diff --git a/core/Makefile b/core/Makefile
index 92f9b9c..0d6b175 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -768,10 +768,7 @@
 # $5 partition tag
 # $6 output file
 define _apkcerts_write_line
-$(hide) echo -n 'name="$(1).apk" certificate="$2" private_key="$3"' >> $6
-$(if $(4), $(hide) echo -n ' compressed="$4"' >> $6)
-$(if $(5), $(hide) echo -n ' partition="$5"' >> $6)
-$(hide) echo '' >> $6
+$(hide) echo 'name="$(1).apk" certificate="$2" private_key="$3"$(if $(4), compressed="$4")$(if $(5), partition="$5")' >> $6
 
 endef
 
@@ -842,16 +839,6 @@
 
 
 # -----------------------------------------------------------------
-# build system stats
-BUILD_SYSTEM_STATS := $(PRODUCT_OUT)/build_system_stats.txt
-$(BUILD_SYSTEM_STATS):
-	@rm -f $@
-	@$(foreach s,$(STATS.MODULE_TYPE),echo "modules_type_make,$(s),$(words $(STATS.MODULE_TYPE.$(s)))" >>$@;)
-	@$(foreach s,$(STATS.SOONG_MODULE_TYPE),echo "modules_type_soong,$(s),$(STATS.SOONG_MODULE_TYPE.$(s))" >>$@;)
-$(call declare-1p-target,$(BUILD_SYSTEM_STATS),build)
-$(call dist-for-goals,droidcore-unbundled,$(BUILD_SYSTEM_STATS))
-
-# -----------------------------------------------------------------
 # build /product/etc/security/avb/system_other.avbpubkey if needed
 ifdef BUILDING_SYSTEM_OTHER_IMAGE
 ifeq ($(BOARD_AVB_ENABLE),true)
@@ -926,18 +913,6 @@
 
 $(call dist-for-goals,droidcore-unbundled,$(WALL_WERROR))
 
-# -----------------------------------------------------------------
-# Modules missing profile files
-PGO_PROFILE_MISSING := $(PRODUCT_OUT)/pgo_profile_file_missing.txt
-$(PGO_PROFILE_MISSING):
-	@rm -f $@
-	echo "# Modules missing PGO profile files" >> $@
-	for m in $(SOONG_MODULES_MISSING_PGO_PROFILE_FILE); do echo $$m >> $@; done
-
-$(call declare-0p-target,$(PGO_PROFILE_MISSING))
-
-$(call dist-for-goals,droidcore,$(PGO_PROFILE_MISSING))
-
 CERTIFICATE_VIOLATION_MODULES_FILENAME := $(PRODUCT_OUT)/certificate_violation_modules.txt
 $(CERTIFICATE_VIOLATION_MODULES_FILENAME):
 	rm -f $@
@@ -1223,55 +1198,6 @@
 endif # BOARD_PREBUILT_DTBOIMAGE_16KB
 
 
-ifneq ($(BOARD_KERNEL_PATH_16K),)
-BUILT_KERNEL_16K_TARGET := $(PRODUCT_OUT)/kernel_16k
-
-$(eval $(call copy-one-file,$(BOARD_KERNEL_PATH_16K),$(BUILT_KERNEL_16K_TARGET)))
-
-# Copies BOARD_KERNEL_PATH_16K to output directory as is
-kernel_16k: $(BUILT_KERNEL_16K_TARGET)
-.PHONY: kernel_16k
-
-BUILT_BOOTIMAGE_16K_TARGET := $(PRODUCT_OUT)/boot_16k.img
-
-BOARD_KERNEL_16K_BOOTIMAGE_PARTITION_SIZE := $(BOARD_BOOTIMAGE_PARTITION_SIZE)
-
-$(BUILT_BOOTIMAGE_16K_TARGET): $(MKBOOTIMG) $(AVBTOOL) $(INTERNAL_BOOTIMAGE_FILES) $(BOARD_AVB_BOOT_KEY_PATH) $(BUILT_KERNEL_16K_TARGET)
-	$(call pretty,"Target boot 16k image: $@")
-	$(call build_boot_from_kernel_avb_enabled,$@,$(BUILT_KERNEL_16K_TARGET))
-
-
-bootimage_16k: $(BUILT_BOOTIMAGE_16K_TARGET)
-.PHONY: bootimage_16k
-
-BUILT_BOOT_OTA_PACKAGE_16K := $(PRODUCT_OUT)/boot_ota_16k.zip
-$(BUILT_BOOT_OTA_PACKAGE_16K):  $(OTA_FROM_RAW_IMG) \
-                                $(BUILT_BOOTIMAGE_16K_TARGET) \
-                                $(INSTALLED_BOOTIMAGE_TARGET) \
-                                $(DEFAULT_SYSTEM_DEV_CERTIFICATE).pk8 \
-                                $(INSTALLED_DTBOIMAGE_16KB_TARGET) \
-                                $(INSTALLED_DTBOIMAGE_TARGET)
-	$(OTA_FROM_RAW_IMG) --package_key $(DEFAULT_SYSTEM_DEV_CERTIFICATE) \
-                      --max_timestamp `cat $(BUILD_DATETIME_FILE)` \
-                      --path $(HOST_OUT) \
-                      --partition_name $(if $(and $(INSTALLED_DTBOIMAGE_TARGET),\
-                          $(INSTALLED_DTBOIMAGE_16KB_TARGET)),\
-                        boot$(comma)dtbo,\
-                        boot) \
-                      --output $@ \
-                      $(if $(BOARD_16K_OTA_USE_INCREMENTAL),\
-                        $(INSTALLED_BOOTIMAGE_TARGET):$(BUILT_BOOTIMAGE_16K_TARGET),\
-                        $(BUILT_BOOTIMAGE_16K_TARGET)\
-                      )\
-                      $(if $(and $(INSTALLED_DTBOIMAGE_TARGET),$(INSTALLED_DTBOIMAGE_16KB_TARGET)),\
-                        $(INSTALLED_DTBOIMAGE_16KB_TARGET))
-
-boototapackage_16k: $(BUILT_BOOT_OTA_PACKAGE_16K)
-.PHONY: boototapackage_16k
-
-endif
-
-
 ramdisk_intermediates :=$= $(call intermediates-dir-for,PACKAGING,ramdisk)
 $(eval $(call write-partition-file-list,$(ramdisk_intermediates)/file_list.txt,$(TARGET_RAMDISK_OUT),$(INTERNAL_RAMDISK_FILES)))
 
@@ -1508,6 +1434,55 @@
 endif # my_installed_prebuilt_gki_apex not defined
 
 ifneq ($(BOARD_KERNEL_PATH_16K),)
+
+BUILT_KERNEL_16K_TARGET := $(PRODUCT_OUT)/kernel_16k
+
+$(eval $(call copy-one-file,$(BOARD_KERNEL_PATH_16K),$(BUILT_KERNEL_16K_TARGET)))
+
+# Copies BOARD_KERNEL_PATH_16K to output directory as is
+kernel_16k: $(BUILT_KERNEL_16K_TARGET)
+.PHONY: kernel_16k
+
+BUILT_BOOTIMAGE_16K_TARGET := $(PRODUCT_OUT)/boot_16k.img
+
+BOARD_KERNEL_16K_BOOTIMAGE_PARTITION_SIZE := $(BOARD_BOOTIMAGE_PARTITION_SIZE)
+
+$(BUILT_BOOTIMAGE_16K_TARGET): $(MKBOOTIMG) $(AVBTOOL) $(INTERNAL_BOOTIMAGE_FILES) $(BOARD_AVB_BOOT_KEY_PATH) $(BUILT_KERNEL_16K_TARGET)
+	$(call pretty,"Target boot 16k image: $@")
+	$(call build_boot_from_kernel_avb_enabled,$@,$(BUILT_KERNEL_16K_TARGET))
+
+
+bootimage_16k: $(BUILT_BOOTIMAGE_16K_TARGET)
+.PHONY: bootimage_16k
+
+BUILT_BOOT_OTA_PACKAGE_16K := $(PRODUCT_OUT)/boot_ota_16k.zip
+$(BUILT_BOOT_OTA_PACKAGE_16K): PRIVATE_BOOTIMAGE_TARGET := $(INSTALLED_BOOTIMAGE_TARGET)
+$(BUILT_BOOT_OTA_PACKAGE_16K): PRIVATE_BOOTIMAGE_16KB_TARGET := $(BUILT_BOOTIMAGE_16K_TARGET)
+$(BUILT_BOOT_OTA_PACKAGE_16K):  $(OTA_FROM_RAW_IMG) \
+                                $(DEFAULT_SYSTEM_DEV_CERTIFICATE).pk8 \
+                                $(INSTALLED_BOOTIMAGE_TARGET) \
+                                $(BUILT_BOOTIMAGE_16K_TARGET) \
+                                $(INSTALLED_DTBOIMAGE_16KB_TARGET) \
+                                $(INSTALLED_DTBOIMAGE_TARGET)
+	$(OTA_FROM_RAW_IMG) --package_key $(DEFAULT_SYSTEM_DEV_CERTIFICATE) \
+                      --max_timestamp `cat $(BUILD_DATETIME_FILE)` \
+                      --path $(HOST_OUT) \
+                      --partition_name $(if $(and $(INSTALLED_DTBOIMAGE_TARGET),\
+                          $(INSTALLED_DTBOIMAGE_16KB_TARGET)),\
+                        boot$(comma)dtbo,\
+                        boot) \
+                      --output $@ \
+                      $(if $(BOARD_16K_OTA_USE_INCREMENTAL),\
+                        $(PRIVATE_BOOTIMAGE_TARGET):$(PRIVATE_BOOTIMAGE_16KB_TARGET),\
+                        $(PRIVATE_BOOTIMAGE_16KB_TARGET)\
+                      )\
+                      $(if $(and $(INSTALLED_DTBOIMAGE_TARGET),$(INSTALLED_DTBOIMAGE_16KB_TARGET)),\
+                        $(INSTALLED_DTBOIMAGE_16KB_TARGET))
+
+boototapackage_16k: $(BUILT_BOOT_OTA_PACKAGE_16K)
+.PHONY: boototapackage_16k
+
+
 BUILT_BOOT_OTA_PACKAGE_4K := $(PRODUCT_OUT)/boot_ota_4k.zip
 $(BUILT_BOOT_OTA_PACKAGE_4K): $(OTA_FROM_RAW_IMG) \
                               $(INSTALLED_BOOTIMAGE_TARGET) \
@@ -1536,11 +1511,26 @@
 ifeq ($(BOARD_16K_OTA_MOVE_VENDOR),true)
 $(eval $(call copy-one-file,$(BUILT_BOOT_OTA_PACKAGE_4K),$(TARGET_OUT_VENDOR)/boot_otas/boot_ota_4k.zip))
 $(eval $(call copy-one-file,$(BUILT_BOOT_OTA_PACKAGE_16K),$(TARGET_OUT_VENDOR)/boot_otas/boot_ota_16k.zip))
+
 ALL_DEFAULT_INSTALLED_MODULES += $(TARGET_OUT_VENDOR)/boot_otas/boot_ota_4k.zip
 ALL_DEFAULT_INSTALLED_MODULES += $(TARGET_OUT_VENDOR)/boot_otas/boot_ota_16k.zip
+
+ifneq ($(BOARD_VENDOR_KERNEL_MODULES_2ND_STAGE_16KB_MODE),)
+# Add the modules that need to be loaded in the Second Boot Stage
+# to /vendor_dlkm/lib/modules/16k-mode
+VENDOR_DLKM_16K_MODE_DIR := lib/modules/16k-mode
+$(foreach module,$(BOARD_VENDOR_KERNEL_MODULES_2ND_STAGE_16KB_MODE), \
+    $(eval $(call copy-one-file,$(TARGET_KERNEL_DIR_16K)/$(module),\
+                                $(TARGET_OUT_VENDOR_DLKM)/$(VENDOR_DLKM_16K_MODE_DIR)/$(module))))
+
+ALL_DEFAULT_INSTALLED_MODULES += $(foreach module,$(BOARD_VENDOR_KERNEL_MODULES_2ND_STAGE_16KB_MODE),\
+    $(TARGET_OUT_VENDOR_DLKM)/$(VENDOR_DLKM_16K_MODE_DIR)/$(module))
+endif # BOARD_VENDOR_KERNEL_MODULES_2ND_STAGE_16KB_MODE not empty
+
 else
 $(eval $(call copy-one-file,$(BUILT_BOOT_OTA_PACKAGE_4K),$(TARGET_OUT)/boot_otas/boot_ota_4k.zip))
 $(eval $(call copy-one-file,$(BUILT_BOOT_OTA_PACKAGE_16K),$(TARGET_OUT)/boot_otas/boot_ota_16k.zip))
+
 ALL_DEFAULT_INSTALLED_MODULES += $(TARGET_OUT)/boot_otas/boot_ota_4k.zip
 ALL_DEFAULT_INSTALLED_MODULES += $(TARGET_OUT)/boot_otas/boot_ota_16k.zip
 endif # BOARD_16K_OTA_MOVE_VENDOR == true
@@ -1797,6 +1787,7 @@
 INTERNAL_VENDOR_KERNEL_RAMDISK_TARGET := $(call intermediates-dir-for,PACKAGING,vendor_kernel_boot)/vendor_kernel_ramdisk.cpio$(RAMDISK_EXT)
 
