diff --git a/Android.bp b/Android.bp
new file mode 100644
index 0000000..52a1055
--- /dev/null
+++ b/Android.bp
@@ -0,0 +1,45 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    default_applicable_licenses: ["device_google_gs-common_license"],
+}
+
+// Added automatically by a large-scale-change that took the approach of
+// 'apply every license found to every target'. While this makes sure we respect
+// every license restriction, it may not be entirely correct.
+//
+// e.g. GPL in an MIT project might only apply to the contrib/ directory.
+//
+// Please consider splitting the single license below into multiple licenses,
+// taking care not to lose any license_kind information, and overriding the
+// default license using the 'licenses: [...]' property on targets as needed.
+//
+// For unused files, consider creating a 'fileGroup' with "//visibility:private"
+// to attach the license to, and including a comment whether the files may be
+// used in the current project.
+// See: http://go/android-license-faq
+license {
+    name: "device_google_gs-common_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+        "SPDX-license-identifier-BSD",
+    ],
+    license_text: [
+        "NOTICE",
+    ],
+}
diff --git a/MK_OWNERS b/MK_OWNERS
new file mode 100644
index 0000000..67af9f7
--- /dev/null
+++ b/MK_OWNERS
@@ -0,0 +1,20 @@
+# NOTE: CHANGE THIS FILE WITH CAUTIOUS
+# - this file is referenced by other OWNERS file, e.g. device/google/*/OWNERS
+# - changing this file might break the function, check go/gerrit-code-owners-syntax first
+#
+# Makefile Review Guide for OWNERS: go/pixel-device-mk-owner-checklist
+
+aaronding@google.com
+rurumihong@google.com
+adamshih@google.com
+wilsonsung@google.com
+cyanhsieh@google.com
+cyuanjen@google.com
+robinpeng@google.com
+achant@google.com
+etam@google.com
+pattjin@google.com
+bkhalife@google.com
+lokeshgoel@google.com
+jainne@google.com
+pscovanner@google.com
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..316b4eb
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,190 @@
+
+   Copyright (c) 2014, The Android Open Source Project
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
diff --git a/OWNERS b/OWNERS
index 262b161..b715f13 100644
--- a/OWNERS
+++ b/OWNERS
@@ -2,5 +2,4 @@
 per-file *.te,*_contexts,te_macros,global_macros=set noparent
 per-file *.te,*_contexts,te_macros,global_macros=file:/sepolicy/OWNERS
 per-file *.mk=set noparent
-per-file *.mk=aaronding@google.com,rurumihong@google.com,adamshih@google.com,wilsonsung@google.com,cyanhsieh@google.com,cyuanjen@google.com,robinpeng@google.com,achant@google.com,etam@google.com,pattjin@google.com,bkhalife@google.com,lokeshgoel@google.com,jainne@google.com,pscovanner@google.com
-
+per-file *.mk=file:MK_OWNERS
diff --git a/aoc/aoc.mk b/aoc/aoc.mk
index 2eadb08..136bb42 100644
--- a/aoc/aoc.mk
+++ b/aoc/aoc.mk
@@ -1,7 +1,8 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/aoc/sepolicy
 
 PRODUCT_PACKAGES += dump_aoc \
-		    aocd
+		    aocd \
+		    aocxd
 
 ifeq (,$(filter aosp_%,$(TARGET_PRODUCT)))
 # IAudioMetricExt HIDL
@@ -23,4 +24,5 @@
 	aocdump \
 	aocutil \
 	aoc_audio_cfg \
-	vp_util
+	vp_util \
+	aocx_tool
diff --git a/aoc/dump_aoc.cpp b/aoc/dump_aoc.cpp
index 8d5278d..baf056e 100644
--- a/aoc/dump_aoc.cpp
+++ b/aoc/dump_aoc.cpp
@@ -29,13 +29,10 @@
     runCommand("AoC logging wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/logging_wakeup");
     runCommand("AoC hotword wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/hotword_wakeup");
     runCommand("AoC memory exception wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_exception");
-    runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_a32");
-    runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_ff1");
+    runCommand("AoC memory votes", "timeout 0.5 cat /sys/devices/platform/*.aoc/control/memory_votes_a32");
+    runCommand("AoC memory votes", "timeout 0.5 cat /sys/devices/platform/*.aoc/control/memory_votes_ff1");
     runCommand("clean AoC buffer","echo ' ' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (A32)", "echo 'dbg heap -c 1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (F1)", "echo 'dbg heap -c 2' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (HF0)", "echo 'dbg heap -c 3' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (HF1)", "echo 'dbg heap -c 4' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
+    runCommand("AoC DVFS (A32)", "echo 'dbg info -c 1 DVFSA32' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC DVFS (FF1)", "echo 'dbg info -c 2 DVFSFF1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Monitor Mode Status", "echo 'monitor_mode status' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     return 0;
diff --git a/aoc/sepolicy/aocd.te b/aoc/sepolicy/aocd.te
index b2bfd13..464e46b 100644
--- a/aoc/sepolicy/aocd.te
+++ b/aoc/sepolicy/aocd.te
@@ -20,4 +20,5 @@
 
 # set properties
 set_prop(aocd, vendor_aoc_prop)
-set_prop(aocd, vendor_timeout_aoc_prop)
\ No newline at end of file
+set_prop(aocd, vendor_timeout_aoc_prop)
+get_prop(aocd, vendor_volte_mif_off)
\ No newline at end of file
diff --git a/aoc/sepolicy/aocxd.te b/aoc/sepolicy/aocxd.te
new file mode 100644
index 0000000..bcfcd7b
--- /dev/null
+++ b/aoc/sepolicy/aocxd.te
@@ -0,0 +1,28 @@
+# aocxd server domain
+type aocxd, domain;
+type aocxd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(aocxd)
+
+# sysfs operations
+allow aocxd sysfs_aoc:dir search;
+
+# dev operations
+allow aocxd aoc_device:chr_file rw_file_perms;
+
+# allow inotify to watch for additions/removals from /dev
+allow aocxd device:dir r_dir_perms;
+
+# set properties
+set_prop(aocxd, vendor_aoc_prop);
+
+# allow binder access
+vndbinder_use(aocxd);
+
+# allow managing wakelocks
+wakelock_use(aocxd);
+
+# add aocx service to the domain
+add_service(aocxd, aocx);
+
+# allow managing thread priority
+allow aocxd self:global_capability_class_set sys_nice;
diff --git a/aoc/sepolicy/file_contexts b/aoc/sepolicy/file_contexts
index 58edf2f..73293f7 100644
--- a/aoc/sepolicy/file_contexts
+++ b/aoc/sepolicy/file_contexts
@@ -27,11 +27,19 @@
 /dev/acd-audio_ap_offload_rx        u:object_r:aoc_device:s0
 /dev/acd-audio_ap_offload_tx        u:object_r:aoc_device:s0
 /dev/acd-mel_processor              u:object_r:aoc_device:s0
+/dev/acd-aocx_control               u:object_r:aoc_device:s0
+/dev/acd-aocx_inject[0-9]*          u:object_r:aoc_device:s0
+/dev/acd-aocx_tapout[0-9]*          u:object_r:aoc_device:s0
+/dev/acd-mc_headpos                 u:object_r:aoc_device:s0
+/dev/acd-chre_bt_offload_ctl        u:object_r:aoc_device:s0
+/dev/acd-chre_bt_offload_data_tx    u:object_r:aoc_device:s0
+/dev/acd-chre_bt_offload_data_rx    u:object_r:aoc_device:s0
 
 # AoC vendor binaries
 /vendor/bin/aocd                    u:object_r:aocd_exec:s0
 /vendor/bin/aocdump                 u:object_r:aocdump_exec:s0
 /vendor/bin/dump/dump_aoc           u:object_r:dump_aoc_exec:s0
+/vendor/bin/aocxd                   u:object_r:aocxd_exec:s0
 
 # AoC audio files
 /vendor/etc/aoc(/.*)?               u:object_r:aoc_audio_file:s0
diff --git a/aoc/sepolicy/property.te b/aoc/sepolicy/property.te
index c2f5695..e6d715b 100644
--- a/aoc/sepolicy/property.te
+++ b/aoc/sepolicy/property.te
@@ -1,3 +1,4 @@
 # AoC
 vendor_internal_prop(vendor_aoc_prop)
-vendor_internal_prop(vendor_timeout_aoc_prop)
\ No newline at end of file
+vendor_internal_prop(vendor_timeout_aoc_prop)
+vendor_internal_prop(vendor_volte_mif_off)
diff --git a/aoc/sepolicy/property_contexts b/aoc/sepolicy/property_contexts
index 3c2acb6..475272a 100644
--- a/aoc/sepolicy/property_contexts
+++ b/aoc/sepolicy/property_contexts
@@ -1,3 +1,4 @@
 # AoC
 vendor.aoc.firmware.version                     u:object_r:vendor_aoc_prop:s0
-persist.vendor.aoc.status_request_timed_out     u:object_r:vendor_timeout_aoc_prop:s0
\ No newline at end of file
+persist.vendor.aoc.status_request_timed_out     u:object_r:vendor_timeout_aoc_prop:s0
+persist.vendor.radio.volte_mif_off              u:object_r:vendor_volte_mif_off:s0
\ No newline at end of file
diff --git a/aoc/sepolicy/service.te b/aoc/sepolicy/service.te
new file mode 100644
index 0000000..502b28d
--- /dev/null
+++ b/aoc/sepolicy/service.te
@@ -0,0 +1 @@
+type aocx, service_manager_type;
diff --git a/aoc/sepolicy/service_contexts b/aoc/sepolicy/service_contexts
new file mode 100644
index 0000000..de31e51
--- /dev/null
+++ b/aoc/sepolicy/service_contexts
@@ -0,0 +1 @@
+aocx.IAocx    u:object_r:aocx:s0
diff --git a/audio/aidl.mk b/audio/aidl.mk
index bd11249..e06ac0b 100644
--- a/audio/aidl.mk
+++ b/audio/aidl.mk
@@ -1,3 +1,4 @@
+
 DEVICE_MANIFEST_FILE += device/google/gs-common/audio/aidl/manifest.xml
 
 # Audio HALs
@@ -5,9 +6,6 @@
     android.hardware.audio.service-aidl.aoc \
     vendor.google.whitechapel.audio.hal.parserservice \
 
-# AIDL software effects. These are the effects supporting in all projects.
-# For the project-specific effects, such as haptic generator, please add them
-# to makefile in the project's device folder.
 PRODUCT_PACKAGES += \
     libvisualizeraidl \
     libbundleaidl \
@@ -15,8 +13,10 @@
     libdynamicsprocessingaidl \
     libloudnessenhanceraidl \
     libdownmixaidl \
+    libhapticgeneratoraidl \
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/aidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio
 
 include device/google/gs-common/audio/common.mk
 
@@ -24,3 +24,7 @@
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.audio_hal.aidl.enable=true
+PRODUCT_SYSTEM_EXT_PROPERTIES += \
+       ro.audio.ihaladaptervendorextension_enabled=true
+
+$(call soong_config_set,pixel_audio_hal_type,aidl_build,true)
diff --git a/audio/aidl/device_framework_matrix_product.xml b/audio/aidl/device_framework_matrix_product.xml
index 10b6e4b..3079aab 100644
--- a/audio/aidl/device_framework_matrix_product.xml
+++ b/audio/aidl/device_framework_matrix_product.xml
@@ -9,7 +9,7 @@
     </hal>
     <hal format="aidl">
         <name>vendor.google.whitechapel.audio.extension</name>
-        <version>1</version>
+        <version>2</version>
         <interface>
             <name>IAudioExtension</name>
             <instance>default</instance>
diff --git a/audio/common.mk b/audio/common.mk
index 4157970..edf7b6a 100644
--- a/audio/common.mk
+++ b/audio/common.mk
@@ -6,7 +6,7 @@
 	libmahalcontroller \
 	libAlgFx_HiFi3z
 
-ifneq ($(RELEASE_PIXEL_AIDL_AUDIO_HAL),true)
+ifneq ($(USE_AUDIO_HAL_AIDL),true)
 ## AudioHAL Configurations
 PRODUCT_COPY_FILES += \
 	frameworks/av/services/audiopolicy/config/a2dp_audio_policy_configuration_7_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/a2dp_audio_policy_configuration_7_0.xml \
diff --git a/audio/hidl_zuma.mk b/audio/hidl_zuma.mk
index d671f46..41dd02a 100644
--- a/audio/hidl_zuma.mk
+++ b/audio/hidl_zuma.mk
@@ -31,6 +31,7 @@
 	audio.bluetooth.default \
 	audio.r_submix.default \
 	audio_spk_35l41 \
+	audio_spk_tas25xx \
 	audio_hdmi_aoc \
 	sound_trigger.primary.$(TARGET_BOARD_PLATFORM)
 
diff --git a/audio/sepolicy/aidl/hal_audio_default.te b/audio/sepolicy/aidl/hal_audio_default.te
index 2512a17..1ae90c7 100644
--- a/audio/sepolicy/aidl/hal_audio_default.te
+++ b/audio/sepolicy/aidl/hal_audio_default.te
@@ -1 +1,4 @@
 add_service(hal_audio_default, hal_audio_ext_service)
+# Allow audio-hal to register battery_mitigation service
+allow hal_audio_default hal_battery_mitigation_service:service_manager find;
+binder_call(hal_audio_default, battery_mitigation)
diff --git a/audio/sepolicy/aidl/service.te b/audio/sepolicy/aidl/service.te
index cbdc404..d931f16 100644
--- a/audio/sepolicy/aidl/service.te
+++ b/audio/sepolicy/aidl/service.te
@@ -1,3 +1,3 @@
 # Audio
 type hal_audio_ext_service, hal_service_type, service_manager_type;
-type hal_audio_parameter_parser_service, service_manager_type;
+type hal_audio_parameter_parser_service, service_manager_type;
\ No newline at end of file
diff --git a/audio/sepolicy/aidl/service_contexts b/audio/sepolicy/aidl/service_contexts
index c2b7716..7a7d61d 100644
--- a/audio/sepolicy/aidl/service_contexts
+++ b/audio/sepolicy/aidl/service_contexts
@@ -1,4 +1,3 @@
 # Audio
 vendor.google.whitechapel.audio.extension.IAudioExtension/default    u:object_r:hal_audio_ext_service:s0
-android.media.audio.IHalAdapterVendorExtension/default               u:object_r:hal_audio_parameter_parser_service:s0
-
+android.media.audio.IHalAdapterVendorExtension/default               u:object_r:hal_audio_parameter_parser_service:s0
\ No newline at end of file
diff --git a/audio/sepolicy/common/genfs_contexts b/audio/sepolicy/common/genfs_contexts
index eaa0c71..c4a3120 100644
--- a/audio/sepolicy/common/genfs_contexts
+++ b/audio/sepolicy/common/genfs_contexts
@@ -21,3 +21,4 @@
 genfscon sysfs /devices/platform/audiometrics/offload_effects_id            u:object_r:sysfs_pixelstats:s0
 genfscon sysfs /devices/platform/audiometrics/offload_effects_duration      u:object_r:sysfs_pixelstats:s0
 genfscon sysfs /devices/platform/audiometrics/bt_usage                      u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/speaker_version               u:object_r:sysfs_pixelstats:s0
diff --git a/audio/sepolicy/common/hal_audio_default.te b/audio/sepolicy/common/hal_audio_default.te
index 5cb03ac..fac4f1a 100644
--- a/audio/sepolicy/common/hal_audio_default.te
+++ b/audio/sepolicy/common/hal_audio_default.te
@@ -12,6 +12,8 @@
 allow hal_audio_default amcs_device:file rw_file_perms;
 allow hal_audio_default amcs_device:chr_file rw_file_perms;
 allow hal_audio_default sysfs_pixelstats:file rw_file_perms;
+allow hal_audio_default sysfs_extcon:dir search;
+allow hal_audio_default sysfs_extcon:file r_file_perms;
 
 #allow access to aoc and kernel boottime
 allow hal_audio_default sysfs_aoc:dir { search };
@@ -26,9 +28,15 @@
 hal_client_domain(hal_audio_default, hal_thermal);
 allow hal_audio_default fwk_sensor_hwservice:hwservice_manager find;
 
+hal_client_domain(hal_audio_default, hal_graphics_allocator);
+
 userdebug_or_eng(`
     allow hal_audio_default self:unix_stream_socket create_stream_socket_perms;
     allow hal_audio_default audio_vendor_data_file:sock_file { create unlink };
 ')
 
 wakelock_use(hal_audio_default);
+
+vndbinder_use(hal_audio_default);
+allow hal_audio_default aocx:service_manager find;
+binder_call(hal_audio_default, aocxd);
diff --git a/audio/sepolicy/common/property.te b/audio/sepolicy/common/property.te
index e2ffcd1..2287b84 100644
--- a/audio/sepolicy/common/property.te
+++ b/audio/sepolicy/common/property.te
@@ -1,2 +1,5 @@
 # Audio
 vendor_internal_prop(vendor_audio_prop)
+
+# The property for Audio App
+vendor_restricted_prop(vendor_audio_prop_restricted)
diff --git a/audio/sepolicy/common/property_contexts b/audio/sepolicy/common/property_contexts
index 1749ac8..96e678c 100644
--- a/audio/sepolicy/common/property_contexts
+++ b/audio/sepolicy/common/property_contexts
@@ -9,3 +9,6 @@
 vendor.audiodump.log.cca.updated                u:object_r:vendor_audio_prop:s0
 vendor.audiodump.cca.config                     u:object_r:vendor_audio_prop:s0
 vendor.audio_hal.aidl.enable                    u:object_r:vendor_audio_prop:s0
+
+# for audio app
+persist.vendor.app.audio.                       u:object_r:vendor_audio_prop_restricted:s0
diff --git a/audio/sepolicy/common/vendor_init.te b/audio/sepolicy/common/vendor_init.te
index 26f3fa8..1562d45 100644
--- a/audio/sepolicy/common/vendor_init.te
+++ b/audio/sepolicy/common/vendor_init.te
@@ -1,2 +1,5 @@
 # Audio property
 set_prop(vendor_init, vendor_audio_prop)
+
+# Audio App property
+set_prop(vendor_init, vendor_audio_prop_restricted)
diff --git a/battery_mitigation/Android.bp b/battery_mitigation/Android.bp
deleted file mode 100644
index c919de5..0000000
--- a/battery_mitigation/Android.bp
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-soong_namespace {
-    imports: [
-        "hardware/google/pixel",
-    ],
-}
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-cc_binary {
-    vendor: true,
-    name: "battery_mitigation",
-    relative_install_path: "hw",
-    proprietary: true,
-    init_rc: ["battery_mitigation.rc"],
-    shared_libs: [
-        "libpixelmitigation",
-        "libbase",
-        "libbinder_ndk",
-        "libcutils",
-        "libhardware",
-        "liblog",
-        "libutils",
-        "android.hardware.thermal@2.0",
-        "android.hardware.thermal-V1-ndk"
-    ],
-    srcs: [
-        "battery_mitigation.cpp",
-    ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
-}
diff --git a/battery_mitigation/battery_mitigation.cpp b/battery_mitigation/battery_mitigation.cpp
deleted file mode 100644
index 18bb63d..0000000
--- a/battery_mitigation/battery_mitigation.cpp
+++ /dev/null
@@ -1,246 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "battery-mitigation"
-
-#include <android/binder_process.h>
-#include <battery_mitigation/BatteryMitigation.h>
-#include <battery_mitigation/BatteryMitigationService.h>
-#include <sys/resource.h>
-#include <system/thread_defs.h>
-
-#define COUNT_LIMIT 10
-
-using android::hardware::google::pixel::BatteryMitigation;
-using android::hardware::google::pixel::BatteryMitigationService;
-using android::hardware::google::pixel::MitigationConfig;
-
-android::sp<BatteryMitigation> bmSp;
-android::sp<BatteryMitigationService> batteryMitigationService;
-
-const struct MitigationConfig::Config cfg = {
-    .SystemPath = {
-        "/dev/thermal/tz-by-name/batoilo/temp",
-        "/dev/thermal/tz-by-name/smpl_gm/temp",
-        "/dev/thermal/tz-by-name/soc/temp",
-        "/dev/thermal/tz-by-name/vdroop1/temp",
-        "/dev/thermal/tz-by-name/vdroop2/temp",
-        "/dev/thermal/tz-by-name/ocp_gpu/temp",
-        "/dev/thermal/tz-by-name/ocp_tpu/temp",
-        "/dev/thermal/tz-by-name/soft_ocp_cpu2/temp",
-        "/dev/thermal/tz-by-name/soft_ocp_cpu1/temp",
-        "/dev/thermal/tz-by-name/battery/temp",
-        "/dev/thermal/tz-by-name/battery_cycle/temp",
-        "/sys/bus/iio/devices/iio:device0/lpf_power",
-        "/sys/bus/iio/devices/iio:device1/lpf_power",
-        "/dev/thermal/cdev-by-name/thermal-cpufreq-2/cur_state",
-        "/dev/thermal/cdev-by-name/thermal-cpufreq-1/cur_state",
-        "/dev/thermal/cdev-by-name/thermal-gpufreq-0/cur_state",
-        "/dev/thermal/cdev-by-name/tpu_cooling/cur_state",
-        "/dev/thermal/cdev-by-name/CAM/cur_state",
-        "/dev/thermal/cdev-by-name/DISP/cur_state",
-        "/dev/thermal/cdev-by-name/gxp-cooling/cur_state",
-        "/sys/class/power_supply/battery/voltage_now",
-        "/sys/class/power_supply/battery/current_now",
-    },
-    .FilteredZones = {
-        "batoilo",
-        "vdroop1",
-        "vdroop2",
-        "smpl_gm",
-    },
-    .SystemName = {
-        "batoilo", "smpl_gm", "soc", "vdroop1", "vdroop2", "ocp_gpu",
-        "ocp_tpu", "soft_ocp_cpu2", "soft_ocp_cpu1", "battery", "battery_cycle",
-        "main", "sub", "CPU2", "CPU1", "GPU", "TPU", "CAM", "DISP", "NPU",
-        "voltage_now", "current_now",
-    },
-    .LogFilePath = "/data/vendor/mitigation/thismeal.txt",
-    .TimestampFormat = "%Y-%m-%d %H:%M:%S",
-};
-
-const struct MitigationConfig::EventThreadConfig eventThreadCfg = {
-    .NumericSysfsStatPaths = {
-        {"cpu0_freq", "/sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq"},
-        {"cpu1_freq", "/sys/devices/system/cpu/cpu1/cpufreq/scaling_cur_freq"},
-        {"cpu2_freq", "/sys/devices/system/cpu/cpu2/cpufreq/scaling_cur_freq"},
-        {"gpu_freq", "/sys/devices/platform/1f000000.mali/cur_freq"},
-        {"battery_temp", "/dev/thermal/tz-by-name/battery/temp"},
-        {"battery_cycle", "/dev/thermal/tz-by-name/battery_cycle/temp"},
-        {"voltage_now", "/sys/class/power_supply/battery/voltage_now"},
-        {"current_now", "/sys/class/power_supply/battery/current_now"},
-    },
-    .TriggeredIdxPath = "/sys/devices/virtual/pmic/mitigation/br_stats/triggered_idx",
-    .triggeredStatePath[android::hardware::google::pixel::UVLO1] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/uvlo1_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::UVLO2] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/uvlo2_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::OILO1] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/oilo1_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::OILO2] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/oilo2_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::SMPL] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/smpl_triggered",
-    .BrownoutStatsPath = "/sys/devices/virtual/pmic/mitigation/br_stats/stats",
-    .StoringPath = "/data/vendor/mitigation/thismeal.bin",
-    .ParsedThismealPath = "/data/vendor/mitigation/thismeal.txt",
-    .ParsedLastmealPath = "/data/vendor/mitigation/lastmeal.txt",
-    .ParsedLastmealCSVPath = "/data/vendor/mitigation/lastmeal.csv",
-    .FvpStatsPath = "/sys/devices/platform/acpm_stats/fvp_stats",
-    .PmicCommon = {
-                /* Main Pmic */
-                {
-                    .OdpmDir = "/sys/bus/iio/devices/iio:device0",
-                    .OdpmEnabledRailsPath = "/sys/bus/iio/devices/iio:device0/enabled_rails",
-                    .PmicNamePath = "/sys/bus/iio/devices/iio:device0/name",
-                },
-                /* Sub Pmic */
-                {
-                    .OdpmDir = "/sys/bus/iio/devices/iio:device1",
-                    .OdpmEnabledRailsPath = "/sys/bus/iio/devices/iio:device1/enabled_rails",
-                    .PmicNamePath = "/sys/bus/iio/devices/iio:device1/name",
-                },
-    },
-    .PlatformSpecific = {
-                /* MIN_SUPPORTED_PLATFORM */
-                {
-                    .MainPmicName = "s2mpg10-odpm\n",
-                    .SubPmicName = "s2mpg11-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77759fg/capacity"},
-                    },
-                },
-                {
-                    .MainPmicName = "s2mpg12-odpm\n",
-                    .SubPmicName = "s2mpg13-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77759fg/capacity"},
-                    },
-                },
-                {
-                    .MainPmicName = "s2mpg14-odpm\n",
-                    .SubPmicName = "s2mpg15-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77779fg/capacity"},
-                    },
-                },
-                /* MAX_SUPPORTED_PLATFORM */
-                {
-                    .MainPmicName = "s2mpg14-odpm\n",
-                    .SubPmicName = "s2mpg15-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77779fg/capacity"},
-                    },
-                },
-
-    },
-};
-
-const char kReadyFilePath[] = "/sys/devices/virtual/pmic/mitigation/instruction/ready";
-const char kReadyProperty[] = "vendor.brownout.mitigation.ready";
-const char kLastMealPath[] = "/data/vendor/mitigation/lastmeal.txt";
-const char kBRRequestedProperty[] = "vendor.brownout_reason";
-const char kLastMealProperty[] = "vendor.brownout.br.feasible";
-const char kCDTProperty[] = "ro.boot.cdt_hwid";
-const std::regex kTimestampRegex("^\\S+\\s[0-9]+:[0-9]+:[0-9]+\\S+$");
-
-std::string GetSystemProperty(std::string property) {
-    char value[PROP_VALUE_MAX];
-    __system_property_get(property.c_str(), value);
-    return std::string(value);
-}
-
-int main(int argc, char **argv) {
-    std::string cdt = GetSystemProperty(kCDTProperty);
-    int platformNum  = atoi(cdt.substr(5, 1).c_str());
-    batteryMitigationService = new BatteryMitigationService(eventThreadCfg,
-                                                            platformNum);
-    if (!batteryMitigationService) {
-        return 0;
-    }
-    bool platformSupported = batteryMitigationService->isPlatformSupported();
-    bool brownoutStatsBinarySupported = batteryMitigationService->isBrownoutStatsBinarySupported();
-    if (argc == 2) {
-        if(strcmp(argv[1], "-d") == 0 &&
-           brownoutStatsBinarySupported &&
-           platformSupported) {
-            /* Create thismeal.txt from thismeal.bin */
-            batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedThismealPath);
-        }
-        return 0;
-    }
-
-    setpriority(PRIO_PROCESS, 0, ANDROID_PRIORITY_AUDIO);
-    auto batteryMitigationStartTime = std::chrono::system_clock::now();
-    ABinderProcess_setThreadPoolMaxThreadCount(1);
-    ABinderProcess_startThreadPool();
-
-    bool mitigationLogTimeValid;
-    std::string reason = android::base::GetProperty(kBRRequestedProperty, "");
-    if (brownoutStatsBinarySupported) {
-        /* Create lastmeal.txt if the dump time in thismeal.bin are valid */
-        mitigationLogTimeValid = batteryMitigationService->isTimeValid(eventThreadCfg.StoringPath,
-                                                                       batteryMitigationStartTime);
-        if (!reason.empty() && mitigationLogTimeValid &&
-            batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedLastmealPath) &&
-            batteryMitigationService->genLastmealCSV(eventThreadCfg.ParsedLastmealCSVPath)) {
-            android::base::SetProperty(kLastMealProperty, "1");
-        }
-    } else{
-        bmSp = new BatteryMitigation(cfg);
-        if (!bmSp) {
-            return 0;
-        }
-        mitigationLogTimeValid = bmSp->isMitigationLogTimeValid(batteryMitigationStartTime,
-                                                                cfg.LogFilePath,
-                                                                cfg.TimestampFormat,
-                                                                kTimestampRegex);
-        if (!reason.empty() && mitigationLogTimeValid) {
-            std::ifstream src(cfg.LogFilePath, std::ios::in);
-            std::ofstream dst(kLastMealPath, std::ios::out);
-            dst << src.rdbuf();
-            android::base::SetProperty(kLastMealProperty, "1");
-        }
-    }
-
-    bool isBatteryMitigationReady = false;
-    std::string ready_str;
-    int val = 0;
-    for (int i = 0; i < COUNT_LIMIT; i++) {
-        if (!android::base::ReadFileToString(kReadyFilePath, &ready_str)) {
-            continue;
-        }
-        ready_str = android::base::Trim(ready_str);
-        if (!android::base::ParseInt(ready_str, &val)) {
-            continue;
-        }
-        if (val == 1) {
-            isBatteryMitigationReady = true;
-            break;
-        }
-    }
-    if (isBatteryMitigationReady) {
-        android::base::SetProperty(kReadyProperty, "1");
-    }
-    if (isBatteryMitigationReady && brownoutStatsBinarySupported) {
-        /* Start BrownoutEventThread to poll brownout event from kernel */
-        batteryMitigationService->startBrownoutEventThread();
-    }
-    while (true) {
-        pause();
-    }
-    return 0;
-}
diff --git a/battery_mitigation/battery_mitigation.rc b/battery_mitigation/battery_mitigation.rc
deleted file mode 100644
index 6c8f5cc..0000000
--- a/battery_mitigation/battery_mitigation.rc
+++ /dev/null
@@ -1,96 +0,0 @@
-on property:vendor.thermal.link_ready=1
-    mkdir /data/vendor/mitigation 0755 system system
-    chown system system /data/vendor/mitigation
-    start vendor.battery_mitigation
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,if && property:sys.boot.reason=reboot,uvlo,pmic,if
-    setprop vendor.brownout_reason "uvlo,pmic,if"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,pmic,if && property:sys.boot.reason=reboot,ocp,pmic,if
-    setprop vendor.brownout_reason "ocp,pmic,if"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,main && property:sys.boot.reason=reboot,uvlo,pmic,main
-    setprop vendor.brownout_reason "uvlo,pmic,main"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,sub && property:sys.boot.reason=reboot,uvlo,pmic,sub
-    setprop vendor.brownout_reason "uvlo,pmic,sub"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK1M && property:sys.boot.reason=reboot,ocp,buck1m
-    setprop vendor.brownout_reason "ocp,buck1m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK2M && property:sys.boot.reason=reboot,ocp,buck2m
-    setprop vendor.brownout_reason "ocp,buck2m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK3M && property:sys.boot.reason=reboot,ocp,buck3m
-    setprop vendor.brownout_reason "ocp,buck3m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK4M && property:sys.boot.reason=reboot,ocp,buck4m
-    setprop vendor.brownout_reason "ocp,buck4m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK5M && property:sys.boot.reason=reboot,ocp,buck5m
-    setprop vendor.brownout_reason "ocp,buck5m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK6M && property:sys.boot.reason=reboot,ocp,buck6m
-    setprop vendor.brownout_reason "ocp,buck6m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK7M && property:sys.boot.reason=reboot,ocp,buck7m
-    setprop vendor.brownout_reason "ocp,buck7m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK8M && property:sys.boot.reason=reboot,ocp,buck8m
-    setprop vendor.brownout_reason "ocp,buck8m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK9M && property:sys.boot.reason=reboot,ocp,buck9m
-    setprop vendor.brownout_reason "ocp,buck9m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK10M && property:sys.boot.reason=reboot,ocp,buck10m
-    setprop vendor.brownout_reason "ocp,buck10m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK1S && property:sys.boot.reason=reboot,ocp,buck1s
-    setprop vendor.brownout_reason "ocp,buck1s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK2S && property:sys.boot.reason=reboot,ocp,buck2s
-    setprop vendor.brownout_reason "ocp,buck2s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK3S && property:sys.boot.reason=reboot,ocp,buck3s
-    setprop vendor.brownout_reason "ocp,buck3s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK4S && property:sys.boot.reason=reboot,ocp,buck4s
-    setprop vendor.brownout_reason "ocp,buck4s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK5S && property:sys.boot.reason=reboot,ocp,buck5s
-    setprop vendor.brownout_reason "ocp,buck5s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK6S && property:sys.boot.reason=reboot,ocp,buck6s
-    setprop vendor.brownout_reason "ocp,buck6s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK7S && property:sys.boot.reason=reboot,ocp,buck7s
-    setprop vendor.brownout_reason "ocp,buck7s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK8S && property:sys.boot.reason=reboot,ocp,buck8s
-    setprop vendor.brownout_reason "ocp,buck8s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK9S && property:sys.boot.reason=reboot,ocp,buck9s
-    setprop vendor.brownout_reason "ocp,buck9s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK10S && property:sys.boot.reason=reboot,ocp,buck10s
-    setprop vendor.brownout_reason "ocp,buck10s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKDS && property:sys.boot.reason=reboot,ocp,buckds
-    setprop vendor.brownout_reason "ocp,buckds"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKAS && property:sys.boot.reason=reboot,ocp,buckas
-    setprop vendor.brownout_reason "ocp,buckas"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKCS && property:sys.boot.reason=reboot,ocp,buckcs
-    setprop vendor.brownout_reason "ocp,buckcs"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKBS && property:sys.boot.reason=reboot,ocp,buckbs
-    setprop vendor.brownout_reason "ocp,buckbs"
-
-on property:vendor.brownout.br.feasible=1
-    chown system system data/vendor/mitigation/lastmeal.txt
-
-service vendor.battery_mitigation /vendor/bin/hw/battery_mitigation
-    user system
-    group system
-    capabilities WAKE_ALARM BLOCK_SUSPEND
diff --git a/battery_mitigation/bcl.mk b/battery_mitigation/bcl.mk
index 13e5788..5bf1a25 100644
--- a/battery_mitigation/bcl.mk
+++ b/battery_mitigation/bcl.mk
@@ -7,7 +7,17 @@
 endif
 endif
 
+ifeq ($(RELEASE_PIXEL_AIDL_BATTERY_MITIGATION_HAL), true)
+PRODUCT_PROPERTY_OVERRIDES += \
+       vendor.battery_mitigation.aidl.enable=true
+endif
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/battery_mitigation \
+                            vendor/google/battery_mitigation
+PRODUCT_PACKAGES += vendor.google.battery_mitigation-default
+PRODUCT_PACKAGES += vendor.google.battery_mitigation.service_static
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/battery_mitigation/compatibility_matrix.xml
+
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy/vendor
 SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy/system_ext/private
 SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy/system_ext/public
-PRODUCT_SOONG_NAMESPACES += device/google/gs-common/battery_mitigation
diff --git a/battery_mitigation/compatibility_matrix.xml b/battery_mitigation/compatibility_matrix.xml
new file mode 100644
index 0000000..7e3d88e
--- /dev/null
+++ b/battery_mitigation/compatibility_matrix.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>vendor.google.battery_mitigation</name>
+        <version>1</version>
+        <interface>
+            <name>IBatteryMitigation</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/battery_mitigation/sepolicy/vendor/battery_mitigation.te b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
index 4b5bc48..30b314c 100644
--- a/battery_mitigation/sepolicy/vendor/battery_mitigation.te
+++ b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
@@ -19,13 +19,20 @@
 r_dir_file(battery_mitigation, sysfs_odpm)
 r_dir_file(battery_mitigation, sysfs_power_stats)
 allow battery_mitigation sysfs_bcl:dir r_dir_perms;
-allow battery_mitigation sysfs_bcl:file r_file_perms;
+allow battery_mitigation sysfs_bcl:file rw_file_perms;
 allow battery_mitigation sysfs_bcl:lnk_file r_file_perms;
 allow battery_mitigation sysfs_thermal:lnk_file r_file_perms;
 allow battery_mitigation mitigation_vendor_data_file:dir rw_dir_perms;
 allow battery_mitigation mitigation_vendor_data_file:file create_file_perms;
+allow battery_mitigation dumpstate:fd use;
+allow battery_mitigation dumpstate:fifo_file rw_file_perms;
 
 # Allow battery_mitigation to use Binder IPC so that service manager can notify it for callbacks
 binder_use(battery_mitigation)
 # Allow battery_mitigation to listen brownout event by epoll_wait
 wakelock_use(battery_mitigation)
+# Allow battery_mitigation to run aidl service
+add_service(battery_mitigation, hal_battery_mitigation_service)
+# Allow battery_mitigation to run audio mitigation callback
+binder_call(battery_mitigation, hal_audio_default)
+binder_call(battery_mitigation, servicemanager)
diff --git a/battery_mitigation/sepolicy/vendor/dumpstate.te b/battery_mitigation/sepolicy/vendor/dumpstate.te
new file mode 100644
index 0000000..b3bb1d4
--- /dev/null
+++ b/battery_mitigation/sepolicy/vendor/dumpstate.te
@@ -0,0 +1,3 @@
+# To call battery_mitigation hal
+allow dumpstate hal_battery_mitigation_service:service_manager find;
+binder_call(dumpstate, battery_mitigation);
diff --git a/battery_mitigation/sepolicy/vendor/service.te b/battery_mitigation/sepolicy/vendor/service.te
new file mode 100644
index 0000000..f0c7e9d
--- /dev/null
+++ b/battery_mitigation/sepolicy/vendor/service.te
@@ -0,0 +1 @@
+type hal_battery_mitigation_service, hal_service_type, service_manager_type;
diff --git a/battery_mitigation/sepolicy/vendor/service_contexts b/battery_mitigation/sepolicy/vendor/service_contexts
new file mode 100644
index 0000000..472259e
--- /dev/null
+++ b/battery_mitigation/sepolicy/vendor/service_contexts
@@ -0,0 +1 @@
+vendor.google.battery_mitigation.IBatteryMitigation/default    u:object_r:hal_battery_mitigation_service:s0
diff --git a/bcmbt/bluetooth.mk b/bcmbt/bluetooth.mk
index eb6a29b..18c066b 100644
--- a/bcmbt/bluetooth.mk
+++ b/bcmbt/bluetooth.mk
@@ -1,6 +1,8 @@
 PRODUCT_SOONG_NAMESPACES += vendor/broadcom/bluetooth
 PRODUCT_PACKAGES += \
        android.hardware.bluetooth-V1-ndk.so \
+       android.hardware.bluetooth.finder-V1-ndk.so \
+       android.hardware.bluetooth.ranging-V1-ndk.so \
        android.hardware.bluetooth-service.bcmbtlinux \
        vendor.google.bluetooth_ext-V1-ndk.so \
        bt_vendor.conf \
@@ -9,6 +11,7 @@
 
 
 BOARD_SEPOLICY_DIRS += device/google/gs-common/bcmbt/sepolicy
+BOARD_SEPOLICY_DIRS += hardware/google/pixel-sepolicy/powerstats
 
