diff --git a/fastboot/README.md b/fastboot/README.md
index 28e623c..6996d4a 100644
--- a/fastboot/README.md
+++ b/fastboot/README.md
@@ -25,7 +25,7 @@
 ## Transport and Framing
 
 1. Host sends a command, which is an ascii string in a single
-   packet no greater than 64 bytes.
+   packet no greater than 4096 bytes.
 
 2. Client response with a single packet no greater than 256 bytes.
    The first four bytes of the response are "OKAY", "FAIL", "DATA",
diff --git a/fastboot/constants.h b/fastboot/constants.h
index ad169d1..a803307 100644
--- a/fastboot/constants.h
+++ b/fastboot/constants.h
@@ -69,6 +69,7 @@
 #define FB_VAR_VARIANT "variant"
 #define FB_VAR_OFF_MODE_CHARGE_STATE "off-mode-charge"
 #define FB_VAR_BATTERY_VOLTAGE "battery-voltage"
+#define FB_VAR_BATTERY_SOC "battery-soc"
 #define FB_VAR_BATTERY_SOC_OK "battery-soc-ok"
 #define FB_VAR_SUPER_PARTITION_NAME "super-partition-name"
 #define FB_VAR_SNAPSHOT_UPDATE_STATUS "snapshot-update-status"
diff --git a/fastboot/device/commands.cpp b/fastboot/device/commands.cpp
index 6de598f..bd936ae 100644
--- a/fastboot/device/commands.cpp
+++ b/fastboot/device/commands.cpp
@@ -134,6 +134,7 @@
         {FB_VAR_IS_FORCE_DEBUGGABLE, {GetIsForceDebuggable, nullptr}},
         {FB_VAR_OFF_MODE_CHARGE_STATE, {GetOffModeChargeState, nullptr}},
         {FB_VAR_BATTERY_VOLTAGE, {GetBatteryVoltage, nullptr}},
+        {FB_VAR_BATTERY_SOC, {GetBatterySoC, nullptr}},
         {FB_VAR_BATTERY_SOC_OK, {GetBatterySoCOk, nullptr}},
         {FB_VAR_HW_REVISION, {GetHardwareRevision, nullptr}},
         {FB_VAR_SUPER_PARTITION_NAME, {GetSuperPartitionName, nullptr}},
diff --git a/fastboot/device/fastboot_device.cpp b/fastboot/device/fastboot_device.cpp
index 6b6a982..0dc4e97 100644
--- a/fastboot/device/fastboot_device.cpp
+++ b/fastboot/device/fastboot_device.cpp
@@ -151,7 +151,8 @@
 }
 
 BootControlClient* FastbootDevice::boot1_1() const {
-    if (boot_control_hal_->GetVersion() >= android::hal::BootControlVersion::BOOTCTL_V1_1) {
+    if (boot_control_hal_ &&
+        boot_control_hal_->GetVersion() >= android::hal::BootControlVersion::BOOTCTL_V1_1) {
         return boot_control_hal_.get();
     }
     return nullptr;
diff --git a/fastboot/device/variables.cpp b/fastboot/device/variables.cpp
index d2a7947..2847e35 100644
--- a/fastboot/device/variables.cpp
+++ b/fastboot/device/variables.cpp
@@ -130,6 +130,21 @@
     return true;
 }
 
+bool GetBatterySoCHelper(FastbootDevice* device, int32_t* battery_soc) {
+    using aidl::android::hardware::health::HealthInfo;
+
+    auto health_hal = device->health_hal();
+    if (!health_hal) {
+        return false;
+    }
+
+    HealthInfo health_info;
+    auto res = health_hal->getHealthInfo(&health_info);
+    if (!res.isOk()) return false;
+    *battery_soc = health_info.batteryLevel;
+    return true;
+}
+
 bool GetBatterySoCOk(FastbootDevice* device, const std::vector<std::string>& /* args */,
                      std::string* message) {
     int32_t battery_voltage = 0;
@@ -185,6 +200,17 @@
     return false;
 }
 
+bool GetBatterySoC(FastbootDevice* device, const std::vector<std::string>& /* args */,
+                   std::string* message) {
+    int32_t battery_soc = 0;
+    if (GetBatterySoCHelper(device, &battery_soc)) {
+        *message = std::to_string(battery_soc);
+        return true;
+    }
+    *message = "Unable to get battery soc";
+    return false;
+}
+
 bool GetCurrentSlot(FastbootDevice* device, const std::vector<std::string>& /* args */,
                     std::string* message) {
     std::string suffix = device->GetCurrentSlot();
diff --git a/fastboot/device/variables.h b/fastboot/device/variables.h
index 3b2d484..9a46786 100644
--- a/fastboot/device/variables.h
+++ b/fastboot/device/variables.h
@@ -63,6 +63,8 @@
                            std::string* message);
 bool GetBatteryVoltage(FastbootDevice* device, const std::vector<std::string>& args,
                        std::string* message);
+bool GetBatterySoC(FastbootDevice* device, const std::vector<std::string>& args,
+                   std::string* message);
 bool GetBatterySoCOk(FastbootDevice* device, const std::vector<std::string>& args,
                      std::string* message);
 bool GetSuperPartitionName(FastbootDevice* device, const std::vector<std::string>& args,
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index 3ce8141..56b90b9 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -1414,21 +1414,6 @@
     }
 }
 
-bool is_retrofit_device(const ImageSource* source) {
-    // Does this device use dynamic partitions at all?
-    std::vector<char> contents;
-    if (!source->ReadFile("super_empty.img", &contents)) {
-        return false;
-    }
-    auto metadata = android::fs_mgr::ReadFromImageBlob(contents.data(), contents.size());
-    for (const auto& partition : metadata->partitions) {
-        if (partition.attributes & LP_PARTITION_ATTR_SLOT_SUFFIXED) {
-            return true;
-        }
-    }
-    return false;
-}
-
 // Fetch a partition from the device to a given fd. This is a wrapper over FetchToFd to fetch
 // the full image.
 static uint64_t fetch_partition(const std::string& partition, borrowed_fd fd,
@@ -1525,7 +1510,7 @@
         fb->ResizePartition(pname, std::to_string(buf.image_size));
     }
     std::string flash_pname = repack_ramdisk(pname, &buf, fp->fb);
-    flash_buf(fp->source, flash_pname, &buf, apply_vbmeta);
+    flash_buf(fp->source.get(), flash_pname, &buf, apply_vbmeta);
 }
 
 // Sets slot_override as the active slot. If slot_override is blank,
@@ -1679,7 +1664,7 @@
     }
     for (size_t i = 0; i < tasks->size(); i++) {
         if (auto flash_task = tasks->at(i)->AsFlashTask()) {
-            if (FlashTask::IsDynamicParitition(fp->source, flash_task)) {
+            if (FlashTask::IsDynamicParitition(fp->source.get(), flash_task)) {
                 if (!loc) {
                     loc = i;
                 }
@@ -1810,7 +1795,8 @@
     if (fp_->exclude_dynamic_partitions) {
         auto is_non_static_flash_task = [&](const auto& task) -> bool {
             if (auto flash_task = task->AsFlashTask()) {
-                if (!should_flash_in_userspace(fp_->source, flash_task->GetPartitionAndSlot())) {
+                if (!should_flash_in_userspace(fp_->source.get(),
+                                               flash_task->GetPartitionAndSlot())) {
                     return false;
                 }
             }
@@ -1879,18 +1865,6 @@
 
     // Sync the super partition. This will reboot to userspace fastboot if needed.
     tasks.emplace_back(std::make_unique<UpdateSuperTask>(fp_));
-    for (const auto& [image, slot] : os_images_) {
-        // Retrofit devices have two super partitions, named super_a and super_b.
-        // On these devices, secondary slots must be flashed as physical
-        // partitions (otherwise they would not mount on first boot). To enforce
-        // this, we delete any logical partitions for the "other" slot.
-        if (is_retrofit_device(fp_->source)) {
-            std::string partition_name = image->part_name + "_" + slot;
-            if (image->IsSecondary() && should_flash_in_userspace(fp_->source, partition_name)) {
-                tasks.emplace_back(std::make_unique<DeleteTask>(fp_, partition_name));
-            }
-        }
-    }
 
     AddFlashTasks(os_images_, tasks);
 
@@ -1949,8 +1923,7 @@
     if (error != 0) {
         die("failed to open zip file '%s': %s", filename, ErrorCodeString(error));
     }
-    ZipImageSource zp = ZipImageSource(zip);
-    fp->source = &zp;
+    fp->source.reset(new ZipImageSource(zip));
     FlashAllTool tool(fp);
     tool.Flash();
 
@@ -1971,8 +1944,7 @@
 }
 
 static void do_flashall(FlashingPlan* fp) {
-    LocalImageSource s = LocalImageSource();
-    fp->source = &s;
+    fp->source.reset(new LocalImageSource());
     FlashAllTool tool(fp);
     tool.Flash();
 }
@@ -2089,7 +2061,7 @@
         die("Cannot read image: %s", strerror(errno));
     }
 
-    flash_buf(fp->source, partition, &buf, is_vbmeta_partition(partition));
+    flash_buf(fp->source.get(), partition, &buf, is_vbmeta_partition(partition));
     return;
 
 failed:
diff --git a/fastboot/fastboot.h b/fastboot/fastboot.h
index 4859ceb..2c40890 100644
--- a/fastboot/fastboot.h
+++ b/fastboot/fastboot.h
@@ -28,6 +28,7 @@
 #pragma once
 
 #include <functional>
+#include <memory>
 #include <string>
 #include "fastboot_driver_interface.h"
 #include "filesystem.h"
@@ -89,7 +90,7 @@
     // If the image uses the default slot, or the user specified "all", then
     // the paired string will be empty. If the image requests a specific slot
     // (for example, system_other) it is specified instead.
-    ImageSource* source;
+    std::unique_ptr<ImageSource> source;
     bool wants_wipe = false;
     bool skip_reboot = false;
     bool wants_set_active = false;
@@ -187,7 +188,6 @@
 std::vector<SparsePtr> resparse_file(sparse_file* s, int64_t max_size);
 
 bool supports_AB(fastboot::IFastBootDriver* fb);
-bool is_retrofit_device(const ImageSource* source);
 bool is_logical(const std::string& partition);
 void fb_perform_format(const std::string& partition, int skip_if_not_supported,
                        const std::string& type_override, const std::string& size_override,
diff --git a/fastboot/task.cpp b/fastboot/task.cpp
index 4b2b9e3..25c5a6e 100644
--- a/fastboot/task.cpp
+++ b/fastboot/task.cpp
@@ -41,7 +41,7 @@
 
 void FlashTask::Run() {
     auto flash = [&](const std::string& partition) {
-        if (should_flash_in_userspace(fp_->source, partition) && !is_userspace_fastboot() &&
+        if (should_flash_in_userspace(fp_->source.get(), partition) && !is_userspace_fastboot() &&
             !fp_->force_flash) {
             die("The partition you are trying to flash is dynamic, and "
                 "should be flashed via fastbootd. Please run:\n"
@@ -174,7 +174,7 @@
         LOG(VERBOSE) << "Cannot optimize flashing super for all slots";
         return nullptr;
     }
-    if (!CanOptimize(fp->source, tasks)) {
+    if (!CanOptimize(fp->source.get(), tasks)) {
         return nullptr;
     }
 
diff --git a/fastboot/task_test.cpp b/fastboot/task_test.cpp
index 1e25b6f..9cde1a8 100644
--- a/fastboot/task_test.cpp
+++ b/fastboot/task_test.cpp
@@ -192,8 +192,7 @@
         GTEST_SKIP();
     }
 
-    LocalImageSource s;
-    fp->source = &s;
+    fp->source.reset(new LocalImageSource);
     fp->sparse_limit = std::numeric_limits<int64_t>::max();
 
     fastboot::MockFastbootDriver fb;
@@ -239,8 +238,7 @@
         GTEST_SKIP();
     }
 
-    LocalImageSource s;
-    fp->source = &s;
+    fp->source.reset(new LocalImageSource);
 
     fastboot::MockFastbootDriver fb;
     fp->fb = &fb;
@@ -260,7 +258,7 @@
                 ParseFastbootInfoLine(fp.get(), android::base::Tokenize(test.first, " "));
         auto flash_task = task->AsFlashTask();
         ASSERT_FALSE(flash_task == nullptr);
-        ASSERT_EQ(FlashTask::IsDynamicParitition(fp->source, flash_task), test.second);
+        ASSERT_EQ(FlashTask::IsDynamicParitition(fp->source.get(), flash_task), test.second);
     }
 }
 
@@ -269,8 +267,7 @@
         GTEST_SKIP();
     }
 
-    LocalImageSource s;
-    fp->source = &s;
+    fp->source.reset(new LocalImageSource);
     fp->sparse_limit = std::numeric_limits<int64_t>::max();
 
     fastboot::MockFastbootDriver fb;
@@ -301,7 +298,7 @@
     for (auto& test : patternmatchtest) {
         std::vector<std::unique_ptr<Task>> tasks = ParseFastbootInfo(fp.get(), test.first);
         tasks.erase(std::remove_if(tasks.begin(), tasks.end(), remove_if_callback), tasks.end());
-        ASSERT_EQ(OptimizedFlashSuperTask::CanOptimize(fp->source, tasks), test.second);
+        ASSERT_EQ(OptimizedFlashSuperTask::CanOptimize(fp->source.get(), tasks), test.second);
     }
 }
 
@@ -312,8 +309,7 @@
         GTEST_SKIP();
     }
 
-    LocalImageSource s;
-    fp->source = &s;
+    fp->source.reset(new LocalImageSource);
     fp->sparse_limit = std::numeric_limits<int64_t>::max();
 
     fastboot::MockFastbootDriver fb;
@@ -362,7 +358,7 @@
                     contains_optimized_task = true;
                 }
                 if (auto flash_task = task->AsFlashTask()) {
-                    if (FlashTask::IsDynamicParitition(fp->source, flash_task)) {
+                    if (FlashTask::IsDynamicParitition(fp->source.get(), flash_task)) {
                         return false;
                     }
                 }
diff --git a/fs_mgr/TEST_MAPPING b/fs_mgr/TEST_MAPPING
index 37b4988..324f50a 100644
--- a/fs_mgr/TEST_MAPPING
+++ b/fs_mgr/TEST_MAPPING
@@ -36,10 +36,10 @@
   ],
   "kernel-presubmit": [
     {
-      "name": "vts_libdm_test"
+      "name": "libdm_test"
     },
     {
-      "name": "vts_core_liblp_test"
+      "name": "liblp_test"
     },
     {
       "name": "vts_libsnapshot_test"
diff --git a/fs_mgr/clean_scratch_files.rc b/fs_mgr/clean_scratch_files.rc
index 25a7e69..71708f8 100644
--- a/fs_mgr/clean_scratch_files.rc
+++ b/fs_mgr/clean_scratch_files.rc
@@ -1,2 +1,2 @@
-on post-fs-data && property:ro.debuggable=1
+on post-fs-data && property:ro.debuggable=1 && property:ro.boot.dynamic_partitions=true
     exec_background - root root -- /system/bin/clean_scratch_files
diff --git a/fs_mgr/libfiemap/metadata.cpp b/fs_mgr/libfiemap/metadata.cpp
index 22b8afb..0a56f6a 100644
--- a/fs_mgr/libfiemap/metadata.cpp
+++ b/fs_mgr/libfiemap/metadata.cpp
@@ -111,13 +111,7 @@
         return true;
     }
 
-    unique_fd fd(open(metadata_file.c_str(), O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC | O_BINARY | O_SYNC, 0644));
-    if (fd < 0) {
-        LOG(ERROR) << "open failed: " << metadata_file;
-        return false;
-    }
-
-    if (!WriteToImageFile(fd, *exported.get())) {
+    if (!WriteToImageFile(metadata_file, *exported.get())) {
         LOG(ERROR) << "Unable to save new metadata";
         return false;
     }
diff --git a/fs_mgr/liblp/Android.bp b/fs_mgr/liblp/Android.bp
index 996ffd7..24eebdf 100644
--- a/fs_mgr/liblp/Android.bp
+++ b/fs_mgr/liblp/Android.bp
@@ -93,8 +93,8 @@
     srcs: [
         "builder_test.cpp",
         "super_layout_builder_test.cpp",
-        "test_partition_opener.cpp",
         "utility_test.cpp",
+        ":TestPartitionOpener_group",
     ],
 }
 
