diff --git a/core/main.mk b/core/main.mk
index 033a2d9..1946edb 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -96,6 +96,8 @@
 -include tools/tradefederation/build/suites/general-tests/config.mk
 # STS-specific config.
 -include test/sts/tools/sts-tradefed/build/config.mk
+# CTS-Instant-specific config
+-include test/suite_harness/tools/cts-instant-tradefed/build/config.mk
 
 # Clean rules
 .PHONY: clean-dex-files
diff --git a/core/tasks/cts_instant.mk b/core/tasks/cts_instant.mk
new file mode 100644
index 0000000..18f1db3
--- /dev/null
+++ b/core/tasks/cts_instant.mk
@@ -0,0 +1,25 @@
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+test_suite_name := cts_instant
+test_suite_tradefed := cts-instant-tradefed
+test_suite_dynamic_config := test/suite_harness/tools/cts-instant-tradefed/DynamicConfig.xml
+test_suite_readme := test/suite_harness/tools/cts-instant-tradefed/README
+
+include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
+
+.PHONY: cts_instant
+cts_instant: $(compatibility_zip)
+$(call dist-for-goals, cts_instant, $(compatibility_zip))
+
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index d6f3001..0a65d55 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -117,10 +117,6 @@
 BOARD_ROOT_EXTRA_FOLDERS += firmware firmware/radio persist
 BOARD_ROOT_EXTRA_SYMLINKS := /vendor/lib/dsp:/dsp
 
-# TODO(b/79781913): This is a temporary mount pointer for FBE.
-#   Will be remove after the FBE change the placement.
-BOARD_ROOT_EXTRA_FOLDERS += metadata
-
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
 BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
diff --git a/target/board/generic_arm64_ab/sepolicy/file_contexts b/target/board/generic_arm64_ab/sepolicy/file_contexts
index 6b785f5..0a80559 100644
--- a/target/board/generic_arm64_ab/sepolicy/file_contexts
+++ b/target/board/generic_arm64_ab/sepolicy/file_contexts
@@ -10,7 +10,3 @@
 
 # files in firmware
 /firmware(/.*)?         u:object_r:firmware_file:s0
-
-# TODO(b/79781913): This is a temporary mount pointer for FBE.
-#   Will be remove after the FBE change the placement.
-/metadata(/.*)?         u:object_r:metadata_file:s0
diff --git a/target/product/aosp_arm64.mk b/target/product/aosp_arm64.mk
index 650c391..129f213 100644
--- a/target/product/aosp_arm64.mk
+++ b/target/product/aosp_arm64.mk
@@ -42,12 +42,11 @@
 PRODUCT_PACKAGES += \
     vr_hwc
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_arm64/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 # Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
 PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
 
diff --git a/target/product/aosp_x86_64.mk b/target/product/aosp_x86_64.mk
index 7ca1c71..84d3863 100644
--- a/target/product/aosp_x86_64.mk
+++ b/target/product/aosp_x86_64.mk
@@ -39,12 +39,11 @@
 PRODUCT_PACKAGES += \
     vr_hwc
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 # Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
 PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
 
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index 8e100be..03c7d30 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -70,7 +70,11 @@
     sh_vendor \
     vintf \
     toybox_vendor \
-    CarrierConfig
+    CarrierConfig \
+    audio.primary.goldfish \
+    audio.r_submix.default \
+    local_time.default \
+    SdkSetup
 
 PRODUCT_PACKAGES += \
     android.hardware.audio@2.0-impl \
@@ -142,7 +146,22 @@
     device/generic/goldfish/wifi/simulated_hostapd.conf:$(TARGET_COPY_OUT_VENDOR)/etc/simulated_hostapd.conf \
     device/generic/goldfish/wifi/wpa_supplicant.conf:$(TARGET_COPY_OUT_VENDOR)/etc/wifi/wpa_supplicant.conf \
     device/generic/goldfish/wifi/WifiConfigStore.xml:data/misc/wifi/WifiConfigStore.xml \
-    frameworks/native/data/etc/android.hardware.wifi.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.xml
+    frameworks/native/data/etc/android.hardware.wifi.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.xml \
+    device/generic/goldfish/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
+    device/generic/goldfish/camera/media_profiles.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_profiles_V1_0.xml \
+    frameworks/av/media/libstagefright/data/media_codecs_google_audio.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_audio.xml \
+    frameworks/av/media/libstagefright/data/media_codecs_google_telephony.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_telephony.xml \
+    device/generic/goldfish/camera/media_codecs_google_video.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_video.xml \
+    device/generic/goldfish/camera/media_codecs.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs.xml \
+    device/generic/goldfish/camera/media_codecs_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_performance.xml \
+    frameworks/native/data/etc/android.hardware.touchscreen.multitouch.jazzhand.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.touchscreen.multitouch.jazzhand.xml \
+    frameworks/native/data/etc/android.hardware.camera.autofocus.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.camera.autofocus.xml \
+    frameworks/native/data/etc/android.hardware.camera.full.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.camera.full.xml \
+    frameworks/native/data/etc/android.hardware.fingerprint.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.fingerprint.xml \
+    frameworks/native/data/etc/android.software.autofill.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.autofill.xml \
+    frameworks/av/media/libeffects/data/audio_effects.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_effects.conf \
+    device/generic/goldfish/audio_policy.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy.conf
+
 
