Merge "Ban ELF prebuilts in PRODUCT_COPY_FILES"
diff --git a/CleanSpec.mk b/CleanSpec.mk
index 673856c..97dc31f 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -713,6 +713,15 @@
 $(call add-clean-step, find $(SOONG_OUT_DIR)/.intermediates -type d -name "android_*_recovery*" -print0 | xargs -0 rm -rf)
 $(call add-clean-step, find $(SOONG_OUT_DIR)/.intermediates -type d -name "android_*_vendor*" -print0 | xargs -0 rm -rf)
 
+# Clean up VTS-Core and VTS10 related artifacts.
+$(call add-clean-step, rm -rf $(HOST_OUT)/vts-core/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/framework/vts-core-tradefed.jar)
+$(call add-clean-step, rm -rf $(HOST_OUT)/vts10/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/framework/vts10-tradefed.jar)
+# Clean up VTS again as VTS-Core will be renamed to VTS
+$(call add-clean-step, rm -rf $(HOST_OUT)/vts/*)
+$(call add-clean-step, rm -rf $(HOST_OUT)/framework/vts-tradefed.jar)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/Deprecation.md b/Deprecation.md
index 2f936e3..74b54fa 100644
--- a/Deprecation.md
+++ b/Deprecation.md
@@ -14,21 +14,21 @@
 
 | Module type                      | State     |
 | -------------------------------- | --------- |
-| `BUILD_AUX_EXECUTABLE`           | Error     |
-| `BUILD_AUX_STATIC_LIBRARY`       | Error     |
+| `BUILD_AUX_EXECUTABLE`           | Obsolete  |
+| `BUILD_AUX_STATIC_LIBRARY`       | Obsolete  |
 | `BUILD_COPY_HEADERS`             | Error     |
 | `BUILD_HOST_EXECUTABLE`          | Error     |
-| `BUILD_HOST_FUZZ_TEST`           | Error     |
-| `BUILD_HOST_NATIVE_TEST`         | Error     |
+| `BUILD_HOST_FUZZ_TEST`           | Obsolete  |
+| `BUILD_HOST_NATIVE_TEST`         | Obsolete  |
 | `BUILD_HOST_SHARED_LIBRARY`      | Error     |
-| `BUILD_HOST_SHARED_TEST_LIBRARY` | Error     |
+| `BUILD_HOST_SHARED_TEST_LIBRARY` | Obsolete  |
 | `BUILD_HOST_STATIC_LIBRARY`      | Error     |
-| `BUILD_HOST_STATIC_TEST_LIBRARY` | Error     |
-| `BUILD_HOST_TEST_CONFIG`         | Error     |
-| `BUILD_NATIVE_BENCHMARK`         | Error     |
-| `BUILD_SHARED_TEST_LIBRARY`      | Error     |
-| `BUILD_STATIC_TEST_LIBRARY`      | Error     |
-| `BUILD_TARGET_TEST_CONFIG`       | Error     |
+| `BUILD_HOST_STATIC_TEST_LIBRARY` | Obsolete  |
+| `BUILD_HOST_TEST_CONFIG`         | Obsolete  |
+| `BUILD_NATIVE_BENCHMARK`         | Obsolete  |
+| `BUILD_SHARED_TEST_LIBRARY`      | Obsolete  |
+| `BUILD_STATIC_TEST_LIBRARY`      | Obsolete  |
+| `BUILD_TARGET_TEST_CONFIG`       | Obsolete  |
 | `BUILD_*`                        | Available |
 
 ## Module Type Deprecation Process
diff --git a/common/strings.mk b/common/strings.mk
index ce6d6fb..ba20e27 100644
--- a/common/strings.mk
+++ b/common/strings.mk
@@ -88,7 +88,7 @@
 endef
 
 ###########################################################
-## Convert "a=b c= d e = f" into "a=b c=d e=f"
+## Convert "a=b c= d e = f = g h=" into "a=b c=d e= f=g h="
 ##
 ## $(1): list to collapse
 ## $(2): if set, separator word; usually "=", ":", or ":="
@@ -96,11 +96,29 @@
 ###########################################################
 
 define collapse-pairs
+$(strip \
 $(eval _cpSEP := $(strip $(if $(2),$(2),=)))\
-$(strip $(subst $(space)$(_cpSEP)$(space),$(_cpSEP),$(strip \
-    $(subst $(_cpSEP), $(_cpSEP) ,$(1)))$(space)))
+$(eval _cpLHS :=)\
+$(eval _cpRET :=)\
+$(foreach w,$(subst $(space)$(_cpSEP),$(_cpSEP),$(strip \
+            $(subst $(_cpSEP),$(space)$(_cpSEP)$(space),$(1)))),\
+  $(if $(findstring $(_cpSEP),$(w)),\
+    $(eval _cpRET += $(_cpLHS))$(eval _cpLHS := $(w)),\
+    $(eval _cpRET += $(_cpLHS)$(w))$(eval _cpLHS :=)))\
+$(if $(_cpLHS),$(_cpRET)$(space)$(_cpLHS),$(_cpRET))\
+$(eval _cpSEP :=)\
+$(eval _cpLHS :=)\
+$(eval _cpRET :=))
 endef
 
+# Sanity check for collapse-pairs.
+ifneq (a=b c=d e= f=g h=,$(call collapse-pairs,a=b c= d e = f = g h=))
+  $(error collapse-pairs sanity check failure)
+endif
+ifneq (a:=b c:=d e:=f g:=h,$(call collapse-pairs,a:=b c:= d e :=f g := h,:=))
+  $(error collapse-pairs sanity check failure)
+endif
+
 ###########################################################
 ## Given a list of pairs, if multiple pairs have the same
 ## first components, keep only the first pair.
diff --git a/core/Makefile b/core/Makefile
index 835ae5f..f09c75b 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -261,7 +261,7 @@
 INSTALLED_DEFAULT_PROP_TARGET := $(TARGET_OUT)/etc/prop.default
 INSTALLED_DEFAULT_PROP_OLD_TARGET := $(TARGET_ROOT_OUT)/default.prop
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_DEFAULT_PROP_OLD_TARGET)
-$(INSTALLED_DEFAULT_PROP_OLD_TARGET): $(INSTALLED_DEFAULT_PROP_TARGET)
+$(INSTALLED_DEFAULT_PROP_TARGET): .KATI_IMPLICIT_OUTPUTS := $(INSTALLED_DEFAULT_PROP_OLD_TARGET)
 else
 # legacy path
 INSTALLED_DEFAULT_PROP_TARGET := $(TARGET_ROOT_OUT)/default.prop
@@ -429,7 +429,7 @@
 $(intermediate_system_build_prop): $(BUILDINFO_SH) $(BUILDINFO_COMMON_SH) $(INTERNAL_BUILD_ID_MAKEFILE) $(BUILD_SYSTEM)/version_defaults.mk $(system_prop_file) $(INSTALLED_ANDROID_INFO_TXT_TARGET) $(API_FINGERPRINT) $(POST_PROCESS_PROPS)
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
-	$(hide) echo > $@
+	$(hide) rm -f $@ && touch $@
 ifneq ($(PRODUCT_OEM_PROPERTIES),)
 	$(hide) echo "#" >> $@; \
 	        echo "# PRODUCT_OEM_PROPERTIES" >> $@; \
@@ -528,7 +528,7 @@
 $(INSTALLED_VENDOR_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(intermediate_system_build_prop) $(vendor_prop_files)
 	@echo Target vendor buildinfo: $@
 	@mkdir -p $(dir $@)
-	$(hide) echo > $@
+	$(hide) rm -f $@ && touch $@
 ifeq ($(PRODUCT_USE_DYNAMIC_PARTITIONS),true)
 	$(hide) echo ro.boot.dynamic_partitions=true >> $@
 endif
@@ -595,7 +595,7 @@
 $(INSTALLED_PRODUCT_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(product_prop_files)
 	@echo Target product buildinfo: $@
 	@mkdir -p $(dir $@)
-	$(hide) echo > $@
+	$(hide) rm -f $@ && touch $@
 ifdef BOARD_USES_PRODUCTIMAGE
 	$(hide) $(call generate-common-build-props,product,$@)
 endif  # BOARD_USES_PRODUCTIMAGE
@@ -636,7 +636,7 @@
 $(INSTALLED_ODM_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(odm_prop_files)
 	@echo Target odm buildinfo: $@
 	@mkdir -p $(dir $@)
-	$(hide) echo > $@
+	$(hide) rm -f $@ && touch $@
 	$(hide) echo ro.odm.product.cpu.abilist="$(TARGET_CPU_ABI_LIST)">>$@
 	$(hide) echo ro.odm.product.cpu.abilist32="$(TARGET_CPU_ABI_LIST_32_BIT)">>$@
 	$(hide) echo ro.odm.product.cpu.abilist64="$(TARGET_CPU_ABI_LIST_64_BIT)">>$@
@@ -677,7 +677,7 @@
 $(INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET): $(BUILDINFO_COMMON_SH) $(POST_PROCESS_PROPS) $(system_ext_prop_files)
 	@echo Target system_ext buildinfo: $@
 	@mkdir -p $(dir $@)
-	$(hide) echo > $@
+	$(hide) rm -f $@ && touch $@
 	$(hide) $(call generate-common-build-props,system_ext,$@)
 	$(hide) $(foreach file,$(system_ext_prop_files), \
 	    if [ -f "$(file)" ]; then \
@@ -872,7 +872,7 @@
 # -----------------------------------------------------------------
 # Cert-to-package mapping.  Used by the post-build signing tools.
 # Use a macro to add newline to each echo command
-# $1 package name
+# $1 stem name of the package
 # $2 certificate
 # $3 private key
 # $4 compressed
@@ -902,8 +902,8 @@
 	@rm -f $@
 	$(foreach p,$(sort $(PACKAGES)),\
 	  $(if $(PACKAGES.$(p).EXTERNAL_KEY),\
-	    $(call _apkcerts_write_line,$(p),"EXTERNAL","",$(PACKAGES.$(p).COMPRESSED),$(PACKAGES.$(p).PARTITION),$@),\
-	    $(call _apkcerts_write_line,$(p),$(PACKAGES.$(p).CERTIFICATE),$(PACKAGES.$(p).PRIVATE_KEY),$(PACKAGES.$(p).COMPRESSED),$(PACKAGES.$(p).PARTITION),$@)))
+	    $(call _apkcerts_write_line,$(PACKAGES.$(p).STEM),"EXTERNAL","",$(PACKAGES.$(p).COMPRESSED),$(PACKAGES.$(p).PARTITION),$@),\
+	    $(call _apkcerts_write_line,$(PACKAGES.$(p).STEM),$(PACKAGES.$(p).CERTIFICATE),$(PACKAGES.$(p).PRIVATE_KEY),$(PACKAGES.$(p).COMPRESSED),$(PACKAGES.$(p).PARTITION),$@)))
 	# In case value of PACKAGES is empty.
 	$(hide) touch $@
 
@@ -1356,10 +1356,10 @@
 # original notice files instead of making rules to copy them somwehere.
 # Then we could traverse that without quite as much bash drama.
 define combine-notice-files
-$(2) $(3): PRIVATE_MESSAGE := $(4)
-$(2) $(3): PRIVATE_DIR := $(5)
-$(2) : $(3)
-$(3) : $(6) $(BUILD_SYSTEM)/Makefile build/make/tools/generate-notice-files.py
+$(2): PRIVATE_MESSAGE := $(4)
+$(2): PRIVATE_DIR := $(5)
+$(2): .KATI_IMPLICIT_OUTPUTS := $(3)
+$(2): $(6) $(BUILD_SYSTEM)/Makefile build/make/tools/generate-notice-files.py
 	build/make/tools/generate-notice-files.py --text-output $(2) $(foreach xdir, $(7), -e $(xdir) )\
 	    $(if $(filter $(1),xml_excluded_vendor_product_odm),-e vendor -e product -e system_ext -e odm --xml-output, \
 	      $(if $(filter $(1),xml_excluded_system_product_odm),-e system -e product -e system_ext -e odm --xml-output, \
@@ -2132,13 +2132,12 @@
 	$(hide) cat $(INSTALLED_SYSTEM_EXT_BUILD_PROP_TARGET) >> $@
 	$(call append-recovery-ui-properties,$(PRIVATE_RECOVERY_UI_PROPERTIES),$@)
 
-ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
-  INTERNAL_RECOVERYIMAGE_ARGS := \
-      --kernel $(recovery_kernel) --ramdisk $(recovery_ramdisk)
+ifeq (truetrue,$(strip $(BUILDING_VENDOR_BOOT_IMAGE))$(strip $(AB_OTA_UPDATER)))
+  INTERNAL_RECOVERYIMAGE_ARGS := --ramdisk $(recovery_ramdisk)
 ifdef GENERIC_KERNEL_CMDLINE
   INTERNAL_RECOVERYIMAGE_ARGS += --cmdline "$(GENERIC_KERNEL_CMDLINE)"
 endif
-else # INSTALLED_VENDOR_BOOTIMAGE_TARGET not defined
+else # not (BUILDING_VENDOR_BOOT_IMAGE and AB_OTA_UPDATER)
   INTERNAL_RECOVERYIMAGE_ARGS := \
       $(addprefix --second ,$(INSTALLED_2NDBOOTLOADER_TARGET)) \
       --ramdisk $(recovery_ramdisk)
@@ -2166,6 +2165,9 @@
   INTERNAL_RECOVERYIMAGE_ARGS += --dtb $(INSTALLED_DTBIMAGE_TARGET)
 endif
 endif # INSTALLED_VENDOR_BOOTIMAGE_TARGET not defined
+ifndef BOARD_RECOVERY_MKBOOTIMG_ARGS
+  BOARD_RECOVERY_MKBOOTIMG_ARGS := $(BOARD_MKBOOTIMG_ARGS)
+endif
 
 $(recovery_ramdisk): $(MKBOOTFS) $(MINIGZIP) \
 	    $(INTERNAL_ROOT_FILES) \
@@ -2208,11 +2210,11 @@
 # $(2): kernel file
 define build-recoveryimage-target
   $(if $(filter true,$(PRODUCT_SUPPORTS_VBOOT)), \
-    $(MKBOOTIMG) --kernel $(2) $(MKBOOTIMG_KERNEL_ARG) $(INTERNAL_RECOVERYIMAGE_ARGS) \
-                 $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) \
+    $(MKBOOTIMG) --kernel $(2) $(INTERNAL_RECOVERYIMAGE_ARGS) \
+                 $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_RECOVERY_MKBOOTIMG_ARGS) \
                  --output $(1).unsigned, \
-    $(MKBOOTIMG) --kernel $(2) $(MKBOOTIMG_KERNEL_ARG) $(INTERNAL_RECOVERYIMAGE_ARGS) \
-                 $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) \
+    $(MKBOOTIMG) --kernel $(2) $(INTERNAL_RECOVERYIMAGE_ARGS) \
+                 $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_RECOVERY_MKBOOTIMG_ARGS) \
                  --output $(1))
   $(if $(filter true,$(PRODUCT_SUPPORTS_BOOT_SIGNER)),\
     $(if $(filter true,$(BOARD_USES_RECOVERY_AS_BOOT)),\
@@ -2568,7 +2570,12 @@
 # can only be used if the device is unlocked with verification error.
 ifneq ($(strip $(TARGET_NO_KERNEL)),true)
 
-INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot-test-harness.img
+ifneq ($(strip $(BOARD_KERNEL_BINARIES)),)
+  INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET := $(foreach k,$(subst kernel,boot-test-harness,$(BOARD_KERNEL_BINARIES)), \
+    $(PRODUCT_OUT)/$(k).img)
+else
+  INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET := $(PRODUCT_OUT)/boot-test-harness.img
+endif
 
 # Replace ramdisk-debug.img in $(MKBOOTIMG) ARGS with ramdisk-test-harness.img to build boot-test-harness.img
 INTERNAL_TEST_HARNESS_BOOTIMAGE_ARGS := $(subst $(INSTALLED_DEBUG_RAMDISK_TARGET),$(INSTALLED_TEST_HARNESS_RAMDISK_TARGET),$(INTERNAL_DEBUG_BOOTIMAGE_ARGS))
@@ -2581,17 +2588,22 @@
 $(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET): $(AVBTOOL) $(BOARD_AVB_BOOT_TEST_KEY_PATH)
 endif
 
+# $(1): output file
+define build-boot-test-harness-target
+  $(MKBOOTIMG) --kernel $(PRODUCT_OUT)/$(subst .img,,$(subst boot-test-harness,kernel,$(notdir $(1)))) \
+    $(INTERNAL_TEST_HARNESS_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $@
+  $(if $(BOARD_AVB_BOOT_KEY_PATH),$(call test-key-sign-bootimage,$@))
+endef
+
 # Build the new boot-test-harness.img, based on boot-debug.img and ramdisk-test-harness.img.
 $(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET): $(MKBOOTIMG) $(INSTALLED_DEBUG_BOOTIMAGE_TARGET) $(INSTALLED_TEST_HARNESS_RAMDISK_TARGET)
 	$(call pretty,"Target boot test harness image: $@")
-	$(MKBOOTIMG) $(INTERNAL_TEST_HARNESS_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $@
-	$(if $(BOARD_AVB_BOOT_KEY_PATH),$(call test-key-sign-bootimage,$@))
+	$(call build-boot-test-harness-target,$@)
 
 .PHONY: bootimage_test_harness-nodeps
 bootimage_test_harness-nodeps: $(MKBOOTIMG)
 	echo "make $@: ignoring dependencies"
-	$(MKBOOTIMG) $(INTERNAL_TEST_HARNESS_BOOTIMAGE_ARGS) $(INTERNAL_MKBOOTIMG_VERSION_ARGS) $(BOARD_MKBOOTIMG_ARGS) --output $(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET)
-	$(if $(BOARD_AVB_BOOT_KEY_PATH),$(call test-key-sign-bootimage,$(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET)))
+	$(foreach b,$(INSTALLED_TEST_HARNESS_BOOTIMAGE_TARGET),$(call build-boot-test-harness-target,$b))
 
 endif # TARGET_NO_KERNEL
 endif # BOARD_BUILD_SYSTEM_ROOT_IMAGE is not true
@@ -2753,10 +2765,10 @@
 endif # INSTALLED_RECOVERYIMAGE_TARGET
 endif # INSTALLED_BOOTIMAGE_TARGET
 
-$(INSTALLED_SYSTEMIMAGE_TARGET): $(BUILT_SYSTEMIMAGE) $(RECOVERY_FROM_BOOT_PATCH)
+$(INSTALLED_SYSTEMIMAGE_TARGET): $(BUILT_SYSTEMIMAGE)
 	@echo "Install system fs image: $@"
 	$(copy-file-to-target)
-	$(hide) $(call assert-max-image-size,$@ $(RECOVERY_FROM_BOOT_PATCH),$(BOARD_SYSTEMIMAGE_PARTITION_SIZE))
+	$(hide) $(call assert-max-image-size,$@,$(BOARD_SYSTEMIMAGE_PARTITION_SIZE))
 
 systemimage: $(INSTALLED_SYSTEMIMAGE_TARGET)
 
@@ -3118,7 +3130,7 @@
       $(BUILD_IMAGE) \
           $(TARGET_OUT_VENDOR) $(vendorimage_intermediates)/vendor_image_info.txt \
           $(INSTALLED_VENDORIMAGE_TARGET) $(TARGET_OUT)
-  $(call assert-max-image-size,$(INSTALLED_VENDORIMAGE_TARGET),$(BOARD_VENDORIMAGE_PARTITION_SIZE))
+  $(call assert-max-image-size,$(INSTALLED_VENDORIMAGE_TARGET) $(RECOVERY_FROM_BOOT_PATCH),$(BOARD_VENDORIMAGE_PARTITION_SIZE))
 endef
 
 # We just build this directly to the install location.
@@ -3126,7 +3138,8 @@
 $(INSTALLED_VENDORIMAGE_TARGET): \
     $(INTERNAL_USERIMAGES_DEPS) \
     $(INTERNAL_VENDORIMAGE_FILES) \
-    $(INSTALLED_FILES_FILE_VENDOR)
+    $(INSTALLED_FILES_FILE_VENDOR) \
+    $(RECOVERY_FROM_BOOT_PATCH)
 	$(build-vendorimage-target)
 
 .PHONY: vendorimage-nodeps vnod
@@ -3509,8 +3522,12 @@
 endef
 
 ifdef INSTALLED_BOOTIMAGE_TARGET
+# multiple hashes for an image are not yet supported, fortunately this
+# only arises for GKI where the boot descriptor can be left out
+ifeq ($(strip $(BOARD_KERNEL_BINARIES)),)
 $(eval $(call check-and-set-avb-args,boot))
 endif
+endif
 
 ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
 $(eval $(call check-and-set-avb-args,vendor_boot))
@@ -4166,6 +4183,8 @@
 endif
 ifeq ($(INSTALLED_BOOTIMAGE_TARGET),)
 	$(hide) echo "no_boot=true" >> $@
+else
+	echo "boot_images=$(foreach b,$(INSTALLED_BOOTIMAGE_TARGET),$(notdir $(b)))" >> $@
 endif
 ifneq ($(INSTALLED_VENDOR_BOOTIMAGE_TARGET),)
 	echo "vendor_boot=true" >> $@
@@ -4195,6 +4214,7 @@
 	$(hide) echo "extra_recovery_keys=$(PRODUCT_EXTRA_RECOVERY_KEYS)" >> $@
 endif
 	$(hide) echo 'mkbootimg_args=$(BOARD_MKBOOTIMG_ARGS)' >> $@
+	$(hide) echo 'recovery_mkbootimg_args=$(BOARD_RECOVERY_MKBOOTIMG_ARGS)' >> $@
 	$(hide) echo 'mkbootimg_version_args=$(INTERNAL_MKBOOTIMG_VERSION_ARGS)' >> $@
 	$(hide) echo "multistage_support=1" >> $@
 	$(hide) echo "blockimgdiff_versions=3,4" >> $@
@@ -4505,9 +4525,9 @@
 ifdef INSTALLED_KERNEL_TARGET
 	cp $(INSTALLED_KERNEL_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/
 endif
-ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
+ifeq (truetrue,$(strip $(BUILDING_VENDOR_BOOT_IMAGE))$(strip $(AB_OTA_UPDATER)))
 	echo "$(GENERIC_KERNEL_CMDLINE)" > $(zip_root)/$(PRIVATE_RECOVERY_OUT)/cmdline
-else # INSTALLED_VENDOR_BOOTIMAGE_TARGET not defined
+else # not (BUILDING_VENDOR_BOOT_IMAGE and AB_OTA_UPDATER)
 ifdef INSTALLED_2NDBOOTLOADER_TARGET
 	cp $(INSTALLED_2NDBOOTLOADER_TARGET) $(zip_root)/$(PRIVATE_RECOVERY_OUT)/second
 endif
@@ -5187,6 +5207,20 @@
 vendorimage: $(INSTALLED_QEMU_VENDORIMAGE)
 droidcore: $(INSTALLED_QEMU_VENDORIMAGE)
 endif
+
+ifdef INSTALLED_RAMDISK_TARGET
+ifdef INSTALLED_VENDOR_BOOTIMAGE_TARGET
+ifdef INTERNAL_VENDOR_RAMDISK_TARGET
+INSTALLED_QEMU_RAMDISKIMAGE := $(PRODUCT_OUT)/ramdisk-qemu.img
+$(INSTALLED_QEMU_RAMDISKIMAGE): $(INTERNAL_VENDOR_RAMDISK_TARGET) $(INSTALLED_RAMDISK_TARGET)
+	@echo Create ramdisk-qemu.img
+	(cat $(INSTALLED_RAMDISK_TARGET) $(INTERNAL_VENDOR_RAMDISK_TARGET) > $(INSTALLED_QEMU_RAMDISKIMAGE))
+
+droidcore: $(INSTALLED_QEMU_RAMDISKIMAGE)
+endif
+endif
+endif
+
 ifdef INSTALLED_PRODUCTIMAGE_TARGET
 INSTALLED_QEMU_PRODUCTIMAGE := $(PRODUCT_OUT)/product-qemu.img
 $(INSTALLED_QEMU_PRODUCTIMAGE): $(INSTALLED_PRODUCTIMAGE_TARGET) $(MK_QEMU_IMAGE_SH) $(SGDISK_HOST) $(SIMG2IMG)
@@ -5324,6 +5358,7 @@
 	$(APPCOMPAT_ZIP) \
 	$(INSTALLED_SYSTEMIMAGE_TARGET) \
 	$(INSTALLED_QEMU_SYSTEMIMAGE) \
+	$(INSTALLED_QEMU_RAMDISKIMAGE) \
 	$(INSTALLED_QEMU_VENDORIMAGE) \
 	$(QEMU_VERIFIED_BOOT_PARAMS) \
 	$(INSTALLED_USERDATAIMAGE_TARGET) \
diff --git a/core/app_prebuilt_internal.mk b/core/app_prebuilt_internal.mk
index 05d9001..ab574b3 100644
--- a/core/app_prebuilt_internal.mk
+++ b/core/app_prebuilt_internal.mk
@@ -163,6 +163,19 @@
   $(built_module) : $(LOCAL_CERTIFICATE).pk8 $(LOCAL_CERTIFICATE).x509.pem
   $(built_module) : PRIVATE_PRIVATE_KEY := $(LOCAL_CERTIFICATE).pk8
   $(built_module) : PRIVATE_CERTIFICATE := $(LOCAL_CERTIFICATE).x509.pem
+
+  additional_certificates := $(foreach c,$(LOCAL_ADDITIONAL_CERTIFICATES), $(c).x509.pem $(c).pk8)
+  $(built_module): $(additional_certificates)
+  $(built_module): PRIVATE_ADDITIONAL_CERTIFICATES := $(additional_certificates)
+
+  $(built_module): $(LOCAL_CERTIFICATE_LINEAGE)
+  $(built_module): PRIVATE_CERTIFICATE_LINEAGE := $(LOCAL_CERTIFICATE_LINEAGE)
+endif
+
+ifneq ($(LOCAL_MODULE_STEM),)
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
+else
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
 endif
 
