Merge "audio: add hdmi audio sepolicy for AIDL HAL" into main
diff --git a/Android.bp b/Android.bp
new file mode 100644
index 0000000..52a1055
--- /dev/null
+++ b/Android.bp
@@ -0,0 +1,45 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package {
+    default_applicable_licenses: ["device_google_gs-common_license"],
+}
+
+// Added automatically by a large-scale-change that took the approach of
+// 'apply every license found to every target'. While this makes sure we respect
+// every license restriction, it may not be entirely correct.
+//
+// e.g. GPL in an MIT project might only apply to the contrib/ directory.
+//
+// Please consider splitting the single license below into multiple licenses,
+// taking care not to lose any license_kind information, and overriding the
+// default license using the 'licenses: [...]' property on targets as needed.
+//
+// For unused files, consider creating a 'fileGroup' with "//visibility:private"
+// to attach the license to, and including a comment whether the files may be
+// used in the current project.
+// See: http://go/android-license-faq
+license {
+    name: "device_google_gs-common_license",
+    visibility: [":__subpackages__"],
+    license_kinds: [
+        "SPDX-license-identifier-Apache-2.0",
+        "SPDX-license-identifier-BSD",
+    ],
+    license_text: [
+        "NOTICE",
+    ],
+}
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..316b4eb
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,190 @@
+
+   Copyright (c) 2014, The Android Open Source Project
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
diff --git a/aoc/sepolicy/aocd.te b/aoc/sepolicy/aocd.te
index b2bfd13..464e46b 100644
--- a/aoc/sepolicy/aocd.te
+++ b/aoc/sepolicy/aocd.te
@@ -20,4 +20,5 @@
 
 # set properties
 set_prop(aocd, vendor_aoc_prop)
-set_prop(aocd, vendor_timeout_aoc_prop)
\ No newline at end of file
+set_prop(aocd, vendor_timeout_aoc_prop)
+get_prop(aocd, vendor_volte_mif_off)
\ No newline at end of file
diff --git a/aoc/sepolicy/property.te b/aoc/sepolicy/property.te
index c2f5695..e6d715b 100644
--- a/aoc/sepolicy/property.te
+++ b/aoc/sepolicy/property.te
@@ -1,3 +1,4 @@
 # AoC
 vendor_internal_prop(vendor_aoc_prop)
-vendor_internal_prop(vendor_timeout_aoc_prop)
\ No newline at end of file
+vendor_internal_prop(vendor_timeout_aoc_prop)
+vendor_internal_prop(vendor_volte_mif_off)
diff --git a/aoc/sepolicy/property_contexts b/aoc/sepolicy/property_contexts
index 3c2acb6..475272a 100644
--- a/aoc/sepolicy/property_contexts
+++ b/aoc/sepolicy/property_contexts
@@ -1,3 +1,4 @@
 # AoC
 vendor.aoc.firmware.version                     u:object_r:vendor_aoc_prop:s0
-persist.vendor.aoc.status_request_timed_out     u:object_r:vendor_timeout_aoc_prop:s0
\ No newline at end of file
+persist.vendor.aoc.status_request_timed_out     u:object_r:vendor_timeout_aoc_prop:s0
+persist.vendor.radio.volte_mif_off              u:object_r:vendor_volte_mif_off:s0
\ No newline at end of file
diff --git a/audio/aidl.mk b/audio/aidl.mk
index 444b7b7..711f389 100644
--- a/audio/aidl.mk
+++ b/audio/aidl.mk
@@ -1,3 +1,5 @@
+USE_AUDIO_HAL_AIDL := true
+
 DEVICE_MANIFEST_FILE += device/google/gs-common/audio/aidl/manifest.xml
 
 # Audio HALs
@@ -25,3 +27,5 @@
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.audio_hal.aidl.enable=true
+
+$(call soong_config_set,pixel_audio_hal_type,aidl_build,true)
diff --git a/audio/common.mk b/audio/common.mk
index 4157970..edf7b6a 100644
--- a/audio/common.mk
+++ b/audio/common.mk
@@ -6,7 +6,7 @@
 	libmahalcontroller \
 	libAlgFx_HiFi3z
 
-ifneq ($(RELEASE_PIXEL_AIDL_AUDIO_HAL),true)
+ifneq ($(USE_AUDIO_HAL_AIDL),true)
 ## AudioHAL Configurations
 PRODUCT_COPY_FILES += \
 	frameworks/av/services/audiopolicy/config/a2dp_audio_policy_configuration_7_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/a2dp_audio_policy_configuration_7_0.xml \
diff --git a/audio/sepolicy/common/hal_audio_default.te b/audio/sepolicy/common/hal_audio_default.te
index 5cb03ac..c69e339 100644
--- a/audio/sepolicy/common/hal_audio_default.te
+++ b/audio/sepolicy/common/hal_audio_default.te
@@ -26,6 +26,8 @@
 hal_client_domain(hal_audio_default, hal_thermal);
 allow hal_audio_default fwk_sensor_hwservice:hwservice_manager find;
 
+hal_client_domain(hal_audio_default, hal_graphics_allocator);
+
 userdebug_or_eng(`
     allow hal_audio_default self:unix_stream_socket create_stream_socket_perms;
     allow hal_audio_default audio_vendor_data_file:sock_file { create unlink };
diff --git a/battery_mitigation/battery_mitigation.cpp b/battery_mitigation/battery_mitigation.cpp
index 18bb63d..a4e28b9 100644
--- a/battery_mitigation/battery_mitigation.cpp
+++ b/battery_mitigation/battery_mitigation.cpp
@@ -73,11 +73,11 @@
 };
 
 const struct MitigationConfig::EventThreadConfig eventThreadCfg = {
+    .BrownoutStatsEnablePath = "/sys/devices/virtual/pmic/mitigation/br_stats/enable_br_stats",
     .NumericSysfsStatPaths = {
         {"cpu0_freq", "/sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq"},
         {"cpu1_freq", "/sys/devices/system/cpu/cpu1/cpufreq/scaling_cur_freq"},
         {"cpu2_freq", "/sys/devices/system/cpu/cpu2/cpufreq/scaling_cur_freq"},
-        {"gpu_freq", "/sys/devices/platform/1f000000.mali/cur_freq"},
         {"battery_temp", "/dev/thermal/tz-by-name/battery/temp"},
         {"battery_cycle", "/dev/thermal/tz-by-name/battery_cycle/temp"},
         {"voltage_now", "/sys/class/power_supply/battery/voltage_now"},
@@ -115,37 +115,24 @@
                 },
     },
     .PlatformSpecific = {
-                /* MIN_SUPPORTED_PLATFORM */
-                {
-                    .MainPmicName = "s2mpg10-odpm\n",
-                    .SubPmicName = "s2mpg11-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77759fg/capacity"},
+                .NumericSysfsStatPaths = {
+                    {
+                        .name = "battery_soc",
+                        .paths = {
+                            "/sys/class/power_supply/max77759fg/capacity",
+                            "/sys/class/power_supply/max77779fg/capacity",
+                        },
                     },
-                },
-                {
-                    .MainPmicName = "s2mpg12-odpm\n",
-                    .SubPmicName = "s2mpg13-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77759fg/capacity"},
+                    {
+                        .name = "gpu_freq",
+                        .paths = {
+                            "/sys/devices/platform/1c500000.mali/cur_freq",
+                            "/sys/devices/platform/28000000.mali/cur_freq",
+                            "/sys/devices/platform/1f000000.mali/cur_freq",
+                        },
                     },
-                },
-                {
-                    .MainPmicName = "s2mpg14-odpm\n",
-                    .SubPmicName = "s2mpg15-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77779fg/capacity"},
-                    },
-                },
-                /* MAX_SUPPORTED_PLATFORM */
-                {
-                    .MainPmicName = "s2mpg14-odpm\n",
-                    .SubPmicName = "s2mpg15-odpm\n",
-                    .NumericSysfsStatPaths = {
-                        {"battery_soc", "/sys/class/power_supply/max77779fg/capacity"},
-                    },
-                },
 
+                },
     },
 };
 
@@ -154,29 +141,17 @@
 const char kLastMealPath[] = "/data/vendor/mitigation/lastmeal.txt";
 const char kBRRequestedProperty[] = "vendor.brownout_reason";
 const char kLastMealProperty[] = "vendor.brownout.br.feasible";
-const char kCDTProperty[] = "ro.boot.cdt_hwid";
 const std::regex kTimestampRegex("^\\S+\\s[0-9]+:[0-9]+:[0-9]+\\S+$");
 
-std::string GetSystemProperty(std::string property) {
-    char value[PROP_VALUE_MAX];
-    __system_property_get(property.c_str(), value);
-    return std::string(value);
-}
-
 int main(int argc, char **argv) {
-    std::string cdt = GetSystemProperty(kCDTProperty);
-    int platformNum  = atoi(cdt.substr(5, 1).c_str());
-    batteryMitigationService = new BatteryMitigationService(eventThreadCfg,
-                                                            platformNum);
+    batteryMitigationService = new BatteryMitigationService(eventThreadCfg);
     if (!batteryMitigationService) {
         return 0;
     }
-    bool platformSupported = batteryMitigationService->isPlatformSupported();
     bool brownoutStatsBinarySupported = batteryMitigationService->isBrownoutStatsBinarySupported();
     if (argc == 2) {
         if(strcmp(argv[1], "-d") == 0 &&
-           brownoutStatsBinarySupported &&
-           platformSupported) {
+           brownoutStatsBinarySupported) {
             /* Create thismeal.txt from thismeal.bin */
             batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedThismealPath);
         }
diff --git a/battery_mitigation/battery_mitigation.rc b/battery_mitigation/battery_mitigation.rc
index 6c8f5cc..bc95fd3 100644
--- a/battery_mitigation/battery_mitigation.rc
+++ b/battery_mitigation/battery_mitigation.rc
@@ -1,6 +1,7 @@
 on property:vendor.thermal.link_ready=1
     mkdir /data/vendor/mitigation 0755 system system
     chown system system /data/vendor/mitigation
+    chown system system /sys/devices/virtual/pmic/mitigation/br_stats/enable_br_stats
     start vendor.battery_mitigation
 
