Merge "goldfish: bump data to 6G" am: ee837a885e
am: 3f8829b822

Change-Id: Ifc73574d837e365d6012752bb3ab11e5d889d0ed
diff --git a/AndroidProducts.mk b/AndroidProducts.mk
index 198857e..77183bb 100644
--- a/AndroidProducts.mk
+++ b/AndroidProducts.mk
@@ -1,2 +1,3 @@
 PRODUCT_MAKEFILES := \
     $(LOCAL_DIR)/kernel-tests/goldfish_kernel_tests_x86_64.mk \
+    $(LOCAL_DIR)/sdk_phone_x86_vendor.mk
diff --git a/arm32-vendor.mk b/arm32-vendor.mk
index 953ff2a..9a34d5d 100644
--- a/arm32-vendor.mk
+++ b/arm32-vendor.mk
@@ -1,3 +1,4 @@
+PRODUCT_KERNEL_VERSION := 4.4
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.rild.libpath=/vendor/lib/libgoldfish-ril.so
@@ -5,11 +6,14 @@
 # Note: the following lines need to stay at the beginning so that it can
 # take priority  and override the rules it inherit from other mk files
 # see copy file rules in core/Makefile
+PRODUCT_SDK_ADDON_COPY_FILES += \
+    device/generic/goldfish/data/etc/advancedFeatures.ini.arm:images/armeabi-v7a/advancedFeatures.ini \
+    prebuilts/qemu-kernel/arm64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:images/armeabi-v7a/kernel-ranchu-64
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/fstab.ranchu.initrd.arm:$(TARGET_COPY_OUT_RAMDISK)/fstab.ranchu \
     device/generic/goldfish/manifest-arm.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
-    prebuilts/qemu-kernel/arm64/4.4/kernel-qemu2:kernel-ranchu-64 \
     device/generic/goldfish/data/etc/advancedFeatures.ini.arm:advancedFeatures.ini \
+    prebuilts/qemu-kernel/arm64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:kernel-ranchu-64 \
     device/generic/goldfish/fstab.ranchu.arm:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.ranchu
 
 EMULATOR_VENDOR_NO_GNSS := true
diff --git a/arm64-vendor.mk b/arm64-vendor.mk
index 647aea3..a05654d 100644
--- a/arm64-vendor.mk
+++ b/arm64-vendor.mk
@@ -1,3 +1,4 @@
+PRODUCT_KERNEL_VERSION := 4.4
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.rild.libpath=/vendor/lib64/libgoldfish-ril.so
@@ -5,12 +6,15 @@
 # Note: the following lines need to stay at the beginning so that it can
 # take priority  and override the rules it inherit from other mk files
 # see copy file rules in core/Makefile
+PRODUCT_SDK_ADDON_COPY_FILES += \
+    device/generic/goldfish/data/etc/advancedFeatures.ini.arm:images/arm64-v8a/advancedFeatures.ini \
+    prebuilts/qemu-kernel/arm64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:images/arm64-v8a/kernel-ranchu
+
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/fstab.ranchu.initrd.arm:$(TARGET_COPY_OUT_RAMDISK)/fstab.ranchu \
     device/generic/goldfish/manifest-arm.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
-    prebuilts/qemu-kernel/arm64/4.4/kernel-qemu2:kernel-ranchu \
     device/generic/goldfish/data/etc/advancedFeatures.ini.arm:advancedFeatures.ini \
+    prebuilts/qemu-kernel/arm64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:kernel-ranchu \
     device/generic/goldfish/fstab.ranchu.arm:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.ranchu
-
 EMULATOR_VENDOR_NO_GNSS := true
 
diff --git a/camera/EmulatedCamera.cpp b/camera/EmulatedCamera.cpp
index b13a5c3..f24da22 100755
--- a/camera/EmulatedCamera.cpp
+++ b/camera/EmulatedCamera.cpp
@@ -607,6 +607,26 @@
         getCameraDevice()->setPreviewFrameRate(new_frame_rate);
     }
 
+    // Validate KEY_PREVIEW_FPS_RANGE i.e., "preview-fps-range"
+    const char* preview_fps_range = new_param.get(CameraParameters::KEY_PREVIEW_FPS_RANGE);
+    if (preview_fps_range) {
+        char tmp[1024];
+        snprintf(tmp, sizeof(tmp), "%s", preview_fps_range);
+        int low=-1, high=-1;
+        if (sscanf(tmp, "%d,%d", &low, &high) != 2) {
+            ALOGE("incorrect preview-fps-range %s", tmp);
+            return BAD_VALUE;
+        }
+        if (low < 0 || high < 0) {
+            ALOGE("negative preview_fps_range in %s", tmp);
+            return BAD_VALUE;
+        }
+        if (low > high) {
+            ALOGE("invalid preview_fps_range in %s", tmp);
+            return BAD_VALUE;
+        }
+    }
+
     // Validate focus mode
     const char* focus_mode = new_param.get(CameraParameters::KEY_FOCUS_MODE);
     if (focus_mode && !IsValueInList(focus_mode, kValidFocusModes)) {
diff --git a/data/etc/advancedFeatures.ini b/data/etc/advancedFeatures.ini
index f84082b..ddf0073 100644
--- a/data/etc/advancedFeatures.ini
+++ b/data/etc/advancedFeatures.ini
@@ -8,4 +8,5 @@
 Wifi = on
 HostComposition = on
 RefCountPipe = on
+VirtioInput = on
 DynamicPartition = on
diff --git a/data/etc/config.ini.foldable b/data/etc/config.ini.foldable
new file mode 100644
index 0000000..017cf5c
--- /dev/null
+++ b/data/etc/config.ini.foldable
@@ -0,0 +1,21 @@
+avd.ini.encoding=UTF-8
+disk.dataPartition.size=2G
+hw.accelerometer=yes
+hw.audioInput=yes
+hw.battery=yes
+hw.camera.back=emulated
+hw.camera.front=emulated
+hw.dPad=no
+hw.gps=yes
+hw.gpu.enabled=yes
+hw.keyboard=yes
+hw.lcd.density=420
+hw.mainKeys=no
+hw.ramSize=4096
+hw.sensors.orientation=yes
+hw.sensors.proximity=yes
+hw.keyboard.lid=yes
+image.sysdir.1=x86/
+skin.dynamic=no
+skin.name=1536x2152
+skin.path=1536x2152
\ No newline at end of file
diff --git a/data/etc/config.ini.tv b/data/etc/config.ini.tv
index 3ce70fe..5e05080 100644
--- a/data/etc/config.ini.tv
+++ b/data/etc/config.ini.tv
@@ -1,8 +1,8 @@
 avd.ini.encoding=UTF-8
 disk.dataPartition.size=2G
-hw.accelerometer=yes
+hw.accelerometer=no
 hw.audioInput=yes
-hw.battery=yes
+hw.battery=no
 hw.camera.back=emulated
 hw.camera.front=none
 hw.dPad=no
@@ -12,8 +12,8 @@
 hw.lcd.density=320
 hw.mainKeys=no
 hw.ramSize=2048
-hw.sensors.orientation=yes
-hw.sensors.proximity=yes
+hw.sensors.orientation=no
+hw.sensors.proximity=no
 image.sysdir.1=x86/
 skin.dynamic=no
 skin.name=1920x1080
diff --git a/data/etc/config.ini.xl b/data/etc/config.ini.xl
new file mode 100644
index 0000000..40ec7cc
--- /dev/null
+++ b/data/etc/config.ini.xl
@@ -0,0 +1,20 @@
+avd.ini.encoding=UTF-8
+disk.dataPartition.size=2G
+hw.accelerometer=yes
+hw.audioInput=yes
+hw.battery=yes
+hw.camera.back=emulated
+hw.camera.front=emulated
+hw.dPad=no
+hw.gps=yes
+hw.gpu.enabled=yes
+hw.keyboard=yes
+hw.mainKeys=no
+hw.ramSize=2048
+hw.sensors.orientation=yes
+hw.sensors.proximity=yes
+image.sysdir.1=x86/
+skin.dynamic=no
+hw.lcd.density=560
+skin.name=1440x2560
+skin.path=1440x2560
diff --git a/data/etc/handheld_core_hardware.xml b/data/etc/handheld_core_hardware.xml
index 37be092..ebf250b 100644
--- a/data/etc/handheld_core_hardware.xml
+++ b/data/etc/handheld_core_hardware.xml
@@ -68,6 +68,7 @@
     <feature name="android.software.midi" />
     <feature name="android.software.print" />
     <feature name="android.software.cant_save_state" />
+    <feature name="android.software.secure_lock_screen" />
 
