diff --git a/BoardConfig.mk b/BoardConfig.mk
index 60b0033..d2d9b80 100644
--- a/BoardConfig.mk
+++ b/BoardConfig.mk
@@ -87,6 +87,8 @@
 
 BOARD_HAL_STATIC_LIBRARIES := libdumpstate.angler
 
+TARGET_AUX_OS_VARIANT_LIST := angler
+
 TARGET_RECOVERY_FSTAB = device/huawei/angler/fstab.angler
 TARGET_COPY_OUT_VENDOR := vendor
 TARGET_RELEASETOOLS_EXTENSIONS := device/huawei/angler
diff --git a/camera/QCamera2/util/QCameraFlash.cpp b/camera/QCamera2/util/QCameraFlash.cpp
index 2ca8fb4..e5d3c4c 100644
--- a/camera/QCamera2/util/QCameraFlash.cpp
+++ b/camera/QCamera2/util/QCameraFlash.cpp
@@ -156,7 +156,7 @@
         ALOGE("%s: No flash available for camera id: %d",
                 __func__,
                 camera_id);
-        retVal = -EINVAL;
+        retVal = -ENOSYS;
     } else if (m_cameraOpen[camera_id]) {
         ALOGE("%s: Camera in use for camera id: %d",
                 __func__,
diff --git a/device.mk b/device.mk
index 081261e..48a3c05 100644
--- a/device.mk
+++ b/device.mk
@@ -23,7 +23,7 @@
 TARGET_USES_CHINOOK_SENSORHUB := false
 
 ifeq ($(TARGET_PREBUILT_KERNEL),)
-    LOCAL_KERNEL := device/huawei/angler-kernel/Image.gz-dtb
+  LOCAL_KERNEL := device/huawei/angler-kernel/Image.gz-dtb
 else
   LOCAL_KERNEL := $(TARGET_PREBUILT_KERNEL)
 endif
@@ -38,7 +38,9 @@
     device/huawei/angler/ueventd.angler.rc:root/ueventd.angler.rc \
     device/huawei/angler/init.recovery.angler.rc:root/init.recovery.angler.rc \
     device/huawei/angler/init.angler.power.sh:system/bin/init.angler.power.sh \
-    device/huawei/angler/uinput-fpc.kl:system/usr/keylayout/uinput-fpc.kl
+    device/huawei/angler/uinput-fpc.kl:system/usr/keylayout/uinput-fpc.kl \
+    device/huawei/angler/init.qcom.devwait.sh:system/bin/init.qcom.devwait.sh \
+    device/huawei/angler/init.qcom.devstart.sh:system/bin/init.qcom.devstart.sh
 
 ifeq ($(TARGET_USES_CHINOOK_SENSORHUB),true)
 PRODUCT_COPY_FILES += \
@@ -95,7 +97,8 @@
 
 # include fingerprintd
 PRODUCT_PACKAGES += \
-    fingerprintd
+    fingerprintd \
+    android.hardware.biometrics.fingerprint@2.1-impl
 
 # Delegation for OEM customization
 PRODUCT_OEM_PROPERTIES := \
@@ -183,7 +186,12 @@
     hwcomposer.msm8994 \
     libgenlock \
     memtrack.msm8994 \
-    lights.angler
+    android.hardware.memtrack@1.0-impl
+
+# Light HAL
+PRODUCT_PACKAGES += \
+    lights.angler \
+    android.hardware.light@2.0-impl
 
 USE_XML_AUDIO_POLICY_CONF := 1
 PRODUCT_PACKAGES += \
@@ -202,12 +210,6 @@
 PRODUCT_PACKAGES += \
     android.hardware.soundtrigger@2.0-impl
 
-# TODO(b/31817599) remove when angler_treble goes away
-ifeq ($(TARGET_PRODUCT), angler_treble)
-PRODUCT_PACKAGES += \
-    android.hardware.audio@2.0-service
-endif
-
 # Audio effects
 PRODUCT_PACKAGES += \
     libqcomvisualizer \
@@ -224,6 +226,12 @@
     libOmxVdecHevc \
     libOmxVenc
 
+PRODUCT_PACKAGES += \
+    android.hardware.audio@2.0-impl \
+    android.hardware.audio.effect@2.0-impl \
+    android.hardware.broadcastradio@1.0-impl \
+    android.hardware.soundtrigger@2.0-impl
+
 #CAMERA
 PRODUCT_PACKAGES += \
     camera.msm8994 \
@@ -248,7 +256,13 @@
 PRODUCT_PACKAGES += \
     sensors.angler \
     activity_recognition.angler \
-    context_hub.default
+    context_hub.default \
+    android.hardware.sensors@1.0-impl \
+    android.hardware.contexthub@1.0-impl \
+
+# new gatekeeper HAL
+PRODUCT_PACKAGES += \
+    android.hardware.gatekeeper@1.0-impl
 
 ifeq ($(TARGET_USES_CHINOOK_SENSORHUB),true)
 PRODUCT_PACKAGES += \
@@ -271,10 +285,12 @@
     charger_res_images
 
 PRODUCT_PACKAGES += \
+    android.hardware.wifi@1.0-service \
     libwpa_client \
     hostapd \
     wlutil \
     wificond \
+    wifilogd \
     wpa_supplicant \
     wpa_supplicant.conf
 
@@ -290,20 +306,46 @@
 # NFC
 PRODUCT_PACKAGES += \
     libnfc-nci \
-    nfc_nci.angler \
     NfcNci \
     Tag \
+    nfc_nci.angler \
     android.hardware.nfc@1.0-impl \
 
 ifeq ($(ENABLE_TREBLE), true)
 PRODUCT_PACKAGES += \
-    android.hardware.nfc@1.0-service
+    android.hardware.nfc@1.0-service \
+    android.hardware.vibrator@1.0-service   \
+    android.hardware.thermal@1.0-service    \
+    android.hardware.gatekeeper@1.0-service \
+
 endif
 
