diff --git a/CleanSpec.mk b/CleanSpec.mk
index 3d9a1ef..f5f2a14 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -613,6 +613,12 @@
 
 # Clean up old location of system_other.avbpubkey
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/security/avb/)
+
+# Clean up bufferhub files
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/bin/hw/android.frameworks.bufferhub@1.0-service)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/etc/init/android.frameworks.bufferhub@1.0-service.rc)
+
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/super.img)
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/Makefile b/core/Makefile
index ff5a0c6..db2ddc4 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -380,7 +380,7 @@
     ro.product.name \
     ro.product.device
 OEM_THUMBPRINT_PROPERTIES := $(filter $(KNOWN_OEM_THUMBPRINT_PROPERTIES),\
-    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_OEM_PROPERTIES))
+    $(PRODUCT_OEM_PROPERTIES))
 
 # Display parameters shown under Settings -> About Phone
 ifeq ($(TARGET_BUILD_VARIANT),user)
@@ -426,11 +426,11 @@
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
 	$(hide) echo > $@
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_OEM_PROPERTIES),)
+ifneq ($(PRODUCT_OEM_PROPERTIES),)
 	$(hide) echo "#" >> $@; \
 	        echo "# PRODUCT_OEM_PROPERTIES" >> $@; \
 	        echo "#" >> $@;
-	$(hide) $(foreach prop,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_OEM_PROPERTIES), \
+	$(hide) $(foreach prop,$(PRODUCT_OEM_PROPERTIES), \
 	    echo "import /oem/oem.prop $(prop)" >> $@;)
 endif
 	$(hide) PRODUCT_BRAND="$(PRODUCT_SYSTEM_BRAND)" \
@@ -488,7 +488,7 @@
 	$(hide) $(foreach line,$(FINAL_BUILD_PROPERTIES), \
 	    echo "$(line)" >> $@;)
 	$(hide) cat $(INSTALLED_ANDROID_INFO_TXT_TARGET) | grep 'require version-' | sed -e 's/require version-/ro.build.expect./g' >> $@
-	$(hide) build/make/tools/post_process_props.py $@ $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_PROPERTY_BLACKLIST)
+	$(hide) build/make/tools/post_process_props.py $@ $(PRODUCT_SYSTEM_PROPERTY_BLACKLIST)
 
 build_desc :=
 
@@ -539,7 +539,7 @@
 	$(hide) $(foreach line,$(FINAL_VENDOR_BUILD_PROPERTIES), \
 	    echo "$(line)" >> $@;)
 endif  # property_overrides_split_enabled
-	$(hide) build/make/tools/post_process_props.py $@ $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_PROPERTY_BLACKLIST)
+	$(hide) build/make/tools/post_process_props.py $@ $(PRODUCT_VENDOR_PROPERTY_BLACKLIST)
 
 # -----------------------------------------------------------------
 # product build.prop
@@ -823,7 +823,7 @@
 # directory).
 event_log_tags_src := \
     $(sort $(foreach m,\
-      $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES) \
+      $(PRODUCT_PACKAGES) \
       $(call module-names-for-tag-list,user), \
       $(ALL_MODULES.$(m).EVENT_LOG_TAGS)) \
       $(filter-out vendor/% device/% out/%,$(all_event_log_tags_src)))
@@ -898,6 +898,7 @@
 $(INSTALLED_FILES_FILE_RAMDISK): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_FILES_JSON_RAMDISK)
 $(INSTALLED_FILES_FILE_RAMDISK) : $(INTERNAL_RAMDISK_FILES) $(FILESLIST)
 	@echo Installed file list: $@
+	@mkdir -p $(TARGET_RAMDISK_OUT)
 	@mkdir -p $(dir $@)
 	@rm -f $@
 	$(hide) $(FILESLIST) $(TARGET_RAMDISK_OUT) > $(@:.txt=.json)
@@ -948,9 +949,9 @@
   INTERNAL_BOOTIMAGE_ARGS += --pagesize $(BOARD_KERNEL_PAGESIZE)
 endif
 
-ifeq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY),true)
+ifeq ($(PRODUCT_SUPPORTS_VERITY),true)
 ifeq ($(BOARD_BUILD_SYSTEM_ROOT_IMAGE),true)
-VERITY_KEYID := veritykeyid=id:`openssl x509 -in $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).x509.pem -text \
+VERITY_KEYID := veritykeyid=id:`openssl x509 -in $(PRODUCT_VERITY_SIGNING_KEY).x509.pem -text \
                 | grep keyid | sed 's/://g' | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]' | sed 's/keyid//g'`
 endif
 endif
@@ -992,34 +993,34 @@
 	  --partition_name boot $(INTERNAL_AVB_BOOT_SIGNING_ARGS) \
 	  $(BOARD_AVB_BOOT_ADD_HASH_FOOTER_ARGS)
 
-else ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER)) # BOARD_AVB_ENABLE != true
+else ifeq (true,$(PRODUCT_SUPPORTS_BOOT_SIGNER)) # BOARD_AVB_ENABLE != true
 
 $(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INTERNAL_BOOTIMAGE_FILES) $(BOOT_SIGNER)
 	$(call pretty,"Target boot image: $@")
 	$(hide) $(MKBOOTIMG) $(INTERNAL_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $@
-	$(BOOT_SIGNER) /boot $@ $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).x509.pem $@
+	$(BOOT_SIGNER) /boot $@ $(PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCT_VERITY_SIGNING_KEY).x509.pem $@
 	$(hide) $(call assert-max-image-size,$@,$(BOARD_BOOTIMAGE_PARTITION_SIZE))
 
 .PHONY: bootimage-nodeps
 bootimage-nodeps: $(MKBOOTIMG) $(BOOT_SIGNER)
 	@echo "make $@: ignoring dependencies"
 	$(hide) $(MKBOOTIMG) $(INTERNAL_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(INSTALLED_BOOTIMAGE_TARGET)
-	$(BOOT_SIGNER) /boot $(INSTALLED_BOOTIMAGE_TARGET) $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).x509.pem $(INSTALLED_BOOTIMAGE_TARGET)
+	$(BOOT_SIGNER) /boot $(INSTALLED_BOOTIMAGE_TARGET) $(PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCT_VERITY_SIGNING_KEY).x509.pem $(INSTALLED_BOOTIMAGE_TARGET)
 	$(hide) $(call assert-max-image-size,$(INSTALLED_BOOTIMAGE_TARGET),$(BOARD_BOOTIMAGE_PARTITION_SIZE))
 
-else ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT)) # PRODUCT_SUPPORTS_BOOT_SIGNER != true
+else ifeq (true,$(PRODUCT_SUPPORTS_VBOOT)) # PRODUCT_SUPPORTS_BOOT_SIGNER != true
 
 $(INSTALLED_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INTERNAL_BOOTIMAGE_FILES) $(VBOOT_SIGNER) $(FUTILITY)
 	$(call pretty,"Target boot image: $@")
 	$(hide) $(MKBOOTIMG) $(INTERNAL_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $@.unsigned
-	$(VBOOT_SIGNER) $(FUTILITY) $@.unsigned $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $@.keyblock $@
+	$(VBOOT_SIGNER) $(FUTILITY) $@.unsigned $(PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $@.keyblock $@
 	$(hide) $(call assert-max-image-size,$@,$(BOARD_BOOTIMAGE_PARTITION_SIZE))
 
 .PHONY: bootimage-nodeps
 bootimage-nodeps: $(MKBOOTIMG) $(VBOOT_SIGNER) $(FUTILITY)
 	@echo "make $@: ignoring dependencies"
 	$(hide) $(MKBOOTIMG) $(INTERNAL_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(INSTALLED_BOOTIMAGE_TARGET).unsigned
-	$(VBOOT_SIGNER) $(FUTILITY) $(INSTALLED_BOOTIMAGE_TARGET).unsigned $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $(INSTALLED_BOOTIMAGE_TARGET).keyblock $(INSTALLED_BOOTIMAGE_TARGET)
+	$(VBOOT_SIGNER) $(FUTILITY) $(INSTALLED_BOOTIMAGE_TARGET).unsigned $(PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $(INSTALLED_BOOTIMAGE_TARGET).keyblock $(INSTALLED_BOOTIMAGE_TARGET)
 	$(hide) $(call assert-max-image-size,$(INSTALLED_BOOTIMAGE_TARGET),$(BOARD_BOOTIMAGE_PARTITION_SIZE))
 
 else # PRODUCT_SUPPORTS_VBOOT != true
@@ -1330,9 +1331,9 @@
 
 INTERNAL_USERIMAGES_BINARY_PATHS := $(sort $(dir $(INTERNAL_USERIMAGES_DEPS)))
 
-ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY))
+ifeq (true,$(PRODUCT_SUPPORTS_VERITY))
 INTERNAL_USERIMAGES_DEPS += $(BUILD_VERITY_METADATA) $(BUILD_VERITY_TREE) $(APPEND2SIMG) $(VERITY_SIGNER)
-ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY_FEC))
+ifeq (true,$(PRODUCT_SUPPORTS_VERITY_FEC))
 INTERNAL_USERIMAGES_DEPS += $(FEC)
 endif
 endif
@@ -1346,7 +1347,7 @@
 
 ifeq (true,$(PRODUCT_USE_DYNAMIC_PARTITIONS))
 
-ifeq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY),true)
+ifeq ($(PRODUCT_SUPPORTS_VERITY),true)
   $(error vboot 1.0 doesn't support logical partition)
 endif
 
@@ -1370,8 +1371,8 @@
     $(if $(BOARD_SYSTEMIMAGE_SQUASHFS_COMPRESSOR_OPT),$(hide) echo "system_squashfs_compressor_opt=$(BOARD_SYSTEMIMAGE_SQUASHFS_COMPRESSOR_OPT)" >> $(1))
     $(if $(BOARD_SYSTEMIMAGE_SQUASHFS_BLOCK_SIZE),$(hide) echo "system_squashfs_block_size=$(BOARD_SYSTEMIMAGE_SQUASHFS_BLOCK_SIZE)" >> $(1))
     $(if $(BOARD_SYSTEMIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "system_squashfs_disable_4k_align=$(BOARD_SYSTEMIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
-    $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BASE_FS_PATH),$(hide) echo "system_base_fs_file=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BASE_FS_PATH)" >> $(1))
-    $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_HEADROOM),$(hide) echo "system_headroom=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_HEADROOM)" >> $(1))
+    $(if $(PRODUCT_SYSTEM_BASE_FS_PATH),$(hide) echo "system_base_fs_file=$(PRODUCT_SYSTEM_BASE_FS_PATH)" >> $(1))
+    $(if $(PRODUCT_SYSTEM_HEADROOM),$(hide) echo "system_headroom=$(PRODUCT_SYSTEM_HEADROOM)" >> $(1))
     $(if $(BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "system_reserved_size=$(BOARD_SYSTEMIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
 )
 $(if $(filter $(2),userdata),\
@@ -1392,7 +1393,7 @@
     $(if $(BOARD_VENDORIMAGE_SQUASHFS_COMPRESSOR_OPT),$(hide) echo "vendor_squashfs_compressor_opt=$(BOARD_VENDORIMAGE_SQUASHFS_COMPRESSOR_OPT)" >> $(1))
     $(if $(BOARD_VENDORIMAGE_SQUASHFS_BLOCK_SIZE),$(hide) echo "vendor_squashfs_block_size=$(BOARD_VENDORIMAGE_SQUASHFS_BLOCK_SIZE)" >> $(1))
     $(if $(BOARD_VENDORIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "vendor_squashfs_disable_4k_align=$(BOARD_VENDORIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
-    $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_BASE_FS_PATH),$(hide) echo "vendor_base_fs_file=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_BASE_FS_PATH)" >> $(1))
+    $(if $(PRODUCT_VENDOR_BASE_FS_PATH),$(hide) echo "vendor_base_fs_file=$(PRODUCT_VENDOR_BASE_FS_PATH)" >> $(1))
     $(if $(BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "vendor_reserved_size=$(BOARD_VENDORIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
 )
 $(if $(filter $(2),product),\
@@ -1405,7 +1406,7 @@
     $(if $(BOARD_PRODUCTIMAGE_SQUASHFS_COMPRESSOR_OPT),$(hide) echo "product_squashfs_compressor_opt=$(BOARD_PRODUCTIMAGE_SQUASHFS_COMPRESSOR_OPT)" >> $(1))
     $(if $(BOARD_PRODUCTIMAGE_SQUASHFS_BLOCK_SIZE),$(hide) echo "product_squashfs_block_size=$(BOARD_PRODUCTIMAGE_SQUASHFS_BLOCK_SIZE)" >> $(1))
     $(if $(BOARD_PRODUCTIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "product_squashfs_disable_4k_align=$(BOARD_PRODUCTIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
-    $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_BASE_FS_PATH),$(hide) echo "product_base_fs_file=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_BASE_FS_PATH)" >> $(1))
+    $(if $(PRODUCT_PRODUCT_BASE_FS_PATH),$(hide) echo "product_base_fs_file=$(PRODUCT_PRODUCT_BASE_FS_PATH)" >> $(1))
     $(if $(BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "product_reserved_size=$(BOARD_PRODUCTIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
 )
 $(if $(filter $(2),product_services),\
@@ -1430,7 +1431,7 @@
     $(if $(BOARD_ODMIMAGE_SQUASHFS_COMPRESSOR_OPT),$(hide) echo "odm_squashfs_compressor_opt=$(BOARD_ODMIMAGE_SQUASHFS_COMPRESSOR_OPT)" >> $(1))
     $(if $(BOARD_ODMIMAGE_SQUASHFS_BLOCK_SIZE),$(hide) echo "odm_squashfs_block_size=$(BOARD_ODMIMAGE_SQUASHFS_BLOCK_SIZE)" >> $(1))
     $(if $(BOARD_ODMIMAGE_SQUASHFS_DISABLE_4K_ALIGN),$(hide) echo "odm_squashfs_disable_4k_align=$(BOARD_ODMIMAGE_SQUASHFS_DISABLE_4K_ALIGN)" >> $(1))
-    $(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ODM_BASE_FS_PATH),$(hide) echo "odm_base_fs_file=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ODM_BASE_FS_PATH)" >> $(1))
+    $(if $(PRODUCT_ODM_BASE_FS_PATH),$(hide) echo "odm_base_fs_file=$(PRODUCT_ODM_BASE_FS_PATH)" >> $(1))
     $(if $(BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE),$(hide) echo "odm_reserved_size=$(BOARD_ODMIMAGE_PARTITION_RESERVED_SIZE)" >> $(1))
 )
 $(if $(filter $(2),oem),\
@@ -1448,21 +1449,21 @@
 $(if $(BOARD_FLASH_LOGICAL_BLOCK_SIZE), $(hide) echo "flash_logical_block_size=$(BOARD_FLASH_LOGICAL_BLOCK_SIZE)" >> $(1))
 $(if $(BOARD_FLASH_ERASE_BLOCK_SIZE), $(hide) echo "flash_erase_block_size=$(BOARD_FLASH_ERASE_BLOCK_SIZE)" >> $(1))
 $(hide) echo "selinux_fc=$(SELINUX_FC)" >> $(1)
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER),$(hide) echo "boot_signer=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity_key=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity_signer_cmd=$(notdir $(VERITY_SIGNER))" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY_FEC),$(hide) echo "verity_fec=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VERITY_FEC)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_BOOT_SIGNER),$(hide) echo "boot_signer=$(PRODUCT_SUPPORTS_BOOT_SIGNER)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity=$(PRODUCT_SUPPORTS_VERITY)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity_key=$(PRODUCT_VERITY_SIGNING_KEY)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VERITY),$(hide) echo "verity_signer_cmd=$(notdir $(VERITY_SIGNER))" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VERITY_FEC),$(hide) echo "verity_fec=$(PRODUCT_SUPPORTS_VERITY_FEC)" >> $(1))
 $(if $(filter eng, $(TARGET_BUILD_VARIANT)),$(hide) echo "verity_disable=true" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_VERITY_PARTITION),$(hide) echo "system_verity_block_device=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_VERITY_PARTITION)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_VERITY_PARTITION),$(hide) echo "vendor_verity_block_device=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_VERITY_PARTITION)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_VERITY_PARTITION),$(hide) echo "product_verity_block_device=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_VERITY_PARTITION)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION),$(hide) echo "product_services_verity_block_device=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_key=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_subkey=$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_SUBKEY)" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "futility=$(notdir $(FUTILITY))" >> $(1))
-$(if $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_signer_cmd=$(VBOOT_SIGNER)" >> $(1))
+$(if $(PRODUCT_SYSTEM_VERITY_PARTITION),$(hide) echo "system_verity_block_device=$(PRODUCT_SYSTEM_VERITY_PARTITION)" >> $(1))
+$(if $(PRODUCT_VENDOR_VERITY_PARTITION),$(hide) echo "vendor_verity_block_device=$(PRODUCT_VENDOR_VERITY_PARTITION)" >> $(1))
+$(if $(PRODUCT_PRODUCT_VERITY_PARTITION),$(hide) echo "product_verity_block_device=$(PRODUCT_PRODUCT_VERITY_PARTITION)" >> $(1))
+$(if $(PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION),$(hide) echo "product_services_verity_block_device=$(PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot=$(PRODUCT_SUPPORTS_VBOOT)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_key=$(PRODUCT_VBOOT_SIGNING_KEY)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_subkey=$(PRODUCT_VBOOT_SIGNING_SUBKEY)" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "futility=$(notdir $(FUTILITY))" >> $(1))
+$(if $(PRODUCT_SUPPORTS_VBOOT),$(hide) echo "vboot_signer_cmd=$(VBOOT_SIGNER)" >> $(1))
 $(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_avbtool=$(notdir $(AVBTOOL))" >> $(1))
 $(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_system_hashtree_enable=$(BOARD_AVB_ENABLE)" >> $(1))
 $(if $(BOARD_AVB_ENABLE),$(hide) echo "avb_system_add_hashtree_footer_args=$(BOARD_AVB_SYSTEM_ADD_HASHTREE_FOOTER_ARGS)" >> $(1))
@@ -1898,17 +1899,17 @@
   $(hide) ln -sf prop.default $(TARGET_RECOVERY_ROOT_OUT)/default.prop
   $(BOARD_RECOVERY_IMAGE_PREPARE)
   $(hide) $(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_RECOVERY_ROOT_OUT) | $(MINIGZIP) > $(recovery_ramdisk)
-  $(if $(filter true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT)), \
+  $(if $(filter true,$(PRODUCT_SUPPORTS_VBOOT)), \
     $(hide) $(MKBOOTIMG) $(INTERNAL_RECOVERYIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(1).unsigned, \
     $(hide) $(MKBOOTIMG) $(INTERNAL_RECOVERYIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(1) --id > $(RECOVERYIMAGE_ID_FILE))
-  $(if $(filter true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER)),\
+  $(if $(filter true,$(PRODUCT_SUPPORTS_BOOT_SIGNER)),\
     $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)),\
-      $(BOOT_SIGNER) /boot $(1) $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).x509.pem $(1),\
-      $(BOOT_SIGNER) /recovery $(1) $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY).x509.pem $(1)\
+      $(BOOT_SIGNER) /boot $(1) $(PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCT_VERITY_SIGNING_KEY).x509.pem $(1),\
+      $(BOOT_SIGNER) /recovery $(1) $(PRODUCT_VERITY_SIGNING_KEY).pk8 $(PRODUCT_VERITY_SIGNING_KEY).x509.pem $(1)\
     )\
   )
-  $(if $(filter true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT)), \
-    $(VBOOT_SIGNER) $(FUTILITY) $(1).unsigned $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $(1).keyblock $(1))
+  $(if $(filter true,$(PRODUCT_SUPPORTS_VBOOT)), \
+    $(VBOOT_SIGNER) $(FUTILITY) $(1).unsigned $(PRODUCT_VBOOT_SIGNING_KEY).vbpubk $(PRODUCT_VBOOT_SIGNING_KEY).vbprivk $(PRODUCT_VBOOT_SIGNING_SUBKEY).vbprivk $(1).keyblock $(1))
   $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)), \
     $(hide) $(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(BOARD_BOOTIMAGE_PARTITION_SIZE))), \
     $(hide) $(call assert-max-image-size,$(1),$(call get-hash-image-max-size,$(BOARD_RECOVERYIMAGE_PARTITION_SIZE))))
@@ -1919,10 +1920,10 @@
 endef
 