     <!-- Feature to specify if the device supports adding device admins. -->
     <feature name="android.software.device_admin" />
@@ -76,6 +77,7 @@
     <feature name="android.software.managed_users" />
 
     <feature name="android.software.picture_in_picture" />
+    <feature name="android.software.activities_on_secondary_displays" />
 
     <feature name="android.software.cts" />
     <!-- devices with GPS must include android.hardware.location.gps.xml -->
diff --git a/data/etc/local.prop b/data/etc/local.prop
new file mode 100644
index 0000000..33c632b
--- /dev/null
+++ b/data/etc/local.prop
@@ -0,0 +1 @@
+ro.logd.size=2M
diff --git a/data/etc/user/advancedFeatures.ini b/data/etc/user/advancedFeatures.ini
index a1a11b7..6c45030 100644
--- a/data/etc/user/advancedFeatures.ini
+++ b/data/etc/user/advancedFeatures.ini
@@ -9,4 +9,5 @@
 Wifi = on
 HostComposition = on
 RefCountPipe = on
+VirtioInput = on
 DynamicPartition = on
diff --git a/gps/gps_qemu.c b/gps/gps_qemu.c
index 9033caf..59d2f4e 100644
--- a/gps/gps_qemu.c
+++ b/gps/gps_qemu.c
@@ -26,6 +26,7 @@
 #include <errno.h>
 #include <pthread.h>
 #include <fcntl.h>
+#include <inttypes.h>
 #include <sys/epoll.h>
 #include <math.h>
 #include <time.h>
@@ -33,6 +34,7 @@
 #define  LOG_TAG  "gps_qemu"
 #include <log/log.h>
 #include <cutils/sockets.h>
+#include <cutils/properties.h>
 #include <hardware/gps.h>
 #include "qemu_pipe.h"
 
@@ -61,13 +63,29 @@
     const char*  end;
 } Token;
 
-#define  MAX_NMEA_TOKENS  16
+#define  MAX_NMEA_TOKENS  64
 
 typedef struct {
     int     count;
     Token   tokens[ MAX_NMEA_TOKENS ];
 } NmeaTokenizer;
 
+/* this is the state of our connection to the qemu_gpsd daemon */
+typedef struct {
+    int                     init;
+    int                     fd;
+    GpsCallbacks            callbacks;
+    pthread_t               thread;
+    int                     control[2];
+    pthread_mutex_t         lock;
+    GpsMeasurementCallbacks*   measurement_callbacks; /* protected by lock:
+                                                         accessed by main and child threads */
+    bool                    gnss_enabled; /* set by ro.kernel.qemu.gps.gnss_enabled=1 */
+    bool                    fix_provided_by_gnss; /* set by ro.kernel.qemu.gps.fix_by_gnss=1 */
+} GpsState;
+
+static GpsState  _gps_state[1];
+
 static int
 nmea_tokenizer_init( NmeaTokenizer*  t, const char*  p, const char*  end )
 {
@@ -126,39 +144,70 @@
 }
 
 
-static int
-str2int( const char*  p, const char*  end )
+static int64_t
+str2int64( const char*  p, const char*  end )
 {
-    int   result = 0;
+    int64_t   result = 0;
+
+#if GPS_DEBUG
+    char temp[1024];
+    snprintf(temp, sizeof(temp), "'%.*s'", end-p, p);
+#endif
+
+    bool is_negative = false;
+    if (end > p && *p == '-') {
+        is_negative = true;
+        ++p;
+    }
+
     int   len    = end - p;
 
     for ( ; len > 0; len--, p++ )
     {
         int  c;
 
-        if (p >= end)
+        if (p >= end) {
+            ALOGE("parse error at func %s line %d", __func__, __LINE__);
             goto Fail;
+        }
 
         c = *p - '0';
-        if ((unsigned)c >= 10)
+        if ((unsigned)c >= 10) {
+            ALOGE("parse error at func %s line %d on %c", __func__, __LINE__, c);
             goto Fail;
+        }
 
         result = result*10 + c;
     }
+    if (is_negative) {
+        result = - result;
+    }
+#if GPS_DEBUG
+    ALOGD("%s ==> %" PRId64, temp, result);
+#endif
     return  result;
 
 Fail:
     return -1;
 }
 
+static int
+str2int( const char*  p, const char*  end )
+{
+    /* danger: downward convert to 32bit */
+    return str2int64(p, end);
+}
+
 static double
 str2float( const char*  p, const char*  end )
 {
     int   len    = end - p;
-    char  temp[16];
+    char  temp[64];
 
-    if (len >= (int)sizeof(temp))
+    if (len >= (int)sizeof(temp)) {
+        ALOGE("%s %d input is too long: '%.*s'", __func__, __LINE__, end-p, p);
         return 0.;
+    }
 
     memcpy( temp, p, len );
     temp[len] = 0;
@@ -173,7 +222,7 @@
 /*****************************************************************/
 /*****************************************************************/
 
-#define  NMEA_MAX_SIZE  83
+#define  NMEA_MAX_SIZE  1024
 
 typedef struct {
     int     pos;
@@ -181,40 +230,16 @@
     int     utc_year;
     int     utc_mon;
     int     utc_day;
-    int     utc_diff;
     GpsLocation  fix;
     gps_location_callback  callback;
+    GnssData    gnss_data;
+    int         gnss_count;
+
     char    in[ NMEA_MAX_SIZE+1 ];
+    bool    gnss_enabled; /* passed in from _gps_state */
+    bool    fix_provided_by_gnss; /* passed in from _gps_state */
 } NmeaReader;
 
-
-static void
-nmea_reader_update_utc_diff( NmeaReader*  r )
-{
-    time_t         now = time(NULL);
-    struct tm      tm_local;
-    struct tm      tm_utc;
-    long           time_local, time_utc;
-
-    gmtime_r( &now, &tm_utc );
-    localtime_r( &now, &tm_local );
-
-    time_local = tm_local.tm_sec +
-                 60*(tm_local.tm_min +
-                 60*(tm_local.tm_hour +
-                 24*(tm_local.tm_yday +
-                 365*tm_local.tm_year)));
-
-    time_utc = tm_utc.tm_sec +
-               60*(tm_utc.tm_min +
-               60*(tm_utc.tm_hour +
-               24*(tm_utc.tm_yday +
-               365*tm_utc.tm_year)));
-
-    r->utc_diff = time_utc - time_local;
-}
-
-
 static void
 nmea_reader_init( NmeaReader*  r )
 {
@@ -228,18 +253,10 @@
     r->callback = NULL;
     r->fix.size = sizeof(r->fix);
 
-    nmea_reader_update_utc_diff( r );
-}
+    GpsState*  s = _gps_state;
+    r->gnss_enabled = s->gnss_enabled;
+    r->fix_provided_by_gnss = s->fix_provided_by_gnss;
 
