diff --git a/OWNERS b/OWNERS
index f3f3ad4..1e9b763 100644
--- a/OWNERS
+++ b/OWNERS
@@ -2,6 +2,10 @@
 dwillemsen@google.com
 nanzhang@google.com
 
+per-file * = ccross@android.com
+per-file * = dwillemsen@google.com
+per-file * = nanzhang@google.com
+
 # for version updates
 per-file version_defaults.mk = aseaton@google.com
 per-file version_defaults.mk = elisapascual@google.com
diff --git a/core/Makefile b/core/Makefile
index a6b67ad..0a2f6e3 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -2409,7 +2409,8 @@
 OTATOOLS_DEPS := \
   system/extras/verity/build_verity_metadata.py \
   system/extras/ext4_utils/mke2fs.conf \
-  external/avb/test/data/testkey_rsa4096.pem \
+  $(sort $(shell find external/avb/test/data -type f -name "testkey_*.pem" -o \
+      -name "atx_metadata.bin")) \
   $(sort $(shell find system/update_engine/scripts -name \*.pyc -prune -o -type f -print)) \
   $(sort $(shell find build/target/product/security -type f -name \*.x509.pem -o -name \*.pk8 -o \
       -name verity_key)) \
diff --git a/core/config.mk b/core/config.mk
index 20dbddc..d218408 100644
--- a/core/config.mk
+++ b/core/config.mk
@@ -1009,6 +1009,7 @@
 TARGET_SDK_VERSIONS_WITHOUT_JAVA_19_SUPPORT := $(call numbers_less_than,27,$(TARGET_AVAILABLE_SDK_VERSIONS))
 
 INTERNAL_PLATFORM_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/public_api.txt
+INTERNAL_PLATFORM_DEX_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/public-dex.txt
 INTERNAL_PLATFORM_PRIVATE_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/private.txt
 INTERNAL_PLATFORM_PRIVATE_DEX_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/private-dex.txt
 INTERNAL_PLATFORM_REMOVED_API_FILE := $(TARGET_OUT_COMMON_INTERMEDIATES)/PACKAGING/removed.txt
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index 9ea1ff4..d570ccd 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -96,15 +96,17 @@
   my_sanitize_diag :=
 endif
 
-# Enable CFI in included paths.
+# Enable CFI in included paths (for Arm64 only).
 ifeq ($(filter cfi, $(my_sanitize)),)
-  combined_include_paths := $(CFI_INCLUDE_PATHS) \
-                            $(PRODUCT_CFI_INCLUDE_PATHS)
+  ifneq ($(filter arm64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
+    combined_include_paths := $(CFI_INCLUDE_PATHS) \
+                              $(PRODUCT_CFI_INCLUDE_PATHS)
 
-  ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_include_paths)),\
-         $(filter $(dir)%,$(LOCAL_PATH)))),)
-    my_sanitize := cfi $(my_sanitize)
-    my_sanitize_diag := cfi $(my_sanitize_diag)
+    ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_include_paths)),\
+           $(filter $(dir)%,$(LOCAL_PATH)))),)
+      my_sanitize := cfi $(my_sanitize)
+      my_sanitize_diag := cfi $(my_sanitize_diag)
+    endif
   endif
 endif
 
@@ -330,6 +332,7 @@
   ifeq ($(filter STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
     ifndef LOCAL_SDK_VERSION
       my_static_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_MINIMAL_RUNTIME_LIBRARY)
+      my_ldflags += -Wl,--exclude-libs,$($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_MINIMAL_RUNTIME_LIBRARY).a
     endif
   endif
   ifneq ($(filter unsigned-integer-overflow signed-integer-overflow integer,$(my_sanitize)),)
diff --git a/core/dex_preopt_odex_install.mk b/core/dex_preopt_odex_install.mk
index d56c68a..ce91759 100644
--- a/core/dex_preopt_odex_install.mk
+++ b/core/dex_preopt_odex_install.mk
@@ -118,13 +118,9 @@
 
 ifeq (true,$(my_process_profile))
 
