diff --git a/Android.bp b/Android.bp
new file mode 100644
index 0000000..52a1055
--- /dev/null
+++ b/Android.bp
@@ -0,0 +1,45 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    default_applicable_licenses: ["device_google_gs-common_license"],
+}
+
+// Added automatically by a large-scale-change that took the approach of
+// 'apply every license found to every target'. While this makes sure we respect
+// every license restriction, it may not be entirely correct.
+//
+// e.g. GPL in an MIT project might only apply to the contrib/ directory.
+//
+// Please consider splitting the single license below into multiple licenses,
+// taking care not to lose any license_kind information, and overriding the
+// default license using the 'licenses: [...]' property on targets as needed.
+//
+// For unused files, consider creating a 'fileGroup' with "//visibility:private"
+// to attach the license to, and including a comment whether the files may be
+// used in the current project.
+// See: http://go/android-license-faq
+license {
+    name: "device_google_gs-common_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+        "SPDX-license-identifier-BSD",
+    ],
+    license_text: [
+        "NOTICE",
+    ],
+}
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..316b4eb
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,190 @@
+
+   Copyright (c) 2014, The Android Open Source Project
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
diff --git a/aoc/sepolicy/aocd.te b/aoc/sepolicy/aocd.te
index 69b0af0..b2bfd13 100644
--- a/aoc/sepolicy/aocd.te
+++ b/aoc/sepolicy/aocd.te
@@ -10,6 +10,7 @@
 # sysfs operations
 allow aocd sysfs_aoc:dir search;
 allow aocd sysfs_aoc_firmware:file w_file_perms;
+allow aocd sysfs_aoc_notifytimeout:file r_file_perms;
 
 # dev operations
 allow aocd aoc_device:chr_file rw_file_perms;
@@ -19,3 +20,4 @@
 
 # set properties
 set_prop(aocd, vendor_aoc_prop)
+set_prop(aocd, vendor_timeout_aoc_prop)
\ No newline at end of file
diff --git a/aoc/sepolicy/file.te b/aoc/sepolicy/file.te
index 602c5fe..0b853db 100644
--- a/aoc/sepolicy/file.te
+++ b/aoc/sepolicy/file.te
@@ -4,6 +4,7 @@
 type sysfs_aoc_firmware, sysfs_type, fs_type;
 type sysfs_aoc, sysfs_type, fs_type;
 type sysfs_aoc_reset, sysfs_type, fs_type;
+type sysfs_aoc_notifytimeout, sysfs_type, fs_type;
 
 # persist
 type persist_aoc_file, file_type, vendor_persist_type;
diff --git a/aoc/sepolicy/file_contexts b/aoc/sepolicy/file_contexts
index c3a4754..58edf2f 100644
--- a/aoc/sepolicy/file_contexts
+++ b/aoc/sepolicy/file_contexts
@@ -20,6 +20,8 @@
 /dev/acd-com.google.usf.non_wake_up u:object_r:aoc_device:s0
 /dev/acd-com.google.chre             u:object_r:aoc_device:s0
 /dev/acd-com.google.chre.non_wake_up u:object_r:aoc_device:s0
+/dev/acd-com.google.bt              u:object_r:aoc_device:s0
+/dev/acd-com.google.bt.non_wake_up  u:object_r:aoc_device:s0
 /dev/acd-logging                    u:object_r:aoc_device:s0
 /dev/aoc                            u:object_r:aoc_device:s0
 /dev/acd-audio_ap_offload_rx        u:object_r:aoc_device:s0
diff --git a/aoc/sepolicy/property.te b/aoc/sepolicy/property.te
index e6f9ddb..c2f5695 100644
--- a/aoc/sepolicy/property.te
+++ b/aoc/sepolicy/property.te
@@ -1,2 +1,3 @@
 # AoC
 vendor_internal_prop(vendor_aoc_prop)
+vendor_internal_prop(vendor_timeout_aoc_prop)
\ No newline at end of file
diff --git a/aoc/sepolicy/property_contexts b/aoc/sepolicy/property_contexts
index 0838873..3c2acb6 100644
--- a/aoc/sepolicy/property_contexts
+++ b/aoc/sepolicy/property_contexts
@@ -1,2 +1,3 @@
 # AoC
 vendor.aoc.firmware.version                     u:object_r:vendor_aoc_prop:s0
+persist.vendor.aoc.status_request_timed_out     u:object_r:vendor_timeout_aoc_prop:s0
\ No newline at end of file
diff --git a/audio/common.mk b/audio/common.mk
index 7f3375b..4157970 100644
--- a/audio/common.mk
+++ b/audio/common.mk
@@ -6,6 +6,7 @@
 	libmahalcontroller \
 	libAlgFx_HiFi3z
 
+ifneq ($(RELEASE_PIXEL_AIDL_AUDIO_HAL),true)
 ## AudioHAL Configurations
 PRODUCT_COPY_FILES += \
 	frameworks/av/services/audiopolicy/config/a2dp_audio_policy_configuration_7_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/a2dp_audio_policy_configuration_7_0.xml \
@@ -13,10 +14,12 @@
 	frameworks/av/services/audiopolicy/config/hearing_aid_audio_policy_configuration_7_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/hearing_aid_audio_policy_configuration_7_0.xml \
 	frameworks/av/services/audiopolicy/config/r_submix_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/r_submix_audio_policy_configuration.xml \
 	frameworks/av/services/audiopolicy/config/usb_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/usb_audio_policy_configuration.xml \
-    frameworks/av/services/audiopolicy/config/audio_policy_volumes.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_volumes.xml \
+	frameworks/av/services/audiopolicy/config/audio_policy_volumes.xml:$(TARGET_COPY_OUT_VENDOR)/etc/audio_policy_volumes.xml \
 	frameworks/av/services/audiopolicy/config/default_volume_tables.xml:$(TARGET_COPY_OUT_VENDOR)/etc/default_volume_tables.xml \
 	frameworks/av/services/audiopolicy/config/bluetooth_audio_policy_configuration_7_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/bluetooth_audio_policy_configuration_7_0.xml
 
+endif
+
 ## TODO(b/271958194): separate for hidl and aidl.
 PRODUCT_SOONG_NAMESPACES += \
 	vendor/google/whitechapel/audio/hal \
diff --git a/audio/hidl_zuma.mk b/audio/hidl_zuma.mk
index 3a5c211..d671f46 100644
--- a/audio/hidl_zuma.mk
+++ b/audio/hidl_zuma.mk
@@ -23,6 +23,7 @@
 	audio_bluenote_aoc \
 	audio_usb_aoc \
 	audio_cca_aoc \
+	audio_compensation_aoc \
 	libamcsextfile \
 	audio_amcs_ext \
 	audio.usb.default \
diff --git a/audio/sepolicy/common/genfs_contexts b/audio/sepolicy/common/genfs_contexts
index 013b913..eaa0c71 100644
--- a/audio/sepolicy/common/genfs_contexts
+++ b/audio/sepolicy/common/genfs_contexts
@@ -18,3 +18,6 @@
 genfscon sysfs /devices/platform/audiometrics/pcm_count                     u:object_r:sysfs_pixelstats:s0
 genfscon sysfs /devices/platform/audiometrics/pcm_latency                   u:object_r:sysfs_pixelstats:s0
 genfscon sysfs /devices/platform/audiometrics/call_count                    u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/offload_effects_id            u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/offload_effects_duration      u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/bt_usage                      u:object_r:sysfs_pixelstats:s0
diff --git a/audio/sepolicy/common/hal_audio_default.te b/audio/sepolicy/common/hal_audio_default.te
index 5cb03ac..c69e339 100644
--- a/audio/sepolicy/common/hal_audio_default.te
+++ b/audio/sepolicy/common/hal_audio_default.te
@@ -26,6 +26,8 @@
 hal_client_domain(hal_audio_default, hal_thermal);
 allow hal_audio_default fwk_sensor_hwservice:hwservice_manager find;
 
+hal_client_domain(hal_audio_default, hal_graphics_allocator);
+
 userdebug_or_eng(`
     allow hal_audio_default self:unix_stream_socket create_stream_socket_perms;
     allow hal_audio_default audio_vendor_data_file:sock_file { create unlink };
diff --git a/battery_mitigation/battery_mitigation.cpp b/battery_mitigation/battery_mitigation.cpp
index 2443226..fb81b20 100644
--- a/battery_mitigation/battery_mitigation.cpp
+++ b/battery_mitigation/battery_mitigation.cpp
@@ -16,15 +16,20 @@
 
 #define LOG_TAG "battery-mitigation"
 
-#include <battery_mitigation/BatteryMitigation.h>
 #include <android/binder_process.h>
+#include <battery_mitigation/BatteryMitigation.h>
+#include <battery_mitigation/BatteryMitigationService.h>
+#include <sys/resource.h>
+#include <system/thread_defs.h>
 
 #define COUNT_LIMIT 10
 
 using android::hardware::google::pixel::BatteryMitigation;
+using android::hardware::google::pixel::BatteryMitigationService;
 using android::hardware::google::pixel::MitigationConfig;
 
 android::sp<BatteryMitigation> bmSp;
+android::sp<BatteryMitigationService> batteryMitigationService;
 
 const struct MitigationConfig::Config cfg = {
     .SystemPath = {
@@ -67,6 +72,69 @@
     .TimestampFormat = "%Y-%m-%d %H:%M:%S",
 };
 
+const struct MitigationConfig::EventThreadConfig eventThreadCfg = {
+    .NumericSysfsStatPaths = {
+        {"cpu0_freq", "/sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq"},
+        {"cpu1_freq", "/sys/devices/system/cpu/cpu1/cpufreq/scaling_cur_freq"},
+        {"cpu2_freq", "/sys/devices/system/cpu/cpu2/cpufreq/scaling_cur_freq"},
+        {"battery_temp", "/dev/thermal/tz-by-name/battery/temp"},
+        {"battery_cycle", "/dev/thermal/tz-by-name/battery_cycle/temp"},
+        {"voltage_now", "/sys/class/power_supply/battery/voltage_now"},
+        {"current_now", "/sys/class/power_supply/battery/current_now"},
+    },
+    .TriggeredIdxPath = "/sys/devices/virtual/pmic/mitigation/br_stats/triggered_idx",
+    .triggeredStatePath[android::hardware::google::pixel::UVLO1] =
+        "/sys/devices/virtual/pmic/mitigation/triggered_state/uvlo1_triggered",
+    .triggeredStatePath[android::hardware::google::pixel::UVLO2] =
+        "/sys/devices/virtual/pmic/mitigation/triggered_state/uvlo2_triggered",
+    .triggeredStatePath[android::hardware::google::pixel::OILO1] =
+        "/sys/devices/virtual/pmic/mitigation/triggered_state/oilo1_triggered",
+    .triggeredStatePath[android::hardware::google::pixel::OILO2] =
+        "/sys/devices/virtual/pmic/mitigation/triggered_state/oilo2_triggered",
+    .triggeredStatePath[android::hardware::google::pixel::SMPL] =
+        "/sys/devices/virtual/pmic/mitigation/triggered_state/smpl_triggered",
+    .BrownoutStatsPath = "/sys/devices/virtual/pmic/mitigation/br_stats/stats",
+    .StoringPath = "/data/vendor/mitigation/thismeal.bin",
+    .ParsedThismealPath = "/data/vendor/mitigation/thismeal.txt",
+    .ParsedLastmealPath = "/data/vendor/mitigation/lastmeal.txt",
+    .ParsedLastmealCSVPath = "/data/vendor/mitigation/lastmeal.csv",
+    .FvpStatsPath = "/sys/devices/platform/acpm_stats/fvp_stats",
+    .PmicCommon = {
+                /* Main Pmic */
+                {
+                    .OdpmDir = "/sys/bus/iio/devices/iio:device0",
+                    .OdpmEnabledRailsPath = "/sys/bus/iio/devices/iio:device0/enabled_rails",
+                    .PmicNamePath = "/sys/bus/iio/devices/iio:device0/name",
+                },
+                /* Sub Pmic */
+                {
+                    .OdpmDir = "/sys/bus/iio/devices/iio:device1",
+                    .OdpmEnabledRailsPath = "/sys/bus/iio/devices/iio:device1/enabled_rails",
+                    .PmicNamePath = "/sys/bus/iio/devices/iio:device1/name",
+                },
+    },
+    .PlatformSpecific = {
+                .NumericSysfsStatPaths = {
+                    {
+                        .name = "battery_soc",
+                        .paths = {
+                            "/sys/class/power_supply/max77759fg/capacity",
+                            "/sys/class/power_supply/max77779fg/capacity",
+                        },
+                    },
+                    {
+                        .name = "gpu_freq",
+                        .paths = {
+                            "/sys/devices/platform/1c500000.mali/cur_freq",
+                            "/sys/devices/platform/28000000.mali/cur_freq",
+                            "/sys/devices/platform/1f000000.mali/cur_freq",
+                        },
+                    },
+
+                },
+    },
+};
+
 const char kReadyFilePath[] = "/sys/devices/virtual/pmic/mitigation/instruction/ready";
 const char kReadyProperty[] = "vendor.brownout.mitigation.ready";
 const char kLastMealPath[] = "/data/vendor/mitigation/lastmeal.txt";
@@ -74,25 +142,54 @@
 const char kLastMealProperty[] = "vendor.brownout.br.feasible";
 const std::regex kTimestampRegex("^\\S+\\s[0-9]+:[0-9]+:[0-9]+\\S+$");
 
-int main(int /*argc*/, char ** /*argv*/) {
+int main(int argc, char **argv) {
+    batteryMitigationService = new BatteryMitigationService(eventThreadCfg);
+    if (!batteryMitigationService) {
+        return 0;
+    }
+    bool brownoutStatsBinarySupported = batteryMitigationService->isBrownoutStatsBinarySupported();
+    if (argc == 2) {
+        if(strcmp(argv[1], "-d") == 0 &&
+           brownoutStatsBinarySupported) {
+            /* Create thismeal.txt from thismeal.bin */
+            batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedThismealPath);
+        }
+        return 0;
+    }
+
+    setpriority(PRIO_PROCESS, 0, ANDROID_PRIORITY_AUDIO);
     auto batteryMitigationStartTime = std::chrono::system_clock::now();
     ABinderProcess_setThreadPoolMaxThreadCount(1);
     ABinderProcess_startThreadPool();
-    bmSp = new BatteryMitigation(cfg);
-    if (!bmSp) {
-        return 0;
-    }
-    bool mitigationLogTimeValid = bmSp->isMitigationLogTimeValid(batteryMitigationStartTime,
-                                                                 cfg.LogFilePath,
-                                                                 cfg.TimestampFormat,
-                                                                 kTimestampRegex);
+
+    bool mitigationLogTimeValid;
     std::string reason = android::base::GetProperty(kBRRequestedProperty, "");
-    if (!reason.empty() && mitigationLogTimeValid) {
-        std::ifstream src(cfg.LogFilePath, std::ios::in);
-        std::ofstream dst(kLastMealPath, std::ios::out);
-        dst << src.rdbuf();
-        android::base::SetProperty(kLastMealProperty, "1");
+    if (brownoutStatsBinarySupported) {
+        /* Create lastmeal.txt if the dump time in thismeal.bin are valid */
+        mitigationLogTimeValid = batteryMitigationService->isTimeValid(eventThreadCfg.StoringPath,
+                                                                       batteryMitigationStartTime);
+        if (!reason.empty() && mitigationLogTimeValid &&
+            batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedLastmealPath) &&
+            batteryMitigationService->genLastmealCSV(eventThreadCfg.ParsedLastmealCSVPath)) {
+            android::base::SetProperty(kLastMealProperty, "1");
+        }
+    } else{
+        bmSp = new BatteryMitigation(cfg);
+        if (!bmSp) {
+            return 0;
+        }
+        mitigationLogTimeValid = bmSp->isMitigationLogTimeValid(batteryMitigationStartTime,
+                                                                cfg.LogFilePath,
+                                                                cfg.TimestampFormat,
+                                                                kTimestampRegex);
+        if (!reason.empty() && mitigationLogTimeValid) {
+            std::ifstream src(cfg.LogFilePath, std::ios::in);
+            std::ofstream dst(kLastMealPath, std::ios::out);
+            dst << src.rdbuf();
+            android::base::SetProperty(kLastMealProperty, "1");
+        }
     }
+
     bool isBatteryMitigationReady = false;
     std::string ready_str;
     int val = 0;
@@ -112,6 +209,10 @@
     if (isBatteryMitigationReady) {
         android::base::SetProperty(kReadyProperty, "1");
     }
+    if (isBatteryMitigationReady && brownoutStatsBinarySupported) {
+        /* Start BrownoutEventThread to poll brownout event from kernel */
+        batteryMitigationService->startBrownoutEventThread();
+    }
     while (true) {
         pause();
     }
diff --git a/battery_mitigation/sepolicy/vendor/battery_mitigation.te b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
index 4b83c28..4b5bc48 100644
--- a/battery_mitigation/sepolicy/vendor/battery_mitigation.te
+++ b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
@@ -10,11 +10,14 @@
 hal_client_domain(battery_mitigation, hal_thermal);
 hal_client_domain(battery_mitigation, hal_health);
 
+r_dir_file(battery_mitigation, sysfs_acpm_stats)
 r_dir_file(battery_mitigation, sysfs_batteryinfo)
 r_dir_file(battery_mitigation, sysfs_iio_devices)
+r_dir_file(battery_mitigation, sysfs_gpu)
 r_dir_file(battery_mitigation, sysfs_thermal)
 r_dir_file(battery_mitigation, thermal_link_device)
 r_dir_file(battery_mitigation, sysfs_odpm)
+r_dir_file(battery_mitigation, sysfs_power_stats)
 allow battery_mitigation sysfs_bcl:dir r_dir_perms;
 allow battery_mitigation sysfs_bcl:file r_file_perms;
 allow battery_mitigation sysfs_bcl:lnk_file r_file_perms;
@@ -24,3 +27,5 @@
 
 # Allow battery_mitigation to use Binder IPC so that service manager can notify it for callbacks
 binder_use(battery_mitigation)
+# Allow battery_mitigation to listen brownout event by epoll_wait
+wakelock_use(battery_mitigation)
diff --git a/bcmbt/dump/dump_bcmbt.cpp b/bcmbt/dump/dump_bcmbt.cpp
index 91dd7fa..0135198 100644
--- a/bcmbt/dump/dump_bcmbt.cpp
+++ b/bcmbt/dump/dump_bcmbt.cpp
@@ -17,11 +17,13 @@
 //#include <android-base/properties.h>
 #include <android-base/file.h>
 
+#define BCMBT_ACTIVITY_LOG_DIRECTORY "/data/vendor/bluetooth"
 #define BCMBT_SNOOP_LOG_DIRECTORY "/data/vendor/bluetooth"
 #define BCMBT_FW_LOG_DIRECTORY "/data/vendor/ssrdump/coredump"
 #define BCMBT_SNOOP_LOG_PREFIX "btsnoop_hci_vnd"
 #define BCMBT_FW_DUMP_LOG_PREFIX "coredump_bt_socdump_"
 #define BCMBT_CHRE_DUMP_LOG_PREFIX "coredump_bt_chredump_"
+#define BCMBT_ACTIVITY_LOG_PREFIX "bt_activity_"
 