-
-static void
-nmea_reader_set_callback( NmeaReader*  r, gps_location_callback  cb )
-{
-    r->callback = cb;
-    if (cb != NULL && r->fix.flags != 0) {
-        D("%s: sending latest fix to new callback", __FUNCTION__);
-        r->callback( &r->fix );
-    }
 }
 
 
@@ -275,14 +292,7 @@
     tm.tm_mday  = r->utc_day;
     tm.tm_isdst = -1;
 
-    // This is a little confusing, let's use an example:
-    // Suppose now it's 1970-1-1 01:00 GMT, local time is 1970-1-1 00:00 GMT-1
-    // Then the utc_diff is 3600.
-    // The time string from GPS is 01:00:00, mktime assumes it's a local
-    // time. So we are doing mktime for 1970-1-1 01:00 GMT-1. The result of
-    // mktime is 7200 (1970-1-1 02:00 GMT) actually. To get the correct
-    // timestamp, we have to subtract utc_diff here.
-    fix_time = mktime( &tm ) - r->utc_diff;
+    fix_time = timegm( &tm );
     r->fix.timestamp = (long long)fix_time * 1000;
     return 0;
 }
@@ -423,6 +433,43 @@
     return 0;
 }
 
+static int64_t get_int64(Token tok) {
+    return str2int64(tok.p, tok.end);
+}
+
+static int get_int(Token tok) {
+    return str2int(tok.p, tok.end);
+}
+
+static double get_double(Token tok) {
+    return str2float(tok.p, tok.end);
+}
+
+static bool has_all_required_flags(GpsLocationFlags flags) {
+    return ( flags & GPS_LOCATION_HAS_LAT_LONG
+            && flags & GPS_LOCATION_HAS_ALTITUDE
+           );
+}
+
+static bool is_ready_to_send(NmeaReader* r) {
+    if (has_all_required_flags(r->fix.flags)) {
+        if (r->gnss_enabled && r->fix_provided_by_gnss) {
+            return (r->gnss_count > 2); /* required by CTS */
+        }
+        return true;
+    }
+    return false;
+}
+
+static void
+nmea_reader_set_callback( NmeaReader*  r, gps_location_callback  cb )
+{
+    r->callback = cb;
+    if (cb != NULL && is_ready_to_send(r)) {
+        D("%s: sending latest fix to new callback", __FUNCTION__);
+        r->callback( &r->fix );
+    }
+}
 
 static void
 nmea_reader_parse( NmeaReader*  r )
@@ -476,6 +523,30 @@
                                       tok_longitudeHemi.p[0]);
         nmea_reader_update_altitude(r, tok_altitude, tok_altitudeUnits);
 
+    } else if ( !memcmp(tok.p, "GNSSv1", 6) ) {
+        r->gnss_data.clock.time_ns                         = get_int64(nmea_tokenizer_get(tzer,1));
+        r->gnss_data.clock.full_bias_ns                    = get_int64(nmea_tokenizer_get(tzer,2));
+        r->gnss_data.clock.bias_ns                         = get_double(nmea_tokenizer_get(tzer,3));
+        r->gnss_data.clock.bias_uncertainty_ns             = get_double(nmea_tokenizer_get(tzer,4));
+        r->gnss_data.clock.drift_nsps                      = get_double(nmea_tokenizer_get(tzer,5));
+        r->gnss_data.clock.drift_uncertainty_nsps          = get_double(nmea_tokenizer_get(tzer,6));
+        r->gnss_data.clock.hw_clock_discontinuity_count    = get_int(nmea_tokenizer_get(tzer,7));
+        r->gnss_data.clock.flags                           = get_int(nmea_tokenizer_get(tzer,8));
+
+        r->gnss_data.measurement_count  = get_int(nmea_tokenizer_get(tzer,9));
+
+        for (int i = 0; i < r->gnss_data.measurement_count; ++i) {
+            r->gnss_data.measurements[i].svid                               = get_int(nmea_tokenizer_get(tzer,10 + i*9 + 0));
+            r->gnss_data.measurements[i].constellation                      = get_int(nmea_tokenizer_get(tzer,10 + i*9 + 1));
+            r->gnss_data.measurements[i].state                              = get_int(nmea_tokenizer_get(tzer,10 + i*9 + 2));
+            r->gnss_data.measurements[i].received_sv_time_in_ns             = get_int64(nmea_tokenizer_get(tzer,10 + i*9 + 3));
+            r->gnss_data.measurements[i].received_sv_time_uncertainty_in_ns = get_int64(nmea_tokenizer_get(tzer,10 + i*9 + 4));
+            r->gnss_data.measurements[i].c_n0_dbhz                          = get_double(nmea_tokenizer_get(tzer,10 + i*9 + 5));
+            r->gnss_data.measurements[i].pseudorange_rate_mps               = get_double(nmea_tokenizer_get(tzer,10 + i*9 + 6));
+            r->gnss_data.measurements[i].pseudorange_rate_uncertainty_mps   = get_double(nmea_tokenizer_get(tzer,10 + i*9 + 7));
+            r->gnss_data.measurements[i].carrier_frequency_hz               = get_double(nmea_tokenizer_get(tzer,10 + i*9 + 8));
+            r->gnss_data.measurements[i].flags                              = GNSS_MEASUREMENT_HAS_CARRIER_FREQUENCY;
+        }
     } else if ( !memcmp(tok.p, "GSA", 3) ) {
         // do something ?
     } else if ( !memcmp(tok.p, "RMC", 3) ) {
@@ -510,7 +581,7 @@
     // Always update accuracy
     nmea_reader_update_accuracy( r );
 
-    if (r->fix.flags != 0) {
+    if (is_ready_to_send(r)) {
 #if GPS_DEBUG
         char   temp[256];
         char*  p   = temp;
@@ -533,17 +604,36 @@
         if (r->fix.flags & GPS_LOCATION_HAS_ACCURACY) {
             p += snprintf(p,end-p, " accuracy=%g", r->fix.accuracy);
         }
-        gmtime_r( (time_t*) &r->fix.timestamp, &utc );
+        //The unit of r->fix.timestamp is millisecond.
+        time_t timestamp = r->fix.timestamp / 1000;
+        gmtime_r( (time_t*) &timestamp, &utc );
         p += snprintf(p, end-p, " time=%s", asctime( &utc ) );
-        D(temp);
 #endif
         if (r->callback) {
+            D("%s", temp);
             r->callback( &r->fix );
+            /* we have sent a complete fix, now prepare for next complete fix */
+            r->fix.flags = 0;
         }
         else {
             D("no callback, keeping data until needed !");
         }
     }
+
+    if (r->gnss_data.measurement_count > 0) {
+        /* this runs in child thread */
+        GpsState*  s = _gps_state;
+        pthread_mutex_lock(&s->lock);
+        if (s->measurement_callbacks && s->measurement_callbacks->gnss_measurement_callback) {
+            D("sending gnss measurement data");
+            s->measurement_callbacks->gnss_measurement_callback(&r->gnss_data);
+            r->gnss_data.measurement_count = 0;
+            r->gnss_count ++;
+        } else {
+            D("no gnss measurement_callbacks, keeping data until needed !");
+        }
+        pthread_mutex_unlock(&s->lock);
+    }
 }
 
 
@@ -587,17 +677,6 @@
 };
 
 
-/* this is the state of our connection to the qemu_gpsd daemon */
-typedef struct {
-    int                     init;
-    int                     fd;
-    GpsCallbacks            callbacks;
-    pthread_t               thread;
-    int                     control[2];
-} GpsState;
-
-static GpsState  _gps_state[1];
-
 
 static void
 gps_state_done( GpsState*  s )
@@ -608,6 +687,8 @@
     write( s->control[0], &cmd, 1 );
     pthread_join(s->thread, &dummy);
 
