diff --git a/aoc/aoc.mk b/aoc/aoc.mk
index 2eadb08..136bb42 100644
--- a/aoc/aoc.mk
+++ b/aoc/aoc.mk
@@ -1,7 +1,8 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/aoc/sepolicy
 
 PRODUCT_PACKAGES += dump_aoc \
-		    aocd
+		    aocd \
+		    aocxd
 
 ifeq (,$(filter aosp_%,$(TARGET_PRODUCT)))
 # IAudioMetricExt HIDL
@@ -23,4 +24,5 @@
 	aocdump \
 	aocutil \
 	aoc_audio_cfg \
-	vp_util
+	vp_util \
+	aocx_tool
diff --git a/aoc/dump_aoc.cpp b/aoc/dump_aoc.cpp
index 8d5278d..b3827c8 100644
--- a/aoc/dump_aoc.cpp
+++ b/aoc/dump_aoc.cpp
@@ -32,10 +32,6 @@
     runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_a32");
     runCommand("AoC memory votes", "timeout 0.1 cat /sys/devices/platform/*.aoc/control/memory_votes_ff1");
     runCommand("clean AoC buffer","echo ' ' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (A32)", "echo 'dbg heap -c 1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (F1)", "echo 'dbg heap -c 2' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (HF0)", "echo 'dbg heap -c 3' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
-    runCommand("AoC Heap Stats (HF1)", "echo 'dbg heap -c 4' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC DVFS (FF1)", "echo 'dbg info -c 2 DVFSFF1' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     runCommand("AoC Monitor Mode Status", "echo 'monitor_mode status' > /dev/acd-debug; timeout 0.1 cat /dev/acd-debug");
     return 0;
diff --git a/aoc/sepolicy/aocxd.te b/aoc/sepolicy/aocxd.te
new file mode 100644
index 0000000..bcfcd7b
--- /dev/null
+++ b/aoc/sepolicy/aocxd.te
@@ -0,0 +1,28 @@
+# aocxd server domain
+type aocxd, domain;
+type aocxd_exec, vendor_file_type, exec_type, file_type;
+init_daemon_domain(aocxd)
+
+# sysfs operations
+allow aocxd sysfs_aoc:dir search;
+
+# dev operations
+allow aocxd aoc_device:chr_file rw_file_perms;
+
+# allow inotify to watch for additions/removals from /dev
+allow aocxd device:dir r_dir_perms;
+
+# set properties
+set_prop(aocxd, vendor_aoc_prop);
+
+# allow binder access
+vndbinder_use(aocxd);
+
+# allow managing wakelocks
+wakelock_use(aocxd);
+
+# add aocx service to the domain
+add_service(aocxd, aocx);
+
+# allow managing thread priority
+allow aocxd self:global_capability_class_set sys_nice;
diff --git a/aoc/sepolicy/file_contexts b/aoc/sepolicy/file_contexts
index 58edf2f..c43bc75 100644
--- a/aoc/sepolicy/file_contexts
+++ b/aoc/sepolicy/file_contexts
@@ -27,11 +27,14 @@
 /dev/acd-audio_ap_offload_rx        u:object_r:aoc_device:s0
 /dev/acd-audio_ap_offload_tx        u:object_r:aoc_device:s0
 /dev/acd-mel_processor              u:object_r:aoc_device:s0
+/dev/acd-aocx_control               u:object_r:aoc_device:s0
+/dev/acd-mc_headpos                 u:object_r:aoc_device:s0
 
 # AoC vendor binaries
 /vendor/bin/aocd                    u:object_r:aocd_exec:s0
 /vendor/bin/aocdump                 u:object_r:aocdump_exec:s0
 /vendor/bin/dump/dump_aoc           u:object_r:dump_aoc_exec:s0
+/vendor/bin/aocxd                   u:object_r:aocxd_exec:s0
 
 # AoC audio files
 /vendor/etc/aoc(/.*)?               u:object_r:aoc_audio_file:s0
diff --git a/aoc/sepolicy/vndservice.te b/aoc/sepolicy/vndservice.te
new file mode 100644
index 0000000..01c2436
--- /dev/null
+++ b/aoc/sepolicy/vndservice.te
@@ -0,0 +1 @@
+type aocx, vndservice_manager_type;
diff --git a/aoc/sepolicy/vndservice_contexts b/aoc/sepolicy/vndservice_contexts
new file mode 100644
index 0000000..de31e51
--- /dev/null
+++ b/aoc/sepolicy/vndservice_contexts
@@ -0,0 +1 @@
+aocx.IAocx    u:object_r:aocx:s0
diff --git a/audio/aidl.mk b/audio/aidl.mk
index bd11249..b8fd96b 100644
--- a/audio/aidl.mk
+++ b/audio/aidl.mk
@@ -1,3 +1,4 @@
+
 DEVICE_MANIFEST_FILE += device/google/gs-common/audio/aidl/manifest.xml
 
 # Audio HALs
@@ -17,6 +18,7 @@
     libdownmixaidl \
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/aidl
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio
 
 include device/google/gs-common/audio/common.mk
 
@@ -24,3 +26,7 @@
 
 PRODUCT_PROPERTY_OVERRIDES += \
        vendor.audio_hal.aidl.enable=true
+PRODUCT_SYSTEM_EXT_PROPERTIES += \
+       ro.audio.ihaladaptervendorextension_enabled=true
+
+$(call soong_config_set,pixel_audio_hal_type,aidl_build,true)
diff --git a/audio/common.mk b/audio/common.mk
index 4157970..edf7b6a 100644
--- a/audio/common.mk
+++ b/audio/common.mk
@@ -6,7 +6,7 @@
 	libmahalcontroller \
 	libAlgFx_HiFi3z
 
-ifneq ($(RELEASE_PIXEL_AIDL_AUDIO_HAL),true)
+ifneq ($(USE_AUDIO_HAL_AIDL),true)
 ## AudioHAL Configurations
 PRODUCT_COPY_FILES += \
 	frameworks/av/services/audiopolicy/config/a2dp_audio_policy_configuration_7_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/a2dp_audio_policy_configuration_7_0.xml \
diff --git a/audio/hidl_zuma.mk b/audio/hidl_zuma.mk
index d671f46..41dd02a 100644
--- a/audio/hidl_zuma.mk
+++ b/audio/hidl_zuma.mk
@@ -31,6 +31,7 @@
 	audio.bluetooth.default \
 	audio.r_submix.default \
 	audio_spk_35l41 \
+	audio_spk_tas25xx \
 	audio_hdmi_aoc \
 	sound_trigger.primary.$(TARGET_BOARD_PLATFORM)
 
diff --git a/audio/sepolicy/aidl/service.te b/audio/sepolicy/aidl/service.te
index cbdc404..d931f16 100644
--- a/audio/sepolicy/aidl/service.te
+++ b/audio/sepolicy/aidl/service.te
@@ -1,3 +1,3 @@
 # Audio
 type hal_audio_ext_service, hal_service_type, service_manager_type;
-type hal_audio_parameter_parser_service, service_manager_type;
+type hal_audio_parameter_parser_service, service_manager_type;
\ No newline at end of file
diff --git a/audio/sepolicy/aidl/service_contexts b/audio/sepolicy/aidl/service_contexts
index c2b7716..7a7d61d 100644
--- a/audio/sepolicy/aidl/service_contexts
+++ b/audio/sepolicy/aidl/service_contexts
@@ -1,4 +1,3 @@
 # Audio
 vendor.google.whitechapel.audio.extension.IAudioExtension/default    u:object_r:hal_audio_ext_service:s0
-android.media.audio.IHalAdapterVendorExtension/default               u:object_r:hal_audio_parameter_parser_service:s0
-
+android.media.audio.IHalAdapterVendorExtension/default               u:object_r:hal_audio_parameter_parser_service:s0
\ No newline at end of file
diff --git a/audio/sepolicy/common/hal_audio_default.te b/audio/sepolicy/common/hal_audio_default.te
index c69e339..bfe72b1 100644
--- a/audio/sepolicy/common/hal_audio_default.te
+++ b/audio/sepolicy/common/hal_audio_default.te
@@ -34,3 +34,7 @@
 ')
 
