diff --git a/aoc/dump_aoc.cpp b/aoc/dump_aoc.cpp
index 97da3b5..6be56b0 100644
--- a/aoc/dump_aoc.cpp
+++ b/aoc/dump_aoc.cpp
@@ -19,18 +19,18 @@
 // Dump Aoc.
 int main() {
     setbuf(stdout, NULL);
-    dumpFileContent("AoC Service Status", "/sys/devices/platform/19000000.aoc/services");
-    dumpFileContent("AoC Restarts", "/sys/devices/platform/19000000.aoc/restart_count");
-    dumpFileContent("AoC Coredumps", "/sys/devices/platform/19000000.aoc/coredump_count");
-    dumpFileContent("AoC ring buf wake", "/sys/devices/platform/19000000.aoc/control/ring_buffer_wakeup");
-    dumpFileContent("AoC host ipc wake", "/sys/devices/platform/19000000.aoc/control/host_ipc_wakeup");
-    dumpFileContent("AoC usf wake", "/sys/devices/platform/19000000.aoc/control/usf_wakeup");
-    dumpFileContent("AoC audio wake", "/sys/devices/platform/19000000.aoc/control/audio_wakeup");
-    dumpFileContent("AoC logging wake", "/sys/devices/platform/19000000.aoc/control/logging_wakeup");
-    dumpFileContent("AoC hotword wake", "/sys/devices/platform/19000000.aoc/control/hotword_wakeup");
-    dumpFileContent("AoC memory exception wake", "/sys/devices/platform/19000000.aoc/control/memory_exception");
-    dumpFileContent("AoC memory votes", "/sys/devices/platform/19000000.aoc/control/memory_votes_a32");
-    dumpFileContent("AoC memory votes", "/sys/devices/platform/19000000.aoc/control/memory_votes_ff1");
+    runCommand("AoC Service Status", "timeout 0.1 cat /sys/devices/platform/*.aoc/services");
+    runCommand("AoC Restarts", "timeout 0.1 cat /sys/devices/platform/*.aoc/restart_count");
+    runCommand("AoC Coredumps", "timeout 0.1 cat /sys/devices/platform/*.aoc/coredump_count");
+    runCommand("AoC ring buf wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/ring_buffer_wakeup");
+    runCommand("AoC host ipc wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/host_ipc_wakeup");
+    runCommand("AoC usf wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/usf_wakeup");
+    runCommand("AoC audio wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/audio_wakeup");
+    runCommand("AoC logging wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/logging_wakeup");
+    runCommand("AoC hotword wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/hotword_wakeup");
+    runCommand("AoC memory exception wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_exception");
+    runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_a32");
+    runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_ff1");
     runCommand("clean AoC buffer","echo ' ' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Heap Stats (A32)", "echo 'dbg heap -c 1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Heap Stats (F1)", "echo 'dbg heap -c 2' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
diff --git a/aoc/sepolicy/dump_aoc.te b/aoc/sepolicy/dump_aoc.te
index f5f085c..0731da4 100644
--- a/aoc/sepolicy/dump_aoc.te
+++ b/aoc/sepolicy/dump_aoc.te
@@ -1,5 +1,6 @@
 pixel_bugreport(dump_aoc)
 allow dump_aoc sysfs_aoc:dir search;
+allow dump_aoc sysfs:dir r_dir_perms;
 allow dump_aoc sysfs_aoc_dumpstate:file r_file_perms;
 allow dump_aoc aoc_device:chr_file rw_file_perms;
 allow dump_aoc vendor_shell_exec:file execute_no_trans;
diff --git a/audio/hidl_zuma.mk b/audio/hidl_zuma.mk
index 980d5fb..1438b27 100644
--- a/audio/hidl_zuma.mk
+++ b/audio/hidl_zuma.mk
@@ -22,6 +22,7 @@
 	audio_fortemedia_aoc \
 	audio_bluenote_aoc \
 	audio_usb_aoc \
+	audio_cca_aoc \
 	libamcsextfile \
 	audio_amcs_ext \
 	audio.usb.default \
diff --git a/battery_mitigation/battery_mitigation.cpp b/battery_mitigation/battery_mitigation.cpp
index 230f297..2443226 100644
--- a/battery_mitigation/battery_mitigation.cpp
+++ b/battery_mitigation/battery_mitigation.cpp
@@ -19,6 +19,8 @@
 #include <battery_mitigation/BatteryMitigation.h>
 #include <android/binder_process.h>
 