-ifdef LOCAL_VENDOR_MODULE
-$(call pretty-error, Internal error: profiles are not supported for vendor modules)
-else
 ifeq (,$(LOCAL_DEX_PREOPT_APP_IMAGE))
 LOCAL_DEX_PREOPT_APP_IMAGE := true
 endif
-endif
 
 ifndef LOCAL_DEX_PREOPT_PROFILE
 $(call pretty-error,Must have specified class listing (LOCAL_DEX_PREOPT_PROFILE))
diff --git a/core/envsetup.mk b/core/envsetup.mk
index 12b5869..700189e 100644
--- a/core/envsetup.mk
+++ b/core/envsetup.mk
@@ -663,7 +663,7 @@
 
 TARGET_OUT_PRODUCT := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_PRODUCT)
 ifneq ($(filter address,$(SANITIZE_TARGET)),)
-target_out_product_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/system
+target_out_product_shared_libraries_base := $(PRODUCT_OUT)/$(TARGET_COPY_OUT_ASAN)/product
 ifeq ($(SANITIZE_LITE),true)
 # When using SANITIZE_LITE, APKs must not be packaged with sanitized libraries, as they will not
 # work with unsanitized app_process. For simplicity, generate APKs into /data/asan/.
@@ -672,7 +672,7 @@
 target_out_product_app_base := $(TARGET_OUT_PRODUCT)
 endif
 else
-target_out_product_shared_libraries_base := $(TARGET_OUT)
+target_out_product_shared_libraries_base := $(TARGET_OUT_PRODUCT)
 target_out_product_app_base := $(TARGET_OUT_PRODUCT)
 endif
 
diff --git a/core/main.mk b/core/main.mk
index 033a2d9..1946edb 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -96,6 +96,8 @@
 -include tools/tradefederation/build/suites/general-tests/config.mk
 # STS-specific config.
 -include test/sts/tools/sts-tradefed/build/config.mk
+# CTS-Instant-specific config
+-include test/suite_harness/tools/cts-instant-tradefed/build/config.mk
 
 # Clean rules
 .PHONY: clean-dex-files
diff --git a/core/tasks/cts_instant.mk b/core/tasks/cts_instant.mk
new file mode 100644
index 0000000..18f1db3
--- /dev/null
+++ b/core/tasks/cts_instant.mk
@@ -0,0 +1,25 @@
+# Copyright (C) 2018 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+test_suite_name := cts_instant
+test_suite_tradefed := cts-instant-tradefed
+test_suite_dynamic_config := test/suite_harness/tools/cts-instant-tradefed/DynamicConfig.xml
+test_suite_readme := test/suite_harness/tools/cts-instant-tradefed/README
+
+include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
+
+.PHONY: cts_instant
+cts_instant: $(compatibility_zip)
+$(call dist-for-goals, cts_instant, $(compatibility_zip))
+
diff --git a/core/tasks/vendor_module_check.mk b/core/tasks/vendor_module_check.mk
index ae967c6..6695994 100644
--- a/core/tasks/vendor_module_check.mk
+++ b/core/tasks/vendor_module_check.mk
@@ -44,6 +44,7 @@
         ti \
         trusted_logic \
         verizon \
+        waves \
         widevine
 
 
diff --git a/core/tasks/vndk.mk b/core/tasks/vndk.mk
index 3604aed..b9133df 100644
--- a/core/tasks/vndk.mk
+++ b/core/tasks/vndk.mk
@@ -141,9 +141,13 @@
 #######################################
 # vndk_snapshot_zip
 vndk_snapshot_variant := $(vndk_snapshot_out)/$(TARGET_ARCH)
-vndk_lib_dir := $(vndk_snapshot_variant)/arch-$(TARGET_ARCH)-$(TARGET_ARCH_VARIANT)
-vndk_lib_dir_2nd := $(vndk_snapshot_variant)/arch-$(TARGET_2ND_ARCH)-$(TARGET_2ND_ARCH_VARIANT)
-vndk_snapshot_zip := $(PRODUCT_OUT)/android-vndk-$(TARGET_ARCH).zip
+binder :=
+ifneq ($(TARGET_USES_64_BIT_BINDER), true)
+  binder := binder32
+endif
+vndk_lib_dir := $(subst $(space),/,$(strip $(vndk_snapshot_variant) $(binder) arch-$(TARGET_ARCH)-$(TARGET_ARCH_VARIANT)))
+vndk_lib_dir_2nd := $(subst $(space),/,$(strip $(vndk_snapshot_variant) $(binder) arch-$(TARGET_2ND_ARCH)-$(TARGET_2ND_ARCH_VARIANT)))
+vndk_snapshot_zip := $(PRODUCT_OUT)/android-vndk-$(TARGET_PRODUCT).zip
 