 wakelock_use(hal_audio_default);
+
+vndbinder_use(hal_audio_default);
+allow hal_audio_default aocx:service_manager find;
+binder_call(hal_audio_default, aocxd);
diff --git a/battery_mitigation/Android.bp b/battery_mitigation/Android.bp
deleted file mode 100644
index c919de5..0000000
--- a/battery_mitigation/Android.bp
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-soong_namespace {
-    imports: [
-        "hardware/google/pixel",
-    ],
-}
-
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-cc_binary {
-    vendor: true,
-    name: "battery_mitigation",
-    relative_install_path: "hw",
-    proprietary: true,
-    init_rc: ["battery_mitigation.rc"],
-    shared_libs: [
-        "libpixelmitigation",
-        "libbase",
-        "libbinder_ndk",
-        "libcutils",
-        "libhardware",
-        "liblog",
-        "libutils",
-        "android.hardware.thermal@2.0",
-        "android.hardware.thermal-V1-ndk"
-    ],
-    srcs: [
-        "battery_mitigation.cpp",
-    ],
-    cflags: [
-        "-Wall",
-        "-Werror",
-    ],
-}
diff --git a/battery_mitigation/battery_mitigation.cpp b/battery_mitigation/battery_mitigation.cpp
deleted file mode 100644
index fb81b20..0000000
--- a/battery_mitigation/battery_mitigation.cpp
+++ /dev/null
@@ -1,220 +0,0 @@
-/*
- * Copyright (C) 2022 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "battery-mitigation"
-
-#include <android/binder_process.h>
-#include <battery_mitigation/BatteryMitigation.h>
-#include <battery_mitigation/BatteryMitigationService.h>
-#include <sys/resource.h>
-#include <system/thread_defs.h>
-
-#define COUNT_LIMIT 10
-
-using android::hardware::google::pixel::BatteryMitigation;
-using android::hardware::google::pixel::BatteryMitigationService;
-using android::hardware::google::pixel::MitigationConfig;
-
-android::sp<BatteryMitigation> bmSp;
-android::sp<BatteryMitigationService> batteryMitigationService;
-
-const struct MitigationConfig::Config cfg = {
-    .SystemPath = {
-        "/dev/thermal/tz-by-name/batoilo/temp",
-        "/dev/thermal/tz-by-name/smpl_gm/temp",
-        "/dev/thermal/tz-by-name/soc/temp",
-        "/dev/thermal/tz-by-name/vdroop1/temp",
-        "/dev/thermal/tz-by-name/vdroop2/temp",
-        "/dev/thermal/tz-by-name/ocp_gpu/temp",
-        "/dev/thermal/tz-by-name/ocp_tpu/temp",
-        "/dev/thermal/tz-by-name/soft_ocp_cpu2/temp",
-        "/dev/thermal/tz-by-name/soft_ocp_cpu1/temp",
-        "/dev/thermal/tz-by-name/battery/temp",
-        "/dev/thermal/tz-by-name/battery_cycle/temp",
-        "/sys/bus/iio/devices/iio:device0/lpf_power",
-        "/sys/bus/iio/devices/iio:device1/lpf_power",
-        "/dev/thermal/cdev-by-name/thermal-cpufreq-2/cur_state",
-        "/dev/thermal/cdev-by-name/thermal-cpufreq-1/cur_state",
-        "/dev/thermal/cdev-by-name/thermal-gpufreq-0/cur_state",
-        "/dev/thermal/cdev-by-name/tpu_cooling/cur_state",
-        "/dev/thermal/cdev-by-name/CAM/cur_state",
-        "/dev/thermal/cdev-by-name/DISP/cur_state",
-        "/dev/thermal/cdev-by-name/gxp-cooling/cur_state",
-        "/sys/class/power_supply/battery/voltage_now",
-        "/sys/class/power_supply/battery/current_now",
-    },
-    .FilteredZones = {
-        "batoilo",
-        "vdroop1",
-        "vdroop2",
-        "smpl_gm",
-    },
-    .SystemName = {
-        "batoilo", "smpl_gm", "soc", "vdroop1", "vdroop2", "ocp_gpu",
-        "ocp_tpu", "soft_ocp_cpu2", "soft_ocp_cpu1", "battery", "battery_cycle",
-        "main", "sub", "CPU2", "CPU1", "GPU", "TPU", "CAM", "DISP", "NPU",
-        "voltage_now", "current_now",
-    },
-    .LogFilePath = "/data/vendor/mitigation/thismeal.txt",
-    .TimestampFormat = "%Y-%m-%d %H:%M:%S",
-};
-
-const struct MitigationConfig::EventThreadConfig eventThreadCfg = {
-    .NumericSysfsStatPaths = {
-        {"cpu0_freq", "/sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq"},
-        {"cpu1_freq", "/sys/devices/system/cpu/cpu1/cpufreq/scaling_cur_freq"},
-        {"cpu2_freq", "/sys/devices/system/cpu/cpu2/cpufreq/scaling_cur_freq"},
-        {"battery_temp", "/dev/thermal/tz-by-name/battery/temp"},
-        {"battery_cycle", "/dev/thermal/tz-by-name/battery_cycle/temp"},
-        {"voltage_now", "/sys/class/power_supply/battery/voltage_now"},
-        {"current_now", "/sys/class/power_supply/battery/current_now"},
-    },
-    .TriggeredIdxPath = "/sys/devices/virtual/pmic/mitigation/br_stats/triggered_idx",
-    .triggeredStatePath[android::hardware::google::pixel::UVLO1] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/uvlo1_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::UVLO2] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/uvlo2_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::OILO1] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/oilo1_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::OILO2] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/oilo2_triggered",
-    .triggeredStatePath[android::hardware::google::pixel::SMPL] =
-        "/sys/devices/virtual/pmic/mitigation/triggered_state/smpl_triggered",
-    .BrownoutStatsPath = "/sys/devices/virtual/pmic/mitigation/br_stats/stats",
-    .StoringPath = "/data/vendor/mitigation/thismeal.bin",
-    .ParsedThismealPath = "/data/vendor/mitigation/thismeal.txt",
-    .ParsedLastmealPath = "/data/vendor/mitigation/lastmeal.txt",
-    .ParsedLastmealCSVPath = "/data/vendor/mitigation/lastmeal.csv",
-    .FvpStatsPath = "/sys/devices/platform/acpm_stats/fvp_stats",
-    .PmicCommon = {
-                /* Main Pmic */
-                {
-                    .OdpmDir = "/sys/bus/iio/devices/iio:device0",
-                    .OdpmEnabledRailsPath = "/sys/bus/iio/devices/iio:device0/enabled_rails",
-                    .PmicNamePath = "/sys/bus/iio/devices/iio:device0/name",
-                },
-                /* Sub Pmic */
-                {
-                    .OdpmDir = "/sys/bus/iio/devices/iio:device1",
-                    .OdpmEnabledRailsPath = "/sys/bus/iio/devices/iio:device1/enabled_rails",
-                    .PmicNamePath = "/sys/bus/iio/devices/iio:device1/name",
-                },
-    },
-    .PlatformSpecific = {
-                .NumericSysfsStatPaths = {
-                    {
-                        .name = "battery_soc",
-                        .paths = {
-                            "/sys/class/power_supply/max77759fg/capacity",
-                            "/sys/class/power_supply/max77779fg/capacity",
-                        },
-                    },
-                    {
-                        .name = "gpu_freq",
-                        .paths = {
-                            "/sys/devices/platform/1c500000.mali/cur_freq",
-                            "/sys/devices/platform/28000000.mali/cur_freq",
-                            "/sys/devices/platform/1f000000.mali/cur_freq",
-                        },
-                    },
-
-                },
-    },
-};
-
-const char kReadyFilePath[] = "/sys/devices/virtual/pmic/mitigation/instruction/ready";
-const char kReadyProperty[] = "vendor.brownout.mitigation.ready";
-const char kLastMealPath[] = "/data/vendor/mitigation/lastmeal.txt";
-const char kBRRequestedProperty[] = "vendor.brownout_reason";
-const char kLastMealProperty[] = "vendor.brownout.br.feasible";
-const std::regex kTimestampRegex("^\\S+\\s[0-9]+:[0-9]+:[0-9]+\\S+$");
-
-int main(int argc, char **argv) {
-    batteryMitigationService = new BatteryMitigationService(eventThreadCfg);
-    if (!batteryMitigationService) {
-        return 0;
-    }
-    bool brownoutStatsBinarySupported = batteryMitigationService->isBrownoutStatsBinarySupported();
-    if (argc == 2) {
-        if(strcmp(argv[1], "-d") == 0 &&
-           brownoutStatsBinarySupported) {
-            /* Create thismeal.txt from thismeal.bin */
-            batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedThismealPath);
-        }
-        return 0;
-    }
-
-    setpriority(PRIO_PROCESS, 0, ANDROID_PRIORITY_AUDIO);
-    auto batteryMitigationStartTime = std::chrono::system_clock::now();
-    ABinderProcess_setThreadPoolMaxThreadCount(1);
-    ABinderProcess_startThreadPool();
-
-    bool mitigationLogTimeValid;
-    std::string reason = android::base::GetProperty(kBRRequestedProperty, "");
-    if (brownoutStatsBinarySupported) {
-        /* Create lastmeal.txt if the dump time in thismeal.bin are valid */
-        mitigationLogTimeValid = batteryMitigationService->isTimeValid(eventThreadCfg.StoringPath,
-                                                                       batteryMitigationStartTime);
-        if (!reason.empty() && mitigationLogTimeValid &&
-            batteryMitigationService->genParsedMeal(eventThreadCfg.ParsedLastmealPath) &&
-            batteryMitigationService->genLastmealCSV(eventThreadCfg.ParsedLastmealCSVPath)) {
-            android::base::SetProperty(kLastMealProperty, "1");
-        }
-    } else{
-        bmSp = new BatteryMitigation(cfg);
-        if (!bmSp) {
-            return 0;
-        }
-        mitigationLogTimeValid = bmSp->isMitigationLogTimeValid(batteryMitigationStartTime,
-                                                                cfg.LogFilePath,
-                                                                cfg.TimestampFormat,
-                                                                kTimestampRegex);
-        if (!reason.empty() && mitigationLogTimeValid) {
-            std::ifstream src(cfg.LogFilePath, std::ios::in);
-            std::ofstream dst(kLastMealPath, std::ios::out);
-            dst << src.rdbuf();
-            android::base::SetProperty(kLastMealProperty, "1");
-        }
-    }
-
-    bool isBatteryMitigationReady = false;
-    std::string ready_str;
-    int val = 0;
-    for (int i = 0; i < COUNT_LIMIT; i++) {
-        if (!android::base::ReadFileToString(kReadyFilePath, &ready_str)) {
-            continue;
-        }
-        ready_str = android::base::Trim(ready_str);
-        if (!android::base::ParseInt(ready_str, &val)) {
-            continue;
-        }
-        if (val == 1) {
-            isBatteryMitigationReady = true;
-            break;
-        }
-    }
-    if (isBatteryMitigationReady) {
-        android::base::SetProperty(kReadyProperty, "1");
-    }
-    if (isBatteryMitigationReady && brownoutStatsBinarySupported) {
-        /* Start BrownoutEventThread to poll brownout event from kernel */
-        batteryMitigationService->startBrownoutEventThread();
-    }
-    while (true) {
-        pause();
-    }
-    return 0;
-}
diff --git a/battery_mitigation/battery_mitigation.rc b/battery_mitigation/battery_mitigation.rc
deleted file mode 100644
index 6c8f5cc..0000000
--- a/battery_mitigation/battery_mitigation.rc
+++ /dev/null
@@ -1,96 +0,0 @@
-on property:vendor.thermal.link_ready=1
-    mkdir /data/vendor/mitigation 0755 system system
-    chown system system /data/vendor/mitigation
-    start vendor.battery_mitigation
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,if && property:sys.boot.reason=reboot,uvlo,pmic,if
-    setprop vendor.brownout_reason "uvlo,pmic,if"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,pmic,if && property:sys.boot.reason=reboot,ocp,pmic,if
-    setprop vendor.brownout_reason "ocp,pmic,if"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,main && property:sys.boot.reason=reboot,uvlo,pmic,main
-    setprop vendor.brownout_reason "uvlo,pmic,main"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,uvlo,pmic,sub && property:sys.boot.reason=reboot,uvlo,pmic,sub
-    setprop vendor.brownout_reason "uvlo,pmic,sub"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK1M && property:sys.boot.reason=reboot,ocp,buck1m
-    setprop vendor.brownout_reason "ocp,buck1m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK2M && property:sys.boot.reason=reboot,ocp,buck2m
-    setprop vendor.brownout_reason "ocp,buck2m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK3M && property:sys.boot.reason=reboot,ocp,buck3m
-    setprop vendor.brownout_reason "ocp,buck3m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK4M && property:sys.boot.reason=reboot,ocp,buck4m
-    setprop vendor.brownout_reason "ocp,buck4m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK5M && property:sys.boot.reason=reboot,ocp,buck5m
-    setprop vendor.brownout_reason "ocp,buck5m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK6M && property:sys.boot.reason=reboot,ocp,buck6m
-    setprop vendor.brownout_reason "ocp,buck6m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK7M && property:sys.boot.reason=reboot,ocp,buck7m
-    setprop vendor.brownout_reason "ocp,buck7m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK8M && property:sys.boot.reason=reboot,ocp,buck8m
-    setprop vendor.brownout_reason "ocp,buck8m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK9M && property:sys.boot.reason=reboot,ocp,buck9m
-    setprop vendor.brownout_reason "ocp,buck9m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK10M && property:sys.boot.reason=reboot,ocp,buck10m
-    setprop vendor.brownout_reason "ocp,buck10m"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK1S && property:sys.boot.reason=reboot,ocp,buck1s
-    setprop vendor.brownout_reason "ocp,buck1s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK2S && property:sys.boot.reason=reboot,ocp,buck2s
-    setprop vendor.brownout_reason "ocp,buck2s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK3S && property:sys.boot.reason=reboot,ocp,buck3s
-    setprop vendor.brownout_reason "ocp,buck3s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK4S && property:sys.boot.reason=reboot,ocp,buck4s
-    setprop vendor.brownout_reason "ocp,buck4s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK5S && property:sys.boot.reason=reboot,ocp,buck5s
-    setprop vendor.brownout_reason "ocp,buck5s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK6S && property:sys.boot.reason=reboot,ocp,buck6s
-    setprop vendor.brownout_reason "ocp,buck6s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK7S && property:sys.boot.reason=reboot,ocp,buck7s
-    setprop vendor.brownout_reason "ocp,buck7s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK8S && property:sys.boot.reason=reboot,ocp,buck8s
-    setprop vendor.brownout_reason "ocp,buck8s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK9S && property:sys.boot.reason=reboot,ocp,buck9s
-    setprop vendor.brownout_reason "ocp,buck9s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCK10S && property:sys.boot.reason=reboot,ocp,buck10s
-    setprop vendor.brownout_reason "ocp,buck10s"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKDS && property:sys.boot.reason=reboot,ocp,buckds
-    setprop vendor.brownout_reason "ocp,buckds"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKAS && property:sys.boot.reason=reboot,ocp,buckas
-    setprop vendor.brownout_reason "ocp,buckas"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKCS && property:sys.boot.reason=reboot,ocp,buckcs
-    setprop vendor.brownout_reason "ocp,buckcs"
-
-on property:vendor.thermal.link_ready=1 && property:ro.boot.bootreason=reboot,ocp,BUCKBS && property:sys.boot.reason=reboot,ocp,buckbs
-    setprop vendor.brownout_reason "ocp,buckbs"
-
-on property:vendor.brownout.br.feasible=1
-    chown system system data/vendor/mitigation/lastmeal.txt
-
-service vendor.battery_mitigation /vendor/bin/hw/battery_mitigation
-    user system
-    group system
-    capabilities WAKE_ALARM BLOCK_SUSPEND
diff --git a/battery_mitigation/bcl.mk b/battery_mitigation/bcl.mk
index 13e5788..5bf1a25 100644
--- a/battery_mitigation/bcl.mk
+++ b/battery_mitigation/bcl.mk
@@ -7,7 +7,17 @@
 endif
 endif
 
