None.
@@ -370,12 +370,61 @@
   extra_signapk_args = OPTIONS.extra_signapk_args[:]
   extra_signapk_args.extend(['-a', '4096'])
 
+  password = container_pw.get(container_key) if container_pw else None
   common.SignFile(
       aligned_apex,
       signed_apex,
       container_key,
-      container_pw.get(container_key),
+      password,
       codename_to_api_level_map=codename_to_api_level_map,
       extra_signapk_args=extra_signapk_args)
 
   return signed_apex
+
+
+def SignApex(avbtool, apex_data, payload_key, container_key, container_pw,
+             apk_keys, codename_to_api_level_map,
+             no_hashtree, signing_args=None):
+  """Signs the current APEX with the given payload/container keys.
+
+  Args:
+    apex_file: Path to apex file path.
+    payload_key: The path to payload signing key (w/ extension).
+    container_key: The path to container signing key (w/o extension).
+    container_pw: The matching password of the container_key, or None.
+    apk_keys: A dict that holds the signing keys for apk files.
+    codename_to_api_level_map: A dict that maps from codename to API level.
+    no_hashtree: Don't include hashtree in the signed APEX.
+    signing_args: Additional args to be passed to the payload signer.
+
+  Returns:
+    The path to the signed APEX file.
+  """
+  apex_file = common.MakeTempFile(prefix='apex-container-', suffix='.apex')
+  with open(apex_file, 'wb') as output_fp:
+    output_fp.write(apex_data)
+
+  debugfs_path = os.path.join(OPTIONS.search_path, "bin", "debugfs_static")
+  cmd = ['deapexer', '--debugfs_path', debugfs_path,
+         'info', '--print-type', apex_file]
+
+  try:
+    apex_type = common.RunAndCheckOutput(cmd).strip()
+    if apex_type == 'UNCOMPRESSED':
+      return SignUncompressedApex(
+          avbtool,
+          apex_data,
+          payload_key=payload_key,
+          container_key=container_key,
+          container_pw=None,
+          codename_to_api_level_map=codename_to_api_level_map,
+          no_hashtree=no_hashtree,
+          apk_keys=apk_keys,
+          signing_args=signing_args)
+    else:
+      # TODO(b/172912232): support signing compressed apex
+      raise ApexInfoError('Unsupported apex type {}'.format(apex_type))
+
+  except common.ExternalError as e:
+    raise ApexInfoError(
+        'Failed to get type for {}:\n{}'.format(apex_file))
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 0172add..26c4ae8 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -128,6 +128,12 @@
     'odm_dlkm',
 ]
 
+# Partitions with a build.prop file
+PARTITIONS_WITH_BUILD_PROP = PARTITIONS_WITH_CARE_MAP + ['boot']
+
+# See sysprop.mk. If file is moved, add new search paths here; don't remove
+# existing search paths.
+RAMDISK_BUILD_PROP_REL_PATHS = ['system/etc/ramdisk/build.prop']
 
 class ErrorCode(object):
   """Define error_codes for failures that happen during the actual
@@ -417,7 +423,7 @@
             "3.2.2. Build Parameters.".format(fingerprint))
 
     self._partition_fingerprints = {}
-    for partition in PARTITIONS_WITH_CARE_MAP:
+    for partition in PARTITIONS_WITH_BUILD_PROP:
       try:
         fingerprint = self.CalculatePartitionFingerprint(partition)
         check_fingerprint(fingerprint)
@@ -425,7 +431,7 @@
       except ExternalError:
         continue
     if "system" in self._partition_fingerprints:
-      # system_other is not included in PARTITIONS_WITH_CARE_MAP, but does
+      # system_other is not included in PARTITIONS_WITH_BUILD_PROP, but does
       # need a fingerprint when creating the image.
       self._partition_fingerprints[
           "system_other"] = self._partition_fingerprints["system"]
@@ -473,12 +479,16 @@
 
   def GetPartitionBuildProp(self, prop, partition):
     """Returns the inquired build property for the provided partition."""
+
+    # Boot image uses ro.[product.]bootimage instead of boot.
+    prop_partition =  "bootimage" if partition == "boot" else partition
+
     # If provided a partition for this property, only look within that
     # partition's build.prop.
     if prop in BuildInfo._RO_PRODUCT_RESOLVE_PROPS:
-      prop = prop.replace("ro.product", "ro.product.{}".format(partition))
+      prop = prop.replace("ro.product", "ro.product.{}".format(prop_partition))
     else:
-      prop = prop.replace("ro.", "ro.{}.".format(partition))
+      prop = prop.replace("ro.", "ro.{}.".format(prop_partition))
 
     prop_val = self._GetRawBuildProp(prop, partition)
     if prop_val is not None:
@@ -649,6 +659,20 @@
         raise KeyError(fn)
 