 $(vndk_snapshot_zip): PRIVATE_VNDK_SNAPSHOT_OUT := $(vndk_snapshot_out)
 
@@ -233,6 +237,7 @@
 vndk_snapshot_out :=
 vndk_snapshot_configs_out :=
 vndk_snapshot_variant :=
+binder :=
 vndk_lib_dir :=
 vndk_lib_dir_2nd :=
 vndk_snapshot_dependencies :=
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index 8841b6b..43f3f02 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -234,6 +234,16 @@
       PLATFORM_SECURITY_PATCH := 2018-06-05
 endif
 
+ifndef PLATFORM_SECURITY_PATCH_TIMESTAMP
+  # Used to indicate the matching timestamp for the security patch string in PLATFORM_SECURITY_PATCH.
+  ifneq (,$(findstring Darwin,$(UNAME)))
+    PLATFORM_SECURITY_PATCH_TIMESTAMP := $(shell date -jf '%Y-%m-%d %T %Z' '$(PLATFORM_SECURITY_PATCH) 00:00:00 GMT' +%s)
+  else
+    PLATFORM_SECURITY_PATCH_TIMESTAMP := $(shell date -d 'TZ="GMT" $(PLATFORM_SECURITY_PATCH)' +%s)
+  endif
+endif
+.KATI_READONLY := PLATFORM_SECURITY_PATCH_TIMESTAMP
+
 ifndef PLATFORM_BASE_OS
   # Used to indicate the base os applied to the device.
   # Can be an arbitrary string, but must be a single word.
diff --git a/target/board/generic/BoardConfig.mk b/target/board/generic/BoardConfig.mk
index c76339f..2a1c45f 100644
--- a/target/board/generic/BoardConfig.mk
+++ b/target/board/generic/BoardConfig.mk
@@ -56,6 +56,9 @@
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
 DEVICE_MATRIX_FILE   := device/generic/goldfish/compatibility_matrix.xml
 
+# Android generic system image always create metadata partition
+BOARD_USES_METADATA_PARTITION := true
+
 # Set this to create /cache mount point for non-A/B devices that mounts /cache.
 # The partition size doesn't matter, just to make build pass.
 BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/board/generic/sepolicy/bootanim.te b/target/board/generic/sepolicy/bootanim.te
index e4f7c73..bc84ee7 100644
--- a/target/board/generic/sepolicy/bootanim.te
+++ b/target/board/generic/sepolicy/bootanim.te
@@ -5,4 +5,5 @@
 
 allow bootanim graphics_device:chr_file { read ioctl open };
 
+typeattribute bootanim system_writes_vendor_properties_violators;
 set_prop(bootanim, qemu_prop)
diff --git a/target/board/generic/sepolicy/surfaceflinger.te b/target/board/generic/sepolicy/surfaceflinger.te
index e03d07e..2bba8a7 100644
--- a/target/board/generic/sepolicy/surfaceflinger.te
+++ b/target/board/generic/sepolicy/surfaceflinger.te
@@ -1,4 +1,5 @@
 allow surfaceflinger self:process execmem;
 allow surfaceflinger ashmem_device:chr_file execute;
 
+typeattribute surfaceflinger system_writes_vendor_properties_violators;
 set_prop(surfaceflinger, qemu_prop)
diff --git a/target/board/generic/sepolicy/zygote.te b/target/board/generic/sepolicy/zygote.te
index e97d895..da403b5 100644
--- a/target/board/generic/sepolicy/zygote.te
+++ b/target/board/generic/sepolicy/zygote.te
@@ -1,3 +1,4 @@
+typeattribute zygote system_writes_vendor_properties_violators;
 set_prop(zygote, qemu_prop)
 # TODO (b/63631799) fix this access
 # Suppress denials to storage. Webview zygote should not be accessing.
diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk
index d6f3001..d4a8553 100644
--- a/target/board/generic_arm64/BoardConfig.mk
+++ b/target/board/generic_arm64/BoardConfig.mk
@@ -85,6 +85,9 @@
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
 DEVICE_MATRIX_FILE   := device/generic/goldfish/compatibility_matrix.xml
 