 include $(BUILD_SYSTEM)/app_certificate_validate.mk
diff --git a/core/aux_config.mk b/core/aux_config.mk
deleted file mode 100644
index 10d2536..0000000
--- a/core/aux_config.mk
+++ /dev/null
@@ -1,187 +0,0 @@
-variant_list := $(filter AUX-%,$(MAKECMDGOALS))
-
-ifdef variant_list
-AUX_OS_VARIANT_LIST := $(patsubst AUX-%,%,$(variant_list))
-else
-AUX_OS_VARIANT_LIST := $(TARGET_AUX_OS_VARIANT_LIST)
-endif
-
-# exclude AUX targets from build
-ifeq ($(AUX_OS_VARIANT_LIST),none)
-AUX_OS_VARIANT_LIST :=
-endif
-
-# temporary workaround to support external toolchain
-ifeq ($(NANOHUB_TOOLCHAIN),)
-AUX_OS_VARIANT_LIST :=
-endif
-
-# setup toolchain paths for various CPU architectures
-# this one will come from android prebuilts eventually
-AUX_TOOLCHAIN_cortexm4 := $(NANOHUB_TOOLCHAIN)
-ifeq ($(wildcard $(AUX_TOOLCHAIN_cortexm4)gcc),)
-AUX_TOOLCHAIN_cortexm4:=
-endif
-
-# there is no MAKE var that defines path to HOST toolchain
-# all the interesting paths are hardcoded in soong, and are not available from here
-# There is no other way but to hardcode them again, as we may need host x86 toolcain for AUX
-ifeq ($(HOST_OS),linux)
-AUX_TOOLCHAIN_x86 := prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.15-4.8/bin/x86_64-linux-
-endif
-
-# setup AUX globals
-AUX_SHLIB_SUFFIX := .so
-AUX_GLOBAL_ARFLAGS := crsPD
-AUX_STATIC_LIB_SUFFIX := .a
-
-# Load ever-lasting "indexed" version of AUX variant environment; it is treated as READ-ONLY from this
-# moment on.
-#
-# $(1) - variant
-# no return value
-define aux-variant-setup-paths
-$(eval AUX_OUT_ROOT_$(1) := $(PRODUCT_OUT)/aux/$(1)) \
-$(eval AUX_COMMON_OUT_ROOT_$(1) := $(AUX_OUT_ROOT_$(1))/common) \
-$(eval AUX_OUT_$(1) := $(AUX_OUT_ROOT_$(1))/$(AUX_OS_$(1))-$(AUX_ARCH_$(1))-$(AUX_CPU_$(1))) \
-$(eval AUX_OUT_INTERMEDIATES_$(1) := $(AUX_OUT_$(1))/obj) \
-$(eval AUX_OUT_COMMON_INTERMEDIATES_$(1) := $(AUX_COMMON_OUT_ROOT_$(1))/obj) \
-$(eval AUX_OUT_HEADERS_$(1) := $(AUX_OUT_INTERMEDIATES_$(1))/include) \
-$(eval AUX_OUT_NOTICE_FILES_$(1) := $(AUX_OUT_INTERMEDIATES_$(1))/NOTICE_FILES) \
-$(eval AUX_OUT_FAKE_$(1) := $(AUX_OUT_$(1))/fake_packages) \
-$(eval AUX_OUT_GEN_$(1) := $(AUX_OUT_$(1))/gen) \
-$(eval AUX_OUT_COMMON_GEN_$(1) := $(AUX_COMMON_OUT_ROOT_$(1))/gen) \
-$(eval AUX_OUT_EXECUTABLES_$(1) := $(AUX_OUT_$(1))/bin) \
-$(eval AUX_OUT_UNSTRIPPED_$(1) := $(AUX_OUT_$(1))/symbols)
-endef
-
-# Copy "indexed" AUX environment for given VARIANT into
-# volatile not-indexed set of variables for simplicity of access.
-# Injection of index support throughout the build system is suboptimal
-# hence volatile environment is constructed
-# Unlike HOST*, TARGET* variables, AUX* variables are NOT read-only, but their
-# indexed versions are.
-#
-# $(1) - variant
-# no return value
-define aux-variant-load-env
-$(eval AUX_OS_VARIANT:=$(1)) \
-$(eval AUX_OS:=$(AUX_OS_$(1))) \
-$(eval AUX_ARCH:=$(AUX_ARCH_$(1))) \
-$(eval AUX_SUBARCH:=$(AUX_SUBARCH_$(1))) \
-$(eval AUX_CPU:=$(AUX_CPU_$(1))) \
-$(eval AUX_OS_PATH:=$(AUX_OS_PATH_$(1))) \
-$(eval AUX_OUT_ROOT := $(AUX_OUT_ROOT_$(1))) \
-$(eval AUX_COMMON_OUT_ROOT := $(AUX_COMMON_OUT_ROOT_$(1))) \
-$(eval AUX_OUT := $(AUX_OUT_$(1))) \
-$(eval AUX_OUT_INTERMEDIATES := $(AUX_OUT_INTERMEDIATES_$(1))) \
-$(eval AUX_OUT_COMMON_INTERMEDIATES := $(AUX_OUT_COMMON_INTERMEDIATES_$(1))) \
-$(eval AUX_OUT_HEADERS := $(AUX_OUT_HEADERS_$(1))) \
-$(eval AUX_OUT_NOTICE_FILES := $(AUX_OUT_NOTICE_FILES_$(1))) \
-$(eval AUX_OUT_FAKE := $(AUX_OUT_FAKE_$(1))) \
-$(eval AUX_OUT_GEN := $(AUX_OUT_GEN_$(1))) \
-$(eval AUX_OUT_COMMON_GEN := $(AUX_OUT_COMMON_GEN_$(1))) \
-$(eval AUX_OUT_EXECUTABLES := $(AUX_OUT_EXECUTABLES_$(1))) \
-$(eval AUX_OUT_UNSTRIPPED := $(AUX_OUT_UNSTRIPPED_$(1)))
-endef
-
-# given a variant:path pair, load the variant conviguration with aux-variant-setup-paths from file
-# this is a build system extension mechainsm, since configuration typically resides in non-build
-# project space
-#
-# $(1) - variant:path pair
-# $(2) - file suffix
-# no return value
-define aux-variant-import-from-pair
-$(eval _pair := $(subst :, ,$(1))) \
-$(eval _name:=$(word 1,$(_pair))) \
-$(eval _path:=$(word 2,$(_pair))) \
-$(eval include $(_path)/$(_name)$(2)) \
-$(eval AUX_OS_VARIANT_LIST_$(AUX_OS_$(1)):=) \
-$(call aux-variant-setup-paths,$(_name)) \
-$(eval AUX_ALL_VARIANTS += $(_name)) \
-$(eval AUX_ALL_OSES := $(filter-out $(AUX_OS_$(_name)),$(AUX_ALL_OSES)) $(AUX_OS_$(_name))) \
-$(eval AUX_ALL_CPUS := $(filter-out $(AUX_CPU_$(_name)),$(AUX_ALL_CPUS)) $(AUX_CPU_$(_name))) \
-$(eval AUX_ALL_ARCHS := $(filter-out $(AUX_ARCH_$(_name)),$(AUX_ALL_ARCHS)) $(AUX_ARCH_$(_name))) \
-$(eval AUX_ALL_SUBARCHS := $(filter-out $(AUX_SUBARCH_$(_name)),$(AUX_ALL_SUBARCHS)) $(AUX_SUBARCH_$(_name)))
-endef
-
-# Load system configuration referenced by AUX variant config;
-# this is a build extension mechanism; typically system config
-# resides in a non-build projects;
-# system config may define new rules and globally visible BUILD*
-# includes to support project-specific build steps and toolchains
-# MAintains list of valiants that reference this os config in OS "indexed" var
-# this facilitates multivariant build of the OS (or whataver it is the name of common component these variants share)
-#
-# $(1) - variant
-# no return value
-define aux-import-os-config
-$(eval _aioc_os := $(AUX_OS_$(1))) \
-$(eval AUX_OS_PATH_$(1) := $(patsubst $(_aioc_os):%,%,$(filter $(_aioc_os):%,$(AUX_ALL_OS_PATHS)))) \
-$(eval _aioc_os_cfg := $(AUX_OS_PATH_$(1))/$(_aioc_os)$(os_sfx)) \
-$(if $(wildcard $(_aioc_os_cfg)),,$(error AUX '$(_aioc_os)' OS config file [$(notdir $(_aioc_os_cfg))] required by AUX variant '$(1)' does not exist)) \
-$(if $(filter $(_aioc_os),$(_os_list)),,$(eval include $(_aioc_os_cfg))) \
-$(eval AUX_OS_VARIANT_LIST_$(_aioc_os) += $(1)) \
-$(eval _os_list += $(_aioc_os))
-endef
-
-# make sure that AUX config variables are minimally sane;
-# as a bare minimum they must contain the vars described by aux_env
-# Generate error if requirement is not met.
-#
-#$(1) - variant
-# no return value
-define aux-variant-validate
-$(eval _all:=) \
-$(eval _req:=$(addsuffix _$(1),$(aux_env))) \
-$(foreach var,$(_req),$(eval _all += $(var))) \
-$(eval _missing := $(filter-out $(_all),$(_req))) \
-$(if $(_missing),$(error AUX variant $(1) must define vars: $(_missing)))
-endef
-
-AUX_ALL_VARIANTS :=
-AUX_ALL_OSES :=
-AUX_ALL_CPUS :=
-AUX_ALL_ARCHS :=
-AUX_ALL_SUBARCHS :=
-
-variant_sfx :=_aux_variant_config.mk
-os_sfx :=_aux_os_config.mk
-
-ifdef AUX_OS_VARIANT_LIST
-
-config_roots := $(wildcard device vendor)
-all_configs :=
-ifdef config_roots
-all_configs := $(sort $(shell find $(config_roots) -maxdepth 4 -name '*$(variant_sfx)' -o -name '*$(os_sfx)'))
-endif
-all_os_configs := $(filter %$(os_sfx),$(all_configs))
-all_variant_configs := $(filter %$(variant_sfx),$(all_configs))
-
-AUX_ALL_OS_PATHS := $(foreach f,$(all_os_configs),$(patsubst %$(os_sfx),%,$(notdir $(f))):$(patsubst %/,%,$(dir $(f))))
-AUX_ALL_OS_VARIANT_PATHS := $(foreach f,$(all_variant_configs),$(patsubst %$(variant_sfx),%,$(notdir $(f))):$(patsubst %/,%,$(dir $(f))))
-
-my_variant_pairs := $(foreach v,$(AUX_OS_VARIANT_LIST),$(filter $(v):%,$(AUX_ALL_OS_VARIANT_PATHS)))
-my_missing_variants := $(foreach v,$(AUX_OS_VARIANT_LIST),$(if $(filter $(v):%,$(AUX_ALL_OS_VARIANT_PATHS)),,$(v)))
-
-ifneq ($(strip $(my_missing_variants)),)
-$(error Don't know how to build variant(s): $(my_missing_variants))
-endif
-
-# mandatory variables
-aux_env := AUX_OS AUX_ARCH AUX_SUBARCH AUX_CPU
-
-$(foreach v,$(my_variant_pairs),$(if $(filter $(v),$(AUX_ALL_VARIANTS)),,$(call aux-variant-import-from-pair,$(v),$(variant_sfx))))
-
-ifdef AUX_ALL_VARIANTS
-_os_list :=
-$(foreach v,$(AUX_ALL_VARIANTS),\
-  $(call aux-import-os-config,$(v)) \
-  $(call aux-variant-validate,$(v)) \
-)
-endif
-
-endif # AUX_OS_VARIANT_LIST
-
-INSTALLED_AUX_TARGETS :=
diff --git a/core/aux_executable.mk b/core/aux_executable.mk
deleted file mode 100644
index 5395e61..0000000
--- a/core/aux_executable.mk
+++ /dev/null
@@ -1,95 +0,0 @@
-# caller might have included aux_toolchain, e.g. if custom build steps are defined
-ifeq ($(LOCAL_IS_AUX_MODULE),)
-include $(BUILD_SYSTEM)/aux_toolchain.mk
-endif
-
-ifeq ($(AUX_BUILD_NOT_COMPATIBLE),)
-
-###########################################################
-## Standard rules for building an executable file.
-##
-## Additional inputs from base_rules.make:
-## None.
-###########################################################
-
-ifeq ($(strip $(LOCAL_MODULE_CLASS)),)
-LOCAL_MODULE_CLASS := EXECUTABLES
-endif
-
-$(call $(aux-executable-hook))
-
-###########################################################
-## Standard rules for building any target-side binaries
-## with dynamic linkage (dynamic libraries or executables
-## that link with dynamic libraries)
-##
-## Files including this file must define a rule to build
-## the target $(linked_module).
-###########################################################
-
-# The name of the target file, without any path prepended.
-# This duplicates logic from base_rules.mk because we need to
-# know its results before base_rules.mk is included.
-include $(BUILD_SYSTEM)/configure_module_stem.mk
-
-intermediates := $(call local-intermediates-dir)
-
-# Define the target that is the unmodified output of the linker.
-# The basename of this target must be the same as the final output
-# binary name, because it's used to set the "soname" in the binary.
-# The includer of this file will define a rule to build this target.
-linked_module := $(intermediates)/LINKED/$(my_built_module_stem)
-
-ALL_ORIGINAL_DYNAMIC_BINARIES += $(linked_module)
-
-# Because AUX_SYMBOL_FILTER_FILE depends on ALL_ORIGINAL_DYNAMIC_BINARIES,
-# the linked_module rules won't necessarily inherit the PRIVATE_
-# variables from LOCAL_BUILT_MODULE.  This tells binary.make to explicitly
-# define the PRIVATE_ variables for linked_module as well as for
-# LOCAL_BUILT_MODULE.
-LOCAL_INTERMEDIATE_TARGETS += $(linked_module)
-
-###################################
-include $(BUILD_SYSTEM)/binary.mk
-###################################
-
-aux_output := $(linked_module)
-
-ifneq ($(LOCAL_CUSTOM_BUILD_STEP_INPUT),)
-ifneq ($(LOCAL_CUSTOM_BUILD_STEP_OUTPUT),)
-
-# injecting custom build steps
-$(LOCAL_CUSTOM_BUILD_STEP_INPUT): $(aux_output)
-	@echo "$(AUX_DISPLAY) custom copy: $(PRIVATE_MODULE) ($@)"
-	@mkdir -p $(dir $@)
-	$(hide) $(copy-file-to-target)
-
-aux_output := $(LOCAL_CUSTOM_BUILD_STEP_OUTPUT)
-
-endif
-endif
-
-$(LOCAL_BUILT_MODULE): $(aux_output)
-	@echo "$(AUX_DISPLAY) final copy: $(PRIVATE_MODULE) ($@)"
-	@mkdir -p $(dir $@)
-	$(hide) $(copy-file-to-target)
-
-INSTALLED_AUX_TARGETS += $(LOCAL_INSTALLED_MODULE)
-
-$(cleantarget): PRIVATE_CLEAN_FILES += \
-    $(linked_module) \
-
-# Define PRIVATE_ variables from global vars
-$(linked_module): PRIVATE_POST_LINK_CMD := $(LOCAL_POST_LINK_CMD)
-
-ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
-$(linked_module): $(all_objects) $(all_libraries) $(LOCAL_ADDITIONAL_DEPENDENCIES)
-	$(transform-o-to-aux-static-executable)
-	$(PRIVATE_POST_LINK_CMD)
-else
-$(linked_module): $(all_objects) $(all_libraries) $(LOCAL_ADDITIONAL_DEPENDENCIES)
-	$(transform-o-to-aux-executable)
-	$(PRIVATE_POST_LINK_CMD)
-endif
-
-endif # AUX_BUILD_NOT_COMPATIBLE
diff --git a/core/aux_static_library.mk b/core/aux_static_library.mk
deleted file mode 100644
index d88478d..0000000
--- a/core/aux_static_library.mk
+++ /dev/null
@@ -1,27 +0,0 @@
-ifeq ($(LOCAL_IS_AUX_MODULE),)
-include $(BUILD_SYSTEM)/aux_toolchain.mk
-endif
-
-ifeq ($(AUX_BUILD_NOT_COMPATIBLE),)
-
-ifeq ($(strip $(LOCAL_MODULE_CLASS)),)
-LOCAL_MODULE_CLASS := STATIC_LIBRARIES
-endif
-ifeq ($(strip $(LOCAL_MODULE_SUFFIX)),)
-LOCAL_MODULE_SUFFIX := .a
-endif
-
-LOCAL_UNINSTALLABLE_MODULE := true
-
-ifneq ($(strip $(LOCAL_MODULE_STEM)$(LOCAL_BUILT_MODULE_STEM)),)
-$(error $(LOCAL_PATH): Cannot set module stem for a library)
-endif
-
-include $(BUILD_SYSTEM)/binary.mk
-
-$(LOCAL_BUILT_MODULE) : PRIVATE_AR := $(AUX_AR)
-$(LOCAL_BUILT_MODULE) : $(built_whole_libraries)
-$(LOCAL_BUILT_MODULE) : $(all_objects)
-	$(transform-o-to-aux-static-lib)
-
-endif # AUX_BUILD_NOT_COMPATIBLE
diff --git a/core/aux_toolchain.mk b/core/aux_toolchain.mk
deleted file mode 100644
index c710228..0000000
--- a/core/aux_toolchain.mk
+++ /dev/null
@@ -1,52 +0,0 @@
-###########################################################
-# takes form LOCAL_AUX_TOOLCHAIN_$(LOCAL_AUX_CPU)
-###########################################################
-
-###############################
-# setup AUX environment
-###############################
-
-# shortcuts for targets with a single instance of OS, ARCH, VARIANT, CPU
-AUX_TOOLCHAIN := $(if $(LOCAL_AUX_TOOLCHAIN),$(LOCAL_AUX_TOOLCHAIN),$(AUX_TOOLCHAIN_$(AUX_CPU)))
-AUX_BUILD_NOT_COMPATIBLE:=
-ifeq ($(strip $(AUX_TOOLCHAIN)),)
-  ifeq ($(strip $(AUX_CPU)),)
-    $(warning $(LOCAL_PATH): $(LOCAL_MODULE): Undefined CPU for AUX toolchain)
-    AUX_BUILD_NOT_COMPATIBLE += TOOLCHAIN
-  else
-    $(warning $(LOCAL_PATH): $(LOCAL_MODULE): Undefined AUX toolchain for CPU=$(AUX_CPU))
-    AUX_BUILD_NOT_COMPATIBLE += TOOLCHAIN
-  endif
-endif
-
-AUX_BUILD_NOT_COMPATIBLE += $(foreach var,OS ARCH SUBARCH CPU OS_VARIANT,$(if $(LOCAL_AUX_$(var)),$(if \
-    $(filter $(LOCAL_AUX_$(var)),$(AUX_$(var))),,$(var))))
-
-AUX_BUILD_NOT_COMPATIBLE := $(strip $(AUX_BUILD_NOT_COMPATIBLE))
-
-ifneq ($(AUX_BUILD_NOT_COMPATIBLE),)
-$(info $(LOCAL_PATH): $(LOCAL_MODULE): not compatible: "$(AUX_BUILD_NOT_COMPATIBLE)" with)
-$(info ====> OS=$(AUX_OS) CPU=$(AUX_CPU) ARCH=$(AUX_ARCH) SUBARCH=$(AUX_SUBARCH) OS_VARIANT=$(AUX_OS_VARIANT))
-$(info ====> TOOLCHAIN=$(AUX_TOOLCHAIN))
-endif
-
-AUX_AR := $(AUX_TOOLCHAIN)ar
-AUX_AS := $(AUX_TOOLCHAIN)gcc
-AUX_CC := $(AUX_TOOLCHAIN)gcc
-AUX_CXX := $(AUX_TOOLCHAIN)g++
-AUX_LINKER := $(AUX_TOOLCHAIN)ld
-AUX_OBJCOPY := $(AUX_TOOLCHAIN)objcopy
-AUX_OBJDUMP := $(AUX_TOOLCHAIN)objdump
-
-###############################
-# setup Android environment
-###############################
-
-LOCAL_IS_AUX_MODULE := true
-LOCAL_2ND_ARCH_VAR_PREFIX :=
-LOCAL_CC := $(AUX_CC)
-LOCAL_CXX := $(AUX_CXX)
-LOCAL_NO_DEFAULT_COMPILER_FLAGS := true
-LOCAL_SYSTEM_SHARED_LIBRARIES :=
-LOCAL_CXX_STL := none
-LOCAL_NO_PIC := true
diff --git a/core/base_rules.mk b/core/base_rules.mk
index f78e509..f5e8e35 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -34,7 +34,6 @@
 $(call verify-module-name)
 
 LOCAL_IS_HOST_MODULE := $(strip $(LOCAL_IS_HOST_MODULE))
-LOCAL_IS_AUX_MODULE := $(strip $(LOCAL_IS_AUX_MODULE))
 ifdef LOCAL_IS_HOST_MODULE
   ifneq ($(LOCAL_IS_HOST_MODULE),true)
     $(error $(LOCAL_PATH): LOCAL_IS_HOST_MODULE must be "true" or empty, not "$(LOCAL_IS_HOST_MODULE)")
@@ -47,16 +46,8 @@
   my_host := host-
   my_kind := HOST
 else
-  ifdef LOCAL_IS_AUX_MODULE
-    ifneq ($(LOCAL_IS_AUX_MODULE),true)
-      $(error $(LOCAL_PATH): LOCAL_IS_AUX_MODULE must be "true" or empty, not "$(LOCAL_IS_AUX_MODULE)")
-    endif
-    my_prefix := AUX_
-    my_kind := AUX
-  else
-    my_prefix := TARGET_
-    my_kind :=
-  endif
+  my_prefix := TARGET_
+  my_kind :=
   my_host :=
 endif
 
@@ -206,6 +197,7 @@
 endif
 my_module_path := $(patsubst %/,%,$(my_module_path))
 my_module_relative_path := $(strip $(LOCAL_MODULE_RELATIVE_PATH))
+
 ifdef LOCAL_IS_HOST_MODULE
   partition_tag :=
   actual_partition_tag :=
@@ -316,12 +308,9 @@
   my_all_targets := device_$(my_register_name)_all_targets
 endif
 
