diff --git a/cmds/dumpstate/Android.bp b/cmds/dumpstate/Android.bp
index a1c10f5..b22cc2a 100644
--- a/cmds/dumpstate/Android.bp
+++ b/cmds/dumpstate/Android.bp
@@ -159,7 +159,6 @@
         "tests/dumpstate_test.cpp",
     ],
     static_libs: [
-        "libc++fs",
         "libgmock",
     ],
     test_config: "dumpstate_test.xml",
diff --git a/cmds/servicemanager/Android.bp b/cmds/servicemanager/Android.bp
index 3897197..e5d7b74 100644
--- a/cmds/servicemanager/Android.bp
+++ b/cmds/servicemanager/Android.bp
@@ -29,6 +29,7 @@
         "liblog",
         "libutils",
         "libselinux",
+        "libperfetto_c",
     ],
 
     target: {
@@ -48,7 +49,13 @@
             enabled: false,
         },
         vendor: {
-            exclude_shared_libs: ["libvintf"],
+            exclude_shared_libs: [
+                "libvintf",
+                "libperfetto_c",
+            ],
+        },
+        recovery: {
+            exclude_shared_libs: ["libperfetto_c"],
         },
     },
 }
diff --git a/cmds/servicemanager/ServiceManager.cpp b/cmds/servicemanager/ServiceManager.cpp
index 95a05cd..1333599 100644
--- a/cmds/servicemanager/ServiceManager.cpp
+++ b/cmds/servicemanager/ServiceManager.cpp
@@ -18,6 +18,7 @@
 
 #include <android-base/logging.h>
 #include <android-base/properties.h>
+#include <android-base/scopeguard.h>
 #include <android-base/strings.h>
 #include <binder/BpBinder.h>
 #include <binder/IPCThreadState.h>
@@ -27,6 +28,11 @@
 #include <cutils/multiuser.h>
 #include <thread>
 
+#if !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+#include "perfetto/public/te_category_macros.h"
+#include "perfetto/public/te_macros.h"
+#endif // !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+
 #ifndef VENDORSERVICEMANAGER
 #include <vintf/VintfObject.h>
 #ifdef __ANDROID_RECOVERY__
@@ -42,6 +48,17 @@
 
 namespace android {
 
+#if defined(VENDORSERVICEMANAGER) || defined(__ANDROID_RECOVERY__)
+#define SM_PERFETTO_TRACE_FUNC(...)
+#else
+
+PERFETTO_TE_CATEGORIES_DEFINE(PERFETTO_SM_CATEGORIES);
+
+#define SM_PERFETTO_TRACE_FUNC(...) \
+    PERFETTO_TE_SCOPED(servicemanager, PERFETTO_TE_SLICE_BEGIN(__func__) __VA_OPT__(, ) __VA_ARGS__)
+
+#endif // !(defined(VENDORSERVICEMANAGER) || defined(__ANDROID_RECOVERY__))
+
 bool is_multiuser_uid_isolated(uid_t uid) {
     uid_t appid = multiuser_get_app_id(uid);
     return appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END;
@@ -348,18 +365,24 @@
 }
 
 Status ServiceManager::getService(const std::string& name, sp<IBinder>* outBinder) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     *outBinder = tryGetService(name, true);
     // returns ok regardless of result for legacy reasons
     return Status::ok();
 }
 
 Status ServiceManager::checkService(const std::string& name, sp<IBinder>* outBinder) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     *outBinder = tryGetService(name, false);
     // returns ok regardless of result for legacy reasons
     return Status::ok();
 }
 
 sp<IBinder> ServiceManager::tryGetService(const std::string& name, bool startIfNotFound) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     sp<IBinder> out;
@@ -398,6 +421,8 @@
 }
 
 bool isValidServiceName(const std::string& name) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     if (name.size() == 0) return false;
     if (name.size() > 127) return false;
 