 DEVICE_MANIFEST_FILE += device/google/gs-common/bcmbt/manifest_bluetooth.xml
 DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/bcmbt/compatibility_matrix.xml
diff --git a/bcmbt/compatibility_matrix.xml b/bcmbt/compatibility_matrix.xml
index 1a63ccf..65b0c6d 100644
--- a/bcmbt/compatibility_matrix.xml
+++ b/bcmbt/compatibility_matrix.xml
@@ -6,7 +6,6 @@
             <name>IBluetoothFinder</name>
             <instance>default</instance>
         </interface>
-        <fqname>IBluetoothFinder/default</fqname>
         <interface>
             <name>IBluetoothCcc</name>
             <instance>default</instance>
diff --git a/bcmbt/dump/dump_bcmbt.cpp b/bcmbt/dump/dump_bcmbt.cpp
index 0135198..fde0ad0 100644
--- a/bcmbt/dump/dump_bcmbt.cpp
+++ b/bcmbt/dump/dump_bcmbt.cpp
@@ -21,8 +21,10 @@
 #define BCMBT_SNOOP_LOG_DIRECTORY "/data/vendor/bluetooth"
 #define BCMBT_FW_LOG_DIRECTORY "/data/vendor/ssrdump/coredump"
 #define BCMBT_SNOOP_LOG_PREFIX "btsnoop_hci_vnd"
+#define BCMBT_BACKUP_SNOOP_LOG_PREFIX "backup_btsnoop_hci_vnd"
 #define BCMBT_FW_DUMP_LOG_PREFIX "coredump_bt_socdump_"
 #define BCMBT_CHRE_DUMP_LOG_PREFIX "coredump_bt_chredump_"
+#define BCMBT_HAL_DUMP_LOG_PREFIX "coredump_bt_"
 #define BCMBT_ACTIVITY_LOG_PREFIX "bt_activity_"
 
 int main() {
@@ -33,8 +35,10 @@
     }
 
     dumpLogs(BCMBT_SNOOP_LOG_DIRECTORY, outputDir.c_str(), 2, BCMBT_SNOOP_LOG_PREFIX);
+    dumpLogs(BCMBT_SNOOP_LOG_DIRECTORY, outputDir.c_str(), 2, BCMBT_BACKUP_SNOOP_LOG_PREFIX);
     dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_FW_DUMP_LOG_PREFIX);
     dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_CHRE_DUMP_LOG_PREFIX);
+    dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_HAL_DUMP_LOG_PREFIX);
     dumpLogs(BCMBT_ACTIVITY_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_ACTIVITY_LOG_PREFIX);
     return 0;
 }
diff --git a/bcmbt/manifest_bluetooth.xml b/bcmbt/manifest_bluetooth.xml
index f14112c..a72f1c9 100644
--- a/bcmbt/manifest_bluetooth.xml
+++ b/bcmbt/manifest_bluetooth.xml
@@ -5,6 +5,16 @@
         <fqname>IBluetoothHci/default</fqname>
     </hal>
     <hal format="aidl">
+        <name>android.hardware.bluetooth.finder</name>
+        <version>1</version>
+        <fqname>IBluetoothFinder/default</fqname>
+    </hal>
+    <hal format="aidl">
+        <name>android.hardware.bluetooth.ranging</name>
+        <version>1</version>
+        <fqname>IBluetoothChannelSounding/default</fqname>
+    </hal>
+    <hal format="aidl">
         <name>vendor.google.bluetooth_ext</name>
         <version>1</version>
         <fqname>IBTChannelAvoidance/default</fqname>
diff --git a/betterbug/betterbug.mk b/betterbug/betterbug.mk
new file mode 100644
index 0000000..906933d
--- /dev/null
+++ b/betterbug/betterbug.mk
@@ -0,0 +1,8 @@
+# When neither AOSP nor factory targets
+ifeq (,$(filter aosp_% factory_%, $(TARGET_PRODUCT)))
+  PRODUCT_PACKAGES += BetterBugStub
+  PRODUCT_PACKAGES_DEBUG += BetterBug
+endif
+
+PRODUCT_PUBLIC_SEPOLICY_DIRS += device/google/gs-common/betterbug/sepolicy/product/public
+PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/betterbug/sepolicy/product/private
diff --git a/betterbug/sepolicy/product/private/better_bug_app.te b/betterbug/sepolicy/product/private/better_bug_app.te
new file mode 100644
index 0000000..26e0565
--- /dev/null
+++ b/betterbug/sepolicy/product/private/better_bug_app.te
@@ -0,0 +1,47 @@
+typeattribute better_bug_app coredomain;
+
+app_domain(better_bug_app)
+net_domain(better_bug_app)
+
+allow better_bug_app app_api_service:service_manager find;
+allow better_bug_app mediaserver_service:service_manager find;
+allow better_bug_app radio_service:service_manager find;
+allow better_bug_app system_api_service:service_manager find;
+
+allow better_bug_app privapp_data_file:file execute;
+allow better_bug_app privapp_data_file:lnk_file r_file_perms;
+allow better_bug_app shell_data_file:file r_file_perms;
+allow better_bug_app shell_data_file:dir r_dir_perms;
+
+# Allow traceur to pass file descriptors through a content provider to betterbug
+allow better_bug_app trace_data_file:file { getattr read };
+
+# Allow betterbug to read profile reports generated by profcollect.
+userdebug_or_eng(`
+  allow better_bug_app profcollectd_data_file:file r_file_perms;
+')
+
+# Allow BetterBug access to WM traces attributes
+allow better_bug_app wm_trace_data_file:dir r_dir_perms;
+allow better_bug_app wm_trace_data_file:file getattr;
+
+# Allow the bug reporting frontend to read the presence and timestamp of the
+# trace attached to the bugreport (but not its contents, which will go in the
+# usual bugreport .zip file). This is used by the bug reporting UI to tell if
+# the bugreport will contain a system trace or not while the bugreport is still
+# in progress.
+allow better_bug_app perfetto_traces_bugreport_data_file:dir r_dir_perms;
+allow better_bug_app perfetto_traces_bugreport_data_file:file { getattr };
+
+# Allow BetterBug to receive Perfetto traces through the framework
+# (i.e. TracingServiceProxy) and sendfile them into their private
+# directories for reporting when network and battery conditions are
+# appropriate.
+allow better_bug_app perfetto:fd use;
+allow better_bug_app perfetto_traces_data_file:file { read getattr };
+
+# Allow BetterBug to set property to start vendor.touch_dumpstate
+set_prop(better_bug_app, ctl_start_prop)
+
+# Allow BetterBug to read system boot reason
+get_prop(better_bug_app, system_boot_reason_prop)
diff --git a/betterbug/sepolicy/product/private/seapp_contexts b/betterbug/sepolicy/product/private/seapp_contexts
new file mode 100644
index 0000000..77fe3e1
--- /dev/null
+++ b/betterbug/sepolicy/product/private/seapp_contexts
@@ -0,0 +1,2 @@
+# BetterBug
+user=_app isPrivApp=true name=com.google.android.apps.internal.betterbug domain=better_bug_app type=privapp_data_file levelFrom=user
diff --git a/betterbug/sepolicy/product/public/better_bug_app.te b/betterbug/sepolicy/product/public/better_bug_app.te
new file mode 100644
index 0000000..9a14782
--- /dev/null
+++ b/betterbug/sepolicy/product/public/better_bug_app.te
@@ -0,0 +1 @@
+type better_bug_app, domain;
diff --git a/bootctrl/1.2/Android.bp b/bootctrl/1.2/Android.bp
new file mode 100644
index 0000000..ad0b0e1
--- /dev/null
+++ b/bootctrl/1.2/Android.bp
@@ -0,0 +1,89 @@
+//
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+soong_namespace {
+    imports: [
+        "hardware/google/pixel",
+    ],
+}
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "//device/google/gs-common:device_google_gs-common_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: [
+        "//device/google/gs-common:device_google_gs-common_license",
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.boot@1.2-service-pixel",
+    defaults: ["hidl_defaults"],
+    relative_install_path: "hw",
+    vendor: true,
+    init_rc: ["android.hardware.boot@1.2-service-pixel.rc"],
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+        "service.cpp"
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.0",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot@1.2",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
+
+cc_library {
+    name: "android.hardware.boot@1.2-impl-pixel",
+    stem: "android.hardware.boot@1.0-impl-1.2-impl-pixel",
+    recovery: true,
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+    ],
+    relative_install_path: "hw",
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.0",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot@1.2",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
diff --git a/bootctrl/1.2/BootControl.cpp b/bootctrl/1.2/BootControl.cpp
new file mode 100644
index 0000000..ff02013
--- /dev/null
+++ b/bootctrl/1.2/BootControl.cpp
@@ -0,0 +1,526 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "BootControl.h"
+
+#include <android-base/file.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/properties.h>
+#include <libboot_control/libboot_control.h>
+#include <log/log.h>
+#include <trusty/tipc.h>
+
+#include "DevInfo.h"
+#include "GptUtils.h"
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+using android::bootable::GetMiscVirtualAbMergeStatus;
+using android::bootable::InitMiscVirtualAbMessageIfNeeded;
+using android::bootable::SetMiscVirtualAbMergeStatus;
+using android::hardware::boot::V1_0::BoolResult;
+using android::hardware::boot::V1_0::CommandResult;
+using android::hardware::boot::V1_1::MergeStatus;
+
+namespace {
+
+// clang-format off
+
+#define BOOT_A_PATH     "/dev/block/by-name/boot_a"
+#define BOOT_B_PATH     "/dev/block/by-name/boot_b"
+#define DEVINFO_PATH    "/dev/block/by-name/devinfo"
+
+#define BLOW_AR_PATH    "/sys/kernel/boot_control/blow_ar"
+
+// slot flags
+#define AB_ATTR_PRIORITY_SHIFT      52
+#define AB_ATTR_PRIORITY_MASK       (3UL << AB_ATTR_PRIORITY_SHIFT)
+#define AB_ATTR_ACTIVE_SHIFT        54
+#define AB_ATTR_ACTIVE              (1UL << AB_ATTR_ACTIVE_SHIFT)
+#define AB_ATTR_RETRY_COUNT_SHIFT   (55)
+#define AB_ATTR_RETRY_COUNT_MASK    (7UL << AB_ATTR_RETRY_COUNT_SHIFT)
+#define AB_ATTR_SUCCESSFUL          (1UL << 58)
+#define AB_ATTR_UNBOOTABLE          (1UL << 59)
+
+#define AB_ATTR_MAX_PRIORITY        3UL
+#define AB_ATTR_MAX_RETRY_COUNT     3UL
+
+// clang-format on
+
+static std::string getDevPath(uint32_t slot) {
+    char real_path[PATH_MAX];
+
+    const char *path = slot == 0 ? BOOT_A_PATH : BOOT_B_PATH;
+
+    int ret = readlink(path, real_path, sizeof real_path);
+    if (ret < 0) {
+        ALOGE("readlink failed for boot device %s\n", strerror(errno));
+        return std::string();
+    }
+
+    std::string dp(real_path);
+    // extract /dev/sda.. part
+    return dp.substr(0, sizeof "/dev/block/sdX" - 1);
+}
+
+static bool isSlotFlagSet(uint32_t slot, uint64_t flag) {
+    std::string dev_path = getDevPath(slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    return !!(e->attr & flag);
+}
+
+static bool setSlotFlag(uint32_t slot, uint64_t flag) {
+    std::string dev_path = getDevPath(slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    e->attr |= flag;
+    gpt.Sync();
+
+    return true;
+}
+
+static bool is_devinfo_valid;
+static bool is_devinfo_initialized;
+static std::mutex devinfo_lock;
+static devinfo_t devinfo;
+
+static bool isDevInfoValid() {
+    const std::lock_guard<std::mutex> lock(devinfo_lock);
+
+    if (is_devinfo_initialized) {
+        return is_devinfo_valid;
+    }
+
+    is_devinfo_initialized = true;
+
+    android::base::unique_fd fd(open(DEVINFO_PATH, O_RDONLY));
+    android::base::ReadFully(fd, &devinfo, sizeof devinfo);
+
+    if (devinfo.magic != DEVINFO_MAGIC) {
+        return is_devinfo_valid;
+    }
+
+    uint32_t version = ((uint32_t)devinfo.ver_major << 16) | devinfo.ver_minor;
+    // only version 3.3+ supports A/B data
+    if (version >= 0x0003'0003) {
+        is_devinfo_valid = true;
+    }
+
+    return is_devinfo_valid;
+}
+
+static bool DevInfoSync() {
+    if (!isDevInfoValid()) {
+        return false;
+    }
+
+    android::base::unique_fd fd(open(DEVINFO_PATH, O_WRONLY | O_DSYNC));
+    return android::base::WriteFully(fd, &devinfo, sizeof devinfo);
+}
+
+static void DevInfoInitSlot(devinfo_ab_slot_data_t &slot_data) {
+    slot_data.retry_count = AB_ATTR_MAX_RETRY_COUNT;
+    slot_data.unbootable = 0;
+    slot_data.successful = 0;
+    slot_data.active = 1;
+    slot_data.fastboot_ok = 0;
+}
+
+static int blow_otp_AR(bool secure) {
+    static const char *dev_name = "/dev/trusty-ipc-dev0";
+    static const char *otp_name = "com.android.trusty.otp_manager.tidl";
+    int fd = 1, ret = 0;
+    uint32_t cmd = secure? OTP_CMD_write_antirbk_secure_ap : OTP_CMD_write_antirbk_non_secure_ap;
+    fd = tipc_connect(dev_name, otp_name);
+    if (fd < 0) {
+        ALOGI("Failed to connect to OTP_MGR ns TA - is it missing?\n");
+        ret = -1;
+        return ret;
+    }
+
+    struct otp_mgr_req_base req = {
+        .command = cmd,
+        .resp_payload_size = 0,
+    };
+    struct iovec iov[] = {
+        {
+            .iov_base = &req,
+            .iov_len = sizeof(req),
+        },
+    };
+
+    int rc = tipc_send(fd, iov, 1, NULL, 0);
+    if (rc != sizeof(req)) {
+        ALOGI("Send fail! %x\n", rc);
+        return rc;
+    }
+
+    struct otp_mgr_rsp_base resp;
+    rc = read(fd, &resp, sizeof(resp));
+    if (rc < 0) {
+        ALOGI("Read fail! %x\n", rc);
+        return rc;
+    }
+
+    if (rc < sizeof(resp)) {
+        ALOGI("Not enough data! %x\n", rc);
+        return -EIO;
+    }
+
+    if (resp.command != (cmd | OTP_RESP_BIT)) {
+        ALOGI("Wrong command! %x\n", resp.command);
+        return -EINVAL;
+    }
+
+    if (resp.result != 0) {
+        fprintf(stderr, "AR writing error! %x\n", resp.result);
+        return -EINVAL;
+    }
+
+    tipc_close(fd);
+    return 0;
+}
+
+static bool blowAR_zuma() {
+    int ret = blow_otp_AR(true);
+    if (ret) {
+        ALOGI("Blow secure anti-rollback OTP failed");
+        return false;
+    }
+
+    ret = blow_otp_AR(false);
+    if (ret) {
+        ALOGI("Blow non-secure anti-rollback OTP failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool blowAR_gs101() {
+    android::base::unique_fd fd(open(BLOW_AR_PATH, O_WRONLY | O_DSYNC));
+    return android::base::WriteStringToFd("1", fd);
+}
+
+static bool blowAR() {
+    char platform[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.hardware.platform", platform, "");
+
+    if (std::string(platform) == "gs101") {
+        return blowAR_gs101();
+    } else if (std::string(platform) == "gs201" || std::string(platform) == "zuma") {
+        return blowAR_zuma();
+    }
+
+    return true;
+}
+
+}  // namespace
+
+// Methods from ::android::hardware::boot::V1_0::IBootControl follow.
+Return<uint32_t> BootControl::getNumberSlots() {
+    uint32_t slots = 0;
+
+    if (access(BOOT_A_PATH, F_OK) == 0)
+        slots++;
+
+    if (access(BOOT_B_PATH, F_OK) == 0)
+        slots++;
+
+    return slots;
+}
+
+Return<uint32_t> BootControl::getCurrentSlot() {
+    char suffix[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.slot_suffix", suffix, "_a");
+    return std::string(suffix) == "_b" ? 1 : 0;
+}
+
+Return<void> BootControl::markBootSuccessful(markBootSuccessful_cb _hidl_cb) {
+    if (getNumberSlots() == 0) {
+        // no slots, just return true otherwise Android keeps trying
+        _hidl_cb({true, ""});
+        return Void();
+    }
+
+    bool ret;
+    if (isDevInfoValid()) {
+        auto const slot = getCurrentSlot();
+        devinfo.ab_data.slots[slot].successful = 1;
+        ret = DevInfoSync();
+    } else {
+        ret = setSlotFlag(getCurrentSlot(), AB_ATTR_SUCCESSFUL);
+    }
+
+    if (!ret) {
+        _hidl_cb({false, "Failed to set successful flag"});
+        return Void();
+    }
+
+    if (!blowAR()) {
+        ALOGE("Failed to blow anti-rollback counter");
+        // Ignore the error, since ABL will re-trigger it on reboot
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<void> BootControl::setActiveBootSlot(uint32_t slot, setActiveBootSlot_cb _hidl_cb) {
+    if (slot >= 2) {
+        _hidl_cb({false, "Invalid slot"});
+        return Void();
+    }
+
+    if (isDevInfoValid()) {
+        auto &active_slot_data = devinfo.ab_data.slots[slot];
+        auto &inactive_slot_data = devinfo.ab_data.slots[!slot];
+
+        inactive_slot_data.active = 0;
+        DevInfoInitSlot(active_slot_data);
+
+        if (!DevInfoSync()) {
+            _hidl_cb({false, "Could not update DevInfo data"});
+            return Void();
+        }
+    } else {
+        std::string dev_path = getDevPath(slot);
+        if (dev_path.empty()) {
+            _hidl_cb({false, "Could not get device path for slot"});
+            return Void();
+        }
+
+        GptUtils gpt(dev_path);
+        if (gpt.Load()) {
+            _hidl_cb({false, "failed to load gpt data"});
+            return Void();
+        }
+
+        gpt_entry *active_entry = gpt.GetPartitionEntry(slot == 0 ? "boot_a" : "boot_b");
+        gpt_entry *inactive_entry = gpt.GetPartitionEntry(slot == 0 ? "boot_b" : "boot_a");
+        if (active_entry == nullptr || inactive_entry == nullptr) {
+            _hidl_cb({false, "failed to get entries for boot partitions"});
+            return Void();
+        }
+
+        ALOGV("slot active attributes %lx\n", active_entry->attr);
+        ALOGV("slot inactive attributes %lx\n", inactive_entry->attr);
+
+        // update attributes for active and inactive
+        inactive_entry->attr &= ~AB_ATTR_ACTIVE;
+        active_entry->attr = AB_ATTR_ACTIVE | (AB_ATTR_MAX_PRIORITY << AB_ATTR_PRIORITY_SHIFT) |
+                             (AB_ATTR_MAX_RETRY_COUNT << AB_ATTR_RETRY_COUNT_SHIFT);
+    }
+
+    char boot_dev[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.bootdevice", boot_dev, "");
+    if (boot_dev[0] == '\0') {
+        ALOGI("failed to get ro.boot.bootdevice. try ro.boot.boot_devices\n");
+        property_get("ro.boot.boot_devices", boot_dev, "");
+        if (boot_dev[0] == '\0') {
+            _hidl_cb({false, "invalid ro.boot.bootdevice and ro.boot.boot_devices prop"});
+            return Void();
+        }
+    }
+
+    std::string boot_lun_path =
+            std::string("/sys/devices/platform/") + boot_dev + "/pixel/boot_lun_enabled";
+    int fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+    if (fd < 0) {
+        // Try old path for kernels < 5.4
+        // TODO: remove once kernel 4.19 support is deprecated
+        std::string boot_lun_path =
+                std::string("/sys/devices/platform/") + boot_dev + "/attributes/boot_lun_enabled";
+        fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+        if (fd < 0) {
+            _hidl_cb({false, "failed to open ufs attr boot_lun_enabled"});
+            return Void();
+        }
+    }
+
+    //
+    // bBootLunEn
+    // 0x1  => Boot LU A = enabled, Boot LU B = disable
+    // 0x2  => Boot LU A = disable, Boot LU B = enabled
+    //
+    int ret = android::base::WriteStringToFd(slot == 0 ? "1" : "2", fd);
+    close(fd);
+    if (ret < 0) {
+        _hidl_cb({false, "faied to write boot_lun_enabled attribute"});
+        return Void();
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<void> BootControl::setSlotAsUnbootable(uint32_t slot, setSlotAsUnbootable_cb _hidl_cb) {
+    if (slot >= 2) {
+        _hidl_cb({false, "Invalid slot"});
+        return Void();
+    }
+
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        slot_data.unbootable = 1;
+        if (!DevInfoSync()) {
+            _hidl_cb({false, "Could not update DevInfo data"});
+            return Void();
+        }
+    } else {
+        std::string dev_path = getDevPath(slot);
+        if (dev_path.empty()) {
+            _hidl_cb({false, "Could not get device path for slot"});
+            return Void();
+        }
+
+        GptUtils gpt(dev_path);
+        gpt.Load();
+
+        gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+        e->attr |= AB_ATTR_UNBOOTABLE;
+
+        gpt.Sync();
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<::android::hardware::boot::V1_0::BoolResult> BootControl::isSlotBootable(uint32_t slot) {
+    if (getNumberSlots() == 0)
+        return BoolResult::FALSE;
+    if (slot >= getNumberSlots())
+        return BoolResult::INVALID_SLOT;
+
+    bool unbootable;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        unbootable = !!slot_data.unbootable;
+    } else {
+        unbootable = isSlotFlagSet(slot, AB_ATTR_UNBOOTABLE);
+    }
+
+    return unbootable ? BoolResult::FALSE : BoolResult::TRUE;
+}
+
+Return<::android::hardware::boot::V1_0::BoolResult> BootControl::isSlotMarkedSuccessful(
+        uint32_t slot) {
+    if (getNumberSlots() == 0) {
+        // just return true so that we don't we another call trying to mark it as successful
+        // when there is no slots
+        return BoolResult::TRUE;
+    }
+    if (slot >= getNumberSlots())
+        return BoolResult::INVALID_SLOT;
+
+    bool successful;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        successful = !!slot_data.successful;
+    } else {
+        successful = isSlotFlagSet(slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    return successful ? BoolResult::TRUE : BoolResult::FALSE;
+}
+
+Return<void> BootControl::getSuffix(uint32_t slot, getSuffix_cb _hidl_cb) {
+    _hidl_cb(slot == 0 ? "_a" : slot == 1 ? "_b" : "");
+    return Void();
+}
+
+// Methods from ::android::hardware::boot::V1_1::IBootControl follow.
+bool BootControl::Init() {
+    return InitMiscVirtualAbMessageIfNeeded();
+}
+
+Return<bool> BootControl::setSnapshotMergeStatus(
+        ::android::hardware::boot::V1_1::MergeStatus status) {
+    return SetMiscVirtualAbMergeStatus(getCurrentSlot(), status);
+}
+
+Return<::android::hardware::boot::V1_1::MergeStatus> BootControl::getSnapshotMergeStatus() {
+    MergeStatus status;
+    if (!GetMiscVirtualAbMergeStatus(getCurrentSlot(), &status)) {
+        return MergeStatus::UNKNOWN;
+    }
+    return status;
+}
+
+// Methods from ::android::hardware::boot::V1_2::IBootControl follow.
+Return<uint32_t> BootControl::getActiveBootSlot() {
+    if (getNumberSlots() == 0)
+        return 0;
+
+    if (isDevInfoValid())
+        return devinfo.ab_data.slots[1].active ? 1 : 0;
+    return isSlotFlagSet(1, AB_ATTR_ACTIVE) ? 1 : 0;
+}
+
+// Methods from ::android::hidl::base::V1_0::IBase follow.
+
+IBootControl *HIDL_FETCH_IBootControl(const char * /* name */) {
+    auto module = new BootControl();
+
+    module->Init();
+
+    return module;
+}
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/BootControl.h b/bootctrl/1.2/BootControl.h
new file mode 100644
index 0000000..45b7efa
--- /dev/null
+++ b/bootctrl/1.2/BootControl.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/hardware/boot/1.2/IBootControl.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+struct BootControl : public IBootControl {
+    bool Init();
+
+    // Methods from ::android::hardware::boot::V1_0::IBootControl follow.
+    Return<uint32_t> getNumberSlots() override;
+    Return<uint32_t> getCurrentSlot() override;
+    Return<void> markBootSuccessful(markBootSuccessful_cb _hidl_cb) override;
+    Return<void> setActiveBootSlot(uint32_t slot, setActiveBootSlot_cb _hidl_cb) override;
+    Return<void> setSlotAsUnbootable(uint32_t slot, setSlotAsUnbootable_cb _hidl_cb) override;
+    Return<::android::hardware::boot::V1_0::BoolResult> isSlotBootable(uint32_t slot) override;
+    Return<::android::hardware::boot::V1_0::BoolResult> isSlotMarkedSuccessful(
+            uint32_t slot) override;
+    Return<void> getSuffix(uint32_t slot, getSuffix_cb _hidl_cb) override;
+
+    // Methods from ::android::hardware::boot::V1_1::IBootControl follow.
+    Return<bool> setSnapshotMergeStatus(
+            ::android::hardware::boot::V1_1::MergeStatus status) override;
+    Return<::android::hardware::boot::V1_1::MergeStatus> getSnapshotMergeStatus() override;
+
+    // Methods from ::android::hardware::boot::V1_2::IBootControl follow.
+    Return<uint32_t> getActiveBootSlot() override;
+
+    // Methods from ::android::hidl::base::V1_0::IBase follow.
+};
+
+// FIXME: most likely delete, this is only for passthrough implementations
+extern "C" IBootControl *HIDL_FETCH_IBootControl(const char *name);
+
+enum otpmgr_command : uint32_t {
+    OTP_REQ_SHIFT = 1,
+    OTP_RESP_BIT = 1,
+    OTP_CMD_write_antirbk_non_secure_ap = (7 << OTP_REQ_SHIFT),
+    OTP_CMD_write_antirbk_secure_ap = (8 << OTP_REQ_SHIFT),
+};
+
+struct otp_mgr_req_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    uint8_t handle;
+}__packed;
+
+struct otp_mgr_rsp_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    int result;
+}__packed;
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/DevInfo.h b/bootctrl/1.2/DevInfo.h
new file mode 100644
index 0000000..a09a83a
--- /dev/null
+++ b/bootctrl/1.2/DevInfo.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+//
+// definitions taken from ABL code
+//
+
+constexpr uint32_t DEVINFO_MAGIC = 0x49564544;
+constexpr size_t DEVINFO_AB_SLOT_COUNT = 2;
+
+struct devinfo_ab_slot_data_t {
+    uint8_t retry_count;
+    uint8_t unbootable : 1;
+    uint8_t successful : 1;
+    uint8_t active : 1;
+    uint8_t fastboot_ok : 1;
+    uint8_t : 4;
+    uint8_t unused[2];
+} __attribute__((packed));
+
+typedef struct {
+    devinfo_ab_slot_data_t slots[DEVINFO_AB_SLOT_COUNT];
+} __attribute__((packed)) devinfo_ab_data_t;
+
+struct devinfo_t {
+    uint32_t magic;
+    uint16_t ver_major;
+    uint16_t ver_minor;
+    uint8_t unused[40];
+    devinfo_ab_data_t ab_data;
+    uint8_t unused1[72];  // use remaining up to complete 128 bytes
+} __attribute__((packed));
+
+static_assert(sizeof(devinfo_t) == 128, "invalid devinfo struct size");
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/GptUtils.cpp b/bootctrl/1.2/GptUtils.cpp
new file mode 100644
index 0000000..25088e7
--- /dev/null
+++ b/bootctrl/1.2/GptUtils.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "GptUtils.h"
+
+#include <android-base/file.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <log/log.h>
+#include <zlib.h>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+namespace {
+
+static int ValidateGptHeader(gpt_header *gpt) {
+    if (gpt->signature != GPT_SIGNATURE) {
+        ALOGE("invalid gpt signature 0x%lx\n", gpt->signature);
+        return -1;
+    }
+
+    if (gpt->header_size != sizeof(gpt_header)) {
+        ALOGE("invalid gpt header size %u\n", gpt->header_size);
+        return -1;
+    }
+
+    if (gpt->entry_size != sizeof(gpt_entry)) {
+        ALOGE("invalid gpt entry size %u\n", gpt->entry_size);
+        return -1;
+    }
+
+    return 0;
+}
+
+}  // namespace
+
+GptUtils::GptUtils(const std::string dev_path) : dev_path(dev_path), fd(0) {}
+
+int GptUtils::Load(void) {
+    fd = open(dev_path.c_str(), O_RDWR);
+    if (fd < 0) {
+        ALOGE("failed to open block dev %s, %d\n", dev_path.c_str(), errno);
+        return -1;
+    }
+
+    int ret = ioctl(fd, BLKSSZGET, &block_size);
+    if (ret < 0) {
+        ALOGE("failed to get block size %d\n", errno);
+        return -1;
+    }
+
+    // read primary header
+    lseek64(fd, block_size, SEEK_SET);
+    ret = read(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to read gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_primary)) {
+        ALOGE("error validating gpt header\n");
+        return -1;
+    }
+
+    // read partition entries
+    entry_array.resize(gpt_primary.entry_count);
+    uint32_t entries_size = gpt_primary.entry_size * gpt_primary.entry_count;
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = read(fd, entry_array.data(), entries_size);
+    if (ret < 0) {
+        ALOGE("failed to read gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // read gpt back header
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = read(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to read gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_backup)) {
+        ALOGW("error validating gpt backup\n");  // just warn about it, not fail
+    }
+
+    // Create map <partition name, gpt_entry pointer>
+    auto get_name = [](const uint16_t *efi_name) {
+        char name[37] = {};
+        for (int i = 0; efi_name[i] && i < sizeof name - 1; ++i) name[i] = efi_name[i];
+        return std::string(name);
+    };
+
+    for (auto const &e : entry_array) {
+        if (e.name[0] == 0)
+            break;  // stop at the first partition with no name
+        std::string s = get_name(e.name);
+        entries[s] = const_cast<gpt_entry *>(&e);
+    }
+
+    return 0;
+}
+
+gpt_entry *GptUtils::GetPartitionEntry(std::string name) {
+    return entries.find(name) != entries.end() ? entries[name] : nullptr;
+}
+
+int GptUtils::Sync(void) {
+    if (!fd)
+        return -1;
+
+    // calculate crc and check if we need to update gpt
+    gpt_primary.entries_crc32 = crc32(0, reinterpret_cast<uint8_t *>(entry_array.data()),
+                                      entry_array.size() * sizeof(gpt_entry));
+
+    // save old crc
+    uint32_t crc = gpt_primary.crc32;
+    gpt_primary.crc32 = 0;
+
+    gpt_primary.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_primary), sizeof gpt_primary);
+    if (crc == gpt_primary.crc32)
+        return 0;  // nothing to do (no changes)
+
+    ALOGI("updating GPT\n");
+
+    lseek64(fd, block_size * gpt_primary.current_lba, SEEK_SET);
+    int ret = write(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to write gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // update GPT backup entries and backup
+    lseek64(fd, block_size * gpt_backup.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup partition entries %d\n", errno);
+        return -1;
+    }
+
+    gpt_backup.entries_crc32 = gpt_primary.entries_crc32;
+    gpt_backup.crc32 = 0;
+    gpt_backup.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_backup), sizeof gpt_backup);
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = write(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    fsync(fd);
+
+    return 0;
+}
+
+GptUtils::~GptUtils() {
+    if (fd) {
+        Sync();
+        close(fd);
+    }
+}
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/GptUtils.h b/bootctrl/1.2/GptUtils.h
new file mode 100644
index 0000000..a2bed33
--- /dev/null
+++ b/bootctrl/1.2/GptUtils.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+#define GPT_SIGNATURE 0x5452415020494645UL
+
+typedef struct {
+    uint8_t type_guid[16];
+    uint8_t guid[16];
+    uint64_t first_lba;
+    uint64_t last_lba;
+    uint64_t attr;
+    uint16_t name[36];
+} __attribute__((packed)) gpt_entry;
+
+typedef struct {
+    uint64_t signature;
+    uint32_t revision;
+    uint32_t header_size;
+    uint32_t crc32;
+    uint32_t reserved;
+    uint64_t current_lba;
+    uint64_t backup_lba;
+    uint64_t first_usable_lba;
+    uint64_t last_usable_lba;
+    uint8_t disk_guid[16];
+    uint64_t start_lba;
+    uint32_t entry_count;
+    uint32_t entry_size;
+    uint32_t entries_crc32;
+} __attribute__((packed)) gpt_header;
+
+class GptUtils {
+  public:
+    GptUtils(const std::string dev_path);
+    int Load(void);
+    gpt_entry *GetPartitionEntry(std::string name);
+    int Sync(void);
+    ~GptUtils();
+
+  private:
+    std::string dev_path;
+    int fd;
+    uint32_t block_size;
+    gpt_header gpt_primary;
+    gpt_header gpt_backup;
+    std::vector<gpt_entry> entry_array;
+    std::map<std::string, gpt_entry *> entries;
+};
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc b/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc
new file mode 100644
index 0000000..ff7d2f3
--- /dev/null
+++ b/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc
@@ -0,0 +1,7 @@
+service vendor.boot-hal-1-2 /vendor/bin/hw/android.hardware.boot@1.2-service-pixel
+    interface android.hardware.boot@1.0::IBootControl default
+    interface android.hardware.boot@1.1::IBootControl default
+    interface android.hardware.boot@1.2::IBootControl default
+    class early_hal
+    user root
+    group root drmrpc
diff --git a/bootctrl/1.2/service.cpp b/bootctrl/1.2/service.cpp
new file mode 100644
index 0000000..f07682e
--- /dev/null
+++ b/bootctrl/1.2/service.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.boot@1.2-service"
+
+#include <android/hardware/boot/1.2/IBootControl.h>
+#include <hidl/HidlTransportSupport.h>
+#include <hidl/Status.h>
+#include <log/log.h>
+
+#include "BootControl.h"
+
+using ::android::status_t;
+
+using ::android::hardware::boot::V1_2::IBootControl;
+
+using ::android::hardware::boot::V1_2::implementation::BootControl;
+// using ::android::hardware::boot::implementation::BootControl;
+
+int main(int /* argc */, char * /* argv */[]) {
+    // This function must be called before you join to ensure the proper
+    // number of threads are created. The threadpool will never exceed
+    // size one because of this call.
+    ::android::hardware::configureRpcThreadpool(1 /*threads*/, true /*willJoin*/);
+
+    ::android::sp bootctrl = new BootControl();
+    const status_t status = bootctrl->registerAsService();
+    if (status != ::android::OK) {
+        return 1;  // or handle error
+    }
+
+    // Adds this thread to the threadpool, resulting in one total
+    // thread in the threadpool. We could also do other things, but
+    // would have to specify 'false' to willJoin in configureRpcThreadpool.
+    ::android::hardware::joinRpcThreadpool();
+    return 1;  // joinRpcThreadpool should never return
+}
diff --git a/bootctrl/aidl/Android.bp b/bootctrl/aidl/Android.bp
new file mode 100644
index 0000000..f5ba503
--- /dev/null
+++ b/bootctrl/aidl/Android.bp
@@ -0,0 +1,71 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+soong_namespace {
+    imports: [
+        "hardware/google/pixel",
+    ],
+}
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "//device/google/gs-common:device_google_gs-common_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: [
+        "//device/google/gs-common:device_google_gs-common_license",
+    ],
+}
+
+cc_defaults {
+    name: "android.hardware.boot-service_common-pixel",
+    relative_install_path: "hw",
+    defaults: ["libboot_control_defaults"],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot-V1-ndk",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+    ],
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+        "service.cpp"
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.boot-service.default-pixel",
+    defaults: ["android.hardware.boot-service_common-pixel"],
+    init_rc: ["android.hardware.boot-service.default-pixel.rc"],
+    vendor: true,
+}
+
+cc_binary {
+    name: "android.hardware.boot-service.default_recovery-pixel",
+    defaults: ["android.hardware.boot-service_common-pixel"],
+    vintf_fragments: ["android.hardware.boot-service.default_recovery-pixel.xml"],
+    init_rc: ["android.hardware.boot-service.default_recovery-pixel.rc"],
+    recovery: true,
+}
diff --git a/bootctrl/aidl/BootControl.cpp b/bootctrl/aidl/BootControl.cpp
new file mode 100644
index 0000000..e771845
--- /dev/null
+++ b/bootctrl/aidl/BootControl.cpp
@@ -0,0 +1,562 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "BootControl.h"
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/properties.h>
+#include <libboot_control/libboot_control.h>
+#include <log/log.h>
+#include <trusty/tipc.h>
+
+#include "DevInfo.h"
+#include "GptUtils.h"
+
+using HIDLMergeStatus = ::android::bootable::BootControl::MergeStatus;
+using ndk::ScopedAStatus;
+
+using android::bootable::GetMiscVirtualAbMergeStatus;
+using android::bootable::InitMiscVirtualAbMessageIfNeeded;
+using android::bootable::SetMiscVirtualAbMergeStatus;
+
+namespace aidl::android::hardware::boot {
+
+namespace {
+
+// clang-format off
+
+#define BOOT_A_PATH     "/dev/block/by-name/boot_a"
+#define BOOT_B_PATH     "/dev/block/by-name/boot_b"
+#define DEVINFO_PATH    "/dev/block/by-name/devinfo"
+
+#define BLOW_AR_PATH    "/sys/kernel/boot_control/blow_ar"
+
+// slot flags
+#define AB_ATTR_PRIORITY_SHIFT      52
+#define AB_ATTR_PRIORITY_MASK       (3UL << AB_ATTR_PRIORITY_SHIFT)
+#define AB_ATTR_ACTIVE_SHIFT        54
+#define AB_ATTR_ACTIVE              (1UL << AB_ATTR_ACTIVE_SHIFT)
+#define AB_ATTR_RETRY_COUNT_SHIFT   (55)
+#define AB_ATTR_RETRY_COUNT_MASK    (7UL << AB_ATTR_RETRY_COUNT_SHIFT)
+#define AB_ATTR_SUCCESSFUL          (1UL << 58)
+#define AB_ATTR_UNBOOTABLE          (1UL << 59)
+
+#define AB_ATTR_MAX_PRIORITY        3UL
+#define AB_ATTR_MAX_RETRY_COUNT     3UL
+
+// clang-format on
+
+static std::string getDevPath(int32_t in_slot) {
+    char real_path[PATH_MAX];
+
+    const char *path = in_slot == 0 ? BOOT_A_PATH : BOOT_B_PATH;
+
+    int ret = readlink(path, real_path, sizeof real_path);
+    if (ret < 0) {
+        ALOGE("readlink failed for boot device %s\n", strerror(errno));
+        return std::string();
+    }
+
+    std::string dp(real_path);
+    // extract /dev/sda.. part
+    return dp.substr(0, sizeof "/dev/block/sdX" - 1);
+}
+
+static bool isSlotFlagSet(int32_t in_slot, uint64_t flag) {
+    std::string dev_path = getDevPath(in_slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", in_slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    return !!(e->attr & flag);
+}
+
+static bool setSlotFlag(int32_t in_slot, uint64_t flag) {
+    std::string dev_path = getDevPath(in_slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", in_slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    e->attr |= flag;
+    gpt.Sync();
+
+    return true;
+}
+
+static bool is_devinfo_valid;
+static bool is_devinfo_initialized;
+static std::mutex devinfo_lock;
+static devinfo_t devinfo;
+
+static bool isDevInfoValid() {
+    const std::lock_guard<std::mutex> lock(devinfo_lock);
+
+    if (is_devinfo_initialized) {
+        return is_devinfo_valid;
+    }
+
+    is_devinfo_initialized = true;
+
+    ::android::base::unique_fd fd(open(DEVINFO_PATH, O_RDONLY));
+    ::android::base::ReadFully(fd, &devinfo, sizeof devinfo);
+
+    if (devinfo.magic != DEVINFO_MAGIC) {
+        return is_devinfo_valid;
+    }
+
+    uint32_t version = ((uint32_t)devinfo.ver_major << 16) | devinfo.ver_minor;
+    // only version 3.3+ supports A/B data
+    if (version >= 0x0003'0003) {
+        is_devinfo_valid = true;
+    }
+
+    return is_devinfo_valid;
+}
+
+static bool DevInfoSync() {
+    if (!isDevInfoValid()) {
+        return false;
+    }
+
+    ::android::base::unique_fd fd(open(DEVINFO_PATH, O_WRONLY | O_DSYNC));
+    return ::android::base::WriteFully(fd, &devinfo, sizeof devinfo);
+}
+
+static void DevInfoInitSlot(devinfo_ab_slot_data_t &slot_data) {
+    slot_data.retry_count = AB_ATTR_MAX_RETRY_COUNT;
+    slot_data.unbootable = 0;
+    slot_data.successful = 0;
+    slot_data.active = 1;
+    slot_data.fastboot_ok = 0;
+}
+
+static int blow_otp_AR(bool secure) {
+    static const char *dev_name = "/dev/trusty-ipc-dev0";
+    static const char *otp_name = "com.android.trusty.otp_manager.tidl";
+    int fd = 1, ret = 0;
+    uint32_t cmd = secure? OTP_CMD_write_antirbk_secure_ap : OTP_CMD_write_antirbk_non_secure_ap;
+    fd = tipc_connect(dev_name, otp_name);
+    if (fd < 0) {
+        ALOGI("Failed to connect to OTP_MGR ns TA - is it missing?\n");
+        ret = -1;
+        return ret;
+    }
+
+    struct otp_mgr_req_base req = {
+        .command = cmd,
+        .resp_payload_size = 0,
+    };
+    struct iovec iov[] = {
+        {
+            .iov_base = &req,
+            .iov_len = sizeof(req),
+        },
+    };
+
+    size_t rc = tipc_send(fd, iov, 1, NULL, 0);
+    if (rc != sizeof(req)) {
+        ALOGI("Send fail! %zx\n", rc);
+        return rc;
+    }
+
+    struct otp_mgr_rsp_base resp;
+    rc = read(fd, &resp, sizeof(resp));
+    if (rc < 0) {
+        ALOGI("Read fail! %zx\n", rc);
+        return rc;
+    }
+
+    if (rc < sizeof(resp)) {
+        ALOGI("Not enough data! %zx\n", rc);
+        return -EIO;
+    }
+
+    if (resp.command != (cmd | OTP_RESP_BIT)) {
+        ALOGI("Wrong command! %x\n", resp.command);
+        return -EINVAL;
+    }
+
+    if (resp.result != 0) {
+        fprintf(stderr, "AR writing error! %x\n", resp.result);
+        return -EINVAL;
+    }
+
+    tipc_close(fd);
+    return 0;
+}
+
+static bool blowAR_zuma() {
+    int ret = blow_otp_AR(true);
+    if (ret) {
+        ALOGI("Blow secure anti-rollback OTP failed");
+        return false;
+    }
+
+    ret = blow_otp_AR(false);
+    if (ret) {
+        ALOGI("Blow non-secure anti-rollback OTP failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool blowAR_gs101() {
+    ::android::base::unique_fd fd(open(BLOW_AR_PATH, O_WRONLY | O_DSYNC));
+    return ::android::base::WriteStringToFd("1", fd);
+}
+
+static bool blowAR() {
+    char platform[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.hardware.platform", platform, "");
+
+    if (std::string(platform) == "gs101") {
+        return blowAR_gs101();
+    } else if (std::string(platform) == "gs201" || std::string(platform) == "zuma") {
+        return blowAR_zuma();
+    }
+
+    return true;
+}
+
+static constexpr MergeStatus ToAIDLMergeStatus(HIDLMergeStatus status) {
+    switch (status) {
+        case HIDLMergeStatus::NONE:
+            return MergeStatus::NONE;
+        case HIDLMergeStatus::UNKNOWN:
+            return MergeStatus::UNKNOWN;
+        case HIDLMergeStatus::SNAPSHOTTED:
+            return MergeStatus::SNAPSHOTTED;
+        case HIDLMergeStatus::MERGING:
+            return MergeStatus::MERGING;
+        case HIDLMergeStatus::CANCELLED:
+            return MergeStatus::CANCELLED;
+    }
+}
+
+static constexpr HIDLMergeStatus ToHIDLMergeStatus(MergeStatus status) {
+    switch (status) {
+        case MergeStatus::NONE:
+            return HIDLMergeStatus::NONE;
+        case MergeStatus::UNKNOWN:
+            return HIDLMergeStatus::UNKNOWN;
+        case MergeStatus::SNAPSHOTTED:
+            return HIDLMergeStatus::SNAPSHOTTED;
+        case MergeStatus::MERGING:
+            return HIDLMergeStatus::MERGING;
+        case MergeStatus::CANCELLED:
+            return HIDLMergeStatus::CANCELLED;
+    }
+}
+
+}  // namespace
+
+BootControl::BootControl() {
+    CHECK(InitMiscVirtualAbMessageIfNeeded());
+}
+
+ScopedAStatus BootControl::getActiveBootSlot(int32_t* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        *_aidl_return = 0;
+        return ScopedAStatus::ok();
+    }
+
+    if (isDevInfoValid()) {
+        *_aidl_return = devinfo.ab_data.slots[1].active ? 1 : 0;
+        return ScopedAStatus::ok();
+    }
+    *_aidl_return = isSlotFlagSet(1, AB_ATTR_ACTIVE) ? 1 : 0;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getCurrentSlot(int32_t* _aidl_return) {
+    char suffix[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.slot_suffix", suffix, "_a");
+    *_aidl_return = std::string(suffix) == "_b" ? 1 : 0;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getNumberSlots(int32_t* _aidl_return) {
+    int32_t slots = 0;
+
+    if (access(BOOT_A_PATH, F_OK) == 0)
+        slots++;
+
+    if (access(BOOT_B_PATH, F_OK) == 0)
+        slots++;
+
+    *_aidl_return = slots;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getSnapshotMergeStatus(MergeStatus* _aidl_return) {
+    HIDLMergeStatus status;
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (!GetMiscVirtualAbMergeStatus(current_slot, &status)) {
+        *_aidl_return = MergeStatus::UNKNOWN;
+        return ScopedAStatus::ok();
+    }
+    *_aidl_return = ToAIDLMergeStatus(status);
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getSuffix(int32_t in_slot, std::string* _aidl_return) {
+    *_aidl_return = in_slot == 0 ? "_a" : in_slot == 1 ? "_b" : "";
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::isSlotBootable(int32_t in_slot, bool* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        *_aidl_return = false;
+        return ScopedAStatus::ok();
+    }
+    if (in_slot >= slots)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    bool unbootable;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        unbootable = !!slot_data.unbootable;
+    } else {
+        unbootable = isSlotFlagSet(in_slot, AB_ATTR_UNBOOTABLE);
+    }
+
+    *_aidl_return = unbootable ? false: true;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::isSlotMarkedSuccessful(int32_t in_slot, bool* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        // just return true so that we don't we another call trying to mark it as successful
+        // when there is no slots
+        *_aidl_return = true;
+        return ScopedAStatus::ok();
+    }
+    if (in_slot >= slots)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    bool successful;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        successful = !!slot_data.successful;
+    } else {
+        successful = isSlotFlagSet(in_slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    *_aidl_return = successful ? true : false;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::markBootSuccessful() {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        // no slots, just return true otherwise Android keeps trying
+        return ScopedAStatus::ok();
+    }
+
+    bool ret;
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (isDevInfoValid()) {
+        auto const slot = current_slot;
+        devinfo.ab_data.slots[slot].successful = 1;
+        ret = DevInfoSync();
+    } else {
+        ret = setSlotFlag(current_slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    if (!ret) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                  "Failed to set successful flag");
+    }
+
+    if (!blowAR()) {
+        ALOGE("Failed to blow anti-rollback counter");
+        // Ignore the error, since ABL will re-trigger it on reboot
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setActiveBootSlot(int32_t in_slot) {
+    if (in_slot >= 2) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+    }
+
+    if (isDevInfoValid()) {
+        auto &active_slot_data = devinfo.ab_data.slots[in_slot];
+        auto &inactive_slot_data = devinfo.ab_data.slots[!in_slot];
+
+        inactive_slot_data.active = 0;
+        DevInfoInitSlot(active_slot_data);
+
+        if (!DevInfoSync()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not update DevInfo data");
+        }
+    } else {
+        std::string dev_path = getDevPath(in_slot);
+        if (dev_path.empty()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not get device path for slot");
+        }
+
+        GptUtils gpt(dev_path);
+        if (gpt.Load()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                      "failed to load gpt data");
+        }
+
+        gpt_entry *active_entry = gpt.GetPartitionEntry(in_slot == 0 ? "boot_a" : "boot_b");
+        gpt_entry *inactive_entry = gpt.GetPartitionEntry(in_slot == 0 ? "boot_b" : "boot_a");
+        if (active_entry == nullptr || inactive_entry == nullptr) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "failed to get entries for boot partitions");
+        }
+
+        ALOGV("slot active attributes %lx\n", active_entry->attr);
+        ALOGV("slot inactive attributes %lx\n", inactive_entry->attr);
+
+        // update attributes for active and inactive
+        inactive_entry->attr &= ~AB_ATTR_ACTIVE;
+        active_entry->attr = AB_ATTR_ACTIVE | (AB_ATTR_MAX_PRIORITY << AB_ATTR_PRIORITY_SHIFT) |
+                             (AB_ATTR_MAX_RETRY_COUNT << AB_ATTR_RETRY_COUNT_SHIFT);
+    }
+
+    char boot_dev[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.bootdevice", boot_dev, "");
+    if (boot_dev[0] == '\0') {
+        ALOGI("failed to get ro.boot.bootdevice. try ro.boot.boot_devices\n");
+        property_get("ro.boot.boot_devices", boot_dev, "");
+        if (boot_dev[0] == '\0') {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "invalid ro.boot.bootdevice and ro.boot.boot_devices prop");
+        }
+    }
+
+    std::string boot_lun_path =
+            std::string("/sys/devices/platform/") + boot_dev + "/pixel/boot_lun_enabled";
+    int fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+    if (fd < 0) {
+        // Try old path for kernels < 5.4
+        // TODO: remove once kernel 4.19 support is deprecated
+        std::string boot_lun_path =
+                std::string("/sys/devices/platform/") + boot_dev + "/attributes/boot_lun_enabled";
+        fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+        if (fd < 0) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "failed to open ufs attr boot_lun_enabled");
+        }
+    }
+
+    //
+    // bBootLunEn
+    // 0x1  => Boot LU A = enabled, Boot LU B = disable
+    // 0x2  => Boot LU A = disable, Boot LU B = enabled
+    //
+    int ret = ::android::base::WriteStringToFd(in_slot == 0 ? "1" : "2", fd);
+    close(fd);
+    if (ret < 0) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                COMMAND_FAILED, "faied to write boot_lun_enabled attribute");
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setSlotAsUnbootable(int32_t in_slot) {
+    if (in_slot >= 2)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        slot_data.unbootable = 1;
+        if (!DevInfoSync()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not update DevInfo data");
+        }
+    } else {
+        std::string dev_path = getDevPath(in_slot);
+        if (dev_path.empty()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not get device path for slot");
+        }
+
+        GptUtils gpt(dev_path);
+        gpt.Load();
+
+        gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+        e->attr |= AB_ATTR_UNBOOTABLE;
+
+        gpt.Sync();
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setSnapshotMergeStatus(MergeStatus in_status) {
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (!SetMiscVirtualAbMergeStatus(current_slot, ToHIDLMergeStatus(in_status)))
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                  "Operation failed");
+    return ScopedAStatus::ok();
+}
+
+}  // namespace aidl::android::hardware::boot
diff --git a/bootctrl/aidl/BootControl.h b/bootctrl/aidl/BootControl.h
new file mode 100644
index 0000000..a54f66d
--- /dev/null
+++ b/bootctrl/aidl/BootControl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/boot/BnBootControl.h>
+#include <libboot_control/libboot_control.h>
+
+namespace aidl::android::hardware::boot {
+
+class BootControl final : public BnBootControl {
+  public:
+    BootControl();
+    ::ndk::ScopedAStatus getActiveBootSlot(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getCurrentSlot(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getNumberSlots(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getSnapshotMergeStatus(
+            ::aidl::android::hardware::boot::MergeStatus* _aidl_return) override;
+    ::ndk::ScopedAStatus getSuffix(int32_t in_slot, std::string* _aidl_return) override;
+    ::ndk::ScopedAStatus isSlotBootable(int32_t in_slot, bool* _aidl_return) override;
+    ::ndk::ScopedAStatus isSlotMarkedSuccessful(int32_t in_slot, bool* _aidl_return) override;
+    ::ndk::ScopedAStatus markBootSuccessful() override;
+    ::ndk::ScopedAStatus setActiveBootSlot(int32_t in_slot) override;
+    ::ndk::ScopedAStatus setSlotAsUnbootable(int32_t in_slot) override;
+    ::ndk::ScopedAStatus setSnapshotMergeStatus(
+            ::aidl::android::hardware::boot::MergeStatus in_status) override;
+};
+
+enum otpmgr_command : uint32_t {
+    OTP_REQ_SHIFT = 1,
+    OTP_RESP_BIT = 1,
+    OTP_CMD_write_antirbk_non_secure_ap = (7 << OTP_REQ_SHIFT),
+    OTP_CMD_write_antirbk_secure_ap = (8 << OTP_REQ_SHIFT),
+};
+
+struct otp_mgr_req_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    uint8_t handle;
+}__packed;
+
+struct otp_mgr_rsp_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    int result;
+}__packed;
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/DevInfo.h b/bootctrl/aidl/DevInfo.h
new file mode 100644
index 0000000..aa5f5d3
--- /dev/null
+++ b/bootctrl/aidl/DevInfo.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+namespace aidl::android::hardware::boot {
+
+//
+// definitions taken from ABL code
+//
+
+constexpr uint32_t DEVINFO_MAGIC = 0x49564544;
+constexpr size_t DEVINFO_AB_SLOT_COUNT = 2;
+
+struct devinfo_ab_slot_data_t {
+    uint8_t retry_count;
+    uint8_t unbootable : 1;
+    uint8_t successful : 1;
+    uint8_t active : 1;
+    uint8_t fastboot_ok : 1;
+    uint8_t : 4;
+    uint8_t unused[2];
+} __attribute__((packed));
+
+typedef struct {
+    devinfo_ab_slot_data_t slots[DEVINFO_AB_SLOT_COUNT];
+} __attribute__((packed)) devinfo_ab_data_t;
+
+struct devinfo_t {
+    uint32_t magic;
+    uint16_t ver_major;
+    uint16_t ver_minor;
+    uint8_t unused[40];
+    devinfo_ab_data_t ab_data;
+    uint8_t unused1[72];  // use remaining up to complete 128 bytes
+} __attribute__((packed));
+
+static_assert(sizeof(devinfo_t) == 128, "invalid devinfo struct size");
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/GptUtils.cpp b/bootctrl/aidl/GptUtils.cpp
new file mode 100644
index 0000000..34dec11
--- /dev/null
+++ b/bootctrl/aidl/GptUtils.cpp
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "GptUtils.h"
+
+#include <android-base/file.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <log/log.h>
+#include <zlib.h>
+
+namespace aidl::android::hardware::boot {
+
+namespace {
+
+static int ValidateGptHeader(gpt_header *gpt) {
+    if (gpt->signature != GPT_SIGNATURE) {
+        ALOGE("invalid gpt signature 0x%lx\n", gpt->signature);
+        return -1;
+    }
+
+    if (gpt->header_size != sizeof(gpt_header)) {
+        ALOGE("invalid gpt header size %u\n", gpt->header_size);
+        return -1;
+    }
+
+    if (gpt->entry_size != sizeof(gpt_entry)) {
+        ALOGE("invalid gpt entry size %u\n", gpt->entry_size);
+        return -1;
+    }
+
+    return 0;
+}
+
+}  // namespace
+
+GptUtils::GptUtils(const std::string dev_path) : dev_path(dev_path), fd(0) {}
+
+int GptUtils::Load(void) {
+    fd = open(dev_path.c_str(), O_RDWR);
+    if (fd < 0) {
+        ALOGE("failed to open block dev %s, %d\n", dev_path.c_str(), errno);
+        return -1;
+    }
+
+    int ret = ioctl(fd, BLKSSZGET, &block_size);
+    if (ret < 0) {
+        ALOGE("failed to get block size %d\n", errno);
+        return -1;
+    }
+
+    // read primary header
+    lseek64(fd, block_size, SEEK_SET);
+    ret = read(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to read gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_primary)) {
+        ALOGE("error validating gpt header\n");
+        return -1;
+    }
+
+    // read partition entries
+    entry_array.resize(gpt_primary.entry_count);
+    uint32_t entries_size = gpt_primary.entry_size * gpt_primary.entry_count;
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = read(fd, entry_array.data(), entries_size);
+    if (ret < 0) {
+        ALOGE("failed to read gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // read gpt back header
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = read(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to read gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_backup)) {
+        ALOGW("error validating gpt backup\n");  // just warn about it, not fail
+    }
+
+    // Create map <partition name, gpt_entry pointer>
+    auto get_name = [](const uint16_t *efi_name) {
+        char name[37] = {};
+        for (size_t i = 0; efi_name[i] && i < sizeof name - 1; ++i) name[i] = efi_name[i];
+        return std::string(name);
+    };
+
+    for (auto const &e : entry_array) {
+        if (e.name[0] == 0)
+            break;  // stop at the first partition with no name
+        std::string s = get_name(e.name);
+        entries[s] = const_cast<gpt_entry *>(&e);
+    }
+
+    return 0;
+}
+
+gpt_entry *GptUtils::GetPartitionEntry(std::string name) {
+    return entries.find(name) != entries.end() ? entries[name] : nullptr;
+}
+
+int GptUtils::Sync(void) {
+    if (!fd)
+        return -1;
+
+    // calculate crc and check if we need to update gpt
+    gpt_primary.entries_crc32 = crc32(0, reinterpret_cast<uint8_t *>(entry_array.data()),
+                                      entry_array.size() * sizeof(gpt_entry));
+
+    // save old crc
+    uint32_t crc = gpt_primary.crc32;
+    gpt_primary.crc32 = 0;
+
+    gpt_primary.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_primary), sizeof gpt_primary);
+    if (crc == gpt_primary.crc32)
+        return 0;  // nothing to do (no changes)
+
+    ALOGI("updating GPT\n");
+
+    lseek64(fd, block_size * gpt_primary.current_lba, SEEK_SET);
+    int ret = write(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to write gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // update GPT backup entries and backup
+    lseek64(fd, block_size * gpt_backup.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup partition entries %d\n", errno);
+        return -1;
+    }
+
+    gpt_backup.entries_crc32 = gpt_primary.entries_crc32;
+    gpt_backup.crc32 = 0;
+    gpt_backup.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_backup), sizeof gpt_backup);
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = write(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    fsync(fd);
+
+    return 0;
+}
+
+GptUtils::~GptUtils() {
+    if (fd) {
+        Sync();
+        close(fd);
+    }
+}
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/GptUtils.h b/bootctrl/aidl/GptUtils.h
new file mode 100644
index 0000000..ec68cf6
--- /dev/null
+++ b/bootctrl/aidl/GptUtils.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+namespace aidl::android::hardware::boot {
+
+#define GPT_SIGNATURE 0x5452415020494645UL
+
+typedef struct {
+    uint8_t type_guid[16];
+    uint8_t guid[16];
+    uint64_t first_lba;
+    uint64_t last_lba;
+    uint64_t attr;
+    uint16_t name[36];
+} __attribute__((packed)) gpt_entry;
+
+typedef struct {
+    uint64_t signature;
+    uint32_t revision;
+    uint32_t header_size;
+    uint32_t crc32;
+    uint32_t reserved;
+    uint64_t current_lba;
+    uint64_t backup_lba;
+    uint64_t first_usable_lba;
+    uint64_t last_usable_lba;
+    uint8_t disk_guid[16];
+    uint64_t start_lba;
+    uint32_t entry_count;
+    uint32_t entry_size;
+    uint32_t entries_crc32;
+} __attribute__((packed)) gpt_header;
+
+class GptUtils {
+  public:
+    GptUtils(const std::string dev_path);
+    int Load(void);
+    gpt_entry *GetPartitionEntry(std::string name);
+    int Sync(void);
+    ~GptUtils();
+
+  private:
+    std::string dev_path;
+    int fd;
+    uint32_t block_size;
+    gpt_header gpt_primary;
+    gpt_header gpt_backup;
+    std::vector<gpt_entry> entry_array;
+    std::map<std::string, gpt_entry *> entries;
+};
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc b/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc
new file mode 100644
index 0000000..a9887b9
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc
@@ -0,0 +1,5 @@
+service vendor.boot-default /vendor/bin/hw/android.hardware.boot-service.default-pixel
+    class early_hal
+    user root
+    group root drmrpc
+
diff --git a/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc
new file mode 100644
index 0000000..e58617e
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc
@@ -0,0 +1,7 @@
+service vendor.boot-default /system/bin/hw/android.hardware.boot-service.default_recovery-pixel
+    class early_hal
+    user root
+    group root
+    seclabel u:r:hal_bootctl_default:s0
+    interface aidl android.hardware.boot.IBootControl/default
+
diff --git a/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml
new file mode 100644
index 0000000..23ccc4e
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml
@@ -0,0 +1,6 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.boot</name>
+        <fqname>IBootControl/default</fqname>
+    </hal>
+</manifest>
diff --git a/bootctrl/aidl/service.cpp b/bootctrl/aidl/service.cpp
new file mode 100644
index 0000000..41b6c25
--- /dev/null
+++ b/bootctrl/aidl/service.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "aidl.android.hardware.boot-service.default"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <hidl/HidlSupport.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include "BootControl.h"
+
+using aidl::android::hardware::boot::BootControl;
+using aidl::android::hardware::boot::IBootControl;
+using ::android::hardware::configureRpcThreadpool;
+using ::android::hardware::joinRpcThreadpool;
+
+int main(int, char* argv[]) {
+    android::base::InitLogging(argv, android::base::KernelLogger);
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<IBootControl> service = ndk::SharedRefBase::make<BootControl>();
+
+    const std::string instance = std::string(BootControl::descriptor) + "/default";
+    auto status = AServiceManager_addService(service->asBinder().get(), instance.c_str());
+    CHECK_EQ(status, STATUS_OK) << "Failed to add service " << instance << " " << status;
+    LOG(INFO) << "IBootControl AIDL service running...";
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // should not reach
+}
diff --git a/bootctrl/bootctrl_aidl.mk b/bootctrl/bootctrl_aidl.mk
new file mode 100644
index 0000000..e9d7051
--- /dev/null
+++ b/bootctrl/bootctrl_aidl.mk
@@ -0,0 +1,6 @@
+PRODUCT_PACKAGES += \
+	android.hardware.boot-service.default-pixel \
+	android.hardware.boot-service.default_recovery-pixel
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/aidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/aidl
diff --git a/bootctrl/bootctrl_hidl_1.2.mk b/bootctrl/bootctrl_hidl_1.2.mk
new file mode 100644
index 0000000..ef25066
--- /dev/null
+++ b/bootctrl/bootctrl_hidl_1.2.mk
@@ -0,0 +1,6 @@
+PRODUCT_PACKAGES += \
+	android.hardware.boot@1.2-impl-pixel \
+	android.hardware.boot@1.2-service-pixel
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/1.2
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/1.2
diff --git a/bootctrl/sepolicy/1.2/device.te b/bootctrl/sepolicy/1.2/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/1.2/file.te b/bootctrl/sepolicy/1.2/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/1.2/file_contexts b/bootctrl/sepolicy/1.2/file_contexts
new file mode 100644
index 0000000..c456356
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot@1\.2-service-pixel                    u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/1.2/hal_bootctl_default.te b/bootctrl/sepolicy/1.2/hal_bootctl_default.te
new file mode 100644
index 0000000..fe017f9
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/hal_bootctl_default.te
@@ -0,0 +1,3 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
diff --git a/bootctrl/sepolicy/aidl/device.te b/bootctrl/sepolicy/aidl/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/aidl/file.te b/bootctrl/sepolicy/aidl/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/aidl/file_contexts b/bootctrl/sepolicy/aidl/file_contexts
new file mode 100644
index 0000000..339896f
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot-service\.default-pixel                u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/aidl/hal_bootctl_default.te b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
new file mode 100644
index 0000000..2ffeb27
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
@@ -0,0 +1,8 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
+allow hal_bootctl_default tee_device:chr_file rw_file_perms;
+
+recovery_only(`
+  allow hal_bootctl_default rootfs:dir r_dir_perms;
+')
diff --git a/camera/Android.bp b/camera/Android.bp
index d615e6a..e845678 100644
--- a/camera/Android.bp
+++ b/camera/Android.bp
@@ -12,8 +12,8 @@
     ],
     shared_libs: [
         "libbase",
-	"libdump",
-	"liblog",
+        "libdump",
+        "liblog",
     ],
     vendor: true,
     relative_install_path: "dump",
@@ -26,3 +26,11 @@
     src: "vendor.android.hardware.camera.preview-dis.xml",
     sub_dir: "permissions",
 }
+
+prebuilt_etc {
+    name: "concurrent_foldable_dual_front_xml",
+    vendor: true,
+    filename: "com.google.pixel.camera.concurrent_foldable_dual_front.xml",
+    src: "com.google.pixel.camera.concurrent_foldable_dual_front.xml",
+    sub_dir: "permissions",
+}
diff --git a/camera/com.google.pixel.camera.concurrent_foldable_dual_front.xml b/camera/com.google.pixel.camera.concurrent_foldable_dual_front.xml
new file mode 100644
index 0000000..e2dda0e
--- /dev/null
+++ b/camera/com.google.pixel.camera.concurrent_foldable_dual_front.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!-- The feature on Pixel devices which supports concurrent foldable
+     dual front streaming -->
+<permissions>
+    <feature name="com.google.pixel.camera.concurrent_foldable_dual_front" />
+</permissions>
diff --git a/camera/dump_camera.cpp b/camera/dump_camera.cpp
index 548a866..6aa3414 100644
--- a/camera/dump_camera.cpp
+++ b/camera/dump_camera.cpp
@@ -42,11 +42,15 @@
   // Attach multiple latest sessions (in case the user is running concurrent
   // sessions or starts a new session after the one with performance issues).
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 10, "session-ended-");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 10, "multicam-");
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "high-drop-rate-");
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "watchdog-");
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "camera-ended-");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "fatal-error-");
   dumpLogs(kGraphStateDumpDir.data(), cameraDestDir.c_str(), 5,
            "hal_graph_state_");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 10,
+           "fd_state_tracker-");
 
