diff --git a/Changes.md b/Changes.md
index 70e338c..2720a0f 100644
--- a/Changes.md
+++ b/Changes.md
@@ -1,5 +1,14 @@
 # Build System Changes for Android.mk Writers
 
+## COPY_HEADERS usage now produces warnings {#copy_headers}
+
+We've considered `BUILD_COPY_HEADERS`/`LOCAL_COPY_HEADERS` to be deprecated for
+a long time, and the places where it's been able to be used have shrinked over
+the last several releases. Equivalent functionality is not available in Soong.
+
+See the [build/soong/docs/best_practices.md#headers] for more information about
+how best to handle headers in Android.
+
 ## `m4` is not available on `$PATH`
 
 There is a prebuilt of it available in prebuilts/build-tools, and a make
@@ -553,6 +562,7 @@
 
 
 [build/soong/Changes.md]: https://android.googlesource.com/platform/build/soong/+/master/Changes.md
+[build/soong/docs/best_practices.md#headers]: https://android.googlesource.com/platform/build/soong/+/master/docs/best_practices.md#headers
 [external/fonttools/Lib/fontTools/Android.bp]: https://android.googlesource.com/platform/external/fonttools/+/master/Lib/fontTools/Android.bp
 [frameworks/base/Android.bp]: https://android.googlesource.com/platform/frameworks/base/+/master/Android.bp
 [frameworks/base/data/fonts/Android.mk]: https://android.googlesource.com/platform/frameworks/base/+/master/data/fonts/Android.mk
diff --git a/Deprecation.md b/Deprecation.md
index 9378e1a..5e26492 100644
--- a/Deprecation.md
+++ b/Deprecation.md
@@ -16,8 +16,11 @@
 | -------------------------------- | --------- |
 | `BUILD_AUX_EXECUTABLE`           | Error     |
 | `BUILD_AUX_STATIC_LIBRARY`       | Error     |
+| `BUILD_COPY_HEADERS`             | Warning   |
+| `BUILD_HOST_EXECUTABLE`          | Warning   |
 | `BUILD_HOST_FUZZ_TEST`           | Error     |
 | `BUILD_HOST_NATIVE_TEST`         | Error     |
+| `BUILD_HOST_SHARED_LIBRARY`      | Warning   |
 | `BUILD_HOST_SHARED_TEST_LIBRARY` | Error     |
 | `BUILD_HOST_STATIC_LIBRARY`      | Warning   |
 | `BUILD_HOST_STATIC_TEST_LIBRARY` | Error     |
diff --git a/core/Makefile b/core/Makefile
index 4e4ffbd..c862e97 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -16,7 +16,28 @@
 define check-product-copy-files
 $(if $(filter-out $(TARGET_COPY_OUT_SYSTEM_OTHER)/%,$(2)), \
   $(if $(filter %.apk, $(2)),$(error \
-     Prebuilt apk found in PRODUCT_COPY_FILES: $(1), use BUILD_PREBUILT instead!)))
+     Prebuilt apk found in PRODUCT_COPY_FILES: $(1), use BUILD_PREBUILT instead!))) \
+$(if $(filter true,$(BUILD_BROKEN_VINTF_PRODUCT_COPY_FILES)),, \
+  $(if $(filter $(TARGET_COPY_OUT_SYSTEM)/etc/vintf/% \
+                $(TARGET_COPY_OUT_SYSTEM)/manifest.xml \
+                $(TARGET_COPY_OUT_SYSTEM)/compatibility_matrix.xml,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), use vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_PRODUCT)/etc/vintf/%,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use PRODUCT_MANIFEST_FILES / DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE / vintf_compatibility_matrix / vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_SYSTEM_EXT)/etc/vintf/%,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use vintf_compatibility_matrix / vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_VENDOR)/etc/vintf/% \
+                $(TARGET_COPY_OUT_VENDOR)/manifest.xml \
+                $(TARGET_COPY_OUT_VENDOR)/compatibility_matrix.xml,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use DEVICE_MANIFEST_FILE / DEVICE_MATRIX_FILE / vintf_compatibility_matrix / vintf_fragments instead!)) \
+  $(if $(filter $(TARGET_COPY_OUT_ODM)/etc/vintf/% \
+                $(TARGET_COPY_OUT_ODM)/etc/manifest%,$(2)), \
+    $(error VINTF metadata found in PRODUCT_COPY_FILES: $(1), \
+      use ODM_MANIFEST_FILES / vintf_fragments instead!)) \
+)
 endef
 # filter out the duplicate <source file>:<dest file> pairs.
 unique_product_copy_files_pairs :=
@@ -1550,6 +1571,8 @@
 $(if $(filter $(2),userdata),\
     $(if $(BOARD_USERDATAIMAGE_FILE_SYSTEM_TYPE),$(hide) echo "userdata_fs_type=$(BOARD_USERDATAIMAGE_FILE_SYSTEM_TYPE)" >> $(1))
     $(if $(BOARD_USERDATAIMAGE_PARTITION_SIZE),$(hide) echo "userdata_size=$(BOARD_USERDATAIMAGE_PARTITION_SIZE)" >> $(1))
+    $(if $(PRODUCT_FS_CASEFOLD),$(hide) echo "needs_casefold=$(PRODUCT_FS_CASEFOLD)" >> $(1))
+    $(if $(PRODUCT_QUOTA_PROJID),$(hide) echo "needs_projid=$(PRODUCT_QUOTA_PROJID)" >> $(1))
     $(hide) echo "userdata_selinux_fc=$(SELINUX_FC)" >> $(1)
 )
 $(if $(filter $(2),cache),\
@@ -3505,34 +3528,59 @@
 intermediates := $(call intermediates-dir-for,PACKAGING,check_vintf_all)
 check_vintf_all_deps :=
 
+# The build system only writes VINTF metadata to */etc/vintf paths. Legacy paths aren't needed here
+# because they are only used for prebuilt images.
+check_vintf_common_srcs_patterns := \
+  $(TARGET_OUT)/etc/vintf/% \
+  $(TARGET_OUT_VENDOR)/etc/vintf/% \
+  $(TARGET_OUT_ODM)/etc/vintf/% \
+  $(TARGET_OUT_PRODUCT)/etc/vintf/% \
+  $(TARGET_OUT_SYSTEM_EXT)/etc/vintf/% \
+
+check_vintf_common_srcs := $(sort $(filter $(check_vintf_common_srcs_patterns), \
+  $(INTERNAL_SYSTEMIMAGE_FILES) \
+  $(INTERNAL_VENDORIMAGE_FILES) \
+  $(INTERNAL_ODMIMAGE_FILES) \
+  $(INTERNAL_PRODUCTIMAGE_FILES) \
+  $(INTERNAL_SYSTEM_EXTIMAGE_FILES) \
+))
+check_vintf_common_srcs_patterns :=
+
+check_vintf_has_system :=
+check_vintf_has_vendor :=
+
 # -- Check system manifest / matrix including fragments (excluding other framework manifests / matrices, e.g. product);
-ifeq ($(BUILDING_SYSTEM_IMAGE),true)
+check_vintf_system_deps := $(filter $(TARGET_OUT)/etc/vintf/%, $(check_vintf_common_srcs))
+ifneq ($(check_vintf_system_deps),)
+check_vintf_has_system := true
 check_vintf_system_log := $(intermediates)/check_vintf_system_log
 check_vintf_all_deps += $(check_vintf_system_log)
-$(check_vintf_system_log): $(HOST_OUT_EXECUTABLES)/checkvintf \
-                           $(filter $(TARGET_OUT)/etc/vintf/%, $(INTERNAL_SYSTEMIMAGE_FILES))
+$(check_vintf_system_log): $(HOST_OUT_EXECUTABLES)/checkvintf $(check_vintf_system_deps)
 	@( $< --check-one --dirmap /system:$(TARGET_OUT) > $@ 2>&1 ) || ( cat $@ && exit 1 )
 check_vintf_system_log :=
-endif # BUILDING_SYSTEM_IMAGE
+endif # check_vintf_system_deps
+check_vintf_system_deps :=
 
 # -- Check vendor manifest / matrix including fragments (excluding other device manifests / matrices)
-ifeq ($(BUILDING_VENDOR_IMAGE),true)
+check_vintf_vendor_deps := $(filter $(TARGET_OUT_VENDOR)/etc/vintf/%, $(check_vintf_common_srcs))
+ifneq ($(check_vintf_vendor_deps),)
+check_vintf_has_vendor := true
 check_vintf_vendor_log := $(intermediates)/check_vintf_vendor_log
 check_vintf_all_deps += $(check_vintf_vendor_log)
-$(check_vintf_vendor_log): $(HOST_OUT_EXECUTABLES)/checkvintf \
-                           $(filter $(TARGET_OUT_VENDOR)/etc/vintf/%, $(INTERNAL_VENDORIMAGE_FILES))
+$(check_vintf_vendor_log): $(HOST_OUT_EXECUTABLES)/checkvintf $(check_vintf_vendor_deps)
 	@( $< --check-one --dirmap /vendor:$(TARGET_OUT_VENDOR) > $@ 2>&1 ) || ( cat $@ && exit 1 )
 check_vintf_vendor_log :=
-endif # BUILDING_VENDOR_IMAGE
+endif # check_vintf_vendor_deps
+check_vintf_vendor_deps :=
 