 on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,if && property:sys.boot.reason=reboot,uvlo,pmic,if
diff --git a/battery_mitigation/sepolicy/vendor/battery_mitigation.te b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
index 4b5bc48..ee0780a 100644
--- a/battery_mitigation/sepolicy/vendor/battery_mitigation.te
+++ b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
@@ -19,7 +19,7 @@
 r_dir_file(battery_mitigation, sysfs_odpm)
 r_dir_file(battery_mitigation, sysfs_power_stats)
 allow battery_mitigation sysfs_bcl:dir r_dir_perms;
-allow battery_mitigation sysfs_bcl:file r_file_perms;
+allow battery_mitigation sysfs_bcl:file rw_file_perms;
 allow battery_mitigation sysfs_bcl:lnk_file r_file_perms;
 allow battery_mitigation sysfs_thermal:lnk_file r_file_perms;
 allow battery_mitigation mitigation_vendor_data_file:dir rw_dir_perms;
diff --git a/bootctrl/1.2/Android.bp b/bootctrl/1.2/Android.bp
new file mode 100644
index 0000000..ad0b0e1
--- /dev/null
+++ b/bootctrl/1.2/Android.bp
@@ -0,0 +1,89 @@
+//
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+soong_namespace {
+    imports: [
+        "hardware/google/pixel",
+    ],
+}
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "//device/google/gs-common:device_google_gs-common_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: [
+        "//device/google/gs-common:device_google_gs-common_license",
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.boot@1.2-service-pixel",
+    defaults: ["hidl_defaults"],
+    relative_install_path: "hw",
+    vendor: true,
+    init_rc: ["android.hardware.boot@1.2-service-pixel.rc"],
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+        "service.cpp"
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.0",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot@1.2",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
+
+cc_library {
+    name: "android.hardware.boot@1.2-impl-pixel",
+    stem: "android.hardware.boot@1.0-impl-1.2-impl-pixel",
+    recovery: true,
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+    ],
+    relative_install_path: "hw",
+    shared_libs: [
+        "libbase",
+        "liblog",
+        "libhidlbase",
+        "libutils",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.0",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot@1.2",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
diff --git a/bootctrl/1.2/BootControl.cpp b/bootctrl/1.2/BootControl.cpp
new file mode 100644
index 0000000..ff02013
--- /dev/null
+++ b/bootctrl/1.2/BootControl.cpp
@@ -0,0 +1,526 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "BootControl.h"
+
+#include <android-base/file.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/properties.h>
+#include <libboot_control/libboot_control.h>
+#include <log/log.h>
+#include <trusty/tipc.h>
+
+#include "DevInfo.h"
+#include "GptUtils.h"
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+using android::bootable::GetMiscVirtualAbMergeStatus;
+using android::bootable::InitMiscVirtualAbMessageIfNeeded;
+using android::bootable::SetMiscVirtualAbMergeStatus;
+using android::hardware::boot::V1_0::BoolResult;
+using android::hardware::boot::V1_0::CommandResult;
+using android::hardware::boot::V1_1::MergeStatus;
+
+namespace {
+
+// clang-format off
+
+#define BOOT_A_PATH     "/dev/block/by-name/boot_a"
+#define BOOT_B_PATH     "/dev/block/by-name/boot_b"
+#define DEVINFO_PATH    "/dev/block/by-name/devinfo"
+
+#define BLOW_AR_PATH    "/sys/kernel/boot_control/blow_ar"
+
+// slot flags
+#define AB_ATTR_PRIORITY_SHIFT      52
+#define AB_ATTR_PRIORITY_MASK       (3UL << AB_ATTR_PRIORITY_SHIFT)
+#define AB_ATTR_ACTIVE_SHIFT        54
+#define AB_ATTR_ACTIVE              (1UL << AB_ATTR_ACTIVE_SHIFT)
+#define AB_ATTR_RETRY_COUNT_SHIFT   (55)
+#define AB_ATTR_RETRY_COUNT_MASK    (7UL << AB_ATTR_RETRY_COUNT_SHIFT)
+#define AB_ATTR_SUCCESSFUL          (1UL << 58)
+#define AB_ATTR_UNBOOTABLE          (1UL << 59)
+
+#define AB_ATTR_MAX_PRIORITY        3UL
+#define AB_ATTR_MAX_RETRY_COUNT     3UL
+
+// clang-format on
+
+static std::string getDevPath(uint32_t slot) {
+    char real_path[PATH_MAX];
+
+    const char *path = slot == 0 ? BOOT_A_PATH : BOOT_B_PATH;
+
+    int ret = readlink(path, real_path, sizeof real_path);
+    if (ret < 0) {
+        ALOGE("readlink failed for boot device %s\n", strerror(errno));
+        return std::string();
+    }
+
+    std::string dp(real_path);
+    // extract /dev/sda.. part
+    return dp.substr(0, sizeof "/dev/block/sdX" - 1);
+}
+
+static bool isSlotFlagSet(uint32_t slot, uint64_t flag) {
+    std::string dev_path = getDevPath(slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    return !!(e->attr & flag);
+}
+
+static bool setSlotFlag(uint32_t slot, uint64_t flag) {
+    std::string dev_path = getDevPath(slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    e->attr |= flag;
+    gpt.Sync();
+
+    return true;
+}
+
+static bool is_devinfo_valid;
+static bool is_devinfo_initialized;
+static std::mutex devinfo_lock;
+static devinfo_t devinfo;
+
+static bool isDevInfoValid() {
+    const std::lock_guard<std::mutex> lock(devinfo_lock);
+
+    if (is_devinfo_initialized) {
+        return is_devinfo_valid;
+    }
+
+    is_devinfo_initialized = true;
+
+    android::base::unique_fd fd(open(DEVINFO_PATH, O_RDONLY));
+    android::base::ReadFully(fd, &devinfo, sizeof devinfo);
+
+    if (devinfo.magic != DEVINFO_MAGIC) {
+        return is_devinfo_valid;
+    }
+
+    uint32_t version = ((uint32_t)devinfo.ver_major << 16) | devinfo.ver_minor;
+    // only version 3.3+ supports A/B data
+    if (version >= 0x0003'0003) {
+        is_devinfo_valid = true;
+    }
+
+    return is_devinfo_valid;
+}
+
+static bool DevInfoSync() {
+    if (!isDevInfoValid()) {
+        return false;
+    }
+
+    android::base::unique_fd fd(open(DEVINFO_PATH, O_WRONLY | O_DSYNC));
+    return android::base::WriteFully(fd, &devinfo, sizeof devinfo);
+}
+
+static void DevInfoInitSlot(devinfo_ab_slot_data_t &slot_data) {
+    slot_data.retry_count = AB_ATTR_MAX_RETRY_COUNT;
+    slot_data.unbootable = 0;
+    slot_data.successful = 0;
+    slot_data.active = 1;
+    slot_data.fastboot_ok = 0;
+}
+
+static int blow_otp_AR(bool secure) {
+    static const char *dev_name = "/dev/trusty-ipc-dev0";
+    static const char *otp_name = "com.android.trusty.otp_manager.tidl";
+    int fd = 1, ret = 0;
+    uint32_t cmd = secure? OTP_CMD_write_antirbk_secure_ap : OTP_CMD_write_antirbk_non_secure_ap;
+    fd = tipc_connect(dev_name, otp_name);
+    if (fd < 0) {
+        ALOGI("Failed to connect to OTP_MGR ns TA - is it missing?\n");
+        ret = -1;
+        return ret;
+    }
+
+    struct otp_mgr_req_base req = {
+        .command = cmd,
+        .resp_payload_size = 0,
+    };
+    struct iovec iov[] = {
+        {
+            .iov_base = &req,
+            .iov_len = sizeof(req),
+        },
+    };
+
+    int rc = tipc_send(fd, iov, 1, NULL, 0);
+    if (rc != sizeof(req)) {
+        ALOGI("Send fail! %x\n", rc);
+        return rc;
+    }
+
+    struct otp_mgr_rsp_base resp;
+    rc = read(fd, &resp, sizeof(resp));
+    if (rc < 0) {
+        ALOGI("Read fail! %x\n", rc);
+        return rc;
+    }
+
+    if (rc < sizeof(resp)) {
+        ALOGI("Not enough data! %x\n", rc);
+        return -EIO;
+    }
+
+    if (resp.command != (cmd | OTP_RESP_BIT)) {
+        ALOGI("Wrong command! %x\n", resp.command);
+        return -EINVAL;
+    }
+
+    if (resp.result != 0) {
+        fprintf(stderr, "AR writing error! %x\n", resp.result);
+        return -EINVAL;
+    }
+
+    tipc_close(fd);
+    return 0;
+}
+
+static bool blowAR_zuma() {
+    int ret = blow_otp_AR(true);
+    if (ret) {
+        ALOGI("Blow secure anti-rollback OTP failed");
+        return false;
+    }
+
+    ret = blow_otp_AR(false);
+    if (ret) {
+        ALOGI("Blow non-secure anti-rollback OTP failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool blowAR_gs101() {
+    android::base::unique_fd fd(open(BLOW_AR_PATH, O_WRONLY | O_DSYNC));
+    return android::base::WriteStringToFd("1", fd);
+}
+
+static bool blowAR() {
+    char platform[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.hardware.platform", platform, "");
+
+    if (std::string(platform) == "gs101") {
+        return blowAR_gs101();
+    } else if (std::string(platform) == "gs201" || std::string(platform) == "zuma") {
+        return blowAR_zuma();
+    }
+
+    return true;
+}
+
+}  // namespace
+
+// Methods from ::android::hardware::boot::V1_0::IBootControl follow.
+Return<uint32_t> BootControl::getNumberSlots() {
+    uint32_t slots = 0;
+
+    if (access(BOOT_A_PATH, F_OK) == 0)
+        slots++;
+
+    if (access(BOOT_B_PATH, F_OK) == 0)
+        slots++;
+
+    return slots;
+}
+
+Return<uint32_t> BootControl::getCurrentSlot() {
+    char suffix[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.slot_suffix", suffix, "_a");
+    return std::string(suffix) == "_b" ? 1 : 0;
+}
+
+Return<void> BootControl::markBootSuccessful(markBootSuccessful_cb _hidl_cb) {
+    if (getNumberSlots() == 0) {
+        // no slots, just return true otherwise Android keeps trying
+        _hidl_cb({true, ""});
+        return Void();
+    }
+
+    bool ret;
+    if (isDevInfoValid()) {
+        auto const slot = getCurrentSlot();
+        devinfo.ab_data.slots[slot].successful = 1;
+        ret = DevInfoSync();
+    } else {
+        ret = setSlotFlag(getCurrentSlot(), AB_ATTR_SUCCESSFUL);
+    }
+
+    if (!ret) {
+        _hidl_cb({false, "Failed to set successful flag"});
+        return Void();
+    }
+
+    if (!blowAR()) {
+        ALOGE("Failed to blow anti-rollback counter");
+        // Ignore the error, since ABL will re-trigger it on reboot
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<void> BootControl::setActiveBootSlot(uint32_t slot, setActiveBootSlot_cb _hidl_cb) {
+    if (slot >= 2) {
+        _hidl_cb({false, "Invalid slot"});
+        return Void();
+    }
+
+    if (isDevInfoValid()) {
+        auto &active_slot_data = devinfo.ab_data.slots[slot];
+        auto &inactive_slot_data = devinfo.ab_data.slots[!slot];
+
+        inactive_slot_data.active = 0;
+        DevInfoInitSlot(active_slot_data);
+
+        if (!DevInfoSync()) {
+            _hidl_cb({false, "Could not update DevInfo data"});
+            return Void();
+        }
+    } else {
+        std::string dev_path = getDevPath(slot);
+        if (dev_path.empty()) {
+            _hidl_cb({false, "Could not get device path for slot"});
+            return Void();
+        }
+
+        GptUtils gpt(dev_path);
+        if (gpt.Load()) {
+            _hidl_cb({false, "failed to load gpt data"});
+            return Void();
+        }
+
+        gpt_entry *active_entry = gpt.GetPartitionEntry(slot == 0 ? "boot_a" : "boot_b");
+        gpt_entry *inactive_entry = gpt.GetPartitionEntry(slot == 0 ? "boot_b" : "boot_a");
+        if (active_entry == nullptr || inactive_entry == nullptr) {
+            _hidl_cb({false, "failed to get entries for boot partitions"});
+            return Void();
+        }
+
+        ALOGV("slot active attributes %lx\n", active_entry->attr);
+        ALOGV("slot inactive attributes %lx\n", inactive_entry->attr);
+
+        // update attributes for active and inactive
+        inactive_entry->attr &= ~AB_ATTR_ACTIVE;
+        active_entry->attr = AB_ATTR_ACTIVE | (AB_ATTR_MAX_PRIORITY << AB_ATTR_PRIORITY_SHIFT) |
+                             (AB_ATTR_MAX_RETRY_COUNT << AB_ATTR_RETRY_COUNT_SHIFT);
+    }
+
+    char boot_dev[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.bootdevice", boot_dev, "");
+    if (boot_dev[0] == '\0') {
+        ALOGI("failed to get ro.boot.bootdevice. try ro.boot.boot_devices\n");
+        property_get("ro.boot.boot_devices", boot_dev, "");
+        if (boot_dev[0] == '\0') {
+            _hidl_cb({false, "invalid ro.boot.bootdevice and ro.boot.boot_devices prop"});
+            return Void();
+        }
+    }
+
+    std::string boot_lun_path =
+            std::string("/sys/devices/platform/") + boot_dev + "/pixel/boot_lun_enabled";