   return 0;
 }
diff --git a/camera/lyric.mk b/camera/lyric.mk
index b9583ea..7762f4d 100644
--- a/camera/lyric.mk
+++ b/camera/lyric.mk
@@ -11,13 +11,8 @@
 $(call soong_config_set,gch,hwl_library,lyric)
 endif
 
-# Check if we're in PDK build
-ifeq ($(wildcard vendor/google/camera),)
-# If vendor/google/camera doesn't exist, it's a PDK build.
-$(call soong_config_set,lyric,pdk_build,true)
-else
-# Otherwise, it's an internal Google build.
-$(call soong_config_set,lyric,pdk_build,false)
+# Check if we're in the internal build
+ifneq ($(wildcard vendor/google/camera),)
 
 PRODUCT_SOONG_NAMESPACES += \
     vendor/google/camera \
@@ -37,6 +32,7 @@
 
 # Calibration tool for debug builds
 PRODUCT_PACKAGES_DEBUG += tarasque_test
+PRODUCT_PACKAGES_DEBUG += ProtoCalibGenerator
 
 endif  # vendor/google/camera check
 
diff --git a/camera/sepolicy/product/private/vendor_pcs_app.te b/camera/sepolicy/product/private/vendor_pcs_app.te
index 6bf0451..55eeee7 100644
--- a/camera/sepolicy/product/private/vendor_pcs_app.te
+++ b/camera/sepolicy/product/private/vendor_pcs_app.te
@@ -1,12 +1,32 @@
 typeattribute vendor_pcs_app coredomain;
 
 app_domain(vendor_pcs_app);
+net_domain(vendor_pcs_app);
+bluetooth_domain(vendor_pcs_app);
 
 allow vendor_pcs_app {
     app_api_service
     audioserver_service
     cameraserver_service
+    drmserver_service
     mediametrics_service
     mediaserver_service
+    nfc_service
     radio_service
 }:service_manager find;
+
+# Following allowances were replicated from priv_app
+# Write to /cache.
+allow vendor_pcs_app { cache_file cache_recovery_file }:dir create_dir_perms;
+allow vendor_pcs_app { cache_file cache_recovery_file }:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow vendor_pcs_app cache_file:lnk_file r_file_perms;
+
+# Access to /data/media.
+allow vendor_pcs_app media_rw_data_file:dir create_dir_perms;
+allow vendor_pcs_app media_rw_data_file:file create_file_perms;
+
+# Access to /data/preloads
+r_dir_file(vendor_pcs_app, preloads_data_file)
+r_dir_file(vendor_pcs_app, preloads_media_file)
+
diff --git a/camera/sepolicy/vendor/hal_camera_default.te b/camera/sepolicy/vendor/hal_camera_default.te
index 4c9aa05..9e7b105 100644
--- a/camera/sepolicy/vendor/hal_camera_default.te
+++ b/camera/sepolicy/vendor/hal_camera_default.te
@@ -8,5 +8,6 @@
 
 binder_call(hal_camera_default, vendor_pcs_app);
 
-# Allow Lyric HAL to start ISP Service
+# Allow Lyric HAL to start ISP Service and Image Processing HAL
 add_service(hal_camera_default, vendor_camera_isp_service)
+add_service(hal_camera_default, vendor_image_processing_hal_service)
diff --git a/camera/sepolicy/vendor/service.te b/camera/sepolicy/vendor/service.te
index 87a1d93..35887ba 100644
--- a/camera/sepolicy/vendor/service.te
+++ b/camera/sepolicy/vendor/service.te
@@ -5,3 +5,5 @@
 type vendor_camera_isp_service, hal_service_type, protected_service, service_manager_type;
 
 type vendor_camera_cameraidremapper_service, hal_service_type, protected_service, service_manager_type;
+
+type vendor_image_processing_hal_service, hal_service_type, protected_service, service_manager_type;
diff --git a/camera/sepolicy/vendor/service_contexts b/camera/sepolicy/vendor/service_contexts
index 1bcaab8..9f5e335 100644
--- a/camera/sepolicy/vendor/service_contexts
+++ b/camera/sepolicy/vendor/service_contexts
@@ -5,3 +5,5 @@
 com.google.pixel.camera.isp.IIspService/default u:object_r:vendor_camera_isp_service:s0
 
 com.google.pixel.camera.services.cameraidremapper.ICameraIdRemapper/default u:object_r:vendor_camera_cameraidremapper_service:s0
+
+com.google.android.imageprocessing.IImageProcessingHal u:object_r:vendor_image_processing_hal_service:s0
diff --git a/camera/sepolicy/vendor/vendor_pcs_app.te b/camera/sepolicy/vendor/vendor_pcs_app.te
index e269a2f..b4d71b5 100644
--- a/camera/sepolicy/vendor/vendor_pcs_app.te
+++ b/camera/sepolicy/vendor/vendor_pcs_app.te
@@ -1,14 +1,17 @@
-# Allow PCS to find the LyricConfigProvider service through ServiceManager.
-allow vendor_pcs_app vendor_camera_lyricconfigprovider_service:service_manager find;
-# Allow PCS to find the CameraIdRemapper service through ServiceManager.
-allow vendor_pcs_app vendor_camera_cameraidremapper_service:service_manager find;
+allow vendor_pcs_app {
+    vendor_camera_lyricconfigprovider_service
+    vendor_camera_cameraidremapper_service
+    edgetpu_app_service
+}:service_manager find;
 
 allow vendor_pcs_app hal_pixel_remote_camera_service:service_manager add;
 
 binder_call(vendor_pcs_app, hal_pixel_remote_camera_service);
-
 binder_call(vendor_pcs_app, hal_camera_default);
 
+# Allow interacting with EdgeTpu.
+allow vendor_pcs_app edgetpu_device:chr_file { getattr read write ioctl map };
+
 # Allow PCS to open socket connections for HTTP streaming support.
 allow vendor_pcs_app vendor_pcs_app:unpriv_socket_class_set create_socket_perms_no_ioctl;
 allow vendor_pcs_app fwmarkd_socket:sock_file write;
diff --git a/chre/README.txt b/chre/README.txt
new file mode 100644
index 0000000..3bdea2b
--- /dev/null
+++ b/chre/README.txt
@@ -0,0 +1,5 @@
+This folder contains the common settings for CHRE shared by various platforms.
+
+Dependencies among types can happen. For example, hal_contexthub_default
+depends on sysfs_aoc at the moment. When setting up a device with CHRE
+we should make sure rules of dependent types are included too.
diff --git a/chre/hal.mk b/chre/hal.mk
new file mode 100644
index 0000000..13ebb7f
--- /dev/null
+++ b/chre/hal.mk
@@ -0,0 +1,2 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/chre/sepolicy/
+PRODUCT_PACKAGES += android.hardware.contexthub-service.generic
\ No newline at end of file
diff --git a/chre/sepolicy/file_contexts b/chre/sepolicy/file_contexts
new file mode 100644
index 0000000..0659579
--- /dev/null
+++ b/chre/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.contexthub-service\.generic               u:object_r:hal_contexthub_default_exec:s0
diff --git a/chre/sepolicy/hal_contexthub_default.te b/chre/sepolicy/hal_contexthub_default.te
new file mode 100644
index 0000000..87e3a42
--- /dev/null
+++ b/chre/sepolicy/hal_contexthub_default.te
@@ -0,0 +1,37 @@
+#
+# Context hub multiclient HAL common selinux policies
+#
+
+# Permit communication with AoC
+allow hal_contexthub_default aoc_device:chr_file rw_file_perms;
+
+# Allow context hub HAL to determine AoC's current clock
+allow hal_contexthub_default sysfs_aoc:dir search;
+allow hal_contexthub_default sysfs_aoc_boottime:file r_file_perms;
+
+# Allow context hub HAL to create thread to watch AOC's device
+allow hal_contexthub_default device:dir r_dir_perms;
+
+# Allow context hub HAL to use the USF low latency transport
+usf_low_latency_transport(hal_contexthub_default)
+
+# Allow context hub HAL to talk to the WiFi HAL
+binder_call(hal_contexthub_default, hal_wifi_ext)
+allow hal_contexthub_default hal_wifi_ext_service:service_manager find;
+
+# Allow context hub HAL to talk to stats service
+binder_call(hal_contexthub_default, stats_service_server)
+allow hal_contexthub_default fwk_stats_service:service_manager find;
+
+# Allow context hub HAL to write data to /data/vendor/chre/ directory
+allow hal_contexthub_default chre_data_file:dir create_dir_perms;
+allow hal_contexthub_default chre_data_file:file create_file_perms;
+
+# Allow context hub HAL to use WakeLock
+wakelock_use(hal_contexthub_default)
+
+# Allow context hub HAL to block suspend, which is required to use EPOLLWAKEUP
+allow hal_contexthub_default self:global_capability2_class_set block_suspend;
+
+# Allow binder calls with clients
+binder_call(hal_contexthub_default, hal_sensors_default)
diff --git a/chre/sepolicy/property.te b/chre/sepolicy/property.te
new file mode 100644
index 0000000..f2a98eb
--- /dev/null
+++ b/chre/sepolicy/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_chre_hal_prop)
\ No newline at end of file
diff --git a/chre/sepolicy/property_contexts b/chre/sepolicy/property_contexts
new file mode 100644
index 0000000..f3d3fd8
--- /dev/null
+++ b/chre/sepolicy/property_contexts
@@ -0,0 +1 @@
+vendor.chre.multiclient_hal                     u:object_r:vendor_chre_hal_prop:s0
\ No newline at end of file
diff --git a/chre/sepolicy/vendor_init.te b/chre/sepolicy/vendor_init.te
new file mode 100644
index 0000000..d1a70fe
--- /dev/null
+++ b/chre/sepolicy/vendor_init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, vendor_chre_hal_prop)
\ No newline at end of file
diff --git a/dauntless/gsc.mk b/dauntless/gsc.mk
index 892f71a..188d9f9 100644
--- a/dauntless/gsc.mk
+++ b/dauntless/gsc.mk
@@ -9,7 +9,6 @@
     android.hardware.weaver-service.citadel \
     android.hardware.authsecret-service.citadel \
     android.hardware.oemlock-service.citadel \
-    android.hardware.identity@1.0-service.citadel \
     init_citadel \
     android.hardware.strongbox_keystore.xml \
     android.hardware.security.keymint-service.citadel \
@@ -19,5 +18,6 @@
 PRODUCT_PACKAGES_DEBUG += citadel_integration_tests \
                           pwntest \
                           nugget_targeted_tests \
-                          CitadelProvision
-endif
\ No newline at end of file
+                          CitadelProvision \
+                          nugget_aidl_test_weaver
+endif
diff --git a/diagnosticstool/diagnosticstool.mk b/diagnosticstool/diagnosticstool.mk
deleted file mode 100644
index 67fbd88..0000000
--- a/diagnosticstool/diagnosticstool.mk
+++ /dev/null
@@ -1 +0,0 @@
-PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/diagnosticstool/sepolicy
diff --git a/diagnosticstool/sepolicy/diagnosticstool_app.te b/diagnosticstool/sepolicy/diagnosticstool_app.te
deleted file mode 100644
index d1874e6..0000000
--- a/diagnosticstool/sepolicy/diagnosticstool_app.te
+++ /dev/null
@@ -1,4 +0,0 @@
-type diagnosticstool_app, domain;
-app_domain(diagnosticstool_app)
-
-allow diagnosticstool_app app_api_service:service_manager find;
diff --git a/diagnosticstool/sepolicy/seapp_contexts b/diagnosticstool/sepolicy/seapp_contexts
deleted file mode 100644
index 3c601cd..0000000
--- a/diagnosticstool/sepolicy/seapp_contexts
+++ /dev/null
@@ -1,2 +0,0 @@
-# Diagnostics Tool
-user=_app seinfo=platform name=com.google.android.apps.diagnosticstool domain=diagnosticstool_app isPrivApp=true levelFrom=user
diff --git a/display_logbuffer/Android.bp b/display_logbuffer/Android.bp
new file mode 100644
index 0000000..e2859d9
--- /dev/null
+++ b/display_logbuffer/Android.bp
@@ -0,0 +1,19 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "dump_display_logbuffer",
+    srcs: ["dump_display_logbuffer.cpp"],
+    init_rc: ["init.display_logbuffer.rc"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libdump",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
diff --git a/display_logbuffer/dump.mk b/display_logbuffer/dump.mk
new file mode 100644
index 0000000..9808c1d
--- /dev/null
+++ b/display_logbuffer/dump.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/display_logbuffer/sepolicy
+
+PRODUCT_PACKAGES += dump_display_logbuffer
diff --git a/display_logbuffer/dump_display_logbuffer.cpp b/display_logbuffer/dump_display_logbuffer.cpp
new file mode 100644
index 0000000..7477c8c
--- /dev/null
+++ b/display_logbuffer/dump_display_logbuffer.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <dump/pixel_dump.h>
+#include <unistd.h>
+
+const char* logbuffer_paths[][2] = {
+    {"DSIM0", "/dev/logbuffer_dsim0"},
+    {"DSIM1", "/dev/logbuffer_dsim1"},
+};
+
+int main() {
+    for (auto &logbuffer_path : logbuffer_paths) {
+        if(!access(logbuffer_path[1], R_OK)) {
+            dumpFileContent(logbuffer_path[0], logbuffer_path[1]);
+        }
+    }
+
+    return 0;
+}
\ No newline at end of file
diff --git a/display_logbuffer/init.display_logbuffer.rc b/display_logbuffer/init.display_logbuffer.rc
new file mode 100644
index 0000000..2a39ce3
--- /dev/null
+++ b/display_logbuffer/init.display_logbuffer.rc
@@ -0,0 +1,3 @@
+on property:ro.build.type=userdebug
+    chown system system /dev/logbuffer_dsim0
+    chown system system /dev/logbuffer_dsim1
diff --git a/display_logbuffer/sepolicy/device.te b/display_logbuffer/sepolicy/device.te
new file mode 100644
index 0000000..94432f4
--- /dev/null
+++ b/display_logbuffer/sepolicy/device.te
@@ -0,0 +1 @@
+type display_log_device, dev_type;
\ No newline at end of file
diff --git a/display_logbuffer/sepolicy/dump_display_logbuffer.te b/display_logbuffer/sepolicy/dump_display_logbuffer.te
new file mode 100644
index 0000000..34da48c
--- /dev/null
+++ b/display_logbuffer/sepolicy/dump_display_logbuffer.te
@@ -0,0 +1,3 @@
+pixel_bugreport(dump_display_logbuffer)
+
+allow dump_display_logbuffer display_log_device:chr_file r_file_perms;
\ No newline at end of file
diff --git a/display_logbuffer/sepolicy/file_contexts b/display_logbuffer/sepolicy/file_contexts
new file mode 100644
index 0000000..7425214
--- /dev/null
+++ b/display_logbuffer/sepolicy/file_contexts
@@ -0,0 +1,4 @@
+/vendor/bin/dump/dump_display_logbuffer      u:object_r:dump_display_logbuffer_exec:s0
+
+/dev/logbuffer_dsim0                         u:object_r:display_log_device:s0
+/dev/logbuffer_dsim1                         u:object_r:display_log_device:s0
diff --git a/edgetpu/sepolicy/device.te b/edgetpu/sepolicy/device.te
index 9296ba5..78e918a 100644
--- a/edgetpu/sepolicy/device.te
+++ b/edgetpu/sepolicy/device.te
@@ -1,2 +1,2 @@
 # EdgeTPU device (DarwiNN)
-type edgetpu_device, dev_type, mlstrustedobject;
+type edgetpu_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
diff --git a/edgetpu/sepolicy/edgetpu_app_service.te b/edgetpu/sepolicy/edgetpu_app_service.te
index 271805e..838f476 100644
--- a/edgetpu/sepolicy/edgetpu_app_service.te
+++ b/edgetpu/sepolicy/edgetpu_app_service.te
@@ -38,3 +38,12 @@
 
 # Allow EdgeTPU service to log to stats service. (metrics)
 allow edgetpu_app_server fwk_stats_service:service_manager find;
+
+# Allow mlock without size restriction
+allow edgetpu_app_server self:capability ipc_lock;
+
+# Need to effectively read file mapped file when mmap + mlocked.
+allow edgetpu_app_server privapp_data_file:file { map read};
+
+# For shell level testing of mlock
+allow edgetpu_app_server shell_data_file:file { map read};
diff --git a/edgetpu/sepolicy/edgetpu_tachyon_service.te b/edgetpu/sepolicy/edgetpu_tachyon_service.te
index 66a4667..da34353 100644
--- a/edgetpu/sepolicy/edgetpu_tachyon_service.te
+++ b/edgetpu/sepolicy/edgetpu_tachyon_service.te
@@ -27,6 +27,9 @@
 allow edgetpu_tachyon_server gpu_device:dir r_dir_perms;
 allow edgetpu_tachyon_server ion_device:chr_file r_file_perms;
 
+# Allow Tachyon service to access dmabuf sysytem.
+allow edgetpu_tachyon_server dmabuf_system_heap_device:chr_file r_file_perms;
+
 # Allow Tachyon service to read the overcommit_memory info.
 allow edgetpu_tachyon_server proc_overcommit_memory:file r_file_perms;
 