 PRODUCT_PACKAGE_OVERLAYS := device/generic/goldfish/overlay
 
diff --git a/target/product/full.mk b/target/product/full.mk
index b66ae92..7c0578c 100644
--- a/target/product/full.mk
+++ b/target/product/full.mk
@@ -19,11 +19,10 @@
 # build quite specifically for the emulator, and might not be
 # entirely appropriate to inherit from for on-device configurations.
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 # Overrides
 PRODUCT_NAME := full
 PRODUCT_DEVICE := generic
diff --git a/target/product/full_x86.mk b/target/product/full_x86.mk
index 4dff713..6ea2d05 100644
--- a/target/product/full_x86.mk
+++ b/target/product/full_x86.mk
@@ -23,11 +23,10 @@
 # that isn't a wifi connection. This will instruct init.rc to enable the
 # network connection so that you can use it with ADB
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 ifdef NET_ETH0_STARTONBOOT
   PRODUCT_PROPERTY_OVERRIDES += net.eth0.startonboot=1
 endif
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 1e2f39e..10a19b3 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -65,24 +65,29 @@
       when installed.
 
   --downgrade
-      Intentionally generate an incremental OTA that updates from a newer
-      build to an older one (based on timestamp comparison). "post-timestamp"
-      will be replaced by "ota-downgrade=yes" in the metadata file. A data
-      wipe will always be enforced, so "ota-wipe=yes" will also be included in
-      the metadata file. The update-binary in the source build will be used in
-      the OTA package, unless --binary flag is specified. Please also check the
-      doc for --override_timestamp below.
+      Intentionally generate an incremental OTA that updates from a newer build
+      to an older one (e.g. downgrading from P preview back to O MR1).
+      "ota-downgrade=yes" will be set in the package metadata file. A data wipe
+      will always be enforced when using this flag, so "ota-wipe=yes" will also
+      be included in the metadata file. The update-binary in the source build
+      will be used in the OTA package, unless --binary flag is specified. Please
+      also check the comment for --override_timestamp below.
 
   --override_timestamp
-      Intentionally generate an incremental OTA that updates from a newer
-      build to an older one (based on timestamp comparison), by overriding the
-      timestamp in package metadata. This differs from --downgrade flag: we
-      know for sure this is NOT an actual downgrade case, but two builds are
-      cut in a reverse order. A legit use case is that we cut a new build C
-      (after having A and B), but want to enfore an update path of A -> C -> B.
-      Specifying --downgrade may not help since that would enforce a data wipe
-      for C -> B update. The value of "post-timestamp" will be set to the newer
-      timestamp plus one, so that the package can be pushed and applied.
+      Intentionally generate an incremental OTA that updates from a newer build
+      to an older one (based on timestamp comparison), by setting the downgrade
+      flag in the package metadata. This differs from --downgrade flag, as we
+      don't enforce a data wipe with this flag. Because we know for sure this is
+      NOT an actual downgrade case, but two builds happen to be cut in a reverse
+      order (e.g. from two branches). A legit use case is that we cut a new
+      build C (after having A and B), but want to enfore an update path of A ->
+      C -> B. Specifying --downgrade may not help since that would enforce a
+      data wipe for C -> B update.
+
+      We used to set a fake timestamp in the package metadata for this flow. But
+      now we consolidate the two cases (i.e. an actual downgrade, or a downgrade
+      based on timestamp) with the same "ota-downgrade=yes" flag, with the
+      difference being whether "ota-wipe=yes" is set.
 
   -e  (--extra_script)  <file>
       Insert the contents of file at the end of the update script.
@@ -180,7 +185,6 @@
 OPTIONS.patch_threshold = 0.95
 OPTIONS.wipe_user_data = False
 OPTIONS.downgrade = False
-OPTIONS.timestamp = False
 OPTIONS.extra_script = None
 OPTIONS.worker_threads = multiprocessing.cpu_count() // 2
 if OPTIONS.worker_threads == 0:
@@ -898,23 +902,16 @@
 
   if OPTIONS.downgrade:
     if not is_downgrade:
-      raise RuntimeError("--downgrade specified but no downgrade detected: "
-                         "pre: %s, post: %s" % (pre_timestamp, post_timestamp))
+      raise RuntimeError(
+          "--downgrade or --override_timestamp specified but no downgrade "
+          "detected: pre: %s, post: %s" % (pre_timestamp, post_timestamp))
     metadata["ota-downgrade"] = "yes"
-  elif OPTIONS.timestamp:
-    if not is_downgrade:
-      raise RuntimeError("--override_timestamp specified but no timestamp hack "
-                         "needed: pre: %s, post: %s" % (pre_timestamp,
-                                                        post_timestamp))
-    metadata["post-timestamp"] = str(long(pre_timestamp) + 1)
   else:
     if is_downgrade:
-      raise RuntimeError("Downgrade detected based on timestamp check: "
-                         "pre: %s, post: %s. Need to specify "
-                         "--override_timestamp OR --downgrade to allow "
-                         "building the incremental." % (pre_timestamp,
-                                                        post_timestamp))
-    metadata["post-timestamp"] = post_timestamp
+      raise RuntimeError(
+          "Downgrade detected based on timestamp check: pre: %s, post: %s. "
+          "Need to specify --override_timestamp OR --downgrade to allow "
+          "building the incremental." % (pre_timestamp, post_timestamp))
 