 int main() {
     std::string outputDir = concatenatePath(BUGREPORT_PACKING_DIR, "bcmbt");
@@ -33,5 +35,6 @@
     dumpLogs(BCMBT_SNOOP_LOG_DIRECTORY, outputDir.c_str(), 2, BCMBT_SNOOP_LOG_PREFIX);
     dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_FW_DUMP_LOG_PREFIX);
     dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_CHRE_DUMP_LOG_PREFIX);
+    dumpLogs(BCMBT_ACTIVITY_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_ACTIVITY_LOG_PREFIX);
     return 0;
 }
diff --git a/bootctrl/1.2/Android.bp b/bootctrl/1.2/Android.bp
new file mode 100644
index 0000000..ad0b0e1
--- /dev/null
+++ b/bootctrl/1.2/Android.bp
@@ -0,0 +1,89 @@
+//
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+soong_namespace {
+    imports: [
+        "hardware/google/pixel",
+    ],
+}
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "//device/google/gs-common:device_google_gs-common_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: [
+        "//device/google/gs-common:device_google_gs-common_license",
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.boot@1.2-service-pixel",
+    defaults: ["hidl_defaults"],
+    relative_install_path: "hw",
+    vendor: true,
+    init_rc: ["android.hardware.boot@1.2-service-pixel.rc"],
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+        "service.cpp"
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.0",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot@1.2",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
+
+cc_library {
+    name: "android.hardware.boot@1.2-impl-pixel",
+    stem: "android.hardware.boot@1.0-impl-1.2-impl-pixel",
+    recovery: true,
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+    ],
+    relative_install_path: "hw",
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.0",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot@1.2",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
diff --git a/bootctrl/1.2/BootControl.cpp b/bootctrl/1.2/BootControl.cpp
new file mode 100644
index 0000000..ff02013
--- /dev/null
+++ b/bootctrl/1.2/BootControl.cpp
@@ -0,0 +1,526 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "BootControl.h"
+
+#include <android-base/file.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/properties.h>
+#include <libboot_control/libboot_control.h>
+#include <log/log.h>
+#include <trusty/tipc.h>
+
+#include "DevInfo.h"
+#include "GptUtils.h"
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+using android::bootable::GetMiscVirtualAbMergeStatus;
+using android::bootable::InitMiscVirtualAbMessageIfNeeded;
+using android::bootable::SetMiscVirtualAbMergeStatus;
+using android::hardware::boot::V1_0::BoolResult;
+using android::hardware::boot::V1_0::CommandResult;
+using android::hardware::boot::V1_1::MergeStatus;
+
+namespace {
+
+// clang-format off
+
+#define BOOT_A_PATH     "/dev/block/by-name/boot_a"
+#define BOOT_B_PATH     "/dev/block/by-name/boot_b"
+#define DEVINFO_PATH    "/dev/block/by-name/devinfo"
+
+#define BLOW_AR_PATH    "/sys/kernel/boot_control/blow_ar"
+
+// slot flags
+#define AB_ATTR_PRIORITY_SHIFT      52
+#define AB_ATTR_PRIORITY_MASK       (3UL << AB_ATTR_PRIORITY_SHIFT)
+#define AB_ATTR_ACTIVE_SHIFT        54
+#define AB_ATTR_ACTIVE              (1UL << AB_ATTR_ACTIVE_SHIFT)
+#define AB_ATTR_RETRY_COUNT_SHIFT   (55)
+#define AB_ATTR_RETRY_COUNT_MASK    (7UL << AB_ATTR_RETRY_COUNT_SHIFT)
+#define AB_ATTR_SUCCESSFUL          (1UL << 58)
+#define AB_ATTR_UNBOOTABLE          (1UL << 59)
+
+#define AB_ATTR_MAX_PRIORITY        3UL
+#define AB_ATTR_MAX_RETRY_COUNT     3UL
+
+// clang-format on
+
+static std::string getDevPath(uint32_t slot) {
+    char real_path[PATH_MAX];
+
+    const char *path = slot == 0 ? BOOT_A_PATH : BOOT_B_PATH;
+
+    int ret = readlink(path, real_path, sizeof real_path);
+    if (ret < 0) {
+        ALOGE("readlink failed for boot device %s\n", strerror(errno));
+        return std::string();
+    }
+
+    std::string dp(real_path);
+    // extract /dev/sda.. part
+    return dp.substr(0, sizeof "/dev/block/sdX" - 1);
+}
+
+static bool isSlotFlagSet(uint32_t slot, uint64_t flag) {
+    std::string dev_path = getDevPath(slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    return !!(e->attr & flag);
+}
+
+static bool setSlotFlag(uint32_t slot, uint64_t flag) {
+    std::string dev_path = getDevPath(slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    e->attr |= flag;
+    gpt.Sync();
+
+    return true;
+}
+
+static bool is_devinfo_valid;
+static bool is_devinfo_initialized;
+static std::mutex devinfo_lock;
+static devinfo_t devinfo;
+
+static bool isDevInfoValid() {
+    const std::lock_guard<std::mutex> lock(devinfo_lock);
+
+    if (is_devinfo_initialized) {
+        return is_devinfo_valid;
+    }
+
+    is_devinfo_initialized = true;
+
+    android::base::unique_fd fd(open(DEVINFO_PATH, O_RDONLY));
+    android::base::ReadFully(fd, &devinfo, sizeof devinfo);
+
+    if (devinfo.magic != DEVINFO_MAGIC) {
+        return is_devinfo_valid;
+    }
+
+    uint32_t version = ((uint32_t)devinfo.ver_major << 16) | devinfo.ver_minor;
+    // only version 3.3+ supports A/B data
+    if (version >= 0x0003'0003) {
+        is_devinfo_valid = true;
+    }
+
+    return is_devinfo_valid;
+}
+
+static bool DevInfoSync() {
+    if (!isDevInfoValid()) {
+        return false;
+    }
+
+    android::base::unique_fd fd(open(DEVINFO_PATH, O_WRONLY | O_DSYNC));
+    return android::base::WriteFully(fd, &devinfo, sizeof devinfo);
+}
+
+static void DevInfoInitSlot(devinfo_ab_slot_data_t &slot_data) {
+    slot_data.retry_count = AB_ATTR_MAX_RETRY_COUNT;
+    slot_data.unbootable = 0;
+    slot_data.successful = 0;
+    slot_data.active = 1;
+    slot_data.fastboot_ok = 0;
+}
+
+static int blow_otp_AR(bool secure) {
+    static const char *dev_name = "/dev/trusty-ipc-dev0";
+    static const char *otp_name = "com.android.trusty.otp_manager.tidl";
+    int fd = 1, ret = 0;
+    uint32_t cmd = secure? OTP_CMD_write_antirbk_secure_ap : OTP_CMD_write_antirbk_non_secure_ap;
+    fd = tipc_connect(dev_name, otp_name);
+    if (fd < 0) {
+        ALOGI("Failed to connect to OTP_MGR ns TA - is it missing?\n");
+        ret = -1;
+        return ret;
+    }
+
+    struct otp_mgr_req_base req = {
+        .command = cmd,
+        .resp_payload_size = 0,
+    };
+    struct iovec iov[] = {
+        {
+            .iov_base = &req,
+            .iov_len = sizeof(req),
+        },
+    };
+
+    int rc = tipc_send(fd, iov, 1, NULL, 0);
+    if (rc != sizeof(req)) {
+        ALOGI("Send fail! %x\n", rc);
+        return rc;
+    }
+
+    struct otp_mgr_rsp_base resp;
+    rc = read(fd, &resp, sizeof(resp));
+    if (rc < 0) {
+        ALOGI("Read fail! %x\n", rc);
+        return rc;
+    }
+
+    if (rc < sizeof(resp)) {
+        ALOGI("Not enough data! %x\n", rc);
+        return -EIO;
+    }
+
+    if (resp.command != (cmd | OTP_RESP_BIT)) {
+        ALOGI("Wrong command! %x\n", resp.command);
+        return -EINVAL;
+    }
+
+    if (resp.result != 0) {
+        fprintf(stderr, "AR writing error! %x\n", resp.result);
+        return -EINVAL;
+    }
+
+    tipc_close(fd);
+    return 0;
+}
+
+static bool blowAR_zuma() {
+    int ret = blow_otp_AR(true);
+    if (ret) {
+        ALOGI("Blow secure anti-rollback OTP failed");
+        return false;
+    }
+
+    ret = blow_otp_AR(false);
+    if (ret) {
+        ALOGI("Blow non-secure anti-rollback OTP failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool blowAR_gs101() {
+    android::base::unique_fd fd(open(BLOW_AR_PATH, O_WRONLY | O_DSYNC));
+    return android::base::WriteStringToFd("1", fd);
+}
+
+static bool blowAR() {
+    char platform[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.hardware.platform", platform, "");
+
+    if (std::string(platform) == "gs101") {
+        return blowAR_gs101();
+    } else if (std::string(platform) == "gs201" || std::string(platform) == "zuma") {
+        return blowAR_zuma();
+    }
+
+    return true;
+}
+
+}  // namespace
+
+// Methods from ::android::hardware::boot::V1_0::IBootControl follow.
+Return<uint32_t> BootControl::getNumberSlots() {
+    uint32_t slots = 0;
+
+    if (access(BOOT_A_PATH, F_OK) == 0)
+        slots++;
+
+    if (access(BOOT_B_PATH, F_OK) == 0)
+        slots++;
+
+    return slots;
+}
+
+Return<uint32_t> BootControl::getCurrentSlot() {
+    char suffix[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.slot_suffix", suffix, "_a");
+    return std::string(suffix) == "_b" ? 1 : 0;
+}
+
+Return<void> BootControl::markBootSuccessful(markBootSuccessful_cb _hidl_cb) {
+    if (getNumberSlots() == 0) {
+        // no slots, just return true otherwise Android keeps trying
+        _hidl_cb({true, ""});
+        return Void();
+    }
+
+    bool ret;
+    if (isDevInfoValid()) {
+        auto const slot = getCurrentSlot();
+        devinfo.ab_data.slots[slot].successful = 1;
+        ret = DevInfoSync();
+    } else {
+        ret = setSlotFlag(getCurrentSlot(), AB_ATTR_SUCCESSFUL);
+    }
+
+    if (!ret) {
+        _hidl_cb({false, "Failed to set successful flag"});
+        return Void();
+    }
+
+    if (!blowAR()) {
+        ALOGE("Failed to blow anti-rollback counter");
+        // Ignore the error, since ABL will re-trigger it on reboot
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<void> BootControl::setActiveBootSlot(uint32_t slot, setActiveBootSlot_cb _hidl_cb) {
+    if (slot >= 2) {
+        _hidl_cb({false, "Invalid slot"});
+        return Void();
+    }
+
+    if (isDevInfoValid()) {
+        auto &active_slot_data = devinfo.ab_data.slots[slot];
+        auto &inactive_slot_data = devinfo.ab_data.slots[!slot];
+
+        inactive_slot_data.active = 0;
+        DevInfoInitSlot(active_slot_data);
+
+        if (!DevInfoSync()) {
+            _hidl_cb({false, "Could not update DevInfo data"});
+            return Void();
+        }
+    } else {
+        std::string dev_path = getDevPath(slot);
+        if (dev_path.empty()) {
+            _hidl_cb({false, "Could not get device path for slot"});
+            return Void();
+        }
+
+        GptUtils gpt(dev_path);
+        if (gpt.Load()) {
+            _hidl_cb({false, "failed to load gpt data"});
+            return Void();
+        }
+
+        gpt_entry *active_entry = gpt.GetPartitionEntry(slot == 0 ? "boot_a" : "boot_b");
+        gpt_entry *inactive_entry = gpt.GetPartitionEntry(slot == 0 ? "boot_b" : "boot_a");
+        if (active_entry == nullptr || inactive_entry == nullptr) {
+            _hidl_cb({false, "failed to get entries for boot partitions"});
+            return Void();
+        }
+
+        ALOGV("slot active attributes %lx\n", active_entry->attr);
+        ALOGV("slot inactive attributes %lx\n", inactive_entry->attr);
+
+        // update attributes for active and inactive
+        inactive_entry->attr &= ~AB_ATTR_ACTIVE;
+        active_entry->attr = AB_ATTR_ACTIVE | (AB_ATTR_MAX_PRIORITY << AB_ATTR_PRIORITY_SHIFT) |
+                             (AB_ATTR_MAX_RETRY_COUNT << AB_ATTR_RETRY_COUNT_SHIFT);
+    }
+
+    char boot_dev[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.bootdevice", boot_dev, "");
+    if (boot_dev[0] == '\0') {
+        ALOGI("failed to get ro.boot.bootdevice. try ro.boot.boot_devices\n");
+        property_get("ro.boot.boot_devices", boot_dev, "");
+        if (boot_dev[0] == '\0') {
+            _hidl_cb({false, "invalid ro.boot.bootdevice and ro.boot.boot_devices prop"});
+            return Void();
+        }
+    }
+
+    std::string boot_lun_path =
+            std::string("/sys/devices/platform/") + boot_dev + "/pixel/boot_lun_enabled";
+    int fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+    if (fd < 0) {
+        // Try old path for kernels < 5.4
+        // TODO: remove once kernel 4.19 support is deprecated
+        std::string boot_lun_path =
+                std::string("/sys/devices/platform/") + boot_dev + "/attributes/boot_lun_enabled";
+        fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+        if (fd < 0) {
+            _hidl_cb({false, "failed to open ufs attr boot_lun_enabled"});
+            return Void();
+        }
+    }
+
+    //
+    // bBootLunEn
+    // 0x1  => Boot LU A = enabled, Boot LU B = disable
+    // 0x2  => Boot LU A = disable, Boot LU B = enabled
+    //
+    int ret = android::base::WriteStringToFd(slot == 0 ? "1" : "2", fd);
+    close(fd);
+    if (ret < 0) {
+        _hidl_cb({false, "faied to write boot_lun_enabled attribute"});
+        return Void();
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<void> BootControl::setSlotAsUnbootable(uint32_t slot, setSlotAsUnbootable_cb _hidl_cb) {
+    if (slot >= 2) {
+        _hidl_cb({false, "Invalid slot"});
+        return Void();
+    }
+
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        slot_data.unbootable = 1;
+        if (!DevInfoSync()) {
+            _hidl_cb({false, "Could not update DevInfo data"});
+            return Void();
+        }
+    } else {
+        std::string dev_path = getDevPath(slot);
+        if (dev_path.empty()) {
+            _hidl_cb({false, "Could not get device path for slot"});
+            return Void();
+        }
+
+        GptUtils gpt(dev_path);
+        gpt.Load();
+
+        gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+        e->attr |= AB_ATTR_UNBOOTABLE;
+
+        gpt.Sync();
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<::android::hardware::boot::V1_0::BoolResult> BootControl::isSlotBootable(uint32_t slot) {
+    if (getNumberSlots() == 0)
+        return BoolResult::FALSE;
+    if (slot >= getNumberSlots())
+        return BoolResult::INVALID_SLOT;
+
+    bool unbootable;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        unbootable = !!slot_data.unbootable;
+    } else {
+        unbootable = isSlotFlagSet(slot, AB_ATTR_UNBOOTABLE);
+    }
+
+    return unbootable ? BoolResult::FALSE : BoolResult::TRUE;
+}
+
+Return<::android::hardware::boot::V1_0::BoolResult> BootControl::isSlotMarkedSuccessful(
+        uint32_t slot) {
+    if (getNumberSlots() == 0) {
+        // just return true so that we don't we another call trying to mark it as successful
+        // when there is no slots
+        return BoolResult::TRUE;
+    }
+    if (slot >= getNumberSlots())
+        return BoolResult::INVALID_SLOT;
+
+    bool successful;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        successful = !!slot_data.successful;
+    } else {
+        successful = isSlotFlagSet(slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    return successful ? BoolResult::TRUE : BoolResult::FALSE;
+}
+
+Return<void> BootControl::getSuffix(uint32_t slot, getSuffix_cb _hidl_cb) {
+    _hidl_cb(slot == 0 ? "_a" : slot == 1 ? "_b" : "");
+    return Void();
+}
+
+// Methods from ::android::hardware::boot::V1_1::IBootControl follow.
+bool BootControl::Init() {
+    return InitMiscVirtualAbMessageIfNeeded();
+}
+
+Return<bool> BootControl::setSnapshotMergeStatus(
+        ::android::hardware::boot::V1_1::MergeStatus status) {
+    return SetMiscVirtualAbMergeStatus(getCurrentSlot(), status);
+}
+
+Return<::android::hardware::boot::V1_1::MergeStatus> BootControl::getSnapshotMergeStatus() {
+    MergeStatus status;
+    if (!GetMiscVirtualAbMergeStatus(getCurrentSlot(), &status)) {
+        return MergeStatus::UNKNOWN;
+    }
+    return status;
+}
+
+// Methods from ::android::hardware::boot::V1_2::IBootControl follow.
+Return<uint32_t> BootControl::getActiveBootSlot() {
+    if (getNumberSlots() == 0)
+        return 0;
+
+    if (isDevInfoValid())
+        return devinfo.ab_data.slots[1].active ? 1 : 0;
+    return isSlotFlagSet(1, AB_ATTR_ACTIVE) ? 1 : 0;
+}
+
+// Methods from ::android::hidl::base::V1_0::IBase follow.
+
+IBootControl *HIDL_FETCH_IBootControl(const char * /* name */) {
+    auto module = new BootControl();
+
+    module->Init();
+
+    return module;
+}
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/BootControl.h b/bootctrl/1.2/BootControl.h
new file mode 100644
index 0000000..45b7efa
--- /dev/null
+++ b/bootctrl/1.2/BootControl.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/hardware/boot/1.2/IBootControl.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+struct BootControl : public IBootControl {
+    bool Init();
+
+    // Methods from ::android::hardware::boot::V1_0::IBootControl follow.
+    Return<uint32_t> getNumberSlots() override;
+    Return<uint32_t> getCurrentSlot() override;
+    Return<void> markBootSuccessful(markBootSuccessful_cb _hidl_cb) override;
+    Return<void> setActiveBootSlot(uint32_t slot, setActiveBootSlot_cb _hidl_cb) override;
+    Return<void> setSlotAsUnbootable(uint32_t slot, setSlotAsUnbootable_cb _hidl_cb) override;
+    Return<::android::hardware::boot::V1_0::BoolResult> isSlotBootable(uint32_t slot) override;
+    Return<::android::hardware::boot::V1_0::BoolResult> isSlotMarkedSuccessful(
+            uint32_t slot) override;
+    Return<void> getSuffix(uint32_t slot, getSuffix_cb _hidl_cb) override;
+
+    // Methods from ::android::hardware::boot::V1_1::IBootControl follow.
+    Return<bool> setSnapshotMergeStatus(
+            ::android::hardware::boot::V1_1::MergeStatus status) override;
+    Return<::android::hardware::boot::V1_1::MergeStatus> getSnapshotMergeStatus() override;
+
+    // Methods from ::android::hardware::boot::V1_2::IBootControl follow.
+    Return<uint32_t> getActiveBootSlot() override;
+
+    // Methods from ::android::hidl::base::V1_0::IBase follow.
+};
+
+// FIXME: most likely delete, this is only for passthrough implementations
+extern "C" IBootControl *HIDL_FETCH_IBootControl(const char *name);
+
+enum otpmgr_command : uint32_t {
+    OTP_REQ_SHIFT = 1,
+    OTP_RESP_BIT = 1,
+    OTP_CMD_write_antirbk_non_secure_ap = (7 << OTP_REQ_SHIFT),
+    OTP_CMD_write_antirbk_secure_ap = (8 << OTP_REQ_SHIFT),
+};
+
+struct otp_mgr_req_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    uint8_t handle;
+}__packed;
+
+struct otp_mgr_rsp_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    int result;
+}__packed;
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/DevInfo.h b/bootctrl/1.2/DevInfo.h
new file mode 100644
index 0000000..a09a83a
--- /dev/null
+++ b/bootctrl/1.2/DevInfo.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+//
+// definitions taken from ABL code
+//
+
+constexpr uint32_t DEVINFO_MAGIC = 0x49564544;
+constexpr size_t DEVINFO_AB_SLOT_COUNT = 2;
+
+struct devinfo_ab_slot_data_t {
+    uint8_t retry_count;
+    uint8_t unbootable : 1;
+    uint8_t successful : 1;
+    uint8_t active : 1;
+    uint8_t fastboot_ok : 1;
+    uint8_t : 4;
+    uint8_t unused[2];
+} __attribute__((packed));
+
+typedef struct {
+    devinfo_ab_slot_data_t slots[DEVINFO_AB_SLOT_COUNT];
+} __attribute__((packed)) devinfo_ab_data_t;
+
+struct devinfo_t {
+    uint32_t magic;
+    uint16_t ver_major;
+    uint16_t ver_minor;
+    uint8_t unused[40];
+    devinfo_ab_data_t ab_data;
+    uint8_t unused1[72];  // use remaining up to complete 128 bytes
+} __attribute__((packed));
+
+static_assert(sizeof(devinfo_t) == 128, "invalid devinfo struct size");
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/GptUtils.cpp b/bootctrl/1.2/GptUtils.cpp
new file mode 100644
index 0000000..25088e7
--- /dev/null
+++ b/bootctrl/1.2/GptUtils.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "GptUtils.h"
+
+#include <android-base/file.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <log/log.h>
+#include <zlib.h>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+namespace {
+
+static int ValidateGptHeader(gpt_header *gpt) {
+    if (gpt->signature != GPT_SIGNATURE) {
+        ALOGE("invalid gpt signature 0x%lx\n", gpt->signature);
+        return -1;
+    }
+
+    if (gpt->header_size != sizeof(gpt_header)) {
+        ALOGE("invalid gpt header size %u\n", gpt->header_size);
+        return -1;
+    }
+
+    if (gpt->entry_size != sizeof(gpt_entry)) {
+        ALOGE("invalid gpt entry size %u\n", gpt->entry_size);
+        return -1;
+    }
+
+    return 0;
+}
+
+}  // namespace
+
+GptUtils::GptUtils(const std::string dev_path) : dev_path(dev_path), fd(0) {}
+
+int GptUtils::Load(void) {
+    fd = open(dev_path.c_str(), O_RDWR);
+    if (fd < 0) {
+        ALOGE("failed to open block dev %s, %d\n", dev_path.c_str(), errno);
+        return -1;
+    }
+
+    int ret = ioctl(fd, BLKSSZGET, &block_size);
+    if (ret < 0) {
+        ALOGE("failed to get block size %d\n", errno);
+        return -1;
+    }
+
+    // read primary header
+    lseek64(fd, block_size, SEEK_SET);
+    ret = read(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to read gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_primary)) {
+        ALOGE("error validating gpt header\n");
+        return -1;
+    }
+
+    // read partition entries
+    entry_array.resize(gpt_primary.entry_count);
+    uint32_t entries_size = gpt_primary.entry_size * gpt_primary.entry_count;
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = read(fd, entry_array.data(), entries_size);
+    if (ret < 0) {
+        ALOGE("failed to read gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // read gpt back header
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = read(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to read gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_backup)) {
+        ALOGW("error validating gpt backup\n");  // just warn about it, not fail
+    }
+
+    // Create map <partition name, gpt_entry pointer>
+    auto get_name = [](const uint16_t *efi_name) {
+        char name[37] = {};
+        for (int i = 0; efi_name[i] && i < sizeof name - 1; ++i) name[i] = efi_name[i];
+        return std::string(name);
+    };
+
+    for (auto const &e : entry_array) {
+        if (e.name[0] == 0)
+            break;  // stop at the first partition with no name
+        std::string s = get_name(e.name);
+        entries[s] = const_cast<gpt_entry *>(&e);
+    }
+
+    return 0;
+}
+
+gpt_entry *GptUtils::GetPartitionEntry(std::string name) {
+    return entries.find(name) != entries.end() ? entries[name] : nullptr;
+}
+
+int GptUtils::Sync(void) {
+    if (!fd)
+        return -1;
+
+    // calculate crc and check if we need to update gpt
+    gpt_primary.entries_crc32 = crc32(0, reinterpret_cast<uint8_t *>(entry_array.data()),
+                                      entry_array.size() * sizeof(gpt_entry));
+
+    // save old crc
+    uint32_t crc = gpt_primary.crc32;
+    gpt_primary.crc32 = 0;
+
+    gpt_primary.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_primary), sizeof gpt_primary);
+    if (crc == gpt_primary.crc32)
+        return 0;  // nothing to do (no changes)
+
+    ALOGI("updating GPT\n");
+
+    lseek64(fd, block_size * gpt_primary.current_lba, SEEK_SET);
+    int ret = write(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to write gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // update GPT backup entries and backup
+    lseek64(fd, block_size * gpt_backup.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup partition entries %d\n", errno);
+        return -1;
+    }
+
+    gpt_backup.entries_crc32 = gpt_primary.entries_crc32;
+    gpt_backup.crc32 = 0;
+    gpt_backup.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_backup), sizeof gpt_backup);
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = write(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    fsync(fd);
+
+    return 0;
+}
+
+GptUtils::~GptUtils() {
+    if (fd) {
+        Sync();
+        close(fd);
+    }
+}
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/GptUtils.h b/bootctrl/1.2/GptUtils.h
new file mode 100644
index 0000000..a2bed33
--- /dev/null
+++ b/bootctrl/1.2/GptUtils.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+#define GPT_SIGNATURE 0x5452415020494645UL
+
+typedef struct {
+    uint8_t type_guid[16];
+    uint8_t guid[16];
+    uint64_t first_lba;
+    uint64_t last_lba;
+    uint64_t attr;
+    uint16_t name[36];
+} __attribute__((packed)) gpt_entry;
+
+typedef struct {
+    uint64_t signature;
+    uint32_t revision;
+    uint32_t header_size;
+    uint32_t crc32;
+    uint32_t reserved;
+    uint64_t current_lba;
+    uint64_t backup_lba;
+    uint64_t first_usable_lba;
+    uint64_t last_usable_lba;
+    uint8_t disk_guid[16];
+    uint64_t start_lba;
+    uint32_t entry_count;
+    uint32_t entry_size;
+    uint32_t entries_crc32;
+} __attribute__((packed)) gpt_header;
+
+class GptUtils {
+  public:
+    GptUtils(const std::string dev_path);
+    int Load(void);
+    gpt_entry *GetPartitionEntry(std::string name);
+    int Sync(void);
+    ~GptUtils();
+
+  private:
+    std::string dev_path;
+    int fd;
+    uint32_t block_size;
+    gpt_header gpt_primary;
+    gpt_header gpt_backup;
+    std::vector<gpt_entry> entry_array;
+    std::map<std::string, gpt_entry *> entries;
+};
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc b/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc
new file mode 100644
index 0000000..ff7d2f3
--- /dev/null
+++ b/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc
@@ -0,0 +1,7 @@
+service vendor.boot-hal-1-2 /vendor/bin/hw/android.hardware.boot@1.2-service-pixel
+    interface android.hardware.boot@1.0::IBootControl default
+    interface android.hardware.boot@1.1::IBootControl default
+    interface android.hardware.boot@1.2::IBootControl default
+    class early_hal
+    user root
+    group root drmrpc
diff --git a/bootctrl/1.2/service.cpp b/bootctrl/1.2/service.cpp
new file mode 100644
index 0000000..f07682e
--- /dev/null
+++ b/bootctrl/1.2/service.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.boot@1.2-service"
+
+#include <android/hardware/boot/1.2/IBootControl.h>
+#include <hidl/HidlTransportSupport.h>
+#include <hidl/Status.h>
+#include <log/log.h>
+
+#include "BootControl.h"
+
+using ::android::status_t;
+
+using ::android::hardware::boot::V1_2::IBootControl;
+
+using ::android::hardware::boot::V1_2::implementation::BootControl;
+// using ::android::hardware::boot::implementation::BootControl;
+
+int main(int /* argc */, char * /* argv */[]) {
+    // This function must be called before you join to ensure the proper
+    // number of threads are created. The threadpool will never exceed
+    // size one because of this call.
+    ::android::hardware::configureRpcThreadpool(1 /*threads*/, true /*willJoin*/);
+
+    ::android::sp bootctrl = new BootControl();
+    const status_t status = bootctrl->registerAsService();
+    if (status != ::android::OK) {
+        return 1;  // or handle error
+    }
+
+    // Adds this thread to the threadpool, resulting in one total
+    // thread in the threadpool. We could also do other things, but
+    // would have to specify 'false' to willJoin in configureRpcThreadpool.
+    ::android::hardware::joinRpcThreadpool();
+    return 1;  // joinRpcThreadpool should never return
+}
diff --git a/bootctrl/aidl/Android.bp b/bootctrl/aidl/Android.bp
new file mode 100644
index 0000000..f5ba503
--- /dev/null
+++ b/bootctrl/aidl/Android.bp
@@ -0,0 +1,71 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+soong_namespace {
+    imports: [
+        "hardware/google/pixel",
+    ],
+}
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "//device/google/gs-common:device_google_gs-common_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: [
+        "//device/google/gs-common:device_google_gs-common_license",
+    ],
+}
+
+cc_defaults {
+    name: "android.hardware.boot-service_common-pixel",
+    relative_install_path: "hw",
+    defaults: ["libboot_control_defaults"],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot-V1-ndk",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+    ],
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+        "service.cpp"
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.boot-service.default-pixel",
+    defaults: ["android.hardware.boot-service_common-pixel"],
+    init_rc: ["android.hardware.boot-service.default-pixel.rc"],
+    vendor: true,
+}
+
+cc_binary {
+    name: "android.hardware.boot-service.default_recovery-pixel",
+    defaults: ["android.hardware.boot-service_common-pixel"],
+    vintf_fragments: ["android.hardware.boot-service.default_recovery-pixel.xml"],
+    init_rc: ["android.hardware.boot-service.default_recovery-pixel.rc"],
+    recovery: true,
+}
diff --git a/bootctrl/aidl/BootControl.cpp b/bootctrl/aidl/BootControl.cpp
new file mode 100644
index 0000000..e771845
--- /dev/null
+++ b/bootctrl/aidl/BootControl.cpp