+ifeq ($(RELEASE_PIXEL_AIDL_BATTERY_MITIGATION_HAL), true)
+PRODUCT_PROPERTY_OVERRIDES += \
+       vendor.battery_mitigation.aidl.enable=true
+endif
+
+PRODUCT_SOONG_NAMESPACES += device/google/gs-common/battery_mitigation \
+                            vendor/google/battery_mitigation
+PRODUCT_PACKAGES += vendor.google.battery_mitigation-default
+PRODUCT_PACKAGES += vendor.google.battery_mitigation.service_static
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/battery_mitigation/compatibility_matrix.xml
+
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy/vendor
 SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy/system_ext/private
 SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += device/google/gs-common/battery_mitigation/sepolicy/system_ext/public
-PRODUCT_SOONG_NAMESPACES += device/google/gs-common/battery_mitigation
diff --git a/battery_mitigation/compatibility_matrix.xml b/battery_mitigation/compatibility_matrix.xml
new file mode 100644
index 0000000..7e3d88e
--- /dev/null
+++ b/battery_mitigation/compatibility_matrix.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>vendor.google.battery_mitigation</name>
+        <version>1</version>
+        <interface>
+            <name>IBatteryMitigation</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/battery_mitigation/sepolicy/vendor/battery_mitigation.te b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
index 4b5bc48..7552bd2 100644
--- a/battery_mitigation/sepolicy/vendor/battery_mitigation.te
+++ b/battery_mitigation/sepolicy/vendor/battery_mitigation.te
@@ -19,7 +19,7 @@
 r_dir_file(battery_mitigation, sysfs_odpm)
 r_dir_file(battery_mitigation, sysfs_power_stats)
 allow battery_mitigation sysfs_bcl:dir r_dir_perms;
-allow battery_mitigation sysfs_bcl:file r_file_perms;
+allow battery_mitigation sysfs_bcl:file rw_file_perms;
 allow battery_mitigation sysfs_bcl:lnk_file r_file_perms;
 allow battery_mitigation sysfs_thermal:lnk_file r_file_perms;
 allow battery_mitigation mitigation_vendor_data_file:dir rw_dir_perms;
@@ -29,3 +29,5 @@
 binder_use(battery_mitigation)
 # Allow battery_mitigation to listen brownout event by epoll_wait
 wakelock_use(battery_mitigation)
+# Allow battery_mitigation to run aidl service
+add_service(battery_mitigation, hal_battery_mitigation_service)
diff --git a/battery_mitigation/sepolicy/vendor/service.te b/battery_mitigation/sepolicy/vendor/service.te
new file mode 100644
index 0000000..3ffe254
--- /dev/null
+++ b/battery_mitigation/sepolicy/vendor/service.te
@@ -0,0 +1 @@
+type hal_battery_mitigation_service, protected_service, hal_service_type, service_manager_type;
diff --git a/battery_mitigation/sepolicy/vendor/service_contexts b/battery_mitigation/sepolicy/vendor/service_contexts
new file mode 100644
index 0000000..472259e
--- /dev/null
+++ b/battery_mitigation/sepolicy/vendor/service_contexts
@@ -0,0 +1 @@
+vendor.google.battery_mitigation.IBatteryMitigation/default    u:object_r:hal_battery_mitigation_service:s0
diff --git a/bcmbt/dump/dump_bcmbt.cpp b/bcmbt/dump/dump_bcmbt.cpp
index 0135198..fde0ad0 100644
--- a/bcmbt/dump/dump_bcmbt.cpp
+++ b/bcmbt/dump/dump_bcmbt.cpp
@@ -21,8 +21,10 @@
 #define BCMBT_SNOOP_LOG_DIRECTORY "/data/vendor/bluetooth"
 #define BCMBT_FW_LOG_DIRECTORY "/data/vendor/ssrdump/coredump"
 #define BCMBT_SNOOP_LOG_PREFIX "btsnoop_hci_vnd"
+#define BCMBT_BACKUP_SNOOP_LOG_PREFIX "backup_btsnoop_hci_vnd"
 #define BCMBT_FW_DUMP_LOG_PREFIX "coredump_bt_socdump_"
 #define BCMBT_CHRE_DUMP_LOG_PREFIX "coredump_bt_chredump_"
+#define BCMBT_HAL_DUMP_LOG_PREFIX "coredump_bt_"
 #define BCMBT_ACTIVITY_LOG_PREFIX "bt_activity_"
 
 int main() {
@@ -33,8 +35,10 @@
     }
 
     dumpLogs(BCMBT_SNOOP_LOG_DIRECTORY, outputDir.c_str(), 2, BCMBT_SNOOP_LOG_PREFIX);
+    dumpLogs(BCMBT_SNOOP_LOG_DIRECTORY, outputDir.c_str(), 2, BCMBT_BACKUP_SNOOP_LOG_PREFIX);
     dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_FW_DUMP_LOG_PREFIX);
     dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_CHRE_DUMP_LOG_PREFIX);
+    dumpLogs(BCMBT_FW_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_HAL_DUMP_LOG_PREFIX);
     dumpLogs(BCMBT_ACTIVITY_LOG_DIRECTORY, outputDir.c_str(), 10, BCMBT_ACTIVITY_LOG_PREFIX);
     return 0;
 }
diff --git a/betterbug/betterbug.mk b/betterbug/betterbug.mk
new file mode 100644
index 0000000..f3ae647
--- /dev/null
+++ b/betterbug/betterbug.mk
@@ -0,0 +1,5 @@
+PRODUCT_PACKAGES += BetterBugStub
+PRODUCT_PACKAGES_DEBUG += BetterBug
+
+PRODUCT_PUBLIC_SEPOLICY_DIRS += device/google/gs-common/betterbug/sepolicy/product/public
+PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/betterbug/sepolicy/product/private
diff --git a/betterbug/sepolicy/product/private/better_bug_app.te b/betterbug/sepolicy/product/private/better_bug_app.te
new file mode 100644
index 0000000..bb50612
--- /dev/null
+++ b/betterbug/sepolicy/product/private/better_bug_app.te
@@ -0,0 +1,15 @@
+typeattribute better_bug_app coredomain;
+
+app_domain(better_bug_app)
+net_domain(better_bug_app)
+
+allow better_bug_app shell_data_file:file read;
+allow better_bug_app privapp_data_file:file execute;
+
+allow better_bug_app app_api_service:service_manager find;
+allow better_bug_app system_api_service:service_manager find;
+allow better_bug_app mediaserver_service:service_manager find;
+
+set_prop(better_bug_app, ctl_start_prop)
+
+get_prop(better_bug_app, system_boot_reason_prop)
diff --git a/betterbug/sepolicy/product/private/seapp_contexts b/betterbug/sepolicy/product/private/seapp_contexts
new file mode 100644
index 0000000..261e710
--- /dev/null
+++ b/betterbug/sepolicy/product/private/seapp_contexts
@@ -0,0 +1,2 @@
+# BetterBug
+user=_app isPrivApp=true name=com.google.android.apps.internal.betterbug domain=better_bug_app type=app_data_file levelFrom=all
diff --git a/betterbug/sepolicy/product/public/better_bug_app.te b/betterbug/sepolicy/product/public/better_bug_app.te
new file mode 100644
index 0000000..9a14782
--- /dev/null
+++ b/betterbug/sepolicy/product/public/better_bug_app.te
@@ -0,0 +1 @@
+type better_bug_app, domain;
diff --git a/camera/dump_camera.cpp b/camera/dump_camera.cpp
index 548a866..5a0229b 100644
--- a/camera/dump_camera.cpp
+++ b/camera/dump_camera.cpp
@@ -45,6 +45,7 @@
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "high-drop-rate-");
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "watchdog-");
   dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "camera-ended-");
+  dumpLogs(kCameraLogDir.data(), cameraDestDir.c_str(), 5, "fatal-error-");
   dumpLogs(kGraphStateDumpDir.data(), cameraDestDir.c_str(), 5,
            "hal_graph_state_");
 