-# variant is enough to make nano class unique; it serves as a key to lookup (OS,ARCH) tuple
-aux_class := $($(my_prefix)OS_VARIANT)
 # Make sure that this IS_HOST/CLASS/MODULE combination is unique.
 module_id := MODULE.$(if \
-    $(LOCAL_IS_HOST_MODULE),$($(my_prefix)OS),$(if \
-    $(LOCAL_IS_AUX_MODULE),$(aux_class),TARGET)).$(LOCAL_MODULE_CLASS).$(my_register_name)
+    $(LOCAL_IS_HOST_MODULE),$($(my_prefix)OS),TARGET).$(LOCAL_MODULE_CLASS).$(my_register_name)
 ifdef $(module_id)
 $(error $(LOCAL_PATH): $(module_id) already defined by $($(module_id)))
 endif
@@ -357,16 +346,16 @@
 ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
   # Apk and its attachments reside in its own subdir.
   ifeq ($(LOCAL_MODULE_CLASS),APPS)
-  # framework-res.apk doesn't like the additional layer.
-  ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
-  # Neither do Runtime Resource Overlay apks, which contain just the overlaid resources.
-  else ifeq ($(LOCAL_IS_RUNTIME_RESOURCE_OVERLAY),true)
-  else
-    ifneq ($(use_testcase_folder),true)
-      my_module_path := $(my_module_path)/$(LOCAL_MODULE)
+    # framework-res.apk doesn't like the additional layer.
+    ifeq ($(LOCAL_NO_STANDARD_LIBRARIES),true)
+      # Neither do Runtime Resource Overlay apks, which contain just the overlaid resources.
+    else ifeq ($(LOCAL_IS_RUNTIME_RESOURCE_OVERLAY),true)
+    else
+      ifneq ($(use_testcase_folder),true)
+        my_module_path := $(my_module_path)/$(LOCAL_MODULE)
+      endif
     endif
   endif
-  endif
   LOCAL_INSTALLED_MODULE := $(my_module_path)/$(my_installed_module_stem)
 endif
 
@@ -428,7 +417,6 @@
 ###########################################################
 $(LOCAL_INTERMEDIATE_TARGETS) : PRIVATE_PATH:=$(LOCAL_PATH)
 $(LOCAL_INTERMEDIATE_TARGETS) : PRIVATE_IS_HOST_MODULE := $(LOCAL_IS_HOST_MODULE)
-$(LOCAL_INTERMEDIATE_TARGETS) : PRIVATE_IS_AUX_MODULE := $(LOCAL_IS_AUX_MODULE)
 $(LOCAL_INTERMEDIATE_TARGETS) : PRIVATE_HOST:= $(my_host)
 $(LOCAL_INTERMEDIATE_TARGETS) : PRIVATE_PREFIX := $(my_prefix)
 
@@ -597,6 +585,7 @@
 ## Compatibility suite files.
 ###########################################################
 ifdef LOCAL_COMPATIBILITY_SUITE
+ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
 
 # If we are building a native test or benchmark and its stem variants are not defined,
 # separate the multiple architectures into subdirectories of the testcase folder.
@@ -757,6 +746,7 @@
   $(eval my_compat_dist_config_$(suite) := ) \
   $(eval my_compat_dist_test_data_$(suite) := ))
 
+endif  # LOCAL_UNINSTALLABLE_MODULE
 endif  # LOCAL_COMPATIBILITY_SUITE
 
 ###########################################################
@@ -816,6 +806,16 @@
 ALL_MODULES.$(my_register_name).PICKUP_FILES := \
     $(ALL_MODULES.$(my_register_name).PICKUP_FILES) $(LOCAL_PICKUP_FILES)
 endif
+# Record the platform availability of this module. Note that the availability is not
+# meaningful for non-installable modules (e.g., static libs) or host modules.
+# We only care about modules that are installable to the device.
+ifeq (true,$(LOCAL_NOT_AVAILABLE_FOR_PLATFORM))
+  ifneq (true,$(LOCAL_UNINSTALLABLE_MODULE))
+    ifndef LOCAL_IS_HOST_MODULE
+      ALL_MODULES.$(my_register_name).NOT_AVAILABLE_FOR_PLATFORM := true
+    endif
+  endif
+endif
 
 my_required_modules := $(LOCAL_REQUIRED_MODULES) \
     $(LOCAL_REQUIRED_MODULES_$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
@@ -906,7 +906,7 @@
 ##########################################################
 # Track module-level dependencies.
 # Use $(LOCAL_MODULE) instead of $(my_register_name) to ignore module's bitness.
-ifneq (,$(filter deps-license,$(MAKECMDGOALS)))
+ifdef RECORD_ALL_DEPS
 ALL_DEPS.MODULES := $(ALL_DEPS.MODULES) $(LOCAL_MODULE)
 ALL_DEPS.$(LOCAL_MODULE).ALL_DEPS := $(sort \
   $(ALL_DEPS.$(LOCAL_MODULE).ALL_DEPS) \
diff --git a/core/binary.mk b/core/binary.mk
index e021b7d..b14d8b8 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -1136,6 +1136,18 @@
     $(if $(filter $(l),$(VENDOR_PUBLIC_LIBRARIES)),$(l).vendorpublic,$(l)))
 endif
 
+###########################################################
+## When compiling against the NDK, use SDK variants of Soong libraries
+###########################################################
+
+ifneq ($(LOCAL_SDK_VERSION),)
+  my_whole_static_libraries := $(call use_soong_sdk_libraries,$(my_whole_static_libraries))
+  my_static_libraries := $(call use_soong_sdk_libraries,$(my_static_libraries))
+  my_shared_libraries := $(call use_soong_sdk_libraries,$(my_shared_libraries))
+  my_system_shared_libraries := $(call use_soong_sdk_libraries,$(my_system_shared_libraries))
+  my_header_libraries := $(call use_soong_sdk_libraries,$(my_header_libraries))
+endif
+
 ##########################################################
 ## Set up installed module dependency
 ## We cannot compute the full path of the LOCAL_SHARED_LIBRARIES for
@@ -1558,28 +1570,22 @@
 ## Define PRIVATE_ variables from global vars
 ###########################################################
 ifndef LOCAL_IS_HOST_MODULE
+
 ifdef LOCAL_USE_VNDK
-my_target_global_c_includes := \
-    $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_INCLUDES)
-my_target_global_c_system_includes := \
-    $(TARGET_OUT_HEADERS) \
-    $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_SYSTEM_INCLUDES)
+  my_target_global_c_includes :=
+  my_target_global_c_system_includes := $(TARGET_OUT_HEADERS)
 else ifdef LOCAL_SDK_VERSION
-my_target_global_c_includes :=
-my_target_global_c_system_includes := $(my_ndk_stl_include_path) $(my_ndk_sysroot_include)
+  my_target_global_c_includes :=
+  my_target_global_c_system_includes := $(my_ndk_stl_include_path) $(my_ndk_sysroot_include)
 else ifdef BOARD_VNDK_VERSION
-my_target_global_c_includes := $(SRC_HEADERS) \
-    $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_INCLUDES) \
+  my_target_global_c_includes := $(SRC_HEADERS) \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)C_INCLUDES)
-my_target_global_c_system_includes := $(SRC_SYSTEM_HEADERS) \
-    $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_SYSTEM_INCLUDES) \
+  my_target_global_c_system_includes := $(SRC_SYSTEM_HEADERS) \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)C_SYSTEM_INCLUDES)
 else
-my_target_global_c_includes := $(SRC_HEADERS) \
-    $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_INCLUDES) \
+  my_target_global_c_includes := $(SRC_HEADERS) \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)C_INCLUDES)
-my_target_global_c_system_includes := $(SRC_SYSTEM_HEADERS) $(TARGET_OUT_HEADERS) \
-    $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)PROJECT_SYSTEM_INCLUDES) \
+  my_target_global_c_system_includes := $(SRC_SYSTEM_HEADERS) $(TARGET_OUT_HEADERS) \
     $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)C_SYSTEM_INCLUDES)
 endif
 
@@ -1662,9 +1668,22 @@
 ####################################################
 ## Import includes
 ####################################################
+imported_includes :=
+
+ifdef LOCAL_USE_VNDK
+  imported_includes += $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))
+else ifdef LOCAL_SDK_VERSION
+  # Apps shouldn't need device-specific kernel headers
+else ifdef BOARD_VNDK_VERSION
+  # For devices building with the VNDK, only the VNDK gets device-specific kernel headers by default
+  # In soong, it's entirely opt-in
+else
+  # For older non-VNDK builds, continue adding in kernel headers to everything like we used to
+  imported_includes += $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))
+endif
+
 imported_includes := $(strip \
-    $(if $(LOCAL_USE_VNDK),\
-      $(call intermediates-dir-for,HEADER_LIBRARIES,device_kernel_headers,$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))) \
+    $(imported_includes) \
     $(foreach l, $(installed_shared_library_module_names), \
       $(call intermediates-dir-for,SHARED_LIBRARIES,$(l),$(my_kind),,$(LOCAL_2ND_ARCH_VAR_PREFIX),$(my_host_cross))) \
     $(foreach l, $(my_static_libraries) $(my_whole_static_libraries), \
diff --git a/core/board_config.mk b/core/board_config.mk
index da4ba3d..2279c3f 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -366,11 +366,6 @@
     ifneq ($(TARGET_NO_VENDOR_BOOT),true)
       BUILDING_VENDOR_BOOT_IMAGE := true
     endif
-    ifdef BUILDING_RECOVERY_IMAGE
-      ifneq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
-        $(error Boot header version >=3 requires recovery as boot)
-      endif
-    endif
   endif
 endif
 .KATI_READONLY := BUILDING_VENDOR_BOOT_IMAGE
diff --git a/core/check_elf_file.mk b/core/check_elf_file.mk
index da4168d..d54a5b7 100644
--- a/core/check_elf_file.mk
+++ b/core/check_elf_file.mk
@@ -38,6 +38,8 @@
 	    $<
 	$(hide) touch $@
 
+CHECK_ELF_FILES.$(check_elf_files_stamp) := 1
+
 ifneq ($(strip $(LOCAL_CHECK_ELF_FILES)),false)
 ifneq ($(strip $(BUILD_BROKEN_PREBUILT_ELF_FILES)),true)
 $(LOCAL_BUILT_MODULE): $(check_elf_files_stamp)
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index e27d91c..5af0570 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -152,6 +152,7 @@
 LOCAL_JETIFIER_ENABLED:=
 LOCAL_JNI_SHARED_LIBRARIES:=
 LOCAL_JNI_SHARED_LIBRARIES_ABI:=
+LOCAL_CERTIFICATE_LINEAGE:=
 LOCAL_LDFLAGS:=
 LOCAL_LDLIBS:=
 LOCAL_LOGTAGS_FILES:=
@@ -191,6 +192,7 @@
 LOCAL_NOSANITIZE:=
 LOCAL_NO_STANDARD_LIBRARIES:=
 LOCAL_NO_STATIC_ANALYZER:=
+LOCAL_NOT_AVAILABLE_FOR_PLATFORM:=
 LOCAL_NOTICE_FILE:=
 LOCAL_ODM_MODULE:=
 LOCAL_OEM_MODULE:=
@@ -292,7 +294,6 @@
 LOCAL_SYSTEM_SHARED_LIBRARIES:=none
 LOCAL_TARGET_REQUIRED_MODULES:=
 LOCAL_TEST_CONFIG:=
-LOCAL_TEST_CONFIG_OPTIONS:=
 LOCAL_TEST_DATA:=
 LOCAL_TEST_MODULE_TO_PROGUARD_WITH:=
 LOCAL_TIDY:=
@@ -473,17 +474,6 @@
 LOCAL_ROBOTEST_TIMEOUT :=
 LOCAL_TEST_PACKAGE :=
 
-# Aux specific variables
-LOCAL_AUX_ARCH :=
-LOCAL_AUX_CPU :=
-LOCAL_AUX_OS :=
-LOCAL_AUX_OS_VARIANT :=
-LOCAL_AUX_SUBARCH :=
-LOCAL_AUX_TOOLCHAIN :=
-LOCAL_CUSTOM_BUILD_STEP_INPUT:=
-LOCAL_CUSTOM_BUILD_STEP_OUTPUT:=
-LOCAL_IS_AUX_MODULE :=
-
 full_android_manifest :=
 non_system_module :=
 
diff --git a/core/config.mk b/core/config.mk
index b329b0d..8910c11 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -122,6 +122,25 @@
 $(KATI_obsolete_var MD5SUM)
 $(KATI_obsolete_var BOARD_HAL_STATIC_LIBRARIES, See $(CHANGES_URL)#BOARD_HAL_STATIC_LIBRARIES)
 $(KATI_obsolete_var LOCAL_HAL_STATIC_LIBRARIES, See $(CHANGES_URL)#BOARD_HAL_STATIC_LIBRARIES)
+$(KATI_obsolete_var \
+  TARGET_AUX_OS_VARIANT_LIST \
+  LOCAL_AUX_ARCH \
+  LOCAL_AUX_CPU \
+  LOCAL_AUX_OS \
+  LOCAL_AUX_OS_VARIANT \
+  LOCAL_AUX_SUBARCH \
+  LOCAL_AUX_TOOLCHAIN \
+  LOCAL_CUSTOM_BUILD_STEP_INPUT \
+  LOCAL_CUSTOM_BUILD_STEP_OUTPUT \
+  LOCAL_IS_AUX_MODULE \
+  ,AUX support has been removed)
+$(KATI_obsolete_var HOST_OUT_TEST_CONFIG TARGET_OUT_TEST_CONFIG LOCAL_TEST_CONFIG_OPTIONS)
+$(KATI_obsolete_var \
+  TARGET_PROJECT_INCLUDES \
+  2ND_TARGET_PROJECT_INCLUDES \
+  TARGET_PROJECT_SYSTEM_INCLUDES \
+  2ND_TARGET_PROJECT_SYSTEM_INCLUDES \
+  ,Project include variables have been removed)
 
 # Used to force goals to build.  Only use for conditionally defined goals.
 .PHONY: FORCE
@@ -170,8 +189,6 @@
 BUILD_HOST_SHARED_LIBRARY :=$= $(BUILD_SYSTEM)/host_shared_library.mk
 BUILD_STATIC_LIBRARY :=$= $(BUILD_SYSTEM)/static_library.mk
 BUILD_HEADER_LIBRARY :=$= $(BUILD_SYSTEM)/header_library.mk
-BUILD_AUX_STATIC_LIBRARY :=$= $(BUILD_SYSTEM)/aux_static_library.mk
-BUILD_AUX_EXECUTABLE :=$= $(BUILD_SYSTEM)/aux_executable.mk
 BUILD_SHARED_LIBRARY :=$= $(BUILD_SYSTEM)/shared_library.mk
 BUILD_EXECUTABLE :=$= $(BUILD_SYSTEM)/executable.mk
 BUILD_HOST_EXECUTABLE :=$= $(BUILD_SYSTEM)/host_executable.mk
@@ -186,23 +203,12 @@
 BUILD_HOST_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/host_java_library.mk
 BUILD_COPY_HEADERS :=$= $(BUILD_SYSTEM)/copy_headers.mk
 BUILD_NATIVE_TEST :=$= $(BUILD_SYSTEM)/native_test.mk
-BUILD_NATIVE_BENCHMARK :=$= $(BUILD_SYSTEM)/native_benchmark.mk
-BUILD_HOST_NATIVE_TEST :=$= $(BUILD_SYSTEM)/host_native_test.mk
 BUILD_FUZZ_TEST :=$= $(BUILD_SYSTEM)/fuzz_test.mk
-BUILD_HOST_FUZZ_TEST :=$= $(BUILD_SYSTEM)/host_fuzz_test.mk
-
-BUILD_SHARED_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/shared_test_lib.mk
-BUILD_HOST_SHARED_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/host_shared_test_lib.mk
-BUILD_STATIC_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/static_test_lib.mk
-BUILD_HOST_STATIC_TEST_LIBRARY :=$= $(BUILD_SYSTEM)/host_static_test_lib.mk
 
 BUILD_NOTICE_FILE :=$= $(BUILD_SYSTEM)/notice_files.mk
 BUILD_HOST_DALVIK_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/host_dalvik_java_library.mk
 BUILD_HOST_DALVIK_STATIC_JAVA_LIBRARY :=$= $(BUILD_SYSTEM)/host_dalvik_static_java_library.mk
 
-BUILD_HOST_TEST_CONFIG :=$= $(BUILD_SYSTEM)/host_test_config.mk
-BUILD_TARGET_TEST_CONFIG :=$= $(BUILD_SYSTEM)/target_test_config.mk
-
 include $(BUILD_SYSTEM)/deprecation.mk
 
 # ###############################################################
@@ -579,7 +585,7 @@
 # prebuilts/build-tools/common/bison.
 # To run bison from elsewhere you need to set up enviromental variable
 # BISON_PKGDATADIR.
-BISON_PKGDATADIR := $(PWD)/prebuilts/build-tools/common/bison
+BISON_PKGDATADIR := $(prebuilt_build_tools)/common/bison
 BISON := $(prebuilt_build_tools_bin_noasan)/bison
 YACC := $(BISON) -d
 BISON_DATA := $(wildcard $(BISON_PKGDATADIR)/* $(BISON_PKGDATADIR)/*/*)
@@ -1057,16 +1063,6 @@
 RELATIVE_PWD :=
 endif
 
-TARGET_PROJECT_INCLUDES :=
-TARGET_PROJECT_SYSTEM_INCLUDES := \
-		$(TARGET_DEVICE_KERNEL_HEADERS) $(TARGET_BOARD_KERNEL_HEADERS) \
-		$(TARGET_PRODUCT_KERNEL_HEADERS)
-
-ifdef TARGET_2ND_ARCH
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_PROJECT_INCLUDES := $(TARGET_PROJECT_INCLUDES)
-$(TARGET_2ND_ARCH_VAR_PREFIX)TARGET_PROJECT_SYSTEM_INCLUDES := $(TARGET_PROJECT_SYSTEM_INCLUDES)
-endif
-
 # Flags for DEX2OAT
 first_non_empty_of_three = $(if $(1),$(1),$(if $(2),$(2),$(3)))
 DEX2OAT_TARGET_ARCH := $(TARGET_ARCH)
@@ -1149,19 +1145,6 @@
 TARGET_SDK_VERSIONS_WITHOUT_JAVA_18_SUPPORT := $(call numbers_less_than,24,$(TARGET_AVAILABLE_SDK_VERSIONS))
 TARGET_SDK_VERSIONS_WITHOUT_JAVA_19_SUPPORT := $(call numbers_less_than,30,$(TARGET_AVAILABLE_SDK_VERSIONS))
 
-ifndef INTERNAL_PLATFORM_PRIVATE_API_FILE
-INTERNAL_PLATFORM_PRIVATE_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/private.txt
-endif
-ifndef INTERNAL_PLATFORM_PRIVATE_DEX_API_FILE
-INTERNAL_PLATFORM_PRIVATE_DEX_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/private-dex.txt
-endif
-ifndef INTERNAL_PLATFORM_SYSTEM_PRIVATE_API_FILE
-INTERNAL_PLATFORM_SYSTEM_PRIVATE_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/system-private.txt
-endif
-ifndef INTERNAL_PLATFORM_SYSTEM_PRIVATE_DEX_API_FILE
-INTERNAL_PLATFORM_SYSTEM_PRIVATE_DEX_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/system-private-dex.txt
-endif
-
 # Missing optional uses-libraries so that the platform doesn't create build rules that depend on
 # them.
 INTERNAL_PLATFORM_MISSING_USES_LIBRARIES := \
@@ -1231,4 +1214,7 @@
 DEFAULT_DATA_OUT_MODULES := ltp $(ltp_packages) $(kselftest_modules)
 .KATI_READONLY := DEFAULT_DATA_OUT_MODULES
 
+# Make RECORD_ALL_DEPS readonly and also set it if deps-license is a goal.
+RECORD_ALL_DEPS :=$= $(filter true,$(RECORD_ALL_DEPS))$(filter deps-license,$(MAKECMDGOALS))
+
 include $(BUILD_SYSTEM)/dumpvar.mk
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index 8c76a8d..c5cb91c 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -372,8 +372,8 @@
   my_cflags += $(HWADDRESS_SANITIZER_CONFIG_EXTRA_CFLAGS)
 endif
 
-# Use minimal diagnostics when integer overflow is enabled; never do it for HOST or AUX modules
-ifeq ($(LOCAL_IS_HOST_MODULE)$(LOCAL_IS_AUX_MODULE),)
+# Use minimal diagnostics when integer overflow is enabled; never do it for HOST modules
+ifeq ($(LOCAL_IS_HOST_MODULE),)
   # Pre-emptively add UBSAN minimal runtime incase a static library dependency requires it
   ifeq ($(filter STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
     ifndef LOCAL_SDK_VERSION
diff --git a/core/definitions.mk b/core/definitions.mk
index 9eaaa20..1467e96 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -95,7 +95,6 @@
 
 # Display names for various build targets
 TARGET_DISPLAY := target
-AUX_DISPLAY := aux
 HOST_DISPLAY := host
 HOST_CROSS_DISPLAY := host cross
 
@@ -510,23 +509,18 @@
 $(if $(1),$(call reverse-list,$(wordlist 2,$(words $(1)),$(1)))) $(firstword $(1))
 endef
 
-define def-host-aux-target
-$(eval _idf_val_:=$(if $(strip $(LOCAL_IS_HOST_MODULE)),HOST,$(if $(strip $(LOCAL_IS_AUX_MODULE)),AUX,))) \
-$(_idf_val_)
-endef
-
 ###########################################################
 ## Returns correct _idfPrefix from the list:
-##   { HOST, HOST_CROSS, AUX, TARGET }
+##   { HOST, HOST_CROSS, TARGET }
 ###########################################################
 # the following rules checked in order:
-# ($1 is in {AUX, HOST_CROSS} => $1;
+# ($1 is in {HOST_CROSS} => $1;
 # ($1 is empty) => TARGET;
 # ($2 is not empty) => HOST_CROSS;
 # => HOST;
 define find-idf-prefix
 $(strip \
-    $(eval _idf_pfx_:=$(strip $(filter AUX HOST_CROSS,$(1)))) \
+    $(eval _idf_pfx_:=$(strip $(filter HOST_CROSS,$(1)))) \
     $(eval _idf_pfx_:=$(if $(strip $(1)),$(if $(_idf_pfx_),$(_idf_pfx_),$(if $(strip $(2)),HOST_CROSS,HOST)),TARGET)) \
     $(_idf_pfx_)
 )
@@ -542,7 +536,7 @@
 
 # $(1): target class, like "APPS"
 # $(2): target name, like "NotePad"
-# $(3): { HOST, HOST_CROSS, AUX, <empty (TARGET)>, <other non-empty (HOST)> }
+# $(3): { HOST, HOST_CROSS, <empty (TARGET)>, <other non-empty (HOST)> }
 # $(4): if non-empty, force the intermediates to be COMMON
 # $(5): if non-empty, force the intermediates to be for the 2nd arch
 # $(6): if non-empty, force the intermediates to be for the host cross os
@@ -579,7 +573,7 @@
         $(error $(LOCAL_PATH): LOCAL_MODULE_CLASS not defined before call to local-intermediates-dir)) \
     $(if $(strip $(LOCAL_MODULE)),, \
         $(error $(LOCAL_PATH): LOCAL_MODULE not defined before call to local-intermediates-dir)) \
-    $(call intermediates-dir-for,$(LOCAL_MODULE_CLASS),$(LOCAL_MODULE),$(call def-host-aux-target),$(1),$(2),$(3)) \
+    $(call intermediates-dir-for,$(LOCAL_MODULE_CLASS),$(LOCAL_MODULE),$(if $(strip $(LOCAL_IS_HOST_MODULE)),HOST),$(1),$(2),$(3)) \
 )
 endef
 
@@ -594,7 +588,7 @@
 
 # $(1): target class, like "APPS"
 # $(2): target name, like "NotePad"
-# $(3): { HOST, HOST_CROSS, AUX, <empty (TARGET)>, <other non-empty (HOST)> }
+# $(3): { HOST, HOST_CROSS, <empty (TARGET)>, <other non-empty (HOST)> }
 # $(4): if non-empty, force the generated sources to be COMMON
 define generated-sources-dir-for
 $(strip \
@@ -624,7 +618,7 @@
         $(error $(LOCAL_PATH): LOCAL_MODULE_CLASS not defined before call to local-generated-sources-dir)) \
     $(if $(strip $(LOCAL_MODULE)),, \
         $(error $(LOCAL_PATH): LOCAL_MODULE not defined before call to local-generated-sources-dir)) \
-    $(call generated-sources-dir-for,$(LOCAL_MODULE_CLASS),$(LOCAL_MODULE),$(call def-host-aux-target),$(1)) \
+    $(call generated-sources-dir-for,$(LOCAL_MODULE_CLASS),$(LOCAL_MODULE),$(if $(strip $(LOCAL_IS_HOST_MODULE)),HOST),$(1)) \
 )
 endef
 