@@ -46,3 +49,14 @@
 get_prop(edgetpu_tachyon_server, vendor_hetero_runtime_prop)
 # Allow Tachyon service to read EdgeTPU CPU scheduler properties
 get_prop(edgetpu_tachyon_server, vendor_edgetpu_cpu_scheduler_prop)
+
+# Allow mlock without size restriction
+allow edgetpu_tachyon_server self:capability ipc_lock;
+
+# Need to effectively read file mapped file when mmap + mlocked.
+allow edgetpu_tachyon_server privapp_data_file:file { map read};
+
+# For shell level testing of mlock
+userdebug_or_eng(`
+    allow edgetpu_tachyon_server shell_data_file:file { map read};
+')
diff --git a/edgetpu/sepolicy/file_contexts b/edgetpu/sepolicy/file_contexts
index df0a63e..6190fcf 100644
--- a/edgetpu/sepolicy/file_contexts
+++ b/edgetpu/sepolicy/file_contexts
@@ -15,8 +15,10 @@
 /vendor/lib64/libmetrics_logger\.so                                        u:object_r:same_process_hal_file:s0
 /vendor/lib64/libedgetpu_util\.so                                          u:object_r:same_process_hal_file:s0
 # EdgeTPU runtime libraries
-/vendor/lib64/com\.google\.edgetpu_app_service-V[1-2]-ndk\.so              u:object_r:same_process_hal_file:s0
+/vendor/lib64/com\.google\.edgetpu_app_service-V[1-4]-ndk\.so              u:object_r:same_process_hal_file:s0
 /vendor/lib64/com\.google\.edgetpu_vendor_service-V[1-2]-ndk\.so           u:object_r:same_process_hal_file:s0
+# EdgeTPU Tachyon libraries
+/vendor/lib64/libedgetpu_tachyon\.google\.so                               u:object_r:same_process_hal_file:s0
 
 # EdgeTPU data files
 /data/vendor/hal_neuralnetworks_darwinn(/.*)?                              u:object_r:hal_neuralnetworks_darwinn_data_file:s0
@@ -27,3 +29,6 @@
 
 # Tachyon service
 /vendor/bin/hw/com\.google\.edgetpu.tachyon-service                        u:object_r:edgetpu_tachyon_server_exec:s0
+
+# libfmq.so is dynamically loaded by the Tachyon client-side library libedgetpu_tachyon.google.so
+/vendor/lib64/libfmq\.so                                                   u:object_r:same_process_hal_file:s0
diff --git a/edgetpu/sepolicy/hal_audio_default.te b/edgetpu/sepolicy/hal_audio_default.te
index 2646fcc..4d58e0b 100644
--- a/edgetpu/sepolicy/hal_audio_default.te
+++ b/edgetpu/sepolicy/hal_audio_default.te
@@ -12,3 +12,19 @@
 
 # Allow audio HAL to read tflite Darwinn delegate properties
 get_prop(hal_audio_default, vendor_tflite_delegate_prop)
+
+# Allow audio HAL to read DarwiNN runtime properties
+get_prop(hal_audio_default, vendor_edgetpu_runtime_prop)
+
+# Allow audio HAL to read hetero runtime properties
+get_prop(hal_audio_default, vendor_hetero_runtime_prop)
+
+# Allow DMA Buf access.
+allow hal_audio_default dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Allow audio HAL to connect to the stats service for logging EdgeTpu metrics.
+allow hal_audio_default fwk_stats_service:service_manager find;
+
+# Allow audio HAL to send EdgeTpu trace packets to Perfetto.
+# Enable for prod devices, see: go/darwinn-perfetto-critical-events
+perfetto_producer(hal_audio_default)
diff --git a/edgetpu/sepolicy/priv_app.te b/edgetpu/sepolicy/priv_app.te
index a9b49c3..579cc61 100644
--- a/edgetpu/sepolicy/priv_app.te
+++ b/edgetpu/sepolicy/priv_app.te
@@ -7,3 +7,6 @@
 # Allows privileged applications to access the EdgeTPU device, except open,
 # which is guarded by the EdgeTPU service.
 allow priv_app edgetpu_device:chr_file { getattr read write ioctl map };
+
+# Allows EdgeTPU Tachyon service to call the app.
+binder_call(edgetpu_tachyon_server, priv_app);
diff --git a/edgetpu/sepolicy/service.te b/edgetpu/sepolicy/service.te
index b1a5409..5ea2006 100644
--- a/edgetpu/sepolicy/service.te
+++ b/edgetpu/sepolicy/service.te
@@ -4,4 +4,4 @@
 type edgetpu_tachyon_service, app_api_service, service_manager_type, isolated_compute_allowed_service;
 
 # EdgeTPU binder service type declaration.
-type edgetpu_app_service, service_manager_type;
+type edgetpu_app_service, service_manager_type, isolated_compute_allowed_service;
diff --git a/edgetpu/sepolicy/untrusted_app_all.te b/edgetpu/sepolicy/untrusted_app_all.te
index 9abec61..3c92900 100644
--- a/edgetpu/sepolicy/untrusted_app_all.te
+++ b/edgetpu/sepolicy/untrusted_app_all.te
@@ -5,3 +5,5 @@
 # by the EdgeTPU service.
 allow untrusted_app_all edgetpu_device:chr_file { getattr read write ioctl map };
 
+# Allows EdgeTPU Tachyon service to call the app.
+binder_call(edgetpu_tachyon_server, untrusted_app_all);
diff --git a/fingerprint/Android.bp b/fingerprint/Android.bp
new file mode 100644
index 0000000..b5bd008
--- /dev/null
+++ b/fingerprint/Android.bp
@@ -0,0 +1,21 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "dump_fingerprint",
+    srcs: ["dump_fingerprint.cpp"],
+    init_rc: ["init.fingerprint.dump.rc"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+        "liblog",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
diff --git a/fingerprint/dump_fingerprint.cpp b/fingerprint/dump_fingerprint.cpp
new file mode 100644
index 0000000..1c8c7cd
--- /dev/null
+++ b/fingerprint/dump_fingerprint.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <android-base/file.h>
+#include <dump/pixel_dump.h>
+#include <log/log.h>
+#include <stdio.h>
+#include <string.h>
+
+static constexpr const char *kTombstonesDirPath = "/data/vendor/tombstones/fingerprint/";
+
+int main() {
+    printf("------ Fingerprint tombstones ------\n");
+    std::unique_ptr<DIR, decltype(&closedir)> tombstones_dir(opendir(kTombstonesDirPath), closedir);
+    if (tombstones_dir) {
+        dirent *entry;
+        while ((entry = readdir(tombstones_dir.get())) != nullptr) {
+            std::string file_name(entry->d_name);
+            if (!strcmp(file_name.c_str(), ".") || !strcmp(file_name.c_str(), ".."))
+                continue;
+            std::string file_path(kTombstonesDirPath + file_name);
+            dumpFileContent(file_name.c_str(), file_path.c_str());
+        }
+    }
+
+    return 0;
+}
diff --git a/fingerprint/fingerprint.mk b/fingerprint/fingerprint.mk
new file mode 100644
index 0000000..fb3ceda
--- /dev/null
+++ b/fingerprint/fingerprint.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/fingerprint/sepolicy
+
+PRODUCT_PACKAGES += dump_fingerprint
diff --git a/fingerprint/init.fingerprint.dump.rc b/fingerprint/init.fingerprint.dump.rc
new file mode 100644
index 0000000..f00cdc4
--- /dev/null
+++ b/fingerprint/init.fingerprint.dump.rc
@@ -0,0 +1,2 @@
+on post-fs-data
+    mkdir /data/vendor/tombstones/fingerprint 0770 system system
diff --git a/fingerprint/sepolicy/dump_fingerprint.te b/fingerprint/sepolicy/dump_fingerprint.te
new file mode 100644
index 0000000..9af033b
--- /dev/null
+++ b/fingerprint/sepolicy/dump_fingerprint.te
@@ -0,0 +1,5 @@
+pixel_bugreport(dump_fingerprint)
+
+allow dump_fingerprint fingerprint_vendor_data_file:dir r_dir_perms;
+allow dump_fingerprint fingerprint_vendor_data_file:file r_file_perms;
+
diff --git a/fingerprint/sepolicy/file_contexts b/fingerprint/sepolicy/file_contexts
new file mode 100644
index 0000000..a035703
--- /dev/null
+++ b/fingerprint/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+/vendor/bin/dump/dump_fingerprint          u:object_r:dump_fingerprint_exec:s0
+/data/vendor/tombstones/fingerprint(/.*)?  u:object_r:fingerprint_vendor_data_file:s0
diff --git a/fingerprint/sepolicy/hal_fingerprint.te b/fingerprint/sepolicy/hal_fingerprint.te
new file mode 100644
index 0000000..6e1af7e
--- /dev/null
+++ b/fingerprint/sepolicy/hal_fingerprint.te
@@ -0,0 +1 @@
+allow hal_fingerprint trusty_log_device:chr_file r_file_perms;
diff --git a/gear/dumpstate_v3/Android.bp b/gear/dumpstate_v3/Android.bp
new file mode 100644
index 0000000..d1ab29c
--- /dev/null
+++ b/gear/dumpstate_v3/Android.bp
@@ -0,0 +1,29 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "android.hardware.dumpstate.3-service",
+    srcs: [
+        "Dumpstate.cpp",
+        "service.cpp",
+    ],
+    init_rc: ["android.hardware.dumpstate.3-service.rc"],
+    vintf_fragments: ["android.hardware.dumpstate.3-service.xml"],
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "libdumpstateutil",
+        "liblog",
+        "libutils",
+        "libdump",
+        "android.hardware.dumpstate-V1-ndk",
+    ],
+    vendor: true,
+    relative_install_path: "hw",
+}
diff --git a/gear/dumpstate_v3/Dumpstate.cpp b/gear/dumpstate_v3/Dumpstate.cpp
new file mode 100644
index 0000000..31df2c7
--- /dev/null
+++ b/gear/dumpstate_v3/Dumpstate.cpp
@@ -0,0 +1,230 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "dumpstate_device"
+#define ATRACE_TAG ATRACE_TAG_ALWAYS
+
+#include <inttypes.h>
+
+#include <android-base/file.h>
+#include <android-base/stringprintf.h>
+#include <android-base/properties.h>
+#include <android-base/unique_fd.h>
+#include <cutils/trace.h>
+#include <log/log.h>
+#include <sys/stat.h>
+#include <dump/pixel_dump.h>
+#include "Dumpstate.h"
+
+#include "DumpstateUtil.h"
+
+#define HW_REVISION "ro.boot.hardware.revision"
+
+using android::os::dumpstate::CommandOptions;
+using android::os::dumpstate::DumpFileToFd;
+using android::os::dumpstate::PropertiesHelper;
+using android::os::dumpstate::RunCommandToFd;
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace dumpstate {
+
+typedef std::chrono::time_point<std::chrono::steady_clock> timepoint_t;
+
+const char kVerboseLoggingProperty[] = "persist.vendor.verbose_logging_enabled";
+
+timepoint_t startSection(int fd, const std::string &sectionName) {
+    ATRACE_BEGIN(sectionName.c_str());
+    ::android::base::WriteStringToFd(
+            "\n"
+            "------ Section start: " + sectionName + " ------\n"
+            "\n", fd);
+    return std::chrono::steady_clock::now();
+}
+
+void endSection(int fd, const std::string &sectionName, timepoint_t startTime) {
+    ATRACE_END();
+    auto endTime = std::chrono::steady_clock::now();
+    auto elapsedMsec = std::chrono::duration_cast<std::chrono::milliseconds>
+            (endTime - startTime).count();
+
+    ::android::base::WriteStringToFd(
+            "\n"
+            "------ Section end: " + sectionName + " ------\n"
+            "Elapsed msec: " + std::to_string(elapsedMsec) + "\n"
+            "\n", fd);
+}
+
+// Dump data requested by an argument to the "dump" interface, or help info
+// if the specified section is not supported.
+void Dumpstate::dumpTextSection(int fd, const std::string &sectionName) {
+    bool dumpAll = (sectionName == kAllSections);
+    std::string dumpFiles;
+    struct dirent **dirent_list = NULL;
+    int num_entries = scandir("/vendor/bin/dump", &dirent_list, 0, (int (*)(const struct dirent **, const struct dirent **)) alphasort);
+    if (!dirent_list) {
+        ALOGE("Unable to scan dir: /vendor/bin/dump\n");
+        return;
+    } else if (num_entries <= 0) {
+        ALOGE("No file is found.\n");
+        return;
+    }
+    // Execute all or designated programs under vendor/bin/dump/
+    for (int i = 0; i <  num_entries; i++) {
+        if (dirent_list[i]->d_name[0] == '.') {
+            continue;
+        }
+        std::string bin(dirent_list[i]->d_name);
+        dumpFiles = dumpFiles + " " + bin;
+        if (dumpAll || sectionName == bin) {
+            auto startTime = startSection(fd, bin);
+            RunCommandToFd(fd, "/vendor/bin/dump/"+bin, {"/vendor/bin/dump/"+bin}, CommandOptions::WithTimeout(15).Build());
+            endSection(fd, bin, startTime);
+            if (!dumpAll) {
+                return;
+            }
+        }
+    }
+
+    if (dumpAll) {
+        RunCommandToFd(fd, "VENDOR PROPERTIES", {"/vendor/bin/getprop"});
+        return;
+    }
+
+    // An unsupported section was requested on the command line
+    ::android::base::WriteStringToFd("Unrecognized text section: " + sectionName + "\n", fd);
+    ::android::base::WriteStringToFd("Try \"" + kAllSections + "\" or one of the following:", fd);
+    ::android::base::WriteStringToFd(dumpFiles, fd);
+    ::android::base::WriteStringToFd("\nNote: sections with attachments (e.g. dump_soc) are"
+                                   "not available from the command line.\n", fd);
+    while (num_entries--) {
+        free(dirent_list[num_entries]);
+    }
+    free(dirent_list);
+}
+
+void Dumpstate::dumpLogSection(int fd, int fd_bin)
+{
+    std::string logDir = MODEM_LOG_DIRECTORY;
+    const std::string logCombined = logDir + "/combined_logs.tar";
+    const std::string logAllDir = logDir + "/all_logs";
+
+    RunCommandToFd(fd, "MKDIR LOG", {"/vendor/bin/mkdir", "-p", logAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
+
+    dumpTextSection(fd, kAllSections);
+
+    RunCommandToFd(fd, "TAR LOG", {"/vendor/bin/tar", "cvf", logCombined.c_str(), "-C", logAllDir.c_str(), "."}, CommandOptions::WithTimeout(20).Build());
+    RunCommandToFd(fd, "CHG PERM", {"/vendor/bin/chmod", "a+w", logCombined.c_str()}, CommandOptions::WithTimeout(2).Build());
+
+    std::vector<uint8_t> buffer(65536);
+    ::android::base::unique_fd fdLog(TEMP_FAILURE_RETRY(open(logCombined.c_str(), O_RDONLY | O_CLOEXEC | O_NONBLOCK)));
+
+    if (fdLog >= 0) {
+        while (1) {
+            ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fdLog, buffer.data(), buffer.size()));
+
+            if (bytes_read == 0) {
+                break;
+            } else if (bytes_read < 0) {
+                ALOGD("read(%s): %s\n", logCombined.c_str(), strerror(errno));
+                break;
+            }
+
+            ssize_t result = TEMP_FAILURE_RETRY(write(fd_bin, buffer.data(), bytes_read));
+
+            if (result != bytes_read) {
+                ALOGD("Failed to write %zd bytes, actually written: %zd", bytes_read, result);
+                break;
+            }
+        }
+    }
+
+    RunCommandToFd(fd, "RM LOG DIR", { "/vendor/bin/rm", "-r", logAllDir.c_str()}, CommandOptions::WithTimeout(2).Build());
+    RunCommandToFd(fd, "RM LOG", { "/vendor/bin/rm", logCombined.c_str()}, CommandOptions::WithTimeout(2).Build());
+}
+
+ndk::ScopedAStatus Dumpstate::dumpstateBoard(const std::vector<::ndk::ScopedFileDescriptor>& in_fds,
+                                             IDumpstateDevice::DumpstateMode in_mode,
+                                             int64_t in_timeoutMillis) {
+    ATRACE_BEGIN("dumpstateBoard");
+    // Unused arguments.
+    (void) in_timeoutMillis;
+
+    if (in_mode < IDumpstateDevice::DumpstateMode::FULL || in_mode > IDumpstateDevice::DumpstateMode::PROTO) {
+        ALOGE("Invalid mode: %d\n", in_mode);
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT, "Invalid mode");
+    }
+
+    if (in_fds.size() < 1) {
+        ALOGE("no FDs\n");
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "No file descriptor");
+    }
+
+    int fd = in_fds[0].get();
+    if (fd < 0) {
+        ALOGE("invalid FD: %d\n", fd);
+        return ndk::ScopedAStatus::fromExceptionCodeWithMessage(EX_ILLEGAL_ARGUMENT,
+                                                                "Invalid file descriptor");
+    }
+
+    if (in_fds.size() < 2) {
+          ALOGE("no FD for dumpstate_board binary\n");
+          dumpTextSection(fd, "");
+    } else {
+          int fd_bin = in_fds[1].get();
+          dumpLogSection(fd, fd_bin);
+    }
+
+    ATRACE_END();
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Dumpstate::setVerboseLoggingEnabled(bool in_enable) {
+    ::android::base::SetProperty(kVerboseLoggingProperty, in_enable ? "true" : "false");
+    return ndk::ScopedAStatus::ok();
+}
+
+ndk::ScopedAStatus Dumpstate::getVerboseLoggingEnabled(bool* _aidl_return) {
+    *_aidl_return = ::android::base::GetBoolProperty(kVerboseLoggingProperty, false);
+    return ndk::ScopedAStatus::ok();
+}
+
+// Since AIDLs that support the dump() interface are automatically invoked during
+// bugreport generation and we don't want to generate a second copy of the same
+// data that will go into dumpstate_board.txt, this function will only do
+// something if it is called with an option, e.g.
+//   dumpsys android.hardware.dumpstate.IDumpstateDevice/default all
+//
+// Also, note that sections which generate attachments and/or binary data when
+// included in a bugreport are not available through the dump() interface.
+binder_status_t Dumpstate::dump(int fd, const char** args, uint32_t numArgs) {
+
+    if (numArgs != 1) {
+        return STATUS_OK;
+    }
+
+    dumpTextSection(fd, static_cast<std::string>(args[0]));
+
+    fsync(fd);
+    return STATUS_OK;
+}
+
+}  // namespace dumpstate
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/gear/dumpstate_v3/Dumpstate.h b/gear/dumpstate_v3/Dumpstate.h
new file mode 100644
index 0000000..787b774
--- /dev/null
+++ b/gear/dumpstate_v3/Dumpstate.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/dumpstate/BnDumpstateDevice.h>
+#include <aidl/android/hardware/dumpstate/IDumpstateDevice.h>
+#include <android/binder_status.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace dumpstate {
+
+class Dumpstate : public BnDumpstateDevice {
+  public:
+    ::ndk::ScopedAStatus dumpstateBoard(const std::vector<::ndk::ScopedFileDescriptor>& in_fds,
+                                        IDumpstateDevice::DumpstateMode in_mode,
+                                        int64_t in_timeoutMillis) override;
+
+    ::ndk::ScopedAStatus getVerboseLoggingEnabled(bool* _aidl_return) override;
+
+    ::ndk::ScopedAStatus setVerboseLoggingEnabled(bool in_enable) override;
+
+    binder_status_t dump(int fd, const char** args, uint32_t numArgs) override;
+
+  private:
+    const std::string kAllSections = "all";
+
+    void dumpTextSection(int fd, std::string const& sectionName);
+    void dumpLogSection(int fd, int fdModem);
+
+    //bool getVerboseLoggingEnabledImpl();
+    //::ndk::ScopedAStatus dumpstateBoardImpl(const int fd, const bool full);
+};
+
+}  // namespace dumpstate
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/gear/dumpstate_v3/aidl.mk b/gear/dumpstate_v3/aidl.mk
new file mode 100644
index 0000000..bcecb78
--- /dev/null
+++ b/gear/dumpstate_v3/aidl.mk
@@ -0,0 +1,4 @@
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/gear/dumpstate_v3
+PRODUCT_PACKAGES += android.hardware.dumpstate.3-service
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gear/dumpstate_v3/sepolicy
+
diff --git a/gear/dumpstate_v3/android.hardware.dumpstate.3-service.rc b/gear/dumpstate_v3/android.hardware.dumpstate.3-service.rc
new file mode 100644
index 0000000..0a80e0c
--- /dev/null
+++ b/gear/dumpstate_v3/android.hardware.dumpstate.3-service.rc
@@ -0,0 +1,5 @@
+service vendor.dumpstate-default /vendor/bin/hw/android.hardware.dumpstate.3-service
+    class hal
+    user system
+    group system shell
+    interface aidl android.hardware.dumpstate.IDumpstateDevice/default
diff --git a/gear/dumpstate_v3/android.hardware.dumpstate.3-service.xml b/gear/dumpstate_v3/android.hardware.dumpstate.3-service.xml
new file mode 100644
index 0000000..5e51b28
--- /dev/null
+++ b/gear/dumpstate_v3/android.hardware.dumpstate.3-service.xml
@@ -0,0 +1,9 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.dumpstate</name>
+        <interface>
+            <name>IDumpstateDevice</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/gear/dumpstate_v3/sepolicy/file.te b/gear/dumpstate_v3/sepolicy/file.te
new file mode 100644
index 0000000..1777353
--- /dev/null
+++ b/gear/dumpstate_v3/sepolicy/file.te
@@ -0,0 +1,6 @@
+# dumpstate packing directory
+type radio_vendor_data_file, file_type, data_file_type;
+userdebug_or_eng(`
+  typeattribute radio_vendor_data_file mlstrustedobject;
+')
+
diff --git a/gear/dumpstate_v3/sepolicy/file_contexts b/gear/dumpstate_v3/sepolicy/file_contexts
new file mode 100644
index 0000000..da10e76
--- /dev/null
+++ b/gear/dumpstate_v3/sepolicy/file_contexts
@@ -0,0 +1,5 @@
+# generic dumpstate for pixel
+/vendor/bin/hw/android\.hardware\.dumpstate\.3-service     u:object_r:hal_dumpstate_default_exec:s0
+
+/data/vendor/radio(/.*)?                                   u:object_r:radio_vendor_data_file:s0
+
diff --git a/gear/dumpstate_v3/sepolicy/hal_dumpstate_default.te b/gear/dumpstate_v3/sepolicy/hal_dumpstate_default.te
new file mode 100644
index 0000000..06ebb75
--- /dev/null
+++ b/gear/dumpstate_v3/sepolicy/hal_dumpstate_default.te
@@ -0,0 +1,7 @@
+# required permission to use tar to pack dumpsate_board.bin
+allow hal_dumpstate_default vendor_toolbox_exec:file execute_no_trans;
+allow hal_dumpstate_default radio_vendor_data_file:dir create_dir_perms;
+allow hal_dumpstate_default radio_vendor_data_file:file create_file_perms;
+allow hal_dumpstate_default shell_data_file:file getattr;
+set_prop(hal_dumpstate_default, vendor_logger_prop)
+
diff --git a/gear/dumpstate_v3/sepolicy/property.te b/gear/dumpstate_v3/sepolicy/property.te
new file mode 100644
index 0000000..c6f5a4f
--- /dev/null
+++ b/gear/dumpstate_v3/sepolicy/property.te
@@ -0,0 +1,3 @@
+# verbose property
+vendor_internal_prop(vendor_logger_prop)
+
diff --git a/gear/dumpstate_v3/sepolicy/property_contexts b/gear/dumpstate_v3/sepolicy/property_contexts
new file mode 100644
index 0000000..5ead16f
--- /dev/null
+++ b/gear/dumpstate_v3/sepolicy/property_contexts
@@ -0,0 +1,3 @@
+# verbose property name
+persist.vendor.verbose_logging_enabled     u:object_r:vendor_logger_prop:s0
+
diff --git a/gear/dumpstate_v3/service.cpp b/gear/dumpstate_v3/service.cpp
new file mode 100644
index 0000000..53dc8ac
--- /dev/null
+++ b/gear/dumpstate_v3/service.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "android.hardware.dumpstate.3-service"
+
+#include "Dumpstate.h"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+
+using aidl::android::hardware::dumpstate::Dumpstate;
+
+int main() {
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<Dumpstate> dumpstate = ndk::SharedRefBase::make<Dumpstate>();
+
+    const std::string instance = std::string() + Dumpstate::descriptor + "/default";
+    binder_status_t status =
+            AServiceManager_addService(dumpstate->asBinder().get(), instance.c_str());
+    CHECK_EQ(status, STATUS_OK);
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // Unreachable
+}
diff --git a/gps/brcm/device.mk b/gps/brcm/device.mk
index 3065542..45b4eb0 100644
--- a/gps/brcm/device.mk
+++ b/gps/brcm/device.mk
@@ -1,14 +1,12 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gps/brcm/sepolicy
 
 PRODUCT_SOONG_NAMESPACES += vendor/broadcom/gps/bcm47765
-
-SOONG_CONFIG_NAMESPACES += gpssdk
-SOONG_CONFIG_gpssdk += sdkv1
-SOONG_CONFIG_gpssdk_sdkv1 ?= false
-
-SOONG_CONFIG_NAMESPACES += gpssdk
-SOONG_CONFIG_gpssdk += gpsmcuversion
-SOONG_CONFIG_gpssdk_gpsmcuversion ?= gpsv2_$(TARGET_BUILD_VARIANT)
+ifeq (,$(call soong_config_get,gpssdk,sdkv1))
+    $(call soong_config_set,gpssdk,sdkv1,false)
+endif
+ifeq (,$(call soong_config_get,gpssdk,gpsmcuversion))
+    $(call soong_config_set,gpssdk,gpsmcuversion,gpsv2_$(TARGET_BUILD_VARIANT))
+endif
 
 PRODUCT_PACKAGES += \
 	bcm47765_gps_package \
diff --git a/gps/lsi/sepolicy/device.te b/gps/lsi/sepolicy/device.te
new file mode 100644
index 0000000..15d049f
--- /dev/null
+++ b/gps/lsi/sepolicy/device.te
@@ -0,0 +1 @@
+type vendor_gnss_device, dev_type;
diff --git a/gps/lsi/sepolicy/file_contexts b/gps/lsi/sepolicy/file_contexts
new file mode 100644
index 0000000..e6af3b1
--- /dev/null
+++ b/gps/lsi/sepolicy/file_contexts
@@ -0,0 +1,10 @@
+# GPS
+/dev/gnss_ipc                  u:object_r:vendor_gnss_device:s0
+/dev/gnss_boot                 u:object_r:vendor_gnss_device:s0
+/dev/gnss_dump                 u:object_r:vendor_gnss_device:s0
+/vendor/bin/hw/gnssd            u:object_r:gnssd_exec:s0
+/vendor/bin/hw/sctd             u:object_r:sctd_exec:s0
+/vendor/bin/hw/swcnd            u:object_r:swcnd_exec:s0
+/vendor/bin/hw/spad             u:object_r:spad_exec:s0
+/vendor/bin/hw/android.hardware.gnss-service           u:object_r:hal_gnss_default_exec:s0
+/data/vendor/gps(/.*)?             u:object_r:vendor_gps_file:s0
diff --git a/gps/lsi/sepolicy/genfs_contexts b/gps/lsi/sepolicy/genfs_contexts
new file mode 100644
index 0000000..d19427c
--- /dev/null
+++ b/gps/lsi/sepolicy/genfs_contexts
@@ -0,0 +1,2 @@
+# gps coredump node
+genfscon sysfs /devices/platform/gnssif/coredump                                                                     u:object_r:sysfs_gps:s0
diff --git a/gps/lsi/sepolicy/gnss_check.te b/gps/lsi/sepolicy/gnss_check.te
new file mode 100644
index 0000000..31d0944
--- /dev/null
+++ b/gps/lsi/sepolicy/gnss_check.te
@@ -0,0 +1,9 @@
+type gnss_check, domain;
+type gnss_check_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(gnss_check);
+
+allow gnss_check vendor_toolbox_exec:file { execute_no_trans };
+
+set_prop(gnss_check, ctl_stop_prop);
+set_prop(gnss_check, ctl_start_prop);
diff --git a/gps/lsi/sepolicy/gnssd.te b/gps/lsi/sepolicy/gnssd.te
new file mode 100644
index 0000000..a293b95
--- /dev/null
+++ b/gps/lsi/sepolicy/gnssd.te
@@ -0,0 +1,36 @@
+type gnssd, domain;
+type gnssd_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(gnssd);
+
+# Allow gnssd to access rild
+binder_call(gnssd, rild);
+binder_call(gnssd, hwservicemanager)
+allow gnssd hal_exynos_rild_hwservice:hwservice_manager find;
+allow gnssd radio_device:chr_file rw_file_perms;
+
+# Allow gnssd to acess gnss device
+allow gnssd vendor_gnss_device:chr_file rw_file_perms;
+allow gnssd vendor_gps_file:dir create_dir_perms;
+allow gnssd vendor_gps_file:file create_file_perms;
+allow gnssd vendor_gps_file:fifo_file create_file_perms;
+
+# Allow gnssd to obtain wakelock
+wakelock_use(gnssd)
+
+# Allow a base set of permissions required for network access.
+net_domain(gnssd);
+
+# Allow gnssd to get boot complete
+get_prop(gnssd, bootanim_system_prop)
+
+allow gnssd sysfs_soc:file r_file_perms;
+allow gnssd sysfs_gps:file rw_file_perms;
+
+# Allow gnssd to set GPS property
+set_prop(gnssd, vendor_gps_prop)
+
+# Read RIL property
+get_prop(gnssd, vendor_rild_prop)
+
+# Read modme state
+allow gnssd sysfs_modem_state:file r_file_perms;
diff --git a/gps/lsi/sepolicy/hal_gnss_default.te b/gps/lsi/sepolicy/hal_gnss_default.te
new file mode 100644
index 0000000..7d363f0
--- /dev/null
+++ b/gps/lsi/sepolicy/hal_gnss_default.te
@@ -0,0 +1,13 @@
+allow hal_gnss_default fwk_sensor_service:service_manager find;
+allow hal_gnss_default gnssd:unix_stream_socket connectto;
+allow hal_gnss_default vendor_gps_file:dir create_dir_perms;
+allow hal_gnss_default vendor_gps_file:file create_file_perms;
+allow hal_gnss_default vendor_gps_file:fifo_file create_file_perms;
+allow hal_gnss_default sysfs_gps:file rw_file_perms;
+binder_call(hal_gnss_default, gnssd);
+
+#Read GPS property
+get_prop(hal_gnss_default, vendor_gps_prop)
+
+#IPC between pixel and vendor HAL
+binder_call(hal_gnss_default, hal_gnss_pixel)
diff --git a/gps/lsi/sepolicy/rild.te b/gps/lsi/sepolicy/rild.te
new file mode 100644
index 0000000..c620a19
--- /dev/null
+++ b/gps/lsi/sepolicy/rild.te
@@ -0,0 +1 @@
+binder_call(rild, gnssd)
diff --git a/gps/lsi/sepolicy/sctd.te b/gps/lsi/sepolicy/sctd.te
new file mode 100644
index 0000000..8966ef8
--- /dev/null
+++ b/gps/lsi/sepolicy/sctd.te
@@ -0,0 +1,3 @@
+type sctd, domain;
+type sctd_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(sctd);
diff --git a/gps/lsi/sepolicy/spad.te b/gps/lsi/sepolicy/spad.te
new file mode 100644
index 0000000..eaf8b1c
--- /dev/null
+++ b/gps/lsi/sepolicy/spad.te
@@ -0,0 +1,3 @@
+type spad, domain;
+type spad_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(spad);
diff --git a/gps/lsi/sepolicy/swcnd.te b/gps/lsi/sepolicy/swcnd.te
new file mode 100644
index 0000000..c366cad
--- /dev/null
+++ b/gps/lsi/sepolicy/swcnd.te
@@ -0,0 +1,3 @@
+type swcnd, domain;
+type swcnd_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(swcnd);
diff --git a/gps/lsi/sepolicy/vendor_init.te b/gps/lsi/sepolicy/vendor_init.te
new file mode 100644
index 0000000..c8d637d
--- /dev/null
+++ b/gps/lsi/sepolicy/vendor_init.te
@@ -0,0 +1,2 @@
+# gps vendor property
+set_prop(vendor_init, vendor_gps_prop)
diff --git a/gps/pixel/sepolicy/file_contexts b/gps/pixel/sepolicy/file_contexts
new file mode 100644
index 0000000..8bd8f92
--- /dev/null
+++ b/gps/pixel/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+/vendor/bin/hw/android\.hardware\.gnss-service\.pixel             u:object_r:hal_gnss_pixel_exec:s0
+
diff --git a/gps/pixel/sepolicy/hal_gnss_pixel.te b/gps/pixel/sepolicy/hal_gnss_pixel.te
new file mode 100644
index 0000000..cc63702
--- /dev/null
+++ b/gps/pixel/sepolicy/hal_gnss_pixel.te
@@ -0,0 +1,23 @@
+#IPC between pixel and vendor HAL
+binder_call(hal_gnss_pixel, hal_gnss_default)
+
+#Read modem state
+allow hal_gnss_pixel sysfs_modem_state:file r_file_perms;
+
+#Toggle coredump node
+allow hal_gnss_pixel sysfs_gps:file rw_file_perms;
+
+# Allow access to CHRE multiclient HAL.
+get_prop(hal_gnss_pixel, vendor_chre_hal_prop)
+
+# Allow binder to CHRE.
+binder_call(hal_gnss_pixel, hal_contexthub_default)
+allow hal_gnss_pixel hal_contexthub_service:service_manager find;
+
+# Allow connect to gnss service
+allow hal_gnss_pixel vendor_gps_file:dir create_dir_perms;
+allow hal_gnss_pixel vendor_gps_file:fifo_file create_file_perms;
+
+# Allow access ssrdump information
+allow hal_gnss_pixel sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+allow hal_gnss_pixel sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
diff --git a/gps/pixel/sepolicy/service_contexts b/gps/pixel/sepolicy/service_contexts
new file mode 100644
index 0000000..cc9871f
--- /dev/null
+++ b/gps/pixel/sepolicy/service_contexts
@@ -0,0 +1 @@
+android.hardware.gnss.IGnss/vendor                                 u:object_r:hal_gnss_service:s0
\ No newline at end of file
diff --git a/gpu/gpu.mk b/gpu/gpu.mk
index d1c3a6d..b87e7ad 100644
--- a/gpu/gpu.mk
+++ b/gpu/gpu.mk
@@ -1,3 +1,16 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gpu/sepolicy
 
 PRODUCT_PACKAGES += gpu_probe
+
+USE_MAPPER5 := false
+
+PRODUCT_PACKAGES += pixel_gralloc_allocator
+PRODUCT_PACKAGES += pixel_gralloc_mapper
+
+ifeq ($(USE_MAPPER5), true)
+$(call soong_config_set,arm_gralloc,mapper_version,mapper5)
+$(call soong_config_set,aion_buffer,mapper_version,mapper5)
+else
+$(call soong_config_set,arm_gralloc,mapper_version,mapper4)
+$(call soong_config_set,aion_buffer,mapper_version,mapper4)
+endif
diff --git a/gpu/sepolicy/service_contexts b/gpu/sepolicy/service_contexts
new file mode 100644
index 0000000..88ee08c
--- /dev/null
+++ b/gpu/sepolicy/service_contexts
@@ -0,0 +1,4 @@
+# Note that native/passthrough HALs use the "{type}/{instance}" pattern from
+# SEPolicy perspective and are looked up via the corresponding filename
+# "{type}.{instance}.so".
+mapper/pixel u:object_r:hal_graphics_mapper_service:s0
diff --git a/gs_watchdogd/gs_watchdogd.cpp b/gs_watchdogd/gs_watchdogd.cpp
index 59b089c..82e01d0 100644
--- a/gs_watchdogd/gs_watchdogd.cpp
+++ b/gs_watchdogd/gs_watchdogd.cpp
@@ -14,9 +14,11 @@
  * limitations under the License.
  */
 
+#include <android-base/chrono_utils.h>
 #include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/stringprintf.h>
+#include <android-base/unique_fd.h>
 
 #include <errno.h>
 #include <fcntl.h>
@@ -26,21 +28,28 @@
 #include <string.h>
 #include <unistd.h>
 
-#define DEV_GLOB "/sys/devices/platform/*.watchdog_cl0/watchdog/watchdog*"
+#include <chrono>
+#include <vector>
+
+#define DEV_GLOB "/sys/devices/platform/*.watchdog_cl*/watchdog/watchdog*"
+
+#define DEFAULT_INTERVAL 10s
+#define DEFAULT_MARGIN 10s
 
 using android::base::Basename;
 using android::base::StringPrintf;
+using std::literals::chrono_literals::operator""s;
 
 int main(int argc, char** argv) {
     android::base::InitLogging(argv, &android::base::KernelLogger);
 
-    int interval = 10;
-    if (argc >= 2) interval = atoi(argv[1]);
+    std::chrono::seconds interval = argc >= 2
+        ? std::chrono::seconds(atoi(argv[1])) : DEFAULT_INTERVAL;
+    std::chrono::seconds margin = argc >= 3
+        ? std::chrono::seconds(atoi(argv[2])) : DEFAULT_MARGIN;
 
-    int margin = 10;
-    if (argc >= 3) margin = atoi(argv[2]);
-
-    LOG(INFO) << "gs_watchdogd started (interval " << interval << ", margin " << margin << ")!";
+    LOG(INFO) << "gs_watchdogd started (interval " << interval.count()
+              << ", margin " << margin.count() << ")!";
 
     glob_t globbuf;
     int ret = glob(DEV_GLOB, GLOB_MARK, nullptr, &globbuf);
@@ -49,40 +58,42 @@
         return 1;
     }
 
-    if (globbuf.gl_pathc > 1) {
-        PLOG(WARNING) << "Multiple watchdog dev path found by " << DEV_GLOB;
-    }
+    std::vector<android::base::unique_fd> wdt_dev_fds;
 
-    std::string dev_path = StringPrintf("/dev/%s", Basename(globbuf.gl_pathv[0]).c_str());
-    globfree(&globbuf);
+    for (size_t i = 0; i < globbuf.gl_pathc; i++) {
+        std::chrono::seconds timeout = interval + margin;
+        int timeout_secs = timeout.count();
+        std::string dev_path = StringPrintf("/dev/%s", Basename(globbuf.gl_pathv[i]).c_str());
 
-    int fd = open(dev_path.c_str(), O_RDWR | O_CLOEXEC);
-    if (fd == -1) {
-        PLOG(ERROR) << "Failed to open " << dev_path;
-        return 1;
-    }
+        int fd = TEMP_FAILURE_RETRY(open(dev_path.c_str(), O_RDWR | O_CLOEXEC));
+        if (fd == -1) {
+            PLOG(ERROR) << "Failed to open " << dev_path;
+            return 1;
+        }
 
-    int timeout = interval + margin;
-    ret = ioctl(fd, WDIOC_SETTIMEOUT, &timeout);
-    if (ret) {
-        PLOG(ERROR) << "Failed to set timeout to " << timeout;
-        ret = ioctl(fd, WDIOC_GETTIMEOUT, &timeout);
+        wdt_dev_fds.emplace_back(fd);
+        ret = ioctl(fd, WDIOC_SETTIMEOUT, &timeout_secs);
         if (ret) {
-            PLOG(ERROR) << "Failed to get timeout";
-        } else {
-            if (timeout > margin) {
-                interval = timeout - margin;
+            PLOG(ERROR) << "Failed to set timeout to " << timeout_secs;
+            ret = ioctl(fd, WDIOC_GETTIMEOUT, &timeout_secs);
+            if (ret) {
+                PLOG(ERROR) << "Failed to get timeout";
             } else {
-                interval = 1;
+                interval = timeout > margin ? timeout - margin : 1s;
+                LOG(WARNING) << "Adjusted interval to timeout returned by driver: "
+                             << "timeout " << timeout_secs
+                             << ", interval " << interval.count()
+                             << ", margin " << margin.count();
             }
-            LOG(WARNING) << "Adjusted interval to timeout returned by driver: "
-                         << "timeout " << timeout << ", interval " << interval << ", margin "
-                         << margin;
         }
     }
 
+    globfree(&globbuf);
+
     while (true) {
-        write(fd, "", 1);
-        sleep(interval);
+        for (const auto& fd : wdt_dev_fds) {
+            TEMP_FAILURE_RETRY(write(fd, "", 1));
+        }
+        sleep(interval.count());
     }
 }
diff --git a/gxp/dump_gxp.cpp b/gxp/dump_gxp.cpp
index 518a44a..5d9f28a 100644
--- a/gxp/dump_gxp.cpp
+++ b/gxp/dump_gxp.cpp
@@ -17,7 +17,7 @@
 #include <android-base/properties.h>
 #include <android-base/file.h>
 
