diff --git a/AndroidProducts.mk b/AndroidProducts.mk
index fa47f8b..ae396fd 100644
--- a/AndroidProducts.mk
+++ b/AndroidProducts.mk
@@ -17,6 +17,8 @@
 PRODUCT_MAKEFILES := \
     $(LOCAL_DIR)/aosp_crosshatch.mk \
     $(LOCAL_DIR)/aosp_blueline.mk \
+    $(LOCAL_DIR)/aosp_crosshatch_hwasan.mk \
+    $(LOCAL_DIR)/aosp_blueline_hwasan.mk \
 
 COMMON_LUNCH_CHOICES := \
     aosp_crosshatch-userdebug \
diff --git a/BoardConfig-common.mk b/BoardConfig-common.mk
index e1f1832..eba44f8 100644
--- a/BoardConfig-common.mk
+++ b/BoardConfig-common.mk
@@ -63,6 +63,27 @@
 BOARD_USES_RECOVERY_AS_BOOT := true
 BOARD_USES_METADATA_PARTITION := true
 
+# Board uses A/B OTA.
+AB_OTA_UPDATER := true
+
+AB_OTA_PARTITIONS += \
+    boot \
+    system \
+    vbmeta \
+    dtbo
+
+# Skip product and system_ext partition for nodap build
+ifeq ($(filter %_nodap,$(TARGET_PRODUCT)),)
+AB_OTA_PARTITIONS += \
+    product \
+    system_ext
+endif
+
+ifneq ($(filter %_mainline,$(TARGET_PRODUCT)),)
+AB_OTA_PARTITIONS += \
+    vbmeta_system
+endif
+
 # Partitions (listed in the file) to be wiped under recovery.
 TARGET_RECOVERY_WIPE := device/google/crosshatch/recovery.wipe
 ifneq ($(filter %_mainline,$(TARGET_PRODUCT)),)
@@ -72,16 +93,11 @@
 endif
 TARGET_RECOVERY_PIXEL_FORMAT := RGBX_8888
 TARGET_RECOVERY_UI_LIB := \
-    librecovery_ui_crosshatch \
-    libnos_citadel_for_recovery \
-    libnos_for_recovery \
-    libbootloader_message \
+    librecovery_ui_pixel \
     libfstab
 
 ifneq ($(filter %_mainline,$(TARGET_PRODUCT)),)
-# TODO (b/136154856) product_services partition is removed from
-# BOARD_AVB_VBMETA_SYSTEM. Instead, we will add system_ext once it is ready.
-BOARD_AVB_VBMETA_SYSTEM := system
+BOARD_AVB_VBMETA_SYSTEM := system system_ext
 BOARD_AVB_VBMETA_SYSTEM_KEY_PATH := external/avb/test/data/testkey_rsa2048.pem
 BOARD_AVB_VBMETA_SYSTEM_ALGORITHM := SHA256_RSA2048
 BOARD_AVB_VBMETA_SYSTEM_ROLLBACK_INDEX := $(PLATFORM_SECURITY_PATCH_TIMESTAMP)
@@ -107,8 +123,6 @@
 else
   BOARD_SYSTEMIMAGE_EXTFS_INODE_COUNT := 4096
 endif
-else
-  BOARD_EXT4_SHARE_DUP_BLOCKS := true
 endif
 BOARD_SYSTEMIMAGE_JOURNAL_SIZE := 0
 
@@ -123,12 +137,24 @@
 # boot.img
 BOARD_BOOTIMAGE_PARTITION_SIZE := 0x04000000
 
+# system_ext.img
+ifneq ($(PRODUCT_USE_DYNAMIC_PARTITIONS), true)
+TARGET_COPY_OUT_SYSTEM_EXT := system/system_ext
+else
+BOARD_SYSTEM_EXTIMAGE_FILE_SYSTEM_TYPE := ext4
+endif
+ifeq ($(PRODUCT_NO_PRODUCT_PARTITION), true)
+# no system_ext partition as well
+TARGET_COPY_OUT_SYSTEM_EXT := system/system_ext
+endif
+
 ifeq ($(PRODUCT_USE_DYNAMIC_PARTITIONS), true)
 BOARD_SUPER_PARTITION_GROUPS := google_dynamic_partitions
 BOARD_GOOGLE_DYNAMIC_PARTITIONS_PARTITION_LIST := \
     system \
     vendor \
-    product
+    product \
+    system_ext
 
 ifeq ($(PRODUCT_RETROFIT_DYNAMIC_PARTITIONS), true)
 # Normal Pixel 3 must retrofit dynamic partitions.
@@ -144,29 +170,16 @@
 else
 # Mainline Pixel 3 has an actual super partition.
 
-# TODO (b/136154856) product_services partition is removed.
-# Instead, we will add system_ext once it is ready.
-# BOARD_PRODUCT_SERVICESIMAGE_FILE_SYSTEM_TYPE := ext4
-# TARGET_COPY_OUT_PRODUCT_SERVICES := product_services
-
 BOARD_SUPER_PARTITION_SIZE := 12884901888
 # Assume 1MB metadata size.
 # TODO(b/117997386): Use correct metadata size.
 BOARD_GOOGLE_DYNAMIC_PARTITIONS_SIZE := 6441402368
 
-# TODO (b/136154856) product_services partition removed.
-# Instead, we will add system_ext once it is ready.
-# BOARD_GOOGLE_DYNAMIC_PARTITIONS_PARTITION_LIST += \
-#    product_services \
-
 endif # PRODUCT_RETROFIT_DYNAMIC_PARTITIONS
 endif # PRODUCT_USE_DYNAMIC_PARTITIONS
 
 BOARD_FLASH_BLOCK_SIZE := 131072
 
-# Generate an APEX image for experiment b/119800099.
-DEXPREOPT_GENERATE_APEX_IMAGE := true
-
 BOARD_ROOT_EXTRA_SYMLINKS := /vendor/dsp:/dsp
 BOARD_ROOT_EXTRA_SYMLINKS += /mnt/vendor/persist:/persist
 
@@ -204,6 +217,13 @@
 # Sensors
 USE_SENSOR_MULTI_HAL := true
 TARGET_SUPPORT_DIRECT_REPORT := true
+# Enable sensor Version V_2
+USE_SENSOR_HAL_VER := 2.0
+
+# CHRE
+CHRE_DAEMON_ENABLED := true
+CHRE_DAEMON_LPMA_ENABLED := true
+CHRE_DAEMON_USE_SDSPRPC := true
 
 # wlan
 BOARD_WLAN_DEVICE := qcwcn
@@ -215,6 +235,9 @@
 BOARD_HOSTAPD_PRIVATE_LIB := lib_driver_cmd_$(BOARD_WLAN_DEVICE)
 WIFI_HIDL_FEATURE_AWARE := true
 WIFI_HIDL_FEATURE_DUAL_INTERFACE:= true
+WIFI_FEATURE_WIFI_EXT_HAL := true
+WIFI_FEATURE_IMU_DETECTION := false
+WIFI_HIDL_UNIFIED_SUPPLICANT_SERVICE_RC_ENTRY := true
 
 # Audio
 BOARD_USES_ALSA_AUDIO := true
diff --git a/CleanSpec.mk b/CleanSpec.mk
index a4963f7..eebe141 100644
--- a/CleanSpec.mk
+++ b/CleanSpec.mk
@@ -100,7 +100,7 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/lib64/hw/android.hardware.graphics.composer@2.1-impl.so)
 
 # Remove StrongBox RC
-$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.keymaster@4.0-service.citadel.rc)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.keymaster@4.1-service.citadel.rc)
 
 # Migrate to versioned VNDK directory
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/system/lib/vndk-sp)
@@ -158,3 +158,12 @@
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.vibrator@1.2-service.crosshatch)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.memtrack@1.0-service.rc)
 $(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/bin/hw/android.hardware.memtrack@1.0-service)
+
+# Removing GSI keys from the ramdisk.
+# Those keys will be embedded into VTS instead, to verify the GSI image in used.
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/first_stage_ramdisk/avb/q-gsi.avbpubkey)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/first_stage_ramdisk/avb/r-gsi.avbpubkey)
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/recovery/root/first_stage_ramdisk/avb/s-gsi.avbpubkey)
+
+# Use stable aidl power HAL
+$(call add-clean-step, rm -rf $(PRODUCT_OUT)/vendor/etc/init/android.hardware.power@1.3-service.pixel-libperfmgr.rc)
diff --git a/WCNSS_qcom_cfg.ini b/WCNSS_qcom_cfg.ini
index eb06c40..b141b8e 100644
--- a/WCNSS_qcom_cfg.ini
+++ b/WCNSS_qcom_cfg.ini
@@ -690,10 +690,6 @@
 # Enable/Disable rtt sta mac randomization
 enable_rtt_mac_randomization=1
 
-oce_sta_enable=0
-oce_sap_enable=0
-oce_enable_rssi_assoc_reject=0
-
 #Enable/Disable Secondary Retry Rate feature subset
 gEnableSecondaryRate=0x17
 
@@ -704,6 +700,8 @@
 #Timer value is in seconds
 gAutoBmpsTimerValue=90
 
+#Enable/Disable 802.11ai FILS support
+g_is_fils_enabled=0
 END
 
 # Note: Configuration parser would not read anything past the END marker
diff --git a/aosp_blueline.mk b/aosp_blueline.mk
index 9a38f9f..624d5da 100644
--- a/aosp_blueline.mk
+++ b/aosp_blueline.mk
@@ -14,10 +14,33 @@
 # limitations under the License.
 #
 
-# Inherit from the common Open Source product configuration
+#
+# All components inherited here go to system image
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
+# Enable mainline checking
+# TODO(b/138706293): enable Enable mainline checking later
+#PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+# TODO(b/136525499): move *_vendor.mk into the vendor makefile later
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, device/google/crosshatch/device-blueline.mk)
 $(call inherit-product-if-exists, vendor/google_devices/crosshatch/proprietary/device-vendor.mk)
 
@@ -26,8 +49,11 @@
 # STOPSHIP deal with Qualcomm stuff later
 # PRODUCT_RESTRICT_VENDOR_FILES := all
 
+PRODUCT_PACKAGES += com.android.vndk.current.on_vendor
+
+
 PRODUCT_MANUFACTURER := Google
-PRODUCT_BRAND := Android
 PRODUCT_NAME := aosp_blueline
 PRODUCT_DEVICE := blueline
+PRODUCT_BRAND := Android
 PRODUCT_MODEL := AOSP on blueline
diff --git a/aosp_blueline_hwasan.mk b/aosp_blueline_hwasan.mk
new file mode 100644
index 0000000..4d1d3e8
--- /dev/null
+++ b/aosp_blueline_hwasan.mk
@@ -0,0 +1,23 @@
+#
+# Copyright 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+$(call inherit-product, device/google/crosshatch/aosp_blueline.mk)
+PRODUCT_NAME := aosp_blueline_hwasan
+
+# Add "hwaddress" as a global sanitizer if it's missing.
+ifeq ($(filter hwaddress,$(SANITIZE_TARGET)),)
+  SANITIZE_TARGET := $(strip $(SANITIZE_TARGET) hwaddress)
+endif
diff --git a/aosp_crosshatch.mk b/aosp_crosshatch.mk
index 7db148c..c921d36 100644
--- a/aosp_crosshatch.mk
+++ b/aosp_crosshatch.mk
@@ -14,10 +14,33 @@
 # limitations under the License.
 #
 
-# Inherit from the common Open Source product configuration
+#
+# All components inherited here go to system image
+#
 $(call inherit-product, $(SRC_TARGET_DIR)/product/core_64_bit.mk)
-$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/mainline_system.mk)
 
+# Enable mainline checking
+# TODO(b/138706293): enable Enable mainline checking later
+#PRODUCT_ENFORCE_ARTIFACT_PATH_REQUIREMENTS := relaxed
+
+#
+# All components inherited here go to system_ext image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_system_ext.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_system_ext.mk)
+
+#
+# All components inherited here go to product image
+#
+$(call inherit-product, $(SRC_TARGET_DIR)/product/aosp_product.mk)
+
+#
+# All components inherited here go to vendor image
+#
+# TODO(b/136525499): move *_vendor.mk into the vendor makefile later
+$(call inherit-product, $(SRC_TARGET_DIR)/product/handheld_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/telephony_vendor.mk)
 $(call inherit-product, device/google/crosshatch/device-crosshatch.mk)
 $(call inherit-product-if-exists, vendor/google_devices/crosshatch/proprietary/device-vendor.mk)
 
@@ -26,8 +49,11 @@
 # STOPSHIP deal with Qualcomm stuff later
 # PRODUCT_RESTRICT_VENDOR_FILES := all
 
+PRODUCT_PACKAGES += com.android.vndk.current.on_vendor
+
+
 PRODUCT_MANUFACTURER := Google
-PRODUCT_BRAND := Android
 PRODUCT_NAME := aosp_crosshatch
 PRODUCT_DEVICE := crosshatch
+PRODUCT_BRAND := Android
 PRODUCT_MODEL := AOSP on crosshatch
diff --git a/aosp_crosshatch_hwasan.mk b/aosp_crosshatch_hwasan.mk
new file mode 100644
index 0000000..adcc235
--- /dev/null
+++ b/aosp_crosshatch_hwasan.mk
@@ -0,0 +1,23 @@
+#
+# Copyright 2019 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+$(call inherit-product, device/google/crosshatch/aosp_crosshatch.mk)
+PRODUCT_NAME := aosp_crosshatch_hwasan
+
+# Add "hwaddress" as a global sanitizer if it's missing.
+ifeq ($(filter hwaddress,$(SANITIZE_TARGET)),)
+  SANITIZE_TARGET := $(strip $(SANITIZE_TARGET) hwaddress)
+endif
diff --git a/audio_platform_info_tavil_b1.xml b/audio_platform_info_tavil_b1.xml
index c6aa434..d8e04b2 100644
--- a/audio_platform_info_tavil_b1.xml
+++ b/audio_platform_info_tavil_b1.xml
@@ -80,7 +80,17 @@
         <device name="SND_DEVICE_IN_CAMCORDER_SELFIE_INVERT_LANDSCAPE" acdb_id="66"/>
         <device name="SND_DEVICE_IN_CAMCORDER_SELFIE_PORTRAIT" acdb_id="66"/>
         <device name="SND_DEVICE_IN_VOICE_HEARING_AID" acdb_id="19"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_DMIC_STEREO" acdb_id="144"/>
     </acdb_ids>
+
+    <audio_input_source_delay>
+        <audio_source_delay name="AUDIO_SOURCE_CAMCORDER" delay="20"/>
+    </audio_input_source_delay>
+
+    <audio_output_usecase_delay>
+        <audio_usecase_delay name="USECASE_AUDIO_PLAYBACK_DEEP_BUFFER" delay="20"/>
+    </audio_output_usecase_delay>
+
     <bit_width_configs>
         <device name="SND_DEVICE_OUT_SPEAKER" bit_width="24"/>
     </bit_width_configs>
@@ -184,7 +194,7 @@
             frequencies="106.00 112.00 118.00 125.00 132.00 140.00 150.00 160.00 170.00 180.00 190.00 200.00 212.00 224.00 236.00 250.00 265.00 280.00 300.00 315.00 335.00 355.00 375.00 400.00 425.00 450.00 475.00 500.00 530.00 560.00 600.00 630.00 670.00 710.00 750.00 800.00 850.00 900.00 950.00 1000.00 1060.00 1120.00 1180.00 1250.00 1320.00 1400.00 1500.00 1600.00 1700.00 1800.00 1900.00 2000.00 2120.00 2240.00 2360.00 2500.00 2650.00 2800.00 3000.00 3150.00 3350.00 3550.00 3750.00 4000.00 4250.00 4500.00 4750.00 5000.00 5300.00 5600.00 6000.00 6300.00 6700.00 7100.00 7500.00 8000.00 8500.00 9000.00 9500.00 10000.00 10600.00 11200.00 11800.00 12500.00 13200.00 14000.00 15000.00 16000.00 17000.00 18000.00 19000.00 20000.00"
             responses="-0.75 -0.74 -0.69 -0.65 -0.62 -0.61 -0.56 -0.53 -0.50 -0.47 -0.43 -0.40 -0.37 -0.36 -0.33 -0.30 -0.28 -0.25 -0.24 -0.24 -0.24 -0.25 -0.24 -0.12 -0.10 -0.08 -0.09 -0.07 -0.07 -0.06 -0.06 -0.06 -0.05 -0.04 -0.05 -0.04 -0.01 0.02 0.02 0.00 0.02 0.03 0.07 0.10 0.10 0.13 0.01 0.01 0.10 0.11 0.19 0.24 0.38 0.46 0.26 0.27 0.43 0.76 0.75 1.09 1.09 0.94 1.06 1.21 1.47 1.45 1.36 2.07 2.85 2.90 3.85 4.65 5.84 5.46 6.15 7.50 8.30 10.62 12.70 16.65 20.95 25.41 26.32 20.20 16.60 11.24 7.85 7.62 20.19 7.32 2.87 5.18"
             sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 1.0 0.0" geometric_location="0.0546 0.1456 0.00415" />
-        <microphone device_id="builtin_mic_3" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="top" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+        <microphone device_id="builtin_mic_3" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="bottom" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
             group="0" index_in_the_group="2" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="92"
             frequencies="100.00 106.00 112.00 118.00 125.00 132.00 140.00 150.00 160.00 170.00 180.00 190.00 200.00 212.00 224.00 236.00 250.00 265.00 280.00 300.00 315.00 335.00 355.00 375.00 400.00 425.00 450.00 475.00 500.00 530.00 560.00 600.00 630.00 670.00 710.00 750.00 800.00 850.00 900.00 950.00 1000.00 1060.00 1120.00 1180.00 1250.00 1320.00 1400.00 1500.00 1600.00 1700.00 1800.00 1900.00 2000.00 2120.00 2240.00 2360.00 2500.00 2650.00 2800.00 3000.00 3150.00 3350.00 3550.00 3750.00 4000.00 4250.00 4500.00 4750.00 5000.00 5300.00 5600.00 6000.00 6300.00 6700.00 7100.00 7500.00 8000.00 8500.00 9000.00 9500.00 10000.00 10600.00 11200.00 11800.00 12500.00 13200.00 14000.00 15000.00 16000.00 17000.00 18000.00 19000.00"
             responses="-9.24 -9.31 -9.39 -9.45 -9.46 -9.47 -9.50 -9.52 -9.51 -9.52 -9.51 -9.50 -9.49 -9.47 -9.48 -9.49 -9.48 -9.50 -9.51 -9.53 -9.55 -9.59 -9.63 -9.67 -9.58 -9.57 -9.65 -9.68 -9.71 -9.75 -9.79 -9.84 -9.87 -9.87 -9.90 -9.90 -9.91 -9.97 -10.01 -10.05 -9.85 -9.93 -9.94 -9.98 -10.04 -10.12 -10.28 -10.25 -10.01 -9.86 -9.81 -9.82 -9.61 -9.46 -8.27 -8.42 -8.98 -8.99 -8.82 -9.21 -8.92 -8.97 -9.30 -9.44 -9.52 -9.28 -9.09 -8.81 -7.02 -5.72 -5.30 -7.26 -8.39 -12.28 -8.23 -6.99 -5.52 -4.87 -3.82 -6.09 0.00 -2.15 -0.26 1.48 5.22 10.92 6.41 9.55 12.96 3.35 22.00 19.75"
@@ -193,6 +203,10 @@
     <snd_devices>
         <input_snd_device>
             <input_snd_device_mic_mapping>
+                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_MIC">
+                        <mic_info mic_device_id="builtin_mic_1"
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                    </snd_dev>
                     <snd_dev in_snd_device="SND_DEVICE_IN_CAMCORDER_LANDSCAPE">
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
@@ -241,7 +255,11 @@
                         <mic_info mic_device_id="builtin_mic_3"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_AEC_NS">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC">
+                        <mic_info mic_device_id="builtin_mic_1"
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                    </snd_dev>
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_NS">
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
@@ -249,93 +267,29 @@
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_NS">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_AEC_NS">
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_DMIC_STEREO">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_MIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_DMIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_DMIC_TMUS">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_STEREO">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_SPEAKER_DMIC">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_THREE_MIC">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                         <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_AEC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_AEC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_AEC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_AEC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_MIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                     </snd_dev>
                     <snd_dev in_snd_device="SND_DEVICE_IN_UNPROCESSED_MIC">
                         <mic_info mic_device_id="builtin_mic_1"
@@ -349,25 +303,11 @@
                     </snd_dev>
                     <snd_dev in_snd_device="SND_DEVICE_IN_UNPROCESSED_THREE_MIC">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
                         <mic_info mic_device_id="builtin_mic_2"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_STEREO">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_STEREO">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                     </snd_dev>
             </input_snd_device_mic_mapping>
         </input_snd_device>
diff --git a/audio_platform_info_tavil_c1.xml b/audio_platform_info_tavil_c1.xml
index 91833e9..dd2b38c 100644
--- a/audio_platform_info_tavil_c1.xml
+++ b/audio_platform_info_tavil_c1.xml
@@ -80,7 +80,17 @@
         <device name="SND_DEVICE_IN_CAMCORDER_SELFIE_INVERT_LANDSCAPE" acdb_id="66"/>
         <device name="SND_DEVICE_IN_CAMCORDER_SELFIE_PORTRAIT" acdb_id="66"/>
         <device name="SND_DEVICE_IN_VOICE_HEARING_AID" acdb_id="19"/>
+        <device name="SND_DEVICE_IN_VOICE_REC_DMIC_STEREO" acdb_id="144"/>
     </acdb_ids>
+
+    <audio_input_source_delay>
+        <audio_source_delay name="AUDIO_SOURCE_CAMCORDER" delay="20"/>
+    </audio_input_source_delay>
+
+    <audio_output_usecase_delay>
+        <audio_usecase_delay name="USECASE_AUDIO_PLAYBACK_DEEP_BUFFER" delay="20"/>
+    </audio_output_usecase_delay>
+
     <bit_width_configs>
         <device name="SND_DEVICE_OUT_SPEAKER" bit_width="24"/>
     </bit_width_configs>
@@ -89,23 +99,23 @@
         <usecase name="USECASE_AUDIO_PLAYBACK_OFFLOAD" type="out" id="8"/>
         <usecase name="USECASE_VOWLAN_CALL" type="in" id="-1"/>
         <usecase name="USECASE_VOWLAN_CALL" type="out" id="-1"/>
-        <usecase name="USECASE_AUDIO_RECORD_LOW_LATENCY" type="in" id="17" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_ULL" type="out" id="17" />
-        <usecase name="USECASE_VOICEMMODE1_CALL" type="in" id="2" />
-        <usecase name="USECASE_VOICEMMODE1_CALL" type="out" id="2" />
-        <usecase name="USECASE_VOICEMMODE2_CALL" type="in" id="19" />
-        <usecase name="USECASE_VOICEMMODE2_CALL" type="out" id="19" />
-        <usecase name="USECASE_AUDIO_SPKR_CALIB_TX" type="in" id="41" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_AFE_PROXY" type="in" id="-1" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_AFE_PROXY" type="out" id="6" />
-        <usecase name="USECASE_AUDIO_RECORD_AFE_PROXY" type="in" id="7" />
-        <usecase name="USECASE_AUDIO_RECORD_AFE_PROXY" type="out" id="-1" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="in" id="-1" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="out" id="33" />
-        <usecase name="USECASE_AUDIO_RECORD_MMAP" type="in" id="33" />
-        <usecase name="USECASE_AUDIO_RECORD_MMAP" type="out" id="-1" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_VOIP" type="in" id="-1" />
-        <usecase name="USECASE_AUDIO_PLAYBACK_VOIP" type="out" id="16" />
+        <usecase name="USECASE_AUDIO_RECORD_LOW_LATENCY" type="in" id="17"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_ULL" type="out" id="17"/>
+        <usecase name="USECASE_VOICEMMODE1_CALL" type="in" id="2"/>
+        <usecase name="USECASE_VOICEMMODE1_CALL" type="out" id="2"/>
+        <usecase name="USECASE_VOICEMMODE2_CALL" type="in" id="19"/>
+        <usecase name="USECASE_VOICEMMODE2_CALL" type="out" id="19"/>
+        <usecase name="USECASE_AUDIO_SPKR_CALIB_TX" type="in" id="41"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_AFE_PROXY" type="in" id="-1"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_AFE_PROXY" type="out" id="6"/>
+        <usecase name="USECASE_AUDIO_RECORD_AFE_PROXY" type="in" id="7"/>
+        <usecase name="USECASE_AUDIO_RECORD_AFE_PROXY" type="out" id="-1"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="in" id="-1"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_MMAP" type="out" id="33"/>
+        <usecase name="USECASE_AUDIO_RECORD_MMAP" type="in" id="33"/>
+        <usecase name="USECASE_AUDIO_RECORD_MMAP" type="out" id="-1"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_VOIP" type="in" id="-1"/>
+        <usecase name="USECASE_AUDIO_PLAYBACK_VOIP" type="out" id="16"/>
         <usecase name="USECASE_AUDIO_RECORD_VOIP" type="in" id="16"/>
         <usecase name="USECASE_AUDIO_RECORD_VOIP" type="out" id="-1"/>
         <usecase name="USECASE_INCALL_MUSIC_UPLINK" type="out" id="27"/>
@@ -182,7 +192,7 @@
             frequencies="106.00 112.00 118.00 125.00 132.00 140.00 150.00 160.00 170.00 180.00 190.00 200.00 212.00 224.00 236.00 250.00 265.00 280.00 300.00 315.00 335.00 355.00 375.00 400.00 425.00 450.00 475.00 500.00 530.00 560.00 600.00 630.00 670.00 710.00 750.00 800.00 850.00 900.00 950.00 1000.00 1060.00 1120.00 1180.00 1250.00 1320.00 1400.00 1500.00 1600.00 1700.00 1800.00 1900.00 2000.00 2120.00 2240.00 2360.00 2500.00 2650.00 2800.00 3000.00 3150.00 3350.00 3550.00 3750.00 4000.00 4250.00 4500.00 4750.00 5000.00 5300.00 5600.00 6000.00 6300.00 6700.00 7100.00 7500.00 8000.00 8500.00 9000.00 9500.00 10000.00 10600.00 11200.00 11800.00 12500.00 13200.00 14000.00 15000.00 16000.00 17000.00 18000.00 19000.00 20000.00"
             responses="-0.22 -0.21 -0.20 -0.21 -0.20 -0.21 -0.21 -0.23 -0.23 -0.25 -0.23 -0.24 -0.25 -0.25 -0.26 -0.26 -0.26 -0.28 -0.29 -0.32 -0.35 -0.40 -0.43 -0.20 -0.10 -0.11 -0.13 -0.14 -0.15 -0.15 -0.15 -0.14 -0.14 -0.15 -0.09 -0.05 -0.04 -0.02 0.01 0.00 0.06 0.10 0.12 0.13 0.09 0.12 0.20 0.13 0.18 0.27 0.40 0.44 0.51 0.66 -0.18 0.55 0.76 0.48 0.30 0.32 0.56 0.81 1.23 1.64 2.67 3.58 3.81 4.63 5.57 5.72 5.34 6.07 5.53 7.78 9.37 10.29 11.96 12.54 9.23 13.87 17.26 20.08 29.00 21.14 17.87 23.97 26.36 16.81 11.33 11.68 10.10 14.49"
             sensitivity="-37.0" max_spl="132.5" min_spl="28.5" orientation="0.0 1.0 0.0" geometric_location="0.062 0.158 0.0036" />
-        <microphone device_id="builtin_mic_2" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="top" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
+        <microphone device_id="builtin_mic_2" type="AUDIO_DEVICE_IN_BUILTIN_MIC" address="bottom" location="AUDIO_MICROPHONE_LOCATION_MAINBODY"
             group="0" index_in_the_group="2" directionality="AUDIO_MICROPHONE_DIRECTIONALITY_OMNI" num_frequency_responses="92"
             frequencies="106.00 112.00 118.00 125.00 132.00 140.00 150.00 160.00 170.00 180.00 190.00 200.00 212.00 224.00 236.00 250.00 265.00 280.00 300.00 315.00 335.00 355.00 375.00 400.00 425.00 450.00 475.00 500.00 530.00 560.00 600.00 630.00 670.00 710.00 750.00 800.00 850.00 900.00 950.00 1000.00 1060.00 1120.00 1180.00 1250.00 1320.00 1400.00 1500.00 1600.00 1700.00 1800.00 1900.00 2000.00 2120.00 2240.00 2360.00 2500.00 2650.00 2800.00 3000.00 3150.00 3350.00 3550.00 3750.00 4000.00 4250.00 4500.00 4750.00 5000.00 5300.00 5600.00 6000.00 6300.00 6700.00 7100.00 7500.00 8000.00 8500.00 9000.00 9500.00 10000.00 10600.00 11200.00 11800.00 12500.00 13200.00 14000.00 15000.00 16000.00 17000.00 18000.00 19000.00 20000.00"
             responses="0.00 0.00 0.00 0.01 0.02 0.04 0.03 0.05 0.05 0.04 0.05 0.05 0.05 0.06 0.05 0.06 0.05 0.05 0.04 0.03 0.02 0.01 0.01 0.05 0.04 0.02 -0.02 -0.05 -0.09 -0.11 -0.14 -0.15 -0.16 -0.14 -0.15 -0.14 -0.12 -0.07 -0.03 0.00 0.08 0.10 0.14 0.24 0.35 0.43 0.63 0.73 0.83 0.86 1.03 1.23 1.48 2.21 2.68 1.73 1.82 1.88 2.20 2.41 2.96 3.18 3.71 4.38 5.32 6.25 7.11 7.41 7.87 9.21 9.94 9.26 7.23 7.17 8.68 10.94 12.04 16.45 18.00 22.64 29.18 29.79 34.34 36.35 31.54 31.92 33.54 18.23 6.72 25.84 18.95 23.91"
@@ -191,6 +201,10 @@
     <snd_devices>
         <input_snd_device>
             <input_snd_device_mic_mapping>
+                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_MIC">
+                        <mic_info mic_device_id="builtin_mic_1"
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                    </snd_dev>
                     <snd_dev in_snd_device="SND_DEVICE_IN_CAMCORDER_LANDSCAPE">
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
@@ -239,7 +253,11 @@
                         <mic_info mic_device_id="builtin_mic_3"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_AEC_NS">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC">
+                        <mic_info mic_device_id="builtin_mic_1"
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
+                    </snd_dev>
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_NS">
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
@@ -247,93 +265,29 @@
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_NS">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC_AEC_NS">
                         <mic_info mic_device_id="builtin_mic_1"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_MIC">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_REC_DMIC_STEREO">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_MIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_DMIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_DMIC_TMUS">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_STEREO">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                     </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_VOICE_SPEAKER_DMIC">
+                    <snd_dev in_snd_device="SND_DEVICE_IN_THREE_MIC">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
                         <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_AEC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_AEC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_AEC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_AEC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_NS">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_MIC">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                     </snd_dev>
                     <snd_dev in_snd_device="SND_DEVICE_IN_UNPROCESSED_MIC">
                         <mic_info mic_device_id="builtin_mic_1"
@@ -347,25 +301,11 @@
                     </snd_dev>
                     <snd_dev in_snd_device="SND_DEVICE_IN_UNPROCESSED_THREE_MIC">
                         <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
                         <mic_info mic_device_id="builtin_mic_2"
                             channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                         <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_HANDSET_DMIC_STEREO">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                    </snd_dev>
-                    <snd_dev in_snd_device="SND_DEVICE_IN_SPEAKER_DMIC_STEREO">
-                        <mic_info mic_device_id="builtin_mic_1"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_2"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
-                        <mic_info mic_device_id="builtin_mic_3"
-                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_PROCESSED"/>
+                            channel_mapping="AUDIO_MICROPHONE_CHANNEL_MAPPING_DIRECT AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED AUDIO_MICROPHONE_CHANNEL_MAPPING_UNUSED"/>
                     </snd_dev>
             </input_snd_device_mic_mapping>
         </input_snd_device>
diff --git a/audio_policy_volumes_b1.xml b/audio_policy_volumes_b1.xml
index 42e1d6a..32f3419 100644
--- a/audio_policy_volumes_b1.xml
+++ b/audio_policy_volumes_b1.xml
@@ -44,7 +44,7 @@
     <volume stream="AUDIO_STREAM_VOICE_CALL" deviceCategory="DEVICE_CATEGORY_EXT_MEDIA"
                                              ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_VOICE_CALL" deviceCategory="DEVICE_CATEGORY_HEARING_AID"
-                                             ref="DEFAULT_HEARING_AID_VOLUME_CURVE"/>
+                                             ref="DEFAULT_NON_MUTABLE_HEARING_AID_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_SYSTEM" deviceCategory="DEVICE_CATEGORY_HEADSET">
         <point>1,-3000</point>
         <point>33,-2600</point>
diff --git a/audio_policy_volumes_c1.xml b/audio_policy_volumes_c1.xml
index f2a4eab..c25b1dc 100644
--- a/audio_policy_volumes_c1.xml
+++ b/audio_policy_volumes_c1.xml
@@ -44,7 +44,7 @@
     <volume stream="AUDIO_STREAM_VOICE_CALL" deviceCategory="DEVICE_CATEGORY_EXT_MEDIA"
                                              ref="DEFAULT_MEDIA_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_VOICE_CALL" deviceCategory="DEVICE_CATEGORY_HEARING_AID"
-                                             ref="DEFAULT_HEARING_AID_VOLUME_CURVE"/>
+                                             ref="DEFAULT_NON_MUTABLE_HEARING_AID_VOLUME_CURVE"/>
     <volume stream="AUDIO_STREAM_SYSTEM" deviceCategory="DEVICE_CATEGORY_HEADSET">
         <point>1,-3000</point>
         <point>33,-2600</point>
diff --git a/blueline/overlay/frameworks/base/core/res/res/values/config.xml b/blueline/overlay/frameworks/base/core/res/res/values/config.xml
index dd900c5..37a77cc 100755
--- a/blueline/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/blueline/overlay/frameworks/base/core/res/res/values/config.xml
@@ -134,23 +134,26 @@
          backlight values -->
     <bool name="config_displayBrightnessBucketsInDoze">true</bool>
 
-    <!-- Default screen brightness setting.
-         Must be in the range specified by minimum and maximum. -->
-    <integer name="config_screenBrightnessSettingDefault">98</integer>
-
     <!-- Default screen brightness for VR setting. Default value: 0x1A0 for EVT2. -->
     <!-- 8 bit brightness level of 111 corresponds to the 10 bit brightness level of 0x1A0 on EVT2. -->
     <integer name="config_screenBrightnessForVrSettingDefault">111</integer>
     <integer name="config_screenBrightnessForVrSettingMinimum">111</integer>
     <integer name="config_screenBrightnessForVrSettingMaximum">111</integer>
 
-    <!-- Minimum screen brightness setting allowed by the power manager.
-         The user is forbidden from setting the brightness below this level. -->
-    <integer name="config_screenBrightnessSettingMinimum">1</integer>
+    <!-- Minimum screen brightness setting allowed by power manager.
+         The user is forbidden from setting the brightness below this level.
+         Equivalent to 1/255. -->
+    <item name="config_screenBrightnessSettingMinimumFloat" format="float" type="dimen">0.0</item>
 
-    <!-- Maximum screen brightness setting allowed by the power manager.
-         The user is forbidden from setting the brightness above this level. -->
-    <integer name="config_screenBrightnessSettingMaximum">255</integer>
+    <!-- Maximum screen brightness allowed by the power manager.
+    The user is forbidden from setting the brightness above this level. -->
+    <item name="config_screenBrightnessSettingMaximumFloat" format="float" type="dimen">1.0</item>
+
+    <!-- Default screen brightness setting.
+         Must be in the range specified by minimum and maximum.
+         Equivalent to 98/255 (default for this device)    -->
+    <item name="config_screenBrightnessSettingDefaultFloat" format="float" type="dimen">0.38188976378</item>
+
 