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
-ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_BOOT_SIGNER))
+ifeq (true,$(PRODUCT_SUPPORTS_BOOT_SIGNER))
 $(INSTALLED_BOOTIMAGE_TARGET) : $(BOOT_SIGNER)
 endif
-ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
+ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
 $(INSTALLED_BOOTIMAGE_TARGET) : $(VBOOT_SIGNER)
 endif
 ifeq (true,$(BOARD_AVB_ENABLE))
@@ -2164,7 +2165,7 @@
 #   libicuuc.so
 #   libnativehelper.so  - cf_x86_phone-userdebug builds get this in system/lib/arm
 #   libprofile.so
-#   libsigchain.so
+#   libsigchain.so  - cf_x86_phone-userdebug builds get this in system/lib/arm
 #   libtombstoned_client.so
 APEX_MODULE_LIBS= \
   libadbconnection.so \
@@ -2181,6 +2182,10 @@
   libopenjdkjvmti.so \
   libpac.so \
 
+# An option to disable the check below, for local use since some build targets
+# still may create these libraries in /system (b/129006418).
+DISABLE_APEX_LIBS_ABSENCE_CHECK ?=
+
 # If the check below fails, some library has ended up in system/lib or
 # system/lib64 that is intended to only go into some APEX package. The likely
 # cause is that a library or binary in /system has grown a dependency that
@@ -2202,17 +2207,22 @@
 # might be misconfigured or something is wrong in the build system. Please reach
 # out to the APEX package owners and/or soong-team@, or
 # android-building@googlegroups.com externally.
+ifndef DISABLE_APEX_LIBS_ABSENCE_CHECK
 define check-apex-libs-absence
 $(hide) ( \
   cd $(TARGET_OUT); \
   findres=$$(find lib* -type f \( -false $(foreach lib,$(APEX_MODULE_LIBS),-o -name $(lib)) \) -print) || exit 1; \
   if [ -n "$$findres" ]; then \
-    echo "APEX libraries found in system image (see comment in this makefile for details):" 1>&2; \
+    echo "APEX libraries found in system image (see comment in build/make/core/Makefile for details):" 1>&2; \
     echo "$$findres" | sort 1>&2; \
     false; \
   fi; \
 )
 endef
+else
+define check-apex-libs-absence
+endef
+endif
 
 # $(1): output file
 define build-systemimage-target
@@ -2703,7 +2713,7 @@
 # image which defines a vintf_fragment.
 ifdef BUILT_VENDOR_MANIFEST
 BUILT_ASSEMBLED_VENDOR_MANIFEST := $(PRODUCT_OUT)/verified_assembled_vendor_manifest.xml
-ifeq (true,$(strip $(PRODUCT_ENFORCE_VINTF_MANIFEST)))
+ifeq (true,$(PRODUCT_ENFORCE_VINTF_MANIFEST))
 ifneq ($(strip $(DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE) $(DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE)),)
 $(BUILT_ASSEMBLED_VENDOR_MANIFEST): PRIVATE_SYSTEM_ASSEMBLE_VINTF_ENV_VARS := VINTF_ENFORCE_NO_UNUSED_HALS=true
 endif # DEVICE_FRAMEWORK_COMPATIBILITY_MATRIX_FILE or DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE
@@ -3539,7 +3549,7 @@
   $(BUILD_VERITY_METADATA) \
   $(BUILD_VERITY_TREE)
 
-ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
+ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
 OTATOOLS += \
   $(FUTILITY) \
   $(VBOOT_SIGNER)
@@ -3609,7 +3619,7 @@
 OTATOOLS_RELEASETOOLS := \
   $(sort $(shell find build/make/tools/releasetools -name "*.pyc" -prune -o -type f))
 
-ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SUPPORTS_VBOOT))
+ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
 OTATOOLS_DEPS += \
   $(sort $(shell find external/vboot_reference/tests/devkeys -type f))
 endif
@@ -3759,11 +3769,11 @@
 	    $(BOARD_PREBUILT_DTBOIMAGE) \
 	    $(BOARD_PREBUILT_RECOVERY_DTBOIMAGE) \
 	    $(BOARD_RECOVERY_ACPIO) \
-	    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BASE_FS_PATH) \
-	    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_BASE_FS_PATH) \
-	    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_BASE_FS_PATH) \
-	    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH) \
-	    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ODM_BASE_FS_PATH) \
+	    $(PRODUCT_SYSTEM_BASE_FS_PATH) \
+	    $(PRODUCT_VENDOR_BASE_FS_PATH) \
+	    $(PRODUCT_PRODUCT_BASE_FS_PATH) \
+	    $(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH) \
+	    $(PRODUCT_ODM_BASE_FS_PATH) \
 	    $(LPMAKE) \
 	    $(SELINUX_FC) \
 	    $(APKCERTS_FILE) \
@@ -3946,25 +3956,25 @@
 	# OTA scripts are only interested in fingerprint related properties
 	$(hide) echo "oem_fingerprint_properties=$(OEM_THUMBPRINT_PROPERTIES)" >> $(zip_root)/META/misc_info.txt
 endif
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BASE_FS_PATH),)
-	$(hide) cp $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BASE_FS_PATH) \
-	  $(zip_root)/META/$(notdir $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BASE_FS_PATH))
+ifneq ($(PRODUCT_SYSTEM_BASE_FS_PATH),)
+	$(hide) cp $(PRODUCT_SYSTEM_BASE_FS_PATH) \
+	  $(zip_root)/META/$(notdir $(PRODUCT_SYSTEM_BASE_FS_PATH))
 endif
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_BASE_FS_PATH),)
-	$(hide) cp $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_BASE_FS_PATH) \
-	  $(zip_root)/META/$(notdir $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_BASE_FS_PATH))
+ifneq ($(PRODUCT_VENDOR_BASE_FS_PATH),)
+	$(hide) cp $(PRODUCT_VENDOR_BASE_FS_PATH) \
+	  $(zip_root)/META/$(notdir $(PRODUCT_VENDOR_BASE_FS_PATH))
 endif
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_BASE_FS_PATH),)
-	$(hide) cp $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_BASE_FS_PATH) \
-	  $(zip_root)/META/$(notdir $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_BASE_FS_PATH))
+ifneq ($(PRODUCT_PRODUCT_BASE_FS_PATH),)
+	$(hide) cp $(PRODUCT_PRODUCT_BASE_FS_PATH) \
+	  $(zip_root)/META/$(notdir $(PRODUCT_PRODUCT_BASE_FS_PATH))
 endif
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH),)
-	$(hide) cp $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH) \
-	  $(zip_root)/META/$(notdir $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH))
+ifneq ($(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH),)
+	$(hide) cp $(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH) \
+	  $(zip_root)/META/$(notdir $(PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH))
 endif
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ODM_BASE_FS_PATH),)
-	$(hide) cp $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ODM_BASE_FS_PATH) \
-	  $(zip_root)/META/$(notdir $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ODM_BASE_FS_PATH))
+ifneq ($(PRODUCT_ODM_BASE_FS_PATH),)
+	$(hide) cp $(PRODUCT_ODM_BASE_FS_PATH) \
+	  $(zip_root)/META/$(notdir $(PRODUCT_ODM_BASE_FS_PATH))
 endif
 ifneq (,$(filter address, $(SANITIZE_TARGET)))
 	# We need to create userdata.img with real data because the instrumented libraries are in userdata.img.
@@ -4416,7 +4426,7 @@
 endef
 
 ifneq (true,$(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS))
-INSTALLED_SUPERIMAGE_TARGET := $(PRODUCT_OUT)/super.img
+INSTALLED_SUPERIMAGE_TARGET := $(call intermediates-dir-for,PACKAGING,super.img)/super.img
 $(INSTALLED_SUPERIMAGE_TARGET): extracted_input_target_files := $(patsubst %.zip,%,$(BUILT_TARGET_FILES_PACKAGE))
 $(INSTALLED_SUPERIMAGE_TARGET): $(LPMAKE) $(BUILT_TARGET_FILES_PACKAGE) $(BUILD_SUPER_IMAGE)
 	$(call pretty,"Target super fs image: $@")
@@ -4604,8 +4614,8 @@
   sdk_atree_files += $(atree_dir)/sdk-android-$(TARGET_CPU_ABI).atree
 endif
 
-ifneq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ATREE_FILES),)
-sdk_atree_files += $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ATREE_FILES)
+ifneq ($(PRODUCT_SDK_ATREE_FILES),)
+sdk_atree_files += $(PRODUCT_SDK_ATREE_FILES)
 else
 sdk_atree_files += $(atree_dir)/sdk.atree
 endif
diff --git a/core/app_certificate_validate.mk b/core/app_certificate_validate.mk
index 6d3fdc8..c01526a 100644
--- a/core/app_certificate_validate.mk
+++ b/core/app_certificate_validate.mk
@@ -2,9 +2,9 @@
 ifeq (true,$(non_system_module))
   ifneq (,$(filter $(dir $(DEFAULT_SYSTEM_DEV_CERTIFICATE))%,$(LOCAL_CERTIFICATE)))
     CERTIFICATE_VIOLATION_MODULES += $(LOCAL_MODULE)
-    ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT))
-      $(if $(filter $(LOCAL_MODULE),$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)),,\
+    ifeq (true,$(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT))
+      $(if $(filter $(LOCAL_MODULE),$(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)),,\
         $(call pretty-error,The module in product partition cannot be signed with certificate in system.))
     endif
   endif
-endif
\ No newline at end of file
+endif
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 7e7d6dc..d5055d4 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -224,15 +224,15 @@
 ifdef LOCAL_IS_HOST_MODULE
   partition_tag :=
 else
-ifeq (true,$(LOCAL_VENDOR_MODULE))
+ifeq (true,$(strip $(LOCAL_VENDOR_MODULE)))
   partition_tag := _VENDOR
-else ifeq (true,$(LOCAL_OEM_MODULE))
+else ifeq (true,$(strip $(LOCAL_OEM_MODULE)))
   partition_tag := _OEM
-else ifeq (true,$(LOCAL_ODM_MODULE))
+else ifeq (true,$(strip $(LOCAL_ODM_MODULE)))
   partition_tag := _ODM
-else ifeq (true,$(LOCAL_PRODUCT_MODULE))
+else ifeq (true,$(strip $(LOCAL_PRODUCT_MODULE)))
   partition_tag := _PRODUCT
-else ifeq (true,$(LOCAL_PRODUCT_SERVICES_MODULE))
+else ifeq (true,$(strip $(LOCAL_PRODUCT_SERVICES_MODULE)))
   partition_tag := _PRODUCT_SERVICES
 else ifeq (NATIVE_TESTS,$(LOCAL_MODULE_CLASS))
   partition_tag := _DATA
@@ -257,13 +257,11 @@
 endif
 
 use_testcase_folder :=
-ifdef ENABLE_DEFAULT_TEST_LOCATION
-  ifeq ($(my_module_path),)
-    ifneq ($(LOCAL_MODULE),$(filter $(LOCAL_MODULE),$(DEFAULT_DATA_OUT_MODULES)))
-      ifdef LOCAL_COMPATIBILITY_SUITE
-        ifneq (true, $(LOCAL_IS_HOST_MODULE))
-          use_testcase_folder := true
-        endif
+ifeq ($(my_module_path),)
+  ifneq ($(LOCAL_MODULE),$(filter $(LOCAL_MODULE),$(DEFAULT_DATA_OUT_MODULES)))
+    ifdef LOCAL_COMPATIBILITY_SUITE
+      ifneq (true, $(LOCAL_IS_HOST_MODULE))
+        use_testcase_folder := true
       endif
     endif
   endif
diff --git a/core/build_rro_package.mk b/core/build_rro_package.mk
index c3daf6e..a6921d5 100644
--- a/core/build_rro_package.mk
+++ b/core/build_rro_package.mk
@@ -16,11 +16,11 @@
 endif
 
 partition :=
-ifeq ($(LOCAL_ODM_MODULE),true)
+ifeq ($(strip $(LOCAL_ODM_MODULE)),true)
   partition := $(TARGET_OUT_ODM)
-else ifeq ($(LOCAL_VENDOR_MODULE),true)
+else ifeq ($(strip $(LOCAL_VENDOR_MODULE)),true)
   partition := $(TARGET_OUT_VENDOR)
-else ifeq ($(LOCAL_PRODUCT_SERVICES_MODULE),true)
+else ifeq ($(strip $(LOCAL_PRODUCT_SERVICES_MODULE)),true)
   partition := $(TARGET_OUT_PRODUCT_SERVICES)
 else
   partition := $(TARGET_OUT_PRODUCT)
diff --git a/core/config.mk b/core/config.mk
index cca6200..2e3e31f 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -1183,12 +1183,9 @@
 include $(BUILD_SYSTEM)/soong_config.mk
 endif
 