 $(INTERNAL_VENDOR_KERNEL_RAMDISK_TARGET): $(MKBOOTFS) $(INTERNAL_VENDOR_KERNEL_RAMDISK_FILES) | $(COMPRESSION_COMMAND_DEPS)
+	$(hide) : $(words $(INTERNAL_VENDOR_KERNEL_RAMDISK_FILES))
 	$(MKBOOTFS) -d $(TARGET_OUT) $(TARGET_VENDOR_KERNEL_RAMDISK_OUT) | $(COMPRESSION_COMMAND) > $@
 
 INSTALLED_VENDOR_KERNEL_RAMDISK_TARGET := $(PRODUCT_OUT)/vendor_kernel_ramdisk.img
@@ -7959,6 +7950,18 @@
 	$(INSTALLED_USERDATAIMAGE_TARGET)
 
 # -----------------------------------------------------------------
+# Desktop generated firmware filesystem.
+TARGET_PRODUCT_FW_IMAGE_PACKAGE := prebuilt-$(TARGET_PRODUCT)-firmware-image
+GENERATED_FW_IMAGE := $(PRODUCT_OUT)/product/etc/$(TARGET_PRODUCT)-firmware.img
+
+generated_fw_image_found := $(strip $(foreach pp,$(PRODUCT_PACKAGES),\
+	$(if $(findstring $(TARGET_PRODUCT_FW_IMAGE_PACKAGE),$(pp)),$(pp))))
+
+ifneq (,$(generated_fw_image_found))
+$(call dist-for-goals,dist_files,$(GENERATED_FW_IMAGE))
+endif
+
+# -----------------------------------------------------------------
 # Desktop pack image hook.
 ifneq (,$(strip $(PACK_DESKTOP_FILESYSTEM_IMAGES)))
 PACK_IMAGE_TARGET := $(PRODUCT_OUT)/android-desktop_image.bin
@@ -8076,7 +8079,7 @@
 allimages_zip := $(PRODUCT_OUT)/all_images.zip
 $(allimages_zip): PRIVATE_SOONG_ZIP_ARGUMENTS := $(allimages_soong_zip_args)
 $(allimages_zip): $(SOONG_ZIP) $(allimages_deps)
-	$(SOONG_ZIP) -o $@ --sort_entries $(PRIVATE_SOONG_ZIP_ARGUMENTS)
+	$(SOONG_ZIP) -o $@ $(PRIVATE_SOONG_ZIP_ARGUMENTS)
 
 .PHONY: soong_only_diff_test
 soong_only_diff_test: PRIVATE_ALLIMAGES_ZIP := $(allimages_zip)
diff --git a/core/android_soong_config_vars.mk b/core/android_soong_config_vars.mk
index 6fbc255..6aea680 100644
--- a/core/android_soong_config_vars.mk
+++ b/core/android_soong_config_vars.mk
@@ -325,3 +325,8 @@
 # Variables for extra branches
 # TODO(b/383238397): Use bootstrap_go_package to enable extra flags.
 -include vendor/google/build/extra_soong_config_vars.mk
+
+# Variable for CI test packages
+ifneq ($(filter arm x86 true,$(TARGET_ARCH) $(TARGET_2ND_ARCH) $(TARGET_ENABLE_MEDIADRM_64)),)
+  $(call soong_config_set_bool,ci_tests,uses_widevine_tests, true)
+endif
diff --git a/core/base_rules.mk b/core/base_rules.mk
index 5363e0f..9ffe518 100644
--- a/core/base_rules.mk
+++ b/core/base_rules.mk
@@ -861,13 +861,6 @@
       $(eval my_compat_dist_config_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
         $(LOCAL_PATH)/DynamicConfig.xml:$(dir)/$(LOCAL_MODULE).dynamic)))
   endif
-
-  ifneq (,$(wildcard $(LOCAL_PATH)/$(LOCAL_MODULE)_*.config))
-  $(foreach extra_config, $(wildcard $(LOCAL_PATH)/$(LOCAL_MODULE)_*.config), \
-    $(foreach suite, $(LOCAL_COMPATIBILITY_SUITE), \
-      $(eval my_compat_dist_config_$(suite) += $(foreach dir, $(call compatibility_suite_dirs,$(suite)), \
-        $(extra_config):$(dir)/$(notdir $(extra_config))))))
-  endif
 endif # $(my_prefix)$(LOCAL_MODULE_CLASS)_$(LOCAL_MODULE)_compat_files
 
 
@@ -938,12 +931,6 @@
     my_supported_variant := DEVICE
   endif
 endif
-###########################################################
-## Add test module to ALL_DISABLED_PRESUBMIT_TESTS if LOCAL_PRESUBMIT_DISABLED is set to true.
-###########################################################
-ifeq ($(LOCAL_PRESUBMIT_DISABLED),true)
-  ALL_DISABLED_PRESUBMIT_TESTS += $(LOCAL_MODULE)
-endif  # LOCAL_PRESUBMIT_DISABLED
 
 ###########################################################
 ## Register with ALL_MODULES
diff --git a/core/clear_vars.mk b/core/clear_vars.mk
index fed19e6..2e67aff 100644
--- a/core/clear_vars.mk
+++ b/core/clear_vars.mk
@@ -204,7 +204,6 @@
 LOCAL_PREBUILT_STATIC_JAVA_LIBRARIES:=
 LOCAL_USE_EMBEDDED_DEX:=
 LOCAL_USE_EMBEDDED_NATIVE_LIBS:=
-LOCAL_PRESUBMIT_DISABLED:=
 LOCAL_PRIVATE_PLATFORM_APIS:=
 LOCAL_PRIVILEGED_MODULE:=
 LOCAL_PROC_MACRO_LIBRARIES:=
diff --git a/core/definitions.mk b/core/definitions.mk
index ade8a9c..40f5af0 100644
--- a/core/definitions.mk
+++ b/core/definitions.mk
@@ -90,9 +90,6 @@
 # All installed vintf manifest fragments for a partition at
 ALL_VINTF_MANIFEST_FRAGMENTS_LIST:=
 
-# All tests that should be skipped in presubmit check.
-ALL_DISABLED_PRESUBMIT_TESTS :=
-
 # All compatibility suites mentioned in LOCAL_COMPATIBILITY_SUITE
 ALL_COMPATIBILITY_SUITES :=
 
diff --git a/core/main.mk b/core/main.mk
index 41a36ca..9710dc8 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -1467,7 +1467,6 @@
 # dist_files only for putting your library into the dist directory with a full build.
 .PHONY: dist_files
 
-$(call dist-for-goals, dist_files, $(SOONG_OUT_DIR)/module_bp_java_deps.json)
 $(call dist-for-goals, dist_files, $(PRODUCT_OUT)/module-info.json)
 
 .PHONY: apps_only
diff --git a/core/proguard.flags b/core/proguard.flags
index dc32e15..76655ca 100644
--- a/core/proguard.flags
+++ b/core/proguard.flags
@@ -30,12 +30,12 @@
 # Needed to ensure callback field references are kept in their respective
 # owning classes when the downstream callback registrars only store weak refs.
 -if @com.android.internal.annotations.WeaklyReferencedCallback class *
--keepclassmembers,allowaccessmodification class * {
-  <1> *;
+-keepclassmembers,allowaccessmodification,allowobfuscation,allowshrinking class * {
+  !synthetic <1> *;
 }
 -if class * extends @com.android.internal.annotations.WeaklyReferencedCallback **
--keepclassmembers,allowaccessmodification class * {
-  <1> *;
+-keepclassmembers,allowaccessmodification,allowobfuscation,allowshrinking class * {
+  !synthetic <1> *;
 }
 