     <!-- An array describing the screen's backlight values corresponding to the brightness
          values in the config_screenBrightnessNits array.
diff --git a/blueline/overlay_packages/SettingsOverlayG013A/Android.bp b/blueline/overlay_packages/SettingsOverlayG013A/Android.bp
new file mode 100644
index 0000000..b6a76e6
--- /dev/null
+++ b/blueline/overlay_packages/SettingsOverlayG013A/Android.bp
@@ -0,0 +1,4 @@
+runtime_resource_overlay {
+    name: "SettingsOverlayG013A",
+    product_specific: true,
+}
\ No newline at end of file
diff --git a/blueline/overlay_packages/SettingsOverlayG013A/AndroidManifest.xml b/blueline/overlay_packages/SettingsOverlayG013A/AndroidManifest.xml
new file mode 100644
index 0000000..10ea437
--- /dev/null
+++ b/blueline/overlay_packages/SettingsOverlayG013A/AndroidManifest.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.settings.overlay.g013a">
+    <application android:hasCode="false" />
+    <overlay android:targetPackage="com.android.settings"
+             android:requiredSystemPropertyName="ro.boot.hardware.sku"
+             android:requiredSystemPropertyValue="G013A"
+             android:isStatic="true" />
+</manifest>
\ No newline at end of file
diff --git a/blueline/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013a.png b/blueline/overlay_packages/SettingsOverlayG013A/res/drawable/regulatory_info.png
similarity index 100%
rename from blueline/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013a.png
rename to blueline/overlay_packages/SettingsOverlayG013A/res/drawable/regulatory_info.png
Binary files differ
diff --git a/blueline/overlay_packages/SettingsOverlayG013B/Android.bp b/blueline/overlay_packages/SettingsOverlayG013B/Android.bp
new file mode 100644
index 0000000..cf4dad7
--- /dev/null
+++ b/blueline/overlay_packages/SettingsOverlayG013B/Android.bp
@@ -0,0 +1,4 @@
+runtime_resource_overlay {
+    name: "SettingsOverlayG013B",
+    product_specific: true,
+}
\ No newline at end of file
diff --git a/blueline/overlay_packages/SettingsOverlayG013B/AndroidManifest.xml b/blueline/overlay_packages/SettingsOverlayG013B/AndroidManifest.xml
new file mode 100644
index 0000000..0902d09
--- /dev/null
+++ b/blueline/overlay_packages/SettingsOverlayG013B/AndroidManifest.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.settings.overlay.g013b">
+    <application android:hasCode="false" />
+    <overlay android:targetPackage="com.android.settings"
+             android:requiredSystemPropertyName="ro.boot.hardware.sku"
+             android:requiredSystemPropertyValue="G013B"
+             android:isStatic="true" />
+</manifest>
\ No newline at end of file
diff --git a/blueline/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013b.png b/blueline/overlay_packages/SettingsOverlayG013B/res/drawable/regulatory_info.png
similarity index 100%
rename from blueline/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013b.png
rename to blueline/overlay_packages/SettingsOverlayG013B/res/drawable/regulatory_info.png
Binary files differ
diff --git a/component-overrides.xml b/component-overrides.xml
new file mode 100644
index 0000000..bb3419d
--- /dev/null
+++ b/component-overrides.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<config>
+    <component-override package="com.android.bluetooth" >
+        <component class=".sap.SapService" enabled="true" />
+    </component-override>
+</config>
\ No newline at end of file
diff --git a/crosshatch/overlay/frameworks/base/core/res/res/values/config.xml b/crosshatch/overlay/frameworks/base/core/res/res/values/config.xml
index 8f41c9e..2501aff 100755
--- a/crosshatch/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/crosshatch/overlay/frameworks/base/core/res/res/values/config.xml
@@ -151,6 +151,23 @@
          The user is forbidden from setting the brightness above this level. -->
     <integer name="config_screenBrightnessSettingMaximum">255</integer>
 
+    <!-- Minimum screen brightness setting allowed by power manager.
+        The user is forbidden from setting the brightness below this level.
+        Equivalent to 1/255. -->
+    <item name="config_screenBrightnessSettingMinimumFloat" format="float" type="dimen">0.0</item>
+
+    <!-- Maximum screen brightness allowed by the power manager.
+         The user is forbidden from setting the brightness above this level.
+         This value is a fraction between 3.5% and 100%. -->
+    <item name="config_screenBrightnessSettingMaximumFloat" format="float" type="dimen">1.0</item>
+
+    <!-- Default screen brightness setting.
+         Must be in the range specified by minimum and maximum.
+         This value is a fraction between 3.5% and 100%.
+         Equivalent to 98/255 (default for this device)    -->
+    <item name="config_screenBrightnessSettingDefaultFloat" format="float" type="dimen">0.38188976378</item>
+
+
     <!-- An array describing the screen's backlight values corresponding to the brightness
          values in the config_screenBrightnessNits array.
 
diff --git a/crosshatch/overlay_packages/SettingsOverlayG013C/Android.bp b/crosshatch/overlay_packages/SettingsOverlayG013C/Android.bp
new file mode 100644
index 0000000..5dcbc04
--- /dev/null
+++ b/crosshatch/overlay_packages/SettingsOverlayG013C/Android.bp
@@ -0,0 +1,4 @@
+runtime_resource_overlay {
+    name: "SettingsOverlayG013C",
+    product_specific: true,
+}
\ No newline at end of file
diff --git a/crosshatch/overlay_packages/SettingsOverlayG013C/AndroidManifest.xml b/crosshatch/overlay_packages/SettingsOverlayG013C/AndroidManifest.xml
new file mode 100644
index 0000000..04c4ade
--- /dev/null
+++ b/crosshatch/overlay_packages/SettingsOverlayG013C/AndroidManifest.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.settings.overlay.g013c">
+    <application android:hasCode="false" />
+    <overlay android:targetPackage="com.android.settings"
+             android:requiredSystemPropertyName="ro.boot.hardware.sku"
+             android:requiredSystemPropertyValue="G013C"
+             android:isStatic="true" />
+</manifest>
\ No newline at end of file
diff --git a/crosshatch/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013c.png b/crosshatch/overlay_packages/SettingsOverlayG013C/res/drawable/regulatory_info.png
similarity index 100%
rename from crosshatch/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013c.png
rename to crosshatch/overlay_packages/SettingsOverlayG013C/res/drawable/regulatory_info.png
Binary files differ
diff --git a/crosshatch/overlay_packages/SettingsOverlayG013D/Android.bp b/crosshatch/overlay_packages/SettingsOverlayG013D/Android.bp
new file mode 100644
index 0000000..cee7d1b
--- /dev/null
+++ b/crosshatch/overlay_packages/SettingsOverlayG013D/Android.bp
@@ -0,0 +1,4 @@
+runtime_resource_overlay {
+    name: "SettingsOverlayG013D",
+    product_specific: true,
+}
\ No newline at end of file
diff --git a/crosshatch/overlay_packages/SettingsOverlayG013D/AndroidManifest.xml b/crosshatch/overlay_packages/SettingsOverlayG013D/AndroidManifest.xml
new file mode 100644
index 0000000..08e37f5
--- /dev/null
+++ b/crosshatch/overlay_packages/SettingsOverlayG013D/AndroidManifest.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.settings.overlay.g013d">
+    <application android:hasCode="false" />
+    <overlay android:targetPackage="com.android.settings"
+             android:requiredSystemPropertyName="ro.boot.hardware.sku"
+             android:requiredSystemPropertyValue="G013D"
+             android:isStatic="true" />
+</manifest>
\ No newline at end of file
diff --git a/crosshatch/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013d.png b/crosshatch/overlay_packages/SettingsOverlayG013D/res/drawable/regulatory_info.png
similarity index 100%
rename from crosshatch/overlay/packages/apps/Settings/res/drawable/regulatory_info_g013d.png
rename to crosshatch/overlay_packages/SettingsOverlayG013D/res/drawable/regulatory_info.png
Binary files differ
diff --git a/device-blueline.mk b/device-blueline.mk
index f0f2f6d..0b3faba 100644
--- a/device-blueline.mk
+++ b/device-blueline.mk
@@ -20,6 +20,15 @@
 
 DEVICE_PACKAGE_OVERLAYS += device/google/crosshatch/blueline/overlay
 
+# SKU specific RROs
+PRODUCT_PACKAGES += \
+    SettingsOverlayG013A \
+    SettingsOverlayG013B \
+
+# Setup wizard overlay packages for ActiveEdge
+PRODUCT_PACKAGES += \
+    PixelSetupWizardOverlayActiveEdge \
+
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/init.insmod.blueline.cfg:$(TARGET_COPY_OUT_VENDOR)/etc/init.insmod.cfg
 
@@ -30,6 +39,15 @@
     $(LOCAL_PATH)/audio_platform_info_tavil_b1.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_platform_info_tavil_b1.xml
 
 PRODUCT_COPY_FILES += \
-    device/google/crosshatch/nfc/libnfc-nxp.blueline.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp.conf
+    device/google/crosshatch/nfc/libnfc-nxp.blueline.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp.conf \
+    device/google/crosshatch/nfc/libnfc-nxp.blueline.uicc.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp-G013A.conf \
+    device/google/crosshatch/nfc/libnfc-nxp.blueline.ese.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp-G013B.conf
 
 PRODUCT_PRODUCT_PROPERTIES += ro.com.google.ime.height_ratio=1.2
+
+# Enable iorapd perfetto tracing for app starts
+PRODUCT_PRODUCT_PROPERTIES += \
+    iorapd.perfetto.enable=true
+# Enable iorapd readahead for app starts
+PRODUCT_PRODUCT_PROPERTIES += \
+    iorapd.readahead.enable=true
diff --git a/device-common.mk b/device-common.mk
index f0618a1..610689c 100644
--- a/device-common.mk
+++ b/device-common.mk
@@ -21,6 +21,9 @@
 # define hardware platform
 PRODUCT_PLATFORM := sdm845
 
+# Enable updating of APEXes
+$(call inherit-product, $(SRC_TARGET_DIR)/product/updatable_apex.mk)
+
 include device/google/crosshatch/device.mk
 
 # Audio fluence, ns, aec property, voice volume steps
@@ -82,18 +85,6 @@
 # A low number, like 48, might increase power consumption or stress the system.
 PRODUCT_PROPERTY_OVERRIDES += aaudio.hw_burst_min_usec=2000
 
-# Set lmkd options
-PRODUCT_PRODUCT_PROPERTIES += \
-    ro.lmk.low=1001 \
-    ro.lmk.medium=800 \
-    ro.lmk.critical=0 \
-    ro.lmk.critical_upgrade=false \
-    ro.lmk.upgrade_pressure=100 \
-    ro.lmk.downgrade_pressure=100 \
-    ro.lmk.kill_heaviest_task=true \
-    ro.lmk.kill_timeout_ms=100 \
-    ro.lmk.use_minfree_levels=true \
-
 # A2DP offload enabled for compilation
 AUDIO_FEATURE_ENABLED_A2DP_OFFLOAD := true
 
diff --git a/device-crosshatch.mk b/device-crosshatch.mk
index 502996c..44afb3b 100644
--- a/device-crosshatch.mk
+++ b/device-crosshatch.mk
@@ -20,6 +20,15 @@
 
 DEVICE_PACKAGE_OVERLAYS += device/google/crosshatch/crosshatch/overlay
 
+# SKU specific RROs
+PRODUCT_PACKAGES += \
+    SettingsOverlayG013C \
+    SettingsOverlayG013D \
+
+# Setup wizard overlay packages for ActiveEdge
+PRODUCT_PACKAGES += \
+    PixelSetupWizardOverlayActiveEdge \
+
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/init.insmod.crosshatch.cfg:$(TARGET_COPY_OUT_VENDOR)/etc/init.insmod.cfg
 
@@ -30,7 +39,17 @@
     $(LOCAL_PATH)/audio_platform_info_tavil_c1.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_platform_info_tavil_c1.xml
 
 PRODUCT_COPY_FILES += \
-    device/google/crosshatch/nfc/libnfc-nxp.crosshatch.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp.conf
+    device/google/crosshatch/nfc/libnfc-nxp.crosshatch.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp.conf \
+    device/google/crosshatch/nfc/libnfc-nxp.crosshatch.uicc.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp-G013C.conf \
+    device/google/crosshatch/nfc/libnfc-nxp.crosshatch.ese.conf:$(TARGET_COPY_OUT_VENDOR)/etc/libnfc-nxp-G013D.conf
 
 PRODUCT_PACKAGES += \
     NoCutoutOverlay
+
+# Enable iorapd prefetching by default for crosshatch targets
+PRODUCT_PRODUCT_PROPERTIES += \
+    iorapd.readahead.enable=true
+
+# Disable Camera Pinning by default for crosshatch targets
+PRODUCT_PRODUCT_PROPERTIES += \
+    pinner.pin_camera=false
diff --git a/device.mk b/device.mk
index 622772b..d53911e 100644
--- a/device.mk
+++ b/device.mk
@@ -17,6 +17,7 @@
 PRODUCT_SOONG_NAMESPACES += \
     device/google/crosshatch \
     hardware/google/av \
+    hardware/google/camera \
     hardware/google/interfaces \
     hardware/google/pixel \
     hardware/qcom/sdm845 \
@@ -38,6 +39,7 @@
 
 PRODUCT_COPY_FILES += \
     device/google/crosshatch/default-permissions.xml:$(TARGET_COPY_OUT_VENDOR)/etc/default-permissions/default-permissions.xml \
+    device/google/crosshatch/component-overrides.xml:$(TARGET_COPY_OUT_VENDOR)/etc/sysconfig/component-overrides.xml \
     frameworks/native/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
     frameworks/native/data/etc/android.software.verified_boot.xml:$(TARGET_COPY_OUT_PRODUCT)/etc/permissions/android.software.verified_boot.xml
 
@@ -46,12 +48,16 @@
     ro.control_privapp_permissions=enforce
 
 # Enable on-access verification of priv apps. This requires fs-verity support in kernel.
-PRODUCT_PRODUCT_PROPERTIES += \
+PRODUCT_PROPERTY_OVERRIDES += \
     ro.apk_verity.mode=1
 
 PRODUCT_PACKAGES += \
     messaging
 
+ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
+PRODUCT_PACKAGES += chre_test_client
+endif
+
 LOCAL_PATH := device/google/crosshatch
 SRC_MEDIA_HAL_DIR := hardware/qcom/media/sdm845
 SRC_DISPLAY_HAL_DIR := hardware/qcom/display/sdm845
@@ -60,9 +66,6 @@
 
 $(call inherit-product, $(LOCAL_PATH)/utils.mk)
 
-# Installs gsi keys into ramdisk, to boot a GSI with verified boot.
-$(call inherit-product, $(SRC_TARGET_DIR)/product/gsi_keys.mk)
-
 # Installs gsi keys into ramdisk, to boot a developer GSI with verified boot.
 $(call inherit-product, $(SRC_TARGET_DIR)/product/developer_gsi_keys.mk)
 
@@ -84,7 +87,6 @@
 PRODUCT_COPY_FILES += \
     $(LOCAL_KERNEL):kernel \
     $(LOCAL_PATH)/init.recovery.hardware.rc:recovery/root/init.recovery.$(PRODUCT_PLATFORM).rc \
-    $(LOCAL_PATH)/init.hardware.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).rc \
     $(LOCAL_PATH)/init.hardware.usb.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).usb.rc \
     $(LOCAL_PATH)/ueventd.hardware.rc:$(TARGET_COPY_OUT_VENDOR)/ueventd.rc \
     $(LOCAL_PATH)/init.power.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).power.rc \
@@ -106,6 +108,18 @@
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/init.edge_sense.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.edge_sense.sh
 
+ifeq (,$(filter %_xr,$(TARGET_PRODUCT)))
+  PRODUCT_COPY_FILES += \
+    $(LOCAL_PATH)/init.hardware.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).rc
+else
+  # XR variants for Pixel devices (e.g. blueline_xr and crosshatch_xr). Note
+  # that this is a nonintrusive way to add XR-specific init.rc entries, as the
+  # init.hardware.xr.rc file imports the original init.hardware.rc file.
+  PRODUCT_COPY_FILES += \
+    $(LOCAL_PATH)/init.hardware.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).common.rc \
+    $(LOCAL_PATH)/init.hardware.xr.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).rc
+endif
+
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
   PRODUCT_COPY_FILES += \
       $(LOCAL_PATH)/init.hardware.diag.rc.userdebug:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.$(PRODUCT_PLATFORM).diag.rc
@@ -139,6 +153,10 @@
     update_engine \
     update_verifier
 
+# Resume on Reboot support
+PRODUCT_PACKAGES += \
+    android.hardware.rebootescrow-service.citadel
+
 # Use Sdcardfs
 PRODUCT_PRODUCT_PROPERTIES += \
     ro.sys.sdcardfs=1
@@ -154,26 +172,6 @@
 PRODUCT_PROPERTY_OVERRIDES += \
     ro.cp_system_other_odex=1
 
-AB_OTA_PARTITIONS += \
-    boot \
-    system \
-    vbmeta \
-    dtbo
-
-# Skip product partition for nodap build
-ifeq ($(filter %_nodap,$(TARGET_PRODUCT)),)
-AB_OTA_PARTITIONS += \
-    product
-endif
-
-ifneq ($(filter %_mainline,$(TARGET_PRODUCT)),)
-# TODO (b/136154856) product_services partition is removed from
-# AB_OTA_PARTITIONS. Instead, we will add system_ext once it is ready.
-AB_OTA_PARTITIONS += \
-    vbmeta_system \
-
-endif
-
 AB_OTA_POSTINSTALL_CONFIG += \
     RUN_POSTINSTALL_system=true \
     POSTINSTALL_PATH_system=system/bin/otapreopt_script \
@@ -208,6 +206,7 @@
     frameworks/native/data/etc/android.hardware.camera.raw.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.camera.raw.xml\
     frameworks/native/data/etc/android.hardware.bluetooth.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.bluetooth.xml \
     frameworks/native/data/etc/android.hardware.bluetooth_le.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.bluetooth_le.xml \
+    frameworks/native/data/etc/android.hardware.reboot_escrow.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.reboot_escrow.xml \
     frameworks/native/data/etc/android.hardware.sensor.accelerometer.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.accelerometer.xml \
     frameworks/native/data/etc/android.hardware.sensor.assist.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.assist.xml \
     frameworks/native/data/etc/android.hardware.sensor.compass.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.compass.xml \
@@ -218,6 +217,7 @@
     frameworks/native/data/etc/android.hardware.sensor.stepcounter.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.stepcounter.xml \
     frameworks/native/data/etc/android.hardware.sensor.stepdetector.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.stepdetector.xml \
     frameworks/native/data/etc/android.hardware.sensor.hifi_sensors.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.sensor.hifi_sensors.xml \
+    frameworks/native/data/etc/android.hardware.context_hub.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.context_hub.xml \
     frameworks/native/data/etc/android.hardware.location.gps.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.location.gps.xml \
     frameworks/native/data/etc/android.hardware.telephony.gsm.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.telephony.gsm.xml \
     frameworks/native/data/etc/android.hardware.telephony.cdma.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.telephony.cdma.xml \
@@ -235,18 +235,18 @@
     frameworks/native/data/etc/android.hardware.nfc.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.nfc.xml \
     frameworks/native/data/etc/android.hardware.nfc.hce.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.nfc.hce.xml \
     frameworks/native/data/etc/android.hardware.nfc.hcef.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.nfc.hcef.xml \
+    frameworks/native/data/etc/com.nxp.mifare.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/com.nxp.mifare.xml \
     frameworks/native/data/etc/android.hardware.vr.headtracking-0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vr.headtracking.xml \
     frameworks/native/data/etc/android.hardware.vr.high_performance.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vr.high_performance.xml \
     frameworks/native/data/etc/android.hardware.vulkan.level-1.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.level.xml \
     frameworks/native/data/etc/android.hardware.vulkan.compute-0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.compute.xml \
     frameworks/native/data/etc/android.hardware.vulkan.version-1_1.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.vulkan.version.xml \
+    frameworks/native/data/etc/android.software.vulkan.deqp.level-2020-03-01.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.vulkan.deqp.level.xml \
     frameworks/native/data/etc/android.hardware.telephony.carrierlock.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.telephony.carrierlock.xml \
+    frameworks/native/data/etc/android.hardware.se.omapi.uicc.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.se.omapi.uicc.xml \
     frameworks/native/data/etc/android.hardware.strongbox_keystore.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.strongbox_keystore.xml \
     frameworks/native/data/etc/android.software.ipsec_tunnels.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.ipsec_tunnels.xml \
 
-# power HAL
-PRODUCT_PACKAGES += \
-    android.hardware.power@1.3-service.pixel-libperfmgr
 
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/powerhint.json:$(TARGET_COPY_OUT_VENDOR)/etc/powerhint.json
@@ -260,6 +260,7 @@
     persist.audio.fluence.voicerec=false \
     ro.config.vc_call_vol_steps=7 \
     ro.config.media_vol_steps=25 \
+    vendor.audio.offload.gapless.enabled=true \
 
 # MaxxAudio effect and add rotation monitor
 PRODUCT_PROPERTY_OVERRIDES += \
@@ -347,10 +348,6 @@
     $(LOCAL_PATH)/wifi_concurrency_cfg.txt:$(TARGET_COPY_OUT_VENDOR)/etc/wifi/wifi_concurrency_cfg.txt \
     $(LOCAL_PATH)/WCNSS_qcom_cfg.ini:$(TARGET_COPY_OUT_VENDOR)/firmware/wlan/qca_cld/WCNSS_qcom_cfg.ini \
 
-#ipacm configuration files
-PRODUCT_COPY_FILES += \
-    hardware/qcom/data/ipacfg-mgr/msm8998/ipacm/src/IPACM_cfg.xml:$(TARGET_COPY_OUT_VENDOR)/etc/IPACM_cfg.xml
-
 PRODUCT_PACKAGES += \
     hwcomposer.sdm845 \
     android.hardware.graphics.composer@2.3-service \
@@ -408,8 +405,8 @@
 PRODUCT_PACKAGES += \
     android.hardware.drm@1.0-impl \
     android.hardware.drm@1.0-service \
-    android.hardware.drm@1.2-service.clearkey \
-    android.hardware.drm@1.2-service.widevine
+    android.hardware.drm@1.3-service.clearkey \
+    android.hardware.drm@1.3-service.widevine
 
 # NFC and Secure Element packages
 PRODUCT_PACKAGES += \
@@ -425,8 +422,10 @@
 PRODUCT_COPY_FILES += \
     frameworks/native/data/etc/android.hardware.nfc.uicc.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013A/android.hardware.nfc.uicc.xml \
     frameworks/native/data/etc/android.hardware.nfc.ese.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013B/android.hardware.nfc.ese.xml \
+    frameworks/native/data/etc/android.hardware.se.omapi.ese.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013B/android.hardware.se.omapi.ese.xml \
     frameworks/native/data/etc/android.hardware.nfc.uicc.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013C/android.hardware.nfc.uicc.xml \
-    frameworks/native/data/etc/android.hardware.nfc.ese.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013D/android.hardware.nfc.ese.xml
+    frameworks/native/data/etc/android.hardware.nfc.ese.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013D/android.hardware.nfc.ese.xml \
+    frameworks/native/data/etc/android.hardware.se.omapi.ese.xml:$(TARGET_COPY_OUT_VENDOR)/odm/etc/permissions/sku_G013D/android.hardware.se.omapi.ese.xml
 
 PRODUCT_COPY_FILES += \
     device/google/crosshatch/nfc/com.google.hardware.pixel.japan.xml:$(TARGET_COPY_OUT_ODM)/etc/permissions/sku_G013B/com.google.hardware.pixel.japan.xml \
@@ -452,6 +451,10 @@
 PRODUCT_PROPERTY_OVERRIDES += \
     debug.media.codec2=2 \
 
+# Disable OMX
+PRODUCT_PROPERTY_OVERRIDES += \
+    vendor.media.omx=0 \
+
 # Create input surface on the framework side
 PRODUCT_PROPERTY_OVERRIDES += \
     debug.stagefright.c2inputsurface=-1 \
@@ -467,17 +470,21 @@
     android.hardware.camera.provider@2.4-service_64 \
     camera.device@3.2-impl \
     camera.sdm845 \
-    libgooglecamerahal \
-    libgoogle_camera_hal_tests \
     libqomx_core \
     libmmjpeg_interface \
     libmmcamera_interface \
     libcameradepthcalibrator
 
+# Google Camera HAL test libraries in debug builds
+PRODUCT_PACKAGES_DEBUG += \
+    libgoogle_camera_hal_proprietary_tests \
+    libgoogle_camera_hal_tests.vendor
+
 PRODUCT_PACKAGES += \
     sensors.$(PRODUCT_HARDWARE) \
-    android.hardware.sensors@1.0-impl \
-    android.hardware.sensors@1.0-service
+    android.hardware.sensors@2.0-impl \
+    android.hardware.sensors@2.0-service \
+    android.hardware.sensors@2.0-service.rc
 
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/sensors/hals.conf:vendor/etc/sensors/hals.conf
@@ -492,8 +499,7 @@
 
 # Context hub HAL
 PRODUCT_PACKAGES += \
-    android.hardware.contexthub@1.0-impl.generic \
-    android.hardware.contexthub@1.0-service
+    android.hardware.contexthub@1.1-service.generic
 
 # Boot control HAL
 PRODUCT_PACKAGES += \
@@ -511,7 +517,7 @@
 
 # Wireless Charger HAL
 PRODUCT_PACKAGES += \
-    vendor.google.wireless_charger@1.1
+    vendor.google.wireless_charger@1.2
 
 ENABLE_VENDOR_RIL_SERVICE := true
 
@@ -536,7 +542,8 @@
 PRODUCT_PACKAGES += \
     android.hardware.wifi@1.0-service \
     wificond \
-    libwpa_client
+    libwpa_client \
+    WifiOverlay
 
 LIB_NL := libnl_2
 PRODUCT_PACKAGES += $(LIB_NL)
@@ -559,9 +566,8 @@
     audio.bluetooth.default
 
 PRODUCT_PACKAGES += \
-    android.hardware.audio@5.0-impl:32 \
-    android.hardware.audio.effect@5.0-impl:32 \
-    android.hardware.broadcastradio@1.0-impl \
+    android.hardware.audio@6.0-impl:32 \
+    android.hardware.audio.effect@6.0-impl:32 \
     android.hardware.soundtrigger@2.2-impl \
     android.hardware.bluetooth.audio@2.0-impl \
     android.hardware.audio@2.0-service
@@ -624,8 +630,15 @@
 PRODUCT_PROPERTY_OVERRIDES += \
     persist.vendor.sys.ssr.restart_level=modem,slpi,adsp
 
+ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
+# Sensor debug flag
+PRODUCT_PROPERTY_OVERRIDES += \
+    persist.vendor.debug.ash.logger=0 \
+    persist.vendor.debug.ash.logger.time=0
+endif
+
 # setup dalvik vm configs
-$(call inherit-product, frameworks/native/build/phone-xhdpi-2048-dalvik-heap.mk)
+$(call inherit-product, frameworks/native/build/phone-xhdpi-4096-dalvik-heap.mk)
 
 ifneq ($(filter %_mainline,$(TARGET_PRODUCT)),)
 PRODUCT_COPY_FILES += \
@@ -644,15 +657,19 @@
 PRODUCT_PACKAGES += \
     charger_res_images
 
-# b/36703476
-# Set default log size on userdebug/eng build to 1M
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
-PRODUCT_PROPERTY_OVERRIDES += ro.logd.size=1M
+# b/36703476: Set default log size to 1M
+PRODUCT_PROPERTY_OVERRIDES += \
+  ro.logd.size=1M
+# b/114766334: persist all logs by default rotating on 30 files of 1MiB
+PRODUCT_PROPERTY_OVERRIDES += \
+  logd.logpersistd=logcatd \
+  logd.logpersistd.size=30
 endif
 
 # Dumpstate HAL
 PRODUCT_PACKAGES += \
-    android.hardware.dumpstate@1.0-service.crosshatch
+    android.hardware.dumpstate@1.1-service.crosshatch
 
 # Citadel
 PRODUCT_PACKAGES += \
@@ -661,7 +678,8 @@
     android.hardware.authsecret@1.0-service.citadel \
     android.hardware.oemlock@1.0-service.citadel \
     android.hardware.weaver@1.0-service.citadel \
-    android.hardware.keymaster@4.0-service.citadel \
+    android.hardware.keymaster@4.1-service.citadel \
+    android.hardware.identity@1.0-service.citadel \
     wait_for_strongbox
 
 # Citadel debug stuff
@@ -675,20 +693,21 @@
 PRODUCT_PACKAGES += \
     vndk-sp
 
-
-PRODUCT_ENFORCE_RRO_TARGETS := *
-
 # Override heap growth limit due to high display density on device
 PRODUCT_PROPERTY_OVERRIDES += \
     dalvik.vm.heapgrowthlimit=256m
 
 PRODUCT_PACKAGES += \
-    ipacm
+    ipacm \
+    IPACM_cfg.xml
 
 #Set default CDMA subscription to RUIM
 PRODUCT_PROPERTY_OVERRIDES += \
     ro.telephony.default_cdma_sub=0
 
+# Set network mode to Global by default and no DSDS/DSDA
+PRODUCT_PROPERTY_OVERRIDES += ro.telephony.default_network=10
+
 # Set display color mode to Automatic by default
 PRODUCT_PROPERTY_OVERRIDES += \
     persist.sys.sf.color_saturation=1.0 \
@@ -698,20 +717,12 @@
 PRODUCT_COPY_FILES += \
     device/google/crosshatch/permissions/com.google.hardware.camera.easel_2018.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/com.google.hardware.camera.easel_2018.xml
 
-# ConfirmationUI HAL
-PRODUCT_PACKAGES += \
-    android.hardware.confirmationui@1.0-service-crosshatch
-
 # Fingerprint
 PRODUCT_PACKAGES += \
     android.hardware.biometrics.fingerprint@2.1-service.fpc
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/init.fingerprint.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.fingerprint.sh \
 
-# Reliability reporting
-PRODUCT_PACKAGES += \
-    pixelstats-vendor
-
 PRODUCT_COPY_FILES += \
     frameworks/native/data/etc/android.hardware.fingerprint.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.fingerprint.xml
 
@@ -771,7 +782,8 @@
 
 # Keymaster configuration
 PRODUCT_COPY_FILES += \
-    frameworks/native/data/etc/android.software.device_id_attestation.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.device_id_attestation.xml
+    frameworks/native/data/etc/android.software.device_id_attestation.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.software.device_id_attestation.xml \
+     frameworks/native/data/etc/android.hardware.device_unique_attestation.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.device_unique_attestation.xml
 
 # Enable modem logging
 PRODUCT_PROPERTY_OVERRIDES += \
@@ -781,10 +793,13 @@
 # Enable modem logging for debug
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
 PRODUCT_PROPERTY_OVERRIDES += \
-    persist.vendor.sys.modem.diag.mdlog=true \
-    persist.vendor.sys.modem.diag.mdlog_br_num=5
+    persist.vendor.sys.modem.diag.mdlog=true
 else
+PRODUCT_PROPERTY_OVERRIDES += \
+    persist.vendor.sys.modem.diag.mdlog=false
 endif
+PRODUCT_PROPERTY_OVERRIDES += \
+    persist.vendor.sys.modem.diag.mdlog_br_num=5
 
 # Enable tcpdump_logger on userdebug and eng
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
@@ -828,7 +843,7 @@
 
 # Increment the SVN for any official public releases
 PRODUCT_PROPERTY_OVERRIDES += \
-    ro.vendor.build.svn=35
+    ro.vendor.build.svn=37
 
 PRODUCT_PRODUCT_PROPERTIES += \
     ro.adb.secure=1
@@ -842,10 +857,6 @@
     android.hardware.fastboot@1.0-impl.pixel \
     fastbootd
 
-# Thermal HAL
-PRODUCT_PACKAGES += \
-    android.hardware.thermal@2.0-service.pixel \
-
 PRODUCT_COPY_FILES += \
     $(LOCAL_PATH)/thermal_info_config_$(PRODUCT_HARDWARE).json:$(TARGET_COPY_OUT_VENDOR)/etc/thermal_info_config.json \
     $(LOCAL_PATH)/thermal_info_config_$(PRODUCT_HARDWARE)_evt.json:$(TARGET_COPY_OUT_VENDOR)/etc/thermal_info_config_evt.json
@@ -870,5 +881,18 @@
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.surface_flinger.use_color_management=true
 PRODUCT_DEFAULT_PROPERTY_OVERRIDES += ro.surface_flinger.protected_contents=true
 
+# Vendor verbose logging default property
+ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
 PRODUCT_PROPERTY_OVERRIDES += \
-    ro.apex.updatable=true
+    persist.vendor.verbose_logging_enabled=true
+else
+PRODUCT_PROPERTY_OVERRIDES += \
+    persist.vendor.verbose_logging_enabled=false
+endif
+
+include hardware/google/pixel/pixelstats/device.mk
+include hardware/google/pixel/mm/device_legacy.mk
+include hardware/google/pixel/thermal/device.mk
+
+# power HAL
+-include hardware/google/pixel/power-libperfmgr/aidl/device.mk
diff --git a/device_framework_matrix.xml b/device_framework_matrix.xml
index 258e710..75ed494 100644
--- a/device_framework_matrix.xml
+++ b/device_framework_matrix.xml
@@ -55,7 +55,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>vendor.google.radioext</name>
-        <version>1.1</version>
+        <version>1.2</version>
         <interface>
             <name>IRadioExt</name>
             <instance>default</instance>
@@ -63,7 +63,7 @@
     </hal>
     <hal format="hidl" optional="true">
         <name>vendor.google.wireless_charger</name>
-        <version>1.1</version>
+        <version>1.2</version>
         <interface>
             <name>IWirelessCharger</name>
             <instance>default</instance>
@@ -174,19 +174,10 @@
             <instance>default</instance>
         </interface>
       </hal>
-    <hal format="hidl">
-        <name>android.hardware.wifi.supplicant</name>
-        <transport>hwbinder</transport>
-        <version>1.2</version>
-        <interface>
-            <name>ISupplicant</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
     <hal format="hidl" optional="true">
         <name>vendor.google.wifi_ext</name>
         <transport>hwbinder</transport>
-        <version>1.0</version>
+        <version>1.1</version>
         <interface>
             <name>IWifiExt</name>
             <instance>default</instance>
diff --git a/dumpstate/Android.mk b/dumpstate/Android.mk
index 2776e89..a5cb24b 100644
--- a/dumpstate/Android.mk
+++ b/dumpstate/Android.mk
@@ -16,8 +16,8 @@
 
 LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)
-LOCAL_MODULE := android.hardware.dumpstate@1.0-service.crosshatch
-LOCAL_INIT_RC := android.hardware.dumpstate@1.0-service.crosshatch.rc
+LOCAL_MODULE := android.hardware.dumpstate@1.1-service.crosshatch
+LOCAL_INIT_RC := android.hardware.dumpstate@1.1-service.crosshatch.rc
 LOCAL_MODULE_RELATIVE_PATH := hw
 
 LOCAL_SRC_FILES := \
@@ -26,12 +26,11 @@
 
 LOCAL_SHARED_LIBRARIES := \
     android.hardware.dumpstate@1.0 \
+    android.hardware.dumpstate@1.1 \
     libbase \
     libcutils \
     libdumpstateutil \
     libhidlbase \
-    libhidltransport \
-    libhwbinder \
     liblog \
     libutils
 
diff --git a/dumpstate/DumpstateDevice.cpp b/dumpstate/DumpstateDevice.cpp
index 8df77f1..ae40f70 100755
--- a/dumpstate/DumpstateDevice.cpp
+++ b/dumpstate/DumpstateDevice.cpp
@@ -22,8 +22,10 @@
 #include <android-base/unique_fd.h>
 #include <cutils/properties.h>
 #include <hidl/HidlBinderSupport.h>
+#include <hidl/HidlSupport.h>
 
 #include <log/log.h>
+#include <pthread.h>
 #include <string.h>
 
 #define _SVID_SOURCE
@@ -46,6 +48,10 @@
 #define TCPDUMP_NUMBER_BUGREPORT "persist.vendor.tcpdump.log.br_num"
 #define TCPDUMP_PERSIST_PROPERTY "persist.vendor.tcpdump.log.alwayson"
 