@@ -0,0 +1,562 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "BootControl.h"
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/properties.h>
+#include <libboot_control/libboot_control.h>
+#include <log/log.h>
+#include <trusty/tipc.h>
+
+#include "DevInfo.h"
+#include "GptUtils.h"
+
+using HIDLMergeStatus = ::android::bootable::BootControl::MergeStatus;
+using ndk::ScopedAStatus;
+
+using android::bootable::GetMiscVirtualAbMergeStatus;
+using android::bootable::InitMiscVirtualAbMessageIfNeeded;
+using android::bootable::SetMiscVirtualAbMergeStatus;
+
+namespace aidl::android::hardware::boot {
+
+namespace {
+
+// clang-format off
+
+#define BOOT_A_PATH     "/dev/block/by-name/boot_a"
+#define BOOT_B_PATH     "/dev/block/by-name/boot_b"
+#define DEVINFO_PATH    "/dev/block/by-name/devinfo"
+
+#define BLOW_AR_PATH    "/sys/kernel/boot_control/blow_ar"
+
+// slot flags
+#define AB_ATTR_PRIORITY_SHIFT      52
+#define AB_ATTR_PRIORITY_MASK       (3UL << AB_ATTR_PRIORITY_SHIFT)
+#define AB_ATTR_ACTIVE_SHIFT        54
+#define AB_ATTR_ACTIVE              (1UL << AB_ATTR_ACTIVE_SHIFT)
+#define AB_ATTR_RETRY_COUNT_SHIFT   (55)
+#define AB_ATTR_RETRY_COUNT_MASK    (7UL << AB_ATTR_RETRY_COUNT_SHIFT)
+#define AB_ATTR_SUCCESSFUL          (1UL << 58)
+#define AB_ATTR_UNBOOTABLE          (1UL << 59)
+
+#define AB_ATTR_MAX_PRIORITY        3UL
+#define AB_ATTR_MAX_RETRY_COUNT     3UL
+
+// clang-format on
+
+static std::string getDevPath(int32_t in_slot) {
+    char real_path[PATH_MAX];
+
+    const char *path = in_slot == 0 ? BOOT_A_PATH : BOOT_B_PATH;
+
+    int ret = readlink(path, real_path, sizeof real_path);
+    if (ret < 0) {
+        ALOGE("readlink failed for boot device %s\n", strerror(errno));
+        return std::string();
+    }
+
+    std::string dp(real_path);
+    // extract /dev/sda.. part
+    return dp.substr(0, sizeof "/dev/block/sdX" - 1);
+}
+
+static bool isSlotFlagSet(int32_t in_slot, uint64_t flag) {
+    std::string dev_path = getDevPath(in_slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", in_slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    return !!(e->attr & flag);
+}
+
+static bool setSlotFlag(int32_t in_slot, uint64_t flag) {
+    std::string dev_path = getDevPath(in_slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", in_slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    e->attr |= flag;
+    gpt.Sync();
+
+    return true;
+}
+
+static bool is_devinfo_valid;
+static bool is_devinfo_initialized;
+static std::mutex devinfo_lock;
+static devinfo_t devinfo;
+
+static bool isDevInfoValid() {
+    const std::lock_guard<std::mutex> lock(devinfo_lock);
+
+    if (is_devinfo_initialized) {
+        return is_devinfo_valid;
+    }
+
+    is_devinfo_initialized = true;
+
+    ::android::base::unique_fd fd(open(DEVINFO_PATH, O_RDONLY));
+    ::android::base::ReadFully(fd, &devinfo, sizeof devinfo);
+
+    if (devinfo.magic != DEVINFO_MAGIC) {
+        return is_devinfo_valid;
+    }
+
+    uint32_t version = ((uint32_t)devinfo.ver_major << 16) | devinfo.ver_minor;
+    // only version 3.3+ supports A/B data
+    if (version >= 0x0003'0003) {
+        is_devinfo_valid = true;
+    }
+
+    return is_devinfo_valid;
+}
+
+static bool DevInfoSync() {
+    if (!isDevInfoValid()) {
+        return false;
+    }
+
+    ::android::base::unique_fd fd(open(DEVINFO_PATH, O_WRONLY | O_DSYNC));
+    return ::android::base::WriteFully(fd, &devinfo, sizeof devinfo);
+}
+
+static void DevInfoInitSlot(devinfo_ab_slot_data_t &slot_data) {
+    slot_data.retry_count = AB_ATTR_MAX_RETRY_COUNT;
+    slot_data.unbootable = 0;
+    slot_data.successful = 0;
+    slot_data.active = 1;
+    slot_data.fastboot_ok = 0;
+}
+
+static int blow_otp_AR(bool secure) {
+    static const char *dev_name = "/dev/trusty-ipc-dev0";
+    static const char *otp_name = "com.android.trusty.otp_manager.tidl";
+    int fd = 1, ret = 0;
+    uint32_t cmd = secure? OTP_CMD_write_antirbk_secure_ap : OTP_CMD_write_antirbk_non_secure_ap;
+    fd = tipc_connect(dev_name, otp_name);
+    if (fd < 0) {
+        ALOGI("Failed to connect to OTP_MGR ns TA - is it missing?\n");
+        ret = -1;
+        return ret;
+    }
+
+    struct otp_mgr_req_base req = {
+        .command = cmd,
+        .resp_payload_size = 0,
+    };
+    struct iovec iov[] = {
+        {
+            .iov_base = &req,
+            .iov_len = sizeof(req),
+        },
+    };
+
+    size_t rc = tipc_send(fd, iov, 1, NULL, 0);
+    if (rc != sizeof(req)) {
+        ALOGI("Send fail! %zx\n", rc);
+        return rc;
+    }
+
+    struct otp_mgr_rsp_base resp;
+    rc = read(fd, &resp, sizeof(resp));
+    if (rc < 0) {
+        ALOGI("Read fail! %zx\n", rc);
+        return rc;
+    }
+
+    if (rc < sizeof(resp)) {
+        ALOGI("Not enough data! %zx\n", rc);
+        return -EIO;
+    }
+
+    if (resp.command != (cmd | OTP_RESP_BIT)) {
+        ALOGI("Wrong command! %x\n", resp.command);
+        return -EINVAL;
+    }
+
+    if (resp.result != 0) {
+        fprintf(stderr, "AR writing error! %x\n", resp.result);
+        return -EINVAL;
+    }
+
+    tipc_close(fd);
+    return 0;
+}
+
+static bool blowAR_zuma() {
+    int ret = blow_otp_AR(true);
+    if (ret) {
+        ALOGI("Blow secure anti-rollback OTP failed");
+        return false;
+    }
+
+    ret = blow_otp_AR(false);
+    if (ret) {
+        ALOGI("Blow non-secure anti-rollback OTP failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool blowAR_gs101() {
+    ::android::base::unique_fd fd(open(BLOW_AR_PATH, O_WRONLY | O_DSYNC));
+    return ::android::base::WriteStringToFd("1", fd);
+}
+
+static bool blowAR() {
+    char platform[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.hardware.platform", platform, "");
+
+    if (std::string(platform) == "gs101") {
+        return blowAR_gs101();
+    } else if (std::string(platform) == "gs201" || std::string(platform) == "zuma") {
+        return blowAR_zuma();
+    }
+
+    return true;
+}
+
+static constexpr MergeStatus ToAIDLMergeStatus(HIDLMergeStatus status) {
+    switch (status) {
+        case HIDLMergeStatus::NONE:
+            return MergeStatus::NONE;
+        case HIDLMergeStatus::UNKNOWN:
+            return MergeStatus::UNKNOWN;
+        case HIDLMergeStatus::SNAPSHOTTED:
+            return MergeStatus::SNAPSHOTTED;
+        case HIDLMergeStatus::MERGING:
+            return MergeStatus::MERGING;
+        case HIDLMergeStatus::CANCELLED:
+            return MergeStatus::CANCELLED;
+    }
+}
+
+static constexpr HIDLMergeStatus ToHIDLMergeStatus(MergeStatus status) {
+    switch (status) {
+        case MergeStatus::NONE:
+            return HIDLMergeStatus::NONE;
+        case MergeStatus::UNKNOWN:
+            return HIDLMergeStatus::UNKNOWN;
+        case MergeStatus::SNAPSHOTTED:
+            return HIDLMergeStatus::SNAPSHOTTED;
+        case MergeStatus::MERGING:
+            return HIDLMergeStatus::MERGING;
+        case MergeStatus::CANCELLED:
+            return HIDLMergeStatus::CANCELLED;
+    }
+}
+
+}  // namespace
+
+BootControl::BootControl() {
+    CHECK(InitMiscVirtualAbMessageIfNeeded());
+}
+
+ScopedAStatus BootControl::getActiveBootSlot(int32_t* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        *_aidl_return = 0;
+        return ScopedAStatus::ok();
+    }
+
+    if (isDevInfoValid()) {
+        *_aidl_return = devinfo.ab_data.slots[1].active ? 1 : 0;
+        return ScopedAStatus::ok();
+    }
+    *_aidl_return = isSlotFlagSet(1, AB_ATTR_ACTIVE) ? 1 : 0;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getCurrentSlot(int32_t* _aidl_return) {
+    char suffix[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.slot_suffix", suffix, "_a");
+    *_aidl_return = std::string(suffix) == "_b" ? 1 : 0;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getNumberSlots(int32_t* _aidl_return) {
+    int32_t slots = 0;
+
+    if (access(BOOT_A_PATH, F_OK) == 0)
+        slots++;
+
+    if (access(BOOT_B_PATH, F_OK) == 0)
+        slots++;
+
+    *_aidl_return = slots;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getSnapshotMergeStatus(MergeStatus* _aidl_return) {
+    HIDLMergeStatus status;
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (!GetMiscVirtualAbMergeStatus(current_slot, &status)) {
+        *_aidl_return = MergeStatus::UNKNOWN;
+        return ScopedAStatus::ok();
+    }
+    *_aidl_return = ToAIDLMergeStatus(status);
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getSuffix(int32_t in_slot, std::string* _aidl_return) {
+    *_aidl_return = in_slot == 0 ? "_a" : in_slot == 1 ? "_b" : "";
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::isSlotBootable(int32_t in_slot, bool* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        *_aidl_return = false;
+        return ScopedAStatus::ok();
+    }
+    if (in_slot >= slots)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    bool unbootable;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        unbootable = !!slot_data.unbootable;
+    } else {
+        unbootable = isSlotFlagSet(in_slot, AB_ATTR_UNBOOTABLE);
+    }
+
+    *_aidl_return = unbootable ? false: true;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::isSlotMarkedSuccessful(int32_t in_slot, bool* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        // just return true so that we don't we another call trying to mark it as successful
+        // when there is no slots
+        *_aidl_return = true;
+        return ScopedAStatus::ok();
+    }
+    if (in_slot >= slots)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    bool successful;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        successful = !!slot_data.successful;
+    } else {
+        successful = isSlotFlagSet(in_slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    *_aidl_return = successful ? true : false;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::markBootSuccessful() {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        // no slots, just return true otherwise Android keeps trying
+        return ScopedAStatus::ok();
+    }
+
+    bool ret;
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (isDevInfoValid()) {
+        auto const slot = current_slot;
+        devinfo.ab_data.slots[slot].successful = 1;
+        ret = DevInfoSync();
+    } else {
+        ret = setSlotFlag(current_slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    if (!ret) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                  "Failed to set successful flag");
+    }
+
+    if (!blowAR()) {
+        ALOGE("Failed to blow anti-rollback counter");
+        // Ignore the error, since ABL will re-trigger it on reboot
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setActiveBootSlot(int32_t in_slot) {
+    if (in_slot >= 2) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+    }
+
+    if (isDevInfoValid()) {
+        auto &active_slot_data = devinfo.ab_data.slots[in_slot];
+        auto &inactive_slot_data = devinfo.ab_data.slots[!in_slot];
+
+        inactive_slot_data.active = 0;
+        DevInfoInitSlot(active_slot_data);
+
+        if (!DevInfoSync()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not update DevInfo data");
+        }
+    } else {
+        std::string dev_path = getDevPath(in_slot);
+        if (dev_path.empty()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not get device path for slot");
+        }
+
+        GptUtils gpt(dev_path);
+        if (gpt.Load()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                      "failed to load gpt data");
+        }
+
+        gpt_entry *active_entry = gpt.GetPartitionEntry(in_slot == 0 ? "boot_a" : "boot_b");
+        gpt_entry *inactive_entry = gpt.GetPartitionEntry(in_slot == 0 ? "boot_b" : "boot_a");
+        if (active_entry == nullptr || inactive_entry == nullptr) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "failed to get entries for boot partitions");
+        }
+
+        ALOGV("slot active attributes %lx\n", active_entry->attr);
+        ALOGV("slot inactive attributes %lx\n", inactive_entry->attr);
+
+        // update attributes for active and inactive
+        inactive_entry->attr &= ~AB_ATTR_ACTIVE;
+        active_entry->attr = AB_ATTR_ACTIVE | (AB_ATTR_MAX_PRIORITY << AB_ATTR_PRIORITY_SHIFT) |
+                             (AB_ATTR_MAX_RETRY_COUNT << AB_ATTR_RETRY_COUNT_SHIFT);
+    }
+
+    char boot_dev[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.bootdevice", boot_dev, "");
+    if (boot_dev[0] == '\0') {
+        ALOGI("failed to get ro.boot.bootdevice. try ro.boot.boot_devices\n");
+        property_get("ro.boot.boot_devices", boot_dev, "");
+        if (boot_dev[0] == '\0') {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "invalid ro.boot.bootdevice and ro.boot.boot_devices prop");
+        }
+    }
+
+    std::string boot_lun_path =
+            std::string("/sys/devices/platform/") + boot_dev + "/pixel/boot_lun_enabled";
+    int fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+    if (fd < 0) {
+        // Try old path for kernels < 5.4
+        // TODO: remove once kernel 4.19 support is deprecated
+        std::string boot_lun_path =
+                std::string("/sys/devices/platform/") + boot_dev + "/attributes/boot_lun_enabled";
+        fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+        if (fd < 0) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "failed to open ufs attr boot_lun_enabled");
+        }
+    }
+
+    //
+    // bBootLunEn
+    // 0x1  => Boot LU A = enabled, Boot LU B = disable
+    // 0x2  => Boot LU A = disable, Boot LU B = enabled
+    //
+    int ret = ::android::base::WriteStringToFd(in_slot == 0 ? "1" : "2", fd);
+    close(fd);
+    if (ret < 0) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                COMMAND_FAILED, "faied to write boot_lun_enabled attribute");
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setSlotAsUnbootable(int32_t in_slot) {
+    if (in_slot >= 2)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        slot_data.unbootable = 1;
+        if (!DevInfoSync()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not update DevInfo data");
+        }
+    } else {
+        std::string dev_path = getDevPath(in_slot);
+        if (dev_path.empty()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not get device path for slot");
+        }
+
+        GptUtils gpt(dev_path);
+        gpt.Load();
+
+        gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+        e->attr |= AB_ATTR_UNBOOTABLE;
+
+        gpt.Sync();
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setSnapshotMergeStatus(MergeStatus in_status) {
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (!SetMiscVirtualAbMergeStatus(current_slot, ToHIDLMergeStatus(in_status)))
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                  "Operation failed");
+    return ScopedAStatus::ok();
+}
+
+}  // namespace aidl::android::hardware::boot
diff --git a/bootctrl/aidl/BootControl.h b/bootctrl/aidl/BootControl.h
new file mode 100644
index 0000000..a54f66d
--- /dev/null
+++ b/bootctrl/aidl/BootControl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/boot/BnBootControl.h>
+#include <libboot_control/libboot_control.h>
+
+namespace aidl::android::hardware::boot {
+
+class BootControl final : public BnBootControl {
+  public:
+    BootControl();
+    ::ndk::ScopedAStatus getActiveBootSlot(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getCurrentSlot(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getNumberSlots(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getSnapshotMergeStatus(
+            ::aidl::android::hardware::boot::MergeStatus* _aidl_return) override;
+    ::ndk::ScopedAStatus getSuffix(int32_t in_slot, std::string* _aidl_return) override;
+    ::ndk::ScopedAStatus isSlotBootable(int32_t in_slot, bool* _aidl_return) override;
+    ::ndk::ScopedAStatus isSlotMarkedSuccessful(int32_t in_slot, bool* _aidl_return) override;
+    ::ndk::ScopedAStatus markBootSuccessful() override;
+    ::ndk::ScopedAStatus setActiveBootSlot(int32_t in_slot) override;
+    ::ndk::ScopedAStatus setSlotAsUnbootable(int32_t in_slot) override;
+    ::ndk::ScopedAStatus setSnapshotMergeStatus(
+            ::aidl::android::hardware::boot::MergeStatus in_status) override;
+};
+
+enum otpmgr_command : uint32_t {
+    OTP_REQ_SHIFT = 1,
+    OTP_RESP_BIT = 1,
+    OTP_CMD_write_antirbk_non_secure_ap = (7 << OTP_REQ_SHIFT),
+    OTP_CMD_write_antirbk_secure_ap = (8 << OTP_REQ_SHIFT),
+};
+
+struct otp_mgr_req_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    uint8_t handle;
+}__packed;
+
+struct otp_mgr_rsp_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    int result;
+}__packed;
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/DevInfo.h b/bootctrl/aidl/DevInfo.h
new file mode 100644
index 0000000..aa5f5d3
--- /dev/null
+++ b/bootctrl/aidl/DevInfo.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+namespace aidl::android::hardware::boot {
+
+//
+// definitions taken from ABL code
+//
+
+constexpr uint32_t DEVINFO_MAGIC = 0x49564544;
+constexpr size_t DEVINFO_AB_SLOT_COUNT = 2;
+
+struct devinfo_ab_slot_data_t {
+    uint8_t retry_count;
+    uint8_t unbootable : 1;
+    uint8_t successful : 1;
+    uint8_t active : 1;
+    uint8_t fastboot_ok : 1;
+    uint8_t : 4;
+    uint8_t unused[2];
+} __attribute__((packed));
+
+typedef struct {
+    devinfo_ab_slot_data_t slots[DEVINFO_AB_SLOT_COUNT];
+} __attribute__((packed)) devinfo_ab_data_t;
+
+struct devinfo_t {
+    uint32_t magic;
+    uint16_t ver_major;
+    uint16_t ver_minor;
+    uint8_t unused[40];
+    devinfo_ab_data_t ab_data;
+    uint8_t unused1[72];  // use remaining up to complete 128 bytes
+} __attribute__((packed));
+
+static_assert(sizeof(devinfo_t) == 128, "invalid devinfo struct size");
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/GptUtils.cpp b/bootctrl/aidl/GptUtils.cpp
new file mode 100644
index 0000000..34dec11
--- /dev/null
+++ b/bootctrl/aidl/GptUtils.cpp
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "GptUtils.h"
+
+#include <android-base/file.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <log/log.h>
+#include <zlib.h>
+
+namespace aidl::android::hardware::boot {
+
+namespace {
+
+static int ValidateGptHeader(gpt_header *gpt) {
+    if (gpt->signature != GPT_SIGNATURE) {
+        ALOGE("invalid gpt signature 0x%lx\n", gpt->signature);
+        return -1;
+    }
+
+    if (gpt->header_size != sizeof(gpt_header)) {
+        ALOGE("invalid gpt header size %u\n", gpt->header_size);
+        return -1;
+    }
+
+    if (gpt->entry_size != sizeof(gpt_entry)) {
+        ALOGE("invalid gpt entry size %u\n", gpt->entry_size);
+        return -1;
+    }
+
+    return 0;
+}
+
+}  // namespace
+
+GptUtils::GptUtils(const std::string dev_path) : dev_path(dev_path), fd(0) {}
+
+int GptUtils::Load(void) {
+    fd = open(dev_path.c_str(), O_RDWR);
+    if (fd < 0) {
+        ALOGE("failed to open block dev %s, %d\n", dev_path.c_str(), errno);
+        return -1;
+    }
+
+    int ret = ioctl(fd, BLKSSZGET, &block_size);
+    if (ret < 0) {
+        ALOGE("failed to get block size %d\n", errno);
+        return -1;
+    }
+
+    // read primary header
+    lseek64(fd, block_size, SEEK_SET);
+    ret = read(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to read gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_primary)) {
+        ALOGE("error validating gpt header\n");
+        return -1;
+    }
+
+    // read partition entries
+    entry_array.resize(gpt_primary.entry_count);
+    uint32_t entries_size = gpt_primary.entry_size * gpt_primary.entry_count;
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = read(fd, entry_array.data(), entries_size);
+    if (ret < 0) {
+        ALOGE("failed to read gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // read gpt back header
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = read(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to read gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_backup)) {
+        ALOGW("error validating gpt backup\n");  // just warn about it, not fail
+    }
+
+    // Create map <partition name, gpt_entry pointer>
+    auto get_name = [](const uint16_t *efi_name) {
+        char name[37] = {};
+        for (size_t i = 0; efi_name[i] && i < sizeof name - 1; ++i) name[i] = efi_name[i];
+        return std::string(name);
+    };
+
+    for (auto const &e : entry_array) {
+        if (e.name[0] == 0)
+            break;  // stop at the first partition with no name
+        std::string s = get_name(e.name);
+        entries[s] = const_cast<gpt_entry *>(&e);
+    }
+
+    return 0;
+}
+
+gpt_entry *GptUtils::GetPartitionEntry(std::string name) {
+    return entries.find(name) != entries.end() ? entries[name] : nullptr;
+}
+
+int GptUtils::Sync(void) {
+    if (!fd)
+        return -1;
+
+    // calculate crc and check if we need to update gpt
+    gpt_primary.entries_crc32 = crc32(0, reinterpret_cast<uint8_t *>(entry_array.data()),
+                                      entry_array.size() * sizeof(gpt_entry));
+
+    // save old crc
+    uint32_t crc = gpt_primary.crc32;
+    gpt_primary.crc32 = 0;
+
+    gpt_primary.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_primary), sizeof gpt_primary);
+    if (crc == gpt_primary.crc32)
+        return 0;  // nothing to do (no changes)
+
+    ALOGI("updating GPT\n");
+
+    lseek64(fd, block_size * gpt_primary.current_lba, SEEK_SET);
+    int ret = write(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to write gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // update GPT backup entries and backup
+    lseek64(fd, block_size * gpt_backup.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup partition entries %d\n", errno);
+        return -1;
+    }
+
+    gpt_backup.entries_crc32 = gpt_primary.entries_crc32;
+    gpt_backup.crc32 = 0;
+    gpt_backup.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_backup), sizeof gpt_backup);
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = write(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    fsync(fd);
+
+    return 0;
+}
+
+GptUtils::~GptUtils() {
+    if (fd) {
+        Sync();
+        close(fd);
+    }
+}
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/GptUtils.h b/bootctrl/aidl/GptUtils.h
new file mode 100644
index 0000000..ec68cf6
--- /dev/null
+++ b/bootctrl/aidl/GptUtils.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+namespace aidl::android::hardware::boot {
+
+#define GPT_SIGNATURE 0x5452415020494645UL
+
+typedef struct {
+    uint8_t type_guid[16];
+    uint8_t guid[16];
+    uint64_t first_lba;
+    uint64_t last_lba;
+    uint64_t attr;
+    uint16_t name[36];
+} __attribute__((packed)) gpt_entry;
+
+typedef struct {
+    uint64_t signature;
+    uint32_t revision;
+    uint32_t header_size;
+    uint32_t crc32;
+    uint32_t reserved;
+    uint64_t current_lba;
+    uint64_t backup_lba;
+    uint64_t first_usable_lba;
+    uint64_t last_usable_lba;
+    uint8_t disk_guid[16];
+    uint64_t start_lba;
+    uint32_t entry_count;
+    uint32_t entry_size;
+    uint32_t entries_crc32;
+} __attribute__((packed)) gpt_header;
+
+class GptUtils {
+  public:
+    GptUtils(const std::string dev_path);
+    int Load(void);
+    gpt_entry *GetPartitionEntry(std::string name);
+    int Sync(void);
+    ~GptUtils();
+
+  private:
+    std::string dev_path;
+    int fd;
+    uint32_t block_size;
+    gpt_header gpt_primary;
+    gpt_header gpt_backup;
+    std::vector<gpt_entry> entry_array;
+    std::map<std::string, gpt_entry *> entries;
+};
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc b/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc
new file mode 100644
index 0000000..a9887b9
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc
@@ -0,0 +1,5 @@
+service vendor.boot-default /vendor/bin/hw/android.hardware.boot-service.default-pixel
+    class early_hal
+    user root
+    group root drmrpc
+
diff --git a/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc
new file mode 100644
index 0000000..e58617e
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc
@@ -0,0 +1,7 @@
+service vendor.boot-default /system/bin/hw/android.hardware.boot-service.default_recovery-pixel
+    class early_hal
+    user root
+    group root
+    seclabel u:r:hal_bootctl_default:s0
+    interface aidl android.hardware.boot.IBootControl/default
+
diff --git a/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml
new file mode 100644
index 0000000..23ccc4e
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml
@@ -0,0 +1,6 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.boot</name>
+        <fqname>IBootControl/default</fqname>
+    </hal>
+</manifest>
diff --git a/bootctrl/aidl/service.cpp b/bootctrl/aidl/service.cpp
new file mode 100644
index 0000000..41b6c25
--- /dev/null
+++ b/bootctrl/aidl/service.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "aidl.android.hardware.boot-service.default"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <hidl/HidlSupport.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include "BootControl.h"
+
+using aidl::android::hardware::boot::BootControl;
+using aidl::android::hardware::boot::IBootControl;
+using ::android::hardware::configureRpcThreadpool;
+using ::android::hardware::joinRpcThreadpool;
+
+int main(int, char* argv[]) {
+    android::base::InitLogging(argv, android::base::KernelLogger);
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<IBootControl> service = ndk::SharedRefBase::make<BootControl>();
+
+    const std::string instance = std::string(BootControl::descriptor) + "/default";
+    auto status = AServiceManager_addService(service->asBinder().get(), instance.c_str());
+    CHECK_EQ(status, STATUS_OK) << "Failed to add service " << instance << " " << status;
+    LOG(INFO) << "IBootControl AIDL service running...";
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // should not reach
+}
diff --git a/bootctrl/bootctrl_aidl.mk b/bootctrl/bootctrl_aidl.mk
new file mode 100644
index 0000000..e9d7051
--- /dev/null
+++ b/bootctrl/bootctrl_aidl.mk
@@ -0,0 +1,6 @@
+PRODUCT_PACKAGES += \
+	android.hardware.boot-service.default-pixel \
+	android.hardware.boot-service.default_recovery-pixel
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/aidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/aidl
diff --git a/bootctrl/bootctrl_hidl_1.2.mk b/bootctrl/bootctrl_hidl_1.2.mk
new file mode 100644
index 0000000..ef25066
--- /dev/null
+++ b/bootctrl/bootctrl_hidl_1.2.mk
@@ -0,0 +1,6 @@
+PRODUCT_PACKAGES += \
+	android.hardware.boot@1.2-impl-pixel \
+	android.hardware.boot@1.2-service-pixel
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/1.2
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/1.2
diff --git a/bootctrl/sepolicy/1.2/device.te b/bootctrl/sepolicy/1.2/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/1.2/file.te b/bootctrl/sepolicy/1.2/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/1.2/file_contexts b/bootctrl/sepolicy/1.2/file_contexts
new file mode 100644
index 0000000..c456356
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot@1\.2-service-pixel                    u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/1.2/hal_bootctl_default.te b/bootctrl/sepolicy/1.2/hal_bootctl_default.te
new file mode 100644
index 0000000..fe017f9
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/hal_bootctl_default.te
@@ -0,0 +1,3 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
diff --git a/bootctrl/sepolicy/aidl/device.te b/bootctrl/sepolicy/aidl/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/aidl/file.te b/bootctrl/sepolicy/aidl/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/aidl/file_contexts b/bootctrl/sepolicy/aidl/file_contexts
new file mode 100644
index 0000000..339896f
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot-service\.default-pixel                u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/aidl/hal_bootctl_default.te b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
new file mode 100644
index 0000000..2ffeb27
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
@@ -0,0 +1,8 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
+allow hal_bootctl_default tee_device:chr_file rw_file_perms;
+
+recovery_only(`
+  allow hal_bootctl_default rootfs:dir r_dir_perms;
+')
diff --git a/camera/lyric.mk b/camera/lyric.mk
index b9583ea..e3feab3 100644
--- a/camera/lyric.mk
+++ b/camera/lyric.mk
@@ -37,6 +37,7 @@
 
