diff --git a/core/Makefile b/core/Makefile
index d4c31e5..74df214 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -78,8 +78,13 @@
 endif
 
 # -----------------------------------------------------------------
-# default.prop
+# prop.default
+ifdef property_overrides_split_enabled
+INSTALLED_DEFAULT_PROP_TARGET := $(TARGET_OUT)/etc/prop.default
+else
+# legacy path
 INSTALLED_DEFAULT_PROP_TARGET := $(TARGET_ROOT_OUT)/default.prop
+endif
 ALL_DEFAULT_INSTALLED_MODULES += $(INSTALLED_DEFAULT_PROP_TARGET)
 FINAL_DEFAULT_PROPERTIES := \
     $(call collapse-pairs, $(ADDITIONAL_DEFAULT_PROPERTIES))
@@ -95,6 +100,7 @@
 $(INSTALLED_DEFAULT_PROP_TARGET): $(intermediate_system_build_prop)
 	@echo Target buildinfo: $@
 	@mkdir -p $(dir $@)
+	@rm -f $@
 	$(hide) echo "#" > $@; \
 	        echo "# ADDITIONAL_DEFAULT_PROPERTIES" >> $@; \
 	        echo "#" >> $@;
@@ -107,6 +113,10 @@
 	$(hide) echo ro.bootimage.build.date.utc=`$(DATE_FROM_FILE) +%s`>>$@
 	$(hide) echo ro.bootimage.build.fingerprint="$(BUILD_FINGERPRINT_FROM_FILE)">>$@
 	$(hide) build/tools/post_process_props.py $@
+ifdef property_overrides_split_enabled
+	$(hide) mkdir -p $(TARGET_ROOT_OUT)
+	$(hide) ln -sf system/etc/prop.default $(TARGET_ROOT_OUT)/default.prop
+endif
 
 # -----------------------------------------------------------------
 # vendor default.prop
@@ -1203,12 +1213,13 @@
     $(hide) cp -f $(recovery_wipe) $(TARGET_RECOVERY_ROOT_OUT)/etc/recovery.wipe)
   $(hide) cp $(RECOVERY_INSTALL_OTA_KEYS) $(TARGET_RECOVERY_ROOT_OUT)/res/keys
   $(hide) cat $(INSTALLED_DEFAULT_PROP_TARGET) \
-          > $(TARGET_RECOVERY_ROOT_OUT)/default.prop
+          > $(TARGET_RECOVERY_ROOT_OUT)/prop.default
   $(if $(INSTALLED_VENDOR_DEFAULT_PROP_TARGET), \
     $(hide) cat $(INSTALLED_VENDOR_DEFAULT_PROP_TARGET) \
-            >> $(TARGET_RECOVERY_ROOT_OUT)/default.prop)
+            >> $(TARGET_RECOVERY_ROOT_OUT)/prop.default)
   $(hide) cat $(recovery_build_props) \
-          >> $(TARGET_RECOVERY_ROOT_OUT)/default.prop
+          >> $(TARGET_RECOVERY_ROOT_OUT)/prop.default
+  $(hide) ln -sf prop.default $(TARGET_RECOVERY_ROOT_OUT)/default.prop
   $(BOARD_RECOVERY_IMAGE_PREPARE)
   $(if $(filter true,$(BOARD_BUILD_SYSTEM_ROOT_IMAGE)), \
     $(hide) mkdir -p $(TARGET_RECOVERY_ROOT_OUT)/system_root; \
diff --git a/core/version_defaults.mk b/core/version_defaults.mk
index ba4b9e4..a5af6b7 100644
--- a/core/version_defaults.mk
+++ b/core/version_defaults.mk
@@ -188,7 +188,7 @@
     #  It must be of the form "YYYY-MM-DD" on production devices.
     #  It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
     #  If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
-      PLATFORM_SECURITY_PATCH := 2017-08-05
+      PLATFORM_SECURITY_PATCH := 2017-09-05
 endif
 