+#define COUNT_LIMIT 10
+
 using android::hardware::google::pixel::BatteryMitigation;
 using android::hardware::google::pixel::MitigationConfig;
 
@@ -94,7 +96,7 @@
     bool isBatteryMitigationReady = false;
     std::string ready_str;
     int val = 0;
-    while (!isBatteryMitigationReady) {
+    for (int i = 0; i < COUNT_LIMIT; i++) {
         if (!android::base::ReadFileToString(kReadyFilePath, &ready_str)) {
             continue;
         }
@@ -104,9 +106,12 @@
         }
         if (val == 1) {
             isBatteryMitigationReady = true;
+            break;
         }
     }
-    android::base::SetProperty(kReadyProperty, "1");
+    if (isBatteryMitigationReady) {
+        android::base::SetProperty(kReadyProperty, "1");
+    }
     while (true) {
         pause();
     }
diff --git a/battery_mitigation/bcl.mk b/battery_mitigation/bcl.mk
index 87e0f95..9fd81f8 100644
--- a/battery_mitigation/bcl.mk
+++ b/battery_mitigation/bcl.mk
@@ -1,7 +1,11 @@
+ifeq (,$(filter factory_%,$(TARGET_PRODUCT)))
 PRODUCT_PACKAGES += battery_mitigation
+endif
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
+ifeq (,$(filter factory_%,$(TARGET_PRODUCT)))
 PRODUCT_PACKAGES += BrownoutDetection
 endif
+endif
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy
 PRODUCT_SOONG_NAMESPACES += device/google/gs-common/battery_mitigation
diff --git a/bcmbt/bluetooth.mk b/bcmbt/bluetooth.mk
index 6615878..eb6a29b 100644
--- a/bcmbt/bluetooth.mk
+++ b/bcmbt/bluetooth.mk
@@ -1,6 +1,8 @@
 PRODUCT_SOONG_NAMESPACES += vendor/broadcom/bluetooth
 PRODUCT_PACKAGES += \
-       android.hardware.bluetooth@1.1-service.bcmbtlinux \
+       android.hardware.bluetooth-V1-ndk.so \
+       android.hardware.bluetooth-service.bcmbtlinux \
+       vendor.google.bluetooth_ext-V1-ndk.so \
        bt_vendor.conf \
        android.hardware.bluetooth.prebuilt.xml \
        android.hardware.bluetooth_le.prebuilt.xml
diff --git a/bcmbt/compatibility_matrix.xml b/bcmbt/compatibility_matrix.xml
index ec47e35..f0a2a05 100644
--- a/bcmbt/compatibility_matrix.xml
+++ b/bcmbt/compatibility_matrix.xml
@@ -1,39 +1,28 @@
 <compatibility-matrix version="1.0" type="framework" level="7">
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ccc</name>
-        <version>1.1</version>
+    <hal format="aidl" optional="true">
+        <name>vendor.google.bluetooth_ext</name>
+        <version>1</version>
+        <interface>
+            <name>IBluetoothFinder</name>
+            <instance>default</instance>
+        </interface>
+        <fqname>IBluetoothFinder/default</fqname>
         <interface>
             <name>IBluetoothCcc</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.bt_channel_avoidance</name>
-        <version>1.0</version>
         <interface>
             <name>IBTChannelAvoidance</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.sar</name>
-        <version>1.1</version>
         <interface>
             <name>IBluetoothSar</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>hardware.google.bluetooth.ext</name>
-        <version>1.0</version>
         <interface>
             <name>IBluetoothExt</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>hardware.google.bluetooth.ewp</name>
-        <version>1.0</version>
         <interface>
             <name>IBluetoothEwp</name>
             <instance>default</instance>
diff --git a/bcmbt/manifest_bluetooth.xml b/bcmbt/manifest_bluetooth.xml
index 64238c7..f14112c 100644
--- a/bcmbt/manifest_bluetooth.xml
+++ b/bcmbt/manifest_bluetooth.xml
@@ -1,56 +1,17 @@
 <manifest version="1.0" type="device">
-    <hal format="hidl">
+    <hal format="aidl">
         <name>android.hardware.bluetooth</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IBluetoothHci</name>
-            <instance>default</instance>
-        </interface>
+        <version>1</version>
+        <fqname>IBluetoothHci/default</fqname>
     </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.bt_channel_avoidance</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBTChannelAvoidance</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.sar</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IBluetoothSar</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ext</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothExt</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ccc</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IBluetoothCcc</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ewp</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothEwp</name>
-            <instance>default</instance>
-        </interface>
+    <hal format="aidl">
+        <name>vendor.google.bluetooth_ext</name>
+        <version>1</version>
+        <fqname>IBTChannelAvoidance/default</fqname>
+        <fqname>IBluetoothCcc/default</fqname>
+        <fqname>IBluetoothEwp/default</fqname>
+        <fqname>IBluetoothExt/default</fqname>
+        <fqname>IBluetoothFinder/default</fqname>
+        <fqname>IBluetoothSar/default</fqname>
     </hal>
 </manifest>
diff --git a/bcmbt/sepolicy/file_contexts b/bcmbt/sepolicy/file_contexts
index d4681db..e7aac6a 100644
--- a/bcmbt/sepolicy/file_contexts
+++ b/bcmbt/sepolicy/file_contexts
@@ -1,5 +1,5 @@
 # Bluetooth
-/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.1-service\.bcmbtlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth-service\.bcmbtlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
 