+    int fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+    if (fd < 0) {
+        // Try old path for kernels < 5.4
+        // TODO: remove once kernel 4.19 support is deprecated
+        std::string boot_lun_path =
+                std::string("/sys/devices/platform/") + boot_dev + "/attributes/boot_lun_enabled";
+        fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+        if (fd < 0) {
+            _hidl_cb({false, "failed to open ufs attr boot_lun_enabled"});
+            return Void();
+        }
+    }
+
+    //
+    // bBootLunEn
+    // 0x1  => Boot LU A = enabled, Boot LU B = disable
+    // 0x2  => Boot LU A = disable, Boot LU B = enabled
+    //
+    int ret = android::base::WriteStringToFd(slot == 0 ? "1" : "2", fd);
+    close(fd);
+    if (ret < 0) {
+        _hidl_cb({false, "faied to write boot_lun_enabled attribute"});
+        return Void();
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<void> BootControl::setSlotAsUnbootable(uint32_t slot, setSlotAsUnbootable_cb _hidl_cb) {
+    if (slot >= 2) {
+        _hidl_cb({false, "Invalid slot"});
+        return Void();
+    }
+
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        slot_data.unbootable = 1;
+        if (!DevInfoSync()) {
+            _hidl_cb({false, "Could not update DevInfo data"});
+            return Void();
+        }
+    } else {
+        std::string dev_path = getDevPath(slot);
+        if (dev_path.empty()) {
+            _hidl_cb({false, "Could not get device path for slot"});
+            return Void();
+        }
+
+        GptUtils gpt(dev_path);
+        gpt.Load();
+
+        gpt_entry *e = gpt.GetPartitionEntry(slot ? "boot_b" : "boot_a");
+        e->attr |= AB_ATTR_UNBOOTABLE;
+
+        gpt.Sync();
+    }
+
+    _hidl_cb({true, ""});
+    return Void();
+}
+
+Return<::android::hardware::boot::V1_0::BoolResult> BootControl::isSlotBootable(uint32_t slot) {
+    if (getNumberSlots() == 0)
+        return BoolResult::FALSE;
+    if (slot >= getNumberSlots())
+        return BoolResult::INVALID_SLOT;
+
+    bool unbootable;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        unbootable = !!slot_data.unbootable;
+    } else {
+        unbootable = isSlotFlagSet(slot, AB_ATTR_UNBOOTABLE);
+    }
+
+    return unbootable ? BoolResult::FALSE : BoolResult::TRUE;
+}
+
+Return<::android::hardware::boot::V1_0::BoolResult> BootControl::isSlotMarkedSuccessful(
+        uint32_t slot) {
+    if (getNumberSlots() == 0) {
+        // just return true so that we don't we another call trying to mark it as successful
+        // when there is no slots
+        return BoolResult::TRUE;
+    }
+    if (slot >= getNumberSlots())
+        return BoolResult::INVALID_SLOT;
+
+    bool successful;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[slot];
+        successful = !!slot_data.successful;
+    } else {
+        successful = isSlotFlagSet(slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    return successful ? BoolResult::TRUE : BoolResult::FALSE;
+}
+
+Return<void> BootControl::getSuffix(uint32_t slot, getSuffix_cb _hidl_cb) {
+    _hidl_cb(slot == 0 ? "_a" : slot == 1 ? "_b" : "");
+    return Void();
+}
+
+// Methods from ::android::hardware::boot::V1_1::IBootControl follow.
+bool BootControl::Init() {
+    return InitMiscVirtualAbMessageIfNeeded();
+}
+
+Return<bool> BootControl::setSnapshotMergeStatus(
+        ::android::hardware::boot::V1_1::MergeStatus status) {
+    return SetMiscVirtualAbMergeStatus(getCurrentSlot(), status);
+}
+
+Return<::android::hardware::boot::V1_1::MergeStatus> BootControl::getSnapshotMergeStatus() {
+    MergeStatus status;
+    if (!GetMiscVirtualAbMergeStatus(getCurrentSlot(), &status)) {
+        return MergeStatus::UNKNOWN;
+    }
+    return status;
+}
+
+// Methods from ::android::hardware::boot::V1_2::IBootControl follow.
+Return<uint32_t> BootControl::getActiveBootSlot() {
+    if (getNumberSlots() == 0)
+        return 0;
+
+    if (isDevInfoValid())
+        return devinfo.ab_data.slots[1].active ? 1 : 0;
+    return isSlotFlagSet(1, AB_ATTR_ACTIVE) ? 1 : 0;
+}
+
+// Methods from ::android::hidl::base::V1_0::IBase follow.
+
+IBootControl *HIDL_FETCH_IBootControl(const char * /* name */) {
+    auto module = new BootControl();
+
+    module->Init();
+
+    return module;
+}
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/BootControl.h b/bootctrl/1.2/BootControl.h
new file mode 100644
index 0000000..45b7efa
--- /dev/null
+++ b/bootctrl/1.2/BootControl.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/hardware/boot/1.2/IBootControl.h>
+#include <hidl/MQDescriptor.h>
+#include <hidl/Status.h>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+using ::android::sp;
+using ::android::hardware::hidl_array;
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hardware::Return;
+using ::android::hardware::Void;
+
+struct BootControl : public IBootControl {
+    bool Init();
+
+    // Methods from ::android::hardware::boot::V1_0::IBootControl follow.
+    Return<uint32_t> getNumberSlots() override;
+    Return<uint32_t> getCurrentSlot() override;
+    Return<void> markBootSuccessful(markBootSuccessful_cb _hidl_cb) override;
+    Return<void> setActiveBootSlot(uint32_t slot, setActiveBootSlot_cb _hidl_cb) override;
+    Return<void> setSlotAsUnbootable(uint32_t slot, setSlotAsUnbootable_cb _hidl_cb) override;
+    Return<::android::hardware::boot::V1_0::BoolResult> isSlotBootable(uint32_t slot) override;
+    Return<::android::hardware::boot::V1_0::BoolResult> isSlotMarkedSuccessful(
+            uint32_t slot) override;
+    Return<void> getSuffix(uint32_t slot, getSuffix_cb _hidl_cb) override;
+
+    // Methods from ::android::hardware::boot::V1_1::IBootControl follow.
+    Return<bool> setSnapshotMergeStatus(
+            ::android::hardware::boot::V1_1::MergeStatus status) override;
+    Return<::android::hardware::boot::V1_1::MergeStatus> getSnapshotMergeStatus() override;
+
+    // Methods from ::android::hardware::boot::V1_2::IBootControl follow.
+    Return<uint32_t> getActiveBootSlot() override;
+
+    // Methods from ::android::hidl::base::V1_0::IBase follow.
+};
+
+// FIXME: most likely delete, this is only for passthrough implementations
+extern "C" IBootControl *HIDL_FETCH_IBootControl(const char *name);
+
+enum otpmgr_command : uint32_t {
+    OTP_REQ_SHIFT = 1,
+    OTP_RESP_BIT = 1,
+    OTP_CMD_write_antirbk_non_secure_ap = (7 << OTP_REQ_SHIFT),
+    OTP_CMD_write_antirbk_secure_ap = (8 << OTP_REQ_SHIFT),
+};
+
+struct otp_mgr_req_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    uint8_t handle;
+}__packed;
+
+struct otp_mgr_rsp_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    int result;
+}__packed;
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/DevInfo.h b/bootctrl/1.2/DevInfo.h
new file mode 100644
index 0000000..a09a83a
--- /dev/null
+++ b/bootctrl/1.2/DevInfo.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+//
+// definitions taken from ABL code
+//
+
+constexpr uint32_t DEVINFO_MAGIC = 0x49564544;
+constexpr size_t DEVINFO_AB_SLOT_COUNT = 2;
+
+struct devinfo_ab_slot_data_t {
+    uint8_t retry_count;
+    uint8_t unbootable : 1;
+    uint8_t successful : 1;
+    uint8_t active : 1;
+    uint8_t fastboot_ok : 1;
+    uint8_t : 4;
+    uint8_t unused[2];
+} __attribute__((packed));
+
+typedef struct {
+    devinfo_ab_slot_data_t slots[DEVINFO_AB_SLOT_COUNT];
+} __attribute__((packed)) devinfo_ab_data_t;
+
+struct devinfo_t {
+    uint32_t magic;
+    uint16_t ver_major;
+    uint16_t ver_minor;
+    uint8_t unused[40];
+    devinfo_ab_data_t ab_data;
+    uint8_t unused1[72];  // use remaining up to complete 128 bytes
+} __attribute__((packed));
+
+static_assert(sizeof(devinfo_t) == 128, "invalid devinfo struct size");
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/GptUtils.cpp b/bootctrl/1.2/GptUtils.cpp
new file mode 100644
index 0000000..25088e7
--- /dev/null
+++ b/bootctrl/1.2/GptUtils.cpp
@@ -0,0 +1,193 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "GptUtils.h"
+
+#include <android-base/file.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <log/log.h>
+#include <zlib.h>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+namespace {
+
+static int ValidateGptHeader(gpt_header *gpt) {
+    if (gpt->signature != GPT_SIGNATURE) {
+        ALOGE("invalid gpt signature 0x%lx\n", gpt->signature);
+        return -1;
+    }
+
+    if (gpt->header_size != sizeof(gpt_header)) {
+        ALOGE("invalid gpt header size %u\n", gpt->header_size);
+        return -1;
+    }
+
+    if (gpt->entry_size != sizeof(gpt_entry)) {
+        ALOGE("invalid gpt entry size %u\n", gpt->entry_size);
+        return -1;
+    }
+
+    return 0;
+}
+
+}  // namespace
+
+GptUtils::GptUtils(const std::string dev_path) : dev_path(dev_path), fd(0) {}
+
+int GptUtils::Load(void) {
+    fd = open(dev_path.c_str(), O_RDWR);
+    if (fd < 0) {
+        ALOGE("failed to open block dev %s, %d\n", dev_path.c_str(), errno);
+        return -1;
+    }
+
+    int ret = ioctl(fd, BLKSSZGET, &block_size);
+    if (ret < 0) {
+        ALOGE("failed to get block size %d\n", errno);
+        return -1;
+    }
+
+    // read primary header
+    lseek64(fd, block_size, SEEK_SET);
+    ret = read(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to read gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_primary)) {
+        ALOGE("error validating gpt header\n");
+        return -1;
+    }
+
+    // read partition entries
+    entry_array.resize(gpt_primary.entry_count);
+    uint32_t entries_size = gpt_primary.entry_size * gpt_primary.entry_count;
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = read(fd, entry_array.data(), entries_size);
+    if (ret < 0) {
+        ALOGE("failed to read gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // read gpt back header
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = read(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to read gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_backup)) {
+        ALOGW("error validating gpt backup\n");  // just warn about it, not fail
+    }
+
+    // Create map <partition name, gpt_entry pointer>
+    auto get_name = [](const uint16_t *efi_name) {
+        char name[37] = {};
+        for (int i = 0; efi_name[i] && i < sizeof name - 1; ++i) name[i] = efi_name[i];
+        return std::string(name);
+    };
+
+    for (auto const &e : entry_array) {
+        if (e.name[0] == 0)
+            break;  // stop at the first partition with no name
+        std::string s = get_name(e.name);
+        entries[s] = const_cast<gpt_entry *>(&e);
+    }
+
+    return 0;
+}
+
+gpt_entry *GptUtils::GetPartitionEntry(std::string name) {
+    return entries.find(name) != entries.end() ? entries[name] : nullptr;
+}
+
+int GptUtils::Sync(void) {
+    if (!fd)
+        return -1;
+
+    // calculate crc and check if we need to update gpt
+    gpt_primary.entries_crc32 = crc32(0, reinterpret_cast<uint8_t *>(entry_array.data()),
+                                      entry_array.size() * sizeof(gpt_entry));
+
+    // save old crc
+    uint32_t crc = gpt_primary.crc32;
+    gpt_primary.crc32 = 0;
+
+    gpt_primary.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_primary), sizeof gpt_primary);
+    if (crc == gpt_primary.crc32)
+        return 0;  // nothing to do (no changes)
+
+    ALOGI("updating GPT\n");
+
+    lseek64(fd, block_size * gpt_primary.current_lba, SEEK_SET);
+    int ret = write(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to write gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // update GPT backup entries and backup
+    lseek64(fd, block_size * gpt_backup.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup partition entries %d\n", errno);
+        return -1;
+    }
+
+    gpt_backup.entries_crc32 = gpt_primary.entries_crc32;
+    gpt_backup.crc32 = 0;
+    gpt_backup.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_backup), sizeof gpt_backup);
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = write(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    fsync(fd);
+
+    return 0;
+}
+
+GptUtils::~GptUtils() {
+    if (fd) {
