diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index 6909275..5f16363 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -159,6 +159,10 @@
 LOCAL_CERTIFICATE_LINEAGE:=
 LOCAL_LDFLAGS:=
 LOCAL_LDLIBS:=
+LOCAL_LICENSE_CONDITIONS:=
+LOCAL_LICENSE_KINDS:=
+LOCAL_LICENSE_INSTALL_MAP:=
+LOCAL_LICENSE_PACKAGE_NAME:=
 LOCAL_LOGTAGS_FILES:=
 LOCAL_MANIFEST_FILE:=
 LOCAL_MANIFEST_INSTRUMENTATION_FOR:=
@@ -170,6 +174,7 @@
 LOCAL_MODULE_HOST_ARCH_WARN:=
 LOCAL_MODULE_HOST_CROSS_ARCH:=
 LOCAL_MODULE_HOST_OS:=
+LOCAL_MODULE_IS_CONTAINER:=
 LOCAL_MODULE_OWNER:=
 LOCAL_MODULE_PATH:=
 LOCAL_MODULE_RELATIVE_PATH :=
diff --git a/core/definitions.mk b/core/definitions.mk
index 0230340..4300efe 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -525,6 +525,96 @@
 endef
 
 ###########################################################
+## Sometimes a notice dependency will reference an unadorned
+## module name that only appears in ALL_MODULES adorned with
+## an ARCH suffix or a `host_cross_` prefix.
+##
+## After all of the modules are processed in base_rules.mk,
+## replace all such dependencies with every matching adorned
+## module name.
+###########################################################
+
+define fix-notice-deps
+$(strip \
+  $(eval _all_module_refs := \
+    $(sort \
+      $(foreach m,$(sort $(ALL_MODULES)), \
+        $(ALL_MODULES.$(m).NOTICE_DEPS) \
+      ) \
+    ) \
+  ) \
+  $(foreach m, $(_all_module_refs), \
+    $(eval _lookup.$(m) := \
+      $(sort \
+        $(if $(strip $(ALL_MODULES.$(m).PATH)), \
+          $(m), \
+          $(filter $(m)_32 $(m)_64 host_cross_$(m) host_cross_$(m)_32 host_cross_$(m)_64, $(ALL_MODULES)) \
+        ) \
+      ) \
+    ) \
+  ) \
+  $(foreach m, $(ALL_MODULES), \
+    $(eval ALL_MODULES.$(m).NOTICE_DEPS := \
+      $(sort \
+         $(foreach d,$(ALL_MODULES.$(m).NOTICE_DEPS), \
+           $(_lookup.$(d)) \
+        ) \
+      ) \
+    ) \
+  ) \
+)
+endef
+
+###########################################################
+## Target directory for license metadata files.
+###########################################################
+define license-metadata-dir
+$(call generated-sources-dir-for,META,lic,)
+endef
+
+###########################################################
+## License metadata build rule for my_register_name $1
+###########################################################
+define license-metadata-rule
+$(strip $(eval _dir := $(call license-metadata-dir)))
+$(strip $(eval _deps := $(sort $(filter-out $(_dir)/$(1).meta_lic,$(foreach d,$(ALL_MODULES.$(1).NOTICE_DEPS), $(_dir)/$(d).meta_lic)))))
+$(foreach b,$(sort $(ALL_MODULES.$(1).BUILT) $(ALL_MODULES.$(1).INSTALLED)),
+$(_dir)/$(b).meta_module ::
+	mkdir -p $$(dir $$@)
+	echo $(_dir)/$(1).meta_lic >> $$@
+	sort -u $$@ -o $$@
+
+)
+$(_dir)/$(1).meta_lic: PRIVATE_KINDS := $(sort $(ALL_MODULES.$(1).LICENSE_KINDS))
+$(_dir)/$(1).meta_lic: PRIVATE_CONDITIONS := $(sort $(ALL_MODULES.$(1).LICENSE_CONDITIONS))
+$(_dir)/$(1).meta_lic: PRIVATE_NOTICES := $(sort $(ALL_MODULES.$(1).NOTICES))
+$(_dir)/$(1).meta_lic: PRIVATE_NOTICE_DEPS := $(_deps)
+$(_dir)/$(1).meta_lic: PRIVATE_TARGETS := $(sort $(ALL_MODULES.$(1).BUILT) $(ALL_MODULES.$(1).INSTALLED))
+$(_dir)/$(1).meta_lic: PRIVATE_IS_CONTAINER := $(sort $(ALL_MODULES.$(1).IS_CONTAINER))
+$(_dir)/$(1).meta_lic: PRIVATE_PACKAGE_NAME := $(ALL_MODULES.$(1).LICENSE_PACKAGE_NAME)
+$(_dir)/$(1).meta_lic: PRIVATE_INSTALL_MAP := $(sort $(ALL_MODULES.$(1).LICENSE_INSTALL_MAP))
+$(_dir)/$(1).meta_lic : $(_deps) $(ALL_MODULES.$(1).NOTICES) $(foreach b,$(sort $(ALL_MODULES.$(1).BUILT) $(ALL_MODULES.$(1).INSTALLED)), $(_dir)/$(b).meta_module) build/make/tools/build-license-metadata.sh
+	rm -f $$@
+	mkdir -p $$(dir $$@)
+	build/make/tools/build-license-metadata.sh -k $$(PRIVATE_KINDS) -c $$(PRIVATE_CONDITIONS) -n $$(PRIVATE_NOTICES) -d $$(PRIVATE_NOTICE_DEPS) -m $$(PRIVATE_INSTALL_MAP) -t $$(PRIVATE_TARGETS) $$(if $$(filter-out false,$$(PRIVATE_IS_CONTAINER)),-is_container) -p $$(PRIVATE_PACKAGE_NAME) -o $$@
+
+$(1) : $(_dir)/$(1).meta_lic
+
+$(if $(ALL_MODULES.$(1).INSTALLED_NOTICE_FILE),$(ALL_MODULES.$(1).INSTALLED_NOTICE_FILE) : $(_dir)/$(1).meta_lic)
+
+.PHONY: $(1).meta_lic
+$(1).meta_lic : $(_dir)/$(1).meta_lic
+
+endef
+
+###########################################################
+## Declares a license metadata build rule for ALL_MODULES
+###########################################################
+define build-license-metadata
+$(foreach m,$(ALL_MODULES),$(eval $(call license-metadata-rule,$(m))))
+endef
+
+###########################################################
 ## Returns correct _idfPrefix from the list:
 ##   { HOST, HOST_CROSS, TARGET }
 ###########################################################
diff --git a/core/main.mk b/core/main.mk
index 8857b5d..fb13093 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1404,6 +1404,17 @@
 ALL_DEFAULT_INSTALLED_MODULES :=
 