 /dev/wbrc                           u:object_r:wb_coexistence_dev:s0
 /dev/ttySAC16                       u:object_r:hci_attach_dev:s0
diff --git a/bcmbt/sepolicy/hal_bluetooth_btlinux.te b/bcmbt/sepolicy/hal_bluetooth_btlinux.te
index f348099..263f689 100644
--- a/bcmbt/sepolicy/hal_bluetooth_btlinux.te
+++ b/bcmbt/sepolicy/hal_bluetooth_btlinux.te
@@ -1,4 +1,5 @@
 add_hwservice(hal_bluetooth_btlinux, hal_bluetooth_coexistence_hwservice);
+add_service(hal_bluetooth_btlinux, hal_bluetooth_coexistence_service);
 get_prop(hal_bluetooth_btlinux, boot_status_prop)
 
 allow hal_bluetooth_btlinux sysfs_bluetooth_writable:file rw_file_perms;
diff --git a/bcmbt/sepolicy/service.te b/bcmbt/sepolicy/service.te
new file mode 100644
index 0000000..b8403da
--- /dev/null
+++ b/bcmbt/sepolicy/service.te
@@ -0,0 +1,2 @@
+# Bluetooth HAL extension
+type hal_bluetooth_coexistence_service, hal_service_type, service_manager_type;
diff --git a/bcmbt/sepolicy/service_contexts b/bcmbt/sepolicy/service_contexts
new file mode 100644
index 0000000..4aecc90
--- /dev/null
+++ b/bcmbt/sepolicy/service_contexts
@@ -0,0 +1,7 @@
+# Bluetooth HAL extension
+vendor.google.bluetooth_ext.IBTChannelAvoidance/default                      u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothSar/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothCcc/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothEwp/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothExt/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothFinder/default                         u:object_r:hal_bluetooth_coexistence_service:s0
diff --git a/camera/Android.bp b/camera/Android.bp
index 9d647c9..d615e6a 100644
--- a/camera/Android.bp
+++ b/camera/Android.bp
@@ -18,3 +18,11 @@
     vendor: true,
     relative_install_path: "dump",
 }
+
+prebuilt_etc {
+    name: "lyric_preview_dis_xml",
+    vendor: true,
+    filename: "vendor.android.hardware.camera.preview-dis.xml",
+    src: "vendor.android.hardware.camera.preview-dis.xml",
+    sub_dir: "permissions",
+}
diff --git a/camera/OWNERS b/camera/OWNERS
new file mode 100644
index 0000000..d5ac048
--- /dev/null
+++ b/camera/OWNERS
@@ -0,0 +1,2 @@
+krzysio@google.com
+yromanenko@google.com
diff --git a/camera/dump_camera.cpp b/camera/dump_camera.cpp
index 105c024..548a866 100644
--- a/camera/dump_camera.cpp
+++ b/camera/dump_camera.cpp
@@ -13,30 +13,40 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <dump/pixel_dump.h>
-#include <android-base/properties.h>
 #include <android-base/file.h>
+#include <android-base/properties.h>
+#include <dump/pixel_dump.h>
+
+namespace {
+
+constexpr std::string_view kCameraLogDir = "/data/vendor/camera/profiler";
+constexpr std::string_view kGraphStateDumpDir = "/data/vendor/camera";
+
+}  // namespace
 