 # -- Check VINTF compatibility of build.
 # Skip partial builds; only check full builds. Only check if:
 # - PRODUCT_ENFORCE_VINTF_MANIFEST is true
-# - Building system and vendor images
+# - system / vendor VINTF metadata exists
 # - Building product / system_ext / odm images if board has product / system_ext / odm images
 ifeq ($(PRODUCT_ENFORCE_VINTF_MANIFEST),true)
-ifeq ($(BUILDING_SYSTEM_IMAGE),true)
-ifeq ($(BUILDING_VENDOR_IMAGE),true)
+ifeq ($(check_vintf_has_system),true)
+ifeq ($(check_vintf_has_vendor),true)
 ifeq ($(filter true,$(BUILDING_ODM_IMAGE)),$(filter true,$(BOARD_USES_ODMIMAGE)))
 ifeq ($(filter true,$(BUILDING_PRODUCT_IMAGE)),$(filter true,$(BOARD_USES_PRODUCTIMAGE)))
 ifeq ($(filter true,$(BUILDING_SYSTEM_EXT_IMAGE)),$(filter true,$(BOARD_USES_SYSTEM_EXTIMAGE)))
@@ -3541,7 +3589,7 @@
 check_vintf_all_deps += $(check_vintf_compatible_log)
 
 check_vintf_compatible_args :=
-check_vintf_compatible_deps :=
+check_vintf_compatible_deps := $(check_vintf_common_srcs)
 
 # -- Kernel version and configurations.
 ifeq ($(PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS),true)
@@ -3601,24 +3649,6 @@
 
 endif # PRODUCT_OTA_ENFORCE_VINTF_KERNEL_REQUIREMENTS
 
-# The build system only writes VINTF metadata to */etc/vintf paths. Legacy paths aren't needed here
-# because they are only used for prebuilt images.
-check_vintf_compatible_deps_patterns := \
-  $(TARGET_OUT)/etc/vintf/% \
-  $(TARGET_OUT_VENDOR)/etc/vintf/% \
-  $(TARGET_OUT_ODM)/etc/vintf/% \
-  $(TARGET_OUT_PRODUCT)/etc/vintf/% \
-  $(TARGET_OUT_SYSTEM_EXT)/etc/vintf/% \
-
-check_vintf_compatible_deps += $(sort $(filter $(check_vintf_compatible_deps_patterns), \
-  $(INTERNAL_SYSTEMIMAGE_FILES) \
-  $(INTERNAL_VENDORIMAGE_FILES) \
-  $(INTERNAL_ODMIMAGE_FILES) \
-  $(INTERNAL_PRODUCTIMAGE_FILES) \
-  $(INTERNAL_SYSTEM_EXTIMAGE_FILES) \
-))
-check_vintf_compatible_deps_patterns :=
-
 check_vintf_compatible_args += \
   --dirmap /system:$(TARGET_OUT) \
   --dirmap /vendor:$(TARGET_OUT_VENDOR) \
@@ -3651,8 +3681,8 @@
 endif # BUILDING_SYSTEM_EXT_IMAGE equals BOARD_USES_SYSTEM_EXTIMAGE
 endif # BUILDING_PRODUCT_IMAGE equals BOARD_USES_PRODUCTIMAGE
 endif # BUILDING_ODM_IMAGE equals BOARD_USES_ODMIMAGE
-endif # BUILDING_VENDOR_IMAGE
-endif # BUILDING_SYSTEM_IMAGE
+endif # check_vintf_has_vendor
+endif # check_vintf_has_system
 endif # PRODUCT_ENFORCE_VINTF_MANIFEST
 
 # Add all logs of VINTF checks to dist builds
@@ -3664,6 +3694,9 @@
 check-vintf-all: $(check_vintf_all_deps)
 	$(foreach file,$^,echo "$(file)"; cat "$(file)"; echo;)
 
+check_vintf_has_vendor :=
+check_vintf_has_system :=
+check_vintf_common_srcs :=
 check_vintf_all_deps :=
 intermediates :=
 endif # !TARGET_BUILD_APPS
@@ -3797,6 +3830,7 @@
   mkbootfs \
   mkbootimg \
   mke2fs \
+  mke2fs.conf \
   mkf2fsuserimg.sh \
   mksquashfs \
   mksquashfsimage.sh \
@@ -3818,6 +3852,15 @@
   verity_verifier \
   zipalign \
 
+# Additional tools to unpack and repack the apex file.
+INTERNAL_OTATOOLS_MODULES += \
+  apexer \
+  deapexer \
+  debugfs_static \
+  merge_zips \
+  resize2fs \
+  soong_zip \
+
 ifeq (true,$(PRODUCT_SUPPORTS_VBOOT))
 INTERNAL_OTATOOLS_MODULES += \
   futility \
@@ -3873,7 +3916,7 @@
 	mkdir -p $(dir $@)
 	$(call copy-files-with-structure,$(PRIVATE_OTATOOLS_PACKAGE_FILES),$(HOST_OUT)/,$(PRIVATE_ZIP_ROOT))
 	$(call copy-files-with-structure,$(PRIVATE_OTATOOLS_RELEASETOOLS),build/make/tools/,$(PRIVATE_ZIP_ROOT))
-	cp $(SOONG_ZIP) $(ZIP2ZIP) $(PRIVATE_ZIP_ROOT)/bin/
+	cp $(SOONG_ZIP) $(ZIP2ZIP) $(MERGE_ZIPS) $(PRIVATE_ZIP_ROOT)/bin/
 	$(SOONG_ZIP) -o $@ -C $(PRIVATE_ZIP_ROOT) -D $(PRIVATE_ZIP_ROOT)
 
 .PHONY: otatools-package
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 6b80a15..cce6ec1 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -800,22 +800,28 @@
 my_required_modules += $(LOCAL_REQUIRED_MODULES_$($(my_prefix)OS))
 endif
 
-###############################################################################
-## When compiling against the VNDK, add the .vendor suffix to required modules.
-###############################################################################
+##########################################################################
+## When compiling against the VNDK, add the .vendor or .product suffix to
+## required modules.
+##########################################################################
 ifneq ($(LOCAL_USE_VNDK),)
-  ####################################################
-  ## Soong modules may be built twice, once for /system
-  ## and once for /vendor. If we're using the VNDK,
-  ## switch all soong libraries over to the /vendor
-  ## variant.
-  ####################################################
+  #####################################################
+  ## Soong modules may be built three times, once for
+  ## /system, once for /vendor and once for /product.
+  ## If we're using the VNDK, switch all soong
+  ## libraries over to the /vendor or /product variant.
+  #####################################################
   ifneq ($(LOCAL_MODULE_MAKEFILE),$(SOONG_ANDROID_MK))
     # We don't do this renaming for soong-defined modules since they already
-    # have correct names (with .vendor suffix when necessary) in their
-    # LOCAL_*_LIBRARIES.
-    my_required_modules := $(foreach l,$(my_required_modules),\
-      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    # have correct names (with .vendor or .product suffix when necessary) in
+    # their LOCAL_*_LIBRARIES.
+    ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+      my_required_modules := $(foreach l,$(my_required_modules),\
+        $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+    else
+      my_required_modules := $(foreach l,$(my_required_modules),\
+        $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    endif
   endif
 endif
 
diff --git a/core/binary.mk b/core/binary.mk
index 560fff7..a62f76c 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -1145,22 +1145,35 @@
 ## When compiling against the VNDK, use LL-NDK libraries
 ###########################################################
 ifneq ($(LOCAL_USE_VNDK),)
-  ####################################################
-  ## Soong modules may be built twice, once for /system
-  ## and once for /vendor. If we're using the VNDK,
-  ## switch all soong libraries over to the /vendor
-  ## variant.
-  ####################################################
-  my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
-    $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_static_libraries := $(foreach l,$(my_static_libraries),\
-    $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_shared_libraries := $(foreach l,$(my_shared_libraries),\
-    $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_system_shared_libraries := $(foreach l,$(my_system_shared_libraries),\
-    $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
-  my_header_libraries := $(foreach l,$(my_header_libraries),\
-    $(if $(SPLIT_VENDOR.HEADER_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  #####################################################
+  ## Soong modules may be built three times, once for
+  ## /system, once for /vendor and once for /product.
+  ## If we're using the VNDK, switch all soong
+  ## libraries over to the /vendor or /product variant.
+  #####################################################
+  ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+    my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
+      $(if $(SPLIT_PRODUCT.STATIC_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_static_libraries := $(foreach l,$(my_static_libraries),\
+      $(if $(SPLIT_PRODUCT.STATIC_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_system_shared_libraries := $(foreach l,$(my_system_shared_libraries),\
+      $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+    my_header_libraries := $(foreach l,$(my_header_libraries),\
+      $(if $(SPLIT_PRODUCT.HEADER_LIBRARIES.$(l)),$(l).product,$(l)))
+  else
+    my_whole_static_libraries := $(foreach l,$(my_whole_static_libraries),\
+      $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_static_libraries := $(foreach l,$(my_static_libraries),\
+      $(if $(SPLIT_VENDOR.STATIC_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_system_shared_libraries := $(foreach l,$(my_system_shared_libraries),\
+      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+    my_header_libraries := $(foreach l,$(my_header_libraries),\
+      $(if $(SPLIT_VENDOR.HEADER_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  endif
 endif
 
 # Platform can use vendor public libraries. If a required shared lib is one of
@@ -1207,6 +1220,7 @@
 my_allowed_types := $(my_allowed_ndk_types)
 else ifdef LOCAL_USE_VNDK
     _name := $(patsubst %.vendor,%,$(LOCAL_MODULE))
+    _name := $(patsubst %.product,%,$(LOCAL_MODULE))
     ifneq ($(filter $(_name),$(VNDK_CORE_LIBRARIES) $(VNDK_SAMEPROCESS_LIBRARIES) $(LLNDK_LIBRARIES)),)
         ifeq ($(filter $(_name),$(VNDK_PRIVATE_LIBRARIES)),)
             my_link_type := native:vndk
@@ -1215,6 +1229,12 @@
         endif
         my_warn_types :=
         my_allowed_types := native:vndk native:vndk_private
+    else ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+        # Modules installed to /product cannot directly depend on modules marked
+        # with vendor_available: false
+        my_link_type := native:product
+        my_warn_types :=
+        my_allowed_types := native:product native:vndk native:platform_vndk
     else
         # Modules installed to /vendor cannot directly depend on modules marked
         # with vendor_available: false
diff --git a/core/board_config.mk b/core/board_config.mk
index b9b4dc2..5d658dc 100644
--- a/core/board_config.mk
+++ b/core/board_config.mk
@@ -26,6 +26,7 @@
   BOARD_KERNEL_CMDLINE \
   BOARD_KERNEL_BASE \
   BOARD_USES_GENERIC_AUDIO \
+  BOARD_USES_RECOVERY_AS_BOOT \
   BOARD_VENDOR_USE_AKMD \
   BOARD_WPA_SUPPLICANT_DRIVER \
   BOARD_WLAN_DEVICE \
@@ -86,10 +87,11 @@
 