 
+# Some notice deps refer to module names without prefix or arch suffix where
+# only the variants with them get built.
+# fix-notice-deps replaces those unadorned module names with every built variant.
+$(call fix-notice-deps)
+
+# Create a license metadata rule per module. Could happen in base_rules.mk or
+# notice_files.mk; except, it has to happen after fix-notice-deps to avoid
+# missing dependency errors.
+$(call build-license-metadata)
+
+
 # These are additional goals that we build, in order to make sure that there
 # is as little code as possible in the tree that doesn't build.
 modules_to_check := $(foreach m,$(ALL_MODULES),$(ALL_MODULES.$(m).CHECKED))
diff --git a/core/notice_files.mk b/core/notice_files.mk
index 0430007..89f822b 100644
--- a/core/notice_files.mk
+++ b/core/notice_files.mk
@@ -9,6 +9,32 @@
 notice_file:=$(strip $(wildcard $(LOCAL_PATH)/LICENSE $(LOCAL_PATH)/LICENCE $(LOCAL_PATH)/NOTICE))
 endif
 
+ifneq (,$(strip $(LOCAL_LICENSE_PACKAGE_NAME)))
+license_package_name:=$(strip $(LOCAL_LICENSE_PACKAGE_NAME))
+else ifdef my_register_name
+license_package_name:=$(my_register_name)
+else
+license_package_name:=$(strip $(LOCAL_MODULE))
+endif
+
+ifneq (,$(strip $(LOCAL_LICENSE_INSTALL_MAP)))
+install_map:=$(strip $(LOCAL_LICENSE_INSTALL_MAP))
+else
+install_map:=
+endif
+
+ifneq (,$(strip $(LOCAL_LICENSE_KINDS)))
+license_kinds:=$(strip $(LOCAL_LICENSE_KINDS))
+else
+license_kinds:=legacy_by_exception_only
+endif
+
+ifneq (,$(strip $(LOCAL_LICENSE_CONDITIONS)))
+license_conditions:=$(strip $(LOCAL_LICENSE_CONDITIONS))
+else
+license_conditions:=by_exception_only
+endif
+
 ifeq ($(LOCAL_MODULE_CLASS),GYP)
   # We ignore NOTICE files for modules of type GYP.
   notice_file :=
@@ -40,10 +66,64 @@
 