 int main() {
-    if (!::android::base::GetBoolProperty("vendor.camera.debug.camera_performance_analyzer.attach_to_bugreport", true)) {
-        return 0;
-    }
-
-    static const std::string kCameraLogDir = "/data/vendor/camera/profiler";
-    const std::string cameraDestDir = concatenatePath(BUGREPORT_PACKING_DIR, "camera");
-
-    if (mkdir(cameraDestDir.c_str(), 0777) == -1) {
-        printf("Unable to create folder: %s\n", cameraDestDir.c_str());
-        return 0;
-    }
-
-    // Attach multiple latest sessions (in case the user is running concurrent
-    // sessions or starts a new session after the one with performance issues).
-    dumpLogs(kCameraLogDir.c_str(), cameraDestDir.c_str(), 10, "session-ended-");
-    dumpLogs(kCameraLogDir.c_str(), cameraDestDir.c_str(), 5, "high-drop-rate-");
-    dumpLogs(kCameraLogDir.c_str(), cameraDestDir.c_str(), 5, "watchdog-");
-    dumpLogs(kCameraLogDir.c_str(), cameraDestDir.c_str(), 5, "camera-ended-");
-
+  if (!::android::base::GetBoolProperty(
+          "vendor.camera.debug.camera_performance_analyzer.attach_to_bugreport",
+          true)) {
     return 0;
-}
+  }
 
+  const std::string cameraDestDir =
+      concatenatePath(BUGREPORT_PACKING_DIR, "camera");
+
+  if (mkdir(cameraDestDir.c_str(), 0777) == -1) {
+    printf("Unable to create folder: %s\n", cameraDestDir.c_str());
+    return 0;
+  }
+
+  // Attach multiple latest sessions (in case the user is running concurrent
+  // sessions or starts a new session after the one with performance issues).
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 10, "session-ended-");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "high-drop-rate-");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "watchdog-");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "camera-ended-");
+  dumpLogs(kGraphStateDumpDir.data(), cameraDestDir.c_str(), 5,
+           "hal_graph_state_");
+
+  return 0;
+}
diff --git a/camera/lyric.mk b/camera/lyric.mk
new file mode 100644
index 0000000..4a43c0f
--- /dev/null
+++ b/camera/lyric.mk
@@ -0,0 +1,55 @@
+PRODUCT_SOONG_NAMESPACES += \
+    hardware/google/camera \
+    vendor/google/services/LyricCameraHAL/src \
+    vendor/google/services/LyricCameraHAL/src/apex
+
+$(call soong_config_set,lyric,use_lyric_camera_hal,true)
+$(call soong_config_set,google3a_config,gcam_awb,true)
+$(call soong_config_set,google3a_config,ghawb_truetone,true)
+
+# Select GCH backend.
+# TODO(b/192681010): This dependency inversion should be removed.
+ifneq ($(wildcard vendor/google/services/LyricCameraHAL/src),)
+$(call soong_config_set,gch,hwl_library,lyric)
+endif
+
+# Check if we're in PDK build
+ifeq ($(wildcard vendor/google/camera),)
+# If vendor/google/camera doesn't exist, it's a PDK build.
+$(call soong_config_set,lyric,pdk_build,true)
+else
+# Otherwise, it's an internal Google build.
+$(call soong_config_set,lyric,pdk_build,false)
+
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/google/camera \
+    vendor/google/camera/google_3a/libs_v4 \
+    vendor/google/camera/rlsservice
+
+# TODO(b/257379485): 3A is incrementally enabling cuttlefish build for native
+# code coverage support, temporary require separate namespace for folders that
+# can be built successfully.
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/google/camera/google_3a/libs_v4/g3ABase \
+    vendor/google/camera/google_3a/libs_v4/gABC/native_coverage \
+    vendor/google/camera/google_3a/libs_v4/gAF \
+    vendor/google/camera/google_3a/libs_v4/gafd \
+    vendor/google/camera/google_3a/libs_v4/gHAWB/native_coverage
+
+# Calibration tool for debug builds
+PRODUCT_PACKAGES_DEBUG += tarasque_test
+
+endif  # vendor/google/camera check
+
+# Init-time log settings for Google 3A
+PRODUCT_PACKAGES += libg3a_standalone_gabc_rc
+PRODUCT_PACKAGES += libg3a_standalone_gaf_rc
+PRODUCT_PACKAGES += libg3a_standalone_ghawb_rc
+
+# Vendor APEX which contains the camera HAL
+PRODUCT_PACKAGES += com.google.pixel.camera.hal
+PRODUCT_PACKAGES += init.camera.set-interrupts-ownership
+PRODUCT_PACKAGES += lyric_preview_dis_xml
+
+# sepolicy dir is added in dump.mk.
+# Make doesn't deduplicate sepolicy dirs, so including it here causes build errors.
diff --git a/camera/lyric_soong_variables.md b/camera/lyric_soong_variables.md
new file mode 100644
index 0000000..b442943
--- /dev/null
+++ b/camera/lyric_soong_variables.md
@@ -0,0 +1,46 @@
+# Lyric Soong variables
+
+## `kernel_version`
+
+Example:
+```
+$(call soong_config_set,lyric,kernel_version,v515)
+```
+Linux kernel version on the device. Determines the version of the LWIS userspace
+API to use in Lyric.
+
+## `soc`
+
+Example:
+```
+$(call soong_config_set,lyric,soc,gs101)
+```
+The codename for the chip used in the device. Currently only Google silicon
+is supported.
+
+## `camera_hardware`
+
+Example:
+```
+$(call soong_config_set,lyric,camera_hardware,oriole)
+```
+Specifies the set of sensors and peripherals present on the device. Determines
+the DeviceContext class that will be used.
+
+## `tuning_product`
+
+Example:
+```
+$(call soong_config_set,lyric,tuning_product,oriole)
+```
+Specifies the set of tuning data to use. This may be different than
+`camera_hardware` because not all devices have their own tuning data;
+development-only devices only have the default tuning for their SoC.
+
+## `target_device`
+
+Example:
+```
+$(call soong_config_set,google3a_config,target_device,oriole)
+```
+A mixture of `camera_hardware` and `tuning_product` used by 3A.
diff --git a/camera/sepolicy/file_contexts b/camera/sepolicy/file_contexts
index 4bb5308..bc21b02 100644
--- a/camera/sepolicy/file_contexts
+++ b/camera/sepolicy/file_contexts
@@ -1,5 +1,5 @@
 /vendor/bin/dump/dump_camera           u:object_r:dump_camera_exec:s0
+/vendor/bin/init\.camera\.set-interrupts-ownership u:object_r:init-camera-set-interrupts-ownership_exec:s0
 