@@ -1499,89 +1493,6 @@
 $(hide) mv -f $@.tmp $@
 endef
 
-# $(1): the full path of the source static library.
-# $(2): the full path of the destination static library.
-define _extract-and-include-single-aux-whole-static-lib
-$(hide) ldir=$(PRIVATE_INTERMEDIATES_DIR)/WHOLE/$(basename $(notdir $(1)))_objs;\
-    rm -rf $$ldir; \
-    mkdir -p $$ldir; \
-    cp $(1) $$ldir; \
-    lib_to_include=$$ldir/$(notdir $(1)); \
-    filelist=; \
-    subdir=0; \
-    for f in `$(PRIVATE_AR) t $(1)`; do \
-        if [ -e $$ldir/$$f ]; then \
-            mkdir $$ldir/$$subdir; \
-            ext=$$subdir/; \
-            subdir=$$((subdir+1)); \
-            $(PRIVATE_AR) m $$lib_to_include $$f; \
-        else \
-            ext=; \
-        fi; \
-        $(PRIVATE_AR) p $$lib_to_include $$f > $$ldir/$$ext$$f; \
-        filelist="$$filelist $$ldir/$$ext$$f"; \
-    done ; \
-    $(PRIVATE_AR) $(AUX_GLOBAL_ARFLAGS) $(2) $$filelist
-
-endef
-
-define extract-and-include-aux-whole-static-libs
-$(call extract-and-include-whole-static-libs-first, $(firstword $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES)),$(1))
-$(foreach lib,$(wordlist 2,999,$(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES)), \
-    $(call _extract-and-include-single-aux-whole-static-lib, $(lib), $(1)))
-endef
-
-# Explicitly delete the archive first so that ar doesn't
-# try to add to an existing archive.
-define transform-o-to-aux-static-lib
-@echo "$($(PRIVATE_PREFIX)DISPLAY) StaticLib: $(PRIVATE_MODULE) ($@)"
-@mkdir -p $(dir $@)
-@rm -f $@ $@.tmp
-$(call extract-and-include-aux-whole-static-libs,$@.tmp)
-$(call split-long-arguments,$(PRIVATE_AR) \
-    $(AUX_GLOBAL_ARFLAGS) $@.tmp,$(PRIVATE_ALL_OBJECTS))
-$(hide) mv -f $@.tmp $@
-endef
-
-define transform-o-to-aux-executable-inner
-$(hide) $(PRIVATE_CXX_LINK) -pie \
-  -Bdynamic \
-  -Wl,--gc-sections \
-  $(PRIVATE_ALL_OBJECTS) \
-  -Wl,--whole-archive \
-  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-  -Wl,--no-whole-archive \
-  $(PRIVATE_ALL_STATIC_LIBRARIES) \
-  $(PRIVATE_LDFLAGS) \
-  -o $@
-endef
-
-define transform-o-to-aux-executable
-@echo "$(AUX_DISPLAY) Executable: $(PRIVATE_MODULE) ($@)"
-@mkdir -p $(dir $@)
-$(transform-o-to-aux-executable-inner)
-endef
-
-define transform-o-to-aux-static-executable-inner
-$(hide) $(PRIVATE_CXX_LINK) \
-  -Bstatic \
-  -Wl,--gc-sections \
-  $(PRIVATE_ALL_OBJECTS) \
-  -Wl,--whole-archive \
-  $(PRIVATE_ALL_WHOLE_STATIC_LIBRARIES) \
-  -Wl,--no-whole-archive \
-  $(PRIVATE_ALL_STATIC_LIBRARIES) \
-  $(PRIVATE_LDFLAGS) \
-  -Wl,-Map=$(@).map \
-  -o $@
-endef
-
-define transform-o-to-aux-static-executable
-@echo "$(AUX_DISPLAY) StaticExecutable: $(PRIVATE_MODULE) ($@)"
-@mkdir -p $(dir $@)
-$(transform-o-to-aux-static-executable-inner)
-endef
-
 ###########################################################
 ## Commands for running host ar
 ###########################################################
@@ -2093,7 +2004,7 @@
 $(if $(PRIVATE_JAR_EXCLUDE_PACKAGES), $(hide) rm -rf \
     $(foreach pkg, $(PRIVATE_JAR_EXCLUDE_PACKAGES), \
         $(PRIVATE_CLASS_INTERMEDIATES_DIR)/$(subst .,/,$(pkg))))
-$(hide) $(JAR) -cf $@ $(call jar-args-sorted-files-in-directory,$(PRIVATE_CLASS_INTERMEDIATES_DIR))
+$(hide) $(SOONG_ZIP) -jar -o $@ -C $(PRIVATE_CLASS_INTERMEDIATES_DIR) -D $(PRIVATE_CLASS_INTERMEDIATES_DIR)
 $(if $(PRIVATE_EXTRA_JAR_ARGS),$(call add-java-resources-to,$@))
 endef
 
@@ -2285,6 +2196,7 @@
 define sign-package-arg
 $(hide) mv $(1) $(1).unsigned
 $(hide) $(JAVA) -Djava.library.path=$$(dirname $(SIGNAPK_JNI_LIBRARY_PATH)) -jar $(SIGNAPK_JAR) \
+    $(if $(strip $(PRIVATE_CERTIFICATE_LINEAGE)), --lineage $(PRIVATE_CERTIFICATE_LINEAGE)) \
     $(PRIVATE_CERTIFICATE) $(PRIVATE_PRIVATE_KEY) \
     $(PRIVATE_ADDITIONAL_CERTIFICATES) $(1).unsigned $(1).signed
 $(hide) mv $(1).signed $(1)
@@ -3337,3 +3249,9 @@
   XZ="$(XZ)" \
   $(LIBRARY_IDENTITY_CHECK_SCRIPT) $(SOONG_STRIP_PATH) $(1) $(2)
 endef
+
+# Convert Soong libraries that have SDK variant
+define use_soong_sdk_libraries
+  $(foreach l,$(1),$(if $(filter $(l),$(SOONG_SDK_VARIANT_MODULES)),\
+      $(l).sdk,$(l)))
+endef
diff --git a/core/deprecation.mk b/core/deprecation.mk
index 19bd4cf..2b7a869 100644
--- a/core/deprecation.mk
+++ b/core/deprecation.mk
@@ -29,25 +29,25 @@
 # BUILD_BROKEN_USES_BUILD_* in your BoardConfig.mk in order to turn them back
 # to warnings.
 DEFAULT_ERROR_BUILD_MODULE_TYPES :=$= \
-  BUILD_AUX_EXECUTABLE \
-  BUILD_AUX_STATIC_LIBRARY \
   BUILD_COPY_HEADERS \
   BUILD_HOST_EXECUTABLE \
-  BUILD_HOST_FUZZ_TEST \
-  BUILD_HOST_NATIVE_TEST \
   BUILD_HOST_SHARED_LIBRARY \
   BUILD_HOST_STATIC_LIBRARY \
-  BUILD_HOST_STATIC_TEST_LIBRARY \
-  BUILD_HOST_TEST_CONFIG \
-  BUILD_NATIVE_BENCHMARK \
-  BUILD_STATIC_TEST_LIBRARY \
-  BUILD_TARGET_TEST_CONFIG \
 
 # These are BUILD_* variables that are always errors to reference.
 # Setting the BUILD_BROKEN_USES_BUILD_* variables is also an error.
 OBSOLETE_BUILD_MODULE_TYPES :=$= \
+  BUILD_AUX_EXECUTABLE \
+  BUILD_AUX_STATIC_LIBRARY \
+  BUILD_HOST_FUZZ_TEST \
+  BUILD_HOST_NATIVE_TEST \
   BUILD_HOST_SHARED_TEST_LIBRARY \
+  BUILD_HOST_STATIC_TEST_LIBRARY \
+  BUILD_HOST_TEST_CONFIG \
+  BUILD_NATIVE_BENCHMARK \
   BUILD_SHARED_TEST_LIBRARY \
+  BUILD_STATIC_TEST_LIBRARY \
+  BUILD_TARGET_TEST_CONFIG \
 
 $(foreach m,$(OBSOLETE_BUILD_MODULE_TYPES),\
   $(KATI_obsolete_var $(m),Please convert to Soong) \
diff --git a/core/envsetup.mk b/core/envsetup.mk
index ac3d5cf..2a97acf 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -258,7 +258,12 @@
 # java code with dalvikvm/art.
 # Jars present in the ART apex. These should match exactly the list of
 # Java libraries in the ART apex build rule.
-ART_APEX_JARS := core-oj core-libart core-icu4j okhttp bouncycastle apache-xml
+ART_APEX_JARS := \
+    com.android.art:core-oj \
+    com.android.art:core-libart \
+    com.android.art:okhttp \
+    com.android.art:bouncycastle \
+    com.android.art:apache-xml
 #################################################################
 
 # Read the product specs so we can get TARGET_DEVICE and other
@@ -360,9 +365,6 @@
   HOST_OUT_COMMON_INTERMEDIATES \
   HOST_OUT_FAKE
 
-# Nano environment config
-include $(BUILD_SYSTEM)/aux_config.mk
-
 HOST_CROSS_OUT_INTERMEDIATES := $(HOST_CROSS_OUT)/obj
 HOST_CROSS_OUT_NOTICE_FILES := $(HOST_CROSS_OUT_INTERMEDIATES)/NOTICE_FILES
 .KATI_READONLY := \
@@ -378,9 +380,6 @@
 HOST_CROSS_OUT_GEN := $(HOST_CROSS_OUT)/gen
 .KATI_READONLY := HOST_CROSS_OUT_GEN
 
-HOST_OUT_TEST_CONFIG := $(HOST_OUT)/test_config
-.KATI_READONLY := HOST_OUT_TEST_CONFIG
-
 # Out for HOST_2ND_ARCH
 $(HOST_2ND_ARCH_VAR_PREFIX)HOST_OUT_INTERMEDIATES := $(HOST_OUT)/obj32
 $(HOST_2ND_ARCH_VAR_PREFIX)HOST_OUT_SHARED_LIBRARIES := $(HOST_OUT)/lib
@@ -466,7 +465,6 @@
 TARGET_OUT_NOTICE_FILES := $(TARGET_OUT_INTERMEDIATES)/NOTICE_FILES
 TARGET_OUT_FAKE := $(PRODUCT_OUT)/fake_packages
 TARGET_OUT_TESTCASES := $(PRODUCT_OUT)/testcases
-TARGET_OUT_TEST_CONFIG := $(PRODUCT_OUT)/test_config
 .KATI_READONLY := \
   TARGET_OUT_EXECUTABLES \
   TARGET_OUT_OPTIONAL_EXECUTABLES \
@@ -480,8 +478,7 @@
   TARGET_OUT_ETC \
   TARGET_OUT_NOTICE_FILES \
   TARGET_OUT_FAKE \
-  TARGET_OUT_TESTCASES \
-  TARGET_OUT_TEST_CONFIG
+  TARGET_OUT_TESTCASES
 
 ifeq ($(SANITIZE_LITE),true)
 # When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
diff --git a/core/host_dalvik_java_library.mk b/core/host_dalvik_java_library.mk
index 5021510..da32978 100644
--- a/core/host_dalvik_java_library.mk
+++ b/core/host_dalvik_java_library.mk
@@ -99,6 +99,7 @@
     $(NORMALIZE_PATH) \
     $(JAR_ARGS) \
     $(ZIPSYNC) \
+    $(SOONG_ZIP) \
     | $(SOONG_JAVAC_WRAPPER)
 	$(transform-host-java-to-dalvik-package)
 
diff --git a/core/host_fuzz_test.mk b/core/host_fuzz_test.mk
deleted file mode 100644
index 54c6577..0000000
--- a/core/host_fuzz_test.mk
+++ /dev/null
@@ -1,10 +0,0 @@
-################################################
-## A thin wrapper around BUILD_HOST_EXECUTABLE
-## Common flags for host fuzz tests are added.
-################################################
-$(call record-module-type,HOST_FUZZ_TEST)
-
-LOCAL_SANITIZE += fuzzer
-LOCAL_STATIC_LIBRARIES += libLLVMFuzzer
-
-include $(BUILD_HOST_EXECUTABLE)
diff --git a/core/host_java_library.mk b/core/host_java_library.mk
index 8998d52..f9abe9b 100644
--- a/core/host_java_library.mk
+++ b/core/host_java_library.mk
@@ -90,6 +90,7 @@
     $(ZIPTIME) \
     $(JAR_ARGS) \
     $(ZIPSYNC) \
+    $(SOONG_ZIP) \
     | $(SOONG_JAVAC_WRAPPER)
 	$(transform-host-java-to-package)
 	$(remove-timestamps-from-package)
diff --git a/core/host_native_test.mk b/core/host_native_test.mk
deleted file mode 100644
index aa05bb3..0000000
--- a/core/host_native_test.mk
+++ /dev/null
@@ -1,23 +0,0 @@
-################################################
-## A thin wrapper around BUILD_HOST_EXECUTABLE
-## Common flags for host native tests are added.
-################################################
-$(call record-module-type,HOST_NATIVE_TEST)
-
-ifdef LOCAL_MODULE_CLASS
-ifneq ($(LOCAL_MODULE_CLASS),NATIVE_TESTS)
-$(error $(LOCAL_PATH): LOCAL_MODULE_CLASS must be NATIVE_TESTS with BUILD_HOST_NATIVE_TEST)
-endif
-endif
-
-LOCAL_MODULE_CLASS := NATIVE_TESTS
-
-include $(BUILD_SYSTEM)/host_test_internal.mk
-
-ifndef LOCAL_MULTILIB
-ifndef LOCAL_32_BIT_ONLY
-LOCAL_MULTILIB := both
-endif
-endif
-
-include $(BUILD_HOST_EXECUTABLE)
diff --git a/core/host_shared_test_lib.mk b/core/host_shared_test_lib.mk
deleted file mode 100644
index ed7e23a..0000000
--- a/core/host_shared_test_lib.mk
+++ /dev/null
@@ -1 +0,0 @@
-$(error BUILD_HOST_SHARED_TEST_LIBRARY is obsolete)
diff --git a/core/host_static_test_lib.mk b/core/host_static_test_lib.mk
deleted file mode 100644
index a9e39b1..0000000
--- a/core/host_static_test_lib.mk
+++ /dev/null
@@ -1,9 +0,0 @@
-##################################################
-## A thin wrapper around BUILD_HOST_STATIC_LIBRARY
-## Common flags for host native tests are added.
-##################################################
-$(call record-module-type,HOST_STATIC_TEST_LIBRARY)
-
-include $(BUILD_SYSTEM)/host_test_internal.mk
-
-include $(BUILD_SYSTEM)/host_static_library.mk
diff --git a/core/host_test_config.mk b/core/host_test_config.mk
deleted file mode 100644
index b9975e5..0000000
--- a/core/host_test_config.mk
+++ /dev/null
@@ -1,25 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-#
-# Common rules for building a TradeFed test XML file for host side tests.
-#
-
-$(call record-module-type,HOST_TEST_CONFIG)
-
-LOCAL_IS_HOST_MODULE := true
-
-include $(BUILD_SYSTEM)/test_config_common.mk
diff --git a/core/host_test_internal.mk b/core/host_test_internal.mk
deleted file mode 100644
index dfe8cf1..0000000
--- a/core/host_test_internal.mk
+++ /dev/null
@@ -1,28 +0,0 @@
-#####################################################
-## Shared definitions for all host test compilations.
-#####################################################
-
-ifeq ($(LOCAL_GTEST),true)
-  LOCAL_CFLAGS_linux += -DGTEST_OS_LINUX
-  LOCAL_CFLAGS_darwin += -DGTEST_OS_MAC
-
-  LOCAL_CFLAGS += -DGTEST_HAS_STD_STRING -O0 -g
-
-  LOCAL_STATIC_LIBRARIES += libgtest_main_host libgtest_host
-endif
-
-ifdef LOCAL_MODULE_PATH
-$(error $(LOCAL_PATH): Do not set LOCAL_MODULE_PATH when building test $(LOCAL_MODULE))
-endif
-
-ifdef LOCAL_MODULE_PATH_32
-$(error $(LOCAL_PATH): Do not set LOCAL_MODULE_PATH_32 when building test $(LOCAL_MODULE))
-endif
-
-ifdef LOCAL_MODULE_PATH_64
-$(error $(LOCAL_PATH): Do not set LOCAL_MODULE_PATH_64 when building test $(LOCAL_MODULE))
-endif
-
-ifndef LOCAL_MODULE_RELATIVE_PATH
-LOCAL_MODULE_RELATIVE_PATH := $(LOCAL_MODULE)
-endif
diff --git a/core/install_jni_libs_internal.mk b/core/install_jni_libs_internal.mk
index d87513b..b482eb5 100644
--- a/core/install_jni_libs_internal.mk
+++ b/core/install_jni_libs_internal.mk
@@ -12,9 +12,18 @@
 #   my_embedded_prebuilt_jni_libs, prebuilt jni libs embedded in prebuilt apk.
 #
 
+my_sdk_variant = $(1)
+ifneq (,$(and $(my_embed_jni),$(LOCAL_SDK_VERSION)))
+  # Soong produces $(lib).so in $(lib).sdk_intermediates so that the library
+  # has the correct name for embedding in an APK.  Append .sdk to the name
+  # of the intermediates directory, but not the .so name.
+  my_sdk_variant = $(call use_soong_sdk_libraries,$(1))
+endif
+
 my_jni_shared_libraries := $(strip \
-    $(foreach lib,$(LOCAL_JNI_SHARED_LIBRARIES), \
-      $(call intermediates-dir-for,SHARED_LIBRARIES,$(lib),,,$(my_2nd_arch_prefix))/$(lib).so))
+  $(foreach lib,$(LOCAL_JNI_SHARED_LIBRARIES), \
+    $(call intermediates-dir-for,SHARED_LIBRARIES,$(call my_sdk_variant,$(lib)),,,$(my_2nd_arch_prefix))/$(lib).so))
+
 
 # App-specific lib path.
 my_app_lib_path := $(dir $(LOCAL_INSTALLED_MODULE))lib/$(TARGET_$(my_2nd_arch_prefix)ARCH)
@@ -115,7 +124,18 @@
     my_allowed_types := $(my_allowed_ndk_types) native:platform native:product native:vendor native:vndk native:vndk_private native:platform_vndk
   endif
 
-  my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
+  ifneq (,$(LOCAL_SDK_VERSION))
+    ifeq ($(SOONG_ANDROID_MK),$(LOCAL_MODULE_MAKEFILE))
+      # SOONG_SDK_VARIANT_MODULES isn't complete yet while parsing Soong modules, and Soong has
+      # already ensured that apps link against the correct SDK variants, rewrite all JNI libraries
+      # to the SDK variant.
+      my_link_deps := $(addprefix SHARED_LIBRARIES:,$(addsuffix .sdk,$(LOCAL_JNI_SHARED_LIBRARIES)))
+    else
+      my_link_deps := $(addprefix SHARED_LIBRARIES:,$(call use_soong_sdk_libraries,$(LOCAL_JNI_SHARED_LIBRARIES)))
+    endif
+  else
+    my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
+  endif
 
   my_common :=
   include $(BUILD_SYSTEM)/link_type.mk
diff --git a/core/java.mk b/core/java.mk
index 44e005d..61a3ad3 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -296,6 +296,7 @@
     $(NORMALIZE_PATH) \
     $(JAR_ARGS) \
     $(ZIPSYNC) \
+    $(SOONG_ZIP) \
     | $(SOONG_JAVAC_WRAPPER)
 	@echo "Target Java: $@
 	$(call compile-java,$(TARGET_JAVAC),$(PRIVATE_ALL_JAVA_HEADER_LIBRARIES))
@@ -500,9 +501,9 @@
 	$(transform-classes.jar-to-dex)
 endif
 
-ifneq ($(filter $(LOCAL_MODULE),$(PRODUCT_BOOT_JARS)),)
-  $(call pretty-error,Modules in PRODUCT_BOOT_JARS must be defined in Android.bp files)
-endif
+$(foreach pair,$(PRODUCT_BOOT_JARS), \
+  $(if $(filter $(LOCAL_MODULE),$(call word-colon,2,$(pair))), \
+    $(call pretty-error,Modules in PRODUCT_BOOT_JARS must be defined in Android.bp files)))
 
 $(built_dex): $(built_dex_intermediate)
 	@echo Copying: $@
diff --git a/core/java_common.mk b/core/java_common.mk
index f6e01d2..b218c0d 100644
--- a/core/java_common.mk
+++ b/core/java_common.mk
@@ -382,7 +382,9 @@
   endif # USE_CORE_LIB_BOOTCLASSPATH
 endif # !LOCAL_IS_HOST_MODULE
 
+ifdef RECORD_ALL_DEPS
 ALL_DEPS.$(LOCAL_MODULE).ALL_DEPS := $(ALL_DEPS.$(LOCAL_MODULE).ALL_DEPS) $(full_java_bootclasspath_libs)
+endif
 
 # Export the SDK libs. The sdk library names listed in LOCAL_SDK_LIBRARIES are first exported.
 # Then sdk library names exported from dependencies are all re-exported.
diff --git a/core/java_prebuilt_internal.mk b/core/java_prebuilt_internal.mk
index 8a2091e..95ae2f8 100644
--- a/core/java_prebuilt_internal.mk
+++ b/core/java_prebuilt_internal.mk
@@ -35,9 +35,9 @@
 my_dex_jar := $(my_prebuilt_src_file)
 # This is a target shared library, i.e. a jar with classes.dex.
 