diff --git a/camera/sepolicy/product/private/vendor_pcs_app.te b/camera/sepolicy/product/private/vendor_pcs_app.te
index 6bf0451..55eeee7 100644
--- a/camera/sepolicy/product/private/vendor_pcs_app.te
+++ b/camera/sepolicy/product/private/vendor_pcs_app.te
@@ -1,12 +1,32 @@
 typeattribute vendor_pcs_app coredomain;
 
 app_domain(vendor_pcs_app);
+net_domain(vendor_pcs_app);
+bluetooth_domain(vendor_pcs_app);
 
 allow vendor_pcs_app {
     app_api_service
     audioserver_service
     cameraserver_service
+    drmserver_service
     mediametrics_service
     mediaserver_service
+    nfc_service
     radio_service
 }:service_manager find;
+
+# Following allowances were replicated from priv_app
+# Write to /cache.
+allow vendor_pcs_app { cache_file cache_recovery_file }:dir create_dir_perms;
+allow vendor_pcs_app { cache_file cache_recovery_file }:file create_file_perms;
+# /cache is a symlink to /data/cache on some devices. Allow reading the link.
+allow vendor_pcs_app cache_file:lnk_file r_file_perms;
+
+# Access to /data/media.
+allow vendor_pcs_app media_rw_data_file:dir create_dir_perms;
+allow vendor_pcs_app media_rw_data_file:file create_file_perms;
+
+# Access to /data/preloads
+r_dir_file(vendor_pcs_app, preloads_data_file)
+r_dir_file(vendor_pcs_app, preloads_media_file)
+
diff --git a/camera/sepolicy/vendor/vendor_pcs_app.te b/camera/sepolicy/vendor/vendor_pcs_app.te
index e269a2f..b4d71b5 100644
--- a/camera/sepolicy/vendor/vendor_pcs_app.te
+++ b/camera/sepolicy/vendor/vendor_pcs_app.te
@@ -1,14 +1,17 @@
-# Allow PCS to find the LyricConfigProvider service through ServiceManager.
-allow vendor_pcs_app vendor_camera_lyricconfigprovider_service:service_manager find;
-# Allow PCS to find the CameraIdRemapper service through ServiceManager.
-allow vendor_pcs_app vendor_camera_cameraidremapper_service:service_manager find;
+allow vendor_pcs_app {
+    vendor_camera_lyricconfigprovider_service
+    vendor_camera_cameraidremapper_service
+    edgetpu_app_service
+}:service_manager find;
 
 allow vendor_pcs_app hal_pixel_remote_camera_service:service_manager add;
 
 binder_call(vendor_pcs_app, hal_pixel_remote_camera_service);
-
 binder_call(vendor_pcs_app, hal_camera_default);
 
+# Allow interacting with EdgeTpu.
+allow vendor_pcs_app edgetpu_device:chr_file { getattr read write ioctl map };
+
 # Allow PCS to open socket connections for HTTP streaming support.
 allow vendor_pcs_app vendor_pcs_app:unpriv_socket_class_set create_socket_perms_no_ioctl;
 allow vendor_pcs_app fwmarkd_socket:sock_file write;
diff --git a/chre/README.txt b/chre/README.txt
new file mode 100644
index 0000000..3bdea2b
--- /dev/null
+++ b/chre/README.txt
@@ -0,0 +1,5 @@
+This folder contains the common settings for CHRE shared by various platforms.
+
+Dependencies among types can happen. For example, hal_contexthub_default
+depends on sysfs_aoc at the moment. When setting up a device with CHRE
+we should make sure rules of dependent types are included too.
diff --git a/chre/hal.mk b/chre/hal.mk
new file mode 100644
index 0000000..13ebb7f
--- /dev/null
+++ b/chre/hal.mk
@@ -0,0 +1,2 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/chre/sepolicy/
+PRODUCT_PACKAGES += android.hardware.contexthub-service.generic
\ No newline at end of file
diff --git a/chre/sepolicy/file_contexts b/chre/sepolicy/file_contexts
new file mode 100644
index 0000000..0659579
--- /dev/null
+++ b/chre/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/android\.hardware\.contexthub-service\.generic               u:object_r:hal_contexthub_default_exec:s0
diff --git a/chre/sepolicy/hal_contexthub_default.te b/chre/sepolicy/hal_contexthub_default.te
new file mode 100644
index 0000000..87e3a42
--- /dev/null
+++ b/chre/sepolicy/hal_contexthub_default.te
@@ -0,0 +1,37 @@
+#
+# Context hub multiclient HAL common selinux policies
+#
+
+# Permit communication with AoC
+allow hal_contexthub_default aoc_device:chr_file rw_file_perms;
+
+# Allow context hub HAL to determine AoC's current clock
+allow hal_contexthub_default sysfs_aoc:dir search;
+allow hal_contexthub_default sysfs_aoc_boottime:file r_file_perms;
+
+# Allow context hub HAL to create thread to watch AOC's device
+allow hal_contexthub_default device:dir r_dir_perms;
+
+# Allow context hub HAL to use the USF low latency transport
+usf_low_latency_transport(hal_contexthub_default)
+
+# Allow context hub HAL to talk to the WiFi HAL
+binder_call(hal_contexthub_default, hal_wifi_ext)
+allow hal_contexthub_default hal_wifi_ext_service:service_manager find;
+
+# Allow context hub HAL to talk to stats service
+binder_call(hal_contexthub_default, stats_service_server)
+allow hal_contexthub_default fwk_stats_service:service_manager find;
+
+# Allow context hub HAL to write data to /data/vendor/chre/ directory
+allow hal_contexthub_default chre_data_file:dir create_dir_perms;
+allow hal_contexthub_default chre_data_file:file create_file_perms;
+
+# Allow context hub HAL to use WakeLock
+wakelock_use(hal_contexthub_default)
+
+# Allow context hub HAL to block suspend, which is required to use EPOLLWAKEUP
+allow hal_contexthub_default self:global_capability2_class_set block_suspend;
+
+# Allow binder calls with clients
+binder_call(hal_contexthub_default, hal_sensors_default)
diff --git a/chre/sepolicy/property.te b/chre/sepolicy/property.te
new file mode 100644
index 0000000..f2a98eb
--- /dev/null
+++ b/chre/sepolicy/property.te
@@ -0,0 +1 @@
+vendor_internal_prop(vendor_chre_hal_prop)
\ No newline at end of file
diff --git a/chre/sepolicy/property_contexts b/chre/sepolicy/property_contexts
new file mode 100644
index 0000000..f3d3fd8
--- /dev/null
+++ b/chre/sepolicy/property_contexts
@@ -0,0 +1 @@
+vendor.chre.multiclient_hal                     u:object_r:vendor_chre_hal_prop:s0
\ No newline at end of file
diff --git a/chre/sepolicy/vendor_init.te b/chre/sepolicy/vendor_init.te
new file mode 100644
index 0000000..d1a70fe
--- /dev/null
+++ b/chre/sepolicy/vendor_init.te
@@ -0,0 +1 @@
+set_prop(vendor_init, vendor_chre_hal_prop)
\ No newline at end of file
diff --git a/dauntless/gsc.mk b/dauntless/gsc.mk
index 892f71a..0c4985f 100644
--- a/dauntless/gsc.mk
+++ b/dauntless/gsc.mk
@@ -19,5 +19,6 @@
 PRODUCT_PACKAGES_DEBUG += citadel_integration_tests \
                           pwntest \
                           nugget_targeted_tests \
-                          CitadelProvision
-endif
\ No newline at end of file
+                          CitadelProvision \
+                          nugget_aidl_test_weaver
+endif
diff --git a/diagnosticstool/diagnosticstool.mk b/diagnosticstool/diagnosticstool.mk
deleted file mode 100644
index 67fbd88..0000000
--- a/diagnosticstool/diagnosticstool.mk
+++ /dev/null
@@ -1 +0,0 @@
-PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/gs-common/diagnosticstool/sepolicy
diff --git a/diagnosticstool/sepolicy/diagnosticstool_app.te b/diagnosticstool/sepolicy/diagnosticstool_app.te
deleted file mode 100644
index d1874e6..0000000
--- a/diagnosticstool/sepolicy/diagnosticstool_app.te
+++ /dev/null
@@ -1,4 +0,0 @@
-type diagnosticstool_app, domain;
-app_domain(diagnosticstool_app)
-
-allow diagnosticstool_app app_api_service:service_manager find;
diff --git a/diagnosticstool/sepolicy/seapp_contexts b/diagnosticstool/sepolicy/seapp_contexts
deleted file mode 100644
index 3c601cd..0000000
--- a/diagnosticstool/sepolicy/seapp_contexts
+++ /dev/null
@@ -1,2 +0,0 @@
-# Diagnostics Tool
-user=_app seinfo=platform name=com.google.android.apps.diagnosticstool domain=diagnosticstool_app isPrivApp=true levelFrom=user
diff --git a/edgetpu/sepolicy/file_contexts b/edgetpu/sepolicy/file_contexts
index df0a63e..0cada88 100644
--- a/edgetpu/sepolicy/file_contexts
+++ b/edgetpu/sepolicy/file_contexts
@@ -15,7 +15,7 @@
 /vendor/lib64/libmetrics_logger\.so                                        u:object_r:same_process_hal_file:s0
 /vendor/lib64/libedgetpu_util\.so                                          u:object_r:same_process_hal_file:s0
 # EdgeTPU runtime libraries
-/vendor/lib64/com\.google\.edgetpu_app_service-V[1-2]-ndk\.so              u:object_r:same_process_hal_file:s0
+/vendor/lib64/com\.google\.edgetpu_app_service-V[1-3]-ndk\.so              u:object_r:same_process_hal_file:s0
 /vendor/lib64/com\.google\.edgetpu_vendor_service-V[1-2]-ndk\.so           u:object_r:same_process_hal_file:s0
 
 # EdgeTPU data files
diff --git a/edgetpu/sepolicy/hal_audio_default.te b/edgetpu/sepolicy/hal_audio_default.te
index 2646fcc..523770c 100644
--- a/edgetpu/sepolicy/hal_audio_default.te
+++ b/edgetpu/sepolicy/hal_audio_default.te
@@ -12,3 +12,7 @@
 