+    pthread_mutex_destroy(&s->lock);
+
     // close the control socket pair
     close( s->control[0] ); s->control[0] = -1;
     close( s->control[1] ); s->control[1] = -1;
@@ -755,6 +836,7 @@
                         if (!started) {
                             D("gps thread starting  location_cb=%p", state->callbacks.location_cb);
                             started = 1;
+                            reader->gnss_count = 0;
                             nmea_reader_set_callback( reader, state->callbacks.location_cb );
                             gps_status.status = GPS_STATUS_SESSION_BEGIN;
                             if (state->callbacks.status_cb) {
@@ -804,6 +886,18 @@
     }
 }
 
+#define  BUFF_SIZE   (PROPERTY_KEY_MAX + PROPERTY_VALUE_MAX + 2)
+static bool is_gnss_measurement_enabled() {
+    char temp[BUFF_SIZE];
+    property_get("ro.kernel.qemu.gps.gnss_enabled", temp, "");
+    return (strncmp(temp, "1", 1) == 0);
+}
+
+static bool is_fix_provided_by_gnss_measurement() {
+    char temp[BUFF_SIZE];
+    property_get("ro.kernel.qemu.gps.fix_by_gnss", temp, "");
+    return (strncmp(temp, "1", 1) == 0);
+}
 
 static void
 gps_state_init( GpsState*  state, GpsCallbacks* callbacks )
@@ -827,6 +921,12 @@
         goto Fail;
     }
 
+    state->gnss_enabled = is_gnss_measurement_enabled();
+    D("gnss_enabled:%s", state->gnss_enabled ? "yes":"no");
+    state->fix_provided_by_gnss = is_fix_provided_by_gnss_measurement();
+
+    pthread_mutex_init (&state->lock, (const pthread_mutexattr_t *) NULL);
+
     state->thread = callbacks->create_thread_cb( "gps_state_thread", gps_state_thread, state );
 
     if ( !state->thread ) {
@@ -840,11 +940,17 @@
     state->callbacks.set_capabilities_cb(0);
 
 
+
+
     // Setup system info, we are pre 2016 hardware.
     GnssSystemInfo sysinfo;
     sysinfo.size = sizeof(GnssSystemInfo);
     sysinfo.year_of_hw = 2015;
     state->callbacks.set_system_info_cb(&sysinfo);
+    if (state->gnss_enabled) {
+        D("enabling GPS_CAPABILITY_MEASUREMENTS");
+        state->callbacks.set_capabilities_cb(GPS_CAPABILITY_MEASUREMENTS);
+    }
 
     D("gps state initialized");
     return;
@@ -950,10 +1056,43 @@
     return 0;
 }
 
+static int qemu_gps_measurement_init(GpsMeasurementCallbacks* callbacks) {
+    /* this runs in main thread */
+    D("calling %s with input %p", __func__, callbacks);
+    GpsState*  s = _gps_state;
+    pthread_mutex_lock(&s->lock);
+    s->measurement_callbacks = callbacks;
+    pthread_mutex_unlock(&s->lock);
+
+    return 0;
+}
+
+static void qemu_gps_measurement_close() {
+    /* this runs in main thread */
+    D("calling %s", __func__);
+    GpsState*  s = _gps_state;
+    pthread_mutex_lock(&s->lock);
+    s->measurement_callbacks = NULL;
+    pthread_mutex_unlock(&s->lock);
+}
+
+static const GpsMeasurementInterface qemuGpsMeasurementInterface  = {
+    sizeof(GpsMeasurementInterface),
+    qemu_gps_measurement_init,
+    qemu_gps_measurement_close,
+};
+
 static const void*
-qemu_gps_get_extension(const char* __unused name)
+qemu_gps_get_extension(const char* name)
 {
-    // no extensions supported
+    if(name && strcmp(name, GPS_MEASUREMENT_INTERFACE) == 0) {
+        /* when this is called, _gps_state is not initialized yet */
+        bool gnss_enabled = is_gnss_measurement_enabled();
+        if (gnss_enabled) {
+            D("calling %s with GPS_MEASUREMENT_INTERFACE enabled", __func__);
+            return &qemuGpsMeasurementInterface;
+        }
+    }
     return NULL;
 }
 
diff --git a/gralloc/Android.mk b/gralloc/Android.mk
index a837f0a..e0b0b85 100644
--- a/gralloc/Android.mk
+++ b/gralloc/Android.mk
@@ -32,6 +32,7 @@
 
 LOCAL_MODULE := gralloc.goldfish.default
 LOCAL_CFLAGS:= -DLOG_TAG=\"gralloc\" -Wno-missing-field-initializers
+LOCAL_CFLAGS:= -DPLATFORM_SDK_VERSION=$(PLATFORM_SDK_VERSION)
 ifeq ($(TARGET_USE_PAN_DISPLAY),true)
 LOCAL_CFLAGS += -DUSE_PAN_DISPLAY=1
 endif
diff --git a/gralloc/gralloc.cpp b/gralloc/gralloc.cpp
index 07bbfba..3f2c025 100644
--- a/gralloc/gralloc.cpp
+++ b/gralloc/gralloc.cpp
@@ -89,6 +89,10 @@
         .unregisterBuffer = gralloc_unregister_buffer,
         .lock = gralloc_lock,
         .unlock = gralloc_unlock,
+#if PLATFORM_SDK_VERSION >= 28
+        .validateBufferSize = NULL,
+        .getTransportSize = NULL,
+#endif
     },
     .framebuffer = 0,
     .flags = 0,
diff --git a/init.ranchu.rc b/init.ranchu.rc
index c64ece7..81bcc22 100644
--- a/init.ranchu.rc
+++ b/init.ranchu.rc
@@ -3,8 +3,11 @@
 
 on early-init
     mount debugfs debugfs /sys/kernel/debug mode=755
+    mount proc proc /proc remount hidepid=2,gid=3009
 
 on init
+    # set RLIMIT_MEMLOCK to 8MB for BPF network statistics
+    setrlimit memlock 8388608 8388608
 
     symlink /dev/goldfish_pipe /dev/android_pipe
     symlink /dev/goldfish_pipe /dev/qemu_pipe
@@ -25,9 +28,11 @@
     mkdir /data/vendor/wifi/wpa/sockets 0770 wifi wifi
 
 on boot
+    setprop ro.hardware.egl emulation
     setprop debug.hwui.renderer opengl
     setprop debug.hwui.renderer ${ro.kernel.qemu.uirenderer}
     setprop ro.opengles.version ${ro.kernel.qemu.opengles.version}
+    setprop ro.zygote.disable_gl_preload 1
     setprop dalvik.vm.heapsize 192m
     setprop dalvik.vm.heapsize ${ro.kernel.qemu.dalvik.vm.heapsize}
     chown root system /sys/power/wake_lock
diff --git a/input/virtio_input_multi_touch_1.idc b/input/virtio_input_multi_touch_1.idc
new file mode 100644
index 0000000..f740c04
--- /dev/null
+++ b/input/virtio_input_multi_touch_1.idc
@@ -0,0 +1,7 @@
+device.internal = 1
+
+touch.deviceType = touchScreen
+touch.orientationAware = 1
+
+cursor.mode = navigation
+cursor.orientationAware = 1
diff --git a/input/virtio_input_multi_touch_2.idc b/input/virtio_input_multi_touch_2.idc
new file mode 100644
index 0000000..baba2dc
--- /dev/null
+++ b/input/virtio_input_multi_touch_2.idc
@@ -0,0 +1,12 @@
+device.internal = 1
+
+touch.deviceType = touchScreen
+touch.orientationAware = 1
+
+cursor.mode = navigation
+cursor.orientationAware = 1
+
+# This displayID matches the unique ID of the virtual display created for Emulator.
+# This will indicate to input flinger than it should link this input device
+# with the virtual display.
+touch.displayId = virtual:android:1234567
diff --git a/kernel-tests/goldfish_kernel_tests_x86_64.mk b/kernel-tests/goldfish_kernel_tests_x86_64.mk
index 9e5e0cb..19d4f0d 100644
--- a/kernel-tests/goldfish_kernel_tests_x86_64.mk
+++ b/kernel-tests/goldfish_kernel_tests_x86_64.mk
@@ -22,11 +22,15 @@
 BOARD_FLASH_BLOCK_SIZE := 512
 BOARD_HAVE_BLUETOOTH := false
 