 # Data
 /data/vendor/camera(/.*)?              u:object_r:vendor_camera_data_file:s0
-
diff --git a/camera/sepolicy/init.camera.set-interrupts-ownership.te b/camera/sepolicy/init.camera.set-interrupts-ownership.te
new file mode 100644
index 0000000..781e68d
--- /dev/null
+++ b/camera/sepolicy/init.camera.set-interrupts-ownership.te
@@ -0,0 +1,10 @@
+type init-camera-set-interrupts-ownership, domain;
+type init-camera-set-interrupts-ownership_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(init-camera-set-interrupts-ownership)
+
+allow init-camera-set-interrupts-ownership vendor_toolbox_exec:file rx_file_perms;
+allow init-camera-set-interrupts-ownership proc_interrupts:file r_file_perms;
+allow init-camera-set-interrupts-ownership proc_irq:dir r_dir_perms;
+allow init-camera-set-interrupts-ownership proc_irq:file { r_file_perms setattr };
+allow init-camera-set-interrupts-ownership self:capability { chown setuid setgid };
diff --git a/camera/vendor.android.hardware.camera.preview-dis.xml b/camera/vendor.android.hardware.camera.preview-dis.xml
new file mode 100644
index 0000000..ae54eef
--- /dev/null
+++ b/camera/vendor.android.hardware.camera.preview-dis.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!-- This is to advertise that the camera device supports preview digital image stabilization
+     in both front and back cameras-->
+<permissions>
+    <feature name="vendor.android.hardware.camera.preview-dis.front" />
+    <feature name="vendor.android.hardware.camera.preview-dis.back" />
+</permissions>
diff --git a/insmod/init.common.cfg b/insmod/init.common.cfg
index 3a81fd2..340eb4b 100644
--- a/insmod/init.common.cfg
+++ b/insmod/init.common.cfg
@@ -6,6 +6,7 @@
 