+# Keymaster HAL
+PRODUCT_PACKAGES += \
+    android.hardware.keymaster@3.0-impl
+
+ifeq ($(ENABLE_TREBLE), true)
+PRODUCT_PACKAGES += \
+    android.hardware.keymaster@3.0-service
+endif
+
+# Vibrator
+PRODUCT_PACKAGES += \
+    android.hardware.vibrator@1.0-impl
+
 # Power HAL
 PRODUCT_PACKAGES += \
     power.angler \
-    thermal.angler
+    android.hardware.power@1.0-impl \
+
+# Thermal HAL
+PRODUCT_PACKAGES += \
+    thermal.angler \
+    android.hardware.thermal@1.0-impl
+
+#GNSS HAL
+PRODUCT_PACKAGES += \
+    android.hardware.gnss@1.0-impl
 
 # Test HAL for hwbinder performance benchamrk  (only for userdebug and eng builds)
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
@@ -349,7 +391,13 @@
 
 # VR HAL
 PRODUCT_PACKAGES += \
-    vr.angler
+    vr.angler \
+    android.hardware.vr@1.0-impl
+
+ifeq ($(ENABLE_TREBLE), true)
+PRODUCT_PACKAGES += \
+    android.hardware.vr@1.0-service
+endif
 
 # Enable low power video mode for 4K encode
 PRODUCT_PROPERTY_OVERRIDES += \
@@ -470,7 +518,7 @@
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
 ifeq (,$(filter aosp_angler, $(TARGET_PRODUCT)))
 PRODUCT_PACKAGES += \
-    QXDMLoggerV2
+    NexusLogger
 endif # aosp_angler
 
 PRODUCT_COPY_FILES += \
diff --git a/dumpstate/Android.mk b/dumpstate/Android.mk
index 3800e19..3f263f1 100644
--- a/dumpstate/Android.mk
+++ b/dumpstate/Android.mk
@@ -15,7 +15,7 @@
 LOCAL_PATH:= $(call my-dir)
 include $(CLEAR_VARS)
 
-LOCAL_C_INCLUDES := frameworks/native/cmds/dumpstate
+LOCAL_STATIC_LIBRARIES := libdumpstateheaders
 
 LOCAL_SRC_FILES := dumpstate.cpp
 
diff --git a/dumpstate/dumpstate.cpp b/dumpstate/dumpstate.cpp
index a0a498d..afc5bda 100644
--- a/dumpstate/dumpstate.cpp
+++ b/dumpstate/dumpstate.cpp
@@ -18,24 +18,26 @@
 
 void dumpstate_board()
 {
-    dump_file("INTERRUPTS", "/proc/interrupts");
-    dump_file("RPM Stats", "/d/rpm_stats");
-    dump_file("Power Management Stats", "/d/rpm_master_stats");
-    run_command("SUBSYSTEM TOMBSTONES", 5, SU_PATH, "root", "ls", "-l", "/data/tombstones/ramdump", NULL);
-    dump_file("BAM DMUX Log", "/d/ipc_logging/bam_dmux/log");
-    dump_file("SMD Log", "/d/ipc_logging/smd/log");
-    dump_file("SMD PKT Log", "/d/ipc_logging/smd_pkt/log");
-    dump_file("IPC Router Log", "/d/ipc_logging/ipc_router/log");
-    dump_file("Enabled Clocks", "/d/clk/enabled_clocks");
-    dump_file("wlan", "/sys/module/bcmdhd/parameters/info_string");
-    run_command("ION HEAPS", 5, SU_PATH, "root", "/system/bin/sh", "-c", "for d in $(ls -d /d/ion/*); do for f in $(ls $d); do echo --- $d/$f; cat $d/$f; done; done", NULL);
-    run_command("Temperatures", 5, SU_PATH, "root", "/system/bin/sh", "-c", "for f in die_temp emmc_therm msm_therm pa_therm1 quiet_therm ; do echo -n \"$f : \" ; cat /sys/class/hwmon/hwmon1/device/$f ; done ; for f in `ls /sys/class/thermal` ; do type=`cat /sys/class/thermal/$f/type` ; temp=`cat /sys/class/thermal/$f/temp` ; echo \"$type: $temp\" ; done", NULL);
-    dump_file("dmesg-ramoops-0", "/sys/fs/pstore/dmesg-ramoops-0");
-    dump_file("dmesg-ramoops-1", "/sys/fs/pstore/dmesg-ramoops-1");
-    dump_file("LITTLE cluster time-in-state", "/sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state");
-    run_command("LITTLE cluster cpuidle", 5, SU_PATH, "root", "/system/bin/sh", "-c", "for d in $(ls -d /sys/devices/system/cpu/cpu0/cpuidle/state*); do echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done", NULL);
-    dump_file("big cluster time-in-state", "/sys/devices/system/cpu/cpu4/cpufreq/stats/time_in_state");
-    run_command("big cluster cpuidle", 5, SU_PATH, "root", "/system/bin/sh", "-c", "for d in $(ls -d /sys/devices/system/cpu/cpu4/cpuidle/state*); do echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done", NULL);
-    dump_file("Battery:", "/sys/class/power_supply/bms/uevent");
-    run_command("Battery:", 5, SU_PATH, "root", "/system/bin/sh", "-c", "for f in 1 2 3 4 5 6 7 8; do echo $f > /sys/class/power_supply/bms/cycle_count_id; echo \"$f: `cat /sys/class/power_supply/bms/cycle_count`\"; done", NULL);
+    Dumpstate& ds = Dumpstate::GetInstance();
+
+    ds.DumpFile("INTERRUPTS", "/proc/interrupts");
+    ds.DumpFile("RPM Stats", "/d/rpm_stats");
+    ds.DumpFile("Power Management Stats", "/d/rpm_master_stats");
+    ds.RunCommand("SUBSYSTEM TOMBSTONES", {"ls", "-l", "/data/tombstones/ramdump"}, CommandOptions::AS_ROOT_5);
+    ds.DumpFile("BAM DMUX Log", "/d/ipc_logging/bam_dmux/log");
+    ds.DumpFile("SMD Log", "/d/ipc_logging/smd/log");
+    ds.DumpFile("SMD PKT Log", "/d/ipc_logging/smd_pkt/log");
+    ds.DumpFile("IPC Router Log", "/d/ipc_logging/ipc_router/log");
+    ds.DumpFile("Enabled Clocks", "/d/clk/enabled_clocks");
+    ds.DumpFile("wlan", "/sys/module/bcmdhd/parameters/info_string");
+    ds.RunCommand("ION HEAPS", {"/system/bin/sh", "-c", "for d in $(ls -d /d/ion/*); do for f in $(ls $d); do echo --- $d/$f; cat $d/$f; done; done"}, CommandOptions::AS_ROOT_5);
+    ds.RunCommand("Temperatures", {"/system/bin/sh", "-c", "for f in die_temp emmc_therm msm_therm pa_therm1 quiet_therm ; do echo -n \"$f : \" ; cat /sys/class/hwmon/hwmon1/device/$f ; done ; for f in `ls /sys/class/thermal` ; do type=`cat /sys/class/thermal/$f/type` ; temp=`cat /sys/class/thermal/$f/temp` ; echo \"$type: $temp\" ; done"}, CommandOptions::AS_ROOT_5);
+    ds.DumpFile("dmesg-ramoops-0", "/sys/fs/pstore/dmesg-ramoops-0");
+    ds.DumpFile("dmesg-ramoops-1", "/sys/fs/pstore/dmesg-ramoops-1");
+    ds.DumpFile("LITTLE cluster time-in-state", "/sys/devices/system/cpu/cpu0/cpufreq/stats/time_in_state");
+    ds.RunCommand("LITTLE cluster cpuidle", {"/system/bin/sh", "-c", "for d in $(ls -d /sys/devices/system/cpu/cpu0/cpuidle/state*); do echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done"}, CommandOptions::AS_ROOT_5);
+    ds.DumpFile("big cluster time-in-state", "/sys/devices/system/cpu/cpu4/cpufreq/stats/time_in_state");
+    ds.RunCommand("big cluster cpuidle", {"/system/bin/sh", "-c", "for d in $(ls -d /sys/devices/system/cpu/cpu4/cpuidle/state*); do echo \"$d: `cat $d/name` `cat $d/desc` `cat $d/time` `cat $d/usage`\"; done"}, CommandOptions::AS_ROOT_5);
+    ds.DumpFile("Battery:", "/sys/class/power_supply/bms/uevent");
+    ds.RunCommand("Battery:", {"/system/bin/sh", "-c", "for f in 1 2 3 4 5 6 7 8; do echo $f > /sys/class/power_supply/bms/cycle_count_id; echo \"$f: `cat /sys/class/power_supply/bms/cycle_count`\"; done"}, CommandOptions::AS_ROOT_5);
 };
diff --git a/fstab.angler b/fstab.angler
index de0e0b1..0adb464 100644
--- a/fstab.angler
+++ b/fstab.angler
@@ -5,7 +5,7 @@
 