+        Sync();
+        close(fd);
+    }
+}
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/GptUtils.h b/bootctrl/1.2/GptUtils.h
new file mode 100644
index 0000000..a2bed33
--- /dev/null
+++ b/bootctrl/1.2/GptUtils.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+namespace android {
+namespace hardware {
+namespace boot {
+namespace V1_2 {
+namespace implementation {
+
+#define GPT_SIGNATURE 0x5452415020494645UL
+
+typedef struct {
+    uint8_t type_guid[16];
+    uint8_t guid[16];
+    uint64_t first_lba;
+    uint64_t last_lba;
+    uint64_t attr;
+    uint16_t name[36];
+} __attribute__((packed)) gpt_entry;
+
+typedef struct {
+    uint64_t signature;
+    uint32_t revision;
+    uint32_t header_size;
+    uint32_t crc32;
+    uint32_t reserved;
+    uint64_t current_lba;
+    uint64_t backup_lba;
+    uint64_t first_usable_lba;
+    uint64_t last_usable_lba;
+    uint8_t disk_guid[16];
+    uint64_t start_lba;
+    uint32_t entry_count;
+    uint32_t entry_size;
+    uint32_t entries_crc32;
+} __attribute__((packed)) gpt_header;
+
+class GptUtils {
+  public:
+    GptUtils(const std::string dev_path);
+    int Load(void);
+    gpt_entry *GetPartitionEntry(std::string name);
+    int Sync(void);
+    ~GptUtils();
+
+  private:
+    std::string dev_path;
+    int fd;
+    uint32_t block_size;
+    gpt_header gpt_primary;
+    gpt_header gpt_backup;
+    std::vector<gpt_entry> entry_array;
+    std::map<std::string, gpt_entry *> entries;
+};
+
+}  // namespace implementation
+}  // namespace V1_2
+}  // namespace boot
+}  // namespace hardware
+}  // namespace android
diff --git a/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc b/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc
new file mode 100644
index 0000000..ff7d2f3
--- /dev/null
+++ b/bootctrl/1.2/android.hardware.boot@1.2-service-pixel.rc
@@ -0,0 +1,7 @@
+service vendor.boot-hal-1-2 /vendor/bin/hw/android.hardware.boot@1.2-service-pixel
+    interface android.hardware.boot@1.0::IBootControl default
+    interface android.hardware.boot@1.1::IBootControl default
+    interface android.hardware.boot@1.2::IBootControl default
+    class early_hal
+    user root
+    group root drmrpc
diff --git a/bootctrl/1.2/service.cpp b/bootctrl/1.2/service.cpp
new file mode 100644
index 0000000..f07682e
--- /dev/null
+++ b/bootctrl/1.2/service.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "android.hardware.boot@1.2-service"
+
+#include <android/hardware/boot/1.2/IBootControl.h>
+#include <hidl/HidlTransportSupport.h>
+#include <hidl/Status.h>
+#include <log/log.h>
+
+#include "BootControl.h"
+
+using ::android::status_t;
+
+using ::android::hardware::boot::V1_2::IBootControl;
+
+using ::android::hardware::boot::V1_2::implementation::BootControl;
+// using ::android::hardware::boot::implementation::BootControl;
+
+int main(int /* argc */, char * /* argv */[]) {
+    // This function must be called before you join to ensure the proper
+    // number of threads are created. The threadpool will never exceed
+    // size one because of this call.
+    ::android::hardware::configureRpcThreadpool(1 /*threads*/, true /*willJoin*/);
+
+    ::android::sp bootctrl = new BootControl();
+    const status_t status = bootctrl->registerAsService();
+    if (status != ::android::OK) {
+        return 1;  // or handle error
+    }
+
+    // Adds this thread to the threadpool, resulting in one total
+    // thread in the threadpool. We could also do other things, but
+    // would have to specify 'false' to willJoin in configureRpcThreadpool.
+    ::android::hardware::joinRpcThreadpool();
+    return 1;  // joinRpcThreadpool should never return
+}
diff --git a/bootctrl/aidl/Android.bp b/bootctrl/aidl/Android.bp
new file mode 100644
index 0000000..f5ba503
--- /dev/null
+++ b/bootctrl/aidl/Android.bp
@@ -0,0 +1,71 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+soong_namespace {
+    imports: [
+        "hardware/google/pixel",
+    ],
+}
+
+package {
+    // See: http://go/android-license-faq
+    // A large-scale-change added 'default_applicable_licenses' to import
+    // all of the 'license_kinds' from "//device/google/gs-common:device_google_gs-common_license"
+    // to get the below license kinds:
+    //   SPDX-license-identifier-Apache-2.0
+    default_applicable_licenses: [
+        "//device/google/gs-common:device_google_gs-common_license",
+    ],
+}
+
+cc_defaults {
+    name: "android.hardware.boot-service_common-pixel",
+    relative_install_path: "hw",
+    defaults: ["libboot_control_defaults"],
+    shared_libs: [
+        "libbase",
+        "libbinder_ndk",
+        "libcutils",
+        "libz",
+        "libtrusty",
+        "android.hardware.boot@1.1",
+        "android.hardware.boot-V1-ndk",
+    ],
+    static_libs: [
+        "libboot_control",
+        "libbootloader_message_vendor",
+    ],
+    srcs: [
+        "BootControl.cpp",
+        "GptUtils.cpp",
+        "service.cpp"
+    ],
+}
+
+cc_binary {
+    name: "android.hardware.boot-service.default-pixel",
+    defaults: ["android.hardware.boot-service_common-pixel"],
+    init_rc: ["android.hardware.boot-service.default-pixel.rc"],
+    vendor: true,
+}
+
+cc_binary {
+    name: "android.hardware.boot-service.default_recovery-pixel",
+    defaults: ["android.hardware.boot-service_common-pixel"],
+    vintf_fragments: ["android.hardware.boot-service.default_recovery-pixel.xml"],
+    init_rc: ["android.hardware.boot-service.default_recovery-pixel.rc"],
+    recovery: true,
+}
diff --git a/bootctrl/aidl/BootControl.cpp b/bootctrl/aidl/BootControl.cpp
new file mode 100644
index 0000000..e771845
--- /dev/null
+++ b/bootctrl/aidl/BootControl.cpp
@@ -0,0 +1,562 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "BootControl.h"
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/unique_fd.h>
+#include <bootloader_message/bootloader_message.h>
+#include <cutils/properties.h>
+#include <libboot_control/libboot_control.h>
+#include <log/log.h>
+#include <trusty/tipc.h>
+
+#include "DevInfo.h"
+#include "GptUtils.h"
+
+using HIDLMergeStatus = ::android::bootable::BootControl::MergeStatus;
+using ndk::ScopedAStatus;
+
+using android::bootable::GetMiscVirtualAbMergeStatus;
+using android::bootable::InitMiscVirtualAbMessageIfNeeded;
+using android::bootable::SetMiscVirtualAbMergeStatus;
+
+namespace aidl::android::hardware::boot {
+
+namespace {
+
+// clang-format off
+
+#define BOOT_A_PATH     "/dev/block/by-name/boot_a"
+#define BOOT_B_PATH     "/dev/block/by-name/boot_b"
+#define DEVINFO_PATH    "/dev/block/by-name/devinfo"
+
+#define BLOW_AR_PATH    "/sys/kernel/boot_control/blow_ar"
+
+// slot flags
+#define AB_ATTR_PRIORITY_SHIFT      52
+#define AB_ATTR_PRIORITY_MASK       (3UL << AB_ATTR_PRIORITY_SHIFT)
+#define AB_ATTR_ACTIVE_SHIFT        54
+#define AB_ATTR_ACTIVE              (1UL << AB_ATTR_ACTIVE_SHIFT)
+#define AB_ATTR_RETRY_COUNT_SHIFT   (55)
+#define AB_ATTR_RETRY_COUNT_MASK    (7UL << AB_ATTR_RETRY_COUNT_SHIFT)
+#define AB_ATTR_SUCCESSFUL          (1UL << 58)
+#define AB_ATTR_UNBOOTABLE          (1UL << 59)
+
+#define AB_ATTR_MAX_PRIORITY        3UL
+#define AB_ATTR_MAX_RETRY_COUNT     3UL
+
+// clang-format on
+
+static std::string getDevPath(int32_t in_slot) {
+    char real_path[PATH_MAX];
+
+    const char *path = in_slot == 0 ? BOOT_A_PATH : BOOT_B_PATH;
+
+    int ret = readlink(path, real_path, sizeof real_path);
+    if (ret < 0) {
+        ALOGE("readlink failed for boot device %s\n", strerror(errno));
+        return std::string();
+    }
+
+    std::string dp(real_path);
+    // extract /dev/sda.. part
+    return dp.substr(0, sizeof "/dev/block/sdX" - 1);
+}
+
+static bool isSlotFlagSet(int32_t in_slot, uint64_t flag) {
+    std::string dev_path = getDevPath(in_slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", in_slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    return !!(e->attr & flag);
+}
+
+static bool setSlotFlag(int32_t in_slot, uint64_t flag) {
+    std::string dev_path = getDevPath(in_slot);
+    if (dev_path.empty()) {
+        ALOGI("Could not get device path for slot %d\n", in_slot);
+        return false;
+    }
+
+    GptUtils gpt(dev_path);
+    if (gpt.Load()) {
+        ALOGI("failed to load gpt data\n");
+        return false;
+    }
+
+    gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+    if (e == nullptr) {
+        ALOGI("failed to get gpt entry\n");
+        return false;
+    }
+
+    e->attr |= flag;
+    gpt.Sync();
+
+    return true;
+}
+
+static bool is_devinfo_valid;
+static bool is_devinfo_initialized;
+static std::mutex devinfo_lock;
+static devinfo_t devinfo;
+
+static bool isDevInfoValid() {
+    const std::lock_guard<std::mutex> lock(devinfo_lock);
+
+    if (is_devinfo_initialized) {
+        return is_devinfo_valid;
+    }
+
+    is_devinfo_initialized = true;
+
+    ::android::base::unique_fd fd(open(DEVINFO_PATH, O_RDONLY));
+    ::android::base::ReadFully(fd, &devinfo, sizeof devinfo);
+
+    if (devinfo.magic != DEVINFO_MAGIC) {
+        return is_devinfo_valid;
+    }
+
+    uint32_t version = ((uint32_t)devinfo.ver_major << 16) | devinfo.ver_minor;
+    // only version 3.3+ supports A/B data
+    if (version >= 0x0003'0003) {
+        is_devinfo_valid = true;
+    }
+
+    return is_devinfo_valid;
+}
+
+static bool DevInfoSync() {
+    if (!isDevInfoValid()) {
+        return false;
+    }
+
+    ::android::base::unique_fd fd(open(DEVINFO_PATH, O_WRONLY | O_DSYNC));
+    return ::android::base::WriteFully(fd, &devinfo, sizeof devinfo);
+}
+
+static void DevInfoInitSlot(devinfo_ab_slot_data_t &slot_data) {
+    slot_data.retry_count = AB_ATTR_MAX_RETRY_COUNT;
+    slot_data.unbootable = 0;
+    slot_data.successful = 0;
+    slot_data.active = 1;
+    slot_data.fastboot_ok = 0;
+}
+
+static int blow_otp_AR(bool secure) {
+    static const char *dev_name = "/dev/trusty-ipc-dev0";
+    static const char *otp_name = "com.android.trusty.otp_manager.tidl";
+    int fd = 1, ret = 0;
+    uint32_t cmd = secure? OTP_CMD_write_antirbk_secure_ap : OTP_CMD_write_antirbk_non_secure_ap;
+    fd = tipc_connect(dev_name, otp_name);
+    if (fd < 0) {
+        ALOGI("Failed to connect to OTP_MGR ns TA - is it missing?\n");
+        ret = -1;
+        return ret;
+    }
+
+    struct otp_mgr_req_base req = {
+        .command = cmd,
+        .resp_payload_size = 0,
+    };
+    struct iovec iov[] = {
+        {
+            .iov_base = &req,
+            .iov_len = sizeof(req),
+        },
+    };
+
+    size_t rc = tipc_send(fd, iov, 1, NULL, 0);
+    if (rc != sizeof(req)) {
+        ALOGI("Send fail! %zx\n", rc);
+        return rc;
+    }
+
+    struct otp_mgr_rsp_base resp;
+    rc = read(fd, &resp, sizeof(resp));
+    if (rc < 0) {
+        ALOGI("Read fail! %zx\n", rc);
+        return rc;
+    }
+
+    if (rc < sizeof(resp)) {
+        ALOGI("Not enough data! %zx\n", rc);
+        return -EIO;
+    }
+
+    if (resp.command != (cmd | OTP_RESP_BIT)) {
+        ALOGI("Wrong command! %x\n", resp.command);
+        return -EINVAL;
+    }
+
+    if (resp.result != 0) {
+        fprintf(stderr, "AR writing error! %x\n", resp.result);
+        return -EINVAL;
+    }
+
+    tipc_close(fd);
+    return 0;
+}
+
+static bool blowAR_zuma() {
+    int ret = blow_otp_AR(true);
+    if (ret) {
+        ALOGI("Blow secure anti-rollback OTP failed");
+        return false;
+    }
+
+    ret = blow_otp_AR(false);
+    if (ret) {
+        ALOGI("Blow non-secure anti-rollback OTP failed");
+        return false;
+    }
+
+    return true;
+}
+
+static bool blowAR_gs101() {
+    ::android::base::unique_fd fd(open(BLOW_AR_PATH, O_WRONLY | O_DSYNC));
+    return ::android::base::WriteStringToFd("1", fd);
+}
+
+static bool blowAR() {
+    char platform[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.hardware.platform", platform, "");
+
+    if (std::string(platform) == "gs101") {
+        return blowAR_gs101();
+    } else if (std::string(platform) == "gs201" || std::string(platform) == "zuma") {
+        return blowAR_zuma();
+    }
+
+    return true;
+}
+
+static constexpr MergeStatus ToAIDLMergeStatus(HIDLMergeStatus status) {