 installed_notice_file :=
 
+is_container:=$(strip $(LOCAL_MODULE_IS_CONTAINER))
+ifeq (,$(is_container))
+ifneq (,$(strip $(filter %.zip %.tar %.tgz %.tar.gz %.apk %.img %.srcszip %.apex, $(LOCAL_BUILT_MODULE))))
+is_container:=true
+else
+is_container:=false
+endif
+else ifneq (,$(strip $(filter-out true false,$(is_container))))
+$(error Unrecognized value '$(is_container)' for LOCAL_MODULE_IS_CONTAINER)
+endif
+
+ifeq (true,$(is_container))
+# Include shared libraries' notices for "container" types, but not for binaries etc.
+notice_deps := \
+    $(sort \
+        $(LOCAL_REQUIRED_MODULES) \
+        $(LOCAL_STATIC_LIBRARIES) \
+        $(LOCAL_WHOLE_STATIC_LIBRARIES) \
+        $(LOCAL_SHARED_LIBRARIES) \
+        $(LOCAL_DYLIB_LIBRARIES) \
+        $(LOCAL_RLIB_LIBRARIES) \
+        $(LOCAL_PROC_MACRO_LIBRARIES) \
+        $(LOCAL_HEADER_LIBRARIES) \
+        $(LOCAL_STATIC_JAVA_LIBRARIES) \
+        $(LOCAL_JAVA_LIBRARIES) \
+        $(LOCAL_JNI_SHARED_LIBRARIES) \
+    )
+else
+notice_deps := \
+    $(sort \
+        $(LOCAL_REQUIRED_MODULES) \
+        $(LOCAL_STATIC_LIBRARIES) \
+        $(LOCAL_WHOLE_STATIC_LIBRARIES) \
+        $(LOCAL_RLIB_LIBRARIES) \
+        $(LOCAL_PROC_MACRO_LIBRARIES) \
+        $(LOCAL_HEADER_LIBRARIES) \
+        $(LOCAL_STATIC_JAVA_LIBRARIES) \
+    )
+endif
+ifeq ($(LOCAL_IS_HOST_MODULE),true)
+notice_deps := $(sort $(notice_deps) $(LOCAL_HOST_REQUIRED_MODULES))
+else
+notice_deps := $(sort $(notice_deps) $(LOCAL_TARGET_REQUIRED_MODULES))
+endif
+
+ifdef my_register_name
+ALL_MODULES.$(my_register_name).LICENSE_PACKAGE_NAME := $(strip $(license_package_name))
+ALL_MODULES.$(my_register_name).LICENSE_KINDS := $(sort $(ALL_MODULES.$(my_register_name).LICENSE_KINDS) $(license_kinds))
+ALL_MODULES.$(my_register_name).LICENSE_CONDITIONS := $(sort $(ALL_MODULES.$(my_register_name).LICENSE_CONDITIONS) $(license_conditions))
+ALL_MODULES.$(my_register_name).LICENSE_INSTALL_MAP := $(sort $(ALL_MODULES.$(my_register_name).LICENSE_INSTALL_MAP) $(install_map))
+ALL_MODULES.$(my_register_name).NOTICE_DEPS := $(sort $(ALL_MODULES.$(my_register_name).NOTICE_DEPS) $(notice_deps))
+ALL_MODULES.$(my_register_name).IS_CONTAINER := $(sort $(ALL_MODULES.$(my_register_name).IS_CONTAINER) $(is_container))
+endif
+
 ifdef notice_file
 
 ifdef my_register_name
-ALL_MODULES.$(my_register_name).NOTICES := $(ALL_MODULES.$(my_register_name).NOTICES) $(notice_file)
+ALL_MODULES.$(my_register_name).NOTICES := $(sort $(ALL_MODULES.$(my_register_name).NOTICES) $(notice_file))
 endif
 
 # This relies on the name of the directory in PRODUCT_OUT matching where
@@ -87,8 +167,6 @@
       # Soong produces uninstallable *.sdk shared libraries for embedding in APKs.
       module_installed_filename := \
           $(patsubst $(PRODUCT_OUT)/%,%,$($(LOCAL_2ND_ARCH_VAR_PREFIX)$(my_prefix)OUT_SHARED_LIBRARIES))/$(notdir $(LOCAL_BUILT_MODULE))
-    else
-      $(error Cannot determine where to install NOTICE file for $(LOCAL_MODULE))
     endif # JAVA_LIBRARIES
   endif # STATIC_LIBRARIES
 endif
@@ -101,12 +179,17 @@
 
 installed_notice_file := $($(my_prefix)OUT_NOTICE_FILES)/src/$(module_installed_filename).txt
 
+ifdef my_register_name
+ALL_MODULES.$(my_register_name).INSTALLED_NOTICE_FILE := $(installed_notice_file)
+endif
+
 $(installed_notice_file): PRIVATE_INSTALLED_MODULE := $(module_installed_filename)
+$(installed_notice_file) : PRIVATE_NOTICES := $(notice_file)
 
