diff --git a/OWNERS b/OWNERS
index b807c00..2f454e4 100644
--- a/OWNERS
+++ b/OWNERS
@@ -4,7 +4,6 @@
 wilsonsung@google.com
 lucaswei@google.com
 cyanhsieh@google.com
-rogerliao@google.com
 cyuanjen@google.com
 robinpeng@google.com
 achant@google.com
@@ -13,4 +12,8 @@
 bkhalife@google.com
 lokeshgoel@google.com
 jainne@google.com
-pscovanner@google.com
\ No newline at end of file
+pscovanner@google.com
+
+per-file *.te,*_contexts,te_macros,global_macros=set noparent
+per-file *.te,*_contexts,te_macros,global_macros=file:/sepolicy/OWNERS
+
diff --git a/aoc/dump_aoc.cpp b/aoc/dump_aoc.cpp
index 97da3b5..8d5278d 100644
--- a/aoc/dump_aoc.cpp
+++ b/aoc/dump_aoc.cpp
@@ -19,22 +19,24 @@
 // Dump Aoc.
 int main() {
     setbuf(stdout, NULL);
-    dumpFileContent("AoC Service Status", "/sys/devices/platform/19000000.aoc/services");
-    dumpFileContent("AoC Restarts", "/sys/devices/platform/19000000.aoc/restart_count");
-    dumpFileContent("AoC Coredumps", "/sys/devices/platform/19000000.aoc/coredump_count");
-    dumpFileContent("AoC ring buf wake", "/sys/devices/platform/19000000.aoc/control/ring_buffer_wakeup");
-    dumpFileContent("AoC host ipc wake", "/sys/devices/platform/19000000.aoc/control/host_ipc_wakeup");
-    dumpFileContent("AoC usf wake", "/sys/devices/platform/19000000.aoc/control/usf_wakeup");
-    dumpFileContent("AoC audio wake", "/sys/devices/platform/19000000.aoc/control/audio_wakeup");
-    dumpFileContent("AoC logging wake", "/sys/devices/platform/19000000.aoc/control/logging_wakeup");
-    dumpFileContent("AoC hotword wake", "/sys/devices/platform/19000000.aoc/control/hotword_wakeup");
-    dumpFileContent("AoC memory exception wake", "/sys/devices/platform/19000000.aoc/control/memory_exception");
-    dumpFileContent("AoC memory votes", "/sys/devices/platform/19000000.aoc/control/memory_votes_a32");
-    dumpFileContent("AoC memory votes", "/sys/devices/platform/19000000.aoc/control/memory_votes_ff1");
+    runCommand("AoC Service Status", "timeout 0.1 cat /sys/devices/platform/*.aoc/services");
+    runCommand("AoC Restarts", "timeout 0.1 cat /sys/devices/platform/*.aoc/restart_count");
+    runCommand("AoC Coredumps", "timeout 0.1 cat /sys/devices/platform/*.aoc/coredump_count");
+    runCommand("AoC ring buf wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/ring_buffer_wakeup");
+    runCommand("AoC host ipc wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/host_ipc_wakeup");
+    runCommand("AoC usf wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/usf_wakeup");
+    runCommand("AoC audio wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/audio_wakeup");
+    runCommand("AoC logging wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/logging_wakeup");
+    runCommand("AoC hotword wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/hotword_wakeup");
+    runCommand("AoC memory exception wake", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_exception");
+    runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_a32");
+    runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_ff1");
     runCommand("clean AoC buffer","echo ' ' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Heap Stats (A32)", "echo 'dbg heap -c 1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Heap Stats (F1)", "echo 'dbg heap -c 2' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Heap Stats (HF0)", "echo 'dbg heap -c 3' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Heap Stats (HF1)", "echo 'dbg heap -c 4' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
+    runCommand("AoC DVFS (FF1)", "echo 'dbg info -c 2 DVFSFF1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
+    runCommand("AoC Monitor Mode Status", "echo 'monitor_mode status' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     return 0;
 }
diff --git a/aoc/sepolicy/dump_aoc.te b/aoc/sepolicy/dump_aoc.te
index f5f085c..0731da4 100644
--- a/aoc/sepolicy/dump_aoc.te
+++ b/aoc/sepolicy/dump_aoc.te
@@ -1,5 +1,6 @@
 pixel_bugreport(dump_aoc)
 allow dump_aoc sysfs_aoc:dir search;
+allow dump_aoc sysfs:dir r_dir_perms;
 allow dump_aoc sysfs_aoc_dumpstate:file r_file_perms;
 allow dump_aoc aoc_device:chr_file rw_file_perms;
 allow dump_aoc vendor_shell_exec:file execute_no_trans;
diff --git a/aoc/sepolicy/file_contexts b/aoc/sepolicy/file_contexts
index fef8d73..c3a4754 100644
--- a/aoc/sepolicy/file_contexts
+++ b/aoc/sepolicy/file_contexts
@@ -18,6 +18,8 @@
 /dev/acd-com.google.umfw_stat       u:object_r:aoc_device:s0
 /dev/acd-com.google.usf             u:object_r:aoc_device:s0
 /dev/acd-com.google.usf.non_wake_up u:object_r:aoc_device:s0
+/dev/acd-com.google.chre             u:object_r:aoc_device:s0
+/dev/acd-com.google.chre.non_wake_up u:object_r:aoc_device:s0
 /dev/acd-logging                    u:object_r:aoc_device:s0
 /dev/aoc                            u:object_r:aoc_device:s0
 /dev/acd-audio_ap_offload_rx        u:object_r:aoc_device:s0
diff --git a/audio/aidl.mk b/audio/aidl.mk
index 172b63d..bd11249 100644
--- a/audio/aidl.mk
+++ b/audio/aidl.mk
@@ -2,7 +2,8 @@
 
 # Audio HALs
 PRODUCT_PACKAGES += \
-    android.hardware.audio.service-aidl.aoc
+    android.hardware.audio.service-aidl.aoc \
+    vendor.google.whitechapel.audio.hal.parserservice \
 
 # AIDL software effects. These are the effects supporting in all projects.
 # For the project-specific effects, such as haptic generator, please add them
diff --git a/audio/aidl/device_framework_matrix_product.xml b/audio/aidl/device_framework_matrix_product.xml
index 48b8889..10b6e4b 100644
--- a/audio/aidl/device_framework_matrix_product.xml
+++ b/audio/aidl/device_framework_matrix_product.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework" level="7">
+<compatibility-matrix version="1.0" type="framework">
     <hal format="hidl">
        <name>vendor.google.audiometricext</name>
        <version>1.0</version>
@@ -7,4 +7,12 @@
            <instance>default</instance>
        </interface>
     </hal>
+    <hal format="aidl">
+        <name>vendor.google.whitechapel.audio.extension</name>
+        <version>1</version>
+        <interface>
+            <name>IAudioExtension</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
 </compatibility-matrix>
diff --git a/audio/aidl/manifest.xml b/audio/aidl/manifest.xml
index 8d957cc..237aa4a 100644
--- a/audio/aidl/manifest.xml
+++ b/audio/aidl/manifest.xml
@@ -1,4 +1,4 @@
-<manifest version="1.0" type="device" target-level="7">
+<manifest version="1.0" type="device">
     <hal format="hidl">
        <name>vendor.google.audiometricext</name>
        <transport>hwbinder</transport>
diff --git a/audio/hidl/device_framework_matrix_product.xml b/audio/hidl/device_framework_matrix_product.xml
index 4c0a3c1..3005497 100644
--- a/audio/hidl/device_framework_matrix_product.xml
+++ b/audio/hidl/device_framework_matrix_product.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework" level="7">
+<compatibility-matrix version="1.0" type="framework">
     <hal format="hidl">
        <name>vendor.google.whitechapel.audio.audioext</name>
        <version>4.0</version>
diff --git a/audio/hidl/manifest.xml b/audio/hidl/manifest.xml
index 80eec22..a8d4979 100644
--- a/audio/hidl/manifest.xml
+++ b/audio/hidl/manifest.xml
@@ -1,4 +1,4 @@
-<manifest version="1.0" type="device" target-level="7">
+<manifest version="1.0" type="device">
    <hal format="hidl">
         <name>android.hardware.audio</name>
         <transport>hwbinder</transport>
diff --git a/audio/hidl_zuma.mk b/audio/hidl_zuma.mk
index 980d5fb..3a5c211 100644
--- a/audio/hidl_zuma.mk
+++ b/audio/hidl_zuma.mk
@@ -22,6 +22,7 @@
 	audio_fortemedia_aoc \
 	audio_bluenote_aoc \
 	audio_usb_aoc \
+	audio_cca_aoc \
 	libamcsextfile \
 	audio_amcs_ext \
 	audio.usb.default \
@@ -29,9 +30,11 @@
 	audio.bluetooth.default \
 	audio.r_submix.default \
 	audio_spk_35l41 \
+	audio_hdmi_aoc \
 	sound_trigger.primary.$(TARGET_BOARD_PLATFORM)
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio
 
 include device/google/gs-common/audio/common.mk
 
diff --git a/audio/sepolicy/aidl/file_contexts b/audio/sepolicy/aidl/file_contexts
index 9e07893..3f3390e 100644
--- a/audio/sepolicy/aidl/file_contexts
+++ b/audio/sepolicy/aidl/file_contexts
@@ -1,2 +1,3 @@
 # Audio Hal AIDL Service for Aoc
 /vendor/bin/hw/android\.hardware\.audio\.service-aidl\.aoc                  u:object_r:hal_audio_default_exec:s0
+/system_ext/bin/hw/vendor\.google\.whitechapel\.audio\.hal\.parserservice   u:object_r:hal_audio_parameter_parser_exec:s0
diff --git a/audio/sepolicy/aidl/parser_service.te b/audio/sepolicy/aidl/parser_service.te
new file mode 100644
index 0000000..bce6d49
--- /dev/null
+++ b/audio/sepolicy/aidl/parser_service.te
@@ -0,0 +1,14 @@
+# Define a parameter parser service
+type hal_audio_parameter_parser, coredomain, domain;
+type hal_audio_parameter_parser_exec, system_file_type, file_type, exec_type;
+init_daemon_domain(hal_audio_parameter_parser)
+
+# The server will serve a binder service.
+binder_service(hal_audio_parameter_parser)
+
+add_service(hal_audio_parameter_parser, hal_audio_parameter_parser_service);
+
+binder_call(audioserver, hal_audio_parameter_parser)
+binder_call(hal_audio_parameter_parser, servicemanager)
+
+allow audioserver hal_audio_parameter_parser_service:service_manager find;
diff --git a/audio/sepolicy/aidl/service.te b/audio/sepolicy/aidl/service.te
index 052558c..cbdc404 100644
--- a/audio/sepolicy/aidl/service.te
+++ b/audio/sepolicy/aidl/service.te
@@ -1,2 +1,3 @@
 # Audio
-type hal_audio_ext_service, service_manager_type;
+type hal_audio_ext_service, hal_service_type, service_manager_type;
+type hal_audio_parameter_parser_service, service_manager_type;
diff --git a/audio/sepolicy/aidl/service_contexts b/audio/sepolicy/aidl/service_contexts
index 1b5f301..c2b7716 100644
--- a/audio/sepolicy/aidl/service_contexts
+++ b/audio/sepolicy/aidl/service_contexts
@@ -1,2 +1,4 @@
 # Audio
 vendor.google.whitechapel.audio.extension.IAudioExtension/default    u:object_r:hal_audio_ext_service:s0
+android.media.audio.IHalAdapterVendorExtension/default               u:object_r:hal_audio_parameter_parser_service:s0
+
diff --git a/audio/sepolicy/common/genfs_contexts b/audio/sepolicy/common/genfs_contexts
index 1df3116..4b1c3a9 100644
--- a/audio/sepolicy/common/genfs_contexts
+++ b/audio/sepolicy/common/genfs_contexts
@@ -10,4 +10,9 @@
 genfscon sysfs /devices/platform/audiometrics/hwinfo_part_number            u:object_r:sysfs_pixelstats:s0
 genfscon sysfs /devices/platform/audiometrics/ams_rate_read_once            u:object_r:sysfs_pixelstats:s0
 genfscon sysfs /devices/platform/audiometrics/cca_rate_read_once            u:object_r:sysfs_pixelstats:s0
-
+genfscon sysfs /devices/platform/audiometrics/pdm_state                     u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/waves                         u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/adapted_info_active_count     u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/adapted_info_active_duration  u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/pcm_count                     u:object_r:sysfs_pixelstats:s0
+genfscon sysfs /devices/platform/audiometrics/pcm_latency                   u:object_r:sysfs_pixelstats:s0
diff --git a/audio/sepolicy/common/hal_audio_default.te b/audio/sepolicy/common/hal_audio_default.te
index 7465532..5cb03ac 100644
--- a/audio/sepolicy/common/hal_audio_default.te
+++ b/audio/sepolicy/common/hal_audio_default.te
@@ -13,6 +13,10 @@
 allow hal_audio_default amcs_device:chr_file rw_file_perms;
 allow hal_audio_default sysfs_pixelstats:file rw_file_perms;
 
+#allow access to aoc and kernel boottime
+allow hal_audio_default sysfs_aoc:dir { search };
+allow hal_audio_default sysfs_aoc_boottime:file r_file_perms;
+
 #allow access to DMABUF Heaps for AAudio API
 allow hal_audio_default dmabuf_heap_device:chr_file r_file_perms;
 
diff --git a/audio/sepolicy/hdmi_audio/genfs_contexts b/audio/sepolicy/hdmi_audio/genfs_contexts
new file mode 100644
index 0000000..eb7e1cf
--- /dev/null
+++ b/audio/sepolicy/hdmi_audio/genfs_contexts
@@ -0,0 +1 @@
+genfscon sysfs /devices/platform/drmdp-adma/extcon/hdmi_audio                 u:object_r:sysfs_extcon:s0
diff --git a/battery_mitigation/battery_mitigation.cpp b/battery_mitigation/battery_mitigation.cpp
index 230f297..2443226 100644
--- a/battery_mitigation/battery_mitigation.cpp
+++ b/battery_mitigation/battery_mitigation.cpp
@@ -19,6 +19,8 @@
 #include <battery_mitigation/BatteryMitigation.h>
 #include <android/binder_process.h>
 
+#define COUNT_LIMIT 10
+
 using android::hardware::google::pixel::BatteryMitigation;
 using android::hardware::google::pixel::MitigationConfig;
 