 # Understand the common @Keep annotation from various Android packages:
diff --git a/core/proguard/checknotnull.flags b/core/proguard/checknotnull.flags
new file mode 100644
index 0000000..1e1e5ce
--- /dev/null
+++ b/core/proguard/checknotnull.flags
@@ -0,0 +1,25 @@
+# Tell R8 that the following methods are check not null methods, and to
+# replace invocations to them with a more concise nullness check that produces
+# (slightly) less informative error messages
+
+-convertchecknotnull class com.google.common.base.Preconditions {
+  ** checkNotNull(...);
+}
+
+-convertchecknotnull class java.util.Objects {
+  ** requireNonNull(...);
+}
+
+-convertchecknotnull class kotlin.jvm.internal.Intrinsics {
+  void checkNotNull(...);
+  void checkExpressionValueIsNotNull(...);
+  void checkNotNullExpressionValue(...);
+  void checkReturnedValueIsNotNull(...);
+  void checkFieldIsNotNull(...);
+  void checkParameterIsNotNull(...);
+  void checkNotNullParameter(...);
+}
+
+-convertchecknotnull class dagger.internal.Preconditions {
+  ** checkNotNull*(...);
+}
diff --git a/core/tasks/test_mapping.mk b/core/tasks/test_mapping.mk
deleted file mode 100644
index eb2a585..0000000
--- a/core/tasks/test_mapping.mk
+++ /dev/null
@@ -1,40 +0,0 @@
-# Copyright (C) 2017 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Create an artifact to include TEST_MAPPING files in source tree. Also include
-# a file (out/disabled-presubmit-tests) containing the tests that should be
-# skipped in presubmit check.
-
-.PHONY: test_mapping
-
-intermediates := $(call intermediates-dir-for,PACKAGING,test_mapping)
-test_mappings_zip := $(intermediates)/test_mappings.zip
-test_mapping_list := $(OUT_DIR)/.module_paths/TEST_MAPPING.list
-$(test_mappings_zip) : PRIVATE_all_disabled_presubmit_tests := $(ALL_DISABLED_PRESUBMIT_TESTS)
-$(test_mappings_zip) : PRIVATE_test_mapping_list := $(test_mapping_list)
-
-$(test_mappings_zip) : .KATI_DEPFILE := $(test_mappings_zip).d
-$(test_mappings_zip) : $(test_mapping_list) $(SOONG_ZIP)
-	@echo "Building artifact to include TEST_MAPPING files and tests to skip in presubmit check."
-	rm -rf $@ $(dir $@)/disabled-presubmit-tests
-	echo $(sort $(PRIVATE_all_disabled_presubmit_tests)) | tr " " "\n" > $(dir $@)/disabled-presubmit-tests
-	$(SOONG_ZIP) -o $@ -C . -l $(PRIVATE_test_mapping_list) -C $(dir $@) -f $(dir $@)/disabled-presubmit-tests
-	echo "$@ : " $$(cat $(PRIVATE_test_mapping_list)) > $@.d
-	rm -f $(dir $@)/disabled-presubmit-tests
-
-test_mapping : $(test_mappings_zip)
-
-$(call dist-for-goals, dist_files test_mapping,$(test_mappings_zip))
-
-$(call declare-1p-target,$(test_mappings_zip),)
diff --git a/core/tasks/tradefed-tests-list.mk b/core/tasks/tradefed-tests-list.mk
index 47c360d..e437f89 100644
--- a/core/tasks/tradefed-tests-list.mk
+++ b/core/tasks/tradefed-tests-list.mk
@@ -18,11 +18,19 @@
 COMPATIBILITY.tradefed_tests_dir := \
   $(COMPATIBILITY.tradefed_tests_dir) \
   tools/tradefederation/core/res/config \
-  tools/tradefederation/core/javatests/res/config
+  tools/tradefederation/core/javatests/res/config \
+  vendor/google_tradefederation/contrib/res/config \
+  vendor/google_tradefederation/core/res/config \
+  vendor/google_tradefederation/core/javatests/res/config \
+  vendor/google_tradefederation/core/prod_tests/res/config
 
 tradefed_tests :=
 $(foreach dir, $(COMPATIBILITY.tradefed_tests_dir), \
-  $(eval tradefed_tests += $(shell find $(dir) -type f -name "*.xml")))
+  $(if $(wildcard $(dir)/*), \
+    $(eval tradefed_tests += $(shell find $(dir) -type f -name "*.xml")) \
+  ) \
+)
+
 tradefed_tests_list_intermediates := $(call intermediates-dir-for,PACKAGING,tradefed_tests_list,HOST,COMMON)
 tradefed_tests_list_zip := $(tradefed_tests_list_intermediates)/tradefed-tests_list.zip
 all_tests :=
diff --git a/envsetup.sh b/envsetup.sh
index 554a220..c040311 100644
--- a/envsetup.sh
+++ b/envsetup.sh
@@ -438,68 +438,6 @@
     echo
 }
 
-function lunch()
-{
-    local answer
-    setup_cog_env_if_needed
-
-    if [[ $# -gt 1 ]]; then
-        echo "usage: lunch [target]" >&2
-        return 1
-    fi
-
-    local used_lunch_menu=0
-
-    if [ "$1" ]; then
-        answer=$1
-    else
-        print_lunch_menu
-        echo "Which would you like? [aosp_cf_x86_64_phone-trunk_staging-eng]"
-        echo -n "Pick from common choices above (e.g. 13) or specify your own (e.g. aosp_barbet-trunk_staging-eng): "
-        read answer
-        used_lunch_menu=1
-    fi
-
-    local selection=
-
-    if [ -z "$answer" ]
-    then
-        selection=aosp_cf_x86_64_phone-trunk_staging-eng
-    elif (echo -n $answer | grep -q -e "^[0-9][0-9]*$")
-    then
-        local choices=($(TARGET_BUILD_APPS= TARGET_PRODUCT= TARGET_RELEASE= TARGET_BUILD_VARIANT= _get_build_var_cached COMMON_LUNCH_CHOICES 2>/dev/null))
-        if [ $answer -le ${#choices[@]} ]
-        then
-            # array in zsh starts from 1 instead of 0.
-            if [ -n "$ZSH_VERSION" ]
-            then
-                selection=${choices[$(($answer))]}
-            else
-                selection=${choices[$(($answer-1))]}
-            fi
-        fi
-    else
-        selection=$answer
-    fi
-
-    export TARGET_BUILD_APPS=
-
-    # This must be <product>-<release>-<variant>
-    local product release variant
-    # Split string on the '-' character.
-    IFS="-" read -r product release variant <<< "$selection"
-
-    if [[ -z "$product" ]] || [[ -z "$release" ]] || [[ -z "$variant" ]]
-    then
-        echo
-        echo "Invalid lunch combo: $selection"
-        echo "Valid combos must be of the form <product>-<release>-<variant>"
-        return 1
-    fi
-
-    _lunch_meat $product $release $variant
-}
-
 function _lunch_meat()
 {
     local product=$1
@@ -582,13 +520,13 @@
         echo "Note that the previous interactive menu and list of hard-coded"
         echo "list of curated targets has been removed. If you would like the"
         echo "list of products, release configs for a particular product, or"
-        echo "variants, run list_products, list_release_configs, list_variants"
+        echo "variants, run list_products list_releases or list_variants"
         echo "respectively."
         echo
     ) 1>&2
 }
 
-function lunch2()
+function lunch()
 {
     if [[ $# -eq 1 && $1 = "--help" ]]; then
         _lunch_usage
diff --git a/target/product/OWNERS b/target/product/OWNERS
index 48d3f2a..276c885 100644
--- a/target/product/OWNERS
+++ b/target/product/OWNERS
@@ -8,3 +8,6 @@
 per-file go_defaults.mk = gkaiser@google.com, kushg@google.com, rajekumar@google.com
 per-file go_defaults_512.mk = gkaiser@google.com, kushg@google.com, rajekumar@google.com
 per-file go_defaults_common.mk = gkaiser@google.com, kushg@google.com, rajekumar@google.com
+
+# Translation
+per-file languages_default.mk = aapple@google.com
diff --git a/target/product/generic/Android.bp b/target/product/generic/Android.bp
index 12abea9..5bfff66 100644
--- a/target/product/generic/Android.bp
+++ b/target/product/generic/Android.bp
@@ -880,11 +880,6 @@
                 default: [
                     "framework-connectivity-b", // base_system
                 ],
-            }) + select(release_flag("RELEASE_AVATAR_PICKER_APP"), {
-                true: [
-                    "AvatarPicker", // generic_system (RELEASE_AVATAR_PICKER_APP)
-                ],
-                default: [],
             }) + select(release_flag("RELEASE_UPROBESTATS_MODULE"), {
                 true: [
                     "com.android.uprobestats", // base_system (RELEASE_UPROBESTATS_MODULE)
diff --git a/target/product/gsi/Android.bp b/target/product/gsi/Android.bp
index dafbe46..8c200a1 100644
--- a/target/product/gsi/Android.bp
+++ b/target/product/gsi/Android.bp
@@ -209,4 +209,14 @@
         true: true,
         default: false,
     }),
+    multilib: {
+        common: {
+            deps: select(release_flag("RELEASE_AVATAR_PICKER_APP"), {
+                true: [
+                    "AvatarPicker", // handheld_system_ext (RELEASE_AVATAR_PICKER_APP)
+                ],
+                default: [],
+            }),
+        },
+    },
 }
diff --git a/target/product/handheld_system.mk b/target/product/handheld_system.mk
index 6799066..2b055c7 100644
--- a/target/product/handheld_system.mk
+++ b/target/product/handheld_system.mk
@@ -34,7 +34,6 @@
 
 PRODUCT_PACKAGES += \
     android.software.window_magnification.prebuilt.xml \
-    $(if $(RELEASE_AVATAR_PICKER_APP), AvatarPicker,) \
     BasicDreams \
     BlockedNumberProvider \
     BluetoothMidiService \
diff --git a/target/product/handheld_system_ext.mk b/target/product/handheld_system_ext.mk
index 187b627..6d686c5 100644
--- a/target/product/handheld_system_ext.mk
+++ b/target/product/handheld_system_ext.mk
@@ -23,6 +23,7 @@
 # /system_ext packages
 PRODUCT_PACKAGES += \
     AccessibilityMenu \
+    $(if $(RELEASE_AVATAR_PICKER_APP), AvatarPicker,) \
     Launcher3QuickStep \
     Provision \
     Settings \
diff --git a/tools/aconfig/Cargo.toml b/tools/aconfig/Cargo.toml
index bf5e1a9..a031b7f 100644
--- a/tools/aconfig/Cargo.toml
+++ b/tools/aconfig/Cargo.toml
@@ -8,7 +8,8 @@
     "aconfig_storage_read_api",
     "aconfig_storage_write_api",
     "aflags",
-    "printflags"
+    "printflags",
+    "convert_finalized_flags"
 ]
 
 resolver = "2"
diff --git a/tools/aconfig/aconfig/Android.bp b/tools/aconfig/aconfig/Android.bp
index cce0ca9..7bdec58 100644
--- a/tools/aconfig/aconfig/Android.bp
+++ b/tools/aconfig/aconfig/Android.bp
@@ -7,7 +7,10 @@
     edition: "2021",
     clippy_lints: "android",
     lints: "android",
-    srcs: ["src/main.rs"],
+    srcs: [
+        "src/main.rs",
+        ":finalized_flags_record.json",
+    ],
     rustlibs: [
         "libaconfig_protos",
         "libaconfig_storage_file",
@@ -18,6 +21,7 @@
         "libserde",
         "libserde_json",
         "libtinytemplate",
+        "libconvert_finalized_flags",
     ],
 }
 