+    switch (status) {
+        case HIDLMergeStatus::NONE:
+            return MergeStatus::NONE;
+        case HIDLMergeStatus::UNKNOWN:
+            return MergeStatus::UNKNOWN;
+        case HIDLMergeStatus::SNAPSHOTTED:
+            return MergeStatus::SNAPSHOTTED;
+        case HIDLMergeStatus::MERGING:
+            return MergeStatus::MERGING;
+        case HIDLMergeStatus::CANCELLED:
+            return MergeStatus::CANCELLED;
+    }
+}
+
+static constexpr HIDLMergeStatus ToHIDLMergeStatus(MergeStatus status) {
+    switch (status) {
+        case MergeStatus::NONE:
+            return HIDLMergeStatus::NONE;
+        case MergeStatus::UNKNOWN:
+            return HIDLMergeStatus::UNKNOWN;
+        case MergeStatus::SNAPSHOTTED:
+            return HIDLMergeStatus::SNAPSHOTTED;
+        case MergeStatus::MERGING:
+            return HIDLMergeStatus::MERGING;
+        case MergeStatus::CANCELLED:
+            return HIDLMergeStatus::CANCELLED;
+    }
+}
+
+}  // namespace
+
+BootControl::BootControl() {
+    CHECK(InitMiscVirtualAbMessageIfNeeded());
+}
+
+ScopedAStatus BootControl::getActiveBootSlot(int32_t* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        *_aidl_return = 0;
+        return ScopedAStatus::ok();
+    }
+
+    if (isDevInfoValid()) {
+        *_aidl_return = devinfo.ab_data.slots[1].active ? 1 : 0;
+        return ScopedAStatus::ok();
+    }
+    *_aidl_return = isSlotFlagSet(1, AB_ATTR_ACTIVE) ? 1 : 0;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getCurrentSlot(int32_t* _aidl_return) {
+    char suffix[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.slot_suffix", suffix, "_a");
+    *_aidl_return = std::string(suffix) == "_b" ? 1 : 0;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getNumberSlots(int32_t* _aidl_return) {
+    int32_t slots = 0;
+
+    if (access(BOOT_A_PATH, F_OK) == 0)
+        slots++;
+
+    if (access(BOOT_B_PATH, F_OK) == 0)
+        slots++;
+
+    *_aidl_return = slots;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getSnapshotMergeStatus(MergeStatus* _aidl_return) {
+    HIDLMergeStatus status;
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (!GetMiscVirtualAbMergeStatus(current_slot, &status)) {
+        *_aidl_return = MergeStatus::UNKNOWN;
+        return ScopedAStatus::ok();
+    }
+    *_aidl_return = ToAIDLMergeStatus(status);
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::getSuffix(int32_t in_slot, std::string* _aidl_return) {
+    *_aidl_return = in_slot == 0 ? "_a" : in_slot == 1 ? "_b" : "";
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::isSlotBootable(int32_t in_slot, bool* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        *_aidl_return = false;
+        return ScopedAStatus::ok();
+    }
+    if (in_slot >= slots)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    bool unbootable;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        unbootable = !!slot_data.unbootable;
+    } else {
+        unbootable = isSlotFlagSet(in_slot, AB_ATTR_UNBOOTABLE);
+    }
+
+    *_aidl_return = unbootable ? false: true;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::isSlotMarkedSuccessful(int32_t in_slot, bool* _aidl_return) {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        // just return true so that we don't we another call trying to mark it as successful
+        // when there is no slots
+        *_aidl_return = true;
+        return ScopedAStatus::ok();
+    }
+    if (in_slot >= slots)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    bool successful;
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        successful = !!slot_data.successful;
+    } else {
+        successful = isSlotFlagSet(in_slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    *_aidl_return = successful ? true : false;
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::markBootSuccessful() {
+    int32_t slots = 0;
+    getNumberSlots(&slots);
+    if (slots == 0) {
+        // no slots, just return true otherwise Android keeps trying
+        return ScopedAStatus::ok();
+    }
+
+    bool ret;
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (isDevInfoValid()) {
+        auto const slot = current_slot;
+        devinfo.ab_data.slots[slot].successful = 1;
+        ret = DevInfoSync();
+    } else {
+        ret = setSlotFlag(current_slot, AB_ATTR_SUCCESSFUL);
+    }
+
+    if (!ret) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                  "Failed to set successful flag");
+    }
+
+    if (!blowAR()) {
+        ALOGE("Failed to blow anti-rollback counter");
+        // Ignore the error, since ABL will re-trigger it on reboot
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setActiveBootSlot(int32_t in_slot) {
+    if (in_slot >= 2) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+    }
+
+    if (isDevInfoValid()) {
+        auto &active_slot_data = devinfo.ab_data.slots[in_slot];
+        auto &inactive_slot_data = devinfo.ab_data.slots[!in_slot];
+
+        inactive_slot_data.active = 0;
+        DevInfoInitSlot(active_slot_data);
+
+        if (!DevInfoSync()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not update DevInfo data");
+        }
+    } else {
+        std::string dev_path = getDevPath(in_slot);
+        if (dev_path.empty()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not get device path for slot");
+        }
+
+        GptUtils gpt(dev_path);
+        if (gpt.Load()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                      "failed to load gpt data");
+        }
+
+        gpt_entry *active_entry = gpt.GetPartitionEntry(in_slot == 0 ? "boot_a" : "boot_b");
+        gpt_entry *inactive_entry = gpt.GetPartitionEntry(in_slot == 0 ? "boot_b" : "boot_a");
+        if (active_entry == nullptr || inactive_entry == nullptr) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "failed to get entries for boot partitions");
+        }
+
+        ALOGV("slot active attributes %lx\n", active_entry->attr);
+        ALOGV("slot inactive attributes %lx\n", inactive_entry->attr);
+
+        // update attributes for active and inactive
+        inactive_entry->attr &= ~AB_ATTR_ACTIVE;
+        active_entry->attr = AB_ATTR_ACTIVE | (AB_ATTR_MAX_PRIORITY << AB_ATTR_PRIORITY_SHIFT) |
+                             (AB_ATTR_MAX_RETRY_COUNT << AB_ATTR_RETRY_COUNT_SHIFT);
+    }
+
+    char boot_dev[PROPERTY_VALUE_MAX];
+    property_get("ro.boot.bootdevice", boot_dev, "");
+    if (boot_dev[0] == '\0') {
+        ALOGI("failed to get ro.boot.bootdevice. try ro.boot.boot_devices\n");
+        property_get("ro.boot.boot_devices", boot_dev, "");
+        if (boot_dev[0] == '\0') {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "invalid ro.boot.bootdevice and ro.boot.boot_devices prop");
+        }
+    }
+
+    std::string boot_lun_path =
+            std::string("/sys/devices/platform/") + boot_dev + "/pixel/boot_lun_enabled";
+    int fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+    if (fd < 0) {
+        // Try old path for kernels < 5.4
+        // TODO: remove once kernel 4.19 support is deprecated
+        std::string boot_lun_path =
+                std::string("/sys/devices/platform/") + boot_dev + "/attributes/boot_lun_enabled";
+        fd = open(boot_lun_path.c_str(), O_RDWR | O_DSYNC);
+        if (fd < 0) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "failed to open ufs attr boot_lun_enabled");
+        }
+    }
+
+    //
+    // bBootLunEn
+    // 0x1  => Boot LU A = enabled, Boot LU B = disable
+    // 0x2  => Boot LU A = disable, Boot LU B = enabled
+    //
+    int ret = ::android::base::WriteStringToFd(in_slot == 0 ? "1" : "2", fd);
+    close(fd);
+    if (ret < 0) {
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                COMMAND_FAILED, "faied to write boot_lun_enabled attribute");
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setSlotAsUnbootable(int32_t in_slot) {
+    if (in_slot >= 2)
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                INVALID_SLOT, (std::string("Invalid slot ") + std::to_string(in_slot)).c_str());
+
+    if (isDevInfoValid()) {
+        auto &slot_data = devinfo.ab_data.slots[in_slot];
+        slot_data.unbootable = 1;
+        if (!DevInfoSync()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not update DevInfo data");
+        }
+    } else {
+        std::string dev_path = getDevPath(in_slot);
+        if (dev_path.empty()) {
+            return ScopedAStatus::fromServiceSpecificErrorWithMessage(
+                    COMMAND_FAILED, "Could not get device path for slot");
+        }
+
+        GptUtils gpt(dev_path);
+        gpt.Load();
+
+        gpt_entry *e = gpt.GetPartitionEntry(in_slot ? "boot_b" : "boot_a");
+        e->attr |= AB_ATTR_UNBOOTABLE;
+
+        gpt.Sync();
+    }
+
+    return ScopedAStatus::ok();
+}
+
+ScopedAStatus BootControl::setSnapshotMergeStatus(MergeStatus in_status) {
+    int32_t current_slot = 0;
+    getCurrentSlot(&current_slot);
+    if (!SetMiscVirtualAbMergeStatus(current_slot, ToHIDLMergeStatus(in_status)))
+        return ScopedAStatus::fromServiceSpecificErrorWithMessage(COMMAND_FAILED,
+                                                                  "Operation failed");
+    return ScopedAStatus::ok();
+}
+
+}  // namespace aidl::android::hardware::boot
diff --git a/bootctrl/aidl/BootControl.h b/bootctrl/aidl/BootControl.h
new file mode 100644
index 0000000..a54f66d
--- /dev/null
+++ b/bootctrl/aidl/BootControl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <aidl/android/hardware/boot/BnBootControl.h>
+#include <libboot_control/libboot_control.h>
+
+namespace aidl::android::hardware::boot {
+
+class BootControl final : public BnBootControl {
+  public:
+    BootControl();
+    ::ndk::ScopedAStatus getActiveBootSlot(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getCurrentSlot(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getNumberSlots(int32_t* _aidl_return) override;
+    ::ndk::ScopedAStatus getSnapshotMergeStatus(
+            ::aidl::android::hardware::boot::MergeStatus* _aidl_return) override;
+    ::ndk::ScopedAStatus getSuffix(int32_t in_slot, std::string* _aidl_return) override;
+    ::ndk::ScopedAStatus isSlotBootable(int32_t in_slot, bool* _aidl_return) override;
+    ::ndk::ScopedAStatus isSlotMarkedSuccessful(int32_t in_slot, bool* _aidl_return) override;
+    ::ndk::ScopedAStatus markBootSuccessful() override;
+    ::ndk::ScopedAStatus setActiveBootSlot(int32_t in_slot) override;
+    ::ndk::ScopedAStatus setSlotAsUnbootable(int32_t in_slot) override;
+    ::ndk::ScopedAStatus setSnapshotMergeStatus(
+            ::aidl::android::hardware::boot::MergeStatus in_status) override;
+};
+
+enum otpmgr_command : uint32_t {
+    OTP_REQ_SHIFT = 1,
+    OTP_RESP_BIT = 1,
+    OTP_CMD_write_antirbk_non_secure_ap = (7 << OTP_REQ_SHIFT),
+    OTP_CMD_write_antirbk_secure_ap = (8 << OTP_REQ_SHIFT),
+};
+
+struct otp_mgr_req_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    uint8_t handle;
+}__packed;
+
+struct otp_mgr_rsp_base {
+    uint32_t command;
+    uint32_t resp_payload_size;
+    int result;
+}__packed;
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/DevInfo.h b/bootctrl/aidl/DevInfo.h
new file mode 100644
index 0000000..aa5f5d3
--- /dev/null
+++ b/bootctrl/aidl/DevInfo.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+namespace aidl::android::hardware::boot {
+
+//
+// definitions taken from ABL code
+//
+
+constexpr uint32_t DEVINFO_MAGIC = 0x49564544;
+constexpr size_t DEVINFO_AB_SLOT_COUNT = 2;
+
+struct devinfo_ab_slot_data_t {
+    uint8_t retry_count;
+    uint8_t unbootable : 1;
+    uint8_t successful : 1;
+    uint8_t active : 1;
+    uint8_t fastboot_ok : 1;
+    uint8_t : 4;
+    uint8_t unused[2];
+} __attribute__((packed));
+
+typedef struct {
+    devinfo_ab_slot_data_t slots[DEVINFO_AB_SLOT_COUNT];
+} __attribute__((packed)) devinfo_ab_data_t;
+
+struct devinfo_t {
+    uint32_t magic;
+    uint16_t ver_major;
+    uint16_t ver_minor;
+    uint8_t unused[40];
+    devinfo_ab_data_t ab_data;
+    uint8_t unused1[72];  // use remaining up to complete 128 bytes