+# Android generic system image always create metadata partition
+BOARD_USES_METADATA_PARTITION := true
+
 # Set this to create /cache mount point for non-A/B devices that mounts /cache.
 # The partition size doesn't matter, just to make build pass.
 BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE := ext4
@@ -117,10 +120,6 @@
 BOARD_ROOT_EXTRA_FOLDERS += firmware firmware/radio persist
 BOARD_ROOT_EXTRA_SYMLINKS := /vendor/lib/dsp:/dsp
 
-# TODO(b/79781913): This is a temporary mount pointer for FBE.
-#   Will be remove after the FBE change the placement.
-BOARD_ROOT_EXTRA_FOLDERS += metadata
-
 # TODO(b/36764215): remove this setting when the generic system image
 # no longer has QCOM-specific directories under /.
 BOARD_SEPOLICY_DIRS += build/target/board/generic_arm64_ab/sepolicy
diff --git a/target/board/generic_arm64_ab/sepolicy/file_contexts b/target/board/generic_arm64_ab/sepolicy/file_contexts
index 6b785f5..0a80559 100644
--- a/target/board/generic_arm64_ab/sepolicy/file_contexts
+++ b/target/board/generic_arm64_ab/sepolicy/file_contexts
@@ -10,7 +10,3 @@
 
 # files in firmware
 /firmware(/.*)?         u:object_r:firmware_file:s0
-
-# TODO(b/79781913): This is a temporary mount pointer for FBE.
-#   Will be remove after the FBE change the placement.
-/metadata(/.*)?         u:object_r:metadata_file:s0
diff --git a/target/board/generic_x86/BoardConfig.mk b/target/board/generic_x86/BoardConfig.mk
index 0721a71..5af7e5a 100644
--- a/target/board/generic_x86/BoardConfig.mk
+++ b/target/board/generic_x86/BoardConfig.mk
@@ -58,6 +58,9 @@
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := true
 DEVICE_MATRIX_FILE   := device/generic/goldfish/compatibility_matrix.xml
 
+# Android generic system image always create metadata partition
+BOARD_USES_METADATA_PARTITION := true
+
 # Set this to create /cache mount point for non-A/B devices that mounts /cache.
 # The partition size doesn't matter, just to make build pass.
 BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/board/generic_x86_64/BoardConfig.mk b/target/board/generic_x86_64/BoardConfig.mk
index e2f8f47..81e325e 100755
--- a/target/board/generic_x86_64/BoardConfig.mk
+++ b/target/board/generic_x86_64/BoardConfig.mk
@@ -56,6 +56,9 @@
 BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true
 DEVICE_MATRIX_FILE   := device/generic/goldfish/compatibility_matrix.xml
 
+# Android generic system image always create metadata partition
+BOARD_USES_METADATA_PARTITION := true
+
 # Set this to create /cache mount point for non-A/B devices that mounts /cache.
 # The partition size doesn't matter, just to make build pass.
 BOARD_CACHEIMAGE_FILE_SYSTEM_TYPE := ext4
diff --git a/target/board/treble_common.mk b/target/board/treble_common.mk
index bf07e28..c4e68fe 100644
--- a/target/board/treble_common.mk
+++ b/target/board/treble_common.mk
@@ -39,6 +39,9 @@
 # Generic AOSP image always requires separate vendor.img
 TARGET_COPY_OUT_VENDOR := vendor
 