-#define maxGxpDebugDumps 3
+#define maxGxpDebugDumps 4
 
 int main() {
     /* TODO(b/277094681): Set default value to false around device beta milestone. */
diff --git a/gxp/sepolicy/appdomain.te b/gxp/sepolicy/appdomain.te
new file mode 100644
index 0000000..ada9421
--- /dev/null
+++ b/gxp/sepolicy/appdomain.te
@@ -0,0 +1,2 @@
+# Allow apps to read gxp properties
+get_prop(appdomain, vendor_gxp_prop)
diff --git a/gxp/sepolicy/edgetpu_app_service.te b/gxp/sepolicy/edgetpu_app_service.te
new file mode 100644
index 0000000..780823f
--- /dev/null
+++ b/gxp/sepolicy/edgetpu_app_service.te
@@ -0,0 +1,6 @@
+# Allow Edgetpu App Service to access the GXP device and read GXP properties.
+allow edgetpu_app_server gxp_device:chr_file rw_file_perms;
+get_prop(edgetpu_app_server, vendor_gxp_prop)
+
+# Allows Edgetpu App Service to search for GXP firmware file.
+allow edgetpu_app_server vendor_fw_file:dir search;
diff --git a/gxp/sepolicy/edgetpu_tachyon_service.te b/gxp/sepolicy/edgetpu_tachyon_service.te
new file mode 100644
index 0000000..35987dd
--- /dev/null
+++ b/gxp/sepolicy/edgetpu_tachyon_service.te
@@ -0,0 +1,3 @@
+# Allow Tachyon service to access the GXP device and read GXP properties.
+allow edgetpu_tachyon_server gxp_device:chr_file rw_file_perms;
+get_prop(edgetpu_tachyon_server, vendor_gxp_prop)
diff --git a/gxp/sepolicy/priv_app.te b/gxp/sepolicy/priv_app.te
new file mode 100644
index 0000000..8afc24d
--- /dev/null
+++ b/gxp/sepolicy/priv_app.te
@@ -0,0 +1,3 @@
+# Allows privileged applications to access the GXP device, except open,
+# which is guarded by the EdgeTPU service.
+allow priv_app gxp_device:chr_file { getattr read write ioctl map };
diff --git a/gxp/sepolicy/untrusted_app_all.te b/gxp/sepolicy/untrusted_app_all.te
new file mode 100644
index 0000000..456dfee
--- /dev/null
+++ b/gxp/sepolicy/untrusted_app_all.te
@@ -0,0 +1,3 @@
+# Allows applications to access the GXP device, except open,
+# which is guarded by the EdgeTPU service.
+allow untrusted_app_all gxp_device:chr_file { getattr read write ioctl map };
diff --git a/gyotaku_app/dump/Android.bp b/gyotaku_app/dump/Android.bp
new file mode 100644
index 0000000..0f62d0a
--- /dev/null
+++ b/gyotaku_app/dump/Android.bp
@@ -0,0 +1,20 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "dump_gyotaku",
+    srcs: ["dump_gyotaku.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+        "liblog",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
diff --git a/gyotaku_app/dump/dump_gyotaku.cpp b/gyotaku_app/dump/dump_gyotaku.cpp
new file mode 100644
index 0000000..0f22e68
--- /dev/null
+++ b/gyotaku_app/dump/dump_gyotaku.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <unistd.h>
+#include <dump/pixel_dump.h>
+#include <android-base/file.h>
+
+#define GYOTAKU_DIRECTORY "/data/vendor/gyotaku/andlog"
+#define GYOTAKU_ANDROID_LOG_PREFIX "android_"
+#define GYOTAKU_ODPM_LOG_PREFIX "odpm_"
+#define maxFileLogsNumber 30
+
+int main() {
+    std::string outputDir = concatenatePath(BUGREPORT_PACKING_DIR, "gyotaku");
+    if (mkdir(outputDir.c_str(), 0700) == -1) {
+        printf("Unable to create folder: %s\n", outputDir.c_str());
+        return 0;
+    }
+
+    dumpLogs(GYOTAKU_DIRECTORY, outputDir.c_str(), maxFileLogsNumber, GYOTAKU_ANDROID_LOG_PREFIX);
+    dumpLogs(GYOTAKU_DIRECTORY, outputDir.c_str(), maxFileLogsNumber, GYOTAKU_ODPM_LOG_PREFIX);
+    return 0;
+}
+
diff --git a/gyotaku_app/dump/dump_gyotaku.te b/gyotaku_app/dump/dump_gyotaku.te
new file mode 100644
index 0000000..8c1727f
--- /dev/null
+++ b/gyotaku_app/dump/dump_gyotaku.te
@@ -0,0 +1,11 @@
+pixel_bugreport(dump_gyotaku)
+
+userdebug_or_eng(`
+  # For access and collecting logs into vendor radio type folder.
+  allow dump_gyotaku radio_vendor_data_file:dir create_dir_perms;
+  allow dump_gyotaku radio_vendor_data_file:file create_file_perms;
+
+  # For access /data/vendor/ folder.
+  allow dump_gyotaku gyotaku_vendor_data_file:dir create_dir_perms;
+  allow dump_gyotaku gyotaku_vendor_data_file:file create_file_perms;
+')
diff --git a/gyotaku_app/dump/file.te b/gyotaku_app/dump/file.te
new file mode 100644
index 0000000..8035955
--- /dev/null
+++ b/gyotaku_app/dump/file.te
@@ -0,0 +1,5 @@
+# For /data/vendor use
+type gyotaku_vendor_data_file, file_type, data_file_type;
+userdebug_or_eng(`
+    typeattribute gyotaku_vendor_data_file mlstrustedobject;
+')
diff --git a/gyotaku_app/dump/file_contexts b/gyotaku_app/dump/file_contexts
new file mode 100644
index 0000000..3a16a00
--- /dev/null
+++ b/gyotaku_app/dump/file_contexts
@@ -0,0 +1,4 @@
+/data/vendor/gyotaku(/.*)?                u:object_r:gyotaku_vendor_data_file:s0
+
+# Pixel dump for Gyotaku
+/vendor/bin/dump/dump_gyotaku           u:object_r:dump_gyotaku_exec:s0
diff --git a/gyotaku_app/dump/gyotaku_app.te b/gyotaku_app/dump/gyotaku_app.te
new file mode 100644
index 0000000..6816080
--- /dev/null
+++ b/gyotaku_app/dump/gyotaku_app.te
@@ -0,0 +1,5 @@
+userdebug_or_eng(`
+  # For access /data/vendor/gyotaku folder
+  allow gyotaku_app gyotaku_vendor_data_file:dir create_dir_perms;
+  allow gyotaku_app gyotaku_vendor_data_file:file create_file_perms;
+')
diff --git a/gyotaku_app/fingerprint/gyotaku_app.te b/gyotaku_app/fingerprint/gyotaku_app.te
new file mode 100644
index 0000000..f6475f5
--- /dev/null
+++ b/gyotaku_app/fingerprint/gyotaku_app.te
@@ -0,0 +1,19 @@
+# Specific build for fingerprint
+type gyotaku_app, domain;
+
+app_domain(gyotaku_app)
+net_domain(gyotaku_app)
+
+# For Gyotaku app common use
+allow gyotaku_app app_api_service:service_manager find;
+allow gyotaku_app privapp_data_file:lnk_file read;
+allow gyotaku_app system_app_data_file:dir create_dir_perms;
+allow gyotaku_app system_app_data_file:file create_file_perms;
+
+# For getproperty isDebuggable use
+get_prop(gyotaku_app, userdebug_or_eng_prop)
+
+# For access /data/vendor/misc fingerprint use.
+allow gyotaku_app vendor_misc_data_file:dir search;
+allow gyotaku_app vendor_fingerprint_data_file:dir r_dir_perms;
+allow gyotaku_app vendor_fingerprint_data_file:file r_file_perms;
diff --git a/gyotaku_app/fingerprint/seapp_contexts b/gyotaku_app/fingerprint/seapp_contexts
new file mode 100644
index 0000000..b1c6248
--- /dev/null
+++ b/gyotaku_app/fingerprint/seapp_contexts
@@ -0,0 +1,2 @@
+# Gyotaku app
+user=system seinfo=platform name=com.google.android.apps.internal.gyotaku domain=gyotaku_app type=system_app_data_file levelFrom=all
diff --git a/gyotaku_app/gyotaku.mk b/gyotaku_app/gyotaku.mk
index fa58556..8a6bb10 100644
--- a/gyotaku_app/gyotaku.mk
+++ b/gyotaku_app/gyotaku.mk
@@ -4,5 +4,11 @@
       Gyotaku
 
       BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/sepolicy/
+
+      # Pixel 5a (barbet) does not support Pixel dump
+      ifeq (,$(filter barbet%,$(TARGET_PRODUCT)))
+        PRODUCT_PACKAGES_DEBUG += dump_gyotaku
+        BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/dump
+      endif
   endif
 endif
diff --git a/gyotaku_app/gyotaku_fingerprint.mk b/gyotaku_app/gyotaku_fingerprint.mk
new file mode 100644
index 0000000..051b88e
--- /dev/null
+++ b/gyotaku_app/gyotaku_fingerprint.mk
@@ -0,0 +1,5 @@
+# Specific build for fingerprint
+PRODUCT_PACKAGES_DEBUG += \
+   Gyotaku
+
+BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/fingerprint
diff --git a/insmod/16k/Android.bp b/insmod/16k/Android.bp
new file mode 100644
index 0000000..975c5dc
--- /dev/null
+++ b/insmod/16k/Android.bp
@@ -0,0 +1,14 @@
+
+soong_namespace {
+}
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+sh_binary {
+    name: "insmod.sh",
+    src: "insmod.sh",
+    init_rc: ["init.module.rc"],
+    vendor: true,
+}
diff --git a/insmod/init.module.rc b/insmod/16k/init.module.rc
similarity index 100%
copy from insmod/init.module.rc
copy to insmod/16k/init.module.rc
diff --git a/insmod/insmod.sh b/insmod/16k/insmod.sh
old mode 100755
new mode 100644
similarity index 68%
copy from insmod/insmod.sh
copy to insmod/16k/insmod.sh
index 03843f5..8ec8199
--- a/insmod/insmod.sh
+++ b/insmod/16k/insmod.sh
@@ -11,6 +11,23 @@
 system_modules_dir=
 vendor_modules_dir=
 
+
+pagesize=$(getconf PAGESIZE)
+# bootoption=$(getprop ro.product.build.16k_page.enabled)
+# We do not need to check ro.product.build.16k_page.enabled , because this
+# version of insmod.sh will only be used if PRODUCT_16K_DEVELOPER_OPTION
+# is set to true
+
+if [ "$pagesize" != "4096" ] ; then
+    echo "Device has page size $pagesize , skip loading modules from vendor_dlkm/system_dlkm because all modules are stored on vendor_boot"
+    setprop vendor.common.modules.ready 1
+    setprop vendor.device.modules.ready 1
+    setprop vendor.all.modules.ready 1
+    setprop vendor.all.devices.ready 1
+    return 0
+fi
+
+
 for dir in system vendor; do
   for f in /${dir}/lib/modules/*/modules.dep /${dir}/lib/modules/modules.dep; do
     if [[ -f "$f" ]]; then
@@ -52,10 +69,10 @@
 else
   # Set property even if there is no insmod config
   # to unblock early-boot trigger
-  setprop vendor.common.modules.ready
-  setprop vendor.device.modules.ready
-  setprop vendor.all.modules.ready
-  setprop vendor.all.devices.ready
+  setprop vendor.common.modules.ready 1
+  setprop vendor.device.modules.ready 1
+  setprop vendor.all.modules.ready 1
+  setprop vendor.all.devices.ready 1
   exit 1
 fi
 
@@ -66,6 +83,17 @@
       "insmod") insmod $arg ;;
       "setprop") setprop $arg 1 ;;
       "enable") echo 1 > $arg ;;
+      "condinsmod")
+        prop=$(echo $arg | cut -d '|' -f 1)
+        module1=$(echo $arg | cut -d '|' -f 2)
+        module2=$(echo $arg | cut -d '|' -f 3)
+        value=$(getprop $prop)
+        if [[ ${value} == "true" ]]; then
+          insmod ${vendor_modules_dir}/${module1}
+        else
+          insmod ${vendor_modules_dir}/${module2}
+        fi
+        ;;
       "modprobe")
         case ${arg} in
           "system -b *" | "system -b")
diff --git a/insmod/4k/Android.bp b/insmod/4k/Android.bp
new file mode 100644
index 0000000..ddfec40
--- /dev/null
+++ b/insmod/4k/Android.bp
@@ -0,0 +1,13 @@
+
+soong_namespace {
+}
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+sh_binary {
+    name: "insmod.sh",
+    src: "insmod.sh",
+    init_rc: ["init.module.rc"],
+    vendor: true,
+}
diff --git a/insmod/init.module.rc b/insmod/4k/init.module.rc
similarity index 100%
rename from insmod/init.module.rc
rename to insmod/4k/init.module.rc
diff --git a/insmod/insmod.sh b/insmod/4k/insmod.sh
similarity index 87%
rename from insmod/insmod.sh
rename to insmod/4k/insmod.sh
index 03843f5..8cac37e 100755
--- a/insmod/insmod.sh
+++ b/insmod/4k/insmod.sh
@@ -66,6 +66,17 @@
       "insmod") insmod $arg ;;
       "setprop") setprop $arg 1 ;;
       "enable") echo 1 > $arg ;;
+      "condinsmod")
+        prop=$(echo $arg | cut -d '|' -f 1)
+        module1=$(echo $arg | cut -d '|' -f 2)
+        module2=$(echo $arg | cut -d '|' -f 3)
+        value=$(getprop $prop)
+        if [[ ${value} == "true" ]]; then
+          insmod ${vendor_modules_dir}/${module1}
+        else
+          insmod ${vendor_modules_dir}/${module2}
+        fi
+        ;;
       "modprobe")
         case ${arg} in
           "system -b *" | "system -b")
diff --git a/insmod/Android.bp b/insmod/Android.bp
index eed35ec..143e777 100644
--- a/insmod/Android.bp
+++ b/insmod/Android.bp
@@ -2,13 +2,6 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-sh_binary {
-    name: "insmod.sh",
-    src: "insmod.sh",
-    init_rc: ["init.module.rc"],
-    vendor: true,
-}
-
 prebuilt_etc {
     name: "init.common.cfg",
     src: "init.common.cfg",
diff --git a/insmod/insmod.mk b/insmod/insmod.mk
index aa2261a..0d8da9e 100644
--- a/insmod/insmod.mk
+++ b/insmod/insmod.mk
@@ -1,3 +1,9 @@
+ifeq (true,$(PRODUCT_16K_DEVELOPER_OPTION))
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/insmod/16k
+else
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/insmod/4k
+endif
+
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/insmod/sepolicy
 PRODUCT_PACKAGES += \
         insmod.sh \
diff --git a/mediacodec/common/sepolicy/service.te b/mediacodec/common/sepolicy/service.te
new file mode 100644
index 0000000..3f0130b
--- /dev/null
+++ b/mediacodec/common/sepolicy/service.te
@@ -0,0 +1 @@
+type eco_service, service_manager_type;
diff --git a/mediacodec/common/sepolicy/vndservice_contexts b/mediacodec/common/sepolicy/service_contexts
similarity index 100%
rename from mediacodec/common/sepolicy/vndservice_contexts
rename to mediacodec/common/sepolicy/service_contexts
diff --git a/mediacodec/common/sepolicy/vndservice.te b/mediacodec/common/sepolicy/vndservice.te
deleted file mode 100644
index 0784fe3..0000000
--- a/mediacodec/common/sepolicy/vndservice.te
+++ /dev/null
@@ -1 +0,0 @@
-type eco_service, vndservice_manager_type;
diff --git a/mediacodec/samsung/sepolicy/mediacodec_samsung.te b/mediacodec/samsung/sepolicy/mediacodec_samsung.te
index b5bd996..8d5c52c 100644
--- a/mediacodec/samsung/sepolicy/mediacodec_samsung.te
+++ b/mediacodec/samsung/sepolicy/mediacodec_samsung.te
@@ -5,6 +5,7 @@
 hal_server_domain(mediacodec_samsung, hal_codec2)
 add_service(mediacodec_samsung, eco_service)
 
+binder_use(mediacodec_samsung)
 vndbinder_use(mediacodec_samsung)
 
 allow mediacodec_samsung video_device:chr_file rw_file_perms;
diff --git a/modem/Android.bp b/modem/Android.bp
deleted file mode 100644
index dbc1cac..0000000
--- a/modem/Android.bp
+++ /dev/null
@@ -1,44 +0,0 @@
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-sh_binary {
-    name: "dump_modem.sh",
-    src: "dump_modem.sh",
-    vendor: true,
-    sub_dir: "dump",
-}
-
-cc_defaults {
-    name: "dump_modemlog_defaults",
-    srcs: ["modem_log_dumper.cpp"],
-    local_include_dirs: ["include"],
-    shared_libs: ["liblog"],
-}
-
-cc_binary {
-    name: "dump_modemlog",
-    srcs: ["dump_modemlog.cpp"],
-    cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
-    ],
-    shared_libs: [
-        "libbase",
-        "libdump",
-        "liblog",
-    ],
-    defaults: ["dump_modemlog_defaults"],
-    vendor: true,
-    relative_install_path: "dump",
-}
-
-cc_test {
-    name: "dump_modemlog_test",
-    srcs: ["test/*.cpp"],
-    defaults: ["dump_modemlog_defaults"],
-    local_include_dirs: ["test/include"],
-    static_libs: ["libgmock"],
-    vendor: true,
-}
diff --git a/modem/OWNERS b/modem/OWNERS
new file mode 100644
index 0000000..4b70b88
--- /dev/null
+++ b/modem/OWNERS
@@ -0,0 +1,3 @@
+# Give ownership of code files to Apps and Services team.
+# SEPolicy files are intentionally ignored since they should be reviewed by the SEPolicy team.
+per-file *.bp,*.cpp,*.h,*.sh=kierancyphus@google.com,everrosales@google.com,nicoleytlee@google.com,alanblc@google.com
diff --git a/modem/android_property_manager/Android.bp b/modem/android_property_manager/Android.bp
new file mode 100644
index 0000000..af89aec
--- /dev/null
+++ b/modem/android_property_manager/Android.bp
@@ -0,0 +1,9 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "modem_android_property_manager",
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
diff --git a/modem/android_property_manager/fake/Android.bp b/modem/android_property_manager/fake/Android.bp
new file mode 100644
index 0000000..247b97c
--- /dev/null
+++ b/modem/android_property_manager/fake/Android.bp
@@ -0,0 +1,23 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+// When `modem_android_property_manager_fake` is included statically, its
+// dependencies are not transitively included, so the target will also have to
+// include this default to restate them.
+cc_defaults {
+    name: "modem_android_property_manager_fake_defaults",
+    static_libs: [
+        "modem_android_property_manager",
+        "libbase",
+        "modem_log_constants",
+    ],
+}
+
+cc_library_static {
+    name: "modem_android_property_manager_fake",
+    export_include_dirs: [ "include" ],
+    srcs: [ "fake_android_property_manager.cpp" ],
+    defaults: [ "modem_android_property_manager_fake_defaults" ],
+    vendor_available: true,
+}
diff --git a/modem/android_property_manager/fake/fake_android_property_manager.cpp b/modem/android_property_manager/fake/fake_android_property_manager.cpp
new file mode 100644
index 0000000..d25d6da
--- /dev/null
+++ b/modem/android_property_manager/fake/fake_android_property_manager.cpp
@@ -0,0 +1,80 @@
+#include "fake_android_property_manager.h"
+
+#include <android-base/parseint.h>
+#include <android-base/result.h>
+
+#include <cerrno>
+#include <map>
+#include <string>
+
+#include "modem_log_constants.h"
+
+namespace pixel_modem {
+
+bool FakeAndroidPropertyManager::GetBoolProperty(const std::string& key,
+                                                 bool default_value) {
+  auto value_result = GetProperty(key);
+  return value_result.ok() ? (*value_result) == kTruthString : default_value;
+}
+
+std::string FakeAndroidPropertyManager::GetProperty(
+    const std::string& key, const std::string& default_value) {
+  auto value_result = GetProperty(key);
+  return value_result.ok() ? *value_result : default_value;
+}
+
+int FakeAndroidPropertyManager::GetIntProperty(const std::string& key,
+                                               int default_value) {
+  int value = default_value;
+
+  auto property_result = GetProperty(key);
+  if (property_result.ok()) {
+    android::base::ParseInt<int>((*property_result).data(), &value);
+  }
+  return value;
+}
+
+/**
+ * This function needs to copy the behaviour of `modem_logging_control` to
+ * ensure that the right properties are being set in order.
+ *
+ * More specifically, this function will also set the
+ * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
+ * set to simulate modem logging stopping / starting.
+ */
+bool FakeAndroidPropertyManager::SetProperty(const std::string& key,
+                                             const std::string& value) {
+  if (key == logging::kModemLoggingEnabledProperty) {
+    property_map_[logging::kModemLoggingStatusProperty.data()] = value;
+
+    // need to track if modem logging has restarted or not
+    if (value == kFalseString) {
+      modem_logging_has_been_off_ = true;
+    }
+    if (modem_logging_has_been_off_ && (value == kTruthString)) {
+      modem_logging_has_restarted_ = true;
+    }
+  }
+  property_map_[key] = value;
+  return true;
+}
+
+/**
+ * @brief Gets android system property if present.
+ *
+ * @param[in] key Name of property.
+ *
+ * @return Status of get operation and value if successful.
+ * @retval EINVAL Key not present in map.
+ */
+android::base::Result<std::string> FakeAndroidPropertyManager::GetProperty(
+    const std::string& key) {
+  const auto it = property_map_.find(key);
+  if (it == property_map_.end()) {
+    return android::base::Error()
+           << "Property: " << key << " not found." << EINVAL;
+  }
+  return it->second;
+}
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/fake/include/fake_android_property_manager.h b/modem/android_property_manager/fake/include/fake_android_property_manager.h
new file mode 100644
index 0000000..eeea5a0
--- /dev/null
+++ b/modem/android_property_manager/fake/include/fake_android_property_manager.h
@@ -0,0 +1,54 @@
+#pragma once
+
+#include <map>
+#include <string>
+
+#include "android-base/result.h"
+#include "android_property_manager.h"
+
+namespace pixel_modem {
+
+/**
+ * @brief Fake Implementation of AndroidPropertyManager that mocks some of the
+ * property changing behaviour from pixellogger's `modem_logging_control`.
+ */
+class FakeAndroidPropertyManager : public AndroidPropertyManager {
+ public:
+  bool GetBoolProperty(const std::string& key, bool default_value) override;
+
+  std::string GetProperty(const std::string& key,
+                          const std::string& default_value) override;
+
+  int GetIntProperty(const std::string& key, int default_value) override;
+
+  /**
+   * This function needs to copy the behaviour of `modem_logging_control` to
+   * ensure that the right properties are being set in order.
+   *
+   * More specifically, this function will also set the
+   * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
+   * set to simulate modem logging stopping / starting.
+   */
+  bool SetProperty(const std::string& key, const std::string& value) override;
+
+  inline bool ModemLoggingHasRestarted() {
+    return modem_logging_has_restarted_;
+  }
+
+ private:
+  /**
+   * @brief Gets android system property if present.
+   *
+   * @param[in] key Name of property.
+   *
+   * @return Status of get operation and value if successful.
+   * @retval EINVAL Key not present in map.
+   */
+  android::base::Result<std::string> GetProperty(const std::string& key);
+
+  std::map<std::string, std::string> property_map_;
+  bool modem_logging_has_been_off_ = false;
+  bool modem_logging_has_restarted_ = false;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/impl/Android.bp b/modem/android_property_manager/impl/Android.bp
new file mode 100644
index 0000000..2023e8f
--- /dev/null
+++ b/modem/android_property_manager/impl/Android.bp
@@ -0,0 +1,18 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+modem_android_property_manager_impl_public_deps = [
+    "modem_android_property_manager",
+]
+
+cc_library_shared {
+    name: "modem_android_property_manager_impl",
+    export_include_dirs: [ "include" ],
+    srcs: [ "android_property_manager_impl.cpp" ],
+    shared_libs: modem_android_property_manager_impl_public_deps + [
+        "libbase",
+    ],
+    export_shared_lib_headers: modem_android_property_manager_impl_public_deps,
+    vendor_available: true,
+}
diff --git a/modem/android_property_manager/impl/android_property_manager_impl.cpp b/modem/android_property_manager/impl/android_property_manager_impl.cpp
new file mode 100644
index 0000000..b6b900a
--- /dev/null
+++ b/modem/android_property_manager/impl/android_property_manager_impl.cpp
@@ -0,0 +1,29 @@
+#include "android_property_manager_impl.h"
+
+#include <android-base/properties.h>
+
+#include <string>
+
+namespace pixel_modem {
+
+bool AndroidPropertyManagerImpl::GetBoolProperty(const std::string& key,
+                                                 bool default_value) {
+  return android::base::GetBoolProperty(key, default_value);
+}
+
+std::string AndroidPropertyManagerImpl::GetProperty(
+    const std::string& key, const std::string& default_value) {
+  return android::base::GetProperty(key, default_value);
+}
+
+int AndroidPropertyManagerImpl::GetIntProperty(const std::string& key,
+                                               int default_value) {
+  return android::base::GetIntProperty(key, default_value);
+}
+
+bool AndroidPropertyManagerImpl::SetProperty(const std::string& key,
+                                             const std::string& value) {
+  return android::base::SetProperty(key, value);
+}
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/impl/include/android_property_manager_impl.h b/modem/android_property_manager/impl/include/android_property_manager_impl.h
new file mode 100644
index 0000000..91cee25
--- /dev/null
+++ b/modem/android_property_manager/impl/include/android_property_manager_impl.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <string>
+
+#include "android_property_manager.h"
+
+namespace pixel_modem {
+
+/**
+ * @brief Implementation of AndroidPropertyManager that directly forwards to
+ * android base methods.
+ */
+class AndroidPropertyManagerImpl : public AndroidPropertyManager {
+ public:
+  bool GetBoolProperty(const std::string& key, bool default_value) override;
+
+  std::string GetProperty(const std::string& key,
+                          const std::string& default_value) override;
+
+  int GetIntProperty(const std::string& key, int default_value) override;
+
+  bool SetProperty(const std::string& key, const std::string& value) override;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/include/android_property_manager.h b/modem/android_property_manager/include/android_property_manager.h
new file mode 100644
index 0000000..e41a28d
--- /dev/null
+++ b/modem/android_property_manager/include/android_property_manager.h
@@ -0,0 +1,27 @@
+
+#pragma once
+
+#include <string>
+#include <string_view>
+
+namespace pixel_modem {
+
+// Used to set boolean parameters to true / false
+inline constexpr std::string_view kTruthString = "true";
+inline constexpr std::string_view kFalseString = "false";
+
+/**
+ * @brief Interface for interacting with Android System Properties.
+ */
+class AndroidPropertyManager {
+ public:
+  virtual ~AndroidPropertyManager() = default;
+  virtual bool GetBoolProperty(const std::string& key, bool default_value) = 0;
+  virtual std::string GetProperty(const std::string& key,
+                                  const std::string& default_value) = 0;
+  virtual int GetIntProperty(const std::string& key, int default_value) = 0;
+  virtual bool SetProperty(const std::string& key,
+                           const std::string& value) = 0;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/Android.bp b/modem/clock_manager/Android.bp
new file mode 100644
index 0000000..98aff6f
--- /dev/null
+++ b/modem/clock_manager/Android.bp
@@ -0,0 +1,9 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "modem_clock_manager",
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
diff --git a/modem/clock_manager/fake/Android.bp b/modem/clock_manager/fake/Android.bp
new file mode 100644
index 0000000..eb16445
--- /dev/null
+++ b/modem/clock_manager/fake/Android.bp
@@ -0,0 +1,15 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_defaults {
+    name: "fake_modem_clock_manager_defaults",
+    shared_libs: [ "modem_clock_manager" ],
+}
+
+cc_library_static {
+    name: "fake_modem_clock_manager",
+    export_include_dirs: [ "include" ],
+    defaults: [ "fake_modem_clock_manager_defaults" ],
+    vendor_available: true,
+}
diff --git a/modem/clock_manager/fake/include/fake_clock_manager.h b/modem/clock_manager/fake/include/fake_clock_manager.h
new file mode 100644
index 0000000..8956777
--- /dev/null
+++ b/modem/clock_manager/fake/include/fake_clock_manager.h
@@ -0,0 +1,21 @@
+#include "clock_manager.h"
+
+namespace pixel_modem {
+
+/**
+ * @brief Fake implementation of clock manager that doesn't actually sleep.
+ *
+ * A lot of vendor code don't have return values and instead force the client
+ * codes to sleep for a specified period of time before checking some system
+ * properties. However, since unit tests don't rely on the real vendor
+ * implementations, these sleeps should be ignored and so a fake clock should be
+ * used.
+ *
+ * Since this definition is unlikely to change, it will be defined in the header
+ * and not an implementation file.
+ */
+struct FakeClockManager : public ClockManager {
+  void Sleep(size_t /*seconds*/) const override{};
+};
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/impl/Android.bp b/modem/clock_manager/impl/Android.bp
new file mode 100644
index 0000000..13f4cc6
--- /dev/null
+++ b/modem/clock_manager/impl/Android.bp
@@ -0,0 +1,16 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+modem_clock_manager_impl_public_deps = [
+    "modem_clock_manager",
+]
+
+cc_library {
+    name: "modem_clock_manager_impl",
+    export_include_dirs: [ "include" ],
+    srcs: [ "clock_manager_impl.cpp" ],
+    shared_libs: modem_clock_manager_impl_public_deps,
+    export_shared_lib_headers: modem_clock_manager_impl_public_deps,
+    vendor_available: true,
+}
diff --git a/modem/clock_manager/impl/clock_manager_impl.cpp b/modem/clock_manager/impl/clock_manager_impl.cpp
new file mode 100644
index 0000000..dc61a63
--- /dev/null
+++ b/modem/clock_manager/impl/clock_manager_impl.cpp
@@ -0,0 +1,9 @@
+#include "clock_manager_impl.h"
+
+#include <unistd.h>
+
+namespace pixel_modem {
+
+void ClockManagerImpl::Sleep(size_t seconds) const { sleep(seconds); }
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/impl/include/clock_manager_impl.h b/modem/clock_manager/impl/include/clock_manager_impl.h
new file mode 100644
index 0000000..d626b98
--- /dev/null
+++ b/modem/clock_manager/impl/include/clock_manager_impl.h
@@ -0,0 +1,13 @@
+#pragma once
+
+#include <cstddef>
+
+#include "clock_manager.h"
+
+namespace pixel_modem {
+
+struct ClockManagerImpl : public ClockManager {
+  void Sleep(size_t seconds) const override;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/include/clock_manager.h b/modem/clock_manager/include/clock_manager.h
new file mode 100644
index 0000000..1db88c5
--- /dev/null
+++ b/modem/clock_manager/include/clock_manager.h
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <cstddef>
+
+namespace pixel_modem {
+
+/**
+ * @brief Interface for time based operations.
+ *
+ * This interface was intentionally not called `Clock`, like the Java side
+ * counterpart since it's likely that clients would call the local variable
+ * `clock(_)`, which would clash with the C defined `clock` method.
+ */
+struct ClockManager {
+  virtual ~ClockManager() = default;
+
+  /**
+   * @brief Sleep the thread for a given number of seconds.
+   *
+   * @param seconds Minimum number of seconds to sleep for. Note, this is
+   * different than the Java android clock which accepts seconds. This was done
+   * because C++ developers are likely more familiar with the `sleep` command,
+   * which accepts seconds.
+   */
+  virtual void Sleep(size_t seconds) const = 0;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/dump_modemlog.cpp b/modem/dump_modemlog.cpp
deleted file mode 100644
index 1b6b2e9..0000000
--- a/modem/dump_modemlog.cpp
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <android-base/properties.h>
-#include <dump/pixel_dump.h>
-
-#include "dumper.h"
-#include "modem_log_dumper.h"
-
-namespace modem {
-namespace logging {
-
-/**
- * @brief Implementation of AndroidPropertyManager that directly forwards to
- * android base methods.
- */
-class AndroidPropertyManagerImpl : public AndroidPropertyManager {
- public:
-  bool GetBoolProperty(const std::string& key, bool default_value) override {
-    return android::base::GetBoolProperty(key, default_value);
-  };
-
-  std::string GetProperty(const std::string& key,
-                          const std::string& default_value) override {
-    return android::base::GetProperty(key, default_value);
-  };
-  int GetIntProperty(const std::string& key, int default_value) override {
-    return android::base::GetIntProperty(key, default_value);
-  };
-  void SetProperty(const std::string& key, const std::string& value) override {
-    android::base::SetProperty(key, value);
-  };
-};
-
-/**
- * @brief Implementation of Dumper that directly forwards to their corresponding
- * dumpstate methods.
- */
-class DumperImpl : public Dumper {
- public:
-  void DumpLogs(const LogDumpInfo& log_dump_info) override {
-    dumpLogs(log_dump_info.src_dir.data(), log_dump_info.dest_dir.data(),
-             log_dump_info.limit, log_dump_info.prefix.data());
-  }
-  void CopyFile(const FileCopyInfo& file_copy_info) override {
-    copyFile(file_copy_info.src_dir.data(), file_copy_info.dest_dir.data());
-  }
-};
-
-}  // namespace logging
-}  // namespace modem
-
-int main() {
-  modem::logging::DumperImpl dumper_impl;
-  modem::logging::AndroidPropertyManagerImpl android_property_manager_impl;
-  modem::logging::ModemLogDumper modem_log_dumper(
-      dumper_impl, android_property_manager_impl);
-
-  modem_log_dumper.DumpModemLogs();
-  return 0;
-}
diff --git a/modem/dump_modemlog/Android.bp b/modem/dump_modemlog/Android.bp
new file mode 100644
index 0000000..aca7b20
--- /dev/null
+++ b/modem/dump_modemlog/Android.bp
@@ -0,0 +1,79 @@
+package {
+    default_applicable_licenses: [ "Android-Apache-2.0" ],
+}
+
+sh_binary {
+    name: "dump_modem.sh",
+    src: "dump_modem.sh",
+    vendor: true,
+    sub_dir: "dump",
+}
+
+// Modem Log Dumper
+
+modem_log_dumper_public_deps = [
+    "modem_android_property_manager",
+]
+
+// When `modem_log_dumper` is included statically, its dependencies are not
+// transitively included, so the target will also have to include this default
+// to restate them.
+cc_defaults {
+    name: "modem_log_dumper_defaults",
+    shared_libs: modem_log_dumper_public_deps + [
+        "libbase",
+        // liblog is not directly used by us, but it's a transitive dependency of libbase
+        "liblog",
+        "modem_log_constants",
+    ],
+}
+
+cc_library {
+    name: "modem_log_dumper",
+    srcs: [ "modem_log_dumper.cpp" ],
+    defaults: [ "modem_log_dumper_defaults" ],
+    export_shared_lib_headers: modem_log_dumper_public_deps,
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
+
+// dump_modemlog
+
+cc_binary {
+    name: "dump_modemlog",
+    srcs: [ "dump_modemlog.cpp" ],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+        "liblog",
+        "modem_android_property_manager_impl",
+        "modem_log_dumper",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
+
+cc_test {
+    name: "dump_modemlog_test",
+    srcs: [ "modem_log_dumper_test.cpp" ],
+    defaults: [
+        "modem_log_dumper_defaults",
+        "modem_android_property_manager_fake_defaults",
+    ],
+    static_libs: [
+        "modem_android_property_manager",
+        "modem_android_property_manager_fake",
+        "modem_log_constants",
+        "modem_log_dumper",
+        "libgmock",
+    ],
+    vendor: true,
+    // Shared libs in vendor folder are guarded by SEPolicy, so tests need root
+    // access to run them.
+    require_root: true,
+}
diff --git a/modem/dump_modem.sh b/modem/dump_modemlog/dump_modem.sh
similarity index 100%
rename from modem/dump_modem.sh
rename to modem/dump_modemlog/dump_modem.sh
diff --git a/modem/dump_modemlog/dump_modemlog.cpp b/modem/dump_modemlog/dump_modemlog.cpp
new file mode 100644
index 0000000..bed936c
--- /dev/null
+++ b/modem/dump_modemlog/dump_modemlog.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <android-base/properties.h>
+#include <dump/pixel_dump.h>
+
+#include "android_property_manager_impl.h"
+#include "dumper.h"
+#include "modem_log_dumper.h"
+
+namespace pixel_modem::logging {
+
+/**
+ * @brief Implementation of Dumper that directly forwards to their corresponding
+ * dumpstate methods.
+ */
+class DumperImpl : public Dumper {
+ public:
+  void DumpLogs(const LogDumpInfo& log_dump_info) override {
+    dumpLogs(log_dump_info.src_dir.data(), log_dump_info.dest_dir.data(),
+             log_dump_info.limit, log_dump_info.prefix.data());
+  }
+  void CopyFile(const FileCopyInfo& file_copy_info) override {
+    copyFile(file_copy_info.src_dir.data(), file_copy_info.dest_dir.data());
+  }
+};
+
+}  // namespace pixel_modem::logging
+
+int main() {
+  pixel_modem::logging::DumperImpl dumper_impl;
+  pixel_modem::AndroidPropertyManagerImpl android_property_manager_impl;
+  pixel_modem::logging::ModemLogDumper modem_log_dumper(
+      dumper_impl, android_property_manager_impl);
+
+  modem_log_dumper.DumpModemLogs();
+  return 0;
+}
diff --git a/modem/dump_modemlog/dump_modemlog.mk b/modem/dump_modemlog/dump_modemlog.mk
new file mode 100644
index 0000000..5e91ab7
--- /dev/null
+++ b/modem/dump_modemlog/dump_modemlog.mk
@@ -0,0 +1,5 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/dump_modemlog/sepolicy
+
+PRODUCT_PACKAGES += dump_modem.sh
+PRODUCT_PACKAGES += dump_modemlog
+
diff --git a/modem/dump_modemlog/include/bugreport_constants.h b/modem/dump_modemlog/include/bugreport_constants.h
new file mode 100644
index 0000000..25c800f
--- /dev/null
+++ b/modem/dump_modemlog/include/bugreport_constants.h
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <string_view>
+
+#include "dumper.h"
+
+namespace pixel_modem::logging {
+
+inline constexpr std::string_view kBugreportPackingDirectory =
+    "/data/vendor/radio/logs/always-on/all_logs";
+
+inline constexpr LogDumpInfo kLogDumpInfo[] = {
+    {.src_dir = "/data/vendor/radio/extended_logs",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 20,
+     .prefix = "extended_log_"},
+    {.src_dir = "/data/vendor/radio/sim/",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 1,
+     .prefix = "sim_poweron_log_"},
+    {.src_dir = "data/vendor/radio/logs/history",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 2,
+     .prefix = "Logging"}};
+
+constexpr FileCopyInfo kFileCopyInfo[] = {
+    {.src_dir = "/mnt/vendor/efs/nv_normal.bin",
+     .dest_dir = "/data/vendor/radio/logs/always-on/all_logs/nv_normal.bin"},
+    {.src_dir = "/mnt/vendor/efs/nv_protected.bin",
+     .dest_dir =
+         "/data/vendor/radio/logs/always-on/all_logs/nv_protected.bin"}};
+
+}  // namespace pixel_modem::logging
diff --git a/modem/include/dumper.h b/modem/dump_modemlog/include/dumper.h
similarity index 95%
rename from modem/include/dumper.h
rename to modem/dump_modemlog/include/dumper.h
index 348e666..a9b96c6 100644
--- a/modem/include/dumper.h
+++ b/modem/dump_modemlog/include/dumper.h
@@ -3,8 +3,7 @@
 #include <ostream>
 #include <string_view>
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 
 /**
  * @brief Data object for information about dumpings logs.
@@ -67,5 +66,5 @@
   virtual void DumpLogs(const LogDumpInfo& log_dump_info);
   virtual void CopyFile(const FileCopyInfo& file_copy_info);
 };
-}  // namespace logging
-}  // namespace modem
+
+}  // namespace pixel_modem::logging
diff --git a/modem/include/modem_log_dumper.h b/modem/dump_modemlog/include/modem_log_dumper.h
similarity index 96%
rename from modem/include/modem_log_dumper.h
rename to modem/dump_modemlog/include/modem_log_dumper.h
index 96911b0..1533217 100644
--- a/modem/include/modem_log_dumper.h
+++ b/modem/dump_modemlog/include/modem_log_dumper.h
@@ -3,8 +3,7 @@
 #include "android_property_manager.h"
 #include "dumper.h"
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 
 /**
  * @brief Responsible for dumping all relevant modem logs.
@@ -77,5 +76,4 @@
   AndroidPropertyManager& android_property_manager_;
 };
 
-}  // namespace logging
-}  // namespace modem
+}  // namespace pixel_modem::logging
diff --git a/modem/modem_log_dumper.cpp b/modem/dump_modemlog/modem_log_dumper.cpp
similarity index 85%
rename from modem/modem_log_dumper.cpp
rename to modem/dump_modemlog/modem_log_dumper.cpp
index fad8d29..127478e 100644
--- a/modem/modem_log_dumper.cpp
+++ b/modem/dump_modemlog/modem_log_dumper.cpp
@@ -2,11 +2,11 @@
 
 #include <log/log.h>
 
+#include "bugreport_constants.h"
 #include "dumper.h"
 #include "modem_log_constants.h"
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 
 void ModemLogDumper::DumpModemLogs() {
   bool shouldRestartModemLogging =
@@ -15,7 +15,11 @@
       kModemLoggingNumberBugreportProperty.data(),
       kDefaultBugreportNumberFiles);
 
-  if (shouldRestartModemLogging) {
+  // Should always trigger `stopModemLogging`. This is because currently copying
+  // modem logs and stopping modem logging are entangled.
+  // TODO: b/289435256 - Always copy logs and return this to checking if logging
+  // is actively running.
+  if (allowedToStopModemLogging()) {
     // If modem logging is running at time of bugreport, it needs to be stopped
     // to ensure that the most recent logs are included in the bugreport. If
     // this command fails, only older log files will be included, as seen in
@@ -76,5 +80,5 @@
   android_property_manager_.SetProperty(kModemLoggingEnabledProperty.data(),
                                         "true");
 }
-}  // namespace logging
-}  // namespace modem
+
+}  // namespace pixel_modem::logging
diff --git a/modem/test/modem_log_dumper_test.cpp b/modem/dump_modemlog/modem_log_dumper_test.cpp
similarity index 90%
rename from modem/test/modem_log_dumper_test.cpp
rename to modem/dump_modemlog/modem_log_dumper_test.cpp
index a052d43..81bec8b 100644
--- a/modem/test/modem_log_dumper_test.cpp
+++ b/modem/dump_modemlog/modem_log_dumper_test.cpp
@@ -2,13 +2,15 @@
 