 # Calibration tool for debug builds
 PRODUCT_PACKAGES_DEBUG += tarasque_test
+PRODUCT_PACKAGES_DEBUG += ProtoCalibGenerator
 
 endif  # vendor/google/camera check
 
diff --git a/camera/sepolicy/product/private/service_contexts b/camera/sepolicy/product/private/service_contexts
new file mode 100644
index 0000000..fed03af
--- /dev/null
+++ b/camera/sepolicy/product/private/service_contexts
@@ -0,0 +1 @@
+com.google.pixel.camera.services.binder.IServiceBinder/default u:object_r:camera_binder_service:s0
\ No newline at end of file
diff --git a/camera/sepolicy/product/private/vendor_pbcs_app.te b/camera/sepolicy/product/private/vendor_pbcs_app.te
index d77162e..54bc0c0 100644
--- a/camera/sepolicy/product/private/vendor_pbcs_app.te
+++ b/camera/sepolicy/product/private/vendor_pbcs_app.te
@@ -7,3 +7,6 @@
 allow vendor_pbcs_app app_api_service:service_manager find;
 # Allow PBCS to find Camera Service.
 allow vendor_pbcs_app cameraserver_service:service_manager find;
+
+# Allow PBCS to add the ServiceBinder service to ServiceManager.
+add_service(vendor_pbcs_app, camera_binder_service);
\ No newline at end of file
diff --git a/camera/sepolicy/product/public/service.te b/camera/sepolicy/product/public/service.te
new file mode 100644
index 0000000..f94fd9f
--- /dev/null
+++ b/camera/sepolicy/product/public/service.te
@@ -0,0 +1 @@
+type camera_binder_service, hal_service_type, protected_service, service_manager_type;
\ No newline at end of file
diff --git a/camera/sepolicy/vendor/hal_camera_default.te b/camera/sepolicy/vendor/hal_camera_default.te
index dd00cc3..4c9aa05 100644
--- a/camera/sepolicy/vendor/hal_camera_default.te
+++ b/camera/sepolicy/vendor/hal_camera_default.te
@@ -1,4 +1,4 @@
-allow hal_camera_default vendor_camera_binder_service:service_manager find;
+allow hal_camera_default camera_binder_service:service_manager find;
 # Allow Lyric Hal to find the LyricConfigProvider service through ServiceManager.
 allow hal_camera_default vendor_camera_lyricconfigprovider_service:service_manager find;
 
diff --git a/camera/sepolicy/vendor/service.te b/camera/sepolicy/vendor/service.te
index 877dbc1..87a1d93 100644
--- a/camera/sepolicy/vendor/service.te
+++ b/camera/sepolicy/vendor/service.te
@@ -1,5 +1,3 @@
-type vendor_camera_binder_service, hal_service_type, protected_service, service_manager_type;
-
 type hal_pixel_remote_camera_service, hal_service_type, protected_service, service_manager_type;
 
 type vendor_camera_lyricconfigprovider_service, hal_service_type, protected_service, service_manager_type;
diff --git a/camera/sepolicy/vendor/service_contexts b/camera/sepolicy/vendor/service_contexts
index e6eaa64..1bcaab8 100644
--- a/camera/sepolicy/vendor/service_contexts
+++ b/camera/sepolicy/vendor/service_contexts
@@ -1,5 +1,3 @@
-com.google.pixel.camera.services.binder.IServiceBinder/default u:object_r:vendor_camera_binder_service:s0
-
 com.google.pixel.camera.connectivity.hal.provider.ICameraProvider/default u:object_r:hal_pixel_remote_camera_service:s0
 
 com.google.pixel.camera.services.lyricconfigprovider.ILyricConfigProvider/default u:object_r:vendor_camera_lyricconfigprovider_service:s0
diff --git a/camera/sepolicy/vendor/vendor_pbcs_app.te b/camera/sepolicy/vendor/vendor_pbcs_app.te
index 7b9c5e2..b25c9a2 100644
--- a/camera/sepolicy/vendor/vendor_pbcs_app.te
+++ b/camera/sepolicy/vendor/vendor_pbcs_app.te
@@ -1,5 +1,5 @@
 # Allow PBCS to add the ServiceBinder service to ServiceManager.
-add_service(vendor_pbcs_app, vendor_camera_binder_service);
+add_service(vendor_pbcs_app, camera_binder_service);
 # Allow PBCS to add the LyricConfigProvider service to ServiceManager.
 add_service(vendor_pbcs_app, vendor_camera_lyricconfigprovider_service);
 # Allow PBCS to add the CameraIdRemapper service to ServiceManager.
diff --git a/dauntless/sepolicy/citadeld.te b/dauntless/sepolicy/citadeld.te
index 86cb61c..60c633c 100644
--- a/dauntless/sepolicy/citadeld.te
+++ b/dauntless/sepolicy/citadeld.te
@@ -11,3 +11,5 @@
 allow citadeld citadel_device:chr_file rw_file_perms;
 allow citadeld fwk_stats_service:service_manager find;
 allow citadeld hal_power_stats_vendor_service:service_manager find;
+
+set_prop(citadeld, vendor_nos_citadel_version);
diff --git a/dauntless/sepolicy/hal_weaver_citadel.te b/dauntless/sepolicy/hal_weaver_citadel.te
index c47287b..3c5ca8e 100644
--- a/dauntless/sepolicy/hal_weaver_citadel.te
+++ b/dauntless/sepolicy/hal_weaver_citadel.te
@@ -9,3 +9,6 @@
 binder_call(hal_weaver_citadel, citadeld)
 
 allow hal_weaver_citadel citadeld_service:service_manager find;
+
+# Allow callbacks
+allow citadeld hal_weaver_citadel:binder call;
diff --git a/dauntless/sepolicy/property.te b/dauntless/sepolicy/property.te
new file mode 100644
index 0000000..2e1c4ec
--- /dev/null
+++ b/dauntless/sepolicy/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_nos_citadel_version)
diff --git a/dauntless/sepolicy/property_contexts b/dauntless/sepolicy/property_contexts
new file mode 100644
index 0000000..835de17
--- /dev/null
+++ b/dauntless/sepolicy/property_contexts
@@ -0,0 +1 @@
+vendor.nos.citadel.version     u:object_r:vendor_nos_citadel_version:s0
diff --git a/device.mk b/device.mk
index f686621..45b7da8 100644
--- a/device.mk
+++ b/device.mk
@@ -14,6 +14,10 @@
 # limitations under the License.
 #
 
+ifeq (,$(filter true, $(PRODUCT_WITHOUT_TTS_VOICE_PACKS)))
+include device/google/gs-common/tts/voice_packs.mk
+endif
+
 PRODUCT_SOONG_NAMESPACES += \
 	device/google/gs-common/powerstats
 
diff --git a/display/dump_display.cpp b/display/dump_display.cpp
index d78a91a..b811889 100644
--- a/display/dump_display.cpp
+++ b/display/dump_display.cpp
@@ -24,6 +24,7 @@
     runCommand("libdisplaycolor", "/vendor/bin/dumpsys displaycolor -v");
     dumpFileContent("Primary panel name", "/sys/devices/platform/exynos-drm/primary-panel/panel_name");
     dumpFileContent("Primary panel extra info", "/sys/devices/platform/exynos-drm/primary-panel/panel_extinfo");
+    dumpFileContent("Primary panel power Vreg", "/sys/devices/platform/exynos-drm/primary-panel/panel_pwr_vreg");
     return 0;
 }
 
diff --git a/display/sepolicy/genfs_contexts b/display/sepolicy/genfs_contexts
index 9eaf5fb..7c46278 100644
--- a/display/sepolicy/genfs_contexts
+++ b/display/sepolicy/genfs_contexts
@@ -1,3 +1,3 @@
 
 genfscon debugfs /dri/0/crtc-                                           u:object_r:vendor_dri_debugfs:s0
-
+genfscon sysfs /module/drm/parameters/debug                             u:object_r:sysfs_display:s0
diff --git a/edgetpu/edgetpu.mk b/edgetpu/edgetpu.mk
index 5ad2711..feb728f 100644
--- a/edgetpu/edgetpu.mk
+++ b/edgetpu/edgetpu.mk
@@ -23,6 +23,10 @@
 PRODUCT_PACKAGES += com.google.edgetpu.dba-service
 # TPU DBA C API library
 PRODUCT_PACKAGES += libedgetpu_dba.google
+# TPU Tachyon HAL service
+PRODUCT_PACKAGES += com.google.edgetpu.tachyon-service
+# TPU Tachyon C API library
+PRODUCT_PACKAGES += libedgetpu_tachyon.google
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/edgetpu/sepolicy
 
diff --git a/edgetpu/sepolicy/appdomain.te b/edgetpu/sepolicy/appdomain.te
index 804a202..d3239ab 100644
--- a/edgetpu/sepolicy/appdomain.te
+++ b/edgetpu/sepolicy/appdomain.te
@@ -1,5 +1,8 @@
-# Allow apps to read tflite Darwinn delegate properties
+# Allow apps to read tflite DarwiNN delegate properties
 get_prop(appdomain, vendor_tflite_delegate_prop)
 
+# Allow apps to read DarwiNN runtime properties
+get_prop(appdomain, vendor_edgetpu_runtime_prop)
+
 # Allow apps to read hetero runtime properties
 get_prop(appdomain, vendor_hetero_runtime_prop)
diff --git a/edgetpu/sepolicy/edgetpu_dba_service.te b/edgetpu/sepolicy/edgetpu_dba_service.te
index da210da..f6ecd09 100644
--- a/edgetpu/sepolicy/edgetpu_dba_service.te
+++ b/edgetpu/sepolicy/edgetpu_dba_service.te
@@ -41,9 +41,15 @@
 # under userdebug builds.
 userdebug_or_eng(`perfetto_producer(edgetpu_dba_server)')
 
-# Allow EdgeTPU DBA service to read tflite Darwinn delegate properties
+# Allow EdgeTPU DBA service to read tflite DarwiNN delegate properties
 get_prop(edgetpu_dba_server, vendor_tflite_delegate_prop)
+# Allow EdgeTPU DBA service to read DarwiNN runtime properties
+get_prop(edgetpu_dba_server, vendor_edgetpu_runtime_prop)
 # Allow EdgeTPU DBA service to read hetero runtime properties
 get_prop(edgetpu_dba_server, vendor_hetero_runtime_prop)
 # Allow EdgeTPU DBA service to read EdgeTPU CPU scheduler properties
 get_prop(edgetpu_dba_server, vendor_edgetpu_cpu_scheduler_prop)
+
+# Allow DMA Buf access.
+allow edgetpu_dba_server dmabuf_system_heap_device:chr_file r_file_perms;
+
diff --git a/edgetpu/sepolicy/edgetpu_tachyon_service.te b/edgetpu/sepolicy/edgetpu_tachyon_service.te
new file mode 100644
index 0000000..5ead23b
--- /dev/null
+++ b/edgetpu/sepolicy/edgetpu_tachyon_service.te
@@ -0,0 +1,51 @@
+# Tachyon service.
+type edgetpu_tachyon_server, domain;
+type edgetpu_tachyon_server_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(edgetpu_tachyon_server)
+
+# The vendor service will use binder calls.
+binder_use(edgetpu_tachyon_server);
+
+# The vendor service will serve a binder service.
+binder_service(edgetpu_tachyon_server);
+
+# Tachyon service to register the service to service_manager.
+add_service(edgetpu_tachyon_server, edgetpu_tachyon_service);
+
+# Allow Tachyon service to access the edgetpu_app_service.
+allow edgetpu_tachyon_server edgetpu_app_service:service_manager find;
+binder_call(edgetpu_tachyon_server, edgetpu_app_server);
+
+# Allow Tachyon service to look for TPU instance in /dev/edgetpu or /dev/edgetpu-soc.
+allow edgetpu_tachyon_server edgetpu_device:chr_file rw_file_perms;
+
+# Allow Tachyon service to access hardware buffers and ION memory.
+allow edgetpu_tachyon_server hal_allocator:fd use;
+allow edgetpu_tachyon_server hal_graphics_mapper_hwservice:hwservice_manager find;
+allow edgetpu_tachyon_server hal_graphics_allocator:fd use;
+allow edgetpu_tachyon_server gpu_device:chr_file rw_file_perms;
+allow edgetpu_tachyon_server gpu_device:dir r_dir_perms;
+allow edgetpu_tachyon_server ion_device:chr_file r_file_perms;
+
+# Allow Tachyon service to access dmabuf sysytem.
+allow edgetpu_tachyon_server dmabuf_system_heap_device:chr_file r_file_perms;
+
+# Allow Tachyon service to read the overcommit_memory info.
+allow edgetpu_tachyon_server proc_overcommit_memory:file r_file_perms;
+
+# Allow Tachyon service to read the kernel version.
+# This is done inside the InitGoogle.
+allow edgetpu_tachyon_server proc_version:file r_file_perms;
+
+# Allow Tachyon service to send trace packets to Perfetto with SELinux enabled
+# under userdebug builds.
+userdebug_or_eng(`perfetto_producer(edgetpu_tachyon_server)')
+
+# Allow Tachyon service to read tflite DarwiNN delegate properties
+get_prop(edgetpu_tachyon_server, vendor_tflite_delegate_prop)
+# Allow Tachyon service to read DarwiNN runtime properties
+get_prop(edgetpu_tachyon_server, vendor_edgetpu_runtime_prop)
+# Allow Tachyon service to read hetero runtime properties
+get_prop(edgetpu_tachyon_server, vendor_hetero_runtime_prop)
+# Allow Tachyon service to read EdgeTPU CPU scheduler properties
+get_prop(edgetpu_tachyon_server, vendor_edgetpu_cpu_scheduler_prop)
diff --git a/edgetpu/sepolicy/file_contexts b/edgetpu/sepolicy/file_contexts
index 8f6481c..df0a63e 100644
--- a/edgetpu/sepolicy/file_contexts
+++ b/edgetpu/sepolicy/file_contexts
@@ -24,3 +24,6 @@
 
 # EdgeTPU DBA service
 /vendor/bin/hw/com\.google\.edgetpu.dba-service                            u:object_r:edgetpu_dba_server_exec:s0
+
+# Tachyon service
+/vendor/bin/hw/com\.google\.edgetpu.tachyon-service                        u:object_r:edgetpu_tachyon_server_exec:s0
diff --git a/edgetpu/sepolicy/hal_audio_default.te b/edgetpu/sepolicy/hal_audio_default.te
new file mode 100644
index 0000000..2646fcc
--- /dev/null
+++ b/edgetpu/sepolicy/hal_audio_default.te
@@ -0,0 +1,14 @@
+# Allow the audio hal to access the EdgeTPU service and the
+# Android shared memory allocated by the EdgeTPU service for
+# on-device compilation.
+allow hal_audio_default edgetpu_device:chr_file rw_file_perms;
+allow hal_audio_default edgetpu_vendor_service:service_manager find;
+binder_call(hal_audio_default, edgetpu_vendor_server)
+
+# Allow edgetpu_app_service as well, due to the EdgeTpu metrics logging
+# library has a dependency on edgetpu_app_service, see b/275016466.
+allow hal_audio_default edgetpu_app_service:service_manager find;
+binder_call(hal_audio_default, edgetpu_app_server)
+
+# Allow audio HAL to read tflite Darwinn delegate properties
+get_prop(hal_audio_default, vendor_tflite_delegate_prop)
diff --git a/edgetpu/sepolicy/hal_camera_default.te b/edgetpu/sepolicy/hal_camera_default.te
index 3c09f2f..624533a 100644
--- a/edgetpu/sepolicy/hal_camera_default.te
+++ b/edgetpu/sepolicy/hal_camera_default.te
@@ -1,5 +1,8 @@
-# Allow camera HAL to read tflite Darwinn delegate properties
+# Allow camera HAL to read tflite DarwiNN delegate properties
 get_prop(hal_camera_default, vendor_tflite_delegate_prop)
 
+# Allow camera HAL to read DarwiNN runtime properties
+get_prop(hal_camera_default, vendor_edgetpu_runtime_prop)
+
 # Allow camera HAL to read hetero runtime properties
 get_prop(hal_camera_default, vendor_hetero_runtime_prop)
diff --git a/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te b/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te
index 7d50bfc..3b2cd4f 100644
--- a/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te
+++ b/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te
@@ -7,7 +7,7 @@
 # The TPU HAL looks for TPU instance in /dev/abrolhos
 allow hal_neuralnetworks_darwinn edgetpu_device:chr_file rw_file_perms;
 
-# Allow DawriNN service to use a client-provided fd residing in /vendor/etc/.
+# Allow DarwiNN service to use a client-provided fd residing in /vendor/etc/.
 allow hal_neuralnetworks_darwinn vendor_configs_file:file r_file_perms;
 
 # Allow DarwiNN service to access data files.
@@ -54,5 +54,11 @@
 
 # Allow NNAPI HAL to read tflite DarwiNN delegate properties
 get_prop(hal_neuralnetworks_darwinn, vendor_tflite_delegate_prop)
+# Allow NNAPI HAL to read DarwiNN runtime properties
+get_prop(hal_neuralnetworks_darwinn, vendor_edgetpu_runtime_prop)
 # Allow NNAPI HAL to read hetero runtime properties
 get_prop(hal_neuralnetworks_darwinn, vendor_hetero_runtime_prop)
+
+# Allow DMA Buf access.
+allow hal_neuralnetworks_darwinn dmabuf_system_heap_device:chr_file r_file_perms;
+
diff --git a/edgetpu/sepolicy/property.te b/edgetpu/sepolicy/property.te
index 625ed0a..f0ec931 100644
--- a/edgetpu/sepolicy/property.te
+++ b/edgetpu/sepolicy/property.te
@@ -2,13 +2,16 @@
 # since it lives under /system_ext/.
 system_public_prop(vendor_edgetpu_service_prop)
 
-# Tflite Darwinn delegate properties are written once by vendor_init,
-# and then read by apps, camera hal, and some Darwinn vendor services.
+# Tflite DarwiNN delegate properties are written once by vendor_init,
+# and then read by apps, camera hal, and some DarwiNN vendor services.
 system_vendor_config_prop(vendor_tflite_delegate_prop)
 
 # The EdgeTPU CPU scheduler properties are written once by vendor_init,
 # and then read by HAL service.
 system_vendor_config_prop(vendor_edgetpu_cpu_scheduler_prop)
 
+# DarwiNN runtime properties.
+system_vendor_config_prop(vendor_edgetpu_runtime_prop)
+
 # Hetero runtime properties, including tracing levels.
 system_vendor_config_prop(vendor_hetero_runtime_prop)
diff --git a/edgetpu/sepolicy/property_contexts b/edgetpu/sepolicy/property_contexts
index dabbd20..76c394f 100644
--- a/edgetpu/sepolicy/property_contexts
+++ b/edgetpu/sepolicy/property_contexts
@@ -1,6 +1,7 @@
 # for EdgeTPU
 vendor.edgetpu.service.                         u:object_r:vendor_edgetpu_service_prop:s0
 vendor.edgetpu.cpu_scheduler.                   u:object_r:vendor_edgetpu_cpu_scheduler_prop:s0
+vendor.edgetpu.runtime.                         u:object_r:vendor_edgetpu_runtime_prop:s0
 
 # for DarwinnDelegate
 vendor.edgetpu.tflite_delegate.                 u:object_r:vendor_tflite_delegate_prop:s0
diff --git a/edgetpu/sepolicy/service.te b/edgetpu/sepolicy/service.te
index a61c8f8..b1a5409 100644
--- a/edgetpu/sepolicy/service.te
+++ b/edgetpu/sepolicy/service.te
@@ -1,6 +1,7 @@
 type edgetpu_nnapi_service, app_api_service, service_manager_type, isolated_compute_allowed_service;
 type edgetpu_vendor_service, service_manager_type, hal_service_type;
 type edgetpu_dba_service, app_api_service, service_manager_type, isolated_compute_allowed_service;
+type edgetpu_tachyon_service, app_api_service, service_manager_type, isolated_compute_allowed_service;
 
 # EdgeTPU binder service type declaration.
 type edgetpu_app_service, service_manager_type;
diff --git a/edgetpu/sepolicy/service_contexts b/edgetpu/sepolicy/service_contexts
index 83967f7..31684eb 100644
--- a/edgetpu/sepolicy/service_contexts
+++ b/edgetpu/sepolicy/service_contexts
@@ -8,3 +8,6 @@
 
 # EdgeTPU DBA Service
 com.google.edgetpu.dba.IDevice/default                     u:object_r:edgetpu_dba_service:s0
+
+# Tachyon Service
+com.google.edgetpu.tachyon.IComputeService/default         u:object_r:edgetpu_tachyon_service:s0
diff --git a/gear/dumpstate/Dumpstate.cpp b/gear/dumpstate/Dumpstate.cpp
index 9fe7c1a..31df2c7 100644
--- a/gear/dumpstate/Dumpstate.cpp
+++ b/gear/dumpstate/Dumpstate.cpp
@@ -74,21 +74,21 @@
 void Dumpstate::dumpTextSection(int fd, const std::string &sectionName) {
     bool dumpAll = (sectionName == kAllSections);
     std::string dumpFiles;
-
-    // Execute all or designated programs under vendor/bin/dump/
-    std::unique_ptr<DIR, decltype(&closedir)> dir(opendir("/vendor/bin/dump"), closedir);
-    if (!dir) {
-        ALOGE("Fail To Open Dir vendor/bin/dump/");
-        ::android::base::WriteStringToFd("Fail To Open Dir vendor/bin/dump/\n", fd);
+    struct dirent **dirent_list = NULL;
+    int num_entries = scandir("/vendor/bin/dump", &dirent_list, 0, (int (*)(const struct dirent **, const struct dirent **)) alphasort);
+    if (!dirent_list) {
+        ALOGE("Unable to scan dir: /vendor/bin/dump\n");
+        return;
+    } else if (num_entries <= 0) {
+        ALOGE("No file is found.\n");
         return;
     }
-    dirent *entry;
-    while ((entry = readdir(dir.get())) != nullptr) {
-        // Skip '.', '..'
-        if (entry->d_name[0] == '.') {
+    // Execute all or designated programs under vendor/bin/dump/
+    for (int i = 0; i <  num_entries; i++) {
+        if (dirent_list[i]->d_name[0] == '.') {
             continue;
         }
-        std::string bin(entry->d_name);
+        std::string bin(dirent_list[i]->d_name);
         dumpFiles = dumpFiles + " " + bin;
         if (dumpAll || sectionName == bin) {
             auto startTime = startSection(fd, bin);
@@ -111,6 +111,10 @@
     ::android::base::WriteStringToFd(dumpFiles, fd);
     ::android::base::WriteStringToFd("\nNote: sections with attachments (e.g. dump_soc) are"
                                    "not available from the command line.\n", fd);
+    while (num_entries--) {
+        free(dirent_list[num_entries]);
+    }
+    free(dirent_list);
 }
 
 void Dumpstate::dumpLogSection(int fd, int fd_bin)
diff --git a/gps/brcm/device.mk b/gps/brcm/device.mk
index dd64dd3..3065542 100644
--- a/gps/brcm/device.mk
+++ b/gps/brcm/device.mk
@@ -2,9 +2,13 @@
 
 PRODUCT_SOONG_NAMESPACES += vendor/broadcom/gps/bcm47765
 
-$(call soong_config_set, gpssdk, sdkv1, False)
+SOONG_CONFIG_NAMESPACES += gpssdk
+SOONG_CONFIG_gpssdk += sdkv1
+SOONG_CONFIG_gpssdk_sdkv1 ?= false
 
-$(call soong_config_set, gpssdk, gpsmcuversion, gpsv2_$(TARGET_BUILD_VARIANT))
+SOONG_CONFIG_NAMESPACES += gpssdk
+SOONG_CONFIG_gpssdk += gpsmcuversion
+SOONG_CONFIG_gpssdk_gpsmcuversion ?= gpsv2_$(TARGET_BUILD_VARIANT)
 