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/system       /system         ext4    ro,barrier=1,inode_readahead_blks=8                             wait,verify=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor       /vendor         ext4    ro,barrier=1,inode_readahead_blks=8                             wait,verify=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
-/dev/block/platform/soc.0/f9824900.sdhci/by-name/userdata     /data           ext4    noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,discard,errors=panic,inode_readahead_blks=8 wait,check,forcefdeorfbe=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
+/dev/block/platform/soc.0/f9824900.sdhci/by-name/userdata     /data           ext4    noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,errors=panic,inode_readahead_blks=8 wait,check,forcefdeorfbe=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/cache        /cache          ext4    noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,errors=panic wait,check
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/persist      /persist        ext4    nosuid,nodev,barrier=1,data=ordered,nodelalloc,nomblk_io_submit,errors=panic wait,notrim
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/modem        /firmware       vfat    ro,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0        wait
diff --git a/fstab.aosp_angler b/fstab.aosp_angler
index ab57d3a..6dba761 100644
--- a/fstab.aosp_angler
+++ b/fstab.aosp_angler
@@ -5,7 +5,7 @@
 
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/system       /system         ext4    ro,barrier=1,inode_readahead_blks=8                             wait,verify=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor       /vendor         ext4    ro,barrier=1,inode_readahead_blks=8                             wait
-/dev/block/platform/soc.0/f9824900.sdhci/by-name/userdata     /data           ext4    noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,discard,errors=panic,inode_readahead_blks=8 wait,check,forcefdeorfbe=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
+/dev/block/platform/soc.0/f9824900.sdhci/by-name/userdata     /data           ext4    noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,errors=panic,inode_readahead_blks=8 wait,check,forcefdeorfbe=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/cache        /cache          ext4    noatime,nosuid,nodev,barrier=1,data=ordered,nomblk_io_submit,noauto_da_alloc,errors=panic wait,check
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/persist      /persist        ext4    nosuid,nodev,barrier=1,data=ordered,nodelalloc,nomblk_io_submit,errors=panic wait,notrim
 /dev/block/platform/soc.0/f9824900.sdhci/by-name/modem        /firmware       vfat    ro,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0        wait
diff --git a/init.angler.qseecomd.sh b/init.angler.qseecomd.sh
index f126a77..25a477d 100644
--- a/init.angler.qseecomd.sh
+++ b/init.angler.qseecomd.sh
@@ -1,5 +1,6 @@
 #!/system/bin/sh
 
+registered="`getprop sys.listeners.registered`"
 while [ "$registered" != "true" ]
 do
     sleep 0.1
diff --git a/init.angler.rc b/init.angler.rc
index ef2b52a..ff80591 100755
--- a/init.angler.rc
+++ b/init.angler.rc
@@ -60,6 +60,9 @@
     # Update dm-verity state and set partition.*.verified properties
     verity_update_state
 