 # Load common kernel modules
 # Modules here will be loaded *before* device specific modules
-modprobe|-b *
+modprobe|system -b *
+modprobe|vendor -b *
 # All common modules loaded
 setprop|vendor.common.modules.ready
diff --git a/insmod/insmod.sh b/insmod/insmod.sh
index 2c434ef..03843f5 100755
--- a/insmod/insmod.sh
+++ b/insmod/insmod.sh
@@ -8,16 +8,29 @@
 #############################################################
 
 modules_dir=
+system_modules_dir=
+vendor_modules_dir=
 
-for f in /vendor/lib/modules/*/modules.dep /vendor/lib/modules/modules.dep; do
-  if [[ -f "$f" ]]; then
-    modules_dir="$(dirname "$f")"
-    break
-  fi
+for dir in system vendor; do
+  for f in /${dir}/lib/modules/*/modules.dep /${dir}/lib/modules/modules.dep; do
+    if [[ -f "$f" ]]; then
+      if [[ "${dir}" == "system" ]]; then
+        system_modules_dir="$(dirname "$f")"
+      else
+        vendor_modules_dir="$(dirname "$f")"
+        modules_dir=${vendor_modules_dir}
+      fi
+      break
+    fi
+  done
 done
 
-if [[ -z "${modules_dir}" ]]; then
-  echo "Unable to locate kernel modules directory" 2>&1
+if [[ -z "${system_modules_dir}" ]]; then
+  echo "Unable to locate system kernel modules directory" 2>&1
+fi
+
+if [[ -z "${vendor_modules_dir}" ]]; then
+  echo "Unable to locate vendor kernel modules directory" 2>&1
   exit 1
 fi
 
@@ -55,12 +68,23 @@
       "enable") echo 1 > $arg ;;
       "modprobe")
         case ${arg} in
-          "-b *" | "-b")
-            arg="-b --all=${modules_dir}/modules.load" ;;
-          "*" | "")
-            arg="--all=${modules_dir}/modules.load" ;;
+          "system -b *" | "system -b")
+            modules_dir=${system_modules_dir}
+            arg="-b --all=${system_modules_dir}/modules.load" ;;
+          "system *" | "system")
+            modules_dir=${system_modules_dir}
+            arg="--all=${system_modules_dir}/modules.load" ;;
+          "-b *" | "-b" | "vendor -b *" | "vendor -b")
+            modules_dir=${vendor_modules_dir}
+            arg="-b --all=${vendor_modules_dir}/modules.load" ;;
+          "*" | "" | "vendor *" | "vendor")
+            modules_dir=${vendor_modules_dir}
+            arg="--all=${vendor_modules_dir}/modules.load" ;;
         esac
-        modprobe -a -d "${modules_dir}" $arg ;;
+        if [[ -d "${modules_dir}" ]]; then
+          modprobe -a -d "${modules_dir}" $arg
+        fi
+        ;;
       "wait") wait_for_file $arg ;;
     esac
   done < $cfg_file
diff --git a/insmod/sepolicy/insmod-sh.te b/insmod/sepolicy/insmod-sh.te
index d7b4f72..ba82b0a 100644
--- a/insmod/sepolicy/insmod-sh.te
+++ b/insmod/sepolicy/insmod-sh.te
@@ -3,6 +3,9 @@
 init_daemon_domain(insmod-sh)
 
 allow insmod-sh self:capability sys_module;
+allow insmod-sh system_dlkm_file:dir r_dir_perms;
+allow insmod-sh system_dlkm_file:file r_file_perms;
+allow insmod-sh system_dlkm_file:system module_load;
 allow insmod-sh vendor_kernel_modules:system module_load;
 allow insmod-sh vendor_toolbox_exec:file execute_no_trans;
 
diff --git a/modem/dump_modem.sh b/modem/dump_modem.sh
index f9f7cf2..b3f4ed3 100644
--- a/modem/dump_modem.sh
+++ b/modem/dump_modem.sh
@@ -1,5 +1,8 @@
 #!/vendor/bin/sh
 
+WAKEUP_EVENTS_FILE=/sys/devices/platform/cpif/wakeup_events
+CPIF_LOGBUFFER=/dev/logbuffer_cpif
+
 echo "------ Modem Stat ------"
 cat /data/vendor/modem_stat/debug.txt
 