+SYSTEM_CORE_ROOTDIR := system/core/rootdir
+PREBUILTS := prebuilts
+GOLDFISH_DIR := device/generic/goldfish
 THIS_DIR := device/generic/goldfish/kernel-tests
 
 # android.hardware.
 PRODUCT_PACKAGES += \
     android.hardware.keymaster@3.0-service \
+    android.hardware.keymaster@3.0-impl \
     android.hardware.drm@1.1-service.clearkey \
     android.hardware.graphics.allocator@2.0-service \
     android.hardware.graphics.allocator@2.0-impl \
@@ -50,7 +54,6 @@
     libdl \
     libutils \
     libsysutils \
-    libbinder \
     libhardware \
     libhardware_legacy \
     linker \
@@ -79,18 +82,11 @@
 PRODUCT_PACKAGES += \
     qemu-props \
 
-# Graphics
-PRODUCT_PACKAGES += \
-
 # Device modules
 PRODUCT_PACKAGES += \
     android.system.suspend@1.0-service \
     ashmemd \
     libashmemd_client \
-    keymaster@3.0-impl \
-    gralloc.goldfish \
-    gralloc.goldfish.default \
-    gralloc.ranchu \
     servicemanager \
     hwservicemanager \
     vndservice \
@@ -99,6 +95,8 @@
     toybox \
     vold \
     init \
+    init_system \
+    init_vendor \
     init.environ.rc \
     init.rc \
     reboot \
@@ -112,6 +110,9 @@
 PRODUCT_HOST_PACKAGES += \
     e2fsck \
     mke2fs \
+    e2fsdroid \
+    sload_f2fs \
+    make_f2fs \
 
 # SELinux
 PRODUCT_PACKAGES += \
@@ -124,14 +125,25 @@
     mac_permissions.xml \
 
 PRODUCT_COPY_FILES += \
+    $(SYSTEM_CORE_ROOTDIR)/init.usb.rc:root/init.usb.rc \
+    $(SYSTEM_CORE_ROOTDIR)/init.usb.configfs.rc:root/init.usb.configfs.rc \
+    $(SYSTEM_CORE_ROOTDIR)/ueventd.rc:root/ueventd.rc \
+    $(SYSTEM_CORE_ROOTDIR)/etc/hosts:system/etc/hosts \
+
+PRODUCT_COPY_FILES += \
+    $(PREBUILTS)/qemu-kernel/x86_64/4.14/kernel-qemu2:kernel-ranchu \
+
+PRODUCT_COPY_FILES += \
+    $(GOLDFISH_DIR)/data/etc/encryptionkey.img:encryptionkey.img \
+    $(GOLDFISH_DIR)/ueventd.ranchu.rc:$(TARGET_COPY_OUT_VENDOR)/ueventd.rc \
+
+PRODUCT_COPY_FILES += \
     $(THIS_DIR)/manifest.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
     $(THIS_DIR)/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
     $(THIS_DIR)/init.ranchu.rc:$(TARGET_COPY_OUT_VENDOR)/etc/init/hw/init.ranchu.rc \
     $(THIS_DIR)/fstab.ranchu:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.ranchu \
     $(THIS_DIR)/config.ini:config.ini \
-    device/generic/goldfish/data/etc/encryptionkey.img:encryptionkey.img \
-    development/sys-img/advancedFeatures.ini:advancedFeatures.ini \
-    prebuilts/qemu-kernel/x86_64/4.14/kernel-qemu2:kernel-ranchu \
+    $(THIS_DIR)/advancedFeatures.ini:advancedFeatures.ini \
 
 # The set of packages we want to force 'speed' compilation on.
 PRODUCT_DEXPREOPT_SPEED_APPS := \
diff --git a/kernel-tests/manifest.xml b/kernel-tests/manifest.xml
index 359b4ad..a917344 100644
--- a/kernel-tests/manifest.xml
+++ b/kernel-tests/manifest.xml
@@ -1,4 +1,30 @@
 <manifest version="1.0" type="device" target-level="3">
+    <hal format="hidl">
+        <name>android.hardware.keymaster</name>
+        <transport>hwbinder</transport>
+        <version>3.0</version>
+        <interface>
+            <name>IKeymasterDevice</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="hidl">
+        <name>android.hardware.drm</name>
+        <transport>hwbinder</transport>
+        <version>1.0</version>
+        <interface>
+            <name>ICryptoFactory</name>
+            <instance>default</instance>
+        </interface>
+        <interface>
+            <name>IDrmFactory</name>
+            <instance>default</instance>
+        </interface>
+        <fqname>@1.1::ICryptoFactory/clearkey</fqname>
+        <fqname>@1.1::IDrmFactory/clearkey</fqname>
+        <fqname>@1.1::ICryptoFactory/widevine</fqname>
+        <fqname>@1.1::IDrmFactory/widevine</fqname>
+    </hal>
     <sepolicy>
         <version>27.0</version>
     </sepolicy>
diff --git a/manifest-arm.xml b/manifest-arm.xml
index 26d4b3d..2189d91 100644
--- a/manifest-arm.xml
+++ b/manifest-arm.xml
@@ -200,6 +200,15 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="hidl">
+        <name>android.hardware.thermal</name>
+        <transport>hwbinder</transport>
+        <version>2.0</version>
+        <interface>
+            <name>IThermal</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <sepolicy>
         <version>27.0</version>
     </sepolicy>
diff --git a/manifest.xml b/manifest.xml
index 26d4b3d..dd598e8 100644
--- a/manifest.xml
+++ b/manifest.xml
@@ -11,10 +11,10 @@
             <name>IDrmFactory</name>
             <instance>default</instance>
         </interface>
-        <fqname>@1.1::ICryptoFactory/clearkey</fqname>
-        <fqname>@1.1::IDrmFactory/clearkey</fqname>
-        <fqname>@1.1::ICryptoFactory/widevine</fqname>
-        <fqname>@1.1::IDrmFactory/widevine</fqname>
+        <fqname>@1.2::ICryptoFactory/clearkey</fqname>
+        <fqname>@1.2::IDrmFactory/clearkey</fqname>
+        <fqname>@1.2::ICryptoFactory/widevine</fqname>
+        <fqname>@1.2::IDrmFactory/widevine</fqname>
     </hal>
     <hal format="hidl">
         <name>android.hardware.audio.effect</name>
@@ -200,6 +200,15 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="hidl">
+        <name>android.hardware.thermal</name>
+        <transport>hwbinder</transport>
+        <version>2.0</version>
+        <interface>
+            <name>IThermal</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
     <sepolicy>
         <version>27.0</version>
     </sepolicy>
diff --git a/overlay/frameworks/base/core/res/res/values/config.xml b/overlay/frameworks/base/core/res/res/values/config.xml
index e7923e4..b466231 100644
--- a/overlay/frameworks/base/core/res/res/values/config.xml
+++ b/overlay/frameworks/base/core/res/res/values/config.xml
@@ -36,4 +36,8 @@
     <!-- MMS user agent prolfile url -->
     <string name="config_mms_user_agent_profile_url" translatable="false">http://gsm.lge.com/html/gsm/Nexus5-M3.xml</string>
 