@@ -94,7 +96,7 @@
     bool isBatteryMitigationReady = false;
     std::string ready_str;
     int val = 0;
-    while (!isBatteryMitigationReady) {
+    for (int i = 0; i < COUNT_LIMIT; i++) {
         if (!android::base::ReadFileToString(kReadyFilePath, &ready_str)) {
             continue;
         }
@@ -104,9 +106,12 @@
         }
         if (val == 1) {
             isBatteryMitigationReady = true;
+            break;
         }
     }
-    android::base::SetProperty(kReadyProperty, "1");
+    if (isBatteryMitigationReady) {
+        android::base::SetProperty(kReadyProperty, "1");
+    }
     while (true) {
         pause();
     }
diff --git a/battery_mitigation/bcl.mk b/battery_mitigation/bcl.mk
index 87e0f95..9fd81f8 100644
--- a/battery_mitigation/bcl.mk
+++ b/battery_mitigation/bcl.mk
@@ -1,7 +1,11 @@
+ifeq (,$(filter factory_%,$(TARGET_PRODUCT)))
 PRODUCT_PACKAGES += battery_mitigation
+endif
 ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
+ifeq (,$(filter factory_%,$(TARGET_PRODUCT)))
 PRODUCT_PACKAGES += BrownoutDetection
 endif
+endif
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy
 PRODUCT_SOONG_NAMESPACES += device/google/gs-common/battery_mitigation
diff --git a/bcmbt/bluetooth.mk b/bcmbt/bluetooth.mk
index 6615878..eb6a29b 100644
--- a/bcmbt/bluetooth.mk
+++ b/bcmbt/bluetooth.mk
@@ -1,6 +1,8 @@
 PRODUCT_SOONG_NAMESPACES += vendor/broadcom/bluetooth
 PRODUCT_PACKAGES += \
-       android.hardware.bluetooth@1.1-service.bcmbtlinux \
+       android.hardware.bluetooth-V1-ndk.so \
+       android.hardware.bluetooth-service.bcmbtlinux \
+       vendor.google.bluetooth_ext-V1-ndk.so \
        bt_vendor.conf \
        android.hardware.bluetooth.prebuilt.xml \
        android.hardware.bluetooth_le.prebuilt.xml
diff --git a/bcmbt/compatibility_matrix.xml b/bcmbt/compatibility_matrix.xml
index ec47e35..1a63ccf 100644
--- a/bcmbt/compatibility_matrix.xml
+++ b/bcmbt/compatibility_matrix.xml
@@ -1,39 +1,28 @@
-<compatibility-matrix version="1.0" type="framework" level="7">
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ccc</name>
-        <version>1.1</version>
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>vendor.google.bluetooth_ext</name>
+        <version>1</version>
+        <interface>
+            <name>IBluetoothFinder</name>
+            <instance>default</instance>
+        </interface>
+        <fqname>IBluetoothFinder/default</fqname>
         <interface>
             <name>IBluetoothCcc</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.bt_channel_avoidance</name>
-        <version>1.0</version>
         <interface>
             <name>IBTChannelAvoidance</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.sar</name>
-        <version>1.1</version>
         <interface>
             <name>IBluetoothSar</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>hardware.google.bluetooth.ext</name>
-        <version>1.0</version>
         <interface>
             <name>IBluetoothExt</name>
             <instance>default</instance>
         </interface>
-    </hal>
-    <hal format="hidl" optional="true">
-        <name>hardware.google.bluetooth.ewp</name>
-        <version>1.0</version>
         <interface>
             <name>IBluetoothEwp</name>
             <instance>default</instance>
diff --git a/bcmbt/dump/Android.bp b/bcmbt/dump/Android.bp
new file mode 100644
index 0000000..c22d559
--- /dev/null
+++ b/bcmbt/dump/Android.bp
@@ -0,0 +1,20 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "dump_bcmbt",
+    srcs: ["dump_bcmbt.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+	"libdump",
+	"liblog",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
diff --git a/bcmbt/dump/dump_bcmbt.cpp b/bcmbt/dump/dump_bcmbt.cpp
new file mode 100644
index 0000000..91dd7fa
--- /dev/null
+++ b/bcmbt/dump/dump_bcmbt.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <dump/pixel_dump.h>
+//#include <android-base/properties.h>
+#include <android-base/file.h>
+
+#define BCMBT_SNOOP_LOG_DIRECTORY "/data/vendor/bluetooth"
+#define BCMBT_FW_LOG_DIRECTORY "/data/vendor/ssrdump/coredump"
+#define BCMBT_SNOOP_LOG_PREFIX "btsnoop_hci_vnd"
+#define BCMBT_FW_DUMP_LOG_PREFIX "coredump_bt_socdump_"
+#define BCMBT_CHRE_DUMP_LOG_PREFIX "coredump_bt_chredump_"
+
+int main() {
+    std::string outputDir = concatenatePath(BUGREPORT_PACKING_DIR, "bcmbt");
+    if (mkdir(outputDir.c_str(), 0777) == -1) {
+        printf("Unable to create folder: %s\n", outputDir.c_str());
+        return 0;
+    }
+
+    dumpLogs(BCMBT_SNOOP_LOG_DIRECTORY, outputDir.c_str(), 2, BCMBT_SNOOP_LOG_PREFIX);
+    dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_FW_DUMP_LOG_PREFIX);
+    dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_CHRE_DUMP_LOG_PREFIX);
+    return 0;
+}
diff --git a/bcmbt/dump/dumplog.mk b/bcmbt/dump/dumplog.mk
new file mode 100644
index 0000000..8dc1765
--- /dev/null
+++ b/bcmbt/dump/dumplog.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/bcmbt/dump/sepolicy/
+
+PRODUCT_PACKAGES_DEBUG += dump_bcmbt
diff --git a/bcmbt/dump/sepolicy/dump_bcmbt.te b/bcmbt/dump/sepolicy/dump_bcmbt.te
new file mode 100644
index 0000000..8fa76b8
--- /dev/null
+++ b/bcmbt/dump/sepolicy/dump_bcmbt.te
@@ -0,0 +1,11 @@
+pixel_bugreport(dump_bcmbt)
+
+userdebug_or_eng(`
+  allow dump_bcmbt radio_vendor_data_file:dir create_dir_perms;
+  allow dump_bcmbt radio_vendor_data_file:file create_file_perms;
+  allow dump_bcmbt vendor_bt_data_file:dir r_dir_perms;
+  allow dump_bcmbt vendor_bt_data_file:file r_file_perms;
+  allow dump_bcmbt sscoredump_vendor_data_coredump_file:dir r_dir_perms;
+  allow dump_bcmbt sscoredump_vendor_data_coredump_file:file r_file_perms;
+  allow dump_bcmbt sscoredump_vendor_data_crashinfo_file:dir search;
+')
diff --git a/bcmbt/dump/sepolicy/file_contexts b/bcmbt/dump/sepolicy/file_contexts
new file mode 100644
index 0000000..e3f0df6
--- /dev/null
+++ b/bcmbt/dump/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/dump/dump_bcmbt           u:object_r:dump_bcmbt_exec:s0
diff --git a/bcmbt/manifest_bluetooth.xml b/bcmbt/manifest_bluetooth.xml
index 64238c7..f14112c 100644
--- a/bcmbt/manifest_bluetooth.xml
+++ b/bcmbt/manifest_bluetooth.xml
@@ -1,56 +1,17 @@
 <manifest version="1.0" type="device">
-    <hal format="hidl">
+    <hal format="aidl">
         <name>android.hardware.bluetooth</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IBluetoothHci</name>
-            <instance>default</instance>
-        </interface>
+        <version>1</version>
+        <fqname>IBluetoothHci/default</fqname>
     </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.bt_channel_avoidance</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBTChannelAvoidance</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.sar</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IBluetoothSar</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ext</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothExt</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ccc</name>
-        <transport>hwbinder</transport>
-        <version>1.1</version>
-        <interface>
-            <name>IBluetoothCcc</name>
-            <instance>default</instance>
-        </interface>
-    </hal>
-    <hal format="hidl">
-        <name>hardware.google.bluetooth.ewp</name>
-        <transport>hwbinder</transport>
-        <version>1.0</version>
-        <interface>
-            <name>IBluetoothEwp</name>
-            <instance>default</instance>
-        </interface>
+    <hal format="aidl">
+        <name>vendor.google.bluetooth_ext</name>
+        <version>1</version>
+        <fqname>IBTChannelAvoidance/default</fqname>
+        <fqname>IBluetoothCcc/default</fqname>
+        <fqname>IBluetoothEwp/default</fqname>
+        <fqname>IBluetoothExt/default</fqname>
+        <fqname>IBluetoothFinder/default</fqname>
+        <fqname>IBluetoothSar/default</fqname>
     </hal>
 </manifest>
diff --git a/bcmbt/sepolicy/file_contexts b/bcmbt/sepolicy/file_contexts
index d4681db..e7aac6a 100644
--- a/bcmbt/sepolicy/file_contexts
+++ b/bcmbt/sepolicy/file_contexts
@@ -1,5 +1,5 @@
 # Bluetooth
-/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.1-service\.bcmbtlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth-service\.bcmbtlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
 
 /dev/wbrc                           u:object_r:wb_coexistence_dev:s0
 /dev/ttySAC16                       u:object_r:hci_attach_dev:s0
diff --git a/bcmbt/sepolicy/hal_bluetooth_btlinux.te b/bcmbt/sepolicy/hal_bluetooth_btlinux.te
index f348099..263f689 100644
--- a/bcmbt/sepolicy/hal_bluetooth_btlinux.te
+++ b/bcmbt/sepolicy/hal_bluetooth_btlinux.te
@@ -1,4 +1,5 @@
 add_hwservice(hal_bluetooth_btlinux, hal_bluetooth_coexistence_hwservice);
+add_service(hal_bluetooth_btlinux, hal_bluetooth_coexistence_service);
 get_prop(hal_bluetooth_btlinux, boot_status_prop)
 
 allow hal_bluetooth_btlinux sysfs_bluetooth_writable:file rw_file_perms;
diff --git a/bcmbt/sepolicy/service.te b/bcmbt/sepolicy/service.te
new file mode 100644
index 0000000..b8403da
--- /dev/null
+++ b/bcmbt/sepolicy/service.te
@@ -0,0 +1,2 @@
+# Bluetooth HAL extension
+type hal_bluetooth_coexistence_service, hal_service_type, service_manager_type;
diff --git a/bcmbt/sepolicy/service_contexts b/bcmbt/sepolicy/service_contexts
new file mode 100644
index 0000000..4aecc90
--- /dev/null
+++ b/bcmbt/sepolicy/service_contexts
@@ -0,0 +1,7 @@
+# Bluetooth HAL extension
+vendor.google.bluetooth_ext.IBTChannelAvoidance/default                      u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothSar/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothCcc/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothEwp/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothExt/default                            u:object_r:hal_bluetooth_coexistence_service:s0
+vendor.google.bluetooth_ext.IBluetoothFinder/default                         u:object_r:hal_bluetooth_coexistence_service:s0
diff --git a/camera/Android.bp b/camera/Android.bp
index 9d647c9..d615e6a 100644
--- a/camera/Android.bp
+++ b/camera/Android.bp
@@ -18,3 +18,11 @@
     vendor: true,
     relative_install_path: "dump",
 }
+
+prebuilt_etc {
+    name: "lyric_preview_dis_xml",
+    vendor: true,
+    filename: "vendor.android.hardware.camera.preview-dis.xml",
+    src: "vendor.android.hardware.camera.preview-dis.xml",
+    sub_dir: "permissions",
+}
diff --git a/camera/OWNERS b/camera/OWNERS
new file mode 100644
index 0000000..d5ac048
--- /dev/null
+++ b/camera/OWNERS
@@ -0,0 +1,2 @@
+krzysio@google.com
+yromanenko@google.com
diff --git a/camera/compatibility_matrix.xml b/camera/compatibility_matrix.xml
new file mode 100644
index 0000000..cd4b76e
--- /dev/null
+++ b/camera/compatibility_matrix.xml
@@ -0,0 +1,13 @@
+<compatibility-matrix version="1.0" type="device">
+    <hal format="aidl" optional="true">
+        <name>com.google.pixel.camera.services.binder</name>
+        <version>1</version>
+        <interface>
+            <name>IServiceBinder</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <vndk>
+        <version>0.0.0</version>
+    </vndk>
+</compatibility-matrix>
diff --git a/camera/device_framework_matrix_product.xml b/camera/device_framework_matrix_product.xml
new file mode 100644
index 0000000..171dfa8
--- /dev/null
+++ b/camera/device_framework_matrix_product.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>com.google.pixel.camera.connectivity.hal.provider</name>
+        <version>1</version>
+        <interface>
+            <name>ICameraProvider</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/camera/lyric.mk b/camera/lyric.mk
new file mode 100644
index 0000000..b9583ea
--- /dev/null
+++ b/camera/lyric.mk
@@ -0,0 +1,60 @@
+PRODUCT_SOONG_NAMESPACES += \
+    hardware/google/camera
+
+$(call soong_config_set,lyric,use_lyric_camera_hal,true)
+$(call soong_config_set,google3a_config,gcam_awb,true)
+$(call soong_config_set,google3a_config,ghawb_truetone,true)
+
+# Select GCH backend.
+# TODO(b/192681010): This dependency inversion should be removed.
+ifneq ($(wildcard vendor/google/services/LyricCameraHAL/src),)
+$(call soong_config_set,gch,hwl_library,lyric)
+endif
+
+# Check if we're in PDK build
+ifeq ($(wildcard vendor/google/camera),)
+# If vendor/google/camera doesn't exist, it's a PDK build.
+$(call soong_config_set,lyric,pdk_build,true)
+else
+# Otherwise, it's an internal Google build.
+$(call soong_config_set,lyric,pdk_build,false)
+
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/google/camera \
+    vendor/google/camera/google_3a/libs_v4 \
+    vendor/google/camera/rlsservice
+
+# TODO(b/257379485): 3A is incrementally enabling cuttlefish build for native
+# code coverage support, temporary require separate namespace for folders that
+# can be built successfully.
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/google/camera/common/g3_shared \
+    vendor/google/camera/google_3a/libs_v4/g3ABase \
+    vendor/google/camera/google_3a/libs_v4/gABC/native_coverage \
+    vendor/google/camera/google_3a/libs_v4/gAF \
+    vendor/google/camera/google_3a/libs_v4/gafd \
+    vendor/google/camera/google_3a/libs_v4/gHAWB/native_coverage
+
+# Calibration tool for debug builds
+PRODUCT_PACKAGES_DEBUG += tarasque_test
+
+endif  # vendor/google/camera check
+
+# Init-time log settings for Google 3A
+PRODUCT_PACKAGES += libg3a_standalone_gabc_rc
+PRODUCT_PACKAGES += libg3a_standalone_gaf_rc
+PRODUCT_PACKAGES += libg3a_standalone_ghawb_rc
+
+# Vendor APEX which contains the camera HAL
+PRODUCT_PACKAGES += com.google.pixel.camera.hal
+PRODUCT_PACKAGES += init.camera.set-interrupts-ownership
+PRODUCT_PACKAGES += lyric_preview_dis_xml
+
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += \
+    device/google/gs-common/camera/device_framework_matrix_product.xml
+
+DEVICE_MATRIX_FILE += \
+    device/google/gs-common/camera/compatibility_matrix.xml
+
+# sepolicy dir is added in dump.mk.
+# Make doesn't deduplicate sepolicy dirs, so including it here causes build errors.
diff --git a/camera/lyric_soong_variables.md b/camera/lyric_soong_variables.md
new file mode 100644
index 0000000..b442943
--- /dev/null
+++ b/camera/lyric_soong_variables.md
@@ -0,0 +1,46 @@
+# Lyric Soong variables
+
+## `kernel_version`
+
+Example:
+```
+$(call soong_config_set,lyric,kernel_version,v515)
+```
+Linux kernel version on the device. Determines the version of the LWIS userspace
+API to use in Lyric.
+
+## `soc`
+
+Example:
+```
+$(call soong_config_set,lyric,soc,gs101)
+```
+The codename for the chip used in the device. Currently only Google silicon
+is supported.
+
+## `camera_hardware`
+
+Example:
+```
+$(call soong_config_set,lyric,camera_hardware,oriole)
+```
+Specifies the set of sensors and peripherals present on the device. Determines
+the DeviceContext class that will be used.
+
+## `tuning_product`
+
+Example:
+```
+$(call soong_config_set,lyric,tuning_product,oriole)
+```
+Specifies the set of tuning data to use. This may be different than
+`camera_hardware` because not all devices have their own tuning data;
+development-only devices only have the default tuning for their SoC.
+
+## `target_device`
+
+Example:
+```
+$(call soong_config_set,google3a_config,target_device,oriole)
+```
+A mixture of `camera_hardware` and `tuning_product` used by 3A.
diff --git a/camera/sepolicy/file_contexts b/camera/sepolicy/file_contexts
index 4bb5308..bc21b02 100644
--- a/camera/sepolicy/file_contexts
+++ b/camera/sepolicy/file_contexts
@@ -1,5 +1,5 @@
 /vendor/bin/dump/dump_camera           u:object_r:dump_camera_exec:s0
+/vendor/bin/init\.camera\.set-interrupts-ownership u:object_r:init-camera-set-interrupts-ownership_exec:s0
 