@@ -122,3 +122,8 @@
     name: "vts_kernel_liblp_test",
     defaults: ["liblp_test_defaults"],
 }
+
+filegroup {
+   name: "TestPartitionOpener_group",
+   srcs: [ "test_partition_opener.cpp"],
+}
diff --git a/fs_mgr/liblp/fuzzer/Android.bp b/fs_mgr/liblp/fuzzer/Android.bp
new file mode 100644
index 0000000..a9e3509
--- /dev/null
+++ b/fs_mgr/liblp/fuzzer/Android.bp
@@ -0,0 +1,201 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+cc_defaults {
+    name: "liblp_fuzz_defaults",
+    header_libs: [
+        "libstorage_literals_headers",
+    ],
+    shared_libs: [
+        "liblp",
+        "libbase",
+        "liblog",
+    ],
+    static_libs: [
+        "libcutils",
+    ],
+    include_dirs: [
+        "system/core/fs_mgr/liblp",
+    ],
+    fuzz_config: {
+        cc: [
+            "android-media-fuzzing-reports@google.com",
+        ],
+        componentid: 59148,
+        hotlists: ["4593311"],
+        description: "The fuzzers target the APIs of all liblp modules",
+        vector: "local_no_privileges_required",
+        service_privilege: "privileged",
+        users: "multi_user",
+        fuzzed_code_usage: "shipped"
+    }
+}
+
+cc_fuzz {
+    name: "liblp_builder_fuzzer",
+    srcs: ["liblp_builder_fuzzer.cpp"],
+    defaults: ["liblp_fuzz_defaults"],
+}
+
+cc_fuzz {
+    name: "liblp_super_layout_builder_fuzzer",
+    srcs: ["liblp_super_layout_builder_fuzzer.cpp"],
+    defaults: ["liblp_fuzz_defaults"],
+}
+
+python_binary_host {
+    name: "image_gen_rand",
+    srcs: ["image_gen_rand.py"],
+}
+
+genrule_defaults {
+    name: "test_data_gen_defaults",
+    tools: [
+        "image_gen_rand",
+    ],
+}
+
+// Fake dtb image.
+genrule {
+    name: "test_dtb",
+    defaults: ["test_data_gen_defaults"],
+    out: ["test_dtb.img"],
+    cmd: "$(location image_gen_rand) --seed dtb --length 1024 > $(out)",
+}
+
+// Fake bootconfig image.
+genrule {
+    name: "test_bootconfig",
+    defaults: ["test_data_gen_defaults"],
+    out: ["test_bootconfig.img"],
+    cmd: "$(location image_gen_rand) --seed bootconfig --length 1024 > $(out)",
+}
+
+// Fake vendor ramdisk with type "none".
+genrule {
+    name: "test_vendor_ramdisk_none",
+    defaults: ["test_data_gen_defaults"],
+    out: ["test_vendor_ramdisk_none.img"],
+    cmd: "$(location image_gen_rand) --seed vendor_ramdisk_none --length 1024 > $(out)",
+}
+
+// Fake vendor ramdisk with type "platform".
+genrule {
+    name: "test_vendor_ramdisk_platform",
+    defaults: ["test_data_gen_defaults"],
+    out: ["test_vendor_ramdisk_platform.img"],
+    cmd: "$(location image_gen_rand) --seed vendor_ramdisk_platform --length 1024 > $(out)",
+}
+
+// Fake replacement ramdisk.
+genrule {
+    name: "test_vendor_ramdisk_replace",
+    defaults: ["test_data_gen_defaults"],
+    out: ["test_vendor_ramdisk_replace.img"],
+    cmd: "$(location image_gen_rand) --seed replace --length 3072 > $(out)",
+}
+
+// Genrules for test vendor boot images.
+fastboot_sign_test_image = "$(location avbtool) add_hash_footer --salt 00 --image $(out) " +
+    "--partition_name vendor_boot --partition_size $$(( 1 * 1024 * 1024 ))"
+
+genrule_defaults {
+    name: "test_vendor_boot_gen_defaults",
+    defaults: ["test_data_gen_defaults"],
+    tools: [
+        "avbtool",
+        "mkbootimg",
+    ],
+}
+
+genrule {
+    name: "test_vendor_boot_v3",
+    defaults: ["test_vendor_boot_gen_defaults"],
+    out: ["test_vendor_boot_v3.img"],
+    srcs: [
+        ":test_dtb",
+        ":test_vendor_ramdisk_none",
+    ],
+    cmd: "$(location mkbootimg) --header_version 3 " +
+        "--vendor_ramdisk $(location :test_vendor_ramdisk_none) " +
+        "--dtb $(location :test_dtb) " +
+        "--vendor_boot $(out) && " +
+        fastboot_sign_test_image,
+}
+
+genrule {
+    name: "test_vendor_boot_v4_without_frag",
+    defaults: ["test_vendor_boot_gen_defaults"],
+    out: ["test_vendor_boot_v4_without_frag.img"],
+    srcs: [
+        ":test_dtb",
+        ":test_vendor_ramdisk_none",
+        ":test_bootconfig",
+    ],
+    cmd: "$(location mkbootimg) --header_version 4 " +
+        "--vendor_ramdisk $(location :test_vendor_ramdisk_none) " +
+        "--dtb $(location :test_dtb) " +
+        "--vendor_bootconfig $(location :test_bootconfig) " +
+        "--vendor_boot $(out) && " +
+        fastboot_sign_test_image,
+}
+
+genrule {
+    name: "test_vendor_boot_v4_with_frag",
+    defaults: ["test_vendor_boot_gen_defaults"],
+    out: ["test_vendor_boot_v4_with_frag.img"],
+    srcs: [
+        ":test_dtb",
+        ":test_vendor_ramdisk_none",
+        ":test_vendor_ramdisk_platform",
+        ":test_bootconfig",
+    ],
+    cmd: "$(location mkbootimg) --header_version 4 " +
+        "--dtb $(location :test_dtb) " +
+        "--vendor_bootconfig $(location :test_bootconfig) " +
+        "--ramdisk_type none --ramdisk_name none_ramdisk " +
+        "--vendor_ramdisk_fragment $(location :test_vendor_ramdisk_none) " +
+        "--ramdisk_type platform --ramdisk_name platform_ramdisk " +
+        "--vendor_ramdisk_fragment $(location :test_vendor_ramdisk_platform) " +
+        "--vendor_boot $(out) && " +
+        fastboot_sign_test_image,
+}
+
+cc_fuzz {
+    name: "liblp_apis_fuzzer",
+    srcs: [
+        "liblp_apis_fuzzer.cpp",
+        ":TestPartitionOpener_group",
+    ],
+    defaults: ["liblp_fuzz_defaults"],
+    shared_libs: [
+        "libsparse",
+    ],
+    data: [
+        ":test_dtb",
+        ":test_bootconfig",
+        ":test_vendor_ramdisk_none",
+        ":test_vendor_ramdisk_platform",
+        ":test_vendor_ramdisk_replace",
+        ":test_vendor_boot_v3",
+        ":test_vendor_boot_v4_without_frag",
+        ":test_vendor_boot_v4_with_frag",
+    ],
+    cflags: [
+      "-Wno-unused-parameter",
+   ],
+}
diff --git a/fs_mgr/liblp/fuzzer/README.md b/fs_mgr/liblp/fuzzer/README.md
new file mode 100644
index 0000000..f831e2e
--- /dev/null
+++ b/fs_mgr/liblp/fuzzer/README.md
@@ -0,0 +1,136 @@
+# Fuzzers for liblp
+## Table of contents
++  [liblp_builder_fuzzer](#Builder)
++  [liblp_super_layout_builder_fuzzer](#SuperBuilder)
++  [liblp_apis_fuzzer](#APIs)
+
+# <a  name="Builder"></a> Fuzzer for LiblpBuilder
+
+LiblpBuilder supports the following parameters:
+1. kAttributeTypes (parameter name: "attribute")
+2. blockDevSize (parameter name: "blockdev_size")
+3. metadataMaxSize (parameter name: "metadata_max_size")
+4. metadataSlotCount (parameter name: "metadata_slot_count")
+5. partitionName (parameter name: "partition_name")
+6. superBlockDeviceName (parameter name: "block_device_name")
+7. blockDeviceInfoSize (parameter name: "block_device_info_size")
+8. alignment (parameter name: "alignment")
+9. alignmentOffset (parameter name: "alignment_offset")
+10. logicalBlockSize (parameter name: "logical_block_size")
+11. maxMetadataSize (parameter name: "max_metadata_size")
+12. numSlots (parameter name: "metadata_slot_count")
+13. deviceIndex (parameter name: "device_index")
+14. start (parameter name: "start")
+15. end (parameter name: "end")
+16. addedGroupName (parameter name: "group_name")
+17. partitionGroupName (parameter name: "partition_name")
+18. numSectors (parameter name: "num_sectors")
+19. physicalSector (parameter name: "physical_sector")
+20. resizedPartitionSize (parameter name: "requested_size")
+
+| Parameter| Valid Values| Configured Value|
+|------------- |-------------| ----- |
+|`kAttributeTypes`| 1.`LP_PARTITION_ATTR_NONE`,<br/> 2.`LP_PARTITION_ATTR_READONLY`,<br/> 3.`LP_PARTITION_ATTR_SLOT_SUFFIXED`,<br/> 4.`LP_PARTITION_ATTR_UPDATED`,<br/> 5.`LP_PARTITION_ATTR_DISABLED`|Value obtained from FuzzedDataProvider|
+|`blockDevSize`| Integer value from `0` to `100000`|Value obtained from FuzzedDataProvider|
+|`metadataMaxSize`| Integer value from `0` to `10000` |Value obtained from FuzzedDataProvider|
+|`metadataSlotCount`| Integer value from `0` to `2` |Value obtained from FuzzedDataProvider|
+|`partitionName`| String |Value obtained from FuzzedDataProvider|
+|`superBlockDeviceName`| String |Value obtained from FuzzedDataProvider|
+|`blockDeviceInfoSize`| Integer |Value obtained from FuzzedDataProvider|
+|`alignment`| Integer |Value obtained from FuzzedDataProvider|
+|`alignmentOffset`| Integer |Value obtained from FuzzedDataProvider|
+|`logicalBlockSize`| Integer |Value obtained from FuzzedDataProvider|
+|`maxMetadataSize`| Integer value from `0` to `10000` |Value obtained from FuzzedDataProvider|
+|`numSlots`| Integer value from `0` to `2` |Value obtained from FuzzedDataProvider|
+|`deviceIndex`| Integer |Value obtained from FuzzedDataProvider|
+|`start`| Integer |Value obtained from FuzzedDataProvider|
+|`end`| Integer |Value obtained from FuzzedDataProvider|
+|`partitionGroupName`| String |Value obtained from FuzzedDataProvider|
+|`numSectors`| Integer value from `1` to `1000000` |Value obtained from FuzzedDataProvider|
+|`physicalSector`| Integer value from `1` to `1000000` |Value obtained from FuzzedDataProvider|
+|`resizedPartitionSize`| Integer value from `0` to `10000` |Value obtained from FuzzedDataProvider|
+
+#### Steps to run
+1. Build the fuzzer
+```
+  $ mm -j$(nproc) liblp_builder_fuzzer
+```
+2. Run on device
+```
+  $ adb sync data
+  $ adb shell /data/fuzz/arm64/liblp_builder_fuzzer/liblp_builder_fuzzer
+```
+
+# <a  name="SuperBuilder"></a> Fuzzer for LiblpSuperLayoutBuilder
+
+SuperLayoutBuilder supports the following parameters:
+1. kAttributeTypes (parameter name: "attribute")
+2. blockDevSize (parameter name: "blockdev_size")
+3. metadataMaxSize (parameter name: "metadata_max_size")
+4. metadataSlotCount (parameter name: "metadata_slot_count")
+5. partitionName (parameter name: "partition_name")
+6. data (parameter name: "data")
+7. imageName (parameter name: "image_name")
+
+| Parameter| Valid Values| Configured Value|
+|------------- |-------------| ----- |
+|`kAttributeTypes`| 1.`LP_PARTITION_ATTR_NONE`,<br/> 2.`LP_PARTITION_ATTR_READONLY`,<br/> 3.`LP_PARTITION_ATTR_SLOT_SUFFIXED`,<br/> 4.`LP_PARTITION_ATTR_UPDATED`,<br/> 5.`LP_PARTITION_ATTR_DISABLED`|Value obtained from FuzzedDataProvider|
+|`blockDevSize`| Integer value from `0` to `100000`|Value obtained from FuzzedDataProvider|
+|`metadataMaxSize`| Integer value from `0` to `10000` |Value obtained from FuzzedDataProvider|
+|`metadataSlotCount`| Integer value from `0` to `2` |Value obtained from FuzzedDataProvider|
+|`partitionName`| String |Value obtained from FuzzedDataProvider|
+|`data`| String |Value obtained from FuzzedDataProvider|
+|`imageName`| String |Value obtained from FuzzedDataProvider|
+
+#### Steps to run
+1. Build the fuzzer
+```
+  $ mm -j$(nproc) liblp_super_layout_builder_fuzzer
+```
+2. Run on device
+```
+  $ adb sync data
+  $ adb shell /data/fuzz/arm64/liblp_super_layout_builder_fuzzer/liblp_super_layout_builder_fuzzer
+```
+
+# <a  name="APIs"></a> Fuzzer for LiblpApis
+
+LiblpAPIs supports the following parameters:
+1. blockDeviceInfoSize (parameter name: "block_device_info_size")
+2. alignment (parameter name: "alignment")
+3. alignmentOffset (parameter name: "alignment_offset")
+4. logicalBlockSize (parameter name: "logical_block_size")
+5. blockDevSize (parameter name: "blockdev_size")
+6. metadataMaxSize (parameter name: "metadata_max_size")
+7. metadataSlotCount (parameter name: "metadata_slot_count")
+8. blockDeviceInfoName (parameter name: "block_device_info_name")
+9. numSectors (parameter name: "num_sectors")
+10. physicalSector (parameter name: "physical_sector")
+11. sparsify (parameter name: "sparsify")
+12. buffer (parameter name: "data")
+
+| Parameter| Valid Values| Configured Value|
+|------------- |-------------| ----- |
+|`blockDeviceInfoSize`| Integer |Value obtained from FuzzedDataProvider|
+|`alignment`| Integer |Value obtained from FuzzedDataProvider|
+|`alignmentOffset`| Integer |Value obtained from FuzzedDataProvider|
+|`logicalBlockSize`| Integer |Value obtained from FuzzedDataProvider|
+|`blockDevSize`| Integer value in multiples of `LP_SECTOR_SIZE`|Value obtained from FuzzedDataProvider|
+|`metadataMaxSize`| Integer value from `0` to `10000` |Value obtained from FuzzedDataProvider|
+|`metadataSlotCount`| Integer value from `0` to `2` |Value obtained from FuzzedDataProvider|
+|`blockDeviceInfoName`| String |Value obtained from FuzzedDataProvider|
+|`numSectors`| Integer value from `1` to `1000000` |Value obtained from FuzzedDataProvider|
+|`physicalSector`| Integer value from `1` to `1000000` |Value obtained from FuzzedDataProvider|
+|`alignment`| Bool |Value obtained from FuzzedDataProvider|
+|`alignment`| Vector |Value obtained from FuzzedDataProvider|
+
+#### Steps to run
+1. Build the fuzzer
+```
+  $ mm -j$(nproc) liblp_apis_fuzzer
+```
+2. Run on device
+```
+  $ adb sync data
+  $ adb shell /data/fuzz/arm64/liblp_apis_fuzzer/liblp_apis_fuzzer
+```
diff --git a/fs_mgr/liblp/fuzzer/image_gen_rand.py b/fs_mgr/liblp/fuzzer/image_gen_rand.py
new file mode 100644
index 0000000..6e85472
--- /dev/null
+++ b/fs_mgr/liblp/fuzzer/image_gen_rand.py
@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+Write given number of random bytes, generated with optional seed.
+"""
+
+import random, argparse
+
+if __name__ == '__main__':
+  parser = argparse.ArgumentParser(description=__doc__)
+  parser.add_argument('--seed', help='Seed to random generator')
+  parser.add_argument('--length', type=int, required=True, help='Length of output')
+  args = parser.parse_args()
+
+  if args.seed:
+    random.seed(args.seed)
+
+  print(''.join(chr(random.randrange(0,0xff)) for _ in range(args.length)))
diff --git a/fs_mgr/liblp/fuzzer/liblp_apis_fuzzer.cpp b/fs_mgr/liblp/fuzzer/liblp_apis_fuzzer.cpp
new file mode 100644
index 0000000..b6fbc14
--- /dev/null
+++ b/fs_mgr/liblp/fuzzer/liblp_apis_fuzzer.cpp
@@ -0,0 +1,243 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <android-base/file.h>
+#include <fcntl.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <liblp/builder.h>
+#include <liblp/partition_opener.h>
+#include <linux/memfd.h>
+#include <sys/syscall.h>
+#include <writer.h>
+#include "images.h"
+#include "test_partition_opener.h"
+
+using namespace std;
+using namespace android;
+using namespace android::fs_mgr;
+using unique_fd = android::base::unique_fd;
+
+static constexpr size_t kDiskSize = 131072;
+static constexpr size_t kMetadataSize = 512;
+static constexpr size_t kMetadataSlots = 2;
+static constexpr uint32_t kMaxBytes = 20;
+static constexpr uint32_t kValidAlignment = 0;
+static constexpr uint32_t kValidAlignmentOffset = 0;
+static constexpr uint32_t kValidLogicalBlockSize = 4096;
+static constexpr uint32_t kMinMetadataSize = 0;
+static constexpr uint32_t kMaxMetadataSize = 10000;
+static constexpr uint32_t kMinSlot = 0;
+static constexpr uint32_t kMaxSlot = 10;
+static constexpr uint32_t kMinFactor = 0;
+static constexpr uint32_t kMaxFactor = 10;
+static constexpr uint32_t kMetadataGeometrySize = 4096;
+static constexpr uint64_t kValidNumSectors = 1901568;
+static constexpr uint64_t kValidPhysicalSector = 3608576;
+static constexpr uint64_t kMinSectorValue = 1;
+static constexpr uint64_t kMaxSectorValue = 1000000;
+static constexpr uint64_t kMaxBufferSize = 100000;
+
+const string kImageFile = "image_file";
+const string kSuperName = "super";
+const string kSystemPartitionName = "system";
+const string kPartitionName = "builder_partition";
+const string kSuperPartitionName = "super_partition";
+
+const string kSuffix[] = {"_a", "_b", "a", "b"};
+
+class LiplpApisFuzzer {
+  public:
+    LiplpApisFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){};
+    void process();
+
+  private:
+    void setupBuilder();
+    BlockDeviceInfo getBlockDevice();
+    FuzzedDataProvider mFdp;
+    unique_ptr<MetadataBuilder> mBuilder;
+    string mBlockDeviceInfoName;
+    string mSuperPartitionName;
+    string mPartitionName;
+    const string mImagePaths[10] = {
+            "data/test_dtb.img",
+            "data/test_bootconfig.img",
+            "data/test_vendor_ramdisk_none.img",
+            "data/test_vendor_ramdisk_platform.img",
+            "data/test_vendor_ramdisk_replace.img",
+            "data/test_vendor_boot_v4_with_frag.img",
+            "data/test_vendor_boot_v4_without_frag.img",
+            "data/test_vendor_boot_v3.img",
+            "dev/null",
+            mFdp.ConsumeRandomLengthString(kMaxBytes),
+    };
+};
+
+BlockDeviceInfo LiplpApisFuzzer::getBlockDevice() {
+    mBlockDeviceInfoName =
+            mFdp.ConsumeBool() ? kSuperName : mFdp.ConsumeRandomLengthString(kMaxBytes);
+    uint64_t blockDeviceInfoSize =
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint64_t>() : kDiskSize;
+    uint32_t alignment = mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>() : kValidAlignment;
+    uint32_t alignmentOffset =
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>() : kValidAlignmentOffset;
+    uint32_t logicalBlockSize =
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>() : kValidLogicalBlockSize;
+
+    BlockDeviceInfo superInfo{mBlockDeviceInfoName, blockDeviceInfoSize, alignment, alignmentOffset,
+                              logicalBlockSize};
+    return superInfo;
+}
+
+void LiplpApisFuzzer::setupBuilder() {
+    uint64_t randomBlockDevSize =
+            mFdp.ConsumeIntegralInRange<uint64_t>(kMinFactor, kMaxFactor) * LP_SECTOR_SIZE;
+    uint64_t blockDevSize = mFdp.ConsumeBool() ? randomBlockDevSize : kDiskSize;
+    uint32_t randomMetadataMaxSize =
+            mFdp.ConsumeIntegralInRange<uint32_t>(kMinMetadataSize, kMaxMetadataSize);
+    uint32_t metadataMaxSize = mFdp.ConsumeBool() ? kMetadataSize : randomMetadataMaxSize;
+    uint32_t metadataSlotCount = mFdp.ConsumeIntegralInRange<uint32_t>(kMinSlot, kMaxSlot);
+    mBuilder = MetadataBuilder::New(blockDevSize, metadataMaxSize, metadataSlotCount);
+
+    if (mBuilder.get()) {
+        mBuilder->AddPartition(kSystemPartitionName, LP_PARTITION_ATTR_READONLY);
+
+        mPartitionName =
+                mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes) : kPartitionName;
+        if (!mPartitionName.size()) {
+            mPartitionName = kPartitionName;
+        }
+        mSuperPartitionName = mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes)
+                                                 : kSuperPartitionName;
+        if (!mSuperPartitionName.size()) {
+            mSuperPartitionName = kSuperPartitionName;
+        }
+
+        Partition* super = mBuilder->AddPartition(mSuperPartitionName, LP_PARTITION_ATTR_READONLY);
+        mBuilder->AddPartition(mPartitionName, LP_PARTITION_ATTR_READONLY);
+
+        int64_t numSectors = mFdp.ConsumeBool() ? mFdp.ConsumeIntegralInRange<uint64_t>(
+                                                          kMinSectorValue, kMaxSectorValue)
+                                                : kValidNumSectors;
+        int64_t physicalSector = mFdp.ConsumeBool() ? mFdp.ConsumeIntegralInRange<uint64_t>(
+                                                              kMinSectorValue, kMaxSectorValue)
+                                                    : kValidPhysicalSector;
+
+        mBuilder->AddLinearExtent(super, mBlockDeviceInfoName, numSectors, physicalSector);
+    }
+}
+
+void LiplpApisFuzzer::process() {
+    BlockDeviceInfo superInfo = getBlockDevice();
+    unique_fd fd(syscall(__NR_memfd_create, "image_file", MFD_ALLOW_SEALING));
+    setupBuilder();
+
+    TestPartitionOpener opener(
+            {{mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes) : kSuperName, fd}},
+            {{mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes) : kSuperName,
+              superInfo}});
+
+    if (mBuilder.get()) {
+        unique_ptr<LpMetadata> metadata = mBuilder->Export();
+        const LpMetadata& metadataValue = *metadata.get();
+
+        map<string, string> images = {};
+        if (mFdp.ConsumeBool()) {
+            images[mSuperPartitionName] = mFdp.PickValueInArray(mImagePaths);
+        }
+
+        while (mFdp.remaining_bytes()) {
+            auto invokeAPIs = mFdp.PickValueInArray<const function<void()>>({
+                    [&]() { WriteToImageFile(fd, metadataValue); },
+                    [&]() { WriteToImageFile(kImageFile.c_str(), metadataValue); },
+                    [&]() { FlashPartitionTable(opener, kSuperName, metadataValue); },
+                    [&]() {
+                        UpdatePartitionTable(opener, mPartitionName, metadataValue,
+                                             mFdp.ConsumeBool() ? 0 : 1 /* slot_number */);
+                    },
+                    [&]() {
+                        ReadMetadata(mPartitionName, mFdp.ConsumeBool() ? 0 : 1 /* slot_number */);
+                    },
+                    [&]() { FlashPartitionTable(mPartitionName, metadataValue); },
+                    [&]() {
+                        UpdatePartitionTable(mPartitionName, metadataValue,
+                                             mFdp.ConsumeBool() ? 0 : 1 /* slot_number */);
+                    },
+                    [&]() {
+                        WriteToImageFile(kImageFile.c_str(), metadataValue,
+                                         metadata->geometry.logical_block_size, images,
+                                         mFdp.ConsumeBool() ? true : false /* sparsify */);
+                    },
+
+                    [&]() {
+                        WriteSplitImageFiles(kImageFile.c_str(), metadataValue,
+                                             metadata->geometry.logical_block_size, images,
+                                             mFdp.ConsumeBool() ? true : false /* sparsify */);
+                    },
+                    [&]() { ReadFromImageFile(kImageFile.c_str()); },
+                    [&]() { IsEmptySuperImage(kImageFile.c_str()); },
+                    [&]() {
+                        uint64_t bufferSize = mFdp.ConsumeIntegralInRange<uint64_t>(
+                                2 * kMetadataGeometrySize, kMaxBufferSize);
+                        vector<uint8_t> buffer = mFdp.ConsumeBytes<uint8_t>(kMaxBytes);
+                        buffer.resize(bufferSize);
+                        ReadFromImageBlob(buffer.data(), buffer.size());
+                    },
+                    [&]() {
+                        uint32_t groupVectorSize = metadata->groups.size();
+                        uint32_t randomGroupIndex =
+                                mFdp.ConsumeIntegralInRange<uint32_t>(0, groupVectorSize);
+                        GetPartitionGroupName(metadata->groups[randomGroupIndex]);
+                    },
+                    [&]() {
+                        uint32_t blockDeviceVectorSize = metadata->block_devices.size();
+                        uint32_t randomBlockDeviceIndex =
+                                mFdp.ConsumeIntegralInRange<uint32_t>(0, blockDeviceVectorSize);
+                        GetBlockDevicePartitionName(
+                                metadata->block_devices[randomBlockDeviceIndex]);
+                    },
+                    [&]() { GetMetadataSuperBlockDevice(metadataValue); },
+                    [&]() {
+                        string suffix = mFdp.ConsumeBool()
+                                                ? mFdp.PickValueInArray<string>(kSuffix)
+                                                : mFdp.ConsumeRandomLengthString(kMaxBytes);
+                        SlotNumberForSlotSuffix(suffix);
+                    },
+                    [&]() {
+                        auto entry = FindPartition(metadataValue, kSystemPartitionName);
+                        GetPartitionSize(metadataValue, *entry);
+                    },
+                    [&]() { GetPartitionSlotSuffix(mPartitionName); },
+                    [&]() { FindPartition(metadataValue, mPartitionName); },
+                    [&]() {
+                        uint32_t partitionVectorSize = metadata->partitions.size();
+                        uint32_t randomPartitionIndex =
+                                mFdp.ConsumeIntegralInRange<uint32_t>(0, partitionVectorSize);
+                        GetPartitionName(metadata->partitions[randomPartitionIndex]);
+                    },
+                    [&]() { GetTotalSuperPartitionSize(metadataValue); },
+                    [&]() { GetBlockDevicePartitionNames(metadataValue); },
+            });
+            invokeAPIs();
+        }
+        remove(kImageFile.c_str());
+    }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    LiplpApisFuzzer liplpApisFuzzer(data, size);
+    liplpApisFuzzer.process();
+    return 0;
+}
diff --git a/fs_mgr/liblp/fuzzer/liblp_builder_fuzzer.cpp b/fs_mgr/liblp/fuzzer/liblp_builder_fuzzer.cpp
new file mode 100644
index 0000000..e5fbe27
--- /dev/null
+++ b/fs_mgr/liblp/fuzzer/liblp_builder_fuzzer.cpp
@@ -0,0 +1,438 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <fuzzer/FuzzedDataProvider.h>
+#include <liblp/builder.h>
+#include <liblp/property_fetcher.h>
+#include <storage_literals/storage_literals.h>
+
+using namespace android::fs_mgr;
+using namespace std;
+using namespace android::storage_literals;
+
+static constexpr uint64_t kValidBlockSize = 4096 * 50;
+static constexpr uint64_t kBlockDeviceInfoSize = 1024 * 1024;
+static constexpr uint64_t kValidBlockDeviceInfoSize = 8_GiB;
+static constexpr uint64_t kValidMaxGroupSize = 40960;
+static constexpr uint64_t kMinBlockDevValue = 0;
+static constexpr uint64_t kMaxBlockDevValue = 100000;
+static constexpr uint64_t kMinSectorValue = 1;
+static constexpr uint64_t kMaxSectorValue = 1000000;
+static constexpr uint64_t kMinValue = 0;
+static constexpr uint64_t kMaxValue = 10000;
+static constexpr uint64_t kValidNumSectors = 1901568;
+static constexpr uint64_t kValidPhysicalSector = 3608576;
+static constexpr uint64_t kMinElements = 0;
+static constexpr uint64_t kMaxElements = 10;
+static constexpr uint32_t kValidAlignment = 786432;
+static constexpr uint32_t kValidMetadataSize = 40960;
+static constexpr uint32_t kValidAlignmentOffset = 229376;
+static constexpr uint32_t kValidLogicalBlockSize = 4096;
+static constexpr uint32_t kValidMaxMetadataSize = 65536;
+static constexpr uint32_t kMinMetadataValue = 0;