 # Allow audio HAL to read tflite Darwinn delegate properties
 get_prop(hal_audio_default, vendor_tflite_delegate_prop)
+get_prop(hal_audio_default, vendor_edgetpu_runtime_prop)
+
+# Allow DMA Buf access.
+allow hal_audio_default dmabuf_system_heap_device:chr_file r_file_perms;
diff --git a/gps/lsi/s5400.mk b/gps/lsi/s5400.mk
new file mode 100644
index 0000000..1bfc88e
--- /dev/null
+++ b/gps/lsi/s5400.mk
@@ -0,0 +1,19 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gps/lsi/sepolicy
+
+PRODUCT_SOONG_NAMESPACES += \
+    vendor/samsung_slsi/gps/s5400
+
+PRODUCT_PACKAGES += \
+    android.hardware.location.gps.prebuilt.xml \
+    gnssd \
+    android.hardware.gnss-service \
+    ca.pem \
+    gnss_check.sh \
+    kepler.bin
+
+ifneq (,$(filter userdebug eng, $(TARGET_BUILD_VARIANT)))
+    PRODUCT_VENDOR_PROPERTIES += vendor.gps.aol.enabled=true
+endif
+
+# Enable Pixel GNSS HAL
+include device/google/gs-common/gps/pixel/pixel_gnss_hal.mk
\ No newline at end of file
diff --git a/gps/lsi/sepolicy/file.te b/gps/lsi/sepolicy/file.te
new file mode 100644
index 0000000..af9582b
--- /dev/null
+++ b/gps/lsi/sepolicy/file.te
@@ -0,0 +1 @@
+type vendor_gps_file, file_type, data_file_type;
diff --git a/gps/lsi/sepolicy/file_contexts b/gps/lsi/sepolicy/file_contexts
new file mode 100644
index 0000000..9840eab
--- /dev/null
+++ b/gps/lsi/sepolicy/file_contexts
@@ -0,0 +1,12 @@
+# GPS
+/dev/gnss_ipc                  u:object_r:vendor_gnss_device:s0
+/dev/gnss_boot                 u:object_r:vendor_gnss_device:s0
+/dev/gnss_dump                 u:object_r:vendor_gnss_device:s0
+/vendor/bin/hw/gnssd            u:object_r:gnssd_exec:s0
+/vendor/bin/hw/sctd             u:object_r:sctd_exec:s0
+/vendor/bin/hw/swcnd            u:object_r:swcnd_exec:s0
+/vendor/bin/hw/spad             u:object_r:spad_exec:s0
+/vendor/bin/hw/android.hardware.gnss-service           u:object_r:hal_gnss_default_exec:s0
+/vendor/bin/gnss_check\.sh                                     u:object_r:gnss_check_exec:s0
+# keep only one rule and use eGNSS one
+# /data/vendor/gps(/.*)?             u:object_r:vendor_gps_file:s0
diff --git a/gps/lsi/sepolicy/genfs_contexts b/gps/lsi/sepolicy/genfs_contexts
new file mode 100644
index 0000000..d19427c
--- /dev/null
+++ b/gps/lsi/sepolicy/genfs_contexts
@@ -0,0 +1,2 @@
+# gps coredump node
+genfscon sysfs /devices/platform/gnssif/coredump                                                                     u:object_r:sysfs_gps:s0
diff --git a/gps/lsi/sepolicy/gnss_check.te b/gps/lsi/sepolicy/gnss_check.te
new file mode 100644
index 0000000..31d0944
--- /dev/null
+++ b/gps/lsi/sepolicy/gnss_check.te
@@ -0,0 +1,9 @@
+type gnss_check, domain;
+type gnss_check_exec, exec_type, vendor_file_type, file_type;
+
+init_daemon_domain(gnss_check);
+
+allow gnss_check vendor_toolbox_exec:file { execute_no_trans };
+
+set_prop(gnss_check, ctl_stop_prop);
+set_prop(gnss_check, ctl_start_prop);
diff --git a/gps/lsi/sepolicy/gnssd.te b/gps/lsi/sepolicy/gnssd.te
new file mode 100644
index 0000000..56ab51f
--- /dev/null
+++ b/gps/lsi/sepolicy/gnssd.te
@@ -0,0 +1,33 @@
+type gnssd, domain;
+type gnssd_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(gnssd);
+
+# Allow gnssd to access rild
+binder_call(gnssd, rild);
+binder_call(gnssd, hwservicemanager)
+allow gnssd hal_exynos_rild_hwservice:hwservice_manager find;
+allow gnssd radio_device:chr_file rw_file_perms;
+
+# Allow gnssd to acess gnss device
+allow gnssd vendor_gnss_device:chr_file rw_file_perms;
+allow gnssd vendor_gps_file:dir create_dir_perms;
+allow gnssd vendor_gps_file:file create_file_perms;
+allow gnssd vendor_gps_file:fifo_file create_file_perms;
+
+# Allow gnssd to obtain wakelock
+wakelock_use(gnssd)
+
+# Allow a base set of permissions required for network access.
+net_domain(gnssd);
+
+# Allow gnssd to get boot complete
+get_prop(gnssd, bootanim_system_prop)
+
+allow gnssd sysfs_soc:file r_file_perms;
+allow gnssd sysfs_gps:file rw_file_perms;
+
+# Allow gnssd to set GPS property
+set_prop(gnssd, vendor_gps_prop)
+
+# Read RIL property
+get_prop(gnssd, vendor_rild_prop)
diff --git a/gps/lsi/sepolicy/hal_gnss_default.te b/gps/lsi/sepolicy/hal_gnss_default.te
new file mode 100644
index 0000000..7d363f0
--- /dev/null
+++ b/gps/lsi/sepolicy/hal_gnss_default.te
@@ -0,0 +1,13 @@
+allow hal_gnss_default fwk_sensor_service:service_manager find;
+allow hal_gnss_default gnssd:unix_stream_socket connectto;
+allow hal_gnss_default vendor_gps_file:dir create_dir_perms;
+allow hal_gnss_default vendor_gps_file:file create_file_perms;
+allow hal_gnss_default vendor_gps_file:fifo_file create_file_perms;
+allow hal_gnss_default sysfs_gps:file rw_file_perms;
+binder_call(hal_gnss_default, gnssd);
+
+#Read GPS property
+get_prop(hal_gnss_default, vendor_gps_prop)
+
+#IPC between pixel and vendor HAL
+binder_call(hal_gnss_default, hal_gnss_pixel)
diff --git a/gps/lsi/sepolicy/rild.te b/gps/lsi/sepolicy/rild.te
new file mode 100644
index 0000000..c620a19
--- /dev/null
+++ b/gps/lsi/sepolicy/rild.te
@@ -0,0 +1 @@
+binder_call(rild, gnssd)
diff --git a/gps/lsi/sepolicy/sctd.te b/gps/lsi/sepolicy/sctd.te
new file mode 100644
index 0000000..8966ef8
--- /dev/null
+++ b/gps/lsi/sepolicy/sctd.te
@@ -0,0 +1,3 @@
+type sctd, domain;
+type sctd_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(sctd);
diff --git a/gps/lsi/sepolicy/spad.te b/gps/lsi/sepolicy/spad.te
new file mode 100644
index 0000000..eaf8b1c
--- /dev/null
+++ b/gps/lsi/sepolicy/spad.te
@@ -0,0 +1,3 @@
+type spad, domain;
+type spad_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(spad);
diff --git a/gps/lsi/sepolicy/swcnd.te b/gps/lsi/sepolicy/swcnd.te
new file mode 100644
index 0000000..c366cad
--- /dev/null
+++ b/gps/lsi/sepolicy/swcnd.te
@@ -0,0 +1,3 @@
+type swcnd, domain;
+type swcnd_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(swcnd);
diff --git a/gps/lsi/sepolicy/vendor_init.te b/gps/lsi/sepolicy/vendor_init.te
new file mode 100644
index 0000000..c8d637d
--- /dev/null
+++ b/gps/lsi/sepolicy/vendor_init.te
@@ -0,0 +1,2 @@
+# gps vendor property
+set_prop(vendor_init, vendor_gps_prop)
diff --git a/gps/pixel/device_framework_matrix_product.xml b/gps/pixel/device_framework_matrix_product.xml
new file mode 100644
index 0000000..2c93444
--- /dev/null
+++ b/gps/pixel/device_framework_matrix_product.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework" level="8">
+    <hal format="aidl" optional="true">
+        <name>android.hardware.gnss</name>
+        <version>3</version>
+        <interface>
+            <name>IGnss</name>
+            <instance>vendor</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/gps/pixel/pixel_gnss_hal.mk b/gps/pixel/pixel_gnss_hal.mk
new file mode 100644
index 0000000..b0edff7
--- /dev/null
+++ b/gps/pixel/pixel_gnss_hal.mk
@@ -0,0 +1,15 @@
+# Include this file to enable Pixel GNSS HAL
+
+$(call soong_config_set, pixel_gnss, enable_pixel_gnss_aidl_service, true)
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gps/pixel/sepolicy
+
+PRODUCT_PACKAGES += \
+    android.hardware.gnss-service.pixel
+
+PRODUCT_VENDOR_PROPERTIES += \
+    persist.vendor.gps.hal.service.name=vendor
+
+# Compatibility matrix
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += \
+    device/google/gs-common/gps/pixel/device_framework_matrix_product.xml
diff --git a/gps/pixel/sepolicy/file.te b/gps/pixel/sepolicy/file.te
new file mode 100644
index 0000000..79e95ab
--- /dev/null
+++ b/gps/pixel/sepolicy/file.te
@@ -0,0 +1 @@
+type sysfs_modem_state, sysfs_type, fs_type;
diff --git a/gps/pixel/sepolicy/file_contexts b/gps/pixel/sepolicy/file_contexts
new file mode 100644
index 0000000..8bd8f92
--- /dev/null
+++ b/gps/pixel/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+/vendor/bin/hw/android\.hardware\.gnss-service\.pixel             u:object_r:hal_gnss_pixel_exec:s0
+
diff --git a/gps/pixel/sepolicy/genfs_contexts b/gps/pixel/sepolicy/genfs_contexts
new file mode 100644
index 0000000..494aa97
--- /dev/null
+++ b/gps/pixel/sepolicy/genfs_contexts
@@ -0,0 +1,2 @@
+# modem state node
+genfscon sysfs /devices/platform/cpif/modem_state       u:object_r:sysfs_modem_state:s0
diff --git a/gps/pixel/sepolicy/hal_gnss_pixel.te b/gps/pixel/sepolicy/hal_gnss_pixel.te
new file mode 100644
index 0000000..512ecc9
--- /dev/null
+++ b/gps/pixel/sepolicy/hal_gnss_pixel.te
@@ -0,0 +1,14 @@
+type hal_gnss_pixel, domain;
+hal_server_domain(hal_gnss_pixel, hal_gnss)
+
+type hal_gnss_pixel_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_gnss_pixel)
+
+#IPC between pixel and vendor HAL
+binder_call(hal_gnss_pixel, hal_gnss_default)
+
+#Read modem state
+allow hal_gnss_pixel sysfs_modem_state:file r_file_perms;
+
+#Toggle coredump node
+allow hal_gnss_pixel sysfs_gps:file rw_file_perms;
diff --git a/gps/pixel/sepolicy/service_contexts b/gps/pixel/sepolicy/service_contexts
new file mode 100644
index 0000000..cc9871f
--- /dev/null
+++ b/gps/pixel/sepolicy/service_contexts
@@ -0,0 +1 @@
+android.hardware.gnss.IGnss/vendor                                 u:object_r:hal_gnss_service:s0
\ No newline at end of file
diff --git a/gpu/gpu.mk b/gpu/gpu.mk
index d1c3a6d..b87e7ad 100644
--- a/gpu/gpu.mk
+++ b/gpu/gpu.mk
@@ -1,3 +1,16 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gpu/sepolicy
 
