Merge changes from topics "framework-wifi-apex", "split-framework-wifi"

* changes:
  Move framework-wifi into the Wifi APEX
  Add framework-wifi to bootclasspath
diff --git a/CleanSpec.mk b/CleanSpec.mk
index 6e7bf62..7aba352 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -505,9 +505,9 @@
 
 # Remove *_OUT_INTERMEDIATE_LIBRARIES
 $(call add-clean-step, rm -rf $(addsuffix /lib,\
-  $(HOST_OUT_INTERMEDIATES) $(2ND_HOST_OUT_INTERMEDIATES) \
-  $(HOST_CROSS_OUT_INTERMEDIATES) $(2ND_HOST_CROSS_OUT_INTERMEDIATES) \
-  $(TARGET_OUT_INTERMEDIATES) $(2ND_TARGET_OUT_INTERMEDIATES)))
+$(HOST_OUT_INTERMEDIATES) $(2ND_HOST_OUT_INTERMEDIATES) \
+$(HOST_CROSS_OUT_INTERMEDIATES) $(2ND_HOST_CROSS_OUT_INTERMEDIATES) \
+$(TARGET_OUT_INTERMEDIATES) $(2ND_TARGET_OUT_INTERMEDIATES)))
 
 # Remove strip.sh intermediates to save space
 $(call add-clean-step, find $(OUT_DIR) \( -name "*.so.debug" -o -name "*.so.dynsyms" -o -name "*.so.funcsyms" -o -name "*.so.keep_symbols" -o -name "*.so.mini_debuginfo.xz" \) -print0 | xargs -0 rm -f)
@@ -716,6 +716,12 @@
 # Remove MediaProvider after moving into APEX
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/priv-app/MediaProvider)
 
+# The core image variant has been renamed to ""
+$(call add-clean-step, find $(SOONG_OUT_DIR)/.intermediates -type d -name "android_*_core*" -print0 | xargs -0 rm -rf)
+
+# Remove 'media' command
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/bin/media)
+
 # ************************************************
 # NEWER CLEAN STEPS MUST BE AT THE END OF THE LIST
 # ************************************************
diff --git a/core/Makefile b/core/Makefile
index 9946d42..5fdca13 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -94,6 +94,8 @@
   $(error duplicate header copies are no longer allowed. For more information about headers, see: https://android.googlesource.com/platform/build/soong/+/master/docs/best_practices.md#headers)
 endif
 
+$(file >$(PRODUCT_OUT)/.copied_headers_list,$(TARGET_OUT_HEADERS) $(ALL_COPIED_HEADERS))
+
 # -----------------------------------------------------------------
 # docs/index.html
 ifeq (,$(TARGET_BUILD_APPS))
@@ -3625,6 +3627,8 @@
 	$(build-vbmetaimage-target)
 
 .PHONY: vbmetaimage-nodeps
+vbmetaimage-nodeps: PRIVATE_AVB_VBMETA_SIGNING_ARGS := \
+    --algorithm $(BOARD_AVB_ALGORITHM) --key $(BOARD_AVB_KEY_PATH)
 vbmetaimage-nodeps:
 	$(build-vbmetaimage-target)
 endif # BUILDING_VBMETA_IMAGE
diff --git a/core/binary.mk b/core/binary.mk
index ae456e3..cf3cfd5 100644
--- a/core/binary.mk
+++ b/core/binary.mk
@@ -109,7 +109,7 @@
     ifeq ($(strip $(my_xom)),true)
       ifeq (arm64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH))
         ifeq ($(my_use_clang_lld),true)
-          my_ldflags += -Wl,-execute-only
+          my_ldflags += -Wl,--execute-only -Wl,-z,separate-code
         endif
       endif
     endif
diff --git a/core/java.mk b/core/java.mk
index 907f2dc..a041321 100644
--- a/core/java.mk
+++ b/core/java.mk
@@ -413,6 +413,7 @@
 legacy_proguard_flags += -printmapping $(proguard_dictionary)
 legacy_proguard_flags += -printconfiguration $(proguard_configuration)
 
+common_proguard_flags :=
 common_proguard_flag_files := $(BUILD_SYSTEM)/proguard.flags
 ifneq ($(LOCAL_INSTRUMENTATION_FOR)$(filter tests,$(LOCAL_MODULE_TAGS)),)
 common_proguard_flags += -dontshrink # don't shrink tests by default
diff --git a/core/main.mk b/core/main.mk
index b2a400c..e4257d1 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1185,9 +1185,10 @@
 # still may create these libraries in /system (b/129006418).
 DISABLE_APEX_LIBS_ABSENCE_CHECK ?=
 