@@ -413,6 +438,8 @@
 }
 
 Status ServiceManager::addService(const std::string& name, const sp<IBinder>& binder, bool allowIsolated, int32_t dumpPriority) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     if (multiuser_get_app_id(ctx.uid) >= AID_APP) {
@@ -505,6 +532,8 @@
 }
 
 Status ServiceManager::listServices(int32_t dumpPriority, std::vector<std::string>* outList) {
+    SM_PERFETTO_TRACE_FUNC();
+
     if (!mAccess->canList(mAccess->getCallingContext())) {
         return Status::fromExceptionCode(Status::EX_SECURITY, "SELinux denied.");
     }
@@ -532,6 +561,8 @@
 
 Status ServiceManager::registerForNotifications(
         const std::string& name, const sp<IServiceCallback>& callback) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     if (!mAccess->canFind(ctx, name)) {
@@ -578,6 +609,8 @@
 }
 Status ServiceManager::unregisterForNotifications(
         const std::string& name, const sp<IServiceCallback>& callback) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     if (!mAccess->canFind(ctx, name)) {
@@ -601,6 +634,8 @@
 }
 
 Status ServiceManager::isDeclared(const std::string& name, bool* outReturn) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     if (!mAccess->canFind(ctx, name)) {
@@ -616,6 +651,8 @@
 }
 
 binder::Status ServiceManager::getDeclaredInstances(const std::string& interface, std::vector<std::string>* outReturn) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("interface", interface.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     std::vector<std::string> allInstances;
@@ -640,6 +677,8 @@
 
 Status ServiceManager::updatableViaApex(const std::string& name,
                                         std::optional<std::string>* outReturn) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     if (!mAccess->canFind(ctx, name)) {
@@ -656,6 +695,8 @@
 
 Status ServiceManager::getUpdatableNames([[maybe_unused]] const std::string& apexName,
                                          std::vector<std::string>* outReturn) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("apexName", apexName.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     std::vector<std::string> apexUpdatableNames;
@@ -674,12 +715,13 @@
     if (outReturn->size() == 0 && apexUpdatableNames.size() != 0) {
         return Status::fromExceptionCode(Status::EX_SECURITY, "SELinux denied.");
     }
-
     return Status::ok();
 }
 
 Status ServiceManager::getConnectionInfo(const std::string& name,
                                          std::optional<ConnectionInfo>* outReturn) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     auto ctx = mAccess->getCallingContext();
 
     if (!mAccess->canFind(ctx, name)) {
@@ -697,6 +739,8 @@
 void ServiceManager::removeRegistrationCallback(const wp<IBinder>& who,
                                     ServiceCallbackMap::iterator* it,
                                     bool* found) {
+    SM_PERFETTO_TRACE_FUNC();
+
     std::vector<sp<IServiceCallback>>& listeners = (*it)->second;
 
     for (auto lit = listeners.begin(); lit != listeners.end();) {
@@ -716,6 +760,8 @@
 }
 
 void ServiceManager::binderDied(const wp<IBinder>& who) {
+    SM_PERFETTO_TRACE_FUNC();
+
     for (auto it = mNameToService.begin(); it != mNameToService.end();) {
         if (who == it->second.binder) {
             // TODO: currently, this entry contains the state also
@@ -758,6 +804,8 @@
 
 Status ServiceManager::registerClientCallback(const std::string& name, const sp<IBinder>& service,
                                               const sp<IClientCallback>& cb) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     if (cb == nullptr) {
         return Status::fromExceptionCode(Status::EX_NULL_POINTER, "Callback null.");
     }
@@ -918,6 +966,8 @@
 }
 
 Status ServiceManager::tryUnregisterService(const std::string& name, const sp<IBinder>& binder) {
+    SM_PERFETTO_TRACE_FUNC(PERFETTO_TE_ARG_STRING("name", name.c_str()));
+
     if (binder == nullptr) {
         return Status::fromExceptionCode(Status::EX_NULL_POINTER, "Null service.");
     }
@@ -983,6 +1033,7 @@
 }
 