+#define MODEM_EFS_DUMP_PROPERTY "vendor.sys.modem.diag.efsdump"
+
+#define VENDOR_VERBOSE_LOGGING_ENABLED_PROPERTY "persist.vendor.verbose_logging_enabled"
+
 using android::os::dumpstate::CommandOptions;
 using android::os::dumpstate::DumpFileToFd;
 using android::os::dumpstate::PropertiesHelper;
@@ -54,15 +60,15 @@
 namespace android {
 namespace hardware {
 namespace dumpstate {
-namespace V1_0 {
+namespace V1_1 {
 namespace implementation {
 
 #define DIAG_LOG_PREFIX "diag_log_"
 #define TCPDUMP_LOG_PREFIX "tcpdump"
 #define EXTENDED_LOG_PREFIX "extended_log_"
 
-void DumpstateDevice::dumpLogs(int fd, std::string srcDir, std::string destDir,
-                               int maxFileNum, const char *logPrefix) {
+static void dumpLogs(int fd, std::string srcDir, std::string destDir,
+                     int maxFileNum, const char *logPrefix) {
     struct dirent **dirent_list = NULL;
     int num_entries = scandir(srcDir.c_str(),
                               &dirent_list,
@@ -107,34 +113,70 @@
     free(dirent_list);
 }
 
-void DumpstateDevice::dumpModem(int fd, int fdModem)
+static void *dumpModemThread(void *data)
 {
+    long fdModem = (long)data;
+
+    ALOGD("dumpModemThread started\n");
+
     std::string modemLogDir = android::base::GetProperty(MODEM_LOG_LOC_PROPERTY, "");
     if (modemLogDir.empty()) {
         ALOGD("No modem log place is set");
-        return;
+        return NULL;
     }
 
     std::string filePrefix = android::base::GetProperty(MODEM_LOG_PREFIX_PROPERTY, "");
 
     if (filePrefix.empty()) {
         ALOGD("Modem log prefix is not set");
-        return;
+        return NULL;
     }
 
+    sleep(1);
+    ALOGD("Waited modem for 1 second to flush logs");
+
     const std::string modemLogCombined = modemLogDir + "/" + filePrefix + "all.tar";
     const std::string modemLogAllDir = modemLogDir + "/modem_log";
 
-    RunCommandToFd(fd, "MKDIR MODEM LOG", {"/vendor/bin/mkdir", "-p", modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
+    RunCommandToFd(STDOUT_FILENO, "MKDIR MODEM LOG", {"/vendor/bin/mkdir", "-p", modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
+
+    const std::string diagLogDir = "/data/vendor/radio/diag_logs/logs";
+    const std::string diagPoweronLogPath = "/data/vendor/radio/diag_logs/logs/diag_poweron_log.qmdl";
+
+    bool diagLogEnabled = android::base::GetBoolProperty(DIAG_MDLOG_PERSIST_PROPERTY, false);
+
+    if (diagLogEnabled) {
+        bool diagLogStarted = android::base::GetBoolProperty( DIAG_MDLOG_STATUS_PROPERTY, false);
+
+        if (diagLogStarted) {
+            android::base::SetProperty(DIAG_MDLOG_PROPERTY, "false");
+            ALOGD("Stopping diag_mdlog...\n");
+            if (android::base::WaitForProperty(DIAG_MDLOG_STATUS_PROPERTY, "false", std::chrono::seconds(10))) {
+                ALOGD("diag_mdlog exited");
+            } else {
+                ALOGE("Waited mdlog timeout after 10 second");
+            }
+        } else {
+            ALOGD("diag_mdlog is not running");
+        }
+
+        dumpLogs(STDOUT_FILENO, diagLogDir, modemLogAllDir, android::base::GetIntProperty(DIAG_MDLOG_NUMBER_BUGREPORT, 100), DIAG_LOG_PREFIX);
+
+        if (diagLogStarted) {
+            ALOGD("Restarting diag_mdlog...");
+            android::base::SetProperty(DIAG_MDLOG_PROPERTY, "true");
+        }
+    }
+    RunCommandToFd(STDOUT_FILENO, "CP MODEM POWERON LOG", {"/vendor/bin/cp", diagPoweronLogPath.c_str(), modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
 
     if (!PropertiesHelper::IsUserBuild()) {
-        RunCommandToFd(fd, "MODEM RFS INFO", {"/vendor/bin/find /data/vendor/rfs/mpss/OEMFI/"}, CommandOptions::WithTimeout(2).Build());
-        RunCommandToFd(fd, "MODEM DIAG SYSTEM PROPERTIES", {"/vendor/bin/getprop | grep vendor.sys.modem.diag"}, CommandOptions::WithTimeout(2).Build());
+        android::base::SetProperty(MODEM_EFS_DUMP_PROPERTY, "true");
 
-        const std::string diagLogDir = "/data/vendor/radio/diag_logs/logs";
         const std::string tcpdumpLogDir = "/data/vendor/tcpdump_logger/logs";
         const std::string extendedLogDir = "/data/vendor/radio/extended_logs";
         const std::vector<std::string> rilAndNetmgrLogs{
+            "/data/vendor/radio/haldebug_ril0",
+            "/data/vendor/radio/haldebug_ril1",
             "/data/vendor/radio/ril_log0",
             "/data/vendor/radio/ril_log0_old",
             "/data/vendor/radio/ril_log1",
@@ -145,58 +187,31 @@
             "/data/vendor/radio/qmi_fw_log_old",
             "/data/vendor/netmgr/netmgr_log",
             "/data/vendor/netmgr/netmgr_log_old",
+            "/data/vendor/radio/omadm_logs.txt",
             "/data/vendor/radio/power_anomaly_data.txt",
             "/data/vendor/radio/diag_logs/diag_trace.txt",
             "/data/vendor/radio/diag_logs/diag_trace_old.txt",
-            "/data/vendor/radio/diag_logs/logs/diag_poweron_log.qmdl",
             "/data/vendor/radio/metrics_data",
             "/data/vendor/ssrlog/ssr_log.txt",
             "/data/vendor/ssrlog/ssr_log_old.txt",
             "/data/vendor/rfs/mpss/modem_efs",
         };
 
-        bool smlogEnabled = android::base::GetBoolProperty(MODEM_LOGGING_SWITCH, false) && !access("/vendor/bin/smlog_dump", X_OK);
-        bool diagLogEnabled = android::base::GetBoolProperty(DIAG_MDLOG_PERSIST_PROPERTY, false);
         bool tcpdumpEnabled = android::base::GetBoolProperty(TCPDUMP_PERSIST_PROPERTY, false);
-
-        if (smlogEnabled) {
-            RunCommandToFd(fd, "SMLOG DUMP", {"smlog_dump", "-d", "-o", modemLogAllDir.c_str()}, CommandOptions::WithTimeout(10).Build());
-        } else if (diagLogEnabled) {
-            bool diagLogStarted = android::base::GetBoolProperty( DIAG_MDLOG_STATUS_PROPERTY, false);
-
-            if (diagLogStarted) {
-                android::base::SetProperty(DIAG_MDLOG_PROPERTY, "false");
-                ALOGD("Stopping diag_mdlog...\n");
-                if (android::base::WaitForProperty(DIAG_MDLOG_STATUS_PROPERTY, "false", std::chrono::seconds(20))) {
-                    ALOGD("diag_mdlog exited");
-                } else {
-                    ALOGE("Waited mdlog timeout after 20 second");
-                }
-            } else {
-                ALOGD("diag_mdlog is not running");
-            }
-
-            dumpLogs(fd, diagLogDir, modemLogAllDir, android::base::GetIntProperty(DIAG_MDLOG_NUMBER_BUGREPORT, 100), DIAG_LOG_PREFIX);
-
-            if (diagLogStarted) {
-                ALOGD("Restarting diag_mdlog...");
-                android::base::SetProperty(DIAG_MDLOG_PROPERTY, "true");
-            }
-        }
-
         if (tcpdumpEnabled) {
-            dumpLogs(fd, tcpdumpLogDir, modemLogAllDir, android::base::GetIntProperty(TCPDUMP_NUMBER_BUGREPORT, 5), TCPDUMP_LOG_PREFIX);
+            dumpLogs(STDOUT_FILENO, tcpdumpLogDir, modemLogAllDir, android::base::GetIntProperty(TCPDUMP_NUMBER_BUGREPORT, 5), TCPDUMP_LOG_PREFIX);
         }
 
         for (const auto& logFile : rilAndNetmgrLogs) {
-            RunCommandToFd(fd, "CP MODEM LOG", {"/vendor/bin/cp", logFile.c_str(), modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
+            RunCommandToFd(STDOUT_FILENO, "CP MODEM LOG", {"/vendor/bin/cp", logFile.c_str(), modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
         }
 
-        dumpLogs(fd, extendedLogDir, modemLogAllDir, 100, EXTENDED_LOG_PREFIX);
+        dumpLogs(STDOUT_FILENO, extendedLogDir, modemLogAllDir, 100, EXTENDED_LOG_PREFIX);
+        android::base::SetProperty(MODEM_EFS_DUMP_PROPERTY, "false");
     }
 
-    RunCommandToFd(fd, "TAR LOG", {"/vendor/bin/tar", "cvf", modemLogCombined.c_str(), "-C", modemLogAllDir.c_str(), "."}, CommandOptions::WithTimeout(120).Build());
-    RunCommandToFd(fd, "CHG PERM", {"/vendor/bin/chmod", "a+w", modemLogCombined.c_str()}, CommandOptions::WithTimeout(2).Build());
+    RunCommandToFd(STDOUT_FILENO, "TAR LOG", {"/vendor/bin/tar", "cvf", modemLogCombined.c_str(), "-C", modemLogAllDir.c_str(), "."}, CommandOptions::WithTimeout(20).Build());
+    RunCommandToFd(STDOUT_FILENO, "CHG PERM", {"/vendor/bin/chmod", "a+w", modemLogCombined.c_str()}, CommandOptions::WithTimeout(2).Build());
 
     std::vector<uint8_t> buffer(65536);
     android::base::unique_fd fdLog(TEMP_FAILURE_RETRY(open(modemLogCombined.c_str(), O_RDONLY | O_CLOEXEC | O_NONBLOCK)));
@@ -221,8 +236,12 @@
         }
     }
 
-    RunCommandToFd(fd, "RM MODEM DIR", { "/vendor/bin/rm", "-r", modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
-    RunCommandToFd(fd, "RM LOG", { "/vendor/bin/rm", modemLogCombined.c_str()}, CommandOptions::WithTimeout(2).Build());
+    RunCommandToFd(STDOUT_FILENO, "RM MODEM DIR", { "/vendor/bin/rm", "-r", modemLogAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
+    RunCommandToFd(STDOUT_FILENO, "RM LOG", { "/vendor/bin/rm", modemLogCombined.c_str()}, CommandOptions::WithTimeout(2).Build());
+
+    ALOGD("dumpModemThread finished\n");
+
+    return NULL;
 }
 
 static void DumpTouch(int fd) {
@@ -272,9 +291,24 @@
     }
 }
 
+static void DumpSensorLog(int fd) {
+    const std::string logPath = "/data/vendor/sensors/log/sensor_log.txt";
+    const std::string lastlogPath = "/data/vendor/sensors/log/sensor_lastlog.txt";
+
+    if (!access(logPath.c_str(), R_OK)) {
+        DumpFileToFd(fd, "sensor log", logPath);
+    }
+    if (!access(lastlogPath.c_str(), R_OK)) {
+        DumpFileToFd(fd, "sensor lastlog", lastlogPath);
+    }
+}
+
 static void DumpF2FS(int fd) {
     DumpFileToFd(fd, "F2FS", "/sys/kernel/debug/f2fs/status");
-    DumpFileToFd(fd, "F2FS - fragmentation", "/proc/fs/f2fs/dm-6/segment_info");
+    RunCommandToFd(fd, "F2FS - fragmentation", {"/vendor/bin/sh", "-c",
+                       "for d in $(ls /proc/fs/f2fs/); do "
+                       "echo $d: /dev/block/mapper/`ls -l /dev/block/mapper | grep $d | awk '{print $8,$9,$10}'`; "
+                       "cat /proc/fs/f2fs/$d/segment_info; done"});
 }
 
 static void DumpUFS(int fd) {
@@ -332,6 +366,17 @@
 
 // Methods from ::android::hardware::dumpstate::V1_0::IDumpstateDevice follow.
 Return<void> DumpstateDevice::dumpstateBoard(const hidl_handle& handle) {
+    // Ignore return value, just return an empty status.
+    dumpstateBoard_1_1(handle, DumpstateMode::DEFAULT, 30 * 1000 /* timeoutMillis */);
+    return Void();
+}
+
+// Methods from ::android::hardware::dumpstate::V1_1::IDumpstateDevice follow.
+Return<DumpstateStatus> DumpstateDevice::dumpstateBoard_1_1(const hidl_handle& handle,
+                                                            const DumpstateMode mode,
+                                                            const uint64_t timeoutMillis) {
+    // Unused arguments.
+    (void) timeoutMillis;
     // Exit when dump is completed since this is a lazy HAL.
     addPostCommandTask([]() {
         exit(0);
@@ -339,16 +384,46 @@
 
     if (handle == nullptr || handle->numFds < 1) {
         ALOGE("no FDs\n");
-        return Void();
+        return DumpstateStatus::ILLEGAL_ARGUMENT;
     }
 
     int fd = handle->data[0];
     if (fd < 0) {
         ALOGE("invalid FD: %d\n", handle->data[0]);
-        return Void();
+        return DumpstateStatus::ILLEGAL_ARGUMENT;
+    }
+
+    bool isModeValid = false;
+    for (const auto dumpstateMode : hidl_enum_range<DumpstateMode>()) {
+        if (mode == dumpstateMode) {
+            isModeValid = true;
+            break;
+        }
+    }
+    if (!isModeValid) {
+        ALOGE("Invalid mode: %d\n", mode);
+        return DumpstateStatus::ILLEGAL_ARGUMENT;
+    } else if (mode == DumpstateMode::WEAR) {
+        // We aren't a Wear device.
+        ALOGE("Unsupported mode: %d\n", mode);
+        return DumpstateStatus::UNSUPPORTED_MODE;
     }
 
     RunCommandToFd(fd, "Notify modem", {"/vendor/bin/modem_svc", "-s"}, CommandOptions::WithTimeout(1).Build());
+
+    pthread_t modemThreadHandle = 0;
+    if (getVerboseLoggingEnabled()) {
+        ALOGD("Verbose logging is enabled.\n");
+        if (handle->numFds < 2) {
+            ALOGE("no FD for modem\n");
+        } else {
+            int fdModem = handle->data[1];
+            if (pthread_create(&modemThreadHandle, NULL, dumpModemThread, (void *)((long)fdModem)) != 0) {
+                ALOGE("could not create thread for dumpModem\n");
+            }
+        }
+    }
+
     RunCommandToFd(fd, "VENDOR PROPERTIES", {"/vendor/bin/getprop"});
     DumpFileToFd(fd, "SoC serial number", "/sys/devices/soc0/serial_number");
     DumpFileToFd(fd, "CPU present", "/sys/devices/system/cpu/present");
@@ -358,6 +433,8 @@
     DumpF2FS(fd);
     DumpUFS(fd);
 
+    DumpSensorLog(fd);
+
     DumpFileToFd(fd, "INTERRUPTS", "/proc/interrupts");
 
     DumpPower(fd);
@@ -409,12 +486,6 @@
     // Slower dump put later in case stuck the rest of dump
     // Timeout after 3s as TZ log missing EOF
     RunCommandToFd(fd, "QSEE logs", {"/vendor/bin/sh", "-c", "/vendor/bin/timeout 3 cat /d/tzdbg/qsee_log"});
-    if (handle->numFds < 2) {
-        ALOGE("no FD for modem\n");
-    } else {
-        int fdModem = handle->data[1];
-        dumpModem(fd, fdModem);
-    }
 
     // Citadel info
     RunCommandToFd(fd, "Citadel VERSION", {"/vendor/bin/hw/citadel_updater", "-lv"});
@@ -429,11 +500,24 @@
     // Keep this at the end as very long on not for humans
     DumpFileToFd(fd, "WLAN FW Log Symbol Table", "/vendor/firmware/Data.msc");
 
+    if (modemThreadHandle) {
+        pthread_join(modemThreadHandle, NULL);
+    }
+
+    return DumpstateStatus::OK;
+}
+
+Return<void> DumpstateDevice::setVerboseLoggingEnabled(const bool enable) {
+    android::base::SetProperty(VENDOR_VERBOSE_LOGGING_ENABLED_PROPERTY, enable ? "true" : "false");
     return Void();
 }
 
+Return<bool> DumpstateDevice::getVerboseLoggingEnabled() {
+    return android::base::GetBoolProperty(VENDOR_VERBOSE_LOGGING_ENABLED_PROPERTY, false);
+}
+
 }  // namespace implementation
-}  // namespace V1_0
+}  // namespace V1_1
 }  // namespace dumpstate
 }  // namespace hardware
 }  // namespace android
diff --git a/dumpstate/DumpstateDevice.h b/dumpstate/DumpstateDevice.h
index ba5fcb7..2a10a8b 100644
--- a/dumpstate/DumpstateDevice.h
+++ b/dumpstate/DumpstateDevice.h
@@ -13,10 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#ifndef ANDROID_HARDWARE_DUMPSTATE_V1_0_DUMPSTATEDEVICE_H
-#define ANDROID_HARDWARE_DUMPSTATE_V1_0_DUMPSTATEDEVICE_H
+#ifndef ANDROID_HARDWARE_DUMPSTATE_V1_1_DUMPSTATEDEVICE_H
+#define ANDROID_HARDWARE_DUMPSTATE_V1_1_DUMPSTATEDEVICE_H
 
-#include <android/hardware/dumpstate/1.0/IDumpstateDevice.h>
+#include <android/hardware/dumpstate/1.1/IDumpstateDevice.h>
 #include <hidl/MQDescriptor.h>
 #include <hidl/Status.h>
 #include <string>
@@ -24,10 +24,12 @@
 namespace android {
 namespace hardware {
 namespace dumpstate {
-namespace V1_0 {
+namespace V1_1 {
 namespace implementation {
 
-using ::android::hardware::dumpstate::V1_0::IDumpstateDevice;
+using ::android::hardware::dumpstate::V1_1::IDumpstateDevice;
+using ::android::hardware::dumpstate::V1_1::DumpstateStatus;
+using ::android::hardware::dumpstate::V1_1::IDumpstateDevice;
 using ::android::hardware::hidl_array;
 using ::android::hardware::hidl_handle;
 using ::android::hardware::hidl_string;
@@ -40,15 +42,19 @@
   // Methods from ::android::hardware::dumpstate::V1_0::IDumpstateDevice follow.
   Return<void> dumpstateBoard(const hidl_handle& h) override;
 
-  void dumpLogs(int fd, std::string srcDir, std::string destDir, int maxFileNum,
-                const char *logPrefix);
-  void dumpModem(int fd, int fdModem);
+
+  // Methods from ::android::hardware::dumpstate::V1_1::IDumpstateDevice follow.
+  Return<DumpstateStatus> dumpstateBoard_1_1(const hidl_handle& h,
+                                             const DumpstateMode mode,
+                                             const uint64_t timeoutMillis) override;
+  Return<void> setVerboseLoggingEnabled(const bool enable) override;
+  Return<bool> getVerboseLoggingEnabled() override;
 };
 
 }  // namespace implementation
-}  // namespace V1_0
+}  // namespace V1_1
 }  // namespace dumpstate
 }  // namespace hardware
 }  // namespace android
 
-#endif  // ANDROID_HARDWARE_DUMPSTATE_V1_0_DUMPSTATEDEVICE_H
+#endif  // ANDROID_HARDWARE_DUMPSTATE_V1_1_DUMPSTATEDEVICE_H
diff --git a/dumpstate/android.hardware.dumpstate@1.0-service.crosshatch.rc b/dumpstate/android.hardware.dumpstate@1.0-service.crosshatch.rc
deleted file mode 100644
index 6bfb0db..0000000
--- a/dumpstate/android.hardware.dumpstate@1.0-service.crosshatch.rc
+++ /dev/null
@@ -1,10 +0,0 @@
-service vendor.dumpstate-1-0 /vendor/bin/hw/android.hardware.dumpstate@1.0-service.crosshatch
-    class hal
-    user system
-    group system
-    interface android.hardware.dumpstate@1.0::IDumpstateDevice default
-    oneshot
-    disabled
-
-on boot
-    chmod 0444 /sys/kernel/debug/tzdbg/qsee_log
diff --git a/dumpstate/android.hardware.dumpstate@1.1-service.crosshatch.rc b/dumpstate/android.hardware.dumpstate@1.1-service.crosshatch.rc
new file mode 100644
index 0000000..5156de8
--- /dev/null
+++ b/dumpstate/android.hardware.dumpstate@1.1-service.crosshatch.rc
@@ -0,0 +1,11 @@
+service vendor.dumpstate-1-1 /vendor/bin/hw/android.hardware.dumpstate@1.1-service.crosshatch
+    class hal
+    user system
+    group system vendor_rfs
+    interface android.hardware.dumpstate@1.0::IDumpstateDevice default
+    interface android.hardware.dumpstate@1.1::IDumpstateDevice default
+    oneshot
+    disabled
+
+on boot
+    chmod 0444 /sys/kernel/debug/tzdbg/qsee_log
diff --git a/dumpstate/service.cpp b/dumpstate/service.cpp
index 3b7a8da..72e1dc6 100644
--- a/dumpstate/service.cpp
+++ b/dumpstate/service.cpp
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#define LOG_TAG "android.hardware.dumpstate@1.0-service.crosshatch"
+#define LOG_TAG "android.hardware.dumpstate@1.1-service.crosshatch"
 
 #include <hidl/HidlSupport.h>
 #include <hidl/HidlTransportSupport.h>
@@ -21,8 +21,8 @@
 #include "DumpstateDevice.h"
 
 using ::android::hardware::configureRpcThreadpool;
-using ::android::hardware::dumpstate::V1_0::IDumpstateDevice;
-using ::android::hardware::dumpstate::V1_0::implementation::DumpstateDevice;
+using ::android::hardware::dumpstate::V1_1::IDumpstateDevice;
+using ::android::hardware::dumpstate::V1_1::implementation::DumpstateDevice;
 using ::android::hardware::joinRpcThreadpool;
 using ::android::sp;
 
diff --git a/fstab.hardware b/fstab.hardware
index 4c0b3e0..a3c9aa9 100644
--- a/fstab.hardware
+++ b/fstab.hardware
@@ -2,6 +2,7 @@
 
 #<src>                                              <mnt_point>        <type>      <mnt_flags and options>                               <fs_mgr_flags>
 system                                              /system            ext4        ro,barrier=1                                          wait,slotselect,avb=vbmeta,logical,first_stage_mount
+system_ext                                          /system_ext        ext4        ro,barrier=1                                          wait,slotselect,avb,logical,first_stage_mount
 vendor                                              /vendor            ext4        ro,barrier=1                                          wait,slotselect,avb,logical,first_stage_mount
 product                                             /product           ext4        ro,barrier=1                                          wait,slotselect,avb,logical,first_stage_mount
 /dev/block/by-name/metadata                         /metadata          ext4        noatime,nosuid,nodev,discard,sync                     wait,formattable,first_stage_mount
@@ -9,4 +10,4 @@
 /dev/block/bootdevice/by-name/misc                  /misc              emmc        defaults                                              defaults
 /dev/block/bootdevice/by-name/modem                 /vendor/firmware_mnt          vfat        ro,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0   wait,slotselect
 /devices/platform/soc/a600000.ssusb/a600000.dwc3*   auto               vfat        defaults                                              voldmanaged=usb:auto
-/dev/block/zram0                                    none               swap        defaults                                              zramsize=2147483648,max_comp_streams=8,zram_loopback_path=/data/per_boot/zram_swap,zram_loopback_size=512M
+/dev/block/zram0                                    none               swap        defaults                                              zramsize=2147483648,max_comp_streams=8,zram_backingdev_size=512M
diff --git a/fstab.mainline.hardware b/fstab.mainline.hardware
index 28548aa..61d3fd2 100644
--- a/fstab.mainline.hardware
+++ b/fstab.mainline.hardware
@@ -2,10 +2,9 @@
 
 #<src>                                              <mnt_point>        <type>      <mnt_flags and options>                               <fs_mgr_flags>
 system                                              /system            ext4        ro,barrier=1                                          wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
+system_ext                                          /system_ext        ext4        ro,barrier=1                                          wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
 vendor                                              /vendor            ext4        ro,barrier=1                                          wait,slotselect,avb=vbmeta,logical,first_stage_mount
 product                                             /product           ext4        ro,barrier=1                                          wait,slotselect,avb,logical,first_stage_mount
-# TODO(b/136154856) product_services will be renamed to system_ext
-#product_services                                    /product_services  ext4        ro,barrier=1                                          wait,slotselect,avb,logical,first_stage_mount
 /dev/block/by-name/metadata                         /metadata          ext4        noatime,nosuid,nodev,discard                          wait,formattable,first_stage_mount
 /dev/block/bootdevice/by-name/userdata              /data              f2fs        noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier       latemount,wait,check,fileencryption=ice,keydirectory=/metadata/vold/metadata_encryption,quota,formattable,sysfs_path=/sys/devices/platform/soc/1d84000.ufshc,reservedsize=128M
 /dev/block/bootdevice/by-name/misc                  /misc              emmc        defaults                                              defaults
diff --git a/gpt-utils/gpt-utils.cpp b/gpt-utils/gpt-utils.cpp
index 27a0801..f21e14f 100644
--- a/gpt-utils/gpt-utils.cpp
+++ b/gpt-utils/gpt-utils.cpp
@@ -744,7 +744,7 @@
     int r = 0;
     int fd = -1;
     int is_ufs = gpt_utils_is_ufs_device();
-    enum gpt_state gpt_prim, gpt_second;
+    enum gpt_state gpt_prim, gpt_second = GPT_OK;
     enum boot_update_stage internal_stage;
     struct stat xbl_partition_stat;
 
diff --git a/gpt-utils/gpt-utils.h b/gpt-utils/gpt-utils.h
index cb4226c..f7e2d4c 100644
--- a/gpt-utils/gpt-utils.h
+++ b/gpt-utils/gpt-utils.h
@@ -72,7 +72,7 @@
 #define AB_PARTITION_ATTR_SLOT_ACTIVE (0x1<<2)
 #define AB_PARTITION_ATTR_BOOT_SUCCESSFUL (0x1<<6)
 #define AB_PARTITION_ATTR_UNBOOTABLE (0x1<<7)
-#define AB_SLOT_ACTIVE_VAL              0x1F
+#define AB_SLOT_ACTIVE_VAL              0xF
 #define AB_SLOT_INACTIVE_VAL            0x0
 #define AB_SLOT_ACTIVE                  1
 #define AB_SLOT_INACTIVE                0
diff --git a/health/Android.bp b/health/Android.bp
index 6b7da04..534f12d 100644
--- a/health/Android.bp
+++ b/health/Android.bp
@@ -41,8 +41,6 @@
         "libbase",
         "libcutils",
         "libhidlbase",
-        "libhidltransport",
-        "libhwbinder",
         "libpixelhealth",
         "libutils",
         "android.hardware.health@2.0",
diff --git a/health/HealthService.cpp b/health/HealthService.cpp
index fec8692..098ca51 100644
--- a/health/HealthService.cpp
+++ b/health/HealthService.cpp
@@ -14,9 +14,8 @@
  * limitations under the License.
  */
 #define LOG_TAG "android.hardware.health@2.0-service.crosshatch"
-#include <android-base/logging.h>
-
 #include <android-base/file.h>
+#include <android-base/logging.h>
 #include <android-base/parseint.h>
 #include <android-base/strings.h>
 #include <health2/Health.h>
@@ -24,6 +23,7 @@
 #include <healthd/healthd.h>
 #include <hidl/HidlTransportSupport.h>
 #include <pixelhealth/BatteryMetricsLogger.h>
+#include <pixelhealth/BatteryThermalControl.h>
 #include <pixelhealth/CycleCountBackupRestore.h>
 #include <pixelhealth/DeviceHealth.h>
 #include <pixelhealth/LowBatteryShutdownMetrics.h>
@@ -40,25 +40,28 @@
 using android::hardware::health::V2_0::DiskStats;
 using android::hardware::health::V2_0::StorageAttribute;
 using android::hardware::health::V2_0::StorageInfo;
+using ::device::google::crosshatch::health::BatteryRechargingControl;
 using hardware::google::pixel::health::BatteryMetricsLogger;
+using hardware::google::pixel::health::BatteryThermalControl;
 using hardware::google::pixel::health::CycleCountBackupRestore;
 using hardware::google::pixel::health::DeviceHealth;
 using hardware::google::pixel::health::LowBatteryShutdownMetrics;
-using ::device::google::crosshatch::health::BatteryRechargingControl;
 
 constexpr char kBatteryResistance[] = "/sys/class/power_supply/maxfg/resistance";
 constexpr char kBatteryOCV[] = "/sys/class/power_supply/maxfg/voltage_ocv";
 constexpr char kVoltageAvg[] = "/sys/class/power_supply/maxfg/voltage_avg";
 
 static BatteryRechargingControl battRechargingControl;
+static BatteryThermalControl battThermalControl("sys/devices/virtual/thermal/tz-by-name/soc/mode");
 static BatteryMetricsLogger battMetricsLogger(kBatteryResistance, kBatteryOCV);
 static LowBatteryShutdownMetrics shutdownMetrics(kVoltageAvg);
 static CycleCountBackupRestore ccBackupRestoreBMS(
     8, "/sys/class/power_supply/bms/device/cycle_counts_bins",
-    "/persist/battery/qcom_cycle_counts_bins");
+    "/mnt/vendor/persist/battery/qcom_cycle_counts_bins");
 static CycleCountBackupRestore ccBackupRestoreMAX(
     10, "/sys/class/power_supply/maxfg/cycle_counts_bins",
-    "/persist/battery/max_cycle_counts_bins", "/sys/class/power_supply/maxfg/serial_number");
+    "/mnt/vendor/persist/battery/max_cycle_counts_bins",
+    "/sys/class/power_supply/maxfg/serial_number");
 static DeviceHealth deviceHealth;
 
 #define UFS_DIR "/sys/devices/platform/soc/1d84000.ufshc"
@@ -112,6 +115,7 @@
 int healthd_board_battery_update(struct android::BatteryProperties *props) {
     battRechargingControl.updateBatteryProperties(props);
     deviceHealth.update(props);
+    battThermalControl.updateThermalState(props);
     battMetricsLogger.logBatteryProperties(props);
     shutdownMetrics.logShutdownVoltage(props);
     ccBackupRestoreBMS.Backup(props->batteryLevel);
diff --git a/init.hardware.diag.rc.user b/init.hardware.diag.rc.user
index c24f851..6b98ad4 100644
--- a/init.hardware.diag.rc.user
+++ b/init.hardware.diag.rc.user
@@ -14,6 +14,37 @@
 # limitations under the License.
 #
 
-on property:ro.boot.mode=normal
-    rm /dev/diag
-    rm /dev/diagtest
+on init
+    chmod 666 /dev/diag
+
+on post-fs-data
+    mkdir /data/vendor/radio 0777 radio radio
+    mkdir /data/vendor/radio/diag_logs 0777 system system
+    rm /data/vendor/radio/diag_logs/logs/diag_poweron_log.qmdl
+
+service diag_mdlog_start /vendor/bin/diag_mdlog
+    class late_start
+    user shell
+    group system diag media_rw
+    disabled
+    oneshot
+
+service diag_mdlog_stop /vendor/bin/diag_mdlog -k
+    class late_start
+    user shell
+    group system diag media_rw
+    disabled
+    oneshot
+
+on property:persist.vendor.sys.modem.diag.mdlog=*
+    rm /data/vendor/radio/diag_logs/diag_mdlog_pid
+    setprop vendor.sys.modem.diag.mdlog ${persist.vendor.sys.modem.diag.mdlog}
+
+on property:vendor.sys.modem.diag.mdlog=true
+    start diag_mdlog_start
+
+on property:vendor.sys.modem.diag.mdlog=false
+    start diag_mdlog_stop
+
+on property:persist.vendor.verbose_logging_enabled=*
+    setprop persist.vendor.sys.modem.diag.mdlog ${persist.vendor.verbose_logging_enabled}
diff --git a/init.hardware.diag.rc.userdebug b/init.hardware.diag.rc.userdebug
index 9f29aef..b3e4a80 100644
--- a/init.hardware.diag.rc.userdebug
+++ b/init.hardware.diag.rc.userdebug
@@ -45,7 +45,7 @@
     rm /data/vendor/radio/diag_logs/diag_mdlog_pid
     setprop vendor.sys.modem.diag.mdlog ${persist.vendor.sys.modem.diag.mdlog}
 
-on property:vendor.sys.modem.diag.mdlog=true
+on property:vendor.sys.modem.diag.mdlog=true && property:persist.vendor.verbose_logging_enabled=true
     start diag_mdlog_start
 
 on property:vendor.sys.modem.diag.mdlog=false
diff --git a/init.hardware.mpssrfs.rc.userdebug b/init.hardware.mpssrfs.rc.userdebug
index af83446..d919889 100644
--- a/init.hardware.mpssrfs.rc.userdebug
+++ b/init.hardware.mpssrfs.rc.userdebug
@@ -6,3 +6,6 @@
     write /data/vendor/rfs/mpss/mcfg_nv_list_flag "1"
     chown vendor_rfs vendor_rfs /data/vendor/rfs/mpss/mcfg_nv_list_flag
     chmod 0700 /data/vendor/rfs/mpss/mcfg_nv_list_flag
+
+on property:vendor.sys.modem.diag.efsdump=true
+    chmod 0660 /data/vendor/rfs/mpss/modem_efs
diff --git a/init.hardware.rc b/init.hardware.rc
index fa97493..3d6f113 100644
--- a/init.hardware.rc
+++ b/init.hardware.rc
@@ -41,7 +41,7 @@
     # Ensure 100% reporting is sticky
     write /sys/class/power_supply/maxfg/offmode_charger 1
 
-service vendor.charger /charger
+service vendor.charger /system/bin/charger
     class charger
     seclabel u:r:charger:s0
     user system
@@ -81,7 +81,7 @@
 
     # start Citadel keymaster (StrongBox) early
     start vendor.citadeld
-    start vendor.keymaster-4-0-citadel
+    start vendor.keymaster-4-1-citadel
 
     # Boot time fs tune
     write /sys/block/sda/queue/iostats 0
@@ -105,9 +105,6 @@
     write /sys/devices/platform/soc/${ro.boot.bootdevice}/clkgate_enable 0
     write /sys/devices/platform/soc/${ro.boot.bootdevice}/hibern8_on_idle_enable 0
 
-    # Disable powersaving
-    write /sys/module/lpm_levels/parameters/sleep_disabled 1
-
     # Loading kernel modules in background
     start insmod_sh
 
@@ -140,15 +137,6 @@
     write /dev/stune/top-app/schedtune.boost 10
     write /dev/stune/top-app/schedtune.prefer_idle 1
 
-    # Setup cpusets used by the VR services.
-    mkdir /dev/cpuset/kernel 0750 root system
-    write /dev/cpuset/kernel/cpus 0
-    write /dev/cpuset/kernel/mems 0
-    chown system system /dev/cpuset/kernel/tasks
-    chown system system /dev/cpuset/kernel/cpus
-    chmod 0660 /dev/cpuset/kernel/tasks
-    chmod 0660 /dev/cpuset/kernel/cpus
-
     mkdir /dev/cpuset/camera-daemon
     write /dev/cpuset/camera-daemon/cpus 0-7
     write /dev/cpuset/camera-daemon/mems 0
@@ -156,52 +144,6 @@
     chown system system /dev/cpuset/camera-daemon/tasks
     chmod 0664 /dev/cpuset/camera-daemon/tasks
 