+    # Busy loop to wait for devices booted by devstart_sh just in case device not ready
+    exec - root root system -- /system/bin/init.qcom.devwait.sh
+
 on boot
     # execute script to set initial CPU settings
     # don't run as a service to avoid race conditions
@@ -140,8 +143,8 @@
     chown root system /sys/class/kgsl/kgsl-3d0/dispatch/inflight_low_latency
     chmod 0660 /sys/class/kgsl/kgsl-3d0/dispatch/inflight_low_latency
 
-    write /sys/block/mmcblk0/queue/rq_affinity 0
-    write /sys/block/mmcblk0/queue/scheduler noop
+    # Wifi firmware reload path
+    chown wifi wifi /sys/module/bcmdhd/parameters/firmware_path
 
 on property:init.svc.per_mgr=running
     start per_proxy
@@ -153,10 +156,21 @@
     symlink /dev/block/platform/soc.0/f9824900.sdhci /dev/block/bootdevice
 
     start qseecomd
+    # Busy loop to wait for qseecomd started
     exec - root root system -- /system/bin/init.angler.qseecomd.sh
+    # Start devices by sysfs trigger
+    start devstart_sh
 
 on post-fs-data
-    write /sys/kernel/boot_adsp/boot 1
+    # boot time fs tune
+    write /sys/block/mmcblk0/queue/iostats 0
+    write /sys/block/mmcblk0/queue/scheduler cfq
+    write /sys/block/mmcblk0/queue/iosched/slice_idle 0
+    write /sys/block/mmcblk0/queue/read_ahead_kb 2048
+    write /sys/block/mmcblk0/queue/nr_requests 256
+    write /sys/block/dm-0/queue/read_ahead_kb 2048
+    write /sys/block/dm-1/queue/read_ahead_kb 2048
+    write /sys/block/dm-2/queue/read_ahead_kb 2048
 
     # Ecc_Handler qcril.db
     mkdir /data/misc/radio 0770 system radio
@@ -262,6 +276,15 @@
 on property:sys.boot_completed=1
      #allow CPUs to go in deeper idle state than C0
      write /sys/module/lpm_levels/parameters/sleep_disabled 0
+     #end boot time fs tune
+     write /sys/block/mmcblk0/queue/scheduler noop
+     write /sys/block/mmcblk0/queue/rq_affinity 0
+     write /sys/block/mmcblk0/queue/read_ahead_kb 128
+     write /sys/block/mmcblk0/queue/nr_requests 128
+     write /sys/block/dm-0/queue/read_ahead_kb 128
+     write /sys/block/dm-1/queue/read_ahead_kb 128
+     write /sys/block/dm-2/queue/read_ahead_kb 128
+     write /sys/block/mmcblk0/queue/iostats 1
 
 # Search the laser device under /dev/input, then create symlink
 service InputEventFind /vendor/bin/InputEventFind
@@ -288,10 +311,10 @@
 on property:persist.sys.ssr.enable_ramdumps=0
     write /sys/module/subsystem_restart/parameters/enable_ramdumps 0
 
-service charger /sbin/healthd -c
+service charger /charger
     class charger
     group log
-    seclabel u:r:healthd:s0
+    seclabel u:r:charger:s0
     writepid /dev/cpuset/system-background/tasks
 
 service per_mgr /vendor/bin/pm-service
@@ -497,3 +520,9 @@
 on property:ro.boot.mode=hw-factory
     start diag_test_server
 
+service devstart_sh /system/bin/init.qcom.devstart.sh
+    class main
+    user root
+    group root system
+    disabled
+    oneshot
diff --git a/init.qcom.devstart.sh b/init.qcom.devstart.sh
new file mode 100755
index 0000000..8e8cff5
--- /dev/null
+++ b/init.qcom.devstart.sh
@@ -0,0 +1,4 @@
+#!/system/bin/sh
+
+echo 1 > /sys/kernel/boot_adsp/boot
+setprop sys.qcom.devup 1
diff --git a/init.qcom.devwait.sh b/init.qcom.devwait.sh
new file mode 100755
index 0000000..aeee1d4
--- /dev/null
+++ b/init.qcom.devwait.sh
@@ -0,0 +1,8 @@
+#!/system/bin/sh
+
+up="`getprop sys.qcom.devup`"
+while [ "$up" != "1" ]
+do
+    sleep 0.1
+    up="`getprop sys.qcom.devup`"
+done
diff --git a/overlay/frameworks/base/core/res/res/values-mcc204-mnc04/config.xml b/overlay/frameworks/base/core/res/res/values-mcc204-mnc04/config.xml
index ee36992..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc204-mnc04/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc204-mnc04/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>+31654501233</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc222-mnc10/config.xml b/overlay/frameworks/base/core/res/res/values-mcc222-mnc10/config.xml
index d455066..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc222-mnc10/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc222-mnc10/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>42020</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc232-mnc01/config.xml b/overlay/frameworks/base/core/res/res/values-mcc232-mnc01/config.xml
index 595a62b..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc232-mnc01/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc232-mnc01/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>66477</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc234-mnc10/config.xml b/overlay/frameworks/base/core/res/res/values-mcc234-mnc10/config.xml
deleted file mode 100755
index a389824..0000000
--- a/overlay/frameworks/base/core/res/res/values-mcc234-mnc10/config.xml
+++ /dev/null
@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-/*
-** Copyright 2015, The Android Open Source Project
-**
-** Licensed under the Apache License, Version 2.0 (the "License");
-** you may not use this file except in compliance with the License.
-** You may obtain a copy of the License at
-**
-**     http://www.apache.org/licenses/LICENSE-2.0
-**
-** Unless required by applicable law or agreed to in writing, software
-** distributed under the License is distributed on an "AS IS" BASIS,
-** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-** See the License for the specific language governing permissions and
-** limitations under the License.
-*/
--->
-<resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>901</item>
-    </string-array>
-</resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc234-mnc15/config.xml b/overlay/frameworks/base/core/res/res/values-mcc234-mnc15/config.xml
index 6fe0c05..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc234-mnc15/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc234-mnc15/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>121</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc262-mnc02/config.xml b/overlay/frameworks/base/core/res/res/values-mcc262-mnc02/config.xml
index 701aa17..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc262-mnc02/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc262-mnc02/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>5500</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc268-mnc01/config.xml b/overlay/frameworks/base/core/res/res/values-mcc268-mnc01/config.xml
index 043040d..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc268-mnc01/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc268-mnc01/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>123</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc276-mnc02/config.xml b/overlay/frameworks/base/core/res/res/values-mcc276-mnc02/config.xml
index 8244a45..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc276-mnc02/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc276-mnc02/config.xml
@@ -34,7 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>135</item>
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc284-mnc01/config.xml b/overlay/frameworks/base/core/res/res/values-mcc284-mnc01/config.xml
index 7f4ce0e..732ac3c 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc284-mnc01/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc284-mnc01/config.xml
@@ -34,6 +34,4 @@
         <item>INTERMEDIATE_POS=0</item>
         <item>SUPL_ES=0</item>
     </string-array>
-    <string-array translatable="false" name="config_default_vm_number">
-    </string-array>
 </resources>
diff --git a/overlay/frameworks/base/core/res/res/values-mcc311-mnc480/config.xml b/overlay/frameworks/base/core/res/res/values-mcc311-mnc480/config.xml
index 1944c36..6d7dce6 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc311-mnc480/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc311-mnc480/config.xml
@@ -17,9 +17,6 @@
 */
 -->
 <resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>*86</item>
-    </string-array>
 