 #include <string_view>
 
+#include "android_property_manager.h"
+#include "bugreport_constants.h"
 #include "dumper.h"
 #include "fake_android_property_manager.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "modem_log_constants.h"
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 namespace {
 
 using ::testing::Eq;
@@ -23,9 +25,8 @@
 
 void StartModemLogging(
     FakeAndroidPropertyManager& fake_android_property_manager) {
-  fake_android_property_manager.SetProperty(
-      kModemLoggingEnabledProperty.data(),
-      FakeAndroidPropertyManager::kTruthString.data());
+  fake_android_property_manager.SetProperty(kModemLoggingEnabledProperty.data(),
+                                            kTruthString.data());
 }
 
 class MockDumper : public Dumper {
@@ -101,6 +102,6 @@
 
   EXPECT_FALSE(fake_android_property_manager.ModemLoggingHasRestarted());
 }
+
 }  // namespace
-}  // namespace logging
-}  // namespace modem
+}  // namespace pixel_modem::logging
diff --git a/modem/sepolicy/dump_modem.te b/modem/dump_modemlog/sepolicy/dump_modem.te
similarity index 100%
rename from modem/sepolicy/dump_modem.te
rename to modem/dump_modemlog/sepolicy/dump_modem.te
diff --git a/modem/sepolicy/dump_modemlog.te b/modem/dump_modemlog/sepolicy/dump_modemlog.te
similarity index 100%
rename from modem/sepolicy/dump_modemlog.te
rename to modem/dump_modemlog/sepolicy/dump_modemlog.te
diff --git a/modem/sepolicy/file.te b/modem/dump_modemlog/sepolicy/file.te
similarity index 100%
rename from modem/sepolicy/file.te
rename to modem/dump_modemlog/sepolicy/file.te
diff --git a/modem/sepolicy/file_contexts b/modem/dump_modemlog/sepolicy/file_contexts
similarity index 100%
rename from modem/sepolicy/file_contexts
rename to modem/dump_modemlog/sepolicy/file_contexts
diff --git a/modem/sepolicy/genfs_contexts b/modem/dump_modemlog/sepolicy/genfs_contexts
similarity index 100%
rename from modem/sepolicy/genfs_contexts
rename to modem/dump_modemlog/sepolicy/genfs_contexts
diff --git a/modem/include/android_property_manager.h b/modem/include/android_property_manager.h
deleted file mode 100644
index 7135d66..0000000
--- a/modem/include/android_property_manager.h
+++ /dev/null
@@ -1,21 +0,0 @@
-#pragma once
-
-#include <string>
-
-namespace modem {
-namespace logging {
-
-/**
- * @brief Interface for interacting with Android System Properties.
- */
-class AndroidPropertyManager {
- public:
-  virtual ~AndroidPropertyManager() = default;
-  virtual bool GetBoolProperty(const std::string& key, bool default_value);
-  virtual std::string GetProperty(const std::string& key,
-                                  const std::string& default_value);
-  virtual int GetIntProperty(const std::string& key, int default_value);
-  virtual void SetProperty(const std::string& key, const std::string& value);
-};
-}  // namespace logging
-}  // namespace modem
diff --git a/modem/include/modem_log_constants.h b/modem/include/modem_log_constants.h
deleted file mode 100644
index 29a0fa8..0000000
--- a/modem/include/modem_log_constants.h
+++ /dev/null
@@ -1,56 +0,0 @@
-#pragma once
-#include <string>
-
-#include "dumper.h"
-
-namespace modem {
-namespace logging {
-
-// Modem related Android System Properties
-
-// Controls triggering `modem_logging_start` and `modem_logging_stop`.
-inline constexpr static std::string_view kModemLoggingEnabledProperty =
-    "vendor.sys.modem.logging.enable";
-// Signals the current modem logging state. This will be set to
-// `vendor.sys.modem.logging.enable` when `modem_log_start` or `modem_log_stop`
-// terminates.
-inline constexpr static std::string_view kModemLoggingStatusProperty =
-    "vendor.sys.modem.logging.status";
-// Int which specifies how many files to include in the bugreport.
-inline constexpr static std::string_view kModemLoggingNumberBugreportProperty =
-    "persist.vendor.sys.modem.logging.br_num";
-// Signals the current location that is being logged to. This can be used to
-// determine the logging type.
-inline constexpr static std::string_view kModemLoggingPathProperty =
-    "vendor.sys.modem.logging.log_path";
-
-// Bugreport constants
-inline constexpr static int kDefaultBugreportNumberFiles = 100;
-inline constexpr static std::string_view kModemAlwaysOnLogDirectory =
-    "/data/vendor/radio/logs/always-on";
-inline constexpr static std::string_view kModemLogPrefix = "sbuff_";
-inline constexpr static std::string_view kBugreportPackingDirectory =
-    "/data/vendor/radio/logs/always-on/all_logs";
-
-inline constexpr static LogDumpInfo kLogDumpInfo[] = {
-    {.src_dir = "/data/vendor/radio/extended_logs",
-     .dest_dir = kBugreportPackingDirectory,
-     .limit = 20,
-     .prefix = "extended_log_"},
-    {.src_dir = "/data/vendor/radio/sim/",
-     .dest_dir = kBugreportPackingDirectory,
-     .limit = 1,
-     .prefix = "sim_poweron_log_"},
-    {.src_dir = "data/vendor/radio/logs/history",
-     .dest_dir = kBugreportPackingDirectory,
-     .limit = 2,
-     .prefix = "Logging"}};
-
-constexpr static FileCopyInfo kFileCopyInfo[] = {
-    {.src_dir = "/mnt/vendor/efs/nv_normal.bin",
-     .dest_dir = "/data/vendor/radio/logs/always-on/all_logs/nv_normal.bin"},
-    {.src_dir = "/mnt/vendor/efs/nv_protected.bin",
-     .dest_dir =
-         "/data/vendor/radio/logs/always-on/all_logs/nv_protected.bin"}};
-}  // namespace logging
-}  // namespace modem
diff --git a/modem/modem.mk b/modem/modem.mk
index 10df7d4..d921e74 100644
--- a/modem/modem.mk
+++ b/modem/modem.mk
@@ -1,5 +1 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/sepolicy
-
-PRODUCT_PACKAGES += dump_modem.sh
-PRODUCT_PACKAGES += dump_modemlog
-
+include device/google/gs-common/modem/dump_modemlog/dump_modemlog.mk
diff --git a/modem/modem_log_constants/Android.bp b/modem/modem_log_constants/Android.bp
new file mode 100644
index 0000000..f4e3177
--- /dev/null
+++ b/modem/modem_log_constants/Android.bp
@@ -0,0 +1,9 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "modem_log_constants",
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
diff --git a/modem/modem_log_constants/include/modem_log_constants.h b/modem/modem_log_constants/include/modem_log_constants.h
new file mode 100644
index 0000000..68004cf
--- /dev/null
+++ b/modem/modem_log_constants/include/modem_log_constants.h
@@ -0,0 +1,35 @@
+#pragma once
+
+#include <string_view>
+
+namespace pixel_modem::logging {
+
+// Modem related Android System Properties
+
+// Controls triggering `modem_logging_start` and `modem_logging_stop`.
+inline constexpr std::string_view kModemLoggingEnabledProperty =
+    "vendor.sys.modem.logging.enable";
+// Signals the current modem logging state. This will be set to
+// `vendor.sys.modem.logging.enable` when `modem_log_start` or `modem_log_stop`
+// terminates.
+inline constexpr std::string_view kModemLoggingStatusProperty =
+    "vendor.sys.modem.logging.status";
+// Int which specifies how many files to include in the bugreport.
+inline constexpr std::string_view kModemLoggingNumberBugreportProperty =
+    "persist.vendor.sys.modem.logging.br_num";
+// Signals the current location that is being logged to. This can be used to
+// determine the logging type.
+inline constexpr std::string_view kModemLoggingPathProperty =
+    "vendor.sys.modem.logging.log_path";
+inline constexpr std::string_view kModemLoggingLogCountProperty =
+    "vendor.sys.modem.logging.log_count";
+inline constexpr std::string_view kModemLoggingLogPath =
+    "vendor.sys.modem.logging.log_path";
+
+// Bugreport constants
+inline constexpr int kDefaultBugreportNumberFiles = 100;
+inline constexpr std::string_view kModemAlwaysOnLogDirectory =
+    "/data/vendor/radio/logs/always-on";
+inline constexpr std::string_view kModemLogPrefix = "sbuff_";
+
+}  // namespace pixel_modem::logging
diff --git a/modem/shared_modem_platform/compatibility_matrix.xml b/modem/shared_modem_platform/compatibility_matrix.xml
new file mode 100644
index 0000000..5019c3e
--- /dev/null
+++ b/modem/shared_modem_platform/compatibility_matrix.xml
@@ -0,0 +1,11 @@
+<compatibility-matrix version="1.0" type="framework">
+    <!-- Optional since older devices will not register any services. -->
+    <hal format="aidl" optional="true">
+        <name>com.google.pixel.shared_modem_platform</name>
+        <version>1</version>
+        <interface>
+            <name>ISharedModemPlatform</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/modem/shared_modem_platform/sepolicy/attributes b/modem/shared_modem_platform/sepolicy/attributes
new file mode 100644
index 0000000..2cc802d
--- /dev/null
+++ b/modem/shared_modem_platform/sepolicy/attributes
@@ -0,0 +1 @@
+hal_attribute(shared_modem_platform)
diff --git a/modem/shared_modem_platform/sepolicy/hal_shared_modem_platform.te b/modem/shared_modem_platform/sepolicy/hal_shared_modem_platform.te
new file mode 100644
index 0000000..8771563
--- /dev/null
+++ b/modem/shared_modem_platform/sepolicy/hal_shared_modem_platform.te
@@ -0,0 +1,8 @@
+# Allow binder connection from client to server
+binder_call(hal_shared_modem_platform_client, hal_shared_modem_platform_server)
+
+# Allow client to find the service, server to register the service
+hal_attribute_service(hal_shared_modem_platform, hal_shared_modem_platform_service)
+
+# Allow binder communication from server to service_manager
+binder_use(hal_shared_modem_platform_server)
diff --git a/modem/shared_modem_platform/sepolicy/service.te b/modem/shared_modem_platform/sepolicy/service.te
new file mode 100644
index 0000000..390fde6
--- /dev/null
+++ b/modem/shared_modem_platform/sepolicy/service.te
@@ -0,0 +1 @@
+type hal_shared_modem_platform_service, hal_service_type, service_manager_type;
diff --git a/modem/shared_modem_platform/sepolicy/service_contexts b/modem/shared_modem_platform/sepolicy/service_contexts
new file mode 100644
index 0000000..58232f7
--- /dev/null
+++ b/modem/shared_modem_platform/sepolicy/service_contexts
@@ -0,0 +1,2 @@
+# Bind Shared Modem Platform AIDL service name to the SELinux type.
+com.google.pixel.shared_modem_platform.ISharedModemPlatform/default u:object_r:hal_shared_modem_platform_service:s0
diff --git a/modem/shared_modem_platform/shared_modem_platform.mk b/modem/shared_modem_platform/shared_modem_platform.mk
new file mode 100644
index 0000000..3f50c37
--- /dev/null
+++ b/modem/shared_modem_platform/shared_modem_platform.mk
@@ -0,0 +1,11 @@
+# This file is not included in `modem.mk` since this is included at the
+# beginning of each `device.mk` file, and so will be called before
+# `SHARED_MODEM_PLATFORM_VENDOR` is defined later in the file.
+SOONG_CONFIG_NAMESPACES += shared_modem_platform
+SOONG_CONFIG_shared_modem_platform += \
+       vendor
+SOONG_CONFIG_shared_modem_platform_vendor := $(SHARED_MODEM_PLATFORM_VENDOR)
+
+PRODUCT_PACKAGES += shared_modem_platform
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/modem/shared_modem_platform/compatibility_matrix.xml
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/shared_modem_platform/sepolicy
diff --git a/modem/test/include/fake_android_property_manager.h b/modem/test/include/fake_android_property_manager.h
deleted file mode 100644
index 79fd4f1..0000000
--- a/modem/test/include/fake_android_property_manager.h
+++ /dev/null
@@ -1,77 +0,0 @@
-
-
-#include <map>
-#include <string>
-#include <string_view>
-
-#include "android_property_manager.h"
-#include "modem_log_constants.h"
-
-namespace modem {
-namespace logging {
-
-/**
- * @brief Fake Implementation of AndroidPropertyManager that mocks some of the
- * property changing behaviour from pixellogger's `modem_logging_control`.
- */
-class FakeAndroidPropertyManager : public AndroidPropertyManager {
- public:
-  inline constexpr static std::string_view kTruthString = "true";
-  inline constexpr static std::string_view kFalseString = "false";
-
-  bool GetBoolProperty(const std::string& key, bool default_value) override {
-    return MapContainsKey(key)
-               ? GetPropertyInternal(key) == kTruthString
-               : default_value;
-  };
-
-  std::string GetProperty(const std::string& key,
-                          const std::string& default_value) override {
-    return MapContainsKey(key) ? GetPropertyInternal(key) : default_value;
-    ;
-  };
-
-  int GetIntProperty(const std::string& key, int default_value) override {
-    return MapContainsKey(key) ? std::stoi(GetPropertyInternal(key))
-                               : default_value;
-  };
-
-  /**
-   * This function needs to copy the behaviour of `modem_logging_control` to
-   * ensure that the right properties are being set in order.
-   *
-   * More specifically, this function will also set the
-   * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
-   * set to simulate modem logging stopping / starting.
-   */
-  void SetProperty(const std::string& key, const std::string& value) override {
-    if (key == kModemLoggingEnabledProperty) {
-      property_map_[kModemLoggingStatusProperty.data()] = value;
-
-      // need to track if modem logging has restarted or not
-      if (value == kFalseString) {
-        modem_logging_has_been_off_ = true;
-      }
-      if (modem_logging_has_been_off_ && (value == kTruthString)) {
-        modem_logging_has_restarted_ = true;
-      }
-    }
-    property_map_[key] = value;
-  };
-
-  bool ModemLoggingHasRestarted() { return modem_logging_has_restarted_; }
-
- private:
-  bool MapContainsKey(const std::string& key) {
-    return property_map_.find(key) != property_map_.end();
-  }
-  std::string GetPropertyInternal(const std::string& key) {
-    return property_map_.find(key)->second;
-  }
-
-  std::map<std::string, std::string> property_map_;
-  bool modem_logging_has_been_off_ = false;
-  bool modem_logging_has_restarted_ = false;
-};
-}  // namespace logging
-}  // namespace modem
diff --git a/mte/OWNERS b/mte/OWNERS
new file mode 100644
index 0000000..929e941
--- /dev/null
+++ b/mte/OWNERS
@@ -0,0 +1,4 @@
+eugenis@google.com
+pcc@google.com
+mitchp@google.com
+fmayer@google.com
diff --git a/mte/fullmte-pixel.mk b/mte/fullmte-pixel.mk
index 96120fb..ac2aba8 100644
--- a/mte/fullmte-pixel.mk
+++ b/mte/fullmte-pixel.mk
@@ -1,2 +1,5 @@
 include build/make/target/product/fullmte.mk
+
+PRODUCT_MODULE_BUILD_FROM_SOURCE := true
+
 BOARD_KERNEL_CMDLINE += bootloader.pixel.MTE_FORCE_ON
diff --git a/performance/Android.bp b/performance/Android.bp
index 6eee7c4..5c0e0b2 100644
--- a/performance/Android.bp
+++ b/performance/Android.bp
@@ -5,13 +5,14 @@
 cc_binary {
     name: "dump_perf",
     srcs: ["dump_perf.cpp"],
+    init_rc: ["init.pixel-mm-gs.rc"],
     cflags: [
         "-Wall",
         "-Wextra",
         "-Werror",
     ],
     shared_libs: [
-	"libdump",
+        "libdump",
     ],
     vendor: true,
     relative_install_path: "dump",
diff --git a/performance/dump_perf.cpp b/performance/dump_perf.cpp
index aa742f1..d2989ad 100644
--- a/performance/dump_perf.cpp
+++ b/performance/dump_perf.cpp
@@ -18,5 +18,8 @@
 
 int main() {
     dumpFileContent("VENDOR PROC DUMP", "/proc/vendor_sched/dump_task");
+    dumpFileContent("BTS scenario", "/sys/kernel/debug/bts/scenario");
+    dumpFileContent("BTS vc", "/sys/kernel/debug/bts/vc");
+    dumpFileContent("BTS status", "/sys/kernel/debug/bts/status");
     return 0;
 }
diff --git a/performance/init.pixel-mm-gs.rc b/performance/init.pixel-mm-gs.rc
new file mode 100644
index 0000000..9bc12e9
--- /dev/null
+++ b/performance/init.pixel-mm-gs.rc
@@ -0,0 +1,20 @@
+# Copyright (C) 2024 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+on init
+    # adjust PCP high level
+    write /proc/sys/vm/percpu_pagelist_high_fraction 430
+
+    # disable proactive compaction
+    write /proc/sys/vm/compaction_proactiveness 0
diff --git a/performance/sepolicy/dump_perf.te b/performance/sepolicy/dump_perf.te
index 15c4f6e..befe9ba 100644
--- a/performance/sepolicy/dump_perf.te
+++ b/performance/sepolicy/dump_perf.te
@@ -1,3 +1,7 @@
 pixel_bugreport(dump_perf)
 
 allow dump_perf proc_vendor_sched:file r_file_perms;
+userdebug_or_eng(`
+  allow dump_perf vendor_bts_debugfs:dir r_dir_perms;
+  allow dump_perf vendor_bts_debugfs:file r_file_perms;
+')
diff --git a/performance/sepolicy/file.te b/performance/sepolicy/file.te
new file mode 100644
index 0000000..8e16bbf
--- /dev/null
+++ b/performance/sepolicy/file.te
@@ -0,0 +1,2 @@
+type sysfs_pakills, fs_type, sysfs_type;
+type vendor_bts_debugfs, fs_type, debugfs_type;
diff --git a/performance/sepolicy/genfs_contexts b/performance/sepolicy/genfs_contexts
index 000c41b..041021c 100644
--- a/performance/sepolicy/genfs_contexts
+++ b/performance/sepolicy/genfs_contexts
@@ -1 +1,3 @@
 genfscon proc /sys/kernel/sched_pelt_multiplier u:object_r:proc_sched:s0
+genfscon sysfs /kernel/vendor_mm/pa_kill u:object_r:sysfs_pakills:s0
+genfscon debugfs /bts u:object_r:vendor_bts_debugfs:s0
diff --git a/performance/sepolicy/hal_power_default.te b/performance/sepolicy/hal_power_default.te
new file mode 100644
index 0000000..763862d
--- /dev/null
+++ b/performance/sepolicy/hal_power_default.te
@@ -0,0 +1,2 @@
+allow hal_power_default sysfs_pakills:file rw_file_perms;
+allow hal_power_default sysfs_pakills:dir r_dir_perms;
diff --git a/performance/sepolicy/vendor_init.te b/performance/sepolicy/vendor_init.te
new file mode 100644
index 0000000..fefecb1
--- /dev/null
+++ b/performance/sepolicy/vendor_init.te
@@ -0,0 +1,3 @@
+# MM
+allow vendor_init proc_percpu_pagelist_high_fraction:file w_file_perms;
+
diff --git a/pixelsupport/pixelsupport.mk b/pixelsupport/pixelsupport.mk
new file mode 100644
index 0000000..068c94f
--- /dev/null
+++ b/pixelsupport/pixelsupport.mk
@@ -0,0 +1,5 @@
+PRODUCT_PACKAGES += PixelSupportPrebuilt
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/pixelsupport/sepolicy/vendor
+PRODUCT_PUBLIC_SEPOLICY_DIRS += device/google/gs-common/pixelsupport/sepolicy/product/public
+PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/pixelsupport/sepolicy/product/private
diff --git a/pixelsupport/sepolicy/product/private/certs/pixelsupport.x509.pem b/pixelsupport/sepolicy/product/private/certs/pixelsupport.x509.pem
new file mode 100644
index 0000000..40c874d
--- /dev/null
+++ b/pixelsupport/sepolicy/product/private/certs/pixelsupport.x509.pem
@@ -0,0 +1,30 @@
+-----BEGIN CERTIFICATE-----
+MIIGBzCCA++gAwIBAgIVAJriiL3+mR75mIC8e0Xqoz59LduNMA0GCSqGSIb3DQEBCwUAMIGSMQsw
+CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU
+MBIGA1UEChMLR29vZ2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxLjAsBgNVBAMMJWNvbV9nb29n
+bGVfYW5kcm9pZF9hcHBzX3BpeGVsX3N1cHBvcnQwIBcNMjIxMjEyMTM1MDA3WhgPMjA1MjEyMTIx
+MzUwMDdaMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91
+bnRhaW4gVmlldzEUMBIGA1UEChMLR29vZ2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxLjAsBgNV
+BAMMJWNvbV9nb29nbGVfYW5kcm9pZF9hcHBzX3BpeGVsX3N1cHBvcnQwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCSWvRumhZOIAZmWKcuVjc1l3OIIWc/nSRVnsfdzeRqK0jwVFcTqMDs
+kmZtEj/UTW+N91ExRzWvAQ027AcE7TGF3X2iKKAfpSB0fpVQato5RIzOrRbwgAzsIvBdVtExqSNk
+5vh8xJ0azHt6Jn77gW03Mq7AL55Si5q3vU1meeGBPD/YWeqd/oNhPfe0kAHdNnnTOnN6SBxSeO8r
+YukV4XYJ3BxgWD1sm2NI8kZ+OGAooBFflZYXoY6NVfLXm6jsqWnooAok7CrNxZc/wstiwd8yYX6f
+6R1Trox3a9xOy7E+6Rig0XhbWm4pbp3Zu0OLArUalbQ1cjd1qFy6q9maieBn14ad+UtLNOUjCx91
+hLWg/mdpYCvArQb3bBDJdjYfdoo7Q8F9QW3JrFrbIeBezM4TTdK9v/sM4+1OxEo6vwMKQM9Ata/H
+Mn89a4nFHgRqGIMKK8zh0Eob+OwiBakviVhAI1o7IONujcJ2hfuyHNPZb8sT0Rewxtw2fD/Jwj+l
+ADmlXWw553geFcwP1SqOC6j/XOeazSvV4ccCME2VZqIE4pmL+RUr+cgAyQHXPZnet74C7K9sNRV6
+JluS6inqP4lKp7gSFuVrQNYHawNPVinbeTLYEu+df3m3yrHAUpaSvsSUC6qQVWCs0sI8PC6A1+bV
+DXMsIYRvrSnmtN75vOECaQIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBTODyZ1S/is
+Y/2ZuMl8B1M6kFiJwDAfBgNVHSMEGDAWgBTODyZ1S/isY/2ZuMl8B1M6kFiJwDANBgkqhkiG9w0B
+AQsFAAOCAgEAL26IGjeu8Q5tn/b4vfYa+7bRUwozAJA9Buyduw/4wVG6rIAkpEsghkgnoOvyjD72
+ncbCkDoBV3a1PLw2W/bMQWfZvYScOzc2yFwcR9LdQIiEYmtgnwuJHnqc2MDsh+MDeclblyBYfIQQ
+bpZ0JArKalSmDyul0QIcfHq+RKmGAzC3bx0xigclIZJxXEG4tyQylttnqNodAEqYdhMMRajI3w9t
+61QwqNv1KTGJt1sC2Q7NyzbZJo02Kwu711Dw6KnVgHaGKC2sRIixsvjm2s6f9/CcVasuLopkJnyl
+epPeD2jHwHdE4/c2K5ZVQeZ+R0pIOEBKwg1AVkn+/UTbhpjYCkEGP09e8T45Y+//eMlrbORJAbji
+H5cfD9aSO2z4slN4B4w+Fw9Kn+a7bsN2xhv7lvAgQ92aq9g/YS1YysZ7kSoCpmKl7rN+0V/RGRVP
+ab2Cb0C3+JewTnOAF30e7zVs9Vaq3oTAV4XFYNiDRUBU/rvv8EIZKcBdufFJmCGYUpmm1EQQdsTt
+mFMPEh5I4Qd0sy+HKvLjThcMGHqDX0bCeXkbFZdj0GXPOOt5LX8NZBdnsbVgENrZml318uLEj3ZU
+DlojsfsTlVcs5eIPX6Dkx0OdgVcMAXnLF+vjP/ygWuLqiPFPCrZD1b+2g2P9Yip3e221tuyca42b
+q3bvQEBwOsA=
+-----END CERTIFICATE-----
diff --git a/pixelsupport/sepolicy/product/private/keys.conf b/pixelsupport/sepolicy/product/private/keys.conf
new file mode 100644
index 0000000..eff6067
--- /dev/null
+++ b/pixelsupport/sepolicy/product/private/keys.conf
@@ -0,0 +1,2 @@
+[@PIXELSUPPORT]
+ALL : device/google/gs-common/pixelsupport/sepolicy/product/private/certs/pixelsupport.x509.pem
diff --git a/pixelsupport/sepolicy/product/private/mac_permissions.xml b/pixelsupport/sepolicy/product/private/mac_permissions.xml
new file mode 100644
index 0000000..cb8d42a
--- /dev/null
+++ b/pixelsupport/sepolicy/product/private/mac_permissions.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policy>
+
+<!--
+
+    * A signature is a hex encoded X.509 certificate or a tag defined in
+      keys.conf and is required for each signer tag.
+    * A signer tag may contain a seinfo tag and multiple package stanzas.
+    * A default tag is allowed that can contain policy for all apps not signed with a
+      previously listed cert. It may not contain any inner package stanzas.
+    * Each signer/default/package tag is allowed to contain one seinfo tag. This tag
+      represents additional info that each app can use in setting a SELinux security
+      context on the eventual process.
+    * When a package is installed the following logic is used to determine what seinfo
+      value, if any, is assigned.
+      - All signatures used to sign the app are checked first.
+      - If a signer stanza has inner package stanzas, those stanza will be checked
+        to try and match the package name of the app. If the package name matches
+        then that seinfo tag is used. If no inner package matches then the outer
+        seinfo tag is assigned.
+      - The default tag is consulted last if needed.
+-->
+    <!-- PixelSupport app key -->
+    <signer signature="@PIXELSUPPORT" >
+      <seinfo value="PixelSupport" />
+    </signer>
+</policy>
diff --git a/pixelsupport/sepolicy/product/private/pixelsupport_app.te b/pixelsupport/sepolicy/product/private/pixelsupport_app.te
new file mode 100644
index 0000000..be6f7dd
--- /dev/null
+++ b/pixelsupport/sepolicy/product/private/pixelsupport_app.te
@@ -0,0 +1,11 @@
+typeattribute pixelsupport_app coredomain;
+
+app_domain(pixelsupport_app)
+# Access the network.
+net_domain(pixelsupport_app)
+# Access bluetooth.
+bluetooth_domain(pixelsupport_app)
+
+allow pixelsupport_app app_api_service:service_manager find;
+allow pixelsupport_app radio_service:service_manager find;
+
diff --git a/pixelsupport/sepolicy/product/private/seapp_contexts b/pixelsupport/sepolicy/product/private/seapp_contexts
new file mode 100644
index 0000000..f16a054
--- /dev/null
+++ b/pixelsupport/sepolicy/product/private/seapp_contexts
@@ -0,0 +1,2 @@
+# Pixel Support App
+user=_app seinfo=PixelSupport name=com.google.android.apps.pixel.support domain=pixelsupport_app type=app_data_file isPrivApp=true levelFrom=user
diff --git a/pixelsupport/sepolicy/product/public/pixelsupport_app.te b/pixelsupport/sepolicy/product/public/pixelsupport_app.te
new file mode 100644
index 0000000..1846ac9
--- /dev/null
+++ b/pixelsupport/sepolicy/product/public/pixelsupport_app.te
@@ -0,0 +1,2 @@
+type pixelsupport_app, domain;
+
diff --git a/pixelsupport/sepolicy/vendor/pixelsupport_app.te b/pixelsupport/sepolicy/vendor/pixelsupport_app.te
new file mode 100644
index 0000000..e3b380c
--- /dev/null
+++ b/pixelsupport/sepolicy/vendor/pixelsupport_app.te
@@ -0,0 +1,2 @@
+set_prop(pixelsupport_app, vendor_gti_prop)
+
diff --git a/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp b/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
index 6e377aa..c842d3e 100644
--- a/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
+++ b/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
@@ -62,6 +62,14 @@
             }
         }
 
+        // Cpufreq data is sorted in ascending order, but power stats are sorted
+        // in descending order. Reverse sorting to maintain consistency with
+        // other power stats.
+        if (states.size() > 1 &&
+                std::atoll(states[0].second.c_str()) < std::atoll(states[1].second.c_str())) {
+            std::reverse(states.begin(), states.end());
+        }
+
         mPowerEntities.push_back({powerEntities[i].first, std::move(states)});
     }
 
diff --git a/powerstats/DisplayMrrStateResidencyDataProvider.cpp b/powerstats/DisplayMrrStateResidencyDataProvider.cpp
new file mode 100644
index 0000000..8ab9af4
--- /dev/null
+++ b/powerstats/DisplayMrrStateResidencyDataProvider.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "DisplayMrrStateResidencyDataProvider.h"
+
+#include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <android-base/strings.h>
+
+using android::base::ParseInt;
+using android::base::ParseUint;
+using android::base::Split;
+using android::base::Trim;
+
+static const std::string TIME_IN_STATE = "time_in_state";
+static const std::string AVAILABLE_STATE = "available_disp_stats";
+static const std::vector<std::string> DISP_STATE = { "On", "HBM", "LP", "Off" };
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+DisplayMrrStateResidencyDataProvider::DisplayMrrStateResidencyDataProvider(
+        const std::string& name, const std::string& path) : mName(name), mPath(path) {
+    mConfigs = std::vector<Config>();
+    std::string statePath = mPath + AVAILABLE_STATE;
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(statePath.c_str(), "r"), fclose);
+    if (fp) {
+        char *line = nullptr;
+        size_t len = 0;
+        Config config = { .state = 0, .resX = 0, .resY = 0, .rr = 0 };
+        while (getline(&line, &len, fp.get()) != -1) {
+            if (parseAvailableState(line, &config)) {
+                mConfigs.push_back(config);
+            } else {
+                PLOG(ERROR) << "Failed to parse display config for [" << std::string(line)
+                            << "] from " << statePath;
+                mConfigs.clear();
+                break;
+            }
+        }
+        free(line);
+    } else {
+        PLOG(ERROR) << "Failed to open file " << statePath;
+    }
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseConfig(
+        char const *line, Config *config, uint64_t *duration) {
+    std::vector<std::string> parts = Split(line, " ");
+
+    if (duration == nullptr) {
+        if (parts.size() != 4) return false;
+    } else {
+        if (parts.size() != 5) return false;
+
+        if (!ParseUint(Trim(parts[4]), duration)) return false;
+    }
+
+    if (!ParseInt(Trim(parts[0]), &config->state)) return false;
+    if (!ParseInt(Trim(parts[1]), &config->resX)) return false;
+    if (!ParseInt(Trim(parts[2]), &config->resY)) return false;
+    if (!ParseInt(Trim(parts[3]), &config->rr)) return false;
+
+    return true;
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseAvailableState(
+        char const *line, Config *config) {
+    return parseConfig(line, config, nullptr);
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseTimeInState(
+        char const *line, Config *config, uint64_t *duration) {
+    return parseConfig(line, config, duration);
+}
+
+bool DisplayMrrStateResidencyDataProvider::getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) {
+    if (mConfigs.empty()) {
+        LOG(ERROR) << "Display MRR state list is empty!";
+        return false;
+    }
+
+    std::string path = mPath + TIME_IN_STATE;
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(path.c_str(), "r"), fclose);
+    if (!fp) {
+        PLOG(ERROR) << "Failed to open file " << path;
+        return false;
+    }
+
+    std::vector<StateResidency> stateResidencies;
+    for (int i = 0; i < mConfigs.size(); i++) {
+        StateResidency s = {.id = i, .totalTimeInStateMs = 0};
+        stateResidencies.push_back(s);
+    }
+
+    char *line = nullptr;
+    size_t len = 0;
+    Config config = { .state = 0, .resX = 0, .resY = 0, .rr = 0 };
+    uint64_t duration;
+    std::vector<Config>::const_iterator found;
+    while (getline(&line, &len, fp.get()) != -1) {
+        if (parseTimeInState(line, &config, &duration)) {
+            found = std::find(mConfigs.begin(), mConfigs.end(), config);
+            if (found != mConfigs.end()) {
+                stateResidencies[found - mConfigs.begin()].totalTimeInStateMs = duration;
+            } else {
+                LOG(ERROR) << "Failed to find config for [" << std::string(line)
+                           << "] in display MRR state list";
+            }
+        } else {
+            LOG(ERROR) << "Failed to parse state and duration from [" << std::string(line) << "]";
+            free(line);
+            return false;
+        }
+    }
+
+    residencies->emplace(mName, stateResidencies);
+
+    free(line);
+
+    return true;
+}
+
+std::unordered_map<std::string, std::vector<State>> DisplayMrrStateResidencyDataProvider::getInfo()
+{
+    int32_t dispId;
+    std::string name;
+    std::vector<State> states;
+    for (int32_t id = 0; id < mConfigs.size(); id++) {
+        dispId = mConfigs[id].state;
+        if (dispId >= DISP_STATE.size()) {
+            LOG(ERROR) << "Display state id " << dispId << " is out of bound";
+            return {};
+        }
+
+        name = DISP_STATE[dispId];
+        if (dispId != DISP_STATE.size() - 1) {
+            name += ": " + std::to_string(mConfigs[id].resX) +
+                    "x" + std::to_string(mConfigs[id].resY) +
+                    "@" + std::to_string(mConfigs[id].rr);
+        }
+        State s = { .id = id, .name = name };
+        states.push_back(s);
+    }
+
+    return {{ mName, states }};
+}
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/TpuDvfsStateResidencyDataProvider.cpp b/powerstats/TpuDvfsStateResidencyDataProvider.cpp
new file mode 100644
index 0000000..e1ce56c
--- /dev/null
+++ b/powerstats/TpuDvfsStateResidencyDataProvider.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "TpuDvfsStateResidencyDataProvider.h"
+
+#include <android-base/logging.h>
+
+static const std::string ENTITY_NAME = "TPU-DVFS";
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+TpuDvfsStateResidencyDataProvider::TpuDvfsStateResidencyDataProvider(
+        const std::string& path,
+        std::vector<std::string> frequencies,
+        uint64_t clockRate)
+    : mPath(path), mFrequencies(std::move(frequencies)), mClockRate(clockRate) {}
+
+bool TpuDvfsStateResidencyDataProvider::getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) {
+    // Using FILE* instead of std::ifstream for performance reasons
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(mPath.c_str(), "r"), fclose);
+    if (!fp) {
+        PLOG(ERROR) << "Failed to open file " << mPath;
+        return false;
+    }
+
+    std::vector<StateResidency> stateResidencies;
+    for (int i = 0; i < mFrequencies.size(); i++) {
+        StateResidency s = {.id = i, .totalTimeInStateMs = 0};
+        stateResidencies.push_back(s);
+    }
+
+    char *line = nullptr;
+    size_t len = 0;
+    std::istringstream ssLine;
+    std::string split;
+    int32_t lineIdx = 0;
+    std::vector<int32_t> stateIdxMap;
+    int32_t colIdx;
+    std::vector<std::string>::const_iterator found;
+    while (getline(&line, &len, fp.get()) != -1) {
+        ssLine.clear();
+        ssLine.str(line);
+        colIdx = 0;
+        for (std::string split; std::getline(ssLine, split, ' ');) {
+            // Skip first column
+            if (split.find(':') != std::string::npos)
+                continue;
+
+            if (lineIdx == 0) {
+                // Build the state index map by first row
+                split.erase(split.find_last_not_of(" \n\r\t") + 1);
+                found = std::find(mFrequencies.begin(), mFrequencies.end(), split);
+                if (found != mFrequencies.end()) {
+                    stateIdxMap.push_back(found - mFrequencies.begin());
+                } else {
+                    PLOG(ERROR) << "TPU frequency " << split << " is not found in " << mPath;
+                    stateIdxMap.push_back(0);
+                }
+            } else {
+                // Add up time in frequency per uid
+                stateResidencies[stateIdxMap[colIdx]].totalTimeInStateMs +=
+                        std::atoll(split.c_str()) / mClockRate;
+            }
+            colIdx++;
+        }
+        lineIdx++;
+    }
+
+    residencies->emplace(ENTITY_NAME, stateResidencies);
+    return true;
+}
+
+std::unordered_map<std::string, std::vector<State>> TpuDvfsStateResidencyDataProvider::getInfo() {
+    std::vector<State> states;
+    for (int32_t id = 0; id < mFrequencies.size(); id++) {
+        State s =
+            {.id = id, .name = std::to_string(std::atol(mFrequencies[id].c_str()) / 1000) + "MHz"};
+        states.push_back(s);
+    }
+
+    return {{ENTITY_NAME, states}};
+}
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/include/DisplayMrrStateResidencyDataProvider.h b/powerstats/include/DisplayMrrStateResidencyDataProvider.h
new file mode 100644
index 0000000..81ea17e
--- /dev/null
+++ b/powerstats/include/DisplayMrrStateResidencyDataProvider.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <PowerStatsAidl.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+class DisplayMrrStateResidencyDataProvider : public PowerStats::IStateResidencyDataProvider {
+  public:
+    DisplayMrrStateResidencyDataProvider(const std::string& name, const std::string& path);
+    ~DisplayMrrStateResidencyDataProvider() = default;
+
+    /*
+     * See IStateResidencyDataProvider::getStateResidencies
+     */
+    bool getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) override;
+
+    /*
+     * See IStateResidencyDataProvider::getInfo
+     */
+    std::unordered_map<std::string, std::vector<State>> getInfo() override;
+
+  private:
+    struct Config {
+      int32_t state; // Display state (On, HBM, LP, Off)
+      int32_t resX;  // Resolution X
+      int32_t resY;  // Resolution Y
+      int32_t rr;    // Refresh rate
+
+      bool operator==(const Config& r) const {
+        return state == r.state && resX == r.resX && resY == r.resY && rr == r.rr;
+      }
+    };
+
+    bool parseConfig(char const *line, Config *config, uint64_t *duration);
+    bool parseAvailableState(char const *line, Config *config);
+    bool parseTimeInState(char const *line, Config *config, uint64_t *duration);
+    bool loadAvailableState();
+
+    const std::string mName;
+    const std::string mPath;
+    std::vector<Config> mConfigs;
+};
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/include/TpuDvfsStateResidencyDataProvider.h b/powerstats/include/TpuDvfsStateResidencyDataProvider.h
new file mode 100644
index 0000000..9ce3bd3
--- /dev/null
+++ b/powerstats/include/TpuDvfsStateResidencyDataProvider.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <PowerStatsAidl.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+class TpuDvfsStateResidencyDataProvider : public PowerStats::IStateResidencyDataProvider {
+  public:
+    TpuDvfsStateResidencyDataProvider(
+            const std::string& path, std::vector<std::string> frequencies, uint64_t clockRate);
+    ~TpuDvfsStateResidencyDataProvider() = default;
+
+    /*
+     * See IStateResidencyDataProvider::getStateResidencies
+     */
+    bool getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) override;
+
+    /*
+     * See IStateResidencyDataProvider::getInfo
+     */
+    std::unordered_map<std::string, std::vector<State>> getInfo() override;
+
+  private:
+    const std::string mPath;
+    const std::vector<std::string> mFrequencies;
+    const uint64_t mClockRate;
+};
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/radio/dump_radio.cpp b/radio/dump_radio.cpp
index 8d6743c..3ee90f0 100644
--- a/radio/dump_radio.cpp
+++ b/radio/dump_radio.cpp
@@ -34,6 +34,8 @@
     if (tcpdumpEnabled) {
         dumpLogs(TCPDUMP_LOG_DIRECTORY, BUGREPORT_PACKING_DIR, ::android::base::GetIntProperty(TCPDUMP_NUMBER_BUGREPORT, 5), TCPDUMP_LOG_PREFIX);
     }
+    copyFile("/data/vendor/radio/adum_log", "/data/vendor/radio/logs/always-on/all_logs/adum_log");
+    copyFile("/data/vendor/radio/adum_log_old", "/data/vendor/radio/logs/always-on/all_logs/adum_log_old");
     copyFile("/data/vendor/radio/metrics_data", "/data/vendor/radio/logs/always-on/all_logs/metrics_data");
     copyFile("/data/vendor/radio/omadm_logs.txt", "/data/vendor/radio/logs/always-on/all_logs/omadm_logs.txt");
     copyFile("/data/vendor/radio/power_anomaly_data.txt", "/data/vendor/radio/logs/always-on/all_logs/power_anomaly_data.txt");
diff --git a/radio/sepolicy/file.te b/radio/sepolicy/file.te
index 02d0209..95b24c0 100644
--- a/radio/sepolicy/file.te
+++ b/radio/sepolicy/file.te
@@ -1,6 +1,9 @@
 # Data
 type tcpdump_vendor_data_file, file_type, data_file_type;
 