-    mkdir /dev/cpuset/system 0750 root system
-    write /dev/cpuset/system/cpus 0
-    write /dev/cpuset/system/mems 0
-    chown system system /dev/cpuset/system/tasks
-    chmod 0660 /dev/cpuset/system/tasks
-
-    mkdir /dev/cpuset/system/performance 0750 root system
-    write /dev/cpuset/system/performance/cpus 0
-    write /dev/cpuset/system/performance/mems 0
-    chown system system /dev/cpuset/system/performance/tasks
-    chmod 0660 /dev/cpuset/system/performance/tasks
-
-    mkdir /dev/cpuset/system/background 0750 root system
-    write /dev/cpuset/system/background/cpus 0
-    write /dev/cpuset/system/background/mems 0
-    chown system system /dev/cpuset/system/background/tasks
-    chmod 0660 /dev/cpuset/system/background/tasks
-
-    mkdir /dev/cpuset/application 0750 root system
-    write /dev/cpuset/application/cpus 0
-    write /dev/cpuset/application/mems 0
-    chown system system /dev/cpuset/application/tasks
-    chmod 0660 /dev/cpuset/application/tasks
-
-    mkdir /dev/cpuset/application/performance 0750 root system
-    write /dev/cpuset/application/performance/cpus 0
-    write /dev/cpuset/application/performance/mems 0
-    chown system system /dev/cpuset/application/performance/tasks
-    chmod 0660 /dev/cpuset/application/performance/tasks
-
-    mkdir /dev/cpuset/application/background 0750 root system
-    write /dev/cpuset/application/background/cpus 0
-    write /dev/cpuset/application/background/mems 0
-    chown system system /dev/cpuset/application/background/tasks
-    chmod 0660 /dev/cpuset/application/background/tasks
-
-    # Create UDS structure for base VR services.
-    mkdir /dev/socket/pdx 0775 system system
-    mkdir /dev/socket/pdx/system 0775 system system
-    mkdir /dev/socket/pdx/system/buffer_hub 0775 system system
-    mkdir /dev/socket/pdx/system/performance 0775 system system
-    mkdir /dev/socket/pdx/system/vr 0775 system system
-    mkdir /dev/socket/pdx/system/vr/display 0775 system system
-    mkdir /dev/socket/pdx/system/vr/pose 0775 system system
-    mkdir /dev/socket/pdx/system/vr/sensors 0775 system system
-
     # b/37682684 Enable suspend clock reporting
     write /sys/kernel/debug/clk/debug_suspend 1
 
@@ -209,6 +151,9 @@
     write /sys/block/zram0/comp_algorithm lz4
     write /proc/sys/vm/page-cluster 0
 
+    # Freezer setup
+    write /dev/freezer/frozen/freezer.killable 1
+
     # Some user code relies on ro.boot.hardware.revision
     setprop ro.boot.hardware.revision ${ro.revision}
 
@@ -221,7 +166,6 @@
     # Property used by pointing to thermal-engine config file
     setprop vendor.thermal.vr_mode -novr
     setprop vendor.thermal.hw_mode -prod
-    setprop vendor.thermal.config "thermal_info_config.json"
 
 on late-init
     write /sys/devices/virtual/thermal/tz-by-name/fps-therm-adc/mode enabled
@@ -229,6 +173,7 @@
     chown system system /sys/devices/virtual/thermal/tz-by-name/fps-therm-monitor/trip_point_0_hyst
     chown system system /sys/devices/virtual/thermal/tz-by-name/usbc-therm-monitor/trip_point_0_temp
     chown system system /sys/devices/virtual/thermal/tz-by-name/usbc-therm-monitor/trip_point_0_hyst
+    chown system system /sys/devices/virtual/thermal/tz-by-name/soc/mode
 
 on fs
     mount_all /vendor/etc/fstab.${ro.boot.hardware.platform} --early
@@ -256,12 +201,10 @@
     restorecon_recursive /mnt/vendor/persist
 
 on late-fs
-    # Start devices by sysfs trigger, including SLPI. SLPI waits for sscrpcd to
-    # read /persist, so to prevent SLPI startup delays, start both here.
     start devstart_sh
-    start vendor.sscrpcd
 
     # Start services for bootanim
+    start vendor.power-hal-1-3
     start surfaceflinger
     start bootanim
     start vendor.hwcomposer-2-3
@@ -317,6 +260,10 @@
     # Setup folder for modem fdr
     mkdir /data/vendor/modem_fdr 0700 root system
 
+    # Resume-on-Reboot after we have the data dir and keymaster
+    mkdir /data/vendor/rebootescrow 0770 hsm hsm
+    start vendor.rebootescrow-citadel
+
     # keep that at the end of on post-fs-data
     # Set indication (checked by vold) that we have finished this action
     setprop vold.post_fs_data_done 1
@@ -387,6 +334,8 @@
 
     mkdir /data/vendor/sensors 0770
     chown system system /data/vendor/sensors
+    mkdir /data/vendor/sensors/log 0770
+    chown system system /data/vendor/sensors/log
 
     chmod 770 /persist/audio
     chmod 660 /persist/audio/audio.cal
@@ -520,17 +469,6 @@
     write /proc/sys/net/core/rmem_max  8388608
     write /proc/sys/net/core/wmem_max  8388608
 
-    # Update DVR cpusets to boot-time values.
-    write /dev/cpuset/kernel/cpus 0-7
-    write /dev/cpuset/system/cpus 0-7
-    write /dev/cpuset/system/performance/cpus 0-7
-    write /dev/cpuset/system/background/cpus 0-7
-    write /dev/cpuset/system/cpus 0-7
-    write /dev/cpuset/application/cpus 0-7
-    write /dev/cpuset/application/performance/cpus 0-7
-    write /dev/cpuset/application/background/cpus 0-7
-    write /dev/cpuset/application/cpus 0-7
-
     # Bluetooth
     chown bluetooth net_bt /sys/class/rfkill/rfkill0/type
     chown bluetooth net_bt /sys/class/rfkill/rfkill0/state
@@ -547,6 +485,9 @@
     # WLAN debug access
     chown system system /d/icnss/stats
 
+    # Default enable uicc_se
+    setprop persist.vendor.radio.uicc_se_enabled true
+
 service init-radio-sh /vendor/bin/init.radio.sh
     class late_start
     user radio
@@ -618,15 +559,6 @@
     write /dev/cpuset/system-background/cpus 0-3
     write /dev/cpuset/restricted/cpus 0-3
 
-    # Update DVR cpusets to runtime values.
-    # Kernel cpuset will be apply on PowerHAL
-    write /dev/cpuset/system/performance/cpus 6-7
-    write /dev/cpuset/system/background/cpus 0-1
-    write /dev/cpuset/system/cpus 0-1,6-7
-    write /dev/cpuset/application/performance/cpus 4-5
-    write /dev/cpuset/application/background/cpus 0-1
-    write /dev/cpuset/application/cpus 0-1,4-5
-
     # Runtime fs tuning: as we have init boottime setting and kernel patch setting
     # default readahead to 2048KB. We should adjust the setting upon boot_complete
     # for runtime performance
@@ -644,6 +576,10 @@
     write /sys/block/dm-5/queue/read_ahead_kb 128
     write /sys/block/dm-6/queue/read_ahead_kb 128
 
+    # Block layer tuning: discard chunk size up to 128MB
+    # Otherwise, contiguous discards can be merged
+    write /sys/block/sda/queue/discard_max_bytes 134217728
+
     # QCOM FG SRAM dump for dumpstate
     chown system system /d/fg/sram/data
     chown system system /d/fg/sram/count
@@ -668,17 +604,6 @@
 
     start per_proxy
 
-    # Create pixel-trace.
-    # At this moment, only mm_event is available. If others want to put more,
-    # it should get hard review from pixel-perf-team.
-    mkdir /sys/kernel/debug/tracing/instances/pixel-trace 0755 system system
-    chown system system /sys/kernel/debug/tracing/instances/pixel-trace/trace
-    chmod 0660 /sys/kernel/debug/tracing/instances/pixel-trace/trace
-    chown system system /sys/kernel/debug/tracing/instances/pixel-trace/tracing_on
-    chmod 0660 /sys/kernel/debug/tracing/instances/pixel-trace/tracing_on
-    write /sys/kernel/debug/tracing/instances/pixel-trace/buffer_size_kb 64
-    write /sys/kernel/debug/tracing/instances/pixel-trace/events/mm_event/enable 1
-
 on property:sys.shutdown.requested=*
     stop per_proxy
 
@@ -687,11 +612,6 @@
    user root
    group root
 
-service time_daemon /vendor/bin/time_daemon
-   class core
-   user root
-   group root
-
 service ss_ramdump /vendor/bin/subsystem_ramdump
     class main
     user root
@@ -709,19 +629,6 @@
 on property:persist.vendor.sys.ssr.enable_ramdumps=0
     write /sys/module/subsystem_restart/parameters/enable_ramdumps 0
 
-service sensors.qti /vendor/bin/sensors.qti
-    class core
-    user system
-    group system
-    # Grants the ability for this daemon to bind IPC router ports so it can
-    # register QMI services
-    capabilities NET_BIND_SERVICE
-
-service vendor.sscrpcd  /vendor/bin/sscrpcd
-    class core
-    user system
-    group system
-
 service adsprpcd /vendor/bin/adsprpcd
    class main
    user media
@@ -754,21 +661,6 @@
    group system
    capabilities NET_BIND_SERVICE
 
-service wpa_supplicant /vendor/bin/hw/wpa_supplicant \
-    -O/data/vendor/wifi/wpa/sockets -puse_p2p_group_interface=1 -dd \
-    -g@android:wpa_wlan0
-    #   we will start as root and wpa_supplicant will switch to user wifi
-    #   after setting up the capabilities required for WEXT
-    #   user wifi
-    #   group wifi inet keystore
-    interface android.hardware.wifi.supplicant@1.0::ISupplicant default
-    interface android.hardware.wifi.supplicant@1.1::ISupplicant default
-    interface android.hardware.wifi.supplicant@1.2::ISupplicant default
-    class main
-    socket wpa_wlan0 dgram 660 wifi wifi
-    disabled
-    oneshot
-
 service cnss-daemon /vendor/bin/cnss-daemon -n -l
    class late_start
    user system
@@ -834,35 +726,13 @@
 service pd_mapper /vendor/bin/pd-mapper
      class core
 
-# turns off tracing right before bugreporting to keep more traces
-on property:init.svc.dumpstatez=running
-    write /d/tracing/instances/pixel-trace/tracing_on 0
-
-on property:init.svc.dumpstatez=stopped
-    write /d/tracing/instances/pixel-trace/tracing_on 1
-
-on property:init.svc.bugreport=running
-    write /d/tracing/instances/pixel-trace/tracing_on 0
-
-on property:init.svc.bugreport=stopped
-    write /d/tracing/instances/pixel-trace/tracing_on 1
-
 # bugreport is triggered by holding down volume down, volume up and power
-service bugreport /system/bin/dumpstate -d -p -B -z \
-        -o /data/user_de/0/com.android.shell/files/bugreports/bugreport
+service bugreport /system/bin/dumpstate -d -p -z
     class main
     disabled
     oneshot
     keycodes 114 115 116
 
-service vendor.chre /vendor/bin/chre
-    class late_start
-    user system
-    group system wakelock
-    capabilities BLOCK_SUSPEND
-    socket chre seqpacket 0660 root system
-    shutdown critical
-
 service devstart_sh /vendor/bin/init.qcom.devstart.sh
     class main
     user root
@@ -928,18 +798,10 @@
 on property:ro.boot.mode=sota
     setprop ro.boot.sota enabled
 
-on property:ro.boot.hardware.sku=G013A
-    setprop persist.vendor.nfc.uicc_enabled true
 on property:ro.boot.hardware.sku=G013B
-    setprop persist.vendor.nfc.uicc_enabled false
-    setprop persist.vendor.radio.uicc_se_enabled false
-    interface_start android.hardware.secure_element@1.1::ISecureElement/eSE1
-on property:ro.boot.hardware.sku=G013C
-    setprop persist.vendor.nfc.uicc_enabled true
+    start vendor.secure_element_hal_service_1_1
 on property:ro.boot.hardware.sku=G013D
-    setprop persist.vendor.nfc.uicc_enabled false
-    setprop persist.vendor.radio.uicc_se_enabled false
-    interface_start android.hardware.secure_element@1.1::ISecureElement/eSE1
+    start vendor.secure_element_hal_service_1_1
 
 # charger driver exposes now finer grain control, map demo mode to those properties
 # demo mode can only be exit wipping data which will also reset the persist properties
@@ -992,15 +854,13 @@
     setprop persist.radio.multisim.config ""
     stop vendor.qcrild2
 
-# Write the dark theme magic (`theme-dark`, or 0x7468656d652d6461726b in hex string) to /misc
-# partition. Offset 0 in vendor space is effectively offset 2048 in /misc partition.
-service vendor.theme_set /vendor/bin/misc_writer --vendor-space-offset 0 --hex-string 0x7468656d652d6461726b
+# Write the dark theme magic to /misc partition.
+service vendor.theme_set /vendor/bin/misc_writer --set-dark-theme
     disabled
     oneshot
 
-# Clear the 10-byte dark theme magic in /misc partition. Offset 0 in vendor space is effectively
-# offset 2048 in /misc partition.
-service vendor.theme_clear /vendor/bin/misc_writer --vendor-space-offset 0 --hex-string 0x00000000000000000000
+# Clear the dark theme magic in /misc partition.
+service vendor.theme_clear /vendor/bin/misc_writer --clear-dark-theme
     disabled
     oneshot
 
@@ -1015,3 +875,14 @@
 
 on property:persist.sys.theme=0
     start vendor.theme_clear
+
+on init && property:ro.boot.slot_successful=no
+    write /sys/module/msm_poweroff/parameters/warm_reset 1
+
+# Set or clear the warm reset flag upon the change of system property. The flag itself is set
+# by writing a sysfs file; and the file will be read by kernel.
+on property:ota.warm_reset=1
+    write /sys/module/msm_poweroff/parameters/warm_reset 1
+
+on property:ota.warm_reset=0
+    write /sys/module/msm_poweroff/parameters/warm_reset 0
diff --git a/init.hardware.xr.rc b/init.hardware.xr.rc
new file mode 100644
index 0000000..983f13e
--- /dev/null
+++ b/init.hardware.xr.rc
@@ -0,0 +1,104 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+#
+# This file inherits from init.${ro.boot.hardware.platform}.rc plus additional
+# configs only used by XR targets.
+#
+import /vendor/etc/init/hw/init.${ro.boot.hardware.platform}.common.rc
+
+on init
+    # Temporarily stop booting into VR directly due to battery drain.
+    # TODO(b/131327495): Re-enable this once VrHeadsetPowerPolicyService or its
+    #                    equivalent lands in Android master.
+    setprop ro.boot.vr 0
+
+    # Setup cpusets used by the VR services.
+    mkdir /dev/cpuset/kernel 0750 root system
+    write /dev/cpuset/kernel/cpus 0
+    write /dev/cpuset/kernel/mems 0
+    chown system system /dev/cpuset/kernel/tasks
+    chown system system /dev/cpuset/kernel/cpus
+    chmod 0660 /dev/cpuset/kernel/tasks
+    chmod 0660 /dev/cpuset/kernel/cpus
+
+    mkdir /dev/cpuset/system 0750 root system
+    write /dev/cpuset/system/cpus 0
+    write /dev/cpuset/system/mems 0
+    chown system system /dev/cpuset/system/tasks
+    chmod 0660 /dev/cpuset/system/tasks
+
+    mkdir /dev/cpuset/system/performance 0750 root system
+    write /dev/cpuset/system/performance/cpus 0
+    write /dev/cpuset/system/performance/mems 0
+    chown system system /dev/cpuset/system/performance/tasks
+    chmod 0660 /dev/cpuset/system/performance/tasks
+
+    mkdir /dev/cpuset/system/background 0750 root system
+    write /dev/cpuset/system/background/cpus 0
+    write /dev/cpuset/system/background/mems 0
+    chown system system /dev/cpuset/system/background/tasks
+    chmod 0660 /dev/cpuset/system/background/tasks
+
+    mkdir /dev/cpuset/application 0750 root system
+    write /dev/cpuset/application/cpus 0
+    write /dev/cpuset/application/mems 0
+    chown system system /dev/cpuset/application/tasks
+    chmod 0660 /dev/cpuset/application/tasks
+
+    mkdir /dev/cpuset/application/performance 0750 root system
+    write /dev/cpuset/application/performance/cpus 0
+    write /dev/cpuset/application/performance/mems 0
+    chown system system /dev/cpuset/application/performance/tasks
+    chmod 0660 /dev/cpuset/application/performance/tasks
+
+    mkdir /dev/cpuset/application/background 0750 root system
+    write /dev/cpuset/application/background/cpus 0
+    write /dev/cpuset/application/background/mems 0
+    chown system system /dev/cpuset/application/background/tasks
+    chmod 0660 /dev/cpuset/application/background/tasks
+
+    # Create UDS structure for base VR services.
+    mkdir /dev/socket/pdx 0775 system system
+    mkdir /dev/socket/pdx/system 0775 system system
+    mkdir /dev/socket/pdx/system/buffer_hub 0775 system system
+    mkdir /dev/socket/pdx/system/performance 0775 system system
+    mkdir /dev/socket/pdx/system/vr 0775 system system
+    mkdir /dev/socket/pdx/system/vr/display 0775 system system
+    mkdir /dev/socket/pdx/system/vr/pose 0775 system system
+    mkdir /dev/socket/pdx/system/vr/sensors 0775 system system
+
+on boot
+    # Update DVR cpusets to boot-time values.
+    write /dev/cpuset/kernel/cpus 0-7
+    write /dev/cpuset/system/cpus 0-7
+    write /dev/cpuset/system/performance/cpus 0-7
+    write /dev/cpuset/system/background/cpus 0-7
+    write /dev/cpuset/system/cpus 0-7
+    write /dev/cpuset/application/cpus 0-7
+    write /dev/cpuset/application/performance/cpus 0-7
+    write /dev/cpuset/application/background/cpus 0-7
+    write /dev/cpuset/application/cpus 0-7
+
+on property:sys.boot_completed=1
+    # Update DVR cpusets to runtime values.
+    # Kernel cpuset will be apply on PowerHAL
+    write /dev/cpuset/system/performance/cpus 6-7
+    write /dev/cpuset/system/background/cpus 0-1
+    write /dev/cpuset/system/cpus 0-1,6-7
+    write /dev/cpuset/application/performance/cpus 4-5
+    write /dev/cpuset/application/background/cpus 0-1
+    write /dev/cpuset/application/cpus 0-1,4-5
diff --git a/json-c/Android.mk b/json-c/Android.mk
index 139a10c..9cd1e23 100644
--- a/json-c/Android.mk
+++ b/json-c/Android.mk
@@ -1,23 +1,7 @@
-LIBJSON_ROOT := $(call my-dir)
+LOCAL_PATH := $(call my-dir)
 include $(CLEAR_VARS)
 LOCAL_MODULE := libjson
-LOCAL_PATH := $(LIBJSON_ROOT)
-LOCAL_C_INCLUDES += $(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr/include
-LOCAL_ADDITIONAL_DEPENDENCIES += $(TARGET_OUT_INTERMEDIATES)/KERNEL_OBJ/usr
-LOCAL_COPY_HEADERS_TO := libjson/inc
-LOCAL_COPY_HEADERS := bits.h \
-		config.h \
-		debug.h \
-		linkhash.h \
-		arraylist.h \
-		json.h \
-		json_config.h \
-		json_inttypes.h \
-		json_util.h \
-		json_object.h \
-		json_tokener.h \
-		json_object_iterator.h \
-		json_c_version.h
+LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)
 LOCAL_SRC_FILES := arraylist.c \
 		debug.c \
 		json_c_version.c \
diff --git a/keymaster/Android.bp b/keymaster/Android.bp
index 02d52a9..afbfc41 100644
--- a/keymaster/Android.bp
+++ b/keymaster/Android.bp
@@ -19,9 +19,10 @@
     srcs: [ "wait_for_strongbox.cpp" ],
     cflags: [ "-Werror", "-Wall" ],
     shared_libs: [
-        "android.hardware.keymaster@4.0",
+        "android.hardware.keymaster@4.1",
         "libbase",
-        "libkeymaster4support",
+        "libkeymaster4_1support",
+        "libutils",
     ],
     proprietary: true,
 }
diff --git a/keymaster/wait_for_strongbox.cpp b/keymaster/wait_for_strongbox.cpp
index 8f95741..c0f4094 100644
--- a/keymaster/wait_for_strongbox.cpp
+++ b/keymaster/wait_for_strongbox.cpp
@@ -19,10 +19,10 @@
 #define LOG_TAG "wait_for_strongbox"
 #include <android-base/logging.h>
 
-#include <keymasterV4_0/Keymaster.h>
+#include <keymasterV4_1/Keymaster.h>
 
-using android::hardware::keymaster::V4_0::SecurityLevel;
-using android::hardware::keymaster::V4_0::support::Keymaster;
+using android::hardware::keymaster::V4_1::SecurityLevel;
+using android::hardware::keymaster::V4_1::support::Keymaster;
 
 useconds_t kWaitTimeMicroseconds = 1 * 1000;  // 1 milliseconds
 
diff --git a/manifest.xml b/manifest.xml
index 3bf170a..3ec6e30 100644
--- a/manifest.xml
+++ b/manifest.xml
@@ -2,7 +2,7 @@
     <hal format="hidl">
         <name>android.hardware.audio</name>
         <transport>hwbinder</transport>
-        <version>5.0</version>
+        <version>6.0</version>
         <interface>
             <name>IDevicesFactory</name>
             <instance>default</instance>
@@ -11,7 +11,7 @@
     <hal format="hidl">
         <name>android.hardware.audio.effect</name>
         <transport>hwbinder</transport>
-        <version>5.0</version>
+        <version>6.0</version>
         <interface>
             <name>IEffectsFactory</name>
             <instance>default</instance>
@@ -29,7 +29,7 @@
     <hal format="hidl">
         <name>android.hardware.biometrics.fingerprint</name>
         <transport>hwbinder</transport>
-        <version>2.1</version>
+        <version>2.2</version>
         <interface>
             <name>IBiometricsFingerprint</name>
             <instance>default</instance>
@@ -45,15 +45,6 @@
         </interface>
     </hal>
     <hal format="hidl">
-        <name>android.hardware.bluetooth.a2dp</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothAudioOffload</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
         <name>android.hardware.bluetooth.audio</name>
         <transport>hwbinder</transport>
         <version>2.0</version>
@@ -99,15 +90,6 @@
         </interface>
     </hal>
     <hal format="hidl">
-        <name>android.hardware.contexthub</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IContexthub</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
         <name>android.hardware.drm</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -121,13 +103,11 @@
         </interface>
         <fqname>@1.2::ICryptoFactory/clearkey</fqname>
         <fqname>@1.2::IDrmFactory/clearkey</fqname>
-        <fqname>@1.2::ICryptoFactory/widevine</fqname>
-        <fqname>@1.2::IDrmFactory/widevine</fqname>
     </hal>
     <hal format="hidl">
         <name>android.hardware.dumpstate</name>
         <transport>hwbinder</transport>
-        <version>1.0</version>
+        <version>1.1</version>
         <interface>
             <name>IDumpstateDevice</name>
             <instance>default</instance>
@@ -190,12 +170,8 @@
     <hal format="hidl">
         <name>android.hardware.keymaster</name>
         <transport>hwbinder</transport>
-        <version>4.0</version>
-        <interface>
-            <name>IKeymasterDevice</name>
-            <instance>default</instance>
-            <instance>strongbox</instance>
-        </interface>
+        <fqname>@4.0::IKeymasterDevice/default</fqname>
+        <fqname>@4.1::IKeymasterDevice/strongbox</fqname>
     </hal>
     <hal format="hidl">
         <name>android.hardware.light</name>
@@ -241,9 +217,9 @@
         <name>android.hardware.neuralnetworks</name>
         <transport>hwbinder</transport>
         <fqname>@1.0::IDevice/paintbox</fqname>
-        <fqname>@1.2::IDevice/qti-default</fqname>
-        <fqname>@1.2::IDevice/qti-dsp</fqname>
-        <fqname>@1.2::IDevice/qti-gpu</fqname>
+        <fqname>@1.3::IDevice/qti-default</fqname>
+        <fqname>@1.3::IDevice/qti-dsp</fqname>
+        <fqname>@1.3::IDevice/qti-gpu</fqname>
     </hal>
     <hal format="hidl">
         <name>android.hardware.nfc</name>
@@ -284,7 +260,7 @@
     <hal format="hidl">
         <name>vendor.google.radioext</name>
         <transport>hwbinder</transport>
-        <version>1.1</version>
+        <version>1.2</version>
         <interface>
             <name>IRadioExt</name>
             <instance>default</instance>
@@ -293,7 +269,7 @@
     <hal format="hidl">
         <name>vendor.google.wireless_charger</name>
         <transport>hwbinder</transport>
-        <version>1.1</version>
+        <version>1.2</version>
         <interface>
             <name>IWirelessCharger</name>
             <instance>default</instance>
@@ -326,7 +302,7 @@
     <hal format="hidl">
         <name>android.hardware.sensors</name>
         <transport>hwbinder</transport>
-        <version>1.0</version>
+        <version>2.0</version>
         <interface>
             <name>ISensors</name>
             <instance>default</instance>
@@ -360,24 +336,6 @@
         </interface>
     </hal>
     <hal format="hidl">
-        <name>android.hardware.usb</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IUsb</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.usb.gadget</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IUsbGadget</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
         <name>android.hardware.weaver</name>
         <transport>hwbinder</transport>
         <version>1.0</version>
@@ -387,33 +345,6 @@
         </interface>
     </hal>
     <hal format="hidl">
-        <name>android.hardware.wifi</name>
-        <transport>hwbinder</transport>
-        <version>1.3</version>
-        <interface>
-            <name>IWifi</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.wifi.hostapd</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IHostapd</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>android.hardware.wifi.supplicant</name>
-        <transport>hwbinder</transport>
-        <version>1.2</version>
-        <interface>
-            <name>ISupplicant</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
         <name>vendor.qti.hardware.radio.ims</name>
         <transport>hwbinder</transport>
         <version>1.2</version>
diff --git a/media_codecs_performance.xml b/media_codecs_performance.xml
index f13544e..9ab2ddf 100644
--- a/media_codecs_performance.xml
+++ b/media_codecs_performance.xml
@@ -87,6 +87,7 @@
     <Decoders>
         <MediaCodec name="c2.android.h263.decoder" type="video/3gpp" update="true">
             <Limit name="measured-frame-rate-176x144" range="167-168" /> <!-- N=28 v90%=1.1 -->
+            <Limit name="measured-frame-rate-352x288" range="167-286" /> <!-- N=94 v98%=1.8 -->
         </MediaCodec>
         <MediaCodec name="OMX.qcom.video.decoder.avc" type="video/avc" update="true">
             <!-- measured 90%:169-286 med:186 SLOW -->
diff --git a/mixer_paths_tavil_b1.xml b/mixer_paths_tavil_b1.xml
index 8463887..a6892fb 100644
--- a/mixer_paths_tavil_b1.xml
+++ b/mixer_paths_tavil_b1.xml
@@ -175,6 +175,7 @@
     <ctl name="MultiMedia8 Mixer USB_AUDIO_TX" value="0"/>
     <ctl name="MultiMedia10 Mixer USB_AUDIO_TX" value="0"/>
     <ctl name="MultiMedia6 Mixer SLIM_0_TX" value="0"/>
+    <ctl name="MultiMedia2 Mixer SLIM_0_TX" value="0"/>
     <ctl name="SLIM_2_RX Format" value="UNPACKED"/>
     <ctl name="SLIM_2_RX SampleRate" value="KHZ_48"/>
     <ctl name="SLIM_5_RX SampleRate" value="KHZ_44P1"/>
@@ -1041,6 +1042,10 @@
         <ctl name="MultiMedia1 Mixer USB_AUDIO_TX" value="1"/>
     </path>
 
+    <path name="hifi-record">
+        <ctl name="MultiMedia2 Mixer SLIM_0_TX" value="1"/>
+    </path>
+
     <path name="hifi-record usb-headset-mic">
         <ctl name="MultiMedia2 Mixer USB_AUDIO_TX" value="1"/>
     </path>
@@ -1376,6 +1381,11 @@
         <ctl name="VoiceMMode2_Tx Mixer SLIM_0_TX_MMode2" value="1"/>
     </path>
 
+    <path name="voicemmode2-call hearing-aid">
+        <ctl name="AFE_PCM_RX_Voice Mixer VoiceMMode2" value="1"/>
+        <ctl name="VoiceMMode2_Tx Mixer SLIM_0_TX_MMode2" value="1"/>
+    </path>
+
     <path name="voicemmode2-call handset">
         <ctl name="VOC_EXT_EC MUX" value="QUAT_TDM_RX_0" />
         <ctl name="QUAT_TDM_RX_0_Voice Mixer VoiceMMode2" value="1"/>
@@ -2426,7 +2436,11 @@
     </path>
 
     <path name="mmap-playback">
-        <ctl name="SLIMBUS_0_RX Audio Mixer MultiMedia16" value="1"/>
+        <ctl name="QUAT_TDM_RX_0 Audio Mixer MultiMedia16" value="1"/>
+    </path>
+
+    <path name="mmap-playback handset">
+        <ctl name="QUAT_TDM_RX_0 Audio Mixer MultiMedia16" value="1"/>
     </path>
 
     <path name="mmap-playback speaker">
diff --git a/nfc/libnfc-nci.conf b/nfc/libnfc-nci.conf
index 2dea7b6..e17401a 100644
--- a/nfc/libnfc-nci.conf
+++ b/nfc/libnfc-nci.conf
@@ -90,3 +90,9 @@
 ###############################################################################
 # Power state for off host AID routing
 OFFHOST_AID_ROUTE_PWR_STATE=0x3B
+
+###############################################################################
+# Mifare Tag implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
diff --git a/nfc/libnfc-nxp.blueline.conf b/nfc/libnfc-nxp.blueline.conf
index 17d5f64..8f4f5ea 100644
--- a/nfc/libnfc-nxp.blueline.conf
+++ b/nfc/libnfc-nxp.blueline.conf
@@ -25,6 +25,12 @@
 MIFARE_READER_ENABLE=0x01
 