     <!-- Values for GPS configuration (Verizon) -->
     <string-array translatable="false" name="config_gpsParameters">
diff --git a/overlay/frameworks/base/core/res/res/values-mcc440-mnc20/config.xml b/overlay/frameworks/base/core/res/res/values-mcc440-mnc20/config.xml
index 1373d47..65f8453 100755
--- a/overlay/frameworks/base/core/res/res/values-mcc440-mnc20/config.xml
+++ b/overlay/frameworks/base/core/res/res/values-mcc440-mnc20/config.xml
@@ -20,9 +20,6 @@
 <!-- These resources are around just to allow their values to be customized
      for different hardware and product builds.  Do not translate. -->
 <resources xmlns:xliff="urn:oasis:names:tc:xliff:document:1.2">
-    <string-array translatable="false" name="config_default_vm_number">
-        <item>1416</item>
-    </string-array>
 
     <string-array translatable= "false" name= "config_mobile_hotspot_provision_app">
         <item>com.huawei.entitlement</item>
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index 130d5e8..e78666f 100755
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -391,9 +391,13 @@
     <!-- Default list of files pinned by the Pinner Service -->
     <string-array translatable="false" name="config_defaultPinnerServiceFiles">
         <item>"/system/framework/arm64/boot-framework.oat"</item>
+        <item>"/system/framework/arm64/boot-framework.vdex"</item>
         <item>"/system/framework/oat/arm64/services.odex"</item>
+        <item>"/system/framework/oat/arm64/services.vdex"</item>
         <item>"/system/framework/arm64/boot.oat"</item>
+        <item>"/system/framework/arm64/boot.vdex"</item>
         <item>"/system/framework/arm64/boot-core-libart.oat"</item>
+        <item>"/system/framework/arm64/boot-core-libart.vdex"</item>
     </string-array>
 
     <!-- Enable system navigation keys. -->
diff --git a/overlay/packages/apps/CarrierConfig/res/xml/vendor.xml b/overlay/packages/apps/CarrierConfig/res/xml/vendor.xml
index 7373bf8..e55a430 100755
--- a/overlay/packages/apps/CarrierConfig/res/xml/vendor.xml
+++ b/overlay/packages/apps/CarrierConfig/res/xml/vendor.xml
@@ -4,7 +4,29 @@
      file is read after any specific config file from the assets folder, so it
      must use explicit filters for MCC ad MNC if that is desired. -->
 <carrier_config_list>
+    <carrier_config mcc="204" mnc="04">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="3" />
+    </carrier_config>
+
+    <!-- VZW specific config -->
+    <carrier_config mcc="204" mnc="04" gid1="BAE0000000000000">
+        <boolean name="ci_action_on_sys_update_bool" value="true" />
+        <string name="ci_action_on_sys_update_extra_string">ServerID</string>
+        <string name="ci_action_on_sys_update_intent_string">com.android.omadm.service.CONFIGURATION_UPDATE</string>
+        <string name="ci_action_on_sys_update_extra_val_string">com.vzwdmserver</string>
+        <boolean name="config_wifi_disable_in_ecbm" value="true" />
+        <boolean name="disable_cdma_activation_code_bool" value="true" />
+        <string-array name="signal_redirection_receiver_string_array" num="1">
+            <item value="com.google.android.carrierentitlement/.VzwActivationReceiver" />
+        </string-array>
+        <string-array name="signal_dcfailure_receiver_string_array" num="1">
+            <item value="com.google.android.carrierentitlement/.VzwActivationReceiver" />
+        </string-array>
+    </carrier_config>
+
     <carrier_config mcc="204" mnc="08">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -28,6 +50,10 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="204" mnc="16">
+        <int name="smsToMmsTextThreshold" value="3" />
+    </carrier_config>
+
     <carrier_config mcc="206" mnc="01">
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
@@ -53,6 +79,7 @@
     </carrier_config>
 
     <carrier_config mcc="206" mnc="05">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -76,6 +103,31 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="208" mnc="01">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="4" />
+    </carrier_config>
+
+    <carrier_config mcc="208" mnc="10">
+        <int name="smsToMmsTextThreshold" value="7" />
+    </carrier_config>
+
+    <carrier_config mcc="214" mnc="01">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="smsToMmsTextThreshold" value="5" />
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="214" mnc="02">
+        <int name="maxMessageSize" value="512000" />
+    </carrier_config>
+
+    <carrier_config mcc="222" mnc="10">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="-1" />
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
     <carrier_config mcc="222" mnc="99">
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
@@ -100,7 +152,12 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="228" mnc="01">
+        <int name="smsToMmsTextThreshold" value="11" />
+    </carrier_config>
+
     <carrier_config mcc="228" mnc="02">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -124,7 +181,21 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="230" mnc="01">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="232" mnc="01">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
+    <carrier_config mcc="232" mnc="03">
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
     <carrier_config mcc="232" mnc="05">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -149,6 +220,7 @@
     </carrier_config>
 
