diff --git a/agnos-firmware b/agnos-firmware
index f4c450d..cc4fe9e 160000
--- a/agnos-firmware
+++ b/agnos-firmware
@@ -1 +1 @@
-Subproject commit f4c450d90ed82cbceaa6d0b17a90827967ab6d02
+Subproject commit cc4fe9ed800d288929ab576c38d37a30c03d0e94
diff --git a/agnos-kernel-sdm845 b/agnos-kernel-sdm845
index fe3db27..2b4c012 160000
--- a/agnos-kernel-sdm845
+++ b/agnos-kernel-sdm845
@@ -1 +1 @@
-Subproject commit fe3db27e13e868335d90baf6d990763254b07a31
+Subproject commit 2b4c01261ed5ea77c5a7dad11e812e384b4fcd67
diff --git a/build_kernel.sh b/build_kernel.sh
index 2ea93a6..9080aca 100755
--- a/build_kernel.sh
+++ b/build_kernel.sh
@@ -45,7 +45,7 @@ cp $DIR/agnos-kernel-sdm845/out/arch/arm64/boot/Image.gz-dtb .
 $TOOLS/mkbootimg \
   --kernel Image.gz-dtb \
   --ramdisk /dev/null \
-  --cmdline "console=ttyMSM0,115200n8 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 video=DSI-1:1080x2160@60e mdss_mdp.panel=0:dsi:0:dsi_ss_ea8074_fhd_cmd_display ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 androidboot.selinux=permissive firmware_class.path=/lib/firmware/updates net.ifnames=0 dyndbg=\"\"" \
+  --cmdline "console=ttyMSM0,115200n8 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 video=DSI-1:1080x2160@60e ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 androidboot.selinux=permissive firmware_class.path=/lib/firmware/updates net.ifnames=0 dyndbg=\"\"" \
   --pagesize 4096 \
   --base 0x80000000 \
   --kernel_offset 0x8000 \
diff --git a/edk2_tici b/edk2_tici
index 00971d6..249a312 160000
--- a/edk2_tici
+++ b/edk2_tici
@@ -1 +1 @@
-Subproject commit 00971d64a756c55d2d0c31d3f90f5db67ee7d686
+Subproject commit 249a31223f76dd76b6ed3d11f7384619372c67e7
diff --git a/internal/README.md b/internal/README.md
index 9a79c72..9181616 100644
--- a/internal/README.md
+++ b/internal/README.md
@@ -12,7 +12,19 @@
 - [ ] factory reset
   - [ ] user-prompted reset
   - [ ] corrupt userdata
+  - [ ] finish ABL reset
 - [ ] color calibration
 - [ ] clean setup
 - [ ] cameras
 - [ ] update works on warm boot
+
+### ABL
+
+- [ ] fastboot USB enumeration
+- [ ] system reset trigger works
+- [ ] boot time hasn't regressed (3.8s)
+
+### XBL
+
+- [ ] display init works in cold and hot temperatures
+- [ ] boot time hasn't regressed (2.4s)
diff --git a/internal/ota_push.sh b/internal/ota_push.sh
index 517a53a..7e3d568 100755
--- a/internal/ota_push.sh
+++ b/internal/ota_push.sh
@@ -37,6 +37,10 @@ XBL_HASH=$(cat $OTA_JSON | jq -r ".[] | select(.name == \"xbl\") | .hash_raw")
 echo "Found xbl hash: $XBL_HASH"
 XBL_CONFIG_HASH=$(cat $OTA_JSON | jq -r ".[] | select(.name == \"xbl_config\") | .hash_raw")
 echo "Found xbl_config hash: $XBL_CONFIG_HASH"
+DEVCFG_HASH=$(cat $OTA_JSON | jq -r ".[] | select(.name == \"devcfg\") | .hash_raw")
+echo "Found devcfg hash: $DEVCFG_HASH"
+AOP_HASH=$(cat $OTA_JSON | jq -r ".[] | select(.name == \"aop\") | .hash_raw")
+echo "Found aop hash: $AOP_HASH"
 