+static constexpr uint32_t kMaxMetadataValue = 10000;
+static constexpr uint32_t kZeroAlignment = 0;
+static constexpr uint32_t kZeroAlignmentOffset = 0;
+static constexpr uint32_t kMaxBytes = 20;
+static constexpr uint32_t kMinSlot = 0;
+static constexpr uint32_t kMaxSlot = 10;
+static constexpr uint32_t kMinBuilder = 0;
+static constexpr uint32_t kMaxBuilder = 4;
+
+const uint64_t kAttributeTypes[] = {
+        LP_PARTITION_ATTR_NONE,    LP_PARTITION_ATTR_READONLY, LP_PARTITION_ATTR_SLOT_SUFFIXED,
+        LP_PARTITION_ATTR_UPDATED, LP_PARTITION_ATTR_DISABLED,
+};
+
+const string kFuzzPartitionName = "fuzz_partition_name";
+const string kSuperPartitionName = "super_partition";
+const string kDeviceInfoName = "super";
+const string kDefaultGroupName = "default";
+
+class BuilderFuzzer {
+  public:
+    BuilderFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){};
+    void process();
+
+  private:
+    FuzzedDataProvider mFdp;
+    void invokeBuilderAPIs();
+    void selectRandomBuilder(int32_t randomBuilder, string superBlockDeviceName);
+    void setupBuilder(string superBlockDeviceName);
+    void callChangePartitionGroup();
+    void callVerifyExtentsAgainstSourceMetadata();
+    vector<BlockDeviceInfo> mBlockDevices;
+    unique_ptr<MetadataBuilder> mBuilder;
+    string mResizePartitionName;
+    string mGroupNames[4] = {
+            "default",
+            "group_a",
+            "group_b",
+            mFdp.ConsumeRandomLengthString(kMaxBytes),
+    };
+    string mPartitionNames[5] = {
+            "system_a",
+            "vendor_a",
+            "system_b",
+            "vendor_b",
+            mFdp.ConsumeRandomLengthString(kMaxBytes),
+    };
+    Partition* mPartition;
+    Partition* mFuzzPartition;
+    Partition* mResizePartition;
+    template <typename T>
+    T getParamValue(T validValue) {
+        T parameter = validValue;
+        if (mFdp.ConsumeBool()) {
+            parameter = mFdp.ConsumeIntegralInRange<T>(kMinValue, kMaxValue);
+        }
+        return parameter;
+    }
+};
+
+void BuilderFuzzer::selectRandomBuilder(int32_t randomBuilder, string superBlockDeviceName) {
+    switch (randomBuilder) {
+        case 0: {
+            uint32_t maxMetadataSize = getParamValue(kValidMaxMetadataSize);
+            uint32_t numSlots = mFdp.ConsumeBool()
+                                        ? kMaxSlot
+                                        : mFdp.ConsumeIntegralInRange<uint32_t>(kMinSlot, kMaxSlot);
+            mBuilder = MetadataBuilder::New(mBlockDevices, superBlockDeviceName, maxMetadataSize,
+                                            numSlots);
+            break;
+        }
+        case 1: {
+            uint64_t blockDevSize =
+                    mFdp.ConsumeIntegralInRange<uint64_t>(kMinBlockDevValue, kMaxBlockDevValue);
+            uint32_t metadataMaxSize =
+                    mFdp.ConsumeIntegralInRange<uint32_t>(kMinMetadataValue, kMaxMetadataValue);
+            uint32_t metadataSlotCount = mFdp.ConsumeIntegralInRange<uint32_t>(kMinSlot, kMaxSlot);
+            mBuilder = MetadataBuilder::New(blockDevSize, metadataMaxSize, metadataSlotCount);
+            break;
+        }
+        case 2: {
+            uint64_t blockDevSize = getParamValue(kValidBlockSize);
+            uint32_t metadataSize = getParamValue(kValidMetadataSize);
+            uint32_t metadataSlotCount = mFdp.ConsumeIntegralInRange<uint32_t>(kMinSlot, kMaxSlot);
+            mBuilder = MetadataBuilder::New(blockDevSize, metadataSize, metadataSlotCount);
+            break;
+        }
+        case 3: {
+            string superPartitionName = mFdp.ConsumeBool()
+                                                ? kSuperPartitionName
+                                                : mFdp.ConsumeRandomLengthString(kMaxBytes);
+            mBuilder = MetadataBuilder::New(PartitionOpener(), superPartitionName,
+                                            mFdp.ConsumeIntegralInRange(0, 1) /* slot_number */);
+            break;
+        }
+        case 4: {
+            string superPartitionName = mFdp.ConsumeBool()
+                                                ? kSuperPartitionName
+                                                : mFdp.ConsumeRandomLengthString(kMaxBytes);
+            mBuilder = MetadataBuilder::New(
+                    superPartitionName,
+                    mFdp.ConsumeIntegralInRange<uint32_t>(0, 1) /* slot_number */);
+            break;
+        }
+    }
+}
+
+void BuilderFuzzer::setupBuilder(string superBlockDeviceName) {
+    uint64_t blockDeviceInfoSize =
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint64_t>() : kValidBlockDeviceInfoSize;
+    uint32_t alignment = mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>() : kValidAlignment;
+    uint32_t alignmentOffset =
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>() : kValidAlignmentOffset;
+    uint32_t logicalBlockSize =
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>() : kValidLogicalBlockSize;
+    BlockDeviceInfo super(superBlockDeviceName, blockDeviceInfoSize, alignment, alignmentOffset,
+                          logicalBlockSize);
+    mBlockDevices.push_back(super);
+
+    mBuilder->AddGroup(kDefaultGroupName, mFdp.ConsumeIntegral<uint64_t>() /* max_size */);
+    mPartition = mBuilder->AddPartition(kSuperPartitionName, LP_PARTITION_ATTR_READONLY);
+
+    mFuzzPartition = mBuilder->AddPartition(kFuzzPartitionName, kDefaultGroupName,
+                                            LP_PARTITION_ATTR_READONLY);
+
+    string mResizePartitionName = mFdp.ConsumeRandomLengthString(kMaxBytes);
+    if (!mResizePartitionName.size()) {
+        mResizePartitionName = "resize_partition";
+    }
+    mResizePartition = mBuilder->AddPartition(mResizePartitionName, kDefaultGroupName,
+                                              LP_PARTITION_ATTR_READONLY);
+
+    string changePartitionDeviceInfoName =
+            mFdp.ConsumeBool() ? kDeviceInfoName : mFdp.ConsumeRandomLengthString(kMaxBytes);
+    BlockDeviceInfo changePartitionDeviceInfo(
+            changePartitionDeviceInfoName,
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint64_t>() : kBlockDeviceInfoSize /* size */,
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>()
+                               : kZeroAlignmentOffset /* alignment */,
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>()
+                               : kZeroAlignmentOffset /* alignment_offset */,
+            mFdp.ConsumeBool() ? mFdp.ConsumeIntegral<uint32_t>()
+                               : kValidLogicalBlockSize /* logical_block_size */);
+    mBlockDevices.push_back(changePartitionDeviceInfo);
+}
+
+void BuilderFuzzer::callChangePartitionGroup() {
+    string group1 = mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes) : "group1";
+    uint64_t group1Size = getParamValue(0);
+
+    string group2 = mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes) : "group2";
+    uint64_t group2Size = getParamValue(0);
+
+    bool group1Added = mBuilder->AddGroup(group1, group1Size);
+    bool group2Added = mBuilder->AddGroup(group2, group2Size);
+
+    string changeGroupPartitionName = mFdp.ConsumeRandomLengthString(kMaxBytes);
+    if (changeGroupPartitionName.size() && group1Added && group2Added) {
+        Partition* changeGroupPartition = mBuilder->AddPartition(changeGroupPartitionName, group1,
+                                                                 LP_PARTITION_ATTR_READONLY);
+        if (changeGroupPartition) {
+            mBuilder->ChangePartitionGroup(changeGroupPartition, group2);
+        }
+    }
+}
+
+void BuilderFuzzer::callVerifyExtentsAgainstSourceMetadata() {
+    uint64_t sourceBlockDevSize = getParamValue(kValidBlockSize);
+    uint32_t sourceMetadataMaxSize = getParamValue(kValidMetadataSize);
+    uint32_t sourceSlotCount = mFdp.ConsumeIntegralInRange<uint32_t>(0, 2);
+    auto sourceBuilder =
+            MetadataBuilder::New(sourceBlockDevSize, sourceMetadataMaxSize, sourceSlotCount);
+
+    uint64_t targetBlockDevSize = getParamValue(kValidBlockSize);
+    uint32_t targetMetadataMaxSize = getParamValue(kValidMetadataSize);
+    uint32_t targetSlotCount = mFdp.ConsumeIntegralInRange<uint32_t>(0, 2);
+    auto targetBuilder =
+            MetadataBuilder::New(targetBlockDevSize, targetMetadataMaxSize, targetSlotCount);
+
+    if (sourceBuilder && targetBuilder) {
+        int64_t sourceGroups = mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+        for (int64_t idx = 0; idx < sourceGroups; ++idx) {
+            sourceBuilder->AddGroup(
+                    mFdp.PickValueInArray(mGroupNames),
+                    mFdp.ConsumeBool() ? kValidMaxGroupSize : mFdp.ConsumeIntegral<uint64_t>());
+        }
+
+        int64_t sourcePartitions = mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+        for (int64_t idx = 0; idx < sourcePartitions; ++idx) {
+            sourceBuilder->AddPartition(mFdp.PickValueInArray(mPartitionNames),
+                                        LP_PARTITION_ATTR_READONLY);
+        }
+
+        int64_t targetGroups = mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+        for (int64_t idx = 0; idx < targetGroups; ++idx) {
+            targetBuilder->AddGroup(
+                    mFdp.PickValueInArray(mGroupNames),
+                    mFdp.ConsumeBool() ? kValidMaxGroupSize : mFdp.ConsumeIntegral<uint64_t>());
+        }
+
+        int64_t targetPartitions = mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+        for (int64_t idx = 0; idx < targetPartitions; ++idx) {
+            targetBuilder->AddPartition(mFdp.PickValueInArray(mPartitionNames),
+                                        LP_PARTITION_ATTR_READONLY);
+        }
+
+        MetadataBuilder::VerifyExtentsAgainstSourceMetadata(
+                *sourceBuilder, mFdp.ConsumeBool() ? 0 : 1 /* source_slot_number */, *targetBuilder,
+                mFdp.ConsumeBool() ? 0 : 1 /* target_slot_number */,
+                vector<string>{"system", "vendor", mFdp.ConsumeRandomLengthString(kMaxBytes)});
+    }
+}
+
+void BuilderFuzzer::invokeBuilderAPIs() {
+    string superBlockDeviceName =
+            mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes) : kDeviceInfoName;
+    uint32_t randomBuilder = mFdp.ConsumeIntegralInRange<uint32_t>(kMinBuilder, kMaxBuilder);
+    selectRandomBuilder(randomBuilder, superBlockDeviceName);
+
+    if (mBuilder.get()) {
+        setupBuilder(superBlockDeviceName);
+
+        while (mFdp.remaining_bytes()) {
+            auto invokeAPIs = mFdp.PickValueInArray<const function<void()>>({
+                    [&]() { callChangePartitionGroup(); },
+                    [&]() {
+                        string addedGroupName = mFdp.PickValueInArray(mGroupNames);
+                        mBuilder->AddGroup(addedGroupName,
+                                           mFdp.ConsumeIntegralInRange<uint64_t>(
+                                                   kMinValue, kMaxValue) /* max_size */);
+                    },
+                    [&]() {
+                        string partitionName = mFdp.PickValueInArray(mPartitionNames);
+                        Partition* addedPartition = mBuilder->AddPartition(
+                                partitionName, mFdp.PickValueInArray(kAttributeTypes));
+                    },
+                    [&]() {
+                        int64_t numSectors = mFdp.ConsumeBool()
+                                                     ? mFdp.ConsumeIntegralInRange<uint64_t>(
+                                                               kMinSectorValue, kMaxSectorValue)
+                                                     : kValidNumSectors;
+                        int64_t physicalSector = mFdp.ConsumeBool()
+                                                         ? mFdp.ConsumeIntegralInRange<uint64_t>(
+                                                                   kMinSectorValue, kMaxSectorValue)
+                                                         : kValidPhysicalSector;
+
+                        int64_t numExtents =
+                                mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+                        bool extentAdded = false;
+                        for (int64_t i = 0; i <= numExtents; ++i) {
+                            extentAdded = mBuilder->AddLinearExtent(mFuzzPartition, kDeviceInfoName,
+                                                                    numSectors, physicalSector);
+                        }
+
+                        if (extentAdded) {
+                            unique_ptr<LpMetadata> metadata = mBuilder->Export();
+                            uint64_t alignedSize =
+                                    mFdp.ConsumeIntegralInRange<uint64_t>(kMinValue, kMaxValue);
+                            mFuzzPartition->GetBeginningExtents(LP_SECTOR_SIZE * numExtents);
+                        }
+                    },
+                    [&]() { callVerifyExtentsAgainstSourceMetadata(); },
+                    [&]() { mBuilder->ListPartitionsInGroup(mFdp.PickValueInArray(mGroupNames)); },
+                    [&]() {
+                        int64_t maxSize = mFdp.ConsumeIntegral<uint64_t>();
+                        mBuilder->ChangeGroupSize(mFdp.PickValueInArray(mGroupNames), maxSize);
+                    },
+                    [&]() {
+                        string deviceInfoName = mFdp.ConsumeBool()
+                                                        ? kDeviceInfoName
+                                                        : mFdp.ConsumeRandomLengthString(kMaxBytes);
+                        mBuilder->GetBlockDeviceInfo(deviceInfoName, &mBlockDevices[1]);
+                    },
+                    [&]() {
+                        string deviceInfoName = mFdp.ConsumeBool()
+                                                        ? kDeviceInfoName
+                                                        : mFdp.ConsumeRandomLengthString(kMaxBytes);
+                        mBuilder->UpdateBlockDeviceInfo(deviceInfoName, mBlockDevices[1]);
+                    },
+                    [&]() {
+                        unique_ptr<LpMetadata> metadata = mBuilder->Export();
+                        mBuilder->ImportPartitions(*metadata.get(),
+                                                   {mFdp.PickValueInArray(mPartitionNames)});
+                    },
+                    [&]() { mBuilder->HasBlockDevice(mFdp.PickValueInArray(mPartitionNames)); },
+                    [&]() { mBuilder->SetVirtualABDeviceFlag(); },
+                    [&]() { mBuilder->SetAutoSlotSuffixing(); },
+                    [&]() { mBuilder->ListGroups(); },
+                    [&]() { mBuilder->UsedSpace(); },
+                    [&]() { mBuilder->RequireExpandedMetadataHeader(); },
+                    [&]() {
+                        uint64_t resizedPartitionSize = getParamValue(0);
+                        mBuilder->ResizePartition(mResizePartition, resizedPartitionSize);
+                    },
+                    [&]() {
+                        uint32_t sourceSlot = mFdp.ConsumeBool() ? 0 : 1;
+                        uint32_t targetSlot = mFdp.ConsumeBool() ? 0 : 1;
+                        PartitionOpener partitionOpener;
+                        string sourcePartition =
+                                mFdp.ConsumeBool() ? kFuzzPartitionName : kDeviceInfoName;
+
+                        MetadataBuilder::NewForUpdate(partitionOpener, sourcePartition, sourceSlot,
+                                                      targetSlot);
+                        partitionOpener.GetDeviceString(mFdp.PickValueInArray(mPartitionNames));
+                    },
+                    [&]() {
+                        unique_ptr<LpMetadata> metadata = mBuilder->Export();
+                        MetadataBuilder::New(*metadata.get());
+                    },
+                    [&]() { mBuilder->AllocatableSpace(); },
+                    [&]() {
+                        PartitionOpener pOpener;
+                        string superPartitionName =
+                                mFdp.ConsumeBool() ? kSuperPartitionName
+                                                   : mFdp.ConsumeRandomLengthString(kMaxBytes);
+                        pOpener.Open(superPartitionName, O_RDONLY);
+                        pOpener.GetInfo(superPartitionName, &mBlockDevices[0]);
+                    },
+                    [&]() {
+                        PartitionOpener pOpener;
+                        string superPartitionName =
+                                mFdp.ConsumeBool() ? kSuperPartitionName
+                                                   : mFdp.ConsumeRandomLengthString(kMaxBytes);
+                        pOpener.Open(superPartitionName, O_RDONLY);
+                        pOpener.GetDeviceString(superPartitionName);
+                    },
+                    [&]() {
+                        Interval::Intersect(
+                                Interval(mFdp.ConsumeIntegral<uint64_t>() /* device _index */,
+                                         mFdp.ConsumeIntegral<uint64_t>() /* start */,
+                                         mFdp.ConsumeIntegral<uint64_t>()) /* end */,
+                                Interval(mFdp.ConsumeIntegral<uint64_t>() /* device _index */,
+                                         mFdp.ConsumeIntegral<uint64_t>() /* start */,
+                                         mFdp.ConsumeIntegral<uint64_t>() /* end */));
+                    },
+                    [&]() {
+                        vector<Interval> intervalVectorA;
+                        int64_t internalVectorAElements =
+                                mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+                        for (int64_t idx = 0; idx < internalVectorAElements; ++idx) {
+                            intervalVectorA.push_back(
+                                    Interval(mFdp.ConsumeIntegral<uint64_t>() /* device _index */,
+                                             mFdp.ConsumeIntegral<uint64_t>() /* start */,
+                                             mFdp.ConsumeIntegral<uint64_t>() /* end */));
+                        }
+
+                        vector<Interval> intervalVectorB;
+                        int64_t internalVectorBElements =
+                                mFdp.ConsumeIntegralInRange<int64_t>(kMinElements, kMaxElements);
+                        for (int64_t idx = 0; idx < internalVectorBElements; ++idx) {
+                            intervalVectorB.push_back(
+                                    Interval(mFdp.ConsumeIntegral<uint64_t>() /* device _index */,
+                                             mFdp.ConsumeIntegral<uint64_t>() /* start */,
+                                             mFdp.ConsumeIntegral<uint64_t>() /* end */));
+                        }
+
+                        Interval::Intersect(intervalVectorA, intervalVectorB);
+                    },
+                    [&]() {
+                        uint64_t numSectors =
+                                mFdp.ConsumeIntegralInRange<uint64_t>(kMinValue, kMaxValue);
+                        uint32_t deviceIndex =
+                                mFdp.ConsumeIntegralInRange<uint32_t>(kMinValue, kMaxValue);
+                        uint64_t physicalSector =
+                                mFdp.ConsumeIntegralInRange<uint64_t>(kMinValue, kMaxValue);
+                        LinearExtent extent(numSectors, deviceIndex, physicalSector);
+                        extent.AsInterval();
+                    },
+                    [&]() {
+                        IPropertyFetcher::OverrideForTesting(std::make_unique<PropertyFetcher>());
+                    },
+            });
+            invokeAPIs();
+        }
+        if (mFdp.ConsumeBool()) {
+            mBuilder->RemoveGroupAndPartitions(mFdp.PickValueInArray(mGroupNames));
+        } else {
+            string removePartition = mFdp.PickValueInArray(mPartitionNames);
+            mBuilder->RemovePartition(removePartition);
+        }
+    }
+}
+
+void BuilderFuzzer::process() {
+    invokeBuilderAPIs();
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    BuilderFuzzer builderFuzzer(data, size);
+    builderFuzzer.process();
+    return 0;
+}
diff --git a/fs_mgr/liblp/fuzzer/liblp_super_layout_builder_fuzzer.cpp b/fs_mgr/liblp/fuzzer/liblp_super_layout_builder_fuzzer.cpp
new file mode 100644
index 0000000..887093c
--- /dev/null
+++ b/fs_mgr/liblp/fuzzer/liblp_super_layout_builder_fuzzer.cpp
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include <android-base/unique_fd.h>
+#include <fcntl.h>
+#include <fuzzer/FuzzedDataProvider.h>
+#include <liblp/metadata_format.h>
+#include <liblp/super_layout_builder.h>
+#include <linux/memfd.h>
+#include <storage_literals/storage_literals.h>
+#include <sys/syscall.h>
+
+using namespace android::fs_mgr;
+using namespace std;
+using unique_fd = android::base::unique_fd;
+using namespace android::storage_literals;
+
+static constexpr uint64_t kSuperLayoutValidBlockDevSize = 4_MiB;
+static constexpr uint64_t kMinBlockDevValue = 0;
+static constexpr uint64_t kMaxBlockDevValue = 100000;
+static constexpr uint64_t kMinElements = 0;
+static constexpr uint64_t kMaxElements = 10;
+static constexpr uint32_t kSuperLayoutValidMetadataSize = 8_KiB;
+static constexpr uint32_t kMinMetadataValue = 0;
+static constexpr uint32_t kMaxMetadataValue = 10000;
+static constexpr uint32_t kMaxBytes = 20;
+static constexpr uint32_t kMinSlot = 0;
+static constexpr uint32_t kMaxSlot = 10;
+static constexpr uint32_t kMinOpen = 0;
+static constexpr uint32_t kMaxOpen = 2;
+
+const uint64_t kAttributeTypes[] = {
+        LP_PARTITION_ATTR_NONE,    LP_PARTITION_ATTR_READONLY, LP_PARTITION_ATTR_SLOT_SUFFIXED,
+        LP_PARTITION_ATTR_UPDATED, LP_PARTITION_ATTR_DISABLED,
+};
+
+class SuperLayoutBuilderFuzzer {
+  public:
+    SuperLayoutBuilderFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){};
+    void process();
+
+  private:
+    FuzzedDataProvider mFdp;
+    void invokeSuperLayoutBuilderAPIs();
+    void callRandomOpen(int32_t open);
+    void addMultiplePartitions(int32_t numPartitions);
+    void setupSuperLayoutBuilder(string fuzzPartitionName);
+    SuperLayoutBuilder mSuperLayoutBuilder;
+    unique_ptr<MetadataBuilder> mSuperBuilder;
+    unique_ptr<LpMetadata> mMetadata;
+    bool mOpenSuccess = false;
+};
+
+void SuperLayoutBuilderFuzzer::setupSuperLayoutBuilder(string fuzzPartitionName) {
+    uint64_t randomBlockDevSize =
+            mFdp.ConsumeIntegralInRange<uint64_t>(kMinBlockDevValue, kMaxBlockDevValue);
+    uint64_t blockDevSize = mFdp.ConsumeBool() ? kSuperLayoutValidBlockDevSize : randomBlockDevSize;
+    uint32_t randomMetadataMaxSize =
+            mFdp.ConsumeIntegralInRange<uint32_t>(kMinMetadataValue, kMaxMetadataValue);
+    uint32_t metadataMaxSize =
+            mFdp.ConsumeBool() ? kSuperLayoutValidMetadataSize : randomMetadataMaxSize;
+    uint32_t metadataSlotCount = mFdp.ConsumeIntegralInRange<uint32_t>(kMinSlot, kMaxSlot);
+    mSuperBuilder = MetadataBuilder::New(blockDevSize, metadataMaxSize, metadataSlotCount);
+
+    if (mSuperBuilder.get()) {
+        if (mFdp.ConsumeBool()) {
+            int32_t numPartitions =
+                    mFdp.ConsumeIntegralInRange<int32_t>(kMinElements, kMaxElements);
+            addMultiplePartitions(numPartitions);
+        }
+
+        uint32_t randomOpen = mFdp.ConsumeIntegralInRange<uint32_t>(kMinOpen, kMaxOpen);
+        callRandomOpen(randomOpen);
+
+        if (!fuzzPartitionName.size()) {
+            fuzzPartitionName = "builder_partition";
+        }
+    }
+}
+
+void SuperLayoutBuilderFuzzer::addMultiplePartitions(int32_t numPartitions) {
+    for (int32_t idx = 0; idx < numPartitions; ++idx) {
+        string partitionName = mFdp.ConsumeBool() ? mFdp.ConsumeRandomLengthString(kMaxBytes)
+                                                  : "builder_partition";
+        mSuperBuilder->AddPartition(partitionName, mFdp.PickValueInArray(kAttributeTypes));
+    }
+}
+
+void SuperLayoutBuilderFuzzer::callRandomOpen(int32_t open) {
+    mMetadata = mSuperBuilder->Export();
+    switch (open) {
+        case 0: {
+            vector<uint8_t> imageData = mFdp.ConsumeBytes<uint8_t>(kMaxBytes);
+            mOpenSuccess = mSuperLayoutBuilder.Open((void*)(imageData.data()), imageData.size());
+            break;
+        }
+        case 1: {
+            mOpenSuccess = mSuperLayoutBuilder.Open(*mMetadata.get());
+            break;
+        }
+        case 2: {
+            unique_fd fd(syscall(__NR_memfd_create, "image_file", 0));
+            WriteToImageFile(fd, *mMetadata.get());
+            mOpenSuccess = mSuperLayoutBuilder.Open(fd);
+            break;
+        }
+    }
+}
+
+void SuperLayoutBuilderFuzzer::invokeSuperLayoutBuilderAPIs() {
+    string imageName = mFdp.ConsumeRandomLengthString(kMaxBytes);
+    string fuzzPartitionName =
+            mFdp.ConsumeBool() ? "builder_partition" : mFdp.ConsumeRandomLengthString(kMaxBytes);
+    setupSuperLayoutBuilder(fuzzPartitionName);
+    if (mOpenSuccess) {
+        while (mFdp.remaining_bytes()) {
+            auto invokeSuperAPIs = mFdp.PickValueInArray<const function<void()>>({
+                    [&]() { mSuperLayoutBuilder.GetImageLayout(); },
+                    [&]() {
+                        mSuperLayoutBuilder.AddPartition(fuzzPartitionName, imageName,
+                                                         mFdp.ConsumeIntegral<uint64_t>());
+                    },
+            });
+            invokeSuperAPIs();
+        }
+    }
+}
+
+void SuperLayoutBuilderFuzzer::process() {
+    invokeSuperLayoutBuilderAPIs();
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    SuperLayoutBuilderFuzzer superLayoutBuilderFuzzer(data, size);
+    superLayoutBuilderFuzzer.process();
+    return 0;
+}
diff --git a/fs_mgr/liblp/images.cpp b/fs_mgr/liblp/images.cpp
index 02b64ac..a2dbb10 100644
--- a/fs_mgr/liblp/images.cpp
+++ b/fs_mgr/liblp/images.cpp
@@ -123,13 +123,46 @@
     return true;
 }
 