+} __attribute__((packed));
+
+static_assert(sizeof(devinfo_t) == 128, "invalid devinfo struct size");
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/GptUtils.cpp b/bootctrl/aidl/GptUtils.cpp
new file mode 100644
index 0000000..34dec11
--- /dev/null
+++ b/bootctrl/aidl/GptUtils.cpp
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bootcontrolhal"
+
+#include "GptUtils.h"
+
+#include <android-base/file.h>
+#include <errno.h>
+#include <linux/fs.h>
+#include <log/log.h>
+#include <zlib.h>
+
+namespace aidl::android::hardware::boot {
+
+namespace {
+
+static int ValidateGptHeader(gpt_header *gpt) {
+    if (gpt->signature != GPT_SIGNATURE) {
+        ALOGE("invalid gpt signature 0x%lx\n", gpt->signature);
+        return -1;
+    }
+
+    if (gpt->header_size != sizeof(gpt_header)) {
+        ALOGE("invalid gpt header size %u\n", gpt->header_size);
+        return -1;
+    }
+
+    if (gpt->entry_size != sizeof(gpt_entry)) {
+        ALOGE("invalid gpt entry size %u\n", gpt->entry_size);
+        return -1;
+    }
+
+    return 0;
+}
+
+}  // namespace
+
+GptUtils::GptUtils(const std::string dev_path) : dev_path(dev_path), fd(0) {}
+
+int GptUtils::Load(void) {
+    fd = open(dev_path.c_str(), O_RDWR);
+    if (fd < 0) {
+        ALOGE("failed to open block dev %s, %d\n", dev_path.c_str(), errno);
+        return -1;
+    }
+
+    int ret = ioctl(fd, BLKSSZGET, &block_size);
+    if (ret < 0) {
+        ALOGE("failed to get block size %d\n", errno);
+        return -1;
+    }
+
+    // read primary header
+    lseek64(fd, block_size, SEEK_SET);
+    ret = read(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to read gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_primary)) {
+        ALOGE("error validating gpt header\n");
+        return -1;
+    }
+
+    // read partition entries
+    entry_array.resize(gpt_primary.entry_count);
+    uint32_t entries_size = gpt_primary.entry_size * gpt_primary.entry_count;
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = read(fd, entry_array.data(), entries_size);
+    if (ret < 0) {
+        ALOGE("failed to read gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // read gpt back header
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = read(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to read gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    if (ValidateGptHeader(&gpt_backup)) {
+        ALOGW("error validating gpt backup\n");  // just warn about it, not fail
+    }
+
+    // Create map <partition name, gpt_entry pointer>
+    auto get_name = [](const uint16_t *efi_name) {
+        char name[37] = {};
+        for (size_t i = 0; efi_name[i] && i < sizeof name - 1; ++i) name[i] = efi_name[i];
+        return std::string(name);
+    };
+
+    for (auto const &e : entry_array) {
+        if (e.name[0] == 0)
+            break;  // stop at the first partition with no name
+        std::string s = get_name(e.name);
+        entries[s] = const_cast<gpt_entry *>(&e);
+    }
+
+    return 0;
+}
+
+gpt_entry *GptUtils::GetPartitionEntry(std::string name) {
+    return entries.find(name) != entries.end() ? entries[name] : nullptr;
+}
+
+int GptUtils::Sync(void) {
+    if (!fd)
+        return -1;
+
+    // calculate crc and check if we need to update gpt
+    gpt_primary.entries_crc32 = crc32(0, reinterpret_cast<uint8_t *>(entry_array.data()),
+                                      entry_array.size() * sizeof(gpt_entry));
+
+    // save old crc
+    uint32_t crc = gpt_primary.crc32;
+    gpt_primary.crc32 = 0;
+
+    gpt_primary.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_primary), sizeof gpt_primary);
+    if (crc == gpt_primary.crc32)
+        return 0;  // nothing to do (no changes)
+
+    ALOGI("updating GPT\n");
+
+    lseek64(fd, block_size * gpt_primary.current_lba, SEEK_SET);
+    int ret = write(fd, &gpt_primary, sizeof gpt_primary);
+    if (ret < 0) {
+        ALOGE("failed to write gpt primary header %d\n", errno);
+        return -1;
+    }
+
+    lseek64(fd, block_size * gpt_primary.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt partition entries %d\n", errno);
+        return -1;
+    }
+
+    // update GPT backup entries and backup
+    lseek64(fd, block_size * gpt_backup.start_lba, SEEK_SET);
+    ret = write(fd, entry_array.data(), entry_array.size() * sizeof(gpt_entry));
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup partition entries %d\n", errno);
+        return -1;
+    }
+
+    gpt_backup.entries_crc32 = gpt_primary.entries_crc32;
+    gpt_backup.crc32 = 0;
+    gpt_backup.crc32 = crc32(0, reinterpret_cast<uint8_t *>(&gpt_backup), sizeof gpt_backup);
+    lseek64(fd, block_size * gpt_primary.backup_lba, SEEK_SET);
+    ret = write(fd, &gpt_backup, sizeof gpt_backup);
+    if (ret < 0) {
+        ALOGE("failed to write gpt backup header %d\n", errno);
+        return -1;
+    }
+
+    fsync(fd);
+
+    return 0;
+}
+
+GptUtils::~GptUtils() {
+    if (fd) {
+        Sync();
+        close(fd);
+    }
+}
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/GptUtils.h b/bootctrl/aidl/GptUtils.h
new file mode 100644
index 0000000..ec68cf6
--- /dev/null
+++ b/bootctrl/aidl/GptUtils.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <string>
+#include <vector>
+
+namespace aidl::android::hardware::boot {
+
+#define GPT_SIGNATURE 0x5452415020494645UL
+
+typedef struct {
+    uint8_t type_guid[16];
+    uint8_t guid[16];
+    uint64_t first_lba;
+    uint64_t last_lba;
+    uint64_t attr;
+    uint16_t name[36];
+} __attribute__((packed)) gpt_entry;
+
+typedef struct {
+    uint64_t signature;
+    uint32_t revision;
+    uint32_t header_size;
+    uint32_t crc32;
+    uint32_t reserved;
+    uint64_t current_lba;
+    uint64_t backup_lba;
+    uint64_t first_usable_lba;
+    uint64_t last_usable_lba;
+    uint8_t disk_guid[16];
+    uint64_t start_lba;
+    uint32_t entry_count;
+    uint32_t entry_size;
+    uint32_t entries_crc32;
+} __attribute__((packed)) gpt_header;
+
+class GptUtils {
+  public:
+    GptUtils(const std::string dev_path);
+    int Load(void);
+    gpt_entry *GetPartitionEntry(std::string name);
+    int Sync(void);
+    ~GptUtils();
+
+  private:
+    std::string dev_path;
+    int fd;
+    uint32_t block_size;
+    gpt_header gpt_primary;
+    gpt_header gpt_backup;
+    std::vector<gpt_entry> entry_array;
+    std::map<std::string, gpt_entry *> entries;
+};
+
+}  // namespace aidl::android::hardware::boot
\ No newline at end of file
diff --git a/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc b/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc
new file mode 100644
index 0000000..a9887b9
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default-pixel.rc
@@ -0,0 +1,5 @@
+service vendor.boot-default /vendor/bin/hw/android.hardware.boot-service.default-pixel
+    class early_hal
+    user root
+    group root drmrpc
+
diff --git a/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc
new file mode 100644
index 0000000..e58617e
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.rc
@@ -0,0 +1,7 @@
+service vendor.boot-default /system/bin/hw/android.hardware.boot-service.default_recovery-pixel
+    class early_hal
+    user root
+    group root
+    seclabel u:r:hal_bootctl_default:s0
+    interface aidl android.hardware.boot.IBootControl/default
+
diff --git a/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml
new file mode 100644
index 0000000..23ccc4e
--- /dev/null
+++ b/bootctrl/aidl/android.hardware.boot-service.default_recovery-pixel.xml
@@ -0,0 +1,6 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>android.hardware.boot</name>
+        <fqname>IBootControl/default</fqname>
+    </hal>
+</manifest>
diff --git a/bootctrl/aidl/service.cpp b/bootctrl/aidl/service.cpp
new file mode 100644
index 0000000..41b6c25
--- /dev/null
+++ b/bootctrl/aidl/service.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "aidl.android.hardware.boot-service.default"
+
+#include <android-base/logging.h>
+#include <android/binder_manager.h>
+#include <android/binder_process.h>
+#include <hidl/HidlSupport.h>
+#include <hidl/HidlTransportSupport.h>
+
+#include "BootControl.h"
+
+using aidl::android::hardware::boot::BootControl;
+using aidl::android::hardware::boot::IBootControl;
+using ::android::hardware::configureRpcThreadpool;
+using ::android::hardware::joinRpcThreadpool;
+
+int main(int, char* argv[]) {
+    android::base::InitLogging(argv, android::base::KernelLogger);
+    ABinderProcess_setThreadPoolMaxThreadCount(0);
+    std::shared_ptr<IBootControl> service = ndk::SharedRefBase::make<BootControl>();
+
+    const std::string instance = std::string(BootControl::descriptor) + "/default";
+    auto status = AServiceManager_addService(service->asBinder().get(), instance.c_str());
+    CHECK_EQ(status, STATUS_OK) << "Failed to add service " << instance << " " << status;
+    LOG(INFO) << "IBootControl AIDL service running...";
+
+    ABinderProcess_joinThreadPool();
+    return EXIT_FAILURE;  // should not reach
+}
diff --git a/bootctrl/bootctrl_aidl.mk b/bootctrl/bootctrl_aidl.mk
new file mode 100644
index 0000000..e9d7051
--- /dev/null
+++ b/bootctrl/bootctrl_aidl.mk
@@ -0,0 +1,6 @@
+PRODUCT_PACKAGES += \
+	android.hardware.boot-service.default-pixel \
+	android.hardware.boot-service.default_recovery-pixel
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/aidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/aidl
diff --git a/bootctrl/bootctrl_hidl_1.2.mk b/bootctrl/bootctrl_hidl_1.2.mk
new file mode 100644
index 0000000..ef25066
--- /dev/null
+++ b/bootctrl/bootctrl_hidl_1.2.mk
@@ -0,0 +1,6 @@
+PRODUCT_PACKAGES += \
+	android.hardware.boot@1.2-impl-pixel \
+	android.hardware.boot@1.2-service-pixel
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/bootctrl/1.2
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bootctrl/sepolicy/1.2
diff --git a/bootctrl/sepolicy/1.2/device.te b/bootctrl/sepolicy/1.2/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/1.2/file.te b/bootctrl/sepolicy/1.2/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/1.2/file_contexts b/bootctrl/sepolicy/1.2/file_contexts
new file mode 100644
index 0000000..c456356
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot@1\.2-service-pixel                    u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/1.2/hal_bootctl_default.te b/bootctrl/sepolicy/1.2/hal_bootctl_default.te
new file mode 100644
index 0000000..fe017f9
--- /dev/null
+++ b/bootctrl/sepolicy/1.2/hal_bootctl_default.te
@@ -0,0 +1,3 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
diff --git a/bootctrl/sepolicy/aidl/device.te b/bootctrl/sepolicy/aidl/device.te
new file mode 100644
index 0000000..4fd0240
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/device.te
@@ -0,0 +1,5 @@
+# devinfo block device
+type devinfo_block_device, dev_type;
+
+# OTA
+type sda_block_device, dev_type;
diff --git a/bootctrl/sepolicy/aidl/file.te b/bootctrl/sepolicy/aidl/file.te
new file mode 100644
index 0000000..5357fa9
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file.te
@@ -0,0 +1,2 @@
+# sysfs
+type sysfs_ota, sysfs_type, fs_type;
diff --git a/bootctrl/sepolicy/aidl/file_contexts b/bootctrl/sepolicy/aidl/file_contexts
new file mode 100644
index 0000000..339896f
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.boot-service\.default-pixel                u:object_r:hal_bootctl_default_exec:s0
diff --git a/bootctrl/sepolicy/aidl/hal_bootctl_default.te b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
new file mode 100644
index 0000000..2ffeb27
--- /dev/null
+++ b/bootctrl/sepolicy/aidl/hal_bootctl_default.te
@@ -0,0 +1,8 @@
+allow hal_bootctl_default devinfo_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sda_block_device:blk_file rw_file_perms;
+allow hal_bootctl_default sysfs_ota:file rw_file_perms;
+allow hal_bootctl_default tee_device:chr_file rw_file_perms;
+
+recovery_only(`
+  allow hal_bootctl_default rootfs:dir r_dir_perms;
+')
diff --git a/camera/lyric.mk b/camera/lyric.mk
index b9583ea..e3feab3 100644
--- a/camera/lyric.mk
+++ b/camera/lyric.mk
@@ -37,6 +37,7 @@
 