 # Generate token
 echo "Logging in..."
@@ -51,6 +55,8 @@ BOOT_FILE_NAME="boot-$BOOT_HASH.img.xz"
 ABL_FILE_NAME="abl-$ABL_HASH.img.xz"
 XBL_FILE_NAME="xbl-$XBL_HASH.img.xz"
 XBL_CONFIG_FILE_NAME="xbl_config-$XBL_CONFIG_HASH.img.xz"
+DEVCFG_FILE_NAME="devcfg-$DEVCFG_HASH.img.xz"
+AOP_FILE_NAME="aop-$AOP_HASH.img.xz"
 
 echo "Copying system to the cloud..."
 SYSTEM_CLOUD_PATH="https://$DATA_ACCOUNT.blob.core.windows.net/$DATA_CONTAINER/$SYSTEM_FILE_NAME"
@@ -80,9 +86,19 @@ echo "Copying xbl_config to the cloud..."
 XBL_CONFIG_CLOUD_PATH="https://$DATA_ACCOUNT.blob.core.windows.net/$DATA_CONTAINER/$XBL_CONFIG_FILE_NAME"
 azcopy cp --overwrite=false $OTA_DIR/$XBL_CONFIG_FILE_NAME "$XBL_CONFIG_CLOUD_PATH?$DATA_SAS_TOKEN"
 
+echo "Copying devcfg to the cloud..."
+DEVCFG_CLOUD_PATH="https://$DATA_ACCOUNT.blob.core.windows.net/$DATA_CONTAINER/$DEVCFG_FILE_NAME"
+azcopy cp --overwrite=false $OTA_DIR/$DEVCFG_FILE_NAME "$DEVCFG_CLOUD_PATH?$DATA_SAS_TOKEN"
+
+echo "Copying aop to the cloud..."
+AOP_CLOUD_PATH="https://$DATA_ACCOUNT.blob.core.windows.net/$DATA_CONTAINER/$AOP_FILE_NAME"
+azcopy cp --overwrite=false $OTA_DIR/$AOP_FILE_NAME "$AOP_CLOUD_PATH?$DATA_SAS_TOKEN"
+
 echo "Done!"
 echo "  System path: $SYSTEM_CLOUD_PATH"
 echo "  Boot path: $BOOT_CLOUD_PATH"
 echo "  abl path: $ABL_CLOUD_PATH"
 echo "  xbl path: $XBL_CLOUD_PATH"
 echo "  xbl_config path: $XBL_CONFIG_CLOUD_PATH"
+echo "  devcfg path: $DEVCFG_CLOUD_PATH"
+echo "  aop path: $AOP_CLOUD_PATH"
diff --git a/internal/package_ota.sh b/internal/package_ota.sh
index b5b55b4..bcd1e42 100755
--- a/internal/package_ota.sh
+++ b/internal/package_ota.sh
@@ -15,6 +15,8 @@ BOOT_IMAGE="$OUTPUT_DIR/boot.img"
 ABL_IMAGE="$FIRMWARE_DIR/abl.bin"
 XBL_IMAGE="$FIRMWARE_DIR/xbl.bin"
 XBL_CONFIG_IMAGE="$FIRMWARE_DIR/xbl_config.bin"
+DEVCFG_IMAGE="$FIRMWARE_DIR/devcfg.bin"
+AOP_IMAGE="$FIRMWARE_DIR/aop.bin"
 
 AGNOS_UPDATE_URL=${AGNOS_UPDATE_URL:-https://commadist.azureedge.net/agnosupdate}
 AGNOS_STAGING_UPDATE_URL=${AGNOS_STAGING_UPDATE_URL:-https://commadist.azureedge.net/agnosupdate-staging}
@@ -53,12 +55,22 @@ echo "Hashing xbl_config..."
 XBL_CONFIG_HASH=$(sha256sum $XBL_CONFIG_IMAGE | cut -c 1-64)
 XBL_CONFIG_SIZE=$(wc -c < $XBL_CONFIG_IMAGE)
 