 
+def ExtractFromInputFile(input_file, fn):
+  """Extracts the contents of fn from input zipfile or directory into a file."""
+  if isinstance(input_file, zipfile.ZipFile):
+    tmp_file = MakeTempFile(os.path.basename(fn))
+    with open(tmp_file, 'w') as f:
+      f.write(input_file.read(fn))
+    return tmp_file
+  else:
+    file = os.path.join(input_file, *fn.split("/"))
+    if not os.path.exists(file):
+      raise KeyError(fn)
+    return file
+
+
 def LoadInfoDict(input_file, repacking=False):
   """Loads the key/value pairs from the given input target_files.
 
@@ -753,7 +777,7 @@
 
   # Tries to load the build props for all partitions with care_map, including
   # system and vendor.
-  for partition in PARTITIONS_WITH_CARE_MAP:
+  for partition in PARTITIONS_WITH_BUILD_PROP:
     partition_prop = "{}.build.prop".format(partition)
     d[partition_prop] = PartitionBuildProps.FromInputFile(
         input_file, partition)
@@ -763,7 +787,7 @@
   # hash / hashtree footers.
   if d.get("avb_enable") == "true":
     build_info = BuildInfo(d)
-    for partition in PARTITIONS_WITH_CARE_MAP:
+    for partition in PARTITIONS_WITH_BUILD_PROP:
       fingerprint = build_info.GetPartitionFingerprint(partition)
       if fingerprint:
         d["avb_{}_salt".format(partition)] = sha256(fingerprint.encode()).hexdigest()
@@ -839,6 +863,39 @@
   @staticmethod
   def FromInputFile(input_file, name, placeholder_values=None):
     """Loads the build.prop file and builds the attributes."""
+
+    if name == "boot":
+      data = PartitionBuildProps._ReadBootPropFile(input_file)
+    else:
+      data = PartitionBuildProps._ReadPartitionPropFile(input_file, name)
+
+    props = PartitionBuildProps(input_file, name, placeholder_values)
+    props._LoadBuildProp(data)
+    return props
+
+  @staticmethod
+  def _ReadBootPropFile(input_file):
+    """
+    Read build.prop for boot image from input_file.
+    Return empty string if not found.
+    """
+    try:
+      boot_img = ExtractFromInputFile(input_file, 'IMAGES/boot.img')
+    except KeyError:
+      logger.warning('Failed to read IMAGES/boot.img')
+      return ''
+    prop_file = GetBootImageBuildProp(boot_img)
+    if prop_file is None:
+      return ''
+    with open(prop_file) as f:
+      return f.read().decode()
+
+  @staticmethod
+  def _ReadPartitionPropFile(input_file, name):
+    """
+    Read build.prop for name from input_file.
+    Return empty string if not found.
+    """
     data = ''
     for prop_file in ['{}/etc/build.prop'.format(name.upper()),
                       '{}/build.prop'.format(name.upper())]:
@@ -847,10 +904,7 @@
         break
       except KeyError:
         logger.warning('Failed to read %s', prop_file)
-
-    props = PartitionBuildProps(input_file, name, placeholder_values)
-    props._LoadBuildProp(data)
-    return props
+    return data
 