-ifneq ($(filter $(LOCAL_MODULE),$(PRODUCT_BOOT_JARS)),)
-  $(call pretty-error,Modules in PRODUCT_BOOT_JARS must be defined in Android.bp files)
-endif
+$(foreach pair,$(PRODUCT_BOOT_JARS), \
+  $(if $(filter $(LOCAL_MODULE),$(call word-colon,2,$(pair))), \
+    $(call pretty-error,Modules in PRODUCT_BOOT_JARS must be defined in Android.bp files)))
 
 ALL_MODULES.$(my_register_name).CLASSES_JAR := $(common_classes_jar)
 
diff --git a/core/line_coverage.mk b/core/line_coverage.mk
index a32eea6..9b0b528 100644
--- a/core/line_coverage.mk
+++ b/core/line_coverage.mk
@@ -35,6 +35,7 @@
 	libvold \
 	libyuv
 
+# Format is <module_name> or <module_name>:<apex_name>
 critical_components_shared := \
 	libaudioprocessing \
 	libbinder \
@@ -47,7 +48,7 @@
 	libopus \
 	libstagefright \
 	libunwind \
-	libvixl
+	libvixl:com.android.art.debug
 
 # Use the intermediates directory to avoid installing libraries to the device.
 intermediates := $(call intermediates-dir-for,PACKAGING,haiku-line-coverage)
@@ -60,7 +61,9 @@
 	$(call intermediates-dir-for,STATIC_LIBRARIES,$(lib))/$(lib).a)
 
 critical_components_shared_inputs := $(foreach lib,$(critical_components_shared), \
-	$(call intermediates-dir-for,SHARED_LIBRARIES,$(lib))/$(lib).so)
+	$(eval filename := $(call word-colon,1,$(lib))) \
+	$(eval modulename := $(subst :,.,$(lib))) \
+	$(call intermediates-dir-for,SHARED_LIBRARIES,$(modulename))/$(filename).so)
 
 fuzz_target_inputs := $(foreach fuzz,$(fuzz_targets), \
 	$(call intermediates-dir-for,EXECUTABLES,$(fuzz))/$(fuzz))
diff --git a/core/link_type.mk b/core/link_type.mk
index f7604ff..ff525cb 100644
--- a/core/link_type.mk
+++ b/core/link_type.mk
@@ -10,7 +10,7 @@
 #   my_link_deps: the dependencies, in the form of <MODULE_CLASS>:<name>
 #
 
-my_link_prefix := LINK_TYPE:$(call find-idf-prefix,$(my_kind),$(my_host_cross))$(if $(filter AUX,$(my_kind)),-$(AUX_OS_VARIANT)):$(if $(my_common),$(my_common):_,_:$(if $(my_2nd_arch_prefix),$(my_2nd_arch_prefix),_))
+my_link_prefix := LINK_TYPE:$(call find-idf-prefix,$(my_kind),$(my_host_cross)):$(if $(my_common),$(my_common):_,_:$(if $(my_2nd_arch_prefix),$(my_2nd_arch_prefix),_))
 link_type := $(my_link_prefix):$(LOCAL_MODULE_CLASS):$(LOCAL_MODULE)
 ALL_LINK_TYPES := $(ALL_LINK_TYPES) $(link_type)
 $(link_type).TYPE := $(my_link_type)
diff --git a/core/local_systemsdk.mk b/core/local_systemsdk.mk
index 2b73f93..460073d 100644
--- a/core/local_systemsdk.mk
+++ b/core/local_systemsdk.mk
@@ -15,7 +15,7 @@
 #
 
 ifdef BOARD_SYSTEMSDK_VERSIONS
-  # Apps and jars in vendor or odm partition are forced to build against System SDK.
+  # Apps and jars in vendor, product or odm partition are forced to build against System SDK.
   _cannot_use_platform_apis :=
   ifneq (,$(filter true,$(LOCAL_VENDOR_MODULE) $(LOCAL_ODM_MODULE) $(LOCAL_PROPRIETARY_MODULE)))
     # Note: no need to check LOCAL_MODULE_PATH* since LOCAL_[VENDOR|ODM|OEM]_MODULE is already
@@ -29,9 +29,9 @@
   ifneq (,$(filter JAVA_LIBRARIES APPS,$(LOCAL_MODULE_CLASS)))
     ifndef LOCAL_SDK_VERSION
       ifeq ($(_cannot_use_platform_apis),true)
-        ifeq (,$(findstring __auto_generated_rro_,$(LOCAL_MODULE)))
+        ifeq (,$(LOCAL_IS_RUNTIME_RESOURCE_OVERLAY))
           # Runtime resource overlays are exempted from building against System SDK.
-          # TODO(b/35859726): remove this exception
+          # TODO(b/155027019): remove this, after no product/vendor apps rely on this behavior.
           LOCAL_SDK_VERSION := system_current
         endif
       endif
diff --git a/core/main.mk b/core/main.mk
index 5fb3810..68303cf 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -344,9 +344,6 @@
 $(error The 'sdk' target may not be specified with any other targets)
 endif
 
-# AUX dependencies are already added by now; remove triggers from the MAKECMDGOALS
-MAKECMDGOALS := $(strip $(filter-out AUX-%,$(MAKECMDGOALS)))
-
 # TODO: this should be eng I think.  Since the sdk is built from the eng
 # variant.
 tags_to_install := debug eng
@@ -740,15 +737,18 @@
 $(_all_deps_for_$(1)_))
 endef
 
-# Scan all modules in general-tests and device-tests suite and flatten the
-# shared library dependencies.
+# Scan all modules in general-tests, device-tests and other selected suites and
+# flatten the shared library dependencies.
 define update-host-shared-libs-deps-for-suites
-$(foreach suite,general-tests device-tests,\
+$(foreach suite,general-tests device-tests vts,\
   $(foreach m,$(COMPATIBILITY.$(suite).MODULES),\
     $(eval my_deps := $(call get-all-shared-libs-deps,$(m)))\
     $(foreach dep,$(my_deps),\
       $(foreach f,$(ALL_MODULES.$(dep).HOST_SHARED_LIBRARY_FILES),\
-        $(eval target := $(HOST_OUT_TESTCASES)/$(lastword $(subst /, ,$(dir $(f))))/$(notdir $(f)))\
+        $(if $(filter $(suite),device-tests general-tests),\
+          $(eval my_testcases := $(HOST_OUT_TESTCASES)),\
+          $(eval my_testcases := $$(COMPATIBILITY_TESTCASES_OUT_$(suite))))\
+        $(eval target := $(my_testcases)/$(lastword $(subst /, ,$(dir $(f))))/$(notdir $(f)))\
         $(eval COMPATIBILITY.$(suite).HOST_SHARED_LIBRARY.FILES := \
           $$(COMPATIBILITY.$(suite).HOST_SHARED_LIBRARY.FILES) $(f):$(target))\
         $(eval COMPATIBILITY.$(suite).HOST_SHARED_LIBRARY.FILES := \
@@ -795,9 +795,10 @@
     $($(if $(2),$($(1)2ND_ARCH_VAR_PREFIX))TARGET_OUT_INTERMEDIATES)/SHARED_LIBRARIES/%,\
     $(call module-built-files,$(mod)))))\
   \
-  $(if $(r),\
+  $(if $(and $(r),$(deps)),\
     $(eval stamp := $(dir $(r))check_elf_files.timestamp)\
-    $(eval $(call add-elf-file-check-shared-lib,$(stamp),$(deps)))\
+    $(if $(CHECK_ELF_FILES.$(stamp)),\
+      $(eval $(call add-elf-file-check-shared-lib,$(stamp),$(deps))))\
   ))
 endef
 
@@ -827,7 +828,6 @@
 #     - TARGET
 #     - HOST
 #     - HOST_CROSS
-#     - AUX-<variant-name>
 #   3: Whether to use the common intermediates directory or not
 #     - _
 #     - COMMON
@@ -854,14 +854,8 @@
 
 link_type_error :=
 
-define link-type-prefix-base
-$(word 2,$(subst :,$(space),$(1)))
-endef
 define link-type-prefix
-$(if $(filter AUX-%,$(link-type-prefix-base)),$(patsubst AUX-%,AUX,$(link-type-prefix-base)),$(link-type-prefix-base))
-endef
-define link-type-aux-variant
-$(if $(filter AUX-%,$(link-type-prefix-base)),$(patsubst AUX-%,%,$(link-type-prefix-base)))
+$(word 2,$(subst :,$(space),$(1)))
 endef
 define link-type-common
 $(patsubst _,,$(word 3,$(subst :,$(space),$(1))))
@@ -879,7 +873,7 @@
 $(strip $(eval _p := $(link-type-prefix))\
   $(if $(filter HOST HOST_CROSS,$(_p)),\
     $($(_p)_OS),\
-    $(if $(filter AUX,$(_p)),AUX,android)))
+    android))
 endef
 define link-type-arch
 $($(link-type-prefix)_$(link-type-2ndarchprefix)ARCH)
@@ -1172,13 +1166,13 @@
   # Verify the artifact path requirements made by included products.
   is_asan := $(if $(filter address,$(SANITIZE_TARGET)),true)
   ifneq (true,$(or $(is_asan),$(DISABLE_ARTIFACT_PATH_REQUIREMENTS)))
-  # Fakes don't get installed, host files are irrelevant, and NDK stubs aren't installed to device.
-  static_whitelist_patterns := $(TARGET_OUT_FAKE)/% $(HOST_OUT)/% $(SOONG_OUT_DIR)/ndk/%
+  # Fakes don't get installed, and NDK stubs aren't installed to device.
+  static_whitelist_patterns := $(TARGET_OUT_FAKE)/% $(SOONG_OUT_DIR)/ndk/%
   # RROs become REQUIRED by the source module, but are always placed on the vendor partition.
   static_whitelist_patterns += %__auto_generated_rro_product.apk
   static_whitelist_patterns += %__auto_generated_rro_vendor.apk
   # Auto-included targets are not considered
-  static_whitelist_patterns += $(call module-installed-files,$(call auto-included-modules))
+  static_whitelist_patterns += $(call product-installed-files,)
   # $(PRODUCT_OUT)/apex is where shared libraries in APEXes get installed.
   # The path can be considered as a fake path, as the shared libraries
   # are installed there just to have symbols files for them under
@@ -1432,9 +1426,6 @@
 .PHONY: vbmetaimage
 vbmetaimage: $(INSTALLED_VBMETAIMAGE_TARGET)
 
-.PHONY: auxiliary
-auxiliary: $(INSTALLED_AUX_TARGETS)
-
 # Build files and then package it into the rom formats
 .PHONY: droidcore
 droidcore: $(filter $(HOST_OUT_ROOT)/%,$(modules_to_install)) \
@@ -1480,7 +1471,6 @@
     $(INSTALLED_FILES_FILE_RECOVERY) \
     $(INSTALLED_FILES_JSON_RECOVERY) \
     $(INSTALLED_ANDROID_INFO_TXT_TARGET) \
-    auxiliary \
     soong_docs
 
 # dist_files only for putting your library into the dist directory with a full build.
diff --git a/core/native_benchmark.mk b/core/native_benchmark.mk
deleted file mode 100644
index 073d8dd..0000000
--- a/core/native_benchmark.mk
+++ /dev/null
@@ -1,15 +0,0 @@
-###########################################
-## A thin wrapper around BUILD_EXECUTABLE
-## Common flags for native benchmarks are added.
-###########################################
-$(call record-module-type,NATIVE_BENCHMARK)
-
-LOCAL_STATIC_LIBRARIES += libgoogle-benchmark
-
-ifndef LOCAL_MULTILIB
-ifndef LOCAL_32_BIT_ONLY
-LOCAL_MULTILIB := both
-endif
-endif
-
-include $(BUILD_EXECUTABLE)
diff --git a/core/ninja_config.mk b/core/ninja_config.mk
index 3f2e5de..1ead512 100644
--- a/core/ninja_config.mk
+++ b/core/ninja_config.mk
@@ -15,7 +15,6 @@
 	$(dont_bother_goals) \
 	all \
 	ECLIPSE-% \
-	AUX-% \
 	brillo_tests \
 	btnod \
 	build-art% \
diff --git a/core/notice_files.mk b/core/notice_files.mk
index 77fb8d4..721a034 100644
--- a/core/notice_files.mk
+++ b/core/notice_files.mk
@@ -82,6 +82,10 @@
     else ifeq ($(LOCAL_MODULE_CLASS),ETC)
       # ETC modules may be uninstallable, yet still have a NOTICE file. e.g. apex components
       module_installed_filename :=
+    else ifneq (,$(and $(filter %.sdk,$(LOCAL_MODULE)),$(filter $(patsubst %.sdk,%,$(LOCAL_MODULE)),$(SOONG_SDK_VARIANT_MODULES))))
+      # Soong produces uninstallable *.sdk shared libraries for embedding in APKs.
+      module_installed_filename := \
+          $(patsubst $(PRODUCT_OUT)/%,%,$($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_SHARED_LIBRARIES))/$(notdir $(LOCAL_BUILT_MODULE))
     else
       $(error Cannot determine where to install NOTICE file for $(LOCAL_MODULE))
     endif # JAVA_LIBRARIES
diff --git a/core/package_internal.mk b/core/package_internal.mk
index c6c2cf5..034a36e 100644
--- a/core/package_internal.mk
+++ b/core/package_internal.mk
@@ -377,9 +377,11 @@
 # they want to use this module's R.java file.
 $(LOCAL_BUILT_MODULE): $(R_file_stamp)
 
+ifneq ($(full_classes_jar),)
 # The R.java file must exist by the time the java source
 # list is generated
 $(java_source_list_file): $(R_file_stamp)
+endif
 
 endif # need_compile_res
 
@@ -471,6 +473,9 @@
 $(LOCAL_BUILT_MODULE): $(additional_certificates)
 $(LOCAL_BUILT_MODULE): PRIVATE_ADDITIONAL_CERTIFICATES := $(additional_certificates)
 
+$(LOCAL_BUILT_MODULE): $(LOCAL_CERTIFICATE_LINEAGE)
+$(LOCAL_BUILT_MODULE): PRIVATE_CERTIFICATE_LINEAGE := $(LOCAL_CERTIFICATE_LINEAGE)
+
 # Set a actual_partition_tag (calculated in base_rules.mk) for the package.
 PACKAGES.$(LOCAL_PACKAGE_NAME).PARTITION := $(actual_partition_tag)
 
@@ -689,6 +694,12 @@
 PACKAGES.$(LOCAL_PACKAGE_NAME).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 PACKAGES.$(LOCAL_PACKAGE_NAME).RESOURCE_FILES := $(all_resources)
 
+ifneq ($(LOCAL_MODULE_STEM),)
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
+else
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
+endif
+
 PACKAGES := $(PACKAGES) $(LOCAL_PACKAGE_NAME)
 
 # Reset internal variables.
diff --git a/core/product.mk b/core/product.mk
index b497abb..ea9be72 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -240,6 +240,10 @@
 # List of system_server jars delivered via apex. Format = <apex name>:<jar name>.
 _product_list_vars += PRODUCT_UPDATABLE_SYSTEM_SERVER_JARS
 
+# Additional system server jars to be appended at the end of the common list.
+# This is necessary to avoid jars reordering due to makefile inheritance order.
+_product_list_vars += PRODUCT_SYSTEM_SERVER_JARS_EXTRA
+
 # All of the apps that we force preopt, this overrides WITH_DEXPREOPT.
 _product_list_vars += PRODUCT_ALWAYS_PREOPT_EXTRACTED_APK
 _product_list_vars += PRODUCT_DEXPREOPT_SPEED_APPS
diff --git a/core/product_config.mk b/core/product_config.mk
index aabd472..82967bc 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -231,6 +231,13 @@
 # Extra boot jars must be appended at the end after common boot jars.
 PRODUCT_BOOT_JARS += $(PRODUCT_BOOT_JARS_EXTRA)
 
+# Add 'platform:' prefix to unqualified boot jars
+PRODUCT_BOOT_JARS := $(foreach pair,$(PRODUCT_BOOT_JARS), \
+  $(if $(findstring :,$(pair)),,platform:)$(pair))
+
+# The extra system server jars must be appended at the end after common system server jars.
+PRODUCT_SYSTEM_SERVER_JARS += $(PRODUCT_SYSTEM_SERVER_JARS_EXTRA)
+
 ifndef PRODUCT_SYSTEM_NAME
   PRODUCT_SYSTEM_NAME := $(PRODUCT_NAME)
 endif
@@ -268,11 +275,9 @@
 endif
 
 $(foreach pair,$(PRODUCT_UPDATABLE_BOOT_JARS), \
-  $(if $(findstring $(call word-colon,2,$(pair)),$(PRODUCT_BOOT_JARS)), \
-    $(error A jar in PRODUCT_UPDATABLE_BOOT_JARS must not be in PRODUCT_BOOT_JARS, \
-      but $(call word-colon,2,$(pair)) is) \
-  ) \
-)
+  $(eval jar := $(call word-colon,2,$(pair))) \
+  $(if $(findstring $(jar), $(PRODUCT_BOOT_JARS)), \
+    $(error A jar in PRODUCT_UPDATABLE_BOOT_JARS must not be in PRODUCT_BOOT_JARS, but $(jar) is)))
 
 ENFORCE_SYSTEM_CERTIFICATE := $(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT)
 ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)
diff --git a/core/rbe.mk b/core/rbe.mk
index 7886e1a..019ac04 100644
--- a/core/rbe.mk
+++ b/core/rbe.mk
@@ -46,8 +46,12 @@
     d8_exec_strategy := "local"
   endif
 
+  platform := "container-image=docker://gcr.io/androidbuild-re-dockerimage/android-build-remoteexec-image@sha256:582efb38f0c229ea39952fff9e132ccbe183e14869b39888010dacf56b360d62"
+  cxx_platform := $(platform)",Pool=default"
+  java_r8_d8_platform := $(platform)",Pool=java16"
+
   RBE_WRAPPER := $(rbe_dir)/rewrapper
-  RBE_CXX := --labels=type=compile,lang=cpp,compiler=clang --env_var_whitelist=PWD --exec_strategy=$(cxx_rbe_exec_strategy)
+  RBE_CXX := --labels=type=compile,lang=cpp,compiler=clang --env_var_whitelist=PWD --exec_strategy=$(cxx_rbe_exec_strategy) --platform="$(cxx_platform)"
 
   # Append rewrapper to existing *_WRAPPER variables so it's possible to
   # use both ccache and rewrapper.
@@ -55,16 +59,17 @@
   CXX_WRAPPER := $(strip $(CXX_WRAPPER) $(RBE_WRAPPER) $(RBE_CXX))
 
   ifdef RBE_JAVAC
-    JAVAC_WRAPPER := $(strip $(JAVAC_WRAPPER) $(RBE_WRAPPER) --labels=type=compile,lang=java,compiler=javac,shallow=true --exec_strategy=$(javac_exec_strategy))
+    JAVAC_WRAPPER := $(strip $(JAVAC_WRAPPER) $(RBE_WRAPPER) --labels=type=compile,lang=java,compiler=javac --exec_strategy=$(javac_exec_strategy) --platform="$(java_r8_d8_platform)")
   endif
 
   ifdef RBE_R8
-    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8,shallow=true --exec_strategy=$(r8_exec_strategy))
+    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8 --exec_strategy=$(r8_exec_strategy) --platform="$(java_r8_d8_platform)" --inputs=out/soong/host/linux-x86/framework/r8-compat-proguard.jar,build/make/core/proguard_basic_keeps.flags --toolchain_inputs=prebuilts/jdk/jdk11/linux-x86/bin/java)
   endif
 
   ifdef RBE_D8
-    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8,shallow=true --exec_strategy=$(d8_exec_strategy))
+    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8 --exec_strategy=$(d8_exec_strategy) --platform="$(java_r8_d8_platform)" --inputs=out/soong/host/linux-x86/framework/d8.jar --toolchain_inputs=prebuilts/jdk/jdk11/linux-x86/bin/java)
   endif
 
   rbe_dir :=
 endif
+
diff --git a/core/shared_test_lib.mk b/core/shared_test_lib.mk
deleted file mode 100644
index 1ea9fe7..0000000
--- a/core/shared_test_lib.mk
+++ /dev/null
@@ -1 +0,0 @@
-$(error BUILD_SHARED_TEST_LIBRARY is obsolete)
diff --git a/core/soong_app_prebuilt.mk b/core/soong_app_prebuilt.mk
index 6dc396c..4197c58 100644
--- a/core/soong_app_prebuilt.mk
+++ b/core/soong_app_prebuilt.mk
@@ -110,7 +110,7 @@
 
 # Copy test suite files.
 ifdef LOCAL_COMPATIBILITY_SUITE
-my_apks_to_install := $(foreach f,$(filter %.apk,$(LOCAL_SOONG_BUILT_INSTALLED)),$(call word-colon,1,$(f)))
+my_apks_to_install := $(foreach f,$(filter %.apk %.idsig,$(LOCAL_SOONG_BUILT_INSTALLED)),$(call word-colon,1,$(f)))
 $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
   $(eval my_compat_dist_$(suite) := $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
     $(foreach a,$(my_apks_to_install),\
@@ -157,6 +157,12 @@
 include $(BUILD_SYSTEM)/app_certificate_validate.mk
 PACKAGES.$(LOCAL_MODULE).OVERRIDES := $(strip $(LOCAL_OVERRIDES_PACKAGES))
 
+ifneq ($(LOCAL_MODULE_STEM),)
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE_STEM)
+else
+  PACKAGES.$(LOCAL_MODULE).STEM := $(LOCAL_MODULE)
+endif
+
 # Set a actual_partition_tag (calculated in base_rules.mk) for the package.
 PACKAGES.$(LOCAL_MODULE).PARTITION := $(actual_partition_tag)
 
diff --git a/core/soong_config.mk b/core/soong_config.mk
index c91639c..18949be 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -32,7 +32,6 @@
 $(call add_json_str,  Platform_sdk_codename,             $(PLATFORM_VERSION_CODENAME))
 $(call add_json_bool, Platform_sdk_final,                $(filter REL,$(PLATFORM_VERSION_CODENAME)))
 $(call add_json_csv,  Platform_version_active_codenames, $(PLATFORM_VERSION_ALL_CODENAMES))
-$(call add_json_csv,  Platform_version_future_codenames, $(PLATFORM_VERSION_FUTURE_CODENAMES))
 $(call add_json_str,  Platform_security_patch,           $(PLATFORM_SECURITY_PATCH))
 $(call add_json_str,  Platform_preview_sdk_version,      $(PLATFORM_PREVIEW_SDK_VERSION))
 $(call add_json_str,  Platform_base_os,                  $(PLATFORM_BASE_OS))
@@ -122,7 +121,7 @@
 $(call add_json_bool, ArtUseReadBarrier,                 $(call invert_bool,$(filter false,$(PRODUCT_ART_USE_READ_BARRIER))))
 $(call add_json_bool, Binder32bit,                       $(BINDER32BIT))
 $(call add_json_str,  BtConfigIncludeDir,                $(BOARD_BLUETOOTH_BDROID_BUILDCFG_INCLUDE_DIR))
-$(call add_json_list, DeviceKernelHeaders,               $(TARGET_PROJECT_SYSTEM_INCLUDES))
+$(call add_json_list, DeviceKernelHeaders,               $(TARGET_DEVICE_KERNEL_HEADERS) $(TARGET_BOARD_KERNEL_HEADERS) $(TARGET_PRODUCT_KERNEL_HEADERS))
 $(call add_json_bool, DevicePrefer32BitApps,             $(filter true,$(TARGET_PREFER_32_BIT_APPS)))
 $(call add_json_bool, DevicePrefer32BitExecutables,      $(filter true,$(TARGET_PREFER_32_BIT_EXECUTABLES)))
 $(call add_json_str,  DeviceVndkVersion,                 $(BOARD_VNDK_VERSION))
@@ -133,6 +132,8 @@
 $(call add_json_list, DeviceSystemSdkVersions,           $(BOARD_SYSTEMSDK_VERSIONS))
 $(call add_json_list, Platform_systemsdk_versions,       $(PLATFORM_SYSTEMSDK_VERSIONS))
 $(call add_json_bool, Malloc_not_svelte,                 $(call invert_bool,$(filter true,$(MALLOC_SVELTE))))
+$(call add_json_bool, Malloc_zero_contents,              $(MALLOC_ZERO_CONTENTS))
+$(call add_json_bool, Malloc_pattern_fill_contents,      $(MALLOC_PATTERN_FILL_CONTENTS))
 $(call add_json_str,  Override_rs_driver,                $(OVERRIDE_RS_DRIVER))
 
 $(call add_json_bool, UncompressPrivAppDex,              $(call invert_bool,$(filter true,$(DONT_UNCOMPRESS_PRIV_APPS_DEXS))))
diff --git a/core/soong_java_prebuilt.mk b/core/soong_java_prebuilt.mk
index 1496d56..509e3f6 100644
--- a/core/soong_java_prebuilt.mk
+++ b/core/soong_java_prebuilt.mk
@@ -91,7 +91,8 @@
 
 ifdef LOCAL_SOONG_DEX_JAR
   ifndef LOCAL_IS_HOST_MODULE
-    ifneq ($(filter $(LOCAL_MODULE),$(PRODUCT_BOOT_JARS)),)  # is_boot_jar
+    boot_jars := $(foreach pair,$(PRODUCT_BOOT_JARS), $(call word-colon,2,$(pair)))
+    ifneq ($(filter $(LOCAL_MODULE),$(boot_jars)),) # is_boot_jar
       ifeq (true,$(WITH_DEXPREOPT))
         # For libart, the boot jars' odex files are replaced by $(DEFAULT_DEX_PREOPT_INSTALLED_IMAGE).
         # We use this installed_odex trick to get boot.art installed.
diff --git a/core/soong_rust_prebuilt.mk b/core/soong_rust_prebuilt.mk
index 4a9eb4a..804e37e 100644
--- a/core/soong_rust_prebuilt.mk
+++ b/core/soong_rust_prebuilt.mk
@@ -75,6 +75,23 @@
   endif
 endif
 
+
+ifeq ($(NATIVE_COVERAGE),true)
+  ifneq (,$(strip $(LOCAL_PREBUILT_COVERAGE_ARCHIVE)))
+    $(eval $(call copy-one-file,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(intermediates)/$(LOCAL_MODULE).zip))
+    ifneq ($(LOCAL_UNINSTALLABLE_MODULE),true)
+      ifdef LOCAL_IS_HOST_MODULE
+        my_coverage_path := $($(my_prefix)OUT_COVERAGE)/$(patsubst $($(my_prefix)OUT)/%,%,$(my_module_path))
+      else
+        my_coverage_path := $(TARGET_OUT_COVERAGE)/$(patsubst $(PRODUCT_OUT)/%,%,$(my_module_path))
+      endif
+      my_coverage_path := $(my_coverage_path)/$(patsubst %.so,%,$(my_installed_module_stem)).zip
+      $(eval $(call copy-one-file,$(LOCAL_PREBUILT_COVERAGE_ARCHIVE),$(my_coverage_path)))
+      $(LOCAL_BUILT_MODULE): $(my_coverage_path)
+    endif
+  endif
+endif
+
 # A product may be configured to strip everything in some build variants.
 # We do the stripping as a post-install command so that LOCAL_BUILT_MODULE
 # is still with the symbols and we don't need to clean it (and relink) when
diff --git a/core/static_test_lib.mk b/core/static_test_lib.mk
deleted file mode 100644
index a0e2970..0000000
--- a/core/static_test_lib.mk
+++ /dev/null
@@ -1,9 +0,0 @@
-#############################################
-## A thin wrapper around BUILD_STATIC_LIBRARY
-## Common flags for native tests are added.
-#############################################
-$(call record-module-type,STATIC_TEST_LIBRARY)
-
-include $(BUILD_SYSTEM)/target_test_internal.mk
-
-include $(BUILD_STATIC_LIBRARY)
diff --git a/core/target_test_config.mk b/core/target_test_config.mk
deleted file mode 100644
index 61f5d2b..0000000
--- a/core/target_test_config.mk
+++ /dev/null
@@ -1,23 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-#
-# Common rules for building a TradeFed test XML file for target side tests.
-#
-
-$(call record-module-type,TARGET_TEST_CONFIG)
-
-include $(BUILD_SYSTEM)/test_config_common.mk
diff --git a/core/tasks/boot_jars_package_check.mk b/core/tasks/boot_jars_package_check.mk
index 05243e5..02d7212 100644
--- a/core/tasks/boot_jars_package_check.mk
+++ b/core/tasks/boot_jars_package_check.mk
@@ -23,19 +23,26 @@
 intermediates := $(call intermediates-dir-for, PACKAGING, boot-jars-package-check,,COMMON)
 stamp := $(intermediates)/stamp
 