 $(installed_notice_file): $(notice_file)
 	@echo Notice file: $< -- $@
 	$(hide) mkdir -p $(dir $@)
-	$(hide) awk 'FNR==1 && NR > 1 {print "\n"} {print}' $^ > $@
+	$(hide) awk 'FNR==1 && NR > 1 {print "\n"} {print}' $(PRIVATE_NOTICES) > $@
 
 ifdef LOCAL_INSTALLED_MODULE
 # Make LOCAL_INSTALLED_MODULE depend on NOTICE files if they exist
diff --git a/core/soong_config.mk b/core/soong_config.mk
index ae494c4..5b2d1dc 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -129,6 +129,7 @@
 $(call add_json_str,  ProductVndkVersion,                $(PRODUCT_PRODUCT_VNDK_VERSION))
 $(call add_json_list, ExtraVndkVersions,                 $(PRODUCT_EXTRA_VNDK_VERSIONS))
 $(call add_json_list, DeviceSystemSdkVersions,           $(BOARD_SYSTEMSDK_VERSIONS))
+$(call add_json_str,  RecoverySnapshotVersion,           $(RECOVERY_SNAPSHOT_VERSION))
 $(call add_json_list, Platform_systemsdk_versions,       $(PLATFORM_SYSTEMSDK_VERSIONS))
 $(call add_json_bool, Malloc_not_svelte,                 $(call invert_bool,$(filter true,$(MALLOC_SVELTE))))
 $(call add_json_bool, Malloc_zero_contents,              $(call invert_bool,$(filter false,$(MALLOC_ZERO_CONTENTS))))
@@ -170,6 +171,7 @@
 
 $(call add_json_list, PgoAdditionalProfileDirs,          $(PGO_ADDITIONAL_PROFILE_DIRS))
 
+$(call add_json_list, BoardReqdMaskPolicy,               $(BOARD_REQD_MASK_POLICY))
 $(call add_json_list, BoardVendorSepolicyDirs,           $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_SEPOLICY_DIRS))
 $(call add_json_list, BoardOdmSepolicyDirs,              $(BOARD_ODM_SEPOLICY_DIRS))
 $(call add_json_list, BoardVendorDlkmSepolicyDirs,       $(BOARD_VENDOR_DLKM_SEPOLICY_DIRS))
@@ -178,8 +180,10 @@
 $(call add_json_list, SystemExtPublicSepolicyDirs,       $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS) $(BOARD_PLAT_PUBLIC_SEPOLICY_DIR))
 $(call add_json_list, SystemExtPrivateSepolicyDirs,      $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS) $(BOARD_PLAT_PRIVATE_SEPOLICY_DIR))
 $(call add_json_list, BoardSepolicyM4Defs,               $(BOARD_SEPOLICY_M4DEFS))
+$(call add_json_str,  BoardSepolicyVers,                 $(BOARD_SEPOLICY_VERS))
 
 $(call add_json_bool, Flatten_apex,                      $(filter true,$(TARGET_FLATTEN_APEX)))
+$(call add_json_bool, ForceApexSymlinkOptimization,      $(filter true,$(TARGET_FORCE_APEX_SYMLINK_OPTIMIZATION)))
 
 $(call add_json_str,  DexpreoptGlobalConfig,             $(DEX_PREOPT_CONFIG))
 
diff --git a/core/tasks/recovery_snapshot.mk b/core/tasks/recovery_snapshot.mk
index fea0bb9..525273b 100644
--- a/core/tasks/recovery_snapshot.mk
+++ b/core/tasks/recovery_snapshot.mk
@@ -14,21 +14,21 @@
 
 current_makefile := $(lastword $(MAKEFILE_LIST))
 
-# BOARD_VNDK_VERSION must be set to 'current' in order to generate a recovery snapshot.
-ifeq ($(BOARD_VNDK_VERSION),current)
+# RECOVERY_SNAPSHOT_VERSION must be set to 'current' in order to generate a recovery snapshot.
+ifeq ($(RECOVERY_SNAPSHOT_VERSION),current)
 
 .PHONY: recovery-snapshot
 recovery-snapshot: $(SOONG_RECOVERY_SNAPSHOT_ZIP)
 
 $(call dist-for-goals, recovery-snapshot, $(SOONG_RECOVERY_SNAPSHOT_ZIP))
 
-else # BOARD_VNDK_VERSION is NOT set to 'current'
+else # RECOVERY_SNAPSHOT_VERSION is NOT set to 'current'
 