 # Data
 /data/vendor/camera(/.*)?              u:object_r:vendor_camera_data_file:s0
-
diff --git a/camera/sepolicy/hal_camera_default.te b/camera/sepolicy/hal_camera_default.te
new file mode 100644
index 0000000..62eef4a
--- /dev/null
+++ b/camera/sepolicy/hal_camera_default.te
@@ -0,0 +1,9 @@
+allow hal_camera_default vendor_camera_binder_service:service_manager find;
+# Allow Lyric Hal to find the LyricConfigProvider service through ServiceManager.
+allow hal_camera_default vendor_camera_lyricconfigprovider_service:service_manager find;
+
+allow hal_camera_default hal_pixel_remote_camera_service:service_manager find;
+
+binder_call(hal_camera_default, vendor_pbcs_app);
+
+binder_call(hal_camera_default, vendor_pcs_app);
diff --git a/camera/sepolicy/init.camera.set-interrupts-ownership.te b/camera/sepolicy/init.camera.set-interrupts-ownership.te
new file mode 100644
index 0000000..781e68d
--- /dev/null
+++ b/camera/sepolicy/init.camera.set-interrupts-ownership.te
@@ -0,0 +1,10 @@
+type init-camera-set-interrupts-ownership, domain;
+type init-camera-set-interrupts-ownership_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(init-camera-set-interrupts-ownership)
+
+allow init-camera-set-interrupts-ownership vendor_toolbox_exec:file rx_file_perms;
+allow init-camera-set-interrupts-ownership proc_interrupts:file r_file_perms;
+allow init-camera-set-interrupts-ownership proc_irq:dir r_dir_perms;
+allow init-camera-set-interrupts-ownership proc_irq:file { r_file_perms setattr };
+allow init-camera-set-interrupts-ownership self:capability { chown setuid setgid };
diff --git a/camera/sepolicy/property.te b/camera/sepolicy/property.te
index 19d6a2f..1f899b6 100644
--- a/camera/sepolicy/property.te
+++ b/camera/sepolicy/property.te
@@ -1,2 +1,3 @@
 vendor_internal_prop(vendor_camera_debug_prop)
+system_vendor_config_prop(vendor_camera_pbcs_debug_prop)
 
diff --git a/camera/sepolicy/property_contexts b/camera/sepolicy/property_contexts
index 5e2c815..0093487 100644
--- a/camera/sepolicy/property_contexts
+++ b/camera/sepolicy/property_contexts
@@ -1,2 +1,4 @@
 vendor.camera.debug.       u:object_r:vendor_camera_debug_prop:s0
+persist.vendor.camera.pbcs.debug.       u:object_r:vendor_camera_pbcs_debug_prop:s0
+vendor.camera.pbcs.debug.       u:object_r:vendor_camera_pbcs_debug_prop:s0
 
diff --git a/camera/sepolicy/seapp_contexts b/camera/sepolicy/seapp_contexts
new file mode 100644
index 0000000..f956929
--- /dev/null
+++ b/camera/sepolicy/seapp_contexts
@@ -0,0 +1,7 @@
+# Pixel PeristentBackgroundCameraServices
+user=system seinfo=platform name=com.google.pixel.camera.services domain=vendor_pbcs_app type=system_app_data_file levelFrom=all
+# The :* will allow all services, which run in their own processes, to use the same vendor_pbcs_app domain.
+user=system seinfo=platform name=com.google.pixel.camera.services:* domain=vendor_pbcs_app type=system_app_data_file levelFrom=all
+
+# Pixel Camera Services
+user=_app seinfo=CameraServices name=com.google.android.apps.camera.services domain=vendor_pcs_app type=app_data_file levelFrom=all
diff --git a/camera/sepolicy/service.te b/camera/sepolicy/service.te
new file mode 100644
index 0000000..330c7ff
--- /dev/null
+++ b/camera/sepolicy/service.te
@@ -0,0 +1,5 @@
+type vendor_camera_binder_service, hal_service_type, protected_service, service_manager_type;
+
+type hal_pixel_remote_camera_service, hal_service_type, protected_service, service_manager_type;
+
+type vendor_camera_lyricconfigprovider_service, hal_service_type, protected_service, service_manager_type;
diff --git a/camera/sepolicy/service_contexts b/camera/sepolicy/service_contexts
new file mode 100644
index 0000000..bec3402
--- /dev/null
+++ b/camera/sepolicy/service_contexts
@@ -0,0 +1,5 @@
+com.google.pixel.camera.services.binder.IServiceBinder/default u:object_r:vendor_camera_binder_service:s0
+
+com.google.pixel.camera.connectivity.hal.provider.ICameraProvider/default u:object_r:hal_pixel_remote_camera_service:s0
+
+com.google.pixel.camera.services.lyricconfigprovider.ILyricConfigProvider/default u:object_r:vendor_camera_lyricconfigprovider_service:s0
diff --git a/camera/sepolicy/vendor_pbcs_app.te b/camera/sepolicy/vendor_pbcs_app.te
new file mode 100644
index 0000000..8c55d0e
--- /dev/null
+++ b/camera/sepolicy/vendor_pbcs_app.te
@@ -0,0 +1,20 @@
+type vendor_pbcs_app, domain, coredomain;
+
+app_domain(vendor_pbcs_app);
+
+dontaudit vendor_pbcs_app system_app_data_file:dir *;
+
+allow vendor_pbcs_app app_api_service:service_manager find;
+# Allow PBCS to find Camera Service.
+allow vendor_pbcs_app cameraserver_service:service_manager find;
+
+# Allow PBCS to add the ServiceBinder service to ServiceManager.
+add_service(vendor_pbcs_app, vendor_camera_binder_service);
+# Allow PBCS to add the LyricConfigProvider service to ServiceManager.
+add_service(vendor_pbcs_app, vendor_camera_lyricconfigprovider_service);
+
+binder_call(vendor_pbcs_app, hal_camera_default);
+
+# Allow PBCS to read debug system properties of the form vendor.camera.pbcs.debug.*
+# and persist.vendor.camera.pbcs.debug.*
+get_prop(vendor_pbcs_app, vendor_camera_pbcs_debug_prop);
diff --git a/camera/sepolicy/vendor_pcs_app.te b/camera/sepolicy/vendor_pcs_app.te
new file mode 100644
index 0000000..ad15405
--- /dev/null
+++ b/camera/sepolicy/vendor_pcs_app.te
@@ -0,0 +1,14 @@
+type vendor_pcs_app, domain, coredomain;
+
+app_domain(vendor_pcs_app);
+
+allow vendor_pcs_app app_api_service:service_manager find;
+
+allow vendor_pcs_app cameraserver_service:service_manager find;
+
+# Allow PCS to find the LyricConfigProvider service through ServiceManager.
+allow vendor_pcs_app vendor_camera_lyricconfigprovider_service:service_manager find;
+
+allow vendor_pcs_app hal_pixel_remote_camera_service:service_manager add;
+
+binder_call(vendor_pcs_app, hal_pixel_remote_camera_service);
diff --git a/camera/vendor.android.hardware.camera.preview-dis.xml b/camera/vendor.android.hardware.camera.preview-dis.xml
new file mode 100644
index 0000000..ae54eef
--- /dev/null
+++ b/camera/vendor.android.hardware.camera.preview-dis.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!-- This is to advertise that the camera device supports preview digital image stabilization
+     in both front and back cameras-->
+<permissions>
+    <feature name="vendor.android.hardware.camera.preview-dis.front" />
+    <feature name="vendor.android.hardware.camera.preview-dis.back" />
+</permissions>
diff --git a/dauntless/sepolicy/citadeld.te b/dauntless/sepolicy/citadeld.te
index 86cb61c..60c633c 100644
--- a/dauntless/sepolicy/citadeld.te
+++ b/dauntless/sepolicy/citadeld.te
@@ -11,3 +11,5 @@
 allow citadeld citadel_device:chr_file rw_file_perms;
 allow citadeld fwk_stats_service:service_manager find;
 allow citadeld hal_power_stats_vendor_service:service_manager find;
+
+set_prop(citadeld, vendor_nos_citadel_version);
diff --git a/dauntless/sepolicy/property.te b/dauntless/sepolicy/property.te
new file mode 100644
index 0000000..2e1c4ec
--- /dev/null
+++ b/dauntless/sepolicy/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_nos_citadel_version)
diff --git a/dauntless/sepolicy/property_contexts b/dauntless/sepolicy/property_contexts
new file mode 100644
index 0000000..835de17
--- /dev/null
+++ b/dauntless/sepolicy/property_contexts
@@ -0,0 +1 @@
+vendor.nos.citadel.version     u:object_r:vendor_nos_citadel_version:s0
diff --git a/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te b/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te
index 7d50bfc..f867528 100644
--- a/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te
+++ b/edgetpu/sepolicy/hal_neuralnetworks_darwinn.te
@@ -7,7 +7,7 @@
 # The TPU HAL looks for TPU instance in /dev/abrolhos
 allow hal_neuralnetworks_darwinn edgetpu_device:chr_file rw_file_perms;
 
-# Allow DawriNN service to use a client-provided fd residing in /vendor/etc/.
+# Allow DarwiNN service to use a client-provided fd residing in /vendor/etc/.
 allow hal_neuralnetworks_darwinn vendor_configs_file:file r_file_perms;
 
 # Allow DarwiNN service to access data files.
diff --git a/gear/dumpstate/Dumpstate.cpp b/gear/dumpstate/Dumpstate.cpp
index 9fe7c1a..31df2c7 100644
--- a/gear/dumpstate/Dumpstate.cpp
+++ b/gear/dumpstate/Dumpstate.cpp
@@ -74,21 +74,21 @@
 void Dumpstate::dumpTextSection(int fd, const std::string &sectionName) {
     bool dumpAll = (sectionName == kAllSections);
     std::string dumpFiles;
-
-    // Execute all or designated programs under vendor/bin/dump/
-    std::unique_ptr<DIR, decltype(&closedir)> dir(opendir("/vendor/bin/dump"), closedir);
-    if (!dir) {
-        ALOGE("Fail To Open Dir vendor/bin/dump/");
-        ::android::base::WriteStringToFd("Fail To Open Dir vendor/bin/dump/\n", fd);
+    struct dirent **dirent_list = NULL;
+    int num_entries = scandir("/vendor/bin/dump", &dirent_list, 0, (int (*)(const struct dirent **, const struct dirent **)) alphasort);
+    if (!dirent_list) {
+        ALOGE("Unable to scan dir: /vendor/bin/dump\n");
+        return;
+    } else if (num_entries <= 0) {
+        ALOGE("No file is found.\n");
         return;
     }
-    dirent *entry;
-    while ((entry = readdir(dir.get())) != nullptr) {
-        // Skip '.', '..'
-        if (entry->d_name[0] == '.') {
+    // Execute all or designated programs under vendor/bin/dump/
+    for (int i = 0; i <  num_entries; i++) {
+        if (dirent_list[i]->d_name[0] == '.') {
             continue;
         }
-        std::string bin(entry->d_name);
+        std::string bin(dirent_list[i]->d_name);
         dumpFiles = dumpFiles + " " + bin;
         if (dumpAll || sectionName == bin) {
             auto startTime = startSection(fd, bin);
@@ -111,6 +111,10 @@
     ::android::base::WriteStringToFd(dumpFiles, fd);
     ::android::base::WriteStringToFd("\nNote: sections with attachments (e.g. dump_soc) are"
                                    "not available from the command line.\n", fd);
+    while (num_entries--) {
+        free(dirent_list[num_entries]);
+    }
+    free(dirent_list);
 }
 
 void Dumpstate::dumpLogSection(int fd, int fd_bin)
diff --git a/gps/dump/dump_gps.cpp b/gps/dump/dump_gps.cpp
index d569f9b..62f69f8 100644
--- a/gps/dump/dump_gps.cpp
+++ b/gps/dump/dump_gps.cpp
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#include <unistd.h>
 #include <dump/pixel_dump.h>
 #include <android-base/properties.h>
 #include <android-base/file.h>
@@ -24,6 +25,9 @@
 #define GPS_MCU_LOG_PREFIX "esw-"
 #define GPS_MALLOC_LOG_DIRECTORY "/data/vendor/gps"
 #define GPS_MALLOC_LOG_PREFIX "malloc_"
+#define GPS_VENDOR_CHIP_INFO "/data/vendor/gps/chip.info"
+#define GPS_RAWLOG_PREFIX "rawbin"
+#define GPS_MEMDUMP_LOG_PREFIX "memdump_"
 
 int main() {
     if(!::android::base::GetBoolProperty("vendor.gps.aol.enabled", false)) {
@@ -41,6 +45,11 @@
     dumpLogs(GPS_LOG_DIRECTORY, outputDir.c_str(), 3, GPS_MCU_LOG_PREFIX);
     dumpLogs(GPS_LOG_DIRECTORY, outputDir.c_str(), maxFileNum, GPS_LOG_PREFIX);
     dumpLogs(GPS_MALLOC_LOG_DIRECTORY, outputDir.c_str(), 1, GPS_MALLOC_LOG_PREFIX);
+    if (access(GPS_VENDOR_CHIP_INFO, F_OK) == 0) {
+        copyFile(GPS_VENDOR_CHIP_INFO, concatenatePath(outputDir.c_str(), "chip.info").c_str());
+    }
+    dumpLogs(GPS_LOG_DIRECTORY, outputDir.c_str(), maxFileNum, GPS_RAWLOG_PREFIX);
+    dumpLogs(GPS_LOG_DIRECTORY, outputDir.c_str(), 18, GPS_MEMDUMP_LOG_PREFIX);
     return 0;
 }
 
diff --git a/gpu/gpu.mk b/gpu/gpu.mk
new file mode 100644
index 0000000..67d1263
--- /dev/null
+++ b/gpu/gpu.mk
@@ -0,0 +1,4 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gpu/sepolicy
+
+PRODUCT_PACKAGES += gpu_probe
+PRODUCT_PACKAGES += android.hardware.neuralnetworks-shim-service-armnn
diff --git a/gpu/sepolicy/file_contexts b/gpu/sepolicy/file_contexts
new file mode 100644
index 0000000..7cadf04
--- /dev/null
+++ b/gpu/sepolicy/file_contexts
@@ -0,0 +1,3 @@
+/vendor/bin/gpu_probe                                                     u:object_r:gpu_probe_exec:s0
+
+/vendor/bin/hw/android\.hardware\.neuralnetworks-shim-service-armnn       u:object_r:hal_neuralnetworks_armnn_exec:s0
diff --git a/gpu/sepolicy/gpu_probe.te b/gpu/sepolicy/gpu_probe.te
new file mode 100644
index 0000000..d8ffb78
--- /dev/null
+++ b/gpu/sepolicy/gpu_probe.te
@@ -0,0 +1,8 @@
+# gpu_probe
+type gpu_probe_exec, exec_type, vendor_file_type, file_type;
+type gpu_probe, domain;
+
+init_daemon_domain(gpu_probe)
+allow gpu_probe gpu_device:chr_file rw_file_perms;
+
+perfetto_producer(gpu_probe)
diff --git a/gpu/sepolicy/hal_neuralnetworks_armnn.te b/gpu/sepolicy/hal_neuralnetworks_armnn.te
new file mode 100644
index 0000000..62c3257
--- /dev/null
+++ b/gpu/sepolicy/hal_neuralnetworks_armnn.te
@@ -0,0 +1,17 @@
+type hal_neuralnetworks_armnn, domain;
+hal_server_domain(hal_neuralnetworks_armnn, hal_neuralnetworks)
+
+type hal_neuralnetworks_armnn_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_neuralnetworks_armnn)
+
+add_service(hal_neuralnetworks_armnn, armnn_nnapi_service);
+
+allow hal_neuralnetworks_armnn armnn_app_service:service_manager find;
+
+get_prop(hal_neuralnetworks_armnn, hwservicemanager_prop)
+
+allow isolated_app app_data_file:file setattr;
+
+allow hal_neuralnetworks_armnn fwk_stats_service:service_manager find;
+binder_call(hal_neuralnetworks_armnn, system_server);
+binder_use(hal_neuralnetworks_armnn)
diff --git a/gpu/sepolicy/priv_app.te b/gpu/sepolicy/priv_app.te
new file mode 100644
index 0000000..97eec7c
--- /dev/null
+++ b/gpu/sepolicy/priv_app.te
@@ -0,0 +1,2 @@
+allow priv_app armnn_app_service:service_manager find;
+allow priv_app armnn_nnapi_service:service_manager find;
diff --git a/gpu/sepolicy/service.te b/gpu/sepolicy/service.te
new file mode 100644
index 0000000..bf5f3ce
--- /dev/null
+++ b/gpu/sepolicy/service.te
@@ -0,0 +1,4 @@
+type armnn_nnapi_service, app_api_service, service_manager_type, isolated_compute_allowed_service;
+type armnn_vendor_service, service_manager_type, hal_service_type;
+type armnn_dba_service, app_api_service, service_manager_type, isolated_compute_allowed_service;
+type armnn_app_service, service_manager_type;
diff --git a/gpu/sepolicy/service_contexts b/gpu/sepolicy/service_contexts
new file mode 100644
index 0000000..a881130
--- /dev/null
+++ b/gpu/sepolicy/service_contexts
@@ -0,0 +1,3 @@
+com.google.armnn.IArmnnVendorService/default             u:object_r:armnn_vendor_service:s0
+android.hardware.neuralnetworks.IDevice/google-armnn     u:object_r:armnn_nnapi_service:s0
+com.google.armnn.IArmnnpAppService/default               u:object_r:armnn_app_service:s0
diff --git a/gxp/dump.mk b/gxp/dump.mk
deleted file mode 100644
index c1f6300..0000000
--- a/gxp/dump.mk
+++ /dev/null
@@ -1,4 +0,0 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gxp/sepolicy/
-
-PRODUCT_PACKAGES_DEBUG += dump_gxp
-
diff --git a/gxp/dump_gxp.cpp b/gxp/dump_gxp.cpp
index 5a0bb3b..518a44a 100644
--- a/gxp/dump_gxp.cpp
+++ b/gxp/dump_gxp.cpp
@@ -21,17 +21,17 @@
 