-bool WriteToImageFile(const std::string& file, const LpMetadata& input) {
-    unique_fd fd(open(file.c_str(), O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC | O_BINARY, 0644));
-    if (fd < 0) {
-        PERROR << __PRETTY_FUNCTION__ << " open failed: " << file;
+#if !defined(_WIN32)
+bool FsyncDirectory(const char* dirname) {
+    android::base::unique_fd fd(TEMP_FAILURE_RETRY(open(dirname, O_RDONLY | O_CLOEXEC)));
+    if (fd == -1) {
+        PLOG(ERROR) << "Failed to open " << dirname;
         return false;
     }
-    return WriteToImageFile(fd, input);
+    if (fsync(fd) == -1) {
+        if (errno == EROFS || errno == EINVAL) {
+            PLOG(WARNING) << "Skip fsync " << dirname
+                          << " on a file system does not support synchronization";
+        } else {
+            PLOG(ERROR) << "Failed to fsync " << dirname;
+            return false;
+        }
+    }
+    return true;
+}
+#endif
+
+bool WriteToImageFile(const std::string& file, const LpMetadata& input) {
+    const auto parent_dir = base::Dirname(file);
+    TemporaryFile tmpfile(parent_dir);
+    if (!WriteToImageFile(tmpfile.fd, input)) {
+        PLOG(ERROR) << "Failed to write geometry data to tmpfile " << tmpfile.path;
+        return false;
+    }
+
+#if !defined(_WIN32)
+    fsync(tmpfile.fd);
+#endif
+    const auto err = rename(tmpfile.path, file.c_str());
+    if (err != 0) {
+        PLOG(ERROR) << "Failed to rename tmp geometry file " << tmpfile.path << " to " << file;
+        return false;
+    }
+#if !defined(_WIN32)
+    FsyncDirectory(parent_dir.c_str());
+#endif
+    return true;
 }
 