 Status ServiceManager::getServiceDebugInfo(std::vector<ServiceDebugInfo>* outReturn) {
+    SM_PERFETTO_TRACE_FUNC();
     if (!mAccess->canList(mAccess->getCallingContext())) {
         return Status::fromExceptionCode(Status::EX_SECURITY, "SELinux denied.");
     }
diff --git a/cmds/servicemanager/ServiceManager.h b/cmds/servicemanager/ServiceManager.h
index 3b925a4..1536014 100644
--- a/cmds/servicemanager/ServiceManager.h
+++ b/cmds/servicemanager/ServiceManager.h
@@ -20,6 +20,10 @@
 #include <android/os/IClientCallback.h>
 #include <android/os/IServiceCallback.h>
 
+#if !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+#include "perfetto/public/te_category_macros.h"
+#endif // !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+
 #include "Access.h"
 
 namespace android {
@@ -29,6 +33,11 @@
 using os::IServiceCallback;
 using os::ServiceDebugInfo;
 
+#if !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+#define PERFETTO_SM_CATEGORIES(C) C(servicemanager, "servicemanager", "Service Manager category")
+PERFETTO_TE_CATEGORIES_DECLARE(PERFETTO_SM_CATEGORIES);
+#endif // !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+
 class ServiceManager : public os::BnServiceManager, public IBinder::DeathRecipient {
 public:
     ServiceManager(std::unique_ptr<Access>&& access);
diff --git a/cmds/servicemanager/main.cpp b/cmds/servicemanager/main.cpp
index 07908ba..c126e91 100644
--- a/cmds/servicemanager/main.cpp
+++ b/cmds/servicemanager/main.cpp
@@ -26,6 +26,26 @@
 #include "Access.h"
 #include "ServiceManager.h"
 
+#if !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+
+#include <perfetto/public/producer.h>
+#include <perfetto/public/te_category_macros.h>
+#include <perfetto/public/te_macros.h>
+#include <perfetto/public/track_event.h>
+
+namespace android {
+
+static void register_perfetto_te_categories() {
+    struct PerfettoProducerInitArgs perfetto_args = PERFETTO_PRODUCER_INIT_ARGS_INIT();
+    perfetto_args.backends = PERFETTO_BACKEND_SYSTEM;
+    PerfettoProducerInit(perfetto_args);
+    PerfettoTeInit();
+    PERFETTO_TE_REGISTER_CATEGORIES(PERFETTO_SM_CATEGORIES);
+}
+} // namespace android
+
+#endif // !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+
 using ::android::Access;
 using ::android::IPCThreadState;
 using ::android::Looper;
@@ -132,6 +152,10 @@
 
     const char* driver = argc == 2 ? argv[1] : "/dev/binder";
 
+#if !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+    android::register_perfetto_te_categories();
+#endif // !defined(VENDORSERVICEMANAGER) && !defined(__ANDROID_RECOVERY__)
+
     LOG(INFO) << "Starting sm instance on " << driver;
 
     sp<ProcessState> ps = ProcessState::initWithDriver(driver);
diff --git a/data/etc/Android.bp b/data/etc/Android.bp
index 707b998..b63d14b 100644
--- a/data/etc/Android.bp
+++ b/data/etc/Android.bp
@@ -412,6 +412,14 @@
     defaults: ["frameworks_native_data_etc_defaults"],
 }
 
+// installed in system
+prebuilt_etc {
+    name: "android.software.preview_sdk.prebuilt.xml",
+    relative_install_path: "permissions",
+    src: "android.software.preview_sdk.xml",
+    filename_from_src: true,
+}
+
 prebuilt_etc {
     name: "android.software.sip.voip.prebuilt.xml",
     src: "android.software.sip.voip.xml",
@@ -454,6 +462,22 @@
     defaults: ["frameworks_native_data_etc_defaults"],
 }
 