diff --git a/tools/aconfig/aconfig/Cargo.toml b/tools/aconfig/aconfig/Cargo.toml
index abd3ee0..7e4bdf2 100644
--- a/tools/aconfig/aconfig/Cargo.toml
+++ b/tools/aconfig/aconfig/Cargo.toml
@@ -17,3 +17,11 @@
 tinytemplate = "1.2.1"
 aconfig_protos = { path = "../aconfig_protos" }
 aconfig_storage_file = { path = "../aconfig_storage_file" }
+convert_finalized_flags = { path = "../convert_finalized_flags" }
+
+[build-dependencies]
+anyhow = "1.0.69"
+itertools = "0.10.5"
+serde = { version = "1.0.152", features = ["derive"] }
+serde_json = "1.0.93"
+convert_finalized_flags = { path = "../convert_finalized_flags" }
diff --git a/tools/aconfig/aconfig/build.rs b/tools/aconfig/aconfig/build.rs
new file mode 100644
index 0000000..8aaec3c
--- /dev/null
+++ b/tools/aconfig/aconfig/build.rs
@@ -0,0 +1,93 @@
+use anyhow::{anyhow, Result};
+use std::env;
+use std::fs;
+use std::fs::File;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+
+use convert_finalized_flags::read_files_to_map_using_path;
+use convert_finalized_flags::FinalizedFlagMap;
+
+// This fn makes assumptions about the working directory which we should not rely
+// on for actual (Soong) builds. It is reasonable to assume that this is being
+// called from the aconfig directory as cargo is used for local development and
+// the cargo workspace for our project is build/make/tools/aconfig.
+// This is meant to get the list of finalized flag
+// files provided by the filegroup + "locations" in soong.
+// Cargo-only usage is asserted via implementation of
+// read_files_to_map_using_env, the only public cargo-only fn.
+fn read_files_to_map_using_env() -> Result<FinalizedFlagMap> {
+    let mut current_dir = std::env::current_dir()?;
+
+    // Path of aconfig from the top of tree.
+    let aconfig_path = PathBuf::from("build/make/tools/aconfig");
+
+    // Path of SDK files from the top of tree.
+    let sdk_dir_path = PathBuf::from("prebuilts/sdk");
+
+    // Iterate up the directory structure until we have the base aconfig dir.
+    while !current_dir.canonicalize()?.ends_with(&aconfig_path) {
+        if let Some(parent) = current_dir.parent() {
+            current_dir = parent.to_path_buf();
+        } else {
+            return Err(anyhow!("Cannot execute outside of aconfig."));
+        }
+    }
+
+    // Remove the aconfig path, leaving the top of the tree.
+    for _ in 0..aconfig_path.components().count() {
+        current_dir.pop();
+    }
+
+    // Get the absolute path of the sdk files.
+    current_dir.push(sdk_dir_path);
+
+    let mut flag_files = Vec::new();
+
+    // Search all sub-dirs in prebuilts/sdk for finalized-flags.txt files.
+    // The files are in prebuilts/sdk/<api level>/finalized-flags.txt.
+    let api_level_dirs = fs::read_dir(current_dir)?;
+    for api_level_dir in api_level_dirs {
+        if api_level_dir.is_err() {
+            eprintln!("Error opening directory: {}", api_level_dir.err().unwrap());
+            continue;
+        }
+
+        // Skip non-directories.
+        let api_level_dir_path = api_level_dir.unwrap().path();
+        if !api_level_dir_path.is_dir() {
+            continue;
+        }
+
+        // Some directories were created before trunk stable and don't have
+        // flags, or aren't api level directories at all.
+        let flag_file_path = api_level_dir_path.join("finalized-flags.txt");
+        if !flag_file_path.exists() {
+            continue;
+        }
+
+        if let Some(path) = flag_file_path.to_str() {
+            flag_files.push(path.to_string());
+        } else {
+            eprintln!("Error converting path to string: {:?}", flag_file_path);
+        }
+    }
+
+    read_files_to_map_using_path(flag_files)
+}
+
+fn main() {
+    let out_dir = env::var_os("OUT_DIR").unwrap();
+    let dest_path = Path::new(&out_dir).join("finalized_flags_record.json");
+
+    let finalized_flags_map: Result<FinalizedFlagMap> = read_files_to_map_using_env();
+    if finalized_flags_map.is_err() {
+        return;
+    }
+    let json_str = serde_json::to_string(&finalized_flags_map.unwrap()).unwrap();
+
+    let mut f = File::create(&dest_path).unwrap();
+    f.write_all(json_str.as_bytes()).unwrap();
+
+    //println!("cargo:rerun-if-changed=input.txt");
+}
diff --git a/tools/aconfig/aconfig/data/Android.bp b/tools/aconfig/aconfig/data/Android.bp
deleted file mode 100644
index 1b5eef0..0000000
--- a/tools/aconfig/aconfig/data/Android.bp
+++ /dev/null
@@ -1,14 +0,0 @@
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-python_binary_host {
-    name: "convert_finalized_flags_to_proto",
-    srcs: ["convert_finalized_flags_to_proto.py"],
-    libs: ["aconfig_internal_proto_python"],
-    version: {
-        py3: {
-            embedded_launcher: true,
-        },
-    },
-}
diff --git a/tools/aconfig/aconfig/data/convert_finalized_flags_to_proto.py b/tools/aconfig/aconfig/data/convert_finalized_flags_to_proto.py
deleted file mode 100644
index 15ff03c..0000000
--- a/tools/aconfig/aconfig/data/convert_finalized_flags_to_proto.py
+++ /dev/null
@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2024 The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-import collections
-import sys
-import os
-
-from io import TextIOWrapper
-from protos import aconfig_internal_pb2
-from typing import Dict, List, Set
-
-def extract_finalized_flags(flag_file: TextIOWrapper):
-  finalized_flags_for_sdk = list()
-
-  for line in f:
-    flag_name = line.strip()
-    if flag_name:
-      finalized_flags_for_sdk.append(flag_name)
-
-  return finalized_flags_for_sdk
-
-def remove_duplicate_flags(all_flags_with_duplicates: Dict[int, List]):
-  result_flags = collections.defaultdict(set)
-
-  for api_level in sorted(all_flags_with_duplicates.keys(), key=int):
-    for flag in all_flags_with_duplicates[api_level]:
-      if not any(flag in value_set for value_set in result_flags.values()):
-        result_flags[api_level].add(flag)
-
-  return result_flags
-
-def build_proto(all_flags: Set):
-  finalized_flags = aconfig_internal_pb2.finalized_flags()
-  for api_level, qualified_name_list in all_flags.items():
-    for qualified_name in qualified_name_list:
-      package_name, flag_name = qualified_name.rsplit('.', 1)
-      finalized_flag = aconfig_internal_pb2.finalized_flag()
-      finalized_flag.name = flag_name
-      finalized_flag.package = package_name
-      finalized_flag.min_sdk = api_level
-      finalized_flags.finalized_flag.append(finalized_flag)
-  return finalized_flags
-
-if __name__ == '__main__':
-  if len(sys.argv) == 1:
-    sys.exit('No prebuilts/sdk directory provided.')
-  all_api_info_dir = sys.argv[1]
-
-  all_flags_with_duplicates = {}
-  for sdk_dir in os.listdir(all_api_info_dir):
-    api_level = sdk_dir.rsplit('/', 1)[0].rstrip('0').rstrip('.')
-
-    # No support for minor versions yet. This also removes non-numeric dirs.
-    # Update once floats are acceptable.
-    if not api_level.isdigit():
-      continue
-
-    flag_file_path = os.path.join(all_api_info_dir, sdk_dir, 'finalized-flags.txt')
-    try:
-      with open(flag_file_path, 'r') as f:
-        finalized_flags_for_sdk = extract_finalized_flags(f)
-        all_flags_with_duplicates[int(api_level)] = finalized_flags_for_sdk
-    except FileNotFoundError:
-      # Either this version is not finalized yet or looking at a
-      # /prebuilts/sdk/version before finalized-flags.txt was introduced.
-      continue
-
-  all_flags = remove_duplicate_flags(all_flags_with_duplicates)
-  finalized_flags = build_proto(all_flags)
-  sys.stdout.buffer.write(finalized_flags.SerializeToString())
diff --git a/tools/aconfig/aconfig/src/codegen/java.rs b/tools/aconfig/aconfig/src/codegen/java.rs
index 6bd9416..4b670a0 100644
--- a/tools/aconfig/aconfig/src/codegen/java.rs
+++ b/tools/aconfig/aconfig/src/codegen/java.rs
@@ -24,6 +24,7 @@
 use crate::codegen::CodegenMode;
 use crate::commands::{should_include_flag, OutputFile};
 use aconfig_protos::{ProtoFlagPermission, ProtoFlagState, ProtoParsedFlag};
+use convert_finalized_flags::{FinalizedFlag, FinalizedFlagMap};
 use std::collections::HashMap;
 
 // Arguments to configure codegen for generate_java_code.
@@ -34,7 +35,7 @@
     pub package_fingerprint: u64,
     pub new_exported: bool,
     pub single_exported_file: bool,
-    pub check_api_level: bool,
+    pub finalized_flags: FinalizedFlagMap,
 }
 
 pub fn generate_java_code<I>(
@@ -47,7 +48,7 @@
 {
     let flag_elements: Vec<FlagElement> = parsed_flags_iter
         .map(|pf| {
-            create_flag_element(package, &pf, config.flag_ids.clone(), config.check_api_level)
+            create_flag_element(package, &pf, config.flag_ids.clone(), &config.finalized_flags)
         })
         .collect();
     let namespace_flags = gen_flags_by_namespace(&flag_elements);
@@ -182,7 +183,7 @@
     package: &str,
     pf: &ProtoParsedFlag,
     flag_offsets: HashMap<String, u16>,
-    check_api_level: bool,
+    finalized_flags: &FinalizedFlagMap,
 ) -> FlagElement {
     let device_config_flag = codegen::create_device_config_ident(package, pf.name())
         .expect("values checked at flag parse time");
@@ -204,6 +205,18 @@
         }
     };
 
+    // An empty map is provided if check_api_level is disabled.
+    let mut finalized_sdk_present: bool = false;
+    let mut finalized_sdk_value: i32 = 0;
+    if !finalized_flags.is_empty() {
+        let finalized_sdk = finalized_flags.get_finalized_level(&FinalizedFlag {
+            flag_name: pf.name().to_string(),
+            package_name: package.to_string(),
+        });
+        finalized_sdk_present = finalized_sdk.is_some();
+        finalized_sdk_value = finalized_sdk.map(|f| f.0).unwrap_or_default();
+    }
+
     FlagElement {
         container: pf.container().to_string(),
         default_value: pf.state() == ProtoFlagState::ENABLED,
@@ -215,8 +228,8 @@
         is_read_write: pf.permission() == ProtoFlagPermission::READ_WRITE,
         method_name: format_java_method_name(pf.name()),
         properties: format_property_name(pf.namespace()),
-        finalized_sdk_present: check_api_level,
-        finalized_sdk_value: i32::MAX, // TODO: b/378936061 - Read value from artifact.
+        finalized_sdk_present,
+        finalized_sdk_value,
     }
 }
 
@@ -300,6 +313,8 @@
 
 #[cfg(test)]
 mod tests {
+    use convert_finalized_flags::ApiLevel;
+
     use super::*;
     use crate::commands::assign_flag_ids;
     use std::collections::HashMap;
@@ -609,7 +624,7 @@
             package_fingerprint: 5801144784618221668,
             new_exported: false,
             single_exported_file: false,
-            check_api_level: false,
+            finalized_flags: FinalizedFlagMap::new(),
         };
         let generated_files = generate_java_code(
             crate::test::TEST_PACKAGE,
@@ -770,7 +785,7 @@
             package_fingerprint: 5801144784618221668,
             new_exported: false,
             single_exported_file: false,
-            check_api_level: false,
+            finalized_flags: FinalizedFlagMap::new(),
         };
         let generated_files = generate_java_code(
             crate::test::TEST_PACKAGE,
@@ -975,7 +990,7 @@
             package_fingerprint: 5801144784618221668,
             new_exported: true,
             single_exported_file: false,
-            check_api_level: false,
+            finalized_flags: FinalizedFlagMap::new(),
         };
         let generated_files = generate_java_code(
             crate::test::TEST_PACKAGE,
@@ -1156,6 +1171,209 @@
     }
 