+# Android generic system image always create metadata partition
+BOARD_USES_METADATA_PARTITION := true
+
 # Generic AOSP image does NOT support HWC1
 TARGET_USES_HWC2 := true
 # Set emulator framebuffer display device buffer count to 3
diff --git a/target/product/aosp_arm64.mk b/target/product/aosp_arm64.mk
index 650c391..129f213 100644
--- a/target/product/aosp_arm64.mk
+++ b/target/product/aosp_arm64.mk
@@ -42,12 +42,11 @@
 PRODUCT_PACKAGES += \
     vr_hwc
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_arm64/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 # Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
 PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
 
diff --git a/target/product/aosp_x86_64.mk b/target/product/aosp_x86_64.mk
index 7ca1c71..84d3863 100644
--- a/target/product/aosp_x86_64.mk
+++ b/target/product/aosp_x86_64.mk
@@ -39,12 +39,11 @@
 PRODUCT_PACKAGES += \
     vr_hwc
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86_64/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 # Needed by Pi newly launched device to pass VtsTrebleSysProp on GSI
 PRODUCT_COMPATIBLE_PROPERTY_OVERRIDE := true
 
diff --git a/target/product/core_minimal.mk b/target/product/core_minimal.mk
index 1849818..85646c1 100644
--- a/target/product/core_minimal.mk
+++ b/target/product/core_minimal.mk
@@ -33,6 +33,7 @@
     HTMLViewer \
     MediaProvider \
     PackageInstaller \
+    SecureElement \
     SettingsProvider \
     Shell \
     StatementService \
@@ -177,3 +178,7 @@
 
 $(call inherit-product, $(SRC_TARGET_DIR)/product/runtime_libart.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/base.mk)
+
+# Enable CFI for security-sensitive components
+$(call inherit-product, $(SRC_TARGET_DIR)/product/cfi-common.mk)
+$(call inherit-product-if-exists, vendor/google/products/cfi-vendor.mk)
diff --git a/target/product/core_tiny.mk b/target/product/core_tiny.mk
index 48a044b..4ef7b48 100644
--- a/target/product/core_tiny.mk
+++ b/target/product/core_tiny.mk
@@ -41,6 +41,7 @@
     DefaultContainerService \
     ExtShared \
     ExtServices \
+    SecureElement \
     SettingsProvider \
     Shell \
     WallpaperBackup \
diff --git a/target/product/embedded.mk b/target/product/embedded.mk
index 6ddc07e..69cf102 100644
--- a/target/product/embedded.mk
+++ b/target/product/embedded.mk
@@ -21,7 +21,7 @@
     adb \
     adbd \
     usbd \
-    android.hardware.configstore@1.0-service \
+    android.hardware.configstore@1.1-service \
     android.hidl.allocator@1.0-service \
     android.hidl.memory@1.0-impl \
     android.hidl.memory@1.0-impl.vendor \
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index 8e100be..03c7d30 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -70,7 +70,11 @@
     sh_vendor \
     vintf \
     toybox_vendor \
-    CarrierConfig
+    CarrierConfig \
+    audio.primary.goldfish \
+    audio.r_submix.default \
+    local_time.default \
+    SdkSetup
 
 PRODUCT_PACKAGES += \
     android.hardware.audio@2.0-impl \
@@ -142,7 +146,22 @@
     device/generic/goldfish/wifi/simulated_hostapd.conf:$(TARGET_COPY_OUT_VENDOR)/etc/simulated_hostapd.conf \
     device/generic/goldfish/wifi/wpa_supplicant.conf:$(TARGET_COPY_OUT_VENDOR)/etc/wifi/wpa_supplicant.conf \
     device/generic/goldfish/wifi/WifiConfigStore.xml:data/misc/wifi/WifiConfigStore.xml \
-    frameworks/native/data/etc/android.hardware.wifi.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.xml
+    frameworks/native/data/etc/android.hardware.wifi.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.wifi.xml \
+    device/generic/goldfish/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
+    device/generic/goldfish/camera/media_profiles.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_profiles_V1_0.xml \
+    frameworks/av/media/libstagefright/data/media_codecs_google_audio.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_audio.xml \
+    frameworks/av/media/libstagefright/data/media_codecs_google_telephony.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_telephony.xml \
+    device/generic/goldfish/camera/media_codecs_google_video.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_video.xml \
+    device/generic/goldfish/camera/media_codecs.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs.xml \
+    device/generic/goldfish/camera/media_codecs_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_performance.xml \
+    frameworks/native/data/etc/android.hardware.touchscreen.multitouch.jazzhand.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.touchscreen.multitouch.jazzhand.xml \
+    frameworks/native/data/etc/android.hardware.camera.autofocus.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.camera.autofocus.xml \
+    frameworks/native/data/etc/android.hardware.camera.full.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.camera.full.xml \
+    frameworks/native/data/etc/android.hardware.fingerprint.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.fingerprint.xml \
+    frameworks/native/data/etc/android.software.autofill.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.autofill.xml \
+    frameworks/av/media/libeffects/data/audio_effects.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_effects.conf \
+    device/generic/goldfish/audio_policy.conf:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy.conf
+
 