 .PHONY: recovery-snapshot
 recovery-snapshot: PRIVATE_MAKEFILE := $(current_makefile)
 recovery-snapshot:
 	$(call echo-error,$(PRIVATE_MAKEFILE),\
-		"CANNOT generate Recovery snapshot. BOARD_VNDK_VERSION must be set to 'current'.")
+		"CANNOT generate Recovery snapshot. RECOVERY_SNAPSHOT_VERSION must be set to 'current'.")
 	exit 1
 
-endif # BOARD_VNDK_VERSION
+endif # RECOVERY_SNAPSHOT_VERSION
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 22eb1e1..fe90165 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -240,7 +240,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2020-12-05
+      PLATFORM_SECURITY_PATCH := 2021-01-05
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index 414e032..30c033d 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -61,6 +61,12 @@
 BOARD_KERNEL-5.4-GZ-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 47185920
 BOARD_KERNEL-5.4-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
 BOARD_KERNEL-5.4-LZ4-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 53477376
+BOARD_KERNEL-5.10_BOOTIMAGE_PARTITION_SIZE := 67108864
+BOARD_KERNEL-5.10-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 67108864
+BOARD_KERNEL-5.10-GZ_BOOTIMAGE_PARTITION_SIZE := 47185920
+BOARD_KERNEL-5.10-GZ-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 47185920
+BOARD_KERNEL-5.10-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
+BOARD_KERNEL-5.10-LZ4-ALLSYMS_BOOTIMAGE_PARTITION_SIZE := 53477376
 BOARD_KERNEL-MAINLINE_BOOTIMAGE_PARTITION_SIZE := 67108864
 BOARD_KERNEL-MAINLINE-GZ_BOOTIMAGE_PARTITION_SIZE := 47185920
 BOARD_KERNEL-MAINLINE-LZ4_BOOTIMAGE_PARTITION_SIZE := 53477376
@@ -71,17 +77,27 @@
 BOARD_BOOT_HEADER_VERSION := 3
 BOARD_MKBOOTIMG_ARGS += --header_version $(BOARD_BOOT_HEADER_VERSION)
 
-BOARD_KERNEL_BINARIES := kernel-4.19-gz kernel-5.4 kernel-5.4-gz kernel-5.4-lz4 \
-    kernel-mainline kernel-mainline-gz kernel-mainline-lz4
+BOARD_KERNEL_BINARIES := \
+    kernel-4.19-gz \
+    kernel-5.4 kernel-5.4-gz kernel-5.4-lz4 \
+    kernel-5.10 kernel-5.10-gz kernel-5.10-lz4 \
+    kernel-mainline kernel-mainline-gz kernel-mainline-lz4 \
+
 ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
-BOARD_KERNEL_BINARIES += kernel-5.4-allsyms kernel-5.4-gz-allsyms kernel-5.4-lz4-allsyms
+BOARD_KERNEL_BINARIES += \
+    kernel-5.4-allsyms kernel-5.4-gz-allsyms kernel-5.4-lz4-allsyms \
+    kernel-5.10-allsyms kernel-5.10-gz-allsyms kernel-5.10-lz4-allsyms \
+
 endif
 
 # Boot image
 BOARD_USES_RECOVERY_AS_BOOT :=
 TARGET_NO_KERNEL := false
 BOARD_USES_GENERIC_KERNEL_IMAGE := true
-BOARD_KERNEL_MODULE_INTERFACE_VERSIONS := 5.4-android12-0
+BOARD_KERNEL_MODULE_INTERFACE_VERSIONS := \
+    5.4-android12-0 \
+    5.10-android12-0 \
+
 # Copy boot image in $OUT to target files. This is defined for targets where
 # the installed GKI APEXes are built from source.
 BOARD_COPY_BOOT_IMAGE_TO_TARGET_FILES := true
diff --git a/target/board/generic_arm64/device.mk b/target/board/generic_arm64/device.mk
index e64014b..37c0f25 100644
--- a/target/board/generic_arm64/device.mk
+++ b/target/board/generic_arm64/device.mk
@@ -19,6 +19,9 @@
     kernel/prebuilts/5.4/arm64/kernel-5.4:kernel-5.4 \
     kernel/prebuilts/5.4/arm64/kernel-5.4-gz:kernel-5.4-gz \
     kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4 \
+    kernel/prebuilts/5.10/arm64/kernel-5.10:kernel-5.10 \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-gz:kernel-5.10-gz \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-lz4:kernel-5.10-lz4 \
     kernel/prebuilts/mainline/arm64/kernel-mainline-allsyms:kernel-mainline \
     kernel/prebuilts/mainline/arm64/kernel-mainline-gz-allsyms:kernel-mainline-gz \
     kernel/prebuilts/mainline/arm64/kernel-mainline-lz4-allsyms:kernel-mainline-lz4
@@ -27,7 +30,11 @@
 PRODUCT_COPY_FILES += \
     kernel/prebuilts/5.4/arm64/kernel-5.4:kernel-5.4-allsyms \
     kernel/prebuilts/5.4/arm64/kernel-5.4-gz:kernel-5.4-gz-allsyms \
-    kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4-allsyms
+    kernel/prebuilts/5.4/arm64/kernel-5.4-lz4:kernel-5.4-lz4-allsyms \
+    kernel/prebuilts/5.10/arm64/kernel-5.10:kernel-5.10-allsyms \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-gz:kernel-5.10-gz-allsyms \
+    kernel/prebuilts/5.10/arm64/kernel-5.10-lz4:kernel-5.10-lz4-allsyms \
+
 endif
 