+    <!-- Indicate whether closing the lid causes the device to enter the folded state which means
+         to get a smaller screen and opening the lid causes the device to enter the unfolded state
+         which means to get a larger screen. -->
+    <bool name="config_lidControlsDisplayFold">true</bool>
 </resources>
diff --git a/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml b/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
index a9e516e..7b206e4 100644
--- a/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
+++ b/overlay/frameworks/base/packages/SettingsProvider/res/values/defaults.xml
@@ -20,6 +20,11 @@
 <resources>
     <bool name="def_lockscreen_disabled">true</bool>
     <bool name="def_wifi_on">true</bool>
+    <!-- Allow scanning even if WiFi is disabled -->
+    <integer name="def_wifi_scan_always_available">1</integer>
+
+    <!-- maximize the timeout to INT_MAX about 500+ hours -->
+    <integer name="def_screen_off_timeout">2147483647</integer>
 
     <!-- Allow users to use both the on-screen keyboard, as well as a real
          keyboard -->
diff --git a/overlay/frameworks/base/packages/SystemUI/res/values/config.xml b/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
new file mode 100644
index 0000000..044c383
--- /dev/null
+++ b/overlay/frameworks/base/packages/SystemUI/res/values/config.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+/**
+ * Copyright (c) 2016, The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+-->
+
+<resources>
+    <!-- Should "4G" be shown instead of "LTE" when the network is NETWORK_TYPE_LTE? -->
+    <!-- No, in the Emulator, show "LTE" for LTE -->
+    <bool name="config_show4GForLTE">false</bool>
+</resources>
diff --git a/ril/reference-ril.c b/ril/reference-ril.c
index 7e52e10..48ad12c 100644
--- a/ril/reference-ril.c
+++ b/ril/reference-ril.c
@@ -1147,6 +1147,12 @@
         if (err < 0 && count < minNumOfElements) goto error;
     }
 
+    // remove gsm/cdma/evdo,just keep LTE
+    int numSignalsToIgnore = sizeof(RIL_SignalStrength_v5)/sizeof(int);
+    for (int i=0; i < numSignalsToIgnore; ++i) {
+        response[i] = INT_MAX;
+    }
+
     RIL_onRequestComplete(t, RIL_E_SUCCESS, response, sizeof(response));
 
     at_response_free(p_response);
@@ -2397,7 +2403,7 @@
    radioCapability.version = RIL_RADIO_CAPABILITY_VERSION;
    radioCapability.session = 0;
    radioCapability.phase   = 0;
-   radioCapability.rat     = 0;
+   radioCapability.rat     = RAF_LTE;
    radioCapability.logicalModemUuid[0] = '\0';
    radioCapability.status  = RC_STATUS_SUCCESS;
 
diff --git a/sdk_phone_x86_vendor.mk b/sdk_phone_x86_vendor.mk
new file mode 100644
index 0000000..7c46068
--- /dev/null
+++ b/sdk_phone_x86_vendor.mk
@@ -0,0 +1,25 @@
+#this only builds the vendor.img
+
+PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    ro.zygote=zygote32
+
+PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
+    ro.logd.size.stats=64K \
+    log.tag.stats_log=I
+
+# Additional settings used in all AOSP builds
+PRODUCT_PROPERTY_OVERRIDES := \
+    ro.config.ringtone=Ring_Synth_04.ogg \
+    ro.config.notification_sound=pixiedust.ogg
+
+# Emulator for vendor
+$(call inherit-product-if-exists, device/generic/goldfish/x86-vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/product/emulator_vendor.mk)
+$(call inherit-product, $(SRC_TARGET_DIR)/board/generic_x86/device.mk)
+
+# Overrides
+PRODUCT_BRAND := google
+PRODUCT_MANUFACTURER := Google
+PRODUCT_NAME := sdk_phone_x86_vendor
+PRODUCT_DEVICE := generic_x86
+PRODUCT_MODEL := Android SDK built for x86
diff --git a/sensors/sensors_qemu.c b/sensors/sensors_qemu.c
index dfa6273..eaf2bb8 100644
--- a/sensors/sensors_qemu.c
+++ b/sensors/sensors_qemu.c
@@ -487,6 +487,12 @@
             t = now;
         }
 
+        if (has_guest_event_time) {
+            if (guest_event_time > now) {
+                guest_event_time = now;
+            }
+        }
+
         while (new_sensors) {
             uint32_t i = 31 - __builtin_clz(new_sensors);
             new_sensors &= ~(1U << i);
@@ -706,7 +712,7 @@
           .version    = 1,
           .handle     = ID_ACCELERATION,
           .type       = SENSOR_TYPE_ACCELEROMETER,
-          .maxRange   = 2.8f,
+          .maxRange   = 39.3f,
           .resolution = 1.0f/4032.0f,
           .power      = 3.0f,
           .minDelay   = 10000,
@@ -724,7 +730,7 @@
           .version    = 1,
           .handle     = ID_GYROSCOPE,
           .type       = SENSOR_TYPE_GYROSCOPE,
-          .maxRange   = 11.1111111,
+          .maxRange   = 16.46f,
           .resolution = 1.0f/1000.0f,
           .power      = 3.0f,
           .minDelay   = 10000,
@@ -739,7 +745,7 @@
           .handle     = ID_MAGNETIC_FIELD,
           .type       = SENSOR_TYPE_MAGNETIC_FIELD,
           .maxRange   = 2000.0f,
-          .resolution = 1.0f,
+          .resolution = 0.5f,
           .power      = 6.7f,
           .minDelay   = 10000,
           .maxDelay   = 500 * 1000,
@@ -865,7 +871,7 @@
           .handle     = ID_MAGNETIC_FIELD_UNCALIBRATED,
           .type       = SENSOR_TYPE_MAGNETIC_FIELD_UNCALIBRATED,
           .maxRange   = 2000.0f,
-          .resolution = 1.0f,
+          .resolution = 0.5f,
           .power      = 6.7f,
           .minDelay   = 10000,
           .maxDelay   = 500 * 1000,
diff --git a/sepolicy/common/dumpstate.te b/sepolicy/common/dumpstate.te
new file mode 100644
index 0000000..e9a7ada
--- /dev/null
+++ b/sepolicy/common/dumpstate.te
@@ -0,0 +1,12 @@
+allow dumpstate sysfs_virtio_block:file r_file_perms;
+allow dumpstate debugfs:dir { open read };
+allow dumpstate mnt_media_rw_file:dir { getattr open read };
+#allow dumpstate varrun_file:dir { search getattr open read };
+
+dontaudit dumpstate kernel:system module_request;
+
+dontaudit dumpstate device:file { open write };
+allow dumpstate nsfs:file getattr;
+dontaudit dumpstate varrun_file:dir search;
+allow dumpstate vold:binder call;
+dontaudit dumpstate apexd:binder call;
diff --git a/sepolicy/common/file.te b/sepolicy/common/file.te
index b0aa217..c106a98 100644
--- a/sepolicy/common/file.te
+++ b/sepolicy/common/file.te
@@ -1,4 +1,5 @@
 type sysfs_writable, fs_type, sysfs_type, mlstrustedobject;
+type sysfs_virtio_block, sysfs_type, fs_type;
 type varrun_file, file_type, data_file_type, mlstrustedobject;
 type mediadrm_vendor_data_file, file_type, data_file_type;
 type nsfs, fs_type;
diff --git a/sepolicy/common/file_contexts b/sepolicy/common/file_contexts
index d955e3d..c1350f9 100644
--- a/sepolicy/common/file_contexts
+++ b/sepolicy/common/file_contexts
@@ -31,11 +31,12 @@
 /vendor/bin/netmgr           u:object_r:netmgr_exec:s0
 