     #[test]
+    fn test_generate_java_code_new_exported_with_sdk_check() {
+        let parsed_flags = crate::test::parse_test_flags();
+        let mode = CodegenMode::Exported;
+        let modified_parsed_flags =
+            crate::commands::modify_parsed_flags_based_on_mode(parsed_flags, mode).unwrap();
+        let flag_ids =
+            assign_flag_ids(crate::test::TEST_PACKAGE, modified_parsed_flags.iter()).unwrap();
+        let mut finalized_flags = FinalizedFlagMap::new();
+        finalized_flags.insert_if_new(
+            ApiLevel(36),
+            FinalizedFlag {
+                flag_name: "disabled_rw_exported".to_string(),
+                package_name: "com.android.aconfig.test".to_string(),
+            },
+        );
+        let config = JavaCodegenConfig {
+            codegen_mode: mode,
+            flag_ids,
+            allow_instrumentation: true,
+            package_fingerprint: 5801144784618221668,
+            new_exported: true,
+            single_exported_file: false,
+            finalized_flags,
+        };
+        let generated_files = generate_java_code(
+            crate::test::TEST_PACKAGE,
+            modified_parsed_flags.into_iter(),
+            config,
+        )
+        .unwrap();
+
+        let expect_flags_content = r#"
+        package com.android.aconfig.test;
+        /** @hide */
+        public final class Flags {
+            /** @hide */
+            public static final String FLAG_DISABLED_RW_EXPORTED = "com.android.aconfig.test.disabled_rw_exported";
+            /** @hide */
+            public static final String FLAG_ENABLED_FIXED_RO_EXPORTED = "com.android.aconfig.test.enabled_fixed_ro_exported";
+            /** @hide */
+            public static final String FLAG_ENABLED_RO_EXPORTED = "com.android.aconfig.test.enabled_ro_exported";
+            public static boolean disabledRwExported() {
+                return FEATURE_FLAGS.disabledRwExported();
+            }
+            public static boolean enabledFixedRoExported() {
+                return FEATURE_FLAGS.enabledFixedRoExported();
+            }
+            public static boolean enabledRoExported() {
+                return FEATURE_FLAGS.enabledRoExported();
+            }
+            private static FeatureFlags FEATURE_FLAGS = new FeatureFlagsImpl();
+        }
+        "#;
+
+        let expect_feature_flags_content = r#"
+        package com.android.aconfig.test;
+        /** @hide */
+        public interface FeatureFlags {
+            boolean disabledRwExported();
+            boolean enabledFixedRoExported();
+            boolean enabledRoExported();
+        }
+        "#;
+
+        let expect_feature_flags_impl_content = r#"
+        package com.android.aconfig.test;
+        import android.os.Build;
+        import android.os.flagging.AconfigPackage;
+        import android.util.Log;
+        /** @hide */
+        public final class FeatureFlagsImpl implements FeatureFlags {
+            private static final String TAG = "FeatureFlagsImplExport";
+            private static volatile boolean isCached = false;
+            private static boolean disabledRwExported = false;
+            private static boolean enabledFixedRoExported = false;
+            private static boolean enabledRoExported = false;
+            private void init() {
+                try {
+                    AconfigPackage reader = AconfigPackage.load("com.android.aconfig.test");
+                    disabledRwExported = Build.VERSION.SDK_INT >= 36 ? true : reader.getBooleanFlagValue("disabled_rw_exported", false);
+                    enabledFixedRoExported = reader.getBooleanFlagValue("enabled_fixed_ro_exported", false);
+                    enabledRoExported = reader.getBooleanFlagValue("enabled_ro_exported", false);
+                } catch (Exception e) {
+                    // pass
+                    Log.e(TAG, e.toString());
+                } catch (LinkageError e) {
+                    // for mainline module running on older devices.
+                    // This should be replaces to version check, after the version bump.
+                    Log.w(TAG, e.toString());
+                }
+                isCached = true;
+            }
+            @Override
+            public boolean disabledRwExported() {
+                if (!isCached) {
+                    init();
+                }
+                return disabledRwExported;
+            }
+            @Override
+            public boolean enabledFixedRoExported() {
+                if (!isCached) {
+                    init();
+                }
+                return enabledFixedRoExported;
+            }
+            @Override
+            public boolean enabledRoExported() {
+                if (!isCached) {
+                    init();
+                }
+                return enabledRoExported;
+            }
+        }"#;
+
+        let expect_custom_feature_flags_content = r#"
+        package com.android.aconfig.test;
+
+        import java.util.Arrays;
+        import java.util.HashSet;
+        import java.util.List;
+        import java.util.Set;
+        import java.util.function.BiPredicate;
+        import java.util.function.Predicate;
+
+        /** @hide */
+        public class CustomFeatureFlags implements FeatureFlags {
+
+            private BiPredicate<String, Predicate<FeatureFlags>> mGetValueImpl;
+
+            public CustomFeatureFlags(BiPredicate<String, Predicate<FeatureFlags>> getValueImpl) {
+                mGetValueImpl = getValueImpl;
+            }
+
+            @Override
+            public boolean disabledRwExported() {
+                return getValue(Flags.FLAG_DISABLED_RW_EXPORTED,
+                    FeatureFlags::disabledRwExported);
+            }
+            @Override
+            public boolean enabledFixedRoExported() {
+                return getValue(Flags.FLAG_ENABLED_FIXED_RO_EXPORTED,
+                    FeatureFlags::enabledFixedRoExported);
+            }
+            @Override
+            public boolean enabledRoExported() {
+                return getValue(Flags.FLAG_ENABLED_RO_EXPORTED,
+                    FeatureFlags::enabledRoExported);
+            }
+
+            protected boolean getValue(String flagName, Predicate<FeatureFlags> getter) {
+                return mGetValueImpl.test(flagName, getter);
+            }
+
+            public List<String> getFlagNames() {
+                return Arrays.asList(
+                    Flags.FLAG_DISABLED_RW_EXPORTED,
+                    Flags.FLAG_ENABLED_FIXED_RO_EXPORTED,
+                    Flags.FLAG_ENABLED_RO_EXPORTED
+                );
+            }
+
+            private Set<String> mReadOnlyFlagsSet = new HashSet<>(
+                Arrays.asList(
+                    ""
+                )
+            );
+        }
+    "#;
+
+        let mut file_set = HashMap::from([
+            ("com/android/aconfig/test/Flags.java", expect_flags_content),
+            ("com/android/aconfig/test/FeatureFlags.java", expect_feature_flags_content),
+            ("com/android/aconfig/test/FeatureFlagsImpl.java", expect_feature_flags_impl_content),
+            (
+                "com/android/aconfig/test/CustomFeatureFlags.java",
+                expect_custom_feature_flags_content,
+            ),
+            (
+                "com/android/aconfig/test/FakeFeatureFlagsImpl.java",
+                EXPECTED_FAKEFEATUREFLAGSIMPL_CONTENT,
+            ),
+        ]);
+
+        for file in generated_files {
+            let file_path = file.path.to_str().unwrap();
+            assert!(file_set.contains_key(file_path), "Cannot find {}", file_path);
+            assert_eq!(
+                None,
+                crate::test::first_significant_code_diff(
+                    file_set.get(file_path).unwrap(),
+                    &String::from_utf8(file.contents).unwrap()
+                ),
+                "File {} content is not correct",
+                file_path
+            );
+            file_set.remove(file_path);
+        }
+
+        assert!(file_set.is_empty());
+    }
+
+    #[test]
     fn test_generate_java_code_test() {
         let parsed_flags = crate::test::parse_test_flags();
         let mode = CodegenMode::Test;
@@ -1170,7 +1388,7 @@
             package_fingerprint: 5801144784618221668,
             new_exported: false,
             single_exported_file: false,
-            check_api_level: false,
+            finalized_flags: FinalizedFlagMap::new(),
         };
         let generated_files = generate_java_code(
             crate::test::TEST_PACKAGE,
@@ -1298,7 +1516,7 @@
             package_fingerprint: 5801144784618221668,
             new_exported: false,
             single_exported_file: false,
-            check_api_level: false,
+            finalized_flags: FinalizedFlagMap::new(),
         };
         let generated_files = generate_java_code(
             crate::test::TEST_PACKAGE,
diff --git a/tools/aconfig/aconfig/src/commands.rs b/tools/aconfig/aconfig/src/commands.rs
index ea63c7a..0c80d3b 100644
--- a/tools/aconfig/aconfig/src/commands.rs
+++ b/tools/aconfig/aconfig/src/commands.rs
@@ -15,6 +15,7 @@
  */
 
 use anyhow::{bail, ensure, Context, Result};
+use convert_finalized_flags::FinalizedFlagMap;
 use itertools::Itertools;
 use protobuf::Message;
 use std::collections::HashMap;
@@ -220,7 +221,7 @@
     allow_instrumentation: bool,
     new_exported: bool,
     single_exported_file: bool,
-    check_api_level: bool,
+    finalized_flags: FinalizedFlagMap,
 ) -> Result<Vec<OutputFile>> {
     let parsed_flags = input.try_parse_flags()?;
     let modified_parsed_flags =
@@ -239,7 +240,7 @@
         package_fingerprint,
         new_exported,
         single_exported_file,
-        check_api_level,
+        finalized_flags,
     };
     generate_java_code(&package, modified_parsed_flags.into_iter(), config)
 }
diff --git a/tools/aconfig/aconfig/src/main.rs b/tools/aconfig/aconfig/src/main.rs
index 16b8272..6b29423 100644
--- a/tools/aconfig/aconfig/src/main.rs
+++ b/tools/aconfig/aconfig/src/main.rs
@@ -33,6 +33,7 @@
 
 use aconfig_storage_file::StorageFileType;
 use codegen::CodegenMode;
+use convert_finalized_flags::FinalizedFlagMap;
 use dump::DumpFormat;
 