 
 def GetPackageMetadata(target_info, source_info=None):
@@ -922,7 +919,7 @@
 
   It generates a dict() that contains the info to be written into an OTA
   package (META-INF/com/android/metadata). It also handles the detection of
-  downgrade / timestamp override / data wipe based on the global options.
+  downgrade / data wipe based on the global options.
 
   Args:
     target_info: The BuildInfo instance that holds the target build info.
@@ -963,11 +960,12 @@
   else:
     metadata['pre-device'] = target_info.device
 
-  # Detect downgrades, or fill in the post-timestamp.
+  # Use the actual post-timestamp, even for a downgrade case.
+  metadata['post-timestamp'] = target_info.GetBuildProp('ro.build.date.utc')
+
+  # Detect downgrades and set up downgrade flags accordingly.
   if is_incremental:
     HandleDowngradeMetadata(metadata, target_info, source_info)
-  else:
-    metadata['post-timestamp'] = target_info.GetBuildProp('ro.build.date.utc')
 
   return metadata
 
@@ -1791,7 +1789,7 @@
       OPTIONS.downgrade = True
       OPTIONS.wipe_user_data = True
     elif o == "--override_timestamp":
-      OPTIONS.timestamp = True
+      OPTIONS.downgrade = True
     elif o in ("-o", "--oem_settings"):
       OPTIONS.oem_source = a.split(',')
     elif o == "--oem_no_mount":
@@ -1869,19 +1867,12 @@
     sys.exit(1)
 
   if OPTIONS.downgrade:
-    # Sanity check to enforce a data wipe.
-    if not OPTIONS.wipe_user_data:
-      raise ValueError("Cannot downgrade without a data wipe")
-
     # We should only allow downgrading incrementals (as opposed to full).
     # Otherwise the device may go back from arbitrary build with this full
     # OTA package.
     if OPTIONS.incremental_source is None:
       raise ValueError("Cannot generate downgradable full OTAs")
 
-  assert not (OPTIONS.downgrade and OPTIONS.timestamp), \
-      "Cannot have --downgrade AND --override_timestamp both"
-
   # Load the build info dicts from the zip directly or the extracted input
   # directory. We don't need to unzip the entire target-files zips, because they
   # won't be needed for A/B OTAs (brillo_update_payload does that on its own).
diff --git a/tools/releasetools/test_ota_from_target_files.py b/tools/releasetools/test_ota_from_target_files.py
index d7cace8..262e701 100644
--- a/tools/releasetools/test_ota_from_target_files.py
+++ b/tools/releasetools/test_ota_from_target_files.py
@@ -524,31 +524,7 @@
             'post-build-incremental' : 'build-version-incremental-target',
             'post-sdk-level' : '27',
             'post-security-patch-level' : '2017-12-01',
-            'pre-device' : 'product-device',
-            'pre-build' : 'build-fingerprint-source',
-            'pre-build-incremental' : 'build-version-incremental-source',
-        },
-        metadata)
-
-  def test_GetPackageMetadata_overrideTimestamp(self):
-    target_info_dict = copy.deepcopy(self.TEST_TARGET_INFO_DICT)
-    source_info_dict = copy.deepcopy(self.TEST_SOURCE_INFO_DICT)
-    self._test_GetPackageMetadata_swapBuildTimestamps(
-        target_info_dict, source_info_dict)
-
-    target_info = BuildInfo(target_info_dict, None)
-    source_info = BuildInfo(source_info_dict, None)
-    common.OPTIONS.incremental_source = ''
-    common.OPTIONS.timestamp = True
-    metadata = GetPackageMetadata(target_info, source_info)
-    self.assertDictEqual(
-        {
-            'ota-type' : 'BLOCK',
-            'post-build' : 'build-fingerprint-target',
-            'post-build-incremental' : 'build-version-incremental-target',
-            'post-sdk-level' : '27',
-            'post-security-patch-level' : '2017-12-01',
-            'post-timestamp' : '1500000001',
+            'post-timestamp' : '1400000000',
             'pre-device' : 'product-device',
             'pre-build' : 'build-fingerprint-source',
             'pre-build-incremental' : 'build-version-incremental-source',
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 68070ba..8c9e07c 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -81,6 +81,12 @@
         logging.warning('Skipping %s that has incomplete block list', entry)
         continue
 
+      # TODO(b/79951650): Handle files with non-monotonic ranges.
+      if not ranges.monotonic:
+        logging.warning(
+            'Skipping %s that has non-monotonic ranges: %s', entry, ranges)
+        continue
+
       blocks_sha1 = image.RangeSha1(ranges)
 
       # The filename under unpacked directory, such as SYSTEM/bin/sh.