 ImageBuilder::ImageBuilder(const LpMetadata& metadata, uint32_t block_size,
@@ -208,7 +241,8 @@
         std::string file_name = "super_" + name + ".img";
         std::string file_path = output_dir + "/" + file_name;
 
-        static const int kOpenFlags = O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC | O_NOFOLLOW | O_BINARY;
+        static const int kOpenFlags =
+                O_CREAT | O_RDWR | O_TRUNC | O_CLOEXEC | O_NOFOLLOW | O_BINARY;
         unique_fd fd(open(file_path.c_str(), kOpenFlags, 0644));
         if (fd < 0) {
             PERROR << "open failed: " << file_path;
diff --git a/fs_mgr/libsnapshot/Android.bp b/fs_mgr/libsnapshot/Android.bp
index 0131f73..6fad662 100644
--- a/fs_mgr/libsnapshot/Android.bp
+++ b/fs_mgr/libsnapshot/Android.bp
@@ -201,6 +201,7 @@
         "libsnapshot_cow/snapshot_reader.cpp",
         "libsnapshot_cow/writer_base.cpp",
         "libsnapshot_cow/writer_v2.cpp",
+        "libsnapshot_cow/writer_v3.cpp",
     ],
     export_include_dirs: ["include"],
     host_supported: true,
@@ -392,6 +393,7 @@
     srcs: [
         "libsnapshot_cow/snapshot_reader_test.cpp",
         "libsnapshot_cow/test_v2.cpp",
+        "libsnapshot_cow/test_v3.cpp",
     ],
     cflags: [
         "-D_FILE_OFFSET_BITS=64",
@@ -415,6 +417,9 @@
     test_options: {
         min_shipping_api_level: 30,
     },
+    data: [
+        "tools/testdata/cow_v2",
+    ],
     auto_gen_config: true,
     require_root: false,
     host_supported: true,
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h
index fd12b84..8191d61 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_compress.h
@@ -29,12 +29,14 @@
 
     virtual ~ICompressor() {}
     // Factory methods for compression methods.
-    static std::unique_ptr<ICompressor> Gz(uint32_t compression_level, const int32_t BLOCK_SZ);
-    static std::unique_ptr<ICompressor> Brotli(uint32_t compression_level, const int32_t BLOCK_SZ);
-    static std::unique_ptr<ICompressor> Lz4(uint32_t compression_level, const int32_t BLOCK_SZ);
-    static std::unique_ptr<ICompressor> Zstd(uint32_t compression_level, const int32_t BLOCK_SZ);
+    static std::unique_ptr<ICompressor> Gz(uint32_t compression_level, const int32_t block_size);
+    static std::unique_ptr<ICompressor> Brotli(uint32_t compression_level,
+                                               const int32_t block_size);
+    static std::unique_ptr<ICompressor> Lz4(uint32_t compression_level, const int32_t block_size);
+    static std::unique_ptr<ICompressor> Zstd(uint32_t compression_level, const int32_t block_size);
 
-    static std::unique_ptr<ICompressor> Create(CowCompression compression, const int32_t BLOCK_SZ);
+    static std::unique_ptr<ICompressor> Create(CowCompression compression,
+                                               const int32_t block_size);
 
     uint32_t GetCompressionLevel() const { return compression_level_; }
     uint32_t GetBlockSize() const { return block_size_; }
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
index 9359b9e..c9777a3 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
@@ -22,6 +22,9 @@
 namespace android {
 namespace snapshot {
 
+struct CowOperationV3;
+typedef CowOperationV3 CowOperation;
+
 static constexpr uint64_t kCowMagicNumber = 0x436f77634f572121ULL;
 static constexpr uint32_t kCowVersionMajor = 2;
 static constexpr uint32_t kCowVersionMinor = 0;
@@ -88,6 +91,18 @@
 
     // Scratch space used during merge
     uint32_t buffer_size;
+
+} __attribute__((packed));
+
+struct CowHeaderV3 : public CowHeader {
+    // Location of sequence buffer in COW.
+    uint64_t sequence_buffer_offset;
+    // Size, in bytes, of the CowResumePoint buffer.
+    uint32_t resume_buffer_size;
+    // Size, in bytes, of the CowOperation buffer.
+    uint32_t op_buffer_size;
+    // Compression Algorithm
+    uint32_t compression_algorithm;
 } __attribute__((packed));
 
 // This structure is the same size of a normal Operation, but is repurposed for the footer.
@@ -109,43 +124,7 @@
     uint64_t num_ops;
 } __attribute__((packed));
 
-// Cow operations are currently fixed-size entries, but this may change if
-// needed.
-struct CowOperation {
-    // The operation code (see the constants and structures below).
-    uint8_t type;
-
-    // If this operation reads from the data section of the COW, this contains
-    // the compression type of that data (see constants below).
-    uint8_t compression;
-
-    // If this operation reads from the data section of the COW, this contains
-    // the length.
-    uint16_t data_length;
-
-    // The block of data in the new image that this operation modifies.
-    uint64_t new_block;
-
-    // The value of |source| depends on the operation code.
-    //
-    // For copy operations, this is a block location in the source image.
-    //
-    // For replace operations, this is a byte offset within the COW's data
-    // sections (eg, not landing within the header or metadata). It is an
-    // absolute position within the image.
-    //
-    // For zero operations (replace with all zeroes), this is unused and must
-    // be zero.
-    //
-    // For Label operations, this is the value of the applied label.
-    //
-    // For Cluster operations, this is the length of the following data region
-    //
-    // For Xor operations, this is the byte location in the source image.
-    uint64_t source;
-} __attribute__((packed));
-
-// The on disk format of cow (currently ==  CowOperation)
+// V2 version of COW. On disk format for older devices
 struct CowOperationV2 {
     // The operation code (see the constants and structures below).
     uint8_t type;
@@ -180,8 +159,33 @@
     uint64_t source;
 } __attribute__((packed));
 
-static_assert(sizeof(CowOperationV2) == sizeof(CowOperation));
-static_assert(sizeof(CowOperation) == sizeof(CowFooterOperation));
+// The on disk format of cow (currently ==  CowOperation)
+struct CowOperationV3 {
+    // The operation code (see the constants and structures below).
+    uint8_t type;
+
+    // If this operation reads from the data section of the COW, this contains
+    // the length.
+    uint16_t data_length;
+
+    // The block of data in the new image that this operation modifies.
+    uint32_t new_block;
+
+    // The value of |source| depends on the operation code.
+    //
+    // CopyOp: a 32-bit block location in the source image.
+    // ReplaceOp: an absolute byte offset within the COW's data section.
+    // XorOp: an absolute byte offset in the source image.
+    // ZeroOp: unused
+    // LabelOp: a 64-bit opaque identifier.
+    //
+    // For ops other than Label:
+    //  Bits 47-62 are reserved and must be zero.
+    // A block is compressed if it’s data is < block_sz
+    uint64_t source_info;
+} __attribute__((packed));
+
+static_assert(sizeof(CowOperationV2) == sizeof(CowFooterOperation));
 
 static constexpr uint8_t kCowCopyOp = 1;
 static constexpr uint8_t kCowReplaceOp = 2;
@@ -208,11 +212,10 @@
 static constexpr uint8_t kCowReadAheadInProgress = 1;
 static constexpr uint8_t kCowReadAheadDone = 2;
 
-static inline uint64_t GetCowOpSourceInfoData(const CowOperation* op) {
-    return op->source;
-}
-static inline bool GetCowOpSourceInfoCompression(const CowOperation* op) {
-    return op->compression != kCowCompressNone;
+static constexpr uint64_t kCowOpSourceInfoDataMask = (1ULL << 48) - 1;
+
+static inline uint64_t GetCowOpSourceInfoData(const CowOperation& op) {
+    return op.source_info & kCowOpSourceInfoDataMask;
 }
 
 struct CowFooter {
@@ -236,10 +239,12 @@
 // 2MB Scratch space used for read-ahead
 static constexpr uint64_t BUFFER_REGION_DEFAULT_SIZE = (1ULL << 21);
 
+std::ostream& operator<<(std::ostream& os, CowOperationV2 const& arg);
+
 std::ostream& operator<<(std::ostream& os, CowOperation const& arg);
 
-int64_t GetNextOpOffset(const CowOperation& op, uint32_t cluster_size);
-int64_t GetNextDataOffset(const CowOperation& op, uint32_t cluster_size);
+int64_t GetNextOpOffset(const CowOperationV2& op, uint32_t cluster_size);
+int64_t GetNextDataOffset(const CowOperationV2& op, uint32_t cluster_size);
 
 // Ops that are internal to the Cow Format and not OTA data
 bool IsMetadataOp(const CowOperation& op);
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h
index 67d301d..2721937 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_reader.h
@@ -165,9 +165,10 @@
     void UpdateMergeOpsCompleted(int num_merge_ops) { header_.num_merge_ops += num_merge_ops; }
 
   private:
+    bool ParseV2(android::base::borrowed_fd fd, std::optional<uint64_t> label);
     bool PrepMergeOps();
     uint64_t FindNumCopyops();
-    uint8_t GetCompressionType(const CowOperation* op);
+    uint8_t GetCompressionType();
 
     android::base::unique_fd owned_fd_;
     android::base::borrowed_fd fd_;
@@ -184,7 +185,10 @@
     std::shared_ptr<std::unordered_map<uint64_t, uint64_t>> data_loc_;
     ReaderFlags reader_flag_;
     bool is_merge_{};
+    uint8_t compression_type_ = kCowCompressNone;
 };
 
+bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header);
+
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h b/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h
index e7b0020..08a79ba 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h
@@ -405,15 +405,6 @@
 
     // Add new public entries above this line.
 
-    // Helpers for failure injection.
-    using MergeConsistencyChecker =
-            std::function<MergeFailureCode(const std::string& name, const SnapshotStatus& status)>;
-
-    void set_merge_consistency_checker(MergeConsistencyChecker checker) {
-        merge_consistency_checker_ = checker;
-    }
-    MergeConsistencyChecker merge_consistency_checker() const { return merge_consistency_checker_; }
-
   private:
     FRIEND_TEST(SnapshotTest, CleanFirstStageMount);
     FRIEND_TEST(SnapshotTest, CreateSnapshot);
@@ -657,8 +648,6 @@
     MergeResult CheckMergeState(LockedFile* lock, const std::function<bool()>& before_cancel);
     MergeResult CheckTargetMergeState(LockedFile* lock, const std::string& name,
                                       const SnapshotUpdateStatus& update_status);
-    MergeFailureCode CheckMergeConsistency(LockedFile* lock, const std::string& name,
-                                           const SnapshotStatus& update_status);
 
     auto UpdateStateToStr(enum UpdateState state);
     // Get status or table information about a device-mapper node with a single target.
@@ -847,7 +836,6 @@
     std::unique_ptr<SnapuserdClient> snapuserd_client_;
     std::unique_ptr<LpMetadata> old_partition_metadata_;
     std::optional<bool> is_snapshot_userspace_;
-    MergeConsistencyChecker merge_consistency_checker_;
 };
 
 }  // namespace snapshot
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_format.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/cow_format.cpp
index ff3ccec..b905291 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_format.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_format.cpp
@@ -14,57 +14,93 @@
 // limitations under the License.
 //
 
+#include <inttypes.h>
 #include <libsnapshot/cow_format.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 #include <android-base/logging.h>
+#include <android-base/stringprintf.h>
+#include <libsnapshot/cow_format.h>
 #include "writer_v2.h"
+#include "writer_v3.h"
 
 namespace android {
 namespace snapshot {
 
 using android::base::unique_fd;
 
-std::ostream& operator<<(std::ostream& os, CowOperation const& op) {
-    os << "CowOperation(type:";
-    if (op.type == kCowCopyOp)
-        os << "kCowCopyOp,    ";
-    else if (op.type == kCowReplaceOp)
-        os << "kCowReplaceOp, ";
-    else if (op.type == kCowZeroOp)
-        os << "kZeroOp,       ";
-    else if (op.type == kCowFooterOp)
-        os << "kCowFooterOp,  ";
-    else if (op.type == kCowLabelOp)
-        os << "kCowLabelOp,   ";
-    else if (op.type == kCowClusterOp)
-        os << "kCowClusterOp  ";
-    else if (op.type == kCowXorOp)
-        os << "kCowXorOp      ";
-    else if (op.type == kCowSequenceOp)
-        os << "kCowSequenceOp ";
-    else if (op.type == kCowFooterOp)
-        os << "kCowFooterOp  ";
-    else
-        os << (int)op.type << "?,";
-    os << "compression:";
-    if (op.compression == kCowCompressNone)
-        os << "kCowCompressNone,   ";
-    else if (op.compression == kCowCompressGz)
-        os << "kCowCompressGz,     ";
-    else if (op.compression == kCowCompressBrotli)
-        os << "kCowCompressBrotli, ";
-    else
-        os << (int)op.compression << "?, ";
-    os << "data_length:" << op.data_length << ",\t";
-    os << "new_block:" << op.new_block << ",\t";
+std::ostream& EmitCowTypeString(std::ostream& os, uint8_t cow_type) {
+    switch (cow_type) {
+        case kCowCopyOp:
+            return os << "kCowCopyOp";
+        case kCowReplaceOp:
+            return os << "kCowReplaceOp";
+        case kCowZeroOp:
+            return os << "kZeroOp";
+        case kCowFooterOp:
+            return os << "kCowFooterOp";
+        case kCowLabelOp:
+            return os << "kCowLabelOp";
+        case kCowClusterOp:
+            return os << "kCowClusterOp";
+        case kCowXorOp:
+            return os << "kCowXorOp";
+        case kCowSequenceOp:
+            return os << "kCowSequenceOp";
+        default:
+            return os << (int)cow_type << "unknown";
+    }
+}
+
+std::ostream& operator<<(std::ostream& os, CowOperationV2 const& op) {
+    os << "CowOperationV2(";
+    EmitCowTypeString(os, op.type) << ", ";
+    switch (op.compression) {
+        case kCowCompressNone:
+            os << "uncompressed, ";
+            break;
+        case kCowCompressGz:
+            os << "gz, ";
+            break;
+        case kCowCompressBrotli:
+            os << "brotli, ";
+            break;
+        case kCowCompressLz4:
+            os << "lz4, ";
+            break;
+        case kCowCompressZstd:
+            os << "zstd, ";
+            break;
+    }
+    os << "data_length:" << op.data_length << ", ";
+    os << "new_block:" << op.new_block << ", ";
     os << "source:" << op.source;
     os << ")";
     return os;
 }
 
-int64_t GetNextOpOffset(const CowOperation& op, uint32_t cluster_ops) {
+std::ostream& operator<<(std::ostream& os, CowOperation const& op) {
+    os << "CowOperation(";
+    EmitCowTypeString(os, op.type);
+    if (op.type == kCowReplaceOp || op.type == kCowXorOp || op.type == kCowSequenceOp) {
+        os << ", data_length:" << op.data_length;
+    }
+    if (op.type != kCowClusterOp && op.type != kCowSequenceOp && op.type != kCowLabelOp) {
+        os << ", new_block:" << op.new_block;
+    }
+    if (op.type == kCowXorOp || op.type == kCowReplaceOp || op.type == kCowCopyOp) {
+        os << ", source:" << (op.source_info & kCowOpSourceInfoDataMask);
+    } else if (op.type == kCowClusterOp) {
+        os << ", cluster_data:" << (op.source_info & kCowOpSourceInfoDataMask);
+    } else {
+        os << ", label:0x" << android::base::StringPrintf("%" PRIx64, op.source_info);
+    }
+    os << ")";
+    return os;
+}
+
+int64_t GetNextOpOffset(const CowOperationV2& op, uint32_t cluster_ops) {
     if (op.type == kCowClusterOp) {
         return op.source;
     } else if ((op.type == kCowReplaceOp || op.type == kCowXorOp) && cluster_ops == 0) {
@@ -74,11 +110,11 @@
     }
 }
 
-int64_t GetNextDataOffset(const CowOperation& op, uint32_t cluster_ops) {
+int64_t GetNextDataOffset(const CowOperationV2& op, uint32_t cluster_ops) {
     if (op.type == kCowClusterOp) {
-        return cluster_ops * sizeof(CowOperation);
+        return cluster_ops * sizeof(CowOperationV2);
     } else if (cluster_ops == 0) {
-        return sizeof(CowOperation);
+        return sizeof(CowOperationV2);
     } else {
         return 0;
     }
@@ -114,6 +150,9 @@
         case 2:
             base = std::make_unique<CowWriterV2>(options, std::move(fd));
             break;
+        case 3:
+            base = std::make_unique<CowWriterV3>(options, std::move(fd));
+            break;
         default:
             LOG(ERROR) << "Cannot create unknown cow version: " << version;
             return nullptr;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
index 1b5d724..607d610 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
@@ -33,6 +33,35 @@
 namespace android {
 namespace snapshot {
 
+bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header) {
+    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
+        PLOG(ERROR) << "lseek header failed";
+        return false;
+    }
+
+    memset(header, 0, sizeof(*header));
+
+    if (!android::base::ReadFully(fd, &header->prefix, sizeof(header->prefix))) {
+        return false;
+    }
+    if (header->prefix.magic != kCowMagicNumber) {
+        LOG(ERROR) << "Header Magic corrupted. Magic: " << header->prefix.magic
+                   << "Expected: " << kCowMagicNumber;
+        return false;
+    }
+    if (header->prefix.header_size > sizeof(CowHeader)) {
+        LOG(ERROR) << "Unknown CowHeader size (got " << header->prefix.header_size
+                   << " bytes, expected at most " << sizeof(CowHeader) << " bytes)";
+        return false;
+    }
+
+    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
+        PLOG(ERROR) << "lseek header failed";
+        return false;
+    }
+    return android::base::ReadFully(fd, header, header->prefix.header_size);
+}
+
 CowReader::CowReader(ReaderFlags reader_flag, bool is_merge)
     : fd_(-1),
       header_(),
@@ -55,6 +84,7 @@
     cow->data_loc_ = data_loc_;
     cow->block_pos_index_ = block_pos_index_;
     cow->is_merge_ = is_merge_;
+    cow->compression_type_ = compression_type_;
     return cow;
 }
 
@@ -101,8 +131,43 @@
     footer_ = parser.footer();
     fd_size_ = parser.fd_size();
     last_label_ = parser.last_label();
-    ops_ = parser.ops();
     data_loc_ = parser.data_loc();
+    ops_ = std::make_shared<std::vector<CowOperation>>(parser.ops()->size());
+
+    // Translate the operation buffer from on disk to in memory
+    for (size_t i = 0; i < parser.ops()->size(); i++) {
+        const auto& v2_op = parser.ops()->at(i);
+
+        auto& new_op = ops_->at(i);
+        new_op.type = v2_op.type;
+        new_op.data_length = v2_op.data_length;
+
+        if (v2_op.new_block > std::numeric_limits<uint32_t>::max()) {
+            LOG(ERROR) << "Out-of-range new block in COW op: " << v2_op;
+            return false;
+        }
+        new_op.new_block = v2_op.new_block;
+
+        uint64_t source_info = v2_op.source;
+        if (new_op.type != kCowLabelOp) {
+            source_info &= kCowOpSourceInfoDataMask;
+            if (source_info != v2_op.source) {
+                LOG(ERROR) << "Out-of-range source value in COW op: " << v2_op;
+                return false;
+            }
+        }
+        if (v2_op.compression != kCowCompressNone) {
+            if (compression_type_ == kCowCompressNone) {
+                compression_type_ = v2_op.compression;
+            } else if (compression_type_ != v2_op.compression) {
+                LOG(ERROR) << "COW has mixed compression types which is not supported;"
+                           << " previously saw " << compression_type_ << ", got "
+                           << v2_op.compression << ", op: " << v2_op;
+                return false;
+            }
+        }
+        new_op.source_info = source_info;
+    }
 
     // If we're resuming a write, we're not ready to merge
     if (label.has_value()) return true;
@@ -540,7 +605,7 @@
         case kCowSequenceOp:
         case kCowReplaceOp:
         case kCowXorOp:
-            return GetRawBytes(GetCowOpSourceInfoData(op), buffer, len, read);
+            return GetRawBytes(GetCowOpSourceInfoData(*op), buffer, len, read);
         default:
             LOG(ERROR) << "Cannot get raw bytes of non-data op: " << *op;
             return false;
@@ -597,14 +662,14 @@
     size_t remaining_;
 };
 