 _build_broken_var_list := \
   BUILD_BROKEN_DUP_RULES \
+  BUILD_BROKEN_OUTSIDE_INCLUDE_DIRS \
   BUILD_BROKEN_PREBUILT_ELF_FILES \
   BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW \
   BUILD_BROKEN_USES_NETWORK \
-  BUILD_BROKEN_OUTSIDE_INCLUDE_DIRS \
+  BUILD_BROKEN_VINTF_PRODUCT_COPY_FILES \
 
 _build_broken_var_list += \
   $(foreach m,$(AVAILABLE_BUILD_MODULE_TYPES) \
@@ -620,11 +622,15 @@
 ###########################################
 # Handle BUILD_BROKEN_USES_BUILD_*
 
-$(foreach m,$(DEFAULT_WARNING_BUILD_MODULE_TYPES),\
+$(foreach m,$(filter-out BUILD_COPY_HEADERS,$(DEFAULT_WARNING_BUILD_MODULE_TYPES)),\
   $(if $(filter false,$(BUILD_BROKEN_USES_$(m))),\
     $(KATI_obsolete_var $(m),Please convert to Soong),\
     $(KATI_deprecated_var $(m),Please convert to Soong)))
 
+$(if $(filter false,$(BUILD_BROKEN_USES_BUILD_COPY_HEADERS)),\
+  $(KATI_obsolete_var BUILD_COPY_HEADERS,See $(CHANGES_URL)#copy_headers),\
+  $(KATI_deprecated_var BUILD_COPY_HEADERS,See $(CHANGES_URL)#copy_headers))
+
 $(foreach m,$(DEFAULT_ERROR_BUILD_MODULE_TYPES),\
   $(if $(filter true,$(BUILD_BROKEN_USES_$(m))),\
     $(KATI_deprecated_var $(m),Please convert to Soong),\
diff --git a/core/cc_prebuilt_internal.mk b/core/cc_prebuilt_internal.mk
index 6313019..1d959b5 100644
--- a/core/cc_prebuilt_internal.mk
+++ b/core/cc_prebuilt_internal.mk
@@ -85,6 +85,7 @@
 my_link_type := native:ndk:$(my_ndk_stl_family):$(my_ndk_stl_link_type)
 else ifdef LOCAL_USE_VNDK
     _name := $(patsubst %.vendor,%,$(LOCAL_MODULE))
+    _name := $(patsubst %.product,%,$(LOCAL_MODULE))
     ifneq ($(filter $(_name),$(VNDK_CORE_LIBRARIES) $(VNDK_SAMEPROCESS_LIBRARIES) $(LLNDK_LIBRARIES)),)
         ifeq ($(filter $(_name),$(VNDK_PRIVATE_LIBRARIES)),)
             my_link_type := native:vndk
@@ -92,7 +93,11 @@
             my_link_type := native:vndk_private
         endif
     else
-        my_link_type := native:vendor
+        ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+            my_link_type := native:product
+        else
+            my_link_type := native:vendor
+        endif
     endif
 else ifneq ($(filter $(TARGET_RECOVERY_OUT)/%,$(LOCAL_MODULE_PATH)),)
 my_link_type := native:recovery
@@ -136,8 +141,13 @@
 
 ifdef my_shared_libraries
 ifdef LOCAL_USE_VNDK
-  my_shared_libraries := $(foreach l,$(my_shared_libraries),\
-    $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  ifeq ($(LOCAL_USE_VNDK_PRODUCT),true)
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_PRODUCT.SHARED_LIBRARIES.$(l)),$(l).product,$(l)))
+  else
+    my_shared_libraries := $(foreach l,$(my_shared_libraries),\
+      $(if $(SPLIT_VENDOR.SHARED_LIBRARIES.$(l)),$(l).vendor,$(l)))
+  endif
 endif
 $(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)DEPENDENCIES_ON_SHARED_LIBRARIES += \
   $(my_register_name):$(LOCAL_INSTALLED_MODULE):$(subst $(space),$(comma),$(my_shared_libraries))
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 303f18e..bbc117f 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -185,7 +185,6 @@
 LOCAL_NO_CRT:=
 LOCAL_NO_DEFAULT_COMPILER_FLAGS:=
 LOCAL_NO_FPIE :=
-LOCAL_NO_LIBGCC:=
 LOCAL_NO_LIBCRT_BUILTINS:=
 LOCAL_NO_NOTICE_FILE:=
 LOCAL_NO_PIC:=
@@ -305,6 +304,7 @@
 LOCAL_USE_AAPT2:=
 LOCAL_USE_CLANG_LLD:=
 LOCAL_USE_VNDK:=
+LOCAL_USE_VNDK_PRODUCT:=
 LOCAL_USES_LIBRARIES:=
 LOCAL_VENDOR_MODULE:=
 LOCAL_VINTF_FRAGMENTS:=
diff --git a/core/cxx_stl_setup.mk b/core/cxx_stl_setup.mk
index 6571d99..a2abb1a 100644
--- a/core/cxx_stl_setup.mk
+++ b/core/cxx_stl_setup.mk
@@ -76,17 +76,27 @@
         my_ldflags += -nostdlib++
     else
         my_static_libraries += libc++demangle
-        ifeq (arm,$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
-            my_static_libraries += libunwind_llvm
-            my_ldflags += -Wl,--exclude-libs,libunwind_llvm.a
-        endif
 
         ifeq ($(my_link_type),static)
             my_static_libraries += libm libc
+            ifeq (arm,$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
+                my_static_libraries += libunwind_llvm
+                my_ldflags += -Wl,--exclude-libs,libunwind_llvm.a
+            else
+                my_static_libraries += libgcc_stripped
+                my_ldflags += -Wl,--exclude-libs,libgcc_stripped.a
+            endif
         endif
     endif
 else ifeq ($(my_cxx_stl),ndk)
-    # Using an NDK STL. Handled in binary.mk.
+    # Using an NDK STL. Handled in binary.mk, except for the unwinder.
+    ifeq (arm,$($(my_prefix)$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
+        my_static_libraries += libunwind_llvm
+        my_ldflags += -Wl,--exclude-libs,libunwind_llvm.a
+    else
+        my_static_libraries += libgcc_stripped
+        my_ldflags += -Wl,--exclude-libs,libgcc_stripped.a
+    endif
 else ifeq ($(my_cxx_stl),libstdc++)
     $(error $(LOCAL_PATH): $(LOCAL_MODULE): libstdc++ is not supported)
 else ifeq ($(my_cxx_stl),none)
diff --git a/core/definitions.mk b/core/definitions.mk
index 49747ed..fd785b8 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -1720,7 +1720,6 @@
   $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
   $(PRIVATE_TARGET_LIBCRT_BUILTINS) \
   $(PRIVATE_TARGET_LIBATOMIC) \
-  $(PRIVATE_TARGET_LIBGCC) \
   $(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
   $(PRIVATE_LDFLAGS) \
   $(PRIVATE_ALL_SHARED_LIBRARIES) \
@@ -1756,7 +1755,6 @@
   $(if $(filter true,$(NATIVE_COVERAGE)),$(PRIVATE_TARGET_COVERAGE_LIB)) \
   $(PRIVATE_TARGET_LIBCRT_BUILTINS) \
   $(PRIVATE_TARGET_LIBATOMIC) \
-  $(PRIVATE_TARGET_LIBGCC) \
   $(PRIVATE_TARGET_GLOBAL_LDFLAGS) \
   $(PRIVATE_LDFLAGS) \
   $(PRIVATE_ALL_SHARED_LIBRARIES) \
@@ -1803,7 +1801,6 @@
   $(PRIVATE_TARGET_LIBATOMIC) \
   $(filter %libcompiler_rt.a %libcompiler_rt.hwasan.a,$(PRIVATE_ALL_STATIC_LIBRARIES)) \
   $(PRIVATE_TARGET_LIBCRT_BUILTINS) \
-  $(PRIVATE_TARGET_LIBGCC) \
   -Wl,--end-group \
   $(PRIVATE_TARGET_CRTEND_O)
 endef
@@ -2203,7 +2200,7 @@
 @mkdir -p $(dir $@)
 $(hide) rm -f $(dir $@)classes*.dex $(dir $@)d8_input.jar
 $(hide) $(ZIP2ZIP) -j -i $< -o $(dir $@)d8_input.jar "**/*.class"
-$(hide) $(DX_COMMAND) $(DEX_FLAGS) \
+$(hide) $(D8_WRAPPER) $(DX_COMMAND) $(DEX_FLAGS) \
     --output $(dir $@) \
     $(addprefix --lib ,$(PRIVATE_D8_LIBS)) \
     --min-api $(PRIVATE_MIN_SDK_VERSION) \
@@ -2682,7 +2679,7 @@
 define transform-jar-to-dex-r8
 @echo R8: $@
 $(hide) rm -f $(PRIVATE_PROGUARD_DICTIONARY)
-$(hide) $(R8_COMPAT_PROGUARD) $(DEX_FLAGS) \
+$(hide) $(R8_WRAPPER) $(R8_COMPAT_PROGUARD) $(DEX_FLAGS) \
     -injars '$<' \
     --min-api $(PRIVATE_MIN_SDK_VERSION) \
     --no-data-resources \
diff --git a/core/deprecation.mk b/core/deprecation.mk
index 761a9b6..cc620a3 100644
--- a/core/deprecation.mk
+++ b/core/deprecation.mk
@@ -1,15 +1,12 @@
 # These module types can still be used without warnings or errors.
 AVAILABLE_BUILD_MODULE_TYPES :=$= \
-  BUILD_COPY_HEADERS \
   BUILD_EXECUTABLE \
   BUILD_FUZZ_TEST \
   BUILD_HEADER_LIBRARY \
   BUILD_HOST_DALVIK_JAVA_LIBRARY \
   BUILD_HOST_DALVIK_STATIC_JAVA_LIBRARY \
-  BUILD_HOST_EXECUTABLE \
   BUILD_HOST_JAVA_LIBRARY \
   BUILD_HOST_PREBUILT \
-  BUILD_HOST_SHARED_LIBRARY \
   BUILD_JAVA_LIBRARY \
   BUILD_MULTI_PREBUILT \
   BUILD_NATIVE_TEST \
@@ -27,6 +24,9 @@
 # relevant BUILD_BROKEN_USES_BUILD_* variables, then these would move to
 # DEFAULT_ERROR_BUILD_MODULE_TYPES.
 DEFAULT_WARNING_BUILD_MODULE_TYPES :=$= \
+  BUILD_COPY_HEADERS \
+  BUILD_HOST_EXECUTABLE \
+  BUILD_HOST_SHARED_LIBRARY \
   BUILD_HOST_STATIC_LIBRARY \
 