@@ -15,3 +18,16 @@
   cat $f
 done
 
+if [ -e $WAKEUP_EVENTS_FILE ]
+then
+  echo "\n------ Wakeup event counts ------"
+  echo $WAKEUP_EVENTS_FILE
+  cat $WAKEUP_EVENTS_FILE
+fi
+
+if [ -e $CPIF_LOGBUFFER ]
+then
+  echo "\n------ CPIF Logbuffer ------"
+  echo $CPIF_LOGBUFFER
+  cat $CPIF_LOGBUFFER
+fi
diff --git a/modem/sepolicy/dump_modem.te b/modem/sepolicy/dump_modem.te
index dc9b38d..2ffa351 100644
--- a/modem/sepolicy/dump_modem.te
+++ b/modem/sepolicy/dump_modem.te
@@ -8,3 +8,5 @@
 allow dump_modem vendor_rfsd_log_file:dir r_dir_perms;
 allow dump_modem vendor_rfsd_log_file:file r_file_perms;
 allow dump_modem vendor_toolbox_exec:file execute_no_trans;
+allow dump_modem sysfs_dump_modem:file r_file_perms;
+allow dump_modem logbuffer_device:chr_file r_file_perms;
diff --git a/modem/sepolicy/file.te b/modem/sepolicy/file.te
new file mode 100644
index 0000000..383480d
--- /dev/null
+++ b/modem/sepolicy/file.te
@@ -0,0 +1 @@
+type sysfs_dump_modem, sysfs_type, fs_type;
diff --git a/modem/sepolicy/genfs_contexts b/modem/sepolicy/genfs_contexts
new file mode 100644
index 0000000..bae95cc
--- /dev/null
+++ b/modem/sepolicy/genfs_contexts
@@ -0,0 +1 @@
+genfscon sysfs /devices/platform/cpif/wakeup_events u:object_r:sysfs_dump_modem:s0
diff --git a/soc/dump_devfreq.cpp b/soc/dump_devfreq.cpp
index 5cbbb94..da91a62 100644
--- a/soc/dump_devfreq.cpp
+++ b/soc/dump_devfreq.cpp
@@ -14,16 +14,28 @@
  * limitations under the License.
  */
 #include <dump/pixel_dump.h>
+#include <unistd.h>
 