 PRODUCT_BUILD_VENDOR_BOOT_IMAGE := false
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index 2205146..2a6981b 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -147,3 +147,70 @@
 VNDK-private: libcompiler_rt.so
 VNDK-private: libft2.so
 VNDK-private: libgui.so
+VNDK-product: android.hardware.audio.common@2.0.so
+VNDK-product: android.hardware.configstore@1.0.so
+VNDK-product: android.hardware.configstore@1.1.so
+VNDK-product: android.hardware.graphics.allocator@2.0.so
+VNDK-product: android.hardware.graphics.allocator@3.0.so
+VNDK-product: android.hardware.graphics.allocator@4.0.so
+VNDK-product: android.hardware.graphics.bufferqueue@1.0.so
+VNDK-product: android.hardware.graphics.bufferqueue@2.0.so
+VNDK-product: android.hardware.graphics.common@1.0.so
+VNDK-product: android.hardware.graphics.common@1.1.so
+VNDK-product: android.hardware.graphics.common@1.2.so
+VNDK-product: android.hardware.graphics.mapper@2.0.so
+VNDK-product: android.hardware.graphics.mapper@2.1.so
+VNDK-product: android.hardware.graphics.mapper@3.0.so
+VNDK-product: android.hardware.graphics.mapper@4.0.so
+VNDK-product: android.hardware.media.bufferpool@2.0.so
+VNDK-product: android.hardware.media.omx@1.0.so
+VNDK-product: android.hardware.media@1.0.so
+VNDK-product: android.hardware.memtrack@1.0.so
+VNDK-product: android.hardware.renderscript@1.0.so
+VNDK-product: android.hardware.soundtrigger@2.0.so
+VNDK-product: android.hidl.memory.token@1.0.so
+VNDK-product: android.hidl.memory@1.0.so
+VNDK-product: android.hidl.safe_union@1.0.so
+VNDK-product: android.hidl.token@1.0.so
+VNDK-product: android.system.suspend@1.0.so
+VNDK-product: libaudioutils.so
+VNDK-product: libbacktrace.so
+VNDK-product: libbase.so
+VNDK-product: libc++.so
+VNDK-product: libcamera_metadata.so
+VNDK-product: libcap.so
+VNDK-product: libcompiler_rt.so
+VNDK-product: libcrypto.so
+VNDK-product: libcurl.so
+VNDK-product: libcutils.so
+VNDK-product: libevent.so
+VNDK-product: libexpat.so
+VNDK-product: libfmq.so
+VNDK-product: libhidlbase.so
+VNDK-product: libhidlmemory.so
+VNDK-product: libion.so
+VNDK-product: libjpeg.so
+VNDK-product: libjsoncpp.so
+VNDK-product: libldacBT_abr.so
+VNDK-product: libldacBT_enc.so
+VNDK-product: liblz4.so
+VNDK-product: liblzma.so
+VNDK-product: libminijail.so
+VNDK-product: libnl.so
+VNDK-product: libpcre2.so
+VNDK-product: libpiex.so
+VNDK-product: libpng.so
+VNDK-product: libprocessgroup.so
+VNDK-product: libprocinfo.so
+VNDK-product: libspeexresampler.so
+VNDK-product: libssl.so
+VNDK-product: libtinyalsa.so
+VNDK-product: libtinyxml2.so
+VNDK-product: libunwindstack.so
+VNDK-product: libutils.so
+VNDK-product: libutilscallstack.so
+VNDK-product: libwifi-system-iface.so
+VNDK-product: libxml2.so
+VNDK-product: libyuv.so
+VNDK-product: libz.so
+VNDK-product: libziparchive.so
diff --git a/tools/build-license-metadata.sh b/tools/build-license-metadata.sh
new file mode 100755
index 0000000..3bad358
--- /dev/null
+++ b/tools/build-license-metadata.sh
@@ -0,0 +1,312 @@
+#!/bin/sh
+
+set -u
+
+ME=$(basename $0)
+
+USAGE="Usage: ${ME} {options}
+
+Builds a license metadata specification and outputs it to stdout or {outfile}.
+
+The available options are:
+
+-k kind...              license kinds
+-c condition...         license conditions
+-p package...           license package name
+-n notice...            license notice file
+-d dependency...        license metadata file dependency
+-t target...            targets
+-m target:installed...  map dependent targets to their installed names
+-is_container           preserved dependent target name when given
+-o outfile              output file
+"
+
+# Global flag variables
+license_kinds=
+license_conditions=