 #[cfg(test)]
@@ -348,6 +349,12 @@
     Ok(())
 }
 
+fn load_finalized_flags() -> Result<FinalizedFlagMap> {
+    let json_str = include_str!(concat!(env!("OUT_DIR"), "/finalized_flags_record.json"));
+    let map = serde_json::from_str(json_str)?;
+    Ok(map)
+}
+
 fn main() -> Result<()> {
     let matches = cli().get_matches();
     match matches.subcommand() {
@@ -383,14 +390,18 @@
             let new_exported = get_required_arg::<bool>(sub_matches, "new-exported")?;
             let single_exported_file =
                 get_required_arg::<bool>(sub_matches, "single-exported-file")?;
+
             let check_api_level = get_required_arg::<bool>(sub_matches, "check-api-level")?;
+            let finalized_flags: FinalizedFlagMap =
+                if *check_api_level { load_finalized_flags()? } else { FinalizedFlagMap::new() };
+
             let generated_files = commands::create_java_lib(
                 cache,
                 *mode,
                 *allow_instrumentation,
                 *new_exported,
                 *single_exported_file,
-                *check_api_level,
+                finalized_flags,
             )
             .context("failed to create java lib")?;
             let dir = PathBuf::from(get_required_arg::<String>(sub_matches, "out")?);
diff --git a/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/ByteBufferReader.java b/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/ByteBufferReader.java
index 1fbcb85..14fc468 100644
--- a/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/ByteBufferReader.java
+++ b/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/ByteBufferReader.java
@@ -19,10 +19,12 @@
 import java.nio.ByteBuffer;
 import java.nio.ByteOrder;
 import java.nio.charset.StandardCharsets;
+import java.util.Objects;
 
 public class ByteBufferReader {
 
     private ByteBuffer mByteBuffer;
+    private int mPosition;
 
     public ByteBufferReader(ByteBuffer byteBuffer) {
         this.mByteBuffer = byteBuffer;
@@ -30,19 +32,19 @@
     }
 
     public int readByte() {
-        return Byte.toUnsignedInt(mByteBuffer.get());
+        return Byte.toUnsignedInt(mByteBuffer.get(nextGetIndex(1)));
     }
 
     public int readShort() {
-        return Short.toUnsignedInt(mByteBuffer.getShort());
+        return Short.toUnsignedInt(mByteBuffer.getShort(nextGetIndex(2)));
     }
 
     public int readInt() {
-        return this.mByteBuffer.getInt();
+        return this.mByteBuffer.getInt(nextGetIndex(4));
     }
 
     public long readLong() {
-        return this.mByteBuffer.getLong();
+        return this.mByteBuffer.getLong(nextGetIndex(8));
     }
 
     public String readString() {
@@ -52,7 +54,7 @@
                     "String length exceeds maximum allowed size (1024 bytes): " + length);
         }
         byte[] bytes = new byte[length];
-        mByteBuffer.get(bytes, 0, length);
+        getArray(nextGetIndex(length), bytes, 0, length);
         return new String(bytes, StandardCharsets.UTF_8);
     }
 
@@ -61,10 +63,26 @@
     }
 
     public void position(int newPosition) {
-        mByteBuffer.position(newPosition);
+        mPosition = newPosition;
     }
 
     public int position() {
-        return mByteBuffer.position();
+        return mPosition;
+    }
+
+    private int nextGetIndex(int nb) {
+        int p = mPosition;
+        mPosition += nb;
+        return p;
+    }
+
+    private void getArray(int index, byte[] dst, int offset, int length) {
+        Objects.checkFromIndexSize(index, length, mByteBuffer.limit());
+        Objects.checkFromIndexSize(offset, length, dst.length);
+
+        int end = offset + length;
+        for (int i = offset, j = index; i < end; i++, j++) {
+            dst[i] = mByteBuffer.get(j);
+        }
     }
 }
diff --git a/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/FlagTable.java b/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/FlagTable.java
index 757844a..ee60b18 100644
--- a/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/FlagTable.java
+++ b/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/FlagTable.java
@@ -24,12 +24,12 @@
 public class FlagTable {
 
     private Header mHeader;
-    private ByteBufferReader mReader;
+    private ByteBuffer mBuffer;
 
     public static FlagTable fromBytes(ByteBuffer bytes) {
         FlagTable flagTable = new FlagTable();
-        flagTable.mReader = new ByteBufferReader(bytes);
-        flagTable.mHeader = Header.fromBytes(flagTable.mReader);
+        flagTable.mBuffer = bytes;
+        flagTable.mHeader = Header.fromBytes(new ByteBufferReader(bytes));
 
         return flagTable;
     }
@@ -41,16 +41,16 @@
         if (newPosition >= mHeader.mNodeOffset) {
             return null;
         }
-
-        mReader.position(newPosition);
-        int nodeIndex = mReader.readInt();
+        ByteBufferReader reader = new ByteBufferReader(mBuffer) ;
+        reader.position(newPosition);
+        int nodeIndex = reader.readInt();
         if (nodeIndex < mHeader.mNodeOffset || nodeIndex >= mHeader.mFileSize) {
             return null;
         }
 
         while (nodeIndex != -1) {
-            mReader.position(nodeIndex);
-            Node node = Node.fromBytes(mReader);
+            reader.position(nodeIndex);
+            Node node = Node.fromBytes(reader);
             if (Objects.equals(flagName, node.mFlagName) && packageId == node.mPackageId) {
                 return node;
             }
diff --git a/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/PackageTable.java b/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/PackageTable.java
index 1e7c2ca..215616e 100644
--- a/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/PackageTable.java
+++ b/tools/aconfig/aconfig_storage_file/srcs/android/aconfig/storage/PackageTable.java
@@ -30,12 +30,12 @@
     private static final int NODE_SKIP_BYTES = 12;
 
     private Header mHeader;
-    private ByteBufferReader mReader;
+    private ByteBuffer mBuffer;
 
     public static PackageTable fromBytes(ByteBuffer bytes) {
         PackageTable packageTable = new PackageTable();
-        packageTable.mReader = new ByteBufferReader(bytes);
-        packageTable.mHeader = Header.fromBytes(packageTable.mReader);
+        packageTable.mBuffer = bytes;
+        packageTable.mHeader = Header.fromBytes(new ByteBufferReader(bytes));
 
         return packageTable;
     }
@@ -47,16 +47,17 @@
         if (newPosition >= mHeader.mNodeOffset) {
             return null;
         }
-        mReader.position(newPosition);
-        int nodeIndex = mReader.readInt();
+        ByteBufferReader reader = new ByteBufferReader(mBuffer);
+        reader.position(newPosition);
+        int nodeIndex = reader.readInt();
 
         if (nodeIndex < mHeader.mNodeOffset || nodeIndex >= mHeader.mFileSize) {
             return null;
         }
 
         while (nodeIndex != -1) {
-            mReader.position(nodeIndex);
-            Node node = Node.fromBytes(mReader, mHeader.mVersion);
+            reader.position(nodeIndex);
+            Node node = Node.fromBytes(reader, mHeader.mVersion);
             if (Objects.equals(packageName, node.mPackageName)) {
                 return node;
             }
@@ -68,12 +69,13 @@
 
     public List<String> getPackageList() {
         List<String> list = new ArrayList<>(mHeader.mNumPackages);
-        mReader.position(mHeader.mNodeOffset);
+        ByteBufferReader reader = new ByteBufferReader(mBuffer);
+        reader.position(mHeader.mNodeOffset);
         int fingerprintBytes = mHeader.mVersion == 1 ? 0 : FINGERPRINT_BYTES;
         int skipBytes = fingerprintBytes + NODE_SKIP_BYTES;
         for (int i = 0; i < mHeader.mNumPackages; i++) {
-            list.add(mReader.readString());
-            mReader.position(mReader.position() + skipBytes);
+            list.add(reader.readString());
+            reader.position(reader.position() + skipBytes);
         }
         return list;
     }
diff --git a/tools/aconfig/aconfig_storage_file/tests/srcs/PackageTableTest.java b/tools/aconfig/aconfig_storage_file/tests/srcs/PackageTableTest.java
index 812ce35..4b68e5b 100644
--- a/tools/aconfig/aconfig_storage_file/tests/srcs/PackageTableTest.java
+++ b/tools/aconfig/aconfig_storage_file/tests/srcs/PackageTableTest.java
@@ -28,7 +28,9 @@
 import org.junit.runners.JUnit4;
 
 import java.util.HashSet;
+import java.util.Objects;
 import java.util.Set;
+import java.util.concurrent.CyclicBarrier;
 