+# Modem
+type sysfs_modem_state, sysfs_type, fs_type;
+
 userdebug_or_eng(`
   typeattribute tcpdump_vendor_data_file mlstrustedobject;
 ')
diff --git a/radio/sepolicy/genfs_contexts b/radio/sepolicy/genfs_contexts
new file mode 100644
index 0000000..039f329
--- /dev/null
+++ b/radio/sepolicy/genfs_contexts
@@ -0,0 +1,3 @@
+# modem state node
+genfscon sysfs /devices/platform/cpif/modem_state       u:object_r:sysfs_modem_state:s0
+
diff --git a/ramdump/ramdump.mk b/ramdump/ramdump.mk
deleted file mode 100644
index 5b34a67..0000000
--- a/ramdump/ramdump.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-PRODUCT_PACKAGES_DEBUG += dump_ramdump
-
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/ramdump/sepolicy
diff --git a/ramdump/sepolicy/file_contexts b/ramdump/sepolicy/file_contexts
deleted file mode 100644
index 726f69d..0000000
--- a/ramdump/sepolicy/file_contexts
+++ /dev/null
@@ -1,2 +0,0 @@
-# dumpstate
-/vendor/bin/dump/dump_ramdump           u:object_r:dump_ramdump_exec:s0
diff --git a/ramdump/Android.bp b/ramdump_and_coredump/Android.bp
similarity index 100%
rename from ramdump/Android.bp
rename to ramdump_and_coredump/Android.bp
diff --git a/ramdump/dump_ramdump.cpp b/ramdump_and_coredump/dump_ramdump.cpp
similarity index 100%
rename from ramdump/dump_ramdump.cpp
rename to ramdump_and_coredump/dump_ramdump.cpp
diff --git a/ramdump_and_coredump/ramdump_and_coredump.mk b/ramdump_and_coredump/ramdump_and_coredump.mk
new file mode 100644
index 0000000..d7a819f
--- /dev/null
+++ b/ramdump_and_coredump/ramdump_and_coredump.mk
@@ -0,0 +1,18 @@
+PRODUCT_PACKAGES += \
+  sscoredump \
+
+PRODUCT_PACKAGES_DEBUG += \
+    dump_ramdump \
+    ramdump \
+
+# When neither AOSP nor factory targets
+ifeq (,$(filter aosp_% factory_%, $(TARGET_PRODUCT)))
+  PRODUCT_PACKAGES += SSRestartDetector
+  PRODUCT_PACKAGES_DEBUG += RamdumpUploader
+endif
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/ramdump_and_coredump/sepolicy
+
+# sscoredump
+PRODUCT_PROPERTY_OVERRIDES += vendor.debug.ssrdump.type=sscoredump
+PRODUCT_SOONG_NAMESPACES += vendor/google/tools/subsystem-coredump
diff --git a/ramdump_and_coredump/sepolicy/bug_map b/ramdump_and_coredump/sepolicy/bug_map
new file mode 100644
index 0000000..0554746
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/bug_map
@@ -0,0 +1,3 @@
+ramdump vendor_hw_plat_prop file b/161103878
+ramdump public_vendor_default_prop file b/161103878
+ramdump proc_bootconfig file b/181615626
diff --git a/ramdump_and_coredump/sepolicy/device.te b/ramdump_and_coredump/sepolicy/device.te
new file mode 100644
index 0000000..7614dd4
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/device.te
@@ -0,0 +1 @@
+type sscoredump_device, dev_type;
diff --git a/ramdump/sepolicy/dump_ramdump.te b/ramdump_and_coredump/sepolicy/dump_ramdump.te
similarity index 100%
rename from ramdump/sepolicy/dump_ramdump.te
rename to ramdump_and_coredump/sepolicy/dump_ramdump.te
diff --git a/ramdump_and_coredump/sepolicy/file.te b/ramdump_and_coredump/sepolicy/file.te
new file mode 100644
index 0000000..10c3171
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/file.te
@@ -0,0 +1,15 @@
+# ramdump: file
+type ramdump_vendor_data_file, file_type, data_file_type, mlstrustedobject;
+type ramdump_vendor_mnt_file, file_type, data_file_type, mlstrustedobject;
+type ramdump_vendor_fs, fusefs_type, data_file_type, mlstrustedobject;
+
+# sscoredump: file
+type sscoredump_vendor_data_coredump_file, file_type, data_file_type, mlstrustedobject;
+type sscoredump_vendor_data_crashinfo_file, file_type, data_file_type, mlstrustedobject;
+
+# sscoredump: sysfs
+type sysfs_sscoredump_level, sysfs_type, fs_type;                  # sscoredump level
+type sysfs_sscoredump_subsystem_report_count, sysfs_type, fs_type; # subsystem report_count: per device explicit path
+
+# ssr_detector_app
+type sscoredump_vendor_data_logcat_file, file_type, data_file_type, mlstrustedobject;
diff --git a/ramdump_and_coredump/sepolicy/file_contexts b/ramdump_and_coredump/sepolicy/file_contexts
new file mode 100644
index 0000000..747fc02
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/file_contexts
@@ -0,0 +1,17 @@
+# dump_ramdump
+/vendor/bin/dump/dump_ramdump           u:object_r:dump_ramdump_exec:s0
+
+# ramdump
+/data/vendor/ramdump(/.*)?                u:object_r:ramdump_vendor_data_file:s0
+/mnt/vendor/ramdump(/.*)?                 u:object_r:ramdump_vendor_mnt_file:s0
+/vendor/bin/ramdump                       u:object_r:ramdump_exec:s0
+/vendor/bin/ramdump32                     u:object_r:ramdump_exec:s0
+
+# sscoredump
+/data/vendor/ssrdump(/.*)?             u:object_r:sscoredump_vendor_data_crashinfo_file:s0
+/data/vendor/ssrdump/coredump(/.*)?    u:object_r:sscoredump_vendor_data_coredump_file:s0
+/dev/sscd_.*                           u:object_r:sscoredump_device:s0
+/vendor/bin/sscoredump                 u:object_r:sscoredump_exec:s0
+
+# ssr_detector_app
+/data/vendor/ssrdump/logcat(/.*)?      u:object_r:sscoredump_vendor_data_logcat_file:s0
diff --git a/ramdump_and_coredump/sepolicy/genfs_contexts b/ramdump_and_coredump/sepolicy/genfs_contexts
new file mode 100644
index 0000000..5a6e494
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/genfs_contexts
@@ -0,0 +1 @@
+genfscon sysfs /class/sscoredump/level u:object_r:sysfs_sscoredump_level:s0
diff --git a/ramdump_and_coredump/sepolicy/property.te b/ramdump_and_coredump/sepolicy/property.te
new file mode 100644
index 0000000..e708b5a
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/property.te
@@ -0,0 +1,2 @@
+# ramdump
+vendor_internal_prop(vendor_ramdump_prop)
diff --git a/ramdump_and_coredump/sepolicy/property_contexts b/ramdump_and_coredump/sepolicy/property_contexts
new file mode 100644
index 0000000..a50f5a9
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/property_contexts
@@ -0,0 +1,3 @@
+# ramdump
+ro.boot.ramdump                           u:object_r:vendor_ramdump_prop:s0
+vendor.debug.ramdump.                     u:object_r:vendor_ramdump_prop:s0
diff --git a/ramdump_and_coredump/sepolicy/ramdump.te b/ramdump_and_coredump/sepolicy/ramdump.te
new file mode 100644
index 0000000..d66139f
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/ramdump.te
@@ -0,0 +1,48 @@
+type ramdump_exec, exec_type, vendor_file_type, file_type;
+type ramdump, domain;
+
+userdebug_or_eng(`
+  init_daemon_domain(ramdump)
+
+  set_prop(ramdump, vendor_ramdump_prop)
+
+  # f2fs set pin file requires sys_admin
+  allow ramdump self:capability { sys_admin sys_rawio };
+
+  allow ramdump ramdump_vendor_data_file:dir create_dir_perms;
+  allow ramdump ramdump_vendor_data_file:file create_file_perms;
+  allow ramdump proc_cmdline:file r_file_perms;
+
+  allow ramdump block_device:dir search;
+  allow ramdump misc_block_device:blk_file rw_file_perms;
+  allow ramdump userdata_block_device:blk_file rw_file_perms;
+
+  # Allow ReadDefaultFstab().
+  read_fstab(ramdump)
+
+  # read /fstab.${ro.hardware}
+  allow ramdump rootfs:file r_file_perms;
+
+  r_dir_file(ramdump, sysfs_type)
+
+  # To access statsd.
+  hwbinder_use(ramdump)
+  get_prop(ramdump, hwservicemanager_prop)
+  get_prop(ramdump, boot_status_prop)
+  allow ramdump fwk_stats_hwservice:hwservice_manager find;
+  binder_call(ramdump, stats_service_server)
+  allow ramdump fwk_stats_service:service_manager find;
+  binder_use(ramdump)
+
+  # To implement fusefs (ramdumpfs) under /mnt/vendor/ramdump.
+  allow ramdump fuse:filesystem relabelfrom;
+  allow ramdump fuse_device:chr_file rw_file_perms;
+  allow ramdump mnt_vendor_file:dir r_dir_perms;
+  allow ramdump ramdump_vendor_mnt_file:dir { getattr mounton };
+  allow ramdump ramdump_vendor_fs:filesystem { mount unmount relabelfrom relabelto };
+  allow ramdump_vendor_mnt_file ramdump_vendor_fs:filesystem associate;
+
+  # Access new Stats AIDL APIs (ag/13714907).
+  allow ramdump fwk_stats_service:service_manager find;
+  binder_call(ramdump, servicemanager)
+')
diff --git a/ramdump_and_coredump/sepolicy/ramdump_app.te b/ramdump_and_coredump/sepolicy/ramdump_app.te
new file mode 100644
index 0000000..85d4bfd
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/ramdump_app.te
@@ -0,0 +1,26 @@
+type ramdump_app, domain;
+
+userdebug_or_eng(`
+  app_domain(ramdump_app)
+
+  allow ramdump_app app_api_service:service_manager find;
+
+  allow ramdump_app ramdump_vendor_data_file:file create_file_perms;
+  allow ramdump_app ramdump_vendor_data_file:dir create_dir_perms;
+
+  set_prop(ramdump_app, vendor_ramdump_prop)
+  get_prop(ramdump_app, system_boot_reason_prop)
+
+  # To access ramdumpfs.
+  allow ramdump_app mnt_vendor_file:dir search;
+  allow ramdump_app ramdump_vendor_mnt_file:dir create_dir_perms;
+  allow ramdump_app ramdump_vendor_mnt_file:file create_file_perms;
+
+  # To access subsystem ramdump files and dirs.
+  allow ramdump_app sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+  allow ramdump_app sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+  allow ramdump_app sscoredump_vendor_data_coredump_file:dir r_dir_perms;
+  allow ramdump_app sscoredump_vendor_data_coredump_file:file r_file_perms;
+  allow ramdump_app sscoredump_vendor_data_logcat_file:dir r_dir_perms;
+  allow ramdump_app sscoredump_vendor_data_logcat_file:file r_file_perms;
+')
diff --git a/ramdump_and_coredump/sepolicy/seapp_contexts b/ramdump_and_coredump/sepolicy/seapp_contexts
new file mode 100644
index 0000000..2618216
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/seapp_contexts
@@ -0,0 +1,5 @@
+# ramdump_app
+user=_app seinfo=platform name=com.android.ramdump domain=ramdump_app type=app_data_file levelFrom=all
+
+# ssr_detector_app
+user=system seinfo=platform name=com.google.SSRestartDetector domain=ssr_detector_app type=system_app_data_file levelFrom=user
diff --git a/ramdump_and_coredump/sepolicy/sscoredump.te b/ramdump_and_coredump/sepolicy/sscoredump.te
new file mode 100644
index 0000000..70d6e1b
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/sscoredump.te
@@ -0,0 +1,18 @@
+type sscoredump, domain;
+type sscoredump_exec, vendor_file_type, exec_type, file_type;
+
+init_daemon_domain(sscoredump)
+
+set_prop(sscoredump, vendor_ssrdump_prop)
+
+allow sscoredump device:dir r_dir_perms;
+allow sscoredump sscoredump_device:chr_file rw_file_perms;
+allow sscoredump sscoredump_vendor_data_crashinfo_file:dir create_dir_perms;
+allow sscoredump sscoredump_vendor_data_crashinfo_file:file create_file_perms;
+allow sscoredump sysfs_sscoredump_subsystem_report_count:file r_file_perms;
+
+userdebug_or_eng(`
+  allow sscoredump sysfs_sscoredump_level:file rw_file_perms;
+  allow sscoredump sscoredump_vendor_data_coredump_file:dir create_dir_perms;
+  allow sscoredump sscoredump_vendor_data_coredump_file:file create_file_perms;
+')
diff --git a/ramdump_and_coredump/sepolicy/ssr_detector_app.te b/ramdump_and_coredump/sepolicy/ssr_detector_app.te
new file mode 100644
index 0000000..ffd612a
--- /dev/null
+++ b/ramdump_and_coredump/sepolicy/ssr_detector_app.te
@@ -0,0 +1,27 @@
+type ssr_detector_app, domain;
+
+app_domain(ssr_detector_app)
+allow ssr_detector_app app_api_service:service_manager find;
+allow ssr_detector_app radio_service:service_manager find;
+
+allow ssr_detector_app system_app_data_file:dir create_dir_perms;
+allow ssr_detector_app system_app_data_file:file create_file_perms;
+
+allow ssr_detector_app sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+allow ssr_detector_app sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+
+userdebug_or_eng(`
+  allow ssr_detector_app sscoredump_vendor_data_coredump_file:dir r_dir_perms;
+  allow ssr_detector_app sscoredump_vendor_data_coredump_file:file r_file_perms;
+  allow ssr_detector_app sscoredump_vendor_data_logcat_file:dir create_dir_perms;
+  allow ssr_detector_app sscoredump_vendor_data_logcat_file:file create_file_perms;
+  get_prop(ssr_detector_app, vendor_aoc_prop)
+  allow ssr_detector_app sysfs_sjtag:dir r_dir_perms;
+  allow ssr_detector_app sysfs_sjtag:file rw_file_perms;
+  allow ssr_detector_app proc_vendor_sched:dir search;
+  allow ssr_detector_app proc_vendor_sched:file rw_file_perms;
+  allow ssr_detector_app cgroup:file write;
+')
+
+get_prop(ssr_detector_app, vendor_ssrdump_prop)
+get_prop(ssr_detector_app, vendor_wifi_version)
diff --git a/recorder/recorder.mk b/recorder/recorder.mk
new file mode 100644
index 0000000..87620da
--- /dev/null
+++ b/recorder/recorder.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/recorder/sepolicy/vendor
+PRODUCT_PUBLIC_SEPOLICY_DIRS += device/google/gs-common/recorder/sepolicy/product/public
+PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/recorder/sepolicy/product/private
diff --git a/recorder/sepolicy/product/private/certs/com_google_android_apps_recorder.x509.pem b/recorder/sepolicy/product/private/certs/com_google_android_apps_recorder.x509.pem
new file mode 100644
index 0000000..833c86b
--- /dev/null
+++ b/recorder/sepolicy/product/private/certs/com_google_android_apps_recorder.x509.pem
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIF+zCCA+OgAwIBAgIVAJFfB9eQ7J1w93C6aGBchm77ysA3MA0GCSqGSIb3DQEBCwUAMIGNMQsw
+CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEU
+MBIGA1UEChMLR29vZ2xlIEluYy4xEDAOBgNVBAsTB0FuZHJvaWQxKTAnBgNVBAMMIGNvbV9nb29n
+bGVfYW5kcm9pZF9hcHBzX3JlY29yZGVyMB4XDTE5MDIxNTE1NDQxMloXDTQ5MDIxNTE1NDQxMlow
+gY0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFpbiBW
+aWV3MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEQMA4GA1UECxMHQW5kcm9pZDEpMCcGA1UEAwwgY29t
+X2dvb2dsZV9hbmRyb2lkX2FwcHNfcmVjb3JkZXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQCFSs/DqyyRbMD2mEHxxv+DDnV7V8j/RUB43aZXC11kKbLAD/E8/WxV+e9frFoXlzXepK4m
+FliWHyLWNSUmFwVxl2JsrkxUJ4QWXIpw9azHkW9kO5r/VPTXCBAZn80qqaqHlzplHbflxLiQc+zv
+lWEg7HJPBMMMFC3yCYfhLbDrriZdMnT4mHMLUo24TzO2znv7c7SDBWQ57lAsdRB0OX+N4DfBXvUR
+QLUO9FazerGdcK58KHkxgo3ZHY3c2+efkfCkZUgu6HKLwA24O2e0/iYmC7vQTItGYCCyzbdlXDix
+t0YgpsdcsOtVSJLwv6movtAX9JGsrGkvZR9Ffa52Vfc+vW0yqahHxVFJ5VD6UrrQpkWjonrsIbHb
+RLQ05ZM735kd4NWrxgS0sDwdfvhmsj29Ag3q/cuIpG/+x37+vmTlMKggeqxSxoQ4RwGyZuvyb8PB
+/lCf6r6bAYyr88oAs03ATz3RqRH38rkHmFp5Cdf488tw2Wj6vB/JqnfPN8woslle0hUIkqH7Ezna
+0zF79yov7oePFdqr++khDHrrMQziwIk2PN+V0MLGQpmX5FF47Zmprtzvu52QN2f5rnKq2HSfBG0i
+FqZ8/iAEnUsCngVObHaASPxXq1AKiy3iEJaLDjFhGbQk9mbj9o/RHb0kyorI3d90PU8ss8xNsUnm
+pXa4sQIDAQABo1AwTjAMBgNVHRMEBTADAQH/MB0GA1UdDgQWBBRXxQfB1H79Hq56Ld1GUrRRfzWo
+ojAfBgNVHSMEGDAWgBRXxQfB1H79Hq56Ld1GUrRRfzWoojANBgkqhkiG9w0BAQsFAAOCAgEARATw
+47mgvvLpdLTPzjORUSLBWXS2WdH43o9tPBNOaLBVRWiua2OyMp8F+nbxm4y/3djGuXsn5S2F12jp
+7xQZcBU4c21vF/ttio/spnnkPBnf0nKndTLoKt4Tpcxq4vnyqyXlBJHIybh+bbc6HVTYM6n8k4vw
+KReUjEjCXAxZ8vWjTgSOAtDrHkaez3tOkACMFmRv+JP1zNG32chLG+8K0/pyLsnknloPAk02Btoc
+t7FI4XKtS/9Z9oipMHfWg8fjI4vRXqiiAR4ctf9EgxcwHY/KVX8RJxsAXMgl65e7qGagbfTWCbHl
+MnRnapjLKkvJKPiIbBx/xdgUoOxdugwL6XPfzg4THQzAiduCgxkDs/H3SQWem6VBZ57KSuudJsop
+s5hb7GS2Hqb5F3YHAlSGQxvj37mDTzbuTH3paqzPwSgnqw0jnkGl//f2osw/mqfD5msDLk4UcmpQ
+IeC10ofhF7hzaZOGwMg8VGzsMR5M154haxj6Y2NFEir6ylz/stPrelkwDvMIDgIororj2Bj7TkWu
++EABNAr8h9yTsJEvxayNMk96U+Rn2LKMZilJdf00SILpr6IFTD8uvRwLIHSCjSbd9C8kkAqbqKs4
+VCg5HPLHjxyXgWOAK1IeqqnryaFPjLqa2RsG6UL+UtIjC6eWMsWOfvRRrpTU21mo2Koc0MI=
+-----END CERTIFICATE-----
diff --git a/recorder/sepolicy/product/private/google_recorder_app.te b/recorder/sepolicy/product/private/google_recorder_app.te
new file mode 100644
index 0000000..ac308aa
--- /dev/null
+++ b/recorder/sepolicy/product/private/google_recorder_app.te
@@ -0,0 +1,16 @@
+app_domain(google_recorder_app)
+net_domain(google_recorder_app)
+
+get_prop(google_recorder_app, graphics_config_writable_prop)
+
+allow google_recorder_app app_api_service:service_manager find;
+allow google_recorder_app audioserver_service:service_manager find;
+allow google_recorder_app mediaextractor_service:service_manager find;
+allow google_recorder_app mediametrics_service:service_manager find;
+allow google_recorder_app mediaserver_service:service_manager find;
+
+allow google_recorder_app privapp_data_file:lnk_file r_file_perms;
+allow google_recorder_app privapp_data_file:file execute;
+
+# Library code may try to access default properties, but should be denied
+dontaudit google_recorder_app default_prop:file read;
diff --git a/recorder/sepolicy/product/private/keys.conf b/recorder/sepolicy/product/private/keys.conf
new file mode 100644
index 0000000..9dad2f5
--- /dev/null
+++ b/recorder/sepolicy/product/private/keys.conf
@@ -0,0 +1,2 @@
+[@GOOGLERECORDER]
+ALL : device/google/gs-common/recorder/sepolicy/product/private/certs/com_google_android_apps_recorder.x509.pem
diff --git a/recorder/sepolicy/product/private/mac_permissions.xml b/recorder/sepolicy/product/private/mac_permissions.xml
new file mode 100644
index 0000000..b1d21bf
--- /dev/null
+++ b/recorder/sepolicy/product/private/mac_permissions.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<policy>
+
+<!--
+
+    * A signature is a hex encoded X.509 certificate or a tag defined in
+      keys.conf and is required for each signer tag.
+    * A signer tag may contain a seinfo tag and multiple package stanzas.
+    * A default tag is allowed that can contain policy for all apps not signed with a
+      previously listed cert. It may not contain any inner package stanzas.
+    * Each signer/default/package tag is allowed to contain one seinfo tag. This tag
+      represents additional info that each app can use in setting a SELinux security
+      context on the eventual process.
+    * When a package is installed the following logic is used to determine what seinfo
+      value, if any, is assigned.
+      - All signatures used to sign the app are checked first.
+      - If a signer stanza has inner package stanzas, those stanza will be checked
+        to try and match the package name of the app. If the package name matches
+        then that seinfo tag is used. If no inner package matches then the outer
+        seinfo tag is assigned.
+      - The default tag is consulted last if needed.
+-->
+    <!-- Google Recorder app key -->
+    <signer signature="@GOOGLERECORDER" >
+      <seinfo value="GoogleRecorder" />
+    </signer>
+</policy>
diff --git a/recorder/sepolicy/product/private/seapp_contexts b/recorder/sepolicy/product/private/seapp_contexts
new file mode 100644
index 0000000..f264927
--- /dev/null
+++ b/recorder/sepolicy/product/private/seapp_contexts
@@ -0,0 +1,2 @@
+# Google Recorder
+user=_app isPrivApp=true seinfo=GoogleRecorder name=com.google.android.apps.recorder domain=google_recorder_app type=app_data_file levelFrom=all
diff --git a/recorder/sepolicy/product/public/google_recorder_app.te b/recorder/sepolicy/product/public/google_recorder_app.te
new file mode 100644
index 0000000..b718e12
--- /dev/null
+++ b/recorder/sepolicy/product/public/google_recorder_app.te
@@ -0,0 +1 @@
+type google_recorder_app, domain;
diff --git a/recorder/sepolicy/vendor/google_recorder_app.te b/recorder/sepolicy/vendor/google_recorder_app.te
new file mode 100644
index 0000000..e140678
--- /dev/null
+++ b/recorder/sepolicy/vendor/google_recorder_app.te
@@ -0,0 +1 @@
+get_prop(google_recorder_app, vendor_audio_prop_restricted)
diff --git a/sensors/sepolicy/hal_sensors_default.te b/sensors/sepolicy/hal_sensors_default.te
index 1d152d4..846b016 100644
--- a/sensors/sepolicy/hal_sensors_default.te
+++ b/sensors/sepolicy/hal_sensors_default.te
@@ -60,6 +60,14 @@
 
 # Allow access to CHRE socket to connect to nanoapps.
 unix_socket_connect(hal_sensors_default, chre, chre)
+## TODO(b/248615564): Remove above rule after CHRE multiclient HAL is launched.
+unix_socket_connect(hal_sensors_default, chre, hal_contexthub_default)
+
+# Allow access to CHRE multiclient HAL.
+get_prop(hal_sensors_default, vendor_chre_hal_prop)
+binder_call(hal_sensors_default, hal_contexthub_default)
+allow hal_sensors_default hal_contexthub_service:service_manager find;
+
 
 # Allow access to the power supply files for MagCC.
 r_dir_file(hal_sensors_default, sysfs_batteryinfo)
diff --git a/sota_app/factoryota-watch.mk b/sota_app/factoryota-watch.mk
new file mode 100644
index 0000000..3107a1c
--- /dev/null
+++ b/sota_app/factoryota-watch.mk
@@ -0,0 +1,4 @@
+PRODUCT_PACKAGES += \
+    FactoryOtaWearPrebuilt
+
+SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/sota_app/sepolicy/system_ext
diff --git a/storage/init.storage.rc b/storage/init.storage.rc
index 56e8e4f..9cad2ea 100644
--- a/storage/init.storage.rc
+++ b/storage/init.storage.rc
@@ -1,3 +1,63 @@
 on property:ro.build.type=userdebug
     write /dev/sys/block/bootdevice/pixel/enable_pixel_ufs_logging 1
     chown system /dev/sg3
+
+on default_storage_mode
+    # F2FS
+    write /dev/sys/fs/by-name/userdata/data_io_flag 8
+    write /dev/sys/fs/by-name/userdata/node_io_flag 8
+    write /dev/sys/fs/by-name/userdata/max_io_bytes 524288
+    write /dev/sys/fs/by-name/userdata/min_hot_blocks 0
+
+    # Block
+    write /dev/sys/block/by-name/rootdisk/queue/iostats 1
+    write /dev/sys/block/by-name/rootdisk/queue/nr_requests 128
+    write /dev/sys/block/by-name/rootdisk/queue/rq_affinity 2
+    write /dev/sys/block/by-name/zoned_device/queue/rq_affinity 2
+
+    # UFS
+    write /dev/sys/block/bootdevice/clkgate_enable 1
+
+on init
+    # Symlink /dev/sys/block/bootdevice
+    wait /dev/block/platform/${ro.boot.boot_devices}
+    symlink /dev/block/platform/${ro.boot.boot_devices} /dev/block/bootdevice
+    symlink /sys/devices/platform/${ro.boot.boot_devices} /dev/sys/block/bootdevice
+
+    # F2FS
+    write /dev/sys/fs/by-name/userdata/data_io_flag 56
+    write /dev/sys/fs/by-name/userdata/node_io_flag 56
+
+    # Block
+    write /dev/sys/block/by-name/rootdisk/queue/iostats 0
+    write /dev/sys/block/by-name/rootdisk/queue/nr_requests 256
+
+    # UFS
+    write /dev/sys/block/bootdevice/clkgate_enable 0
+
+on property:sys.boot_completed=1
+    # Health Storage HAL
+    chown system system /dev/sys/block/bootdevice/manual_gc
+
+    # Pixelstats
+    chown system system /dev/sys/block/bootdevice/slowio_read_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_sync_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_unmap_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_write_cnt
+
+    chown system system /dev/sys/fs/by-name/userdata/committed_atomic_block
+    chown system system /dev/sys/fs/by-name/userdata/compr_new_inode
+    chown system system /dev/sys/fs/by-name/userdata/compr_saved_block
+    chown system system /dev/sys/fs/by-name/userdata/compr_written_block
+    chown system system /dev/sys/fs/by-name/userdata/gc_reclaimed_segments
+    chown system system /dev/sys/fs/by-name/userdata/gc_segment_mode
+    chown system system /dev/sys/fs/by-name/userdata/peak_atomic_write
+    chown system system /dev/sys/fs/by-name/userdata/revoked_atomic_block
+
+    trigger default_storage_mode
+
+on charger
+    trigger default_storage_mode
+
+on property:ro.boot.mode=charger && property:init.svc.vendor.charger=running
+    trigger default_storage_mode
diff --git a/storage/sepolicy/device.te b/storage/sepolicy/device.te
new file mode 100644
index 0000000..e0968f9
--- /dev/null
+++ b/storage/sepolicy/device.te
@@ -0,0 +1,2 @@
+# Userdata Exp block device.
+type userdata_exp_block_device, dev_type;
diff --git a/storage/sepolicy/e2fs.te b/storage/sepolicy/e2fs.te
new file mode 100644
index 0000000..c280cb7
--- /dev/null
+++ b/storage/sepolicy/e2fs.te
@@ -0,0 +1 @@
+allow e2fs userdata_exp_block_device:blk_file rw_file_perms;
diff --git a/storage/sepolicy/file_contexts b/storage/sepolicy/file_contexts
index ecca954..ff863db 100644
--- a/storage/sepolicy/file_contexts
+++ b/storage/sepolicy/file_contexts
@@ -3,3 +3,4 @@
 /dev/sg[0-9]                       u:object_r:sg_device:s0
 /data/vendor/storage(/.*)?         u:object_r:dump_storage_data_file:s0
 /vendor/bin/sg_read_buffer         u:object_r:sg_util_exec:s0
+/dev/block/by-name/userdata_exp.*  u:object_r:userdata_exp_block_device:s0
diff --git a/storage/sepolicy/fsck.te b/storage/sepolicy/fsck.te
new file mode 100644
index 0000000..2043199
--- /dev/null
+++ b/storage/sepolicy/fsck.te
@@ -0,0 +1 @@
+allow fsck userdata_exp_block_device:blk_file rw_file_perms;
diff --git a/storage/sepolicy/vold.te b/storage/sepolicy/vold.te
index 1d743b5..3d35589 100644
--- a/storage/sepolicy/vold.te
+++ b/storage/sepolicy/vold.te
@@ -1,4 +1,8 @@
 allow vold sysfs_scsi_devices_0000:file rw_file_perms;
 
+# Access userdata_exp block device.
+allow vold userdata_exp_block_device:blk_file rw_file_perms;
+allowxperm vold userdata_exp_block_device:blk_file ioctl BLKSECDISCARD;
+
 dontaudit vold dumpstate:fifo_file rw_file_perms;
 dontaudit vold dumpstate:fd use ;
diff --git a/thermal/OWNERS b/thermal/OWNERS
new file mode 100644
index 0000000..5538b5f
--- /dev/null
+++ b/thermal/OWNERS
@@ -0,0 +1 @@
+include platform/hardware/google/pixel:/thermal/OWNERS
diff --git a/thermal/dump/dump_thermal.sh b/thermal/dump/dump_thermal.sh
index 288d34d..bd3aad9 100644
--- a/thermal/dump/dump_thermal.sh
+++ b/thermal/dump/dump_thermal.sh
@@ -34,6 +34,8 @@
 
 echo 'TMU state:'
 cat /sys/module/gs_thermal/parameters/tmu_reg_dump_state
+echo 'TMU intpend:'
+cat /sys/module/gs_thermal/parameters/tmu_reg_dump_intpend
 echo 'TMU current temperature:'
 cat /sys/module/gs_thermal/parameters/tmu_reg_dump_current_temp
 echo 'TMU_TOP rise thresholds:'
diff --git a/thermal/dump/thermal.mk b/thermal/dump/thermal.mk
index 03b1dfa..4bb0344 100644
--- a/thermal/dump/thermal.mk
+++ b/thermal/dump/thermal.mk
@@ -1,3 +1,3 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/thermal/sepolicy/dump
 
-PRODUCT_PACKAGES += dump/dump_thermal.sh
+PRODUCT_PACKAGES += dump_thermal.sh
diff --git a/thermal/sepolicy/thermal_hal/hal_thermal_default.te b/thermal/sepolicy/thermal_hal/hal_thermal_default.te
index 45ccf3a..41a0f5e 100644
--- a/thermal/sepolicy/thermal_hal/hal_thermal_default.te
+++ b/thermal/sepolicy/thermal_hal/hal_thermal_default.te
@@ -5,6 +5,7 @@
 allow hal_thermal_default proc_stat:file r_file_perms;
 allow hal_thermal_default self:netlink_generic_socket create_socket_perms_no_ioctl;
 allow hal_thermal_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+allow hal_thermal_default sysfs_gpu:file r_file_perms;
 
 hal_client_domain(hal_thermal_default, hal_power);
 
diff --git a/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te b/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te
index a6430f1..df699fc 100644
--- a/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te
+++ b/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te
@@ -9,5 +9,5 @@
   allow pixel-thermal-control-sh sysfs_thermal:file rw_file_perms;
   allow pixel-thermal-control-sh sysfs_thermal:lnk_file r_file_perms;
   allow pixel-thermal-control-sh thermal_link_device:dir r_dir_perms;
-  get_prop(pixel-thermal-control-sh, vendor_thermal_prop)
+  set_prop(pixel-thermal-control-sh, vendor_thermal_prop)
 ')
diff --git a/touch/gti/Android.bp b/touch/gti/Android.bp
index c066d0d..d22a5a4 100644
--- a/touch/gti/Android.bp
+++ b/touch/gti/Android.bp
@@ -17,3 +17,35 @@
     vendor: true,
     sub_dir: "dump",
 }
+
+cc_binary {
+    name: "touch_gti_ical",
+    srcs: ["touch_gti_ical.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libcutils",
+        "liblog",
+    ],
+    vendor: true,
+}
+
+sh_binary {
+    name: "predump_gti0.sh",
+    src: "dump_gti0.sh",
+    init_rc: ["init.touch.gti0.rc"],
+    vendor: true,
+    sub_dir: "dump_touch",
+}
+
+sh_binary {
+    name: "predump_gti1.sh",
+    src: "dump_gti1.sh",
+    init_rc: ["init.touch.gti1.rc"],
+    vendor: true,
+    sub_dir: "dump_touch",
+}
diff --git a/touch/gti/gti.mk b/touch/gti/gti.mk
index 171534f..2aab821 100644
--- a/touch/gti/gti.mk
+++ b/touch/gti/gti.mk
@@ -1,3 +1,5 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/sepolicy
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/ical/sepolicy
 
 PRODUCT_PACKAGES += dump_gti0.sh
+PRODUCT_PACKAGES += touch_gti_ical
diff --git a/touch/gti/gti_dual.mk b/touch/gti/gti_dual.mk
index f56645d..d6b7602 100644
--- a/touch/gti/gti_dual.mk
+++ b/touch/gti/gti_dual.mk
@@ -1,5 +1,6 @@
 include device/google/gs-common/touch/gti/gti.mk
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/sepolicy_gti_dual
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/ical/sepolicy_gti_dual
 