 int main() {
     /* TODO(b/277094681): Set default value to false around device beta milestone. */
-    if(::android::base::GetBoolProperty("vendor.gxp.attach_to_bugreport", true)) {
-        std::string outputDir = concatenatePath(BUGREPORT_PACKING_DIR, "gxp_ssrdump");
-        printf("Creating %s", outputDir.c_str());
-        if (mkdir(outputDir.c_str(), 0777) == -1) {
-            printf("Unable to create folder: %s\n", outputDir.c_str());
-            return 0;
-        }
-
-        dumpLogs("/data/vendor/ssrdump/coredump", outputDir.c_str(), maxGxpDebugDumps, "coredump_gxp_");
-        dumpLogs("/data/vendor/ssrdump", outputDir.c_str(), maxGxpDebugDumps, "crashinfo_gxp_");
+    /* TODO(b/288368306): Create an android property for enabling/disabling
+     * bugreport collection for gxp */
+    std::string outputDir = concatenatePath(BUGREPORT_PACKING_DIR, "gxp_ssrdump");
+    printf("Creating %s", outputDir.c_str());
+    if (mkdir(outputDir.c_str(), 0777) == -1) {
+        printf("Unable to create folder: %s\n", outputDir.c_str());
+        return 0;
     }
+
+    dumpLogs("/data/vendor/ssrdump/coredump", outputDir.c_str(), maxGxpDebugDumps, "coredump_gxp_");
+    dumpLogs("/data/vendor/ssrdump", outputDir.c_str(), maxGxpDebugDumps, "crashinfo_gxp_");
     return 0;
 }
 
diff --git a/gxp/gxp.mk b/gxp/gxp.mk
new file mode 100644
index 0000000..45b0f08
--- /dev/null
+++ b/gxp/gxp.mk
@@ -0,0 +1,13 @@
+# GXP logging service
+PRODUCT_PACKAGES += \
+	android.hardware.gxp.logging@service-gxp-logging
+# GXP metrics logger library
+PRODUCT_PACKAGES += \
+	gxp_metrics_logger
+# GXP C-API library
+PRODUCT_PACKAGES += libgxp
+# GXP Debug dump.
+PRODUCT_PACKAGES_DEBUG += dump_gxp
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gxp/sepolicy
+
diff --git a/gxp/sepolicy/device.te b/gxp/sepolicy/device.te
new file mode 100644
index 0000000..382bc9d
--- /dev/null
+++ b/gxp/sepolicy/device.te
@@ -0,0 +1,2 @@
+# GXP device
+type gxp_device, dev_type, mlstrustedobject;
diff --git a/gxp/sepolicy/dump_gxp.te b/gxp/sepolicy/dump_gxp.te
index 61a0482..8d285c5 100644
--- a/gxp/sepolicy/dump_gxp.te
+++ b/gxp/sepolicy/dump_gxp.te
@@ -7,5 +7,7 @@
   allow dump_gxp sscoredump_vendor_data_coredump_file:file r_file_perms;
   allow dump_gxp sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
   allow dump_gxp sscoredump_vendor_data_crashinfo_file:file r_file_perms;
+  # Allow dump_gxp to access gxp properties.
+  get_prop(google_camera_app, vendor_gxp_prop)
 ')
 
diff --git a/gxp/sepolicy/file.te b/gxp/sepolicy/file.te
new file mode 100644
index 0000000..278cdd9
--- /dev/null
+++ b/gxp/sepolicy/file.te
@@ -0,0 +1,2 @@
+# Gxp sysfs file
+type sysfs_gxp, sysfs_type, fs_type;
diff --git a/gxp/sepolicy/file_contexts b/gxp/sepolicy/file_contexts
index 80420f4..08bef12 100644
--- a/gxp/sepolicy/file_contexts
+++ b/gxp/sepolicy/file_contexts
@@ -1,2 +1,12 @@
-/vendor/bin/dump/dump_gxp           u:object_r:dump_gxp_exec:s0
+# GXP Vendor library
+/vendor/lib(64)?/libgxp\.so                                                 u:object_r:same_process_hal_file:s0
+
+# GXP logging service
+/vendor/bin/hw/android\.hardware\.gxp\.logging@service-gxp-logging          u:object_r:gxp_logging_exec:s0
+
+# GXP Metrics Collection Library
+/vendor/lib(64)?/gxp_metrics_logger\.so                                     u:object_r:same_process_hal_file:s0
+
+# Allow collection of debug dump.
+/vendor/bin/dump/dump_gxp                                                   u:object_r:dump_gxp_exec:s0
 
diff --git a/gxp/sepolicy/gxp_logging.te b/gxp/sepolicy/gxp_logging.te
new file mode 100644
index 0000000..fd1af7f
--- /dev/null
+++ b/gxp/sepolicy/gxp_logging.te
@@ -0,0 +1,21 @@
+type gxp_logging, domain;
+type gxp_logging_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(gxp_logging)
+
+# The logging service accesses /dev/gxp
+allow gxp_logging gxp_device:chr_file rw_file_perms;
+
+# Allow logging service to access /sys/class/gxp
+allow gxp_logging sysfs_gxp:dir search;
+allow gxp_logging sysfs_gxp:file rw_file_perms;
+
+# Allow logging service to log to stats service for reporting metrics.
+allow gxp_logging fwk_stats_service:service_manager find;
+binder_call(gxp_logging, system_server);
+binder_use(gxp_logging)
+
+# Allow logging service to read gxp properties.
+get_prop(gxp_logging, vendor_gxp_prop)
+
+# Allow gxp tracing service to send packets to Perfetto
+userdebug_or_eng(`perfetto_producer(gxp_logging)')
diff --git a/gxp/sepolicy/hal_camera_default.te b/gxp/sepolicy/hal_camera_default.te
new file mode 100644
index 0000000..5570a2e
--- /dev/null
+++ b/gxp/sepolicy/hal_camera_default.te
@@ -0,0 +1,3 @@
+# Allow the camera hal to access the GXP device and Properties.
+allow hal_camera_default gxp_device:chr_file rw_file_perms;
+get_prop(hal_camera_default, vendor_gxp_prop)
diff --git a/gxp/sepolicy/property.te b/gxp/sepolicy/property.te
new file mode 100644
index 0000000..b9741f0
--- /dev/null
+++ b/gxp/sepolicy/property.te
@@ -0,0 +1,3 @@
+# Gxp Android properties
+system_vendor_config_prop(vendor_gxp_prop)
+
diff --git a/gxp/sepolicy/property_contexts b/gxp/sepolicy/property_contexts
new file mode 100644
index 0000000..6093c7c
--- /dev/null
+++ b/gxp/sepolicy/property_contexts
@@ -0,0 +1,3 @@
+# GXP Android Property.
+vendor.gxp.                                u:object_r:vendor_gxp_prop:s0
+
diff --git a/gxp/sepolicy/vendor_init.te b/gxp/sepolicy/vendor_init.te
new file mode 100644
index 0000000..ec6ceab
--- /dev/null
+++ b/gxp/sepolicy/vendor_init.te
@@ -0,0 +1,3 @@
+# Gxp Android Properties.
+set_prop(vendor_init, vendor_gxp_prop)
+
diff --git a/insmod/init.common.cfg b/insmod/init.common.cfg
index 3a81fd2..340eb4b 100644
--- a/insmod/init.common.cfg
+++ b/insmod/init.common.cfg
@@ -6,6 +6,7 @@
 
 # Load common kernel modules
 # Modules here will be loaded *before* device specific modules
-modprobe|-b *
+modprobe|system -b *
+modprobe|vendor -b *
 # All common modules loaded
 setprop|vendor.common.modules.ready
diff --git a/insmod/insmod.sh b/insmod/insmod.sh
index 2c434ef..03843f5 100755
--- a/insmod/insmod.sh
+++ b/insmod/insmod.sh
@@ -8,16 +8,29 @@
 #############################################################
 
 modules_dir=
+system_modules_dir=
+vendor_modules_dir=
 
-for f in /vendor/lib/modules/*/modules.dep /vendor/lib/modules/modules.dep; do
-  if [[ -f "$f" ]]; then
-    modules_dir="$(dirname "$f")"
-    break
-  fi
+for dir in system vendor; do
+  for f in /${dir}/lib/modules/*/modules.dep /${dir}/lib/modules/modules.dep; do
+    if [[ -f "$f" ]]; then
+      if [[ "${dir}" == "system" ]]; then
+        system_modules_dir="$(dirname "$f")"
+      else
+        vendor_modules_dir="$(dirname "$f")"
+        modules_dir=${vendor_modules_dir}
+      fi
+      break
+    fi
+  done
 done
 
-if [[ -z "${modules_dir}" ]]; then
-  echo "Unable to locate kernel modules directory" 2>&1
+if [[ -z "${system_modules_dir}" ]]; then
+  echo "Unable to locate system kernel modules directory" 2>&1
+fi
+
+if [[ -z "${vendor_modules_dir}" ]]; then
+  echo "Unable to locate vendor kernel modules directory" 2>&1
   exit 1
 fi
 
@@ -55,12 +68,23 @@
       "enable") echo 1 > $arg ;;
       "modprobe")
         case ${arg} in
-          "-b *" | "-b")
-            arg="-b --all=${modules_dir}/modules.load" ;;
-          "*" | "")
-            arg="--all=${modules_dir}/modules.load" ;;
+          "system -b *" | "system -b")
+            modules_dir=${system_modules_dir}
+            arg="-b --all=${system_modules_dir}/modules.load" ;;
+          "system *" | "system")
+            modules_dir=${system_modules_dir}
+            arg="--all=${system_modules_dir}/modules.load" ;;
+          "-b *" | "-b" | "vendor -b *" | "vendor -b")
+            modules_dir=${vendor_modules_dir}
+            arg="-b --all=${vendor_modules_dir}/modules.load" ;;
+          "*" | "" | "vendor *" | "vendor")
+            modules_dir=${vendor_modules_dir}
+            arg="--all=${vendor_modules_dir}/modules.load" ;;
         esac
-        modprobe -a -d "${modules_dir}" $arg ;;
+        if [[ -d "${modules_dir}" ]]; then
+          modprobe -a -d "${modules_dir}" $arg
+        fi
+        ;;
       "wait") wait_for_file $arg ;;
     esac
   done < $cfg_file
diff --git a/insmod/sepolicy/insmod-sh.te b/insmod/sepolicy/insmod-sh.te
index d7b4f72..ba82b0a 100644
--- a/insmod/sepolicy/insmod-sh.te
+++ b/insmod/sepolicy/insmod-sh.te
@@ -3,6 +3,9 @@
 init_daemon_domain(insmod-sh)
 
 allow insmod-sh self:capability sys_module;
+allow insmod-sh system_dlkm_file:dir r_dir_perms;
+allow insmod-sh system_dlkm_file:file r_file_perms;
+allow insmod-sh system_dlkm_file:system module_load;
 allow insmod-sh vendor_kernel_modules:system module_load;
 allow insmod-sh vendor_toolbox_exec:file execute_no_trans;
 
diff --git a/misc_writer/misc_writer.mk b/misc_writer/misc_writer.mk
new file mode 100644
index 0000000..7cb6c9a
--- /dev/null
+++ b/misc_writer/misc_writer.mk
@@ -0,0 +1,4 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/misc_writer
+
+PRODUCT_PACKAGES += \
+    misc_writer
diff --git a/misc_writer/vendor_misc_writer.te b/misc_writer/vendor_misc_writer.te
new file mode 100644
index 0000000..dd47f02
--- /dev/null
+++ b/misc_writer/vendor_misc_writer.te
@@ -0,0 +1 @@
+get_prop(vendor_misc_writer, sota_prop)
diff --git a/modem/Android.bp b/modem/Android.bp
index 84bdd61..dbc1cac 100644
--- a/modem/Android.bp
+++ b/modem/Android.bp
@@ -9,6 +9,13 @@
     sub_dir: "dump",
 }
 
+cc_defaults {
+    name: "dump_modemlog_defaults",
+    srcs: ["modem_log_dumper.cpp"],
+    local_include_dirs: ["include"],
+    shared_libs: ["liblog"],
+}
+
 cc_binary {
     name: "dump_modemlog",
     srcs: ["dump_modemlog.cpp"],
@@ -22,7 +29,16 @@
         "libdump",
         "liblog",
     ],
+    defaults: ["dump_modemlog_defaults"],
     vendor: true,
     relative_install_path: "dump",
 }
 
+cc_test {
+    name: "dump_modemlog_test",
+    srcs: ["test/*.cpp"],
+    defaults: ["dump_modemlog_defaults"],
+    local_include_dirs: ["test/include"],
+    static_libs: ["libgmock"],
+    vendor: true,
+}
diff --git a/modem/dump_modem.sh b/modem/dump_modem.sh
index f9f7cf2..d1a535d 100644
--- a/modem/dump_modem.sh
+++ b/modem/dump_modem.sh
@@ -1,5 +1,9 @@
 #!/vendor/bin/sh
 
+WAKEUP_EVENTS_FILE=/sys/devices/platform/cpif/wakeup_events
+CPIF_LOGBUFFER=/dev/logbuffer_cpif
+PCIE_EVENT_STATS=/sys/devices/platform/cpif/modem/pcie_event_stats
+
 echo "------ Modem Stat ------"
 cat /data/vendor/modem_stat/debug.txt
 
@@ -15,3 +19,23 @@
   cat $f
 done
 
+if [ -e $WAKEUP_EVENTS_FILE ]
+then
+  echo "\n------ Wakeup event counts ------"
+  echo $WAKEUP_EVENTS_FILE
+  cat $WAKEUP_EVENTS_FILE
+fi
+
+if [ -e $CPIF_LOGBUFFER ]
+then
+  echo "\n------ CPIF Logbuffer ------"
+  echo $CPIF_LOGBUFFER
+  cat $CPIF_LOGBUFFER
+fi
+
+if [ -e $PCIE_EVENT_STATS ]
+then
+  echo "\n------ PCIe event stats ------"
+  echo $PCIE_EVENT_STATS
+  cat $PCIE_EVENT_STATS
+fi
diff --git a/modem/dump_modemlog.cpp b/modem/dump_modemlog.cpp
index f7ef834..1b6b2e9 100644
--- a/modem/dump_modemlog.cpp
+++ b/modem/dump_modemlog.cpp
@@ -13,52 +13,61 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include <dump/pixel_dump.h>
 #include <android-base/properties.h>
-#include <log/log.h>
+#include <dump/pixel_dump.h>
 
-#define MODEM_LOGGING_PERSIST_PROPERTY "persist.vendor.sys.modem.logging.enable"
-#define MODEM_LOGGING_PROPERTY "vendor.sys.modem.logging.enable"
-#define MODEM_LOGGING_STATUS_PROPERTY "vendor.sys.modem.logging.status"
-#define MODEM_LOGGING_NUMBER_BUGREPORT_PROPERTY "persist.vendor.sys.modem.logging.br_num"
-#define MODEM_LOGGING_PATH_PROPERTY "vendor.sys.modem.logging.log_path"
-#define MODEM_SIM_DIRECTORY "/data/vendor/radio/sim/"
-#define MODEM_LOG_PREFIX "sbuff_"
-#define SIM_POWERON_LOG_PREFIX "sim_poweron_log_"
+#include "dumper.h"
+#include "modem_log_dumper.h"
+
+namespace modem {
+namespace logging {
+
+/**
+ * @brief Implementation of AndroidPropertyManager that directly forwards to
+ * android base methods.
+ */
+class AndroidPropertyManagerImpl : public AndroidPropertyManager {
+ public:
+  bool GetBoolProperty(const std::string& key, bool default_value) override {
+    return android::base::GetBoolProperty(key, default_value);
+  };
+
+  std::string GetProperty(const std::string& key,
+                          const std::string& default_value) override {
+    return android::base::GetProperty(key, default_value);
+  };
+  int GetIntProperty(const std::string& key, int default_value) override {
+    return android::base::GetIntProperty(key, default_value);
+  };
+  void SetProperty(const std::string& key, const std::string& value) override {
+    android::base::SetProperty(key, value);
+  };
+};
+
+/**
+ * @brief Implementation of Dumper that directly forwards to their corresponding
+ * dumpstate methods.
+ */
+class DumperImpl : public Dumper {
+ public:
+  void DumpLogs(const LogDumpInfo& log_dump_info) override {
+    dumpLogs(log_dump_info.src_dir.data(), log_dump_info.dest_dir.data(),
+             log_dump_info.limit, log_dump_info.prefix.data());
+  }
+  void CopyFile(const FileCopyInfo& file_copy_info) override {
+    copyFile(file_copy_info.src_dir.data(), file_copy_info.dest_dir.data());
+  }
+};
+
+}  // namespace logging
+}  // namespace modem
 
 int main() {
-    bool modemLogEnabled = ::android::base::GetBoolProperty(MODEM_LOGGING_PERSIST_PROPERTY, false);
-    if (modemLogEnabled && ::android::base::GetProperty(MODEM_LOGGING_PATH_PROPERTY, "") == MODEM_LOG_DIRECTORY) {
-        bool modemLogStarted = ::android::base::GetBoolProperty(MODEM_LOGGING_STATUS_PROPERTY, false);
-        int maxFileNum = ::android::base::GetIntProperty(MODEM_LOGGING_NUMBER_BUGREPORT_PROPERTY, 100);
+  modem::logging::DumperImpl dumper_impl;
+  modem::logging::AndroidPropertyManagerImpl android_property_manager_impl;
+  modem::logging::ModemLogDumper modem_log_dumper(
+      dumper_impl, android_property_manager_impl);
 