 # These are BUILD_* variables that are errors to reference, but you can set
diff --git a/core/dynamic_binary.mk b/core/dynamic_binary.mk
index 27ff2c9..48072b3 100644
--- a/core/dynamic_binary.mk
+++ b/core/dynamic_binary.mk
@@ -132,8 +132,8 @@
 	CLANG_BIN=$(LLVM_PREBUILTS_PATH) \
 	CROSS_COMPILE=$(PRIVATE_TOOLS_PREFIX) \
 	XZ=$(XZ) \
-	$(SOONG_STRIP_PATH) -i $< -o $@ -d $@.d $(PRIVATE_STRIP_ARGS)
-  $(call include-depfile,$(strip_output).d)
+	$(SOONG_STRIP_PATH) -i $< -o $@ -d $@.strip.d $(PRIVATE_STRIP_ARGS)
+  $(call include-depfile,$(strip_output).strip.d,$(strip_output))
 else
   # Don't strip the binary, just copy it.  We can't skip this step
   # because a copy of the binary must appear at LOCAL_BUILT_MODULE.
diff --git a/core/executable.mk b/core/executable.mk
index c8d9272..db8dcc6 100644
--- a/core/executable.mk
+++ b/core/executable.mk
@@ -6,6 +6,10 @@
 # LOCAL_MODULE_PATH_32 and LOCAL_MODULE_PATH_64 or LOCAL_MODULE_STEM_32 and
 # LOCAL_MODULE_STEM_64
 
+ifdef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,BUILD_EXECUTABLE is incompatible with LOCAL_IS_HOST_MODULE. Use BUILD_HOST_EXECUTABLE instead.)
+endif
+
 my_skip_this_target :=
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
   ifeq (true,$(LOCAL_FORCE_STATIC_EXECUTABLE))
diff --git a/core/executable_internal.mk b/core/executable_internal.mk
index a9915aa..32e56dd 100644
--- a/core/executable_internal.mk
+++ b/core/executable_internal.mk
@@ -41,11 +41,6 @@
 else
 my_target_libcrt_builtins := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LIBCRT_BUILTINS)
 endif
-ifeq ($(LOCAL_NO_LIBGCC),true)
-my_target_libgcc :=
-else
-my_target_libgcc := $(call intermediates-dir-for,STATIC_LIBRARIES,libgcc,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libgcc.a
-endif
 my_target_libatomic := $(call intermediates-dir-for,STATIC_LIBRARIES,libatomic,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libatomic.a
 ifeq ($(LOCAL_NO_CRT),true)
 my_target_crtbegin_dynamic_o :=
@@ -66,7 +61,6 @@
 my_target_crtend_o := $(wildcard $(my_ndk_sysroot_lib)/crtend_android.o)
 endif
 $(linked_module): PRIVATE_TARGET_LIBCRT_BUILTINS := $(my_target_libcrt_builtins)
-$(linked_module): PRIVATE_TARGET_LIBGCC := $(my_target_libgcc)
 $(linked_module): PRIVATE_TARGET_LIBATOMIC := $(my_target_libatomic)
 $(linked_module): PRIVATE_TARGET_CRTBEGIN_DYNAMIC_O := $(my_target_crtbegin_dynamic_o)
 $(linked_module): PRIVATE_TARGET_CRTBEGIN_STATIC_O := $(my_target_crtbegin_static_o)
@@ -74,11 +68,11 @@
 $(linked_module): PRIVATE_POST_LINK_CMD := $(LOCAL_POST_LINK_CMD)
 
 ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
-$(linked_module): $(my_target_crtbegin_static_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libgcc) $(my_target_libatomic) $(CLANG_CXX)
+$(linked_module): $(my_target_crtbegin_static_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libatomic) $(CLANG_CXX)
 	$(transform-o-to-static-executable)
 	$(PRIVATE_POST_LINK_CMD)
 else
-$(linked_module): $(my_target_crtbegin_dynamic_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libgcc) $(my_target_libatomic) $(CLANG_CXX)
+$(linked_module): $(my_target_crtbegin_dynamic_o) $(all_objects) $(all_libraries) $(my_target_crtend_o) $(my_target_libcrt_builtins) $(my_target_libatomic) $(CLANG_CXX)
 	$(transform-o-to-executable)
 	$(PRIVATE_POST_LINK_CMD)
 endif
diff --git a/core/host_shared_library.mk b/core/host_shared_library.mk
index 81236d1..c22af97 100644
--- a/core/host_shared_library.mk
+++ b/core/host_shared_library.mk
@@ -37,4 +37,7 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers)
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/host_static_library.mk b/core/host_static_library.mk
index 469da29..3dbd144 100644
--- a/core/host_static_library.mk
+++ b/core/host_static_library.mk
@@ -37,4 +37,7 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers)
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/install_jni_libs_internal.mk b/core/install_jni_libs_internal.mk
index 25a16a3..d87513b 100644
--- a/core/install_jni_libs_internal.mk
+++ b/core/install_jni_libs_internal.mk
@@ -106,11 +106,13 @@
     my_allowed_types := $(my_allowed_ndk_types)
     ifneq (,$(filter true,$(LOCAL_VENDOR_MODULE) $(LOCAL_ODM_MODULE) $(LOCAL_PROPRIETARY_MODULE)))
       my_allowed_types += native:vendor native:vndk native:platform_vndk
+    else ifeq ($(LOCAL_PRODUCT_MODULE),true)
+      my_allowed_types += native:product native:vndk native:platform_vndk
     endif
   else
     my_link_type := app:platform
     my_warn_types := $(my_warn_ndk_types)
-    my_allowed_types := $(my_allowed_ndk_types) native:platform native:vendor native:vndk native:vndk_private native:platform_vndk
+    my_allowed_types := $(my_allowed_ndk_types) native:platform native:product native:vendor native:vndk native:vndk_private native:platform_vndk
   endif
 
   my_link_deps := $(addprefix SHARED_LIBRARIES:,$(LOCAL_JNI_SHARED_LIBRARIES))
diff --git a/core/local_vndk.mk b/core/local_vndk.mk
index 198e361..b1bd3e6 100644
--- a/core/local_vndk.mk
+++ b/core/local_vndk.mk
@@ -1,5 +1,5 @@
 
-#Set LOCAL_USE_VNDK for modules going into vendor or odm partition, except for host modules
+#Set LOCAL_USE_VNDK for modules going into product, vendor or odm partition, except for host modules
 #If LOCAL_SDK_VERSION is set, thats a more restrictive set, so they dont need LOCAL_USE_VNDK
 ifndef LOCAL_IS_HOST_MODULE
 ifndef LOCAL_SDK_VERSION
@@ -8,6 +8,13 @@
     # Note: no need to check LOCAL_MODULE_PATH* since LOCAL_[VENDOR|ODM|OEM]_MODULE is already
     # set correctly before this is included.
   endif
+  ifdef PRODUCT_PRODUCT_VNDK_VERSION
+    # Product modules also use VNDK when PRODUCT_PRODUCT_VNDK_VERSION is defined.
+    ifeq (true,$(LOCAL_PRODUCT_MODULE))
+      LOCAL_USE_VNDK:=true
+      LOCAL_USE_VNDK_PRODUCT:=true
+    endif
+  endif
 endif
 endif
 
@@ -33,6 +40,7 @@
   # If we're not using the VNDK, drop all restrictions
   ifndef BOARD_VNDK_VERSION
     LOCAL_USE_VNDK:=
+    LOCAL_USE_VNDK_PRODUCT:=
   endif
 endif
 
diff --git a/core/main.mk b/core/main.mk
index 99e4e43..ec1effd 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -444,10 +444,6 @@
 subdir_makefiles_total := $(words init post finish)
 endif
 
-droid_targets: no_vendor_variant_vndk_check
-.PHONY: no_vendor_variant_vndk_check
-no_vendor_variant_vndk_check:
-
 $(info [$(call inc_and_print,subdir_makefiles_inc)/$(subdir_makefiles_total)] finishing build rules ...)
 