 PRODUCT_PACKAGE_OVERLAYS := device/generic/goldfish/overlay
 
diff --git a/target/product/full.mk b/target/product/full.mk
index b66ae92..7c0578c 100644
--- a/target/product/full.mk
+++ b/target/product/full.mk
@@ -19,11 +19,10 @@
 # build quite specifically for the emulator, and might not be
 # entirely appropriate to inherit from for on-device configurations.
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 # Overrides
 PRODUCT_NAME := full
 PRODUCT_DEVICE := generic
diff --git a/target/product/full_x86.mk b/target/product/full_x86.mk
index 4dff713..6ea2d05 100644
--- a/target/product/full_x86.mk
+++ b/target/product/full_x86.mk
@@ -23,11 +23,10 @@
 # that isn't a wifi connection. This will instruct init.rc to enable the
 # network connection so that you can use it with ADB
 
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_base_telephony.mk)
 $(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
 
-include $(SRC_TARGET_DIR)/product/emulator.mk
-
 ifdef NET_ETH0_STARTONBOOT
   PRODUCT_PROPERTY_OVERRIDES += net.eth0.startonboot=1
 endif
diff --git a/target/product/vndk/28.txt b/target/product/vndk/28.txt
index 38241f5..712e91c 100644
--- a/target/product/vndk/28.txt
+++ b/target/product/vndk/28.txt
@@ -82,6 +82,7 @@
 VNDK-core: android.hardware.cas@1.0.so
 VNDK-core: android.hardware.configstore-utils.so
 VNDK-core: android.hardware.configstore@1.0.so
+VNDK-core: android.hardware.configstore@1.1.so
 VNDK-core: android.hardware.confirmationui-support-lib.so
 VNDK-core: android.hardware.confirmationui@1.0.so
 VNDK-core: android.hardware.contexthub@1.0.so
diff --git a/target/product/vndk/current.txt b/target/product/vndk/current.txt
index 38241f5..712e91c 100644
--- a/target/product/vndk/current.txt
+++ b/target/product/vndk/current.txt
@@ -82,6 +82,7 @@
 VNDK-core: android.hardware.cas@1.0.so
 VNDK-core: android.hardware.configstore-utils.so
 VNDK-core: android.hardware.configstore@1.0.so
+VNDK-core: android.hardware.configstore@1.1.so
 VNDK-core: android.hardware.confirmationui-support-lib.so
 VNDK-core: android.hardware.confirmationui@1.0.so
 VNDK-core: android.hardware.contexthub@1.0.so
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 1e2f39e..10a19b3 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -65,24 +65,29 @@
       when installed.
 
   --downgrade
-      Intentionally generate an incremental OTA that updates from a newer
-      build to an older one (based on timestamp comparison). "post-timestamp"
-      will be replaced by "ota-downgrade=yes" in the metadata file. A data
-      wipe will always be enforced, so "ota-wipe=yes" will also be included in
-      the metadata file. The update-binary in the source build will be used in
-      the OTA package, unless --binary flag is specified. Please also check the
-      doc for --override_timestamp below.
+      Intentionally generate an incremental OTA that updates from a newer build
+      to an older one (e.g. downgrading from P preview back to O MR1).
+      "ota-downgrade=yes" will be set in the package metadata file. A data wipe
+      will always be enforced when using this flag, so "ota-wipe=yes" will also
+      be included in the metadata file. The update-binary in the source build
+      will be used in the OTA package, unless --binary flag is specified. Please
+      also check the comment for --override_timestamp below.
 