-# The actual names for the updatable jars are <jar_name>.<apex_name> e.g., updatable-media.com.android.media
-updatable_boot_jars := $(foreach pair,$(PRODUCT_UPDATABLE_BOOT_JARS),\
-  $(eval apex := $(call word-colon,1,$(pair)))\
-  $(eval jar := $(call word-colon,2,$(pair)))\
-  $(jar).$(apex)\
-)
-#TODO(jiyong) merge art_boot_jars into updatable_boot_jars
-art_boot_jars := $(addsuffix .com.android.art.release,$(filter $(ART_APEX_JARS),$(PRODUCT_BOOT_JARS)))
+# Convert the colon-separated components <apex>:<jar> to <jar>.<apex> names
+# (e.g. com.android.media:updatable-media -> updatable-media.com.android.media).
+# Special cases:
+#   - for the "platform" or "system_ext" apex drop the .<apex> suffix
+#   - for the ART apex select release variant
+boot_jars := $(foreach pair,$(PRODUCT_BOOT_JARS) $(PRODUCT_UPDATABLE_BOOT_JARS), \
+  $(eval apex := $(call word-colon,1,$(pair))) \
+  $(eval jar := $(call word-colon,2,$(pair))) \
+  $(eval q := :) \
+  $(eval sfx := $(q).$(apex)$(q)) \
+  $(eval sfx := $(subst $(q).platform$(q),$(q)$(q),$(sfx))) \
+  $(eval sfx := $(subst $(q).system_ext$(q),$(q)$(q),$(sfx))) \
+  $(eval sfx := $(subst $(q).com.android.art$(q),$(q).com.android.art.release$(q),$(sfx))) \
+  $(eval sfx := $(patsubst $(q)%$(q),%,$(sfx))) \
+  $(jar)$(sfx))
 
-platform_boot_jars := $(filter-out $(ART_APEX_JARS),$(PRODUCT_BOOT_JARS))
-
-built_boot_jars := $(foreach j, $(updatable_boot_jars) $(art_boot_jars) $(platform_boot_jars), \
+# Convert boot jar names to build paths.
+built_boot_jars := $(foreach j, $(boot_jars), \
   $(call intermediates-dir-for, JAVA_LIBRARIES, $(j),,COMMON)/classes.jar)
+
 script := build/make/core/tasks/check_boot_jars/check_boot_jars.py
 whitelist_file := build/make/core/tasks/check_boot_jars/package_whitelist.txt
 
diff --git a/core/tasks/general-tests.mk b/core/tasks/general-tests.mk
index 1cf7ef8..cb84a5c 100644
--- a/core/tasks/general-tests.mk
+++ b/core/tasks/general-tests.mk
@@ -18,7 +18,7 @@
 general_tests_tools := \
     $(HOST_OUT_JAVA_LIBRARIES)/cts-tradefed.jar \
     $(HOST_OUT_JAVA_LIBRARIES)/compatibility-host-util.jar \
-    $(HOST_OUT_JAVA_LIBRARIES)/vts-core-tradefed.jar \
+    $(HOST_OUT_JAVA_LIBRARIES)/vts-tradefed.jar \
     $(HOST_OUT_JAVA_LIBRARIES)/vts10-tradefed.jar
 
 intermediates_dir := $(call intermediates-dir-for,PACKAGING,general-tests)
diff --git a/core/tasks/platform_availability_check.mk b/core/tasks/platform_availability_check.mk
new file mode 100644
index 0000000..043d130
--- /dev/null
+++ b/core/tasks/platform_availability_check.mk
@@ -0,0 +1,36 @@
+#
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Check whether there is any module that isn't available for platform
+# is installed to the platform.
+
+# Filter FAKE and NON_INSTALLABLE modules out and then collect those are not
+# available for platform
+_modules_not_available_for_platform := \
+$(strip $(foreach m,$(product_MODULES),\
+  $(if $(filter-out FAKE,$(ALL_MODULES.$(m).CLASS)),\
+    $(if $(ALL_MODULES.$(m).INSTALLED),\
+      $(if $(filter true,$(ALL_MODULES.$(m).NOT_AVAILABLE_FOR_PLATFORM)),\
+        $(m))))))
+
+_violators_with_path := $(foreach m,$(sort $(_modules_not_available_for_platform)),\
+    $(m):$(word 1,$(ALL_MODULES.$(m).PATH))\
+)
+
+$(call maybe-print-list-and-error,$(_violators_with_path),\
+Following modules are requested to be installed. But are not available \
+for platform because they do not have "//apex_available:platform" or \
+they depend on other modules that are not available for platform)
diff --git a/core/tasks/sdk-addon.mk b/core/tasks/sdk-addon.mk
index 7f777a5..5097f12 100644
--- a/core/tasks/sdk-addon.mk
+++ b/core/tasks/sdk-addon.mk
@@ -66,7 +66,7 @@
 files_to_copy += \
 	$(addon_dir_img):$(INSTALLED_QEMU_SYSTEMIMAGE):images/$(TARGET_CPU_ABI)/system.img \
 	$(addon_dir_img):$(INSTALLED_QEMU_VENDORIMAGE):images/$(TARGET_CPU_ABI)/vendor.img \
-	$(addon_dir_img):$(BUILT_RAMDISK_TARGET):images/$(TARGET_CPU_ABI)/ramdisk.img \
+	$(addon_dir_img):$(INSTALLED_QEMU_RAMDISKIMAGE):images/$(TARGET_CPU_ABI)/ramdisk.img \
 	$(addon_dir_img):$(PRODUCT_OUT)/system/build.prop:images/$(TARGET_CPU_ABI)/build.prop \
 	$(addon_dir_img):device/generic/goldfish/data/etc/userdata.img:images/$(TARGET_CPU_ABI)/userdata.img \
 	$(addon_dir_img):$(target_notice_file_txt):images/$(TARGET_CPU_ABI)/NOTICE.txt \
diff --git a/core/tasks/tools/compatibility.mk b/core/tasks/tools/compatibility.mk
index b6dd39e..87582a5 100644
--- a/core/tasks/tools/compatibility.mk
+++ b/core/tasks/tools/compatibility.mk
@@ -42,13 +42,16 @@
 
 test_tools += $(test_suite_tools)
 
+# Include host shared libraries
+host_shared_libs := $(call copy-many-files, $(COMPATIBILITY.$(test_suite_name).HOST_SHARED_LIBRARY.FILES))
+
 compatibility_zip := $(out_dir).zip
 $(compatibility_zip): PRIVATE_NAME := android-$(test_suite_name)
 $(compatibility_zip): PRIVATE_OUT_DIR := $(out_dir)
 $(compatibility_zip): PRIVATE_TOOLS := $(test_tools) $(test_suite_prebuilt_tools)
 $(compatibility_zip): PRIVATE_SUITE_NAME := $(test_suite_name)
 $(compatibility_zip): PRIVATE_DYNAMIC_CONFIG := $(test_suite_dynamic_config)
-$(compatibility_zip): $(test_artifacts) $(test_tools) $(test_suite_prebuilt_tools) $(test_suite_dynamic_config) $(SOONG_ZIP) | $(ADB) $(ACP)
+$(compatibility_zip): $(test_artifacts) $(test_tools) $(test_suite_prebuilt_tools) $(test_suite_dynamic_config) $(SOONG_ZIP) $(host_shared_libs) | $(ADB) $(ACP)
 # Make dir structure
 	$(hide) mkdir -p $(PRIVATE_OUT_DIR)/tools $(PRIVATE_OUT_DIR)/testcases
 	$(hide) echo $(BUILD_NUMBER_FROM_FILE) > $(PRIVATE_OUT_DIR)/tools/version.txt
@@ -65,3 +68,4 @@
 test_suite_readme :=
 test_suite_prebuilt_tools :=
 test_suite_tools :=
+host_shared_libs :=
diff --git a/core/tasks/tools/package-modules.mk b/core/tasks/tools/package-modules.mk
index 55a08f5..6cafa4a 100644
--- a/core/tasks/tools/package-modules.mk
+++ b/core/tasks/tools/package-modules.mk
@@ -16,7 +16,16 @@
 #
 
 my_makefile := $(lastword $(filter-out $(lastword $(MAKEFILE_LIST)),$(MAKEFILE_LIST)))
-my_staging_dir := $(call intermediates-dir-for,PACKAGING,$(my_package_name))
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := $(my_package_name)
+LOCAL_MODULE_CLASS := PACKAGING
+LOCAL_MODULE_STEM := $(my_package_name).zip
+LOCAL_UNINSTALLABLE_MODULE := true
+include $(BUILD_SYSTEM)/base_rules.mk
+my_staging_dir := $(intermediates)
+my_package_zip := $(LOCAL_BUILT_MODULE)
+
 my_built_modules := $(foreach p,$(my_copy_pairs),$(call word-colon,1,$(p)))
 my_copy_pairs := $(foreach p,$(my_copy_pairs),$(call word-colon,1,$(p)):$(my_staging_dir)/$(call word-colon,2,$(p)))
 my_pickup_files :=
@@ -80,7 +89,6 @@
   $(error done)
 endif
 
-my_package_zip := $(my_staging_dir)/$(my_package_name).zip
 $(my_package_zip): PRIVATE_COPY_PAIRS := $(my_copy_pairs)
 $(my_package_zip): PRIVATE_PICKUP_FILES := $(my_pickup_files)
 $(my_package_zip) : $(my_built_modules)
diff --git a/core/tasks/vts-core-tests.mk b/core/tasks/vts-core-tests.mk
index f67d722..a3247da 100644
--- a/core/tasks/vts-core-tests.mk
+++ b/core/tasks/vts-core-tests.mk
@@ -12,20 +12,37 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-test_suite_name := vts-core
-test_suite_tradefed := vts-core-tradefed
+-include external/linux-kselftest/android/kselftest_test_list.mk
+-include external/ltp/android/ltp_package_list.mk
+
+test_suite_name := vts
+test_suite_tradefed := vts-tradefed
 test_suite_readme := test/vts/tools/vts-core-tradefed/README
 
-# TODO(b/149249068): Clean up after all VTS tests are converted.
-vts_test_artifact_paths :=
-# Some repo may not include vts project.
--include test/vts/tools/build/tasks/framework/vts_for_core_suite.mk
+# Copy kernel test modules to testcases directories
+kernel_test_host_out := $(HOST_OUT_TESTCASES)/vts_kernel_tests
+kernel_test_vts_out := $(HOST_OUT)/$(test_suite_name)/android-$(test_suite_name)/testcases/vts_kernel_tests
+kernel_test_modules := \
+    $(kselftest_modules) \
+    ltp \
+    $(ltp_packages)
+
+kernel_test_copy_pairs := \
+  $(call target-native-copy-pairs,$(kernel_test_modules),$(kernel_test_vts_out)) \
+  $(call target-native-copy-pairs,$(kernel_test_modules),$(kernel_test_host_out))
+
+copy_kernel_tests := $(call copy-many-files,$(kernel_test_copy_pairs))
+
+# PHONY target to be used to build and test `vts_kernel_tests` without building full vts
+.PHONY: vts_kernel_tests
+vts_kernel_tests: $(copy_kernel_tests)
 
 include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
 
-.PHONY: vts-core
-$(compatibility_zip): $(vts_test_artifact_paths)
-vts-core: $(compatibility_zip)
-$(call dist-for-goals, vts-core, $(compatibility_zip))
+$(compatibility_zip): $(copy_kernel_tests)
 
-tests: vts-core
+.PHONY: vts
+vts: $(compatibility_zip)
+$(call dist-for-goals, vts, $(compatibility_zip))
+
+tests: vts
diff --git a/core/test_config_common.mk b/core/test_config_common.mk
deleted file mode 100644
index 487f9f2..0000000
--- a/core/test_config_common.mk
+++ /dev/null
@@ -1,56 +0,0 @@
-#
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-LOCAL_MODULE_CLASS := TEST_CONFIG
-
-# Output test config files to testcases directory.
-ifeq (,$(filter general-tests, $(LOCAL_COMPATIBILITY_SUITE)))
-  LOCAL_COMPATIBILITY_SUITE += general-tests
-endif
-
-LOCAL_MODULE_SUFFIX := .config
-
-my_test_config_file := $(wildcard $(LOCAL_PATH)/$(LOCAL_MODULE).xml)
-LOCAL_SRC_FILES :=
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# The test config is not in a standalone XML file.
-ifndef my_test_config_file
-
-ifndef LOCAL_TEST_CONFIG_OPTIONS
-  $(call pretty-error,LOCAL_TEST_CONFIG_OPTIONS must be set if the test XML file is not provided.)
-endif
-
-my_base_test_config_file := $(LOCAL_PATH)/AndroidTest.xml
-my_test_config_file := $(dir $(LOCAL_BUILT_MODULE))AndroidTest.xml
-
-$(my_test_config_file) : PRIVATE_test_config_options := $(LOCAL_TEST_CONFIG_OPTIONS)
-$(my_test_config_file) : $(my_base_test_config_file)
-	@echo "Create $(notdir $@) with options: $(PRIVATE_test_config_options)."
-	$(eval _option_xml := \
-		$(foreach option,$(PRIVATE_test_config_options), \
-			$(eval p := $(subst :,$(space),$(option))) \
-			<option name="$(word 1,$(p))" value="$(word 2,$(p))" \/>\n))
-	$(hide) sed 's&</configuration>&$(_option_xml)</configuration>&' $< > $@
-
-endif # my_test_config_file
-
-$(LOCAL_BUILT_MODULE) : $(my_test_config_file)
-	$(copy-file-to-target)
-
-my_base_test_config_file :=
-my_test_config_file :=
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index ab7783f..f16b7a7 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -39,9 +39,9 @@
   include $(INTERNAL_BUILD_ID_MAKEFILE)
 endif
 
-DEFAULT_PLATFORM_VERSION := RP1A
-MIN_PLATFORM_VERSION := RP1A
-MAX_PLATFORM_VERSION := RP1A
+DEFAULT_PLATFORM_VERSION := SP1A
+MIN_PLATFORM_VERSION := SP1A
+MAX_PLATFORM_VERSION := SP1A
 
 ALLOWED_VERSIONS := $(call allowed-platform-versions,\
   $(MIN_PLATFORM_VERSION),\
@@ -85,10 +85,12 @@
 # unreleased API level targetable by this branch, not just those that are valid
 # lunch targets for this branch.
 PLATFORM_VERSION.RP1A := R
+PLATFORM_VERSION.SP1A := S
 
 # These are the current development codenames, if the build is not a final
 # release build.  If this is a final release build, it is simply "REL".
 PLATFORM_VERSION_CODENAME.RP1A := R
+PLATFORM_VERSION_CODENAME.SP1A := S
 
 ifndef PLATFORM_VERSION
   PLATFORM_VERSION := $(PLATFORM_VERSION.$(TARGET_PLATFORM_VERSION))
@@ -123,8 +125,8 @@
     PLATFORM_VERSION_CODENAME := $(TARGET_PLATFORM_VERSION)
   endif
 
-  # This is all of the *active* development codenames. There are future
-  # codenames not included in this list. This confusing name is needed because
+  # This is all of the *active* development codenames.
+  # This confusing name is needed because
   # all_codenames has been baked into build.prop for ages.
   #
   # Should be either the same as PLATFORM_VERSION_CODENAME or a comma-separated
@@ -141,29 +143,14 @@
     $(if $(filter $(_codename),$(PLATFORM_VERSION_ALL_CODENAMES)),,\
       $(eval PLATFORM_VERSION_ALL_CODENAMES += $(_codename))))
 
-  # This is all of the inactive development codenames. Available to be targeted
-  # in this branch but in the future relative to our current target.
-  PLATFORM_VERSION_FUTURE_CODENAMES :=
-
-  # Build a list of all untargeted code names. Avoid duplicates.
-  _versions_not_in_target := \
-    $(filter-out $(PLATFORM_VERSION_ALL_CODENAMES),$(ALL_VERSIONS))
-  $(foreach version,$(_versions_not_in_target),\
-    $(eval _codename := $(PLATFORM_VERSION_CODENAME.$(version)))\
-    $(if $(filter $(_codename),$(PLATFORM_VERSION_FUTURE_CODENAMES)),,\
-      $(eval PLATFORM_VERSION_FUTURE_CODENAMES += $(_codename))))
-
   # And convert from space separated to comma separated.
   PLATFORM_VERSION_ALL_CODENAMES := \
     $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_ALL_CODENAMES)))
-  PLATFORM_VERSION_FUTURE_CODENAMES := \
-    $(subst $(space),$(comma),$(strip $(PLATFORM_VERSION_FUTURE_CODENAMES)))
 
 endif
 .KATI_READONLY := \
   PLATFORM_VERSION_CODENAME \
-  PLATFORM_VERSION_ALL_CODENAMES \
-  PLATFORM_VERSION_FUTURE_CODENAMES
+  PLATFORM_VERSION_ALL_CODENAMES
 
 ifeq (REL,$(PLATFORM_VERSION_CODENAME))
   PLATFORM_PREVIEW_SDK_VERSION := 0
@@ -250,7 +237,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2020-03-05
+      PLATFORM_SECURITY_PATCH := 2020-05-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/envsetup.sh b/envsetup.sh
index 791a43d..0ec7e6f 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -33,7 +33,7 @@
 - allmod:     List all modules.
 - gomod:      Go to the directory containing a module.
 - pathmod:    Get the directory containing a module.
-- refreshmod: Refresh list of modules for allmod/gomod.
+- refreshmod: Refresh list of modules for allmod/gomod/pathmod.
 
 Environment options:
 - SANITIZE_HOST: Set to 'address' to use ASAN for all host modules.
@@ -119,13 +119,13 @@
     if [ "$BUILD_VAR_CACHE_READY" = "true" ]
     then
         eval "echo \"\${var_cache_$1}\""
-    return
+        return 0
     fi
 
     local T=$(gettop)
     if [ ! "$T" ]; then
         echo "Couldn't locate the top of the tree.  Try setting TOP." >&2
-        return
+        return 1
     fi
     (\cd $T; build/soong/soong_ui.bash --dumpvar-mode $1)
 }
@@ -576,10 +576,25 @@
 function print_lunch_menu()
 {
     local uname=$(uname)
-    local choices=$(TARGET_BUILD_APPS= get_build_var COMMON_LUNCH_CHOICES)
+    local choices
+    choices=$(TARGET_BUILD_APPS= get_build_var COMMON_LUNCH_CHOICES 2>/dev/null)
+    local ret=$?
+
     echo
     echo "You're building on" $uname
     echo
+
+    if [ $ret -ne 0 ]
+    then
+        echo "Warning: Cannot display lunch menu."
+        echo
+        echo "Note: You can invoke lunch with an explicit target:"
+        echo
+        echo "  usage: lunch [target]" >&2
+        echo
+        return
+    fi
+
     echo "Lunch menu... pick a combo:"
 
     local i=1
diff --git a/target/board/BoardConfigEmuCommon.mk b/target/board/BoardConfigEmuCommon.mk
index d11f9d2..a2e5518 100644
--- a/target/board/BoardConfigEmuCommon.mk
+++ b/target/board/BoardConfigEmuCommon.mk
@@ -74,6 +74,13 @@
   BOARD_VENDORIMAGE_PARTITION_SIZE := 146800640
 endif
 
+#vendor boot
+TARGET_NO_VENDOR_BOOT := false
+BOARD_INCLUDE_DTB_IN_BOOTIMG := false
+BOARD_BOOT_HEADER_VERSION := 3
+BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
+BOARD_VENDOR_BOOTIMAGE_PARTITION_SIZE := 0x06000000
+
 # Enable chain partition for system.
 BOARD_AVB_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
 BOARD_AVB_SYSTEM_ALGORITHM := SHA256_RSA2048
diff --git a/target/board/BoardConfigGsiCommon.mk b/target/board/BoardConfigGsiCommon.mk
index 61aa67c..c89e203 100644
--- a/target/board/BoardConfigGsiCommon.mk
+++ b/target/board/BoardConfigGsiCommon.mk
@@ -33,6 +33,13 @@
 #   updating the last seen rollback index in the tamper-evident storage.
 BOARD_AVB_ROLLBACK_INDEX := 0
 
+# Enable chain partition for system.
+# GSI need to sign on system.img instead of vbmeta.
+BOARD_AVB_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
+BOARD_AVB_SYSTEM_ALGORITHM := SHA256_RSA2048
+BOARD_AVB_SYSTEM_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)
+BOARD_AVB_SYSTEM_ROLLBACK_INDEX_LOCATION := 1
+
 # GSI specific System Properties
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
 TARGET_SYSTEM_EXT_PROP := build/make/target/board/gsi_system_ext.prop
diff --git a/target/board/emulator_arm64/BoardConfig.mk b/target/board/emulator_arm64/BoardConfig.mk
new file mode 100644
index 0000000..b34ccb4
--- /dev/null
+++ b/target/board/emulator_arm64/BoardConfig.mk
@@ -0,0 +1,77 @@
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# arm64 emulator specific definitions
+TARGET_ARCH := arm64
+TARGET_ARCH_VARIANT := armv8-a
+TARGET_CPU_VARIANT := generic
+TARGET_CPU_ABI := arm64-v8a
+
+TARGET_2ND_ARCH := arm
+TARGET_2ND_CPU_ABI := armeabi-v7a
+TARGET_2ND_CPU_ABI2 := armeabi
+
+ifneq ($(TARGET_BUILD_APPS)$(filter cts sdk vts10,$(MAKECMDGOALS)),)
+# DO NOT USE
+# DO NOT USE
+#
+# This architecture / CPU variant must NOT be used for any 64 bit
+# platform builds. It is the lowest common denominator required
+# to build an unbundled application or cts for all supported 32 and 64 bit
+# platforms.
+#
+# If you're building a 64 bit platform (and not an application) the
+# ARM-v8 specification allows you to assume all the features available in an
+# armv7-a-neon CPU. You should set the following as 2nd arch/cpu variant:
+#
+# TARGET_2ND_ARCH_VARIANT := armv8-a
+# TARGET_2ND_CPU_VARIANT := generic
+#
+# DO NOT USE
+# DO NOT USE
+TARGET_2ND_ARCH_VARIANT := armv7-a-neon
+# DO NOT USE
+# DO NOT USE
+TARGET_2ND_CPU_VARIANT := generic
+# DO NOT USE
+# DO NOT USE
+else
+TARGET_2ND_ARCH_VARIANT := armv8-a
+TARGET_2ND_CPU_VARIANT := generic
+endif
+
+include build/make/target/board/BoardConfigGsiCommon.mk
+include build/make/target/board/BoardConfigEmuCommon.mk
+
+TARGET_NO_KERNEL := false
+TARGET_NO_VENDOR_BOOT := false
+BOARD_USES_RECOVERY_AS_BOOT := true
+
+BOARD_BOOTIMAGE_PARTITION_SIZE := 0x02000000
+BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
+
+BOARD_BOOT_HEADER_VERSION := 3
+BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
+
+# Wifi.
+BOARD_WLAN_DEVICE           := emulator
+BOARD_HOSTAPD_DRIVER        := NL80211
+BOARD_WPA_SUPPLICANT_DRIVER := NL80211
+BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
+BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
+WPA_SUPPLICANT_VERSION      := VER_0_8_X
+WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
+WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
+WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
diff --git a/target/board/emulator_arm64/device.mk b/target/board/emulator_arm64/device.mk
new file mode 100644
index 0000000..6753c11
--- /dev/null
+++ b/target/board/emulator_arm64/device.mk
@@ -0,0 +1,29 @@
+#
+# Copyright (C) 2020 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Cuttlefish has GKI kernel prebuilts, so use those for the GKI boot.img.
+ifeq ($(TARGET_PREBUILT_KERNEL),)
+    LOCAL_KERNEL := device/google/cuttlefish_kernel/5.4-arm64/kernel
+else
+    LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL)
+endif
+
+PRODUCT_COPY_FILES += \
+    $(LOCAL_KERNEL):kernel
+
+# Adjust the Dalvik heap to be appropriate for a tablet.
+$(call inherit-product-if-exists, frameworks/base/build/tablet-dalvik-heap.mk)
+$(call inherit-product-if-exists, frameworks/native/build/tablet-dalvik-heap.mk)
diff --git a/target/board/emulator_arm64/system_ext.prop b/target/board/emulator_arm64/system_ext.prop
new file mode 100644
index 0000000..2f8f803
--- /dev/null
+++ b/target/board/emulator_arm64/system_ext.prop
@@ -0,0 +1,5 @@
+#
+# system.prop for emulator arm64 sdk
+#
+
+rild.libpath=/vendor/lib64/libreference-ril.so
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index a5264e4..d793c38 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -53,20 +53,23 @@
 endif
 
 include build/make/target/board/BoardConfigGsiCommon.mk
-include build/make/target/board/BoardConfigEmuCommon.mk
+
+BOARD_EXT4_SHARE_DUP_BLOCKS := true
 
 TARGET_NO_KERNEL := false
 TARGET_NO_VENDOR_BOOT := true
 BOARD_USES_RECOVERY_AS_BOOT := true
 
-BOARD_BOOTIMAGE_PARTITION_SIZE := 0x02000000
+BOARD_BOOTIMAGE_PARTITION_SIZE := 0x04000000
 BOARD_USERDATAIMAGE_PARTITION_SIZE := 576716800
 
 BOARD_BOOT_HEADER_VERSION := 3
 BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
 
-# Emulator system image is going to be used as GSI and some vendor still hasn't
-# cleaned up all device specific directories under root!
+BOARD_KERNEL_BINARIES := kernel-5.4 kernel-5.4-gz kernel-5.4-lz4
+
+# Some vendors still haven't cleaned up all device specific directories under
+# root!
 