 PRODUCT_PACKAGES += \
 	bcm47765_gps_package \
diff --git a/gpu/gpu.mk b/gpu/gpu.mk
new file mode 100644
index 0000000..d1c3a6d
--- /dev/null
+++ b/gpu/gpu.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gpu/sepolicy
+
+PRODUCT_PACKAGES += gpu_probe
diff --git a/gpu/sepolicy/file_contexts b/gpu/sepolicy/file_contexts
new file mode 100644
index 0000000..764cb67
--- /dev/null
+++ b/gpu/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+/vendor/bin/gpu_probe                                                     u:object_r:gpu_probe_exec:s0
+
diff --git a/gpu/sepolicy/gpu_probe.te b/gpu/sepolicy/gpu_probe.te
new file mode 100644
index 0000000..d8ffb78
--- /dev/null
+++ b/gpu/sepolicy/gpu_probe.te
@@ -0,0 +1,8 @@
+# gpu_probe
+type gpu_probe_exec, exec_type, vendor_file_type, file_type;
+type gpu_probe, domain;
+
+init_daemon_domain(gpu_probe)
+allow gpu_probe gpu_device:chr_file rw_file_perms;
+
+perfetto_producer(gpu_probe)
diff --git a/gxp/dump.mk b/gxp/dump.mk
deleted file mode 100644
index c1f6300..0000000
--- a/gxp/dump.mk
+++ /dev/null
@@ -1,4 +0,0 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gxp/sepolicy/
-
-PRODUCT_PACKAGES_DEBUG += dump_gxp
-
diff --git a/gxp/gxp.mk b/gxp/gxp.mk
new file mode 100644
index 0000000..45b0f08
--- /dev/null
+++ b/gxp/gxp.mk
@@ -0,0 +1,13 @@
+# GXP logging service
+PRODUCT_PACKAGES += \
+	android.hardware.gxp.logging@service-gxp-logging
+# GXP metrics logger library
+PRODUCT_PACKAGES += \
+	gxp_metrics_logger
+# GXP C-API library
+PRODUCT_PACKAGES += libgxp
+# GXP Debug dump.
+PRODUCT_PACKAGES_DEBUG += dump_gxp
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gxp/sepolicy
+
diff --git a/gxp/sepolicy/device.te b/gxp/sepolicy/device.te
new file mode 100644
index 0000000..382bc9d
--- /dev/null
+++ b/gxp/sepolicy/device.te
@@ -0,0 +1,2 @@
+# GXP device
+type gxp_device, dev_type, mlstrustedobject;
diff --git a/gxp/sepolicy/dump_gxp.te b/gxp/sepolicy/dump_gxp.te
index 61a0482..8d285c5 100644
--- a/gxp/sepolicy/dump_gxp.te
+++ b/gxp/sepolicy/dump_gxp.te
@@ -7,5 +7,7 @@
   allow dump_gxp sscoredump_vendor_data_coredump_file:file r_file_perms;
   allow dump_gxp sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
   allow dump_gxp sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+  # Allow dump_gxp to access gxp properties.
+  get_prop(google_camera_app, vendor_gxp_prop)
 ')
 
diff --git a/gxp/sepolicy/edgetpu_tachyon_service.te b/gxp/sepolicy/edgetpu_tachyon_service.te
new file mode 100644
index 0000000..35987dd
--- /dev/null
+++ b/gxp/sepolicy/edgetpu_tachyon_service.te
@@ -0,0 +1,3 @@
+# Allow Tachyon service to access the GXP device and read GXP properties.
+allow edgetpu_tachyon_server gxp_device:chr_file rw_file_perms;
+get_prop(edgetpu_tachyon_server, vendor_gxp_prop)
diff --git a/gxp/sepolicy/file.te b/gxp/sepolicy/file.te
new file mode 100644
index 0000000..278cdd9
--- /dev/null
+++ b/gxp/sepolicy/file.te
@@ -0,0 +1,2 @@
+# Gxp sysfs file
+type sysfs_gxp, sysfs_type, fs_type;
diff --git a/gxp/sepolicy/file_contexts b/gxp/sepolicy/file_contexts
index 80420f4..08bef12 100644
--- a/gxp/sepolicy/file_contexts
+++ b/gxp/sepolicy/file_contexts
@@ -1,2 +1,12 @@
-/vendor/bin/dump/dump_gxp           u:object_r:dump_gxp_exec:s0
+# GXP Vendor library
+/vendor/lib(64)?/libgxp\.so                                                 u:object_r:same_process_hal_file:s0
+
+# GXP logging service
+/vendor/bin/hw/android\.hardware\.gxp\.logging@service-gxp-logging          u:object_r:gxp_logging_exec:s0
+
+# GXP Metrics Collection Library
+/vendor/lib(64)?/gxp_metrics_logger\.so                                     u:object_r:same_process_hal_file:s0
+
+# Allow collection of debug dump.
+/vendor/bin/dump/dump_gxp                                                   u:object_r:dump_gxp_exec:s0
 
diff --git a/gxp/sepolicy/gxp_logging.te b/gxp/sepolicy/gxp_logging.te
new file mode 100644
index 0000000..fd1af7f
--- /dev/null
+++ b/gxp/sepolicy/gxp_logging.te
@@ -0,0 +1,21 @@
+type gxp_logging, domain;
+type gxp_logging_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(gxp_logging)
+
+# The logging service accesses /dev/gxp
+allow gxp_logging gxp_device:chr_file rw_file_perms;
+
+# Allow logging service to access /sys/class/gxp
+allow gxp_logging sysfs_gxp:dir search;
+allow gxp_logging sysfs_gxp:file rw_file_perms;
+
+# Allow logging service to log to stats service for reporting metrics.
+allow gxp_logging fwk_stats_service:service_manager find;
+binder_call(gxp_logging, system_server);
+binder_use(gxp_logging)
+
+# Allow logging service to read gxp properties.
+get_prop(gxp_logging, vendor_gxp_prop)
+
+# Allow gxp tracing service to send packets to Perfetto
+userdebug_or_eng(`perfetto_producer(gxp_logging)')
diff --git a/gxp/sepolicy/hal_camera_default.te b/gxp/sepolicy/hal_camera_default.te
new file mode 100644
index 0000000..5570a2e
--- /dev/null
+++ b/gxp/sepolicy/hal_camera_default.te
@@ -0,0 +1,3 @@
+# Allow the camera hal to access the GXP device and Properties.
+allow hal_camera_default gxp_device:chr_file rw_file_perms;
+get_prop(hal_camera_default, vendor_gxp_prop)
diff --git a/gxp/sepolicy/property.te b/gxp/sepolicy/property.te
new file mode 100644
index 0000000..b9741f0
--- /dev/null
+++ b/gxp/sepolicy/property.te
@@ -0,0 +1,3 @@
+# Gxp Android properties
+system_vendor_config_prop(vendor_gxp_prop)
+
diff --git a/gxp/sepolicy/property_contexts b/gxp/sepolicy/property_contexts
new file mode 100644
index 0000000..6093c7c
--- /dev/null
+++ b/gxp/sepolicy/property_contexts
@@ -0,0 +1,3 @@
+# GXP Android Property.
+vendor.gxp.                                u:object_r:vendor_gxp_prop:s0
+
diff --git a/gxp/sepolicy/vendor_init.te b/gxp/sepolicy/vendor_init.te
new file mode 100644
index 0000000..ec6ceab
--- /dev/null
+++ b/gxp/sepolicy/vendor_init.te
@@ -0,0 +1,3 @@
+# Gxp Android Properties.
+set_prop(vendor_init, vendor_gxp_prop)
+
diff --git a/gyotaku_app/gyotaku.mk b/gyotaku_app/gyotaku.mk
index d1d45c0..fa58556 100644
--- a/gyotaku_app/gyotaku.mk
+++ b/gyotaku_app/gyotaku.mk
@@ -1,8 +1,8 @@
 ifneq ($(TARGET_BUILD_VARIANT), user)
   ifeq (,$(filter aosp_%, $(TARGET_PRODUCT))) # Skip aosp target product
     PRODUCT_PACKAGES_DEBUG += \
-        Gyotaku
+      Gyotaku
 
-    BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/sepolicy/
+      BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/sepolicy/
   endif
 endif
diff --git a/gyotaku_app/sepolicy/gyotaku_app.te b/gyotaku_app/sepolicy/gyotaku_app.te
index 80123cf..867ec4c 100644
--- a/gyotaku_app/sepolicy/gyotaku_app.te
+++ b/gyotaku_app/sepolicy/gyotaku_app.te
@@ -22,4 +22,7 @@
 
   # For persistent property use
   get_prop(gyotaku_app, logpersistd_logging_prop);
+
+  # For access hal_power_stats
+  hal_client_domain(gyotaku_app, hal_power_stats);
 ')
diff --git a/mediacodec/bigwave/mediacodec_bigwave.mk b/mediacodec/bigwave/mediacodec_bigwave.mk
new file mode 100644
index 0000000..4268e53
--- /dev/null
+++ b/mediacodec/bigwave/mediacodec_bigwave.mk
@@ -0,0 +1,14 @@
+PRODUCT_SOONG_NAMESPACES += vendor/google/media/bigwave
+
+PRODUCT_PACKAGES += \
+	google.hardware.media.c2@2.0-service \
+	libgc2_bw_store \
+	libgc2_bw_base \
+	libgc2_bw_av1_dec \
+	libgc2_bw_av1_enc \
+	libbw_av1dec \
+	libbw_av1enc \
+	libgc2_bw_cwl \
+	libgc2_bw_log \
+	libgc2_bw_utils
+
diff --git a/mediacodec/samsung/sepolicy/file.te b/mediacodec/samsung/sepolicy/file.te
index 99c3b66..2b95172 100644
--- a/mediacodec/samsung/sepolicy/file.te
+++ b/mediacodec/samsung/sepolicy/file.te
@@ -1 +1,2 @@
 type sysfs_mfc, sysfs_type, fs_type;
+type sysfs_force_empty, sysfs_type, fs_type;
diff --git a/mediacodec/samsung/sepolicy/genfs_contexts b/mediacodec/samsung/sepolicy/genfs_contexts
index d44d760..0e48616 100644
--- a/mediacodec/samsung/sepolicy/genfs_contexts
+++ b/mediacodec/samsung/sepolicy/genfs_contexts
@@ -1 +1,2 @@
 genfscon sysfs /devices/platform/mfc/video4linux/video u:object_r:sysfs_mfc:s0
+genfscon sysfs /kernel/vendor_mm/cma/vframe/force_empty  u:object_r:sysfs_force_empty:s0
diff --git a/mediacodec/samsung/sepolicy/mediacodec_samsung.te b/mediacodec/samsung/sepolicy/mediacodec_samsung.te
index efc83d7..b5bd996 100644
--- a/mediacodec/samsung/sepolicy/mediacodec_samsung.te
+++ b/mediacodec/samsung/sepolicy/mediacodec_samsung.te
@@ -14,6 +14,9 @@
 allow mediacodec_samsung sysfs_mfc:file r_file_perms;
 allow mediacodec_samsung sysfs_mfc:dir r_dir_perms;
 
+allow mediacodec_samsung sysfs_force_empty:dir r_file_perms;
+allow mediacodec_samsung sysfs_force_empty:file rw_file_perms;
+
 # can use graphics allocator
 hal_client_domain(mediacodec_samsung, hal_graphics_allocator)
 
diff --git a/modem/Android.bp b/modem/Android.bp
deleted file mode 100644
index dbc1cac..0000000
--- a/modem/Android.bp
+++ /dev/null
@@ -1,44 +0,0 @@
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-sh_binary {
-    name: "dump_modem.sh",
-    src: "dump_modem.sh",
-    vendor: true,
-    sub_dir: "dump",
-}
-
-cc_defaults {
-    name: "dump_modemlog_defaults",
-    srcs: ["modem_log_dumper.cpp"],
-    local_include_dirs: ["include"],
-    shared_libs: ["liblog"],
-}
-
-cc_binary {
-    name: "dump_modemlog",
-    srcs: ["dump_modemlog.cpp"],
-    cflags: [
-        "-Wall",
-        "-Wextra",
-        "-Werror",
-    ],
-    shared_libs: [
-        "libbase",
-        "libdump",
-        "liblog",
-    ],
-    defaults: ["dump_modemlog_defaults"],
-    vendor: true,
-    relative_install_path: "dump",
-}
-
-cc_test {
-    name: "dump_modemlog_test",
-    srcs: ["test/*.cpp"],
-    defaults: ["dump_modemlog_defaults"],
-    local_include_dirs: ["test/include"],
-    static_libs: ["libgmock"],
-    vendor: true,
-}
diff --git a/modem/android_property_manager/Android.bp b/modem/android_property_manager/Android.bp
new file mode 100644
index 0000000..af89aec
--- /dev/null
+++ b/modem/android_property_manager/Android.bp
@@ -0,0 +1,9 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "modem_android_property_manager",
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
diff --git a/modem/android_property_manager/fake/Android.bp b/modem/android_property_manager/fake/Android.bp
new file mode 100644
index 0000000..247b97c
--- /dev/null
+++ b/modem/android_property_manager/fake/Android.bp
@@ -0,0 +1,23 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+// When `modem_android_property_manager_fake` is included statically, its
+// dependencies are not transitively included, so the target will also have to
+// include this default to restate them.
+cc_defaults {
+    name: "modem_android_property_manager_fake_defaults",
+    static_libs: [
+        "modem_android_property_manager",
+        "libbase",
+        "modem_log_constants",
+    ],
+}
+
+cc_library_static {
+    name: "modem_android_property_manager_fake",
+    export_include_dirs: [ "include" ],
+    srcs: [ "fake_android_property_manager.cpp" ],
+    defaults: [ "modem_android_property_manager_fake_defaults" ],
+    vendor_available: true,
+}
diff --git a/modem/android_property_manager/fake/fake_android_property_manager.cpp b/modem/android_property_manager/fake/fake_android_property_manager.cpp
new file mode 100644
index 0000000..d25d6da
--- /dev/null
+++ b/modem/android_property_manager/fake/fake_android_property_manager.cpp
@@ -0,0 +1,80 @@
+#include "fake_android_property_manager.h"
+
+#include <android-base/parseint.h>
+#include <android-base/result.h>
+
+#include <cerrno>
+#include <map>
+#include <string>
+
+#include "modem_log_constants.h"
+
+namespace pixel_modem {
+
+bool FakeAndroidPropertyManager::GetBoolProperty(const std::string& key,
+                                                 bool default_value) {
+  auto value_result = GetProperty(key);
+  return value_result.ok() ? (*value_result) == kTruthString : default_value;
+}
+
+std::string FakeAndroidPropertyManager::GetProperty(
+    const std::string& key, const std::string& default_value) {
+  auto value_result = GetProperty(key);
+  return value_result.ok() ? *value_result : default_value;
+}
+
+int FakeAndroidPropertyManager::GetIntProperty(const std::string& key,
+                                               int default_value) {
+  int value = default_value;
+
+  auto property_result = GetProperty(key);
+  if (property_result.ok()) {
+    android::base::ParseInt<int>((*property_result).data(), &value);
+  }
+  return value;
+}
+
+/**
+ * This function needs to copy the behaviour of `modem_logging_control` to
+ * ensure that the right properties are being set in order.
+ *
+ * More specifically, this function will also set the
+ * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
+ * set to simulate modem logging stopping / starting.
+ */
+bool FakeAndroidPropertyManager::SetProperty(const std::string& key,
+                                             const std::string& value) {
+  if (key == logging::kModemLoggingEnabledProperty) {
+    property_map_[logging::kModemLoggingStatusProperty.data()] = value;
+
+    // need to track if modem logging has restarted or not
+    if (value == kFalseString) {
+      modem_logging_has_been_off_ = true;
+    }
+    if (modem_logging_has_been_off_ && (value == kTruthString)) {
+      modem_logging_has_restarted_ = true;
+    }
+  }
+  property_map_[key] = value;
+  return true;
+}
+
+/**
+ * @brief Gets android system property if present.
+ *
+ * @param[in] key Name of property.
+ *
+ * @return Status of get operation and value if successful.
+ * @retval EINVAL Key not present in map.
+ */
+android::base::Result<std::string> FakeAndroidPropertyManager::GetProperty(
+    const std::string& key) {
+  const auto it = property_map_.find(key);
+  if (it == property_map_.end()) {
+    return android::base::Error()
+           << "Property: " << key << " not found." << EINVAL;
+  }
+  return it->second;
+}
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/fake/include/fake_android_property_manager.h b/modem/android_property_manager/fake/include/fake_android_property_manager.h
new file mode 100644
index 0000000..eeea5a0
--- /dev/null
+++ b/modem/android_property_manager/fake/include/fake_android_property_manager.h
@@ -0,0 +1,54 @@
+#pragma once
+
+#include <map>
+#include <string>
+
+#include "android-base/result.h"
+#include "android_property_manager.h"
+
+namespace pixel_modem {
+
+/**
+ * @brief Fake Implementation of AndroidPropertyManager that mocks some of the
+ * property changing behaviour from pixellogger's `modem_logging_control`.
+ */
+class FakeAndroidPropertyManager : public AndroidPropertyManager {
+ public:
+  bool GetBoolProperty(const std::string& key, bool default_value) override;
+
+  std::string GetProperty(const std::string& key,
+                          const std::string& default_value) override;
+
+  int GetIntProperty(const std::string& key, int default_value) override;
+
+  /**
+   * This function needs to copy the behaviour of `modem_logging_control` to
+   * ensure that the right properties are being set in order.
+   *
+   * More specifically, this function will also set the
+   * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
+   * set to simulate modem logging stopping / starting.
+   */
+  bool SetProperty(const std::string& key, const std::string& value) override;
+
+  inline bool ModemLoggingHasRestarted() {
+    return modem_logging_has_restarted_;
+  }
+
+ private:
+  /**
+   * @brief Gets android system property if present.
+   *
+   * @param[in] key Name of property.
+   *
+   * @return Status of get operation and value if successful.
+   * @retval EINVAL Key not present in map.
+   */
+  android::base::Result<std::string> GetProperty(const std::string& key);
+
+  std::map<std::string, std::string> property_map_;
+  bool modem_logging_has_been_off_ = false;
+  bool modem_logging_has_restarted_ = false;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/impl/Android.bp b/modem/android_property_manager/impl/Android.bp
new file mode 100644
index 0000000..2023e8f
--- /dev/null
+++ b/modem/android_property_manager/impl/Android.bp
@@ -0,0 +1,18 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+modem_android_property_manager_impl_public_deps = [
+    "modem_android_property_manager",
+]
+
+cc_library_shared {
+    name: "modem_android_property_manager_impl",
+    export_include_dirs: [ "include" ],
+    srcs: [ "android_property_manager_impl.cpp" ],
+    shared_libs: modem_android_property_manager_impl_public_deps + [
+        "libbase",
+    ],
+    export_shared_lib_headers: modem_android_property_manager_impl_public_deps,
+    vendor_available: true,
+}
diff --git a/modem/android_property_manager/impl/android_property_manager_impl.cpp b/modem/android_property_manager/impl/android_property_manager_impl.cpp
new file mode 100644
index 0000000..b6b900a
--- /dev/null
+++ b/modem/android_property_manager/impl/android_property_manager_impl.cpp
@@ -0,0 +1,29 @@
+#include "android_property_manager_impl.h"
+
+#include <android-base/properties.h>
+
+#include <string>
+
+namespace pixel_modem {
+
+bool AndroidPropertyManagerImpl::GetBoolProperty(const std::string& key,
+                                                 bool default_value) {
+  return android::base::GetBoolProperty(key, default_value);
+}
+
+std::string AndroidPropertyManagerImpl::GetProperty(
+    const std::string& key, const std::string& default_value) {
+  return android::base::GetProperty(key, default_value);
+}
+
+int AndroidPropertyManagerImpl::GetIntProperty(const std::string& key,
+                                               int default_value) {
+  return android::base::GetIntProperty(key, default_value);
+}
+
+bool AndroidPropertyManagerImpl::SetProperty(const std::string& key,
+                                             const std::string& value) {
+  return android::base::SetProperty(key, value);
+}
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/impl/include/android_property_manager_impl.h b/modem/android_property_manager/impl/include/android_property_manager_impl.h
new file mode 100644
index 0000000..91cee25
--- /dev/null
+++ b/modem/android_property_manager/impl/include/android_property_manager_impl.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <string>
+
+#include "android_property_manager.h"
+
+namespace pixel_modem {
+
+/**
+ * @brief Implementation of AndroidPropertyManager that directly forwards to
+ * android base methods.
+ */
+class AndroidPropertyManagerImpl : public AndroidPropertyManager {
+ public:
+  bool GetBoolProperty(const std::string& key, bool default_value) override;
+
+  std::string GetProperty(const std::string& key,
+                          const std::string& default_value) override;
+
+  int GetIntProperty(const std::string& key, int default_value) override;
+
+  bool SetProperty(const std::string& key, const std::string& value) override;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/android_property_manager/include/android_property_manager.h b/modem/android_property_manager/include/android_property_manager.h
new file mode 100644
index 0000000..e41a28d
--- /dev/null
+++ b/modem/android_property_manager/include/android_property_manager.h
@@ -0,0 +1,27 @@
+
+#pragma once
+
+#include <string>
+#include <string_view>
+
+namespace pixel_modem {
+
+// Used to set boolean parameters to true / false
+inline constexpr std::string_view kTruthString = "true";
+inline constexpr std::string_view kFalseString = "false";
+
+/**
+ * @brief Interface for interacting with Android System Properties.
+ */
+class AndroidPropertyManager {
+ public:
+  virtual ~AndroidPropertyManager() = default;
+  virtual bool GetBoolProperty(const std::string& key, bool default_value) = 0;
+  virtual std::string GetProperty(const std::string& key,
+                                  const std::string& default_value) = 0;
+  virtual int GetIntProperty(const std::string& key, int default_value) = 0;
+  virtual bool SetProperty(const std::string& key,
+                           const std::string& value) = 0;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/Android.bp b/modem/clock_manager/Android.bp
new file mode 100644
index 0000000..98aff6f
--- /dev/null
+++ b/modem/clock_manager/Android.bp
@@ -0,0 +1,9 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "modem_clock_manager",
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
diff --git a/modem/clock_manager/fake/Android.bp b/modem/clock_manager/fake/Android.bp
new file mode 100644
index 0000000..eb16445
--- /dev/null
+++ b/modem/clock_manager/fake/Android.bp
@@ -0,0 +1,15 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_defaults {
+    name: "fake_modem_clock_manager_defaults",
+    shared_libs: [ "modem_clock_manager" ],
+}
+
+cc_library_static {
+    name: "fake_modem_clock_manager",
+    export_include_dirs: [ "include" ],
+    defaults: [ "fake_modem_clock_manager_defaults" ],
+    vendor_available: true,
+}
diff --git a/modem/clock_manager/fake/include/fake_clock_manager.h b/modem/clock_manager/fake/include/fake_clock_manager.h
new file mode 100644
index 0000000..8956777
--- /dev/null
+++ b/modem/clock_manager/fake/include/fake_clock_manager.h
@@ -0,0 +1,21 @@
+#include "clock_manager.h"
+
+namespace pixel_modem {
+
+/**
+ * @brief Fake implementation of clock manager that doesn't actually sleep.
+ *
+ * A lot of vendor code don't have return values and instead force the client
+ * codes to sleep for a specified period of time before checking some system
+ * properties. However, since unit tests don't rely on the real vendor
+ * implementations, these sleeps should be ignored and so a fake clock should be
+ * used.
+ *
+ * Since this definition is unlikely to change, it will be defined in the header
+ * and not an implementation file.
+ */
+struct FakeClockManager : public ClockManager {
+  void Sleep(size_t /*seconds*/) const override{};
+};
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/impl/Android.bp b/modem/clock_manager/impl/Android.bp
new file mode 100644
index 0000000..13f4cc6
--- /dev/null
+++ b/modem/clock_manager/impl/Android.bp
@@ -0,0 +1,16 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+modem_clock_manager_impl_public_deps = [
+    "modem_clock_manager",
+]
+
+cc_library {
+    name: "modem_clock_manager_impl",
+    export_include_dirs: [ "include" ],
+    srcs: [ "clock_manager_impl.cpp" ],
+    shared_libs: modem_clock_manager_impl_public_deps,
+    export_shared_lib_headers: modem_clock_manager_impl_public_deps,
+    vendor_available: true,
+}
diff --git a/modem/clock_manager/impl/clock_manager_impl.cpp b/modem/clock_manager/impl/clock_manager_impl.cpp
new file mode 100644
index 0000000..dc61a63
--- /dev/null
+++ b/modem/clock_manager/impl/clock_manager_impl.cpp
@@ -0,0 +1,9 @@
+#include "clock_manager_impl.h"
+
+#include <unistd.h>
+
+namespace pixel_modem {
+
+void ClockManagerImpl::Sleep(size_t seconds) const { sleep(seconds); }
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/impl/include/clock_manager_impl.h b/modem/clock_manager/impl/include/clock_manager_impl.h
new file mode 100644
index 0000000..d626b98
--- /dev/null
+++ b/modem/clock_manager/impl/include/clock_manager_impl.h
@@ -0,0 +1,13 @@
+#pragma once
+
+#include <cstddef>
+
+#include "clock_manager.h"
+
+namespace pixel_modem {
+
+struct ClockManagerImpl : public ClockManager {
+  void Sleep(size_t seconds) const override;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/clock_manager/include/clock_manager.h b/modem/clock_manager/include/clock_manager.h
new file mode 100644
index 0000000..1db88c5
--- /dev/null
+++ b/modem/clock_manager/include/clock_manager.h
@@ -0,0 +1,28 @@
+#pragma once
+
+#include <cstddef>
+
+namespace pixel_modem {
+
+/**
+ * @brief Interface for time based operations.
+ *
+ * This interface was intentionally not called `Clock`, like the Java side
+ * counterpart since it's likely that clients would call the local variable
+ * `clock(_)`, which would clash with the C defined `clock` method.
+ */
+struct ClockManager {
+  virtual ~ClockManager() = default;
+
+  /**
+   * @brief Sleep the thread for a given number of seconds.
+   *
+   * @param seconds Minimum number of seconds to sleep for. Note, this is
+   * different than the Java android clock which accepts seconds. This was done
+   * because C++ developers are likely more familiar with the `sleep` command,
+   * which accepts seconds.
+   */
+  virtual void Sleep(size_t seconds) const = 0;
+};
+
+}  // namespace pixel_modem
diff --git a/modem/dump_modemlog.cpp b/modem/dump_modemlog.cpp
deleted file mode 100644
index 1b6b2e9..0000000
--- a/modem/dump_modemlog.cpp
+++ /dev/null
@@ -1,73 +0,0 @@
-/*
- * Copyright 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-#include <android-base/properties.h>
-#include <dump/pixel_dump.h>
-
-#include "dumper.h"
-#include "modem_log_dumper.h"
-
-namespace modem {
-namespace logging {
-
-/**
- * @brief Implementation of AndroidPropertyManager that directly forwards to
- * android base methods.
- */
-class AndroidPropertyManagerImpl : public AndroidPropertyManager {
- public:
-  bool GetBoolProperty(const std::string& key, bool default_value) override {
-    return android::base::GetBoolProperty(key, default_value);
-  };
-
-  std::string GetProperty(const std::string& key,
-                          const std::string& default_value) override {
-    return android::base::GetProperty(key, default_value);
-  };
-  int GetIntProperty(const std::string& key, int default_value) override {
-    return android::base::GetIntProperty(key, default_value);
-  };
-  void SetProperty(const std::string& key, const std::string& value) override {
-    android::base::SetProperty(key, value);
-  };
-};
-
-/**
- * @brief Implementation of Dumper that directly forwards to their corresponding
- * dumpstate methods.
- */
-class DumperImpl : public Dumper {
- public:
-  void DumpLogs(const LogDumpInfo& log_dump_info) override {
-    dumpLogs(log_dump_info.src_dir.data(), log_dump_info.dest_dir.data(),
-             log_dump_info.limit, log_dump_info.prefix.data());
-  }
-  void CopyFile(const FileCopyInfo& file_copy_info) override {
-    copyFile(file_copy_info.src_dir.data(), file_copy_info.dest_dir.data());
-  }
-};
-
-}  // namespace logging
-}  // namespace modem
-
-int main() {
-  modem::logging::DumperImpl dumper_impl;
-  modem::logging::AndroidPropertyManagerImpl android_property_manager_impl;
-  modem::logging::ModemLogDumper modem_log_dumper(
-      dumper_impl, android_property_manager_impl);
-
-  modem_log_dumper.DumpModemLogs();
-  return 0;
-}
diff --git a/modem/dump_modemlog/Android.bp b/modem/dump_modemlog/Android.bp
new file mode 100644
index 0000000..aca7b20
--- /dev/null
+++ b/modem/dump_modemlog/Android.bp
@@ -0,0 +1,79 @@
+package {
+    default_applicable_licenses: [ "Android-Apache-2.0" ],
+}
+
+sh_binary {
+    name: "dump_modem.sh",
+    src: "dump_modem.sh",
+    vendor: true,
+    sub_dir: "dump",
+}
+
+// Modem Log Dumper
+
+modem_log_dumper_public_deps = [
+    "modem_android_property_manager",
+]
+
+// When `modem_log_dumper` is included statically, its dependencies are not
+// transitively included, so the target will also have to include this default
+// to restate them.
+cc_defaults {
+    name: "modem_log_dumper_defaults",
+    shared_libs: modem_log_dumper_public_deps + [
+        "libbase",
+        // liblog is not directly used by us, but it's a transitive dependency of libbase
+        "liblog",
+        "modem_log_constants",
+    ],
+}
+
+cc_library {
+    name: "modem_log_dumper",
+    srcs: [ "modem_log_dumper.cpp" ],
+    defaults: [ "modem_log_dumper_defaults" ],
+    export_shared_lib_headers: modem_log_dumper_public_deps,
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
+
+// dump_modemlog
+
+cc_binary {
+    name: "dump_modemlog",
+    srcs: [ "dump_modemlog.cpp" ],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+        "liblog",
+        "modem_android_property_manager_impl",
+        "modem_log_dumper",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
+
+cc_test {
+    name: "dump_modemlog_test",
+    srcs: [ "modem_log_dumper_test.cpp" ],
+    defaults: [
+        "modem_log_dumper_defaults",
+        "modem_android_property_manager_fake_defaults",
+    ],
+    static_libs: [
+        "modem_android_property_manager",
+        "modem_android_property_manager_fake",
+        "modem_log_constants",
+        "modem_log_dumper",
+        "libgmock",
+    ],
+    vendor: true,
+    // Shared libs in vendor folder are guarded by SEPolicy, so tests need root
+    // access to run them.
+    require_root: true,
+}
diff --git a/modem/dump_modem.sh b/modem/dump_modemlog/dump_modem.sh
similarity index 100%
rename from modem/dump_modem.sh
rename to modem/dump_modemlog/dump_modem.sh
diff --git a/modem/dump_modemlog/dump_modemlog.cpp b/modem/dump_modemlog/dump_modemlog.cpp
new file mode 100644
index 0000000..bed936c
--- /dev/null
+++ b/modem/dump_modemlog/dump_modemlog.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <android-base/properties.h>
+#include <dump/pixel_dump.h>
+
+#include "android_property_manager_impl.h"
+#include "dumper.h"
+#include "modem_log_dumper.h"
+
+namespace pixel_modem::logging {
+
+/**
+ * @brief Implementation of Dumper that directly forwards to their corresponding
+ * dumpstate methods.
+ */
+class DumperImpl : public Dumper {
+ public:
+  void DumpLogs(const LogDumpInfo& log_dump_info) override {
+    dumpLogs(log_dump_info.src_dir.data(), log_dump_info.dest_dir.data(),
+             log_dump_info.limit, log_dump_info.prefix.data());
+  }
+  void CopyFile(const FileCopyInfo& file_copy_info) override {
+    copyFile(file_copy_info.src_dir.data(), file_copy_info.dest_dir.data());
+  }
+};
+
+}  // namespace pixel_modem::logging
+
+int main() {
+  pixel_modem::logging::DumperImpl dumper_impl;
+  pixel_modem::AndroidPropertyManagerImpl android_property_manager_impl;
+  pixel_modem::logging::ModemLogDumper modem_log_dumper(
+      dumper_impl, android_property_manager_impl);
+
+  modem_log_dumper.DumpModemLogs();
+  return 0;
+}
diff --git a/modem/dump_modemlog/dump_modemlog.mk b/modem/dump_modemlog/dump_modemlog.mk
new file mode 100644
index 0000000..5e91ab7
--- /dev/null
+++ b/modem/dump_modemlog/dump_modemlog.mk
@@ -0,0 +1,5 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/dump_modemlog/sepolicy
+
+PRODUCT_PACKAGES += dump_modem.sh
+PRODUCT_PACKAGES += dump_modemlog
+
diff --git a/modem/dump_modemlog/include/bugreport_constants.h b/modem/dump_modemlog/include/bugreport_constants.h
new file mode 100644
index 0000000..25c800f
--- /dev/null
+++ b/modem/dump_modemlog/include/bugreport_constants.h
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <string_view>
+
+#include "dumper.h"
+
+namespace pixel_modem::logging {
+
+inline constexpr std::string_view kBugreportPackingDirectory =
+    "/data/vendor/radio/logs/always-on/all_logs";
+
+inline constexpr LogDumpInfo kLogDumpInfo[] = {
+    {.src_dir = "/data/vendor/radio/extended_logs",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 20,
+     .prefix = "extended_log_"},
+    {.src_dir = "/data/vendor/radio/sim/",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 1,
+     .prefix = "sim_poweron_log_"},
+    {.src_dir = "data/vendor/radio/logs/history",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 2,
+     .prefix = "Logging"}};
+
+constexpr FileCopyInfo kFileCopyInfo[] = {
+    {.src_dir = "/mnt/vendor/efs/nv_normal.bin",
+     .dest_dir = "/data/vendor/radio/logs/always-on/all_logs/nv_normal.bin"},
+    {.src_dir = "/mnt/vendor/efs/nv_protected.bin",
+     .dest_dir =
+         "/data/vendor/radio/logs/always-on/all_logs/nv_protected.bin"}};
+
+}  // namespace pixel_modem::logging
diff --git a/modem/include/dumper.h b/modem/dump_modemlog/include/dumper.h
similarity index 95%
rename from modem/include/dumper.h
rename to modem/dump_modemlog/include/dumper.h
index 348e666..a9b96c6 100644
--- a/modem/include/dumper.h
+++ b/modem/dump_modemlog/include/dumper.h
@@ -3,8 +3,7 @@
 #include <ostream>
 #include <string_view>
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 
 /**
  * @brief Data object for information about dumpings logs.
@@ -67,5 +66,5 @@
   virtual void DumpLogs(const LogDumpInfo& log_dump_info);
   virtual void CopyFile(const FileCopyInfo& file_copy_info);
 };
-}  // namespace logging
-}  // namespace modem
+
+}  // namespace pixel_modem::logging
diff --git a/modem/include/modem_log_dumper.h b/modem/dump_modemlog/include/modem_log_dumper.h
similarity index 96%
rename from modem/include/modem_log_dumper.h
rename to modem/dump_modemlog/include/modem_log_dumper.h
index 96911b0..1533217 100644
--- a/modem/include/modem_log_dumper.h
+++ b/modem/dump_modemlog/include/modem_log_dumper.h
@@ -3,8 +3,7 @@
 #include "android_property_manager.h"
 #include "dumper.h"
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 
 /**
  * @brief Responsible for dumping all relevant modem logs.
@@ -77,5 +76,4 @@
   AndroidPropertyManager& android_property_manager_;
 };
 