 PRODUCT_PACKAGES += gpu_probe
+
+USE_MAPPER5 := false
+
+PRODUCT_PACKAGES += pixel_gralloc_allocator
+PRODUCT_PACKAGES += pixel_gralloc_mapper
+
+ifeq ($(USE_MAPPER5), true)
+$(call soong_config_set,arm_gralloc,mapper_version,mapper5)
+$(call soong_config_set,aion_buffer,mapper_version,mapper5)
+else
+$(call soong_config_set,arm_gralloc,mapper_version,mapper4)
+$(call soong_config_set,aion_buffer,mapper_version,mapper4)
+endif
diff --git a/gxp/sepolicy/appdomain.te b/gxp/sepolicy/appdomain.te
new file mode 100644
index 0000000..ada9421
--- /dev/null
+++ b/gxp/sepolicy/appdomain.te
@@ -0,0 +1,2 @@
+# Allow apps to read gxp properties
+get_prop(appdomain, vendor_gxp_prop)
diff --git a/gxp/sepolicy/edgetpu_app_service.te b/gxp/sepolicy/edgetpu_app_service.te
new file mode 100644
index 0000000..780823f
--- /dev/null
+++ b/gxp/sepolicy/edgetpu_app_service.te
@@ -0,0 +1,6 @@
+# Allow Edgetpu App Service to access the GXP device and read GXP properties.
+allow edgetpu_app_server gxp_device:chr_file rw_file_perms;
+get_prop(edgetpu_app_server, vendor_gxp_prop)
+
+# Allows Edgetpu App Service to search for GXP firmware file.
+allow edgetpu_app_server vendor_fw_file:dir search;
diff --git a/gxp/sepolicy/priv_app.te b/gxp/sepolicy/priv_app.te
new file mode 100644
index 0000000..8afc24d
--- /dev/null
+++ b/gxp/sepolicy/priv_app.te
@@ -0,0 +1,3 @@
+# Allows privileged applications to access the GXP device, except open,
+# which is guarded by the EdgeTPU service.
+allow priv_app gxp_device:chr_file { getattr read write ioctl map };
diff --git a/gxp/sepolicy/untrusted_app_all.te b/gxp/sepolicy/untrusted_app_all.te
new file mode 100644
index 0000000..456dfee
--- /dev/null
+++ b/gxp/sepolicy/untrusted_app_all.te
@@ -0,0 +1,3 @@
+# Allows applications to access the GXP device, except open,
+# which is guarded by the EdgeTPU service.
+allow untrusted_app_all gxp_device:chr_file { getattr read write ioctl map };
diff --git a/gyotaku_app/dump/Android.bp b/gyotaku_app/dump/Android.bp
new file mode 100644
index 0000000..0f62d0a
--- /dev/null
+++ b/gyotaku_app/dump/Android.bp
@@ -0,0 +1,20 @@
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_binary {
+    name: "dump_gyotaku",
+    srcs: ["dump_gyotaku.cpp"],
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "libdump",
+        "liblog",
+    ],
+    vendor: true,
+    relative_install_path: "dump",
+}
diff --git a/gyotaku_app/dump/dump_gyotaku.cpp b/gyotaku_app/dump/dump_gyotaku.cpp
new file mode 100644
index 0000000..62c2a57
--- /dev/null
+++ b/gyotaku_app/dump/dump_gyotaku.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <unistd.h>
+#include <dump/pixel_dump.h>
+#include <android-base/file.h>
+
+#define GYOTAKU_DIRECTORY "/data/vendor/gyotaku/andlog"
+#define GYOTAKU_ANDROID_LOG_PREFIX "android_"
+
+#define maxFileLogsNumber 30
+
+int main() {
+    std::string outputDir = concatenatePath(BUGREPORT_PACKING_DIR, "gyotaku");
+    if (mkdir(outputDir.c_str(), 0700) == -1) {
+        printf("Unable to create folder: %s\n", outputDir.c_str());
+        return 0;
+    }
+
+    dumpLogs(GYOTAKU_DIRECTORY, outputDir.c_str(), maxFileLogsNumber, GYOTAKU_ANDROID_LOG_PREFIX);
+    return 0;
+}
+
diff --git a/gyotaku_app/dump/dump_gyotaku.te b/gyotaku_app/dump/dump_gyotaku.te
new file mode 100644
index 0000000..8c1727f
--- /dev/null
+++ b/gyotaku_app/dump/dump_gyotaku.te
@@ -0,0 +1,11 @@
+pixel_bugreport(dump_gyotaku)
+
+userdebug_or_eng(`
+  # For access and collecting logs into vendor radio type folder.
+  allow dump_gyotaku radio_vendor_data_file:dir create_dir_perms;
+  allow dump_gyotaku radio_vendor_data_file:file create_file_perms;
+
+  # For access /data/vendor/ folder.
+  allow dump_gyotaku gyotaku_vendor_data_file:dir create_dir_perms;
+  allow dump_gyotaku gyotaku_vendor_data_file:file create_file_perms;
+')
diff --git a/gyotaku_app/dump/file.te b/gyotaku_app/dump/file.te
new file mode 100644
index 0000000..8035955
--- /dev/null
+++ b/gyotaku_app/dump/file.te
@@ -0,0 +1,5 @@
+# For /data/vendor use
+type gyotaku_vendor_data_file, file_type, data_file_type;
+userdebug_or_eng(`
+    typeattribute gyotaku_vendor_data_file mlstrustedobject;
+')
diff --git a/gyotaku_app/dump/file_contexts b/gyotaku_app/dump/file_contexts
new file mode 100644
index 0000000..3a16a00
--- /dev/null
+++ b/gyotaku_app/dump/file_contexts
@@ -0,0 +1,4 @@
+/data/vendor/gyotaku(/.*)?                u:object_r:gyotaku_vendor_data_file:s0
+
+# Pixel dump for Gyotaku
+/vendor/bin/dump/dump_gyotaku           u:object_r:dump_gyotaku_exec:s0
diff --git a/gyotaku_app/dump/gyotaku_app.te b/gyotaku_app/dump/gyotaku_app.te
new file mode 100644
index 0000000..6816080
--- /dev/null
+++ b/gyotaku_app/dump/gyotaku_app.te
@@ -0,0 +1,5 @@
+userdebug_or_eng(`
+  # For access /data/vendor/gyotaku folder
+  allow gyotaku_app gyotaku_vendor_data_file:dir create_dir_perms;
+  allow gyotaku_app gyotaku_vendor_data_file:file create_file_perms;
+')
diff --git a/gyotaku_app/gyotaku.mk b/gyotaku_app/gyotaku.mk
index fa58556..c6c41d5 100644
--- a/gyotaku_app/gyotaku.mk
+++ b/gyotaku_app/gyotaku.mk
@@ -4,5 +4,11 @@
       Gyotaku
 
       BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/sepolicy/
+
+      # Pixel 5a (barbet) does not support Pixel dump
+      ifneq ($(TARGET_PRODUCT), barbet)
+        PRODUCT_PACKAGES_DEBUG += dump_gyotaku
+        BOARD_SEPOLICY_DIRS += device/google/gs-common/gyotaku_app/dump
+      endif
   endif
 endif
diff --git a/mediacodec/common/sepolicy/service.te b/mediacodec/common/sepolicy/service.te
new file mode 100644
index 0000000..3f0130b
--- /dev/null
+++ b/mediacodec/common/sepolicy/service.te
@@ -0,0 +1 @@
+type eco_service, service_manager_type;
diff --git a/mediacodec/common/sepolicy/vndservice_contexts b/mediacodec/common/sepolicy/service_contexts
similarity index 100%
rename from mediacodec/common/sepolicy/vndservice_contexts
rename to mediacodec/common/sepolicy/service_contexts
diff --git a/mediacodec/common/sepolicy/vndservice.te b/mediacodec/common/sepolicy/vndservice.te
deleted file mode 100644
index 0784fe3..0000000
--- a/mediacodec/common/sepolicy/vndservice.te
+++ /dev/null
@@ -1 +0,0 @@
-type eco_service, vndservice_manager_type;
diff --git a/mediacodec/samsung/sepolicy/mediacodec_samsung.te b/mediacodec/samsung/sepolicy/mediacodec_samsung.te
index b5bd996..8d5c52c 100644
--- a/mediacodec/samsung/sepolicy/mediacodec_samsung.te
+++ b/mediacodec/samsung/sepolicy/mediacodec_samsung.te
@@ -5,6 +5,7 @@
 hal_server_domain(mediacodec_samsung, hal_codec2)
 add_service(mediacodec_samsung, eco_service)
 
+binder_use(mediacodec_samsung)
 vndbinder_use(mediacodec_samsung)
 
 allow mediacodec_samsung video_device:chr_file rw_file_perms;
diff --git a/mte/fullmte-pixel.mk b/mte/fullmte-pixel.mk
index 96120fb..6cc525d 100644
--- a/mte/fullmte-pixel.mk
+++ b/mte/fullmte-pixel.mk
@@ -1,2 +1,8 @@
 include build/make/target/product/fullmte.mk
+
+PRODUCT_MODULE_BUILD_FROM_SOURCE := true
+
 BOARD_KERNEL_CMDLINE += bootloader.pixel.MTE_FORCE_ON
+# TODO(b/324412910): Remove this when the stack-buffer-overflow is fixed.
+PRODUCT_PRODUCT_PROPERTIES += \
+  arm64.memtag.process.android.hardware.composer.hwc3-service.pixel=off
\ No newline at end of file
diff --git a/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp b/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
index 6e377aa..c842d3e 100644
--- a/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
+++ b/powerstats/AdaptiveDvfsStateResidencyDataProvider.cpp
@@ -62,6 +62,14 @@
             }
         }
 