-# If ENABLE_DEFAULT_TEST_LOCATION is true, move default install path from
-# $(my_prefix)OUT_DATA to $(my_prefix)OUT_TESTCASES
-ENABLE_DEFAULT_TEST_LOCATION := true
 -include external/linux-kselftest/android/kselftest_test_list.mk
 -include external/ltp/android/ltp_package_list.mk
 DEFAULT_DATA_OUT_MODULES := ltp $(ltp_packages) $(kselftest_modules)
-.KATI_READONLY := ENABLE_DEFAULT_TEST_LOCATION DEFAULT_DATA_OUT_MODULES
+.KATI_READONLY := DEFAULT_DATA_OUT_MODULES
 
 include $(BUILD_SYSTEM)/dumpvar.mk
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index a8a7443..d3adee5 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -213,7 +213,7 @@
 endif
 
 # Or if disabled globally.
-ifeq ($(strip $(PRODUCT_DISABLE_SCUDO)),true)
+ifeq ($(PRODUCT_DISABLE_SCUDO),true)
   my_sanitize := $(filter-out scudo,$(my_sanitize))
 endif
 
diff --git a/core/main.mk b/core/main.mk
index 62d3719..990d255 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -404,12 +404,8 @@
 # Typical build; include any Android.mk files we can find.
 #
 
-# Before we go and include all of the module makefiles, strip values for easier
-# processing.
-$(call strip-product-vars)
-# Before we go and include all of the module makefiles, mark the PRODUCT_*
-# and ADDITIONAL*PROPERTIES values readonly so that they won't be modified.
-$(call readonly-product-vars)
+# Strip and readonly a few more variables so they won't be modified.
+$(readonly-final-product-vars)
 ADDITIONAL_DEFAULT_PROPERTIES := $(strip $(ADDITIONAL_DEFAULT_PROPERTIES))
 .KATI_READONLY := ADDITIONAL_DEFAULT_PROPERTIES
 ADDITIONAL_BUILD_PROPERTIES := $(strip $(ADDITIONAL_BUILD_PROPERTIES))
@@ -557,19 +553,15 @@
 define get-32-bit-modules
 $(sort $(foreach m,$(1),\
   $(if $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).CLASS),\
-    $(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX))\
-  $(if $(ALL_MODULES.$(m)$(HOST_2ND_ARCH_MODULE_SUFFIX).CLASS),\
-    $(m)$(HOST_2ND_ARCH_MODULE_SUFFIX))\
-    ))
+    $(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX))))
 endef
 # Get a list of corresponding 32-bit module names, if one exists;
 # otherwise return the original module name
 define get-32-bit-modules-if-we-can
 $(sort $(foreach m,$(1),\
-  $(if $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).CLASS)$(ALL_MODULES.$(m)$(HOST_2ND_ARCH_MODULE_SUFFIX).CLASS),\
-    $(if $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).CLASS),$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX)) \
-    $(if $(ALL_MODULES.$(m)$(HOST_2ND_ARCH_MODULE_SUFFIX).CLASS),$(m)$(HOST_2ND_ARCH_MODULE_SUFFIX)),\
-  $(m))))
+  $(if $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).CLASS),\
+    $(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX), \
+    $(m))))
 endef
 else  # TARGET_TRANSLATE_2ND_ARCH
 # For binary translation config, by default only install the first arch.
@@ -1114,7 +1106,7 @@
   $(eval _pif_modules += $(call get-32-bit-modules, $(_pif_modules_rest))) \
   $(eval _pif_modules += $(_pif_modules_rest)) \
   $(call expand-required-modules,_pif_modules,$(_pif_modules),$(_pif_overrides)) \
-  $(call module-installed-files, $(_pif_modules)) \
+  $(filter-out $(HOST_OUT_ROOT)/%,$(call module-installed-files, $(_pif_modules))) \
   $(call resolve-product-relative-paths,\
     $(foreach cf,$(PRODUCTS.$(_mk).PRODUCT_COPY_FILES),$(call word-colon,2,$(cf))))
 endef
@@ -1151,9 +1143,9 @@
 ifdef FULL_BUILD
   ifneq (true,$(ALLOW_MISSING_DEPENDENCIES))
     # Check to ensure that all modules in PRODUCT_PACKAGES exist (opt in per product)
-    ifeq (true,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_PACKAGES_EXIST))
-      _whitelist := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_PACKAGES_EXIST_WHITELIST)
-      _modules := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES)
+    ifeq (true,$(PRODUCT_ENFORCE_PACKAGES_EXIST))
+      _whitelist := $(PRODUCT_ENFORCE_PACKAGES_EXIST_WHITELIST)
+      _modules := $(PRODUCT_PACKAGES)
       # Sanity check all modules in PRODUCT_PACKAGES exist. We check for the
       # existence if either <module> or the <module>_32 variant.
       _nonexistant_modules := $(filter-out $(ALL_MODULES),$(_modules))
@@ -1170,7 +1162,7 @@
     # Many host modules are Linux-only, so skip this check on Mac. If we ever have Mac-only modules,
     # maybe it would make sense to have PRODUCT_HOST_PACKAGES_LINUX/_DARWIN?
     ifneq ($(HOST_OS),darwin)
-      _modules := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_HOST_PACKAGES)
+      _modules := $(PRODUCT_HOST_PACKAGES)
       _nonexistant_modules := $(foreach m,$(_modules),\
         $(if $(filter FAKE,$(ALL_MODULES.$(m).CLASS))$(filter $(HOST_OUT_ROOT)/%,$(ALL_MODULES.$(m).INSTALLED)),,$(m)))
       $(call maybe-print-list-and-error,$(_nonexistant_modules),\
@@ -1178,28 +1170,25 @@
     endif
   endif
 
+  # Some modules produce only host installed files when building with TARGET_BUILD_APPS
+  ifeq ($(TARGET_BUILD_APPS),)
+    _modules := $(foreach m,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES) \
+                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG) \
+                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG_ASAN) \
+                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_ENG) \
+                            $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_TESTS),\
+                  $(if $(ALL_MODULES.$(m).INSTALLED),\
+                    $(if $(filter-out $(HOST_OUT_ROOT)/%,$(ALL_MODULES.$(m).INSTALLED)),,\
+                      $(m))))
+    $(call maybe-print-list-and-error,$(sort $(_modules)),\
+      Host modules should be in PRODUCT_HOST_PACKAGES$(comma) not PRODUCT_PACKAGES)
+  endif
+
   product_host_FILES := $(call host-installed-files,$(INTERNAL_PRODUCT))
   product_target_FILES := $(call product-installed-files, $(INTERNAL_PRODUCT))
   # WARNING: The product_MODULES variable is depended on by external files.
   product_MODULES := $(_pif_modules)
 
-  # Verify that PRODUCT_HOST_PACKAGES is complete
-  # This is a temporary requirement during migration
-  # Ignore libraries, since they shouldn't need to be in PRODUCT_PACKAGES for the most part anyway.
-  host_files_in_target_FILES := $(filter-out \
-    $(HOST_OUT_SHARED_LIBRARIES)/% \
-    $($(HOST_2ND_ARCH_VAR_PREFIX)HOST_OUT_SHARED_LIBRARIES)/%,\
-      $(filter $(HOST_OUT_ROOT)/%,$(product_target_FILES)))
-  ifneq (,$(filter-out $(product_host_FILES),$(host_files_in_target_FILES)))
-    packages := $(foreach f,$(filter-out $(product_host_FILES),$(host_files_in_target_FILES)), \
-      $(or $(INSTALLABLE_FILES.$(f).MODULE),$(f)))
-    $(warning Missing modules from PRODUCT_HOST_PACKAGES)
-    $(warning See $(CHANGES_URL)#PRODUCT_HOST_PACKAGES for more information)
-    $(foreach f,$(sort $(packages)),$(warning _ $(f)))
-    $(error stop)
-  endif
-  host_files_in_target_FILES :=
-
   # Verify the artifact path requirements made by included products.
   is_asan := $(if $(filter address,$(SANITIZE_TARGET)),true)
   ifneq (true,$(or $(is_asan),$(DISABLE_ARTIFACT_PATH_REQUIREMENTS)))
@@ -1246,14 +1235,14 @@
     $(eval extra_files := $(filter-out $(files) $(HOST_OUT)/%,$(product_target_FILES))) \
     $(eval files_in_requirement := $(filter $(path_patterns),$(extra_files))) \
     $(eval all_offending_files += $(files_in_requirement)) \
-    $(eval whitelist := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST)) \
+    $(eval whitelist := $(PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST)) \
     $(eval whitelist_patterns := $(call resolve-product-relative-paths,$(whitelist))) \
     $(eval offending_files := $(filter-out $(whitelist_patterns),$(files_in_requirement))) \
-    $(eval enforcement := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS)) \
+    $(eval enforcement := $(PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS)) \
     $(if $(enforcement),\
       $(call maybe-print-list-and-error,$(offending_files),\
         $(INTERNAL_PRODUCT) produces files inside $(makefile)s artifact path requirement. \
-        $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT)) \
+        $(PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT)) \
       $(eval unused_whitelist := $(if $(filter true strict,$(enforcement)),\
         $(foreach p,$(whitelist_patterns),$(if $(filter $(p),$(extra_files)),,$(p))))) \
       $(call maybe-print-list-and-error,$(unused_whitelist),$(INTERNAL_PRODUCT) includes redundant artifact path requirement whitelist entries.) \
@@ -1307,19 +1296,19 @@
   # Ensure every module listed in PRODUCT_PACKAGES* gets something installed
   # TODO: Should we do this for all builds and not just the sdk?
   dangling_modules :=
-  $(foreach m, $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES), \
+  $(foreach m, $(PRODUCT_PACKAGES), \
     $(if $(strip $(ALL_MODULES.$(m).INSTALLED) $(ALL_MODULES.$(m)$(TARGET_2ND_ARCH_MODULE_SUFFIX).INSTALLED)),,\
       $(eval dangling_modules += $(m))))
   ifneq ($(dangling_modules),)
     $(warning: Modules '$(dangling_modules)' in PRODUCT_PACKAGES have nothing to install!)
   endif
-  $(foreach m, $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_DEBUG), \
+  $(foreach m, $(PRODUCT_PACKAGES_DEBUG), \
     $(if $(strip $(ALL_MODULES.$(m).INSTALLED)),,\
       $(warning $(ALL_MODULES.$(m).MAKEFILE): Module '$(m)' in PRODUCT_PACKAGES_DEBUG has nothing to install!)))
-  $(foreach m, $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_ENG), \
+  $(foreach m, $(PRODUCT_PACKAGES_ENG), \
     $(if $(strip $(ALL_MODULES.$(m).INSTALLED)),,\
       $(warning $(ALL_MODULES.$(m).MAKEFILE): Module '$(m)' in PRODUCT_PACKAGES_ENG has nothing to install!)))
-  $(foreach m, $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGES_TESTS), \
+  $(foreach m, $(PRODUCT_PACKAGES_TESTS), \
     $(if $(strip $(ALL_MODULES.$(m).INSTALLED)),,\
       $(warning $(ALL_MODULES.$(m).MAKEFILE): Module '$(m)' in PRODUCT_PACKAGES_TESTS has nothing to install!)))
 endif
diff --git a/core/native_benchmark.mk b/core/native_benchmark.mk
index 4750649..073d8dd 100644
--- a/core/native_benchmark.mk
+++ b/core/native_benchmark.mk
@@ -6,11 +6,6 @@
 
 LOCAL_STATIC_LIBRARIES += libgoogle-benchmark
 
-ifndef ENABLE_DEFAULT_TEST_LOCATION
-LOCAL_MODULE_PATH_64 := $(TARGET_OUT_DATA_METRIC_TESTS)/$(LOCAL_MODULE)
-LOCAL_MODULE_PATH_32 := $($(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_OUT_DATA_METRIC_TESTS)/$(LOCAL_MODULE)
-endif
-
 ifndef LOCAL_MULTILIB
 ifndef LOCAL_32_BIT_ONLY
 LOCAL_MULTILIB := both
diff --git a/core/package_internal.mk b/core/package_internal.mk
index f07e4f5..e27f6ce 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -767,17 +767,10 @@
 
 ifdef LOCAL_COMPATIBILITY_SUITE
 
-ifndef ENABLE_DEFAULT_TEST_LOCATION
-$(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
-  $(eval my_compat_dist_$(suite) := $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
-    $(foreach s,$(my_split_suffixes),\
-      $(intermediates)/package_$(s).apk:$(dir)/$(LOCAL_MODULE)_$(s).apk))))
-else
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
   $(eval my_compat_dist_$(suite) := $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
     $(foreach s,$(my_split_suffixes),\
       $(call compat-copy-pair,$(intermediates)/package_$(s).apk,$(dir)/$(LOCAL_MODULE)_$(s).apk)))))
-endif
 
 $(call create-suite-dependencies)
 
diff --git a/core/product.mk b/core/product.mk
index bb63ab8..29bd1d1 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -106,138 +106,242 @@
 $(call get-product-makefiles,$(_find-android-products-files))
 endef
 
-#
-# Functions for including product makefiles
-#
+_product_var_list :=
+_product_var_list += PRODUCT_NAME
+_product_var_list += PRODUCT_MODEL
 