-}  // namespace logging
-}  // namespace modem
+}  // namespace pixel_modem::logging
diff --git a/modem/modem_log_dumper.cpp b/modem/dump_modemlog/modem_log_dumper.cpp
similarity index 85%
rename from modem/modem_log_dumper.cpp
rename to modem/dump_modemlog/modem_log_dumper.cpp
index fad8d29..127478e 100644
--- a/modem/modem_log_dumper.cpp
+++ b/modem/dump_modemlog/modem_log_dumper.cpp
@@ -2,11 +2,11 @@
 
 #include <log/log.h>
 
+#include "bugreport_constants.h"
 #include "dumper.h"
 #include "modem_log_constants.h"
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 
 void ModemLogDumper::DumpModemLogs() {
   bool shouldRestartModemLogging =
@@ -15,7 +15,11 @@
       kModemLoggingNumberBugreportProperty.data(),
       kDefaultBugreportNumberFiles);
 
-  if (shouldRestartModemLogging) {
+  // Should always trigger `stopModemLogging`. This is because currently copying
+  // modem logs and stopping modem logging are entangled.
+  // TODO: b/289435256 - Always copy logs and return this to checking if logging
+  // is actively running.
+  if (allowedToStopModemLogging()) {
     // If modem logging is running at time of bugreport, it needs to be stopped
     // to ensure that the most recent logs are included in the bugreport. If
     // this command fails, only older log files will be included, as seen in
@@ -76,5 +80,5 @@
   android_property_manager_.SetProperty(kModemLoggingEnabledProperty.data(),
                                         "true");
 }
-}  // namespace logging
-}  // namespace modem
+
+}  // namespace pixel_modem::logging
diff --git a/modem/test/modem_log_dumper_test.cpp b/modem/dump_modemlog/modem_log_dumper_test.cpp
similarity index 90%
rename from modem/test/modem_log_dumper_test.cpp
rename to modem/dump_modemlog/modem_log_dumper_test.cpp
index a052d43..81bec8b 100644
--- a/modem/test/modem_log_dumper_test.cpp
+++ b/modem/dump_modemlog/modem_log_dumper_test.cpp
@@ -2,13 +2,15 @@
 
 #include <string_view>
 
+#include "android_property_manager.h"
+#include "bugreport_constants.h"
 #include "dumper.h"
 #include "fake_android_property_manager.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "modem_log_constants.h"
 
-namespace modem {
-namespace logging {
+namespace pixel_modem::logging {
 namespace {
 
 using ::testing::Eq;
@@ -23,9 +25,8 @@
 
 void StartModemLogging(
     FakeAndroidPropertyManager& fake_android_property_manager) {
-  fake_android_property_manager.SetProperty(
-      kModemLoggingEnabledProperty.data(),
-      FakeAndroidPropertyManager::kTruthString.data());
+  fake_android_property_manager.SetProperty(kModemLoggingEnabledProperty.data(),
+                                            kTruthString.data());
 }
 
 class MockDumper : public Dumper {
@@ -101,6 +102,6 @@
 
   EXPECT_FALSE(fake_android_property_manager.ModemLoggingHasRestarted());
 }
+
 }  // namespace
-}  // namespace logging
-}  // namespace modem
+}  // namespace pixel_modem::logging
diff --git a/modem/sepolicy/dump_modem.te b/modem/dump_modemlog/sepolicy/dump_modem.te
similarity index 100%
rename from modem/sepolicy/dump_modem.te
rename to modem/dump_modemlog/sepolicy/dump_modem.te
diff --git a/modem/sepolicy/dump_modemlog.te b/modem/dump_modemlog/sepolicy/dump_modemlog.te
similarity index 100%
rename from modem/sepolicy/dump_modemlog.te
rename to modem/dump_modemlog/sepolicy/dump_modemlog.te
diff --git a/modem/sepolicy/file.te b/modem/dump_modemlog/sepolicy/file.te
similarity index 100%
rename from modem/sepolicy/file.te
rename to modem/dump_modemlog/sepolicy/file.te
diff --git a/modem/sepolicy/file_contexts b/modem/dump_modemlog/sepolicy/file_contexts
similarity index 100%
rename from modem/sepolicy/file_contexts
rename to modem/dump_modemlog/sepolicy/file_contexts
diff --git a/modem/sepolicy/genfs_contexts b/modem/dump_modemlog/sepolicy/genfs_contexts
similarity index 100%
rename from modem/sepolicy/genfs_contexts
rename to modem/dump_modemlog/sepolicy/genfs_contexts
diff --git a/modem/include/android_property_manager.h b/modem/include/android_property_manager.h
deleted file mode 100644
index 7135d66..0000000
--- a/modem/include/android_property_manager.h
+++ /dev/null
@@ -1,21 +0,0 @@
-#pragma once
-
-#include <string>
-
-namespace modem {
-namespace logging {
-
-/**
- * @brief Interface for interacting with Android System Properties.
- */
-class AndroidPropertyManager {
- public:
-  virtual ~AndroidPropertyManager() = default;
-  virtual bool GetBoolProperty(const std::string& key, bool default_value);
-  virtual std::string GetProperty(const std::string& key,
-                                  const std::string& default_value);
-  virtual int GetIntProperty(const std::string& key, int default_value);
-  virtual void SetProperty(const std::string& key, const std::string& value);
-};
-}  // namespace logging
-}  // namespace modem
diff --git a/modem/include/modem_log_constants.h b/modem/include/modem_log_constants.h
deleted file mode 100644
index 29a0fa8..0000000
--- a/modem/include/modem_log_constants.h
+++ /dev/null
@@ -1,56 +0,0 @@
-#pragma once
-#include <string>
-
-#include "dumper.h"
-
-namespace modem {
-namespace logging {
-
-// Modem related Android System Properties
-
-// Controls triggering `modem_logging_start` and `modem_logging_stop`.
-inline constexpr static std::string_view kModemLoggingEnabledProperty =
-    "vendor.sys.modem.logging.enable";
-// Signals the current modem logging state. This will be set to
-// `vendor.sys.modem.logging.enable` when `modem_log_start` or `modem_log_stop`
-// terminates.
-inline constexpr static std::string_view kModemLoggingStatusProperty =
-    "vendor.sys.modem.logging.status";
-// Int which specifies how many files to include in the bugreport.
-inline constexpr static std::string_view kModemLoggingNumberBugreportProperty =
-    "persist.vendor.sys.modem.logging.br_num";
-// Signals the current location that is being logged to. This can be used to
-// determine the logging type.
-inline constexpr static std::string_view kModemLoggingPathProperty =
-    "vendor.sys.modem.logging.log_path";
-
-// Bugreport constants
-inline constexpr static int kDefaultBugreportNumberFiles = 100;
-inline constexpr static std::string_view kModemAlwaysOnLogDirectory =
-    "/data/vendor/radio/logs/always-on";
-inline constexpr static std::string_view kModemLogPrefix = "sbuff_";
-inline constexpr static std::string_view kBugreportPackingDirectory =
-    "/data/vendor/radio/logs/always-on/all_logs";
-
-inline constexpr static LogDumpInfo kLogDumpInfo[] = {
-    {.src_dir = "/data/vendor/radio/extended_logs",
-     .dest_dir = kBugreportPackingDirectory,
-     .limit = 20,
-     .prefix = "extended_log_"},
-    {.src_dir = "/data/vendor/radio/sim/",
-     .dest_dir = kBugreportPackingDirectory,
-     .limit = 1,
-     .prefix = "sim_poweron_log_"},
-    {.src_dir = "data/vendor/radio/logs/history",
-     .dest_dir = kBugreportPackingDirectory,
-     .limit = 2,
-     .prefix = "Logging"}};
-
-constexpr static FileCopyInfo kFileCopyInfo[] = {
-    {.src_dir = "/mnt/vendor/efs/nv_normal.bin",
-     .dest_dir = "/data/vendor/radio/logs/always-on/all_logs/nv_normal.bin"},
-    {.src_dir = "/mnt/vendor/efs/nv_protected.bin",
-     .dest_dir =
-         "/data/vendor/radio/logs/always-on/all_logs/nv_protected.bin"}};
-}  // namespace logging
-}  // namespace modem
diff --git a/modem/modem.mk b/modem/modem.mk
index 10df7d4..d921e74 100644
--- a/modem/modem.mk
+++ b/modem/modem.mk
@@ -1,5 +1 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/modem/sepolicy
-
-PRODUCT_PACKAGES += dump_modem.sh
-PRODUCT_PACKAGES += dump_modemlog
-
+include device/google/gs-common/modem/dump_modemlog/dump_modemlog.mk
diff --git a/modem/modem_log_constants/Android.bp b/modem/modem_log_constants/Android.bp
new file mode 100644
index 0000000..f4e3177
--- /dev/null
+++ b/modem/modem_log_constants/Android.bp
@@ -0,0 +1,9 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_library {
+    name: "modem_log_constants",
+    export_include_dirs: [ "include" ],
+    vendor_available: true,
+}
diff --git a/modem/modem_log_constants/include/modem_log_constants.h b/modem/modem_log_constants/include/modem_log_constants.h
new file mode 100644
index 0000000..68004cf
--- /dev/null
+++ b/modem/modem_log_constants/include/modem_log_constants.h
@@ -0,0 +1,35 @@
+#pragma once
+
+#include <string_view>
+
+namespace pixel_modem::logging {
+
+// Modem related Android System Properties
+
+// Controls triggering `modem_logging_start` and `modem_logging_stop`.
+inline constexpr std::string_view kModemLoggingEnabledProperty =
+    "vendor.sys.modem.logging.enable";
+// Signals the current modem logging state. This will be set to
+// `vendor.sys.modem.logging.enable` when `modem_log_start` or `modem_log_stop`
+// terminates.
+inline constexpr std::string_view kModemLoggingStatusProperty =
+    "vendor.sys.modem.logging.status";
+// Int which specifies how many files to include in the bugreport.
+inline constexpr std::string_view kModemLoggingNumberBugreportProperty =
+    "persist.vendor.sys.modem.logging.br_num";
+// Signals the current location that is being logged to. This can be used to
+// determine the logging type.
+inline constexpr std::string_view kModemLoggingPathProperty =
+    "vendor.sys.modem.logging.log_path";
+inline constexpr std::string_view kModemLoggingLogCountProperty =
+    "vendor.sys.modem.logging.log_count";
+inline constexpr std::string_view kModemLoggingLogPath =
+    "vendor.sys.modem.logging.log_path";
+
+// Bugreport constants
+inline constexpr int kDefaultBugreportNumberFiles = 100;
+inline constexpr std::string_view kModemAlwaysOnLogDirectory =
+    "/data/vendor/radio/logs/always-on";
+inline constexpr std::string_view kModemLogPrefix = "sbuff_";
+
+}  // namespace pixel_modem::logging
diff --git a/modem/test/include/fake_android_property_manager.h b/modem/test/include/fake_android_property_manager.h
deleted file mode 100644
index 79fd4f1..0000000
--- a/modem/test/include/fake_android_property_manager.h
+++ /dev/null
@@ -1,77 +0,0 @@
-
-
-#include <map>
-#include <string>
-#include <string_view>
-
-#include "android_property_manager.h"
-#include "modem_log_constants.h"
-
-namespace modem {
-namespace logging {
-
-/**
- * @brief Fake Implementation of AndroidPropertyManager that mocks some of the
- * property changing behaviour from pixellogger's `modem_logging_control`.
- */
-class FakeAndroidPropertyManager : public AndroidPropertyManager {
- public:
-  inline constexpr static std::string_view kTruthString = "true";
-  inline constexpr static std::string_view kFalseString = "false";
-
-  bool GetBoolProperty(const std::string& key, bool default_value) override {
-    return MapContainsKey(key)
-               ? GetPropertyInternal(key) == kTruthString
-               : default_value;
-  };
-
-  std::string GetProperty(const std::string& key,
-                          const std::string& default_value) override {
-    return MapContainsKey(key) ? GetPropertyInternal(key) : default_value;
-    ;
-  };
-
-  int GetIntProperty(const std::string& key, int default_value) override {
-    return MapContainsKey(key) ? std::stoi(GetPropertyInternal(key))
-                               : default_value;
-  };
-
-  /**
-   * This function needs to copy the behaviour of `modem_logging_control` to
-   * ensure that the right properties are being set in order.
-   *
-   * More specifically, this function will also set the
-   * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
-   * set to simulate modem logging stopping / starting.
-   */
-  void SetProperty(const std::string& key, const std::string& value) override {
-    if (key == kModemLoggingEnabledProperty) {
-      property_map_[kModemLoggingStatusProperty.data()] = value;
-
-      // need to track if modem logging has restarted or not
-      if (value == kFalseString) {
-        modem_logging_has_been_off_ = true;
-      }
-      if (modem_logging_has_been_off_ && (value == kTruthString)) {
-        modem_logging_has_restarted_ = true;
-      }
-    }
-    property_map_[key] = value;
-  };
-
-  bool ModemLoggingHasRestarted() { return modem_logging_has_restarted_; }
-
- private:
-  bool MapContainsKey(const std::string& key) {
-    return property_map_.find(key) != property_map_.end();
-  }
-  std::string GetPropertyInternal(const std::string& key) {
-    return property_map_.find(key)->second;
-  }
-
-  std::map<std::string, std::string> property_map_;
-  bool modem_logging_has_been_off_ = false;
-  bool modem_logging_has_restarted_ = false;
-};
-}  // namespace logging
-}  // namespace modem
diff --git a/pixel_metrics/dump_pixel_metrics.cpp b/pixel_metrics/dump_pixel_metrics.cpp
index 2dd5553..597d765 100644
--- a/pixel_metrics/dump_pixel_metrics.cpp
+++ b/pixel_metrics/dump_pixel_metrics.cpp
@@ -21,6 +21,7 @@
     setbuf(stdout, NULL);
     dumpFileContent("Long running IRQ metrics", "/sys/kernel/metrics/irq/long_irq_metrics");
     dumpFileContent("Storm IRQ metrics", "/sys/kernel/metrics/irq/storm_irq_metrics");
+    dumpFileContent("Long RT Runnable metrics", "/sys/kernel/metrics/runnable/stats");
     dumpFileContent("Resume latency metrics", "/sys/kernel/metrics/resume_latency/resume_latency_metrics");
     return 0;
 }
diff --git a/pixel_metrics/sepolicy/genfs_contexts b/pixel_metrics/sepolicy/genfs_contexts
index 45ba566..c58fbe7 100644
--- a/pixel_metrics/sepolicy/genfs_contexts
+++ b/pixel_metrics/sepolicy/genfs_contexts
@@ -3,5 +3,7 @@
 genfscon sysfs /kernel/metrics/irq/long_irq_metrics                       u:object_r:sysfs_vendor_metrics:s0
 genfscon sysfs /kernel/metrics/irq/stats_reset                            u:object_r:sysfs_vendor_metrics:s0
 genfscon sysfs /kernel/metrics/irq/storm_irq_metrics                      u:object_r:sysfs_vendor_metrics:s0
+genfscon sysfs /kernel/metrics/runnable/stats_reset                       u:object_r:sysfs_vendor_metrics:s0
+genfscon sysfs /kernel/metrics/runnable/stats                             u:object_r:sysfs_vendor_metrics:s0
 genfscon sysfs /kernel/metrics/thermal/tr_by_group/tmu/stats              u:object_r:sysfs_vendor_metrics:s0
 genfscon sysfs /kernel/metrics/thermal/tr_by_group/spmic/stats            u:object_r:sysfs_vendor_metrics:s0
diff --git a/sensors/sepolicy/file.te b/sensors/sepolicy/file.te
index 97084b6..f59381b 100644
--- a/sensors/sepolicy/file.te
+++ b/sensors/sepolicy/file.te
@@ -1,2 +1,18 @@
+#
+# USF file SELinux type enforcements.
+#
+
 type vendor_usf_stats, vendor_file_type, file_type;
 type vendor_usf_reg_edit, vendor_file_type, file_type;
+
+# Declare the sensor registry persist file type. By convention, persist file
+# types begin with "persist_".
+type persist_sensor_reg_file, file_type, vendor_persist_type;
+
+# Declare the sensor registry data file type. By convention, data file types
+# end with "data_file".
+type sensor_reg_data_file, file_type, data_file_type;
+
+# Declare the sensor debug data file type. By convention, data file types
+# end with "data_file".
+type sensor_debug_data_file, file_type, data_file_type;
diff --git a/sensors/sepolicy/file_contexts b/sensors/sepolicy/file_contexts
index 0fbbdf2..d41b33e 100644
--- a/sensors/sepolicy/file_contexts
+++ b/sensors/sepolicy/file_contexts
@@ -1,3 +1,16 @@
+#
+# USF SELinux file security contexts.
+#
+
 /vendor/bin/dump/dump_sensors      u:object_r:dump_sensors_exec:s0
 /vendor/bin/usf_stats              u:object_r:vendor_usf_stats:s0
 /vendor/bin/usf_reg_edit           u:object_r:vendor_usf_reg_edit:s0
+
+# Sensor registry persist files.
+/mnt/vendor/persist/sensors/registry(/.*)? u:object_r:persist_sensor_reg_file:s0
+
+# Sensor registry data files.
+/data/vendor/sensors/registry(/.*)? u:object_r:sensor_reg_data_file:s0
+
+# Sensor debug data files.
+/data/vendor/sensors/debug(/.*)? u:object_r:sensor_debug_data_file:s0
diff --git a/sensors/sepolicy/hal_sensors_default.te b/sensors/sepolicy/hal_sensors_default.te
new file mode 100644
index 0000000..1d152d4
--- /dev/null
+++ b/sensors/sepolicy/hal_sensors_default.te
@@ -0,0 +1,65 @@
+#
+# USF sensor HAL SELinux type enforcements.
+#
+
+# Allow reading of sensor registry persist files.
+allow hal_sensors_default mnt_vendor_file:dir search;
+allow hal_sensors_default persist_file:dir search;
+allow hal_sensors_default persist_file:file r_file_perms;
+r_dir_file(hal_sensors_default, persist_sensor_reg_file)
+
+# Allow creation and writing of sensor registry data files.
+allow hal_sensors_default sensor_reg_data_file:dir rw_dir_perms;
+allow hal_sensors_default sensor_reg_data_file:file create_file_perms;
+
+userdebug_or_eng(`
+    # Allow creation and writing of sensor debug data files.
+    allow hal_sensors_default sensor_debug_data_file:dir rw_dir_perms;
+    allow hal_sensors_default sensor_debug_data_file:file create_file_perms;
+')
+
+# Allow access to the AoC communication driver.
+allow hal_sensors_default aoc_device:chr_file rw_file_perms;
+
+# Allow access to the AoC clock and kernel boot time sys FS node. This is needed
+# to synchronize the AP and AoC clock timestamps.
+allow hal_sensors_default sysfs_aoc_boottime:file rw_file_perms;
+
+# Allow access to the sysfs_aoc.
+allow hal_sensors_default sysfs_aoc:dir search;
+allow hal_sensors_default sysfs_aoc:file r_file_perms;
+
+# Allow sensor HAL to reset AOC.
+allow hal_sensors_default sysfs_aoc_reset:file rw_file_perms;
+
+# Allow sensor HAL to read AoC dumpstate.
+allow hal_sensors_default sysfs_aoc_dumpstate:file r_file_perms;
+
+# Allow access for AoC properties.
+get_prop(hal_sensors_default, vendor_aoc_prop)
+
+# Allow create thread to watch AOC's device.
+allow hal_sensors_default device:dir r_dir_perms;
+
+# Allow access to sensor service for sensor_listener.
+binder_call(hal_sensors_default, system_server);
+
+# Allow use of the USF low latency transport.
+usf_low_latency_transport(hal_sensors_default)
+
+# Allow sensor HAL to access to display sysfs.
+allow hal_sensors_default sysfs_display:file r_file_perms;
+
+# Allow display_info_service access to the backlight driver.
+allow hal_sensors_default sysfs_leds:dir search;
+allow hal_sensors_default sysfs_leds:file rw_file_perms;
+
+# Allow SensorSuez to connect AIDL stats.
+binder_use(hal_sensors_default);
+allow hal_sensors_default fwk_stats_service:service_manager find;
+
+# Allow access to CHRE socket to connect to nanoapps.
+unix_socket_connect(hal_sensors_default, chre, chre)
+
+# Allow access to the power supply files for MagCC.
+r_dir_file(hal_sensors_default, sysfs_batteryinfo)
diff --git a/sensors/sepolicy/te_macros b/sensors/sepolicy/te_macros
new file mode 100644
index 0000000..01ac13c
--- /dev/null
+++ b/sensors/sepolicy/te_macros
@@ -0,0 +1,14 @@
+#
+# USF SELinux type enforcement macros.
+#
+
+#
+# usf_low_latency_transport(domain)
+#
+# Allows domain use of the USF low latency transport.
+#
+define(`usf_low_latency_transport', `
+  allow $1 hal_graphics_mapper_hwservice:hwservice_manager find;
+  hal_client_domain($1, hal_graphics_allocator)
+')
+
diff --git a/soc/Android.bp b/soc/Android.bp
index e913154..43e9202 100644
--- a/soc/Android.bp
+++ b/soc/Android.bp
@@ -2,11 +2,21 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-sh_binary {
-    name: "dump_memory.sh",
-    src: "dump_memory.sh",
+cc_binary {
+    name: "dump_memory",
+    srcs: ["dump_memory.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+	"libdump",
+	"liblog",
+    ],
     vendor: true,
-    sub_dir: "dump",
+    relative_install_path: "dump",
 }
 