+        // Cpufreq data is sorted in ascending order, but power stats are sorted
+        // in descending order. Reverse sorting to maintain consistency with
+        // other power stats.
+        if (states.size() > 1 &&
+                std::atoll(states[0].second.c_str()) < std::atoll(states[1].second.c_str())) {
+            std::reverse(states.begin(), states.end());
+        }
+
         mPowerEntities.push_back({powerEntities[i].first, std::move(states)});
     }
 
diff --git a/powerstats/DisplayMrrStateResidencyDataProvider.cpp b/powerstats/DisplayMrrStateResidencyDataProvider.cpp
new file mode 100644
index 0000000..8ab9af4
--- /dev/null
+++ b/powerstats/DisplayMrrStateResidencyDataProvider.cpp
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "DisplayMrrStateResidencyDataProvider.h"
+
+#include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <android-base/strings.h>
+
+using android::base::ParseInt;
+using android::base::ParseUint;
+using android::base::Split;
+using android::base::Trim;
+
+static const std::string TIME_IN_STATE = "time_in_state";
+static const std::string AVAILABLE_STATE = "available_disp_stats";
+static const std::vector<std::string> DISP_STATE = { "On", "HBM", "LP", "Off" };
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+DisplayMrrStateResidencyDataProvider::DisplayMrrStateResidencyDataProvider(
+        const std::string& name, const std::string& path) : mName(name), mPath(path) {
+    mConfigs = std::vector<Config>();
+    std::string statePath = mPath + AVAILABLE_STATE;
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(statePath.c_str(), "r"), fclose);
+    if (fp) {
+        char *line = nullptr;
+        size_t len = 0;
+        Config config = { .state = 0, .resX = 0, .resY = 0, .rr = 0 };
+        while (getline(&line, &len, fp.get()) != -1) {
+            if (parseAvailableState(line, &config)) {
+                mConfigs.push_back(config);
+            } else {
+                PLOG(ERROR) << "Failed to parse display config for [" << std::string(line)
+                            << "] from " << statePath;
+                mConfigs.clear();
+                break;
+            }
+        }
+        free(line);
+    } else {
+        PLOG(ERROR) << "Failed to open file " << statePath;
+    }
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseConfig(
+        char const *line, Config *config, uint64_t *duration) {
+    std::vector<std::string> parts = Split(line, " ");
+
+    if (duration == nullptr) {
+        if (parts.size() != 4) return false;
+    } else {
+        if (parts.size() != 5) return false;
+
+        if (!ParseUint(Trim(parts[4]), duration)) return false;
+    }
+
+    if (!ParseInt(Trim(parts[0]), &config->state)) return false;
+    if (!ParseInt(Trim(parts[1]), &config->resX)) return false;
+    if (!ParseInt(Trim(parts[2]), &config->resY)) return false;
+    if (!ParseInt(Trim(parts[3]), &config->rr)) return false;
+
+    return true;
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseAvailableState(
+        char const *line, Config *config) {
+    return parseConfig(line, config, nullptr);
+}
+
+bool DisplayMrrStateResidencyDataProvider::parseTimeInState(
+        char const *line, Config *config, uint64_t *duration) {
+    return parseConfig(line, config, duration);
+}
+
+bool DisplayMrrStateResidencyDataProvider::getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) {
+    if (mConfigs.empty()) {
+        LOG(ERROR) << "Display MRR state list is empty!";
+        return false;
+    }
+
+    std::string path = mPath + TIME_IN_STATE;
+    std::unique_ptr<FILE, decltype(&fclose)> fp(fopen(path.c_str(), "r"), fclose);
+    if (!fp) {
+        PLOG(ERROR) << "Failed to open file " << path;
+        return false;
+    }
+
+    std::vector<StateResidency> stateResidencies;
+    for (int i = 0; i < mConfigs.size(); i++) {
+        StateResidency s = {.id = i, .totalTimeInStateMs = 0};
+        stateResidencies.push_back(s);
+    }
+
+    char *line = nullptr;
+    size_t len = 0;
+    Config config = { .state = 0, .resX = 0, .resY = 0, .rr = 0 };
+    uint64_t duration;
+    std::vector<Config>::const_iterator found;
+    while (getline(&line, &len, fp.get()) != -1) {
+        if (parseTimeInState(line, &config, &duration)) {
+            found = std::find(mConfigs.begin(), mConfigs.end(), config);
+            if (found != mConfigs.end()) {
+                stateResidencies[found - mConfigs.begin()].totalTimeInStateMs = duration;
+            } else {
+                LOG(ERROR) << "Failed to find config for [" << std::string(line)
+                           << "] in display MRR state list";
+            }
+        } else {
+            LOG(ERROR) << "Failed to parse state and duration from [" << std::string(line) << "]";
+            free(line);
+            return false;
+        }
+    }
+
+    residencies->emplace(mName, stateResidencies);
+
+    free(line);
+
+    return true;
+}
+
+std::unordered_map<std::string, std::vector<State>> DisplayMrrStateResidencyDataProvider::getInfo()
+{
+    int32_t dispId;
+    std::string name;
+    std::vector<State> states;
+    for (int32_t id = 0; id < mConfigs.size(); id++) {
+        dispId = mConfigs[id].state;
+        if (dispId >= DISP_STATE.size()) {
+            LOG(ERROR) << "Display state id " << dispId << " is out of bound";
+            return {};
+        }
+
+        name = DISP_STATE[dispId];
+        if (dispId != DISP_STATE.size() - 1) {
+            name += ": " + std::to_string(mConfigs[id].resX) +
+                    "x" + std::to_string(mConfigs[id].resY) +
+                    "@" + std::to_string(mConfigs[id].rr);
+        }
+        State s = { .id = id, .name = name };
+        states.push_back(s);
+    }
+
+    return {{ mName, states }};
+}
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/powerstats/include/DisplayMrrStateResidencyDataProvider.h b/powerstats/include/DisplayMrrStateResidencyDataProvider.h
new file mode 100644
index 0000000..81ea17e
--- /dev/null
+++ b/powerstats/include/DisplayMrrStateResidencyDataProvider.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <PowerStatsAidl.h>
+
+namespace aidl {
+namespace android {
+namespace hardware {
+namespace power {
+namespace stats {
+
+class DisplayMrrStateResidencyDataProvider : public PowerStats::IStateResidencyDataProvider {
+  public:
+    DisplayMrrStateResidencyDataProvider(const std::string& name, const std::string& path);
+    ~DisplayMrrStateResidencyDataProvider() = default;
+
+    /*
+     * See IStateResidencyDataProvider::getStateResidencies
+     */
+    bool getStateResidencies(
+        std::unordered_map<std::string, std::vector<StateResidency>> *residencies) override;
+
+    /*
+     * See IStateResidencyDataProvider::getInfo
+     */
+    std::unordered_map<std::string, std::vector<State>> getInfo() override;
+
+  private:
+    struct Config {
+      int32_t state; // Display state (On, HBM, LP, Off)
+      int32_t resX;  // Resolution X
+      int32_t resY;  // Resolution Y
+      int32_t rr;    // Refresh rate
+
+      bool operator==(const Config& r) const {
+        return state == r.state && resX == r.resX && resY == r.resY && rr == r.rr;
+      }
+    };
+
+    bool parseConfig(char const *line, Config *config, uint64_t *duration);
+    bool parseAvailableState(char const *line, Config *config);
+    bool parseTimeInState(char const *line, Config *config, uint64_t *duration);
+    bool loadAvailableState();
+
+    const std::string mName;
+    const std::string mPath;
+    std::vector<Config> mConfigs;
+};
+
+}  // namespace stats
+}  // namespace power
+}  // namespace hardware
+}  // namespace android
+}  // namespace aidl
diff --git a/radio/dump_radio.cpp b/radio/dump_radio.cpp
index 8d6743c..3ee90f0 100644
--- a/radio/dump_radio.cpp
+++ b/radio/dump_radio.cpp
@@ -34,6 +34,8 @@
     if (tcpdumpEnabled) {
         dumpLogs(TCPDUMP_LOG_DIRECTORY, BUGREPORT_PACKING_DIR, ::android::base::GetIntProperty(TCPDUMP_NUMBER_BUGREPORT, 5), TCPDUMP_LOG_PREFIX);
     }
+    copyFile("/data/vendor/radio/adum_log", "/data/vendor/radio/logs/always-on/all_logs/adum_log");
+    copyFile("/data/vendor/radio/adum_log_old", "/data/vendor/radio/logs/always-on/all_logs/adum_log_old");
     copyFile("/data/vendor/radio/metrics_data", "/data/vendor/radio/logs/always-on/all_logs/metrics_data");
     copyFile("/data/vendor/radio/omadm_logs.txt", "/data/vendor/radio/logs/always-on/all_logs/omadm_logs.txt");
     copyFile("/data/vendor/radio/power_anomaly_data.txt", "/data/vendor/radio/logs/always-on/all_logs/power_anomaly_data.txt");
diff --git a/sensors/sepolicy/hal_sensors_default.te b/sensors/sepolicy/hal_sensors_default.te
index 1d152d4..846b016 100644
--- a/sensors/sepolicy/hal_sensors_default.te
+++ b/sensors/sepolicy/hal_sensors_default.te
@@ -60,6 +60,14 @@
 
 # Allow access to CHRE socket to connect to nanoapps.
 unix_socket_connect(hal_sensors_default, chre, chre)
+## TODO(b/248615564): Remove above rule after CHRE multiclient HAL is launched.
+unix_socket_connect(hal_sensors_default, chre, hal_contexthub_default)
+
+# Allow access to CHRE multiclient HAL.
+get_prop(hal_sensors_default, vendor_chre_hal_prop)
+binder_call(hal_sensors_default, hal_contexthub_default)
+allow hal_sensors_default hal_contexthub_service:service_manager find;
+
 