-uint8_t CowReader::GetCompressionType(const CowOperation* op) {
-    return op->compression;
+uint8_t CowReader::GetCompressionType() {
+    return compression_type_;
 }
 
 ssize_t CowReader::ReadData(const CowOperation* op, void* buffer, size_t buffer_size,
                             size_t ignore_bytes) {
     std::unique_ptr<IDecompressor> decompressor;
-    switch (GetCompressionType(op)) {
+    switch (GetCompressionType()) {
         case kCowCompressNone:
             break;
         case kCowCompressGz:
@@ -624,7 +689,7 @@
             }
             break;
         default:
-            LOG(ERROR) << "Unknown compression type: " << GetCompressionType(op);
+            LOG(ERROR) << "Unknown compression type: " << GetCompressionType();
             return -1;
     }
 
@@ -632,7 +697,7 @@
     if (op->type == kCowXorOp) {
         offset = data_loc_->at(op->new_block);
     } else {
-        offset = GetCowOpSourceInfoData(op);
+        offset = GetCowOpSourceInfoData(*op);
     }
 
     if (!decompressor) {
@@ -648,10 +713,10 @@
 bool CowReader::GetSourceOffset(const CowOperation* op, uint64_t* source_offset) {
     switch (op->type) {
         case kCowCopyOp:
-            *source_offset = GetCowOpSourceInfoData(op) * header_.block_size;
+            *source_offset = GetCowOpSourceInfoData(*op) * header_.block_size;
             return true;
         case kCowXorOp:
-            *source_offset = GetCowOpSourceInfoData(op);
+            *source_offset = GetCowOpSourceInfoData(*op);
             return true;
         default:
             return false;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/inspect_cow.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/inspect_cow.cpp
index a6dee4f..83b5a12 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/inspect_cow.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/inspect_cow.cpp
@@ -22,6 +22,7 @@
 #include <string>
 #include <vector>
 
+#include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/unique_fd.h>
 #include <gflags/gflags.h>
@@ -38,11 +39,13 @@
 DEFINE_bool(verify_merge_sequence, false, "Verify merge order sequencing");
 DEFINE_bool(show_merge_sequence, false, "Show merge order sequence");
 DEFINE_bool(show_raw_ops, false, "Show raw ops directly from the underlying parser");
+DEFINE_string(extract_to, "", "Extract the COW contents to the given file");
 
 namespace android {
 namespace snapshot {
 
 using android::base::borrowed_fd;
+using android::base::unique_fd;
 
 void MyLogger(android::base::LogId, android::base::LogSeverity severity, const char*, const char*,
               unsigned int, const char* message) {
@@ -53,7 +56,7 @@
     }
 }
 
-static void ShowBad(CowReader& reader, const struct CowOperation* op) {
+static void ShowBad(CowReader& reader, const CowOperation* op) {
     size_t count;
     auto buffer = std::make_unique<uint8_t[]>(op->data_length);
 
@@ -104,12 +107,21 @@
 }
 
 static bool Inspect(const std::string& path) {
-    android::base::unique_fd fd(open(path.c_str(), O_RDONLY));
+    unique_fd fd(open(path.c_str(), O_RDONLY));
     if (fd < 0) {
         PLOG(ERROR) << "open failed: " << path;
         return false;
     }
 
+    unique_fd extract_to;
+    if (!FLAGS_extract_to.empty()) {
+        extract_to.reset(open(FLAGS_extract_to.c_str(), O_RDWR | O_CREAT | O_TRUNC, 0664));
+        if (extract_to < 0) {
+            PLOG(ERROR) << "could not open " << FLAGS_extract_to << " for writing";
+            return false;
+        }
+    }
+
     CowReader reader;
 
     auto start_time = std::chrono::steady_clock::now();
@@ -186,12 +198,23 @@
 
         if (!FLAGS_silent && FLAGS_show_ops) std::cout << *op << "\n";
 
-        if (FLAGS_decompress && op->type == kCowReplaceOp && op->compression != kCowCompressNone) {
+        if ((FLAGS_decompress || extract_to >= 0) && op->type == kCowReplaceOp) {
             if (reader.ReadData(op, buffer.data(), buffer.size()) < 0) {
                 std::cerr << "Failed to decompress for :" << *op << "\n";
                 success = false;
                 if (FLAGS_show_bad_data) ShowBad(reader, op);
             }
+            if (extract_to >= 0) {
+                off_t offset = uint64_t(op->new_block) * header.block_size;
+                if (!android::base::WriteFullyAtOffset(extract_to, buffer.data(), buffer.size(),
+                                                       offset)) {
+                    PLOG(ERROR) << "failed to write block " << op->new_block;
+                    return false;
+                }
+            }
+        } else if (extract_to >= 0 && !IsMetadataOp(*op) && op->type != kCowZeroOp) {
+            PLOG(ERROR) << "Cannot extract op yet: " << *op;
+            return false;
         }
 
         if (op->type == kCowSequenceOp && FLAGS_show_merge_sequence) {
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp
index fdb5c59..8f20317 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.cpp
@@ -23,35 +23,6 @@
 
 using android::base::borrowed_fd;
 
-bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header) {
-    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
-        PLOG(ERROR) << "lseek header failed";
-        return false;
-    }
-
-    memset(header, 0, sizeof(*header));
-
-    if (!android::base::ReadFully(fd, &header->prefix, sizeof(header->prefix))) {
-        return false;
-    }
-    if (header->prefix.magic != kCowMagicNumber) {
-        LOG(ERROR) << "Header Magic corrupted. Magic: " << header->prefix.magic
-                   << "Expected: " << kCowMagicNumber;
-        return false;
-    }
-    if (header->prefix.header_size > sizeof(CowHeader)) {
-        LOG(ERROR) << "Unknown CowHeader size (got " << header->prefix.header_size
-                   << " bytes, expected at most " << sizeof(CowHeader) << " bytes)";
-        return false;
-    }
-
-    if (lseek(fd.get(), 0, SEEK_SET) < 0) {
-        PLOG(ERROR) << "lseek header failed";
-        return false;
-    }
-    return android::base::ReadFully(fd, header, header->prefix.header_size);
-}
-
 bool CowParserV2::Parse(borrowed_fd fd, const CowHeader& header, std::optional<uint64_t> label) {
     auto pos = lseek(fd.get(), 0, SEEK_END);
     if (pos < 0) {
@@ -66,18 +37,9 @@
                    << sizeof(CowFooter);
         return false;
     }
-    if (header_.op_size != sizeof(CowOperation)) {
+    if (header_.op_size != sizeof(CowOperationV2)) {
         LOG(ERROR) << "Operation size unknown, read " << header_.op_size << ", expected "
-                   << sizeof(CowOperation);
-        return false;
-    }
-    if (header_.cluster_ops == 1) {
-        LOG(ERROR) << "Clusters must contain at least two operations to function.";
-        return false;
-    }
-    if (header_.op_size != sizeof(CowOperation)) {
-        LOG(ERROR) << "Operation size unknown, read " << header_.op_size << ", expected "
-                   << sizeof(CowOperation);
+                   << sizeof(CowOperationV2);
         return false;
     }
     if (header_.cluster_ops == 1) {
@@ -123,23 +85,23 @@
     uint64_t data_pos = 0;
 
     if (header_.cluster_ops) {
-        data_pos = pos + header_.cluster_ops * sizeof(CowOperation);
+        data_pos = pos + header_.cluster_ops * sizeof(CowOperationV2);
     } else {
-        data_pos = pos + sizeof(CowOperation);
+        data_pos = pos + sizeof(CowOperationV2);
     }
 
-    auto ops_buffer = std::make_shared<std::vector<CowOperation>>();
+    auto ops_buffer = std::make_shared<std::vector<CowOperationV2>>();
     uint64_t current_op_num = 0;
     uint64_t cluster_ops = header_.cluster_ops ?: 1;
     bool done = false;
 
     // Alternating op clusters and data
     while (!done) {
-        uint64_t to_add = std::min(cluster_ops, (fd_size_ - pos) / sizeof(CowOperation));
+        uint64_t to_add = std::min(cluster_ops, (fd_size_ - pos) / sizeof(CowOperationV2));
         if (to_add == 0) break;
         ops_buffer->resize(current_op_num + to_add);
         if (!android::base::ReadFully(fd, &ops_buffer->data()[current_op_num],
-                                      to_add * sizeof(CowOperation))) {
+                                      to_add * sizeof(CowOperationV2))) {
             PLOG(ERROR) << "read op failed";
             return false;
         }
@@ -150,7 +112,7 @@
             if (current_op.type == kCowXorOp) {
                 data_loc->insert({current_op.new_block, data_pos});
             }
-            pos += sizeof(CowOperation) + GetNextOpOffset(current_op, header_.cluster_ops);
+            pos += sizeof(CowOperationV2) + GetNextOpOffset(current_op, header_.cluster_ops);
             data_pos += current_op.data_length + GetNextDataOffset(current_op, header_.cluster_ops);
 
             if (current_op.type == kCowClusterOp) {
@@ -222,7 +184,7 @@
                        << ops_buffer->size();
             return false;
         }
-        if (ops_buffer->size() * sizeof(CowOperation) != footer_->op.ops_size) {
+        if (ops_buffer->size() * sizeof(CowOperationV2) != footer_->op.ops_size) {
             LOG(ERROR) << "ops size does not match ";
             return false;
         }
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h
index afcf687..f51ff88 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/parser_v2.h
@@ -33,7 +33,7 @@
 
     const CowHeader& header() const { return header_; }
     const std::optional<CowFooter>& footer() const { return footer_; }
-    std::shared_ptr<std::vector<CowOperation>> ops() { return ops_; }
+    std::shared_ptr<std::vector<CowOperationV2>> ops() { return ops_; }
     std::shared_ptr<std::unordered_map<uint64_t, uint64_t>> data_loc() const { return data_loc_; }
     uint64_t fd_size() const { return fd_size_; }
     const std::optional<uint64_t>& last_label() const { return last_label_; }
@@ -43,13 +43,11 @@
 
     CowHeader header_ = {};
     std::optional<CowFooter> footer_;
-    std::shared_ptr<std::vector<CowOperation>> ops_;
+    std::shared_ptr<std::vector<CowOperationV2>> ops_;
     std::shared_ptr<std::unordered_map<uint64_t, uint64_t>> data_loc_;
     uint64_t fd_size_;
     std::optional<uint64_t> last_label_;
 };
 
-bool ReadCowHeader(android::base::borrowed_fd fd, CowHeader* header);
-
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/test_v2.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/test_v2.cpp
index e59bd92..35d74ba 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/test_v2.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/test_v2.cpp
@@ -86,10 +86,9 @@
     while (!iter->AtEnd()) {
         auto op = iter->Get();
         ASSERT_EQ(op->type, kCowCopyOp);
-        ASSERT_EQ(op->compression, kCowCompressNone);
         ASSERT_EQ(op->data_length, 0);
         ASSERT_EQ(op->new_block, 10 + i);
-        ASSERT_EQ(op->source, 1000 + i);
+        ASSERT_EQ(GetCowOpSourceInfoData(*op), 1000 + i);
         iter->Next();
         i += 1;
     }
@@ -133,10 +132,9 @@
     auto op = iter->Get();
 
     ASSERT_EQ(op->type, kCowCopyOp);
-    ASSERT_EQ(op->compression, kCowCompressNone);
     ASSERT_EQ(op->data_length, 0);
     ASSERT_EQ(op->new_block, 10);
-    ASSERT_EQ(op->source, 20);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 20);
 
     std::string sink(data.size(), '\0');
 
@@ -145,7 +143,6 @@
     op = iter->Get();
 
     ASSERT_EQ(op->type, kCowReplaceOp);
-    ASSERT_FALSE(GetCowOpSourceInfoCompression(op));
     ASSERT_EQ(op->data_length, 4096);
     ASSERT_EQ(op->new_block, 50);
     ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
@@ -157,20 +154,18 @@
 
     // Note: the zero operation gets split into two blocks.
     ASSERT_EQ(op->type, kCowZeroOp);
-    ASSERT_EQ(op->compression, kCowCompressNone);
     ASSERT_EQ(op->data_length, 0);
     ASSERT_EQ(op->new_block, 51);
-    ASSERT_EQ(op->source, 0);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 0);
 
     iter->Next();
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
 
     ASSERT_EQ(op->type, kCowZeroOp);
-    ASSERT_EQ(op->compression, kCowCompressNone);
     ASSERT_EQ(op->data_length, 0);
     ASSERT_EQ(op->new_block, 52);
-    ASSERT_EQ(op->source, 0);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 0);
 
     iter->Next();
     ASSERT_TRUE(iter->AtEnd());
@@ -212,10 +207,9 @@
     auto op = iter->Get();
 
     ASSERT_EQ(op->type, kCowCopyOp);
-    ASSERT_EQ(op->compression, kCowCompressNone);
     ASSERT_EQ(op->data_length, 0);
     ASSERT_EQ(op->new_block, 10);
-    ASSERT_EQ(op->source, 20);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 20);
 
     std::string sink(data.size(), '\0');
 
@@ -224,10 +218,9 @@
     op = iter->Get();
 
     ASSERT_EQ(op->type, kCowXorOp);
-    ASSERT_FALSE(GetCowOpSourceInfoCompression(op));
     ASSERT_EQ(op->data_length, 4096);
     ASSERT_EQ(op->new_block, 50);
-    ASSERT_EQ(GetCowOpSourceInfoData(op), 98314);  // 4096 * 24 + 10
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 98314);  // 4096 * 24 + 10
     ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
     ASSERT_EQ(sink, data);
 
@@ -237,20 +230,18 @@
 
     // Note: the zero operation gets split into two blocks.
     ASSERT_EQ(op->type, kCowZeroOp);
-    ASSERT_EQ(op->compression, kCowCompressNone);
     ASSERT_EQ(op->data_length, 0);
     ASSERT_EQ(op->new_block, 51);
-    ASSERT_EQ(op->source, 0);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 0);
 
     iter->Next();
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
 
     ASSERT_EQ(op->type, kCowZeroOp);
-    ASSERT_EQ(op->compression, kCowCompressNone);
     ASSERT_EQ(op->data_length, 0);
     ASSERT_EQ(op->new_block, 52);
-    ASSERT_EQ(op->source, 0);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 0);
 
     iter->Next();
     ASSERT_TRUE(iter->AtEnd());
@@ -283,7 +274,6 @@
     std::string sink(data.size(), '\0');
 
     ASSERT_EQ(op->type, kCowReplaceOp);
-    ASSERT_TRUE(GetCowOpSourceInfoCompression(op));
     ASSERT_EQ(op->data_length, 56);  // compressed!
     ASSERT_EQ(op->new_block, 50);
     ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
@@ -339,7 +329,7 @@
             total_blocks += 1;
             std::string sink(xor_data.size(), '\0');
             ASSERT_EQ(op->new_block, 50);
-            ASSERT_EQ(GetCowOpSourceInfoData(op), 98314);  // 4096 * 24 + 10
+            ASSERT_EQ(GetCowOpSourceInfoData(*op), 98314);  // 4096 * 24 + 10
             ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
             ASSERT_EQ(sink, xor_data);
         }
@@ -530,7 +520,6 @@
     std::string sink(data.size(), '\0');
 
     ASSERT_EQ(op->type, kCowReplaceOp);
-    ASSERT_TRUE(GetCowOpSourceInfoCompression(op));
     ASSERT_EQ(op->data_length, 56);  // compressed!
     ASSERT_EQ(op->new_block, 50);
     ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
@@ -548,7 +537,6 @@
 
     sink = {};
     sink.resize(data2.size(), '\0');
-    ASSERT_TRUE(GetCowOpSourceInfoCompression(op));
     ASSERT_EQ(op->data_length, 41);  // compressed!
     ASSERT_EQ(op->new_block, 51);
     ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
@@ -593,7 +581,6 @@
 
     auto op = iter->Get();
     ASSERT_EQ(op->type, kCowReplaceOp);
-    ASSERT_TRUE(GetCowOpSourceInfoCompression(op));
     ASSERT_EQ(op->new_block, 51);
     ASSERT_TRUE(ReadData(reader, op, sink.data(), sink.size()));
 }
@@ -677,7 +664,7 @@
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 3);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 3);
 
     iter->Next();
 
@@ -730,7 +717,7 @@
     ASSERT_FALSE(iter->AtEnd());
     auto op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 0);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 0);
 
     iter->Next();
 
@@ -788,7 +775,7 @@
     ASSERT_FALSE(iter->AtEnd());
     auto op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 5);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 5);
 
     iter->Next();
     ASSERT_TRUE(iter->AtEnd());
@@ -857,7 +844,7 @@
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 4);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 4);
 
     iter->Next();
 
@@ -875,7 +862,7 @@
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 5);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 5);
 
     iter->Next();
 
@@ -928,7 +915,7 @@
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 4);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 4);
 
     iter->Next();
 
@@ -953,7 +940,7 @@
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 5);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 5);
 
     iter->Next();
 
@@ -972,7 +959,7 @@
     ASSERT_FALSE(iter->AtEnd());
     op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 6);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 6);
 
     iter->Next();
 
@@ -1019,7 +1006,7 @@
     ASSERT_FALSE(iter->AtEnd());
     auto op = iter->Get();
     ASSERT_EQ(op->type, kCowLabelOp);
-    ASSERT_EQ(op->source, 50);
+    ASSERT_EQ(GetCowOpSourceInfoData(*op), 50);
 
     iter->Next();
 
@@ -1504,6 +1491,37 @@
     ASSERT_FALSE(reader.VerifyMergeOps());
 }
 
+unique_fd OpenTestFile(const std::string& file, int flags) {
+    std::string path = "tools/testdata/" + file;
+
+    unique_fd fd(open(path.c_str(), flags));
+    if (fd >= 0) {
+        return fd;
+    }
+
+    path = android::base::GetExecutableDirectory() + "/" + path;
+    return unique_fd{open(path.c_str(), flags)};
+}
+
+TEST_F(CowTest, CompatibilityTest) {
+    std::string filename = "cow_v2";
+    auto fd = OpenTestFile(filename, O_RDONLY);
+    if (fd.get() == -1) {
+        LOG(ERROR) << filename << " not found";
+        GTEST_SKIP();
+    }
+    CowReader reader;
+    reader.Parse(fd);
+
+    const auto& header = reader.GetHeader();
+    ASSERT_EQ(header.prefix.magic, kCowMagicNumber);
+    ASSERT_EQ(header.prefix.major_version, kCowVersionMajor);
+    ASSERT_EQ(header.prefix.minor_version, kCowVersionMinor);
+
+    CowFooter footer;
+    ASSERT_TRUE(reader.GetFooter(&footer));
+}
+
 }  // namespace snapshot
 }  // namespace android
 