 ifndef PLATFORM_BASE_OS
diff --git a/target/board/generic/sepolicy/file_contexts b/target/board/generic/sepolicy/file_contexts
index e9502d9..d1a1e8c 100644
--- a/target/board/generic/sepolicy/file_contexts
+++ b/target/board/generic/sepolicy/file_contexts
@@ -17,4 +17,6 @@
 /system/bin/qemud            u:object_r:qemud_exec:s0
 /sys/qemu_trace(/.*)?        u:object_r:sysfs_writable:s0
 /system/etc/init.goldfish.sh u:object_r:goldfish_setup_exec:s0
+/system/vendor/bin/init.ranchu-core.sh u:object_r:goldfish_setup_exec:s0
+/system/vendor/bin/init.ranchu-net.sh u:object_r:goldfish_setup_exec:s0
 /system/bin/qemu-props       u:object_r:qemu_props_exec:s0
diff --git a/target/board/generic/sepolicy/hal_gnss_default.te b/target/board/generic/sepolicy/hal_gnss_default.te
new file mode 100644
index 0000000..0dd3d03
--- /dev/null
+++ b/target/board/generic/sepolicy/hal_gnss_default.te
@@ -0,0 +1,3 @@
+#============= hal_gnss_default ==============
+allow hal_gnss_default vndbinder_device:chr_file { ioctl open read write };
+
diff --git a/target/board/generic/sepolicy/hal_graphics_composer_default.te b/target/board/generic/sepolicy/hal_graphics_composer_default.te
new file mode 100644
index 0000000..034bdef
--- /dev/null
+++ b/target/board/generic/sepolicy/hal_graphics_composer_default.te
@@ -0,0 +1,3 @@
+#============= hal_graphics_composer_default ==============
+allow hal_graphics_composer_default vndbinder_device:chr_file { ioctl open read write };
+
diff --git a/target/product/emulator.mk b/target/product/emulator.mk
index 04aae58..5a5fb8e 100644
--- a/target/product/emulator.mk
+++ b/target/product/emulator.mk
@@ -56,8 +56,14 @@
     android.hardware.biometrics.fingerprint@2.1-service \
     sensors.ranchu \
     android.hardware.graphics.composer@2.1-impl \
-	hwcomposer.goldfish \
-	hwcomposer.ranchu \
+    android.hardware.graphics.composer@2.1-service \
+    android.hardware.graphics.allocator@2.0-service \
+    android.hardware.graphics.allocator@2.0-impl \
+    android.hardware.graphics.mapper@2.0-impl \
+    hwcomposer.goldfish \
+    hwcomposer.ranchu \
+    vintf \
+    CarrierConfig
 
 PRODUCT_PACKAGES += \
     android.hardware.audio@2.0-impl \
@@ -89,10 +95,14 @@
     device/generic/goldfish/fstab.goldfish:root/fstab.goldfish \
     device/generic/goldfish/init.goldfish.rc:root/init.goldfish.rc \
     device/generic/goldfish/init.goldfish.sh:system/etc/init.goldfish.sh \
+    device/generic/goldfish/init.ranchu-core.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-core.sh \
+    device/generic/goldfish/init.ranchu-net.sh:$(TARGET_COPY_OUT_VENDOR)/bin/init.ranchu-net.sh \
+    device/generic/goldfish/init.ranchu.rc:root/init.ranchu.rc \
     device/generic/goldfish/ueventd.goldfish.rc:root/ueventd.goldfish.rc \
     device/generic/goldfish/init.ranchu.rc:root/init.ranchu.rc \
     device/generic/goldfish/fstab.ranchu:root/fstab.ranchu \
     device/generic/goldfish/ueventd.ranchu.rc:root/ueventd.ranchu.rc \
+    device/generic/goldfish/manifest.xml:$(TARGET_COPY_OUT_VENDOR)/manifest.xml \
     device/generic/goldfish/input/goldfish_rotary.idc:system/usr/idc/goldfish_rotary.idc \
     frameworks/native/data/etc/android.hardware.usb.accessory.xml:system/etc/permissions/android.hardware.usb.accessory.xml
 
diff --git a/tools/post_process_props.py b/tools/post_process_props.py
index 83c6f9a..9355e4b 100755
--- a/tools/post_process_props.py
+++ b/tools/post_process_props.py
@@ -35,7 +35,7 @@
 def mangle_default_prop_override(prop):
   pass
 
-# Put the modifications that you need to make into the /default.prop into this
+# Put the modifications that you need to make into the /system/etc/prop.default into this
 # function. The prop object has get(name) and put(name,value) methods.
 def mangle_default_prop(prop):
   # If ro.debuggable is 1, then enable adb on USB by default
@@ -122,7 +122,8 @@
   elif (filename.endswith("/vendor/default.prop") or
         filename.endswith("/odm/default.prop")):
     mangle_default_prop_override(properties)
-  elif filename.endswith("/default.prop"):
+  elif (filename.endswith("/default.prop") or # legacy
+        filename.endswith("/prop.default")):
     mangle_default_prop(properties)
   else:
     sys.stderr.write("bad command line: " + str(argv) + "\n")
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index a76c9c9..eff4ed2 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -225,11 +225,17 @@
     # System properties.
     elif info.filename in ("SYSTEM/build.prop",
                            "VENDOR/build.prop",
-                           "BOOT/RAMDISK/default.prop",
-                           "ROOT/default.prop",
-                           "RECOVERY/RAMDISK/default.prop"):
+                           "SYSTEM/etc/prop.default",
+                           "BOOT/RAMDISK/prop.default",
+                           "BOOT/RAMDISK/default.prop",  # legacy
+                           "ROOT/default.prop",  # legacy
+                           "RECOVERY/RAMDISK/prop.default",
+                           "RECOVERY/RAMDISK/default.prop"):  # legacy
       print "rewriting %s:" % (info.filename,)
-      new_data = RewriteProps(data, misc_info)
+      if stat.S_ISLNK(info.external_attr >> 16):
+        new_data = data
+      else:
+        new_data = RewriteProps(data, misc_info)
       common.ZipWriteStr(output_tf_zip, out_info, new_data)
 
     elif info.filename.endswith("mac_permissions.xml"):