 # Allow access to the power supply files for MagCC.
 r_dir_file(hal_sensors_default, sysfs_batteryinfo)
diff --git a/storage/init.storage.rc b/storage/init.storage.rc
index 56e8e4f..948e820 100644
--- a/storage/init.storage.rc
+++ b/storage/init.storage.rc
@@ -1,3 +1,60 @@
 on property:ro.build.type=userdebug
     write /dev/sys/block/bootdevice/pixel/enable_pixel_ufs_logging 1
     chown system /dev/sg3
+
+on default_storage_mode
+    # F2FS
+    write /dev/sys/fs/by-name/userdata/data_io_flag 8
+    write /dev/sys/fs/by-name/userdata/node_io_flag 8
+
+    # Block
+    write /dev/sys/block/by-name/rootdisk/queue/iostats 1
+    write /dev/sys/block/by-name/rootdisk/queue/nr_requests 128
+    write /dev/sys/block/by-name/rootdisk/queue/rq_affinity 2
+
+    # UFS
+    write /dev/sys/block/bootdevice/clkgate_enable 1
+
+on init
+    # Symlink /dev/sys/block/bootdevice
+    wait /dev/block/platform/${ro.boot.boot_devices}
+    symlink /dev/block/platform/${ro.boot.boot_devices} /dev/block/bootdevice
+    symlink /sys/devices/platform/${ro.boot.boot_devices} /dev/sys/block/bootdevice
+
+    # F2FS
+    write /dev/sys/fs/by-name/userdata/data_io_flag 56
+    write /dev/sys/fs/by-name/userdata/node_io_flag 56
+
+    # Block
+    write /dev/sys/block/by-name/rootdisk/queue/iostats 0
+    write /sys/sys/block/by-name/rootdisk/queue/nr_requests 256
+
+    # UFS
+    write /dev/sys/block/bootdevice/clkgate_enable 0
+
+on property:sys.boot_completed=1
+    # Health Storage HAL
+    chown system system /dev/sys/block/bootdevice/manual_gc
+
+    # Pixelstats
+    chown system system /dev/sys/block/bootdevice/slowio_read_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_sync_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_unmap_cnt
+    chown system system /dev/sys/block/bootdevice/slowio_write_cnt
+
+    chown system system /dev/sys/fs/by-name/userdata/committed_atomic_block
+    chown system system /dev/sys/fs/by-name/userdata/compr_new_inode
+    chown system system /dev/sys/fs/by-name/userdata/compr_saved_block
+    chown system system /dev/sys/fs/by-name/userdata/compr_written_block
+    chown system system /dev/sys/fs/by-name/userdata/gc_reclaimed_segments
+    chown system system /dev/sys/fs/by-name/userdata/gc_segment_mode
+    chown system system /dev/sys/fs/by-name/userdata/peak_atomic_write
+    chown system system /dev/sys/fs/by-name/userdata/revoked_atomic_block
+
+    trigger default_storage_mode
+
+on charger
+    trigger default_storage_mode
+
+on property:ro.boot.mode=charger && property:init.svc.vendor.charger=running
+    trigger default_storage_mode
diff --git a/thermal/dump/thermal.mk b/thermal/dump/thermal.mk
index 03b1dfa..4bb0344 100644
--- a/thermal/dump/thermal.mk
+++ b/thermal/dump/thermal.mk
@@ -1,3 +1,3 @@
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/thermal/sepolicy/dump
 
-PRODUCT_PACKAGES += dump/dump_thermal.sh
+PRODUCT_PACKAGES += dump_thermal.sh
diff --git a/touch/gti/init.touch.gti0.rc b/touch/gti/init.touch.gti0.rc
index 70c6ced..31856ea 100644
--- a/touch/gti/init.touch.gti0.rc
+++ b/touch/gti/init.touch.gti0.rc
@@ -1,4 +1,4 @@
-on property:vendor.device.modules.ready=1
+on property:sys.boot_completed=1
     # Sysfs
     chown system system /sys/devices/virtual/goog_touch_interface/gti.0/force_active
     chown system system /sys/devices/virtual/goog_touch_interface/gti.0/fw_ver
diff --git a/touch/gti/init.touch.gti1.rc b/touch/gti/init.touch.gti1.rc
index 15de6a1..a4de328 100644
--- a/touch/gti/init.touch.gti1.rc
+++ b/touch/gti/init.touch.gti1.rc
@@ -1,4 +1,4 @@
-on property:vendor.device.modules.ready=1
+on property:sys.boot_completed=1
     # Sysfs
     chown system system /sys/devices/virtual/goog_touch_interface/gti.1/force_active
     chown system system /sys/devices/virtual/goog_touch_interface/gti.1/fw_ver
diff --git a/touch/syna/Android.bp b/touch/syna/Android.bp
index 769c76b..46475d8 100644
--- a/touch/syna/Android.bp
+++ b/touch/syna/Android.bp
@@ -5,7 +5,8 @@
 sh_binary {
     name: "dump_syna.sh",
     src: "dump_syna.sh",
-    init_rc: ["init.touch.syna20.rc"],
+    init_rc: ["init.touch.syna.rc"],
     vendor: true,
     sub_dir: "dump",
 }
+
diff --git a/touch/syna/init.touch.syna.rc b/touch/syna/init.touch.syna.rc
new file mode 100644
index 0000000..d52ed3b
--- /dev/null
+++ b/touch/syna/init.touch.syna.rc
@@ -0,0 +1,5 @@
+on property:sys.boot_completed=1
+    chown system system /sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs/get_raw_data
+    chown system system /sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs/force_active
+    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/get_raw_data
+    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/force_active
diff --git a/touch/syna/init.touch.syna20.rc b/touch/syna/init.touch.syna20.rc
deleted file mode 100644
index 7c83a6c..0000000
--- a/touch/syna/init.touch.syna20.rc
+++ /dev/null
@@ -1,3 +0,0 @@
-on property:vendor.device.modules.ready=1
-    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/get_raw_data
-    chown system system /sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs/force_active
diff --git a/touch/syna/sepolicy/genfs_contexts b/touch/syna/sepolicy/genfs_contexts
index c34d93c..f2e675f 100644
--- a/touch/syna/sepolicy/genfs_contexts
+++ b/touch/syna/sepolicy/genfs_contexts
@@ -1,3 +1,3 @@
 genfscon sysfs /devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs     u:object_r:sysfs_touch:s0
+genfscon sysfs /devices/platform/111c0000.spi/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
 genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs   u:object_r:sysfs_touch:s0
-genfscon sysfs /devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/wakeup  u:object_r:sysfs_wakeup:s0
diff --git a/touch/syna/syna0.mk b/touch/syna/syna0.mk
index fe2b0c5..9e10d2a 100644
--- a/touch/syna/syna0.mk
+++ b/touch/syna/syna0.mk
@@ -1,4 +1,4 @@
-PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/10d10000.spi/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi0/spi0.0/synaptics_tcm.0/sysfs
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
 
diff --git a/touch/syna/syna19.mk b/touch/syna/syna19.mk
new file mode 100644
index 0000000..45b053b
--- /dev/null
+++ b/touch/syna/syna19.mk
@@ -0,0 +1,5 @@
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi19/spi19.0/synaptics_tcm.0/sysfs
+
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
+
+PRODUCT_PACKAGES += dump_syna.sh
diff --git a/touch/syna/syna20.mk b/touch/syna/syna20.mk
index 600f1ff..f8c0251 100644
--- a/touch/syna/syna20.mk
+++ b/touch/syna/syna20.mk
@@ -1,4 +1,4 @@
-PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/devices/platform/111d0000.spi/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs
+PRODUCT_VENDOR_PROPERTIES += ro.vendor.touch.dump.sys=/sys/class/spi_master/spi20/spi20.0/synaptics_tcm.0/sysfs
 
 BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/touch/syna/sepolicy
 
diff --git a/touch/twoshay/aidl/compatibility_matrix_gs101.xml b/touch/twoshay/aidl/compatibility_matrix_gs101.xml
new file mode 100644
index 0000000..aaa2d6e
--- /dev/null
+++ b/touch/twoshay/aidl/compatibility_matrix_gs101.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>com.google.input</name>
+        <version>2-3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/touch/twoshay/aidl/compatibility_matrix_zuma.xml b/touch/twoshay/aidl/compatibility_matrix_zuma.xml
new file mode 100644
index 0000000..25d5c50
--- /dev/null
+++ b/touch/twoshay/aidl/compatibility_matrix_zuma.xml
@@ -0,0 +1,26 @@
+<compatibility-matrix version="1.0" type="framework">
+    <hal format="aidl" optional="true">
+        <name>com.google.input</name>
+        <version>2-3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="true">
+        <name>com.google.input.algos.gril</name>
+        <version>2-3</version>
+        <interface>
+            <name>IGrilAntennaTuningService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl" optional="true">
+        <name>com.google.input.algos.spd</name>
+        <version>2-3</version>
+        <interface>
+            <name>IScreenProtectorDetectorService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</compatibility-matrix>
diff --git a/touch/twoshay/aidl/manifest_gs101.xml b/touch/twoshay/aidl/manifest_gs101.xml
new file mode 100644
index 0000000..28472a0
--- /dev/null
+++ b/touch/twoshay/aidl/manifest_gs101.xml
@@ -0,0 +1,10 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>com.google.input</name>
+        <version>3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/touch/twoshay/aidl/manifest_zuma.xml b/touch/twoshay/aidl/manifest_zuma.xml
new file mode 100644
index 0000000..dbac77d
--- /dev/null
+++ b/touch/twoshay/aidl/manifest_zuma.xml
@@ -0,0 +1,26 @@
+<manifest version="1.0" type="device">
+    <hal format="aidl">
+        <name>com.google.input</name>
+        <version>3</version>
+        <interface>
+            <name>ITouchContextService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl">
+        <name>com.google.input.algos.gril</name>
+        <version>3</version>
+        <interface>
+            <name>IGrilAntennaTuningService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+    <hal format="aidl">
+        <name>com.google.input.algos.spd</name>
+        <version>3</version>
+        <interface>
+            <name>IScreenProtectorDetectorService</name>
+            <instance>default</instance>
+        </interface>
+    </hal>
+</manifest>
diff --git a/touch/twoshay/aidl_gs101.mk b/touch/twoshay/aidl_gs101.mk
new file mode 100644
index 0000000..1676cba
--- /dev/null
+++ b/touch/twoshay/aidl_gs101.mk
@@ -0,0 +1,2 @@
+DEVICE_MANIFEST_FILE += device/google/gs-common/touch/twoshay/aidl/manifest_gs101.xml
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/touch/twoshay/aidl/compatibility_matrix_gs101.xml
diff --git a/touch/twoshay/aidl_zuma.mk b/touch/twoshay/aidl_zuma.mk
new file mode 100644
index 0000000..48714fe
--- /dev/null
+++ b/touch/twoshay/aidl_zuma.mk
@@ -0,0 +1,2 @@
+DEVICE_MANIFEST_FILE += device/google/gs-common/touch/twoshay/aidl/manifest_zuma.xml
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/touch/twoshay/aidl/compatibility_matrix_zuma.xml