-# Allow APEX libraries under /system/apex, which happens when APEX flattening
-# is enabled.
-APEX_LIBS_ABSENCE_CHECK_EXCLUDE := apex
+# Allow APEX libraries under:
+# /system/apex, which happens when APEX flattening is enabled.
+# /system/system_ext, which happens with GSI
+APEX_LIBS_ABSENCE_CHECK_EXCLUDE := apex system_ext
 
 # Bionic should not be in /system, except for the bootstrap instance.
 APEX_LIBS_ABSENCE_CHECK_EXCLUDE += lib/bootstrap lib64/bootstrap
diff --git a/core/product.mk b/core/product.mk
index 2276db2..c7aac00 100644
--- a/core/product.mk
+++ b/core/product.mk
@@ -381,6 +381,8 @@
 # If set, Java module in product partition cannot use hidden APIs.
 _product_single_value_vars += PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE
 
+_product_single_value_vars += PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES
+
 .KATI_READONLY := _product_single_value_vars _product_list_vars
 _product_var_list :=$= $(_product_single_value_vars) $(_product_list_vars)
 
diff --git a/core/product_config.mk b/core/product_config.mk
index 4fc7bf6..afe91d4 100644
--- a/core/product_config.mk
+++ b/core/product_config.mk
@@ -264,6 +264,13 @@
   endif
 endif
 
+$(foreach pair,$(PRODUCT_UPDATABLE_BOOT_JARS), \
+  $(if $(findstring $(call word-colon,2,$(pair)),$(PRODUCT_BOOT_JARS)),, \
+    $(error Every jar in PRODUCT_UPDATABLE_BOOT_JARS must also be in PRODUCT_BOOT_JARS, \
+      $(call word-colon,2,$(pair)) is not) \
+  ) \
+)
+
 ENFORCE_SYSTEM_CERTIFICATE := $(PRODUCT_ENFORCE_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT)
 ENFORCE_SYSTEM_CERTIFICATE_WHITELIST := $(PRODUCT_ARTIFACT_SYSTEM_CERTIFICATE_REQUIREMENT_WHITELIST)
 
diff --git a/core/soong_config.mk b/core/soong_config.mk
index 7ce59f1..85e7bbc 100644
--- a/core/soong_config.mk
+++ b/core/soong_config.mk
@@ -199,6 +199,8 @@
 
 $(call add_json_bool, EnforceProductPartitionInterface,  $(PRODUCT_ENFORCE_PRODUCT_PARTITION_INTERFACE))
 
+$(call add_json_bool, InstallExtraFlattenedApexes, $(PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES))
+
 $(call json_end)
 
 $(file >$(SOONG_VARIABLES).tmp,$(json_contents))
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index a41c1ae..2f5fdea 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -250,7 +250,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2020-01-05
+      PLATFORM_SECURITY_PATCH := 2020-02-01
 endif
 .KATI_READONLY := PLATFORM_SECURITY_PATCH
 