 ###############################################################################
+# Mifare Reader implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
+
+###############################################################################
 # Firmware file type
 #.so file   0x01
 #.bin file  0x02
diff --git a/nfc/libnfc-nxp.blueline.ese.conf b/nfc/libnfc-nxp.blueline.ese.conf
new file mode 100644
index 0000000..2a39b73
--- /dev/null
+++ b/nfc/libnfc-nxp.blueline.ese.conf
@@ -0,0 +1,352 @@
+## This file is used by NFC NXP NCI HAL(external/libnfc-nci/halimpl/pn547)
+## and NFC Service Java Native Interface Extensions (packages/apps/Nfc/nci/jni/extns/pn547)
+###############################################################################
+# Application options
+# Logging Levels
+# NXPLOG_DEFAULT_LOGLEVEL    0x01
+# ANDROID_LOG_DEBUG          0x03
+# ANDROID_LOG_WARN           0x02
+# ANDROID_LOG_ERROR          0x01
+# ANDROID_LOG_SILENT         0x00
+NXPLOG_EXTNS_LOGLEVEL=0x01
+NXPLOG_NCIHAL_LOGLEVEL=0x01
+NXPLOG_NCIX_LOGLEVEL=0x01
+NXPLOG_NCIR_LOGLEVEL=0x01
+NXPLOG_FWDNLD_LOGLEVEL=0x01
+NXPLOG_TML_LOGLEVEL=0x01
+NFC_DEBUG_ENABLED=0x00
+
+###############################################################################
+# Nfc Device Node name
+NXP_NFC_DEV_NODE="/dev/nq-nci"
+
+###############################################################################
+# Extension for Mifare reader enable
+MIFARE_READER_ENABLE=0x01
+
+###############################################################################
+# Mifare Reader implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
+
+###############################################################################
+# Firmware file type
+#.so file   0x01
+#.bin file  0x02
+NXP_FW_TYPE=0x02
+
+###############################################################################
+# System clock source selection configuration
+#define CLK_SRC_XTAL       1
+#define CLK_SRC_PLL        2
+NXP_SYS_CLK_SRC_SEL=0x01
+
+###############################################################################
+# System clock frequency selection configuration
+#define CLK_FREQ_13MHZ         1
+#define CLK_FREQ_19_2MHZ       2
+#define CLK_FREQ_24MHZ         3
+#define CLK_FREQ_26MHZ         4
+#define CLK_FREQ_38_4MHZ       5
+#define CLK_FREQ_52MHZ         6
+NXP_SYS_CLK_FREQ_SEL=0x00
+
+###############################################################################
+# The timeout value to be used for clock request acknowledgment
+# min value = 0x01 to max = 0x06
+NXP_SYS_CLOCK_TO_CFG=0x01
+
+###############################################################################
+# NXP proprietary settings
+NXP_ACT_PROP_EXTN={2F, 02, 00}
+
+###############################################################################
+# NFC forum profile settings
+NXP_NFC_PROFILE_EXTN={20, 02, 05, 01, A0, 44, 01, 00}
+
+###############################################################################
+# NXP TVDD configurations settings
+# Allow NFCC to configure External TVDD, two configurations (1 and 2) supported,
+# out of them only one can be configured at a time.
+NXP_EXT_TVDD_CFG=0x02
+
+###############################################################################
+#config1:SLALM, 3.3V for both RM and CM
+NXP_EXT_TVDD_CFG_1={20, 02, 0F, 01, A0, 0E, 0B, 31, 01, 01, 31, 00, 00, 00, 01, 00, D0, 0C}
+
+###############################################################################
+#config2: use DCDC in CE, use Tx_Pwr_Req, set CFG2 mode, SLALM,
+#monitoring 5V from DCDC, 3.3V for both RM and CM, DCDCWaitTime=4.2ms
+NXP_EXT_TVDD_CFG_2={20, 02, 0F, 01, A0, 0E, 0B, 11, 01, C2, 82, 00, BA, 1E, 14, 00, D0, 0C}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_1={
+20, 02, 19, 03,
+A0, 0D, 03, 24, 03, 80,
+A0, 0D, 06, 08, 37, 08, 76, 00, 00,
+A0, 0D, 06, 08, 42, 00, 02, F2, F2
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_2={
+20, 02, 10, 01, A0, AF, 0C, 83, 42, B2, 80, 00, 83, 08, B2, 80, 00, 77, 08
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_3={
+20, 02, 98, 01, A0, 34, 94, 23, 04, 18, 35, 00, 00, 4B, 00, 00, 71, 00, 00,
+71, 00, 00, 96, 00, 00, BC, 00, 00, BC, 00, 00, E1, 00, 00, 07, 01, 00, 07,
+01, 00, 2C, 01, 00, 2C, 01, 00, 52, 01, 00, 52, 01, 00, 77, 01, 00, 77, 01,
+00, C2, 01, 00, C2, 01, 00, 0D, 02, 00, 0D, 02, 00, 58, 02, 00, 58, 02, 00,
+EE, 02, 00, EE, 02, 00, 18, BC, 00, 00, BC, 00, 00, BC, 00, 00, BC, 00, 00,
+E1, 00, 00, E1, 00, 00, 2C, 01, 00, 2C, 01, 00, 2C, 01, 00, 2C, 01, 00, 2C,
+01, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05,
+00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00,
+DC, 05, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_4={
+20, 02, A4, 01, A0, A9, A0, 00, C1, 00, 0A, 01, 80, 41, 0A, 02, 81, 83, 0A,
+03, C0, 42, 06, 04, 80, 46, 06, 05, C3, 01, 03, 06, C2, 05, 03, 07, C2, 4A,
+03, 07, 81, 01, 01, 08, C3, 8B, 03, 08, C3, 05, 01, 09, C3, 92, 03, 09, C6,
+84, 01, 0A, C4, CC, 03, 0A, C6, 89, 01, 0B, C5, D4, 03, 0B, C7, 92, 01, 0C,
+44, 00, 03, 0C, C7, C6, 01, 0D, 42, 04, 03, 0D, C9, CE, 01, 0E, 42, 48, 03,
+0E, 03, 00, 01, 0F, 43, 50, 03, 0F, 43, 04, 01, 10, 43, 91, 03, 10, 45, 0A,
+01, 11, 44, 95, 03, 11, 46, 11, 01, 12, 46, 8E, 01, 13, 47, C5, 01, 14, 48,
+CC, 01, 15, 4B, D4, 01, 16, 4E, D7, 01, 17, 45, A2, 01, 18, 46, A6, 01, 19,
+46, AE, 01, 1A, 47, B4, 01, 1B, 48, EA, 01, 1C, 49, F0, 01
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_5={
+20, 02, 5B, 01, A0, 0B, 57, ED, 0D, 90, 3F, 0F, 4E, 00, 53, 95, 00, 00, 53,
+9F, 00, 00, 6B, 9F, 00, 00, 78, 9F, 00, 00, 7A, 9F, 00, 00, 86, 9F, 00, 00,
+89, 9F, 00, 00, 95, 9F, 00, 00, 9A, 9F, 00, 00, A4, 9F, 00, 00, A6, 9F, 00,
+00, B3, 9F, 00, 00, B5, 9F, 00, 00, C1, 9F, 00, 00, C4, 1F, 00, 00, D0, 1F,
+00, 00, DA, 1F, 00, 00, E1, 1F, 00, 00, EE, 1F, 00, 00, FA, 1F, 00, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_6={
+20, 02, 18, 02,
+A0, 18, 08, 0C, 00, 54, 00, F4, FF, F9, FF,
+A0, 69, 09, 02, CF, 80, 00, 00, 07, 40, 00, 00
+}
+
+
+###############################################################################
+# Core configuration extensions
+# It includes
+# Wired mode settings A0ED, A0EE
+# Tag Detector A040, A041, A043
+# Low Power mode A007
+# Clock settings A002, A003
+# PbF settings A008
+# Clock timeout settings A004
+# eSE (SVDD) PWR REQ settings A0F2
+# Window size A0D8
+# DWP Speed   A0D5
+# How eSE connected to PN553 A012
+# UICC2 bit rate A0D1
+# SWP1A interface A0D4
+# DWP intf behavior config, SVDD Load activated by default if set to 0x31 A037
+# SPI CL Sync enable  A098
+NXP_CORE_CONF_EXTN={20, 02, 5B, 13,
+    A0, EC, 01, 00,
+    A0, ED, 01, 01,
+    A0, 5E, 01, 01,
+    A0, 12, 01, 02,
+    A0, 40, 01, 01,
+    A0, 41, 01, 02,
+    A0, 43, 01, 50,
+    A0, D1, 01, 02,
+    A0, D4, 01, 00,
+    A0, 37, 01, 35,
+    A0, D8, 01, 02,
+    A0, D5, 01, 0A,
+    A0, 98, 01, 03,
+    A0, 9C, 02, 00, 00,
+    A0, AA, 04, F1, 03, 2D, 01,
+    A0, 38, 04, 14, 0B, 0B, 00,
+    A0, 3A, 08, 0A, 00, 0A, 00, 0A, 00, 0A, 00,
+    A0, B2, 01, 19,
+    A0, 91, 01, 01
+}
+
+###############################################################################
+# Core configuration rf field filter settings to enable set to 01 to disable set
+# to 00 last bit
+NXP_CORE_RF_FIELD={ 20, 02, 05, 01, A0, 62, 01, 00 }
+
+###############################################################################
+# To enable i2c fragmentation set i2c fragmentation enable 0x01 to disable set
+# to 0x00
+NXP_I2C_FRAGMENTATION_ENABLED=0x00
+
+###############################################################################
+# Core configuration settings
+NXP_CORE_CONF={ 20, 02, 2D, 0F,
+        85, 01, 01,
+        28, 01, 00,
+        21, 01, 00,
+        30, 01, 08,
+        31, 01, 03,
+        32, 01, 60,
+        38, 01, 01,
+        33, 00,
+        54, 01, 06,
+        50, 01, 02,
+        5B, 01, 00,
+        80, 01, 01,
+        81, 01, 01,
+        82, 01, 0E,
+        18, 01, 01
+}
+
+###############################################################################
+#Enable SWP full power mode when phone is power off
+NXP_SWP_FULL_PWR_ON=0x00
+
+###############################################################################
+#Set the default Felica T3T System Code OffHost route Location :
+#This settings will be used when application does not set this parameter
+# host  0x00
+# eSE   0x01
+# UICC  0x02
+# UICC2 0x03
+DEFAULT_SYS_CODE_ROUTE=0xC0
+
+###############################################################################
+# AID Matching platform options
+# AID_MATCHING_L 0x01
+# AID_MATCHING_K 0x02
+AID_MATCHING_PLATFORM=0x01
+
+###############################################################################
+#CHINA_TIANJIN_RF_SETTING
+#Enable  0x01
+#Disable  0x00
+NXP_CHINA_TIANJIN_RF_ENABLED=0x01
+
+###############################################################################
+#SWP_SWITCH_TIMEOUT_SETTING
+# Allowed range of swp timeout setting is 0x00 to 0x3C [0 - 60].
+# Timeout in milliseconds, for example
+# No Timeout  0x00
+# 10 millisecond timeout 0x0A
+NXP_SWP_SWITCH_TIMEOUT=0x0A
+
+###############################################################################
+# Enable or Disable RF_STATUS_UPDATE to EseHal module
+# Disable           0x00
+# Enable            0x01
+RF_STATUS_UPDATE_ENABLE=0x00
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_OFFHOST_ROUTE=0x80
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_NFCF_ROUTE=0xC0
+
+###############################################################################
+# Configure the default NfcA/IsoDep techology and protocol route. Can be
+# either a secure element (e.g. 0xF4) or the host (0x00)
+DEFAULT_ROUTE=0x00
+
+###############################################################################
+# Vendor Specific Proprietary Protocol & Discovery Configuration
+# Set to 0xFF if unsupported
+#  byte[0] NCI_PROTOCOL_18092_ACTIVE
+#  byte[1] NCI_PROTOCOL_B_PRIME
+#  byte[2] NCI_PROTOCOL_DUAL
+#  byte[3] NCI_PROTOCOL_15693
+#  byte[4] NCI_PROTOCOL_KOVIO
+#  byte[5] NCI_PROTOCOL_MIFARE
+#  byte[6] NCI_DISCOVERY_TYPE_POLL_KOVIO
+#  byte[7] NCI_DISCOVERY_TYPE_POLL_B_PRIME
+#  byte[8] NCI_DISCOVERY_TYPE_LISTEN_B_PRIME
+NFA_PROPRIETARY_CFG={05, FF, FF, 06, 81, 80, 70, FF, FF}
+
+###############################################################################
+# Bail out mode
+#  If set to 1, NFCC is using bail out mode for either Type A or Type B poll.
+NFA_POLL_BAIL_OUT_MODE=0x01
+
+###############################################################################
+# White list of Hosts
+# This values will be the Hosts(NFCEEs) in the HCI Network.
+DEVICE_HOST_WHITE_LIST={C0, 02}
+
+###############################################################################
+# Extended APDU length for ISO_DEP
+ISO_DEP_MAX_TRANSCEIVE=0xFEFF
+
+###############################################################################
+# Choose the presence-check algorithm for type-4 tag.  If not defined, the default value is 1.
+# 0  NFA_RW_PRES_CHK_DEFAULT; Let stack selects an algorithm
+# 1  NFA_RW_PRES_CHK_I_BLOCK; ISO-DEP protocol's empty I-block
+# 2 NFA_RW_PRES_CHK_ISO_DEP_NAK; Type - 4 tag protocol iso-dep nak presence check
+#    command is sent waiting for rsp and ntf.
+PRESENCE_CHECK_ALGORITHM=2
+###############################################################################
+# Configure the NFC Extras to open and use a static pipe.  If the value is
+# not set or set to 0, then the default is use a dynamic pipe based on a
+# destination gate (see NFA_HCI_DEFAULT_DEST_GATE).  Note there is a value
+# for each UICC (where F3="UICC0" and F4="UICC1")
+OFF_HOST_ESE_PIPE_ID=0x16
+OFF_HOST_SIM_PIPE_ID=0x0A
+
+###############################################################################
+#Set the Felica T3T System Code Power state :
+#This settings will be used when application does not set this parameter
+# bit pos 0 = Switch On
+# bit pos 1 = Switch Off
+# bit pos 2 = Battery Off
+# bit pos 3 = Screen On lock
+# bit pos 4 = Screen off unlock
+# bit pos 5 = Screen Off lock
+DEFAULT_SYS_CODE_PWR_STATE=0x3B
+
+###############################################################################
+# Configure the NFCEEIDs of offhost UICC.
+# UICC  0x80 (UICC)
+OFFHOST_ROUTE_UICC={80}
+
+###############################################################################
+# Configure the NFCEEIDs of offhost eSEs.
+# eSE   0xC0 (eSE)
+OFFHOST_ROUTE_ESE={C0}
+
+###############################################################################
+# Configure the list of NFCEE for the ISO-DEP routing.
+# host  0x00
+# eSE   0xC0 (eSE)
+# UICC  0x80 (UICC)
+DEFAULT_ISODEP_ROUTE=0x80
+
+##############################################################################
+# Update Phase tirm offset signbit
+NXP_PHASE_TIRM_OFFSET_SIGN_UPDATE=0x01
+
diff --git a/nfc/libnfc-nxp.blueline.uicc.conf b/nfc/libnfc-nxp.blueline.uicc.conf
new file mode 100644
index 0000000..4f1a5ce
--- /dev/null
+++ b/nfc/libnfc-nxp.blueline.uicc.conf
@@ -0,0 +1,352 @@
+## This file is used by NFC NXP NCI HAL(external/libnfc-nci/halimpl/pn547)
+## and NFC Service Java Native Interface Extensions (packages/apps/Nfc/nci/jni/extns/pn547)
+###############################################################################
+# Application options
+# Logging Levels
+# NXPLOG_DEFAULT_LOGLEVEL    0x01
+# ANDROID_LOG_DEBUG          0x03
+# ANDROID_LOG_WARN           0x02
+# ANDROID_LOG_ERROR          0x01
+# ANDROID_LOG_SILENT         0x00
+NXPLOG_EXTNS_LOGLEVEL=0x01
+NXPLOG_NCIHAL_LOGLEVEL=0x01
+NXPLOG_NCIX_LOGLEVEL=0x01
+NXPLOG_NCIR_LOGLEVEL=0x01
+NXPLOG_FWDNLD_LOGLEVEL=0x01
+NXPLOG_TML_LOGLEVEL=0x01
+NFC_DEBUG_ENABLED=0x00
+
+###############################################################################
+# Nfc Device Node name
+NXP_NFC_DEV_NODE="/dev/nq-nci"
+
+###############################################################################
+# Extension for Mifare reader enable
+MIFARE_READER_ENABLE=0x01
+
+###############################################################################
+# Mifare Reader implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
+
+###############################################################################
+# Firmware file type
+#.so file   0x01
+#.bin file  0x02
+NXP_FW_TYPE=0x02
+
+###############################################################################
+# System clock source selection configuration
+#define CLK_SRC_XTAL       1
+#define CLK_SRC_PLL        2
+NXP_SYS_CLK_SRC_SEL=0x01
+
+###############################################################################
+# System clock frequency selection configuration
+#define CLK_FREQ_13MHZ         1
+#define CLK_FREQ_19_2MHZ       2
+#define CLK_FREQ_24MHZ         3
+#define CLK_FREQ_26MHZ         4
+#define CLK_FREQ_38_4MHZ       5
+#define CLK_FREQ_52MHZ         6
+NXP_SYS_CLK_FREQ_SEL=0x00
+
+###############################################################################
+# The timeout value to be used for clock request acknowledgment
+# min value = 0x01 to max = 0x06
+NXP_SYS_CLOCK_TO_CFG=0x01
+
+###############################################################################
+# NXP proprietary settings
+NXP_ACT_PROP_EXTN={2F, 02, 00}
+
+###############################################################################
+# NFC forum profile settings
+NXP_NFC_PROFILE_EXTN={20, 02, 05, 01, A0, 44, 01, 00}
+
+###############################################################################
+# NXP TVDD configurations settings
+# Allow NFCC to configure External TVDD, two configurations (1 and 2) supported,
+# out of them only one can be configured at a time.
+NXP_EXT_TVDD_CFG=0x02
+
+###############################################################################
+#config1:SLALM, 3.3V for both RM and CM
+NXP_EXT_TVDD_CFG_1={20, 02, 0F, 01, A0, 0E, 0B, 31, 01, 01, 31, 00, 00, 00, 01, 00, D0, 0C}
+
+###############################################################################
+#config2: use DCDC in CE, use Tx_Pwr_Req, set CFG2 mode, SLALM,
+#monitoring 5V from DCDC, 3.3V for both RM and CM, DCDCWaitTime=4.2ms
+NXP_EXT_TVDD_CFG_2={20, 02, 0F, 01, A0, 0E, 0B, 11, 01, C2, 82, 00, BA, 1E, 14, 00, D0, 0C}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_1={
+20, 02, 19, 03,
+A0, 0D, 03, 24, 03, 80,
+A0, 0D, 06, 08, 37, 08, 76, 00, 00,
+A0, 0D, 06, 08, 42, 00, 02, F2, F2
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_2={
+20, 02, 10, 01, A0, AF, 0C, 83, 42, B2, 80, 00, 83, 08, B2, 80, 00, 77, 08
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_3={
+20, 02, 98, 01, A0, 34, 94, 23, 04, 18, 35, 00, 00, 4B, 00, 00, 71, 00, 00,
+71, 00, 00, 96, 00, 00, BC, 00, 00, BC, 00, 00, E1, 00, 00, 07, 01, 00, 07,
+01, 00, 2C, 01, 00, 2C, 01, 00, 52, 01, 00, 52, 01, 00, 77, 01, 00, 77, 01,
+00, C2, 01, 00, C2, 01, 00, 0D, 02, 00, 0D, 02, 00, 58, 02, 00, 58, 02, 00,
+EE, 02, 00, EE, 02, 00, 18, BC, 00, 00, BC, 00, 00, BC, 00, 00, BC, 00, 00,
+E1, 00, 00, E1, 00, 00, 2C, 01, 00, 2C, 01, 00, 2C, 01, 00, 2C, 01, 00, 2C,
+01, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05,
+00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00,
+DC, 05, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_4={
+20, 02, A4, 01, A0, A9, A0, 00, C1, 00, 0A, 01, 80, 41, 0A, 02, 81, 83, 0A,
+03, C0, 42, 06, 04, 80, 46, 06, 05, C3, 01, 03, 06, C2, 05, 03, 07, C2, 4A,
+03, 07, 81, 01, 01, 08, C3, 8B, 03, 08, C3, 05, 01, 09, C3, 92, 03, 09, C6,
+84, 01, 0A, C4, CC, 03, 0A, C6, 89, 01, 0B, C5, D4, 03, 0B, C7, 92, 01, 0C,
+44, 00, 03, 0C, C7, C6, 01, 0D, 42, 04, 03, 0D, C9, CE, 01, 0E, 42, 48, 03,
+0E, 03, 00, 01, 0F, 43, 50, 03, 0F, 43, 04, 01, 10, 43, 91, 03, 10, 45, 0A,
+01, 11, 44, 95, 03, 11, 46, 11, 01, 12, 46, 8E, 01, 13, 47, C5, 01, 14, 48,
+CC, 01, 15, 4B, D4, 01, 16, 4E, D7, 01, 17, 45, A2, 01, 18, 46, A6, 01, 19,
+46, AE, 01, 1A, 47, B4, 01, 1B, 48, EA, 01, 1C, 49, F0, 01
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_5={
+20, 02, 5B, 01, A0, 0B, 57, ED, 0D, 90, 3F, 0F, 4E, 00, 53, 95, 00, 00, 53,
+9F, 00, 00, 6B, 9F, 00, 00, 78, 9F, 00, 00, 7A, 9F, 00, 00, 86, 9F, 00, 00,
+89, 9F, 00, 00, 95, 9F, 00, 00, 9A, 9F, 00, 00, A4, 9F, 00, 00, A6, 9F, 00,
+00, B3, 9F, 00, 00, B5, 9F, 00, 00, C1, 9F, 00, 00, C4, 1F, 00, 00, D0, 1F,
+00, 00, DA, 1F, 00, 00, E1, 1F, 00, 00, EE, 1F, 00, 00, FA, 1F, 00, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_6={
+20, 02, 18, 02,
+A0, 18, 08, 0C, 00, 54, 00, F4, FF, F9, FF,
+A0, 69, 09, 02, CF, 80, 00, 00, 07, 40, 00, 00
+}
+
+
+###############################################################################
+# Core configuration extensions
+# It includes
+# Wired mode settings A0ED, A0EE
+# Tag Detector A040, A041, A043
+# Low Power mode A007
+# Clock settings A002, A003
+# PbF settings A008
+# Clock timeout settings A004
+# eSE (SVDD) PWR REQ settings A0F2
+# Window size A0D8
+# DWP Speed   A0D5
+# How eSE connected to PN553 A012
+# UICC2 bit rate A0D1
+# SWP1A interface A0D4
+# DWP intf behavior config, SVDD Load activated by default if set to 0x31 A037
+# SPI CL Sync enable  A098
+NXP_CORE_CONF_EXTN={20, 02, 5B, 13,
+    A0, EC, 01, 01,
+    A0, ED, 01, 00,
+    A0, 5E, 01, 01,
+    A0, 12, 01, 02,
+    A0, 40, 01, 01,
+    A0, 41, 01, 02,
+    A0, 43, 01, 50,
+    A0, D1, 01, 02,
+    A0, D4, 01, 00,
+    A0, 37, 01, 35,
+    A0, D8, 01, 02,
+    A0, D5, 01, 0A,
+    A0, 98, 01, 03,
+    A0, 9C, 02, 00, 00,
+    A0, AA, 04, F1, 03, 2D, 01,
+    A0, 38, 04, 14, 0B, 0B, 00,
+    A0, 3A, 08, 0A, 00, 0A, 00, 0A, 00, 0A, 00,
+    A0, B2, 01, 19,
+    A0, 91, 01, 01
+}
+
+###############################################################################
+# Core configuration rf field filter settings to enable set to 01 to disable set
+# to 00 last bit
+NXP_CORE_RF_FIELD={ 20, 02, 05, 01, A0, 62, 01, 00 }
+
+###############################################################################
+# To enable i2c fragmentation set i2c fragmentation enable 0x01 to disable set
+# to 0x00
+NXP_I2C_FRAGMENTATION_ENABLED=0x00
+
+###############################################################################
+# Core configuration settings
+NXP_CORE_CONF={ 20, 02, 2D, 0F,
+        85, 01, 01,
+        28, 01, 00,
+        21, 01, 00,
+        30, 01, 08,
+        31, 01, 03,
+        32, 01, 60,
+        38, 01, 01,
+        33, 00,
+        54, 01, 06,
+        50, 01, 02,
+        5B, 01, 00,
+        80, 01, 01,
+        81, 01, 01,
+        82, 01, 0E,
+        18, 01, 01
+}
+
+###############################################################################
+#Enable SWP full power mode when phone is power off
+NXP_SWP_FULL_PWR_ON=0x00
+
+###############################################################################
+#Set the default Felica T3T System Code OffHost route Location :
+#This settings will be used when application does not set this parameter
+# host  0x00
+# eSE   0x01
+# UICC  0x02
+# UICC2 0x03
+DEFAULT_SYS_CODE_ROUTE=0xC0
+
+###############################################################################
+# AID Matching platform options
+# AID_MATCHING_L 0x01
+# AID_MATCHING_K 0x02
+AID_MATCHING_PLATFORM=0x01
+
+###############################################################################
+#CHINA_TIANJIN_RF_SETTING
+#Enable  0x01
+#Disable  0x00
+NXP_CHINA_TIANJIN_RF_ENABLED=0x01
+
+###############################################################################
+#SWP_SWITCH_TIMEOUT_SETTING
+# Allowed range of swp timeout setting is 0x00 to 0x3C [0 - 60].
+# Timeout in milliseconds, for example
+# No Timeout  0x00
+# 10 millisecond timeout 0x0A
+NXP_SWP_SWITCH_TIMEOUT=0x0A
+
+###############################################################################
+# Enable or Disable RF_STATUS_UPDATE to EseHal module
+# Disable           0x00
+# Enable            0x01
+RF_STATUS_UPDATE_ENABLE=0x00
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_OFFHOST_ROUTE=0x80
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_NFCF_ROUTE=0x80
+
+###############################################################################
+# Configure the default NfcA/IsoDep techology and protocol route. Can be
+# either a secure element (e.g. 0xF4) or the host (0x00)
+DEFAULT_ROUTE=0x00
+
+###############################################################################
+# Vendor Specific Proprietary Protocol & Discovery Configuration
+# Set to 0xFF if unsupported
+#  byte[0] NCI_PROTOCOL_18092_ACTIVE
+#  byte[1] NCI_PROTOCOL_B_PRIME
+#  byte[2] NCI_PROTOCOL_DUAL
+#  byte[3] NCI_PROTOCOL_15693
+#  byte[4] NCI_PROTOCOL_KOVIO
+#  byte[5] NCI_PROTOCOL_MIFARE
+#  byte[6] NCI_DISCOVERY_TYPE_POLL_KOVIO
+#  byte[7] NCI_DISCOVERY_TYPE_POLL_B_PRIME
+#  byte[8] NCI_DISCOVERY_TYPE_LISTEN_B_PRIME
+NFA_PROPRIETARY_CFG={05, FF, FF, 06, 81, 80, 70, FF, FF}
+
+###############################################################################
+# Bail out mode
+#  If set to 1, NFCC is using bail out mode for either Type A or Type B poll.
+NFA_POLL_BAIL_OUT_MODE=0x01
+
+###############################################################################
+# White list of Hosts
+# This values will be the Hosts(NFCEEs) in the HCI Network.
+DEVICE_HOST_WHITE_LIST={C0, 02}
+
+###############################################################################
+# Extended APDU length for ISO_DEP
+ISO_DEP_MAX_TRANSCEIVE=0xFEFF
+
+###############################################################################
+# Choose the presence-check algorithm for type-4 tag.  If not defined, the default value is 1.
+# 0  NFA_RW_PRES_CHK_DEFAULT; Let stack selects an algorithm
+# 1  NFA_RW_PRES_CHK_I_BLOCK; ISO-DEP protocol's empty I-block
+# 2 NFA_RW_PRES_CHK_ISO_DEP_NAK; Type - 4 tag protocol iso-dep nak presence check
+#    command is sent waiting for rsp and ntf.
+PRESENCE_CHECK_ALGORITHM=2
+###############################################################################
+# Configure the NFC Extras to open and use a static pipe.  If the value is
+# not set or set to 0, then the default is use a dynamic pipe based on a
+# destination gate (see NFA_HCI_DEFAULT_DEST_GATE).  Note there is a value
+# for each UICC (where F3="UICC0" and F4="UICC1")
+OFF_HOST_ESE_PIPE_ID=0x16
+OFF_HOST_SIM_PIPE_ID=0x0A
+
+###############################################################################
+#Set the Felica T3T System Code Power state :
+#This settings will be used when application does not set this parameter
+# bit pos 0 = Switch On
+# bit pos 1 = Switch Off
+# bit pos 2 = Battery Off
+# bit pos 3 = Screen On lock
+# bit pos 4 = Screen off unlock
+# bit pos 5 = Screen Off lock
+DEFAULT_SYS_CODE_PWR_STATE=0x3B
+
+###############################################################################
+# Configure the NFCEEIDs of offhost UICC.
+# UICC  0x80 (UICC)
+OFFHOST_ROUTE_UICC={80}
+
+###############################################################################
+# Configure the NFCEEIDs of offhost eSEs.
+# eSE   0xC0 (eSE)
+OFFHOST_ROUTE_ESE={C0}
+
+###############################################################################
+# Configure the list of NFCEE for the ISO-DEP routing.
+# host  0x00
+# eSE   0xC0 (eSE)
+# UICC  0x80 (UICC)
+DEFAULT_ISODEP_ROUTE=0x80
+
+##############################################################################
+# Update Phase tirm offset signbit
+NXP_PHASE_TIRM_OFFSET_SIGN_UPDATE=0x01
+
diff --git a/nfc/libnfc-nxp.crosshatch.conf b/nfc/libnfc-nxp.crosshatch.conf
index e5dd65f..66bda79 100644
--- a/nfc/libnfc-nxp.crosshatch.conf
+++ b/nfc/libnfc-nxp.crosshatch.conf
@@ -25,6 +25,12 @@
 MIFARE_READER_ENABLE=0x01
 