   @staticmethod
   def FromBuildPropFile(name, build_prop_file):
@@ -3589,3 +3643,75 @@
         comment('Move partition %s from default to %s' %
                 (p, u.tgt_group))
         append('move %s %s' % (p, u.tgt_group))
+
+
+def GetBootImageBuildProp(boot_img):
+  """
+  Get build.prop from ramdisk within the boot image
+
+  Args:
+    boot_img: the boot image file. Ramdisk must be compressed with lz4 format.
+
+  Return:
+    An extracted file that stores properties in the boot image.
+  """
+  tmp_dir = MakeTempDir('boot_', suffix='.img')
+  try:
+    RunAndCheckOutput(['unpack_bootimg', '--boot_img', boot_img, '--out', tmp_dir])
+    ramdisk = os.path.join(tmp_dir, 'ramdisk')
+    if not os.path.isfile(ramdisk):
+      logger.warning('Unable to get boot image timestamp: no ramdisk in boot')
+      return None
+    uncompressed_ramdisk = os.path.join(tmp_dir, 'uncompressed_ramdisk')
+    RunAndCheckOutput(['lz4', '-d', ramdisk, uncompressed_ramdisk])
+
+    abs_uncompressed_ramdisk = os.path.abspath(uncompressed_ramdisk)
+    extracted_ramdisk = MakeTempDir('extracted_ramdisk')
+    # Use "toybox cpio" instead of "cpio" because the latter invokes cpio from
+    # the host environment.
+    RunAndCheckOutput(['toybox', 'cpio', '-F', abs_uncompressed_ramdisk, '-i'],
+               cwd=extracted_ramdisk)
+
+    for search_path in RAMDISK_BUILD_PROP_REL_PATHS:
+      prop_file = os.path.join(extracted_ramdisk, search_path)
+      if os.path.isfile(prop_file):
+        return prop_file
+      logger.warning('Unable to get boot image timestamp: no %s in ramdisk', search_path)
+
+    return None
+
+  except ExternalError as e:
+    logger.warning('Unable to get boot image build props: %s', e)
+    return None
+
+
+def GetBootImageTimestamp(boot_img):
+  """
+  Get timestamp from ramdisk within the boot image
+
+  Args:
+    boot_img: the boot image file. Ramdisk must be compressed with lz4 format.
+
+  Return:
+    An integer that corresponds to the timestamp of the boot image, or None
+    if file has unknown format. Raise exception if an unexpected error has
+    occurred.
+  """
+  prop_file = GetBootImageBuildProp(boot_img)
+  if not prop_file:
+    return None
+
+  props = PartitionBuildProps.FromBuildPropFile('boot', prop_file)
+  if props is None:
+    return None
+
+  try:
+    timestamp = props.GetProp('ro.bootimage.build.date.utc')
+    if timestamp:
+      return int(timestamp)
+    logger.warning('Unable to get boot image timestamp: ro.bootimage.build.date.utc is undefined')
+    return None
+
+  except ExternalError as e:
+    logger.warning('Unable to get boot image timestamp: %s', e)
+    return None
diff --git a/tools/releasetools/ota_utils.py b/tools/releasetools/ota_utils.py
index cb0f6e6..6bbcc92 100644
--- a/tools/releasetools/ota_utils.py
+++ b/tools/releasetools/ota_utils.py
@@ -21,8 +21,7 @@
 import ota_metadata_pb2
 from common import (ZipDelete, ZipClose, OPTIONS, MakeTempFile,
                     ZipWriteStr, BuildInfo, LoadDictionaryFromFile,
-                    SignFile, PARTITIONS_WITH_CARE_MAP, PartitionBuildProps,
-                    MakeTempDir, RunAndCheckOutput, ExternalError)
+                    SignFile, PARTITIONS_WITH_BUILD_PROP, PartitionBuildProps)
 
 logger = logging.getLogger(__name__)
 
@@ -41,10 +40,6 @@
 METADATA_PROTO_NAME = 'META-INF/com/android/metadata.pb'
 UNZIP_PATTERN = ['IMAGES/*', 'META/*', 'OTA/*', 'RADIO/*']
 
-# See sysprop.mk. If file is moved, add new search paths here; don't remove
-# existing search paths.
-RAMDISK_BUILD_PROP_REL_PATHS = ['system/etc/ramdisk/build.prop']
-
 def FinalizeMetadata(metadata, input_file, output_file, needed_property_files):
   """Finalizes the metadata and signs an A/B OTA package.
 