diff --git a/target/board/mainline_x86_64/BoardConfig.mk b/target/board/mainline_x86_64/BoardConfig.mk
new file mode 100644
index 0000000..118fda6
--- /dev/null
+++ b/target/board/mainline_x86_64/BoardConfig.mk
@@ -0,0 +1,35 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+TARGET_ARCH := x86_64
+TARGET_ARCH_VARIANT := x86_64
+TARGET_CPU_ABI := x86_64
+
+TARGET_2ND_ARCH := x86
+TARGET_2ND_ARCH_VARIANT := x86_64
+TARGET_2ND_CPU_ABI := x86
+
+include build/make/target/board/BoardConfigMainlineCommon.mk
+
+TARGET_NO_KERNEL := true
+
+# Build generic A/B format system-only OTA.
+AB_OTA_UPDATER := true
+AB_OTA_PARTITIONS := system
+
+BOARD_PRODUCTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+BOARD_VENDORIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/product/AndroidProducts.mk b/target/product/AndroidProducts.mk
index ca4ed2c..5ecaf26 100644
--- a/target/product/AndroidProducts.mk
+++ b/target/product/AndroidProducts.mk
@@ -57,6 +57,7 @@
     $(LOCAL_DIR)/mainline_system_arm64.mk \
     $(LOCAL_DIR)/mainline_system_x86.mk \
     $(LOCAL_DIR)/mainline_system_x86_arm.mk \
+    $(LOCAL_DIR)/mainline_system_x86_64.mk \
     $(LOCAL_DIR)/sdk_arm64.mk \
     $(LOCAL_DIR)/sdk.mk \
     $(LOCAL_DIR)/sdk_phone_arm64.mk \
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 278a0a8..5c803ee 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -53,6 +53,7 @@
     com.android.adbd \
     com.android.apex.cts.shim.v1_prebuilt \
     com.android.conscrypt \
+    com.android.cronet \
     com.android.i18n \
     com.android.ipsec \
     com.android.location.provider \
@@ -63,6 +64,7 @@
     com.android.permission \
     com.android.resolv \
     com.android.neuralnetworks \
+    com.android.os.statsd \
     com.android.sdkext \
     com.android.telephony \
     com.android.tzdata \
@@ -201,7 +203,6 @@
     lpdump \
     lshal \
     mdnsd \
-    media \
     mediacodec.policy \
     mediaextractor \
     mediametrics \
@@ -253,7 +254,6 @@
     snapshotctl \
     SoundPicker \
     statsd \
-    service-statsd \
     storaged \
     surfaceflinger \
     svc \
@@ -331,6 +331,7 @@
     voip-common \
     ims-common \
     framework-sdkext \
+    framework-statsd \
     ike \
     updatable-media \
     framework-wifi
@@ -339,6 +340,7 @@
     com.android.conscrypt:conscrypt \
     com.android.ipsec:ike \
     com.android.media:updatable-media \
+    com.android.os.statsd:framework-statsd \
     com.android.sdkext:framework-sdkext \
     com.android.telephony:telephony-common \
     com.android.telephony:ims-common \
@@ -363,6 +365,7 @@
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.zygote=zygote32
 
 PRODUCT_SYSTEM_DEFAULT_PROPERTIES += debug.atrace.tags.enableflags=0
+PRODUCT_SYSTEM_DEFAULT_PROPERTIES += persist.traced.enable=1
 
 # Packages included only for eng or userdebug builds, previously debug tagged
 PRODUCT_PACKAGES_DEBUG := \
diff --git a/target/product/base_vendor.mk b/target/product/base_vendor.mk
index 7d1babf..146a1c9 100644
--- a/target/product/base_vendor.mk
+++ b/target/product/base_vendor.mk
@@ -23,6 +23,7 @@
     init_second_stage.recovery \
     ld.config.recovery.txt \
     linker.recovery \
+    linkerconfig.recovery \
     otacerts.recovery \
     recovery \
     shell_and_utilities_recovery \
diff --git a/target/product/developer_gsi_keys.mk b/target/product/developer_gsi_keys.mk
new file mode 100644
index 0000000..79451ad
--- /dev/null
+++ b/target/product/developer_gsi_keys.mk
@@ -0,0 +1,29 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Device makers who are willing to support booting the public Developer-GSI
+# in locked state can add the following line into a device.mk to inherit this
+# makefile. This file will then install the up-to-date GSI public keys into
+# the first-stage ramdisk to pass verified boot.
+#
+# In device/<company>/<board>/device.mk:
+#   $(call inherit-product, $(SRC_TARGET_DIR)/product/developer_gsi_keys.mk)
+#
+# Currently, the developer GSI images can be downloaded from the following URL:
+#   https://developer.android.com/topic/generic-system-image/releases
+#
+PRODUCT_PACKAGES += \
+    q-developer-gsi.avbpubkey \
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index 52fa1a7..93c861f 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -50,12 +50,6 @@
 #PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
 #config.disable_location=true
 
-# Enable Perfetto traced
-# There is a stable property API for this prop so we can move it to /product.
-# https://android-review.googlesource.com/c/platform/system/libsysprop/+/952375
-PRODUCT_PRODUCT_PROPERTIES += \
-    persist.traced.enable=1
-
 # enable Google-specific location features,
 # like NetworkLocationProvider and LocationCollector
 PRODUCT_SYSTEM_EXT_PROPERTIES += \
diff --git a/target/product/emulator_vendor.mk b/target/product/emulator_vendor.mk
index 7891a26..a935d58 100644
--- a/target/product/emulator_vendor.mk
+++ b/target/product/emulator_vendor.mk
@@ -42,12 +42,6 @@
 #PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
 #config.disable_location=true
 