 cc_binary {
diff --git a/soc/dump_memory.cpp b/soc/dump_memory.cpp
new file mode 100644
index 0000000..1528f73
--- /dev/null
+++ b/soc/dump_memory.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <dump/pixel_dump.h>
+
+#include <android-base/file.h>
+#include <stdio.h>
+#include <log/log.h>
+
+char* concat(char* result, const char* one, const char* two){
+  strcpy(result, one);
+  strcat(result, two);
+  return result;
+}
+
+void iterate(const char* path){
+    dirent *entry, *entry2;
+    char result[100], base[100];
+
+    std::unique_ptr<DIR, decltype(&closedir)> ion(opendir(path), closedir);
+    if (!ion) {
+        ALOGE("Fail To Open Dir %s", path);
+        return;
+    }
+    while ((entry = readdir(ion.get())) != nullptr) {
+        if(entry->d_name[0] == '.') {
+            continue;
+        }
+        strcpy(base, path);
+        strcat(base, entry->d_name);
+        strcat(base, "/");
+        std::unique_ptr<DIR, decltype(&closedir)> ion2(opendir(base), closedir);
+        if (!ion2) {
+            ALOGE("Fail To Open Dir %s\n", base);
+            return;
+        }
+        while ((entry2 = readdir(ion2.get())) != nullptr) {
+            if(entry2->d_name[0] == '.') {
+                continue;
+            }
+            dumpFileContent(entry2->d_name, concat(result, base, entry2->d_name));
+        }
+    }
+    return;
+}
+
+// Dump memory.
+int main() {
+    dirent *entry;
+    char result[100];
+
+    printf("------ ION HEAPS  ------\n");
+    iterate("/d/ion/");
+
+    dumpFileContent("dmabuf info", "/d/dma_buf/bufinfo");
+    dumpFileContent("Page Pinner - longterm pin", "/sys/kernel/debug/page_pinner/buffer");
+
+    printf("------ CMA info  ------\n");
+    std::unique_ptr<DIR, decltype(&closedir)> cmadebug(opendir("/sys/kernel/debug/cma/"), closedir);
+    if (!cmadebug) {
+        ALOGE("Fail To Open Dir /sys/kernel/debug/cma/");
+    } else {
+        while ((entry = readdir(cmadebug.get())) != nullptr) {
+            if(entry->d_name[0] == '.') {
+                continue;
+            }
+            dumpFileContent("count", concat(result, concat(result, "/sys/kernel/debug/cma/", entry->d_name), "/count"));
+            dumpFileContent("used", concat(result, concat(result, "/sys/kernel/debug/cma/", entry->d_name), "/used"));
+            dumpFileContent("bitmap", concat(result, concat(result, "/sys/kernel/debug/cma/", entry->d_name), "/bitmap"));
+        }
+    }
+
+    printf("------ Pixel CMA stat  ------\n");
+    iterate("/sys/kernel/pixel_stat/mm/cma/");
+
+    dumpFileContent("Pixel Trace", "/sys/kernel/tracing/instances/pixel/trace");
+    return 0;
+}
+
diff --git a/soc/dump_memory.sh b/soc/dump_memory.sh
deleted file mode 100644
index 6135dea..0000000
--- a/soc/dump_memory.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/vendor/bin/sh
-echo "------ ION HEAPS ------"
-for d in $(ls -d /d/ion/*)
-do
-  if [ -f $d ]; then
-    echo --- $d
-    cat $d
-  else
-    for f in $(ls $d)
-    do
-      echo --- $d/$f
-      cat $d/$f
-    done
-  fi
-done
-
-echo "------ dmabuf info ------"
-cat "/d/dma_buf/bufinfo"
-
-echo "------ Page Pinner - longterm pin ------"
-cat "/sys/kernel/debug/page_pinner/buffer"
-
-echo "------ CMA info ------"
-for d in $(ls -d /sys/kernel/debug/cma/*)
-do
-  echo --- $d
-  echo --- count; cat $d/count;
-  echo --- used; cat $d/used;
-  echo --- bitmap; cat $d/bitmap;
-done
-
-echo "------ Pixel CMA stat ------"
-for d in $(ls -d /sys/kernel/pixel_stat/mm/cma/*); do
-  if [ -f $d ]; then
-    echo --- $d
-    cat $d
-  else
-    for f in $(ls $d); do
-      echo --- $d/$f
-      cat $d/$f
-    done
-  fi
-done
-
-echo "------ Pixel Trace ------"
-cat "/sys/kernel/tracing/instances/pixel/trace"
diff --git a/soc/sepolicy/soc/file_contexts b/soc/sepolicy/soc/file_contexts
index 23a91e5..5adc605 100644
--- a/soc/sepolicy/soc/file_contexts
+++ b/soc/sepolicy/soc/file_contexts
@@ -1,3 +1,3 @@
 /vendor/bin/dump/dump_soc           u:object_r:dump_soc_exec:s0
-/vendor/bin/dump/dump_memory\.sh    u:object_r:dump_memory_exec:s0
+/vendor/bin/dump/dump_memory        u:object_r:dump_memory_exec:s0
 
diff --git a/soc/soc.mk b/soc/soc.mk
index d08d99d..8ec9412 100644
--- a/soc/soc.mk
+++ b/soc/soc.mk
@@ -1,5 +1,5 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/soc/sepolicy/soc
 
 PRODUCT_PACKAGES += dump_soc
-PRODUCT_PACKAGES_DEBUG += dump_memory.sh
+PRODUCT_PACKAGES_DEBUG += dump_memory
 
diff --git a/storage/Android.bp b/storage/Android.bp
index c8671d1..3a06113 100644
--- a/storage/Android.bp
+++ b/storage/Android.bp
@@ -2,10 +2,20 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-sh_binary {
-    name: "dump_storage.sh",
-    src: "dump_storage.sh",
+cc_binary {
+    name: "dump_storage",
+    srcs: ["dump_storage.cpp"],
     init_rc: ["init.storage.rc"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+	"liblog",
+    ],
     vendor: true,
-    sub_dir: "dump",
+    relative_install_path: "dump",
 }
diff --git a/storage/dump_storage.cpp b/storage/dump_storage.cpp
new file mode 100644
index 0000000..e6b3e4c
--- /dev/null
+++ b/storage/dump_storage.cpp
@@ -0,0 +1,244 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dump/pixel_dump.h>
+#include <android-base/file.h>
+#include <android-base/stringprintf.h>
+#include <android-base/properties.h>
+#include <string.h>
+#include <stdio.h>
+#include <log/log.h>
+#include <regex>
+#include <fstream>
+#include <map>
+
+#define F2FS_FSCK_TIME_PROPERTY "ro.boottime.init.fsck.data"
+#define F2FS_MNT_TIME_PROPERTY "ro.boottime.init.mount.data"
+#define BOOTDEVICE_PROPERTY "ro.boot.bootdevice"
+#define BUILD_TYPE_PROPERTY "ro.build.type"
+
+void read_buffer(int buf_id, int total_len, const char* path)
+{
+    int i, len;
+    system("mkdir -m 0770 -p /data/vendor/storage/");
+    auto cmd = android::base::StringPrintf("rm -f /data/vendor/storage/%s\n", path);
+    system(cmd.c_str());
+
+    for (i=0;i<=total_len;i+=524288) {
+        if (total_len-i < 524288) {
+            len = total_len-i;
+            printf("/vendor/bin/sg_read_buffer -m 0x1c -i %d -l %d -o %d -r /dev/sg3 >> /data/vendor/storage/%s\n",
+                buf_id, len, i, path);
+            auto cmd = android::base::StringPrintf(
+                "/vendor/bin/sg_read_buffer -m 0x1c -i %d -l %d -o %d -r /dev/sg3 >> /data/vendor/storage/%s\n",
+                buf_id, len, i, path);
+            system(cmd.c_str());
+            break;
+        }
+        len = 524288;
+        printf("/vendor/bin/sg_read_buffer -m 0x1c -i %d -l %d -o %d -r /dev/sg3 >> /data/vendor/storage/%s\n",
+            buf_id, len, i, path);
+        auto cmd = android::base::StringPrintf(
+            "/vendor/bin/sg_read_buffer -m 0x1c -i %d -l %d -o %d -r /dev/sg3 >> /data/vendor/storage/%s\n",
+            buf_id, len, i, path);
+        system(cmd.c_str());
+    }
+}
+
+int main() {
+    //F2FS
+    dumpFileContent("F2FS status", "/sys/kernel/debug/f2fs/status");
+    dumpFileContent("F2FS fsck", "/dev/fscklogs/fsck");
+
+    int fsck_time = android::base::GetIntProperty(F2FS_FSCK_TIME_PROPERTY, 0);
+    printf("--- F2FS - fsck time (ms) ---\n%d\n\n", fsck_time);
+    int mnt_time = android::base::GetIntProperty(F2FS_MNT_TIME_PROPERTY, 0);
+    printf("--- F2FS - checkpoint=disable time (ms) ---\n%d\n\n", mnt_time);
+
+    //UFS
+    dumpFileContent("UFS model", "/sys/block/sda/device/model");
+    dumpFileContent("UFS rev", "/sys/block/sda/device/rev");
+    dumpFileContent("UFS size", "/sys/block/sda/size");
+
+    dumpFileContent("UFS Slow IO Read",
+                    "/dev/sys/block/bootdevice/slowio_read_cnt");
+    dumpFileContent("UFS Slow IO Write",
+                    "/dev/sys/block/bootdevice/slowio_write_cnt");
+    dumpFileContent("UFS Slow IO Unmap",
+                    "/dev/sys/block/bootdevice/slowio_unmap_cnt");
+    dumpFileContent("UFS Slow IO Sync",
+                    "/dev/sys/block/bootdevice/slowio_sync_cnt");
+
+    printf("------ UFS err_stats ------\n");
+    const std::string ufs_err_stats_path(
+            "/dev/sys/block/bootdevice/err_stats/");
+    std::unique_ptr<DIR, decltype(&closedir)> statdir(
+            opendir(ufs_err_stats_path.c_str()), closedir);
+    if (statdir) {
+        dirent *stat_entry;
+        while ((stat_entry = readdir(statdir.get())) != nullptr) {
+            std::string ufs_err_stats_path(stat_entry->d_name);
+            if (!strcmp(ufs_err_stats_path.c_str(), ".")
+                    || !strcmp(ufs_err_stats_path.c_str(), ".."))
+                continue;
+            std::string bootdevice = android::base::GetProperty(
+                    BOOTDEVICE_PROPERTY, "");
+            std::string err_stat_path = "/sys/devices/platform/";
+            err_stat_path.append(bootdevice.c_str());
+            err_stat_path.append("/err_stats/");
+            err_stat_path.append(ufs_err_stats_path.c_str());
+            std::ifstream err_stat_file(err_stat_path);
+            if (err_stat_file.is_open()) {
+                std::string err_stat_atom;
+                err_stat_file >> err_stat_atom;
+                printf("%s:%s\n", ufs_err_stats_path.c_str(),
+                       err_stat_atom.c_str());
+                err_stat_file.close();
+            }
+        }
+    }
+
+    printf("\n------ UFS io_stats ------\n");
+    printf("\t\t%-12s %-12s %-12s %-12s %-12s %-12s\n", "ReadCnt", "ReadBytes",
+           "WriteCnt", "WriteBytes", "RWCnt", "RWBytes");
+    const std::string ufs_io_stats = "/dev/sys/block/bootdevice/io_stats/";
+    const std::string iostats_seq[3] = {"_start", "_complete", "_maxdiff"};
+    const std::string iostats[6] = {"rcnt", "rbyte", "wcnt", "wbyte", "rwcnt",
+            "rwbyte"};
+
+    for (int i = 0; i < 3; i++) {
+        const std::string header[3] = {"Started: \t", "Completed: \t",
+                "MaxDiff: \t"};
+        printf("%s", header[i].c_str());
+        for (int j = 0; j < 6; j++) {
+            std::string iostat_path = ufs_io_stats.c_str();
+            iostat_path.append(iostats[j].c_str());
+            iostat_path.append(iostats_seq[i].c_str());
+            std::ifstream io_stats_file(iostat_path.c_str());
+            unsigned long io_stat_atom = 0;
+            if (io_stats_file.is_open()) {
+                io_stats_file >> io_stat_atom;
+                printf("%-12lu ", io_stat_atom);
+                io_stats_file.close();
+            }
+        }
+        printf("\n");
+    }
+
+    printf("\n------ UFS req_stats ------\n");
+    printf("\t%-12s %-12s %-12s %-12s %-12s %-12s\n", "All", "Write", "Read",
+           "Security", "Flush", "Discard");
+    const std::string ufs_req_stats = "/dev/sys/block/bootdevice/req_stats/";
+    const std::string reqstats_seq[4] = {"_min", "_max", "_avg", "_sum"};
+    const std::string reqstats[6] = {"all", "write", "read", "security",
+            "flush", "discard"};
+
+    for (int i = 0; i < 4; i++) {
+        const std::string header[4] = {"Min:\t", "Max: \t", "Avg: \t",
+                "Count: \t"};
+        printf("%s", header[i].c_str());
+        for (int j = 0; j < 6; j++) {
+            std::string reqstat_path = ufs_req_stats.c_str();
+            reqstat_path.append(reqstats[j].c_str());
+            reqstat_path.append(reqstats_seq[i].c_str());
+            std::ifstream req_stats_file(reqstat_path.c_str());
+            unsigned long req_stat_atom = 0;
+            if (req_stats_file.is_open()) {
+                req_stats_file >> req_stat_atom;
+                printf("%-12lu ", req_stat_atom);
+                req_stats_file.close();
+            }
+        }
+        printf("\n");
+    }
+
+    printf("\n------ UFS health ------\n");
+    dumpFileContent(
+            "",
+            "/dev/sys/block/bootdevice/health_descriptor/life_time_estimation_a");
+    dumpFileContent(
+            "",
+            "/dev/sys/block/bootdevice/health_descriptor/life_time_estimation_b");
+    dumpFileContent("", "/dev/sys/block/bootdevice/health_descriptor/eol_info");
+    dumpFileContent(
+            "",
+            "/dev/sys/block/bootdevice/health_descriptor/life_time_estimation_c");
+
+    printf("\n------ UFS error history ------\n");
+    std::string build_type = android::base::GetProperty(BUILD_TYPE_PROPERTY, "");
+    if (build_type == "userdebug") {
+        std::string sg_read_buffer = "/vendor/bin/sg_read_buffer";
+        std::ifstream sg_read_buffer_file(sg_read_buffer.c_str());
+        if (sg_read_buffer_file.is_open()) {
+            const std::string ufs_ver_path(
+                "/dev/sys/block/bootdevice/device_descriptor/specification_version");
+            std::ifstream ufs_ver_file(ufs_ver_path);
+            std::string ufs_ver;
+            if (ufs_ver_file.is_open()) {
+                ufs_ver_file >> ufs_ver;
+                ufs_ver_file.close();
+            }
+            if (strcmp(ufs_ver.c_str(), "0x0210")) {
+                const std::string ufs_brand_path("/sys/block/sda/device/vendor");
+                std::ifstream ufs_brand_file(ufs_brand_path);
+                std::string ufs_brand;
+                if (ufs_brand_file.is_open()) {
+                    ufs_brand_file >> ufs_brand;
+                    ufs_brand_file.close();
+                }
+
+                std::map<std::string, int> const table =
+                    {
+                    {"MICRON", 0x12C},
+                    {"KIOXIA", 0x198},
+                    {"SKhynix", 0x1AD},
+                    {"SAMSUNG", 0x1CE}
+                    };
+                auto ufs_vendor_id = table.find(ufs_brand);
+                if (ufs_vendor_id != table.end()) {
+                    switch(ufs_vendor_id->second){
+                      case 0x12C: //MICRON
+                        read_buffer(16, 2097152, "micron_10_ufs_err_history.dat");
+                        read_buffer(18, 10485760, "micron_12_ufs_err_history.dat");
+                        read_buffer(19, 10485760, "micron_13_ufs_err_history.dat");
+                        break;
+                      case 0x198: //KIOXIA
+                        read_buffer(16, 16773120, "kioxia_10_ufs_err_history.dat");
+                        read_buffer(17, 2097152, "kioxia_11_ufs_err_history.dat");
+                        read_buffer(18, 131072, "kioxia_12_ufs_err_history.dat");
+                        break;
+                      case 0x1AD: //SKhynix
+                        read_buffer(0, 4096, "hynix_00_ufs_err_history.dat");
+                        read_buffer(16, 131072, "skhynix_10_ufs_err_history.dat");
+                        read_buffer(17, 131072, "skhynix_11_ufs_err_history.dat");
+                        read_buffer(18, 131072, "skhynix_12_ufs_err_history.dat");
+                        read_buffer(19, 131072, "skhynix_13_ufs_err_history.dat");
+                        break;
+                      case 0x1CE: //SAMSUNG
+                        read_buffer(16, 8404992, "samsung_10_ufs_err_history.dat");
+                        break;
+                      default:
+                        break;
+                    }
+                }
+                sg_read_buffer_file.close();
+            }
+        } else
+          printf("sg_read_buffer does not exist\n");
+    }
+
+    return 0;
+}
diff --git a/storage/dump_storage.sh b/storage/dump_storage.sh
deleted file mode 100644
index 5f08fc1..0000000
--- a/storage/dump_storage.sh
+++ /dev/null
@@ -1,68 +0,0 @@
-#!/vendor/bin/sh
-# F2FS
-echo "--- F2FS status---"
-cat "/sys/kernel/debug/f2fs/status"
-echo "\n--- F2FS fsck ---"
-cat "/dev/fscklogs/fsck"
-echo "\n--- F2FS - fsck time (ms) ---"
-getprop ro.boottime.init.fsck.data
-echo "\n--- F2FS - checkpoint=disable time (ms) ---"
-getprop ro.boottime.init.mount.data
-
-# UFS
-echo "\n------ UFS model (/sys/block/sda/device/model) ------"
-cat "/sys/block/sda/device/model"
-echo "\n------ UFS rev (/sys/block/sda/device/rev) ------"
-cat "/sys/block/sda/device/rev"
-echo "\n------ UFS size (/sys/block/sda/size) ------"
-cat "/sys/block/sda/size"
-
-echo "\n------ UFS Slow IO Read (/dev/sys/block/bootdevice/slowio_read_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_read_cnt"
-echo "\n------ UFS Slow IO Write (/dev/sys/block/bootdevice/slowio_write_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_write_cnt"
-echo "\n------ UFS Slow IO Unmap (/dev/sys/block/bootdevice/slowio_unmap_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_unmap_cnt"
-echo "\n------ UFS Slow IO Sync (/dev/sys/block/bootdevice/slowio_sync_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_sync_cnt"
-
-echo "\n------ UFS err_stats ------"
-path="/dev/sys/block/bootdevice/err_stats";
-for node in `ls $path/* | grep -v reset_err_status`
-do
-  printf "%s:%d\n" $(basename $node) $(cat $node)
-done
-
-
-echo "\n------ UFS io_stats ------"
-path="/dev/sys/block/bootdevice/io_stats"
-printf "\t\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ReadCnt ReadBytes WriteCnt WriteBytes RWCnt RWBytes
-str=$(cat $path/*_start); arr=($str);
-printf "Started: \t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[1]} ${arr[0]} ${arr[5]} ${arr[4]} ${arr[3]} ${arr[2]}
-str=$(cat $path/*_complete); arr=($str);
-printf "Completed: \t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[1]} ${arr[0]} ${arr[5]} ${arr[4]} ${arr[3]} ${arr[2]}
-str=$(cat $path/*_maxdiff); arr=($str);
-printf "MaxDiff: \t%-12s %-12s %-12s %-12s %-12s %-12s\n\n" ${arr[1]} ${arr[0]} ${arr[5]} ${arr[4]} ${arr[3]} ${arr[2]}
-
-echo "\n------ UFS req_stats ------"
-path="/dev/sys/block/bootdevice/req_stats"
-printf "\t%-12s %-12s %-12s %-12s %-12s %-12s\n" All Write Read Security Flush Discard
-str=$(cat $path/*_min); arr=($str);
-printf "Min:\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-str=$(cat $path/*_max); arr=($str);
-printf "Max:\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-str=$(cat $path/*_avg); arr=($str);
-printf "Avg.:\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-str=$(cat $path/*_sum); arr=($str);
-printf "Count:\t%-12s %-12s %-12s %-12s %-12s %-12s\n\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-
-echo "\n------ UFS health ------"
-for f in $(find /dev/sys/block/bootdevice/health_descriptor -type f)
-do
-  if [[ -r $f && -f $f ]]; then
-    echo --- $f
-    cat $f
-    echo ''
-  fi
-done
-
diff --git a/storage/init.storage.rc b/storage/init.storage.rc
index 445f74b..56e8e4f 100644
--- a/storage/init.storage.rc
+++ b/storage/init.storage.rc
@@ -1,2 +1,3 @@
 on property:ro.build.type=userdebug
     write /dev/sys/block/bootdevice/pixel/enable_pixel_ufs_logging 1
+    chown system /dev/sg3
diff --git a/storage/sepolicy/dump_storage.te b/storage/sepolicy/dump_storage.te
index 9411f8e..5324c17 100644
--- a/storage/sepolicy/dump_storage.te
+++ b/storage/sepolicy/dump_storage.te
@@ -1,12 +1,20 @@
 pixel_bugreport(dump_storage)
 