     <carrier_config mcc="232" mnc="10">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -172,7 +244,61 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="234" mnc="15">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="20">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="smsToMmsTextThreshold" value="11" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="30">
+        <boolean name="carrier_wfc_ims_available_bool" value="true" />
+        <boolean name="editable_wfc_mode_bool" value="false" />
+        <boolean name="prefer_2g_bool" value="false" />
+        <boolean name="hide_ims_apn_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="30" gid1="B3">
+        <boolean name="carrier_name_override_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="30" gid1="C3">
+        <boolean name="carrier_name_override_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="31">
+        <boolean name="prefer_2g_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="32">
+        <boolean name="prefer_2g_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="33">
+        <boolean name="carrier_wfc_ims_available_bool" value="true" />
+        <boolean name="editable_wfc_mode_bool" value="false" />
+        <boolean name="prefer_2g_bool" value="false" />
+        <boolean name="hide_ims_apn_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="34">
+        <boolean name="prefer_2g_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="234" mnc="86">
+        <boolean name="prefer_2g_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="235" mnc="94">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="smsToMmsTextThreshold" value="11" />
+    </carrier_config>
+
     <carrier_config mcc="238" mnc="01">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -197,6 +323,7 @@
     </carrier_config>
 
     <carrier_config mcc="238" mnc="06">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -221,6 +348,7 @@
     </carrier_config>
 
     <carrier_config mcc="238" mnc="20">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -244,7 +372,13 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="240" mnc="01">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
     <carrier_config mcc="240" mnc="02">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -269,6 +403,7 @@
     </carrier_config>
 
     <carrier_config mcc="240" mnc="07">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -293,6 +428,8 @@
     </carrier_config>
 
     <carrier_config mcc="242" mnc="01">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -316,7 +453,102 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="244" mnc="05">
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
+    <carrier_config mcc="244" mnc="12">
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
+    <carrier_config mcc="244" mnc="21">
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
+    <carrier_config mcc="248" mnc="02">
+        <int name="smsToMmsTextThreshold" value="4" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="01">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="02">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="03">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="05">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="07">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="11">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="12">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="15">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="16">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="17">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="19">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="20">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="35">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="37">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="38">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="250" mnc="39">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+   <carrier_config mcc="250" mnc="99">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="262" mnc="01">
+        <int name="smsToMmsTextThreshold" value="4" />
+    </carrier_config>
+
+    <carrier_config mcc="262" mnc="02">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="5" />
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
     <carrier_config mcc="262" mnc="07">
+        <int name="smsToMmsTextThreshold" value="4" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -340,7 +572,23 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="268" mnc="01">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="maxMessageSize" value="614400" />
+        <int name="smsToMmsTextThreshold" value="5" />
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="268" mnc="03">
+        <int name="smsToMmsTextThreshold" value="11" />
+    </carrier_config>
+
+   <carrier_config mcc="268" mnc="06">
+        <int name="smsToMmsTextThreshold" value="11" />
+    </carrier_config>
+
     <carrier_config mcc="272" mnc="01">
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -364,7 +612,227 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="272" mnc="02">
+        <boolean name="prefer_2g_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="272" mnc="05">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="smsToMmsTextThreshold" value="11" />
+    </carrier_config>
+
+    <carrier_config mcc="276" mnc="02">
+        <int name="maxMessageSize" value="307200" />
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="283" mnc="01">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="283" mnc="05">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="283" mnc="10">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="284" mnc="01">
+        <int name="maxMessageSize" value="524288" />
+        <int name="smsToMmsTextThreshold" value="2" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="220">
+        <int name="maxMessageSize" value="614400" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="221">
+        <int name="maxMessageSize" value="614400" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="370">
+        <int name="smsToMmsTextThreshold" value="4" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="490">
+        <int name="smsToMmsTextThreshold" value="6" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="500">
+        <int name="smsToMmsTextThreshold" value="6" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="510">
+        <int name="smsToMmsTextThreshold" value="6" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="520">
+        <int name="smsToMmsTextThreshold" value="6" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="610">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="302" mnc="720">
+        <int name="smsToMmsTextThreshold" value="4" />
+    </carrier_config>
+
+    <carrier_config mcc="310" mnc="004">
+        <boolean name="ci_action_on_sys_update_bool" value="true" />
+        <string name="ci_action_on_sys_update_extra_string">ServerID</string>
+        <string name="ci_action_on_sys_update_intent_string">com.android.omadm.service.CONFIGURATION_UPDATE</string>
+        <string name="ci_action_on_sys_update_extra_val_string">com.vzwdmserver</string>
+        <boolean name="config_wifi_disable_in_ecbm" value="true" />
+        <boolean name="disable_cdma_activation_code_bool" value="true" />
+        <string-array name="signal_redirection_receiver_string_array" num="1">
+            <item value="com.google.android.carrierentitlement/.VzwActivationReceiver" />
+        </string-array>
+        <string-array name="signal_dcfailure_receiver_string_array" num="1">
+            <item value="com.google.android.carrierentitlement/.VzwActivationReceiver" />
+        </string-array>
+    </carrier_config>
+
+    <carrier_config mcc="310" mnc="090">
+        <int name="maxMessageSize" value="1048576" />
+    </carrier_config>
+
+    <carrier_config mcc="310" mnc="260">
+        <boolean name="carrier_allow_turnoff_ims_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="310" mnc="410">
+        <int name="smsToMmsTextThreshold" value="5" />
+    </carrier_config>
+
+    <carrier_config mcc="311" mnc="480">
+        <boolean name="ci_action_on_sys_update_bool" value="true" />
+        <string name="ci_action_on_sys_update_extra_string">ServerID</string>
+        <string name="ci_action_on_sys_update_intent_string">com.android.omadm.service.CONFIGURATION_UPDATE</string>
+        <string name="ci_action_on_sys_update_extra_val_string">com.vzwdmserver</string>
+        <boolean name="config_wifi_disable_in_ecbm" value="true" />
+        <boolean name="disable_cdma_activation_code_bool" value="true" />
+        <string-array name="signal_redirection_receiver_string_array" num="1">
+            <item value="com.google.android.carrierentitlement/.VzwActivationReceiver" />
+        </string-array>
+        <string-array name="signal_dcfailure_receiver_string_array" num="1">
+            <item value="com.google.android.carrierentitlement/.VzwActivationReceiver" />
+        </string-array>
+    </carrier_config>
+
+    <!-- Tracfone on Vzw requests empty spn -->
+    <carrier_config mcc="311" mnc="480" gid1="BA01270000000000">
+        <boolean name="carrier_name_override_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="334" mnc="020">
+        <int name="smsToMmsTextThreshold" value="12" />
+    </carrier_config>
+
+    <carrier_config mcc="334" mnc="050">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="334" mnc="090">
+        <int name="maxMessageSize" value="614400" />
+        <int name="smsToMmsTextThreshold" value="9" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="840">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="854">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="855">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="856">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="857">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="858">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="859">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="860">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="861">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="862">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="863">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="864">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="865">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="866">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="867">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="868">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="869">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="870">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="871">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="872">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="873">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="405" mnc="874">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
+    <carrier_config mcc="440" mnc="00">
+        <boolean name="carrier_volte_available_bool" value="false" />
+    </carrier_config>
+
     <carrier_config mcc="440" mnc="10">
+        <boolean name="carrier_volte_available_bool" value="false" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -389,6 +857,9 @@
     </carrier_config>
 