-_product_var_list := \
-    PRODUCT_NAME \
-    PRODUCT_MODEL \
-    PRODUCT_LOCALES \
-    PRODUCT_AAPT_CONFIG \
-    PRODUCT_AAPT_PREF_CONFIG \
-    PRODUCT_AAPT_PREBUILT_DPI \
-    PRODUCT_HOST_PACKAGES \
-    PRODUCT_PACKAGES \
-    PRODUCT_PACKAGES_DEBUG \
-    PRODUCT_PACKAGES_DEBUG_ASAN \
-    PRODUCT_PACKAGES_ENG \
-    PRODUCT_PACKAGES_TESTS \
-    PRODUCT_DEVICE \
-    PRODUCT_MANUFACTURER \
-    PRODUCT_BRAND \
+# The resoure configuration options to use for this product.
+_product_var_list += PRODUCT_LOCALES
+_product_var_list += PRODUCT_AAPT_CONFIG
+_product_var_list += PRODUCT_AAPT_PREF_CONFIG
+_product_var_list += PRODUCT_AAPT_PREBUILT_DPI
+_product_var_list += PRODUCT_HOST_PACKAGES
+_product_var_list += PRODUCT_PACKAGES
+_product_var_list += PRODUCT_PACKAGES_DEBUG
+_product_var_list += PRODUCT_PACKAGES_DEBUG_ASAN
+_product_var_list += PRODUCT_PACKAGES_ENG
+_product_var_list += PRODUCT_PACKAGES_TESTS
+
+# The device that this product maps to.
+_product_var_list += PRODUCT_DEVICE
+_product_var_list += PRODUCT_MANUFACTURER
+_product_var_list += PRODUCT_BRAND
+
+# These PRODUCT_SYSTEM_* flags, if defined, are used in place of the
+# corresponding PRODUCT_* flags for the sysprops on /system.
+_product_var_list += \
     PRODUCT_SYSTEM_NAME \
     PRODUCT_SYSTEM_MODEL \
     PRODUCT_SYSTEM_DEVICE \
     PRODUCT_SYSTEM_BRAND \
     PRODUCT_SYSTEM_MANUFACTURER \
-    PRODUCT_PROPERTY_OVERRIDES \
-    PRODUCT_DEFAULT_PROPERTY_OVERRIDES \
-    PRODUCT_PRODUCT_PROPERTIES \
-    PRODUCT_PRODUCT_SERVICES_PROPERTIES \
-    PRODUCT_ODM_PROPERTIES \
-    PRODUCT_CHARACTERISTICS \
-    PRODUCT_COPY_FILES \
-    PRODUCT_OTA_PUBLIC_KEYS \
-    PRODUCT_EXTRA_RECOVERY_KEYS \
-    PRODUCT_PACKAGE_OVERLAYS \
-    DEVICE_PACKAGE_OVERLAYS \
-    PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS \
-    PRODUCT_ENFORCE_RRO_TARGETS \
-    PRODUCT_SDK_ATREE_FILES \
-    PRODUCT_SDK_ADDON_NAME \
-    PRODUCT_SDK_ADDON_COPY_FILES \
-    PRODUCT_SDK_ADDON_COPY_MODULES \
-    PRODUCT_SDK_ADDON_DOC_MODULES \
-    PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP \
-    PRODUCT_SOONG_NAMESPACES \
-    PRODUCT_DEFAULT_WIFI_CHANNELS \
-    PRODUCT_DEFAULT_DEV_CERTIFICATE \
-    PRODUCT_RESTRICT_VENDOR_FILES \
-    PRODUCT_VENDOR_KERNEL_HEADERS \
-    PRODUCT_BOOT_JARS \
-    PRODUCT_SUPPORTS_BOOT_SIGNER \
-    PRODUCT_SUPPORTS_VBOOT \
-    PRODUCT_SUPPORTS_VERITY \
-    PRODUCT_SUPPORTS_VERITY_FEC \
-    PRODUCT_OEM_PROPERTIES \
-    PRODUCT_SYSTEM_DEFAULT_PROPERTIES \
-    PRODUCT_SYSTEM_PROPERTY_BLACKLIST \
-    PRODUCT_VENDOR_PROPERTY_BLACKLIST \
-    PRODUCT_SYSTEM_SERVER_APPS \
-    PRODUCT_SYSTEM_SERVER_JARS \
-    PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK \
-    PRODUCT_DEXPREOPT_SPEED_APPS \
-    PRODUCT_LOADED_BY_PRIVILEGED_MODULES \
-    PRODUCT_VBOOT_SIGNING_KEY \
-    PRODUCT_VBOOT_SIGNING_SUBKEY \
-    PRODUCT_VERITY_SIGNING_KEY \
-    PRODUCT_SYSTEM_VERITY_PARTITION \
-    PRODUCT_VENDOR_VERITY_PARTITION \
-    PRODUCT_PRODUCT_VERITY_PARTITION \
-    PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION \
-    PRODUCT_ODM_VERITY_PARTITION \
-    PRODUCT_SYSTEM_SERVER_DEBUG_INFO \
-    PRODUCT_OTHER_JAVA_DEBUG_INFO \
-    PRODUCT_DEX_PREOPT_MODULE_CONFIGS \
-    PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER \
-    PRODUCT_DEX_PREOPT_DEFAULT_FLAGS \
-    PRODUCT_DEX_PREOPT_BOOT_FLAGS \
-    PRODUCT_DEX_PREOPT_PROFILE_DIR \
-    PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION \
-    PRODUCT_DEX_PREOPT_GENERATE_DM_FILES \
-    PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING \
+
+# A list of property assignments, like "key = value", with zero or more
+# whitespace characters on either side of the '='.
+_product_var_list += PRODUCT_PROPERTY_OVERRIDES
+
+# A list of property assignments, like "key = value", with zero or more
+# whitespace characters on either side of the '='.
+# used for adding properties to default.prop
+_product_var_list += PRODUCT_DEFAULT_PROPERTY_OVERRIDES
+
+# A list of property assignments, like "key = value", with zero or more
+# whitespace characters on either side of the '='.
+# used for adding properties to build.prop of product partition
+_product_var_list += PRODUCT_PRODUCT_PROPERTIES
+
+# A list of property assignments, like "key = value", with zero or more
+# whitespace characters on either side of the '='.
+# used for adding properties to build.prop of product partition
+_product_var_list += PRODUCT_PRODUCT_SERVICES_PROPERTIES
+_product_var_list += PRODUCT_ODM_PROPERTIES
+_product_var_list += PRODUCT_CHARACTERISTICS
+
+# A list of words like <source path>:<destination path>[:<owner>].
+# The file at the source path should be copied to the destination path
+# when building  this product.  <destination path> is relative to
+# $(PRODUCT_OUT), so it should look like, e.g., "system/etc/file.xml".
+# The rules for these copy steps are defined in build/make/core/Makefile.
+# The optional :<owner> is used to indicate the owner of a vendor file.
+_product_var_list += PRODUCT_COPY_FILES
+
+# The OTA key(s) specified by the product config, if any.  The names
+# of these keys are stored in the target-files zip so that post-build
+# signing tools can substitute them for the test key embedded by
+# default.
+_product_var_list += PRODUCT_OTA_PUBLIC_KEYS
+_product_var_list += PRODUCT_EXTRA_RECOVERY_KEYS
+
+# Should we use the default resources or add any product specific overlays
+_product_var_list += PRODUCT_PACKAGE_OVERLAYS
+_product_var_list += DEVICE_PACKAGE_OVERLAYS
+
+# Resource overlay list which must be excluded from enforcing RRO.
+_product_var_list += PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS
+
+# Package list to apply enforcing RRO.
+_product_var_list += PRODUCT_ENFORCE_RRO_TARGETS
+
+_product_var_list += PRODUCT_SDK_ATREE_FILES
+_product_var_list += PRODUCT_SDK_ADDON_NAME
+_product_var_list += PRODUCT_SDK_ADDON_COPY_FILES
+_product_var_list += PRODUCT_SDK_ADDON_COPY_MODULES
+_product_var_list += PRODUCT_SDK_ADDON_DOC_MODULES
+_product_var_list += PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP
+
+# which Soong namespaces to export to Make
+_product_var_list += PRODUCT_SOONG_NAMESPACES
+
+_product_var_list += PRODUCT_DEFAULT_WIFI_CHANNELS
+_product_var_list += PRODUCT_DEFAULT_DEV_CERTIFICATE
+_product_var_list += PRODUCT_RESTRICT_VENDOR_FILES
+
+# The list of product-specific kernel header dirs
+_product_var_list += PRODUCT_VENDOR_KERNEL_HEADERS
+
+# A list of module names of BOOTCLASSPATH (jar files)
+_product_var_list += PRODUCT_BOOT_JARS
+_product_var_list += PRODUCT_SUPPORTS_BOOT_SIGNER
+_product_var_list += PRODUCT_SUPPORTS_VBOOT
+_product_var_list += PRODUCT_SUPPORTS_VERITY
+_product_var_list += PRODUCT_SUPPORTS_VERITY_FEC
+_product_var_list += PRODUCT_OEM_PROPERTIES
+
+# A list of property assignments, like "key = value", with zero or more
+# whitespace characters on either side of the '='.
+# used for adding properties to default.prop of system partition
+_product_var_list += PRODUCT_SYSTEM_DEFAULT_PROPERTIES
+
+_product_var_list += PRODUCT_SYSTEM_PROPERTY_BLACKLIST
+_product_var_list += PRODUCT_VENDOR_PROPERTY_BLACKLIST
+_product_var_list += PRODUCT_SYSTEM_SERVER_APPS
+_product_var_list += PRODUCT_SYSTEM_SERVER_JARS
+
+# All of the apps that we force preopt, this overrides WITH_DEXPREOPT.
+_product_var_list += PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK
+_product_var_list += PRODUCT_DEXPREOPT_SPEED_APPS
+_product_var_list += PRODUCT_LOADED_BY_PRIVILEGED_MODULES
+_product_var_list += PRODUCT_VBOOT_SIGNING_KEY
+_product_var_list += PRODUCT_VBOOT_SIGNING_SUBKEY
+_product_var_list += PRODUCT_VERITY_SIGNING_KEY
+_product_var_list += PRODUCT_SYSTEM_VERITY_PARTITION
+_product_var_list += PRODUCT_VENDOR_VERITY_PARTITION
+_product_var_list += PRODUCT_PRODUCT_VERITY_PARTITION
+_product_var_list += PRODUCT_PRODUCT_SERVICES_VERITY_PARTITION
+_product_var_list += PRODUCT_ODM_VERITY_PARTITION
+_product_var_list += PRODUCT_SYSTEM_SERVER_DEBUG_INFO
+_product_var_list += PRODUCT_OTHER_JAVA_DEBUG_INFO
+
+# Per-module dex-preopt configs.
+_product_var_list += PRODUCT_DEX_PREOPT_MODULE_CONFIGS
+_product_var_list += PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER
+_product_var_list += PRODUCT_DEX_PREOPT_DEFAULT_FLAGS
+_product_var_list += PRODUCT_DEX_PREOPT_BOOT_FLAGS
+_product_var_list += PRODUCT_DEX_PREOPT_PROFILE_DIR
+_product_var_list += PRODUCT_DEX_PREOPT_GENERATE_DM_FILES
+_product_var_list += PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING
+
+# Boot image options.
+_product_var_list += \
     PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE \
-    PRODUCT_SYSTEM_SERVER_COMPILER_FILTER \
-    PRODUCT_SANITIZER_MODULE_CONFIGS \
-    PRODUCT_SYSTEM_BASE_FS_PATH \
-    PRODUCT_VENDOR_BASE_FS_PATH \
-    PRODUCT_PRODUCT_BASE_FS_PATH \
-    PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH \
-    PRODUCT_ODM_BASE_FS_PATH \
-    PRODUCT_SHIPPING_API_LEVEL \
-    VENDOR_PRODUCT_RESTRICT_VENDOR_FILES \
-    VENDOR_EXCEPTION_MODULES \
-    VENDOR_EXCEPTION_PATHS \
-    PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD \
-    PRODUCT_ART_USE_READ_BARRIER \
-    PRODUCT_IOT \
-    PRODUCT_SYSTEM_HEADROOM \
-    PRODUCT_MINIMIZE_JAVA_DEBUG_INFO \
-    PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS \
-    PRODUCT_ADB_KEYS \
-    PRODUCT_CFI_INCLUDE_PATHS \
-    PRODUCT_CFI_EXCLUDE_PATHS \
-    PRODUCT_DISABLE_SCUDO \
-    PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE \
-    PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE \
-    PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS \
-    PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT \
-    PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST \
-    PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT \
-    PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST \
+    PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION \
+
+_product_var_list += PRODUCT_SYSTEM_SERVER_COMPILER_FILTER
+# Per-module sanitizer configs
+_product_var_list += PRODUCT_SANITIZER_MODULE_CONFIGS
+_product_var_list += PRODUCT_SYSTEM_BASE_FS_PATH
+_product_var_list += PRODUCT_VENDOR_BASE_FS_PATH
+_product_var_list += PRODUCT_PRODUCT_BASE_FS_PATH
+_product_var_list += PRODUCT_PRODUCT_SERVICES_BASE_FS_PATH
+_product_var_list += PRODUCT_ODM_BASE_FS_PATH
+_product_var_list += PRODUCT_SHIPPING_API_LEVEL
+_product_var_list += VENDOR_PRODUCT_RESTRICT_VENDOR_FILES
+_product_var_list += VENDOR_EXCEPTION_MODULES
+_product_var_list += VENDOR_EXCEPTION_PATHS
+
+# Whether the product wants to ship libartd. For rules and meaning, see art/Android.mk.
+_product_var_list += PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD
+
+# Make this art variable visible to soong_config.mk.
+_product_var_list += PRODUCT_ART_USE_READ_BARRIER
+
+# Whether the product is an Android Things variant.
+_product_var_list += PRODUCT_IOT
+
+# Add reserved headroom to a system image.
+_product_var_list += PRODUCT_SYSTEM_HEADROOM
+
+# Whether to save disk space by minimizing java debug info
+_product_var_list += PRODUCT_MINIMIZE_JAVA_DEBUG_INFO
+
+# Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
+_product_var_list += PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS
+
+_product_var_list += PRODUCT_ADB_KEYS
+
+# Whether any paths should have CFI enabled for components
+_product_var_list += PRODUCT_CFI_INCLUDE_PATHS
+
+# Whether any paths are excluded from sanitization when SANITIZE_TARGET=cfi
+_product_var_list += PRODUCT_CFI_EXCLUDE_PATHS
+
+# Whether the Scudo hardened allocator is disabled platform-wide
+_product_var_list += PRODUCT_DISABLE_SCUDO
+
+# A flag to override PRODUCT_COMPATIBLE_PROPERTY
+_product_var_list += PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE
+
+# Whether the whitelist of actionable compatible properties should be disabled or not
+_product_var_list += PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE
+_product_var_list += PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS
+_product_var_list += PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT
+_product_var_list += PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST
+_product_var_list += PRODUCT_ARTIFACT_PATH_REQUIREMENT_HINT
+_product_var_list += PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST
+
+# List of modules that should be forcefully unmarked from being LOCAL_PRODUCT_MODULE, and hence
+# installed on /system directory by default.
+_product_var_list += PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION
+
+# When this is true, dynamic partitions is retrofitted on a device that has
+# already been launched without dynamic partitions. Otherwise, the device
+# is launched with dynamic partitions.
+# This flag implies PRODUCT_USE_DYNAMIC_PARTITIONS.
+_product_var_list += PRODUCT_RETROFIT_DYNAMIC_PARTITIONS
+
+# Other dynamic partition feature flags.PRODUCT_USE_DYNAMIC_PARTITION_SIZE and
+# PRODUCT_BUILD_SUPER_PARTITION default to the value of PRODUCT_USE_DYNAMIC_PARTITIONS.
+_product_var_list += \
+    PRODUCT_USE_DYNAMIC_PARTITIONS \
     PRODUCT_USE_DYNAMIC_PARTITION_SIZE \
     PRODUCT_BUILD_SUPER_PARTITION \
-    PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION \
-    PRODUCT_USE_DYNAMIC_PARTITIONS \
-    PRODUCT_RETROFIT_DYNAMIC_PARTITIONS \
-    PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS \
-    PRODUCT_XOM_EXCLUDE_PATHS \
-    PRODUCT_MANIFEST_PACKAGE_NAME_OVERRIDES \
-    PRODUCT_PACKAGE_NAME_OVERRIDES \
-    PRODUCT_CERTIFICATE_OVERRIDES \
-    PRODUCT_BUILD_SYSTEM_IMAGE \
-    PRODUCT_BUILD_SYSTEM_OTHER_IMAGE \
-    PRODUCT_BUILD_VENDOR_IMAGE \
-    PRODUCT_BUILD_PRODUCT_IMAGE \
-    PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE \
-    PRODUCT_BUILD_ODM_IMAGE \
-    PRODUCT_BUILD_CACHE_IMAGE \
-    PRODUCT_BUILD_RAMDISK_IMAGE \
-    PRODUCT_BUILD_USERDATA_IMAGE \
-    PRODUCT_UPDATABLE_BOOT_MODULES \
-    PRODUCT_UPDATABLE_BOOT_LOCATIONS \
-    PRODUCT_CHECK_ELF_FILES \
+
+# If set, kernel configuration requirements are present in OTA package (and will be enforced
+# during OTA). Otherwise, kernel configuration requirements are enforced in VTS.
+# Devices that checks the running kernel (instead of the kernel in OTA package) should not
+# set this variable to prevent OTA failures.
+_product_var_list += PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS
+
+# Whether any paths are excluded from being set XOM when ENABLE_XOM=true
+_product_var_list += PRODUCT_XOM_EXCLUDE_PATHS
+_product_var_list += PRODUCT_MANIFEST_PACKAGE_NAME_OVERRIDES
+_product_var_list += PRODUCT_PACKAGE_NAME_OVERRIDES
+_product_var_list += PRODUCT_CERTIFICATE_OVERRIDES
+_product_var_list += PRODUCT_BUILD_SYSTEM_IMAGE
+_product_var_list += PRODUCT_BUILD_SYSTEM_OTHER_IMAGE
+_product_var_list += PRODUCT_BUILD_VENDOR_IMAGE
+_product_var_list += PRODUCT_BUILD_PRODUCT_IMAGE
+_product_var_list += PRODUCT_BUILD_PRODUCT_SERVICES_IMAGE
+_product_var_list += PRODUCT_BUILD_ODM_IMAGE
+_product_var_list += PRODUCT_BUILD_CACHE_IMAGE
+_product_var_list += PRODUCT_BUILD_RAMDISK_IMAGE
+_product_var_list += PRODUCT_BUILD_USERDATA_IMAGE
+_product_var_list += PRODUCT_UPDATABLE_BOOT_MODULES
+_product_var_list += PRODUCT_UPDATABLE_BOOT_LOCATIONS
+
+# Whether the product would like to check prebuilt ELF files.
+_product_var_list += PRODUCT_CHECK_ELF_FILES
+.KATI_READONLY := _product_var_list
 
 define dump-product
 $(warning ==== $(1) ====)\
@@ -251,6 +355,10 @@
 endef
 
 #
+# Functions for including product makefiles
+#
+
+#
 # $(1): product to inherit
 #
 # To be called from product makefiles, and is later evaluated during the import-nodes
@@ -372,26 +480,44 @@
 $(strip $(call _resolve-short-product-name,$(1)))
 endef
 