-allow dump_storage vendor_toolbox_exec:file execute_no_trans;
 allow dump_storage sysfs_scsi_devices_0000:dir r_dir_perms;
 allow dump_storage sysfs_scsi_devices_0000:file r_file_perms;
 
 userdebug_or_eng(`
   allow dump_storage debugfs_f2fs:dir r_dir_perms;
   allow dump_storage debugfs_f2fs:file r_file_perms;
+  allow dump_storage sg_device:chr_file rw_file_perms;
+  allow dump_storage proc:file r_file_perms;
+  allow dump_storage vendor_shell_exec:file execute_no_trans;
+  allow dump_storage vendor_toolbox_exec:file execute_no_trans;
+  allow dump_storage sg_util_exec:file execute_no_trans;
+  allow dump_storage vendor_data_file:dir create_dir_perms;
+  allow dump_storage vendor_data_file:file create_file_perms;
+  allow dump_storage dump_storage_data_file:dir rw_dir_perms;
+  allow dump_storage dump_storage_data_file:file create_file_perms;
 ')
 
 get_prop(dump_storage, boottime_public_prop)
diff --git a/storage/sepolicy/file.te b/storage/sepolicy/file.te
index 64b6b4e..ed4f925 100644
--- a/storage/sepolicy/file.te
+++ b/storage/sepolicy/file.te
@@ -1 +1,4 @@
 type debugfs_f2fs, debugfs_type, fs_type;
+type dump_storage_data_file, file_type, data_file_type;
+type sg_device, dev_type;
+type sg_util_exec, exec_type, vendor_file_type, file_type;
diff --git a/storage/sepolicy/file_contexts b/storage/sepolicy/file_contexts
index a0efd28..ecca954 100644
--- a/storage/sepolicy/file_contexts
+++ b/storage/sepolicy/file_contexts
@@ -1,2 +1,5 @@
-/vendor/bin/dump/dump_storage\.sh      u:object_r:dump_storage_exec:s0
+/vendor/bin/dump/dump_storage      u:object_r:dump_storage_exec:s0
 /sys/devices/platform/[0-9]+\.ufs/pixel/enable_pixel_ufs_logging  u:object_r:sysfs_scsi_devices_0000:s0
+/dev/sg[0-9]                       u:object_r:sg_device:s0
+/data/vendor/storage(/.*)?         u:object_r:dump_storage_data_file:s0
+/vendor/bin/sg_read_buffer         u:object_r:sg_util_exec:s0
diff --git a/storage/sepolicy/vendor_init.te b/storage/sepolicy/vendor_init.te
new file mode 100644
index 0000000..da4fcba
--- /dev/null
+++ b/storage/sepolicy/vendor_init.te
@@ -0,0 +1 @@
+allow vendor_init sg_device:chr_file r_file_perms;
diff --git a/storage/storage.mk b/storage/storage.mk
index cd0556d..ee7110c 100644
--- a/storage/storage.mk
+++ b/storage/storage.mk
@@ -1,6 +1,6 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/storage/sepolicy
 
-PRODUCT_PACKAGES += dump_storage.sh
+PRODUCT_PACKAGES += dump_storage
 
 # Pixel storage tool
 PRODUCT_PACKAGES_DEBUG += \
diff --git a/thermal/Android.bp b/thermal/dump/Android.bp
similarity index 100%
rename from thermal/Android.bp
rename to thermal/dump/Android.bp
diff --git a/thermal/dump_thermal.sh b/thermal/dump/dump_thermal.sh
similarity index 100%
rename from thermal/dump_thermal.sh
rename to thermal/dump/dump_thermal.sh
diff --git a/thermal/dump/thermal.mk b/thermal/dump/thermal.mk
new file mode 100644
index 0000000..03b1dfa
--- /dev/null
+++ b/thermal/dump/thermal.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/thermal/sepolicy/dump
+
+PRODUCT_PACKAGES += dump/dump_thermal.sh
diff --git a/thermal/sepolicy/dump_thermal.te b/thermal/sepolicy/dump/dump_thermal.te
similarity index 100%
rename from thermal/sepolicy/dump_thermal.te
rename to thermal/sepolicy/dump/dump_thermal.te
diff --git a/thermal/sepolicy/file_contexts b/thermal/sepolicy/dump/file_contexts
similarity index 100%
rename from thermal/sepolicy/file_contexts
rename to thermal/sepolicy/dump/file_contexts
diff --git a/thermal/sepolicy/genfs_contexts b/thermal/sepolicy/dump/genfs_contexts
similarity index 100%
rename from thermal/sepolicy/genfs_contexts
rename to thermal/sepolicy/dump/genfs_contexts
diff --git a/thermal/sepolicy/thermal_hal/file.te b/thermal/sepolicy/thermal_hal/file.te
new file mode 100644
index 0000000..a2b1ab8
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/file.te
@@ -0,0 +1,2 @@
+type thermal_link_device, dev_type;
+type debugfs_thermal, debugfs_type, fs_type;
diff --git a/thermal/sepolicy/thermal_hal/file_contexts b/thermal/sepolicy/thermal_hal/file_contexts
new file mode 100644
index 0000000..c3fb04f
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/file_contexts
@@ -0,0 +1,6 @@
+/vendor/bin/hw/android\.hardware\.thermal@2\.0-service\.pixel                     u:object_r:hal_thermal_default_exec:s0
+/vendor/bin/hw/android\.hardware\.thermal-service\.pixel                          u:object_r:hal_thermal_default_exec:s0
+/vendor/bin/thermal_logd                                                          u:object_r:init-thermal-logging-sh_exec:s0
+/vendor/bin/thermal_controld                                                      u:object_r:pixel-thermal-control-sh_exec:s0
+/vendor/bin/thermal_symlinks                                                      u:object_r:init-thermal-symlinks-sh_exec:s0
+/dev/thermal(/.*)?                                                                u:object_r:thermal_link_device:s0
diff --git a/thermal/sepolicy/thermal_hal/genfs_contexts b/thermal/sepolicy/thermal_hal/genfs_contexts
new file mode 100644
index 0000000..3000fa0
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/genfs_contexts
@@ -0,0 +1,3 @@
+genfscon sysfs /devices/virtual/thermal                                        u:object_r:sysfs_thermal:s0
+genfscon sysfs /class/thermal                                                  u:object_r:sysfs_thermal:s0
+genfscon debugfs /gs101-thermal                                                u:object_r:debugfs_thermal:s0
diff --git a/thermal/sepolicy/thermal_hal/hal_thermal_default.te b/thermal/sepolicy/thermal_hal/hal_thermal_default.te
new file mode 100644
index 0000000..45ccf3a
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/hal_thermal_default.te
@@ -0,0 +1,16 @@
+allow hal_thermal_default sysfs_thermal:dir r_dir_perms;
+allow hal_thermal_default sysfs_thermal:file rw_file_perms;
+allow hal_thermal_default sysfs_thermal:lnk_file r_file_perms;
+allow hal_thermal_default thermal_link_device:dir r_dir_perms;
+allow hal_thermal_default proc_stat:file r_file_perms;
+allow hal_thermal_default self:netlink_generic_socket create_socket_perms_no_ioctl;
+allow hal_thermal_default self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
+
+hal_client_domain(hal_thermal_default, hal_power);
+
+# read thermal_config
+get_prop(hal_thermal_default, vendor_thermal_prop)
+
+# Needed for reporting thermal stats event
+allow hal_thermal_default fwk_stats_service:service_manager find;
+binder_call(hal_thermal_default, servicemanager)
diff --git a/thermal/sepolicy/thermal_hal/init-thermal-logging.sh.te b/thermal/sepolicy/thermal_hal/init-thermal-logging.sh.te
new file mode 100644
index 0000000..3da540e
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/init-thermal-logging.sh.te
@@ -0,0 +1,10 @@
+type init-thermal-logging-sh, domain;
+type init-thermal-logging-sh_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(init-thermal-logging-sh)
+
+userdebug_or_eng(`
+  allow init-thermal-logging-sh vendor_toolbox_exec:file rx_file_perms;
+  allow init-thermal-logging-sh sysfs_thermal:dir r_dir_perms;
+  allow init-thermal-logging-sh sysfs_thermal:file r_file_perms;
+')
diff --git a/thermal/sepolicy/thermal_hal/init-thermal-symlinks.sh.te b/thermal/sepolicy/thermal_hal/init-thermal-symlinks.sh.te
new file mode 100644
index 0000000..093512c
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/init-thermal-symlinks.sh.te
@@ -0,0 +1,12 @@
+type init-thermal-symlinks-sh, domain;
+type init-thermal-symlinks-sh_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(init-thermal-symlinks-sh)
+
+allow init-thermal-symlinks-sh vendor_toolbox_exec:file rx_file_perms;
+allow init-thermal-symlinks-sh thermal_link_device:dir rw_dir_perms;
+allow init-thermal-symlinks-sh thermal_link_device:lnk_file create_file_perms;
+allow init-thermal-symlinks-sh sysfs_thermal:dir r_dir_perms;
+allow init-thermal-symlinks-sh sysfs_thermal:file r_file_perms;
+allow init-thermal-symlinks-sh sysfs_thermal:lnk_file r_file_perms;
+set_prop(init-thermal-symlinks-sh, vendor_thermal_prop)
diff --git a/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te b/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te
new file mode 100644
index 0000000..a6430f1
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/pixel-thermal-control.sh.te
@@ -0,0 +1,13 @@
+type pixel-thermal-control-sh, domain;
+type pixel-thermal-control-sh_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(pixel-thermal-control-sh)
+
+userdebug_or_eng(`
+  allow pixel-thermal-control-sh vendor_toolbox_exec:file execute_no_trans;
+  allow pixel-thermal-control-sh sysfs_thermal:dir r_dir_perms;
+  allow pixel-thermal-control-sh sysfs_thermal:file rw_file_perms;
+  allow pixel-thermal-control-sh sysfs_thermal:lnk_file r_file_perms;
+  allow pixel-thermal-control-sh thermal_link_device:dir r_dir_perms;
+  get_prop(pixel-thermal-control-sh, vendor_thermal_prop)
+')
diff --git a/thermal/sepolicy/thermal_hal/property.te b/thermal/sepolicy/thermal_hal/property.te
new file mode 100644
index 0000000..676c85a
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/property.te
@@ -0,0 +1,2 @@
+#thermal HAL
+vendor_internal_prop(vendor_thermal_prop)
diff --git a/thermal/sepolicy/thermal_hal/property_contexts b/thermal/sepolicy/thermal_hal/property_contexts
new file mode 100644
index 0000000..65a02ee
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/property_contexts
@@ -0,0 +1 @@
+vendor.thermal.                           u:object_r:vendor_thermal_prop:s0
diff --git a/thermal/sepolicy/thermal_hal/vendor_init.te b/thermal/sepolicy/thermal_hal/vendor_init.te
new file mode 100644
index 0000000..aaf6ac1
--- /dev/null
+++ b/thermal/sepolicy/thermal_hal/vendor_init.te
@@ -0,0 +1,3 @@
+allow vendor_init thermal_link_device:dir r_dir_perms;
+allow vendor_init thermal_link_device:lnk_file r_file_perms;
+set_prop(vendor_init, vendor_thermal_prop)
diff --git a/thermal/thermal.mk b/thermal/thermal.mk
deleted file mode 100644
index 3b3dede..0000000
--- a/thermal/thermal.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/thermal/sepolicy
-
-PRODUCT_PACKAGES += dump_thermal.sh
diff --git a/thermal/thermal_hal/device.mk b/thermal/thermal_hal/device.mk
new file mode 100644
index 0000000..260b59f
--- /dev/null
+++ b/thermal/thermal_hal/device.mk
@@ -0,0 +1,10 @@
+PRODUCT_PACKAGES += android.hardware.thermal-service.pixel
+
+# Thermal utils
+PRODUCT_PACKAGES += thermal_symlinks
+
+# Thermal logd
+PRODUCT_PACKAGES_DEBUG += thermal_logd
+PRODUCT_PACKAGES_ENG += thermal_logd
+
+BOARD_SEPOLICY_DIRS += device/google/gs-common/thermal/sepolicy/thermal_hal
diff --git a/thermal/thermal_hal/thermal_config_schemas/Android.bp b/thermal/thermal_hal/thermal_config_schemas/Android.bp
new file mode 100644
index 0000000..ed66305
--- /dev/null
+++ b/thermal/thermal_hal/thermal_config_schemas/Android.bp
@@ -0,0 +1,17 @@
+cc_library_static {
+    name: "thermal_HAL_info_config_proto",
+    host_supported: true,
+    srcs: [
+        "thermal_info_config.proto",
+    ],
+    proto: {
+        type: "full",
+        export_proto_headers: true,
+        include_dirs: ["external/protobuf/src"],
+    },
+    cflags: [
+        "-Wall",
+        "-Werror",
+        "-Wno-unused-parameter",
+    ],
+}
\ No newline at end of file
diff --git a/thermal/thermal_hal/thermal_config_schemas/thermal_info_config.proto b/thermal/thermal_hal/thermal_config_schemas/thermal_info_config.proto
new file mode 100644
index 0000000..c97fa7f
--- /dev/null
+++ b/thermal/thermal_hal/thermal_config_schemas/thermal_info_config.proto
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+syntax = "proto3";
+
+package devices.shusky;
+
+message ThermalConfig {
+  repeated Sensor sensors = 1 [ json_name = "Sensors" ];
+  repeated CoolingDevice coolingdevices = 2 [ json_name = "CoolingDevices" ];
+  repeated PowerRails powerrails = 3 [ json_name = "PowerRails" ];
+  Stats stats = 4 [ json_name = "Stats" ];
+}
+
+message Sensor {
+  string name = 1 [ json_name = "Name" ];
+  string type = 2 [ json_name = "Type" ];
+  repeated float hotthreshold = 3 [ json_name = "HotThreshold" ];
+  repeated float hothysteresis = 4 [ json_name = "HotHysteresis" ];
+  string temppath = 5 [ json_name = "TempPath" ];
+  float multiplier = 6 [ json_name = "Multiplier" ];
+  int32 pollingdelay = 7 [ json_name = "PollingDelay" ];
+  int32 passivedelay = 8 [ json_name = "PassiveDelay" ];
+  bool hidden = 9 [ json_name = "Hidden" ];
+  bool virtualsensor = 10 [ json_name = "VirtualSensor" ];
+  repeated string triggersensor = 11 [ json_name = "TriggerSensor" ];
+  string formula = 12 [ json_name = "Formula" ];
+  repeated string combination = 13 [ json_name = "Combination" ];
+  repeated float Coefficient = 14 [ json_name = "Coefficient" ];
+  bool sendpowerhint = 15 [ json_name = "SendPowerHint" ];
+  bool sendcallback = 16 [ json_name = "SendCallback" ];
+  PIDInfo pidinfo = 17 [ json_name = "PIDInfo" ];
+  repeated ExcludedPowerInfo excludedpowerinfo = 18
+      [ json_name = "ExcludedPowerInfo" ];
+  repeated BindedCdevInfo bindedcdevinfos = 19 [ json_name = "BindedCdevInfo" ];
+  repeated string combinationtype = 20 [ json_name = "CombinationType" ];
+  string version = 21 [ json_name = "Version" ];
+  int32 offset = 22 [ json_name = "Offset" ];
+  repeated Profile profile = 23 [ json_name = "Profile" ];
+  float vrthreshold = 24 [ json_name = "VrThreshold" ];
+  bool monitor = 25 [ json_name = "Monitor" ];
+}
+
+message Profile {
+  string mode = 1 [ json_name = "Mode" ];
+  repeated BindedCdevInfo bindedcdevinfo = 2 [ json_name = "BindedCdevInfo" ];
+}
+
+message ExcludedPowerInfo {
+  string powerrail = 1 [ json_name = "PowerRail" ];
+  repeated float powerweight = 2 [ json_name = "PowerWeight" ];
+}
+
+message BindedCdevInfo {
+  string cdevrequest = 1 [ json_name = "CdevRequest" ];
+  repeated float cdevweightforpid = 2 [ json_name = "CdevWeightForPID" ];
+  int32 maxreleasestep = 3 [ json_name = "MaxReleaseStep" ];
+  int32 maxthrottlestep = 4 [ json_name = "MaxThrottleStep" ];
+  repeated int32 cdevceiling = 5 [ json_name = "CdevCeiling" ];
+  repeated int32 limitinfo = 6 [ json_name = "LimitInfo" ];
+  string bindedpowerrail = 7 [ json_name = "BindedPowerRail" ];
+  bool disabled = 8 [ json_name = "Disabled" ];
+}
+
+message PIDInfo {
+  repeated float k_po = 1 [ json_name = "K_Po" ];
+  repeated float k_pu = 2 [ json_name = "K_Pu" ];
+  repeated float k_i = 3 [ json_name = "K_I" ];
+  repeated float k_d = 4 [ json_name = "K_D" ];
+  repeated float i_max = 5 [ json_name = "I_Max" ];
+  repeated float s_power = 6 [ json_name = "S_Power" ];
+  repeated float minallocpower = 7 [ json_name = "MinAllocPower" ];
+  repeated float maxallocpower = 8 [ json_name = "MaxAllocPower" ];
+  repeated float i_cutoff = 9 [ json_name = "I_Cutoff" ];
+  int32 i_default = 10 [ json_name = "I_Default" ];
+}
+
+message CoolingDevice {
+  string name = 1 [ json_name = "Name" ];
+  string type = 2 [ json_name = "Type" ];
+  string writepath = 3 [ json_name = "WritePath" ];
+  repeated int32 state2power = 4 [ json_name = "State2Power" ];
+}
+
+message PowerRails {
+  string name = 1 [ json_name = "Name" ];
+  int32 powersampledelay = 2 [ json_name = "PowerSampleDelay" ];
+  int32 powersamplecount = 3 [ json_name = "PowerSampleCount" ];
+  bool virtualrails = 4 [ json_name = "VirtualRails" ];
+  string formula = 5 [ json_name = "Formula" ];
+  repeated string combination = 6 [ json_name = "Combination" ];
+  repeated float coefficient = 7 [ json_name = "Coefficient" ];
+}
+
+message Stats {
+  SensorStats sensorstats = 1 [ json_name = "Sensors" ];
+  CoolingDeviceStats coolingdevicestats = 2 [ json_name = "CoolingDevices" ];
+}
+
+message SensorStats {
+  repeated string recordwithdefaultthreshold = 1
+      [ json_name = "RecordWithDefaultThreshold" ];
+  repeated SensorStat recordwiththreshold = 2
+      [ json_name = "RecordWithThreshold" ];
+  Abnormality abnormality = 3 [ json_name = "Abnormality" ];
+}
+
+message CoolingDeviceStats {
+  RecordVotePerSensor recordvotepersensor = 1
+      [ json_name = "RecordVotePerSensor" ];
+}
+
+message RecordVotePerSensor {
+  bool defaultthresholdenableall = 1
+      [ json_name = "DefaultThresholdEnableAll" ];
+}
+
+message SensorStat {
+  string name = 1 [ json_name = "Name" ];
+  repeated int32 thresholds = 2 [ json_name = "Thresholds" ];
+}
+
+message Abnormality {
+  Outlier outlier = 1 [ json_name = "Outlier" ];
+  Stuck stuck = 2 [ json_name = "Stuck" ];
+}
+
+message Outlier { repeated Config configs = 1 [ json_name = "Configs" ]; }
+
+message Stuck { repeated Config configs = 1 [ json_name = "Configs" ]; }
+
+message Config {
+  repeated string monitor = 1 [ json_name = "Monitor" ];
+  TempStuck tempstuck = 2 [ json_name = "TempStuck" ];
+  repeated float temprange = 3 [ json_name = "TempRange" ];
+}
+
+message TempStuck {
+  int32 minpollingcount = 1 [ json_name = "MinPollingCount" ];
+  int32 minstuckduration = 2 [ json_name = "MinStuckDuration" ];
+}
diff --git a/trusty/sepolicy/tee.te b/trusty/sepolicy/tee.te
new file mode 100644
index 0000000..50aab69
--- /dev/null
+++ b/trusty/sepolicy/tee.te
@@ -0,0 +1 @@
+allow tee sg_device:chr_file rw_file_perms;
diff --git a/tts/de-de/de-de-x-multi-r45.zvoice b/tts/de-de/de-de-x-multi-r45.zvoice
new file mode 100644
index 0000000..9fca341
--- /dev/null
+++ b/tts/de-de/de-de-x-multi-r45.zvoice
Binary files differ
diff --git a/tts/es-es/es-es-x-multi-r45.zvoice b/tts/es-es/es-es-x-multi-r45.zvoice
new file mode 100644
index 0000000..2e7cb61
--- /dev/null
+++ b/tts/es-es/es-es-x-multi-r45.zvoice
Binary files differ
diff --git a/tts/fr-fr/fr-fr-x-multi-r46.zvoice b/tts/fr-fr/fr-fr-x-multi-r46.zvoice
new file mode 100644
index 0000000..9287d91
--- /dev/null
+++ b/tts/fr-fr/fr-fr-x-multi-r46.zvoice
Binary files differ
diff --git a/tts/it-it/it-it-x-multi-r42.zvoice b/tts/it-it/it-it-x-multi-r42.zvoice
new file mode 100644
index 0000000..a794804
--- /dev/null
+++ b/tts/it-it/it-it-x-multi-r42.zvoice
Binary files differ
diff --git a/tts/ja-jp/ja-jp-x-multi-r44.zvoice b/tts/ja-jp/ja-jp-x-multi-r44.zvoice
new file mode 100644
index 0000000..0d562b2
--- /dev/null
+++ b/tts/ja-jp/ja-jp-x-multi-r44.zvoice
Binary files differ
diff --git a/tts/voice_packs.mk b/tts/voice_packs.mk
new file mode 100644
index 0000000..0bb6d1a
--- /dev/null
+++ b/tts/voice_packs.mk
@@ -0,0 +1,22 @@
+#
+# Copyright (C) 2023 The Android Open-Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Voice packs for Text-To-Speech
+PRODUCT_COPY_FILES += \
+	device/google/gs-common/tts/ja-jp/ja-jp-x-multi-r44.zvoice:product/tts/google/ja-jp/ja-jp-x-multi-r44.zvoice\
+	device/google/gs-common/tts/fr-fr/fr-fr-x-multi-r46.zvoice:product/tts/google/fr-fr/fr-fr-x-multi-r46.zvoice\
+	device/google/gs-common/tts/de-de/de-de-x-multi-r45.zvoice:product/tts/google/de-de/de-de-x-multi-r45.zvoice\
+	device/google/gs-common/tts/it-it/it-it-x-multi-r42.zvoice:product/tts/google/it-it/it-it-x-multi-r42.zvoice\
+	device/google/gs-common/tts/es-es/es-es-x-multi-r45.zvoice:product/tts/google/es-es/es-es-x-multi-r45.zvoice
diff --git a/umfw_stat/dump_umfw_stat.cpp b/umfw_stat/dump_umfw_stat.cpp
index 63478cd..627144b 100644
--- a/umfw_stat/dump_umfw_stat.cpp
+++ b/umfw_stat/dump_umfw_stat.cpp
@@ -26,7 +26,14 @@
 
   // Dump AoC statistics.
   // TODO(b/272300997): Add timeouts for requests.
-  runCommand("AoC statistics", "timeout 5 /vendor/bin/umfw_stat_tool get_all");
+  runCommand("AoC A32 statistics",
+             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:1 get_all");
+  runCommand("AoC FF1 statistics",
+             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:2 get_all");
+  runCommand("AoC HF0 statistics",
+             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:3 get_all");
+  runCommand("AoC HF1 statistics",
+             "timeout 5 /vendor/bin/umfw_stat_tool -s aoc:4 get_all");
 
   return 0;
 }
diff --git a/widevine/widevine.mk b/widevine/widevine.mk
index c59c7b9..420806e 100644
--- a/widevine/widevine.mk
+++ b/widevine/widevine.mk
@@ -1,4 +1,13 @@
 PRODUCT_PACKAGES += \
 	android.hardware.drm-service.clearkey \
 
--include vendor/widevine/libwvdrmengine/apex/device/device.mk
\ No newline at end of file
+ifdef RELEASE_PACKAGE_WIDEVINE
+  PRODUCT_PACKAGES += $(RELEASE_PACKAGE_WIDEVINE)
+  ifneq ($(wildcard vendor/google/dev-keystore),)
+    $(call soong_config_set,widevine,use_devkey,true)
+  endif
+  PRODUCT_VENDOR_LINKER_CONFIG_FRAGMENTS += \
+	vendor/widevine/libwvdrmengine/apex/device/linker.config.json
+else
+  -include vendor/widevine/libwvdrmengine/apex/device/device.mk
+endif
\ No newline at end of file
diff --git a/wireless_charger/compatibility_matrix.xml b/wireless_charger/compatibility_matrix.xml
index 85ee65a..7d18cd9 100644
--- a/wireless_charger/compatibility_matrix.xml
+++ b/wireless_charger/compatibility_matrix.xml
@@ -1,7 +1,7 @@
 <compatibility-matrix version="1.0" type="framework">
     <hal format="aidl" optional="true">
         <name>vendor.google.wireless_charger</name>
-        <version>1</version>
+        <version>1-2</version>
         <interface>
             <name>IWirelessCharger</name>
             <instance>default</instance>