-        if (modemLogStarted) {
-            ::android::base::SetProperty(MODEM_LOGGING_PROPERTY, "false");
-            ALOGD("Stopping modem logging...\n");
-        } else {
-            ALOGD("modem logging is not running\n");
-        }
-
-        for (int i = 0; i < 15; i++) {
-            if (!::android::base::GetBoolProperty(MODEM_LOGGING_STATUS_PROPERTY, false)) {
-                ALOGD("modem logging stopped\n");
-                sleep(1);
-                break;
-            }
-            sleep(1);
-        }
-
-        dumpLogs(MODEM_LOG_DIRECTORY, BUGREPORT_PACKING_DIR, maxFileNum, MODEM_LOG_PREFIX);
-
-        if (modemLogStarted) {
-            ALOGD("Restarting modem logging...\n");
-            ::android::base::SetProperty(MODEM_LOGGING_PROPERTY, "true");
-        }
-    }
-
-    dumpLogs("/data/vendor/radio/extended_logs", BUGREPORT_PACKING_DIR, 20, "extended_log_");
-    dumpLogs(MODEM_SIM_DIRECTORY, BUGREPORT_PACKING_DIR, 1, SIM_POWERON_LOG_PREFIX);
-    copyFile("/mnt/vendor/efs/nv_normal.bin", "/data/vendor/radio/logs/always-on/all_logs/nv_normal.bin");
-    copyFile("/mnt/vendor/efs/nv_protected.bin", "/data/vendor/radio/logs/always-on/all_logs/nv_protected.bin");
-    return 0;
+  modem_log_dumper.DumpModemLogs();
+  return 0;
 }
diff --git a/modem/include/android_property_manager.h b/modem/include/android_property_manager.h
new file mode 100644
index 0000000..7135d66
--- /dev/null
+++ b/modem/include/android_property_manager.h
@@ -0,0 +1,21 @@
+#pragma once
+
+#include <string>
+
+namespace modem {
+namespace logging {
+
+/**
+ * @brief Interface for interacting with Android System Properties.
+ */
+class AndroidPropertyManager {
+ public:
+  virtual ~AndroidPropertyManager() = default;
+  virtual bool GetBoolProperty(const std::string& key, bool default_value);
+  virtual std::string GetProperty(const std::string& key,
+                                  const std::string& default_value);
+  virtual int GetIntProperty(const std::string& key, int default_value);
+  virtual void SetProperty(const std::string& key, const std::string& value);
+};
+}  // namespace logging
+}  // namespace modem
diff --git a/modem/include/dumper.h b/modem/include/dumper.h
new file mode 100644
index 0000000..348e666
--- /dev/null
+++ b/modem/include/dumper.h
@@ -0,0 +1,71 @@
+#pragma once
+
+#include <ostream>
+#include <string_view>
+
+namespace modem {
+namespace logging {
+
+/**
+ * @brief Data object for information about dumpings logs.
+ *
+ * @param src_dir is a const char* containing the path to the directory to be
+ copied.
+ * @param dest_dir is a const char* containing the path to the directory that
+ the contents of the source directory should be copied to.
+ * @param limit is an int of the maximum number of files to copy.
+ * @param prefix is a const char* containing a prefix that all files to be
+ copied should have.
+*/
+struct LogDumpInfo {
+  const std::string_view src_dir;
+  const std::string_view dest_dir;
+  int limit;
+  const std::string_view prefix;
+
+  friend bool operator==(const LogDumpInfo& lhs, const LogDumpInfo& rhs) {
+    return (lhs.limit == rhs.limit) && (lhs.src_dir == rhs.src_dir) &&
+           (lhs.dest_dir == rhs.dest_dir) && (lhs.prefix == rhs.prefix);
+  }
+
+  // Do I have to use .data() here?
+  friend std::ostream& operator<<(std::ostream& os, const LogDumpInfo& obj) {
+    os << "src_dir: " << obj.src_dir << ", dest_dir: " << obj.dest_dir
+       << ", limit: " << obj.limit << ", prefix: " << obj.prefix;
+    return os;
+  }
+};
+
+/**
+ * @brief Data object for information about dumpings logs.
+ *
+ * @param src_dir is a const char* containing the path to a file to be copied.
+ * @param dest_dir is a const char* containing the destination path for the file
+ * to be copied to.
+ */
+struct FileCopyInfo {
+  const std::string_view src_dir;
+  const std::string_view dest_dir;
+
+  friend bool operator==(const FileCopyInfo& lhs, const FileCopyInfo& rhs) {
+    return (lhs.src_dir == rhs.src_dir) && (lhs.dest_dir == rhs.dest_dir);
+  }
+
+  // Do I have to add .data() here?
+  friend std::ostream& operator<<(std::ostream& os, const FileCopyInfo& obj) {
+    os << "src_dir: " << obj.src_dir << ", dest_dir: " << obj.dest_dir;
+    return os;
+  }
+};
+
+/**
+ * @brief Interface for dumping modem logs and files.
+ */
+class Dumper {
+ public:
+  virtual ~Dumper() = default;
+  virtual void DumpLogs(const LogDumpInfo& log_dump_info);
+  virtual void CopyFile(const FileCopyInfo& file_copy_info);
+};
+}  // namespace logging
+}  // namespace modem
diff --git a/modem/include/modem_log_constants.h b/modem/include/modem_log_constants.h
new file mode 100644
index 0000000..29a0fa8
--- /dev/null
+++ b/modem/include/modem_log_constants.h
@@ -0,0 +1,56 @@
+#pragma once
+#include <string>
+
+#include "dumper.h"
+
+namespace modem {
+namespace logging {
+
+// Modem related Android System Properties
+
+// Controls triggering `modem_logging_start` and `modem_logging_stop`.
+inline constexpr static std::string_view kModemLoggingEnabledProperty =
+    "vendor.sys.modem.logging.enable";
+// Signals the current modem logging state. This will be set to
+// `vendor.sys.modem.logging.enable` when `modem_log_start` or `modem_log_stop`
+// terminates.
+inline constexpr static std::string_view kModemLoggingStatusProperty =
+    "vendor.sys.modem.logging.status";
+// Int which specifies how many files to include in the bugreport.
+inline constexpr static std::string_view kModemLoggingNumberBugreportProperty =
+    "persist.vendor.sys.modem.logging.br_num";
+// Signals the current location that is being logged to. This can be used to
+// determine the logging type.
+inline constexpr static std::string_view kModemLoggingPathProperty =
+    "vendor.sys.modem.logging.log_path";
+
+// Bugreport constants
+inline constexpr static int kDefaultBugreportNumberFiles = 100;
+inline constexpr static std::string_view kModemAlwaysOnLogDirectory =
+    "/data/vendor/radio/logs/always-on";
+inline constexpr static std::string_view kModemLogPrefix = "sbuff_";
+inline constexpr static std::string_view kBugreportPackingDirectory =
+    "/data/vendor/radio/logs/always-on/all_logs";
+
+inline constexpr static LogDumpInfo kLogDumpInfo[] = {
+    {.src_dir = "/data/vendor/radio/extended_logs",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 20,
+     .prefix = "extended_log_"},
+    {.src_dir = "/data/vendor/radio/sim/",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 1,
+     .prefix = "sim_poweron_log_"},
+    {.src_dir = "data/vendor/radio/logs/history",
+     .dest_dir = kBugreportPackingDirectory,
+     .limit = 2,
+     .prefix = "Logging"}};
+
+constexpr static FileCopyInfo kFileCopyInfo[] = {
+    {.src_dir = "/mnt/vendor/efs/nv_normal.bin",
+     .dest_dir = "/data/vendor/radio/logs/always-on/all_logs/nv_normal.bin"},
+    {.src_dir = "/mnt/vendor/efs/nv_protected.bin",
+     .dest_dir =
+         "/data/vendor/radio/logs/always-on/all_logs/nv_protected.bin"}};
+}  // namespace logging
+}  // namespace modem
diff --git a/modem/include/modem_log_dumper.h b/modem/include/modem_log_dumper.h
new file mode 100644
index 0000000..96911b0
--- /dev/null
+++ b/modem/include/modem_log_dumper.h
@@ -0,0 +1,81 @@
+#pragma once
+
+#include "android_property_manager.h"
+#include "dumper.h"
+
+namespace modem {
+namespace logging {
+
+/**
+ * @brief Responsible for dumping all relevant modem logs.
+ */
+class ModemLogDumper {
+ public:
+  ModemLogDumper(Dumper& dumper,
+                 AndroidPropertyManager& android_property_manager)
+      : dumper_(dumper), android_property_manager_(android_property_manager){};
+
+  /**
+   * @brief Dumps modem related logs and persistent files to bugreport.
+   *
+   * If PILOT and On Demand Logging are both not enabled, this method will
+   * attempt to stop modem logging, copy over the logs, and then restart so that
+   * the original logging enabled / disabled state is preserved. Additionally,
+   * all directories specified in `kLogDumpInfo` and all files in
+   * `kFileCopyInfo` will be included.
+   */
+  void DumpModemLogs();
+
+ private:
+  /**
+   * @brief Checks modem logging status property to assert if logging is
+   * running or not.
+   */
+  bool isModemLoggingRunning();
+
+  /**
+   * @brief Checks if On Demand Logging or PILOT Logging is enabled.
+   *
+   * If either of them are enabled, then the `log_path` property will no longer
+   * point to the always on logging directory.
+   */
+  bool allowedToStopModemLogging();
+
+  /**
+   * @brief Stops modem logging.
+   *
+   * This sets the modem logging property which in turn triggers
+   * modem_logging_control's modem_logging_stop service. Modem logging isn't
+   * guaranteed to have stopped after this call, so it's necessary to poll the
+   * status property to ensure it's stopped before proceeding.
+   */
+  void stopModemLogging();
+
+  /**
+   * @brief Polls modem logging status property to ensure modem logging has
+   * stopped.
+   *
+   * Even after the property is confirmed to be false, it will continue to
+   * sleep for a second to ensure that the modem_logging_stop service has exited
+   * properly.
+   */
+  void waitForStopModemLogging();
+
+  /**
+   * @brief Starts modem logging.
+   *
+   * This sets the modem logging property which in turn triggers
+   * modem_logging_control's modem_logging_start service. Modem logging isn't
+   * guaranteed to have started after this call, so it's necessary to poll the
+   * status property to ensure it's started before proceeding to guarantee
+   * success.
+   */
+  void startModemLogging();
+
+ private:
+  Dumper& dumper_;
+  AndroidPropertyManager& android_property_manager_;
+};
+
+}  // namespace logging
+}  // namespace modem
diff --git a/modem/modem_log_dumper.cpp b/modem/modem_log_dumper.cpp
new file mode 100644
index 0000000..fad8d29
--- /dev/null
+++ b/modem/modem_log_dumper.cpp
@@ -0,0 +1,80 @@
+#include "modem_log_dumper.h"
+
+#include <log/log.h>
+
+#include "dumper.h"
+#include "modem_log_constants.h"
+
+namespace modem {
+namespace logging {
+
+void ModemLogDumper::DumpModemLogs() {
+  bool shouldRestartModemLogging =
+      allowedToStopModemLogging() && isModemLoggingRunning();
+  int maxFileNum = android_property_manager_.GetIntProperty(
+      kModemLoggingNumberBugreportProperty.data(),
+      kDefaultBugreportNumberFiles);
+
+  if (shouldRestartModemLogging) {
+    // If modem logging is running at time of bugreport, it needs to be stopped
+    // to ensure that the most recent logs are included in the bugreport. If
+    // this command fails, only older log files will be included, as seen in
+    // b/289435256.
+    stopModemLogging();
+    waitForStopModemLogging();
+  } else {
+    ALOGD("modem logging is not running\n");
+  }
+
+  dumper_.DumpLogs({kModemAlwaysOnLogDirectory, kBugreportPackingDirectory,
+                    maxFileNum, kModemLogPrefix});
+
+  if (shouldRestartModemLogging) {
+    startModemLogging();
+  }
+
+  for (const LogDumpInfo& log_dump_info : kLogDumpInfo) {
+    dumper_.DumpLogs(log_dump_info);
+  }
+
+  for (const FileCopyInfo& file_copy_info : kFileCopyInfo) {
+    dumper_.CopyFile(file_copy_info);
+  }
+};
+
+bool ModemLogDumper::isModemLoggingRunning() {
+  return android_property_manager_.GetBoolProperty(
+      kModemLoggingStatusProperty.data(), false);
+}
+
+bool ModemLogDumper::allowedToStopModemLogging() {
+  return android_property_manager_.GetProperty(kModemLoggingPathProperty.data(),
+                                               /*default_value=*/"") ==
+         kModemAlwaysOnLogDirectory;
+}
+
+void ModemLogDumper::stopModemLogging() {
+  android_property_manager_.SetProperty(kModemLoggingEnabledProperty.data(),
+                                        "false");
+  ALOGD("Stopping modem logging...\n");
+}
+
+void ModemLogDumper::waitForStopModemLogging() {
+  // TODO(b/289582966) improve stop logging mechanism to not use sleep
+  for (int i = 0; i < 15; i++) {
+    if (!isModemLoggingRunning()) {
+      ALOGD("modem logging stopped\n");
+      sleep(1);
+      break;
+    }
+    sleep(1);
+  }
+}
+
+void ModemLogDumper::startModemLogging() {
+  ALOGD("Restarting modem logging...\n");
+  android_property_manager_.SetProperty(kModemLoggingEnabledProperty.data(),
+                                        "true");
+}
+}  // namespace logging
+}  // namespace modem
diff --git a/modem/sepolicy/dump_modem.te b/modem/sepolicy/dump_modem.te
index dc9b38d..2ffa351 100644
--- a/modem/sepolicy/dump_modem.te
+++ b/modem/sepolicy/dump_modem.te
@@ -8,3 +8,5 @@
 allow dump_modem vendor_rfsd_log_file:dir r_dir_perms;
 allow dump_modem vendor_rfsd_log_file:file r_file_perms;
 allow dump_modem vendor_toolbox_exec:file execute_no_trans;
+allow dump_modem sysfs_dump_modem:file r_file_perms;
+allow dump_modem logbuffer_device:chr_file r_file_perms;
diff --git a/modem/sepolicy/file.te b/modem/sepolicy/file.te
new file mode 100644
index 0000000..383480d
--- /dev/null
+++ b/modem/sepolicy/file.te
@@ -0,0 +1 @@
+type sysfs_dump_modem, sysfs_type, fs_type;
diff --git a/modem/sepolicy/genfs_contexts b/modem/sepolicy/genfs_contexts
new file mode 100644
index 0000000..98a8fc5
--- /dev/null
+++ b/modem/sepolicy/genfs_contexts
@@ -0,0 +1,2 @@
+genfscon sysfs /devices/platform/cpif/wakeup_events u:object_r:sysfs_dump_modem:s0
+genfscon sysfs /devices/platform/cpif/modem/pcie_event_stats u:object_r:sysfs_dump_modem:s0
diff --git a/modem/test/include/fake_android_property_manager.h b/modem/test/include/fake_android_property_manager.h
new file mode 100644
index 0000000..79fd4f1
--- /dev/null
+++ b/modem/test/include/fake_android_property_manager.h
@@ -0,0 +1,77 @@
+
+
+#include <map>
+#include <string>
+#include <string_view>
+
+#include "android_property_manager.h"
+#include "modem_log_constants.h"
+
+namespace modem {
+namespace logging {
+
+/**
+ * @brief Fake Implementation of AndroidPropertyManager that mocks some of the
+ * property changing behaviour from pixellogger's `modem_logging_control`.
+ */
+class FakeAndroidPropertyManager : public AndroidPropertyManager {
+ public:
+  inline constexpr static std::string_view kTruthString = "true";
+  inline constexpr static std::string_view kFalseString = "false";
+
+  bool GetBoolProperty(const std::string& key, bool default_value) override {
+    return MapContainsKey(key)
+               ? GetPropertyInternal(key) == kTruthString
+               : default_value;
+  };
+
+  std::string GetProperty(const std::string& key,
+                          const std::string& default_value) override {
+    return MapContainsKey(key) ? GetPropertyInternal(key) : default_value;
+    ;
+  };
+
+  int GetIntProperty(const std::string& key, int default_value) override {
+    return MapContainsKey(key) ? std::stoi(GetPropertyInternal(key))
+                               : default_value;
+  };
+
+  /**
+   * This function needs to copy the behaviour of `modem_logging_control` to
+   * ensure that the right properties are being set in order.
+   *
+   * More specifically, this function will also set the
+   * `kModemLoggingStatusProperty` whenever `kModemLoggingEnabledProperty` is
+   * set to simulate modem logging stopping / starting.
+   */
+  void SetProperty(const std::string& key, const std::string& value) override {
+    if (key == kModemLoggingEnabledProperty) {
+      property_map_[kModemLoggingStatusProperty.data()] = value;
+
+      // need to track if modem logging has restarted or not
+      if (value == kFalseString) {
+        modem_logging_has_been_off_ = true;
+      }
+      if (modem_logging_has_been_off_ && (value == kTruthString)) {
+        modem_logging_has_restarted_ = true;
+      }
+    }
+    property_map_[key] = value;
+  };
+
+  bool ModemLoggingHasRestarted() { return modem_logging_has_restarted_; }
+
+ private:
+  bool MapContainsKey(const std::string& key) {
+    return property_map_.find(key) != property_map_.end();
+  }
+  std::string GetPropertyInternal(const std::string& key) {
+    return property_map_.find(key)->second;
+  }
+
+  std::map<std::string, std::string> property_map_;
+  bool modem_logging_has_been_off_ = false;
+  bool modem_logging_has_restarted_ = false;
+};
+}  // namespace logging
+}  // namespace modem
diff --git a/modem/test/modem_log_dumper_test.cpp b/modem/test/modem_log_dumper_test.cpp
new file mode 100644
index 0000000..a052d43
--- /dev/null
+++ b/modem/test/modem_log_dumper_test.cpp
@@ -0,0 +1,106 @@
+#include "modem_log_dumper.h"
+
+#include <string_view>
+
+#include "dumper.h"
+#include "fake_android_property_manager.h"
+#include "gmock/gmock.h"
+#include "gtest/gtest.h"
+
+namespace modem {
+namespace logging {
+namespace {
+
+using ::testing::Eq;
+
+inline constexpr static std::string_view kFakePilotLoggingPath =
+    "//pilot/logging/path";
+inline constexpr static std::string_view kFakeOnDemandLoggingPath =
+    "//on/demand/logging/path";
+inline constexpr static LogDumpInfo kAlwaysOnLogDumpInfo = {
+    kModemAlwaysOnLogDirectory, kBugreportPackingDirectory,
+    kDefaultBugreportNumberFiles, kModemLogPrefix};
+
+void StartModemLogging(
+    FakeAndroidPropertyManager& fake_android_property_manager) {
+  fake_android_property_manager.SetProperty(
+      kModemLoggingEnabledProperty.data(),
+      FakeAndroidPropertyManager::kTruthString.data());
+}
+
+class MockDumper : public Dumper {
+ public:
+  ~MockDumper() = default;
+  MOCK_METHOD(void, DumpLogs, (const LogDumpInfo&), (override));
+  MOCK_METHOD(void, CopyFile, (const FileCopyInfo&), (override));
+};
+
+class ModemLogDumperTest : public ::testing::Test {
+ protected:
+  ModemLogDumperTest()
+      : modem_log_dumper(mock_dumper, fake_android_property_manager) {}
+
+  void SetUp() override {
+    // set default logging mode to always on logging
+    fake_android_property_manager.SetProperty(
+        kModemLoggingPathProperty.data(), kModemAlwaysOnLogDirectory.data());
+  }
+
+  MockDumper mock_dumper;
+  FakeAndroidPropertyManager fake_android_property_manager;
+  ModemLogDumper modem_log_dumper;
+};
+
+TEST_F(ModemLogDumperTest, DumpLogsDumpsAllDirectoriesAndCopiesAllFiles) {
+  EXPECT_CALL(mock_dumper, DumpLogs(Eq(kAlwaysOnLogDumpInfo)));
+
+  for (const LogDumpInfo& log_dump_info : kLogDumpInfo) {
+    EXPECT_CALL(mock_dumper, DumpLogs(Eq(log_dump_info)));
+  }
+
+  for (const FileCopyInfo& fileCopyInfo : kFileCopyInfo) {
+    EXPECT_CALL(mock_dumper, CopyFile(Eq(fileCopyInfo)));
+  }
+
+  modem_log_dumper.DumpModemLogs();
+}
+
+TEST_F(ModemLogDumperTest, DumpLogsRestartModemLoggingWhenEnabled) {
+  StartModemLogging(fake_android_property_manager);
+
+  modem_log_dumper.DumpModemLogs();
+
+  EXPECT_TRUE(fake_android_property_manager.ModemLoggingHasRestarted());
+}
+
+TEST_F(ModemLogDumperTest, DumpLogsDoesNotRestartModemLoggingWhenDisabled) {
+  modem_log_dumper.DumpModemLogs();
+
+  EXPECT_FALSE(fake_android_property_manager.ModemLoggingHasRestarted());
+}
+
+TEST_F(ModemLogDumperTest, DumpLogsDoesNotRestartModemLoggingWhenPilotEnabled) {
+  // Enable PILOT
+  fake_android_property_manager.SetProperty(kModemLoggingPathProperty.data(),
+                                            kFakePilotLoggingPath.data());
+  StartModemLogging(fake_android_property_manager);
+
+  modem_log_dumper.DumpModemLogs();
+
+  EXPECT_FALSE(fake_android_property_manager.ModemLoggingHasRestarted());
+}
+
+TEST_F(ModemLogDumperTest,
+       DumpLogsDoesNotRestartModemLoggingWhenOnDemandLoggingEnabled) {
+  // Enable On Demand Logging
+  fake_android_property_manager.SetProperty(kModemLoggingPathProperty.data(),
+                                            kFakeOnDemandLoggingPath.data());
+  StartModemLogging(fake_android_property_manager);
+
+  modem_log_dumper.DumpModemLogs();
+
+  EXPECT_FALSE(fake_android_property_manager.ModemLoggingHasRestarted());
+}
+}  // namespace
+}  // namespace logging
+}  // namespace modem
diff --git a/mte/fullmte-pixel.mk b/mte/fullmte-pixel.mk
new file mode 100644
index 0000000..96120fb
--- /dev/null
+++ b/mte/fullmte-pixel.mk
@@ -0,0 +1,2 @@
+include build/make/target/product/fullmte.mk
+BOARD_KERNEL_CMDLINE += bootloader.pixel.MTE_FORCE_ON
diff --git a/performance/sepolicy/genfs_contexts b/performance/sepolicy/genfs_contexts
new file mode 100644
index 0000000..000c41b
--- /dev/null
+++ b/performance/sepolicy/genfs_contexts
@@ -0,0 +1 @@
+genfscon proc /sys/kernel/sched_pelt_multiplier u:object_r:proc_sched:s0
diff --git a/pixel_ril/compatibility_matrix.xml b/pixel_ril/compatibility_matrix.xml
index edd9ecd..73d208d 100644
--- a/pixel_ril/compatibility_matrix.xml
+++ b/pixel_ril/compatibility_matrix.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework" level="7">
+<compatibility-matrix version="1.0" type="framework">
     <hal format="aidl" optional="true">
         <name>hardware.google.ril_ext</name>
         <version>1</version>
diff --git a/pixelsystemservice/pixelsystemservice.mk b/pixelsystemservice/pixelsystemservice.mk
new file mode 100644
index 0000000..4a27110
--- /dev/null
+++ b/pixelsystemservice/pixelsystemservice.mk
@@ -0,0 +1,5 @@
+PRODUCT_SOONG_NAMESPACES += vendor/google/apps/PersistentBackgroundServices
+PRODUCT_PACKAGES += \
+       PersistentBackgroundServices
+
+SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/pixelsystemservice/sepolicy
diff --git a/pixelsystemservice/sepolicy/pixelsystemservice_app.te b/pixelsystemservice/sepolicy/pixelsystemservice_app.te
new file mode 100644
index 0000000..f120058
--- /dev/null
+++ b/pixelsystemservice/sepolicy/pixelsystemservice_app.te
@@ -0,0 +1,6 @@
+type pixelsystemservice_app, domain, coredomain;
+
+app_domain(pixelsystemservice_app);
+
+# Standard system services
+allow pixelsystemservice_app app_api_service:service_manager find;
diff --git a/pixelsystemservice/sepolicy/seapp_contexts b/pixelsystemservice/sepolicy/seapp_contexts
new file mode 100644
index 0000000..f1c1262
--- /dev/null
+++ b/pixelsystemservice/sepolicy/seapp_contexts
@@ -0,0 +1,2 @@
+# Pixel System Service
+user=_app seinfo=platform name=com.google.android.pixelsystemservice domain=pixelsystemservice_app type=app_data_file levelFrom=all
diff --git a/sepolicy/OWNERS b/sepolicy/OWNERS
new file mode 100644
index 0000000..aab78ab
--- /dev/null
+++ b/sepolicy/OWNERS
@@ -0,0 +1,5 @@
+include platform/system/sepolicy:/OWNERS
+
+wilsonsung@google.com
+rurumihong@google.com
+
diff --git a/sepolicy/README.txt b/sepolicy/README.txt
new file mode 100644
index 0000000..d1ad3e6
--- /dev/null
+++ b/sepolicy/README.txt
@@ -0,0 +1,2 @@
+This folder holds content for pixel sepolicy operations. Device sepolicy like
+file.te, file_contexts will not live in here.
diff --git a/soc/Android.bp b/soc/Android.bp
index e913154..43e9202 100644
--- a/soc/Android.bp
+++ b/soc/Android.bp
@@ -2,11 +2,21 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-sh_binary {
-    name: "dump_memory.sh",
-    src: "dump_memory.sh",
+cc_binary {
+    name: "dump_memory",
+    srcs: ["dump_memory.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+	"libdump",
+	"liblog",
+    ],
     vendor: true,
-    sub_dir: "dump",
+    relative_install_path: "dump",
 }
 