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/test_v3.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/test_v3.cpp
new file mode 100644
index 0000000..2373d4d
--- /dev/null
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/test_v3.cpp
@@ -0,0 +1,53 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <sys/stat.h>
+
+#include <cstdio>
+#include <iostream>
+#include <memory>
+#include <string_view>
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <gtest/gtest.h>
+#include <libsnapshot/cow_reader.h>
+#include <libsnapshot/cow_writer.h>
+#include "cow_decompress.h"
+#include "libsnapshot/cow_format.h"
+#include "writer_v3.h"
+using android::base::unique_fd;
+using testing::AssertionFailure;
+using testing::AssertionResult;
+using testing::AssertionSuccess;
+
+namespace android {
+namespace snapshot {
+
+class CowOperationV3Test : public ::testing::Test {
+  protected:
+    virtual void SetUp() override {
+        cow_ = std::make_unique<TemporaryFile>();
+        ASSERT_GE(cow_->fd, 0) << strerror(errno);
+    }
+
+    virtual void TearDown() override { cow_ = nullptr; }
+
+    unique_fd GetCowFd() { return unique_fd{dup(cow_->fd)}; }
+
+    std::unique_ptr<TemporaryFile> cow_;
+};
+
+}  // namespace snapshot
+}  // namespace android
\ No newline at end of file
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.cpp
index ff34c59..2ffc37b 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.cpp
@@ -191,5 +191,16 @@
                                                       block_dev_size);
 }
 
+bool CowWriterBase::Sync() {
+    if (is_dev_null_) {
+        return true;
+    }
+    if (fsync(fd_.get()) < 0) {
+        PLOG(ERROR) << "fsync failed";
+        return false;
+    }
+    return true;
+}
+
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h b/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h
index c8b4772..709b248 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_base.h
@@ -34,6 +34,7 @@
     // If the given label is not found, Initialize will fail.
     virtual bool Initialize(std::optional<uint64_t> label = {}) = 0;
 
+    bool Sync();
     bool AddCopy(uint64_t new_block, uint64_t old_block, uint64_t num_blocks = 1) override;
     bool AddRawBlocks(uint64_t new_block_start, const void* data, size_t size) override;
     bool AddXorBlocks(uint32_t new_block_start, const void* data, size_t size, uint32_t old_block,
@@ -62,7 +63,6 @@
     bool ValidateNewBlock(uint64_t new_block);
 
     CowOptions options_;
-    CowHeader header_{};
 
     android::base::unique_fd fd_;
     bool is_dev_null_ = false;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp
index 699529b..63bed07 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.cpp
@@ -110,7 +110,7 @@
     header_.prefix.minor_version = kCowVersionMinor;
     header_.prefix.header_size = sizeof(CowHeader);
     header_.footer_size = sizeof(CowFooter);
-    header_.op_size = sizeof(CowOperation);
+    header_.op_size = sizeof(CowOperationV2);
     header_.block_size = options_.block_size;
     header_.num_merge_ops = options_.num_merge_ops;
     header_.cluster_ops = options_.cluster_ops;
@@ -159,9 +159,9 @@
         struct iovec* cowop_ptr = cowop_vec_.get();
         struct iovec* data_ptr = data_vec_.get();
         for (size_t i = 0; i < header_.cluster_ops; i++) {
-            std::unique_ptr<CowOperation> op = std::make_unique<CowOperation>();
+            std::unique_ptr<CowOperationV2> op = std::make_unique<CowOperationV2>();
             cowop_ptr[i].iov_base = op.get();
-            cowop_ptr[i].iov_len = sizeof(CowOperation);
+            cowop_ptr[i].iov_len = sizeof(CowOperationV2);
             opbuffer_vec_.push_back(std::move(op));
 
             std::unique_ptr<uint8_t[]> buffer = std::make_unique<uint8_t[]>(header_.block_size * 2);
@@ -214,19 +214,19 @@
 }
 
 void CowWriterV2::InitPos() {
-    next_op_pos_ = sizeof(header_) + header_.buffer_size;
-    cluster_size_ = header_.cluster_ops * sizeof(CowOperation);
+    next_op_pos_ = sizeof(CowHeader) + header_.buffer_size;
+    cluster_size_ = header_.cluster_ops * sizeof(CowOperationV2);
     if (header_.cluster_ops) {
         next_data_pos_ = next_op_pos_ + cluster_size_;
     } else {
-        next_data_pos_ = next_op_pos_ + sizeof(CowOperation);
+        next_data_pos_ = next_op_pos_ + sizeof(CowOperationV2);
     }
     current_cluster_size_ = 0;
     current_data_size_ = 0;
 }
 
 bool CowWriterV2::OpenForWrite() {
-    // This limitation is tied to the data field size in CowOperation.
+    // This limitation is tied to the data field size in CowOperationV2.
     if (header_.block_size > std::numeric_limits<uint16_t>::max()) {
         LOG(ERROR) << "Block size is too large";
         return false;
@@ -243,7 +243,7 @@
 
     // Headers are not complete, but this ensures the file is at the right
     // position.
-    if (!android::base::WriteFully(fd_, &header_, sizeof(header_))) {
+    if (!android::base::WriteFully(fd_, &header_, sizeof(CowHeader))) {
         PLOG(ERROR) << "write failed";
         return false;
     }
@@ -262,11 +262,6 @@
         return false;
     }
 
-    if (lseek(fd_.get(), sizeof(header_) + header_.buffer_size, SEEK_SET) < 0) {
-        PLOG(ERROR) << "lseek failed";
-        return false;
-    }
-
     InitPos();
     InitBatchWrites();
 
@@ -313,7 +308,7 @@
     CHECK(!merge_in_progress_);
 
     for (size_t i = 0; i < num_blocks; i++) {
-        CowOperation op = {};
+        CowOperationV2 op = {};
         op.type = kCowCopyOp;
         op.new_block = new_block + i;
         op.source = old_block + i;
@@ -399,7 +394,7 @@
         num_blocks -= pending_blocks;
 
         while (i < size / header_.block_size && pending_blocks) {
-            CowOperation op = {};
+            CowOperationV2 op = {};
             op.new_block = new_block_start + i;
             op.type = type;
             if (type == kCowXorOp) {
@@ -451,7 +446,7 @@
 bool CowWriterV2::EmitZeroBlocks(uint64_t new_block_start, uint64_t num_blocks) {
     CHECK(!merge_in_progress_);
     for (uint64_t i = 0; i < num_blocks; i++) {
-        CowOperation op = {};
+        CowOperationV2 op = {};
         op.type = kCowZeroOp;
         op.new_block = new_block_start + i;
         op.source = 0;
@@ -462,7 +457,7 @@
 
 bool CowWriterV2::EmitLabel(uint64_t label) {
     CHECK(!merge_in_progress_);
-    CowOperation op = {};
+    CowOperationV2 op = {};
     op.type = kCowLabelOp;
     op.source = label;
     return WriteOperation(op) && Sync();
@@ -473,7 +468,7 @@
     size_t to_add = 0;
     size_t max_ops = (header_.block_size * 2) / sizeof(uint32_t);
     while (num_ops > 0) {
-        CowOperation op = {};
+        CowOperationV2 op = {};
         op.type = kCowSequenceOp;
         op.source = next_data_pos_;
         to_add = std::min(num_ops, max_ops);
@@ -489,16 +484,16 @@
 }
 
 bool CowWriterV2::EmitCluster() {
-    CowOperation op = {};
+    CowOperationV2 op = {};
     op.type = kCowClusterOp;
     // Next cluster starts after remainder of current cluster and the next data block.
-    op.source = current_data_size_ + cluster_size_ - current_cluster_size_ - sizeof(CowOperation);
+    op.source = current_data_size_ + cluster_size_ - current_cluster_size_ - sizeof(CowOperationV2);
     return WriteOperation(op);
 }
 
 bool CowWriterV2::EmitClusterIfNeeded() {
     // If there isn't room for another op and the cluster end op, end the current cluster
-    if (cluster_size_ && cluster_size_ < current_cluster_size_ + 2 * sizeof(CowOperation)) {
+    if (cluster_size_ && cluster_size_ < current_cluster_size_ + 2 * sizeof(CowOperationV2)) {
         if (!EmitCluster()) return false;
     }
     return true;
@@ -539,7 +534,7 @@
         extra_cluster = true;
     }
 
-    footer_.op.ops_size = footer_.op.num_ops * sizeof(CowOperation);
+    footer_.op.ops_size = footer_.op.num_ops * sizeof(CowOperationV2);
     if (lseek(fd_.get(), next_op_pos_, SEEK_SET) < 0) {
         PLOG(ERROR) << "Failed to seek to footer position.";
         return false;
@@ -611,9 +606,9 @@
 
     if (op_vec_index_) {
         ret = pwritev(fd_.get(), cowop_vec_.get(), op_vec_index_, current_op_pos_);
-        if (ret != (op_vec_index_ * sizeof(CowOperation))) {
-            PLOG(ERROR) << "pwritev failed for CowOperation. Expected: "
-                        << (op_vec_index_ * sizeof(CowOperation));
+        if (ret != (op_vec_index_ * sizeof(CowOperationV2))) {
+            PLOG(ERROR) << "pwritev failed for CowOperationV2. Expected: "
+                        << (op_vec_index_ * sizeof(CowOperationV2));
             return false;
         }
     }
@@ -635,15 +630,16 @@
     return true;
 }
 
-bool CowWriterV2::WriteOperation(const CowOperation& op, const void* data, size_t size) {
+bool CowWriterV2::WriteOperation(const CowOperationV2& op, const void* data, size_t size) {
     if (!EnsureSpaceAvailable(next_op_pos_ + sizeof(op)) ||
         !EnsureSpaceAvailable(next_data_pos_ + size)) {
         return false;
     }
 
     if (batch_write_) {
-        CowOperation* cow_op = reinterpret_cast<CowOperation*>(cowop_vec_[op_vec_index_].iov_base);
-        std::memcpy(cow_op, &op, sizeof(CowOperation));
+        CowOperationV2* cow_op =
+                reinterpret_cast<CowOperationV2*>(cowop_vec_[op_vec_index_].iov_base);
+        std::memcpy(cow_op, &op, sizeof(CowOperationV2));
         op_vec_index_ += 1;
 
         if (data != nullptr && size > 0) {
@@ -681,7 +677,7 @@
     return EmitClusterIfNeeded();
 }
 
-void CowWriterV2::AddOperation(const CowOperation& op) {
+void CowWriterV2::AddOperation(const CowOperationV2& op) {
     footer_.op.num_ops++;
 
     if (op.type == kCowClusterOp) {
@@ -693,7 +689,7 @@
     }
 
     next_data_pos_ += op.data_length + GetNextDataOffset(op, header_.cluster_ops);
-    next_op_pos_ += sizeof(CowOperation) + GetNextOpOffset(op, header_.cluster_ops);
+    next_op_pos_ += sizeof(CowOperationV2) + GetNextOpOffset(op, header_.cluster_ops);
 }
 
 bool CowWriterV2::WriteRawData(const void* data, const size_t size) {
@@ -703,17 +699,6 @@
     return true;
 }
 
-bool CowWriterV2::Sync() {
-    if (is_dev_null_) {
-        return true;
-    }
-    if (fsync(fd_.get()) < 0) {
-        PLOG(ERROR) << "fsync failed";
-        return false;
-    }
-    return true;
-}
-
 bool CowWriterV2::Truncate(off_t length) {
     if (is_dev_null_ || is_block_device_) {
         return true;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h
index 131a068..24170eb 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v2.h
@@ -50,20 +50,20 @@
     bool OpenForAppend(uint64_t label);
     bool GetDataPos(uint64_t* pos);
     bool WriteRawData(const void* data, size_t size);
-    bool WriteOperation(const CowOperation& op, const void* data = nullptr, size_t size = 0);
-    void AddOperation(const CowOperation& op);
+    bool WriteOperation(const CowOperationV2& op, const void* data = nullptr, size_t size = 0);
+    void AddOperation(const CowOperationV2& op);
     void InitPos();
     void InitBatchWrites();
     void InitWorkers();
     bool FlushCluster();
 
     bool CompressBlocks(size_t num_blocks, const void* data);
-    bool Sync();
     bool Truncate(off_t length);
     bool EnsureSpaceAvailable(const uint64_t bytes_needed) const;
 
   private:
     CowFooter footer_{};
+    CowHeader header_{};
     CowCompression compression_;
     // in the case that we are using one thread for compression, we can store and re-use the same
     // compressor
@@ -84,7 +84,7 @@
     std::vector<std::basic_string<uint8_t>> compressed_buf_;
     std::vector<std::basic_string<uint8_t>>::iterator buf_iter_;
 
-    std::vector<std::unique_ptr<CowOperation>> opbuffer_vec_;
+    std::vector<std::unique_ptr<CowOperationV2>> opbuffer_vec_;
     std::vector<std::unique_ptr<uint8_t[]>> databuffer_vec_;
     std::unique_ptr<struct iovec[]> cowop_vec_;
     int op_vec_index_ = 0;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp
new file mode 100644
index 0000000..5ae5f19
--- /dev/null
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.cpp
@@ -0,0 +1,219 @@
+//
+// Copyright (C) 2020 The Android Open Source_info Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#include "writer_v3.h"
+
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <unistd.h>
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <android-base/properties.h>
+#include <android-base/strings.h>
+#include <android-base/unique_fd.h>
+#include <brotli/encode.h>
+#include <libsnapshot/cow_format.h>
+#include <libsnapshot/cow_reader.h>
+#include <libsnapshot/cow_writer.h>
+#include <lz4.h>
+#include <zlib.h>
+
+#include <fcntl.h>
+#include <linux/fs.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+// The info messages here are spammy, but as useful for update_engine. Disable
+// them when running on the host.
+#ifdef __ANDROID__
+#define LOG_INFO LOG(INFO)
+#else
+#define LOG_INFO LOG(VERBOSE)
+#endif
+
+namespace android {
+namespace snapshot {
+
+static_assert(sizeof(off_t) == sizeof(uint64_t));
+
+using android::base::unique_fd;
+
+CowWriterV3::CowWriterV3(const CowOptions& options, unique_fd&& fd)
+    : CowWriterBase(options, std::move(fd)) {
+    SetupHeaders();
+}
+
+void CowWriterV3::SetupHeaders() {
+    header_ = {};
+    header_.prefix.magic = kCowMagicNumber;
+    header_.prefix.major_version = 3;
+    header_.prefix.minor_version = 0;
+    header_.prefix.header_size = sizeof(CowHeaderV3);
+    header_.footer_size = 0;
+    header_.op_size = sizeof(CowOperationV3);
+    header_.block_size = options_.block_size;
+    header_.num_merge_ops = options_.num_merge_ops;
+    header_.cluster_ops = 0;
+    if (options_.scratch_space) {
+        header_.buffer_size = BUFFER_REGION_DEFAULT_SIZE;
+    }
+
+    // v3 specific fields
+    // WIP: not quite sure how some of these are calculated yet, assuming buffer_size is determined
+    // during COW size estimation
+    header_.sequence_buffer_offset = 0;
+    header_.resume_buffer_size = 0;
+    header_.op_buffer_size = 0;
+    header_.compression_algorithm = kCowCompressNone;
+    return;
+}
+
+bool CowWriterV3::ParseOptions() {
+    num_compress_threads_ = std::max(options_.num_compress_threads, 1);
+    auto parts = android::base::Split(options_.compression, ",");
+    if (parts.size() > 2) {
+        LOG(ERROR) << "failed to parse compression parameters: invalid argument count: "
+                   << parts.size() << " " << options_.compression;
+        return false;
+    }
+    auto algorithm = CompressionAlgorithmFromString(parts[0]);
+    if (!algorithm) {
+        LOG(ERROR) << "unrecognized compression: " << options_.compression;
+        return false;
+    }
+    if (parts.size() > 1) {
+        if (!android::base::ParseUint(parts[1], &compression_.compression_level)) {
+            LOG(ERROR) << "failed to parse compression level invalid type: " << parts[1];
+            return false;
+        }
+    } else {
+        compression_.compression_level =
+                CompressWorker::GetDefaultCompressionLevel(algorithm.value());
+    }
+
+    compression_.algorithm = *algorithm;
+    return true;
+}
+
+CowWriterV3::~CowWriterV3() {}
+
+bool CowWriterV3::Initialize(std::optional<uint64_t> label) {
+    if (!InitFd() || !ParseOptions()) {
+        return false;
+    }
+
+    CHECK(!label.has_value());
+
+    if (!OpenForWrite()) {
+        return false;
+    }
+
+    return true;
+}
+
+bool CowWriterV3::OpenForWrite() {
+    // This limitation is tied to the data field size in CowOperationV2.
+    // Keeping this for V3 writer <- although we
+    if (header_.block_size > std::numeric_limits<uint16_t>::max()) {
+        LOG(ERROR) << "Block size is too large";
+        return false;
+    }
+
+    if (lseek(fd_.get(), 0, SEEK_SET) < 0) {
+        PLOG(ERROR) << "lseek failed";
+        return false;
+    }
+
+    // Headers are not complete, but this ensures the file is at the right
+    // position.
+    if (!android::base::WriteFully(fd_, &header_, sizeof(header_))) {
+        PLOG(ERROR) << "write failed";
+        return false;
+    }
+
+    if (options_.scratch_space) {
+        // Initialize the scratch space
+        std::string data(header_.buffer_size, 0);
+        if (!android::base::WriteFully(fd_, data.data(), header_.buffer_size)) {
+            PLOG(ERROR) << "writing scratch space failed";
+            return false;
+        }
+    }
+
+    if (!Sync()) {
+        LOG(ERROR) << "Header sync failed";
+        return false;
+    }
+
+    next_op_pos_ = 0;
+    next_data_pos_ = 0;
+
+    return true;
+}
+
+bool CowWriterV3::EmitCopy(uint64_t new_block, uint64_t old_block, uint64_t num_blocks) {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+    if (new_block || old_block || num_blocks) return false;
+    return false;
+}
+
+bool CowWriterV3::EmitRawBlocks(uint64_t new_block_start, const void* data, size_t size) {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+
+    if (new_block_start || data || size) return false;
+    return false;
+}
+
+bool CowWriterV3::EmitXorBlocks(uint32_t new_block_start, const void* data, size_t size,
+                                uint32_t old_block, uint16_t offset) {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+    if (new_block_start || old_block || offset || data || size) return false;
+    return false;
+}
+
+bool CowWriterV3::EmitZeroBlocks(uint64_t new_block_start, uint64_t num_blocks) {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+    if (new_block_start && num_blocks) return false;
+    return false;
+}
+
+bool CowWriterV3::EmitLabel(uint64_t label) {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+    if (label) return false;
+    return false;
+}
+
+bool CowWriterV3::EmitSequenceData(size_t num_ops, const uint32_t* data) {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+    if (num_ops && data) return false;
+    return false;
+}
+
+bool CowWriterV3::Finalize() {
+    LOG(ERROR) << __LINE__ << " " << __FILE__ << " <- function here should never be called";
+    return false;
+}
+
+uint64_t CowWriterV3::GetCowSize() {
+    LOG(ERROR) << __LINE__ << " " << __FILE__
+               << " <- Get Cow Size function here should never be called";
+    return 0;
+}
+
+}  // namespace snapshot
+}  // namespace android
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.h b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.h
new file mode 100644
index 0000000..2a88a12
--- /dev/null
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/writer_v3.h
@@ -0,0 +1,59 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <future>
+#include "writer_base.h"
+
+namespace android {
+namespace snapshot {
+
+class CowWriterV3 : public CowWriterBase {
+  public:
+    explicit CowWriterV3(const CowOptions& options, android::base::unique_fd&& fd);
+    ~CowWriterV3() override;
+
+    bool Initialize(std::optional<uint64_t> label = {}) override;
+    bool Finalize() override;
+    uint64_t GetCowSize() override;
+
+  protected:
+    virtual bool EmitCopy(uint64_t new_block, uint64_t old_block, uint64_t num_blocks = 1) override;
+    virtual bool EmitRawBlocks(uint64_t new_block_start, const void* data, size_t size) override;
+    virtual bool EmitXorBlocks(uint32_t new_block_start, const void* data, size_t size,
+                               uint32_t old_block, uint16_t offset) override;
+    virtual bool EmitZeroBlocks(uint64_t new_block_start, uint64_t num_blocks) override;
+    virtual bool EmitLabel(uint64_t label) override;
+    virtual bool EmitSequenceData(size_t num_ops, const uint32_t* data) override;
+
+  private:
+    void SetupHeaders();
+    bool ParseOptions();
+    bool OpenForWrite();
+
+  private:
+    CowHeaderV3 header_{};
+    CowCompression compression_;
+    // in the case that we are using one thread for compression, we can store and re-use the same
+    // compressor
+
+    uint64_t next_op_pos_ = 0;
+    uint64_t next_data_pos_ = 0;
+
+    int num_compress_threads_ = 1;
+};
+
+}  // namespace snapshot
+}  // namespace android
diff --git a/fs_mgr/libsnapshot/partition_cow_creator.cpp b/fs_mgr/libsnapshot/partition_cow_creator.cpp
index 7057223..5bc7e65 100644
--- a/fs_mgr/libsnapshot/partition_cow_creator.cpp
+++ b/fs_mgr/libsnapshot/partition_cow_creator.cpp
@@ -131,15 +131,28 @@
     return is_optimized;
 }
 