-_product_stash_var_list := $(_product_var_list)
-# TODO: Move this to board_config.mk when no longer set in product makefiles
-_product_stash_var_list += WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY
-_product_strip_var_list :=
+# BoardConfig variables that are also inherited in product mks. Should ideally
+# be cleaned up to not be product variables.
+_readonly_late_variables := \
+  DEVICE_PACKAGE_OVERLAYS \
+  WITH_DEXPREOPT_BOOT_IMG_AND_SYSTEM_SERVER_ONLY \
+
+# Modified internally in the build system
+_readonly_late_variables += \
+  PRODUCT_COPY_FILES \
+  PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING \
+  PRODUCT_DEX_PREOPT_BOOT_FLAGS \
+
+_readonly_early_variables := $(filter-out $(_readonly_late_variables),$(_product_var_list))
 
 #
 # Mark the variables in _product_stash_var_list as readonly
 #
-define readonly-product-vars
-$(foreach v,$(_product_stash_var_list), \
+define readonly-variables
+$(foreach v,$(1), \
   $(eval $(v) ?=) \
   $(eval .KATI_READONLY := $(v)) \
  )
 endef
+define readonly-product-vars
+$(call readonly-variables,$(_readonly_early_variables))
+endef
+
+define readonly-final-product-vars
+$(call readonly-variables,$(_readonly_late_variables))
+endef
 
 #
 # Strip the variables in _product_strip_var_list
 #
 define strip-product-vars
-$(foreach v,$(_product_strip_var_list),$(eval $(v) := $(strip $($(v)))))
+$(foreach v,$(_product_var_list), \
+  $(eval $(v) := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).$(v)))) \
+)
 endef
 
 define add-to-product-copy-files-if-exists
diff --git a/core/product_config.mk b/core/product_config.mk
index 7ab1d6d..a088f06 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -252,29 +252,19 @@
 all_product_makefiles :=
 all_product_configs :=
 
+############################################################################
+# Strip and assign the PRODUCT_ variables.
+$(call strip-product-vars)
 
 #############################################################################
+# Sanity check and assign default values
 
-# A list of module names of BOOTCLASSPATH (jar files)
-PRODUCT_BOOT_JARS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_BOOT_JARS))
-PRODUCT_UPDATABLE_BOOT_MODULES := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_UPDATABLE_BOOT_MODULES))
-PRODUCT_UPDATABLE_BOOT_LOCATIONS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_UPDATABLE_BOOT_LOCATIONS))
-PRODUCT_SYSTEM_SERVER_JARS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_JARS))
-PRODUCT_SYSTEM_SERVER_APPS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_APPS))
-PRODUCT_DEXPREOPT_SPEED_APPS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEXPREOPT_SPEED_APPS))
-PRODUCT_LOADED_BY_PRIVILEGED_MODULES := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_LOADED_BY_PRIVILEGED_MODULES))
+TARGET_DEVICE := $(PRODUCT_DEVICE)
 
-# All of the apps that we force preopt, this overrides WITH_DEXPREOPT.
-PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK))
-
-# Find the device that this product maps to.
-TARGET_DEVICE := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEVICE)
+# TODO: also keep track of things like "port", "land" in product files.
 
 # Figure out which resoure configuration options to use for this
 # product.
-PRODUCT_LOCALES := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_LOCALES))
-# TODO: also keep track of things like "port", "land" in product files.
-
 # If CUSTOM_LOCALES contains any locales not already included
 # in PRODUCT_LOCALES, add them to PRODUCT_LOCALES.
 extra_locales := $(filter-out $(PRODUCT_LOCALES),$(CUSTOM_LOCALES))
@@ -288,170 +278,55 @@
 endif
 
 # Add PRODUCT_LOCALES to PRODUCT_AAPT_CONFIG
-PRODUCT_AAPT_CONFIG := $(strip $(PRODUCT_LOCALES) $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_AAPT_CONFIG))
-PRODUCT_AAPT_PREF_CONFIG := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_AAPT_PREF_CONFIG))
-PRODUCT_AAPT_PREBUILT_DPI := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_AAPT_PREBUILT_DPI))
+PRODUCT_AAPT_CONFIG := $(PRODUCT_LOCALES) $(PRODUCT_AAPT_CONFIG)
 
 # Keep a copy of the space-separated config
 PRODUCT_AAPT_CONFIG_SP := $(PRODUCT_AAPT_CONFIG)
+PRODUCT_AAPT_CONFIG := $(subst $(space),$(comma),$(PRODUCT_AAPT_CONFIG))
 
-# Convert spaces to commas.
-PRODUCT_AAPT_CONFIG := \
-    $(subst $(space),$(comma),$(strip $(PRODUCT_AAPT_CONFIG)))
-
-PRODUCT_SYSTEM_NAME := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_NAME))
 ifndef PRODUCT_SYSTEM_NAME
-  PRODUCT_SYSTEM_NAME := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_NAME))
+  PRODUCT_SYSTEM_NAME := $(PRODUCT_NAME)
 endif
-
-PRODUCT_SYSTEM_DEVICE := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_DEVICE))
 ifndef PRODUCT_SYSTEM_DEVICE
-  PRODUCT_SYSTEM_DEVICE := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEVICE)
+  PRODUCT_SYSTEM_DEVICE := $(PRODUCT_DEVICE)
 endif
-
-PRODUCT_BRAND := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_BRAND))
-PRODUCT_SYSTEM_BRAND := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_BRAND))
 ifndef PRODUCT_SYSTEM_BRAND
   PRODUCT_SYSTEM_BRAND := $(PRODUCT_BRAND)
 endif
-
-PRODUCT_MODEL := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MODEL))
 ifndef PRODUCT_MODEL
-  PRODUCT_MODEL := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_NAME))
+  PRODUCT_MODEL := $(PRODUCT_NAME)
 endif
-PRODUCT_SYSTEM_MODEL := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_MODEL))
 ifndef PRODUCT_SYSTEM_MODEL
   PRODUCT_SYSTEM_MODEL := $(PRODUCT_MODEL)
 endif
 
-PRODUCT_MANUFACTURER := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MANUFACTURER))
 ifndef PRODUCT_MANUFACTURER
   PRODUCT_MANUFACTURER := unknown
 endif
-PRODUCT_SYSTEM_MANUFACTURER := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_MANUFACTURER))
 ifndef PRODUCT_SYSTEM_MANUFACTURER
   PRODUCT_SYSTEM_MANUFACTURER := $(PRODUCT_MANUFACTURER)
 endif
 
-ifeq ($(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CHARACTERISTICS),)
+ifndef PRODUCT_CHARACTERISTICS
   TARGET_AAPT_CHARACTERISTICS := default
 else
-  TARGET_AAPT_CHARACTERISTICS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CHARACTERISTICS))
+  TARGET_AAPT_CHARACTERISTICS := $(PRODUCT_CHARACTERISTICS)
 endif
 
-PRODUCT_DEFAULT_WIFI_CHANNELS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEFAULT_WIFI_CHANNELS))
-
-PRODUCT_DEFAULT_DEV_CERTIFICATE := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEFAULT_DEV_CERTIFICATE))
 ifdef PRODUCT_DEFAULT_DEV_CERTIFICATE
-ifneq (1,$(words $(PRODUCT_DEFAULT_DEV_CERTIFICATE)))
+  ifneq (1,$(words $(PRODUCT_DEFAULT_DEV_CERTIFICATE)))
     $(error PRODUCT_DEFAULT_DEV_CERTIFICATE='$(PRODUCT_DEFAULT_DEV_CERTIFICATE)', \
       only 1 certificate is allowed.)
-endif
+  endif
 endif
 
-# A list of words like <source path>:<destination path>[:<owner>].
-# The file at the source path should be copied to the destination path
-# when building  this product.  <destination path> is relative to
-# $(PRODUCT_OUT), so it should look like, e.g., "system/etc/file.xml".
-# The rules for these copy steps are defined in build/make/core/Makefile.
-# The optional :<owner> is used to indicate the owner of a vendor file.
-PRODUCT_COPY_FILES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_COPY_FILES))
+ENFORCE_SYSTEM_CERTIFICATE := $(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT)
+ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)
 
-# A list of property assignments, like "key = value", with zero or more
-# whitespace characters on either side of the '='.
-PRODUCT_PROPERTY_OVERRIDES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PROPERTY_OVERRIDES))
-.KATI_READONLY := PRODUCT_PROPERTY_OVERRIDES
-
-PRODUCT_SHIPPING_API_LEVEL := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SHIPPING_API_LEVEL))
-
-# A list of property assignments, like "key = value", with zero or more
-# whitespace characters on either side of the '='.
-# used for adding properties to default.prop
-PRODUCT_DEFAULT_PROPERTY_OVERRIDES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEFAULT_PROPERTY_OVERRIDES))
-
-.KATI_READONLY := PRODUCT_DEFAULT_PROPERTY_OVERRIDES
-
-# A list of property assignments, like "key = value", with zero or more
-# whitespace characters on either side of the '='.
-# used for adding properties to default.prop of system partition
-PRODUCT_SYSTEM_DEFAULT_PROPERTIES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_DEFAULT_PROPERTIES))
-.KATI_READONLY := PRODUCT_SYSTEM_DEFAULT_PROPERTIES
-
-# A list of property assignments, like "key = value", with zero or more
-# whitespace characters on either side of the '='.
-# used for adding properties to build.prop of product partition
-PRODUCT_PRODUCT_PROPERTIES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_PROPERTIES))
-.KATI_READONLY := PRODUCT_PRODUCT_PROPERTIES
-
-ENFORCE_SYSTEM_CERTIFICATE := \
-    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT)
-
-ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST))
-
-# A list of property assignments, like "key = value", with zero or more
-# whitespace characters on either side of the '='.
-# used for adding properties to build.prop of product partition
-PRODUCT_PRODUCT_SERVICES_PROPERTIES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PRODUCT_SERVICES_PROPERTIES))
-.KATI_READONLY := PRODUCT_PRODUCT_SERVICES_PROPERTIES
-
-# Should we use the default resources or add any product specific overlays
-PRODUCT_PACKAGE_OVERLAYS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_PACKAGE_OVERLAYS))
-DEVICE_PACKAGE_OVERLAYS := \
-        $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).DEVICE_PACKAGE_OVERLAYS))
-
-# The list of product-specific kernel header dirs
-PRODUCT_VENDOR_KERNEL_HEADERS := \
-    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VENDOR_KERNEL_HEADERS)
-
-# The OTA key(s) specified by the product config, if any.  The names
-# of these keys are stored in the target-files zip so that post-build
-# signing tools can substitute them for the test key embedded by
-# default.
-PRODUCT_OTA_PUBLIC_KEYS := $(sort \
-    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_OTA_PUBLIC_KEYS))
-
-PRODUCT_EXTRA_RECOVERY_KEYS := $(sort \
-    $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_EXTRA_RECOVERY_KEYS))
-
-PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_DEFAULT_COMPILER_FILTER))
-PRODUCT_DEX_PREOPT_DEFAULT_FLAGS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_DEFAULT_FLAGS))
-PRODUCT_DEX_PREOPT_GENERATE_DM_FILES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_GENERATE_DM_FILES))
-PRODUCT_DEX_PREOPT_BOOT_FLAGS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_BOOT_FLAGS))
-PRODUCT_DEX_PREOPT_PROFILE_DIR := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_PROFILE_DIR))
-PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_NEVER_ALLOW_STRIPPING))
-
-# Boot image options.
-PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_USE_PROFILE_FOR_BOOT_IMAGE))
-PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_BOOT_IMAGE_PROFILE_LOCATION))
-
-PRODUCT_SYSTEM_SERVER_COMPILER_FILTER := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_COMPILER_FILTER))
-PRODUCT_SYSTEM_SERVER_DEBUG_INFO := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_SERVER_DEBUG_INFO))
-PRODUCT_OTHER_JAVA_DEBUG_INFO := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_OTHER_JAVA_DEBUG_INFO))
+PRODUCT_OTA_PUBLIC_KEYS := $(sort $(PRODUCT_OTA_PUBLIC_KEYS))
+PRODUCT_EXTRA_RECOVERY_KEYS := $(sort $(PRODUCT_EXTRA_RECOVERY_KEYS))
 
 # Resolve and setup per-module dex-preopt configs.
-PRODUCT_DEX_PREOPT_MODULE_CONFIGS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DEX_PREOPT_MODULE_CONFIGS))
 DEXPREOPT_DISABLED_MODULES :=
 # If a module has multiple setups, the first takes precedence.
 _pdpmc_modules :=
@@ -466,9 +341,8 @@
       $(eval DEXPREOPT.$(TARGET_PRODUCT).$(m).CONFIG := $(cf)))))
 _pdpmc_modules :=
 
+
 # Resolve and setup per-module sanitizer configs.
-PRODUCT_SANITIZER_MODULE_CONFIGS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SANITIZER_MODULE_CONFIGS))
 # If a module has multiple setups, the first takes precedence.
 _psmc_modules :=
 $(foreach c,$(PRODUCT_SANITIZER_MODULE_CONFIGS),\
@@ -480,123 +354,29 @@
     $(eval SANITIZER.$(TARGET_PRODUCT).$(m).CONFIG := $(cf))))
 _psmc_modules :=
 
-# Whether the product wants to ship libartd. For rules and meaning, see art/Android.mk.
-PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD))
-
-# Make this art variable visible to soong_config.mk.
-PRODUCT_ART_USE_READ_BARRIER := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ART_USE_READ_BARRIER))
-
-# Whether the product is an Android Things variant.
-PRODUCT_IOT := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_IOT))
-
-# Resource overlay list which must be excluded from enforcing RRO.
-PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_RRO_EXCLUDED_OVERLAYS))
-
-# Package list to apply enforcing RRO.
-PRODUCT_ENFORCE_RRO_TARGETS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ENFORCE_RRO_TARGETS))
-
-# Whether the product would like to check prebuilt ELF files.
-PRODUCT_CHECK_ELF_FILES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CHECK_ELF_FILES))
-.KATI_READONLY := PRODUCT_CHECK_ELF_FILES
-
-# Add reserved headroom to a system image.
-PRODUCT_SYSTEM_HEADROOM := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SYSTEM_HEADROOM))
-
-# Whether to save disk space by minimizing java debug info
-PRODUCT_MINIMIZE_JAVA_DEBUG_INFO := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_MINIMIZE_JAVA_DEBUG_INFO))
-
-# Whether any paths are excluded from sanitization when SANITIZE_TARGET=integer_overflow
-PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS))
-
-# ADB keys for debuggable builds
-PRODUCT_ADB_KEYS :=
-ifneq ($(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
-  PRODUCT_ADB_KEYS := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ADB_KEYS))
+# Reset ADB keys for non-debuggable builds
+ifeq (,$(filter eng userdebug,$(TARGET_BUILD_VARIANT)),)
+  PRODUCT_ADB_KEYS :=
 endif
 ifneq ($(filter-out 0 1,$(words $(PRODUCT_ADB_KEYS))),)
   $(error Only one file may be in PRODUCT_ADB_KEYS: $(PRODUCT_ADB_KEYS))
 endif
-.KATI_READONLY := PRODUCT_ADB_KEYS
 
-# Whether any paths are excluded from sanitization when SANITIZE_TARGET=cfi
-PRODUCT_CFI_EXCLUDE_PATHS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CFI_EXCLUDE_PATHS))
-
-# Whether any paths should have CFI enabled for components
-PRODUCT_CFI_INCLUDE_PATHS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_CFI_INCLUDE_PATHS))
-
-# Whether the Scudo hardened allocator is disabled platform-wide
-PRODUCT_DISABLE_SCUDO := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_DISABLE_SCUDO))
-
-# Whether any paths are excluded from being set XOM when ENABLE_XOM=true
-PRODUCT_XOM_EXCLUDE_PATHS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_XOM_EXCLUDE_PATHS))
-
-# which Soong namespaces to export to Make
-PRODUCT_SOONG_NAMESPACES := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SOONG_NAMESPACES))
-
-# A flag to override PRODUCT_COMPATIBLE_PROPERTY
-PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE))
-
-# Whether the whitelist of actionable compatible properties should be disabled or not
-PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_ACTIONABLE_COMPATIBLE_PROPERTY_DISABLE))
-
-# Dynamic partition feature flags.
-
-# When this is true, dynamic partitions is retrofitted on a device that has
-# already been launched without dynamic partitions. Otherwise, the device
-# is launched with dynamic partitions.
-# This flag implies PRODUCT_USE_DYNAMIC_PARTITIONS.
-PRODUCT_RETROFIT_DYNAMIC_PARTITIONS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_RETROFIT_DYNAMIC_PARTITIONS))
-.KATI_READONLY := PRODUCT_RETROFIT_DYNAMIC_PARTITIONS
-
-PRODUCT_USE_DYNAMIC_PARTITIONS := $(or \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_USE_DYNAMIC_PARTITIONS)), \
-    $(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS))
-.KATI_READONLY := PRODUCT_USE_DYNAMIC_PARTITIONS
+ifndef PRODUCT_USE_DYNAMIC_PARTITIONS
+  PRODUCT_USE_DYNAMIC_PARTITIONS := $(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS)
+endif
 