 cc_binary {
diff --git a/soc/dump_devfreq.cpp b/soc/dump_devfreq.cpp
index 5cbbb94..da91a62 100644
--- a/soc/dump_devfreq.cpp
+++ b/soc/dump_devfreq.cpp
@@ -14,16 +14,28 @@
  * limitations under the License.
  */
 #include <dump/pixel_dump.h>
+#include <unistd.h>
 
+const char* dvfs_paths[][2] = {
+    {"MIF DVFS", "/sys/devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/trans_stat"},
+    {"INT DVFS", "/sys/devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/trans_stat"},
+    {"INTCAM DVFS", "/sys/devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/trans_stat"},
+    {"DISP DVFS", "/sys/devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/trans_stat"},
+    {"CAM DVFS", "/sys/devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/trans_stat"},
+    {"TNR DVFS", "/sys/devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/trans_stat"},
+    {"MFC DVFS", "/sys/devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/trans_stat"},
+    {"BO DVFS", "/sys/devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/trans_stat"},
+    {"BW DVFS", "/sys/devices/platform/17000080.devfreq_bw/devfreq/17000080.devfreq_bw/trans_stat"},
+    {"DSU DVFS", "/sys/devices/platform/17000090.devfreq_dsu/devfreq/17000090.devfreq_dsu/trans_stat"},
+    {"BCI DVFS", "/sys/devices/platform/170000a0.devfreq_bci/devfreq/170000a0.devfreq_bci/trans_stat"},
+    {"BTS stats", "/sys/devices/platform/exynos-bts/bts_stats"}
+};
 int main() {
-    dumpFileContent("MIF DVFS", "/sys/devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/time_in_state");
-    dumpFileContent("INT DVFS", "/sys/devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/time_in_state");
-    dumpFileContent("INTCAM DVFS", "/sys/devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/time_in_state");
-    dumpFileContent("DISP DVFS", "/sys/devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/time_in_state");
-    dumpFileContent("CAM DVFS", "/sys/devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/time_in_state");
-    dumpFileContent("TNR DVFS", "/sys/devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/time_in_state");
-    dumpFileContent("MFC DVFS", "/sys/devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/time_in_state");
-    dumpFileContent("BO DVFS", "/sys/devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/time_in_state");
-    dumpFileContent("BTS stats", "/sys/devices/platform/exynos-bts/bts_stats");
+
+    for (auto &dvfs_path : dvfs_paths ) {
+        if(!access(dvfs_path[1], R_OK)) {
+            dumpFileContent(dvfs_path[0], dvfs_path[1]);
+        }
+    }
     return 0;
 }
diff --git a/soc/dump_memory.cpp b/soc/dump_memory.cpp
new file mode 100644
index 0000000..1528f73
--- /dev/null
+++ b/soc/dump_memory.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <dump/pixel_dump.h>
+
+#include <android-base/file.h>
+#include <stdio.h>
+#include <log/log.h>
+
+char* concat(char* result, const char* one, const char* two){
+  strcpy(result, one);
+  strcat(result, two);
+  return result;
+}
+
+void iterate(const char* path){
+    dirent *entry, *entry2;
+    char result[100], base[100];
+
+    std::unique_ptr<DIR, decltype(&closedir)> ion(opendir(path), closedir);
+    if (!ion) {
+        ALOGE("Fail To Open Dir %s", path);
+        return;
+    }
+    while ((entry = readdir(ion.get())) != nullptr) {
+        if(entry->d_name[0] == '.') {
+            continue;
+        }
+        strcpy(base, path);
+        strcat(base, entry->d_name);
+        strcat(base, "/");
+        std::unique_ptr<DIR, decltype(&closedir)> ion2(opendir(base), closedir);
+        if (!ion2) {
+            ALOGE("Fail To Open Dir %s\n", base);
+            return;
+        }
+        while ((entry2 = readdir(ion2.get())) != nullptr) {
+            if(entry2->d_name[0] == '.') {
+                continue;
+            }
+            dumpFileContent(entry2->d_name, concat(result, base, entry2->d_name));
+        }
+    }
+    return;
+}
+
+// Dump memory.
+int main() {
+    dirent *entry;
+    char result[100];
+
+    printf("------ ION HEAPS  ------\n");
+    iterate("/d/ion/");
+
+    dumpFileContent("dmabuf info", "/d/dma_buf/bufinfo");
+    dumpFileContent("Page Pinner - longterm pin", "/sys/kernel/debug/page_pinner/buffer");
+
+    printf("------ CMA info  ------\n");
+    std::unique_ptr<DIR, decltype(&closedir)> cmadebug(opendir("/sys/kernel/debug/cma/"), closedir);
+    if (!cmadebug) {
+        ALOGE("Fail To Open Dir /sys/kernel/debug/cma/");
+    } else {
+        while ((entry = readdir(cmadebug.get())) != nullptr) {
+            if(entry->d_name[0] == '.') {
+                continue;
+            }
+            dumpFileContent("count", concat(result, concat(result, "/sys/kernel/debug/cma/", entry->d_name), "/count"));
+            dumpFileContent("used", concat(result, concat(result, "/sys/kernel/debug/cma/", entry->d_name), "/used"));
+            dumpFileContent("bitmap", concat(result, concat(result, "/sys/kernel/debug/cma/", entry->d_name), "/bitmap"));
+        }
+    }
+
+    printf("------ Pixel CMA stat  ------\n");
+    iterate("/sys/kernel/pixel_stat/mm/cma/");
+
+    dumpFileContent("Pixel Trace", "/sys/kernel/tracing/instances/pixel/trace");
+    return 0;
+}
+
diff --git a/soc/dump_memory.sh b/soc/dump_memory.sh
deleted file mode 100644
index 6135dea..0000000
--- a/soc/dump_memory.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/vendor/bin/sh
-echo "------ ION HEAPS ------"
-for d in $(ls -d /d/ion/*)
-do
-  if [ -f $d ]; then
-    echo --- $d
-    cat $d
-  else
-    for f in $(ls $d)
-    do
-      echo --- $d/$f
-      cat $d/$f
-    done
-  fi
-done
-
-echo "------ dmabuf info ------"
-cat "/d/dma_buf/bufinfo"
-
-echo "------ Page Pinner - longterm pin ------"
-cat "/sys/kernel/debug/page_pinner/buffer"
-
-echo "------ CMA info ------"
-for d in $(ls -d /sys/kernel/debug/cma/*)
-do
-  echo --- $d
-  echo --- count; cat $d/count;
-  echo --- used; cat $d/used;
-  echo --- bitmap; cat $d/bitmap;
-done
-
-echo "------ Pixel CMA stat ------"
-for d in $(ls -d /sys/kernel/pixel_stat/mm/cma/*); do
-  if [ -f $d ]; then
-    echo --- $d
-    cat $d
-  else
-    for f in $(ls $d); do
-      echo --- $d/$f
-      cat $d/$f
-    done
-  fi
-done
-
-echo "------ Pixel Trace ------"
-cat "/sys/kernel/tracing/instances/pixel/trace"
diff --git a/soc/dump_soc.cpp b/soc/dump_soc.cpp
index 4c34349..ab3ac2d 100644
--- a/soc/dump_soc.cpp
+++ b/soc/dump_soc.cpp
@@ -31,8 +31,10 @@
 // Dump chip ID.
 int main() {
     dumpFileContent("AP HW TUNE", "/sys/devices/system/chip-id/ap_hw_tune_str");
+    dumpFileContent("DVFS VERSION", "/sys/devices/system/chip-id/dvfs_version");
     dumpFileContent("EVT VERSION", "/sys/devices/system/chip-id/evt_ver");
     dumpFileContent("LOT ID", "/sys/devices/system/chip-id/lot_id");
+    dumpFileContent("PACKAGE", "/sys/devices/system/chip-id/pkg_revision");
     dumpFileContent("PRODUCT ID", "/sys/devices/system/chip-id/product_id");
     dumpFileContent("REVISION", "/sys/devices/system/chip-id/revision");
     dumpFileContent("RAW STR", "/sys/devices/system/chip-id/raw_str");
diff --git a/soc/sepolicy/freq/genfs_contexts b/soc/sepolicy/freq/genfs_contexts
index 76a783d..7795c12 100644
--- a/soc/sepolicy/freq/genfs_contexts
+++ b/soc/sepolicy/freq/genfs_contexts
@@ -10,6 +10,17 @@
 genfscon sysfs /devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/time_in_state         u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/17000090.devfreq_dsu/devfreq/17000090.devfreq_dsu/time_in_state       u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/170000a0.devfreq_bci/devfreq/170000a0.devfreq_bci/time_in_state       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000010.devfreq_mif/devfreq/17000010.devfreq_mif/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000020.devfreq_int/devfreq/17000020.devfreq_int/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000030.devfreq_intcam/devfreq/17000030.devfreq_intcam/trans_stat u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000040.devfreq_disp/devfreq/17000040.devfreq_disp/trans_stat     u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000050.devfreq_cam/devfreq/17000050.devfreq_cam/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000060.devfreq_tnr/devfreq/17000060.devfreq_tnr/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000070.devfreq_mfc/devfreq/17000070.devfreq_mfc/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000080.devfreq_bw/devfreq/17000080.devfreq_bw/trans_stat         u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000080.devfreq_bo/devfreq/17000080.devfreq_bo/trans_stat         u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/17000090.devfreq_dsu/devfreq/17000090.devfreq_dsu/trans_stat       u:object_r:sysfs_cpu:s0
+genfscon sysfs /devices/platform/170000a0.devfreq_bci/devfreq/170000a0.devfreq_bci/trans_stat       u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/1f000000.mali/time_in_state                                           u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/1f000000.mali/uid_time_in_state                                       u:object_r:sysfs_cpu:s0
 genfscon sysfs /devices/platform/cpupm/cpupm/time_in_state                                             u:object_r:sysfs_cpu:s0
diff --git a/soc/sepolicy/soc/file_contexts b/soc/sepolicy/soc/file_contexts
index 23a91e5..5adc605 100644
--- a/soc/sepolicy/soc/file_contexts
+++ b/soc/sepolicy/soc/file_contexts
@@ -1,3 +1,3 @@
 /vendor/bin/dump/dump_soc           u:object_r:dump_soc_exec:s0
-/vendor/bin/dump/dump_memory\.sh    u:object_r:dump_memory_exec:s0
+/vendor/bin/dump/dump_memory        u:object_r:dump_memory_exec:s0
 