 ###############################################################################
+# Mifare Reader implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
+
+###############################################################################
 # Firmware file type
 #.so file   0x01
 #.bin file  0x02
diff --git a/nfc/libnfc-nxp.crosshatch.ese.conf b/nfc/libnfc-nxp.crosshatch.ese.conf
new file mode 100644
index 0000000..2d3a72d
--- /dev/null
+++ b/nfc/libnfc-nxp.crosshatch.ese.conf
@@ -0,0 +1,351 @@
+## This file is used by NFC NXP NCI HAL(external/libnfc-nci/halimpl/pn547)
+## and NFC Service Java Native Interface Extensions (packages/apps/Nfc/nci/jni/extns/pn547)
+###############################################################################
+# Application options
+# Logging Levels
+# NXPLOG_DEFAULT_LOGLEVEL    0x01
+# ANDROID_LOG_DEBUG          0x03
+# ANDROID_LOG_WARN           0x02
+# ANDROID_LOG_ERROR          0x01
+# ANDROID_LOG_SILENT         0x00
+NXPLOG_EXTNS_LOGLEVEL=0x01
+NXPLOG_NCIHAL_LOGLEVEL=0x01
+NXPLOG_NCIX_LOGLEVEL=0x01
+NXPLOG_NCIR_LOGLEVEL=0x01
+NXPLOG_FWDNLD_LOGLEVEL=0x01
+NXPLOG_TML_LOGLEVEL=0x01
+NFC_DEBUG_ENABLED=0x00
+
+###############################################################################
+# Nfc Device Node name
+NXP_NFC_DEV_NODE="/dev/nq-nci"
+
+###############################################################################
+# Extension for Mifare reader enable
+MIFARE_READER_ENABLE=0x01
+
+###############################################################################
+# Mifare Reader implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
+
+###############################################################################
+# Firmware file type
+#.so file   0x01
+#.bin file  0x02
+NXP_FW_TYPE=0x02
+
+###############################################################################
+# System clock source selection configuration
+#define CLK_SRC_XTAL       1
+#define CLK_SRC_PLL        2
+NXP_SYS_CLK_SRC_SEL=0x01
+
+###############################################################################
+# System clock frequency selection configuration
+#define CLK_FREQ_13MHZ         1
+#define CLK_FREQ_19_2MHZ       2
+#define CLK_FREQ_24MHZ         3
+#define CLK_FREQ_26MHZ         4
+#define CLK_FREQ_38_4MHZ       5
+#define CLK_FREQ_52MHZ         6
+NXP_SYS_CLK_FREQ_SEL=0x00
+
+###############################################################################
+# The timeout value to be used for clock request acknowledgment
+# min value = 0x01 to max = 0x06
+NXP_SYS_CLOCK_TO_CFG=0x01
+
+###############################################################################
+# NXP proprietary settings
+NXP_ACT_PROP_EXTN={2F, 02, 00}
+
+###############################################################################
+# NFC forum profile settings
+NXP_NFC_PROFILE_EXTN={20, 02, 05, 01, A0, 44, 01, 00}
+
+###############################################################################
+# NXP TVDD configurations settings
+# Allow NFCC to configure External TVDD, two configurations (1 and 2) supported,
+# out of them only one can be configured at a time.
+NXP_EXT_TVDD_CFG=0x02
+
+###############################################################################
+#config1:SLALM, 3.3V for both RM and CM
+NXP_EXT_TVDD_CFG_1={20, 02, 0F, 01, A0, 0E, 0B, 31, 01, 01, 31, 00, 00, 00, 01, 00, D0, 0C}
+
+###############################################################################
+#config2: use DCDC in CE, use Tx_Pwr_Req, set CFG2 mode, SLALM,
+#monitoring 5V from DCDC, 3.3V for both RM and CM, DCDCWaitTime=4.2ms
+NXP_EXT_TVDD_CFG_2={20, 02, 0F, 01, A0, 0E, 0B, 11, 01, C2, 82, 00, BA, 1E, 14, 00, D0, 0C}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_1={
+20, 02, 19, 03,
+A0, 0D, 03, 24, 03, 80,
+A0, 0D, 06, 08, 37, 08, 76, 00, 00,
+A0, 0D, 06, 08, 42, 00, 02, F9, F9
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_2={
+20, 02, 10, 01, A0, AF, 0C, 83, C3, 74, 80, 00, 83, 8B, 74, 80, 00, 77, 08
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_3={
+20, 02, 98, 01, A0, 34, 94, 23, 04, 18, 35, 00, 00, 4B, 00, 00, 71, 00, 00,
+71, 00, 00, 96, 00, 00, BC, 00, 00, BC, 00, 00, E1, 00, 00, 07, 01, 00, 07,
+01, 00, 2C, 01, 00, 2C, 01, 00, 52, 01, 00, 52, 01, 00, 77, 01, 00, 77, 01,
+00, C2, 01, 00, C2, 01, 00, 0D, 02, 00, 0D, 02, 00, 58, 02, 00, 58, 02, 00,
+EE, 02, 00, EE, 02, 00, 18, BC, 00, 00, BC, 00, 00, BC, 00, 00, BC, 00, 00,
+E1, 00, 00, E1, 00, 00, 19, 01, 00, 19, 01, 00, 19, 01, 00, 19, 01, 00, 2C,
+01, 00, 2C, 01, 00, C2, 01, 00, C2, 01, 00, 58, 02, 00, 58, 02, 00, DC, 05,
+00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00,
+DC, 05, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_4={
+20, 02, A4, 01, A0, A9, A0, 00, C1, 00, 0A, 01, 80, 41, 0A, 02, 81, 83, 0A,
+03, C0, 42, 06, 04, 80, 46, 06, 05, C3, 01, 03, 06, C2, 05, 03, 07, C2, 4A,
+03, 07, 81, 01, 01, 08, C3, 8B, 03, 08, C3, 05, 01, 09, C3, 92, 03, 09, C6,
+84, 01, 0A, C4, CC, 03, 0A, C6, 89, 01, 0B, C5, D4, 03, 0B, C7, 92, 01, 0C,
+44, 00, 03, 0C, C7, C6, 01, 0D, 42, 04, 03, 0D, C9, CE, 01, 0E, 42, 48, 03,
+0E, 03, 00, 01, 0F, 43, 50, 03, 0F, 43, 04, 01, 10, 43, 91, 03, 10, 45, 0A,
+01, 11, 44, 95, 03, 11, 46, 11, 01, 12, 46, 8E, 01, 13, 47, C5, 01, 14, 48,
+CC, 01, 15, 4B, D4, 01, 16, 4E, D7, 01, 17, 45, A2, 01, 18, 46, A6, 01, 19,
+46, AE, 01, 1A, 47, B4, 01, 1B, 48, EA, 01, 1C, 49, F0, 01
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_5={
+20, 02, 5B, 01, A0, 0B, 57, ED, 0D, 90, 3F, 0F, 4E, 00, 53, 95, 00, 00, 53,
+9F, 00, 00, 6B, 9F, 00, 00, 78, 9F, 00, 00, 7A, 9F, 00, 00, 86, 9F, 00, 00,
+89, 9F, 00, 00, 95, 9F, 00, 00, 9A, 9F, 00, 00, A4, 9F, 00, 00, A6, 9F, 00,
+00, B3, 9F, 00, 00, B5, 9F, 00, 00, C1, 9F, 00, 00, C4, 1F, 00, 00, D0, 1F,
+00, 00, DA, 1F, 00, 00, E1, 1F, 00, 00, EE, 1F, 00, 00, FA, 1F, 00, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_6={
+20, 02, 18, 02,
+A0, 18, 08, 34, 00, A1, 00, 81, FF, 30, 00,
+A0, 69, 09, 02, CF, 80, 00, 00, 07, 40, 00, 00
+}
+
+###############################################################################
+# Core configuration extensions
+# It includes
+# Wired mode settings A0ED, A0EE
+# Tag Detector A040, A041, A043
+# Low Power mode A007
+# Clock settings A002, A003
+# PbF settings A008
+# Clock timeout settings A004
+# eSE (SVDD) PWR REQ settings A0F2
+# Window size A0D8
+# DWP Speed   A0D5
+# How eSE connected to PN553 A012
+# UICC2 bit rate A0D1
+# SWP1A interface A0D4
+# DWP intf behavior config, SVDD Load activated by default if set to 0x31 A037
+# SPI CL Sync enable  A098
+NXP_CORE_CONF_EXTN={20, 02, 5B, 13,
+    A0, EC, 01, 00,
+    A0, ED, 01, 01,
+    A0, 5E, 01, 01,
+    A0, 12, 01, 02,
+    A0, 40, 01, 01,
+    A0, 41, 01, 02,
+    A0, 43, 01, 50,
+    A0, D1, 01, 02,
+    A0, D4, 01, 00,
+    A0, 37, 01, 35,
+    A0, D8, 01, 02,
+    A0, D5, 01, 0A,
+    A0, 98, 01, 03,
+    A0, 9C, 02, 00, 00,
+    A0, AA, 04, FD, 03, F4, 01,
+    A0, 38, 04, 1A, 0B, 0B, 00,
+    A0, 3A, 08, 96, 00, 96, 00, 96, 00, 96, 00,
+    A0, B2, 01, 19,
+    A0, 91, 01, 01
+}
+
+###############################################################################
+# Core configuration rf field filter settings to enable set to 01 to disable set
+# to 00 last bit
+NXP_CORE_RF_FIELD={ 20, 02, 05, 01, A0, 62, 01, 00 }
+
+###############################################################################
+# To enable i2c fragmentation set i2c fragmentation enable 0x01 to disable set
+# to 0x00
+NXP_I2C_FRAGMENTATION_ENABLED=0x00
+
+###############################################################################
+# Core configuration settings
+NXP_CORE_CONF={ 20, 02, 2D, 0F,
+        85, 01, 01,
+        28, 01, 00,
+        21, 01, 00,
+        30, 01, 08,
+        31, 01, 03,
+        32, 01, 60,
+        38, 01, 01,
+        33, 00,
+        54, 01, 06,
+        50, 01, 02,
+        5B, 01, 00,
+        80, 01, 01,
+        81, 01, 01,
+        82, 01, 0E,
+        18, 01, 01
+}
+
+###############################################################################
+#Enable SWP full power mode when phone is power off
+NXP_SWP_FULL_PWR_ON=0x00
+
+###############################################################################
+#Set the default Felica T3T System Code OffHost route Location :
+#This settings will be used when application does not set this parameter
+# host  0x00
+# eSE   0x01
+# UICC  0x02
+# UICC2 0x03
+DEFAULT_SYS_CODE_ROUTE=0xC0
+
+###############################################################################
+# AID Matching platform options
+# AID_MATCHING_L 0x01
+# AID_MATCHING_K 0x02
+AID_MATCHING_PLATFORM=0x01
+
+###############################################################################
+#CHINA_TIANJIN_RF_SETTING
+#Enable  0x01
+#Disable  0x00
+NXP_CHINA_TIANJIN_RF_ENABLED=0x01
+
+###############################################################################
+#SWP_SWITCH_TIMEOUT_SETTING
+# Allowed range of swp timeout setting is 0x00 to 0x3C [0 - 60].
+# Timeout in milliseconds, for example
+# No Timeout  0x00
+# 10 millisecond timeout 0x0A
+NXP_SWP_SWITCH_TIMEOUT=0x0A
+
+###############################################################################
+# Enable or Disable RF_STATUS_UPDATE to EseHal module
+# Disable           0x00
+# Enable            0x01
+RF_STATUS_UPDATE_ENABLE=0x00
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_OFFHOST_ROUTE=0x80
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_NFCF_ROUTE=0xC0
+
+###############################################################################
+# Configure the default NfcA/IsoDep techology and protocol route. Can be
+# either a secure element (e.g. 0xF4) or the host (0x00)
+DEFAULT_ROUTE=0x00
+
+###############################################################################
+# Vendor Specific Proprietary Protocol & Discovery Configuration
+# Set to 0xFF if unsupported
+#  byte[0] NCI_PROTOCOL_18092_ACTIVE
+#  byte[1] NCI_PROTOCOL_B_PRIME
+#  byte[2] NCI_PROTOCOL_DUAL
+#  byte[3] NCI_PROTOCOL_15693
+#  byte[4] NCI_PROTOCOL_KOVIO
+#  byte[5] NCI_PROTOCOL_MIFARE
+#  byte[6] NCI_DISCOVERY_TYPE_POLL_KOVIO
+#  byte[7] NCI_DISCOVERY_TYPE_POLL_B_PRIME
+#  byte[8] NCI_DISCOVERY_TYPE_LISTEN_B_PRIME
+NFA_PROPRIETARY_CFG={05, FF, FF, 06, 81, 80, 70, FF, FF}
+
+###############################################################################
+# Bail out mode
+#  If set to 1, NFCC is using bail out mode for either Type A or Type B poll.
+NFA_POLL_BAIL_OUT_MODE=0x01
+
+###############################################################################
+# White list of Hosts
+# This values will be the Hosts(NFCEEs) in the HCI Network.
+DEVICE_HOST_WHITE_LIST={C0, 02}
+
+###############################################################################
+# Extended APDU length for ISO_DEP
+ISO_DEP_MAX_TRANSCEIVE=0xFEFF
+
+###############################################################################
+# Choose the presence-check algorithm for type-4 tag.  If not defined, the default value is 1.
+# 0  NFA_RW_PRES_CHK_DEFAULT; Let stack selects an algorithm
+# 1  NFA_RW_PRES_CHK_I_BLOCK; ISO-DEP protocol's empty I-block
+# 2 NFA_RW_PRES_CHK_ISO_DEP_NAK; Type - 4 tag protocol iso-dep nak presence check
+#    command is sent waiting for rsp and ntf.
+PRESENCE_CHECK_ALGORITHM=2
+###############################################################################
+# Configure the NFC Extras to open and use a static pipe.  If the value is
+# not set or set to 0, then the default is use a dynamic pipe based on a
+# destination gate (see NFA_HCI_DEFAULT_DEST_GATE).  Note there is a value
+# for each UICC (where F3="UICC0" and F4="UICC1")
+OFF_HOST_ESE_PIPE_ID=0x16
+OFF_HOST_SIM_PIPE_ID=0x0A
+
+###############################################################################
+#Set the Felica T3T System Code Power state :
+#This settings will be used when application does not set this parameter
+# bit pos 0 = Switch On
+# bit pos 1 = Switch Off
+# bit pos 2 = Battery Off
+# bit pos 3 = Screen On lock
+# bit pos 4 = Screen off unlock
+# bit pos 5 = Screen Off lock
+DEFAULT_SYS_CODE_PWR_STATE=0x3B
+
+###############################################################################
+# Configure the NFCEEIDs of offhost UICC.
+# UICC  0x80 (UICC)
+OFFHOST_ROUTE_UICC={80}
+
+###############################################################################
+# Configure the NFCEEIDs of offhost eSEs.
+# eSE   0xC0 (eSE)
+OFFHOST_ROUTE_ESE={C0}
+
+###############################################################################
+# Configure the list of NFCEE for the ISO-DEP routing.
+# host  0x00
+# eSE   0xC0 (eSE)
+# UICC  0x80 (UICC)
+DEFAULT_ISODEP_ROUTE=0x80
+
+###############################################################################
+# Update Phase tirm offset signbit
+NXP_PHASE_TIRM_OFFSET_SIGN_UPDATE=0x01
+
diff --git a/nfc/libnfc-nxp.crosshatch.uicc.conf b/nfc/libnfc-nxp.crosshatch.uicc.conf
new file mode 100644
index 0000000..a9d1821
--- /dev/null
+++ b/nfc/libnfc-nxp.crosshatch.uicc.conf
@@ -0,0 +1,351 @@
+## This file is used by NFC NXP NCI HAL(external/libnfc-nci/halimpl/pn547)
+## and NFC Service Java Native Interface Extensions (packages/apps/Nfc/nci/jni/extns/pn547)
+###############################################################################
+# Application options
+# Logging Levels
+# NXPLOG_DEFAULT_LOGLEVEL    0x01
+# ANDROID_LOG_DEBUG          0x03
+# ANDROID_LOG_WARN           0x02
+# ANDROID_LOG_ERROR          0x01
+# ANDROID_LOG_SILENT         0x00
+NXPLOG_EXTNS_LOGLEVEL=0x01
+NXPLOG_NCIHAL_LOGLEVEL=0x01
+NXPLOG_NCIX_LOGLEVEL=0x01
+NXPLOG_NCIR_LOGLEVEL=0x01
+NXPLOG_FWDNLD_LOGLEVEL=0x01
+NXPLOG_TML_LOGLEVEL=0x01
+NFC_DEBUG_ENABLED=0x00
+
+###############################################################################
+# Nfc Device Node name
+NXP_NFC_DEV_NODE="/dev/nq-nci"
+
+###############################################################################
+# Extension for Mifare reader enable
+MIFARE_READER_ENABLE=0x01
+
+###############################################################################
+# Mifare Reader implementation
+# 0: General implementation
+# 1: Legacy implementation
+LEGACY_MIFARE_READER=0
+
+###############################################################################
+# Firmware file type
+#.so file   0x01
+#.bin file  0x02
+NXP_FW_TYPE=0x02
+
+###############################################################################
+# System clock source selection configuration
+#define CLK_SRC_XTAL       1
+#define CLK_SRC_PLL        2
+NXP_SYS_CLK_SRC_SEL=0x01
+
+###############################################################################
+# System clock frequency selection configuration
+#define CLK_FREQ_13MHZ         1
+#define CLK_FREQ_19_2MHZ       2
+#define CLK_FREQ_24MHZ         3
+#define CLK_FREQ_26MHZ         4
+#define CLK_FREQ_38_4MHZ       5
+#define CLK_FREQ_52MHZ         6
+NXP_SYS_CLK_FREQ_SEL=0x00
+
+###############################################################################
+# The timeout value to be used for clock request acknowledgment
+# min value = 0x01 to max = 0x06
+NXP_SYS_CLOCK_TO_CFG=0x01
+
+###############################################################################
+# NXP proprietary settings
+NXP_ACT_PROP_EXTN={2F, 02, 00}
+
+###############################################################################
+# NFC forum profile settings
+NXP_NFC_PROFILE_EXTN={20, 02, 05, 01, A0, 44, 01, 00}
+
+###############################################################################
+# NXP TVDD configurations settings
+# Allow NFCC to configure External TVDD, two configurations (1 and 2) supported,
+# out of them only one can be configured at a time.
+NXP_EXT_TVDD_CFG=0x02
+
+###############################################################################
+#config1:SLALM, 3.3V for both RM and CM
+NXP_EXT_TVDD_CFG_1={20, 02, 0F, 01, A0, 0E, 0B, 31, 01, 01, 31, 00, 00, 00, 01, 00, D0, 0C}
+
+###############################################################################
+#config2: use DCDC in CE, use Tx_Pwr_Req, set CFG2 mode, SLALM,
+#monitoring 5V from DCDC, 3.3V for both RM and CM, DCDCWaitTime=4.2ms
+NXP_EXT_TVDD_CFG_2={20, 02, 0F, 01, A0, 0E, 0B, 11, 01, C2, 82, 00, BA, 1E, 14, 00, D0, 0C}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_1={
+20, 02, 19, 03,
+A0, 0D, 03, 24, 03, 80,
+A0, 0D, 06, 08, 37, 08, 76, 00, 00,
+A0, 0D, 06, 08, 42, 00, 02, F9, F9
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_2={
+20, 02, 10, 01, A0, AF, 0C, 83, C3, 74, 80, 00, 83, 8B, 74, 80, 00, 77, 08
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_3={
+20, 02, 98, 01, A0, 34, 94, 23, 04, 18, 35, 00, 00, 4B, 00, 00, 71, 00, 00,
+71, 00, 00, 96, 00, 00, BC, 00, 00, BC, 00, 00, E1, 00, 00, 07, 01, 00, 07,
+01, 00, 2C, 01, 00, 2C, 01, 00, 52, 01, 00, 52, 01, 00, 77, 01, 00, 77, 01,
+00, C2, 01, 00, C2, 01, 00, 0D, 02, 00, 0D, 02, 00, 58, 02, 00, 58, 02, 00,
+EE, 02, 00, EE, 02, 00, 18, BC, 00, 00, BC, 00, 00, BC, 00, 00, BC, 00, 00,
+E1, 00, 00, E1, 00, 00, 19, 01, 00, 19, 01, 00, 19, 01, 00, 19, 01, 00, 2C,
+01, 00, 2C, 01, 00, C2, 01, 00, C2, 01, 00, 58, 02, 00, 58, 02, 00, DC, 05,
+00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00, DC, 05, 00,
+DC, 05, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_4={
+20, 02, A4, 01, A0, A9, A0, 00, C1, 00, 0A, 01, 80, 41, 0A, 02, 81, 83, 0A,
+03, C0, 42, 06, 04, 80, 46, 06, 05, C3, 01, 03, 06, C2, 05, 03, 07, C2, 4A,
+03, 07, 81, 01, 01, 08, C3, 8B, 03, 08, C3, 05, 01, 09, C3, 92, 03, 09, C6,
+84, 01, 0A, C4, CC, 03, 0A, C6, 89, 01, 0B, C5, D4, 03, 0B, C7, 92, 01, 0C,
+44, 00, 03, 0C, C7, C6, 01, 0D, 42, 04, 03, 0D, C9, CE, 01, 0E, 42, 48, 03,
+0E, 03, 00, 01, 0F, 43, 50, 03, 0F, 43, 04, 01, 10, 43, 91, 03, 10, 45, 0A,
+01, 11, 44, 95, 03, 11, 46, 11, 01, 12, 46, 8E, 01, 13, 47, C5, 01, 14, 48,
+CC, 01, 15, 4B, D4, 01, 16, 4E, D7, 01, 17, 45, A2, 01, 18, 46, A6, 01, 19,
+46, AE, 01, 1A, 47, B4, 01, 1B, 48, EA, 01, 1C, 49, F0, 01
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_5={
+20, 02, 5B, 01, A0, 0B, 57, ED, 0D, 90, 3F, 0F, 4E, 00, 53, 95, 00, 00, 53,
+9F, 00, 00, 6B, 9F, 00, 00, 78, 9F, 00, 00, 7A, 9F, 00, 00, 86, 9F, 00, 00,
+89, 9F, 00, 00, 95, 9F, 00, 00, 9A, 9F, 00, 00, A4, 9F, 00, 00, A6, 9F, 00,
+00, B3, 9F, 00, 00, B5, 9F, 00, 00, C1, 9F, 00, 00, C4, 1F, 00, 00, D0, 1F,
+00, 00, DA, 1F, 00, 00, E1, 1F, 00, 00, EE, 1F, 00, 00, FA, 1F, 00, 00
+}
+
+###############################################################################
+# NXP RF configuration ALM/PLM settings
+# This section needs to be updated with the correct values based on the platform
+NXP_RF_CONF_BLK_6={
+20, 02, 18, 02,
+A0, 18, 08, 34, 00, A1, 00, 81, FF, 30, 00,
+A0, 69, 09, 02, CF, 80, 00, 00, 07, 40, 00, 00
+}
+
+###############################################################################
+# Core configuration extensions
+# It includes
+# Wired mode settings A0ED, A0EE
+# Tag Detector A040, A041, A043
+# Low Power mode A007
+# Clock settings A002, A003
+# PbF settings A008
+# Clock timeout settings A004
+# eSE (SVDD) PWR REQ settings A0F2
+# Window size A0D8
+# DWP Speed   A0D5
+# How eSE connected to PN553 A012
+# UICC2 bit rate A0D1
+# SWP1A interface A0D4
+# DWP intf behavior config, SVDD Load activated by default if set to 0x31 A037
+# SPI CL Sync enable  A098
+NXP_CORE_CONF_EXTN={20, 02, 5B, 13,
+    A0, EC, 01, 01,
+    A0, ED, 01, 00,
+    A0, 5E, 01, 01,
+    A0, 12, 01, 02,
+    A0, 40, 01, 01,
+    A0, 41, 01, 02,
+    A0, 43, 01, 50,
+    A0, D1, 01, 02,
+    A0, D4, 01, 00,
+    A0, 37, 01, 35,
+    A0, D8, 01, 02,
+    A0, D5, 01, 0A,
+    A0, 98, 01, 03,
+    A0, 9C, 02, 00, 00,
+    A0, AA, 04, FD, 03, F4, 01,
+    A0, 38, 04, 1A, 0B, 0B, 00,
+    A0, 3A, 08, 96, 00, 96, 00, 96, 00, 96, 00,
+    A0, B2, 01, 19,
+    A0, 91, 01, 01
+}
+
+###############################################################################
+# Core configuration rf field filter settings to enable set to 01 to disable set
+# to 00 last bit
+NXP_CORE_RF_FIELD={ 20, 02, 05, 01, A0, 62, 01, 00 }
+
+###############################################################################
+# To enable i2c fragmentation set i2c fragmentation enable 0x01 to disable set
+# to 0x00
+NXP_I2C_FRAGMENTATION_ENABLED=0x00
+
+###############################################################################
+# Core configuration settings
+NXP_CORE_CONF={ 20, 02, 2D, 0F,
+        85, 01, 01,
+        28, 01, 00,
+        21, 01, 00,
+        30, 01, 08,
+        31, 01, 03,
+        32, 01, 60,
+        38, 01, 01,
+        33, 00,
+        54, 01, 06,
+        50, 01, 02,
+        5B, 01, 00,
+        80, 01, 01,
+        81, 01, 01,
+        82, 01, 0E,
+        18, 01, 01
+}
+
+###############################################################################
+#Enable SWP full power mode when phone is power off
+NXP_SWP_FULL_PWR_ON=0x00
+
+###############################################################################
+#Set the default Felica T3T System Code OffHost route Location :
+#This settings will be used when application does not set this parameter
+# host  0x00
+# eSE   0x01
+# UICC  0x02
+# UICC2 0x03
+DEFAULT_SYS_CODE_ROUTE=0xC0
+
+###############################################################################
+# AID Matching platform options
+# AID_MATCHING_L 0x01
+# AID_MATCHING_K 0x02
+AID_MATCHING_PLATFORM=0x01
+
+###############################################################################
+#CHINA_TIANJIN_RF_SETTING
+#Enable  0x01
+#Disable  0x00
+NXP_CHINA_TIANJIN_RF_ENABLED=0x01
+
+###############################################################################
+#SWP_SWITCH_TIMEOUT_SETTING
+# Allowed range of swp timeout setting is 0x00 to 0x3C [0 - 60].
+# Timeout in milliseconds, for example
+# No Timeout  0x00
+# 10 millisecond timeout 0x0A
+NXP_SWP_SWITCH_TIMEOUT=0x0A
+
+###############################################################################
+# Enable or Disable RF_STATUS_UPDATE to EseHal module
+# Disable           0x00
+# Enable            0x01
+RF_STATUS_UPDATE_ENABLE=0x00
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_OFFHOST_ROUTE=0x80
+
+###############################################################################
+# Configure the single default SE to use.  The default is to use the first
+# SE that is detected by the stack.  This value might be used when the phone
+# supports multiple SE (e.g. 0xF3 and 0xF4) but you want to force it to use
+# one of them (e.g. 0xF4).
+DEFAULT_NFCF_ROUTE=0x80
+
+###############################################################################
+# Configure the default NfcA/IsoDep techology and protocol route. Can be
+# either a secure element (e.g. 0xF4) or the host (0x00)
+DEFAULT_ROUTE=0x00
+
+###############################################################################
+# Vendor Specific Proprietary Protocol & Discovery Configuration
+# Set to 0xFF if unsupported
+#  byte[0] NCI_PROTOCOL_18092_ACTIVE
+#  byte[1] NCI_PROTOCOL_B_PRIME
+#  byte[2] NCI_PROTOCOL_DUAL
+#  byte[3] NCI_PROTOCOL_15693
+#  byte[4] NCI_PROTOCOL_KOVIO
+#  byte[5] NCI_PROTOCOL_MIFARE
+#  byte[6] NCI_DISCOVERY_TYPE_POLL_KOVIO
+#  byte[7] NCI_DISCOVERY_TYPE_POLL_B_PRIME
+#  byte[8] NCI_DISCOVERY_TYPE_LISTEN_B_PRIME
+NFA_PROPRIETARY_CFG={05, FF, FF, 06, 81, 80, 70, FF, FF}
+
+###############################################################################
+# Bail out mode
+#  If set to 1, NFCC is using bail out mode for either Type A or Type B poll.
+NFA_POLL_BAIL_OUT_MODE=0x01
+
+###############################################################################
+# White list of Hosts
+# This values will be the Hosts(NFCEEs) in the HCI Network.
+DEVICE_HOST_WHITE_LIST={C0, 02}
+
+###############################################################################
+# Extended APDU length for ISO_DEP
+ISO_DEP_MAX_TRANSCEIVE=0xFEFF
+
+###############################################################################
+# Choose the presence-check algorithm for type-4 tag.  If not defined, the default value is 1.
+# 0  NFA_RW_PRES_CHK_DEFAULT; Let stack selects an algorithm
+# 1  NFA_RW_PRES_CHK_I_BLOCK; ISO-DEP protocol's empty I-block
+# 2 NFA_RW_PRES_CHK_ISO_DEP_NAK; Type - 4 tag protocol iso-dep nak presence check
+#    command is sent waiting for rsp and ntf.
+PRESENCE_CHECK_ALGORITHM=2
+###############################################################################
+# Configure the NFC Extras to open and use a static pipe.  If the value is
+# not set or set to 0, then the default is use a dynamic pipe based on a
+# destination gate (see NFA_HCI_DEFAULT_DEST_GATE).  Note there is a value
+# for each UICC (where F3="UICC0" and F4="UICC1")
+OFF_HOST_ESE_PIPE_ID=0x16
+OFF_HOST_SIM_PIPE_ID=0x0A
+
+###############################################################################
+#Set the Felica T3T System Code Power state :
+#This settings will be used when application does not set this parameter
+# bit pos 0 = Switch On
+# bit pos 1 = Switch Off
+# bit pos 2 = Battery Off
+# bit pos 3 = Screen On lock
+# bit pos 4 = Screen off unlock
+# bit pos 5 = Screen Off lock
+DEFAULT_SYS_CODE_PWR_STATE=0x3B
+
+###############################################################################
+# Configure the NFCEEIDs of offhost UICC.
+# UICC  0x80 (UICC)
+OFFHOST_ROUTE_UICC={80}
+
+###############################################################################
+# Configure the NFCEEIDs of offhost eSEs.
+# eSE   0xC0 (eSE)
+OFFHOST_ROUTE_ESE={C0}
+
+###############################################################################
+# Configure the list of NFCEE for the ISO-DEP routing.
+# host  0x00
+# eSE   0xC0 (eSE)
+# UICC  0x80 (UICC)
+DEFAULT_ISODEP_ROUTE=0x80
+
+###############################################################################
+# Update Phase tirm offset signbit
+NXP_PHASE_TIRM_OFFSET_SIGN_UPDATE=0x01
+
diff --git a/nfc/manifest_se_eSE1.xml b/nfc/manifest_se_eSE1.xml
index b334e0d..5a9372c 100644
--- a/nfc/manifest_se_eSE1.xml
+++ b/nfc/manifest_se_eSE1.xml
@@ -2,11 +2,8 @@
     <hal format="hidl">
         <name>android.hardware.secure_element</name>
         <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>ISecureElement</name>
-            <instance>eSE1</instance>
-        </interface>
+        <fqname>@1.0::ISecureElement/SIM1</fqname>
+        <fqname>@1.1::ISecureElement/eSE1</fqname>
     </hal>
     <hal format="hidl">
         <name>vendor.nxp.nxpese</name>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc313-mnc100/config.xml b/overlay/frameworks/base/core/res/res/values-mcc313-mnc100/config.xml
deleted file mode 100644
index 3bdaa06..0000000
--- a/overlay/frameworks/base/core/res/res/values-mcc313-mnc100/config.xml
+++ /dev/null
@@ -1,56 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-    Copyright (c) 2018, The Linux Foundation. All rights reserved.
-
-    Redistribution and use in source and binary forms, with or without
-    modification, are permitted provided that the following conditions are
-    met:
-        * Redistributions of source code must retain the above copyright
-          notice, this list of conditions and the following disclaimer.
-        * Redistributions in binary form must reproduce the above
-          copyright notice, this list of conditions and the following
-          disclaimer in the documentation and/or other materials provided
-          with the distribution.
-        * Neither the name of The Linux Foundation nor the names of its
-          contributors may be used to endorse or promote products derived
-          from this software without specific prior written permission.
-
-    THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
-    WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
-    ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
-    BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-    CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
-    BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-    WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-    OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
-    IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--->
-<resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-    <!-- Do not translate. Defines the slots is Two Digit Number for dialing normally not USSD -->
-    <string-array name="config_twoDigitNumberPattern">
-        <item>"0"</item>
-        <item>"00"</item>
-        <item>"*0"</item>
-        <item>"*1"</item>
-        <item>"*2"</item>
-        <item>"*3"</item>
-        <item>"*4"</item>
-        <item>"*5"</item>
-        <item>"*6"</item>
-        <item>"*7"</item>
-        <item>"*8"</item>
-        <item>"*9"</item>
-        <item>"#0"</item>
-        <item>"#1"</item>
-        <item>"#2"</item>
-        <item>"#3"</item>
-        <item>"#4"</item>
-        <item>"#5"</item>
-        <item>"#6"</item>
-        <item>"#7"</item>
-        <item>"#8"</item>
-        <item>"#9"</item>
-    </string-array>
-</resources>
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index 903b978..6329512 100755
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -129,6 +129,13 @@
     </string-array>
 
     <!-- List of regexpressions describing the interface (if any) that represent tetherable
+         Wifi P2P interfaces.  If the device doesn't want to support tethering over Wifi P2p this
+         should be empty.  An example would be "p2p-p2p.*" -->
+    <string-array translatable="false" name="config_tether_wifi_p2p_regexs">
+        <item>"p2p-p2p\\d-.*"</item>
+    </string-array>
+
+    <!-- List of regexpressions describing the interface (if any) that represent tetherable
          bluetooth interfaces.  If the device doesn't want to support tethering over bluetooth this
          should be empty. -->
     <string-array translatable="false" name="config_tether_bluetooth_regexs">
@@ -198,20 +205,6 @@
     <!-- Mask to use when checking skb mark defined in config_networkWakeupPacketMark above. -->
     <integer name="config_networkWakeupPacketMask">0x80000000</integer>
 
-    <!-- Boolean indicating whether the wifi chipset has dual frequency band support -->
-    <bool translatable="false" name="config_wifi_dual_band_support">true</bool>
-
-    <!-- Boolean indicating whether the wifi chipset requires the softap band be -->
-    <!-- converted from 5GHz to ANY due to hardware restrictions -->
-    <bool translatable="false" name="config_wifi_convert_apband_5ghz_to_any">true</bool>
-
-    <!-- Boolean indicating whether 802.11r Fast BSS Transition is enabled on this platform -->
-    <bool translatable="false" name="config_wifi_fast_bss_transition_enabled">true</bool>
-
-    <!-- Boolean indicating whether the wifi chipset has background scan support -->
-    <bool translatable="false" name="config_wifi_background_scan_support">true</bool>
-
-
     <!-- Vibrator pattern for feedback about a long screen/key press -->
     <!-- TODO(b/78128429): increase duration to account for the long latency -->
     <integer-array name="config_longPressVibePattern">
@@ -241,16 +234,6 @@
     <!-- Make things go fast -->
     <bool name="config_ui_enableFadingMarquee">false</bool>
 
-    <!-- Wifi driver supports batched scan -->
-    <bool translatable="false" name="config_wifi_batched_scan_supported">true</bool>
-
-    <!-- Boolean indicating whether or not to revert to default country code when cellular
-    radio is unable to find any MCC information to infer wifi country code from -->
-    <bool translatable="false" name="config_wifi_revert_country_code_on_cellular_loss">false</bool>
-
-    <!-- Boolean indicating whether or not wifi should turn off when emergency call is made -->
-    <bool translatable="false" name="config_wifi_turn_off_during_emergency_call">true</bool>
-
    <!-- Enable doze mode
          ComponentName of a dream to show whenever the system would otherwise have gone to sleep. -->
     <string translatable="false" name="config_dozeComponent">com.android.systemui/com.android.systemui.doze.DozeService</string>
@@ -272,12 +255,6 @@
     <!-- Type of the double tap sensor. Empty if double tap is not supported. -->
     <string name="config_dozeDoubleTapSensorType" translatable="false">com.google.sensor.double_touch</string>
 
-    <!-- ImsService package name to bind to by default, if config_dynamic_bind_ims is true -->
-    <string name="config_ims_package" translatable="false">org.codeaurora.ims</string>
-
-    <!-- Flag specifying whether or not IMS will use the ImsResolver dynamically -->
-    <bool name="config_dynamic_bind_ims">true</bool>
-
     <!-- Specifies whether to decouple the auto-suspend state of the device from the display on/off state. -->
     <bool name="config_powerDecoupleAutoSuspendModeFromDisplay">true</bool>
 
@@ -316,25 +293,6 @@
         <item>lte:524288,1048576,8388608,262144,524288,4194304</item>
     </string-array>
 
-    <!-- Configure wifi tcp buffersizes in the form:
-         rmem_min,rmem_def,rmem_max,wmem_min,wmem_def,wmem_max -->
-    <string name="config_wifi_tcp_buffers" translatable="false">524288,2097152,8388608,262144,524288,4194304</string>
-
-    <!-- Idle Receive current for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_idle_receive_cur_ma">1</integer>
-
-    <!-- Rx current for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_active_rx_cur_ma">100</integer>
-
-    <!-- Tx current for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_tx_cur_ma">250</integer>
-
-    <!-- Operating volatage for wifi radio. 0 by default-->
-    <integer translatable="false" name="config_wifi_operating_voltage_mv">3800</integer>
-
-    <!-- Config SoftAP 2G channel list -->
-    <string  translatable="false" name="config_wifi_framework_sap_2G_channel_list">6</string>
-
     <!-- Config determines whether to update phone object when voice registration
          state changes. Voice radio tech change will always trigger an update of
          phone object irrespective of this config -->
@@ -356,13 +314,11 @@
         <item>"/system/framework/framework.jar"</item>
         <item>"/system/framework/oat/arm64/services.odex"</item>
         <item>"/system/framework/services.jar"</item>
-        <item>"/system/framework/arm64/boot.oat"</item>
-        <item>"/system/framework/arm64/boot-core-libart.oat"</item>
-        <item>"/apex/com.android.runtime/javalib/core-oj.jar"</item>
-        <item>"/apex/com.android.runtime/javalib/core-libart.jar"</item>
+        <item>"/apex/com.android.art/javalib/core-oj.jar"</item>
+        <item>"/apex/com.android.art/javalib/core-libart.jar"</item>
         <item>"/apex/com.android.media/javalib/updatable-media.jar"</item>
-        <item>"/product/priv-app/SystemUIGoogle/SystemUIGoogle.apk"</item>
-        <item>"/product/priv-app/SystemUIGoogle/oat/arm64/SystemUIGoogle.odex"</item>
+        <item>"/system_ext/priv-app/SystemUIGoogle/SystemUIGoogle.apk"</item>
+        <item>"/system_ext/priv-app/SystemUIGoogle/oat/arm64/SystemUIGoogle.odex"</item>
         <item>"/system/lib64/libsurfaceflinger.so"</item>
     </string-array>
 
@@ -372,16 +328,14 @@
     <!-- Should the pinner service pin the Home application? -->
     <bool name="config_pinnerHomeApp">true</bool>
 
-    <!-- List of files pinned by the Pinner Service with the apex boot image b/119800099 -->
-    <string-array translatable="false" name="config_apexBootImagePinnerServiceFiles">
+    <!-- List of files pinned by the Pinner Service with the JIT Zygote boot image b/119800099 -->
+    <string-array translatable="false" name="config_jitzygoteBootImagePinnerServiceFiles">
         <item>"/system/framework/framework.jar"</item>
         <item>"/system/framework/services.jar"</item>
-        <item>"/system/framework/arm64/apex.oat"</item>
-        <item>"/system/framework/arm64/apex-core-libart.oat"</item>
-        <item>"/apex/com.android.runtime/javalib/core-oj.jar"</item>
-        <item>"/apex/com.android.runtime/javalib/core-libart.jar"</item>
+        <item>"/apex/com.android.art/javalib/core-oj.jar"</item>
+        <item>"/apex/com.android.art/javalib/core-libart.jar"</item>
         <item>"/apex/com.android.media/javalib/updatable-media.jar"</item>
-        <item>"/system/priv-app/SystemUIGoogle/SystemUIGoogle.apk"</item>
+        <item>"/system_ext/priv-app/SystemUIGoogle/SystemUIGoogle.apk"</item>
         <item>"/system/lib64/libsurfaceflinger.so"</item>
     </string-array>
 
@@ -417,19 +371,6 @@
     <!-- Whether the new Auto Selection Network UI should be shown -->
     <bool name="config_enableNewAutoSelectNetworkUI">true</bool>
 
-    <!-- Enable ACS (auto channel selection) for Wifi hotspot (SAP) -->
-    <bool translatable="false" name="config_wifi_softap_acs_supported">true</bool>
-
-    <!-- Enable 802.11ac for Wifi hotspot (SAP) -->
-    <bool translatable="false" name="config_wifi_softap_ieee80211ac_supported">true</bool>
-
-    <!-- Integer thresholds, do not connect to APs with RSSI lower than these values  -->
-    <integer translatable="false" name="config_wifi_framework_wifi_score_entry_rssi_threshold_5GHz">-77</integer>
-    <integer translatable="false" name="config_wifi_framework_wifi_score_entry_rssi_threshold_24GHz">-80</integer>
-    <!-- Integer thresholds for low network score, should be somewhat less than the entry threshholds -->
-    <integer translatable="false" name="config_wifi_framework_wifi_score_bad_rssi_threshold_5GHz">-80</integer>
-    <integer translatable="false" name="config_wifi_framework_wifi_score_bad_rssi_threshold_24GHz">-83</integer>
-
     <!-- The default intensity level for haptic feedback. See
          Settings.System.HAPTIC_FEEDBACK_INTENSITY more details on the constant values and
          meanings. -->
@@ -454,15 +395,6 @@
         <item>com.felicanetworks.mfm</item>
     </string-array>
 
-    <!-- True if the firmware supports connected MAC randomization -->
-    <bool name="config_wifi_connected_mac_randomization_supported">true</bool>
-
-    <!-- True if the firmware supports p2p MAC randomization -->
-    <bool name="config_wifi_p2p_mac_randomization_supported">true</bool>
-
-    <!-- True if the firmware supports Wi-Fi link probing -->
-    <bool name="config_wifi_link_probing_supported">true</bool>
-
     <!-- Enable Zram writeback feature to allow unused pages in zram be written to flash. -->
     <bool name="config_zramWriteback">true</bool>
 
diff --git a/overlay/frameworks/base/packages/SystemUI/res/values/config.xml b/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
index fb7e8cb..7e9d21d 100644
--- a/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
+++ b/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
@@ -31,6 +31,13 @@
          always-on display) -->
     <string name="doze_brightness_sensor_type" translatable="false">com.google.sensor.binned_brightness</string>
 
+    <!-- Override value to use for proximity sensor.  -->
+    <string name="proximity_sensor_type" translatable="false">com.google.sensor.binned_brightness</string>
+
+    <!-- If using proximity_sensor_type, specifies a threshold value to distinguish near and
+         far break points.-->
+    <item name="proximity_sensor_threshold" translatable="false" format="float" type="dimen">1</item>
+    
     <!-- Doze: can we assume the pickup sensor includes a proximity check? -->
     <bool name="doze_pickup_performs_proximity_check">true</bool>
 
diff --git a/overlay/packages/apps/Bluetooth/res/values/config.xml b/overlay/packages/apps/Bluetooth/res/values/config.xml
deleted file mode 100644
index e403105..0000000
--- a/overlay/packages/apps/Bluetooth/res/values/config.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-Copyright (c) 2017, The Linux Foundation. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-    * Redistributions of source code must retain the above copyright
-      notice, this list of conditions and the following disclaimer.
-    * Redistributions in binary form must reproduce the above
-      copyright notice, this list of conditions and the following
-      disclaimer in the documentation and/or other materials provided
-      with the distribution.
-    * Neither the name of The Linux Foundation nor the names of its
-      contributors may be used to endorse or promote products derived
-      from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED
-WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT
-ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS
-BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
-BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
-OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
-IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--->
-<resources>
-    <bool name="profile_supported_sap">true</bool>
-    <bool name="profile_supported_hearing_aid">true</bool>
-</resources>
diff --git a/overlay/packages/apps/Nfc/res/values/config.xml b/overlay/packages/apps/Nfc/res/values/config.xml
index 180805f..3c62682 100644
--- a/overlay/packages/apps/Nfc/res/values/config.xml
+++ b/overlay/packages/apps/Nfc/res/values/config.xml
@@ -14,6 +14,10 @@
      limitations under the License.
 -->
 <resources>
+  <bool name="enable_antenna_blocked_alert">true</bool>
+  <integer name="max_antenna_blocked_failure_count">10</integer>
+  <integer name="unknown_tag_polling_delay">2000</integer>
+  <string name="antenna_blocked_alert_link" translatable="false">https://support.google.com/pixelphone?p=nfc_tag_notification</string>
   <string-array name="config_skuSupportsSecureNfc" translatable="false">
     <item>G013B</item>
     <item>G013D</item>
diff --git a/overlay/packages/services/Telephony/res/values/config.xml b/overlay/packages/services/Telephony/res/values/config.xml
index f9a7c26..c269e3d 100644
--- a/overlay/packages/services/Telephony/res/values/config.xml
+++ b/overlay/packages/services/Telephony/res/values/config.xml
@@ -23,6 +23,12 @@
     <!-- Flag indicating whether the device supports RTT (real-time text) -->
     <bool name="config_support_rtt">true</bool>
 
+    <!-- String indicating the package name of the device ImsService implementation for MMTEL. -->
+    <string name="config_ims_mmtel_package" translatable="false">org.codeaurora.ims</string>
+
+    <!-- String indicating the package name of the device ImsService implementation for RCS. -->
+    <string name="config_ims_rcs_package" translatable="false">com.android.service.ims</string>
+
     <!-- This device supports the AudioManager Telephony audio device and output onto this
          device using {@link AudioDeviceInfo#TYPE_TELEPHONY}.
          This is used to support carriers which generate a recording tone to the remote party
diff --git a/pixelstats/Android.bp b/pixelstats/Android.bp
index 05dbc9c..211a311 100644
--- a/pixelstats/Android.bp
+++ b/pixelstats/Android.bp
@@ -24,7 +24,6 @@
     "libbinder",
     "libcutils",
     "libhidlbase",
-    "libhidltransport",
     "liblog",
     "libutils",
     "libpixelstats",
diff --git a/pixelstats/pixelstats-vendor.crosshatch.rc b/pixelstats/pixelstats-vendor.crosshatch.rc
index 9410090..22254bb 100644
--- a/pixelstats/pixelstats-vendor.crosshatch.rc
+++ b/pixelstats/pixelstats-vendor.crosshatch.rc
@@ -1,4 +1,4 @@
 service vendor.pixelstats_vendor /vendor/bin/pixelstats-vendor
     class hal
     user system
-    group system
+    group system context_hub
diff --git a/pixelstats/service.cpp b/pixelstats/service.cpp
index be370c4..1850672 100644
--- a/pixelstats/service.cpp
+++ b/pixelstats/service.cpp
@@ -29,6 +29,7 @@
 using android::hardware::google::pixel::UeventListener;
 