-# Enable Perfetto traced
-# There is a stable property API for this prop so we can move it to /product.
-# https://android-review.googlesource.com/c/platform/system/libsysprop/+/952375
-PRODUCT_PRODUCT_PROPERTIES += \
-    persist.traced.enable=1
-
 # enable Google-specific location features,
 # like NetworkLocationProvider and LocationCollector
 PRODUCT_SYSTEM_EXT_PROPERTIES += \
diff --git a/target/product/go_defaults_common.mk b/target/product/go_defaults_common.mk
index ada339a..c907acf 100644
--- a/target/product/go_defaults_common.mk
+++ b/target/product/go_defaults_common.mk
@@ -20,7 +20,6 @@
 # Set lowram options and enable traced by default
 PRODUCT_PROPERTY_OVERRIDES += \
      ro.config.low_ram=true \
-     persist.traced.enable=1 \
 
 # Speed profile services and wifi-service to reduce RAM and storage.
 PRODUCT_SYSTEM_SERVER_COMPILER_FILTER := speed-profile
diff --git a/target/product/gsi/current.txt b/target/product/gsi/current.txt
index 8ae687f..eb7bcab 100644
--- a/target/product/gsi/current.txt
+++ b/target/product/gsi/current.txt
@@ -52,6 +52,7 @@
 VNDK-SP: libutils.so
 VNDK-SP: libutilscallstack.so
 VNDK-SP: libz.so
+VNDK-SP: vintf-common-V1-ndk_platform.so
 VNDK-SP: vintf-graphics-common-V1-ndk_platform.so
 VNDK-core: android.frameworks.cameraservice.common@2.0.so
 VNDK-core: android.frameworks.cameraservice.device@2.0.so
diff --git a/target/product/gsi_release.mk b/target/product/gsi_release.mk
index aee7959..a6dd418 100644
--- a/target/product/gsi_release.mk
+++ b/target/product/gsi_release.mk
@@ -38,6 +38,12 @@
 # Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
 PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
 
+# GSI targets should install "unflattened" APEXes in /system
+TARGET_FLATTEN_APEX := false
+
+# GSI targets should install "flattened" APEXes in /system_ext as well
+PRODUCT_INSTALL_EXTRA_FLATTENED_APEXES := true
+
 # GSI specific tasks on boot
 PRODUCT_PACKAGES += \
     gsi_skip_mount.cfg \
diff --git a/target/product/mainline_system.mk b/target/product/mainline_system.mk
index 5a5c17d..ccbc907 100644
--- a/target/product/mainline_system.mk
+++ b/target/product/mainline_system.mk
@@ -21,6 +21,9 @@
 # Add adb keys to debuggable AOSP builds (if they exist)
 $(call inherit-product-if-exists, vendor/google/security/adb/vendor_key.mk)
 
+# Enable updating of APEXes
+$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
+
 # Shared java libs
 PRODUCT_PACKAGES += \
     com.android.nfc_extras \
@@ -125,6 +128,14 @@
 PRODUCT_NAME := mainline_system
 PRODUCT_BRAND := generic
 
+# Define /system partition-specific product properties to identify that /system
+# partition is mainline_system.
+PRODUCT_SYSTEM_NAME := mainline
+PRODUCT_SYSTEM_BRAND := Android
+PRODUCT_SYSTEM_MANUFACTURER := Android
+PRODUCT_SYSTEM_MODEL := mainline
+PRODUCT_SYSTEM_DEVICE := generic
+
 _base_mk_whitelist :=
 