diff --git a/soc/sepolicy/soc/genfs_contexts b/soc/sepolicy/soc/genfs_contexts
index e718bd1..bba996d 100644
--- a/soc/sepolicy/soc/genfs_contexts
+++ b/soc/sepolicy/soc/genfs_contexts
@@ -1,6 +1,8 @@
 genfscon sysfs /devices/system/chip-id/ap_hw_tune_str  u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/dvfs_version    u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/evt_ver         u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/lot_id          u:object_r:sysfs_chip_id:s0
+genfscon sysfs /devices/system/chip-id/pkg_revision    u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/product_id      u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/revision        u:object_r:sysfs_chip_id:s0
 genfscon sysfs /devices/system/chip-id/raw_str         u:object_r:sysfs_chip_id:s0
diff --git a/soc/soc.mk b/soc/soc.mk
index d08d99d..8ec9412 100644
--- a/soc/soc.mk
+++ b/soc/soc.mk
@@ -1,5 +1,5 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/soc/sepolicy/soc
 
 PRODUCT_PACKAGES += dump_soc
-PRODUCT_PACKAGES_DEBUG += dump_memory.sh
+PRODUCT_PACKAGES_DEBUG += dump_memory
 
diff --git a/sota_app/factoryota.mk b/sota_app/factoryota.mk
new file mode 100644
index 0000000..14ed2b5
--- /dev/null
+++ b/sota_app/factoryota.mk
@@ -0,0 +1,4 @@
+PRODUCT_PACKAGES += \
+    FactoryOtaPrebuilt
+
+SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/sota_app/sepolicy/system_ext
diff --git a/sota_app/sepolicy/system_ext/factory_ota_app.te b/sota_app/sepolicy/system_ext/factory_ota_app.te
new file mode 100644
index 0000000..f48adeb
--- /dev/null
+++ b/sota_app/sepolicy/system_ext/factory_ota_app.te
@@ -0,0 +1,32 @@
+type factory_ota_app, domain, coredomain;
+
+app_domain(factory_ota_app)
+net_domain(factory_ota_app)
+
+# Write to /data/ota_package for OTA packages.
+# Factory OTA client will download OTA image into ota_package folder and unzip it.
+# Than Update engine could use it to execute OTA process.
+# So Factory OTA client need read / write and create file access right for this folder
+allow factory_ota_app ota_package_file:dir rw_dir_perms;
+allow factory_ota_app ota_package_file:file create_file_perms;
+
+# Properties
+# For write system property persist.*
+set_prop(factory_ota_app, sota_prop);
+
+# Services
+# For get access WiFi manager service and activity service
+allow factory_ota_app app_api_service:service_manager find;
+# Allow Factory OTA to call Update Engine
+binder_call(factory_ota_app, update_engine)
+# Allow Update Engine to call the Factory OTA callback
+binder_call(update_engine, factory_ota_app)
+#For access update engine function
+allow factory_ota_app update_engine_service:service_manager find;
+#For disable NFC wake up device feature
+allow factory_ota_app nfc_service:service_manager find;
+#For get device IMEI
+allow factory_ota_app radio_service:service_manager find;
+
+# For suppress more GPU service sepolicy error log.
+dontaudit factory_ota_app gpuservice:binder call;
diff --git a/sota_app/sepolicy/system_ext/property_contexts b/sota_app/sepolicy/system_ext/property_contexts
new file mode 100644
index 0000000..deb34dc
--- /dev/null
+++ b/sota_app/sepolicy/system_ext/property_contexts
@@ -0,0 +1,5 @@
+ro.boot.sota                                    u:object_r:sota_prop:s0
+ro.boot.sota.                                   u:object_r:sota_prop:s0
+persist.vendor.factoryota.                      u:object_r:sota_prop:s0
+persist.vendor.radio.bootwithlpm                u:object_r:sota_prop:s0
+persist.vendor.nfc.factoryota.                  u:object_r:sota_prop:s0
diff --git a/sota_app/sepolicy/system_ext/seapp_contexts b/sota_app/sepolicy/system_ext/seapp_contexts
new file mode 100644
index 0000000..673f451
--- /dev/null
+++ b/sota_app/sepolicy/system_ext/seapp_contexts
@@ -0,0 +1,2 @@
+# Factory OTA
+user=_app seinfo=platform name=com.google.android.factoryota domain=factory_ota_app levelFrom=all
diff --git a/sota_app/sepolicy/system_ext/vendor_init.te b/sota_app/sepolicy/system_ext/vendor_init.te
new file mode 100644
index 0000000..11191e3
--- /dev/null
+++ b/sota_app/sepolicy/system_ext/vendor_init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, sota_prop)
diff --git a/storage/Android.bp b/storage/Android.bp
index 54e097e..5926545 100644
--- a/storage/Android.bp
+++ b/storage/Android.bp
@@ -2,9 +2,19 @@
     default_applicable_licenses: ["Android-Apache-2.0"],
 }
 
-sh_binary {
-    name: "dump_storage.sh",
-    src: "dump_storage.sh",
+cc_binary {
+    name: "dump_storage",
+    srcs: ["dump_storage.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+	"liblog",
+    ],
     vendor: true,
-    sub_dir: "dump",
+    relative_install_path: "dump",
 }
diff --git a/storage/dump_storage.cpp b/storage/dump_storage.cpp
new file mode 100644
index 0000000..bba1071
--- /dev/null
+++ b/storage/dump_storage.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <dump/pixel_dump.h>
+#include <android-base/file.h>
+#include <android-base/properties.h>
+#include <string.h>
+#include <stdio.h>
+#include <log/log.h>
+#include <regex>
+#include <fstream>
+
+#define F2FS_FSCK_TIME_PROPERTY "ro.boottime.init.fsck.data"
+#define F2FS_MNT_TIME_PROPERTY "ro.boottime.init.mount.data"
+#define BOOTDEVICE_PROPERTY "ro.boot.bootdevice"
+
+int main() {
+    //F2FS
+    dumpFileContent("F2FS status", "/sys/kernel/debug/f2fs/status");
+    dumpFileContent("F2FS fsck", "/dev/fscklogs/fsck");
+
+    int fsck_time = android::base::GetIntProperty(F2FS_FSCK_TIME_PROPERTY, 0);
+    printf("--- F2FS - fsck time (ms) ---\n%d\n\n", fsck_time);
+    int mnt_time = android::base::GetIntProperty(F2FS_MNT_TIME_PROPERTY, 0);
+    printf("--- F2FS - checkpoint=disable time (ms) ---\n%d\n\n", mnt_time);
+
+    //UFS
+    dumpFileContent("UFS model", "/sys/block/sda/device/model");
+    dumpFileContent("UFS rev", "/sys/block/sda/device/rev");
+    dumpFileContent("UFS size", "/sys/block/sda/size");
+
+    dumpFileContent("UFS Slow IO Read",
+                    "/dev/sys/block/bootdevice/slowio_read_cnt");
+    dumpFileContent("UFS Slow IO Write",
+                    "/dev/sys/block/bootdevice/slowio_write_cnt");
+    dumpFileContent("UFS Slow IO Unmap",
+                    "/dev/sys/block/bootdevice/slowio_unmap_cnt");
+    dumpFileContent("UFS Slow IO Sync",
+                    "/dev/sys/block/bootdevice/slowio_sync_cnt");
+
+    printf("------ UFS err_stats ------\n");
+    const std::string ufs_err_stats_path(
+            "/dev/sys/block/bootdevice/err_stats/");
+    std::unique_ptr<DIR, decltype(&closedir)> statdir(
+            opendir(ufs_err_stats_path.c_str()), closedir);
+    if (statdir) {
+        dirent *stat_entry;
+        while ((stat_entry = readdir(statdir.get())) != nullptr) {
+            std::string ufs_err_stats_path(stat_entry->d_name);
+            if (!strcmp(ufs_err_stats_path.c_str(), ".")
+                    || !strcmp(ufs_err_stats_path.c_str(), ".."))
+                continue;
+            std::string bootdevice = android::base::GetProperty(
+                    BOOTDEVICE_PROPERTY, "");
+            std::string err_stat_path = "/sys/devices/platform/";
+            err_stat_path.append(bootdevice.c_str());
+            err_stat_path.append("/err_stats/");
+            err_stat_path.append(ufs_err_stats_path.c_str());
+            std::ifstream err_stat_file(err_stat_path);
+            if (err_stat_file.is_open()) {
+                std::string err_stat_atom;
+                err_stat_file >> err_stat_atom;
+                printf("%s:%s\n", ufs_err_stats_path.c_str(),
+                       err_stat_atom.c_str());
+                err_stat_file.close();
+            }
+        }
+    }
+
+    printf("\n------ UFS io_stats ------\n");
+    printf("\t\t%-12s %-12s %-12s %-12s %-12s %-12s\n", "ReadCnt", "ReadBytes",
+           "WriteCnt", "WriteBytes", "RWCnt", "RWBytes");
+    const std::string ufs_io_stats = "/dev/sys/block/bootdevice/io_stats/";
+    const std::string iostats_seq[3] = {"_start", "_complete", "_maxdiff"};
+    const std::string iostats[6] = {"rcnt", "rbyte", "wcnt", "wbyte", "rwcnt",
+            "rwbyte"};
+
+    for (int i = 0; i < 3; i++) {
+        const std::string header[3] = {"Started: \t", "Completed: \t",
+                "MaxDiff: \t"};
+        printf("%s", header[i].c_str());
+        for (int j = 0; j < 6; j++) {
+            std::string iostat_path = ufs_io_stats.c_str();
+            iostat_path.append(iostats[j].c_str());
+            iostat_path.append(iostats_seq[i].c_str());
+            std::ifstream io_stats_file(iostat_path.c_str());
+            unsigned long io_stat_atom = 0;
+            if (io_stats_file.is_open()) {
+                io_stats_file >> io_stat_atom;
+                printf("%-12lu ", io_stat_atom);
+                io_stats_file.close();
+            }
+        }
+        printf("\n");
+    }
+
+    printf("\n------ UFS req_stats ------\n");
+    printf("\t%-12s %-12s %-12s %-12s %-12s %-12s\n", "All", "Write", "Read",
+           "Security", "Flush", "Discard");
+    const std::string ufs_req_stats = "/dev/sys/block/bootdevice/req_stats/";
+    const std::string reqstats_seq[4] = {"_min", "_max", "_avg", "_sum"};
+    const std::string reqstats[6] = {"all", "write", "read", "security",
+            "flush", "discard"};
+
+    for (int i = 0; i < 4; i++) {
+        const std::string header[4] = {"Min:\t", "Max: \t", "Avg: \t",
+                "Count: \t"};
+        printf("%s", header[i].c_str());
+        for (int j = 0; j < 6; j++) {
+            std::string reqstat_path = ufs_req_stats.c_str();
+            reqstat_path.append(reqstats[j].c_str());
+            reqstat_path.append(reqstats_seq[i].c_str());
+            std::ifstream req_stats_file(reqstat_path.c_str());
+            unsigned long req_stat_atom = 0;
+            if (req_stats_file.is_open()) {
+                req_stats_file >> req_stat_atom;
+                printf("%-12lu ", req_stat_atom);
+                req_stats_file.close();
+            }
+        }
+        printf("\n");
+    }
+
+    printf("\n------ UFS health ------\n");
+    dumpFileContent(
+            "",
+            "/dev/sys/block/bootdevice/health_descriptor/life_time_estimation_a");
+    dumpFileContent(
+            "",
+            "/dev/sys/block/bootdevice/health_descriptor/life_time_estimation_b");
+    dumpFileContent("", "/dev/sys/block/bootdevice/health_descriptor/eol_info");
+    dumpFileContent(
+            "",
+            "/dev/sys/block/bootdevice/health_descriptor/life_time_estimation_c");
+
+    return 0;
+}
diff --git a/storage/dump_storage.sh b/storage/dump_storage.sh
deleted file mode 100644
index 5f08fc1..0000000
--- a/storage/dump_storage.sh
+++ /dev/null
@@ -1,68 +0,0 @@
-#!/vendor/bin/sh
-# F2FS
-echo "--- F2FS status---"
-cat "/sys/kernel/debug/f2fs/status"
-echo "\n--- F2FS fsck ---"
-cat "/dev/fscklogs/fsck"
-echo "\n--- F2FS - fsck time (ms) ---"
-getprop ro.boottime.init.fsck.data
-echo "\n--- F2FS - checkpoint=disable time (ms) ---"
-getprop ro.boottime.init.mount.data
-
-# UFS
-echo "\n------ UFS model (/sys/block/sda/device/model) ------"
-cat "/sys/block/sda/device/model"
-echo "\n------ UFS rev (/sys/block/sda/device/rev) ------"
-cat "/sys/block/sda/device/rev"
-echo "\n------ UFS size (/sys/block/sda/size) ------"
-cat "/sys/block/sda/size"
-
-echo "\n------ UFS Slow IO Read (/dev/sys/block/bootdevice/slowio_read_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_read_cnt"
-echo "\n------ UFS Slow IO Write (/dev/sys/block/bootdevice/slowio_write_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_write_cnt"
-echo "\n------ UFS Slow IO Unmap (/dev/sys/block/bootdevice/slowio_unmap_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_unmap_cnt"
-echo "\n------ UFS Slow IO Sync (/dev/sys/block/bootdevice/slowio_sync_cnt) ------"
-cat "/dev/sys/block/bootdevice/slowio_sync_cnt"
-
-echo "\n------ UFS err_stats ------"
-path="/dev/sys/block/bootdevice/err_stats";
-for node in `ls $path/* | grep -v reset_err_status`
-do
-  printf "%s:%d\n" $(basename $node) $(cat $node)
-done
-
-
-echo "\n------ UFS io_stats ------"
-path="/dev/sys/block/bootdevice/io_stats"
-printf "\t\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ReadCnt ReadBytes WriteCnt WriteBytes RWCnt RWBytes
-str=$(cat $path/*_start); arr=($str);
-printf "Started: \t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[1]} ${arr[0]} ${arr[5]} ${arr[4]} ${arr[3]} ${arr[2]}
-str=$(cat $path/*_complete); arr=($str);
-printf "Completed: \t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[1]} ${arr[0]} ${arr[5]} ${arr[4]} ${arr[3]} ${arr[2]}
-str=$(cat $path/*_maxdiff); arr=($str);
-printf "MaxDiff: \t%-12s %-12s %-12s %-12s %-12s %-12s\n\n" ${arr[1]} ${arr[0]} ${arr[5]} ${arr[4]} ${arr[3]} ${arr[2]}
-
-echo "\n------ UFS req_stats ------"
-path="/dev/sys/block/bootdevice/req_stats"
-printf "\t%-12s %-12s %-12s %-12s %-12s %-12s\n" All Write Read Security Flush Discard
-str=$(cat $path/*_min); arr=($str);
-printf "Min:\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-str=$(cat $path/*_max); arr=($str);
-printf "Max:\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-str=$(cat $path/*_avg); arr=($str);
-printf "Avg.:\t%-12s %-12s %-12s %-12s %-12s %-12s\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-str=$(cat $path/*_sum); arr=($str);
-printf "Count:\t%-12s %-12s %-12s %-12s %-12s %-12s\n\n" ${arr[0]} ${arr[5]} ${arr[3]} ${arr[4]} ${arr[2]} ${arr[1]}
-
-echo "\n------ UFS health ------"
-for f in $(find /dev/sys/block/bootdevice/health_descriptor -type f)
-do
-  if [[ -r $f && -f $f ]]; then
-    echo --- $f
-    cat $f
-    echo ''
-  fi
-done
-
diff --git a/storage/sepolicy/dump_storage.te b/storage/sepolicy/dump_storage.te
index 9411f8e..a404ee2 100644
--- a/storage/sepolicy/dump_storage.te
+++ b/storage/sepolicy/dump_storage.te
@@ -1,6 +1,5 @@
 pixel_bugreport(dump_storage)
 