@@ -179,7 +174,7 @@
     # delta_generator will error out on unused timestamps,
     # so only generate timestamps for dynamic partitions
     # used in OTA update.
-    for partition in sorted(set(PARTITIONS_WITH_CARE_MAP) & ab_partitions):
+    for partition in sorted(set(PARTITIONS_WITH_BUILD_PROP) & ab_partitions):
       partition_prop = build_info.info_dict.get(
           '{}.build.prop'.format(partition))
       # Skip if the partition is missing, or it doesn't have a build.prop
@@ -365,7 +360,7 @@
     # Reload the info_dict as some build properties may change their values
     # based on the value of ro.boot* properties.
     info_dict = copy.deepcopy(default_build_info.info_dict)
-    for partition in PARTITIONS_WITH_CARE_MAP:
+    for partition in PARTITIONS_WITH_BUILD_PROP:
       partition_prop_key = "{}.build.prop".format(partition)
       input_file = info_dict[partition_prop_key].input_file
       if isinstance(input_file, zipfile.ZipFile):
@@ -567,55 +562,3 @@
 
   SignFile(temp_zip_name, output_zip_name, OPTIONS.package_key, pw,
            whole_file=True)
-
-
-def GetBootImageTimestamp(boot_img):
-  """
-  Get timestamp from ramdisk within the boot image
-
-  Args:
-    boot_img: the boot image file. Ramdisk must be compressed with lz4 format.
-
-  Return:
-    An integer that corresponds to the timestamp of the boot image, or None
-    if file has unknown format. Raise exception if an unexpected error has
-    occurred.
-  """
-
-  tmp_dir = MakeTempDir('boot_', suffix='.img')
-  try:
-    RunAndCheckOutput(['unpack_bootimg', '--boot_img', boot_img, '--out', tmp_dir])
-    ramdisk = os.path.join(tmp_dir, 'ramdisk')
-    if not os.path.isfile(ramdisk):
-      logger.warning('Unable to get boot image timestamp: no ramdisk in boot')
-      return None
-    uncompressed_ramdisk = os.path.join(tmp_dir, 'uncompressed_ramdisk')
-    RunAndCheckOutput(['lz4', '-d', ramdisk, uncompressed_ramdisk])
-
-    abs_uncompressed_ramdisk = os.path.abspath(uncompressed_ramdisk)
-    extracted_ramdisk = MakeTempDir('extracted_ramdisk')
-    # Use "toybox cpio" instead of "cpio" because the latter invokes cpio from
-    # the host environment.
-    RunAndCheckOutput(['toybox', 'cpio', '-F', abs_uncompressed_ramdisk, '-i'],
-               cwd=extracted_ramdisk)
-
-    prop_file = None
-    for search_path in RAMDISK_BUILD_PROP_REL_PATHS:
-      prop_file = os.path.join(extracted_ramdisk, search_path)
-      if os.path.isfile(prop_file):
-        break
-      logger.warning('Unable to get boot image timestamp: no %s in ramdisk', search_path)
-
-    if not prop_file:
-      return None
-
-    props = PartitionBuildProps.FromBuildPropFile('boot', prop_file)
-    timestamp = props.GetProp('ro.bootimage.build.date.utc')
-    if timestamp:
-      return int(timestamp)
-    logger.warning('Unable to get boot image timestamp: ro.bootimage.build.date.utc is undefined')
-    return None
-
-  except ExternalError as e:
-    logger.warning('Unable to get boot image timestamp: %s', e)
-    return None
diff --git a/tools/releasetools/test_validate_target_files.py b/tools/releasetools/test_validate_target_files.py
index e9896ae..48b563d 100644
--- a/tools/releasetools/test_validate_target_files.py
+++ b/tools/releasetools/test_validate_target_files.py
@@ -357,9 +357,6 @@
         'google/coral/coral:10/RP1A.200325.001/6337676:user/dev-keys',
         'ro.product.odm.device=coral',
     ]
-    input_tmp = ValidateTargetFilesTest.make_build_prop({
-        'ODM/etc/build.prop': '\n'.join(build_prop),
-    })
+    input_tmp = ValidateTargetFilesTest.make_build_prop(build_prop)
 
-    self.assertRaises(ValueError, CheckBuildPropDuplicity,
-                        input_tmp)
+    self.assertRaises(ValueError, CheckBuildPropDuplicity, input_tmp)
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index d2178b2..401857f 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -236,6 +236,7 @@
 
   logging.info('Done checking %s', script_path)
 
+
 # Symlink files in `src` to `dst`, if the files do not
 # already exists in `dst` directory.
 def symlinkIfNotExists(src, dst):
@@ -246,6 +247,7 @@
       continue
     os.symlink(os.path.join(src, filename), os.path.join(dst, filename))
 
+
 def ValidateVerifiedBootImages(input_tmp, info_dict, options):
   """Validates the Verified Boot related images.
 