 # -------------------------------------------------------------------
@@ -1341,7 +1337,7 @@
 endif
 
 # Build docs as part of checkbuild to catch more breakages.
-module_to_check += $(ALL_DOCS)
+modules_to_check += $(ALL_DOCS)
 
 # for easier debugging
 modules_to_check := $(sort $(modules_to_check))
diff --git a/core/product_config.mk b/core/product_config.mk
index afe91d4..1890599 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -344,6 +344,16 @@
 $(KATI_obsolete_var OVERRIDE_PRODUCT_EXTRA_VNDK_VERSIONS \
     ,Use PRODUCT_EXTRA_VNDK_VERSIONS instead)
 
+ifdef OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE
+  PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE := $(OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE)
+else ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
+  # No shipping level defined
+else ifeq ($(call math_gt,$(PRODUCT_SHIPPING_API_LEVEL),29),true)
+  PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE := true
+endif
+
+$(KATI_obsolete_var OVERRIDE_PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE,Use PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE instead)
+
 define product-overrides-config
 $$(foreach rule,$$(PRODUCT_$(1)_OVERRIDES),\
     $$(if $$(filter 2,$$(words $$(subst :,$$(space),$$(rule)))),,\
diff --git a/core/rbe.mk b/core/rbe.mk
index 231859b..6a92366 100644
--- a/core/rbe.mk
+++ b/core/rbe.mk
@@ -21,12 +21,25 @@
   else
     rbe_dir := $(HOME)/rbe
   endif
-  RBE_WRAPPER := $(rbe_dir)/rewrapper --labels=type=compile,lang=cpp,compiler=clang --env_var_whitelist=PWD
+  RBE_WRAPPER := $(rbe_dir)/rewrapper
+  RBE_CXX := --labels=type=compile,lang=cpp,compiler=clang --env_var_whitelist=PWD
 
   # Append rewrapper to existing *_WRAPPER variables so it's possible to
   # use both ccache and rewrapper.
-  CC_WRAPPER := $(strip $(CC_WRAPPER) $(RBE_WRAPPER))
-  CXX_WRAPPER := $(strip $(CXX_WRAPPER) $(RBE_WRAPPER))
+  CC_WRAPPER := $(strip $(CC_WRAPPER) $(RBE_WRAPPER) $(RBE_CXX))
+  CXX_WRAPPER := $(strip $(CXX_WRAPPER) $(RBE_WRAPPER) $(RBE_CXX))
+
+  ifdef RBE_JAVAC
+    JAVAC_WRAPPER := $(strip $(JAVAC_WRAPPER) $(RBE_WRAPPER) --labels=type=compile,lang=java,compiler=javac,shallow=true)
+  endif
+
+  ifdef RBE_R8
+    R8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=r8,shallow=true)
+  endif
+
+  ifdef RBE_D8
+    D8_WRAPPER := $(strip $(RBE_WRAPPER) --labels=type=compile,compiler=d8,shallow=true)
+  endif
 
   rbe_dir :=
 endif
diff --git a/core/shared_library.mk b/core/shared_library.mk
index 2832c17..ca17151 100644
--- a/core/shared_library.mk
+++ b/core/shared_library.mk
@@ -1,4 +1,7 @@
 $(call record-module-type,SHARED_LIBRARY)
+ifdef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,BUILD_SHARED_LIBRARY is incompatible with LOCAL_IS_HOST_MODULE. Use BUILD_HOST_SHARED_LIBRARY instead.)
+endif
 my_prefix := TARGET_
 include $(BUILD_SYSTEM)/multilib.mk
 
@@ -53,4 +56,7 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers)
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/core/shared_library_internal.mk b/core/shared_library_internal.mk
index 8ec07f8..219772a 100644
--- a/core/shared_library_internal.mk
+++ b/core/shared_library_internal.mk
@@ -39,11 +39,6 @@
 else
 my_target_libcrt_builtins := $($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)LIBCRT_BUILTINS)
 endif
-ifeq ($(LOCAL_NO_LIBGCC),true)
-my_target_libgcc :=
-else
-my_target_libgcc := $(call intermediates-dir-for,STATIC_LIBRARIES,libgcc,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libgcc.a
-endif
 my_target_libatomic := $(call intermediates-dir-for,STATIC_LIBRARIES,libatomic,,,$(LOCAL_2ND_ARCH_VAR_PREFIX))/libatomic.a
 ifeq ($(LOCAL_NO_CRT),true)
 my_target_crtbegin_so_o :=
@@ -60,7 +55,6 @@
 my_target_crtend_so_o := $(wildcard $(my_ndk_sysroot_lib)/crtend_so.o)
 endif
 $(linked_module): PRIVATE_TARGET_LIBCRT_BUILTINS := $(my_target_libcrt_builtins)
-$(linked_module): PRIVATE_TARGET_LIBGCC := $(my_target_libgcc)
 $(linked_module): PRIVATE_TARGET_LIBATOMIC := $(my_target_libatomic)
 $(linked_module): PRIVATE_TARGET_CRTBEGIN_SO_O := $(my_target_crtbegin_so_o)
 $(linked_module): PRIVATE_TARGET_CRTEND_SO_O := $(my_target_crtend_so_o)
@@ -71,7 +65,6 @@
         $(my_target_crtbegin_so_o) \
         $(my_target_crtend_so_o) \
         $(my_target_libcrt_builtins) \
-        $(my_target_libgcc) \
         $(my_target_libatomic) \
         $(LOCAL_ADDITIONAL_DEPENDENCIES) $(CLANG_CXX)
 	$(transform-o-to-shared-lib)
diff --git a/core/soong_app_prebuilt.mk b/core/soong_app_prebuilt.mk
index ebb22c5..0a5ba9d 100644
--- a/core/soong_app_prebuilt.mk
+++ b/core/soong_app_prebuilt.mk
@@ -139,6 +139,9 @@
 my_2nd_arch_prefix :=
 
 PACKAGES := $(PACKAGES) $(LOCAL_MODULE)
+ifndef LOCAL_CERTIFICATE
+  $(call pretty-error,LOCAL_CERTIFICATE must be set for soong_app_prebuilt.mk)
+endif
 ifeq ($(LOCAL_CERTIFICATE),PRESIGNED)
   # The magic string "PRESIGNED" means this package is already checked
   # signed with its release key.
diff --git a/core/soong_cc_prebuilt.mk b/core/soong_cc_prebuilt.mk
index b095b7c..190a7ed 100644
--- a/core/soong_cc_prebuilt.mk
+++ b/core/soong_cc_prebuilt.mk
@@ -75,8 +75,13 @@
 ifdef LOCAL_USE_VNDK
   ifneq ($(LOCAL_VNDK_DEPEND_ON_CORE_VARIANT),true)
     name_without_suffix := $(patsubst %.vendor,%,$(LOCAL_MODULE))
-    ifneq ($(name_without_suffix),$(LOCAL_MODULE)
+    ifneq ($(name_without_suffix),$(LOCAL_MODULE))
       SPLIT_VENDOR.$(LOCAL_MODULE_CLASS).$(name_without_suffix) := 1
+    else
+      name_without_suffix := $(patsubst %.product,%,$(LOCAL_MODULE))
+      ifneq ($(name_without_suffix),$(LOCAL_MODULE))
+        SPLIT_PRODUCT.$(LOCAL_MODULE_CLASS).$(name_without_suffix) := 1
+      endif
     endif
     name_without_suffix :=
   endif
@@ -125,7 +130,7 @@
   $(same_vndk_variants_stamp): $(my_core_shared_lib) $(LOCAL_PREBUILT_MODULE_FILE)
 		$(call verify-vndk-libs-identical,\
 		    $(PRIVATE_CORE_VARIANT),\
-		    $(PRIVATE_VENDOR_VARIANT)\
+		    $(PRIVATE_VENDOR_VARIANT),\
 		    $(PRIVATE_TOOLS_PREFIX))
 
   $(LOCAL_BUILT_MODULE): $(same_vndk_variants_stamp)
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 7813e30..d6188f4 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -112,7 +112,8 @@
 $(call add_json_bool, ClangTidy,                         $(filter 1 true,$(WITH_TIDY)))
 $(call add_json_str,  TidyChecks,                        $(WITH_TIDY_CHECKS))
 
-$(call add_json_bool, NativeCoverage,                    $(filter true,$(NATIVE_COVERAGE)))
+$(call add_json_bool, Native_coverage,                   $(filter true,$(NATIVE_COVERAGE)))
+$(call add_json_bool, ClangCoverage,                     $(filter true,$(CLANG_COVERAGE)))
 $(call add_json_list, CoveragePaths,                     $(COVERAGE_PATHS))
 $(call add_json_list, CoverageExcludePaths,              $(COVERAGE_EXCLUDE_PATHS))
 
@@ -155,6 +156,9 @@
 
 $(call add_json_bool, UseGoma,                           $(filter-out false,$(USE_GOMA)))
 $(call add_json_bool, UseRBE,                            $(filter-out false,$(USE_RBE)))
+$(call add_json_bool, UseRBEJAVAC,                       $(filter-out false,$(RBE_JAVAC)))
+$(call add_json_bool, UseRBER8,                          $(filter-out false,$(RBE_R8)))
+$(call add_json_bool, UseRBED8,                          $(filter-out false,$(RBE_D8)))
 $(call add_json_bool, Arc,                               $(filter true,$(TARGET_ARC)))
 
 $(call add_json_list, NamespacesToExport,                $(PRODUCT_SOONG_NAMESPACES))
@@ -202,6 +206,8 @@
 
 $(call add_json_bool, InstallExtraFlattenedApexes, $(PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES))
 
+$(call add_json_bool, BoardUsesRecoveryAsBoot, $(BOARD_USES_RECOVERY_AS_BOOT))
+
 $(call json_end)
 
 $(file >$(SOONG_VARIABLES).tmp,$(json_contents))
diff --git a/core/static_library.mk b/core/static_library.mk
index 8002e5c..78908cf 100644
--- a/core/static_library.mk
+++ b/core/static_library.mk
@@ -1,4 +1,7 @@
 $(call record-module-type,STATIC_LIBRARY)
+ifdef LOCAL_IS_HOST_MODULE
+  $(call pretty-error,BUILD_STATIC_LIBRARY is incompatible with LOCAL_IS_HOST_MODULE. Use BUILD_HOST_STATIC_LIBRARY instead)
+endif
 my_prefix := TARGET_
 include $(BUILD_SYSTEM)/multilib.mk
 