     <carrier_config mcc="440" mnc="20">
+        <int name="ims_dtmf_tone_delay_int" value="300" />
+        <int name="gsm_dtmf_tone_delay_int" value="300" />
+        <int name="smsToMmsTextThreshold" value="5" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -411,6 +882,22 @@
         </int-array>
     </carrier_config>
 
+    <carrier_config mcc="440" mnc="50">
+        <boolean name="carrier_volte_available_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="440" mnc="51">
+        <boolean name="carrier_volte_available_bool" value="true" />
+    </carrier_config>
+
+    <carrier_config mcc="450" mnc="05">
+        <int name="smsToMmsTextThreshold" value="1" />
+    </carrier_config>
+
+    <carrier_config mcc="505" mnc="01">
+        <int name="maxMessageSize" value="614400" />
+    </carrier_config>
+
     <carrier_config mcc="505" mnc="02">
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
@@ -436,6 +923,7 @@
     </carrier_config>
 
     <carrier_config mcc="505" mnc="03">
+        <int name="smsToMmsTextThreshold" value="3" />
         <!-- The list of ril radio technologies (see ServiceState.java) which only support
              a single data connection at one time.  This may change by carrier via
              overlays (some don't support multiple pdp on UMTS).  All unlisted radio
@@ -458,4 +946,46 @@
             <item value="15" /> <!-- HSPAP -->
         </int-array>
     </carrier_config>
+
+    <carrier_config mcc="655" mnc="01">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="730" mnc="01">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="730" mnc="10">
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="732" mnc="101">
+        <int name="smsToMmsTextThreshold" value="12" />
+    </carrier_config>
+
+    <carrier_config mcc="732" mnc="103">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="732" mnc="111">
+        <boolean name="prefer_2g_bool" value="false" />
+        <int name="smsToMmsTextThreshold" value="10" />
+    </carrier_config>
+
+    <carrier_config mcc="732" mnc="123">
+        <int name="smsToMmsTextThreshold" value="6" />
+    </carrier_config>
+    <carrier_config mcc="450" mnc="02">
+        <boolean name="carrier_instant_lettering_available_bool" value="false" />
+    </carrier_config>
+    <carrier_config mcc="450" mnc="05">
+        <boolean name="carrier_instant_lettering_available_bool" value="false" />
+    </carrier_config>
+    <carrier_config mcc="450" mnc="06">
+        <boolean name="carrier_instant_lettering_available_bool" value="false" />
+    </carrier_config>
+    <carrier_config mcc="450" mnc="08">
+        <boolean name="carrier_instant_lettering_available_bool" value="false" />
+    </carrier_config>
 </carrier_config_list>
diff --git a/power/power.c b/power/power.c
index cc1aba2..357ee2a 100644
--- a/power/power.c
+++ b/power/power.c
@@ -101,10 +101,6 @@
 int display_boost;
 static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
 
-static struct hw_module_methods_t power_module_methods = {
-    .open = NULL,
-};
-
 static void power_init(struct power_module *module)
 {
     ALOGI("QCOM power HAL initing.");
@@ -750,6 +746,44 @@
     return 0;
 }
 
+static int power_open(const hw_module_t* module, const char* name,
+                    hw_device_t** device)
+{
+    ALOGD("%s: enter; name=%s", __FUNCTION__, name);
+    int retval = 0; /* 0 is ok; -1 is error */
+
+    if (strcmp(name, POWER_HARDWARE_MODULE_ID) == 0) {
+        power_module_t *dev = (power_module_t *)calloc(1,
+                sizeof(power_module_t));
+
+        if (dev) {
+            /* Common hw_device_t fields */
+            dev->common.tag = HARDWARE_DEVICE_TAG;
+            dev->common.module_api_version = POWER_MODULE_API_VERSION_0_5;
+            dev->common.hal_api_version = HARDWARE_HAL_API_VERSION;
+
+            dev->init = power_init;
+            dev->powerHint = power_hint;
+            dev->setInteractive = set_interactive;
+            dev->get_number_of_platform_modes = get_number_of_platform_modes;
+            dev->get_platform_low_power_stats = get_platform_low_power_stats;
+            dev->get_voter_list = get_voter_list;
+
+            *device = (hw_device_t*)dev;
+        } else
+            retval = -ENOMEM;
+    } else {
+        retval = -EINVAL;
+    }
+
+    ALOGD("%s: exit %d", __FUNCTION__, retval);
+    return retval;
+}
+
+static struct hw_module_methods_t power_module_methods = {
+    .open = power_open,
+};
+
 struct power_module HAL_MODULE_INFO_SYM = {
     .common = {
         .tag = HARDWARE_MODULE_TAG,
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 4f7f58b..ad4c871 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -79,6 +79,7 @@
 /persist/sensors(/.*)?                                              u:object_r:persist_sensors_file:s0
 
