diff --git a/core/main.mk b/core/main.mk
index ef55b4e..24ffa74 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -90,6 +90,8 @@
 -include tools/tradefederation/build/suites/device-tests/config.mk
 # general-tests-specific-config.
 -include tools/tradefederation/build/suites/general-tests/config.mk
+# STS-specific config.
+-include test/sts/tools/sts-tradefed/build/config.mk
 
 # Clean rules
 .PHONY: clean-dex-files
diff --git a/core/tasks/sts.mk b/core/tasks/sts.mk
new file mode 100644
index 0000000..b3c3baa
--- /dev/null
+++ b/core/tasks/sts.mk
@@ -0,0 +1,23 @@
+# Copyright (C) 2016 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+test_suite_name := sts
+test_suite_tradefed := sts-tradefed
+test_suite_readme := test/sts/README.md
+
+include $(BUILD_SYSTEM)/tasks/tools/compatibility.mk
+
+.PHONY: sts
+sts: $(compatibility_zip)
+$(call dist-for-goals, sts, $(compatibility_zip))
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index e83d6fa..6ecda65 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -234,7 +234,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2017-12-01
+      PLATFORM_SECURITY_PATCH := 2018-04-05
 endif
 
 ifndef PLATFORM_BASE_OS
diff --git a/target/board/generic/sepolicy/hal_gnss_default.te b/target/board/generic/sepolicy/hal_gnss_default.te
index ddc68cc..0dd3d03 100644
--- a/target/board/generic/sepolicy/hal_gnss_default.te
+++ b/target/board/generic/sepolicy/hal_gnss_default.te
@@ -1 +1,3 @@
-vndbinder_use(hal_gnss_default);
+#============= hal_gnss_default ==============
+allow hal_gnss_default vndbinder_device:chr_file { ioctl open read write };
+
diff --git a/target/board/generic/sepolicy/hal_graphics_composer_default.te b/target/board/generic/sepolicy/hal_graphics_composer_default.te
index 40ecda6..034bdef 100644
--- a/target/board/generic/sepolicy/hal_graphics_composer_default.te
+++ b/target/board/generic/sepolicy/hal_graphics_composer_default.te
@@ -1 +1,3 @@
-vndbinder_use(hal_graphics_composer_default);
+#============= hal_graphics_composer_default ==============
+allow hal_graphics_composer_default vndbinder_device:chr_file { ioctl open read write };
+
diff --git a/target/board/treble_common.mk b/target/board/treble_common.mk
index a8c9bc5..26a2655 100644
--- a/target/board/treble_common.mk
+++ b/target/board/treble_common.mk
@@ -29,7 +29,10 @@
 TARGET_NO_KERNEL := true
 
 # system.img is always ext4 with sparse option
+# GSI also includes make_f2fs to support userdata parition in f2fs
+# for some devices
 TARGET_USERIMAGES_USE_EXT4 := true
+TARGET_USERIMAGES_USE_F2FS := true
 TARGET_USERIMAGES_SPARSE_EXT_DISABLED := false
 TARGET_USES_MKE2FS := true
 
diff --git a/target/product/go_defaults_common.mk b/target/product/go_defaults_common.mk
index fbb9567..ca58c1d 100644
--- a/target/product/go_defaults_common.mk
+++ b/target/product/go_defaults_common.mk
@@ -55,3 +55,10 @@
 PRODUCT_PROPERTY_OVERRIDES += dalvik.vm.heapgrowthlimit=128m
 PRODUCT_PROPERTY_OVERRIDES += dalvik.vm.heapsize=256m
 
+# Do not generate libartd.
+PRODUCT_ART_TARGET_INCLUDE_DEBUG_BUILD := false
+
+# Strip the local variable table and the local variable type table to reduce
+# the size of the system image. This has no bearing on stack traces, but will
+# leave less information available via JDWP.
+PRODUCT_MINIMIZE_JAVA_DEBUG_INFO := true
diff --git a/target/product/sdk_base.mk b/target/product/sdk_base.mk
index a641be3..75a63e6 100644
--- a/target/product/sdk_base.mk
+++ b/target/product/sdk_base.mk
@@ -92,7 +92,7 @@
 	frameworks/base/data/sounds/effects/VideoRecord.ogg:system/media/audio/ui/VideoRecord.ogg \
 	frameworks/base/data/sounds/effects/VideoStop.ogg:system/media/audio/ui/VideoStop.ogg \
 	device/generic/goldfish/data/etc/handheld_core_hardware.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/handheld_core_hardware.xml \
-	device/generic/goldfish/camera/media_profiles.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_profiles.xml \
+	device/generic/goldfish/camera/media_profiles.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_profiles_V1_0.xml \
 	frameworks/av/media/libstagefright/data/media_codecs_google_audio.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_audio.xml \
 	frameworks/av/media/libstagefright/data/media_codecs_google_telephony.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_telephony.xml \
 	device/generic/goldfish/camera/media_codecs_google_video.xml:$(TARGET_COPY_OUT_VENDOR)/etc/media_codecs_google_video.xml \
diff --git a/tools/releasetools/ota_from_target_files.py b/tools/releasetools/ota_from_target_files.py
index 6e3ef0a..3225156 100755
--- a/tools/releasetools/ota_from_target_files.py
+++ b/tools/releasetools/ota_from_target_files.py
@@ -1371,7 +1371,15 @@
 
   # Generate payload.
   payload = Payload()
-  payload.Generate(target_file, source_file)
+
+  # Enforce a max timestamp this payload can be applied on top of.
+  if OPTIONS.downgrade:
+    max_timestamp = source_info.GetBuildProp("ro.build.date.utc")
+  else:
+    max_timestamp = metadata["post-timestamp"]
+  additional_args = ["--max_timestamp", max_timestamp]
+
+  payload.Generate(target_file, source_file, additional_args)
 
   # Sign the payload.
   payload_signer = PayloadSigner()
@@ -1388,7 +1396,8 @@
     secondary_target_file = GetTargetFilesZipForSecondaryImages(
         target_file, OPTIONS.skip_postinstall)
     secondary_payload = Payload(secondary=True)
-    secondary_payload.Generate(secondary_target_file)
+    secondary_payload.Generate(secondary_target_file,
+                               additional_args=additional_args)
     secondary_payload.Sign(payload_signer)
     secondary_payload.WriteToZip(output_zip)