@@ -38,4 +41,7 @@
 ###########################################################
 ## Copy headers to the install tree
 ###########################################################
-include $(BUILD_COPY_HEADERS)
+ifdef LOCAL_COPY_HEADERS
+$(call pretty-warning,LOCAL_COPY_HEADERS is deprecated. See $(CHANGES_URL)#copy_headers)
+include $(BUILD_SYSTEM)/copy_headers.mk
+endif
diff --git a/target/board/Android.mk b/target/board/Android.mk
index 5ac45ea..2c7d2da 100644
--- a/target/board/Android.mk
+++ b/target/board/Android.mk
@@ -50,7 +50,6 @@
 
 LOCAL_PREBUILT_MODULE_FILE := $(GEN)
 include $(BUILD_PREBUILT)
-BUILT_VENDOR_MANIFEST := $(LOCAL_BUILT_MODULE)
 endif
 
 # ODM manifest
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 8ced9ab..20fd189 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -132,6 +132,7 @@
     libdrmframework_jni \
     libEGL \
     libETC1 \
+    libfdtrack \
     libFFTEm \
     libfilterfw \
     libgatekeeper \
diff --git a/target/product/emulated_storage.mk b/target/product/emulated_storage.mk
new file mode 100644
index 0000000..89de192
--- /dev/null
+++ b/target/product/emulated_storage.mk
@@ -0,0 +1,21 @@
+#
+# Copyright (C) 2020 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+PRODUCT_QUOTA_PROJID := 1
+PRODUCT_PRODUCT_PROPERTIES += ro.emulated_storage.projid=1
+
+PRODUCT_FS_CASEFOLD := 1
+PRODUCT_PRODUCT_PROPERTIES += ro.emulated_storage.casefold=1
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index a922bc3..2053473 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -110,6 +110,7 @@
 VNDK-core: android.hardware.drm@1.1.so
 VNDK-core: android.hardware.drm@1.2.so
 VNDK-core: android.hardware.dumpstate@1.0.so
+VNDK-core: android.hardware.dumpstate@1.1.so
 VNDK-core: android.hardware.fastboot@1.0.so
 VNDK-core: android.hardware.gatekeeper@1.0.so
 VNDK-core: android.hardware.gnss.measurement_corrections@1.0.so
@@ -169,6 +170,7 @@
 VNDK-core: android.hardware.radio@1.5.so
 VNDK-core: android.hardware.secure_element@1.0.so
 VNDK-core: android.hardware.secure_element@1.1.so
+VNDK-core: android.hardware.secure_element@1.2.so
 VNDK-core: android.hardware.sensors@1.0.so
 VNDK-core: android.hardware.sensors@2.0.so
 VNDK-core: android.hardware.soundtrigger@2.0-core.so
@@ -235,8 +237,6 @@
 VNDK-core: libhardware_legacy.so
 VNDK-core: libhidlallocatorutils.so
 VNDK-core: libjpeg.so
-VNDK-core: libkeymaster_messages.so
-VNDK-core: libkeymaster_portable.so
 VNDK-core: libldacBT_abr.so
 VNDK-core: libldacBT_enc.so
 VNDK-core: liblz4.so
@@ -252,11 +252,8 @@
 VNDK-core: libpng.so
 VNDK-core: libpower.so
 VNDK-core: libprocinfo.so
-VNDK-core: libprotobuf-cpp-lite-3.9.1.so
-VNDK-core: libpuresoftkeymasterdevice.so
 VNDK-core: libradio_metadata.so
 VNDK-core: libselinux.so
-VNDK-core: libsoftkeymasterdevice.so
 VNDK-core: libspeexresampler.so
 VNDK-core: libsqlite.so
 VNDK-core: libssl.so
diff --git a/target/product/mainline_system.mk b/target/product/mainline_system.mk
index c880971..ccbc907 100644
--- a/target/product/mainline_system.mk
+++ b/target/product/mainline_system.mk
@@ -24,9 +24,6 @@
 # Enable updating of APEXes
 $(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
 
-# Mainline devices support userspace reboot
-$(call inherit-product, $(SRC_TARGET_DIR)/product/userspace_reboot.mk)
-
 # Shared java libs
 PRODUCT_PACKAGES += \
     com.android.nfc_extras \
diff --git a/target/product/virtual_ab_ota.mk b/target/product/virtual_ab_ota.mk
index c00b0ed..5c398b4 100644
--- a/target/product/virtual_ab_ota.mk
+++ b/target/product/virtual_ab_ota.mk
@@ -17,3 +17,5 @@
 PRODUCT_VIRTUAL_AB_OTA := true
 
 PRODUCT_PRODUCT_PROPERTIES += ro.virtual_ab.enabled=true
+
+PRODUCT_PACKAGES += e2fsck_ramdisk
diff --git a/tools/releasetools/apex_utils.py b/tools/releasetools/apex_utils.py
index ee3c463..4fac6f3 100644
--- a/tools/releasetools/apex_utils.py
+++ b/tools/releasetools/apex_utils.py
@@ -18,6 +18,7 @@
 import os.path
 import re
 import shlex
+import shutil
 import zipfile
 
 import common
@@ -41,6 +42,140 @@
     Exception.__init__(self, message)
 
 
+class ApexApkSigner(object):
+  """Class to sign the apk files in a apex payload image and repack the apex"""
+
+  def __init__(self, apex_path, key_passwords, codename_to_api_level_map):
+    self.apex_path = apex_path
+    self.key_passwords = key_passwords
+    self.codename_to_api_level_map = codename_to_api_level_map
+
+  def ProcessApexFile(self, apk_keys, payload_key, payload_public_key,
+                      signing_args=None):
+    """Scans and signs the apk files and repack the apex
+
+    Args:
+      apk_keys: A dict that holds the signing keys for apk files.
+      payload_key: The path to the apex payload signing key.
+      payload_public_key: The path to the public key corresponding to the
+       payload signing key.
+
+    Returns:
+      The repacked apex file containing the signed apk files.
+    """
+    list_cmd = ['deapexer', 'list', self.apex_path]
+    entries_names = common.RunAndCheckOutput(list_cmd).split()
+    apk_entries = [name for name in entries_names if name.endswith('.apk')]
+
+    # No need to sign and repack, return the original apex path.
+    if not apk_entries:
+      logger.info('No apk file to sign in %s', self.apex_path)
+      return self.apex_path
+
+    for entry in apk_entries:
+      apk_name = os.path.basename(entry)
+      if apk_name not in apk_keys:
+        raise ApexSigningError('Failed to find signing keys for apk file {} in'
+                               ' apex {}.  Use "-e <apkname>=" to specify a key'
+                               .format(entry, self.apex_path))
+      if not any(dirname in entry for dirname in ['app/', 'priv-app/',
+                                                  'overlay/']):
+        logger.warning('Apk path does not contain the intended directory name:'
+                       ' %s', entry)
+
+    payload_dir, has_signed_apk = self.ExtractApexPayloadAndSignApks(
+        apk_entries, apk_keys)
+    if not has_signed_apk:
+      logger.info('No apk file has been signed in %s', self.apex_path)
+      return self.apex_path
+
+    return self.RepackApexPayload(payload_dir, payload_key, payload_public_key,
+                                  signing_args)
+
+  def ExtractApexPayloadAndSignApks(self, apk_entries, apk_keys):
+    """Extracts the payload image and signs the containing apk files."""
+    payload_dir = common.MakeTempDir()
+    extract_cmd = ['deapexer', 'extract', self.apex_path, payload_dir]
+    common.RunAndCheckOutput(extract_cmd)
+
+    has_signed_apk = False
+    for entry in apk_entries:
+      apk_path = os.path.join(payload_dir, entry)
+      assert os.path.exists(self.apex_path)
+
+      key_name = apk_keys.get(os.path.basename(entry))
+      if key_name in common.SPECIAL_CERT_STRINGS:
+        logger.info('Not signing: %s due to special cert string', apk_path)
+        continue
+
+      logger.info('Signing apk file %s in apex %s', apk_path, self.apex_path)
+      # Rename the unsigned apk and overwrite the original apk path with the
+      # signed apk file.
+      unsigned_apk = common.MakeTempFile()
+      os.rename(apk_path, unsigned_apk)
+      common.SignFile(unsigned_apk, apk_path, key_name, self.key_passwords,
+                      codename_to_api_level_map=self.codename_to_api_level_map)
+      has_signed_apk = True
+    return payload_dir, has_signed_apk
+
+  def RepackApexPayload(self, payload_dir, payload_key, payload_public_key,
+                        signing_args=None):
+    """Rebuilds the apex file with the updated payload directory."""
+    apex_dir = common.MakeTempDir()
+    # Extract the apex file and reuse its meta files as repack parameters.
+    common.UnzipToDir(self.apex_path, apex_dir)
+
+    android_jar_path = common.OPTIONS.android_jar_path
+    if not android_jar_path:
+      android_jar_path = os.path.join(os.environ.get('ANDROID_BUILD_TOP', ''),
+                                      'prebuilts', 'sdk', 'current', 'public',
+                                      'android.jar')
+      logger.warning('android_jar_path not found in options, falling back to'
+                     ' use %s', android_jar_path)
+
+    arguments_dict = {
+        'manifest': os.path.join(apex_dir, 'apex_manifest.pb'),
+        'build_info': os.path.join(apex_dir, 'apex_build_info.pb'),
+        'android_jar_path': android_jar_path,
+        'key': payload_key,
+        'pubkey': payload_public_key,
+    }
+    for filename in arguments_dict.values():
+      assert os.path.exists(filename), 'file {} not found'.format(filename)
+
+    # The repack process will add back these files later in the payload image.
+    for name in ['apex_manifest.pb', 'apex_manifest.json', 'lost+found']:
+      path = os.path.join(payload_dir, name)
+      if os.path.isfile(path):
+        os.remove(path)
+      elif os.path.isdir(path):
+        shutil.rmtree(path)
+
+    repacked_apex = common.MakeTempFile(suffix='.apex')
+    repack_cmd = ['apexer', '--force', '--include_build_info',
+                  '--do_not_check_keyname', '--apexer_tool_path',
+                  os.getenv('PATH')]
+    for key, val in arguments_dict.items():
+      repack_cmd.extend(['--' + key, val])
+    # Add quote to the signing_args as we will pass
+    # --signing_args "--signing_helper_with_files=%path" to apexer
+    if signing_args:
+      repack_cmd.extend(['--signing_args', '"{}"'.format(signing_args)])
+    # optional arguments for apex repacking
+    manifest_json = os.path.join(apex_dir, 'apex_manifest.json')
+    if os.path.exists(manifest_json):
+      repack_cmd.extend(['--manifest_json', manifest_json])
+    assets_dir = os.path.join(apex_dir, 'assets')
+    if os.path.isdir(assets_dir):
+      repack_cmd.extend(['--assets_dir', assets_dir])
+    repack_cmd.extend([payload_dir, repacked_apex])
+    if OPTIONS.verbose:
+      repack_cmd.append('-v')
+    common.RunAndCheckOutput(repack_cmd)
+
+    return repacked_apex
+
+
 def SignApexPayload(avbtool, payload_file, payload_key_path, payload_key_name,
                     algorithm, salt, no_hashtree, signing_args=None):
   """Signs a given payload_file with the payload key."""
@@ -155,7 +290,8 @@
 