 #define UFSHC_PATH(filename) "/sys/devices/platform/soc/1d84000.ufshc/" #filename
+#define UFSHC_HEALTH_PATH(filename) "/sys/devices/platform/soc/1d84000.ufshc/health/" #filename
 const struct SysfsCollector::SysfsPaths sysfs_paths = {
     .SlowioReadCntPath = UFSHC_PATH(slowio_read_cnt),
     .SlowioWriteCntPath = UFSHC_PATH(slowio_write_cnt),
@@ -38,6 +39,10 @@
     .ImpedancePath = "/sys/class/misc/msm_cirrus_playback/resistance_left_right",
     .CodecPath = "/sys/devices/platform/soc/171c0000.slim/tavil-slim-pgd/tavil_codec/codec_state",
     .SpeechDspPath = "/sys/devices/platform/soc/soc:qcom,wcd-dsp-mgr/wdsp_stat",
+    .UFSLifetimeA = UFSHC_HEALTH_PATH(lifetimeA),
+    .UFSLifetimeB = UFSHC_HEALTH_PATH(lifetimeB),
+    .UFSLifetimeC = UFSHC_HEALTH_PATH(lifetimeC),
+    .F2fsStatsPath = "/sys/fs/f2fs/",
 };
 
 const char *const kAudioUevent = "/kernel/q6audio/q6voice_uevent";
diff --git a/powerhint.json b/powerhint.json
index 3d397f6..81b8ef5 100644
--- a/powerhint.json
+++ b/powerhint.json
@@ -219,15 +219,6 @@
       "HoldFd": true
     },
     {
-      "Name": "VRKernelCpuSet",
-      "Path": "/dev/cpuset/kernel/cpus",
-      "Values": [
-        "2,3",
-        "0-7"
-      ],
-      "ResetOnInit": true
-    },
-    {
       "Name": "SchedBoost",
       "Path": "/proc/sys/kernel/sched_boost",
       "Values": [
@@ -237,13 +228,20 @@
       "ResetOnInit": true
     },
     {
+      "Name": "DisplayWakeup",
+      "Path": "/sys/devices/platform/soc/ae00000.qcom,mdss_mdp/drm/card0/sde-crtc-0/early_wakeup",
+      "Values": [
+        "1",
+        "0"
+      ]
+    },
+    {
       "Name": "PowerHALMainState",
       "Path": "vendor.powerhal.state",
       "Values": [
-        "CAMERA_STREAMING",
         "VR_SUSTAINED_PERFORMANCE",
         "SUSTAINED_PERFORMANCE",
-        "VR_MODE",
+        "VR",
         ""
       ],
       "Type": "Property"
@@ -252,7 +250,7 @@
       "Name": "PowerHALAudioState",
       "Path": "vendor.powerhal.audio",
       "Values": [
-        "AUDIO_LOW_LATENCY",
+        "AUDIO_STREAMING_LOW_LATENCY",
         ""
       ],
       "Type": "Property"
@@ -303,66 +301,60 @@
       "Value": "342000000"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "PowerHALMainState",
       "Duration": 0,
-      "Value": "VR_MODE"
+      "Value": "VR"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "ThermalMode",
       "Duration": 0,
       "Value": "-vr"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "CPUBigClusterMaxFreq",
       "Duration": 0,
       "Value": "1459200"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "CPUBigClusterMinFreq",
       "Duration": 0,
       "Value": "1459200"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "CPULittleClusterMaxFreq",
       "Duration": 0,
       "Value": "1420800"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "CPULittleClusterMinFreq",
       "Duration": 0,
       "Value": "1420800"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "GPUMaxFreq",
       "Duration": 0,
       "Value": "342000000"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "GPUMinFreq",
       "Duration": 0,
       "Value": "342000000"
     },
     {
-      "PowerHint": "VR_MODE",
+      "PowerHint": "VR",
       "Node": "GPUBusMinFreq",
       "Duration": 0,
       "Value": "5931"
     },
     {
-      "PowerHint": "VR_MODE",
-      "Node": "VRKernelCpuSet",
-      "Duration": 0,
-      "Value": "2,3"
-    },
-    {
       "PowerHint": "VR_SUSTAINED_PERFORMANCE",
       "Node": "PowerHALMainState",
       "Duration": 0,
@@ -417,12 +409,6 @@
       "Value": "3879"
     },
     {
-      "PowerHint": "VR_SUSTAINED_PERFORMANCE",
-      "Node": "VRKernelCpuSet",
-      "Duration": 0,
-      "Value": "2,3"
-    },
-    {
       "PowerHint": "INTERACTION",
       "Node": "CPUBigClusterMinFreq",
       "Duration": 0,
@@ -597,31 +583,25 @@
       "Value": "44"
     },
     {
-      "PowerHint": "CAMERA_STREAMING",
-      "Node": "PowerHALMainState",
-      "Duration": 0,
-      "Value": "CAMERA_STREAMING"
-    },
-    {
-      "PowerHint": "CAMERA_STREAMING",
+      "PowerHint": "CAMERA_STREAMING_MID",
       "Node": "CPUBigClusterMaxFreq",
       "Duration": 0,
       "Value": "1996800"
     },
     {
-      "PowerHint": "CAMERA_STREAMING",
+      "PowerHint": "CAMERA_STREAMING_MID",
       "Node": "CPUBWSampleMs",
       "Duration": 0,
       "Value": "10"
     },
     {
-      "PowerHint": "CAMERA_STREAMING",
+      "PowerHint": "CAMERA_STREAMING_MID",
       "Node": "CPUBWIOPercent",
       "Duration": 0,
       "Value": "80"
     },
     {
-      "PowerHint": "CAMERA_STREAMING",
+      "PowerHint": "CAMERA_STREAMING_MID",
       "Node": "LLCCBWSampleMs",
       "Duration": 0,
       "Value": "10"
@@ -657,25 +637,25 @@
       "Value": "44"
     },
     {
-      "PowerHint": "AUDIO_STREAMING",
+      "PowerHint": "AUDIO_LAUNCH",
       "Node": "CPUBigClusterMinFreq",
       "Duration": 2000,
       "Value": "1459200"
     },
     {
-      "PowerHint": "AUDIO_STREAMING",
+      "PowerHint": "AUDIO_LAUNCH",
       "Node": "PMQoSCpuDmaLatency",
       "Duration": 2000,
       "Value": "44"
     },
     {
-      "PowerHint": "AUDIO_LOW_LATENCY",
+      "PowerHint": "AUDIO_STREAMING_LOW_LATENCY",
       "Node": "PowerHALAudioState",
       "Duration": 0,
-      "Value": "AUDIO_LOW_LATENCY"
+      "Value": "AUDIO_STREAMING_LOW_LATENCY"
     },
     {
-      "PowerHint": "AUDIO_LOW_LATENCY",
+      "PowerHint": "AUDIO_STREAMING_LOW_LATENCY",
       "Node": "PMQoSCpuDmaLatency",
       "Duration": 0,
       "Value": "44"
@@ -697,6 +677,12 @@
       "Node": "GPUMaxFreq",
       "Duration": 0,
       "Value": "710000000"
+    },
+    {
+      "PowerHint": "DISPLAY_UPDATE_IMMINENT",
+      "Node": "DisplayWakeup",
+      "Duration": 60,
+      "Value": "1"
     }
   ]
 }
diff --git a/powerstats/Android.bp b/powerstats/Android.bp
index 5c4fac6..ad273df 100644
--- a/powerstats/Android.bp
+++ b/powerstats/Android.bp
@@ -28,7 +28,6 @@
         "libbase",
         "libcutils",
         "libhidlbase",
-        "libhidltransport",
         "libfmq",
         "liblog",
         "libutils",
diff --git a/product.prop b/product.prop
index f1247c0..ec43a5b 100644
--- a/product.prop
+++ b/product.prop
@@ -10,9 +10,6 @@
 persist.rild.nitz_short_ons_3=
 DEVICE_PROVISIONED=1
 
-# Set network mode to Global by default and no DSDS/DSDA
-ro.telephony.default_network=10
-
 debug.sf.hw=1
 debug.gralloc.enable_fb_ubwc=1
 
@@ -38,15 +35,11 @@
 vidc.enc.disable.pq=1
 
 # system props for the data netmgrd
-persist.data.netmgrd.qos.enable=true
 persist.vendor.data.mode=concurrent
 
 # system props for time-services
 persist.timed.enable=true
 
-# system props for perfetto
-persist.traced.enable=1
-
 # System prop to turn on CdmaLTEPhone always
 telephony.lteOnCdmaDevice=1
 
diff --git a/recovery/Android.bp b/recovery/Android.bp
deleted file mode 100644
index 9cda7f8..0000000
--- a/recovery/Android.bp
+++ /dev/null
@@ -1,40 +0,0 @@
-//
-// Copyright (C) 2018 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-
-cc_library_static {
-    name: "librecovery_ui_crosshatch",
-    owner: "google",
-    cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
-        "-pedantic",
-    ],
-    srcs: [
-        "recovery_ui.cpp",
-    ],
-
-    static_libs: [
-        "libbase",
-        "libbootloader_message",
-        "libnos_for_recovery",
-        "libnos_citadel_for_recovery",
-    ],
-
-    shared_libs: [
-        "librecovery_ui",
-    ],
-}
diff --git a/recovery/recovery_ui.cpp b/recovery/recovery_ui.cpp
deleted file mode 100644
index c3df373..0000000
--- a/recovery/recovery_ui.cpp
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright (C) 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <stdint.h>
-#include <string.h>
-
-#include <string>
-#include <string_view>
-#include <vector>
-
-#include <android-base/endian.h>
-#include <android-base/logging.h>
-
-#include <app_nugget.h>
-#include <bootloader_message/bootloader_message.h>
-#include <nos/NuggetClient.h>
-#include <nos/debug.h>
-#include <recovery_ui/device.h>
-#include <recovery_ui/screen_ui.h>
-
-namespace android {
-namespace device {
-namespace google {
-namespace crosshatch {
-
-namespace {
-
-/** Wipe user data from Titan M. */
-bool WipeTitanM() {
-    // Connect to Titan M
-    ::nos::NuggetClient client;
-    client.Open();
-    if (!client.IsOpen()) {
-        LOG(ERROR) << "Failed to connect to Titan M";
-        return false;
-    }
-
-    // Tell it to wipe user data
-    const uint32_t magicValue = htole32(ERASE_CONFIRMATION);
-    std::vector<uint8_t> magic(sizeof(magicValue));
-    memcpy(magic.data(), &magicValue, sizeof(magicValue));
-    const uint32_t status
-            = client.CallApp(APP_ID_NUGGET, NUGGET_PARAM_NUKE_FROM_ORBIT, magic, nullptr);
-    if (status != APP_SUCCESS) {
-        LOG(ERROR) << "Titan M user data wipe failed: " << ::nos::StatusCodeString(status)
-                   << " (" << status << ")";
-        return false;
-    }
-
-    LOG(INFO) << "Titan M wipe successful";
-    return true;
-}
-
-// Wipes the provisioned flag as part of data wipe.
-bool WipeProvisionedFlag() {
-    // Must be consistent with the one in init.hardware.rc (10-byte `theme-dark`).
-    const std::string wipe_str(10, '\x00');
-    constexpr size_t kProvisionedFlagOffsetInVendorSpace = 0;
-    if (std::string err; !WriteMiscPartitionVendorSpace(
-            wipe_str.data(), wipe_str.size(), kProvisionedFlagOffsetInVendorSpace, &err)) {
-        LOG(ERROR) << "Failed to write wipe string: " << err;
-        return false;
-    }
-    LOG(INFO) << "Provisioned flag wiped successful";
-    return true;
-}
-
-} // namespace
-
-class CrosshatchDevice : public ::Device
-{
-public:
-    CrosshatchDevice(::ScreenRecoveryUI* const ui) : ::Device(ui) {}
-
-    /** Hook to wipe user data not stored in /data */
-    bool PostWipeData() override {
-        // Try to do everything but report a failure if anything wasn't successful
-        bool totalSuccess = true;
-        ::RecoveryUI* const ui = GetUI();
-
-        ui->Print("Wiping Titan M...\n");
-        if (!WipeTitanM()) {
-            totalSuccess = false;
-        }
-
-        if (!WipeProvisionedFlag()) {
-            totalSuccess = false;
-        }
-
-        // Extendable to wipe other components
-
-        return totalSuccess;
-    }
-};
-
-} // namespace crosshatch
-} // namespace google
-} // namespace device
-} // namespace android
-
-Device *make_device()
-{
-    return new ::android::device::google::crosshatch::CrosshatchDevice(new ::ScreenRecoveryUI);
-}
diff --git a/rro_overlays/WifiOverlay/Android.bp b/rro_overlays/WifiOverlay/Android.bp
new file mode 100644
index 0000000..5407765
--- /dev/null
+++ b/rro_overlays/WifiOverlay/Android.bp
@@ -0,0 +1,7 @@
+runtime_resource_overlay {
+    name: "WifiOverlay",
+    theme: "WifiOverlay",
+    certificate: "platform",
+    sdk_version: "current",
+    product_specific: true
+}
diff --git a/rro_overlays/WifiOverlay/AndroidManifest.xml b/rro_overlays/WifiOverlay/AndroidManifest.xml
new file mode 100644
index 0000000..632ac6a
--- /dev/null
+++ b/rro_overlays/WifiOverlay/AndroidManifest.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (C) 2019 The Android Open Source Project
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<!-- Pixel specific wifi overlays -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.wifi.resources.pixel"
+    android:versionCode="1"
+    android:versionName="1.0">
+    <application android:hasCode="false" />
+    <overlay
+      android:targetPackage="com.android.wifi.resources"
+      android:targetName="WifiCustomization"
+      android:isStatic="true"
+      android:priority="0"/>
+</manifest>
diff --git a/rro_overlays/WifiOverlay/OWNERS b/rro_overlays/WifiOverlay/OWNERS
new file mode 100644
index 0000000..efe20f1
--- /dev/null
+++ b/rro_overlays/WifiOverlay/OWNERS
@@ -0,0 +1,5 @@
+# People who can approve changes for submission
+etancohen@google.com
+kumaranand@google.com
+kumachang@google.com
+satk@google.com
diff --git a/rro_overlays/WifiOverlay/res/values/config.xml b/rro_overlays/WifiOverlay/res/values/config.xml
new file mode 100644
index 0000000..972ca8d
--- /dev/null
+++ b/rro_overlays/WifiOverlay/res/values/config.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
+<resources>
+    <!-- Boolean indicating whether the wifi chipset has 5GHz frequency band support -->
+    <bool translatable="false" name="config_wifi5ghzSupport">true</bool>
+
+    <!-- Boolean indicating whether 802.11r Fast BSS Transition is enabled on this platform -->
+    <bool translatable="false" name="config_wifi_fast_bss_transition_enabled">true</bool>
+
+    <!-- Boolean indicating whether the wifi chipset has background scan support -->
+    <bool translatable="false" name="config_wifi_background_scan_support">true</bool>
+
+    <!-- Integer thresholds, do not connect to APs with RSSI lower than these values  -->
+    <integer translatable="false" name="config_wifi_framework_wifi_score_entry_rssi_threshold_5GHz">-77</integer>
+    <integer translatable="false" name="config_wifi_framework_wifi_score_entry_rssi_threshold_24GHz">-80</integer>
+    <!-- Integer thresholds for low network score, should be somewhat less than the entry thresholds -->
+    <integer translatable="false" name="config_wifi_framework_wifi_score_bad_rssi_threshold_5GHz">-80</integer>
+    <integer translatable="false" name="config_wifi_framework_wifi_score_bad_rssi_threshold_24GHz">-83</integer>
+
+    <!-- Boolean indicating whether or not to revert to default country code when cellular
+    radio is unable to find any MCC information to infer wifi country code from -->
+    <bool translatable="false" name="config_wifi_revert_country_code_on_cellular_loss">false</bool>
+
+    <!-- Boolean indicating whether or not wifi should turn off when emergency call is made -->
+    <bool translatable="false" name="config_wifi_turn_off_during_emergency_call">true</bool>
+
+    <!-- Configure wifi tcp buffersizes in the form:
+         rmem_min,rmem_def,rmem_max,wmem_min,wmem_def,wmem_max -->
+    <string name="config_wifi_tcp_buffers" translatable="false">524288,2097152,8388608,262144,524288,4194304</string>
+
+    <!-- Enable ACS (auto channel selection) for Wifi hotspot (SAP) -->
+    <bool translatable="false" name="config_wifi_softap_acs_supported">true</bool>
+
+    <!-- Enable 802.11ac for Wifi hotspot (SAP) -->
+    <bool translatable="false" name="config_wifi_softap_ieee80211ac_supported">true</bool>
+
+    <!-- True if the firmware supports connected MAC randomization -->
+    <bool name="config_wifi_connected_mac_randomization_supported">true</bool>
+
+    <!-- True if the firmware supports p2p MAC randomization -->
+    <bool name="config_wifi_p2p_mac_randomization_supported">true</bool>
+
+    <!-- True if the firmware supports ap MAC randomization -->
+    <bool name="config_wifi_ap_mac_randomization_supported">true</bool>
+
+    <!-- True if the firmware supports Wi-Fi link probing -->
+    <bool name="config_wifi_link_probing_supported">true</bool>
+
+    <!-- Idle Receive current for wifi radio. 0 by default-->
+    <integer translatable="false" name="config_wifi_idle_receive_cur_ma">1</integer>
+
+    <!-- Rx current for wifi radio. 0 by default-->
+    <integer translatable="false" name="config_wifi_active_rx_cur_ma">100</integer>
+
+    <!-- Tx current for wifi radio. 0 by default-->
+    <integer translatable="false" name="config_wifi_tx_cur_ma">250</integer>
+
+    <!-- Operating volatage for wifi radio. 0 by default-->
+    <integer translatable="false" name="config_wifi_operating_voltage_mv">3800</integer>
+
+    <!-- Indicates that a full bugreport should be triggered when wifi diagnostics detects an error on non-user (i.e debug) builds -->
+    <bool translatable="false" name="config_wifi_diagnostics_bugreport_enabled">true</bool>
+
+    <!-- Default access point SSID used for tethering -->
+    <string name="wifi_tether_configure_ssid_default" translatable="false">Pixel</string>
+
+    <!-- Integer indicating maximum hardware supported client number of soft ap -->
+    <integer translatable="false" name="config_wifiHardwareSoftapMaxClientCount">32</integer>
+</resources>
diff --git a/sdm845/thermal-engine/Android.mk b/sdm845/thermal-engine/Android.mk
index 7b0ac46..5e477c6 100644
--- a/sdm845/thermal-engine/Android.mk
+++ b/sdm845/thermal-engine/Android.mk
@@ -6,14 +6,6 @@
 LOCAL_PATH:= $(call my-dir)
 
 include $(CLEAR_VARS)
-
-LOCAL_VENDOR_MODULE := true
-LOCAL_COPY_HEADERS_TO := thermal-engine
-LOCAL_COPY_HEADERS := ./thermal_client.h
-
-include $(BUILD_COPY_HEADERS)
-
-include $(CLEAR_VARS)
 LOCAL_MODULE := libThermal_headers
 LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)
 LOCAL_VENDOR_MODULE := true
diff --git a/self-extractors/extract-lists.txt b/self-extractors/extract-lists.txt
index c8a18e6..e6dae6a 100644
--- a/self-extractors/extract-lists.txt
+++ b/self-extractors/extract-lists.txt
@@ -1,74 +1,43 @@
   google_devices)
     TO_EXTRACT="\
             IMAGES/vendor.img \
+            RADIO/bootloader.img \
+            RADIO/radio.img \
             "
     ;;
   qcom)
     TO_EXTRACT="\
+            system/app/ims/ims.apk \
             system/app/QtiTelephonyService/QtiTelephonyService.apk \
-            system/etc/permissions/cneapiclient.xml \
             system/etc/permissions/com.qualcomm.qti.imscmservice.xml \
-            system/etc/permissions/com.quicinc.cne.xml \
-            system/etc/permissions/LteDirectDiscovery.xml \
             system/etc/permissions/qcrilhook.xml \
-            system/etc/permissions/radioconfiginterface.xml \
-            system/etc/permissions/radioconfig.xml \
             system/etc/permissions/telephonyservice.xml \
             system/etc/permissions/uimremoteclient.xml \
             system/etc/permissions/uimremoteserver.xml \
             system/etc/permissions/UimService.xml \
-            system/framework/com.qualcomm.qti.uceservice-V2.0-java.jar \
-            system/framework/LteDirectDiscoveryLibrary.jar \
             system/framework/qcrilhook.jar \
             system/framework/QtiTelephonyServicelibrary.jar \
             system/framework/radioconfiginterfacelibrary.jar \
             system/framework/radioconfiglibrary.jar \
             system/framework/uimremoteclientlibrary.jar \
             system/framework/uimremoteserverlibrary.jar \
-            system/framework/vendor.qti.hardware.alarm-V1.0-java.jar \
-            system/framework/vendor.qti.hardware.data.latency-V1.0-java.jar \
-            system/framework/vendor.qti.hardware.soter-V1.0-java.jar \
-            system/lib64/libadsprpc_system.so \
-            system/lib64/libcdsprpc_system.so \
-            system/lib64/libDiagService.so \
-            system/lib64/libdiag_system.so \
-            system/lib64/libGPQTEEC_system.so \
-            system/lib64/libGPTEE_system.so \
             system/lib64/libimscamera_jni.so \
             system/lib64/libimsmedia_jni.so \
             system/lib64/lib-imsvideocodec.so \
             system/lib64/lib-imsvtextutils.so \
             system/lib64/lib-imsvt.so \
             system/lib64/lib-imsvtutils.so \
-            system/lib64/libmdsprpc_system.so \
-            system/lib64/libQTEEConnector_system.so \
             system/lib64/librcc.so \
             system/lib64/libsdm-disp-apis.so \
-            system/lib64/libsdsprpc_system.so \
             system/lib64/libsecureui_svcsock_system.so \
-            system/lib64/libOpenCL_system.so \
-            system/lib64/libsmcinvokecred.so \
-            system/lib64/libtzcom.so \
-            system/lib/libadsprpc_system.so \
-            system/lib/libcdsprpc_system.so \
-            system/lib/libdiag_system.so \
-            system/lib/libGPQTEEC_system.so \
-            system/lib/libGPTEE_system.so \
             system/lib/libimscamera_jni.so \
             system/lib/libimsmedia_jni.so \
             system/lib/lib-imsvideocodec.so \
             system/lib/lib-imsvtextutils.so \
             system/lib/lib-imsvt.so \
             system/lib/lib-imsvtutils.so \
-            system/lib/libmdsprpc_system.so \
-            system/lib/libQTEEConnector_system.so \
             system/lib/librcc.so \
             system/lib/libsdm-disp-apis.so \
-            system/lib/libsdsprpc_system.so \
             system/lib/libsecureui_svcsock_system.so \
-            system/lib/libOpenCL_system.so \
-            system/lib/libsmcinvokecred.so \
-            system/lib/libtzcom.so \
-            system/lib/rfsa/adsp/libsns_low_lat_stream_skel.so \
             "
     ;;
diff --git a/self-extractors/google_devices/staging/Android.mk b/self-extractors/google_devices/staging/Android.mk
new file mode 100644
index 0000000..b8429c8
--- /dev/null
+++ b/self-extractors/google_devices/staging/Android.mk
@@ -0,0 +1,22 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+ifneq ($(filter crosshatch,$(TARGET_DEVICE)),)
+  $(call add-radio-file,bootloader.img)
+  $(call add-radio-file,radio.img)
+endif
diff --git a/self-extractors/qcom/staging/Android.bp.txt b/self-extractors/qcom/staging/Android.bp.txt
new file mode 100644
index 0000000..57e9f2a
--- /dev/null
+++ b/self-extractors/qcom/staging/Android.bp.txt
@@ -0,0 +1,404 @@
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+soong_namespace {
+}
+
+cc_prebuilt_library_shared {
+    name: "libimscamera_jni",
+    arch: {
+        arm: {
+            srcs: ["libimscamera_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libimscamera_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+}
+
+cc_prebuilt_library_shared {
+    name: "libimsmedia_jni",
+    arch: {
+        arm: {
+            srcs: ["libimsmedia_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "libgui",
+                "libbinder",
+                "liblog",
+                "libandroid",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libimsmedia_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "libgui",
+                "libbinder",
+                "liblog",
+                "libandroid",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvideocodec",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvideocodec.so"],
+            shared_libs: [
+                "lib-imsvtutils",
+                "lib-imsvtextutils",
+                "libcutils",
+                "libutils",
+                "liblog",
+                // "libdiag_system",
+                "libgui",
+                "libnativewindow",
+                "libmediandk",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvideocodec.so"],
+            shared_libs: [
+                "lib-imsvtutils",
+                "lib-imsvtextutils",
+                "libcutils",
+                "libutils",
+                "liblog",
+                // "libdiag_system",
+                "libgui",
+                "libnativewindow",
+                "libmediandk",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvtextutils",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvtextutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "lib-imsvtutils",
+                "libGLESv2",
+                "libEGL",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvtextutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "lib-imsvtutils",
+                "libGLESv2",
+                "libEGL",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvt",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvt.so"],
+            shared_libs: [
+                "librcc",
+                "lib-imsvideocodec",
+                "lib-imsvtutils",
+                "libandroid",
+                // "libhwbinder",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.qti.imsrtpservice@1.0",
+                // "libdiag_system",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvt.so"],
+            shared_libs: [
+                "librcc",
+                "lib-imsvideocodec",
+                "lib-imsvtutils",
+                "libandroid",
+                // "libhwbinder",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.qti.imsrtpservice@1.0",
+                // "libdiag_system",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvtutils",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvtutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvtutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "librcc",
+    arch: {
+        arm: {
+            srcs: ["librcc.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/librcc.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "libsdm-disp-apis",
+    arch: {
+        arm: {
+            srcs: ["libsdm-disp-apis.so"],
+            shared_libs: [
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.display.color@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libsdm-disp-apis.so"],
+            shared_libs: [
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.display.color@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "libsecureui_svcsock_system",
+    arch: {
+        arm: {
+            srcs: ["libsecureui_svcsock_system.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "libhwbinder",
+                // "vendor.qti.hardware.tui_comm@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libsecureui_svcsock_system.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "libhwbinder",
+                // "vendor.qti.hardware.tui_comm@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
diff --git a/self-extractors/qcom/staging/Android.mk b/self-extractors/qcom/staging/Android.mk
index 02b56de..7a4baae 100644
--- a/self-extractors/qcom/staging/Android.mk
+++ b/self-extractors/qcom/staging/Android.mk
@@ -1,8 +1,18 @@
 LOCAL_PATH := $(call my-dir)
 
-include $(CLEAR_VARS)
-
 ifneq ($(filter crosshatch, $(TARGET_DEVICE)),)
+include $(CLEAR_VARS)
+LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
+LOCAL_MODULE := ims
+LOCAL_MODULE_TAGS := optional
+LOCAL_BUILT_MODULE_STEM := package.apk
+LOCAL_MODULE_OWNER := qcom
+LOCAL_MODULE_CLASS := APPS
+LOCAL_SRC_FILES := $(LOCAL_MODULE).apk
+LOCAL_CERTIFICATE := platform
+include $(BUILD_PREBUILT)
+
+include $(CLEAR_VARS)
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_MODULE := QtiTelephonyService
 LOCAL_MODULE_TAGS := optional
diff --git a/self-extractors/qcom/staging/BoardConfigPartial.mk b/self-extractors/qcom/staging/BoardConfigPartial.mk
index e0b4fa2..0c90cb2 100644
--- a/self-extractors/qcom/staging/BoardConfigPartial.mk
+++ b/self-extractors/qcom/staging/BoardConfigPartial.mk
@@ -11,3 +11,5 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+VENDOR_BLOBS_LICENSE := vendor/qcom/crosshatch/LICENSE
diff --git a/self-extractors/qcom/staging/device-partial.mk b/self-extractors/qcom/staging/device-partial.mk
index a376fba..3c874ba 100644
--- a/self-extractors/qcom/staging/device-partial.mk
+++ b/self-extractors/qcom/staging/device-partial.mk
@@ -12,75 +12,38 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/qcom/crosshatch/proprietary \
+
 # AOSP packages required by the blobs
 PRODUCT_PACKAGES := \
+    ims \
     libprotobuf-cpp-full \
     QtiTelephonyService
 
 #  blob(s) necessary for crosshatch hardware
+PRODUCT_PACKAGES += \
+    libimscamera_jni \
+    libimsmedia_jni \
+    lib-imsvideocodec \
+    lib-imsvtextutils \
+    lib-imsvt \
+    lib-imsvtutils \
+    librcc \
+    libsdm-disp-apis \
+    libsecureui_svcsock_system \
+
 PRODUCT_COPY_FILES := \
-    vendor/qcom/crosshatch/proprietary/cneapiclient.xml:system/etc/permissions/cneapiclient.xml:qcom \
     vendor/qcom/crosshatch/proprietary/com.qualcomm.qti.imscmservice.xml:system/etc/permissions/com.qualcomm.qti.imscmservice.xml:qcom \
-    vendor/qcom/crosshatch/proprietary/com.qualcomm.qti.uceservice-V2.0-java.jar:system/framework/com.qualcomm.qti.uceservice-V2.0-java.jar:qcom \
-    vendor/qcom/crosshatch/proprietary/com.quicinc.cne.xml:system/etc/permissions/com.quicinc.cne.xml:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libadsprpc_system.so:system/lib64/libadsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libcdsprpc_system.so:system/lib64/libcdsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libDiagService.so:system/lib64/libDiagService.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libdiag_system.so:system/lib64/libdiag_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libGPQTEEC_system.so:system/lib64/libGPQTEEC_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libGPTEE_system.so:system/lib64/libGPTEE_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libimscamera_jni.so:system/lib64/libimscamera_jni.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libimsmedia_jni.so:system/lib64/libimsmedia_jni.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/lib-imsvideocodec.so:system/lib64/lib-imsvideocodec.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/lib-imsvtextutils.so:system/lib64/lib-imsvtextutils.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/lib-imsvt.so:system/lib64/lib-imsvt.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/lib-imsvtutils.so:system/lib64/lib-imsvtutils.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libmdsprpc_system.so:system/lib64/libmdsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libQTEEConnector_system.so:system/lib64/libQTEEConnector_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/librcc.so:system/lib64/librcc.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libsdm-disp-apis.so:system/lib64/libsdm-disp-apis.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libsdsprpc_system.so:system/lib64/libsdsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libsecureui_svcsock_system.so:system/lib64/libsecureui_svcsock_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libOpenCL_system.so:system/lib64/libOpenCL_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libsmcinvokecred.so:system/lib64/libsmcinvokecred.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib64/libtzcom.so:system/lib64/libtzcom.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libadsprpc_system.so:system/lib/libadsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libcdsprpc_system.so:system/lib/libcdsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libdiag_system.so:system/lib/libdiag_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libGPQTEEC_system.so:system/lib/libGPQTEEC_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libGPTEE_system.so:system/lib/libGPTEE_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libimscamera_jni.so:system/lib/libimscamera_jni.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libimsmedia_jni.so:system/lib/libimsmedia_jni.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib-imsvideocodec.so:system/lib/lib-imsvideocodec.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib-imsvtextutils.so:system/lib/lib-imsvtextutils.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib-imsvt.so:system/lib/lib-imsvt.so:qcom \
-    vendor/qcom/crosshatch/proprietary/lib-imsvtutils.so:system/lib/lib-imsvtutils.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libmdsprpc_system.so:system/lib/libmdsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libQTEEConnector_system.so:system/lib/libQTEEConnector_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/librcc.so:system/lib/librcc.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libsdm-disp-apis.so:system/lib/libsdm-disp-apis.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libsdsprpc_system.so:system/lib/libsdsprpc_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libsecureui_svcsock_system.so:system/lib/libsecureui_svcsock_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libsns_low_lat_stream_skel.so:system/lib/rfsa/adsp/libsns_low_lat_stream_skel.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libOpenCL_system.so:system/lib/libOpenCL_system.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libsmcinvokecred.so:system/lib/libsmcinvokecred.so:qcom \
-    vendor/qcom/crosshatch/proprietary/libtzcom.so:system/lib/libtzcom.so:qcom \
-    vendor/qcom/crosshatch/proprietary/LteDirectDiscoveryLibrary.jar:system/framework/LteDirectDiscoveryLibrary.jar:qcom \
-    vendor/qcom/crosshatch/proprietary/LteDirectDiscovery.xml:system/etc/permissions/LteDirectDiscovery.xml:qcom \
     vendor/qcom/crosshatch/proprietary/qcrilhook.jar:system/framework/qcrilhook.jar:qcom \
     vendor/qcom/crosshatch/proprietary/qcrilhook.xml:system/etc/permissions/qcrilhook.xml:qcom \
     vendor/qcom/crosshatch/proprietary/QtiTelephonyServicelibrary.jar:system/framework/QtiTelephonyServicelibrary.jar:qcom \
     vendor/qcom/crosshatch/proprietary/radioconfiginterfacelibrary.jar:system/framework/radioconfiginterfacelibrary.jar:qcom \
-    vendor/qcom/crosshatch/proprietary/radioconfiginterface.xml:system/etc/permissions/radioconfiginterface.xml:qcom \
     vendor/qcom/crosshatch/proprietary/radioconfiglibrary.jar:system/framework/radioconfiglibrary.jar:qcom \
-    vendor/qcom/crosshatch/proprietary/radioconfig.xml:system/etc/permissions/radioconfig.xml:qcom \
     vendor/qcom/crosshatch/proprietary/telephonyservice.xml:system/etc/permissions/telephonyservice.xml:qcom \
     vendor/qcom/crosshatch/proprietary/uimremoteclientlibrary.jar:system/framework/uimremoteclientlibrary.jar:qcom \
     vendor/qcom/crosshatch/proprietary/uimremoteclient.xml:system/etc/permissions/uimremoteclient.xml:qcom \
     vendor/qcom/crosshatch/proprietary/uimremoteserverlibrary.jar:system/framework/uimremoteserverlibrary.jar:qcom \
     vendor/qcom/crosshatch/proprietary/uimremoteserver.xml:system/etc/permissions/uimremoteserver.xml:qcom \
     vendor/qcom/crosshatch/proprietary/UimService.xml:system/etc/permissions/UimService.xml:qcom \
-    vendor/qcom/crosshatch/proprietary/vendor.qti.hardware.alarm-V1.0-java.jar:system/framework/vendor.qti.hardware.alarm-V1.0-java.jar:qcom \
-    vendor/qcom/crosshatch/proprietary/vendor.qti.hardware.data.latency-V1.0-java.jar:system/framework/vendor.qti.hardware.data.latency-V1.0-java.jar:qcom \
-    vendor/qcom/crosshatch/proprietary/vendor.qti.hardware.soter-V1.0-java.jar:system/framework/vendor.qti.hardware.soter-V1.0-java.jar:qcom \
 