 # TODO(b/111434759, b/111287060) SoC specific hacks
 BOARD_ROOT_EXTRA_SYMLINKS += /vendor/lib/dsp:/dsp
@@ -76,14 +79,3 @@
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
 BOARD_SEPOLICY_DIRS += build/make/target/board/generic_arm64/sepolicy
-
-# Wifi.
-BOARD_WLAN_DEVICE           := emulator
-BOARD_HOSTAPD_DRIVER        := NL80211
-BOARD_WPA_SUPPLICANT_DRIVER := NL80211
-BOARD_HOSTAPD_PRIVATE_LIB   := lib_driver_cmd_simulated
-BOARD_WPA_SUPPLICANT_PRIVATE_LIB := lib_driver_cmd_simulated
-WPA_SUPPLICANT_VERSION      := VER_0_8_X
-WIFI_DRIVER_FW_PATH_PARAM   := "/dev/null"
-WIFI_DRIVER_FW_PATH_STA     := "/dev/null"
-WIFI_DRIVER_FW_PATH_AP      := "/dev/null"
diff --git a/target/board/generic_arm64/device.mk b/target/board/generic_arm64/device.mk
index 4fcae46..3b7cd44 100644
--- a/target/board/generic_arm64/device.mk
+++ b/target/board/generic_arm64/device.mk
@@ -14,15 +14,10 @@
 # limitations under the License.
 #
 
-# Cuttlefish has GKI kernel prebuilts, so use those for the GKI boot.img.
-ifeq ($(TARGET_PREBUILT_KERNEL),)
-    LOCAL_KERNEL := device/google/cuttlefish_kernel/5.4-arm64/kernel
-else
-    LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL)
-endif
-
 PRODUCT_COPY_FILES += \
-    $(LOCAL_KERNEL):kernel
+    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4:kernel-5.4 \
+    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-gz:kernel-5.4-gz \
+    device/google/cuttlefish_kernel/5.4-arm64/kernel-5.4-lz4:kernel-5.4-lz4
 
 # Adjust the Dalvik heap to be appropriate for a tablet.
 $(call inherit-product-if-exists, frameworks/base/build/tablet-dalvik-heap.mk)
diff --git a/target/product/aosp_arm64.mk b/target/product/aosp_arm64.mk
index 491397f..3254ccf 100644
--- a/target/product/aosp_arm64.mk
+++ b/target/product/aosp_arm64.mk
@@ -14,8 +14,6 @@
 # limitations under the License.
 #
 
-PRODUCT_USE_DYNAMIC_PARTITIONS := true
-
 # The system image of aosp_arm64-userdebug is a GSI for the devices with:
 # - ARM 64 bits user space
 # - 64 bits binder interface
@@ -51,7 +49,7 @@
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
 
 #
-# All components inherited here go to vendor image
+# All components inherited here go to vendor or vendor_boot image
 #
 $(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_arm64/device.mk)
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 434cbfc..a3ca2a5 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -41,6 +41,7 @@
     bmgr \
     bootanimation \
     bootstat \
+    boringssl_self_test \
     bpfloader \
     bu \
     bugreport \
@@ -81,6 +82,7 @@
     framework-res \
     framework-sysconfig.xml \
     fsck_msdos \
+    fsverity-release-cert-der \
     fs_config_files_system \
     fs_config_dirs_system \
     group_system \
@@ -106,7 +108,6 @@
     installd \
     iorapd \
     ip \
-    ip6tables \
     iptables \
     ip-up-vpn \
     javax.obex \
@@ -320,6 +321,7 @@
     $(ART_APEX_JARS) \
     framework-minus-apex \
     ext \
+    com.android.i18n:core-icu4j \
     telephony-common \
     voip-common \
     ims-common \
diff --git a/target/product/emulated_storage.mk b/target/product/emulated_storage.mk
index 89de192..d7cc9ce 100644
--- a/target/product/emulated_storage.mk
+++ b/target/product/emulated_storage.mk
@@ -15,7 +15,7 @@
 #
 
 PRODUCT_QUOTA_PROJID := 1
-PRODUCT_PRODUCT_PROPERTIES += ro.emulated_storage.projid=1
+PRODUCT_PROPERTY_OVERRIDES += external_storage.projid.enabled=1
 
 PRODUCT_FS_CASEFOLD := 1
-PRODUCT_PRODUCT_PROPERTIES += ro.emulated_storage.casefold=1
+PRODUCT_PROPERTY_OVERRIDES += external_storage.casefold.enabled=1
diff --git a/target/product/full.mk b/target/product/full.mk
index b356f9d..adb54ab 100644
--- a/target/product/full.mk
+++ b/target/product/full.mk
@@ -19,6 +19,7 @@
 # build quite specifically for the emulator, and might not be
 # entirely appropriate to inherit from for on-device configurations.
 
+$(call inherit-product-if-exists, device/generic/goldfish/arm32-vendor.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic/device.mk)
diff --git a/target/product/go_defaults_common.mk b/target/product/go_defaults_common.mk
index f931f4a..3e42b68 100644
--- a/target/product/go_defaults_common.mk
+++ b/target/product/go_defaults_common.mk
@@ -40,7 +40,7 @@
 # Do not spin up a separate process for the network stack on go devices, use an in-process APK.
 PRODUCT_PACKAGES += InProcessNetworkStack
 PRODUCT_PACKAGES += CellBroadcastAppPlatform
-PRODUCT_PACKAGES += InProcessTethering
+PRODUCT_PACKAGES += com.android.tethering.inprocess
 
 # Strip the local variable table and the local variable type table to reduce
 # the size of the system image. This has no bearing on stack traces, but will
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index 0c1f788..1bfdf0a 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -14,6 +14,7 @@
 LLNDK: libmediandk.so
 LLNDK: libnativewindow.so
 LLNDK: libneuralnetworks.so
+LLNDK: libselinux.so
 LLNDK: libsync.so
 LLNDK: libvndksupport.so
 LLNDK: libvulkan.so
@@ -128,7 +129,7 @@
 VNDK-core: android.hardware.health@1.0.so
 VNDK-core: android.hardware.health@2.0.so
 VNDK-core: android.hardware.health@2.1.so
-VNDK-core: android.hardware.identity-V1-ndk_platform.so
+VNDK-core: android.hardware.identity-V2-ndk_platform.so
 VNDK-core: android.hardware.input.classifier@1.0.so
 VNDK-core: android.hardware.input.common@1.0.so
 VNDK-core: android.hardware.ir@1.0.so
@@ -253,7 +254,6 @@
 VNDK-core: libpower.so
 VNDK-core: libprocinfo.so
 VNDK-core: libradio_metadata.so
-VNDK-core: libselinux.so
 VNDK-core: libspeexresampler.so
 VNDK-core: libsqlite.so
 VNDK-core: libssl.so
diff --git a/target/product/runtime_libart.mk b/target/product/runtime_libart.mk
index 5184016..84b1252 100644
--- a/target/product/runtime_libart.mk
+++ b/target/product/runtime_libart.mk
@@ -75,6 +75,10 @@
     pm.dexopt.inactive=verify \
     pm.dexopt.shared=speed
 
+# Pass file with the list of updatable boot class path packages to dex2oat.
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
+    dalvik.vm.dex2oat-updatable-bcp-packages-file=/system/etc/updatable-bcp-packages.txt
+
 # Enable resolution of startup const strings.
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
     dalvik.vm.dex2oat-resolve-startup-strings=true
diff --git a/target/product/sdk_phone_arm64.mk b/target/product/sdk_phone_arm64.mk
index 9024890..3ab0c57 100644
--- a/target/product/sdk_phone_arm64.mk
+++ b/target/product/sdk_phone_arm64.mk
@@ -15,8 +15,36 @@
 #
 QEMU_USE_SYSTEM_EXT_PARTITIONS := true
 
-$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_arm64.mk)
+PRODUCT_USE_DYNAMIC_PARTITIONS := true
+
+# This is a build configuration for a full-featured build of the
+# Open-Source part of the tree. It's geared toward a US-centric
+# build quite specifically for the emulator, and might not be
+# entirely appropriate to inherit from for on-device configurations.
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor or vendor_boot image
+#
 $(call inherit-product-if-exists, device/generic/goldfish/arm64-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/emulator_arm64/device.mk)
 
 # Define the host tools and libs that are parts of the SDK.
 $(call inherit-product, sdk/build/product_sdk.mk)
@@ -29,7 +57,7 @@
 # Overrides
 PRODUCT_BRAND := Android
 PRODUCT_NAME := sdk_phone_arm64
-PRODUCT_DEVICE := generic_arm64
+PRODUCT_DEVICE := emulator_arm64
 PRODUCT_MODEL := Android SDK built for arm64
 
 
diff --git a/target/product/security/Android.bp b/target/product/security/Android.bp
index 080706b..5f4f82b 100644
--- a/target/product/security/Android.bp
+++ b/target/product/security/Android.bp
@@ -3,3 +3,11 @@
     name: "aosp-testkey",
     certificate: "testkey",
 }
+
+// Google-owned certificate for CTS testing, since we can't trust arbitrary keys on release devices.
+prebuilt_etc {
+    name: "fsverity-release-cert-der",
+    src: "fsverity-release.x509.der",
+    sub_dir: "security/fsverity",
+    filename_from_src: true,
+}
diff --git a/target/product/security/fsverity-release.x509.der b/target/product/security/fsverity-release.x509.der
new file mode 100644
index 0000000..cd8cd79
--- /dev/null
+++ b/target/product/security/fsverity-release.x509.der
Binary files differ
diff --git a/target/product/userspace_reboot.mk b/target/product/userspace_reboot.mk
index 76ec83d..3f881af 100644
--- a/target/product/userspace_reboot.mk
+++ b/target/product/userspace_reboot.mk
@@ -16,6 +16,4 @@
 
 # Inherit this when the target supports userspace reboot
 
-PRODUCT_PROPERTY_OVERRIDES := ro.init.userspace_reboot.is_supported=true
-
-# TODO(b/135984674): configure userspace reboot related properties
+PRODUCT_PROPERTY_OVERRIDES := init.userspace_reboot.is_supported=true
diff --git a/tools/fs_config/fs_config.c b/tools/fs_config/fs_config.c
index 2952875..2a75add 100644
--- a/tools/fs_config/fs_config.c
+++ b/tools/fs_config/fs_config.c
@@ -26,6 +26,7 @@
 #include <selinux/label.h>
 
 #include "private/android_filesystem_config.h"
+#include "private/fs_config.h"
 
 // This program takes a list of files and directories (indicated by a
 // trailing slash) on the stdin, and prints to stdout each input
diff --git a/tools/fs_get_stats/fs_get_stats.c b/tools/fs_get_stats/fs_get_stats.c
index 159e2aa..64ef0e2 100644
--- a/tools/fs_get_stats/fs_get_stats.c
+++ b/tools/fs_get_stats/fs_get_stats.c
@@ -4,6 +4,7 @@
 #include <unistd.h>
 
 #include <private/android_filesystem_config.h>
+#include <private/fs_config.h>
 
 #define DO_DEBUG 1
 
diff --git a/tools/releasetools/Android.bp b/tools/releasetools/Android.bp
index f29ec90..d6f2116 100644
--- a/tools/releasetools/Android.bp
+++ b/tools/releasetools/Android.bp
@@ -238,6 +238,16 @@
             embedded_launcher: false,
         },
     },
+    // TODO (b/140144201) Build imgdiff from releasetools_common
+    required: [
+        "aapt2",
+        "boot_signer",
+        "brotli",
+        "bsdiff",
+        "imgdiff",
+        "minigzip",
+        "mkbootfs",
+    ],
 }
 
 python_binary_host {
diff --git a/tools/releasetools/OWNERS b/tools/releasetools/OWNERS
index a8295d4..d7fc540 100644
--- a/tools/releasetools/OWNERS
+++ b/tools/releasetools/OWNERS
@@ -1,3 +1,4 @@
+elsk@google.com
 nhdo@google.com
 xunchang@google.com
 zhaojiac@google.com
diff --git a/tools/releasetools/add_img_to_target_files.py b/tools/releasetools/add_img_to_target_files.py
index cc05c64..7db506c 100755
--- a/tools/releasetools/add_img_to_target_files.py
+++ b/tools/releasetools/add_img_to_target_files.py
@@ -731,16 +731,24 @@
   boot_image = None
   if has_boot:
     banner("boot")
-    # common.GetBootableImage() returns the image directly if present.
-    boot_image = common.GetBootableImage(
-        "IMAGES/boot.img", "boot.img", OPTIONS.input_tmp, "BOOT")
-    # boot.img may be unavailable in some targets (e.g. aosp_arm64).
-    if boot_image:
-      partitions['boot'] = os.path.join(OPTIONS.input_tmp, "IMAGES", "boot.img")
-      if not os.path.exists(partitions['boot']):
-        boot_image.WriteToDir(OPTIONS.input_tmp)
-        if output_zip:
-          boot_image.AddToZip(output_zip)
+    boot_images = OPTIONS.info_dict.get("boot_images")
+    if boot_images is None:
+      boot_images = "boot.img"
+    for b in boot_images.split():
+      # common.GetBootableImage() returns the image directly if present.
+      boot_image = common.GetBootableImage(
+          "IMAGES/" + b, b, OPTIONS.input_tmp, "BOOT")
+      # boot.img may be unavailable in some targets (e.g. aosp_arm64).
+      if boot_image:
+        boot_image_path = os.path.join(OPTIONS.input_tmp, "IMAGES", b)
+        # vbmeta does not need to include boot.img with multiple boot.img files,
+        # which is only used for aosp_arm64 for GKI
+        if len(boot_images.split()) == 1:
+          partitions['boot'] = boot_image_path
+        if not os.path.exists(boot_image_path):
+          boot_image.WriteToDir(OPTIONS.input_tmp)
+          if output_zip:
+            boot_image.AddToZip(output_zip)
 
   if has_vendor_boot:
     banner("vendor_boot")
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 54bb857..f30f787 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -57,7 +57,7 @@
   Returns:
     The number of bytes based on a 1K block_size.
   """
-  cmd = ["du", "-k", "-s", path]
+  cmd = ["du", "-b", "-k", "-s", path]
   output = common.RunAndCheckOutput(cmd, verbose=False)
   return int(output.split()[0]) * 1024
 
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 3bbf9d8..1abf5a5 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -77,6 +77,7 @@
     self.boot_signer_args = []
     self.verity_signer_path = None
     self.verity_signer_args = []
+    self.aftl_tool_path = None
     self.aftl_server = None
     self.aftl_key_path = None
     self.aftl_manufacturer_key_path = None
@@ -335,8 +336,11 @@
   _RO_PRODUCT_RESOLVE_PROPS = ["ro.product.brand", "ro.product.device",
                                "ro.product.manufacturer", "ro.product.model",
                                "ro.product.name"]
-  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER = ["product", "odm", "vendor",
-                                            "system_ext", "system"]
+  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_CURRENT = [
+      "product", "odm", "vendor", "system_ext", "system"]
+  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_ANDROID_10 = [
+      "product", "product_services", "odm", "vendor", "system"]
+  _RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_LEGACY = []
 
   def __init__(self, info_dict, oem_dicts=None):
     """Initializes a BuildInfo instance with the given dicts.
@@ -357,10 +361,13 @@
     self.oem_dicts = oem_dicts
 
     self._is_ab = info_dict.get("ab_update") == "true"
-    self._oem_props = info_dict.get("oem_fingerprint_properties")
 
-    if self._oem_props:
-      assert oem_dicts, "OEM source required for this build"
+    # Skip _oem_props if oem_dicts is None to use BuildInfo in
+    # sign_target_files_apks
+    if self.oem_dicts:
+      self._oem_props = info_dict.get("oem_fingerprint_properties")
+    else:
+      self._oem_props = None
 
     def check_fingerprint(fingerprint):
       if (" " in fingerprint or any(ord(ch) > 127 for ch in fingerprint)):
@@ -446,16 +453,16 @@
     if prop_val:
       return prop_val
 
+    default_source_order = self._GetRoProductPropsDefaultSourceOrder()
     source_order_val = self.info_dict.get("build.prop", {}).get(
         "ro.product.property_source_order")
     if source_order_val:
       source_order = source_order_val.split(",")
     else:
-      source_order = BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER
+      source_order = default_source_order
 
     # Check that all sources in ro.product.property_source_order are valid
-    if any([x not in BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER
-            for x in source_order]):
+    if any([x not in default_source_order for x in source_order]):
       raise ExternalError(
           "Invalid ro.product.property_source_order '{}'".format(source_order))
 
@@ -469,6 +476,27 @@
 
     raise ExternalError("couldn't resolve {}".format(prop))
 
+  def _GetRoProductPropsDefaultSourceOrder(self):
+    # NOTE: refer to CDDs and android.os.Build.VERSION for the definition and
+    # values of these properties for each Android release.
+    android_codename = self.info_dict.get("build.prop", {}).get(
+        "ro.build.version.codename")
+    if android_codename == "REL":
+      android_version = self.info_dict.get("build.prop", {}).get(
+          "ro.build.version.release")
+      if android_version == "10":
+        return BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_ANDROID_10
+      # NOTE: float() conversion of android_version will have rounding error.
+      # We are checking for "9" or less, and using "< 10" is well outside of
+      # possible floating point rounding.
+      try:
+        android_version_val = float(android_version)
+      except ValueError:
+        android_version_val = 0
+      if android_version_val < 10:
+        return BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_LEGACY
+    return BuildInfo._RO_PRODUCT_PROPS_DEFAULT_SOURCE_ORDER_CURRENT
+
   def GetOemProperty(self, key):
     if self.oem_props is not None and key in self.oem_props:
       return self.oem_dicts[0][key]
@@ -931,10 +959,11 @@
   return "{}:{}:{}".format(partition, rollback_index_location, pubkey_path)
 
 
-def AddAftlInclusionProof(output_image):
-  """Appends the aftl inclusion proof to the vbmeta image."""
+def ConstructAftlMakeImageCommands(output_image):
+  """Constructs the command to append the aftl image to vbmeta."""
 
   # Ensure the other AFTL parameters are set as well.
+  assert OPTIONS.aftl_tool_path is not None, 'No aftl tool provided.'
   assert OPTIONS.aftl_key_path is not None, 'No AFTL key provided.'
   assert OPTIONS.aftl_manufacturer_key_path is not None, \
       'No AFTL manufacturer key provided.'
@@ -943,17 +972,25 @@
   os.rename(output_image, vbmeta_image)
   build_info = BuildInfo(OPTIONS.info_dict)
   version_incremental = build_info.GetBuildProp("ro.build.version.incremental")
-  aftl_cmd = ["aftltool", "make_icp_from_vbmeta",
+  aftltool = OPTIONS.aftl_tool_path
+  server_argument_list = [OPTIONS.aftl_server, OPTIONS.aftl_key_path]
+  aftl_cmd = [aftltool, "make_icp_from_vbmeta",
               "--vbmeta_image_path", vbmeta_image,
               "--output", output_image,
               "--version_incremental", version_incremental,
-              "--transparency_log_servers", OPTIONS.aftl_server,
-              "--transparency_log_pub_keys", OPTIONS.aftl_key_path,
+              "--transparency_log_servers", ','.join(server_argument_list),
               "--manufacturer_key", OPTIONS.aftl_manufacturer_key_path,
               "--algorithm", "SHA256_RSA4096",
               "--padding", "4096"]
   if OPTIONS.aftl_signer_helper:
     aftl_cmd.extend(shlex.split(OPTIONS.aftl_signer_helper))
+  return aftl_cmd
+
+
+def AddAftlInclusionProof(output_image):
+  """Appends the aftl inclusion proof to the vbmeta image."""
+
+  aftl_cmd = ConstructAftlMakeImageCommands(output_image)
   RunAndCheckOutput(aftl_cmd)
 
   verify_cmd = ['aftltool', 'verify_image_icp', '--vbmeta_image_path',
@@ -1044,7 +1081,7 @@
   return ramdisk_img
 
 
-def _BuildBootableImage(sourcedir, fs_config_file, info_dict=None,
+def _BuildBootableImage(image_name, sourcedir, fs_config_file, info_dict=None,
                         has_ramdisk=False, two_step_image=False):
   """Build a bootable image from the specified sourcedir.
 