-allow dump_storage vendor_toolbox_exec:file execute_no_trans;
 allow dump_storage sysfs_scsi_devices_0000:dir r_dir_perms;
 allow dump_storage sysfs_scsi_devices_0000:file r_file_perms;
 
diff --git a/storage/sepolicy/file_contexts b/storage/sepolicy/file_contexts
index eda4cf7..e4e41cb 100644
--- a/storage/sepolicy/file_contexts
+++ b/storage/sepolicy/file_contexts
@@ -1 +1 @@
-/vendor/bin/dump/dump_storage\.sh      u:object_r:dump_storage_exec:s0
+/vendor/bin/dump/dump_storage      u:object_r:dump_storage_exec:s0
diff --git a/storage/storage.mk b/storage/storage.mk
index cd0556d..ee7110c 100644
--- a/storage/storage.mk
+++ b/storage/storage.mk
@@ -1,6 +1,6 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/storage/sepolicy
 
-PRODUCT_PACKAGES += dump_storage.sh
+PRODUCT_PACKAGES += dump_storage
 
 # Pixel storage tool
 PRODUCT_PACKAGES_DEBUG += \
diff --git a/thermal/dump_thermal.sh b/thermal/dump_thermal.sh
index 2b87da9..288d34d 100644
--- a/thermal/dump_thermal.sh
+++ b/thermal/dump_thermal.sh
@@ -1,46 +1,46 @@
 #!/vendor/bin/sh
 
-echo "Temperatures"
+echo 'Temperatures'
 for f in /sys/class/thermal/thermal* ; do
-  printf "%s: %s\n" `cat $f/type` `cat $f/temp`
+  echo `cat $f/type`: `cat $f/temp`
 done
 
-echo "Cooling Device Current State"
+echo 'Cooling Device Current State'
 for f in /sys/class/thermal/cooling* ; do
-  printf "%s: %s\n" `cat $f/type` `cat $f/cur_state`
+  echo `cat $f/type`: `cat $f/cur_state`
 done
 
-echo "Cooling Device User Vote State"
+echo 'Cooling Device User Vote State'
 for f in /sys/class/thermal/cooling* ; do
-  if [ ! -f $f/user_vote ]; then continue; fi;
-  printf "%s: %s\n" `cat $f/type` `cat $f/user_vote`
+  if ! [ -r $f/user_vote ]; then continue; fi;
+  echo `cat $f/type`: `cat $f/user_vote`
 done
 
-echo "Cooling Device Time in State"
+echo 'Cooling Device Time in State'
 for f in /sys/class/thermal/cooling* ; do
-  printf "%s: %s\n" `cat $f/type` `cat $f/stats/time_in_state_ms`
+  echo `cat $f/type`: `cat $f/stats/time_in_state_ms`
 done
 
-echo "Cooling Device Trans Table"
+echo 'Cooling Device Trans Table'
 for f in /sys/class/thermal/cooling* ; do
-  printf "%s: %s\n" `cat $f/type` `cat $f/stats/trans_table`
+  echo `cat $f/type`: `cat $f/stats/trans_table`
 done
 
-echo "Cooling Device State2Power Table"
+echo 'Cooling Device State2Power Table'
 for f in /sys/class/thermal/cooling* ; do
-  if [ ! -f $f/state2power_table ]; then continue; fi;
-  printf "%s: %s\n" `cat $f/type` `cat $f/state2power_table`
+  if ! [ -r $f/state2power_table ]; then continue; fi;
+  echo `cat $f/type`: `cat $f/state2power_table`
 done
 
-echo "TMU state:"
+echo 'TMU state:'
 cat /sys/module/gs_thermal/parameters/tmu_reg_dump_state
-echo "TMU current temperature:"
+echo 'TMU current temperature:'
 cat /sys/module/gs_thermal/parameters/tmu_reg_dump_current_temp
-echo "TMU_TOP rise thresholds:"
+echo 'TMU_TOP rise thresholds:'
 cat /sys/module/gs_thermal/parameters/tmu_top_reg_dump_rise_thres
-echo "TMU_TOP fall thresholds:"
+echo 'TMU_TOP fall thresholds:'
 cat /sys/module/gs_thermal/parameters/tmu_top_reg_dump_fall_thres
-echo "TMU_SUB rise thresholds:"
+echo 'TMU_SUB rise thresholds:'
 cat /sys/module/gs_thermal/parameters/tmu_sub_reg_dump_rise_thres
-echo "TMU_SUB fall thresholds:"
+echo 'TMU_SUB fall thresholds:'
 cat /sys/module/gs_thermal/parameters/tmu_sub_reg_dump_fall_thres
diff --git a/touch/gti/dump_gti0.sh b/touch/gti/dump_gti0.sh
index 40886e0..a3af3d7 100644
--- a/touch/gti/dump_gti0.sh
+++ b/touch/gti/dump_gti0.sh
@@ -9,7 +9,26 @@
 fi
 
 echo "------ Force Touch Active ------"
-echo 1 > $path/force_active
+result=$( cat "$path/force_active" 2>&1 )
+if [ $? -eq 0 ]; then
+    state=$( echo "$result" |cut -d " " -f 2 )
+    if [ "$state" = "locked" ]; then
+        echo "The force_active is already locked!"
+    else
+        echo 1 > $path/force_active
+        if [ $? -ne 0  ]; then
+            echo "Failed to active touch device"
+            exit 1
+        fi
+    fi
+else
+    if [[ $result == *Operation\ not\ supported* ]]; then
+        echo "force_active is not support, skip it"
+    else
+        echo "Failed to read the state of force_force"
+        exit 1
+    fi
+fi
 
 echo "------ Touch Firmware Version ------"
 cat $path/fw_ver
@@ -41,5 +60,10 @@
 echo "------ Self Test ------"
 cat $path/self_test
 
+if [[ -f "${procfs_path}/dump" ]]; then
+  echo "------ Dump ------"
+  cat ${procfs_path}/dump
+fi
+
 echo "------ Disable Force Touch Active ------"
 echo 0 > $path/force_active
diff --git a/touch/gti/dump_gti1.sh b/touch/gti/dump_gti1.sh
index 79aa5fb..297ad44 100644
--- a/touch/gti/dump_gti1.sh
+++ b/touch/gti/dump_gti1.sh
@@ -9,7 +9,26 @@
 fi
 
 echo "------ Force Touch Active ------"
-echo 1 > $path/force_active
+result=$( cat "$path/force_active" 2>&1 )
+if [ $? -eq 0 ]; then
+    state=$( echo "$result" |cut -d " " -f 2 )
+    if [ "$state" = "locked" ]; then
+        echo "The force_active is already locked!"
+    else
+        echo 1 > $path/force_active
+        if [ $? -ne 0  ]; then
+            echo "Failed to active touch device"
+            exit 1
+        fi
+    fi
+else
+    if [[ $result == *Operation\ not\ supported* ]]; then
+        echo "force_active is not support, skip it"
+    else
+        echo "Failed to read the state of force_force"
+        exit 1
+    fi
+fi
 
 echo "------ Touch Firmware Version ------"
 cat $path/fw_ver
@@ -41,5 +60,10 @@
 echo "------ Self Test ------"
 cat $path/self_test
 
+if [[ -f "${procfs_path}/dump" ]]; then
+  echo "------ Dump ------"
+  cat ${procfs_path}/dump
+fi
+
 echo "------ Disable Force Touch Active ------"
 echo 0 > $path/force_active
diff --git a/touch/gti/init.touch.gti0.rc b/touch/gti/init.touch.gti0.rc
index 5489ff8..baf03dd 100644
--- a/touch/gti/init.touch.gti0.rc
+++ b/touch/gti/init.touch.gti0.rc
@@ -15,6 +15,7 @@
     # Procfs
     chown system system /proc/goog_touch_interface
     chown system system /proc/goog_touch_interface/gti.0
+    chown system system /proc/goog_touch_interface/gti.0/dump
     chown system system /proc/goog_touch_interface/gti.0/ms_base
     chown system system /proc/goog_touch_interface/gti.0/ms_diff
     chown system system /proc/goog_touch_interface/gti.0/ms_raw
diff --git a/touch/gti/init.touch.gti1.rc b/touch/gti/init.touch.gti1.rc
index 28c8204..d8a37e4 100644
--- a/touch/gti/init.touch.gti1.rc
+++ b/touch/gti/init.touch.gti1.rc
@@ -15,6 +15,7 @@
     # Procfs
     chown system system /proc/goog_touch_interface
     chown system system /proc/goog_touch_interface/gti.1
+    chown system system /proc/goog_touch_interface/gti.1/dump
     chown system system /proc/goog_touch_interface/gti.1/ms_base
     chown system system /proc/goog_touch_interface/gti.1/ms_diff
     chown system system /proc/goog_touch_interface/gti.1/ms_raw
diff --git a/touch/syna/dump_syna.sh b/touch/syna/dump_syna.sh
index d30ff36..d749eff 100644
--- a/touch/syna/dump_syna.sh
+++ b/touch/syna/dump_syna.sh
@@ -1,5 +1,5 @@
 #!/vendor/bin/sh
-path="/sys/devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs"
+path=`getprop ro.vendor.touch.dump.sys`
 
 echo "Enable Force Touch Active"
 echo 21 > $path/force_active
diff --git a/touch/syna/sepolicy/dump_syna.te b/touch/syna/sepolicy/dump_syna.te
index 38655e7..fb9705c 100644
--- a/touch/syna/sepolicy/dump_syna.te
+++ b/touch/syna/sepolicy/dump_syna.te
@@ -3,3 +3,6 @@
 allow dump_syna sysfs_touch:dir r_dir_perms;
 allow dump_syna sysfs_touch:file rw_file_perms;
 allow dump_syna vendor_toolbox_exec:file execute_no_trans;
+
+get_prop(dump_syna, vendor_touch_dump_path_prop)
+
diff --git a/touch/syna/sepolicy/genfs_contexts b/touch/syna/sepolicy/genfs_contexts
index de55bf3..2a8f9e3 100644
--- a/touch/syna/sepolicy/genfs_contexts
+++ b/touch/syna/sepolicy/genfs_contexts
@@ -1,2 +1,3 @@
 genfscon sysfs /devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
 
diff --git a/touch/syna/sepolicy/property.te b/touch/syna/sepolicy/property.te
new file mode 100644
index 0000000..5484690
--- /dev/null
+++ b/touch/syna/sepolicy/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_touch_dump_path_prop)
diff --git a/touch/syna/sepolicy/property_contexts b/touch/syna/sepolicy/property_contexts
new file mode 100644
index 0000000..524cc8b
--- /dev/null
+++ b/touch/syna/sepolicy/property_contexts
@@ -0,0 +1 @@
+ro.vendor.touch.dump. u:object_r:vendor_touch_dump_path_prop:s0
diff --git a/touch/syna/sepolicy/vendor_init.te b/touch/syna/sepolicy/vendor_init.te
new file mode 100644
index 0000000..74a6666
--- /dev/null
+++ b/touch/syna/sepolicy/vendor_init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, vendor_touch_dump_path_prop)
diff --git a/touch/syna/syna.mk b/touch/syna/syna.mk
deleted file mode 100644
index 7f137a0..0000000
--- a/touch/syna/syna.mk
+++ /dev/null
@@ -1,3 +0,0 @@
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
-
-PRODUCT_PACKAGES += dump_syna.sh
diff --git a/touch/syna/syna0.mk b/touch/syna/syna0.mk
new file mode 100644
index 0000000..fe2b0c5
--- /dev/null
+++ b/touch/syna/syna0.mk
@@ -0,0 +1,5 @@
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
+
+PRODUCT_PACKAGES += dump_syna.sh
diff --git a/touch/syna/syna20.mk b/touch/syna/syna20.mk
new file mode 100644
index 0000000..600f1ff
--- /dev/null
+++ b/touch/syna/syna20.mk
@@ -0,0 +1,5 @@
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
+
+PRODUCT_PACKAGES += dump_syna.sh
diff --git a/touch/touchinspector/sepolicy/file.te b/touch/touchinspector/sepolicy/file.te
new file mode 100644
index 0000000..f9468a0
--- /dev/null
+++ b/touch/touchinspector/sepolicy/file.te
@@ -0,0 +1,3 @@
+userdebug_or_eng(`
+    typeattribute proc_touch mlstrustedobject;
+')
diff --git a/touch/touchinspector/sepolicy/google_touch_app.te b/touch/touchinspector/sepolicy/google_touch_app.te
new file mode 100644
index 0000000..0c6928d
--- /dev/null
+++ b/touch/touchinspector/sepolicy/google_touch_app.te
@@ -0,0 +1,9 @@
+type google_touch_app, domain;
+
+userdebug_or_eng(`
+  app_domain(google_touch_app)
+
+  allow google_touch_app app_api_service:service_manager find;
+
+  allow google_touch_app proc_touch:file rw_file_perms;
+')
diff --git a/touch/touchinspector/sepolicy/seapp_contexts b/touch/touchinspector/sepolicy/seapp_contexts
new file mode 100644
index 0000000..659caf4
--- /dev/null
+++ b/touch/touchinspector/sepolicy/seapp_contexts
@@ -0,0 +1,2 @@
+# Touch app
+user=_app seinfo=platform name=com.google.touch.touchinspector domain=google_touch_app type=app_data_file levelFrom=user
diff --git a/touch/touchinspector/touchinspector.mk b/touch/touchinspector/touchinspector.mk
new file mode 100644
index 0000000..d17d8dc
--- /dev/null
+++ b/touch/touchinspector/touchinspector.mk
@@ -0,0 +1,3 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/touchinspector/sepolicy
+
+PRODUCT_PACKAGES_DEBUG += TouchInspector
diff --git a/wireless_charger/compatibility_matrix.xml b/wireless_charger/compatibility_matrix.xml
index d0adcde..85ee65a 100644
--- a/wireless_charger/compatibility_matrix.xml
+++ b/wireless_charger/compatibility_matrix.xml
@@ -1,4 +1,4 @@
-<compatibility-matrix version="1.0" type="framework" level="7">
+<compatibility-matrix version="1.0" type="framework">
     <hal format="aidl" optional="true">
         <name>vendor.google.wireless_charger</name>
         <version>1</version>