 # Calibration tool for debug builds
 PRODUCT_PACKAGES_DEBUG += tarasque_test
+PRODUCT_PACKAGES_DEBUG += ProtoCalibGenerator
 
 endif  # vendor/google/camera check
 
diff --git a/chre/README.txt b/chre/README.txt
new file mode 100644
index 0000000..3bdea2b
--- /dev/null
+++ b/chre/README.txt
@@ -0,0 +1,5 @@
+This folder contains the common settings for CHRE shared by various platforms.
+
+Dependencies among types can happen. For example, hal_contexthub_default
+depends on sysfs_aoc at the moment. When setting up a device with CHRE
+we should make sure rules of dependent types are included too.
diff --git a/chre/hal.mk b/chre/hal.mk
new file mode 100644
index 0000000..13ebb7f
--- /dev/null
+++ b/chre/hal.mk
@@ -0,0 +1,2 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/chre/sepolicy/
+PRODUCT_PACKAGES += android.hardware.contexthub-service.generic
\ No newline at end of file
diff --git a/chre/sepolicy/file_contexts b/chre/sepolicy/file_contexts
new file mode 100644
index 0000000..0659579
--- /dev/null
+++ b/chre/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.contexthub-service\.generic               u:object_r:hal_contexthub_default_exec:s0
diff --git a/chre/sepolicy/hal_contexthub_default.te b/chre/sepolicy/hal_contexthub_default.te
new file mode 100644
index 0000000..542d383
--- /dev/null
+++ b/chre/sepolicy/hal_contexthub_default.te
@@ -0,0 +1,34 @@
+#
+# Context hub multiclient HAL common selinux policies
+#
+
+# Permit communication with AoC
+allow hal_contexthub_default aoc_device:chr_file rw_file_perms;
+
+# Allow context hub HAL to determine AoC's current clock
+allow hal_contexthub_default sysfs_aoc:dir search;
+allow hal_contexthub_default sysfs_aoc_boottime:file r_file_perms;
+
+# Allow context hub HAL to create thread to watch AOC's device
+allow hal_contexthub_default device:dir r_dir_perms;
+
+# Allow context hub HAL to use the USF low latency transport
+usf_low_latency_transport(hal_contexthub_default)
+
+# Allow context hub HAL to talk to the WiFi HAL
+binder_call(hal_contexthub_default, hal_wifi_ext)
+allow hal_contexthub_default hal_wifi_ext_service:service_manager find;
+
+# Allow context hub HAL to talk to stats service
+binder_call(hal_contexthub_default, stats_service_server)
+allow hal_contexthub_default fwk_stats_service:service_manager find;
+
+# Allow context hub HAL to write data to /data/vendor/chre/ directory
+allow hal_contexthub_default chre_data_file:dir create_dir_perms;
+allow hal_contexthub_default chre_data_file:file create_file_perms;
+
+# Allow context hub HAL to use WakeLock
+wakelock_use(hal_contexthub_default)
+
+# Allow context hub HAL to block suspend, which is required to use EPOLLWAKEUP
+allow hal_contexthub_default self:global_capability2_class_set block_suspend;
diff --git a/display_logbuffer/Android.bp b/display_logbuffer/Android.bp
new file mode 100644
index 0000000..e2859d9
--- /dev/null
+++ b/display_logbuffer/Android.bp
@@ -0,0 +1,19 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "dump_display_logbuffer",
+    srcs: ["dump_display_logbuffer.cpp"],
+    init_rc: ["init.display_logbuffer.rc"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libdump",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
diff --git a/display_logbuffer/dump.mk b/display_logbuffer/dump.mk
new file mode 100644
index 0000000..9808c1d
--- /dev/null
+++ b/display_logbuffer/dump.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/display_logbuffer/sepolicy
+
+PRODUCT_PACKAGES += dump_display_logbuffer
diff --git a/display_logbuffer/dump_display_logbuffer.cpp b/display_logbuffer/dump_display_logbuffer.cpp
new file mode 100644
index 0000000..7477c8c
--- /dev/null
+++ b/display_logbuffer/dump_display_logbuffer.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <dump/pixel_dump.h>
+#include <unistd.h>
+
+const char* logbuffer_paths[][2] = {
+    {"DSIM0", "/dev/logbuffer_dsim0"},
+    {"DSIM1", "/dev/logbuffer_dsim1"},
+};
+
+int main() {
+    for (auto &logbuffer_path : logbuffer_paths) {
+        if(!access(logbuffer_path[1], R_OK)) {
+            dumpFileContent(logbuffer_path[0], logbuffer_path[1]);
+        }
+    }
+
+    return 0;
+}
\ No newline at end of file
diff --git a/display_logbuffer/init.display_logbuffer.rc b/display_logbuffer/init.display_logbuffer.rc
new file mode 100644
index 0000000..2a39ce3
--- /dev/null
+++ b/display_logbuffer/init.display_logbuffer.rc
@@ -0,0 +1,3 @@
+on property:ro.build.type=userdebug
+    chown system system /dev/logbuffer_dsim0
+    chown system system /dev/logbuffer_dsim1
diff --git a/display_logbuffer/sepolicy/device.te b/display_logbuffer/sepolicy/device.te
new file mode 100644
index 0000000..94432f4
--- /dev/null
+++ b/display_logbuffer/sepolicy/device.te
@@ -0,0 +1 @@
+type display_log_device, dev_type;
\ No newline at end of file
diff --git a/display_logbuffer/sepolicy/dump_display_logbuffer.te b/display_logbuffer/sepolicy/dump_display_logbuffer.te
new file mode 100644
index 0000000..34da48c
--- /dev/null
+++ b/display_logbuffer/sepolicy/dump_display_logbuffer.te
@@ -0,0 +1,3 @@
+pixel_bugreport(dump_display_logbuffer)
+
+allow dump_display_logbuffer display_log_device:chr_file r_file_perms;
\ No newline at end of file
diff --git a/display_logbuffer/sepolicy/file_contexts b/display_logbuffer/sepolicy/file_contexts
new file mode 100644
index 0000000..7425214
--- /dev/null
+++ b/display_logbuffer/sepolicy/file_contexts
@@ -0,0 +1,4 @@
+/vendor/bin/dump/dump_display_logbuffer      u:object_r:dump_display_logbuffer_exec:s0
+
+/dev/logbuffer_dsim0                         u:object_r:display_log_device:s0
+/dev/logbuffer_dsim1                         u:object_r:display_log_device:s0
diff --git a/edgetpu/sepolicy/hal_audio_default.te b/edgetpu/sepolicy/hal_audio_default.te
index 2646fcc..523770c 100644
--- a/edgetpu/sepolicy/hal_audio_default.te
+++ b/edgetpu/sepolicy/hal_audio_default.te
@@ -12,3 +12,7 @@
 
 # Allow audio HAL to read tflite Darwinn delegate properties
 get_prop(hal_audio_default, vendor_tflite_delegate_prop)
+get_prop(hal_audio_default, vendor_edgetpu_runtime_prop)
+
+# Allow DMA Buf access.
+allow hal_audio_default dmabuf_system_heap_device:chr_file r_file_perms;
diff --git a/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp b/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
index 6e377aa..c842d3e 100644
--- a/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
+++ b/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
@@ -62,6 +62,14 @@
             }
         }
 
+        // Cpufreq data is sorted in ascending order, but power stats are sorted
+        // in descending order. Reverse sorting to maintain consistency with
+        // other power stats.
+        if (states.size() > 1 &&
+                std::atoll(states[0].second.c_str()) < std::atoll(states[1].second.c_str())) {
+            std::reverse(states.begin(), states.end());
+        }
+
         mPowerEntities.push_back({powerEntities[i].first, std::move(states)});
     }
 