@@ -1057,7 +1094,15 @@
   for building the requested image.
   """
 
-  if not os.access(os.path.join(sourcedir, "kernel"), os.F_OK):
+  # "boot" or "recovery", without extension.
+  partition_name = os.path.basename(sourcedir).lower()
+
+  if partition_name == "recovery":
+    kernel = "kernel"
+  else:
+    kernel = image_name.replace("boot", "kernel")
+    kernel = kernel.replace(".img","")
+  if not os.access(os.path.join(sourcedir, kernel), os.F_OK):
     return None
 
   if has_ramdisk and not os.access(os.path.join(sourcedir, "RAMDISK"), os.F_OK):
@@ -1074,7 +1119,7 @@
   # use MKBOOTIMG from environ, or "mkbootimg" if empty or not set
   mkbootimg = os.getenv('MKBOOTIMG') or "mkbootimg"
 
-  cmd = [mkbootimg, "--kernel", os.path.join(sourcedir, "kernel")]
+  cmd = [mkbootimg, "--kernel", os.path.join(sourcedir, kernel)]
 
   fn = os.path.join(sourcedir, "second")
   if os.access(fn, os.F_OK):
@@ -1101,7 +1146,14 @@
     cmd.append("--pagesize")
     cmd.append(open(fn).read().rstrip("\n"))
 
-  args = info_dict.get("mkbootimg_args")
+  if partition_name == "recovery":
+    args = info_dict.get("recovery_mkbootimg_args")
+    if not args:
+      # Fall back to "mkbootimg_args" for recovery image
+      # in case "recovery_mkbootimg_args" is not set.
+      args = info_dict.get("mkbootimg_args")
+  else:
+    args = info_dict.get("mkbootimg_args")
   if args and args.strip():
     cmd.extend(shlex.split(args))
 
@@ -1119,9 +1171,6 @@
   else:
     cmd.extend(["--output", img.name])
 
-  # "boot" or "recovery", without extension.
-  partition_name = os.path.basename(sourcedir).lower()
-
   if partition_name == "recovery":
     if info_dict.get("include_recovery_dtbo") == "true":
       fn = os.path.join(sourcedir, "recovery_dtbo")
@@ -1223,7 +1272,7 @@
                  info_dict.get("recovery_as_boot") == "true")
 
   fs_config = "META/" + tree_subdir.lower() + "_filesystem_config.txt"
-  data = _BuildBootableImage(os.path.join(unpack_dir, tree_subdir),
+  data = _BuildBootableImage(prebuilt_name, os.path.join(unpack_dir, tree_subdir),
                              os.path.join(unpack_dir, fs_config),
                              info_dict, has_ramdisk, two_step_image)
   if data:
@@ -1783,8 +1832,8 @@
       continue
     m = re.match(
         r'^name="(?P<NAME>.*)"\s+certificate="(?P<CERT>.*)"\s+'
-        r'private_key="(?P<PRIVKEY>.*?)"(\s+compressed="(?P<COMPRESSED>.*)")?'
-        r'(\s+partition="(?P<PARTITION>.*)")?$',
+        r'private_key="(?P<PRIVKEY>.*?)"(\s+compressed="(?P<COMPRESSED>.*?)")?'
+        r'(\s+partition="(?P<PARTITION>.*?)")?$',
         line)
     if not m:
       continue
@@ -1876,9 +1925,9 @@
          "java_path=", "java_args=", "android_jar_path=", "public_key_suffix=",
          "private_key_suffix=", "boot_signer_path=", "boot_signer_args=",
          "verity_signer_path=", "verity_signer_args=", "device_specific=",
-         "extra=", "logfile=", "aftl_server=", "aftl_key_path=",
-         "aftl_manufacturer_key_path=", "aftl_signer_helper="] +
-        list(extra_long_opts))
+         "extra=", "logfile=", "aftl_tool_path=", "aftl_server=",
+         "aftl_key_path=", "aftl_manufacturer_key_path=",
+         "aftl_signer_helper="] + list(extra_long_opts))
   except getopt.GetoptError as err:
     Usage(docstring)
     print("**", str(err), "**")
@@ -1916,6 +1965,8 @@
       OPTIONS.verity_signer_path = a
     elif o in ("--verity_signer_args",):
       OPTIONS.verity_signer_args = shlex.split(a)
+    elif o in ("--aftl_tool_path",):
+      OPTIONS.aftl_tool_path = a
     elif o in ("--aftl_server",):
       OPTIONS.aftl_server = a
     elif o in ("--aftl_key_path",):
diff --git a/tools/releasetools/merge_target_files.py b/tools/releasetools/merge_target_files.py
index 8e97509..d9d3854 100755
--- a/tools/releasetools/merge_target_files.py
+++ b/tools/releasetools/merge_target_files.py
@@ -95,6 +95,8 @@
 logger = logging.getLogger(__name__)
 
 OPTIONS = common.OPTIONS
+# Always turn on verbose logging.
+OPTIONS.verbose = True
 OPTIONS.framework_target_files = None
 OPTIONS.framework_item_list = None
 OPTIONS.framework_misc_info_keys = None
@@ -117,14 +119,15 @@
 
 PARTITION_ITEM_PATTERN = re.compile(r'^([A-Z_]+)/\*$')
 
-# In apexkeys.txt or apkcerts.txt, we may find partition tags on the various
-# entries in the file. We use these partition tags to filter the entries in
-# those files from the two different target files packages to produce a merged
-# apexkeys.txt or apkcerts.txt file. A partition tag (e.g., for the product
-# partition) looks like this: 'partition="_PRODUCT"' or 'partition="product".
-# We use the group syntax grab the value of the tag.
+# In apexkeys.txt or apkcerts.txt, we will find partition tags on each entry in
+# the file. We use these partition tags to filter the entries in those files
+# from the two different target files packages to produce a merged apexkeys.txt
+# or apkcerts.txt file. A partition tag (e.g., for the product partition) looks
+# like this: 'partition="product"'. We use the group syntax grab the value of
+# the tag. We use non-greedy matching in case there are other fields on the
+# same line.
 
-PARTITION_TAG_PATTERN = re.compile(r'partition="(.*)"')
+PARTITION_TAG_PATTERN = re.compile(r'partition="(.*?)"')
 
 # The sorting algorithm for apexkeys.txt and apkcerts.txt does not include the
 # ".apex" or ".apk" suffix, so we use the following pattern to extract a key.
@@ -1108,9 +1111,6 @@
     common.Usage(__doc__)
     sys.exit(1)
 
-  # Always turn on verbose logging.
-  OPTIONS.verbose = True
-
   if OPTIONS.framework_item_list:
     framework_item_list = common.LoadListFromFile(OPTIONS.framework_item_list)
   else:
diff --git a/tools/releasetools/sign_apex.py b/tools/releasetools/sign_apex.py
index b0128dc..fb947f4 100755
--- a/tools/releasetools/sign_apex.py
+++ b/tools/releasetools/sign_apex.py
@@ -35,6 +35,10 @@
   -e  (--extra_apks)  <name,name,...=key>
       Add extra APK name/key pairs. This is useful to sign the apk files in the
       apex payload image.
+
+  --codename_to_api_level_map Q:29,R:30,...
+      A Mapping of codename to api level.  This is useful to provide sdk targeting
+      information to APK Signer.
 """
 
 import logging
@@ -48,7 +52,7 @@
 
 
 def SignApexFile(avbtool, apex_file, payload_key, container_key, no_hashtree,
-                 apk_keys=None, signing_args=None):
+                 apk_keys=None, signing_args=None, codename_to_api_level_map=None):
   """Signs the given apex file."""
   with open(apex_file, 'rb') as input_fp:
     apex_data = input_fp.read()
@@ -59,7 +63,7 @@
       payload_key=payload_key,
       container_key=container_key,
       container_pw=None,
-      codename_to_api_level_map=None,
+      codename_to_api_level_map=codename_to_api_level_map,
       no_hashtree=no_hashtree,
       apk_keys=apk_keys,
       signing_args=signing_args)
@@ -82,6 +86,13 @@
       options['payload_key'] = a
     elif o == '--payload_extra_args':
       options['payload_extra_args'] = a
+    elif o == '--codename_to_api_level_map':
+      versions = a.split(",")
+      for v in versions:
+        key, value = v.split(":")
+        if 'codename_to_api_level_map' not in options:
+          options['codename_to_api_level_map'] = {}
+        options['codename_to_api_level_map'].update({key: value})
     elif o in ("-e", "--extra_apks"):
       names, key = a.split("=")
       names = names.split(",")
@@ -98,6 +109,7 @@
       extra_opts='e:',
       extra_long_opts=[
           'avbtool=',
+          'codename_to_api_level_map=',
           'container_key=',
           'payload_extra_args=',
           'payload_key=',
@@ -119,7 +131,9 @@
       options['container_key'],
       no_hashtree=False,
       apk_keys=options.get('extra_apks', {}),
-      signing_args=options.get('payload_extra_args'))
+      signing_args=options.get('payload_extra_args'),
+      codename_to_api_level_map=options.get(
+          'codename_to_api_level_map', {}))
   shutil.copyfile(signed_apex, args[1])
   logger.info("done.")
 
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 783d63c..52cd9a8 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -1082,8 +1082,8 @@
         r'public_key="(?P<PAYLOAD_PUBLIC_KEY>.*)"\s+'
         r'private_key="(?P<PAYLOAD_PRIVATE_KEY>.*)"\s+'
         r'container_certificate="(?P<CONTAINER_CERT>.*)"\s+'
-        r'container_private_key="(?P<CONTAINER_PRIVATE_KEY>.*)"\s+'
-        r'partition="(?P<PARTITION>.*)"$',
+        r'container_private_key="(?P<CONTAINER_PRIVATE_KEY>.*?)"'
+        r'(\s+partition="(?P<PARTITION>.*?)")?$',
         line)
     if not matches:
       continue
diff --git a/tools/releasetools/test_check_target_files_vintf.py b/tools/releasetools/test_check_target_files_vintf.py
index 79f9018..d326229 100644
--- a/tools/releasetools/test_check_target_files_vintf.py
+++ b/tools/releasetools/test_check_target_files_vintf.py
@@ -35,20 +35,20 @@
     'SYSTEM_EXT/etc/build.prop': '',
 
     # Non-empty files
-    'SYSTEM/compatibility_matrix.xml':"""
-        <compatibility-matrix version="1.0" type="framework">
+    'SYSTEM/etc/vintf/compatibility_matrix.1.xml':"""
+        <compatibility-matrix version="1.0" level="1" type="framework">
             <sepolicy>
                 <sepolicy-version>0.0</sepolicy-version>
                 <kernel-sepolicy-version>0</kernel-sepolicy-version>
             </sepolicy>
         </compatibility-matrix>""",
     'SYSTEM/manifest.xml':
-        '<manifest version="1.0" type="framework" />',
+        '<manifest version="1.0" type="framework"/>',
     'VENDOR/build.prop': 'ro.product.first_api_level=29\n',
     'VENDOR/compatibility_matrix.xml':
         '<compatibility-matrix version="1.0" type="device" />',
-    'VENDOR/manifest.xml':
-        '<manifest version="1.0" type="device"/>',
+    'VENDOR/etc/vintf/manifest.xml':
+        '<manifest version="1.0" target-level="1" type="device"/>',
     'META/misc_info.txt':
         'recovery_api_version=3\nfstab_version=2\nvintf_enforce=true\n',
 }
@@ -140,6 +140,6 @@
   def test_CheckVintf_bad_xml(self):
     test_dir = self.prepare_test_dir('does-not-exist')
     write_string_to_file('not an XML',
-                         os.path.join(test_dir, 'VENDOR/manifest.xml'))
+                         os.path.join(test_dir, 'VENDOR/etc/vintf/manifest.xml'))
     # Should raise an error because a file has invalid format.
     self.assertRaises(common.ExternalError, CheckVintf, test_dir)
diff --git a/tools/releasetools/test_common.py b/tools/releasetools/test_common.py
index 9621de8..665eb51 100644
--- a/tools/releasetools/test_common.py
+++ b/tools/releasetools/test_common.py
@@ -19,6 +19,7 @@
 import subprocess
 import tempfile
 import time
+import unittest
 import zipfile
 from hashlib import sha1
 
@@ -107,6 +108,51 @@
       },
   ]
 
+  TEST_INFO_DICT_PROPERTY_SOURCE_ORDER = {
+      'build.prop' : {
+          'ro.build.fingerprint' : 'build-fingerprint',
+          'ro.product.property_source_order' :
+              'product,odm,vendor,system_ext,system',
+      },
+      'system.build.prop' : {
+          'ro.product.system.device' : 'system-product-device',
+      },
+      'vendor.build.prop' : {
+          'ro.product.vendor.device' : 'vendor-product-device',
+      },
+  }
+
+  TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_10 = {
+      'build.prop' : {
+          'ro.build.fingerprint' : 'build-fingerprint',
+          'ro.product.property_source_order' :
+              'product,product_services,odm,vendor,system',
+          'ro.build.version.release' : '10',
+          'ro.build.version.codename' : 'REL',
+      },
+      'system.build.prop' : {
+          'ro.product.system.device' : 'system-product-device',
+      },
+      'vendor.build.prop' : {
+          'ro.product.vendor.device' : 'vendor-product-device',
+      },
+  }
+
+  TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_9 = {
+      'build.prop' : {
+          'ro.product.device' : 'product-device',
+          'ro.build.fingerprint' : 'build-fingerprint',
+          'ro.build.version.release' : '9',
+          'ro.build.version.codename' : 'REL',
+      },
+      'system.build.prop' : {
+          'ro.product.system.device' : 'system-product-device',
+      },
+      'vendor.build.prop' : {
+          'ro.product.vendor.device' : 'vendor-product-device',
+      },
+  }
+
   def test_init(self):
     target_info = common.BuildInfo(self.TEST_INFO_DICT, None)
     self.assertEqual('product-device', target_info.device)
@@ -130,10 +176,6 @@
     self.assertEqual('brand3/product-name/device3:build-thumbprint',
                      target_info.fingerprint)
 
-    # Missing oem_dict should be rejected.
-    self.assertRaises(AssertionError, common.BuildInfo,
-                      self.TEST_INFO_DICT_USES_OEM_PROPS, None)
-
   def test_init_badFingerprint(self):
     info_dict = copy.deepcopy(self.TEST_INFO_DICT)
     info_dict['build.prop']['ro.build.fingerprint'] = 'bad fingerprint'
@@ -253,6 +295,41 @@
         ],
         script_writer.lines)
 
+  def test_ResolveRoProductProperty_FromVendor(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER)
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('vendor-product-device',
+                     info.GetBuildProp('ro.product.device'))
+
+  def test_ResolveRoProductProperty_FromSystem(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER)
+    del info_dict['vendor.build.prop']['ro.product.vendor.device']
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('system-product-device',
+                     info.GetBuildProp('ro.product.device'))
+
+  def test_ResolveRoProductProperty_InvalidPropertySearchOrder(self):
+    info_dict = copy.deepcopy(self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER)
+    info_dict['build.prop']['ro.product.property_source_order'] = 'bad-source'
+    with self.assertRaisesRegexp(common.ExternalError,
+        'Invalid ro.product.property_source_order'):
+      info = common.BuildInfo(info_dict, None)
+      info.GetBuildProp('ro.product.device')
+
+  def test_ResolveRoProductProperty_Android10PropertySearchOrder(self):
+    info_dict = copy.deepcopy(
+        self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_10)
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('vendor-product-device',
+                     info.GetBuildProp('ro.product.device'))
+
+  def test_ResolveRoProductProperty_Android9PropertySearchOrder(self):
+    info_dict = copy.deepcopy(
+        self.TEST_INFO_DICT_PROPERTY_SOURCE_ORDER_ANDROID_9)
+    info = common.BuildInfo(info_dict, None)
+    self.assertEqual('product-device',
+                     info.GetBuildProp('ro.product.device'))
+
 
 class CommonZipTest(test_utils.ReleaseToolsTestCase):
 
@@ -710,6 +787,25 @@
       'Compressed4.apk' : 'certs/compressed4',
   }
 
+  # Test parsing with no optional fields, both optional fields, and only the
+  # partition optional field.
+  APKCERTS_TXT4 = (
+      'name="RecoveryLocalizer.apk" certificate="certs/devkey.x509.pem"'
+      ' private_key="certs/devkey.pk8"\n'
+      'name="Settings.apk"'
+      ' certificate="build/make/target/product/security/platform.x509.pem"'
+      ' private_key="build/make/target/product/security/platform.pk8"'
+      ' compressed="gz" partition="system"\n'
+      'name="TV.apk" certificate="PRESIGNED" private_key=""'
+      ' partition="product"\n'
+  )
+
+  APKCERTS_CERTMAP4 = {
+      'RecoveryLocalizer.apk' : 'certs/devkey',
+      'Settings.apk' : 'build/make/target/product/security/platform',
+      'TV.apk' : 'PRESIGNED',
+  }
+
   def setUp(self):
     self.testdata_dir = test_utils.get_testdata_dir()
 
@@ -786,6 +882,14 @@
     with zipfile.ZipFile(target_files, 'r') as input_zip:
       self.assertRaises(ValueError, common.ReadApkCerts, input_zip)
 
+  def test_ReadApkCerts_WithWithoutOptionalFields(self):
+    target_files = self._write_apkcerts_txt(self.APKCERTS_TXT4)
+    with zipfile.ZipFile(target_files, 'r') as input_zip:
+      certmap, ext = common.ReadApkCerts(input_zip)
+
+    self.assertDictEqual(self.APKCERTS_CERTMAP4, certmap)
+    self.assertIsNone(ext)
+
   def test_ExtractPublicKey(self):
     cert = os.path.join(self.testdata_dir, 'testkey.x509.pem')
     pubkey = os.path.join(self.testdata_dir, 'testkey.pubkey.pem')
@@ -1404,8 +1508,7 @@
     self.assertEqual('3', chained_partition_args[1])
     self.assertTrue(os.path.exists(chained_partition_args[2]))
 
-  @test_utils.SkipIfExternalToolsUnavailable()
-  def test_BuildVBMeta_appendAftl(self):
+  def test_BuildVBMeta_appendAftlCommandSyntax(self):
     testdata_dir = test_utils.get_testdata_dir()
     common.OPTIONS.info_dict = {
         'ab_update': 'true',
@@ -1417,6 +1520,45 @@
                                     '6285659:userdebug/dev-keys'
         }
     }
+    common.OPTIONS.aftl_tool_path = 'aftltool'
+    common.OPTIONS.aftl_server = 'log.endpoints.aftl-dev.cloud.goog:9000'
+    common.OPTIONS.aftl_key_path = os.path.join(testdata_dir,
+                                                'test_transparency_key.pub')
+    common.OPTIONS.aftl_manufacturer_key_path = os.path.join(
+        testdata_dir, 'test_aftl_rsa4096.pem')
+
+    vbmeta_image = tempfile.NamedTemporaryFile(delete=False)
+    cmd = common.ConstructAftlMakeImageCommands(vbmeta_image.name)
+    expected_cmd = [
+        'aftltool', 'make_icp_from_vbmeta',
+        '--vbmeta_image_path', 'place_holder',
+        '--output', vbmeta_image.name,
+        '--version_incremental', '6285659',
+        '--transparency_log_servers',
+        'log.endpoints.aftl-dev.cloud.goog:9000,{}'.format(
+            common.OPTIONS.aftl_key_path),
+        '--manufacturer_key', common.OPTIONS.aftl_manufacturer_key_path,
+        '--algorithm', 'SHA256_RSA4096',
+        '--padding', '4096']
+
+    # ignore the place holder, i.e. path to a temp file
+    self.assertEqual(cmd[:3], expected_cmd[:3])
+    self.assertEqual(cmd[4:], expected_cmd[4:])
+
+  @unittest.skip("enable after we have a server for public")
+  def test_BuildVBMeta_appendAftlContactServer(self):
+    testdata_dir = test_utils.get_testdata_dir()
+    common.OPTIONS.info_dict = {
+        'ab_update': 'true',
+        'avb_avbtool': 'avbtool',
+        'build.prop': {
+            'ro.build.version.incremental': '6285659',
+            'ro.product.device': 'coral',
+            'ro.build.fingerprint': 'google/coral/coral:R/RP1A.200311.002/'
+                                    '6285659:userdebug/dev-keys'
+        }
+    }
+    common.OPTIONS.aftl_tool_path = "aftltool"
     common.OPTIONS.aftl_server = "log.endpoints.aftl-dev.cloud.goog:9000"
     common.OPTIONS.aftl_key_path = os.path.join(testdata_dir,
                                                 'test_transparency_key.pub')
diff --git a/tools/releasetools/test_sign_target_files_apks.py b/tools/releasetools/test_sign_target_files_apks.py
index 2dacd50..308172f 100644
--- a/tools/releasetools/test_sign_target_files_apks.py
+++ b/tools/releasetools/test_sign_target_files_apks.py
@@ -35,9 +35,13 @@
   <signer signature="{}"><seinfo value="media"/></signer>
 </policy>"""
 
+  # Note that we test one apex with the partition tag, and another without to
+  # make sure that new OTA tools can process an older target files package that
+  # does not include the partition tag.
+
   # pylint: disable=line-too-long
   APEX_KEYS_TXT = """name="apex.apexd_test.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package.pem" container_certificate="build/make/target/product/security/testkey.x509.pem" container_private_key="build/make/target/product/security/testkey.pk8" partition="system"
-name="apex.apexd_test_different_app.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" container_certificate="build/make/target/product/security/testkey.x509.pem" container_private_key="build/make/target/product/security/testkey.pk8" partition="system"
+name="apex.apexd_test_different_app.apex" public_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.avbpubkey" private_key="system/apex/apexd/apexd_testdata/com.android.apex.test_package_2.pem" container_certificate="build/make/target/product/security/testkey.x509.pem" container_private_key="build/make/target/product/security/testkey.pk8"
 """
 
   def setUp(self):
diff --git a/tools/releasetools/testdata/vintf/kernel/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/kernel/SYSTEM/etc/vintf/compatibility_matrix.1.xml
similarity index 74%
rename from tools/releasetools/testdata/vintf/kernel/SYSTEM/compatibility_matrix.xml
rename to tools/releasetools/testdata/vintf/kernel/SYSTEM/etc/vintf/compatibility_matrix.1.xml
index ed46b6b..a92dd6e 100644
--- a/tools/releasetools/testdata/vintf/kernel/SYSTEM/compatibility_matrix.xml
+++ b/tools/releasetools/testdata/vintf/kernel/SYSTEM/etc/vintf/compatibility_matrix.1.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework">
+<compatibility-matrix version="1.0" level="1" type="framework">
     <kernel version="4.14.1" />
     <sepolicy>
         <sepolicy-version>0.0</sepolicy-version>
diff --git a/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
similarity index 71%
rename from tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/compatibility_matrix.xml
rename to tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
index 5d891fa..1700e21 100644
--- a/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/compatibility_matrix.xml
+++ b/tools/releasetools/testdata/vintf/matrix_incompat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework">
+<compatibility-matrix version="1.0" level="1" type="framework">
     <sepolicy>
         <sepolicy-version>1.0</sepolicy-version>
         <kernel-sepolicy-version>0</kernel-sepolicy-version>
diff --git a/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
similarity index 85%
rename from tools/releasetools/testdata/vintf/sku_compat/SYSTEM/compatibility_matrix.xml
rename to tools/releasetools/testdata/vintf/sku_compat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
index 19a9b6a..22272fd 100644
--- a/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/compatibility_matrix.xml
+++ b/tools/releasetools/testdata/vintf/sku_compat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework">
+<compatibility-matrix version="1.0" level="1" type="framework">
     <hal format="hidl" optional="false">
         <name>foo</name>
         <version>1.0</version>
diff --git a/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/compatibility_matrix.xml b/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
similarity index 85%
rename from tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/compatibility_matrix.xml
rename to tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
index e0e0d6c..1a3fc43 100644
--- a/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/compatibility_matrix.xml
+++ b/tools/releasetools/testdata/vintf/sku_incompat/SYSTEM/etc/vintf/compatibility_matrix.1.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework">
+<compatibility-matrix version="1.0" level="1" type="framework">
     <hal format="hidl" optional="false">
         <name>foo</name>
         <version>1.1</version>
diff --git a/tools/signapk/src/com/android/signapk/SignApk.java b/tools/signapk/src/com/android/signapk/SignApk.java
index 9809ed4..95ef05f 100644
--- a/tools/signapk/src/com/android/signapk/SignApk.java
+++ b/tools/signapk/src/com/android/signapk/SignApk.java
@@ -36,6 +36,7 @@
 
 import com.android.apksig.ApkSignerEngine;
 import com.android.apksig.DefaultApkSignerEngine;
+import com.android.apksig.SigningCertificateLineage;
 import com.android.apksig.Hints;
 import com.android.apksig.apk.ApkUtils;
 import com.android.apksig.apk.MinSdkVersionException;
@@ -1042,6 +1043,7 @@
         int alignment = 4;
         Integer minSdkVersionOverride = null;
         boolean signUsingApkSignatureSchemeV2 = true;
+        SigningCertificateLineage certLineage = null;
 
         int argstart = 0;
         while (argstart < args.length && args[argstart].startsWith("-")) {
@@ -1069,6 +1071,15 @@
             } else if ("--disable-v2".equals(args[argstart])) {
                 signUsingApkSignatureSchemeV2 = false;
                 ++argstart;
+            } else if ("--lineage".equals(args[argstart])) {
+                File lineageFile = new File(args[++argstart]);
+                try {
+                    certLineage = SigningCertificateLineage.readFromFile(lineageFile);
+                } catch (Exception e) {
+                    throw new IllegalArgumentException(
+                            "Error reading lineage file: " + e.getMessage());
+                }
+                ++argstart;
             } else {
                 usage();
             }
@@ -1149,6 +1160,7 @@
                                 .setV2SigningEnabled(signUsingApkSignatureSchemeV2)
                                 .setOtherSignersSignaturesPreserved(false)
                                 .setCreatedBy("1.0 (Android SignApk)")
+                                .setSigningCertificateLineage(certLineage)
                                 .build()) {
                     // We don't preserve the input APK's APK Signing Block (which contains v2
                     // signatures)
diff --git a/tools/zipalign/ZipFile.cpp b/tools/zipalign/ZipFile.cpp
index 63fb962..88505b7 100644
--- a/tools/zipalign/ZipFile.cpp
+++ b/tools/zipalign/ZipFile.cpp
@@ -1221,7 +1221,7 @@
     FileReader(FILE* fp) : Reader(), fp_(fp), current_offset_(0) {
     }
 
-    bool ReadAtOffset(uint8_t* buf, size_t len, uint32_t offset) const {
+    bool ReadAtOffset(uint8_t* buf, size_t len, off64_t offset) const {
         // Data is usually requested sequentially, so this helps avoid pointless
         // fseeks every time we perform a read. There's an impedence mismatch
         // here because the original API was designed around pread and pwrite.
@@ -1244,7 +1244,7 @@
 
   private:
     FILE* fp_;
-    mutable uint32_t current_offset_;
+    mutable off64_t current_offset_;
 };
 
 // free the memory when you're done