+license_package_name=
+license_notice=
+license_deps=
+targets=
+installmap=
+is_container=false
+ofile=
+
+# Global variables
+depfiles=" "
+effective_conditions=
+
+
+# Exits with a message.
+#
+# When the exit status is 2, assumes a usage error and outputs the usage message
+# to stderr before outputting the specific error message to stderr.
+#
+# Parameters:
+#   Optional numeric exit status (defaults to 2, i.e. a usage error.)
+#   Remaining args treated as an error message sent to stderr.
+die() {
+  lstatus=2
+  case "${1:-}" in *[^0-9]*) ;; *) lstatus="$1"; shift ;; esac
+  case "${lstatus}" in 2) echo "${USAGE}" >&2; echo >&2 ;; esac
+  if [ -n "$*" ]; then
+    echo -e "$*\n" >&2
+  fi
+  exit $lstatus
+}
+
+
+# Sets the flag variables based on the command-line.
+#
+# invoke with: process_args "$@"
+process_args() {
+  lcurr_flag=
+  while [ "$#" -gt '0' ]; do
+    case "${1}" in
+      -h)
+        echo "${USAGE}"
+        exit 0
+        ;;
+      -k)
+        lcurr_flag=kind
+        ;;
+      -c)
+        lcurr_flag=condition
+        ;;
+      -p)
+        lcurr_flag=package
+        ;;
+      -n)
+        lcurr_flag=notice
+        ;;
+      -d)
+        lcurr_flag=dependency
+        ;;
+      -t)
+        lcurr_flag=target
+        ;;
+      -m)
+        lcurr_flag=installmap
+        ;;
+      -o)
+        lcurr_flag=ofile
+        ;;
+      -is_container)
+        lcurr_flag=
+        is_container=true
+        ;;
+      -*)
+        die "Unknown flag: \"${1}\""
+        ;;
+      *)
+        case "${lcurr_flag}" in
+          kind)
+            license_kinds="${license_kinds}${license_kinds:+ }${1}"
+            ;;
+          condition)
+            license_conditions="${license_conditions}${license_conditions:+ }${1}"
+            ;;
+          package)
+            license_package_name="${license_package_name}${license_package_name:+ }${1}"
+            ;;
+          notice)
+            license_notice="${license_notice}${license_notice:+ }${1}"
+            ;;
+          dependency)
+            license_deps="${license_deps}${license_deps:+ }${1}"
+            ;;
+          target)
+            targets="${targets}${targets:+ }${1}"
+            ;;
+          installmap)
+            installmap="${installmap}${installmap:+ }${1}"
+            ;;
+          ofile)
+            if [ -n "${ofile}" ]; then
+              die "Output file -o appears twice as \"${ofile}\" and \"${1}\""
+            fi
+            ofile="${1}"
+            ;;
+          *)
+            die "Must precede argument \"${1}\" with type flag."
+            ;;
+        esac
+        ;;
+    esac
+    shift
+  done
+}
+
+# Reads a license metadata file from stdin, and outputs the named dependencies.
+#
+# No parameters.
+extract_deps() {
+  awk '$1 == "dep_name:" { sub(/^"/, "", $2); sub(/"$/, "", $2); print $2; }'
+}
+
+# Populates the depfiles variable identifying dependency files.
+#
+# Starting with the dependencies enumerated in license_deps, calculates the
+# transitive closure of all dependencies.
+#
+# Dependency names ending in .meta_module indirectly reference license
+# metadata with 1 license metadata filename per line.
+#
+# No parameters; no output.
+read_deps() {
+  lnewdeps=
+  for d in ${license_deps}; do
+    case "${d}" in
+      *.meta_module)
+        lnewdeps="${lnewdeps}${lnewdeps:+ }"$(cat "${d}") ;;
+      *)
+        lnewdeps="${lnewdeps}${lnewdeps:+ }${d}" ;;
+    esac
+  done
+  lnewdeps=$(echo "${lnewdeps}" | tr ' ' '\n' | sort -u)
+  lalldeps=
+  ldeps=
+  lmod=
+  ldep=
+  while [ "${#lnewdeps}" -gt '0' ]; do
+    ldeps="${lnewdeps}"
+    lnewdeps=
+    for ldep in ${ldeps}; do
+      depfiles="${depfiles}${ldep} "