 /vendor/bin/hw/android\.hardware\.drm@1\.0-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
-/vendor/bin/hw/android\.hardware\.drm@1\.1-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
-/vendor/bin/hw/android\.hardware\.drm@1\.1-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
+/vendor/bin/hw/android\.hardware\.drm@1\.2-service\.widevine          u:object_r:hal_drm_widevine_exec:s0
+/vendor/bin/hw/android\.hardware\.drm@1\.2-service\.clearkey          u:object_r:hal_drm_clearkey_exec:s0
 /vendor/bin/hw/android\.hardware\.keymaster@4\.0-strongbox-service u:object_r:hal_keymaster_default_exec:s0
 /vendor/bin/hw/android\.hardware\.health@2\.0-service.goldfish        u:object_r:hal_health_default_exec:s0
 /vendor/bin/hw/android\.hardware\.power@1\.1-service.ranchu           u:object_r:hal_power_default_exec:s0
+/vendor/bin/hw/android\.hardware\.thermal@2\.0-service.mock           u:object_r:hal_thermal_default_exec:s0
 
 /vendor/lib(64)?/hw/vulkan\.ranchu\.so   u:object_r:same_process_hal_file:s0
 /vendor/lib(64)?/hw/gralloc\.ranchu\.so   u:object_r:same_process_hal_file:s0
diff --git a/sepolicy/common/genfs_contexts b/sepolicy/common/genfs_contexts
index 02f08f0..bc99f83 100644
--- a/sepolicy/common/genfs_contexts
+++ b/sepolicy/common/genfs_contexts
@@ -16,6 +16,17 @@
 genfscon sysfs /devices/virtual/mac80211_hwsim/hwsim0/net u:object_r:sysfs_net:s0
 genfscon sysfs /devices/virtual/mac80211_hwsim/hwsim1/net u:object_r:sysfs_net:s0
 
+# block devices
+genfscon sysfs /devices/virtual/block/ram u:object_r:sysfs_devices_block:s0
+genfscon sysfs /devices/virtual/block/md u:object_r:sysfs_devices_block:s0
+
+genfscon sysfs /devices/pci0000:00/0000:00:03.0/virtio0/block/vda u:object_r:sysfs_virtio_block:s0
+genfscon sysfs /devices/pci0000:00/0000:00:04.0/virtio1/block/vdb u:object_r:sysfs_virtio_block:s0
+genfscon sysfs /devices/pci0000:00/0000:00:05.0/virtio2/block/vdc u:object_r:sysfs_virtio_block:s0
+genfscon sysfs /devices/pci0000:00/0000:00:06.0/virtio3/block/vdd u:object_r:sysfs_virtio_block:s0
+genfscon sysfs /devices/pci0000:00/0000:00:07.0/virtio4/block/vde u:object_r:sysfs_virtio_block:s0
+genfscon sysfs /devices/pci0000:00/0000:00:08.0/virtio5/block/vdf u:object_r:sysfs_virtio_block:s0
+
 # /sys/class/power_supply
 genfscon sysfs /devices/platform/9020000.goldfish_battery/power_supply u:object_r:sysfs_batteryinfo:s0
 
diff --git a/sepolicy/common/goldfish_setup.te b/sepolicy/common/goldfish_setup.te
index 7180bcb..187d055 100644
--- a/sepolicy/common/goldfish_setup.te
+++ b/sepolicy/common/goldfish_setup.te
@@ -53,4 +53,3 @@
 allow goldfish_setup hostapd_data_file:file create_file_perms;
 allow goldfish_setup hostapd_data_file:dir rw_dir_perms;
 allow goldfish_setup system_file:file { execute getattr open read };
-dontaudit goldfish_setup self:capability dac_override;
diff --git a/sepolicy/common/hal_graphics_allocator_default.te b/sepolicy/common/hal_graphics_allocator_default.te
index 0c8e27d..c57e452 100644
--- a/sepolicy/common/hal_graphics_allocator_default.te
+++ b/sepolicy/common/hal_graphics_allocator_default.te
@@ -1,2 +1,4 @@
 allow hal_graphics_allocator_default graphics_device:dir search;
 allow hal_graphics_allocator_default graphics_device:chr_file { ioctl open read write };
+allow hal_graphics_allocator_default dumpstate:fd use;
+allow hal_graphics_allocator_default dumpstate:fifo_file write;
diff --git a/sepolicy/common/healthd.te b/sepolicy/common/healthd.te
index ced6704..80db9b7 100644
--- a/sepolicy/common/healthd.te
+++ b/sepolicy/common/healthd.te
@@ -1,2 +1,4 @@
 # Allow to read /sys/class/power_supply directory
 allow healthd sysfs:dir r_dir_perms;
+
+allow healthd self:capability2 wake_alarm;
diff --git a/sepolicy/common/hwservicemanager.te b/sepolicy/common/hwservicemanager.te
new file mode 100644
index 0000000..66b51b2
--- /dev/null
+++ b/sepolicy/common/hwservicemanager.te
@@ -0,0 +1,2 @@
+allow hwservicemanager dumpstate:fd use;
+allow hwservicemanager dumpstate:fifo_file write;
diff --git a/sepolicy/common/idmap.te b/sepolicy/common/idmap.te
new file mode 100644
index 0000000..441801e
--- /dev/null
+++ b/sepolicy/common/idmap.te
@@ -0,0 +1 @@
+allow idmap dumpstate:fd use;
diff --git a/sepolicy/common/init.te b/sepolicy/common/init.te
index 84a4e8d..9c01f79 100644
--- a/sepolicy/common/init.te
+++ b/sepolicy/common/init.te
@@ -1,2 +1,3 @@
 allow init tmpfs:lnk_file create_file_perms;
+allow init proc:dir { mounton };
 dontaudit init kernel:system module_request;
diff --git a/sepolicy/common/kernel.te b/sepolicy/common/kernel.te
new file mode 100644
index 0000000..f71a3fa
--- /dev/null
+++ b/sepolicy/common/kernel.te
@@ -0,0 +1 @@
+dontaudit kernel kernel:system module_request;
diff --git a/sepolicy/common/property_contexts b/sepolicy/common/property_contexts
index f7a241c..4a82974 100644
--- a/sepolicy/common/property_contexts
+++ b/sepolicy/common/property_contexts
@@ -6,3 +6,4 @@
 ro.radio.noril          u:object_r:radio_noril_prop:s0
 net.eth0.               u:object_r:net_eth0_prop:s0
 net.shared_net_ip       u:object_r:net_share_prop:s0
+ro.zygote.disable_gl_preload            u:object_r:qemu_prop:s0
diff --git a/sepolicy/common/vold.te b/sepolicy/common/vold.te
index bea4501..6b3b1f3 100644
--- a/sepolicy/common/vold.te
+++ b/sepolicy/common/vold.te
@@ -1,3 +1,4 @@
 dontaudit vold kernel:system module_request;
-
+allow vold sysfs_devices_block:file w_file_perms;
+allow vold sysfs_virtio_block:file w_file_perms;
 allow vold nsfs:file r_file_perms;
diff --git a/tools/extract_ext4_image.sh b/tools/extract_ext4_image.sh
new file mode 100755
index 0000000..0e591c9
--- /dev/null
+++ b/tools/extract_ext4_image.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -e
+
+if [ "$#" -ne 2 ]; then
+    echo "$0 src.img target.img" >&2
+    exit 1
+fi
+
+srcimg=$1
+target=$2
+
+disksize=$(stat -c %s $srcimg)
+
+mycount=`expr $disksize \/ 1024 - 2048`
+
+dd if=$srcimg of=$target ibs=1k skip=1024 count=${mycount}
+
diff --git a/tools/mk_verified_boot_params.sh b/tools/mk_verified_boot_params.sh
index 4cc0ea8..15813cb 100755
--- a/tools/mk_verified_boot_params.sh
+++ b/tools/mk_verified_boot_params.sh
@@ -2,7 +2,8 @@
 
 if [ $# -ne 3 ]; then
   echo "Usage: mk_verified_boot_params.sh <vbmeta.img> <system-qemu.img> <VerifiedBootParams.textproto>"
-  exit 1
+#when building vendor.img only, this is expected
+  exit 0
 fi
 