diff --git a/powerstats/DisplayMrrStateResidencyDataProvider.cpp b/powerstats/DisplayMrrStateResidencyDataProvider.cpp
new file mode 100644
index 0000000..8ab9af4
--- /dev/null
+++ b/powerstats/DisplayMrrStateResidencyDataProvider.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "DisplayMrrStateResidencyDataProvider.h"
+
+#include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <android-base/strings.h>
+
+using android::base::ParseInt;
+using android::base::ParseUint;
+using android::base::Split;
+using android::base::Trim;
+
+static const std::string TIME_IN_STATE = "time_in_state";
+static const std::string AVAILABLE_STATE = "available_disp_stats";
+static const std::vector<std::string> DISP_STATE = { "On", "HBM", "LP", "Off" };
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+DisplayMrrStateResidencyDataProvider::DisplayMrrStateResidencyDataProvider(
+        const std::string& name, const std::string& path) : mName(name), mPath(path) {
+    mConfigs = std::vector<Config>();
+    std::string statePath = mPath + AVAILABLE_STATE;
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(statePath.c_str(), "r"), fclose);
+    if (fp) {
+        char *line = nullptr;
+        size_t len = 0;
+        Config config = { .state = 0, .resX = 0, .resY = 0, .rr = 0 };
+        while (getline(&line, &len, fp.get()) != -1) {
+            if (parseAvailableState(line, &config)) {
+                mConfigs.push_back(config);
+            } else {
+                PLOG(ERROR) << "Failed to parse display config for [" << std::string(line)
+                            << "] from " << statePath;
+                mConfigs.clear();
+                break;
+            }
+        }
+        free(line);
+    } else {
+        PLOG(ERROR) << "Failed to open file " << statePath;
+    }
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseConfig(
+        char const *line, Config *config, uint64_t *duration) {
+    std::vector<std::string> parts = Split(line, " ");
+
+    if (duration == nullptr) {
+        if (parts.size() != 4) return false;
+    } else {
+        if (parts.size() != 5) return false;
+
+        if (!ParseUint(Trim(parts[4]), duration)) return false;
+    }
+
+    if (!ParseInt(Trim(parts[0]), &config->state)) return false;
+    if (!ParseInt(Trim(parts[1]), &config->resX)) return false;
+    if (!ParseInt(Trim(parts[2]), &config->resY)) return false;
+    if (!ParseInt(Trim(parts[3]), &config->rr)) return false;
+
+    return true;
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseAvailableState(
+        char const *line, Config *config) {
+    return parseConfig(line, config, nullptr);
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseTimeInState(
+        char const *line, Config *config, uint64_t *duration) {
+    return parseConfig(line, config, duration);
+}
+
+bool DisplayMrrStateResidencyDataProvider::getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) {
+    if (mConfigs.empty()) {
+        LOG(ERROR) << "Display MRR state list is empty!";
+        return false;
+    }
+
+    std::string path = mPath + TIME_IN_STATE;
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(path.c_str(), "r"), fclose);
+    if (!fp) {
+        PLOG(ERROR) << "Failed to open file " << path;
+        return false;
+    }
+
+    std::vector<StateResidency> stateResidencies;
+    for (int i = 0; i < mConfigs.size(); i++) {
+        StateResidency s = {.id = i, .totalTimeInStateMs = 0};
+        stateResidencies.push_back(s);
+    }
+
+    char *line = nullptr;
+    size_t len = 0;
+    Config config = { .state = 0, .resX = 0, .resY = 0, .rr = 0 };
+    uint64_t duration;
+    std::vector<Config>::const_iterator found;
+    while (getline(&line, &len, fp.get()) != -1) {
+        if (parseTimeInState(line, &config, &duration)) {
+            found = std::find(mConfigs.begin(), mConfigs.end(), config);
+            if (found != mConfigs.end()) {
+                stateResidencies[found - mConfigs.begin()].totalTimeInStateMs = duration;
+            } else {
+                LOG(ERROR) << "Failed to find config for [" << std::string(line)
+                           << "] in display MRR state list";
+            }
+        } else {
+            LOG(ERROR) << "Failed to parse state and duration from [" << std::string(line) << "]";
+            free(line);
+            return false;
+        }
+    }
+
+    residencies->emplace(mName, stateResidencies);
+
+    free(line);
+
+    return true;
+}
+
+std::unordered_map<std::string, std::vector<State>> DisplayMrrStateResidencyDataProvider::getInfo()
+{
+    int32_t dispId;
+    std::string name;
+    std::vector<State> states;
+    for (int32_t id = 0; id < mConfigs.size(); id++) {
+        dispId = mConfigs[id].state;
+        if (dispId >= DISP_STATE.size()) {
+            LOG(ERROR) << "Display state id " << dispId << " is out of bound";
+            return {};
+        }
+
+        name = DISP_STATE[dispId];
+        if (dispId != DISP_STATE.size() - 1) {
+            name += ": " + std::to_string(mConfigs[id].resX) +
+                    "x" + std::to_string(mConfigs[id].resY) +
+                    "@" + std::to_string(mConfigs[id].rr);
+        }
+        State s = { .id = id, .name = name };
+        states.push_back(s);
+    }
+
+    return {{ mName, states }};
+}
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/TpuDvfsStateResidencyDataProvider.cpp b/powerstats/TpuDvfsStateResidencyDataProvider.cpp
new file mode 100644
index 0000000..e1ce56c
--- /dev/null
+++ b/powerstats/TpuDvfsStateResidencyDataProvider.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "TpuDvfsStateResidencyDataProvider.h"
+
+#include <android-base/logging.h>
+
+static const std::string ENTITY_NAME = "TPU-DVFS";
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+TpuDvfsStateResidencyDataProvider::TpuDvfsStateResidencyDataProvider(
+        const std::string& path,
+        std::vector<std::string> frequencies,
+        uint64_t clockRate)
+    : mPath(path), mFrequencies(std::move(frequencies)), mClockRate(clockRate) {}
+
+bool TpuDvfsStateResidencyDataProvider::getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) {
+    // Using FILE* instead of std::ifstream for performance reasons
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(mPath.c_str(), "r"), fclose);
+    if (!fp) {
+        PLOG(ERROR) << "Failed to open file " << mPath;
+        return false;
+    }
+
+    std::vector<StateResidency> stateResidencies;
+    for (int i = 0; i < mFrequencies.size(); i++) {
+        StateResidency s = {.id = i, .totalTimeInStateMs = 0};
+        stateResidencies.push_back(s);
+    }
+
+    char *line = nullptr;
+    size_t len = 0;
+    std::istringstream ssLine;
+    std::string split;
+    int32_t lineIdx = 0;
+    std::vector<int32_t> stateIdxMap;
+    int32_t colIdx;
+    std::vector<std::string>::const_iterator found;
+    while (getline(&line, &len, fp.get()) != -1) {
+        ssLine.clear();
+        ssLine.str(line);
+        colIdx = 0;
+        for (std::string split; std::getline(ssLine, split, ' ');) {
+            // Skip first column
+            if (split.find(':') != std::string::npos)
+                continue;
+
+            if (lineIdx == 0) {
+                // Build the state index map by first row
+                split.erase(split.find_last_not_of(" \n\r\t") + 1);
+                found = std::find(mFrequencies.begin(), mFrequencies.end(), split);
+                if (found != mFrequencies.end()) {
+                    stateIdxMap.push_back(found - mFrequencies.begin());
+                } else {
+                    PLOG(ERROR) << "TPU frequency " << split << " is not found in " << mPath;
+                    stateIdxMap.push_back(0);
+                }
+            } else {
+                // Add up time in frequency per uid
+                stateResidencies[stateIdxMap[colIdx]].totalTimeInStateMs +=
+                        std::atoll(split.c_str()) / mClockRate;
+            }
+            colIdx++;
+        }
+        lineIdx++;
+    }
+
+    residencies->emplace(ENTITY_NAME, stateResidencies);
+    return true;
+}
+
+std::unordered_map<std::string, std::vector<State>> TpuDvfsStateResidencyDataProvider::getInfo() {
+    std::vector<State> states;
+    for (int32_t id = 0; id < mFrequencies.size(); id++) {
+        State s =
+            {.id = id, .name = std::to_string(std::atol(mFrequencies[id].c_str()) / 1000) + "MHz"};
+        states.push_back(s);
+    }
+
+    return {{ENTITY_NAME, states}};
+}
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/include/DisplayMrrStateResidencyDataProvider.h b/powerstats/include/DisplayMrrStateResidencyDataProvider.h
new file mode 100644
index 0000000..81ea17e
--- /dev/null
+++ b/powerstats/include/DisplayMrrStateResidencyDataProvider.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <PowerStatsAidl.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+class DisplayMrrStateResidencyDataProvider : public PowerStats::IStateResidencyDataProvider {
+  public:
+    DisplayMrrStateResidencyDataProvider(const std::string& name, const std::string& path);
+    ~DisplayMrrStateResidencyDataProvider() = default;
+
+    /*
+     * See IStateResidencyDataProvider::getStateResidencies
+     */
+    bool getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) override;
+
+    /*
+     * See IStateResidencyDataProvider::getInfo
+     */
+    std::unordered_map<std::string, std::vector<State>> getInfo() override;
+
+  private:
+    struct Config {
+      int32_t state; // Display state (On, HBM, LP, Off)
+      int32_t resX;  // Resolution X
+      int32_t resY;  // Resolution Y
+      int32_t rr;    // Refresh rate
+
+      bool operator==(const Config& r) const {
+        return state == r.state && resX == r.resX && resY == r.resY && rr == r.rr;
+      }
+    };
+
+    bool parseConfig(char const *line, Config *config, uint64_t *duration);
+    bool parseAvailableState(char const *line, Config *config);
+    bool parseTimeInState(char const *line, Config *config, uint64_t *duration);
+    bool loadAvailableState();
+
+    const std::string mName;
+    const std::string mPath;
+    std::vector<Config> mConfigs;
+};
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/include/TpuDvfsStateResidencyDataProvider.h b/powerstats/include/TpuDvfsStateResidencyDataProvider.h
new file mode 100644
index 0000000..9ce3bd3
--- /dev/null
+++ b/powerstats/include/TpuDvfsStateResidencyDataProvider.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <PowerStatsAidl.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+class TpuDvfsStateResidencyDataProvider : public PowerStats::IStateResidencyDataProvider {
+  public:
+    TpuDvfsStateResidencyDataProvider(
+            const std::string& path, std::vector<std::string> frequencies, uint64_t clockRate);
+    ~TpuDvfsStateResidencyDataProvider() = default;
+
+    /*
+     * See IStateResidencyDataProvider::getStateResidencies
+     */
+    bool getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) override;
+
+    /*
+     * See IStateResidencyDataProvider::getInfo
+     */
+    std::unordered_map<std::string, std::vector<State>> getInfo() override;
+
+  private:
+    const std::string mPath;
+    const std::vector<std::string> mFrequencies;
+    const uint64_t mClockRate;
+};
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/sensors/sepolicy/hal_sensors_default.te b/sensors/sepolicy/hal_sensors_default.te
index 1d152d4..85a8262 100644
--- a/sensors/sepolicy/hal_sensors_default.te
+++ b/sensors/sepolicy/hal_sensors_default.te
@@ -60,6 +60,9 @@
 
 # Allow access to CHRE socket to connect to nanoapps.
 unix_socket_connect(hal_sensors_default, chre, chre)
+## TODO(b/248615564): Remove above rule after CHRE multiclient HAL is launched.
+unix_socket_connect(hal_sensors_default, chre, hal_contexthub_default)
+
 
 # Allow access to the power supply files for MagCC.
 r_dir_file(hal_sensors_default, sysfs_batteryinfo)
diff --git a/storage/init.storage.rc b/storage/init.storage.rc
index 56e8e4f..948e820 100644
--- a/storage/init.storage.rc
+++ b/storage/init.storage.rc
@@ -1,3 +1,60 @@
 on property:ro.build.type=userdebug
     write /dev/sys/block/bootdevice/pixel/enable_pixel_ufs_logging 1
     chown system /dev/sg3
+
+on default_storage_mode
+    # F2FS
+    write /dev/sys/fs/by-name/userdata/data_io_flag 8
+    write /dev/sys/fs/by-name/userdata/node_io_flag 8
+
+    # Block
+    write /dev/sys/block/by-name/rootdisk/queue/iostats 1
+    write /dev/sys/block/by-name/rootdisk/queue/nr_requests 128
+    write /dev/sys/block/by-name/rootdisk/queue/rq_affinity 2
+
+    # UFS
+    write /dev/sys/block/bootdevice/clkgate_enable 1
+
+on init
+    # Symlink /dev/sys/block/bootdevice
+    wait /dev/block/platform/${ro.boot.boot_devices}
+    symlink /dev/block/platform/${ro.boot.boot_devices} /dev/block/bootdevice
+    symlink /sys/devices/platform/${ro.boot.boot_devices} /dev/sys/block/bootdevice
+
+    # F2FS
+    write /dev/sys/fs/by-name/userdata/data_io_flag 56
+    write /dev/sys/fs/by-name/userdata/node_io_flag 56
+
+    # Block
+    write /dev/sys/block/by-name/rootdisk/queue/iostats 0
+    write /sys/sys/block/by-name/rootdisk/queue/nr_requests 256
+
+    # UFS
+    write /dev/sys/block/bootdevice/clkgate_enable 0
+
+on property:sys.boot_completed=1
+    # Health Storage HAL
+    chown system system /dev/sys/block/bootdevice/manual_gc
+
+    # Pixelstats
+    chown system system /dev/sys/block/bootdevice/slowio_read_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_sync_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_unmap_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_write_cnt
+
+    chown system system /dev/sys/fs/by-name/userdata/committed_atomic_block
+    chown system system /dev/sys/fs/by-name/userdata/compr_new_inode
+    chown system system /dev/sys/fs/by-name/userdata/compr_saved_block
+    chown system system /dev/sys/fs/by-name/userdata/compr_written_block
+    chown system system /dev/sys/fs/by-name/userdata/gc_reclaimed_segments
+    chown system system /dev/sys/fs/by-name/userdata/gc_segment_mode
+    chown system system /dev/sys/fs/by-name/userdata/peak_atomic_write
+    chown system system /dev/sys/fs/by-name/userdata/revoked_atomic_block
+
+    trigger default_storage_mode
+
+on charger
+    trigger default_storage_mode
+
+on property:ro.boot.mode=charger && property:init.svc.vendor.charger=running
+    trigger default_storage_mode
diff --git a/touch/gti/init.touch.gti0.rc b/touch/gti/init.touch.gti0.rc
index 70c6ced..31856ea 100644
--- a/touch/gti/init.touch.gti0.rc
+++ b/touch/gti/init.touch.gti0.rc
@@ -1,4 +1,4 @@
-on property:vendor.device.modules.ready=1
+on property:sys.boot_completed=1
     # Sysfs
     chown system system /sys/devices/virtual/goog_touch_interface/gti.0/force_active
     chown system system /sys/devices/virtual/goog_touch_interface/gti.0/fw_ver
diff --git a/touch/gti/init.touch.gti1.rc b/touch/gti/init.touch.gti1.rc
index 15de6a1..a4de328 100644
--- a/touch/gti/init.touch.gti1.rc
+++ b/touch/gti/init.touch.gti1.rc
@@ -1,4 +1,4 @@
-on property:vendor.device.modules.ready=1
+on property:sys.boot_completed=1
     # Sysfs
     chown system system /sys/devices/virtual/goog_touch_interface/gti.1/force_active
     chown system system /sys/devices/virtual/goog_touch_interface/gti.1/fw_ver