 
 def SignApex(avbtool, apex_data, payload_key, container_key, container_pw,
-             codename_to_api_level_map, no_hashtree, signing_args=None):
+             apk_keys, codename_to_api_level_map,
+             no_hashtree, signing_args=None):
   """Signs the current APEX with the given payload/container keys.
 
   Args:
@@ -163,6 +299,7 @@
     payload_key: The path to payload signing key (w/ extension).
     container_key: The path to container signing key (w/o extension).
     container_pw: The matching password of the container_key, or None.
+    apk_keys: A dict that holds the signing keys for apk files.
     codename_to_api_level_map: A dict that maps from codename to API level.
     no_hashtree: Don't include hashtree in the signed APEX.
     signing_args: Additional args to be passed to the payload signer.
@@ -177,7 +314,15 @@
   APEX_PAYLOAD_IMAGE = 'apex_payload.img'
   APEX_PUBKEY = 'apex_pubkey'
 
-  # 1a. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given
+  # 1. Extract the apex payload image and sign the containing apk files. Repack
+  # the apex file after signing.
+  payload_public_key = common.ExtractAvbPublicKey(avbtool, payload_key)
+  apk_signer = ApexApkSigner(apex_file, container_pw,
+                             codename_to_api_level_map)
+  apex_file = apk_signer.ProcessApexFile(apk_keys, payload_key,
+                                         payload_public_key, signing_args)
+
+  # 2a. Extract and sign the APEX_PAYLOAD_IMAGE entry with the given
   # payload_key.
   payload_dir = common.MakeTempDir(prefix='apex-payload-')
   with zipfile.ZipFile(apex_file) as apex_fd:
@@ -195,8 +340,7 @@
       no_hashtree,
       signing_args)
 
-  # 1b. Update the embedded payload public key.
-  payload_public_key = common.ExtractAvbPublicKey(avbtool, payload_key)
+  # 2b. Update the embedded payload public key.
 
   common.ZipDelete(apex_file, APEX_PAYLOAD_IMAGE)
   if APEX_PUBKEY in zip_items:
@@ -206,11 +350,11 @@
   common.ZipWrite(apex_zip, payload_public_key, arcname=APEX_PUBKEY)
   common.ZipClose(apex_zip)
 
-  # 2. Align the files at page boundary (same as in apexer).
+  # 3. Align the files at page boundary (same as in apexer).
   aligned_apex = common.MakeTempFile(prefix='apex-container-', suffix='.apex')
   common.RunAndCheckOutput(['zipalign', '-f', '4096', apex_file, aligned_apex])
 
-  # 3. Sign the APEX container with container_key.
+  # 4. Sign the APEX container with container_key.
   signed_apex = common.MakeTempFile(prefix='apex-container-', suffix='.apex')
 
   # Specify the 4K alignment when calling SignApk.
diff --git a/tools/releasetools/build_image.py b/tools/releasetools/build_image.py
index 1e7d387..e424b6f 100755
--- a/tools/releasetools/build_image.py
+++ b/tools/releasetools/build_image.py
@@ -248,6 +248,8 @@
   build_command = []
   fs_type = prop_dict.get("fs_type", "")
   run_e2fsck = False
+  needs_projid = prop_dict.get("needs_projid", 0)
+  needs_casefold = prop_dict.get("needs_casefold", 0)
 
   if fs_type.startswith("ext"):
     build_command = [prop_dict["ext_mkuserimg"]]
@@ -287,7 +289,10 @@
         build_command.extend(["-S", prop_dict["hash_seed"]])
     if "ext4_share_dup_blocks" in prop_dict:
       build_command.append("-c")
-    build_command.extend(["--inode_size", "256"])
+    if (needs_projid):
+      build_command.extend(["--inode_size", "512"])
+    else:
+      build_command.extend(["--inode_size", "256"])
     if "selinux_fc" in prop_dict:
       build_command.append(prop_dict["selinux_fc"])
   elif fs_type.startswith("squash"):
@@ -328,6 +333,10 @@
     if "timestamp" in prop_dict:
       build_command.extend(["-T", str(prop_dict["timestamp"])])
     build_command.extend(["-L", prop_dict["mount_point"]])
+    if (needs_projid):
+      build_command.append("--prjquota")
+    if (needs_casefold):
+      build_command.append("--casefold")
   else:
     raise BuildImageError(
         "Error: unknown filesystem type: {}".format(fs_type))
@@ -598,6 +607,8 @@
     copy_prop("flash_logical_block_size", "flash_logical_block_size")
     copy_prop("flash_erase_block_size", "flash_erase_block_size")
     copy_prop("userdata_selinux_fc", "selinux_fc")
+    copy_prop("needs_casefold", "needs_casefold")
+    copy_prop("needs_projid", "needs_projid")
   elif mount_point == "cache":
     copy_prop("cache_fs_type", "fs_type")
     copy_prop("cache_size", "partition_size")
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 6a6f119..2e235ee 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -69,6 +69,7 @@
     self.extra_signapk_args = []
     self.java_path = "java"  # Use the one on the path by default.
     self.java_args = ["-Xmx2048m"]  # The default JVM args.
+    self.android_jar_path = None
     self.public_key_suffix = ".x509.pem"
     self.private_key_suffix = ".pk8"
     # use otatools built boot_signer by default
@@ -1823,7 +1824,7 @@
         argv, "hvp:s:x:" + extra_opts,
         ["help", "verbose", "path=", "signapk_path=",
          "signapk_shared_library_path=", "extra_signapk_args=",
-         "java_path=", "java_args=", "public_key_suffix=",
+         "java_path=", "java_args=", "android_jar_path=", "public_key_suffix=",
          "private_key_suffix=", "boot_signer_path=", "boot_signer_args=",
          "verity_signer_path=", "verity_signer_args=", "device_specific=",
          "extra=", "logfile=", "aftl_server=", "aftl_key_path=",
@@ -1852,6 +1853,8 @@
       OPTIONS.java_path = a
     elif o in ("--java_args",):
       OPTIONS.java_args = shlex.split(a)
+    elif o in ("--android_jar_path",):
+      OPTIONS.android_jar_path = a
     elif o in ("--public_key_suffix",):
       OPTIONS.public_key_suffix = a
     elif o in ("--private_key_suffix",):
diff --git a/tools/releasetools/sign_apex.py b/tools/releasetools/sign_apex.py
index 4c0850c..b0128dc 100755
--- a/tools/releasetools/sign_apex.py
+++ b/tools/releasetools/sign_apex.py
@@ -31,6 +31,10 @@
   --payload_extra_args <args>
       Optional flag that specifies any extra args to be passed to payload signer
       (e.g. --payload_extra_args="--signing_helper_with_files /path/to/helper").
+
+  -e  (--extra_apks)  <name,name,...=key>
+      Add extra APK name/key pairs. This is useful to sign the apk files in the
+      apex payload image.
 """
 
 import logging
@@ -43,8 +47,8 @@
 logger = logging.getLogger(__name__)
 
 
-def SignApexFile(avbtool, apex_file, payload_key, container_key,
-                 no_hashtree, signing_args=None):
+def SignApexFile(avbtool, apex_file, payload_key, container_key, no_hashtree,
+                 apk_keys=None, signing_args=None):
   """Signs the given apex file."""
   with open(apex_file, 'rb') as input_fp:
     apex_data = input_fp.read()
@@ -57,6 +61,7 @@
       container_pw=None,
       codename_to_api_level_map=None,
       no_hashtree=no_hashtree,
+      apk_keys=apk_keys,
       signing_args=signing_args)
 
 
@@ -77,18 +82,26 @@
       options['payload_key'] = a
     elif o == '--payload_extra_args':
       options['payload_extra_args'] = a
+    elif o in ("-e", "--extra_apks"):
+      names, key = a.split("=")
+      names = names.split(",")
+      for n in names:
+        if 'extra_apks' not in options:
+          options['extra_apks'] = {}
+        options['extra_apks'].update({n: key})
     else:
       return False
     return True
 
   args = common.ParseOptions(
       argv, __doc__,
-      extra_opts='',
+      extra_opts='e:',
       extra_long_opts=[
           'avbtool=',
           'container_key=',
           'payload_extra_args=',
           'payload_key=',
+          'extra_apks=',
       ],
       extra_option_handler=option_handler)
 