 # All requirements of PRODUCT_USE_DYNAMIC_PARTITIONS falls back to
 # PRODUCT_USE_DYNAMIC_PARTITIONS if not defined.
-PRODUCT_USE_DYNAMIC_PARTITION_SIZE := $(or \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_USE_DYNAMIC_PARTITION_SIZE)),\
-    $(PRODUCT_USE_DYNAMIC_PARTITIONS))
-.KATI_READONLY := PRODUCT_USE_DYNAMIC_PARTITION_SIZE
-PRODUCT_BUILD_SUPER_PARTITION := $(or \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_BUILD_SUPER_PARTITION)),\
-    $(PRODUCT_USE_DYNAMIC_PARTITIONS))
-.KATI_READONLY := PRODUCT_BUILD_SUPER_PARTITION
+ifndef PRODUCT_USE_DYNAMIC_PARTITION_SIZE
+  PRODUCT_USE_DYNAMIC_PARTITION_SIZE := $(PRODUCT_USE_DYNAMIC_PARTITIONS)
+endif
 
-# List of modules that should be forcefully unmarked from being LOCAL_PRODUCT_MODULE, and hence
-# installed on /system directory by default.
-PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION))
-.KATI_READONLY := PRODUCT_FORCE_PRODUCT_MODULES_TO_SYSTEM_PARTITION
-
-# If set, kernel configuration requirements are present in OTA package (and will be enforced
-# during OTA). Otherwise, kernel configuration requirements are enforced in VTS.
-# Devices that checks the running kernel (instead of the kernel in OTA package) should not
-# set this variable to prevent OTA failures.
-PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS := \
-    $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS))
+ifndef PRODUCT_BUILD_SUPER_PARTITION
+  PRODUCT_BUILD_SUPER_PARTITION := $(PRODUCT_USE_DYNAMIC_PARTITIONS)
+endif
 
 define product-overrides-config
-PRODUCT_$(1)_OVERRIDES := $$(strip $$(PRODUCTS.$$(INTERNAL_PRODUCT).PRODUCT_$(1)_OVERRIDES))
-.KATI_READONLY := PRODUCT_$(1)_OVERRIDES
 $$(foreach rule,$$(PRODUCT_$(1)_OVERRIDES),\
     $$(if $$(filter 2,$$(words $$(subst :,$$(space),$$(rule)))),,\
         $$(error Rule "$$(rule)" in PRODUCT_$(1)_OVERRIDE is not <module_name>:<new_value>)))
@@ -610,8 +390,7 @@
 
 # Macro to use below. $(1) is the name of the partition
 define product-build-image-config
-PRODUCT_BUILD_$(1)_IMAGE := $$(firstword $$(strip $$(PRODUCTS.$$(INTERNAL_PRODUCT).PRODUCT_BUILD_$(1)_IMAGE)))
-.KATI_READONLY := PRODUCT_BUILD_$(1)_IMAGE
+PRODUCT_BUILD_$(1)_IMAGE := $$(firstword $$(PRODUCT_BUILD_$(1)_IMAGE))
 ifneq ($$(filter-out true false,$$(PRODUCT_BUILD_$(1)_IMAGE)),)
     $$(error Invalid PRODUCT_BUILD_$(1)_IMAGE: $$(PRODUCT_BUILD_$(1)_IMAGE) -- true false and empty are supported)
 endif
@@ -631,3 +410,5 @@
   $(eval $(call product-build-image-config,$(image))))
 
 product-build-image-config :=
+
+$(call readonly-product-vars)
diff --git a/core/proguard.flags b/core/proguard.flags
index 6ed1f9b..50049cb 100644
--- a/core/proguard.flags
+++ b/core/proguard.flags
@@ -15,4 +15,35 @@
 @**.VisibleForTesting *;
 }
 
+# Understand the @Keep support annotation.
+-keep class android.support.annotation.Keep
+-keep class androidx.annotation.Keep
+
+-keep @android.support.annotation.Keep class * {*;}
+-keep @androidx.annotation.Keep class * {*;}
+
+-keepclasseswithmembers class * {
+    @android.support.annotation.Keep <methods>;
+}
+
+-keepclasseswithmembers class * {
+    @androidx.annotation.Keep <methods>;
+}
+
+-keepclasseswithmembers class * {
+    @android.support.annotation.Keep <fields>;
+}
+
+-keepclasseswithmembers class * {
+    @androidx.annotation.Keep <fields>;
+}
+
+-keepclasseswithmembers class * {
+    @android.support.annotation.Keep <init>(...);
+}
+
+-keepclasseswithmembers class * {
+    @androidx.annotation.Keep <init>(...);
+}
+
 -include proguard_basic_keeps.flags
diff --git a/core/target_test_internal.mk b/core/target_test_internal.mk
index 1ed1195..40b2ba8 100644
--- a/core/target_test_internal.mk
+++ b/core/target_test_internal.mk
@@ -30,10 +30,8 @@
 endif
 
 use_testcase_folder := false
-ifdef ENABLE_DEFAULT_TEST_LOCATION
-  ifneq ($(LOCAL_MODULE),$(filter $(LOCAL_MODULE),$(DEFAULT_DATA_OUT_MODULES)))
-    use_testcase_folder := true
-  endif
+ifneq ($(LOCAL_MODULE),$(filter $(LOCAL_MODULE),$(DEFAULT_DATA_OUT_MODULES)))
+  use_testcase_folder := true
 endif
 
 ifneq ($(use_testcase_folder),true)
diff --git a/core/tasks/sdk-addon.mk b/core/tasks/sdk-addon.mk
index 122161b..93db1de 100644
--- a/core/tasks/sdk-addon.mk
+++ b/core/tasks/sdk-addon.mk
@@ -18,7 +18,7 @@
 
 # If they didn't define PRODUCT_SDK_ADDON_NAME, then we won't define
 # any of these rules.
-addon_name := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_NAME))
+addon_name := $(PRODUCT_SDK_ADDON_NAME)
 ifneq ($(addon_name),)
 
 addon_dir_leaf  := $(addon_name)-$(FILE_NAME_TAG)-$(INTERNAL_SDK_HOST_OS_NAME)
@@ -43,8 +43,8 @@
 endef
 
 # Files that are built and then copied into the sdk-addon
-ifneq ($(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_COPY_MODULES)),)
-$(foreach cf,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_COPY_MODULES), \
+ifneq ($(PRODUCT_SDK_ADDON_COPY_MODULES),)
+$(foreach cf,$(PRODUCT_SDK_ADDON_COPY_MODULES), \
   $(eval _src := $(call module-stubs-files,$(call word-colon,1,$(cf)))) \
   $(eval $(call stub-addon-jar,$(_src))) \
   $(eval _src := $(call stub-addon-jar-file,$(_src))) \
@@ -55,8 +55,8 @@
 endif
 
 # Files that are copied directly into the sdk-addon
-ifneq ($(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_COPY_FILES)),)
-$(foreach cf,$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_COPY_FILES), \
+ifneq ($(PRODUCT_SDK_ADDON_COPY_FILES),)
+$(foreach cf,$(PRODUCT_SDK_ADDON_COPY_FILES), \
   $(eval _src  := $(call word-colon,1,$(cf))) \
   $(eval _dest := $(call word-colon,2,$(cf))) \
   $(if $(findstring images/,$(_dest)), $(eval _root := $(addon_dir_img)), $(eval _root := $(addon_dir_leaf))) \
@@ -72,7 +72,7 @@
 	$(addon_dir_img):$(PRODUCT_OUT)/system/build.prop:images/$(TARGET_CPU_ABI)/build.prop \
 	$(addon_dir_img):device/generic/goldfish/data/etc/userdata.img:images/$(TARGET_CPU_ABI)/userdata.img \
 	$(addon_dir_img):$(target_notice_file_txt):images/$(TARGET_CPU_ABI)/NOTICE.txt \
-	$(addon_dir_img):$(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP):images/source.properties
+	$(addon_dir_img):$(PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP):images/source.properties
 
 
 ifeq ($(BOARD_AVB_ENABLE),true)
@@ -93,7 +93,7 @@
 addon_img_source_prop := $(call append-path,$(staging),$(addon_dir_img))/images/$(TARGET_CPU_ABI)/source.properties
 sdk_addon_deps += $(addon_img_source_prop)
 
-$(addon_img_source_prop): $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP)
+$(addon_img_source_prop): $(PRODUCT_SDK_ADDON_SYS_IMG_SOURCE_PROP)
 	@echo Generate $@
 	$(hide) mkdir -p $(dir $@)
 	$(hide) sed \
@@ -108,7 +108,7 @@
 # We don't know about all of the docs files, so depend on the timestamps for
 # them, and record the directories, and the packaging rule will just copy the
 # whole thing.
-doc_modules := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_SDK_ADDON_DOC_MODULES))
+doc_modules := $(PRODUCT_SDK_ADDON_DOC_MODULES)
 sdk_addon_deps += $(foreach dm, $(doc_modules), $(call doc-timestamp-for, $(dm)))
 $(full_target): PRIVATE_DOCS_DIRS := $(addprefix $(OUT_DOCS)/, $(doc_modules))
 
diff --git a/core/tasks/tools/build_custom_image.mk b/core/tasks/tools/build_custom_image.mk
index a1151e9..19d2ab5 100644
--- a/core/tasks/tools/build_custom_image.mk
+++ b/core/tasks/tools/build_custom_image.mk
@@ -84,7 +84,7 @@
 $(my_built_custom_image): PRIVATE_SELINUX := $(CUSTOM_IMAGE_SELINUX)
 $(my_built_custom_image): PRIVATE_SUPPORT_VERITY := $(CUSTOM_IMAGE_SUPPORT_VERITY)
 $(my_built_custom_image): PRIVATE_SUPPORT_VERITY_FEC := $(CUSTOM_IMAGE_SUPPORT_VERITY_FEC)
-$(my_built_custom_image): PRIVATE_VERITY_KEY := $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_VERITY_SIGNING_KEY)
+$(my_built_custom_image): PRIVATE_VERITY_KEY := $(PRODUCT_VERITY_SIGNING_KEY)
 $(my_built_custom_image): PRIVATE_VERITY_BLOCK_DEVICE := $(CUSTOM_IMAGE_VERITY_BLOCK_DEVICE)
 $(my_built_custom_image): PRIVATE_DICT_FILE := $(CUSTOM_IMAGE_DICT_FILE)
 $(my_built_custom_image): PRIVATE_AVB_AVBTOOL := $(AVBTOOL)
diff --git a/core/tasks/vendor_module_check.mk b/core/tasks/vendor_module_check.mk
index 6695994..0b8f1e8 100644
--- a/core/tasks/vendor_module_check.mk
+++ b/core/tasks/vendor_module_check.mk
@@ -48,18 +48,18 @@
         widevine
 
 
-_restrictions := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).PRODUCT_RESTRICT_VENDOR_FILES))
+_restrictions := $(PRODUCT_RESTRICT_VENDOR_FILES)
 
 ifneq (,$(_restrictions))
-ifneq (,$(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_PRODUCT_RESTRICT_VENDOR_FILES))
+ifneq (,$(VENDOR_PRODUCT_RESTRICT_VENDOR_FILES))
 $(error Error: cannot set both PRODUCT_RESTRICT_VENDOR_FILES and VENDOR_PRODUCT_RESTRICT_VENDOR_FILES)
 endif
 _vendor_exception_path_prefix :=
 _vendor_exception_modules :=
 else
-_restrictions := $(strip $(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_PRODUCT_RESTRICT_VENDOR_FILES))
-_vendor_exception_path_prefix := $(patsubst %, vendor/%/%, $(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_EXCEPTION_PATHS))
-_vendor_exception_modules := $(PRODUCTS.$(INTERNAL_PRODUCT).VENDOR_EXCEPTION_MODULES)
+_restrictions := $(VENDOR_PRODUCT_RESTRICT_VENDOR_FILES)
+_vendor_exception_path_prefix := $(patsubst %, vendor/%/%, $(VENDOR_EXCEPTION_PATHS))
+_vendor_exception_modules := $(VENDOR_EXCEPTION_MODULES)
 endif
 
 
diff --git a/target/board/BoardConfigEmuCommon.mk b/target/board/BoardConfigEmuCommon.mk
index 3e8d342..617b3c5 100644
--- a/target/board/BoardConfigEmuCommon.mk
+++ b/target/board/BoardConfigEmuCommon.mk
@@ -30,3 +30,5 @@
 
 BOARD_SEPOLICY_DIRS += device/generic/goldfish/sepolicy/common
 
+# TODO(b/125540538): Remove when emulator uses dynamic partitions
+BOARD_BUILD_SYSTEM_ROOT_IMAGE := true
diff --git a/target/board/BoardConfigMainlineCommon.mk b/target/board/BoardConfigMainlineCommon.mk
index fc55408..acbd11d 100644
--- a/target/board/BoardConfigMainlineCommon.mk
+++ b/target/board/BoardConfigMainlineCommon.mk
@@ -5,6 +5,7 @@
 # The generic product target doesn't have any hardware-specific pieces.
 TARGET_NO_BOOTLOADER := true
 TARGET_NO_KERNEL := true
+TARGET_NO_RECOVERY := true
 
 TARGET_USERIMAGES_USE_EXT4 := true
 
@@ -15,10 +16,6 @@
 TARGET_COPY_OUT_PRODUCT := product
 BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
 
-# system-as-root is mandatory from Android P
-TARGET_NO_RECOVERY := true
-BOARD_BUILD_SYSTEM_ROOT_IMAGE := true
-
 BOARD_VNDK_VERSION := current
 
 # Required flag for non-64 bit devices from P.
diff --git a/target/board/generic_arm64_a/BoardConfig.mk b/target/board/generic_arm64_a/BoardConfig.mk
deleted file mode 100644
index 68aedfc..0000000
--- a/target/board/generic_arm64_a/BoardConfig.mk
+++ /dev/null
@@ -1,32 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-include build/make/target/board/BoardConfigGsiCommon.mk
-
-TARGET_ARCH := arm64
-TARGET_ARCH_VARIANT := armv8-a
-TARGET_CPU_ABI := arm64-v8a
-TARGET_CPU_ABI2 :=
-TARGET_CPU_VARIANT := generic
-
-TARGET_2ND_ARCH := arm
-TARGET_2ND_ARCH_VARIANT := armv8-a
-TARGET_2ND_CPU_ABI := armeabi-v7a
-TARGET_2ND_CPU_ABI2 := armeabi
-TARGET_2ND_CPU_VARIANT := generic
-
-# This is a non-system-as-root Legacy GSI build target
-BOARD_BUILD_SYSTEM_ROOT_IMAGE := false
diff --git a/target/board/generic_arm_a/BoardConfig.mk b/target/board/generic_arm_a/BoardConfig.mk
deleted file mode 100644
index 464a74f..0000000
--- a/target/board/generic_arm_a/BoardConfig.mk
+++ /dev/null
@@ -1,29 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-include build/make/target/board/BoardConfigGsiCommon.mk
-
-TARGET_ARCH := arm
-TARGET_ARCH_VARIANT := armv7-a-neon
-TARGET_CPU_ABI := armeabi-v7a
-TARGET_CPU_ABI2 := armeabi
-TARGET_CPU_VARIANT := generic
-
-# Legacy GSI keeps 32 bits binder for 32 bits CPU Arch
-TARGET_USES_64_BIT_BINDER := false
-
-# This is a non-system-as-root Legacy GSI build target
-BOARD_BUILD_SYSTEM_ROOT_IMAGE := false
diff --git a/target/board/generic_x86/device.mk b/target/board/generic_x86/device.mk
index 83cbd54..bbab2b4 100644
--- a/target/board/generic_x86/device.mk
+++ b/target/board/generic_x86/device.mk
@@ -19,10 +19,6 @@
 endif
 