@@ -423,16 +425,25 @@
           'Verified %s with avbtool (key: %s):\n%s', image, key,
           stdoutdata.rstrip())
 
-def CheckDataDuplicity(lines):
+
+def CheckDataInconsistency(lines):
     build_prop = {}
     for line in lines:
       if line.startswith("import") or line.startswith("#"):
         continue
-      key, value = line.split("=", 1)
+      if "=" not in line:
+        continue
+
+      key, value = line.rstrip().split("=", 1)
       if key in build_prop:
-        return key
+        logging.info("Duplicated key found for {}".format(key))
+        if value != build_prop[key]:
+          logging.error("Key {} is defined twice with different values {} vs {}"
+                        .format(key, value, build_prop[key]))
+          return key
       build_prop[key] = value
 
+
 def CheckBuildPropDuplicity(input_tmp):
   """Check all buld.prop files inside directory input_tmp, raise error
   if they contain duplicates"""
@@ -448,9 +459,11 @@
         continue
       logging.info("Checking {}".format(path))
       with open(path, 'r') as fp:
-        dupKey = CheckDataDuplicity(fp.readlines())
+        dupKey = CheckDataInconsistency(fp.readlines())
         if dupKey:
-          raise ValueError("{} contains duplicate keys for {}", path, dupKey)
+          raise ValueError("{} contains duplicate keys for {}".format(
+              path, dupKey))
+
 
 def main():
   parser = argparse.ArgumentParser(
diff --git a/tools/zipalign/ZipFile.cpp b/tools/zipalign/ZipFile.cpp
index 9938a06..1e3c413 100644
--- a/tools/zipalign/ZipFile.cpp
+++ b/tools/zipalign/ZipFile.cpp
@@ -245,7 +245,11 @@
 
     /* read the last part of the file into the buffer */
     if (fread(buf, 1, readAmount, mZipFp) != (size_t) readAmount) {
-        ALOGD("short file? wanted %ld\n", readAmount);
+        if (feof(mZipFp)) {
+            ALOGW("fread %ld bytes failed, unexpected EOF", readAmount);
+        } else {
+            ALOGW("fread %ld bytes failed, %s", readAmount, strerror(errno));
+        }
         result = UNKNOWN_ERROR;
         goto bail;
     }
@@ -327,7 +331,11 @@
     {
         uint8_t checkBuf[4];
         if (fread(checkBuf, 1, 4, mZipFp) != 4) {
-            ALOGD("EOCD check read failed\n");
+            if (feof(mZipFp)) {
+                ALOGW("fread EOCD failed, unexpected EOF");
+            } else {
+                ALOGW("fread EOCD failed, %s", strerror(errno));
+            }
             result = INVALID_OPERATION;
             goto bail;
         }
@@ -785,15 +793,18 @@
 
     while (1) {
         count = fread(tmpBuf, 1, sizeof(tmpBuf), srcFp);
-        if (ferror(srcFp) || ferror(dstFp))
-            return errnoToStatus(errno);
+        if (ferror(srcFp) || ferror(dstFp)) {
+            status_t status = errnoToStatus(errno);
+            ALOGW("fread %zu bytes failed, %s", count, strerror(errno));
+            return status;
+        }
         if (count == 0)
             break;
 
         *pCRC32 = crc32(*pCRC32, tmpBuf, count);
 
         if (fwrite(tmpBuf, 1, count, dstFp) != count) {
-            ALOGD("fwrite %d bytes failed\n", (int) count);
+            ALOGW("fwrite %zu bytes failed, %s", count, strerror(errno));
             return UNKNOWN_ERROR;
         }
     }
@@ -813,7 +824,7 @@
     if (size > 0) {
         *pCRC32 = crc32(*pCRC32, (const unsigned char*)data, size);
         if (fwrite(data, 1, size, dstFp) != size) {
-            ALOGD("fwrite %d bytes failed\n", (int) size);
+            ALOGW("fwrite %zu bytes failed, %s", size, strerror(errno));
             return UNKNOWN_ERROR;
         }
     }
@@ -847,7 +858,11 @@
 
         count = fread(tmpBuf, 1, readSize, srcFp);
         if (count != readSize) {     // error or unexpected EOF
-            ALOGD("fread %d bytes failed\n", (int) readSize);
+            if (feof(srcFp)) {
+                ALOGW("fread %zu bytes failed, unexpected EOF", readSize);
+            } else {
+                ALOGW("fread %zu bytes failed, %s", readSize, strerror(errno));
+            }
             return UNKNOWN_ERROR;
         }
 