   --override_timestamp
-      Intentionally generate an incremental OTA that updates from a newer
-      build to an older one (based on timestamp comparison), by overriding the
-      timestamp in package metadata. This differs from --downgrade flag: we
-      know for sure this is NOT an actual downgrade case, but two builds are
-      cut in a reverse order. A legit use case is that we cut a new build C
-      (after having A and B), but want to enfore an update path of A -> C -> B.
-      Specifying --downgrade may not help since that would enforce a data wipe
-      for C -> B update. The value of "post-timestamp" will be set to the newer
-      timestamp plus one, so that the package can be pushed and applied.
+      Intentionally generate an incremental OTA that updates from a newer build
+      to an older one (based on timestamp comparison), by setting the downgrade
+      flag in the package metadata. This differs from --downgrade flag, as we
+      don't enforce a data wipe with this flag. Because we know for sure this is
+      NOT an actual downgrade case, but two builds happen to be cut in a reverse
+      order (e.g. from two branches). A legit use case is that we cut a new
+      build C (after having A and B), but want to enfore an update path of A ->
+      C -> B. Specifying --downgrade may not help since that would enforce a
+      data wipe for C -> B update.
+
+      We used to set a fake timestamp in the package metadata for this flow. But
+      now we consolidate the two cases (i.e. an actual downgrade, or a downgrade
+      based on timestamp) with the same "ota-downgrade=yes" flag, with the
+      difference being whether "ota-wipe=yes" is set.
 
   -e  (--extra_script)  <file>
       Insert the contents of file at the end of the update script.
@@ -180,7 +185,6 @@
 OPTIONS.patch_threshold = 0.95
 OPTIONS.wipe_user_data = False
 OPTIONS.downgrade = False
-OPTIONS.timestamp = False
 OPTIONS.extra_script = None
 OPTIONS.worker_threads = multiprocessing.cpu_count() // 2
 if OPTIONS.worker_threads == 0:
@@ -898,23 +902,16 @@
 
   if OPTIONS.downgrade:
     if not is_downgrade:
-      raise RuntimeError("--downgrade specified but no downgrade detected: "
-                         "pre: %s, post: %s" % (pre_timestamp, post_timestamp))
+      raise RuntimeError(
+          "--downgrade or --override_timestamp specified but no downgrade "
+          "detected: pre: %s, post: %s" % (pre_timestamp, post_timestamp))
     metadata["ota-downgrade"] = "yes"
-  elif OPTIONS.timestamp:
-    if not is_downgrade:
-      raise RuntimeError("--override_timestamp specified but no timestamp hack "
-                         "needed: pre: %s, post: %s" % (pre_timestamp,
-                                                        post_timestamp))
-    metadata["post-timestamp"] = str(long(pre_timestamp) + 1)
   else:
     if is_downgrade:
-      raise RuntimeError("Downgrade detected based on timestamp check: "
-                         "pre: %s, post: %s. Need to specify "
-                         "--override_timestamp OR --downgrade to allow "
-                         "building the incremental." % (pre_timestamp,
-                                                        post_timestamp))
-    metadata["post-timestamp"] = post_timestamp
+      raise RuntimeError(
+          "Downgrade detected based on timestamp check: pre: %s, post: %s. "
+          "Need to specify --override_timestamp OR --downgrade to allow "
+          "building the incremental." % (pre_timestamp, post_timestamp))
 
 
 def GetPackageMetadata(target_info, source_info=None):
@@ -922,7 +919,7 @@
 
   It generates a dict() that contains the info to be written into an OTA
   package (META-INF/com/android/metadata). It also handles the detection of
-  downgrade / timestamp override / data wipe based on the global options.
+  downgrade / data wipe based on the global options.
 