+      lalldeps="${lalldeps}${lalldeps:+ }"$(cat "${ldep}" | extract_deps)
+    done
+    lalldeps=$(for d in ${lalldeps}; do echo "${d}"; done | sort -u)
+    for d in ${lalldeps}; do
+      ldeps="${d}"
+      case "${d}" in *.meta_module) ldeps=$(cat "${d}") ;; esac
+      for lmod in ${ldeps}; do
+        if ! expr "${depfiles}" : ".* ${lmod} .*" >/dev/null 2>&1; then
+          lnewdeps="${lnewdeps}${lnewdeps:+ }${lmod}"
+        fi
+      done
+    done
+    lalldeps=
+  done
+}
+
+# Returns the effective license conditions for the current license metadata.
+#
+# If a module is restricted or links in a restricted module, the effective
+# license has a restricted condition.
+calculate_effective_conditions() {
+  lconditions="${license_conditions}"
+  case "${license_conditions}" in
+    *restricted*) : do nothing ;;
+    *)
+       for d in ${depfiles}; do
+         if cat "${d}" | egrep -q 'effective_condition\s*:.*restricted' ; then
+           lconditions="${lconditions}${lconditions:+ }restricted"
+         fi
+       done
+     ;;
+  esac
+  echo "${lconditions}"
+}
+
+
+process_args "$@"
+
+if [ -n "${ofile}" ]; then
+  # truncate the output file before appending results
+  : >"${ofile}"
+else
+  ofile=/dev/stdout
+fi
+
+# spit out the license metadata file content
+(
+  echo 'license_package_name: "'${license_package_name}'"'
+  for kind in ${license_kinds}; do
+    echo 'license_kind: "'${kind}'"'
+  done
+  for condition in ${license_conditions}; do
+    echo 'license_condition: "'${condition}'"'
+  done
+  for f in ${license_notice}; do
+    echo 'license_text: "'${f}'"'
+  done
+  echo "is_container: ${is_container}"
+  for t in ${targets}; do
+    echo 'target: "'${t}'"'
+  done
+  for m in ${installmap}; do
+    echo 'install_map: "'${m}'"'
+  done
+) >>"${ofile}"
+read_deps
+effective_conditions=$(calculate_effective_conditions)
+for condition in ${effective_conditions}; do
+  echo 'effective_condition: "'${condition}'"'
+done >>"${ofile}"
+for dep in ${depfiles}; do
+  echo 'dep {'
+  cat "${dep}" | \
+    awk -v name="${dep}" '
+      function strip_type() {
+        $1 = ""
+        sub(/^\s*/, "")
+      }
+      BEGIN {
+        print "  dep_name: " name
+      }
+      $1 == "license_package_name:" {
+        strip_type()
+        print "  dep_package_name: "$0
+      }
+      $1 == "dep_name:" {
+        print "  dep_sub_dep: "$2
+      }
+      $1 == "license_kind:" {
+        print "  dep_license_kind: "$2
+      }
+      $1 == "license_condition:" {
+        print "  dep_license_condition: "$2
+      }
+      $1 == "is_container:" {
+        print "  dep_is_container: "$2
+      }
+      $1 == "license_text:" {
+        strip_type()
+        print "  dep_license_text: "$0
+      }
+      $1 == "target:" {
+        print "  dep_target: "$2
+      }
+      $1 == "install_map:" {
+        print "  dep_install_map: "$2
+      }
+  '
+  # The restricted license kind is contagious to all linked dependencies.
+  dep_conditions=$(echo $(
+      cat "${dep}" | awk '
+        $1 == "effective_condition:" {
+          $1 = ""
+          sub(/^\s*/, "")
+          gsub(/"/, "")
+          print
+        }
+      '
+  ))
+  for condition in ${dep_conditions}; do
+    echo '  dep_effective_condition: "'${condition}'"'
+  done
+  if ! ${is_container}; then
+    case "${dep_conditions}" in
+      *restricted*) : already restricted -- nothing to inherit ;;
+      *)
+        case "${effective_conditions}" in
+          *restricted*)
+            # "contagious" restricted infects everything linked to restricted
+            echo '  dep_effective_condition: "restricted"'
+            ;;
+        esac
+        ;;
+    esac
+  fi
+  echo '}'
+done >>"${ofile}"