 @RunWith(JUnit4.class)
 public class PackageTableTest {
@@ -142,4 +144,46 @@
         assertTrue(packages.contains("com.android.aconfig.storage.test_2"));
         assertTrue(packages.contains("com.android.aconfig.storage.test_4"));
     }
+
+    @Test
+    public void testPackageTable_multithreadsRead() throws Exception {
+        PackageTable packageTable =
+                PackageTable.fromBytes(TestDataUtils.getTestPackageMapByteBuffer(2));
+        int numberOfThreads = 3;
+        Thread[] threads = new Thread[numberOfThreads];
+        final CyclicBarrier gate = new CyclicBarrier(numberOfThreads + 1);
+        String[] expects = {
+            "com.android.aconfig.storage.test_1",
+            "com.android.aconfig.storage.test_2",
+            "com.android.aconfig.storage.test_4"
+        };
+
+        for (int i = 0; i < numberOfThreads; i++) {
+            final String packageName = expects[i];
+            threads[i] =
+                    new Thread() {
+                        @Override
+                        public void run() {
+                            try {
+                                gate.await();
+                            } catch (Exception e) {
+                            }
+                            for (int j = 0; j < 10; j++) {
+                                if (!Objects.equals(
+                                        packageName,
+                                        packageTable.get(packageName).getPackageName())) {
+                                    throw new RuntimeException();
+                                }
+                            }
+                        }
+                    };
+            threads[i].start();
+        }
+
+        gate.await();
+
+        for (int i = 0; i < numberOfThreads; i++) {
+            threads[i].join();
+        }
+    }
 }
diff --git a/tools/aconfig/convert_finalized_flags/Android.bp b/tools/aconfig/convert_finalized_flags/Android.bp
new file mode 100644
index 0000000..5b39560
--- /dev/null
+++ b/tools/aconfig/convert_finalized_flags/Android.bp
@@ -0,0 +1,56 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+rust_defaults {
+    name: "convert_finalized_flags.defaults",
+    edition: "2021",
+    clippy_lints: "android",
+    lints: "android",
+    rustlibs: [
+        "libanyhow",
+        "libclap",
+        "libitertools",
+        "libprotobuf",
+        "libserde",
+        "libserde_json",
+        "libtempfile",
+        "libtinytemplate",
+    ],
+}
+
+rust_library_host {
+    name: "libconvert_finalized_flags",
+    crate_name: "convert_finalized_flags",
+    defaults: ["convert_finalized_flags.defaults"],
+    srcs: [
+        "src/lib.rs",
+    ],
+}
+
+rust_binary_host {
+    name: "convert_finalized_flags",
+    defaults: ["convert_finalized_flags.defaults"],
+    srcs: ["src/main.rs"],
+    rustlibs: [
+        "libconvert_finalized_flags",
+        "libserde_json",
+    ],
+}
+
+rust_test_host {
+    name: "convert_finalized_flags.test",
+    defaults: ["convert_finalized_flags.defaults"],
+    test_suites: ["general-tests"],
+    srcs: ["src/lib.rs"],
+}
+
+genrule {
+    name: "finalized_flags_record.json",
+    srcs: [
+        "//prebuilts/sdk:finalized-api-flags",
+    ],
+    out: ["finalized_flags_record.json"],
+    tools: ["convert_finalized_flags"],
+    cmd: "args=\"\" && for f in $(locations //prebuilts/sdk:finalized-api-flags); do args=\"$$args --flag_file_path $$f\"; done && $(location convert_finalized_flags) $$args > $(out)",
+}
diff --git a/tools/aconfig/convert_finalized_flags/Cargo.toml b/tools/aconfig/convert_finalized_flags/Cargo.toml
new file mode 100644
index 0000000..e34e030
--- /dev/null
+++ b/tools/aconfig/convert_finalized_flags/Cargo.toml
@@ -0,0 +1,15 @@
+[package]
+name = "convert_finalized_flags"
+version = "0.1.0"
+edition = "2021"
+
+[features]
+default = ["cargo"]
+cargo = []
+
+[dependencies]
+anyhow = "1.0.69"
+clap = { version = "4.1.8", features = ["derive"] }
+serde = { version = "1.0.152", features = ["derive"] }
+serde_json = "1.0.93"
+tempfile = "3.13.0"
diff --git a/tools/aconfig/convert_finalized_flags/src/lib.rs b/tools/aconfig/convert_finalized_flags/src/lib.rs
new file mode 100644
index 0000000..10faa39
--- /dev/null
+++ b/tools/aconfig/convert_finalized_flags/src/lib.rs
@@ -0,0 +1,395 @@
+/*
+* Copyright (C) 2025 The Android Open Source Project
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*      http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+//! Functions to extract finalized flag information from
+//! /prebuilts/sdk/#/finalized-flags.txt.
+//! These functions are very specific to that file setup as well as the format
+//! of the files (just a list of the fully-qualified flag names).
+//! There are also some helper functions for local building using cargo. These
+//! functions are only invoked via cargo for quick local testing and will not
+//! be used during actual soong building. They are marked as such.
+use anyhow::{anyhow, Result};
+use serde::{Deserialize, Serialize};
+use std::collections::{HashMap, HashSet};
+use std::fs;
+use std::io::{self, BufRead};
+
+/// Just the fully qualified flag name (package_name.flag_name).
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Hash)]
+pub struct FinalizedFlag {
+    /// Name of the flag.
+    pub flag_name: String,
+    /// Name of the package.
+    pub package_name: String,
+}
+
+/// API level in which the flag was finalized.
+#[derive(Copy, Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Hash)]
+pub struct ApiLevel(pub i32);
+
+/// Contains all flags finalized for a given API level.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct FinalizedFlagMap(HashMap<ApiLevel, HashSet<FinalizedFlag>>);
+
+impl FinalizedFlagMap {
+    /// Creates a new, empty instance.
+    pub fn new() -> Self {
+        Self(HashMap::new())
+    }
+
+    /// Convenience method for is_empty on the underlying map.
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    /// Returns the API level in which the flag was finalized .
+    pub fn get_finalized_level(&self, flag: &FinalizedFlag) -> Option<ApiLevel> {
+        for (api_level, flags_for_level) in &self.0 {
+            if flags_for_level.contains(flag) {
+                return Some(*api_level);
+            }
+        }
+        None
+    }
+
+    /// Insert the flag into the map for the given level if the flag is not
+    /// present in the map already - for *any* level (not just the one given).
+    pub fn insert_if_new(&mut self, level: ApiLevel, flag: FinalizedFlag) {
+        if self.contains(&flag) {
+            return;
+        }
+        self.0.entry(level).or_default().insert(flag);
+    }
+
+    fn contains(&self, flag: &FinalizedFlag) -> bool {
+        self.0.values().any(|flags_set| flags_set.contains(flag))
+    }
+}
+
+/// Converts a string to an int. Will parse to int even if the string is "X.0".
+/// Returns error for "X.1".
+fn str_to_api_level(numeric_string: &str) -> Result<ApiLevel> {
+    let float_value = numeric_string.parse::<f64>()?;
+
+    if float_value.fract() == 0.0 {
+        Ok(ApiLevel(float_value as i32))
+    } else {
+        Err(anyhow!("Numeric string is float, can't parse to int."))
+    }
+}
+
+/// For each file, extracts the qualified flag names into a FinalizedFlag, then
+/// enters them in a map at the API level corresponding to their directory.
+/// Ex: /prebuilts/sdk/35/finalized-flags.txt -> {36, [flag1, flag2]}.
+pub fn read_files_to_map_using_path(flag_files: Vec<String>) -> Result<FinalizedFlagMap> {
+    let mut data_map = FinalizedFlagMap::new();
+
+    for flag_file in flag_files {
+        // Split /path/sdk/<int.int>/finalized-flags.txt -> ['/path/sdk', 'int.int', 'finalized-flags.txt'].
+        let flag_file_split: Vec<String> =
+            flag_file.clone().rsplitn(3, '/').map(|s| s.to_string()).collect();
+
+        if &flag_file_split[0] != "finalized-flags.txt" {
+            return Err(anyhow!("Provided incorrect file, must be finalized-flags.txt"));
+        }
+
+        let api_level_string = &flag_file_split[1];
+
+        // For now, skip any directory with full API level, e.g. "36.1". The
+        // finalized flag files each contain all flags finalized *up to* that
+        // level (including prior levels), so skipping intermediate levels means
+        // the flags will be included at the next full number.
+        // TODO: b/378936061 - Support full SDK version.
+        // In the future, we should error if provided a non-numeric directory.
+        let Ok(api_level) = str_to_api_level(api_level_string) else {
+            continue;
+        };
+
+        let file = fs::File::open(flag_file)?;
+        let reader = io::BufReader::new(file);
+
+        for qualified_flag_name in reader.lines() {
+            // Split the qualified flag name into package and flag name:
+            // com.my.package.name.my_flag_name -> ['com.my.package.name', 'my_flag_name'].
+            let mut flag: Vec<String> =
+                qualified_flag_name?.rsplitn(2, '.').map(|s| s.to_string()).collect();
+
+            if flag.len() != 2 {
+                continue;
+            }
+
+            let package_name = flag.pop().ok_or(anyhow!("Missing flag package."))?;
+            let flag_name = flag.pop().ok_or(anyhow!("Missing flag name."))?;
+
+            // Only add the flag if it wasn't added in a prior file.
+            data_map.insert_if_new(api_level, FinalizedFlag { flag_name, package_name });
+        }
+    }
+
+    Ok(data_map)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs::File;
+    use std::io::Write;
+    use tempfile::tempdir;
+
+    const FLAG_FILE_NAME: &str = "finalized-flags.txt";
+
+    // Creates some flags for testing.
+    fn create_test_flags() -> Vec<FinalizedFlag> {
+        vec![
+            FinalizedFlag { flag_name: "name1".to_string(), package_name: "package1".to_string() },
+            FinalizedFlag { flag_name: "name2".to_string(), package_name: "package2".to_string() },
+            FinalizedFlag { flag_name: "name3".to_string(), package_name: "package3".to_string() },
+        ]
+    }
+
+    // Writes the fully qualified flag names in the given file.
+    fn add_flags_to_file(flag_file: &mut File, flags: &[FinalizedFlag]) {
+        for flag in flags {
+            let _unused = writeln!(flag_file, "{}.{}", flag.package_name, flag.flag_name);
+        }
+    }
+
+    #[test]
+    fn test_read_flags_one_file() {
+        let flags = create_test_flags();
+
+        // Create the file <temp_dir>/35/finalized-flags.txt.
+        let temp_dir = tempdir().unwrap();
+        let mut file_path = temp_dir.path().to_path_buf();
+        file_path.push("35");
+        fs::create_dir_all(&file_path).unwrap();
+        file_path.push(FLAG_FILE_NAME);
+        let mut file = File::create(&file_path).unwrap();
+
+        // Write all flags to the file.
+        add_flags_to_file(&mut file, &[flags[0].clone(), flags[1].clone()]);
+        let flag_file_path = file_path.to_string_lossy().to_string();
+
+        // Convert to map.
+        let map = read_files_to_map_using_path(vec![flag_file_path]).unwrap();
+
+        assert_eq!(map.0.len(), 1);
+        assert!(map.0.get(&ApiLevel(35)).unwrap().contains(&flags[0]));
+        assert!(map.0.get(&ApiLevel(35)).unwrap().contains(&flags[1]));
+    }
+
+    #[test]
+    fn test_read_flags_two_files() {
+        let flags = create_test_flags();
+
+        // Create the file <temp_dir>/35/finalized-flags.txt and for 36.
+        let temp_dir = tempdir().unwrap();
+        let mut file_path1 = temp_dir.path().to_path_buf();
+        file_path1.push("35");
+        fs::create_dir_all(&file_path1).unwrap();
+        file_path1.push(FLAG_FILE_NAME);
+        let mut file1 = File::create(&file_path1).unwrap();
+
+        let mut file_path2 = temp_dir.path().to_path_buf();
+        file_path2.push("36");
+        fs::create_dir_all(&file_path2).unwrap();
+        file_path2.push(FLAG_FILE_NAME);
+        let mut file2 = File::create(&file_path2).unwrap();
+
+        // Write all flags to the files.
+        add_flags_to_file(&mut file1, &[flags[0].clone()]);
+        add_flags_to_file(&mut file2, &[flags[0].clone(), flags[1].clone(), flags[2].clone()]);
+        let flag_file_path1 = file_path1.to_string_lossy().to_string();
+        let flag_file_path2 = file_path2.to_string_lossy().to_string();
+
+        // Convert to map.
+        let map = read_files_to_map_using_path(vec![flag_file_path1, flag_file_path2]).unwrap();
+
+        // Assert there are two API levels, 35 and 36.
+        assert_eq!(map.0.len(), 2);
+        assert!(map.0.get(&ApiLevel(35)).unwrap().contains(&flags[0]));
+
+        // 36 should not have the first flag in the set, as it was finalized in
+        // an earlier API level.
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[1]));
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[2]));
+    }
+
+    #[test]
+    fn test_read_flags_full_numbers() {
+        let flags = create_test_flags();
+
+        // Create the file <temp_dir>/35/finalized-flags.txt and for 36.
+        let temp_dir = tempdir().unwrap();
+        let mut file_path1 = temp_dir.path().to_path_buf();
+        file_path1.push("35.0");
+        fs::create_dir_all(&file_path1).unwrap();
+        file_path1.push(FLAG_FILE_NAME);
+        let mut file1 = File::create(&file_path1).unwrap();
+
+        let mut file_path2 = temp_dir.path().to_path_buf();
+        file_path2.push("36.0");
+        fs::create_dir_all(&file_path2).unwrap();
+        file_path2.push(FLAG_FILE_NAME);
+        let mut file2 = File::create(&file_path2).unwrap();
+
+        // Write all flags to the files.
+        add_flags_to_file(&mut file1, &[flags[0].clone()]);
+        add_flags_to_file(&mut file2, &[flags[0].clone(), flags[1].clone(), flags[2].clone()]);
+        let flag_file_path1 = file_path1.to_string_lossy().to_string();
+        let flag_file_path2 = file_path2.to_string_lossy().to_string();
+
+        // Convert to map.
+        let map = read_files_to_map_using_path(vec![flag_file_path1, flag_file_path2]).unwrap();
+
+        assert_eq!(map.0.len(), 2);
+        assert!(map.0.get(&ApiLevel(35)).unwrap().contains(&flags[0]));
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[1]));
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[2]));
+    }
+
+    #[test]
+    fn test_read_flags_fractions_round_up() {
+        let flags = create_test_flags();
+
+        // Create the file <temp_dir>/35/finalized-flags.txt and for 36.
+        let temp_dir = tempdir().unwrap();
+        let mut file_path1 = temp_dir.path().to_path_buf();
+        file_path1.push("35.1");
+        fs::create_dir_all(&file_path1).unwrap();
+        file_path1.push(FLAG_FILE_NAME);
+        let mut file1 = File::create(&file_path1).unwrap();
+
+        let mut file_path2 = temp_dir.path().to_path_buf();
+        file_path2.push("36.0");
+        fs::create_dir_all(&file_path2).unwrap();
+        file_path2.push(FLAG_FILE_NAME);
+        let mut file2 = File::create(&file_path2).unwrap();
+
+        // Write all flags to the files.
+        add_flags_to_file(&mut file1, &[flags[0].clone()]);
+        add_flags_to_file(&mut file2, &[flags[0].clone(), flags[1].clone(), flags[2].clone()]);
+        let flag_file_path1 = file_path1.to_string_lossy().to_string();
+        let flag_file_path2 = file_path2.to_string_lossy().to_string();
+
+        // Convert to map.
+        let map = read_files_to_map_using_path(vec![flag_file_path1, flag_file_path2]).unwrap();
+
+        // No flags were added in 35. All 35.1 flags were rolled up to 36.
+        assert_eq!(map.0.len(), 1);
+        assert!(!map.0.contains_key(&ApiLevel(35)));
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[0]));
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[1]));
+        assert!(map.0.get(&ApiLevel(36)).unwrap().contains(&flags[2]));
+    }
+
+    #[test]
+    fn test_read_flags_non_numeric() {
+        let flags = create_test_flags();
+
+        // Create the file <temp_dir>/35/finalized-flags.txt.
+        let temp_dir = tempdir().unwrap();
+        let mut file_path = temp_dir.path().to_path_buf();
+        file_path.push("35");
+        fs::create_dir_all(&file_path).unwrap();
+        file_path.push(FLAG_FILE_NAME);
+        let mut flag_file = File::create(&file_path).unwrap();
+
+        let mut invalid_path = temp_dir.path().to_path_buf();
+        invalid_path.push("sdk-annotations");
+        fs::create_dir_all(&invalid_path).unwrap();
+        invalid_path.push(FLAG_FILE_NAME);
+        File::create(&invalid_path).unwrap();
+
+        // Write all flags to the file.
+        add_flags_to_file(&mut flag_file, &[flags[0].clone(), flags[1].clone()]);
+        let flag_file_path = file_path.to_string_lossy().to_string();
+
+        // Convert to map.
+        let map = read_files_to_map_using_path(vec![
+            flag_file_path,
+            invalid_path.to_string_lossy().to_string(),
+        ])
+        .unwrap();
+
+        // No set should be created for sdk-annotations.
+        assert_eq!(map.0.len(), 1);
+        assert!(map.0.get(&ApiLevel(35)).unwrap().contains(&flags[0]));
+        assert!(map.0.get(&ApiLevel(35)).unwrap().contains(&flags[1]));
+    }
+
+    #[test]
+    fn test_read_flags_wrong_file_err() {
+        let flags = create_test_flags();
+
+        // Create the file <temp_dir>/35/finalized-flags.txt.
+        let temp_dir = tempdir().unwrap();
+        let mut file_path = temp_dir.path().to_path_buf();
+        file_path.push("35");
+        fs::create_dir_all(&file_path).unwrap();
+        file_path.push(FLAG_FILE_NAME);
+        let mut flag_file = File::create(&file_path).unwrap();
+
+        let mut pre_flag_path = temp_dir.path().to_path_buf();
+        pre_flag_path.push("18");
+        fs::create_dir_all(&pre_flag_path).unwrap();
+        pre_flag_path.push("some_random_file.txt");
+        File::create(&pre_flag_path).unwrap();
+
+        // Write all flags to the file.
+        add_flags_to_file(&mut flag_file, &[flags[0].clone(), flags[1].clone()]);
+        let flag_file_path = file_path.to_string_lossy().to_string();
+
+        // Convert to map.
+        let map = read_files_to_map_using_path(vec![
+            flag_file_path,
+            pre_flag_path.to_string_lossy().to_string(),
+        ]);
+
+        assert!(map.is_err());
+    }
+
+    #[test]
+    fn test_flags_map_insert_if_new() {
+        let flags = create_test_flags();
+        let mut map = FinalizedFlagMap::new();
+        let l35 = ApiLevel(35);
+        let l36 = ApiLevel(36);
+
+        map.insert_if_new(l35, flags[0].clone());
+        map.insert_if_new(l35, flags[1].clone());
+        map.insert_if_new(l35, flags[2].clone());
+        map.insert_if_new(l36, flags[0].clone());
+
+        assert!(map.0.get(&l35).unwrap().contains(&flags[0]));
+        assert!(map.0.get(&l35).unwrap().contains(&flags[1]));
+        assert!(map.0.get(&l35).unwrap().contains(&flags[2]));
+        assert!(!map.0.contains_key(&l36));
+    }
+
+    #[test]
+    fn test_flags_map_get_level() {
+        let flags = create_test_flags();
+        let mut map = FinalizedFlagMap::new();
+        let l35 = ApiLevel(35);
+        let l36 = ApiLevel(36);
+
+        map.insert_if_new(l35, flags[0].clone());
+        map.insert_if_new(l36, flags[1].clone());
+
+        assert_eq!(map.get_finalized_level(&flags[0]).unwrap(), l35);
+        assert_eq!(map.get_finalized_level(&flags[1]).unwrap(), l36);
+    }
+}
diff --git a/tools/aconfig/convert_finalized_flags/src/main.rs b/tools/aconfig/convert_finalized_flags/src/main.rs
new file mode 100644
index 0000000..38300f6
--- /dev/null
+++ b/tools/aconfig/convert_finalized_flags/src/main.rs
@@ -0,0 +1,57 @@
+/*
+* Copyright (C) 2025 The Android Open Source Project
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+*      http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+*/
+//! convert_finalized_flags is a build time tool used to convert the finalized
+//! flags text files under prebuilts/sdk into structured data (FinalizedFlag
+//! struct).
+//! This binary is intended to run as part of a genrule to create a json file
+//! which is provided to the aconfig binary that creates the codegen.
+//! Usage:
+//! cargo run -- --flag-files-path path/to/prebuilts/sdk/finalized-flags.txt file2.txt etc
+use anyhow::Result;
+use clap::Parser;
+
+use convert_finalized_flags::read_files_to_map_using_path;
+
+const ABOUT_TEXT: &str = "Tool for processing finalized-flags.txt files.
+
+These files contain the list of qualified flag names that have been finalized,
+each on a newline. The directory of the flag file is the finalized API level.
+
+The output is a json map of API level to set of FinalizedFlag objects. The only
+supported use case for this tool is via a genrule at build time for aconfig
+codegen.
+
+Args:
+* `flag-files-path`: Space-separated list of absolute paths for the finalized
+flags files.
+";
+
+#[derive(Parser, Debug)]
+#[clap(long_about=ABOUT_TEXT, bin_name="convert-finalized-flags")]
+struct Cli {
+    /// Flags files.
+    #[arg(long = "flag_file_path")]
+    flag_file_path: Vec<String>,
+}
+
+fn main() -> Result<()> {
+    let cli = Cli::parse();
+    let finalized_flags_map = read_files_to_map_using_path(cli.flag_file_path)?;
+
+    let json_str = serde_json::to_string(&finalized_flags_map)?;
+    println!("{}", json_str);
+    Ok(())
+}
diff --git a/tools/perf/benchmarks b/tools/perf/benchmarks
index 8c24e12..228c1d0 100755
--- a/tools/perf/benchmarks
+++ b/tools/perf/benchmarks
@@ -337,6 +337,12 @@
 