 _my_whitelist := $(_base_mk_whitelist)
diff --git a/target/product/mainline_system_x86_64.mk b/target/product/mainline_system_x86_64.mk
new file mode 100644
index 0000000..1b1a42f
--- /dev/null
+++ b/target/product/mainline_system_x86_64.mk
@@ -0,0 +1,46 @@
+#
+# Copyright (C) 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# All components inherited here go to system image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
+$(call enforce-product-packages-exist,)
+
+# Enable mainline checking
+PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := true
+
+# Enable nonflat APEX
+$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
+
+PRODUCT_BUILD_CACHE_IMAGE := false
+PRODUCT_BUILD_ODM_IMAGE := false
+PRODUCT_BUILD_PRODUCT_IMAGE  := false
+PRODUCT_BUILD_RAMDISK_IMAGE := false
+PRODUCT_BUILD_SYSTEM_IMAGE := true
+PRODUCT_BUILD_SYSTEM_EXT_IMAGE := false
+PRODUCT_BUILD_SYSTEM_OTHER_IMAGE := false
+PRODUCT_BUILD_USERDATA_IMAGE := false
+PRODUCT_BUILD_VENDOR_IMAGE := false
+
+PRODUCT_SHIPPING_API_LEVEL := 29
+
+PRODUCT_RESTRICT_VENDOR_FILES := all
+
+PRODUCT_NAME := mainline_system_x86_64
+PRODUCT_DEVICE := mainline_x86_64
+PRODUCT_BRAND := generic
diff --git a/target/product/media_system.mk b/target/product/media_system.mk
index 6ace361..fed4282 100644
--- a/target/product/media_system.mk
+++ b/target/product/media_system.mk
@@ -55,14 +55,14 @@
     ethernet-service \
     com.android.location.provider \
     service-jobscheduler \
-    service-statsd \
     service-blobstore \
     service-appsearch \
 
 # system server jars which are updated via apex modules.
 # The values should be of the format <apex name>:<jar name>
 PRODUCT_UPDATABLE_SYSTEM_SERVER_JARS := \
-    com.android.wifi:wifi-service
+    com.android.os.statsd:service-statsd \
+    com.android.wifi:wifi-service \
 
 PRODUCT_COPY_FILES += \
     system/core/rootdir/etc/public.libraries.android.txt:system/etc/public.libraries.txt
diff --git a/tools/releasetools/common.py b/tools/releasetools/common.py
index 3ba9a23..556d25a 100644
--- a/tools/releasetools/common.py
+++ b/tools/releasetools/common.py
@@ -76,6 +76,10 @@
     self.boot_signer_args = []
     self.verity_signer_path = None
     self.verity_signer_args = []
+    self.aftl_server = None
+    self.aftl_key_path = None
+    self.aftl_manufacturer_key_path = None
+    self.aftl_signer_helper = None
     self.verbose = False
     self.tempfiles = []
     self.device_specific = None
@@ -959,6 +963,12 @@
 
   RunAndCheckOutput(cmd)
 
+  if OPTIONS.aftl_server is not None:
+    # Ensure the other AFTL parameters are set as well.
+    assert OPTIONS.aftl_key_path is not None, 'No AFTL key provided.'
+    assert OPTIONS.aftl_manufacturer_key_path is not None, 'No AFTL manufacturer key provided.'
+    assert OPTIONS.aftl_signer_helper is not None, 'No AFTL signer helper provided.'
+    # AFTL inclusion proof generation code will go here.
 
 def _MakeRamdisk(sourcedir, fs_config_file=None):
   ramdisk_img = tempfile.NamedTemporaryFile()
@@ -1810,7 +1820,8 @@
          "java_path=", "java_args=", "public_key_suffix=",
          "private_key_suffix=", "boot_signer_path=", "boot_signer_args=",
          "verity_signer_path=", "verity_signer_args=", "device_specific=",
-         "extra=", "logfile="] +
+         "extra=", "logfile=", "aftl_server=", "aftl_key_path=",
+         "aftl_manufacturer_key_path=", "aftl_signer_helper="] +
         list(extra_long_opts))
   except getopt.GetoptError as err:
     Usage(docstring)
@@ -1847,6 +1858,14 @@
       OPTIONS.verity_signer_path = a
     elif o in ("--verity_signer_args",):
       OPTIONS.verity_signer_args = shlex.split(a)
+    elif o in ("--aftl_server",):
+      OPTIONS.aftl_server = a
+    elif o in ("--aftl_key_path",):
+      OPTIONS.aftl_key_path = a
+    elif o in ("--aftl_manufacturer_key_path",):
+      OPTIONS.aftl_manufacturer_key_path = a
+    elif o in ("--aftl_signer_helper",):
+      OPTIONS.aftl_signer_helper = a
     elif o in ("-s", "--device_specific"):
       OPTIONS.device_specific = a
     elif o in ("-x", "--extra"):
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index 0f4f1da..35b11c1 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -972,6 +972,7 @@
           devkeydir + "/media":    d + "/media",
           devkeydir + "/shared":   d + "/shared",
           devkeydir + "/platform": d + "/platform",
+          devkeydir + "/networkstack": d + "/networkstack",
           })
     else:
       OPTIONS.key_map[s] = d