@@ -855,7 +870,7 @@
             *pCRC32 = crc32(*pCRC32, tmpBuf, count);
 
         if (fwrite(tmpBuf, 1, count, dstFp) != count) {
-            ALOGD("fwrite %d bytes failed\n", (int) count);
+            ALOGW("fwrite %zu bytes failed, %s", count, strerror(errno));
             return UNKNOWN_ERROR;
         }
 
@@ -915,8 +930,7 @@
                 goto bail;
             }
             if (getSize < kBufSize) {
-                ALOGV("+++  got %d bytes, EOF reached\n",
-                    (int)getSize);
+                ALOGV("+++  got %zu bytes, EOF reached\n", getSize);
                 atEof = true;
             }
 
@@ -926,9 +940,9 @@
         delete[] inBuf;
     }
 
-    ALOGV("+++ writing %d bytes\n", (int)outSize);
+    ALOGV("+++ writing %zu bytes\n", outSize);
     if (fwrite(outBuf, 1, outSize, dstFp) != outSize) {
-        ALOGD("write %d failed in deflate\n", (int)outSize);
+        ALOGW("fwrite %zu bytes failed, %s", outSize, strerror(errno));
         result = UNKNOWN_ERROR;
         goto bail;
     }
@@ -1134,24 +1148,31 @@
                 getSize = n;
 
             if (fseek(fp, (long) src, SEEK_SET) != 0) {
-                ALOGD("filemove src seek %ld failed\n", (long) src);
+                ALOGW("filemove src seek %ld failed, %s",
+                    (long) src, strerror(errno));
                 return UNKNOWN_ERROR;
             }
 
             if (fread(readBuf, 1, getSize, fp) != getSize) {
-                ALOGD("filemove read %ld off=%ld failed\n",
-                    (long) getSize, (long) src);
+                if (feof(fp)) {
+                    ALOGW("fread %zu bytes off=%ld failed, unexpected EOF",
+                        getSize, (long) src);
+                } else {
+                    ALOGW("fread %zu bytes off=%ld failed, %s",
+                        getSize, (long) src, strerror(errno));
+                }
                 return UNKNOWN_ERROR;
             }
 
             if (fseek(fp, (long) dst, SEEK_SET) != 0) {
-                ALOGD("filemove dst seek %ld failed\n", (long) dst);
+                ALOGW("filemove dst seek %ld failed, %s",
+                    (long) dst, strerror(errno));
                 return UNKNOWN_ERROR;
             }
 
             if (fwrite(readBuf, 1, getSize, fp) != getSize) {
-                ALOGD("filemove write %ld off=%ld failed\n",
-                    (long) getSize, (long) dst);
+                ALOGW("filemove write %zu off=%ld failed, %s",
+                    getSize, (long) dst, strerror(errno));
                 return UNKNOWN_ERROR;
             }
 
@@ -1399,12 +1420,17 @@
     ZipEntry::putLongLE(&buf[0x10], mCentralDirOffset);
     ZipEntry::putShortLE(&buf[0x14], mCommentLen);
 
-    if (fwrite(buf, 1, kEOCDLen, fp) != kEOCDLen)
+    if (fwrite(buf, 1, kEOCDLen, fp) != kEOCDLen) {
+        ALOGW("fwrite EOCD failed, %s", strerror(errno));
         return UNKNOWN_ERROR;
+    }
     if (mCommentLen > 0) {
         assert(mComment != NULL);
-        if (fwrite(mComment, mCommentLen, 1, fp) != mCommentLen)
+        if (fwrite(mComment, mCommentLen, 1, fp) != mCommentLen) {
+            ALOGW("fwrite %d bytes failed, %s",
+                (int) mCommentLen, strerror(errno));
             return UNKNOWN_ERROR;
+        }
     }
 
     return OK;