+echo "Hashing devcfg..."
+DEVCFG_HASH=$(sha256sum $DEVCFG_IMAGE | cut -c 1-64)
+DEVCFG_SIZE=$(wc -c < $DEVCFG_IMAGE)
+
+echo "Hashing aop..."
+AOP_HASH=$(sha256sum $AOP_IMAGE | cut -c 1-64)
+AOP_SIZE=$(wc -c < $AOP_IMAGE)
+
 # Compressing
 SYSTEM_ARCHIVE=$OTA_OUTPUT_DIR/system-$SYSTEM_HASH.img.xz
 BOOT_ARCHIVE=$OTA_OUTPUT_DIR/boot-$BOOT_HASH.img.xz
 ABL_ARCHIVE=$OTA_OUTPUT_DIR/abl-$ABL_HASH.img.xz
 XBL_ARCHIVE=$OTA_OUTPUT_DIR/xbl-$XBL_HASH.img.xz
 XBL_CONFIG_ARCHIVE=$OTA_OUTPUT_DIR/xbl_config-$XBL_CONFIG_HASH.img.xz
+DEVCFG_ARCHIVE=$OTA_OUTPUT_DIR/devcfg-$DEVCFG_HASH.img.xz
+AOP_ARCHIVE=$OTA_OUTPUT_DIR/aop-$AOP_HASH.img.xz
 
 echo "Compressing system..."
 xz -vc $SYSTEM_IMAGE > $SYSTEM_ARCHIVE
@@ -70,6 +82,10 @@ echo "Compressing xbl..."
 xz -vc $XBL_IMAGE > $XBL_ARCHIVE
 echo "Compressing xbl_config..."
 xz -vc $XBL_CONFIG_IMAGE > $XBL_CONFIG_ARCHIVE
+echo "Compressing devcfg..."
+xz -vc $DEVCFG_IMAGE > $DEVCFG_ARCHIVE
+echo "Compressing aop..."
+xz -vc $AOP_IMAGE > $AOP_ARCHIVE
 echo "Creating system casync files"
 casync make --compression=xz --store $OTA_OUTPUT_DIR/system-$SYSTEM_HASH $OTA_OUTPUT_DIR/system-$SYSTEM_HASH.caibx $SYSTEM_IMAGE_RAW
 rm $SYSTEM_IMAGE_RAW
@@ -118,6 +134,26 @@ tee $OUTPUT_JSON > /dev/null <<EOM
     "full_check": true,
     "has_ab": true
   },
+  {
+    "name": "devcfg",
+    "url": "$AGNOS_UPDATE_URL/devcfg-$DEVCFG_HASH.img.xz",
+    "hash": "$DEVCFG_HASH",
+    "hash_raw": "$DEVCFG_HASH",
+    "size": $DEVCFG_SIZE,
+    "sparse": false,
+    "full_check": true,
+    "has_ab": true
+  },
+  {
+    "name": "aop",
+    "url": "$AGNOS_UPDATE_URL/aop-$AOP_HASH.img.xz",
+    "hash": "$AOP_HASH",
+    "hash_raw": "$AOP_HASH",
+    "size": $AOP_SIZE,
+    "sparse": false,
+    "full_check": true,
+    "has_ab": true
+  },
   {
     "name": "system",
     "url": "$AGNOS_UPDATE_URL/system-$SYSTEM_HASH.img.xz",
@@ -176,6 +212,26 @@ tee $OUTPUT_STAGING_JSON > /dev/null <<EOM
     "full_check": true,
     "has_ab": true
   },
+  {
+    "name": "devcfg",
+    "url": "$AGNOS_STAGING_UPDATE_URL/devcfg-$DEVCFG_HASH.img.xz",
+    "hash": "$DEVCFG_HASH",
+    "hash_raw": "$DEVCFG_HASH",
+    "size": $DEVCFG_SIZE,
+    "sparse": false,
+    "full_check": true,
+    "has_ab": true
+  },
+  {
+    "name": "aop",
+    "url": "$AGNOS_STAGING_UPDATE_URL/aop-$AOP_HASH.img.xz",
+    "hash": "$AOP_HASH",
+    "hash_raw": "$AOP_HASH",
+    "size": $AOP_SIZE,
+    "sparse": false,
+    "full_check": true,
+    "has_ab": true
+  },
   {
     "name": "system",
     "url": "$AGNOS_STAGING_UPDATE_URL/system-$SYSTEM_HASH.img.xz",
@@ -197,4 +253,6 @@ echo "  System hash: $SYSTEM_HASH"
 echo "  Boot hash: $BOOT_HASH"
 echo "  abl hash: $ABL_HASH"
 echo "  xbl hash: $XBL_HASH"
-echo "  xbl_config hash: $XBL_CONFIG_HASH"
\ No newline at end of file
+echo "  xbl_config hash: $XBL_CONFIG_HASH"
+echo "  devcfg hash: $DEVCFG_HASH"
+echo "  aop hash: $AOP_HASH"
\ No newline at end of file