 # Example Output from 'avbtool calculate_kernel_cmdline --image vbmeta.img':
diff --git a/vendor.mk b/vendor.mk
index ef7aa88..adbb888 100644
--- a/vendor.mk
+++ b/vendor.mk
@@ -106,12 +106,13 @@
 PRODUCT_PACKAGES += \
     android.hardware.drm@1.0-service \
     android.hardware.drm@1.0-impl \
-    android.hardware.drm@1.1-service.clearkey \
-    android.hardware.drm@1.1-service.widevine
+    android.hardware.drm@1.2-service.clearkey \
+    android.hardware.drm@1.2-service.widevine
 
 PRODUCT_PACKAGES += \
     android.hardware.power@1.1-service.ranchu \
 
+PRODUCT_PROPERTY_OVERRIDES += ro.control_privapp_permissions=enforce
 PRODUCT_PROPERTY_OVERRIDES += ro.hardware.power=ranchu
 
 PRODUCT_PROPERTY_OVERRIDES += persist.sys.zram_enabled=1 \
@@ -137,14 +138,21 @@
 	netmgr \
 	wpa_supplicant \
 
+PRODUCT_PACKAGES += android.hardware.thermal@2.0-service.mock
+
 # Needed for /system/priv-app/SdkSetup/SdkSetup.apk to pass CTS android.permission2.cts.PrivappPermissionsTest.
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/data/etc/permissions/privapp-permissions-goldfish.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/privapp-permissions-goldfish.xml
 
+# Goldfish does not support ION needed for Codec 2.0
+PRODUCT_PROPERTY_OVERRIDES += \
+    debug.stagefright.ccodec=0
+
 
 PRODUCT_COPY_FILES += \
     device/generic/goldfish/fstab.ranchu.initrd:$(TARGET_COPY_OUT_RAMDISK)/fstab.ranchu \
     device/generic/goldfish/data/etc/apns-conf.xml:data/misc/apns/apns-conf.xml \
+    device/generic/goldfish/data/etc/local.prop:data/local.prop \
     device/generic/goldfish/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
     device/generic/goldfish/init.ranchu-net.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-net.sh \
     device/generic/goldfish/wifi/init.wifi.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.wifi.sh \
@@ -152,6 +160,8 @@
     device/generic/goldfish/fstab.ranchu:$(TARGET_COPY_OUT_VENDOR)/etc/fstab.ranchu \
     device/generic/goldfish/ueventd.ranchu.rc:$(TARGET_COPY_OUT_VENDOR)/ueventd.rc \
     device/generic/goldfish/input/goldfish_rotary.idc:$(TARGET_COPY_OUT_VENDOR)/usr/idc/goldfish_rotary.idc \
+    device/generic/goldfish/input/virtio_input_multi_touch_1.idc:$(TARGET_COPY_OUT_VENDOR)/usr/idc/virtio_input_multi_touch_1.idc \
+    device/generic/goldfish/input/virtio_input_multi_touch_2.idc:$(TARGET_COPY_OUT_VENDOR)/usr/idc/virtio_input_multi_touch_2.idc \
     device/generic/goldfish/manifest.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
     device/generic/goldfish/data/etc/config.ini:config.ini \
     device/generic/goldfish/wifi/simulated_hostapd.conf:$(TARGET_COPY_OUT_VENDOR)/etc/simulated_hostapd.conf \
@@ -180,3 +190,4 @@
     frameworks/av/services/audiopolicy/config/r_submix_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/r_submix_audio_policy_configuration.xml \
     frameworks/av/services/audiopolicy/config/audio_policy_volumes.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_volumes.xml \
     frameworks/av/services/audiopolicy/config/default_volume_tables.xml:$(TARGET_COPY_OUT_VENDOR)/etc/default_volume_tables.xml \
+    frameworks/av/services/audiopolicy/config/surround_sound_configuration_5_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/surround_sound_configuration_5_0.xml \
diff --git a/x86-vendor.mk b/x86-vendor.mk
index 33acc94..29157ba 100644
--- a/x86-vendor.mk
+++ b/x86-vendor.mk
@@ -1,3 +1,4 @@
+PRODUCT_KERNEL_VERSION := 4.14
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.rild.libpath=/vendor/lib/libgoldfish-ril.so
@@ -10,7 +11,11 @@
     device/generic/goldfish/data/etc/config.ini.nexus5:config.ini \
     device/generic/goldfish/data/etc/advancedFeatures.ini:advancedFeatures.ini \
     device/generic/goldfish/data/etc/encryptionkey.img:encryptionkey.img \
-    prebuilts/qemu-kernel/x86_64/4.14/kernel-qemu2:kernel-ranchu-64
+    prebuilts/qemu-kernel/x86_64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:kernel-ranchu-64
+PRODUCT_SDK_ADDON_COPY_FILES += \
+    device/generic/goldfish/data/etc/advancedFeatures.ini:images/x86/advancedFeatures.ini \
+    device/generic/goldfish/data/etc/encryptionkey.img:images/x86/encryptionkey.img \
+    prebuilts/qemu-kernel/x86_64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:images/x86/kernel-ranchu-64
 
 PRODUCT_SHIPPING_API_LEVEL := 28
 TARGET_USES_MKE2FS := true
diff --git a/x86_64-vendor.mk b/x86_64-vendor.mk
index d913cc8..b0cbf0a 100644
--- a/x86_64-vendor.mk
+++ b/x86_64-vendor.mk
@@ -1,3 +1,4 @@
+PRODUCT_KERNEL_VERSION := 4.14
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.rild.libpath=/vendor/lib64/libgoldfish-ril.so
@@ -10,7 +11,11 @@
     device/generic/goldfish/data/etc/config.ini.nexus5:config.ini \
     device/generic/goldfish/data/etc/advancedFeatures.ini:advancedFeatures.ini \
     device/generic/goldfish/data/etc/encryptionkey.img:encryptionkey.img \
-    prebuilts/qemu-kernel/x86_64/4.14/kernel-qemu2:kernel-ranchu
+    prebuilts/qemu-kernel/x86_64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:kernel-ranchu
+PRODUCT_SDK_ADDON_COPY_FILES += \
+    device/generic/goldfish/data/etc/advancedFeatures.ini:images/x86_64/advancedFeatures.ini \
+    device/generic/goldfish/data/etc/encryptionkey.img:images/x86_64/encryptionkey.img \
+    prebuilts/qemu-kernel/x86_64/$(PRODUCT_KERNEL_VERSION)/kernel-qemu2:images/x86_64/kernel-ranchu
 
 PRODUCT_SHIPPING_API_LEVEL := 28
 TARGET_USES_MKE2FS := true