+const char* dvfs_paths[][2] = {
+    {"MIF DVFS", "/sys/devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/trans_stat"},
+    {"INT DVFS", "/sys/devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/trans_stat"},
+    {"INTCAM DVFS", "/sys/devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/trans_stat"},
+    {"DISP DVFS", "/sys/devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/trans_stat"},
+    {"CAM DVFS", "/sys/devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/trans_stat"},
+    {"TNR DVFS", "/sys/devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/trans_stat"},
+    {"MFC DVFS", "/sys/devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/trans_stat"},
+    {"BO DVFS", "/sys/devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/trans_stat"},
+    {"BW DVFS", "/sys/devices/platform/17000080.devfreq_bw/devfreq/17000080.devfreq_bw/trans_stat"},
+    {"DSU DVFS", "/sys/devices/platform/17000090.devfreq_dsu/devfreq/17000090.devfreq_dsu/trans_stat"},
+    {"BCI DVFS", "/sys/devices/platform/170000a0.devfreq_bci/devfreq/170000a0.devfreq_bci/trans_stat"},
+    {"BTS stats", "/sys/devices/platform/exynos-bts/bts_stats"}
+};
 int main() {
-    dumpFileContent("MIF DVFS", "/sys/devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/time_in_state");
-    dumpFileContent("INT DVFS", "/sys/devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/time_in_state");
-    dumpFileContent("INTCAM DVFS", "/sys/devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/time_in_state");
-    dumpFileContent("DISP DVFS", "/sys/devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/time_in_state");
-    dumpFileContent("CAM DVFS", "/sys/devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/time_in_state");
-    dumpFileContent("TNR DVFS", "/sys/devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/time_in_state");
-    dumpFileContent("MFC DVFS", "/sys/devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/time_in_state");
-    dumpFileContent("BO DVFS", "/sys/devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/time_in_state");
-    dumpFileContent("BTS stats", "/sys/devices/platform/exynos-bts/bts_stats");
+
+    for (auto &dvfs_path : dvfs_paths ) {
+        if(!access(dvfs_path[1], R_OK)) {
+            dumpFileContent(dvfs_path[0], dvfs_path[1]);
+        }
+    }
     return 0;
 }
diff --git a/soc/dump_soc.cpp b/soc/dump_soc.cpp
index 4c34349..ab3ac2d 100644
--- a/soc/dump_soc.cpp
+++ b/soc/dump_soc.cpp
@@ -31,8 +31,10 @@
 // Dump chip ID.
 int main() {
     dumpFileContent("AP HW TUNE", "/sys/devices/system/chip-id/ap_hw_tune_str");
+    dumpFileContent("DVFS VERSION", "/sys/devices/system/chip-id/dvfs_version");
     dumpFileContent("EVT VERSION", "/sys/devices/system/chip-id/evt_ver");
     dumpFileContent("LOT ID", "/sys/devices/system/chip-id/lot_id");
+    dumpFileContent("PACKAGE", "/sys/devices/system/chip-id/pkg_revision");
     dumpFileContent("PRODUCT ID", "/sys/devices/system/chip-id/product_id");
     dumpFileContent("REVISION", "/sys/devices/system/chip-id/revision");
     dumpFileContent("RAW STR", "/sys/devices/system/chip-id/raw_str");
diff --git a/soc/sepolicy/freq/genfs_contexts b/soc/sepolicy/freq/genfs_contexts
index 76a783d..7795c12 100644
--- a/soc/sepolicy/freq/genfs_contexts
+++ b/soc/sepolicy/freq/genfs_contexts
@@ -10,6 +10,17 @@
 genfscon sysfs /devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/time_in_state         u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/17000090.devfreq_dsu/devfreq/17000090.devfreq_dsu/time_in_state       u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/170000a0.devfreq_bci/devfreq/170000a0.devfreq_bci/time_in_state       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/trans_stat u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/trans_stat     u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000080.devfreq_bw/devfreq/17000080.devfreq_bw/trans_stat         u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/trans_stat         u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000090.devfreq_dsu/devfreq/17000090.devfreq_dsu/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/170000a0.devfreq_bci/devfreq/170000a0.devfreq_bci/trans_stat       u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/1f000000.mali/time_in_state                                           u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/1f000000.mali/uid_time_in_state                                       u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/cpupm/cpupm/time_in_state                                             u:object_r:sysfs_cpu:s0
diff --git a/soc/sepolicy/soc/genfs_contexts b/soc/sepolicy/soc/genfs_contexts
index e718bd1..bba996d 100644
--- a/soc/sepolicy/soc/genfs_contexts
+++ b/soc/sepolicy/soc/genfs_contexts
@@ -1,6 +1,8 @@
 genfscon sysfs /devices/system/chip-id/ap_hw_tune_str  u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/dvfs_version    u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/evt_ver         u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/lot_id          u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/pkg_revision    u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/product_id      u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/revision        u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/raw_str         u:object_r:sysfs_chip_id:s0
diff --git a/touch/touchinspector/sepolicy/file.te b/touch/touchinspector/sepolicy/file.te
new file mode 100644
index 0000000..f9468a0
--- /dev/null
+++ b/touch/touchinspector/sepolicy/file.te
@@ -0,0 +1,3 @@
+userdebug_or_eng(`
+    typeattribute proc_touch mlstrustedobject;
+')
diff --git a/touch/touchinspector/sepolicy/google_touch_app.te b/touch/touchinspector/sepolicy/google_touch_app.te
new file mode 100644
index 0000000..0c6928d
--- /dev/null
+++ b/touch/touchinspector/sepolicy/google_touch_app.te
@@ -0,0 +1,9 @@
+type google_touch_app, domain;
+
+userdebug_or_eng(`
+  app_domain(google_touch_app)
+
+  allow google_touch_app app_api_service:service_manager find;
+
+  allow google_touch_app proc_touch:file rw_file_perms;
+')
diff --git a/touch/touchinspector/sepolicy/seapp_contexts b/touch/touchinspector/sepolicy/seapp_contexts
new file mode 100644
index 0000000..659caf4
--- /dev/null
+++ b/touch/touchinspector/sepolicy/seapp_contexts
@@ -0,0 +1,2 @@
+# Touch app
+user=_app seinfo=platform name=com.google.touch.touchinspector domain=google_touch_app type=app_data_file levelFrom=user
diff --git a/touch/touchinspector/touchinspector.mk b/touch/touchinspector/touchinspector.mk
new file mode 100644
index 0000000..d17d8dc
--- /dev/null
+++ b/touch/touchinspector/touchinspector.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/touchinspector/sepolicy
+
+PRODUCT_PACKAGES_DEBUG += TouchInspector