 # Ensure we package the BIOS files too.
-PRODUCT_PACKAGES += \
-	bios.bin \
-	vgabios-cirrus.bin \
-
 PRODUCT_HOST_PACKAGES += \
 	bios.bin \
 	vgabios-cirrus.bin \
diff --git a/target/board/generic_x86_64/device.mk b/target/board/generic_x86_64/device.mk
index 83cbd54..bbab2b4 100755
--- a/target/board/generic_x86_64/device.mk
+++ b/target/board/generic_x86_64/device.mk
@@ -19,10 +19,6 @@
 endif
 
 # Ensure we package the BIOS files too.
-PRODUCT_PACKAGES += \
-	bios.bin \
-	vgabios-cirrus.bin \
-
 PRODUCT_HOST_PACKAGES += \
 	bios.bin \
 	vgabios-cirrus.bin \
diff --git a/target/board/generic_x86_64_a/BoardConfig.mk b/target/board/generic_x86_64_a/BoardConfig.mk
deleted file mode 100644
index 07eef4f..0000000
--- a/target/board/generic_x86_64_a/BoardConfig.mk
+++ /dev/null
@@ -1,28 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-include build/make/target/board/BoardConfigGsiCommon.mk
-
-TARGET_CPU_ABI := x86_64
-TARGET_ARCH := x86_64
-TARGET_ARCH_VARIANT := x86_64
-
-TARGET_2ND_CPU_ABI := x86
-TARGET_2ND_ARCH := x86
-TARGET_2ND_ARCH_VARIANT := x86_64
-
-# This is a non-system-as-root Legacy GSI build target
-BOARD_BUILD_SYSTEM_ROOT_IMAGE := false
diff --git a/target/board/generic_x86_a/BoardConfig.mk b/target/board/generic_x86_a/BoardConfig.mk
deleted file mode 100644
index e3e8a3a..0000000
--- a/target/board/generic_x86_a/BoardConfig.mk
+++ /dev/null
@@ -1,27 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-include build/make/target/board/BoardConfigGsiCommon.mk
-
-TARGET_CPU_ABI := x86
-TARGET_ARCH := x86
-TARGET_ARCH_VARIANT := x86
-
-# Legacy GSI keeps 32 bits binder for 32 bits CPU Arch
-TARGET_USES_64_BIT_BINDER := false
-
-# This is a non-system-as-root Legacy GSI build target
-BOARD_BUILD_SYSTEM_ROOT_IMAGE := false
diff --git a/target/product/AndroidProducts.mk b/target/product/AndroidProducts.mk
index 12fd99a..cfb8930 100644
--- a/target/product/AndroidProducts.mk
+++ b/target/product/AndroidProducts.mk
@@ -44,16 +44,12 @@
 else
 PRODUCT_MAKEFILES := \
     $(LOCAL_DIR)/aosp_arm64_ab.mk \
-    $(LOCAL_DIR)/aosp_arm64_a.mk \
     $(LOCAL_DIR)/aosp_arm64.mk \
     $(LOCAL_DIR)/aosp_arm_ab.mk \
-    $(LOCAL_DIR)/aosp_arm_a.mk \
     $(LOCAL_DIR)/aosp_arm.mk \
     $(LOCAL_DIR)/aosp_x86_64_ab.mk \
-    $(LOCAL_DIR)/aosp_x86_64_a.mk \
     $(LOCAL_DIR)/aosp_x86_64.mk \
     $(LOCAL_DIR)/aosp_x86_ab.mk \
-    $(LOCAL_DIR)/aosp_x86_a.mk \
     $(LOCAL_DIR)/aosp_x86_arm.mk \
     $(LOCAL_DIR)/aosp_x86.mk \
     $(LOCAL_DIR)/full.mk \
diff --git a/target/product/aosp_arm64_a.mk b/target/product/aosp_arm64_a.mk
deleted file mode 100644
index e45229d..0000000
--- a/target/product/aosp_arm64_a.mk
+++ /dev/null
@@ -1,45 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# PRODUCT_PROPERTY_OVERRIDES cannot be used here because sysprops will be at
-# /vendor/[build|default].prop when build split is on. In order to have sysprops
-# on the generic system image, place them in build/make/target/board/
-# gsi_system.prop.
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
-
-# Enable mainline checking for excat this product name
-ifeq (aosp_arm64_a,$(TARGET_PRODUCT))
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-endif
-
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
-
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
-
-PRODUCT_NAME := aosp_arm64_a
-PRODUCT_DEVICE := generic_arm64_a
-PRODUCT_BRAND := Android
-PRODUCT_MODEL := AOSP on ARM64
diff --git a/target/product/aosp_arm_a.mk b/target/product/aosp_arm_a.mk
deleted file mode 100644
index 249ad2c..0000000
--- a/target/product/aosp_arm_a.mk
+++ /dev/null
@@ -1,32 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# PRODUCT_PROPERTY_OVERRIDES cannot be used here because sysprops will be at
-# /vendor/[build|default].prop when build split is on. In order to have sysprops
-# on the generic system image, place them in build/make/target/board/
-# gsi_system.prop.
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
-
-# Enable mainline checking for excat this product name
-ifeq (aosp_arm_a,$(TARGET_PRODUCT))
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-endif
-
-PRODUCT_NAME := aosp_arm_a
-PRODUCT_DEVICE := generic_arm_a
-PRODUCT_BRAND := Android
-PRODUCT_MODEL := AOSP on ARM32
diff --git a/target/product/aosp_x86_64_a.mk b/target/product/aosp_x86_64_a.mk
deleted file mode 100644
index f40b9a9..0000000
--- a/target/product/aosp_x86_64_a.mk
+++ /dev/null
@@ -1,45 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# PRODUCT_PROPERTY_OVERRIDES cannot be used here because sysprops will be at
-# /vendor/[build|default].prop when build split is on. In order to have sysprops
-# on the generic system image, place them in build/make/target/board/
-# gsi_system.prop.
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
-
-# Enable mainline checking for excat this product name
-ifeq (aosp_x86_64_a,$(TARGET_PRODUCT))
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-endif
-
-PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
-    root/init.zygote32_64.rc \
-    root/init.zygote64_32.rc \
-
-# Copy different zygote settings for vendor.img to select by setting property
-# ro.zygote=zygote64_32 or ro.zygote=zygote32_64:
-#   1. 64-bit primary, 32-bit secondary OR
-#   2. 32-bit primary, 64-bit secondary
-# init.zygote64_32.rc is in the core_64_bit.mk below
-PRODUCT_COPY_FILES += \
-    system/core/rootdir/init.zygote32_64.rc:root/init.zygote32_64.rc
-
-PRODUCT_NAME := aosp_x86_64_a
-PRODUCT_DEVICE := generic_x86_64_a
-PRODUCT_BRAND := Android
-PRODUCT_MODEL := AOSP on x86_64
diff --git a/target/product/aosp_x86_a.mk b/target/product/aosp_x86_a.mk
deleted file mode 100644
index 743e0b9..0000000
--- a/target/product/aosp_x86_a.mk
+++ /dev/null
@@ -1,32 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open-Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-# PRODUCT_PROPERTY_OVERRIDES cannot be used here because sysprops will be at
-# /vendor/[build|default].prop when build split is on. In order to have sysprops
-# on the generic system image, place them in build/make/target/board/
-# gsi_system.prop.
-
-$(call inherit-product, $(SRC_TARGET_DIR)/product/legacy_gsi_common.mk)
-
-# Enable mainline checking for excat this product name
-ifeq (aosp_x86_a,$(TARGET_PRODUCT))
-PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
-endif
-
-PRODUCT_NAME := aosp_x86_a
-PRODUCT_DEVICE := generic_x86_a
-PRODUCT_BRAND := Android
-PRODUCT_MODEL := AOSP on x86
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 51dd82a..c3a7516 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -17,10 +17,8 @@
 # Base modules and settings for the system partition.
 PRODUCT_PACKAGES += \
     abb \
-    adb \
     adbd \
     am \
-    android.frameworks.bufferhub@1.0-service \
     android.hidl.allocator@1.0-service \
     android.hidl.base-V1.0-java \
     android.hidl.manager-V1.0-java \
@@ -36,12 +34,10 @@
     app_process \
     appwidget \
     ashmemd \
-    atest \
     atrace \
     audioserver \
     BackupRestoreConfirmation \
     bcc \
-    bit \
     blank_screen \
     blkid \
     bmgr \
@@ -77,7 +73,6 @@
     e2fsck \
     ExtServices \
     ExtShared \
-    fastboot \
     flags_health_check \
     framework \
     framework-res \
@@ -101,7 +96,6 @@
     incident \
     incidentd \
     incident_helper \
-    incident_report \
     init.environ.rc \
     init.rc \
     init_system \
@@ -173,7 +167,6 @@
     libradio_metadata \
     librtp_jni \
     libsensorservice \
-    libsigchain \
     libskia \
     libsonic \
     libsonivox \
@@ -205,7 +198,6 @@
     lshal \
     mdnsd \
     media \
-    media_cmd \
     mediacodec.policy \
     mediadrmserver \
     mediaextractor \
@@ -285,7 +277,7 @@
 PRODUCT_HOST_PACKAGES += \
     BugReport \
     adb \
-    adbd \
+    art-tools \
     atest \
     bcc \
     bit \
@@ -301,9 +293,7 @@
     minigzip \
     mke2fs \
     resize2fs \
-    selinux_policy_system \
     sgdisk \
-    shell_and_utilities_system \
     sqlite3 \
     tinyplay \
     tune2fs \
@@ -322,11 +312,11 @@
 $(error TARGET_CORE_JARS is empty; cannot initialize PRODUCT_BOOT_JARS variable)
 endif
 
-# The order matters
+# The order matters for runtime class lookup performance.
 PRODUCT_BOOT_JARS := \
     $(TARGET_CORE_JARS) \
-    ext \
     framework \
+    ext \
     telephony-common \
     voip-common \
     ims-common \
diff --git a/target/product/full_x86.mk b/target/product/full_x86.mk
index 17ca398..55c450a 100644
--- a/target/product/full_x86.mk
+++ b/target/product/full_x86.mk
@@ -32,10 +32,6 @@
 endif
 
 # Ensure we package the BIOS files too.
-PRODUCT_PACKAGES += \
-	bios.bin \
-	vgabios-cirrus.bin \
-
 PRODUCT_HOST_PACKAGES += \
 	bios.bin \
 	vgabios-cirrus.bin \
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index e04fd1a..657aa07 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -5,6 +5,7 @@
 LLNDK: libRS.so
 LLNDK: libandroid_net.so
 LLNDK: libc.so
+LLNDK: libcgrouprc.so
 LLNDK: libdl.so
 LLNDK: libft2.so
 LLNDK: liblog.so
@@ -259,6 +260,7 @@
 VNDK-core: libstagefright_flacdec.so
 VNDK-core: libstagefright_foundation.so
 VNDK-core: libstagefright_omx.so
+VNDK-core: libstagefright_omx_soft.so
 VNDK-core: libstagefright_omx_utils.so
 VNDK-core: libstagefright_soft_aacdec.so
 VNDK-core: libstagefright_soft_aacenc.so
diff --git a/target/product/gsi_common.mk b/target/product/gsi_common.mk
index 5e73e63..2c978ab 100644
--- a/target/product/gsi_common.mk
+++ b/target/product/gsi_common.mk
@@ -31,7 +31,6 @@
 # The mainline checking whitelist, should be clean up
 PRODUCT_ARTIFACT_PATH_REQUIREMENT_WHITELIST += \
     system/app/messaging/messaging.apk \
-    system/app/PhotoTable/PhotoTable.apk \
     system/app/WAPPushManager/WAPPushManager.apk \
     system/bin/healthd \
     system/etc/init/healthd.rc \
diff --git a/target/product/gsi_keys.mk b/target/product/gsi_keys.mk
new file mode 100644
index 0000000..5a814db
--- /dev/null
+++ b/target/product/gsi_keys.mk
@@ -0,0 +1,22 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Include GSI keys into first-stage ramdisk, so we can enable verified
+# boot when booting a GSI.
+PRODUCT_PACKAGES += \
+    q-gsi.avbpubkey \
+    r-gsi.avbpubkey \
+    s-gsi.avbpubkey \
diff --git a/target/product/handheld_system.mk b/target/product/handheld_system.mk
index a776622..6463a54 100644
--- a/target/product/handheld_system.mk
+++ b/target/product/handheld_system.mk
@@ -24,10 +24,6 @@
 $(call inherit-product-if-exists, external/google-fonts/carrois-gothic-sc/fonts.mk)
 $(call inherit-product-if-exists, external/google-fonts/coming-soon/fonts.mk)
 $(call inherit-product-if-exists, external/google-fonts/cutive-mono/fonts.mk)
-$(call inherit-product-if-exists, external/google-fonts/arbutus-slab/fonts.mk)
-$(call inherit-product-if-exists, external/google-fonts/arvo/fonts.mk)
-$(call inherit-product-if-exists, external/google-fonts/lato/fonts.mk)
-$(call inherit-product-if-exists, external/google-fonts/rubik/fonts.mk)
 $(call inherit-product-if-exists, external/google-fonts/source-sans-pro/fonts.mk)
 $(call inherit-product-if-exists, external/noto-fonts/fonts.mk)
 $(call inherit-product-if-exists, external/roboto-fonts/fonts.mk)
diff --git a/target/product/mainline.mk b/target/product/mainline.mk
index 59bad98..7900cdf 100644
--- a/target/product/mainline.mk
+++ b/target/product/mainline.mk
@@ -14,10 +14,24 @@
 # limitations under the License.
 #
 
-# Makefile including the mainline system image, and the relevant AOSP portions
-# for the other partitions.
+# This makefile is intended to serve as a base for completely AOSP based
+# mainline devices, It contain the mainline system partition and sensible
+# defaults for the product and vendor partition.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_product.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_product.mk)
+
+$(call inherit-product, frameworks/base/data/sounds/AllAudio.mk)
+
+PRODUCT_PROPERTY_OVERRIDES += \
+    ro.config.ringtone=Ring_Synth_04.ogg \
+    ro.com.android.dataroaming=true \
+
+PRODUCT_PACKAGES += \
+    PhotoTable \
+    WallpaperPicker \
+
+PRODUCT_COPY_FILES += device/sample/etc/apns-full-conf.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/apns-conf.xml
diff --git a/target/product/telephony_product.mk b/target/product/telephony_product.mk
index 70d4828..a4c7e31 100644
--- a/target/product/telephony_product.mk
+++ b/target/product/telephony_product.mk
@@ -21,3 +21,4 @@
 PRODUCT_PACKAGES += \
     CarrierConfig \
     Dialer \
+    EmergencyInfo \
diff --git a/target/product/telephony_system.mk b/target/product/telephony_system.mk
index fd79472..584cf1e 100644
--- a/target/product/telephony_system.mk
+++ b/target/product/telephony_system.mk
@@ -22,6 +22,5 @@
     CarrierDefaultApp \
     CallLogBackup \
     CellBroadcastReceiver \
-    EmergencyInfo \
 
 PRODUCT_COPY_FILES := \
diff --git a/tools/releasetools/merge_target_files.py b/tools/releasetools/merge_target_files.py
index 3c6bfbf..3b72551 100755
--- a/tools/releasetools/merge_target_files.py
+++ b/tools/releasetools/merge_target_files.py
@@ -47,6 +47,9 @@
   --rebuild_recovery
       Rebuild the recovery patch used by non-A/B devices and write it to the
       system image.
+
+  --keep-tmp
+      Keep tempoary files for debugging purposes.
 """
 
 from __future__ import print_function
@@ -296,6 +299,37 @@
       output.write('%s\n' % partition)
 
 
+def append_recovery_to_filesystem_config(output_target_files_temp_dir):
+  """Perform special processing for META/filesystem_config.txt
+
+  This function appends recovery information to META/filesystem_config.txt
+  so that recovery patch regeneration will succeed.
+
+  Args:
+    output_target_files_temp_dir: The name of a directory that will be used
+    to create the output target files package after all the special cases
+    are processed. We find filesystem_config.txt here.
+  """
+
+  filesystem_config_txt = os.path.join(
+      output_target_files_temp_dir,
+      'META',
+      'filesystem_config.txt')
+
+  with open(filesystem_config_txt, 'a') as f:
+    # TODO(bpeckham) this data is hard coded. It should be generated
+    # programmatically.
+    f.write(
+        'system/bin/install-recovery.sh 0 0 750 '
+        'selabel=u:object_r:install_recovery_exec:s0 capabilities=0x0\n')
+    f.write(
+        'system/recovery-from-boot.p 0 0 644 '
+        'selabel=u:object_r:system_file:s0 capabilities=0x0\n')
+    f.write(
+        'system/etc/recovery.img 0 0 440 '
+        'selabel=u:object_r:install_recovery_exec:s0 capabilities=0x0\n')
+
+
 def process_misc_info_txt(
     system_target_files_temp_dir,
     other_target_files_temp_dir,
@@ -454,7 +488,9 @@
     system_target_files_temp_dir,
     other_target_files_temp_dir,
     output_target_files_temp_dir,
-    system_misc_info_keys):
+    system_misc_info_keys,
+    rebuild_recovery
+):
   """Perform special-case processing for certain target files items.
 