 PRODUCT_PACKAGES += dump_gti1.sh
diff --git a/touch/gti/ical/sepolicy/file_contexts b/touch/gti/ical/sepolicy/file_contexts
new file mode 100644
index 0000000..9bd59c3
--- /dev/null
+++ b/touch/gti/ical/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/touch_gti_ical          u:object_r:gti_ical_exec:s0
diff --git a/touch/gti/ical/sepolicy/gti_ical.te b/touch/gti/ical/sepolicy/gti_ical.te
new file mode 100644
index 0000000..228782c
--- /dev/null
+++ b/touch/gti/ical/sepolicy/gti_ical.te
@@ -0,0 +1,8 @@
+type gti_ical, domain;
+type gti_ical_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(gti_ical)
+
+allow gti_ical sysfs_touch_gti:file rw_file_perms;
+allow gti_ical sysfs_touch_gti:dir search;
+
+set_prop(gti_ical, vendor_gti_prop)
diff --git a/touch/gti/ical/sepolicy/property.te b/touch/gti/ical/sepolicy/property.te
new file mode 100644
index 0000000..2a71d74
--- /dev/null
+++ b/touch/gti/ical/sepolicy/property.te
@@ -0,0 +1 @@
+system_public_prop(vendor_gti_prop)
diff --git a/touch/gti/ical/sepolicy/property_contexts b/touch/gti/ical/sepolicy/property_contexts
new file mode 100644
index 0000000..e3badcd
--- /dev/null
+++ b/touch/gti/ical/sepolicy/property_contexts
@@ -0,0 +1 @@
+vendor.touch.gti0.     u:object_r:vendor_gti_prop:s0
diff --git a/touch/gti/ical/sepolicy/vendor_init.te b/touch/gti/ical/sepolicy/vendor_init.te
new file mode 100644
index 0000000..ed0ebda
--- /dev/null
+++ b/touch/gti/ical/sepolicy/vendor_init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, vendor_gti_prop)
diff --git a/touch/gti/ical/sepolicy_gti_dual/property_contexts b/touch/gti/ical/sepolicy_gti_dual/property_contexts
new file mode 100644
index 0000000..c3530ff
--- /dev/null
+++ b/touch/gti/ical/sepolicy_gti_dual/property_contexts
@@ -0,0 +1 @@
+vendor.touch.gti1.     u:object_r:vendor_gti_prop:s0
diff --git a/touch/gti/init.touch.gti0.rc b/touch/gti/init.touch.gti0.rc
index 70c6ced..5f8318e 100644
--- a/touch/gti/init.touch.gti0.rc
+++ b/touch/gti/init.touch.gti0.rc
@@ -1,4 +1,4 @@
-on property:vendor.device.modules.ready=1
+on property:sys.boot_completed=1
     # Sysfs
     chown system system /sys/devices/virtual/goog_touch_interface/gti.0/force_active
     chown system system /sys/devices/virtual/goog_touch_interface/gti.0/fw_ver
@@ -24,3 +24,15 @@
     chown system system /proc/goog_touch_interface/gti.0/ss_base
     chown system system /proc/goog_touch_interface/gti.0/ss_diff
     chown system system /proc/goog_touch_interface/gti.0/ss_raw
+
+on property:vendor.touch.gti0.ical=*
+    setprop vendor.touch.gti0.ical.state init
+    start touch_gti0_ical
+    wait_for_prop vendor.touch.gti0.ical.state done
+
+service touch_gti0_ical /vendor/bin/touch_gti_ical 0 ${vendor.touch.gti0.ical}
+    class main
+    user system
+    group system shell
+    disabled
+    oneshot
diff --git a/touch/gti/init.touch.gti1.rc b/touch/gti/init.touch.gti1.rc
index 15de6a1..ba99210 100644
--- a/touch/gti/init.touch.gti1.rc
+++ b/touch/gti/init.touch.gti1.rc
@@ -1,4 +1,4 @@
-on property:vendor.device.modules.ready=1
+on property:sys.boot_completed=1
     # Sysfs
     chown system system /sys/devices/virtual/goog_touch_interface/gti.1/force_active
     chown system system /sys/devices/virtual/goog_touch_interface/gti.1/fw_ver
@@ -24,3 +24,15 @@
     chown system system /proc/goog_touch_interface/gti.1/ss_base
     chown system system /proc/goog_touch_interface/gti.1/ss_diff
     chown system system /proc/goog_touch_interface/gti.1/ss_raw
+
+on property:vendor.touch.gti1.ical=*
+    setprop vendor.touch.gti1.ical.state init
+    start touch_gti1_ical
+    wait_for_prop vendor.touch.gti1.ical.state done
+
+service touch_gti1_ical /vendor/bin/touch_gti_ical 1 ${vendor.touch.gti1.ical}
+    class main
+    user system
+    group system shell
+    disabled
+    oneshot
diff --git a/touch/gti/predump_gti.mk b/touch/gti/predump_gti.mk
new file mode 100644
index 0000000..ae25254
--- /dev/null
+++ b/touch/gti/predump_gti.mk
@@ -0,0 +1,7 @@
+include device/google/gs-common/touch/predump/predump_touch.mk
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/predump_sepolicy
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/ical/sepolicy
+
+PRODUCT_PACKAGES += predump_gti0.sh
+PRODUCT_PACKAGES += touch_gti_ical
diff --git a/touch/gti/predump_gti_dual.mk b/touch/gti/predump_gti_dual.mk
new file mode 100644
index 0000000..b7f2efc
--- /dev/null
+++ b/touch/gti/predump_gti_dual.mk
@@ -0,0 +1,6 @@
+include device/google/gs-common/touch/gti/predump_gti.mk
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/predump_sepolicy_gti_dual
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/gti/ical/sepolicy_gti_dual
+
+PRODUCT_PACKAGES += predump_gti1.sh
diff --git a/touch/gti/predump_sepolicy/file.te b/touch/gti/predump_sepolicy/file.te
new file mode 100644
index 0000000..c3900f0
--- /dev/null
+++ b/touch/gti/predump_sepolicy/file.te
@@ -0,0 +1,3 @@
+type proc_touch_gti, proc_type, fs_type;
+type sysfs_touch_gti, sysfs_type, fs_type;
+
diff --git a/touch/gti/predump_sepolicy/file_contexts b/touch/gti/predump_sepolicy/file_contexts
new file mode 100644
index 0000000..6d8ca17
--- /dev/null
+++ b/touch/gti/predump_sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/dump_touch/predump_gti0\.sh      u:object_r:predump_touch_exec:s0
diff --git a/touch/gti/predump_sepolicy/genfs_contexts b/touch/gti/predump_sepolicy/genfs_contexts
new file mode 100644
index 0000000..45d3b53
--- /dev/null
+++ b/touch/gti/predump_sepolicy/genfs_contexts
@@ -0,0 +1,4 @@
+# Touch
+genfscon sysfs /devices/virtual/goog_touch_interface                            u:object_r:sysfs_touch_gti:s0
+genfscon proc  /goog_touch_interface                                            u:object_r:proc_touch_gti:s0
+
diff --git a/touch/gti/predump_sepolicy/predump_touch.te b/touch/gti/predump_sepolicy/predump_touch.te
new file mode 100644
index 0000000..7c1f408
--- /dev/null
+++ b/touch/gti/predump_sepolicy/predump_touch.te
@@ -0,0 +1,4 @@
+allow predump_touch proc_touch_gti:dir r_dir_perms;
+allow predump_touch proc_touch_gti:file rw_file_perms;
+allow predump_touch sysfs_touch_gti:dir r_dir_perms;
+allow predump_touch sysfs_touch_gti:file rw_file_perms;
\ No newline at end of file
diff --git a/touch/gti/predump_sepolicy_gti_dual/file_contexts b/touch/gti/predump_sepolicy_gti_dual/file_contexts
new file mode 100644
index 0000000..02a300a
--- /dev/null
+++ b/touch/gti/predump_sepolicy_gti_dual/file_contexts
@@ -0,0 +1,2 @@
+/vendor/bin/dump_touch/predump_gti1\.sh     u:object_r:predump_touch_exec:s0
+
diff --git a/touch/gti/sepolicy/file_contexts b/touch/gti/sepolicy/file_contexts
index 5c429b7..2fce7f5 100644
--- a/touch/gti/sepolicy/file_contexts
+++ b/touch/gti/sepolicy/file_contexts
@@ -1,2 +1 @@
 /vendor/bin/dump/dump_gti0\.sh      u:object_r:dump_gti_exec:s0
-
diff --git a/touch/gti/touch_gti_ical.cpp b/touch/gti/touch_gti_ical.cpp
new file mode 100644
index 0000000..9b5eed5
--- /dev/null
+++ b/touch/gti/touch_gti_ical.cpp
@@ -0,0 +1,141 @@
+/*
+ ** Copyright 2024, The Android Open Source Project
+ **
+ ** Licensed under the Apache License, Version 2.0 (the "License");
+ ** you may not use this file except in compliance with the License.
+ ** You may obtain a copy of the License at
+ **
+ **     http://www.apache.org/licenses/LICENSE-2.0
+ **
+ ** Unless required by applicable law or agreed to in writing, software
+ ** distributed under the License is distributed on an "AS IS" BASIS,
+ ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ ** See the License for the specific language governing permissions and
+ ** limitations under the License.
+ */
+#define LOG_TAG "touch_gti_ical"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#ifdef __ANDROID__
+#include <cutils/properties.h>
+#include <cutils/log.h>
+#else
+#define property_set
+#define property_get
+#define ALOGI printf
+#define ALOGW printf
+#endif
+
+int main(int argc, char *argv[])
+{
+	char *line = NULL;
+	size_t len = 0;
+	FILE *ical_fd;
+	const char *ical_override_cmd_prop[2] = {
+		[0] = "vendor.touch.gti0.ical.override.cmd",
+		[1] = "vendor.touch.gti1.ical.override.cmd",
+	};
+	const char *ical_override_result_prop[2] = {
+		[0] = "vendor.touch.gti0.ical.override.result",
+		[1] = "vendor.touch.gti1.ical.override.result",
+	};
+	const char *ical_write_history_prop[2] = {
+		[0] = "vendor.touch.gti0.ical.write.history",
+		[1] = "vendor.touch.gti1.ical.write.history",
+	};
+	const char *ical_state_prop[2] = {
+		[0] = "vendor.touch.gti0.ical.state",
+		[1] = "vendor.touch.gti1.ical.state",
+	};
+	const char *ical_result_prop[2] = {
+		[0] = "vendor.touch.gti0.ical.result",
+		[1] = "vendor.touch.gti1.ical.result",
+	};
+	const char *ical_sysfs[2] = {
+		[0] = "/sys/devices/virtual/goog_touch_interface/gti.0/interactive_calibrate",
+		[1] = "/sys/devices/virtual/goog_touch_interface/gti.1/interactive_calibrate",
+	};
+	const char *ical_override_cmd_prop_path = ical_override_cmd_prop[0];
+	const char *ical_override_result_prop_path = ical_override_result_prop[0];
+	const char *ical_write_history_prop_path = ical_write_history_prop[0];
+	const char *ical_state_prop_path = ical_state_prop[0];
+	const char *ical_result_prop_path = ical_result_prop[0];
+	const char *ical_sysfs_path = ical_sysfs[0];
+	const char ical_override_all_cmd_prop_val[PROPERTY_VALUE_MAX] = "xxx";
+	char ical_override_cmd_prop_val[PROPERTY_VALUE_MAX] = "\0";
+	char ical_override_result_prop_val[PROPERTY_VALUE_MAX] = "\0";
+	char ical_write_history_prop_val[PROPERTY_VALUE_MAX] = "\0";
+
+	if (argc < 3) {
+		ALOGW("No target dev or command for interactive_calibrate sysfs.\n");
+		property_set(ical_state_prop[0], "done");
+		property_set(ical_state_prop[1], "done");
+		return 0;
+	}
+
+	if (strncmp(argv[1], "1", strlen(argv[1])) == 0 ||
+		strncmp(argv[1], "gti1", strlen(argv[1])) == 0 ||
+		strncmp(argv[1], "gti.1", strlen(argv[1])) == 0) {
+		ical_override_cmd_prop_path = ical_override_cmd_prop[1];
+		ical_override_result_prop_path = ical_override_result_prop[1];
+		ical_write_history_prop_path = ical_write_history_prop[1];
+		ical_state_prop_path = ical_state_prop[1];
+		ical_result_prop_path = ical_result_prop[1];
+		ical_sysfs_path = ical_sysfs[1];
+	}
+
+	property_get(ical_override_cmd_prop_path, ical_override_cmd_prop_val, NULL);
+	property_get(ical_override_result_prop_path, ical_override_result_prop_val, "0 - -2147483648");
+	property_get(ical_write_history_prop_path, ical_write_history_prop_val, NULL);
+
+	property_set(ical_result_prop_path, "na");
+	property_set(ical_state_prop_path, "running");
+	if (access(ical_sysfs_path, F_OK | R_OK | W_OK)) {
+		ALOGW("Can't access %s\n", ical_sysfs_path);
+		property_set(ical_state_prop_path, "done");
+		return 0;
+	}
+
+	ical_fd = fopen(ical_sysfs_path, "r+");
+	if (ical_fd == NULL) {
+		ALOGW("Can't fopen %s\n", ical_sysfs_path);
+		property_set(ical_state_prop_path, "done");
+		return 0;
+	}
+
+	if (strncmp(argv[2], "read", strlen(argv[2])) == 0) {
+		getline(&line, &len, ical_fd);
+		if (line != NULL) {
+			property_set(ical_state_prop_path, "read");
+			if (strncmp(ical_override_cmd_prop_val,
+					ical_write_history_prop_val,
+					strlen(ical_write_history_prop_path)) == 0 ||
+				strncasecmp(ical_override_cmd_prop_val,
+					ical_override_all_cmd_prop_val,
+					strlen(ical_override_all_cmd_prop_val)) == 0) {
+				property_set(ical_result_prop_path, ical_override_result_prop_val);
+				ALOGW("read(original): %s => %s",
+					ical_sysfs_path, line);
+				ALOGW("read(override): %s => %s",
+					ical_sysfs_path, ical_override_result_prop_val);
+			} else {
+				property_set(ical_result_prop_path, line);
+				ALOGI("read: %s => %s", ical_sysfs_path, line);
+			}
+			free(line);
+		}
+	} else {
+		property_set(ical_write_history_prop_path, argv[2]);
+		property_set(ical_state_prop_path, argv[2]);
+		fwrite(argv[2], 1, strlen(argv[2]), ical_fd);
+		ALOGI("write: %s => %s\n", argv[2], ical_sysfs_path);
+	}
+	property_set(ical_state_prop_path, "done");
+
+	fclose(ical_fd);
+	return 0;
+}
+
diff --git a/touch/predump/Android.bp b/touch/predump/Android.bp
new file mode 100644
index 0000000..7d2adda
--- /dev/null
+++ b/touch/predump/Android.bp
@@ -0,0 +1,17 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+sh_binary {
+    name: "predump_touch.sh",
+    src: "predump_touch.sh",
+    init_rc: ["init.touch.predump.rc"],
+    vendor: true,
+}
+
+sh_binary {
+    name: "dump_touch.sh",
+    src: "dump_touch.sh",
+    vendor: true,
+    sub_dir: "dump",
+}
diff --git a/touch/predump/dump_touch.sh b/touch/predump/dump_touch.sh
new file mode 100644
index 0000000..889c283
--- /dev/null
+++ b/touch/predump/dump_touch.sh
@@ -0,0 +1,25 @@
+#!/vendor/bin/sh
+
+DIR=/data/vendor/dump_touch
+LOCKFILE="$DIR"/dumping
+LOGFILE="$DIR"/dump.log
+
+if [ ! -f $LOCKFILE ]
+then
+	echo "-----------------------------------------------------"
+	echo "Error : PreDump Touch Logs couldn't be found."
+	echo "-----------------------------------------------------"
+	exit 2
+fi
+
+state=$(cat $LOCKFILE)
+if [ "$state" != 2 ]
+then
+  echo "Unexpected state! Expected 2 but found ${state}" >> $LOGFILE
+fi
+
+cat $LOGFILE
+echo "" > $LOGFILE
+
+echo 0 > $LOCKFILE
+
diff --git a/touch/predump/init.touch.predump.rc b/touch/predump/init.touch.predump.rc
new file mode 100644
index 0000000..aa93c82
--- /dev/null
+++ b/touch/predump/init.touch.predump.rc
@@ -0,0 +1,12 @@
+service vendor.touch_dumpstate /vendor/bin/predump_touch.sh
+    class main
+    user system
+    group system shell
+    disabled
+    oneshot
+
+on post-fs-data
+    mkdir /data/vendor/dump_touch 0775 system system
+
+on property:init.svc.dumpstatez=running
+    start vendor.touch_dumpstate
diff --git a/touch/predump/predump_touch.mk b/touch/predump/predump_touch.mk
new file mode 100644
index 0000000..1a6efb2
--- /dev/null
+++ b/touch/predump/predump_touch.mk
@@ -0,0 +1,4 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/predump/sepolicy
+
+PRODUCT_PACKAGES += predump_touch.sh
+PRODUCT_PACKAGES += dump_touch.sh
diff --git a/touch/predump/predump_touch.sh b/touch/predump/predump_touch.sh
new file mode 100644
index 0000000..6a0c738
--- /dev/null
+++ b/touch/predump/predump_touch.sh
@@ -0,0 +1,44 @@
+#!/vendor/bin/sh
+
+DIR=/data/vendor/dump_touch
+SCRIPT_DIR=/vendor/bin/dump_touch
+LOCKFILE="$DIR"/dumping
+LOGFILE="$DIR"/dump.log
+
+if [ ! -f $LOCKFILE ]
+then
+#Init Setup
+  echo 0 > $LOCKFILE
+  echo "" > $LOGFILE
+  chmod 660 $LOCKFILE
+  chmod 660 $LOGFILE
+fi
+
+echo $(date) >> $LOGFILE
+
+state=$(cat $LOCKFILE)
+if [ "$state" != 0 ]
+then
+  echo "Unexpected state! Expected 0 but found ${state}" >> $LOGFILE
+fi
+
+echo 1 > $LOCKFILE
+
+for entry in "$SCRIPT_DIR"/*.sh
+do
+  echo "----------------------------------" >> $LOGFILE
+  echo "$entry" >> $LOGFILE
+  echo "----------------------------------" >> $LOGFILE
+  sh $entry >> $LOGFILE
+  echo "----------------------------------" >> $LOGFILE
+done
+
+state=$(cat $LOCKFILE)
+if [ "$state" != 1 ]
+then
+  echo "Unexpected state! Expected 1 but found ${state}" >> $LOGFILE
+fi
+
+echo 2 > $LOCKFILE
+
+
diff --git a/touch/predump/sepolicy/dump_touch.te b/touch/predump/sepolicy/dump_touch.te
new file mode 100644
index 0000000..d383882
--- /dev/null
+++ b/touch/predump/sepolicy/dump_touch.te
@@ -0,0 +1,5 @@
+pixel_bugreport(dump_touch)
+
+allow dump_touch vendor_touch_dump_file:dir r_dir_perms;
+allow dump_touch vendor_touch_dump_file:file rw_file_perms;
+allow dump_touch vendor_toolbox_exec:file execute_no_trans;
diff --git a/touch/predump/sepolicy/file.te b/touch/predump/sepolicy/file.te
new file mode 100644
index 0000000..9be89f1
--- /dev/null
+++ b/touch/predump/sepolicy/file.te
@@ -0,0 +1 @@
+type vendor_touch_dump_file, file_type, data_file_type;
diff --git a/touch/predump/sepolicy/file_contexts b/touch/predump/sepolicy/file_contexts
new file mode 100644
index 0000000..0a1ef36
--- /dev/null
+++ b/touch/predump/sepolicy/file_contexts
@@ -0,0 +1,5 @@
+/vendor/bin/predump_touch\.sh           u:object_r:predump_touch_exec:s0
+/vendor/bin/dump/dump_touch\.sh         u:object_r:dump_touch_exec:s0
+/data/vendor/dump_touch/dump\.log       u:object_r:vendor_touch_dump_file:s0
+/data/vendor/dump_touch/dumping         u:object_r:vendor_touch_dump_file:s0
+/data/vendor/dump_touch                 u:object_r:vendor_touch_dump_file:s0
diff --git a/touch/predump/sepolicy/predump_touch.te b/touch/predump/sepolicy/predump_touch.te
new file mode 100644
index 0000000..edf473b
--- /dev/null
+++ b/touch/predump/sepolicy/predump_touch.te
@@ -0,0 +1,9 @@
+type predump_touch, domain;
+type predump_touch_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(predump_touch)
+
+allow predump_touch vendor_touch_dump_file:dir rw_dir_perms;
+allow predump_touch vendor_touch_dump_file:file create_file_perms;
+
+allow predump_touch vendor_toolbox_exec:file execute_no_trans;
+allow predump_touch vendor_shell_exec:file execute_no_trans;
diff --git a/touch/syna/Android.bp b/touch/syna/Android.bp
index 769c76b..d34ee95 100644
--- a/touch/syna/Android.bp
+++ b/touch/syna/Android.bp
@@ -5,7 +5,15 @@
 sh_binary {
     name: "dump_syna.sh",
     src: "dump_syna.sh",
-    init_rc: ["init.touch.syna20.rc"],
+    init_rc: ["init.touch.syna.rc"],
     vendor: true,
     sub_dir: "dump",
 }
+
+sh_binary {
+    name: "predump_syna.sh",
+    src: "dump_syna.sh",
+    init_rc: ["init.touch.syna.rc"],
+    vendor: true,
+    sub_dir: "dump_touch",
+}
diff --git a/touch/syna/init.touch.syna.rc b/touch/syna/init.touch.syna.rc
new file mode 100644
index 0000000..d52ed3b
--- /dev/null
+++ b/touch/syna/init.touch.syna.rc
@@ -0,0 +1,5 @@
+on property:sys.boot_completed=1
+    chown system system /sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs/get_raw_data
+    chown system system /sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs/force_active
+    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/get_raw_data
+    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/force_active
diff --git a/touch/syna/init.touch.syna20.rc b/touch/syna/init.touch.syna20.rc
deleted file mode 100644
index 7c83a6c..0000000
--- a/touch/syna/init.touch.syna20.rc
+++ /dev/null
@@ -1,3 +0,0 @@
-on property:vendor.device.modules.ready=1
-    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/get_raw_data
-    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/force_active
diff --git a/touch/syna/predump_sepolicy/file.te b/touch/syna/predump_sepolicy/file.te
new file mode 100644
index 0000000..3e53ec3
--- /dev/null
+++ b/touch/syna/predump_sepolicy/file.te
@@ -0,0 +1,2 @@
+type sysfs_touch, sysfs_type, fs_type;
+
diff --git a/touch/syna/predump_sepolicy/file_contexts b/touch/syna/predump_sepolicy/file_contexts
new file mode 100644
index 0000000..37dec52
--- /dev/null
+++ b/touch/syna/predump_sepolicy/file_contexts
@@ -0,0 +1,2 @@
+/vendor/bin/dump_touch/predump_syna\.sh      u:object_r:predump_touch_exec:s0
+
diff --git a/touch/syna/predump_sepolicy/genfs_contexts b/touch/syna/predump_sepolicy/genfs_contexts
new file mode 100644
index 0000000..f2e675f
--- /dev/null
+++ b/touch/syna/predump_sepolicy/genfs_contexts
@@ -0,0 +1,3 @@
+genfscon sysfs /devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs     u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/111c0000.spi/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
diff --git a/touch/syna/predump_sepolicy/predump_touch.te b/touch/syna/predump_sepolicy/predump_touch.te
new file mode 100644
index 0000000..8564ec9
--- /dev/null
+++ b/touch/syna/predump_sepolicy/predump_touch.te
@@ -0,0 +1,5 @@
+
+allow predump_touch sysfs_touch:dir r_dir_perms;
+allow predump_touch sysfs_touch:file rw_file_perms;
+
+get_prop(predump_touch, vendor_touch_dump_path_prop)
diff --git a/touch/syna/predump_sepolicy/property.te b/touch/syna/predump_sepolicy/property.te
new file mode 100644
index 0000000..5484690
--- /dev/null
+++ b/touch/syna/predump_sepolicy/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_touch_dump_path_prop)
diff --git a/touch/syna/predump_sepolicy/property_contexts b/touch/syna/predump_sepolicy/property_contexts
new file mode 100644
index 0000000..524cc8b
--- /dev/null
+++ b/touch/syna/predump_sepolicy/property_contexts
@@ -0,0 +1 @@
+ro.vendor.touch.dump. u:object_r:vendor_touch_dump_path_prop:s0
diff --git a/touch/syna/predump_sepolicy/vendor_init.te b/touch/syna/predump_sepolicy/vendor_init.te
new file mode 100644
index 0000000..74a6666
--- /dev/null
+++ b/touch/syna/predump_sepolicy/vendor_init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, vendor_touch_dump_path_prop)
diff --git a/touch/syna/predump_syna19.mk b/touch/syna/predump_syna19.mk
new file mode 100644
index 0000000..e896fb7
--- /dev/null
+++ b/touch/syna/predump_syna19.mk
@@ -0,0 +1,5 @@
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/predump_sepolicy
+
+PRODUCT_PACKAGES += predump_syna.sh
diff --git a/touch/syna/predump_syna20.mk b/touch/syna/predump_syna20.mk
new file mode 100644
index 0000000..e331956
--- /dev/null
+++ b/touch/syna/predump_syna20.mk
@@ -0,0 +1,5 @@
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/predump_sepolicy
+
+PRODUCT_PACKAGES += predump_syna.sh
diff --git a/touch/syna/sepolicy/genfs_contexts b/touch/syna/sepolicy/genfs_contexts
index c34d93c..f2e675f 100644
--- a/touch/syna/sepolicy/genfs_contexts
+++ b/touch/syna/sepolicy/genfs_contexts
@@ -1,3 +1,3 @@
 genfscon sysfs /devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs     u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/111c0000.spi/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
 genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
-genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/wakeup  u:object_r:sysfs_wakeup:s0
diff --git a/touch/syna/syna0.mk b/touch/syna/syna0.mk
index fe2b0c5..9e10d2a 100644
--- a/touch/syna/syna0.mk
+++ b/touch/syna/syna0.mk
@@ -1,4 +1,4 @@
-PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
 
diff --git a/touch/syna/syna19.mk b/touch/syna/syna19.mk
new file mode 100644
index 0000000..45b053b
--- /dev/null
+++ b/touch/syna/syna19.mk
@@ -0,0 +1,5 @@
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
+
+PRODUCT_PACKAGES += dump_syna.sh
diff --git a/touch/syna/syna20.mk b/touch/syna/syna20.mk
index 600f1ff..f8c0251 100644
--- a/touch/syna/syna20.mk
+++ b/touch/syna/syna20.mk
@@ -1,4 +1,4 @@
-PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
 
diff --git a/touch/twoshay/aidl/compatibility_matrix_gs101.xml b/touch/twoshay/aidl/compatibility_matrix_gs101.xml
new file mode 100644
index 0000000..aaa2d6e
--- /dev/null
+++ b/touch/twoshay/aidl/compatibility_matrix_gs101.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>com.google.input</name>
+        <version>2-3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/touch/twoshay/aidl/compatibility_matrix_zuma.xml b/touch/twoshay/aidl/compatibility_matrix_zuma.xml
new file mode 100644
index 0000000..25d5c50
--- /dev/null
+++ b/touch/twoshay/aidl/compatibility_matrix_zuma.xml
@@ -0,0 +1,26 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>com.google.input</name>
+        <version>2-3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="true">
+        <name>com.google.input.algos.gril</name>
+        <version>2-3</version>
+        <interface>
+            <name>IGrilAntennaTuningService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="true">
+        <name>com.google.input.algos.spd</name>
+        <version>2-3</version>
+        <interface>
+            <name>IScreenProtectorDetectorService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/touch/twoshay/aidl/manifest_gs101.xml b/touch/twoshay/aidl/manifest_gs101.xml
new file mode 100644
index 0000000..28472a0
--- /dev/null
+++ b/touch/twoshay/aidl/manifest_gs101.xml
@@ -0,0 +1,10 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>com.google.input</name>
+        <version>3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/touch/twoshay/aidl/manifest_zuma.xml b/touch/twoshay/aidl/manifest_zuma.xml
new file mode 100644
index 0000000..dbac77d
--- /dev/null
+++ b/touch/twoshay/aidl/manifest_zuma.xml
@@ -0,0 +1,26 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>com.google.input</name>
+        <version>3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl">
+        <name>com.google.input.algos.gril</name>
+        <version>3</version>
+        <interface>
+            <name>IGrilAntennaTuningService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl">
+        <name>com.google.input.algos.spd</name>
+        <version>3</version>
+        <interface>
+            <name>IScreenProtectorDetectorService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/touch/twoshay/aidl_gs101.mk b/touch/twoshay/aidl_gs101.mk
new file mode 100644
index 0000000..1676cba
--- /dev/null
+++ b/touch/twoshay/aidl_gs101.mk
@@ -0,0 +1,2 @@
+DEVICE_MANIFEST_FILE += device/google/gs-common/touch/twoshay/aidl/manifest_gs101.xml
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/touch/twoshay/aidl/compatibility_matrix_gs101.xml
diff --git a/touch/twoshay/aidl_zuma.mk b/touch/twoshay/aidl_zuma.mk
new file mode 100644
index 0000000..48714fe
--- /dev/null
+++ b/touch/twoshay/aidl_zuma.mk
@@ -0,0 +1,2 @@
+DEVICE_MANIFEST_FILE += device/google/gs-common/touch/twoshay/aidl/manifest_zuma.xml
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/touch/twoshay/aidl/compatibility_matrix_zuma.xml
diff --git a/touch/twoshay/sepolicy/device.te b/touch/twoshay/sepolicy/device.te
new file mode 100644
index 0000000..d3ce622
--- /dev/null
+++ b/touch/twoshay/sepolicy/device.te
@@ -0,0 +1 @@
+type touch_offload_device, dev_type;
diff --git a/touch/twoshay/sepolicy/dumpstate.te b/touch/twoshay/sepolicy/dumpstate.te
new file mode 100644
index 0000000..90f14b8
--- /dev/null
+++ b/touch/twoshay/sepolicy/dumpstate.te
@@ -0,0 +1,2 @@
+allow dumpstate touch_context_service:service_manager find;
+binder_call(dumpstate, twoshay)
diff --git a/touch/twoshay/sepolicy/file_contexts b/touch/twoshay/sepolicy/file_contexts
new file mode 100644
index 0000000..09728be
--- /dev/null
+++ b/touch/twoshay/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+/dev/touch_offload                                                               u:object_r:touch_offload_device:s0
+/vendor/bin/twoshay                                                              u:object_r:twoshay_exec:s0
diff --git a/touch/twoshay/sepolicy/hal_dumpstate_default.te b/touch/twoshay/sepolicy/hal_dumpstate_default.te
new file mode 100644
index 0000000..81edc36
--- /dev/null
+++ b/touch/twoshay/sepolicy/hal_dumpstate_default.te
@@ -0,0 +1,2 @@
+allow hal_dumpstate_default touch_context_service:service_manager find;
+binder_call(hal_dumpstate_default, twoshay)
diff --git a/touch/twoshay/sepolicy/platform_app.te b/touch/twoshay/sepolicy/platform_app.te
new file mode 100644
index 0000000..ac997a9
--- /dev/null
+++ b/touch/twoshay/sepolicy/platform_app.te
@@ -0,0 +1,4 @@
+allow platform_app gril_antenna_tuning_service:service_manager find;
+allow platform_app screen_protector_detector_service:service_manager find;
+allow platform_app touch_context_service:service_manager find;
+binder_call(platform_app, twoshay)
diff --git a/touch/twoshay/sepolicy/service.te b/touch/twoshay/sepolicy/service.te
new file mode 100644
index 0000000..4aa064d
--- /dev/null
+++ b/touch/twoshay/sepolicy/service.te
@@ -0,0 +1,3 @@
+type gril_antenna_tuning_service, service_manager_type, hal_service_type;
+type screen_protector_detector_service, service_manager_type, hal_service_type;
+type touch_context_service, service_manager_type, hal_service_type;
diff --git a/touch/twoshay/sepolicy/service_contexts b/touch/twoshay/sepolicy/service_contexts
new file mode 100644
index 0000000..f6aa1db
--- /dev/null
+++ b/touch/twoshay/sepolicy/service_contexts
@@ -0,0 +1,3 @@
+com.google.input.ITouchContextService/default              u:object_r:touch_context_service:s0
+com.google.input.algos.gril.IGrilAntennaTuningService/default              u:object_r:gril_antenna_tuning_service:s0
+com.google.input.algos.spd.IScreenProtectorDetectorService/default u:object_r:screen_protector_detector_service:s0
diff --git a/touch/twoshay/sepolicy/twoshay.te b/touch/twoshay/sepolicy/twoshay.te
new file mode 100644
index 0000000..cd317a0
--- /dev/null
+++ b/touch/twoshay/sepolicy/twoshay.te
@@ -0,0 +1,27 @@
+type twoshay, domain;
+type twoshay_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(twoshay)
+
+allow twoshay touch_offload_device:chr_file rw_file_perms;
+allow twoshay twoshay:capability sys_nice;
+
+binder_use(twoshay)
+add_service(twoshay, gril_antenna_tuning_service)
+add_service(twoshay, screen_protector_detector_service)
+add_service(twoshay, touch_context_service)
+
+binder_call(twoshay, platform_app)
+
+allow twoshay fwk_stats_service:service_manager find;
+binder_call(twoshay, stats_service_server)
+
+# Allow dumpsys output in bugreports.
+allow twoshay dumpstate:fd use;
+allow twoshay dumpstate:fifo_file write;
+
+# b/198755236
+dontaudit twoshay twoshay:capability dac_override;
+
+# b/226830650
+dontaudit twoshay boot_status_prop:file read;
diff --git a/touch/twoshay/twoshay.mk b/touch/twoshay/twoshay.mk
new file mode 100644
index 0000000..bae0975
--- /dev/null
+++ b/touch/twoshay/twoshay.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/twoshay/sepolicy
+PRODUCT_PACKAGES += twoshay
+PRODUCT_SOONG_NAMESPACES += vendor/google/interfaces vendor/google/input/twoshay
diff --git a/trusty/rpmb_dev/rpmb_dev.mk b/trusty/rpmb_dev/rpmb_dev.mk
new file mode 100644
index 0000000..31c68ef
--- /dev/null
+++ b/trusty/rpmb_dev/rpmb_dev.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/trusty/rpmb_dev/sepolicy
+
+PRODUCT_PACKAGES += rpmb_dev
diff --git a/trusty/rpmb_dev/sepolicy/file_contexts b/trusty/rpmb_dev/sepolicy/file_contexts
new file mode 100644
index 0000000..1a44f7d
--- /dev/null
+++ b/trusty/rpmb_dev/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+# Binaries
+/vendor/bin/rpmb_dev     u:object_r:rpmb_dev_exec:s0
diff --git a/trusty/rpmb_dev/sepolicy/rpmb_dev.te b/trusty/rpmb_dev/sepolicy/rpmb_dev.te
new file mode 100644
index 0000000..0f46e03
--- /dev/null
+++ b/trusty/rpmb_dev/sepolicy/rpmb_dev.te
@@ -0,0 +1,4 @@
+type rpmb_dev, domain;
+type rpmb_dev_exec, vendor_file_type, exec_type, file_type;
+
+init_daemon_domain(rpmb_dev)
diff --git a/tts/de-de/de-de-x-multi-r45.zvoice b/tts/de-de/de-de-x-multi-r45.zvoice
deleted file mode 100644
index 9fca341..0000000
--- a/tts/de-de/de-de-x-multi-r45.zvoice
+++ /dev/null
Binary files differ
diff --git a/tts/de-de/de-de-x-multi-r51.zvoice b/tts/de-de/de-de-x-multi-r51.zvoice
new file mode 100644
index 0000000..8ca49a3
--- /dev/null
+++ b/tts/de-de/de-de-x-multi-r51.zvoice
Binary files differ
diff --git a/tts/es-es/es-es-x-multi-r45.zvoice b/tts/es-es/es-es-x-multi-r45.zvoice
deleted file mode 100644
index 2e7cb61..0000000
--- a/tts/es-es/es-es-x-multi-r45.zvoice
+++ /dev/null
Binary files differ
diff --git a/tts/es-es/es-es-x-multi-r50.zvoice b/tts/es-es/es-es-x-multi-r50.zvoice
new file mode 100644
index 0000000..b42cae9
--- /dev/null
+++ b/tts/es-es/es-es-x-multi-r50.zvoice
Binary files differ
diff --git a/tts/fr-fr/fr-fr-x-multi-r46.zvoice b/tts/fr-fr/fr-fr-x-multi-r46.zvoice
deleted file mode 100644
index 9287d91..0000000
--- a/tts/fr-fr/fr-fr-x-multi-r46.zvoice
+++ /dev/null
Binary files differ
diff --git a/tts/fr-fr/fr-fr-x-multi-r51.zvoice b/tts/fr-fr/fr-fr-x-multi-r51.zvoice
new file mode 100644
index 0000000..2e3c160
--- /dev/null
+++ b/tts/fr-fr/fr-fr-x-multi-r51.zvoice
Binary files differ
diff --git a/tts/it-it/it-it-x-multi-r42.zvoice b/tts/it-it/it-it-x-multi-r42.zvoice
deleted file mode 100644
index a794804..0000000
--- a/tts/it-it/it-it-x-multi-r42.zvoice
+++ /dev/null
Binary files differ
diff --git a/tts/it-it/it-it-x-multi-r47.zvoice b/tts/it-it/it-it-x-multi-r47.zvoice
new file mode 100644
index 0000000..78dce63
--- /dev/null
+++ b/tts/it-it/it-it-x-multi-r47.zvoice
Binary files differ
diff --git a/tts/ja-jp/ja-jp-x-multi-r44.zvoice b/tts/ja-jp/ja-jp-x-multi-r44.zvoice
deleted file mode 100644
index 0d562b2..0000000
--- a/tts/ja-jp/ja-jp-x-multi-r44.zvoice
+++ /dev/null
Binary files differ
diff --git a/tts/ja-jp/ja-jp-x-multi-r49.zvoice b/tts/ja-jp/ja-jp-x-multi-r49.zvoice
new file mode 100644
index 0000000..c2f8c80
--- /dev/null
+++ b/tts/ja-jp/ja-jp-x-multi-r49.zvoice
Binary files differ
diff --git a/tts/voice_packs.mk b/tts/voice_packs.mk
index 0bb6d1a..7b95af9 100644
--- a/tts/voice_packs.mk
+++ b/tts/voice_packs.mk
@@ -15,8 +15,8 @@
 
 # Voice packs for Text-To-Speech
 PRODUCT_COPY_FILES += \
-	device/google/gs-common/tts/ja-jp/ja-jp-x-multi-r44.zvoice:product/tts/google/ja-jp/ja-jp-x-multi-r44.zvoice\
-	device/google/gs-common/tts/fr-fr/fr-fr-x-multi-r46.zvoice:product/tts/google/fr-fr/fr-fr-x-multi-r46.zvoice\
-	device/google/gs-common/tts/de-de/de-de-x-multi-r45.zvoice:product/tts/google/de-de/de-de-x-multi-r45.zvoice\
-	device/google/gs-common/tts/it-it/it-it-x-multi-r42.zvoice:product/tts/google/it-it/it-it-x-multi-r42.zvoice\
-	device/google/gs-common/tts/es-es/es-es-x-multi-r45.zvoice:product/tts/google/es-es/es-es-x-multi-r45.zvoice
+	device/google/gs-common/tts/ja-jp/ja-jp-x-multi-r49.zvoice:product/tts/google/ja-jp/ja-jp-x-multi-r49.zvoice\
+	device/google/gs-common/tts/fr-fr/fr-fr-x-multi-r51.zvoice:product/tts/google/fr-fr/fr-fr-x-multi-r51.zvoice\
+	device/google/gs-common/tts/de-de/de-de-x-multi-r51.zvoice:product/tts/google/de-de/de-de-x-multi-r51.zvoice\
+	device/google/gs-common/tts/it-it/it-it-x-multi-r47.zvoice:product/tts/google/it-it/it-it-x-multi-r47.zvoice\
+	device/google/gs-common/tts/es-es/es-es-x-multi-r50.zvoice:product/tts/google/es-es/es-es-x-multi-r50.zvoice
diff --git a/umfw_stat/dump_umfw_stat.cpp b/umfw_stat/dump_umfw_stat.cpp
index 627144b..6c3594d 100644
--- a/umfw_stat/dump_umfw_stat.cpp
+++ b/umfw_stat/dump_umfw_stat.cpp
@@ -27,13 +27,13 @@
   // Dump AoC statistics.
   // TODO(b/272300997): Add timeouts for requests.
   runCommand("AoC A32 statistics",
-             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:1 get_all");
+             "timeout 0.5 /vendor/bin/umfw_stat_tool -s aoc:1 get_all");
   runCommand("AoC FF1 statistics",
-             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:2 get_all");
+             "timeout 0.5 /vendor/bin/umfw_stat_tool -s aoc:2 get_all");
   runCommand("AoC HF0 statistics",
-             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:3 get_all");
+             "timeout 0.5 /vendor/bin/umfw_stat_tool -s aoc:3 get_all");
   runCommand("AoC HF1 statistics",
-             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:4 get_all");
+             "timeout 0.5 /vendor/bin/umfw_stat_tool -s aoc:4 get_all");
 
   return 0;
 }
diff --git a/widevine/widevine.mk b/widevine/widevine.mk
index 420806e..c59c7b9 100644
--- a/widevine/widevine.mk
+++ b/widevine/widevine.mk
@@ -1,13 +1,4 @@
 PRODUCT_PACKAGES += \
 	android.hardware.drm-service.clearkey \
 
-ifdef RELEASE_PACKAGE_WIDEVINE
-  PRODUCT_PACKAGES += $(RELEASE_PACKAGE_WIDEVINE)
-  ifneq ($(wildcard vendor/google/dev-keystore),)
-    $(call soong_config_set,widevine,use_devkey,true)
-  endif
-  PRODUCT_VENDOR_LINKER_CONFIG_FRAGMENTS += \
-	vendor/widevine/libwvdrmengine/apex/device/linker.config.json
-else
-  -include vendor/widevine/libwvdrmengine/apex/device/device.mk
-endif
\ No newline at end of file
+-include vendor/widevine/libwvdrmengine/apex/device/device.mk
\ No newline at end of file
diff --git a/wireless_charger/compatibility_matrix.xml b/wireless_charger/compatibility_matrix.xml
index 7d18cd9..b760b1d 100644
--- a/wireless_charger/compatibility_matrix.xml
+++ b/wireless_charger/compatibility_matrix.xml
@@ -7,4 +7,12 @@
             <instance>default</instance>
         </interface>
     </hal>
+    <hal format="aidl" optional="true">
+        <name>vendor.google.wireless_charger.service</name>
+        <version>1</version>
+        <interface>
+            <name>IWlcService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
 </compatibility-matrix>
diff --git a/wireless_charger/sepolicy/dumpstate.te b/wireless_charger/sepolicy/dumpstate.te
new file mode 100644
index 0000000..3c5fac3
--- /dev/null
+++ b/wireless_charger/sepolicy/dumpstate.te
@@ -0,0 +1 @@
+binder_call(dumpstate, hal_wlcservice)
diff --git a/wireless_charger/sepolicy/file.te b/wireless_charger/sepolicy/file.te
new file mode 100644
index 0000000..6dd54c8
--- /dev/null
+++ b/wireless_charger/sepolicy/file.te
@@ -0,0 +1 @@
+type vendor_wlc_file, file_type, data_file_type;
diff --git a/wireless_charger/sepolicy/file_contexts b/wireless_charger/sepolicy/file_contexts
index 004c7a1..98796a9 100644
--- a/wireless_charger/sepolicy/file_contexts
+++ b/wireless_charger/sepolicy/file_contexts
@@ -1 +1,5 @@
 /vendor/bin/hw/vendor\.google\.wireless_charger-default                  u:object_r:hal_wireless_charger_exec:s0
+/vendor/bin/hw/vendor\.google\.wireless_charger\.service-default         u:object_r:hal_wlcservice_exec:s0
+
+# Data
+/data/vendor/wireless_charger(/.*)?                                      u:object_r:vendor_wlc_file:s0
diff --git a/wireless_charger/sepolicy/hal_wireless_charger.te b/wireless_charger/sepolicy/hal_wireless_charger.te
index 7ab8d83..b5ed734 100644
--- a/wireless_charger/sepolicy/hal_wireless_charger.te
+++ b/wireless_charger/sepolicy/hal_wireless_charger.te
@@ -17,3 +17,4 @@
 
 binder_call(hal_wireless_charger, platform_app)
 binder_call(hal_wireless_charger, system_app)
+binder_call(hal_wireless_charger, hal_wlcservice)
diff --git a/wireless_charger/sepolicy/hal_wlcservice.te b/wireless_charger/sepolicy/hal_wlcservice.te
new file mode 100644
index 0000000..eadb593
--- /dev/null
+++ b/wireless_charger/sepolicy/hal_wlcservice.te
@@ -0,0 +1,18 @@
+type hal_wlcservice, domain;
+type hal_wlcservice_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(hal_wlcservice)
+
+allow hal_wlcservice vendor_wlc_file:dir create_dir_perms;
+allow hal_wlcservice vendor_wlc_file:file create_file_perms;
+allow hal_wlcservice hal_wireless_charger_service:service_manager find;
+allow hal_wlcservice kmsg_device:chr_file { getattr w_file_perms };
+
+binder_call(hal_wlcservice, servicemanager)
+add_service(hal_wlcservice, hal_wlcservice_service)
+
+userdebug_or_eng(`
+     domain_auto_trans(shell,  hal_wlcservice_exec, hal_wlcservice)
+')
+
+binder_call(hal_wlcservice, hal_wireless_charger)
diff --git a/wireless_charger/sepolicy/service.te b/wireless_charger/sepolicy/service.te
new file mode 100644
index 0000000..8f8d87b
--- /dev/null
+++ b/wireless_charger/sepolicy/service.te
@@ -0,0 +1 @@
+type hal_wlcservice_service, hal_service_type, protected_service, service_manager_type;
diff --git a/wireless_charger/sepolicy/service_contexts b/wireless_charger/sepolicy/service_contexts
index 5813e35..ed2faba 100644
--- a/wireless_charger/sepolicy/service_contexts
+++ b/wireless_charger/sepolicy/service_contexts
@@ -1 +1,2 @@
 vendor.google.wireless_charger.IWirelessCharger/default                      u:object_r:hal_wireless_charger_service:s0
+vendor.google.wireless_charger.service.IWlcService/default                   u:object_r:hal_wlcservice_service:s0
diff --git a/wireless_charger/sepolicy/servicemanager.te b/wireless_charger/sepolicy/servicemanager.te
new file mode 100644
index 0000000..74d7244
--- /dev/null
+++ b/wireless_charger/sepolicy/servicemanager.te
@@ -0,0 +1 @@
+binder_call(servicemanager, hal_wlcservice)
diff --git a/wireless_charger/wireless_charger.mk b/wireless_charger/wireless_charger.mk
index acf5fc1..a2dc27c 100644
--- a/wireless_charger/wireless_charger.mk
+++ b/wireless_charger/wireless_charger.mk
@@ -1,5 +1,6 @@
 PRODUCT_SOONG_NAMESPACES += vendor/google/interfaces
 PRODUCT_PACKAGES += vendor.google.wireless_charger-default
+PRODUCT_PACKAGES += vendor.google.wireless_charger.service-default
 DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/wireless_charger/compatibility_matrix.xml
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/wireless_charger/sepolicy