+// installed in system
+prebuilt_etc {
+    name: "android.software.webview.prebuilt.xml",
+    relative_install_path: "permissions",
+    src: "android.software.webview.xml",
+    filename_from_src: true,
+}
+
+// installed in system
+prebuilt_etc {
+    name: "android.software.window_magnification.prebuilt.xml",
+    relative_install_path: "permissions",
+    src: "android.software.window_magnification.xml",
+    filename_from_src: true,
+}
+
 prebuilt_etc {
     name: "aosp_excluded_hardware.prebuilt.xml",
     src: "aosp_excluded_hardware.xml",
diff --git a/include/android/system_fonts.h b/include/android/system_fonts.h
index 94484ea..2d3a214 100644
--- a/include/android/system_fonts.h
+++ b/include/android/system_fonts.h
@@ -31,27 +31,27 @@
  *
  * \code{.cpp}
  *   ASystemFontIterator* iterator = ASystemFontIterator_open();
- *   ASystemFont* font = NULL;
+ *   AFont* font = NULL;
  *
  *   while ((font = ASystemFontIterator_next(iterator)) != nullptr) {
  *       // Look if the font is your desired one.
- *       if (ASystemFont_getWeight(font) == 400 && !ASystemFont_isItalic(font)
- *           && ASystemFont_getLocale(font) == NULL) {
+ *       if (AFont_getWeight(font) == 400 && !AFont_isItalic(font)
+ *           && AFont_getLocale(font) == NULL) {
  *           break;
  *       }
- *       ASystemFont_close(font);
+ *       AFont_close(font);
  *   }
  *   ASystemFontIterator_close(iterator);
  *
- *   int fd = open(ASystemFont_getFontFilePath(font), O_RDONLY);
- *   int collectionIndex = ASystemFont_getCollectionINdex(font);
+ *   int fd = open(AFont_getFontFilePath(font), O_RDONLY | O_CLOEXEC);
+ *   int collectionIndex = AFont_getCollectionIndex(font);
  *   std::vector<std::pair<uint32_t, float>> variationSettings;
- *   for (size_t i = 0; i < ASystemFont_getAxisCount(font); ++i) {
+ *   for (size_t i = 0; i < AFont_getAxisCount(font); ++i) {
  *       variationSettings.push_back(std::make_pair(
- *           ASystemFont_getAxisTag(font, i),
- *           ASystemFont_getAxisValue(font, i)));
+ *           AFont_getAxisTag(font, i),
+ *           AFont_getAxisValue(font, i)));
  *   }
- *   ASystemFont_close(font);
+ *   AFont_close(font);
  *
  *   // Use this font for your text rendering engine.
  *
@@ -99,7 +99,7 @@
 /**
  * Create a system font iterator.
  *
- * Use ASystemFont_close() to close the iterator.
+ * Use ASystemFontIterator_close() to close the iterator.
  *
  * Available since API level 29.
  *
@@ -123,7 +123,7 @@
  *
  * \param iterator an iterator for the system fonts. Passing NULL is not allowed.
  * \return a font. If no more font is available, returns nullptr. You need to release the returned
- *         font by ASystemFont_close when it is no longer needed.
+ *         font with AFont_close() when it is no longer needed.
  */
 AFont* _Nullable ASystemFontIterator_next(ASystemFontIterator* _Nonnull iterator) __INTRODUCED_IN(29);
 
diff --git a/libs/binder/IPCThreadState.cpp b/libs/binder/IPCThreadState.cpp
index 8b65d63..c3bbdba 100644
--- a/libs/binder/IPCThreadState.cpp
+++ b/libs/binder/IPCThreadState.cpp
@@ -621,9 +621,8 @@
         if (cur < max) {
             return true;
         }
-        ALOGW("Waiting for thread to be free. mExecutingThreadsCount=%" PRId64
-              " mMaxThreads=%" PRId64 "\n",
-              cur, max);
+        ALOGW("Waiting for thread to be free. mExecutingThreadsCount=%zu mMaxThreads=%zu\n", cur,
+              max);
         return false;
     });
     mProcess->mOnThreadAvailableWaiting--;