 /sys/bus/msm_subsys(/.*)?                                                                                  u:object_r:sysfs_msm_subsys:s0
+/sys/kernel/boot_adsp/boot                                                                                 u:object_r:sysfs_msm_subsys:s0
 /sys/devices/bt_bcm4358\.[0-9]+/rfkill/rfkill0/state                                                           u:object_r:sysfs_bluetooth_writable:s0
 /sys/devices/soc\.0/\w+\.qcom,\w+/subsys[0-9]/restart_level                                                u:object_r:sysfs_msm_subsys_toggle:s0
 /sys/devices/soc\.0/fd900000\.qcom,mdss_mdp/qcom,mdss_fb_primary\.[0-9]+/leds(/.*)?                        u:object_r:sysfs_led:s0
@@ -126,6 +127,8 @@
 /vendor/bin/ims_rtp_daemon               u:object_r:ims_exec:s0
 /system/bin/init\.angler\.power\.sh      u:object_r:init-power-sh_exec:s0
 /system/bin/init\.angler\.qseecomd\.sh   u:object_r:init-angler-qseecomd-sh_exec:s0
+/system/bin/init\.qcom\.devstart\.sh     u:object_r:init-qcom-devstart-sh_exec:s0
+/system/bin/init\.qcom\.devwait\.sh      u:object_r:init-qcom-devwait-sh_exec:s0
 /system/bin/init\.mcfg\.sh               u:object_r:init-mcfg-sh_exec:s0
 /system/bin/init\.radio\.sh              u:object_r:init-radio-sh_exec:s0
 /vendor/bin/irsc_util                    u:object_r:irsc_util_exec:s0
@@ -175,3 +178,5 @@
 # Sysfs files used by nanoapp_cmd
 /sys/devices/virtual/nanohub/nanohub(/.*)? u:object_r:sysfs_nanoapp_cmd:s0
 
+# NFC hal
+/system/bin/hw/nfc_hal_pn54x    u:object_r:nfc_hal_pn54x_exec:s0
diff --git a/sepolicy/init-devstart-sh.te b/sepolicy/init-devstart-sh.te
new file mode 100644
index 0000000..24004d2
--- /dev/null
+++ b/sepolicy/init-devstart-sh.te
@@ -0,0 +1,15 @@
+type init-qcom-devstart-sh, domain;
+type init-qcom-devstart-sh_exec, exec_type, file_type;
+
+init_daemon_domain(init-qcom-devstart-sh)
+
+allow init-qcom-devstart-sh shell_exec:file rx_file_perms;
+
+# execute toybox/toolbox
+allow init-qcom-devstart-sh toolbox_exec:file rx_file_perms;
+
+# Set the sys.qcom.devup property
+set_prop(init-qcom-devstart-sh, system_prop)
+
+# Set boot_adsp and boot_slpi to 1
+allow init-qcom-devstart-sh sysfs_msm_subsys:file w_file_perms;
diff --git a/sepolicy/init-devwait-sh.te b/sepolicy/init-devwait-sh.te
new file mode 100644
index 0000000..1529536
--- /dev/null
+++ b/sepolicy/init-devwait-sh.te
@@ -0,0 +1,9 @@
+type init-qcom-devwait-sh, domain;
+type init-qcom-devwait-sh_exec, exec_type, file_type;
+
+init_daemon_domain(init-qcom-devwait-sh)
+
+allow init-qcom-devwait-sh shell_exec:file rx_file_perms;
+
+# execute toybox/toolbox
+allow init-qcom-devwait-sh toolbox_exec:file rx_file_perms;
diff --git a/sepolicy/nfc.te b/sepolicy/nfc.te
new file mode 100644
index 0000000..90488a1
--- /dev/null
+++ b/sepolicy/nfc.te
@@ -0,0 +1,2 @@
+# allow NFC process to call into the NFC HAL
+binder_call(nfc, nfc_hal_pn54x)
diff --git a/sepolicy/nfc_hal_pn54x.te b/sepolicy/nfc_hal_pn54x.te
new file mode 100644
index 0000000..2830a71
--- /dev/null
+++ b/sepolicy/nfc_hal_pn54x.te
@@ -0,0 +1,30 @@
+# nfc subsystem
+type nfc_hal_pn54x, domain;
+type nfc_hal_pn54x_exec, exec_type, file_type;
+
+# may be started by init
+init_daemon_domain(nfc_hal_pn54x)
+
+allow nfc_hal_pn54x nfc_hal_pn54x_exec:file rx_file_perms;
+
+# hwbinder access
+hwbinder_use(nfc_hal_pn54x)
+
+# call into NFC process (callbacks)
+binder_call(nfc_hal_pn54x, nfc)
+
+# Set NFC properties
+set_prop(nfc_hal_pn54x, nfc_prop)
+
+# NFC device access.
+allow nfc_hal_pn54x nfc_device:chr_file rw_file_perms;
+
+# Data file accesses.
+allow nfc_hal_pn54x nfc_data_file:dir create_dir_perms;
+allow nfc_hal_pn54x nfc_data_file:notdevfile_class_set create_file_perms;
+
+allow nfc_hal_pn54x sysfs_nfc_power_writable:file rw_file_perms;
+allow nfc_hal_pn54x sysfs:file write;
+
+# TODO: added to match above sysfs rule. Remove me?
+allow nfc_hal_pn54x sysfs_usb:file write;