   Certain files in the output target files package require special-case
@@ -476,12 +512,20 @@
 
     system_misc_info_keys: A list of keys to obtain from the system instance
     of META/misc_info.txt. The remaining keys from the other instance.
+
+    rebuild_recovery: If true, rebuild the recovery patch used by non-A/B
+    devices and write it to the system image.
   """
 
-  process_ab_partitions_txt(
-      system_target_files_temp_dir=system_target_files_temp_dir,
-      other_target_files_temp_dir=other_target_files_temp_dir,
-      output_target_files_temp_dir=output_target_files_temp_dir)
+  if 'ab_update' in system_misc_info_keys:
+    process_ab_partitions_txt(
+        system_target_files_temp_dir=system_target_files_temp_dir,
+        other_target_files_temp_dir=other_target_files_temp_dir,
+        output_target_files_temp_dir=output_target_files_temp_dir)
+
+  if rebuild_recovery:
+    append_recovery_to_filesystem_config(
+        output_target_files_temp_dir=output_target_files_temp_dir)
 
   process_misc_info_txt(
       system_target_files_temp_dir=system_target_files_temp_dir,
@@ -599,7 +643,8 @@
       system_target_files_temp_dir=system_target_files_temp_dir,
       other_target_files_temp_dir=other_target_files_temp_dir,
       output_target_files_temp_dir=output_target_files_temp_dir,
-      system_misc_info_keys=system_misc_info_keys)
+      system_misc_info_keys=system_misc_info_keys,
+      rebuild_recovery=rebuild_recovery)
 
   # Regenerate IMAGES in the temporary directory.
 
@@ -704,7 +749,7 @@
       OPTIONS.output_target_files = a
     elif o == '--rebuild_recovery':
       OPTIONS.rebuild_recovery = True
-    elif o == '--keep_tmp':
+    elif o == '--keep-tmp':
       OPTIONS.keep_tmp = True
     else:
       return False
@@ -720,7 +765,7 @@
           'other-item-list=',
           'output-target-files=',
           'rebuild_recovery',
-          "keep_tmp",
+          'keep-tmp',
       ],
       extra_option_handler=option_handler)
 
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 16c1840..c482a49 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -383,24 +383,24 @@
 
   Args:
     apex_data: Raw APEX data.
-    payload_key: The path to payload signing key (w/o extension).
+    payload_key: The path to payload signing key (w/ extension).
     container_key: The path to container signing key (w/o extension).
     container_pw: The matching password of the container_key, or None.
     codename_to_api_level_map: A dict that maps from codename to API level.
     signing_args: Additional args to be passed to the payload signer.
 
   Returns:
-    (signed_apex, payload_key_name): signed_apex is the path to the signed APEX
-        file; payload_key_name is a str of the payload signing key name (e.g.
-        com.android.tzdata).
+    The path to the signed APEX file.
   """
   apex_file = common.MakeTempFile(prefix='apex-', suffix='.apex')
   with open(apex_file, 'wb') as apex_fp:
     apex_fp.write(apex_data)
 
   APEX_PAYLOAD_IMAGE = 'apex_payload.img'
+  APEX_PUBKEY = 'apex_pubkey'
 
-  # 1. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given payload_key.
+  # 1a. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given
+  # payload_key.
   payload_dir = common.MakeTempDir(prefix='apex-payload-')
   with zipfile.ZipFile(apex_file) as apex_fd:
     payload_file = apex_fd.extract(APEX_PAYLOAD_IMAGE, payload_dir)
@@ -414,9 +414,14 @@
       payload_info['Salt'],
       signing_args)
 
+  # 1b. Update the embedded payload public key.
+  payload_public_key = common.ExtractAvbPublicKey(payload_key)
+
   common.ZipDelete(apex_file, APEX_PAYLOAD_IMAGE)
+  common.ZipDelete(apex_file, APEX_PUBKEY)
   apex_zip = zipfile.ZipFile(apex_file, 'a')
   common.ZipWrite(apex_zip, payload_file, arcname=APEX_PAYLOAD_IMAGE)
+  common.ZipWrite(apex_zip, payload_public_key, arcname=APEX_PUBKEY)
   common.ZipClose(apex_zip)
 
   # 2. Align the files at page boundary (same as in apexer).
@@ -440,7 +445,7 @@
       codename_to_api_level_map=codename_to_api_level_map,
       extra_signapk_args=extra_signapk_args)
 
-  return (signed_apex, payload_info['apex.key'])
+  return signed_apex
 
 
 def ProcessTargetFiles(input_tf_zip, output_tf_zip, misc_info,
@@ -454,10 +459,6 @@
        if GetApkFileInfo(i.filename, compressed_extension, [])[0]])
   system_root_image = misc_info.get("system_root_image") == "true"
 
-  # A dict of APEX payload public keys that should be updated, i.e. the files
-  # under '/system/etc/security/apex/'.
-  updated_apex_payload_keys = {}
-
   for info in input_tf_zip.infolist():
     filename = info.filename
     if filename.startswith("IMAGES/"):
@@ -511,7 +512,7 @@
         print("           : %-*s payload   (%s)" % (
             maxsize, name, payload_key))
 
-        (signed_apex, payload_key_name) = SignApex(
+        signed_apex = SignApex(
             data,
             payload_key,
             container_key,
@@ -519,7 +520,6 @@
             codename_to_api_level_map,
             OPTIONS.avb_extra_args.get('apex'))
         common.ZipWrite(output_tf_zip, signed_apex, filename)
-        updated_apex_payload_keys[payload_key_name] = payload_key
 
       else:
         print(
@@ -606,34 +606,6 @@
     else:
       common.ZipWriteStr(output_tf_zip, out_info, data)
 
-  # Copy or update APEX payload public keys.
-  for info in input_tf_zip.infolist():
-    filename = info.filename
-    if (os.path.dirname(filename) != 'SYSTEM/etc/security/apex' or
-        filename == 'SYSTEM/etc/security/apex/'):
-      continue
-
-    name = os.path.basename(filename)
-
-    # Copy the keys for PRESIGNED APEXes.
-    if name not in updated_apex_payload_keys:
-      data = input_tf_zip.read(filename)
-      common.ZipWriteStr(output_tf_zip, info, data)
-      continue
-
-    key_path = updated_apex_payload_keys[name]
-    if not os.path.exists(key_path) and not key_path.endswith('.pem'):
-      key_path = '{}.pem'.format(key_path)
-    assert os.path.exists(key_path), \
-        'Failed to find public key file {} for APEX {}'.format(
-            updated_apex_payload_keys[name], name)
-
-    print('Replacing APEX payload public key for {} with {}'.format(
-        name, key_path))
-
-    public_key = common.ExtractAvbPublicKey(key_path)
-    common.ZipWrite(output_tf_zip, public_key, arcname=filename)
-
   if OPTIONS.replace_ota_keys:
     ReplaceOtaKeys(input_tf_zip, output_tf_zip, misc_info)
 
@@ -1081,7 +1053,6 @@
       continue
 
     name = matches.group('NAME')
-    payload_public_key = matches.group("PAYLOAD_PUBLIC_KEY")
     payload_private_key = matches.group("PAYLOAD_PRIVATE_KEY")
 
     def CompareKeys(pubkey, pubkey_suffix, privkey, privkey_suffix):
@@ -1091,13 +1062,9 @@
               privkey.endswith(privkey_suffix) and
               pubkey[:-pubkey_suffix_len] == privkey[:-privkey_suffix_len])
 
-    PAYLOAD_PUBLIC_KEY_SUFFIX = '.avbpubkey'
-    PAYLOAD_PRIVATE_KEY_SUFFIX = '.pem'
-    if not CompareKeys(
-        payload_public_key, PAYLOAD_PUBLIC_KEY_SUFFIX,
-        payload_private_key, PAYLOAD_PRIVATE_KEY_SUFFIX):
-      raise ValueError("Failed to parse payload keys: \n{}".format(line))
-
+    # Sanity check on the container key names, as we'll carry them without the
+    # extensions. This doesn't apply to payload keys though, which we will use
+    # full names only.
     container_cert = matches.group("CONTAINER_CERT")
     container_private_key = matches.group("CONTAINER_PRIVATE_KEY")
     if not CompareKeys(
diff --git a/tools/releasetools/test_merge_target_files.py b/tools/releasetools/test_merge_target_files.py
new file mode 100644
index 0000000..bb9ce8e
--- /dev/null
+++ b/tools/releasetools/test_merge_target_files.py
@@ -0,0 +1,77 @@
+#
+# Copyright (C) 2017 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+import os.path
+
+import common
+import test_utils
+from merge_target_files import (
+    read_config_list, validate_config_lists, default_system_item_list,
+    default_other_item_list, default_system_misc_info_keys)
+
+
+class MergeTargetFilesTest(test_utils.ReleaseToolsTestCase):
+
+  def setUp(self):
+    self.testdata_dir = test_utils.get_testdata_dir()
+
+  def test_read_config_list(self):
+    system_item_list_file = os.path.join(self.testdata_dir,
+                                         'merge_config_system_item_list')
+    system_item_list = read_config_list(system_item_list_file)
+    expected_system_item_list = [
+        'META/apkcerts.txt',
+        'META/filesystem_config.txt',
+        'META/root_filesystem_config.txt',
+        'META/system_manifest.xml',
+        'META/system_matrix.xml',
+        'META/update_engine_config.txt',
+        'PRODUCT/*',
+        'ROOT/*',
+        'SYSTEM/*',
+    ]
+    self.assertItemsEqual(system_item_list, expected_system_item_list)
+
+  def test_validate_config_lists_ReturnsFalseIfMissingDefaultItem(self):
+    system_item_list = default_system_item_list[:]
+    system_item_list.remove('SYSTEM/*')
+    self.assertFalse(
+        validate_config_lists(system_item_list, default_system_misc_info_keys,
+                              default_other_item_list))
+
+  def test_validate_config_lists_ReturnsTrueIfDefaultItemInDifferentList(self):
+    system_item_list = default_system_item_list[:]
+    system_item_list.remove('ROOT/*')
+    other_item_list = default_other_item_list[:]
+    other_item_list.append('ROOT/*')
+    self.assertTrue(
+        validate_config_lists(system_item_list, default_system_misc_info_keys,
+                              other_item_list))
+
+  def test_validate_config_lists_ReturnsTrueIfExtraItem(self):
+    system_item_list = default_system_item_list[:]
+    system_item_list.append('MY_NEW_PARTITION/*')
+    self.assertTrue(
+        validate_config_lists(system_item_list, default_system_misc_info_keys,
+                              default_other_item_list))
+
+  def test_validate_config_lists_ReturnsFalseIfBadSystemMiscInfoKeys(self):
+    for bad_key in ['dynamic_partition_list', 'super_partition_groups']:
+      system_misc_info_keys = default_system_misc_info_keys[:]
+      system_misc_info_keys.append(bad_key)
+      self.assertFalse(
+          validate_config_lists(default_system_item_list, system_misc_info_keys,
+                                default_other_item_list))
diff --git a/tools/releasetools/test_sign_target_files_apks.py b/tools/releasetools/test_sign_target_files_apks.py
index 6082baf..6a4df1a 100644
--- a/tools/releasetools/test_sign_target_files_apks.py
+++ b/tools/releasetools/test_sign_target_files_apks.py
@@ -401,14 +401,14 @@
             'build/target/product/security/testkey'),
         }, keys_info)
 
-  def test_ReadApexKeysInfo_mismatchingKeys(self):
+  def test_ReadApexKeysInfo_mismatchingContainerKeys(self):
     # Mismatching payload public / private keys.
     apex_keys = self.APEX_KEYS_TXT + (
         'name="apex.apexd_test_different_app2.apex" '
         'public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" '
-        'private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_3.pem" '
+        'private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" '
         'container_certificate="build/target/product/security/testkey.x509.pem" '
-        'container_private_key="build/target/product/security/testkey.pk8"')
+        'container_private_key="build/target/product/security/testkey2.pk8"')
     target_files = common.MakeTempFile(suffix='.zip')
     with zipfile.ZipFile(target_files, 'w') as target_files_zip:
       target_files_zip.writestr('META/apexkeys.txt', apex_keys)
@@ -416,7 +416,7 @@
     with zipfile.ZipFile(target_files) as target_files_zip:
       self.assertRaises(ValueError, ReadApexKeysInfo, target_files_zip)
 
-  def test_ReadApexKeysInfo_missingPrivateKey(self):
+  def test_ReadApexKeysInfo_missingPayloadPrivateKey(self):
     # Invalid lines will be skipped.
     apex_keys = self.APEX_KEYS_TXT + (
         'name="apex.apexd_test_different_app2.apex" '
@@ -438,3 +438,26 @@
             'system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem',
             'build/target/product/security/testkey'),
         }, keys_info)
+
+  def test_ReadApexKeysInfo_missingPayloadPublicKey(self):
+    # Invalid lines will be skipped.
+    apex_keys = self.APEX_KEYS_TXT + (
+        'name="apex.apexd_test_different_app2.apex" '
+        'private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" '
+        'container_certificate="build/target/product/security/testkey.x509.pem" '
+        'container_private_key="build/target/product/security/testkey.pk8"')
+    target_files = common.MakeTempFile(suffix='.zip')
+    with zipfile.ZipFile(target_files, 'w') as target_files_zip:
+      target_files_zip.writestr('META/apexkeys.txt', apex_keys)
+
+    with zipfile.ZipFile(target_files) as target_files_zip:
+      keys_info = ReadApexKeysInfo(target_files_zip)
+
+    self.assertEqual({
+        'apex.apexd_test.apex': (
+            'system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem',
+            'build/target/product/security/testkey'),
+        'apex.apexd_test_different_app.apex': (
+            'system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem',
+            'build/target/product/security/testkey'),
+        }, keys_info)
diff --git a/tools/releasetools/testdata/merge_config_system_item_list b/tools/releasetools/testdata/merge_config_system_item_list
new file mode 100644
index 0000000..36c2618
--- /dev/null
+++ b/tools/releasetools/testdata/merge_config_system_item_list
@@ -0,0 +1,9 @@
+META/apkcerts.txt
+META/filesystem_config.txt
+META/root_filesystem_config.txt
+META/system_manifest.xml
+META/system_matrix.xml
+META/update_engine_config.txt
+PRODUCT/*
+ROOT/*
+SYSTEM/*
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 275939c..1c856a8 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -318,9 +318,31 @@
   if info_dict.get("avb_enable") == "true":
     logging.info('Verifying Verified Boot 2.0 (AVB) images...')
 
-    # TODO(b/120517892): Temporarily disable the verification for AVB-signed
-    # images. Needing supporting changes in caller to pass in the desired keys.
-    logging.info('Temporarily disabled due to b/120517892')
+    key = options['verity_key']
+    if key is None:
+      key = info_dict['avb_vbmeta_key_path']
+
+    # avbtool verifies all the images that have descriptors listed in vbmeta.
+    image = os.path.join(input_tmp, 'IMAGES', 'vbmeta.img')
+    cmd = ['avbtool', 'verify_image', '--image', image, '--key', key]
+
+    # Append the args for chained partitions if any.
+    for partition in common.AVB_PARTITIONS:
+      key_name = 'avb_' + partition + '_key_path'
+      if info_dict.get(key_name) is not None:
+        chained_partition_arg = common.GetAvbChainedPartitionArg(
+            partition, info_dict, options[key_name])
+        cmd.extend(["--expected_chain_partition", chained_partition_arg])
+
+    proc = common.Run(cmd)
+    stdoutdata, _ = proc.communicate()
+    assert proc.returncode == 0, \
+        'Failed to verify {} with avbtool (key: {}):\n{}'.format(
+            image, key, stdoutdata)
+
+    logging.info(
+        'Verified %s with avbtool (key: %s):\n%s', image, key,
+        stdoutdata.rstrip())
 
 
 def main():