diff --git a/self-extractors_blueline/extract-lists.txt b/self-extractors_blueline/extract-lists.txt
index c8a18e6..e6dae6a 100644
--- a/self-extractors_blueline/extract-lists.txt
+++ b/self-extractors_blueline/extract-lists.txt
@@ -1,74 +1,43 @@
   google_devices)
     TO_EXTRACT="\
             IMAGES/vendor.img \
+            RADIO/bootloader.img \
+            RADIO/radio.img \
             "
     ;;
   qcom)
     TO_EXTRACT="\
+            system/app/ims/ims.apk \
             system/app/QtiTelephonyService/QtiTelephonyService.apk \
-            system/etc/permissions/cneapiclient.xml \
             system/etc/permissions/com.qualcomm.qti.imscmservice.xml \
-            system/etc/permissions/com.quicinc.cne.xml \
-            system/etc/permissions/LteDirectDiscovery.xml \
             system/etc/permissions/qcrilhook.xml \
-            system/etc/permissions/radioconfiginterface.xml \
-            system/etc/permissions/radioconfig.xml \
             system/etc/permissions/telephonyservice.xml \
             system/etc/permissions/uimremoteclient.xml \
             system/etc/permissions/uimremoteserver.xml \
             system/etc/permissions/UimService.xml \
-            system/framework/com.qualcomm.qti.uceservice-V2.0-java.jar \
-            system/framework/LteDirectDiscoveryLibrary.jar \
             system/framework/qcrilhook.jar \
             system/framework/QtiTelephonyServicelibrary.jar \
             system/framework/radioconfiginterfacelibrary.jar \
             system/framework/radioconfiglibrary.jar \
             system/framework/uimremoteclientlibrary.jar \
             system/framework/uimremoteserverlibrary.jar \
-            system/framework/vendor.qti.hardware.alarm-V1.0-java.jar \
-            system/framework/vendor.qti.hardware.data.latency-V1.0-java.jar \
-            system/framework/vendor.qti.hardware.soter-V1.0-java.jar \
-            system/lib64/libadsprpc_system.so \
-            system/lib64/libcdsprpc_system.so \
-            system/lib64/libDiagService.so \
-            system/lib64/libdiag_system.so \
-            system/lib64/libGPQTEEC_system.so \
-            system/lib64/libGPTEE_system.so \
             system/lib64/libimscamera_jni.so \
             system/lib64/libimsmedia_jni.so \
             system/lib64/lib-imsvideocodec.so \
             system/lib64/lib-imsvtextutils.so \
             system/lib64/lib-imsvt.so \
             system/lib64/lib-imsvtutils.so \
-            system/lib64/libmdsprpc_system.so \
-            system/lib64/libQTEEConnector_system.so \
             system/lib64/librcc.so \
             system/lib64/libsdm-disp-apis.so \
-            system/lib64/libsdsprpc_system.so \
             system/lib64/libsecureui_svcsock_system.so \
-            system/lib64/libOpenCL_system.so \
-            system/lib64/libsmcinvokecred.so \
-            system/lib64/libtzcom.so \
-            system/lib/libadsprpc_system.so \
-            system/lib/libcdsprpc_system.so \
-            system/lib/libdiag_system.so \
-            system/lib/libGPQTEEC_system.so \
-            system/lib/libGPTEE_system.so \
             system/lib/libimscamera_jni.so \
             system/lib/libimsmedia_jni.so \
             system/lib/lib-imsvideocodec.so \
             system/lib/lib-imsvtextutils.so \
             system/lib/lib-imsvt.so \
             system/lib/lib-imsvtutils.so \
-            system/lib/libmdsprpc_system.so \
-            system/lib/libQTEEConnector_system.so \
             system/lib/librcc.so \
             system/lib/libsdm-disp-apis.so \
-            system/lib/libsdsprpc_system.so \
             system/lib/libsecureui_svcsock_system.so \
-            system/lib/libOpenCL_system.so \
-            system/lib/libsmcinvokecred.so \
-            system/lib/libtzcom.so \
-            system/lib/rfsa/adsp/libsns_low_lat_stream_skel.so \
             "
     ;;
diff --git a/self-extractors_blueline/google_devices/staging/Android.mk b/self-extractors_blueline/google_devices/staging/Android.mk
new file mode 100644
index 0000000..c30fb2b
--- /dev/null
+++ b/self-extractors_blueline/google_devices/staging/Android.mk
@@ -0,0 +1,22 @@
+#
+# Copyright (C) 2019 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+LOCAL_PATH := $(call my-dir)
+
+ifneq ($(filter blueline,$(TARGET_DEVICE)),)
+  $(call add-radio-file,bootloader.img)
+  $(call add-radio-file,radio.img)
+endif
diff --git a/self-extractors_blueline/qcom/staging/Android.bp.txt b/self-extractors_blueline/qcom/staging/Android.bp.txt
new file mode 100644
index 0000000..57e9f2a
--- /dev/null
+++ b/self-extractors_blueline/qcom/staging/Android.bp.txt
@@ -0,0 +1,404 @@
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+soong_namespace {
+}
+
+cc_prebuilt_library_shared {
+    name: "libimscamera_jni",
+    arch: {
+        arm: {
+            srcs: ["libimscamera_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libimscamera_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+}
+
+cc_prebuilt_library_shared {
+    name: "libimsmedia_jni",
+    arch: {
+        arm: {
+            srcs: ["libimsmedia_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "libgui",
+                "libbinder",
+                "liblog",
+                "libandroid",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libimsmedia_jni.so"],
+            shared_libs: [
+                "libnativehelper",
+                "libcutils",
+                "libutils",
+                "libgui",
+                "libbinder",
+                "liblog",
+                "libandroid",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvideocodec",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvideocodec.so"],
+            shared_libs: [
+                "lib-imsvtutils",
+                "lib-imsvtextutils",
+                "libcutils",
+                "libutils",
+                "liblog",
+                // "libdiag_system",
+                "libgui",
+                "libnativewindow",
+                "libmediandk",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvideocodec.so"],
+            shared_libs: [
+                "lib-imsvtutils",
+                "lib-imsvtextutils",
+                "libcutils",
+                "libutils",
+                "liblog",
+                // "libdiag_system",
+                "libgui",
+                "libnativewindow",
+                "libmediandk",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvtextutils",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvtextutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "lib-imsvtutils",
+                "libGLESv2",
+                "libEGL",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvtextutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "lib-imsvtutils",
+                "libGLESv2",
+                "libEGL",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvt",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvt.so"],
+            shared_libs: [
+                "librcc",
+                "lib-imsvideocodec",
+                "lib-imsvtutils",
+                "libandroid",
+                // "libhwbinder",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.qti.imsrtpservice@1.0",
+                // "libdiag_system",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvt.so"],
+            shared_libs: [
+                "librcc",
+                "lib-imsvideocodec",
+                "lib-imsvtutils",
+                "libandroid",
+                // "libhwbinder",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.qti.imsrtpservice@1.0",
+                // "libdiag_system",
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "lib-imsvtutils",
+    arch: {
+        arm: {
+            srcs: ["lib-imsvtutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/lib-imsvtutils.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "librcc",
+    arch: {
+        arm: {
+            srcs: ["librcc.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/librcc.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                // "libdiag_system",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "libsdm-disp-apis",
+    arch: {
+        arm: {
+            srcs: ["libsdm-disp-apis.so"],
+            shared_libs: [
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.display.color@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libsdm-disp-apis.so"],
+            shared_libs: [
+                "libcutils",
+                "libutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "vendor.display.color@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
+
+cc_prebuilt_library_shared {
+    name: "libsecureui_svcsock_system",
+    arch: {
+        arm: {
+            srcs: ["libsecureui_svcsock_system.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "libhwbinder",
+                // "vendor.qti.hardware.tui_comm@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+        arm64: {
+            srcs: ["lib64/libsecureui_svcsock_system.so"],
+            shared_libs: [
+                "libutils",
+                "libcutils",
+                "liblog",
+                "libhidlbase",
+                // "libhidltransport",
+                // "libhwbinder",
+                // "vendor.qti.hardware.tui_comm@1.0",
+                "libc++",
+                "libc",
+                "libm",
+                "libdl",
+            ],
+        },
+    },
+    compile_multilib: "both",
+    owner: "qcom",
+    strip: {
+        none: true,
+    },
+    check_elf_files: false,
+}
diff --git a/self-extractors_blueline/qcom/staging/Android.mk b/self-extractors_blueline/qcom/staging/Android.mk
index 1e4ad67..f76f159 100644
--- a/self-extractors_blueline/qcom/staging/Android.mk
+++ b/self-extractors_blueline/qcom/staging/Android.mk
@@ -1,8 +1,18 @@
 LOCAL_PATH := $(call my-dir)
 
-include $(CLEAR_VARS)
-
 ifneq ($(filter blueline, $(TARGET_DEVICE)),)
+include $(CLEAR_VARS)
+LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
+LOCAL_MODULE := ims
+LOCAL_MODULE_TAGS := optional
+LOCAL_BUILT_MODULE_STEM := package.apk
+LOCAL_MODULE_OWNER := qcom
+LOCAL_MODULE_CLASS := APPS
+LOCAL_SRC_FILES := $(LOCAL_MODULE).apk
+LOCAL_CERTIFICATE := platform
+include $(BUILD_PREBUILT)
+
+include $(CLEAR_VARS)
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
 LOCAL_MODULE := QtiTelephonyService
 LOCAL_MODULE_TAGS := optional
diff --git a/self-extractors_blueline/qcom/staging/BoardConfigPartial.mk b/self-extractors_blueline/qcom/staging/BoardConfigPartial.mk
index e0b4fa2..9263047 100644
--- a/self-extractors_blueline/qcom/staging/BoardConfigPartial.mk
+++ b/self-extractors_blueline/qcom/staging/BoardConfigPartial.mk
@@ -11,3 +11,5 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+VENDOR_BLOBS_LICENSE := vendor/qcom/blueline/LICENSE
diff --git a/self-extractors_blueline/qcom/staging/device-partial.mk b/self-extractors_blueline/qcom/staging/device-partial.mk
index c75f13b..faaabb1 100644
--- a/self-extractors_blueline/qcom/staging/device-partial.mk
+++ b/self-extractors_blueline/qcom/staging/device-partial.mk
@@ -12,75 +12,38 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/qcom/blueline/proprietary \
+
 # AOSP packages required by the blobs
 PRODUCT_PACKAGES := \
+    ims \
     libprotobuf-cpp-full \
     QtiTelephonyService
 
 #  blob(s) necessary for blueline hardware
+PRODUCT_PACKAGES += \
+    libimscamera_jni \
+    libimsmedia_jni \
+    lib-imsvideocodec \
+    lib-imsvtextutils \
+    lib-imsvt \
+    lib-imsvtutils \
+    librcc \
+    libsdm-disp-apis \
+    libsecureui_svcsock_system \
+
 PRODUCT_COPY_FILES := \
-    vendor/qcom/blueline/proprietary/cneapiclient.xml:system/etc/permissions/cneapiclient.xml:qcom \
     vendor/qcom/blueline/proprietary/com.qualcomm.qti.imscmservice.xml:system/etc/permissions/com.qualcomm.qti.imscmservice.xml:qcom \
-    vendor/qcom/blueline/proprietary/com.qualcomm.qti.uceservice-V2.0-java.jar:system/framework/com.qualcomm.qti.uceservice-V2.0-java.jar:qcom \
-    vendor/qcom/blueline/proprietary/com.quicinc.cne.xml:system/etc/permissions/com.quicinc.cne.xml:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libadsprpc_system.so:system/lib64/libadsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libcdsprpc_system.so:system/lib64/libcdsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libDiagService.so:system/lib64/libDiagService.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libdiag_system.so:system/lib64/libdiag_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libGPQTEEC_system.so:system/lib64/libGPQTEEC_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libGPTEE_system.so:system/lib64/libGPTEE_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libimscamera_jni.so:system/lib64/libimscamera_jni.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libimsmedia_jni.so:system/lib64/libimsmedia_jni.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/lib-imsvideocodec.so:system/lib64/lib-imsvideocodec.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/lib-imsvtextutils.so:system/lib64/lib-imsvtextutils.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/lib-imsvt.so:system/lib64/lib-imsvt.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/lib-imsvtutils.so:system/lib64/lib-imsvtutils.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libmdsprpc_system.so:system/lib64/libmdsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libQTEEConnector_system.so:system/lib64/libQTEEConnector_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/librcc.so:system/lib64/librcc.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libsdm-disp-apis.so:system/lib64/libsdm-disp-apis.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libsdsprpc_system.so:system/lib64/libsdsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libsecureui_svcsock_system.so:system/lib64/libsecureui_svcsock_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libOpenCL_system.so:system/lib64/libOpenCL_system.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libsmcinvokecred.so:system/lib64/libsmcinvokecred.so:qcom \
-    vendor/qcom/blueline/proprietary/lib64/libtzcom.so:system/lib64/libtzcom.so:qcom \
-    vendor/qcom/blueline/proprietary/libadsprpc_system.so:system/lib/libadsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libcdsprpc_system.so:system/lib/libcdsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libdiag_system.so:system/lib/libdiag_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libGPQTEEC_system.so:system/lib/libGPQTEEC_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libGPTEE_system.so:system/lib/libGPTEE_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libimscamera_jni.so:system/lib/libimscamera_jni.so:qcom \
-    vendor/qcom/blueline/proprietary/libimsmedia_jni.so:system/lib/libimsmedia_jni.so:qcom \
-    vendor/qcom/blueline/proprietary/lib-imsvideocodec.so:system/lib/lib-imsvideocodec.so:qcom \
-    vendor/qcom/blueline/proprietary/lib-imsvtextutils.so:system/lib/lib-imsvtextutils.so:qcom \
-    vendor/qcom/blueline/proprietary/lib-imsvt.so:system/lib/lib-imsvt.so:qcom \
-    vendor/qcom/blueline/proprietary/lib-imsvtutils.so:system/lib/lib-imsvtutils.so:qcom \
-    vendor/qcom/blueline/proprietary/libmdsprpc_system.so:system/lib/libmdsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libQTEEConnector_system.so:system/lib/libQTEEConnector_system.so:qcom \
-    vendor/qcom/blueline/proprietary/librcc.so:system/lib/librcc.so:qcom \
-    vendor/qcom/blueline/proprietary/libsdm-disp-apis.so:system/lib/libsdm-disp-apis.so:qcom \
-    vendor/qcom/blueline/proprietary/libsdsprpc_system.so:system/lib/libsdsprpc_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libsecureui_svcsock_system.so:system/lib/libsecureui_svcsock_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libsns_low_lat_stream_skel.so:system/lib/rfsa/adsp/libsns_low_lat_stream_skel.so:qcom \
-    vendor/qcom/blueline/proprietary/libOpenCL_system.so:system/lib/libOpenCL_system.so:qcom \
-    vendor/qcom/blueline/proprietary/libsmcinvokecred.so:system/lib/libsmcinvokecred.so:qcom \
-    vendor/qcom/blueline/proprietary/libtzcom.so:system/lib/libtzcom.so:qcom \
-    vendor/qcom/blueline/proprietary/LteDirectDiscoveryLibrary.jar:system/framework/LteDirectDiscoveryLibrary.jar:qcom \
-    vendor/qcom/blueline/proprietary/LteDirectDiscovery.xml:system/etc/permissions/LteDirectDiscovery.xml:qcom \
     vendor/qcom/blueline/proprietary/qcrilhook.jar:system/framework/qcrilhook.jar:qcom \
     vendor/qcom/blueline/proprietary/qcrilhook.xml:system/etc/permissions/qcrilhook.xml:qcom \
     vendor/qcom/blueline/proprietary/QtiTelephonyServicelibrary.jar:system/framework/QtiTelephonyServicelibrary.jar:qcom \
     vendor/qcom/blueline/proprietary/radioconfiginterfacelibrary.jar:system/framework/radioconfiginterfacelibrary.jar:qcom \
-    vendor/qcom/blueline/proprietary/radioconfiginterface.xml:system/etc/permissions/radioconfiginterface.xml:qcom \
     vendor/qcom/blueline/proprietary/radioconfiglibrary.jar:system/framework/radioconfiglibrary.jar:qcom \
-    vendor/qcom/blueline/proprietary/radioconfig.xml:system/etc/permissions/radioconfig.xml:qcom \
     vendor/qcom/blueline/proprietary/telephonyservice.xml:system/etc/permissions/telephonyservice.xml:qcom \
     vendor/qcom/blueline/proprietary/uimremoteclientlibrary.jar:system/framework/uimremoteclientlibrary.jar:qcom \
     vendor/qcom/blueline/proprietary/uimremoteclient.xml:system/etc/permissions/uimremoteclient.xml:qcom \
     vendor/qcom/blueline/proprietary/uimremoteserverlibrary.jar:system/framework/uimremoteserverlibrary.jar:qcom \
     vendor/qcom/blueline/proprietary/uimremoteserver.xml:system/etc/permissions/uimremoteserver.xml:qcom \
     vendor/qcom/blueline/proprietary/UimService.xml:system/etc/permissions/UimService.xml:qcom \
-    vendor/qcom/blueline/proprietary/vendor.qti.hardware.alarm-V1.0-java.jar:system/framework/vendor.qti.hardware.alarm-V1.0-java.jar:qcom \
-    vendor/qcom/blueline/proprietary/vendor.qti.hardware.data.latency-V1.0-java.jar:system/framework/vendor.qti.hardware.data.latency-V1.0-java.jar:qcom \
-    vendor/qcom/blueline/proprietary/vendor.qti.hardware.soter-V1.0-java.jar:system/framework/vendor.qti.hardware.soter-V1.0-java.jar:qcom \
 
diff --git a/small_hals/Android.bp b/small_hals/Android.bp
index 489c141..2828c83 100644
--- a/small_hals/Android.bp
+++ b/small_hals/Android.bp
@@ -15,7 +15,6 @@
         "android.hardware.vibrator@1.2",
         "libbase",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
diff --git a/teeui/tests/blueline/Android.bp b/teeui/tests/blueline/Android.bp
new file mode 100644
index 0000000..7d528d9
--- /dev/null
+++ b/teeui/tests/blueline/Android.bp
@@ -0,0 +1,18 @@
+cc_test_host {
+    name: "system.teeui_localization_rendering_test.blueline",
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-Wextra",
+        "-O0",
+    ],
+    srcs: [
+        "test_main.cpp",
+    ],
+    test_suites: ["device-tests"],
+    shared_libs: [
+        "libbase",
+        "libteeui_localization_rendering_test",
+    ],
+}
+
diff --git a/teeui/tests/blueline/TEST_MAPPING b/teeui/tests/blueline/TEST_MAPPING
new file mode 100644
index 0000000..acf9e33
--- /dev/null
+++ b/teeui/tests/blueline/TEST_MAPPING
@@ -0,0 +1,35 @@
+{
+  "postsubmit": [
+    {
+      "name": "system.teeui_localization_rendering_test.blueline",
+      "host" : true,
+      "options": [
+          {
+            "native-test-flag": "--width=1080"
+          },
+          {
+            "native-test-flag": "--height=2160"
+          },
+          {
+            "native-test-flag": "--dp2px=2.62135"
+          },
+          {
+            "native-test-flag": "--mm2px=17.42075974"
+          },
+          {
+            "native-test-flag": "--powerButtonTop=20.26"
+          },
+          {
+            "native-test-flag": "--powerButtonBottom=30.26"
+          },
+          {
+            "native-test-flag": "--volUpButtonTop=40.26"
+          },
+          {
+            "native-test-flag": "--volUpButtonBottom=50.26"
+          }
+        ]
+    }
+  ]
+}
+
diff --git a/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml b/teeui/tests/blueline/test_main.cpp
similarity index 60%
rename from overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
rename to teeui/tests/blueline/test_main.cpp
index 378e34b..5d030e5 100644
--- a/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
+++ b/teeui/tests/blueline/test_main.cpp
@@ -1,7 +1,5 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-/**
- * Copyright (c) 2018, The Android Open Source Project
+/*
+ * Copyright 2020, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,10 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
--->
-<resources>
-    <!-- Default for Settings.System.VIBRATE_WHEN_RINGING -->
-    <bool name="def_vibrate_when_ringing">true</bool>
-    <!-- Default for Settings.Global.APPLY_RAMPING_RINGER -->
-    <bool name="def_apply_ramping_ringer">false</bool>
-</resources>
+
+#include <gtest/gtest.h>
+#include <teeui/test/teeui_render_test.h>
+
+int main(int argc, char **argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    teeui::test::initRenderTest(argc, argv);
+    return RUN_ALL_TESTS();
+}
diff --git a/teeui/tests/crosshatch/Android.bp b/teeui/tests/crosshatch/Android.bp
new file mode 100644
index 0000000..437cc1f
--- /dev/null
+++ b/teeui/tests/crosshatch/Android.bp
@@ -0,0 +1,18 @@
+cc_test_host {
+    name: "system.teeui_localization_rendering_test.crosshatch",
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-Wextra",
+        "-O0",
+    ],
+    srcs: [
+        "test_main.cpp",
+    ],
+    test_suites: ["device-tests"],
+    shared_libs: [
+        "libbase",
+        "libteeui_localization_rendering_test",
+    ],
+}
+
diff --git a/teeui/tests/crosshatch/TEST_MAPPING b/teeui/tests/crosshatch/TEST_MAPPING
new file mode 100644
index 0000000..fa43129
--- /dev/null
+++ b/teeui/tests/crosshatch/TEST_MAPPING
@@ -0,0 +1,35 @@
+{
+  "postsubmit": [
+    {
+      "name": "system.teeui_localization_rendering_test.crosshatch",
+      "host" : true,
+      "options": [
+          {
+            "native-test-flag": "--width=1440"
+          },
+          {
+            "native-test-flag": "--height=2950"
+          },
+          {
+            "native-test-flag": "--dp2px=3.495145631"
+          },
+          {
+            "native-test-flag": "--mm2px=20.42958729"
+          },
+          {
+            "native-test-flag": "--powerButtonTop=34.146"
+          },
+          {
+            "native-test-flag": "--powerButtonBottom=44.146"
+          },
+          {
+            "native-test-flag": "--volUpButtonTop=54.146"
+          },
+          {
+            "native-test-flag": "--volUpButtonBottom=64.146"
+          }
+        ]
+    }
+  ]
+}
+
diff --git a/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml b/teeui/tests/crosshatch/test_main.cpp
similarity index 60%
copy from overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
copy to teeui/tests/crosshatch/test_main.cpp
index 378e34b..5d030e5 100644
--- a/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
+++ b/teeui/tests/crosshatch/test_main.cpp
@@ -1,7 +1,5 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-/**
- * Copyright (c) 2018, The Android Open Source Project
+/*
+ * Copyright 2020, The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,10 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
--->
-<resources>
-    <!-- Default for Settings.System.VIBRATE_WHEN_RINGING -->
-    <bool name="def_vibrate_when_ringing">true</bool>
-    <!-- Default for Settings.Global.APPLY_RAMPING_RINGER -->
-    <bool name="def_apply_ramping_ringer">false</bool>
-</resources>
+
+#include <gtest/gtest.h>
+#include <teeui/test/teeui_render_test.h>
+
+int main(int argc, char **argv) {
+    ::testing::InitGoogleTest(&argc, argv);
+    teeui::test::initRenderTest(argc, argv);
+    return RUN_ALL_TESTS();
+}
diff --git a/ueventd.hardware.rc b/ueventd.hardware.rc
index 04be534..166670d 100644
--- a/ueventd.hardware.rc
+++ b/ueventd.hardware.rc
@@ -120,3 +120,6 @@
 
 # fuel gauge history
 /dev/maxfg_history        0644   system system
+
+# Resume-on-Reboot
+/dev/access-kregistry     0660   system system
diff --git a/usb/Android.bp b/usb/Android.bp
index e738f94..9873ee1 100644
--- a/usb/Android.bp
+++ b/usb/Android.bp
@@ -17,16 +17,20 @@
     name: "android.hardware.usb@1.1-service.crosshatch",
     relative_install_path: "hw",
     init_rc: ["android.hardware.usb@1.1-service.crosshatch.rc"],
+    vintf_fragments: [
+        "android.hardware.usb@1.1-service.crosshatch.xml",
+        "android.hardware.usb.gadget@1.1-service.crosshatch.xml",
+    ],
     srcs: ["service.cpp", "Usb.cpp", "UsbGadget.cpp"],
     shared_libs: [
         "android.hardware.usb@1.0",
         "android.hardware.usb@1.1",
         "android.hardware.usb.gadget@1.0",
+        "android.hardware.usb.gadget@1.1",
         "libbase",
         "libcutils",
         "libhardware",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
diff --git a/usb/UsbGadget.cpp b/usb/UsbGadget.cpp
index d7456ce..6d59ad9 100644
--- a/usb/UsbGadget.cpp
+++ b/usb/UsbGadget.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "android.hardware.usb.gadget@1.0-service.crosshatch"
+#define LOG_TAG "android.hardware.usb.gadget@1.1-service.crosshatch"
 
 #include "UsbGadget.h"
 #include <dirent.h>
@@ -58,7 +58,7 @@
 namespace hardware {
 namespace usb {
 namespace gadget {
-namespace V1_0 {
+namespace V1_1 {
 namespace implementation {
 
 volatile bool gadgetPullup;
@@ -283,6 +283,15 @@
   return Status::SUCCESS;
 }
 
+Return<Status> UsbGadget::reset() {
+    if (!WriteStringToFile("none", PULLUP_PATH)) {
+        ALOGI("Gadget cannot be pulled down");
+        return Status::ERROR;
+    }
+
+    return Status::SUCCESS;
+}
+
 static int linkFunction(const char *function, int index) {
   char functionPath[MAX_FILE_PATH_LENGTH];
   char link[MAX_FILE_PATH_LENGTH];
@@ -336,18 +345,24 @@
       if (vendorFunctions == "diag") {
         ret = setVidPid("0x05C6", "0x901B");
       } else {
-        if (!(vendorFunctions == "user" || vendorFunctions == ""))
-          ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-        ret = setVidPid("0x18d1", "0x4ee1");
+          if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+              ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+              ret = Status::CONFIGURATION_NOT_SUPPORTED;
+          } else {
+              ret = setVidPid("0x18d1", "0x4ee1");
+          }
       }
       break;
     case GadgetFunction::ADB | GadgetFunction::MTP:
       if (vendorFunctions == "diag") {
         ret = setVidPid("0x05C6", "0x903A");
       } else {
-        if (!(vendorFunctions == "user" || vendorFunctions == ""))
-          ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-        ret = setVidPid("0x18d1", "0x4ee2");
+          if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+              ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+              ret = Status::CONFIGURATION_NOT_SUPPORTED;
+          } else {
+              ret = setVidPid("0x18d1", "0x4ee2");
+          }
       }
       break;
     case static_cast<uint64_t>(GadgetFunction::RNDIS):
@@ -356,9 +371,12 @@
       } else if (vendorFunctions == "serial_cdev,diag") {
         ret = setVidPid("0x05C6", "0x90B5");
       } else {
-        if (!(vendorFunctions == "user" || vendorFunctions == ""))
-          ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-        ret = setVidPid("0x18d1", "0x4ee3");
+          if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+              ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+              ret = Status::CONFIGURATION_NOT_SUPPORTED;
+          } else {
+              ret = setVidPid("0x18d1", "0x4ee3");
+          }
       }
       break;
     case GadgetFunction::ADB | GadgetFunction::RNDIS:
@@ -367,21 +385,30 @@
       } else if (vendorFunctions == "serial_cdev,diag") {
         ret = setVidPid("0x05C6", "0x90B6");
       } else {
-        if (!(vendorFunctions == "user" || vendorFunctions == ""))
-          ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-        ret = setVidPid("0x18d1", "0x4ee4");
+          if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+              ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+              ret = Status::CONFIGURATION_NOT_SUPPORTED;
+          } else {
+              ret = setVidPid("0x18d1", "0x4ee4");
+          }
       }
       break;
     case static_cast<uint64_t>(GadgetFunction::PTP):
-      if (!(vendorFunctions == "user" || vendorFunctions == ""))
-        ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-      ret = setVidPid("0x18d1", "0x4ee5");
-      break;
+        if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+            ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+            ret = Status::CONFIGURATION_NOT_SUPPORTED;
+        } else {
+            ret = setVidPid("0x18d1", "0x4ee5");
+        }
+        break;
     case GadgetFunction::ADB | GadgetFunction::PTP:
-      if (!(vendorFunctions == "user" || vendorFunctions == ""))
-        ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-      ret = setVidPid("0x18d1", "0x4ee6");
-      break;
+        if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+            ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+            ret = Status::CONFIGURATION_NOT_SUPPORTED;
+        } else {
+            ret = setVidPid("0x18d1", "0x4ee6");
+        }
+        break;
     case static_cast<uint64_t>(GadgetFunction::ADB):
       if (vendorFunctions == "diag") {
         ret = setVidPid("0x05C6", "0x901D");
@@ -390,21 +417,30 @@
       } else if (vendorFunctions == "diag,serial_cdev") {
         ret = setVidPid("0x05C6", "0x901F");
       } else {
-        if (!(vendorFunctions == "user" || vendorFunctions == ""))
-          ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-        ret = setVidPid("0x18d1", "0x4ee7");
+          if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+              ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+              ret = Status::CONFIGURATION_NOT_SUPPORTED;
+          } else {
+              ret = setVidPid("0x18d1", "0x4ee7");
+          }
       }
       break;
     case static_cast<uint64_t>(GadgetFunction::MIDI):
-      if (!(vendorFunctions == "user" || vendorFunctions == ""))
-        ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-      ret = setVidPid("0x18d1", "0x4ee8");
-      break;
+        if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+            ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+            ret = Status::CONFIGURATION_NOT_SUPPORTED;
+        } else {
+            ret = setVidPid("0x18d1", "0x4ee8");
+        }
+        break;
     case GadgetFunction::ADB | GadgetFunction::MIDI:
-      if (!(vendorFunctions == "user" || vendorFunctions == ""))
-        ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
-      ret = setVidPid("0x18d1", "0x4ee9");
-      break;
+        if (!(vendorFunctions == "user" || vendorFunctions == "")) {
+            ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
+            ret = Status::CONFIGURATION_NOT_SUPPORTED;
+        } else {
+            ret = setVidPid("0x18d1", "0x4ee9");
+        }
+        break;
     case static_cast<uint64_t>(GadgetFunction::ACCESSORY):
       if (!(vendorFunctions == "user" || vendorFunctions == ""))
         ALOGE("Invalid vendorFunctions set: %s", vendorFunctions.c_str());
@@ -527,6 +563,8 @@
   if ((functions & GadgetFunction::ADB) != 0) {
     ffsEnabled = true;
     ALOGI("setCurrentUsbFunctions Adb");
+    if (!WriteStringToFile("1", DESC_USE_PATH))
+      return Status::ERROR;
     if (inotify_add_watch(inotifyFd, "/dev/usb-ffs/adb/", IN_ALL_EVENTS) == -1)
       return Status::ERROR;
 
@@ -643,7 +681,7 @@
   return Void();
 }
 }  // namespace implementation
-}  // namespace V1_0
+}  // namespace V1_1
 }  // namespace gadget
 }  // namespace usb
 }  // namespace hardware
diff --git a/usb/UsbGadget.h b/usb/UsbGadget.h
index a0aa42b..327be9a 100644
--- a/usb/UsbGadget.h
+++ b/usb/UsbGadget.h
@@ -14,29 +14,28 @@
  * limitations under the License.
  */
 
-#ifndef ANDROID_HARDWARE_USB_GADGET_V1_0_USBGADGET_H
-#define ANDROID_HARDWARE_USB_GADGET_V1_0_USBGADGET_H
+#pragma once
 
 #include <android-base/file.h>
 #include <android-base/properties.h>
 #include <android-base/unique_fd.h>
-#include <android/hardware/usb/gadget/1.0/IUsbGadget.h>
+#include <android/hardware/usb/gadget/1.1/IUsbGadget.h>
 #include <hidl/MQDescriptor.h>
 #include <hidl/Status.h>
-#include <string>
 #include <sys/epoll.h>
 #include <sys/eventfd.h>
-#include <thread>
 #include <utils/Log.h>
 #include <chrono>
 #include <condition_variable>
 #include <mutex>
+#include <string>
+#include <thread>
 
 namespace android {
 namespace hardware {
 namespace usb {
 namespace gadget {
-namespace V1_0 {
+namespace V1_1 {
 namespace implementation {
 
 using ::android::sp;
@@ -50,7 +49,9 @@
 using ::android::hardware::hidl_vec;
 using ::android::hardware::Return;
 using ::android::hardware::Void;
-using ::std::chrono::steady_clock;
+using ::android::hardware::usb::gadget::V1_0::GadgetFunction;
+using ::android::hardware::usb::gadget::V1_0::Status;
+using ::android::hardware::usb::gadget::V1_1::IUsbGadget;
 using ::std::lock_guard;
 using ::std::move;
 using ::std::mutex;
@@ -58,6 +59,7 @@
 using ::std::thread;
 using ::std::unique_ptr;
 using ::std::vector;
+using ::std::chrono::steady_clock;
 using namespace std::chrono;
 using namespace std::chrono_literals;
 
@@ -80,24 +82,22 @@
   bool mCurrentUsbFunctionsApplied;
 
   Return<void> setCurrentUsbFunctions(uint64_t functions,
-                                      const sp<IUsbGadgetCallback>& callback,
+                                      const sp<V1_0::IUsbGadgetCallback> &callback,
                                       uint64_t timeout) override;
 
-  Return<void> getCurrentUsbFunctions(
-      const sp<IUsbGadgetCallback>& callback) override;
+  Return<void> getCurrentUsbFunctions(const sp<V1_0::IUsbGadgetCallback> &callback) override;
 
-  private:
+  Return<Status> reset() override;
+
+private:
   Status tearDownGadget();
-  Status setupFunctions(uint64_t functions,
-                        const sp<IUsbGadgetCallback>& callback,
+  Status setupFunctions(uint64_t functions, const sp<V1_0::IUsbGadgetCallback> &callback,
                         uint64_t timeout);
 };
 
 }  // namespace implementation
-}  // namespace V1_0
+}  // namespace V1_1
 }  // namespace gadget
 }  // namespace usb
 }  // namespace hardware
 }  // namespace android
-
-#endif  // ANDROID_HARDWARE_USB_V1_2_USBGADGET_H
diff --git a/usb/android.hardware.usb.gadget@1.1-service.crosshatch.xml b/usb/android.hardware.usb.gadget@1.1-service.crosshatch.xml
new file mode 100644
index 0000000..a6f9a1f
--- /dev/null
+++ b/usb/android.hardware.usb.gadget@1.1-service.crosshatch.xml
@@ -0,0 +1,11 @@
+<manifest version="1.0" type="device">
+    <hal format="hidl">
+        <name>android.hardware.usb.gadget</name>
+        <transport>hwbinder</transport>
+        <version>1.1</version>
+        <interface>
+            <name>IUsbGadget</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/usb/android.hardware.usb@1.1-service.crosshatch.xml b/usb/android.hardware.usb@1.1-service.crosshatch.xml
new file mode 100644
index 0000000..5ce2ff4
--- /dev/null
+++ b/usb/android.hardware.usb@1.1-service.crosshatch.xml
@@ -0,0 +1,12 @@
+<manifest version="1.0" type="device">
+    <hal format="hidl">
+        <name>android.hardware.usb</name>
+        <transport>hwbinder</transport>
+        <version>1.1</version>
+        <interface>
+            <name>IUsb</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
+
diff --git a/usb/service.cpp b/usb/service.cpp
index 372267e..2b50540 100644
--- a/usb/service.cpp
+++ b/usb/service.cpp
@@ -27,10 +27,10 @@
 using android::hardware::joinRpcThreadpool;
 
 // Generated HIDL files
+using android::hardware::usb::gadget::V1_1::IUsbGadget;
+using android::hardware::usb::gadget::V1_1::implementation::UsbGadget;
 using android::hardware::usb::V1_1::IUsb;
-using android::hardware::usb::gadget::V1_0::IUsbGadget;
 using android::hardware::usb::V1_1::implementation::Usb;
-using android::hardware::usb::gadget::V1_0::implementation::UsbGadget;
 
 using android::OK;
 using android::status_t;
diff --git a/vibrator/Android.bp b/vibrator/Android.bp
index e8b204f..f80dc63 100644
--- a/vibrator/Android.bp
+++ b/vibrator/Android.bp
@@ -31,8 +31,6 @@
         "libcutils",
         "libhardware",
         "libhidlbase",
-        "libhidltransport",
-        "libhwbinder",
         "liblog",
         "libutils",
     ],
diff --git a/voice_processing/Android.bp b/voice_processing/Android.bp
new file mode 100644
index 0000000..48d21dd
--- /dev/null
+++ b/voice_processing/Android.bp
@@ -0,0 +1,25 @@
+// Copyright (C) 2017 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+cc_library_shared {
+    name: "libqcomvoiceprocessingdescriptors",
+    srcs: ["voice_processing_descriptors.c"],
+    header_libs: [
+        "libaudioeffects",
+        "libhardware_headers",
+    ],
+    relative_install_path: "soundfx",
+    owner: "qcom",
+    proprietary: true,
+}
diff --git a/voice_processing/Android.mk b/voice_processing/Android.mk
deleted file mode 100644
index 674881f..0000000
--- a/voice_processing/Android.mk
+++ /dev/null
@@ -1,29 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-LOCAL_SRC_FILES := voice_processing_descriptors.c
-LOCAL_C_INCLUDES += $(call include-path-for, audio-effects)
-LOCAL_HEADER_LIBRARIES := libhardware_headers
-LOCAL_MULTILIB := $(AUDIOSERVER_MULTILIB)
-LOCAL_MODULE := libqcomvoiceprocessingdescriptors
-LOCAL_MODULE_RELATIVE_PATH := soundfx
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_OWNER := qcom
-LOCAL_PROPRIETARY_MODULE := true
-
-include $(BUILD_SHARED_LIBRARY)
diff --git a/wpa_supplicant_overlay.conf b/wpa_supplicant_overlay.conf
index a1b2b09..f15cd15 100644
--- a/wpa_supplicant_overlay.conf
+++ b/wpa_supplicant_overlay.conf
@@ -7,3 +7,4 @@
 hs20=1
 auto_interworking=0
 bss_no_flush_when_down=1
+driver_param=use_p2p_group_interface=1