   Args:
     target_info: The BuildInfo instance that holds the target build info.
@@ -963,11 +960,12 @@
   else:
     metadata['pre-device'] = target_info.device
 
-  # Detect downgrades, or fill in the post-timestamp.
+  # Use the actual post-timestamp, even for a downgrade case.
+  metadata['post-timestamp'] = target_info.GetBuildProp('ro.build.date.utc')
+
+  # Detect downgrades and set up downgrade flags accordingly.
   if is_incremental:
     HandleDowngradeMetadata(metadata, target_info, source_info)
-  else:
-    metadata['post-timestamp'] = target_info.GetBuildProp('ro.build.date.utc')
 
   return metadata
 
@@ -1791,7 +1789,7 @@
       OPTIONS.downgrade = True
       OPTIONS.wipe_user_data = True
     elif o == "--override_timestamp":
-      OPTIONS.timestamp = True
+      OPTIONS.downgrade = True
     elif o in ("-o", "--oem_settings"):
       OPTIONS.oem_source = a.split(',')
     elif o == "--oem_no_mount":
@@ -1869,19 +1867,12 @@
     sys.exit(1)
 
   if OPTIONS.downgrade:
-    # Sanity check to enforce a data wipe.
-    if not OPTIONS.wipe_user_data:
-      raise ValueError("Cannot downgrade without a data wipe")
-
     # We should only allow downgrading incrementals (as opposed to full).
     # Otherwise the device may go back from arbitrary build with this full
     # OTA package.
     if OPTIONS.incremental_source is None:
       raise ValueError("Cannot generate downgradable full OTAs")
 
-  assert not (OPTIONS.downgrade and OPTIONS.timestamp), \
-      "Cannot have --downgrade AND --override_timestamp both"
-
   # Load the build info dicts from the zip directly or the extracted input
   # directory. We don't need to unzip the entire target-files zips, because they
   # won't be needed for A/B OTAs (brillo_update_payload does that on its own).
diff --git a/tools/releasetools/test_ota_from_target_files.py b/tools/releasetools/test_ota_from_target_files.py
index d7cace8..262e701 100644
--- a/tools/releasetools/test_ota_from_target_files.py
+++ b/tools/releasetools/test_ota_from_target_files.py
@@ -524,31 +524,7 @@
             'post-build-incremental' : 'build-version-incremental-target',
             'post-sdk-level' : '27',
             'post-security-patch-level' : '2017-12-01',
-            'pre-device' : 'product-device',
-            'pre-build' : 'build-fingerprint-source',
-            'pre-build-incremental' : 'build-version-incremental-source',
-        },
-        metadata)
-
-  def test_GetPackageMetadata_overrideTimestamp(self):
-    target_info_dict = copy.deepcopy(self.TEST_TARGET_INFO_DICT)
-    source_info_dict = copy.deepcopy(self.TEST_SOURCE_INFO_DICT)
-    self._test_GetPackageMetadata_swapBuildTimestamps(
-        target_info_dict, source_info_dict)
-
-    target_info = BuildInfo(target_info_dict, None)
-    source_info = BuildInfo(source_info_dict, None)
-    common.OPTIONS.incremental_source = ''
-    common.OPTIONS.timestamp = True
-    metadata = GetPackageMetadata(target_info, source_info)
-    self.assertDictEqual(
-        {
-            'ota-type' : 'BLOCK',
-            'post-build' : 'build-fingerprint-target',
-            'post-build-incremental' : 'build-version-incremental-target',
-            'post-sdk-level' : '27',
-            'post-security-patch-level' : '2017-12-01',
-            'post-timestamp' : '1500000001',
+            'post-timestamp' : '1400000000',
             'pre-device' : 'product-device',
             'pre-build' : 'build-fingerprint-source',
             'pre-build-incremental' : 'build-version-incremental-source',
diff --git a/tools/releasetools/validate_target_files.py b/tools/releasetools/validate_target_files.py
index 68070ba..8c9e07c 100755
--- a/tools/releasetools/validate_target_files.py
+++ b/tools/releasetools/validate_target_files.py
@@ -81,6 +81,12 @@
         logging.warning('Skipping %s that has incomplete block list', entry)
         continue
 
+      # TODO(b/79951650): Handle files with non-monotonic ranges.
+      if not ranges.monotonic:
+        logging.warning(
+            'Skipping %s that has non-monotonic ranges: %s', entry, ranges)
+        continue
+
       blocks_sha1 = image.RangeSha1(ranges)
 
       # The filename under unpacked directory, such as SYSTEM/bin/sh.