     def Run(self):
         """Run all of the user-selected benchmarks."""
+
+        # With `--list`, just list the benchmarks available.
+        if self._options.List():
+            print(" ".join(self._options.BenchmarkIds()))
+            return
+
         # Clean out the log dir or create it if necessary
         prepare_log_dir(self._options.LogDir())
 
@@ -546,6 +552,8 @@
         parser.add_argument("--benchmark", nargs="*", default=[b.id for b in self._benchmarks],
                             metavar="BENCHMARKS",
                             help="Benchmarks to run.  Default suite will be run if omitted.")
+        parser.add_argument("--list", action="store_true",
+                            help="list the available benchmarks.  No benchmark is run.")
         parser.add_argument("--dist-one", action="store_true",
                             help="Copy logs and metrics to the given dist dir. Requires that only"
                                 + " one benchmark be supplied. Postroll steps will be skipped.")
@@ -615,6 +623,12 @@
     def DryRun(self):
         return self._args.dry_run
 
+    def List(self):
+        return self._args.list
+
+    def BenchmarkIds(self) :
+        return [benchmark.id for benchmark in self._benchmarks]
+
     def _lunches(self):
         def parse_lunch(lunch):
             parts = lunch.split("-")
diff --git a/tools/releasetools/fsverity_metadata_generator.py b/tools/releasetools/fsverity_metadata_generator.py
index 50e23e7..e531cca 100644
--- a/tools/releasetools/fsverity_metadata_generator.py
+++ b/tools/releasetools/fsverity_metadata_generator.py
@@ -230,12 +230,6 @@
   if not output_file:
     output_file = input_file + '.fsv_meta'
 
-  if output_file != args.input + '.fsv_meta':
-    sys.exit('When generating .fsv_meta files for symlinks, we assume that all fsv_meta files '
-      'are named the same as the file they protect, just with the .fsv_meta suffix appended. '
-      'We require that all .fsv_meta files follow this convention regardless of if it\'s a link or '
-      'not. However {args.input} had a different output file: {args.output}')
-
   # remove the output file first, as switching between a file and a symlink can be complicated
   try:
     os.remove(output_file)
diff --git a/tools/releasetools/sign_target_files_apks.py b/tools/releasetools/sign_target_files_apks.py
index f1855a5..2fa3fb5 100755
--- a/tools/releasetools/sign_target_files_apks.py
+++ b/tools/releasetools/sign_target_files_apks.py
@@ -910,8 +910,11 @@
 
         # b/384813199: handles the pre-signed com.android.virt.apex in GSI.
         if payload_key == 'PRESIGNED':
-          new_pubkey = GetMicrodroidVbmetaKey(virt_apex_path,
-                                              misc_info['avb_avbtool'])
+          with tempfile.NamedTemporaryFile() as virt_apex_temp_file:
+            virt_apex_temp_file.write(input_tf_zip.read(virt_apex_path))
+            virt_apex_temp_file.flush()
+            new_pubkey = GetMicrodroidVbmetaKey(virt_apex_temp_file.name,
+                                                misc_info['avb_avbtool'])
         else:
           new_pubkey_path = common.ExtractAvbPublicKey(
               misc_info['avb_avbtool'], payload_key)