@@ -105,6 +118,7 @@
       options['payload_key'],
       options['container_key'],
       no_hashtree=False,
+      apk_keys=options.get('extra_apks', {}),
       signing_args=options.get('payload_extra_args'))
   shutil.copyfile(signed_apex, args[1])
   logger.info("done.")
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index fffbace..cce771c 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -103,6 +103,9 @@
       Specify any additional args that are needed to AVB-sign the image
       (e.g. "--signing_helper /path/to/helper"). The args will be appended to
       the existing ones in info dict.
+
+  --android_jar_path <path>
+      Path to the android.jar to repack the apex file.
 """
 
 from __future__ import print_function
@@ -151,6 +154,7 @@
 OPTIONS.avb_keys = {}
 OPTIONS.avb_algorithms = {}
 OPTIONS.avb_extra_args = {}
+OPTIONS.android_jar_path = None
 
 
 AVB_FOOTER_ARGS_BY_PARTITION = {
@@ -492,6 +496,7 @@
             payload_key,
             container_key,
             key_passwords[container_key],
+            apk_keys,
             codename_to_api_level_map,
             no_hashtree=True,
             signing_args=OPTIONS.avb_extra_args.get('apex'))
@@ -1247,6 +1252,8 @@
   apex_keys_info = ReadApexKeysInfo(input_zip)
   apex_keys = GetApexKeys(apex_keys_info, apk_keys)
 
+  # TODO(xunchang) check for the apks inside the apex files, and abort early if
+  # the keys are not available.
   CheckApkAndApexKeysAvailable(
       input_zip,
       set(apk_keys.keys()) | set(apex_keys.keys()),
diff --git a/tools/releasetools/test_apex_utils.py b/tools/releasetools/test_apex_utils.py
index 5d4cc77..07284ad 100644
--- a/tools/releasetools/test_apex_utils.py
+++ b/tools/releasetools/test_apex_utils.py
@@ -16,6 +16,7 @@
 
 import os
 import os.path
+import zipfile
 
 import apex_utils
 import common
@@ -32,6 +33,8 @@
     # The default payload signing key.
     self.payload_key = os.path.join(self.testdata_dir, 'testkey.key')
 
+    common.OPTIONS.search_path = test_utils.get_search_path()
+
   @staticmethod
   def _GetTestPayload():
     payload_file = common.MakeTempFile(prefix='apex-', suffix='.img')
@@ -126,3 +129,67 @@
         payload_file,
         os.path.join(self.testdata_dir, 'testkey_with_passwd.key'),
         no_hashtree=True)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_noApkPresent(self):
+    apex_path = os.path.join(self.testdata_dir, 'foo.apex')
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    processed_apex = signer.ProcessApexFile({}, self.payload_key,
+                                            None)
+    self.assertEqual(apex_path, processed_apex)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_apkKeyNotPresent(self):
+    apex_path = os.path.join(self.testdata_dir, 'has_apk.apex')
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    self.assertRaises(apex_utils.ApexSigningError, signer.ProcessApexFile, {},
+                      self.payload_key, None)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_signApk(self):
+    apex_path = os.path.join(self.testdata_dir, 'has_apk.apex')
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+
+    self.payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    payload_pubkey = common.ExtractAvbPublicKey('avbtool',
+                                                self.payload_key)
+    signer.ProcessApexFile(apk_keys, self.payload_key, payload_pubkey)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_noAssetDir(self):
+    apex_path = os.path.join(self.testdata_dir, 'has_apk.apex')
+    no_asset = common.MakeTempFile(suffix='.apex')
+    with zipfile.ZipFile(no_asset, 'w') as output_zip:
+      with zipfile.ZipFile(apex_path, 'r') as input_zip:
+        name_list = input_zip.namelist()
+        for name in name_list:
+          if not name.startswith('assets'):
+            output_zip.writestr(name, input_zip.read(name))
+
+    signer = apex_utils.ApexApkSigner(no_asset, None, None)
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+
+    self.payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    payload_pubkey = common.ExtractAvbPublicKey('avbtool',
+                                                self.payload_key)
+    signer.ProcessApexFile(apk_keys, self.payload_key, payload_pubkey)
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_ApexApkSigner_withSignerHelper(self):
+    apex_path = os.path.join(self.testdata_dir, 'has_apk.apex')
+    signer = apex_utils.ApexApkSigner(apex_path, None, None)
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+
+    self.payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    payload_pubkey = common.ExtractAvbPublicKey('avbtool', self.payload_key)
+
+    signing_helper = os.path.join(self.testdata_dir, 'signing_helper.sh')
+    os.chmod(signing_helper, 0o700)
+    payload_signer_args = '--signing_helper_with_files={}'.format(
+        signing_helper)
+    signer.ProcessApexFile(apk_keys, self.payload_key, payload_pubkey,
+                           payload_signer_args)
diff --git a/tools/releasetools/test_sign_apex.py b/tools/releasetools/test_sign_apex.py
index 79d1de4..82f5938 100644
--- a/tools/releasetools/test_sign_apex.py
+++ b/tools/releasetools/test_sign_apex.py
@@ -41,3 +41,19 @@
         container_key,
         False)
     self.assertTrue(os.path.exists(signed_foo_apex))
+
+  @test_utils.SkipIfExternalToolsUnavailable()
+  def test_SignApexWithApk(self):
+    test_apex = os.path.join(self.testdata_dir, 'has_apk.apex')
+    payload_key = os.path.join(self.testdata_dir, 'testkey_RSA4096.key')
+    container_key = os.path.join(self.testdata_dir, 'testkey')
+    apk_keys = {'wifi-service-resources.apk': os.path.join(
+        self.testdata_dir, 'testkey')}
+    signed_test_apex = sign_apex.SignApexFile(
+        'avbtool',
+        test_apex,
+        payload_key,
+        container_key,
+        False,
+        apk_keys)
+    self.assertTrue(os.path.exists(signed_test_apex))
diff --git a/tools/releasetools/testdata/has_apk.apex b/tools/releasetools/testdata/has_apk.apex
new file mode 100644
index 0000000..12bbdf9
--- /dev/null
+++ b/tools/releasetools/testdata/has_apk.apex
Binary files differ
diff --git a/tools/warn/cpp_warn_patterns.py b/tools/warn/cpp_warn_patterns.py
index 0c458fb..65ce73a 100644
--- a/tools/warn/cpp_warn_patterns.py
+++ b/tools/warn/cpp_warn_patterns.py
@@ -435,6 +435,30 @@
            [r".*: warning: template argument.+Wunnamed-type-template-args"]),
     medium('Unannotated fall-through between switch labels',
            [r".*: warning: unannotated fall-through between switch labels.+Wimplicit-fallthrough"]),
+    medium('Invalid partial specialization',
+           [r".*: warning: class template partial specialization.+Winvalid-partial-specialization"]),
+    medium('Overlapping compatisons',
+           [r".*: warning: overlapping comparisons.+Wtautological-overlap-compare"]),
+    medium('int in bool context',
+           [r".*: warning: converting.+to a boolean.+Wint-in-bool-context"]),
+    medium('bitwise conditional parentheses',
+           [r".*: warning: operator.+has lower precedence.+Wbitwise-conditional-parentheses"]),
+    medium('sizeof array div',
+           [r".*: warning: .+number of elements in.+array.+Wsizeof-array-div"]),
+    medium('bool operation',
+           [r".*: warning: .+boolean.+always.+Wbool-operation"]),
+    medium('Undefined bool conversion',
+           [r".*: warning: .+may be.+always.+true.+Wundefined-bool-conversion"]),
+    medium('Typedef requires a name',
+           [r".*: warning: typedef requires a name.+Wmissing-declaration"]),
+    medium('Unknown escape sequence',
+           [r".*: warning: unknown escape sequence.+Wunknown-escape-sequence"]),
+    medium('Unicode whitespace',
+           [r".*: warning: treating Unicode.+as whitespace.+Wunicode-whitespace"]),
+    medium('Unused local typedef',
+           [r".*: warning: unused typedef.+Wunused-local-typedef"]),
+    medium('varargs warnings',
+           [r".*: warning: .*argument to 'va_start'.+\[-Wvarargs\]"]),
     harmless('Discarded qualifier from pointer target type',
              [r".*: warning: .+ discards '.+' qualifier from pointer target type"]),
     harmless('Use snprintf instead of sprintf',
diff --git a/tools/warn/java_warn_patterns.py b/tools/warn/java_warn_patterns.py
index 0a443d4..96510b4 100644
--- a/tools/warn/java_warn_patterns.py
+++ b/tools/warn/java_warn_patterns.py
@@ -38,6 +38,10 @@
   return java_warn(Severity.MEDIUM, description, pattern_list)
 
 
+def java_medium_type(name):
+  return java_medium(name, [r'.*\.java:.*: warning: .+ \[' + name + r'\]$'])
+
+
 def java_low(description, pattern_list):
   return java_warn(Severity.LOW, description, pattern_list)
 
@@ -457,6 +461,13 @@
                 [r".*: warning: \[WaitNotInLoop\] .+"]),
     java_medium('A wakelock acquired with a timeout may be released by the system before calling `release`, even after checking `isHeld()`. If so, it will throw a RuntimeException. Please wrap in a try/catch block.',
                 [r".*: warning: \[WakelockReleasedDangerously\] .+"]),
+    java_medium_type('CallbackName'),
+    java_medium_type('ExecutorRegistration'),
+    java_medium_type('ListenerLast'),
+    java_medium_type('MissingBuildMethod'),
+    java_medium_type('NoByteOrShort'),
+    java_medium_type('SetterReturnsThis'),
+    java_medium_type('UseIcu'),
     java_high('AndroidInjection.inject() should always be invoked before calling super.lifecycleMethod()',
               [r".*: warning: \[AndroidInjectionBeforeSuper\] .+"]),
     java_high('Use of class, field, or method that is not compatible with legacy Android devices',