-void WriteExtent(DmSnapCowSizeCalculator* sc, const chromeos_update_engine::Extent& de,
+bool WriteExtent(DmSnapCowSizeCalculator* sc, const chromeos_update_engine::Extent& de,
                  unsigned int sectors_per_block) {
     const auto block_boundary = de.start_block() + de.num_blocks();
     for (auto b = de.start_block(); b < block_boundary; ++b) {
         for (unsigned int s = 0; s < sectors_per_block; ++s) {
-            const auto sector_id = b * sectors_per_block + s;
+            // sector_id = b * sectors_per_block + s;
+            uint64_t block_start_sector_id;
+            if (__builtin_mul_overflow(b, sectors_per_block, &block_start_sector_id)) {
+                LOG(ERROR) << "Integer overflow when calculating sector id (" << b << " * "
+                           << sectors_per_block << ")";
+                return false;
+            }
+            uint64_t sector_id;
+            if (__builtin_add_overflow(block_start_sector_id, s, &sector_id)) {
+                LOG(ERROR) << "Integer overflow when calculating sector id ("
+                           << block_start_sector_id << " + " << s << ")";
+                return false;
+            }
             sc->WriteSector(sector_id);
         }
     }
+    return true;
 }
 
 std::optional<uint64_t> PartitionCowCreator::GetCowSize() {
@@ -167,7 +180,7 @@
     // Allocate space for extra extents (if any). These extents are those that can be
     // used for error corrections or to store verity hash trees.
     for (const auto& de : extra_extents) {
-        WriteExtent(&sc, de, sectors_per_block);
+        if (!WriteExtent(&sc, de, sectors_per_block)) return std::nullopt;
     }
 
     if (update == nullptr) return sc.cow_size_bytes();
@@ -182,7 +195,7 @@
         }
 
         for (const auto& de : written_op->dst_extents()) {
-            WriteExtent(&sc, de, sectors_per_block);
+            if (!WriteExtent(&sc, de, sectors_per_block)) return std::nullopt;
         }
     }
 
diff --git a/fs_mgr/libsnapshot/snapshot.cpp b/fs_mgr/libsnapshot/snapshot.cpp
index 4743a42..f5732fc 100644
--- a/fs_mgr/libsnapshot/snapshot.cpp
+++ b/fs_mgr/libsnapshot/snapshot.cpp
@@ -89,8 +89,6 @@
 static constexpr char kRollbackIndicatorPath[] = "/metadata/ota/rollback-indicator";
 static constexpr auto kUpdateStateCheckInterval = 2s;
 
-MergeFailureCode CheckMergeConsistency(const std::string& name, const SnapshotStatus& status);
-
 // Note: IImageManager is an incomplete type in the header, so the default
 // destructor doesn't work.
 SnapshotManager::~SnapshotManager() {}
@@ -120,9 +118,7 @@
 }
 
 SnapshotManager::SnapshotManager(IDeviceInfo* device)
-    : dm_(device->GetDeviceMapper()), device_(device), metadata_dir_(device_->GetMetadataDir()) {
-    merge_consistency_checker_ = android::snapshot::CheckMergeConsistency;
-}
+    : dm_(device->GetDeviceMapper()), device_(device), metadata_dir_(device_->GetMetadataDir()) {}
 
 static std::string GetCowName(const std::string& snapshot_name) {
     return snapshot_name + "-cow";
@@ -1365,13 +1361,6 @@
         }
     }
 
-    // Merge is complete at this point
-
-    auto code = CheckMergeConsistency(lock, name, snapshot_status);
-    if (code != MergeFailureCode::Ok) {
-        return MergeResult(UpdateState::MergeFailed, code);
-    }
-
     // Merging is done. First, update the status file to indicate the merge
     // is complete. We do this before calling OnSnapshotMergeComplete, even
     // though this means the write is potentially wasted work (since in the
@@ -1401,80 +1390,6 @@
     return GetCowName(snapshot);
 }
 
-MergeFailureCode SnapshotManager::CheckMergeConsistency(LockedFile* lock, const std::string& name,
-                                                        const SnapshotStatus& status) {
-    CHECK(lock);
-
-    return merge_consistency_checker_(name, status);
-}
-
-MergeFailureCode CheckMergeConsistency(const std::string& name, const SnapshotStatus& status) {
-    if (!status.using_snapuserd()) {
-        // Do not try to verify old-style COWs yet.
-        return MergeFailureCode::Ok;
-    }
-
-    auto& dm = DeviceMapper::Instance();
-
-    std::string cow_image_name = GetMappedCowDeviceName(name, status);
-    std::string cow_image_path;
-    if (!dm.GetDmDevicePathByName(cow_image_name, &cow_image_path)) {
-        LOG(ERROR) << "Failed to get path for cow device: " << cow_image_name;
-        return MergeFailureCode::GetCowPathConsistencyCheck;
-    }
-
-    // First pass, count # of ops.
-    size_t num_ops = 0;
-    {
-        unique_fd fd(open(cow_image_path.c_str(), O_RDONLY | O_CLOEXEC));
-        if (fd < 0) {
-            PLOG(ERROR) << "Failed to open " << cow_image_name;
-            return MergeFailureCode::OpenCowConsistencyCheck;
-        }
-
-        CowReader reader;
-        if (!reader.Parse(std::move(fd))) {
-            LOG(ERROR) << "Failed to parse cow " << cow_image_path;
-            return MergeFailureCode::ParseCowConsistencyCheck;
-        }
-
-        num_ops = reader.get_num_total_data_ops();
-    }
-
-    // Second pass, try as hard as we can to get the actual number of blocks
-    // the system thinks is merged.
-    unique_fd fd(open(cow_image_path.c_str(), O_RDONLY | O_DIRECT | O_SYNC | O_CLOEXEC));
-    if (fd < 0) {
-        PLOG(ERROR) << "Failed to open direct " << cow_image_name;
-        return MergeFailureCode::OpenCowDirectConsistencyCheck;
-    }
-
-    void* addr;
-    size_t page_size = getpagesize();
-    if (posix_memalign(&addr, page_size, page_size) < 0) {
-        PLOG(ERROR) << "posix_memalign with page size " << page_size;
-        return MergeFailureCode::MemAlignConsistencyCheck;
-    }
-
-    // COWs are always at least 2MB, this is guaranteed in snapshot creation.
-    std::unique_ptr<void, decltype(&::free)> buffer(addr, ::free);
-    if (!android::base::ReadFully(fd, buffer.get(), page_size)) {
-        PLOG(ERROR) << "Direct read failed " << cow_image_name;
-        return MergeFailureCode::DirectReadConsistencyCheck;
-    }
-
-    auto header = reinterpret_cast<CowHeader*>(buffer.get());
-    if (header->num_merge_ops != num_ops) {
-        LOG(ERROR) << "COW consistency check failed, expected " << num_ops << " to be merged, "
-                   << "but " << header->num_merge_ops << " were actually recorded.";
-        LOG(ERROR) << "Aborting merge progress for snapshot " << name
-                   << ", will try again next boot";
-        return MergeFailureCode::WrongMergeCountConsistencyCheck;
-    }
-
-    return MergeFailureCode::Ok;
-}
-
 MergeFailureCode SnapshotManager::MergeSecondPhaseSnapshots(LockedFile* lock) {
     std::vector<std::string> snapshots;
     if (!ListSnapshots(lock, &snapshots)) {
diff --git a/fs_mgr/libsnapshot/snapshot_test.cpp b/fs_mgr/libsnapshot/snapshot_test.cpp
index e506110..4e6b5e1 100644
--- a/fs_mgr/libsnapshot/snapshot_test.cpp
+++ b/fs_mgr/libsnapshot/snapshot_test.cpp
@@ -1601,97 +1601,6 @@
     }
 }
 
-// Test that a transient merge consistency check failure can resume properly.
-TEST_F(SnapshotUpdateTest, ConsistencyCheckResume) {
-    if (!snapuserd_required_) {
-        // b/179111359
-        GTEST_SKIP() << "Skipping snapuserd test";
-    }
-
-    auto old_sys_size = GetSize(sys_);
-    auto old_prd_size = GetSize(prd_);
-
-    // Grow |sys| but shrink |prd|.
-    SetSize(sys_, old_sys_size * 2);
-    sys_->set_estimate_cow_size(8_MiB);
-    SetSize(prd_, old_prd_size / 2);
-    prd_->set_estimate_cow_size(1_MiB);
-
-    AddOperationForPartitions();
-
-    ASSERT_TRUE(sm->BeginUpdate());
-    ASSERT_TRUE(sm->CreateUpdateSnapshots(manifest_));
-    ASSERT_TRUE(WriteSnapshotAndHash(sys_));
-    ASSERT_TRUE(WriteSnapshotAndHash(vnd_));
-    ASSERT_TRUE(ShiftAllSnapshotBlocks("prd_b", old_prd_size));
-
-    sync();
-
-    // Assert that source partitions aren't affected.
-    for (const auto& name : {"sys_a", "vnd_a", "prd_a"}) {
-        ASSERT_TRUE(IsPartitionUnchanged(name));
-    }
-
-    ASSERT_TRUE(sm->FinishedSnapshotWrites(false));
-
-    // Simulate shutting down the device.
-    ASSERT_TRUE(UnmapAll());
-
-    // After reboot, init does first stage mount.
-    auto init = NewManagerForFirstStageMount("_b");
-    ASSERT_NE(init, nullptr);
-    ASSERT_TRUE(init->NeedSnapshotsInFirstStageMount());
-    ASSERT_TRUE(init->CreateLogicalAndSnapshotPartitions("super", snapshot_timeout_));
-
-    // Check that the target partitions have the same content.
-    for (const auto& name : {"sys_b", "vnd_b", "prd_b"}) {
-        ASSERT_TRUE(IsPartitionUnchanged(name));
-    }
-
-    auto old_checker = init->merge_consistency_checker();
-
-    init->set_merge_consistency_checker(
-            [](const std::string&, const SnapshotStatus&) -> MergeFailureCode {
-                return MergeFailureCode::WrongMergeCountConsistencyCheck;
-            });
-
-    // Initiate the merge and wait for it to be completed.
-    if (ShouldSkipLegacyMerging()) {
-        LOG(INFO) << "Skipping legacy merge in test";
-        return;
-    }
-    ASSERT_TRUE(init->InitiateMerge());
-    ASSERT_EQ(init->IsSnapuserdRequired(), snapuserd_required_);
-    {
-        // Check that the merge phase is FIRST_PHASE until at least one call
-        // to ProcessUpdateState() occurs.
-        ASSERT_TRUE(AcquireLock());
-        auto local_lock = std::move(lock_);
-        auto status = init->ReadSnapshotUpdateStatus(local_lock.get());
-        ASSERT_EQ(status.merge_phase(), MergePhase::FIRST_PHASE);
-    }
-
-    // Merge should have failed.
-    ASSERT_EQ(UpdateState::MergeFailed, init->ProcessUpdateState());
-
-    // Simulate shutting down the device and creating partitions again.
-    ASSERT_TRUE(UnmapAll());
-
-    // Restore the checker.
-    init->set_merge_consistency_checker(std::move(old_checker));
-
-    ASSERT_TRUE(init->CreateLogicalAndSnapshotPartitions("super", snapshot_timeout_));
-
-    // Complete the merge.
-    ASSERT_EQ(UpdateState::MergeCompleted, init->ProcessUpdateState());
-
-    // Check that the target partitions have the same content after the merge.
-    for (const auto& name : {"sys_b", "vnd_b", "prd_b"}) {
-        ASSERT_TRUE(IsPartitionUnchanged(name))
-                << "Content of " << name << " changes after the merge";
-    }
-}
-
 // Test that if new system partitions uses empty space in super, that region is not snapshotted.
 TEST_F(SnapshotUpdateTest, DirectWriteEmptySpace) {
     GTEST_SKIP() << "b/141889746";
diff --git a/fs_mgr/libsnapshot/snapuserd/Android.bp b/fs_mgr/libsnapshot/snapuserd/Android.bp
index 47a8685..1b0c563 100644
--- a/fs_mgr/libsnapshot/snapuserd/Android.bp
+++ b/fs_mgr/libsnapshot/snapuserd/Android.bp
@@ -293,3 +293,48 @@
         "vts",
     ],
 }
+
+cc_binary_host {
+    name: "snapuserd_extractor",
+    defaults: [
+        "fs_mgr_defaults",
+        "libsnapshot_cow_defaults",
+    ],
+    srcs: [
+        "testing/dm_user_harness.cpp",
+        "testing/harness.cpp",
+        "testing/host_harness.cpp",
+        "user-space-merge/extractor.cpp",
+        "snapuserd_extractor.cpp",
+    ],
+    cflags: [
+        "-D_FILE_OFFSET_BITS=64",
+        "-Wall",
+        "-Werror",
+    ],
+    shared_libs: [
+        "libbase",
+        "liblog",
+    ],
+    static_libs: [
+        "libbrotli",
+        "libcutils_sockets",
+        "libdm",
+        "libext2_uuid",
+        "libext4_utils",
+        "libfs_mgr_file_wait",
+        "libgflags",
+        "libsnapshot_cow",
+        "libsnapuserd",
+        "liburing",
+        "libz",
+    ],
+    include_dirs: [
+        "bionic/libc/kernel",
+        ".",
+    ],
+    header_libs: [
+        "libstorage_literals_headers",
+        "libfiemap_headers",
+    ],
+}
diff --git a/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd.cpp b/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd.cpp
index 71664bf..6dc082e 100644
--- a/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd.cpp
@@ -508,7 +508,7 @@
             // the merge of operations are done based on the ops present
             // in the file.
             //===========================================================
-            uint64_t block_source = GetCowOpSourceInfoData(cow_op);
+            uint64_t block_source = GetCowOpSourceInfoData(*cow_op);
             if (prev_id.has_value()) {
                 if (dest_blocks.count(cow_op->new_block) || source_blocks.count(block_source)) {
                     break;
diff --git a/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_readahead.cpp b/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_readahead.cpp
index d5fbe91..ab0b309 100644
--- a/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_readahead.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_readahead.cpp
@@ -172,7 +172,7 @@
 }
 
 void ReadAheadThread::CheckOverlap(const CowOperation* cow_op) {
-    uint64_t source_block = GetCowOpSourceInfoData(cow_op);
+    uint64_t source_block = GetCowOpSourceInfoData(*cow_op);
     if (dest_blocks_.count(cow_op->new_block) || source_blocks_.count(source_block)) {
         overlap_ = true;
     }
@@ -191,7 +191,7 @@
         // Get the first block with offset
         const CowOperation* cow_op = GetRAOpIter();
         CHECK_NE(cow_op, nullptr);
-        *source_offset = GetCowOpSourceInfoData(cow_op);
+        *source_offset = GetCowOpSourceInfoData(*cow_op);
         if (cow_op->type == kCowCopyOp) {
             *source_offset *= BLOCK_SZ;
         }
@@ -210,7 +210,7 @@
         while (!RAIterDone() && num_ops) {
             const CowOperation* op = GetRAOpIter();
             CHECK_NE(op, nullptr);
-            uint64_t next_offset = GetCowOpSourceInfoData(op);
+            uint64_t next_offset = GetCowOpSourceInfoData(*op);
             if (op->type == kCowCopyOp) {
                 next_offset *= BLOCK_SZ;
             }
diff --git a/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_worker.cpp b/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_worker.cpp
index 559dcc7..571b352 100644
--- a/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_worker.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/dm-snapshot-merge/snapuserd_worker.cpp
@@ -103,7 +103,7 @@
     ssize_t rv = reader_->ReadData(cow_op, buffer, BLOCK_SZ);
     if (rv != BLOCK_SZ) {
         SNAP_LOG(ERROR) << "ProcessReplaceOp failed for block " << cow_op->new_block
-                        << ", return = " << rv;
+                        << ", return = " << rv << ", COW operation = " << *cow_op;
         return false;
     }
     return true;
diff --git a/fs_mgr/libsnapshot/snapuserd/snapuserd_extractor.cpp b/fs_mgr/libsnapshot/snapuserd/snapuserd_extractor.cpp
new file mode 100644
index 0000000..f46cd5b
--- /dev/null
+++ b/fs_mgr/libsnapshot/snapuserd/snapuserd_extractor.cpp
@@ -0,0 +1,68 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <fcntl.h>
+#include <linux/fs.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <iostream>
+#include <memory>
+
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <android-base/unique_fd.h>
+#include <gflags/gflags.h>
+#include "user-space-merge/extractor.h"
+
+using namespace std::string_literals;
+
+DEFINE_string(base, "", "Base device/image");
+DEFINE_string(cow, "", "COW device/image");
+DEFINE_string(out, "", "Output path");
+DEFINE_int32(num_sectors, 0, "Number of sectors to read");
+
+int main([[maybe_unused]] int argc, [[maybe_unused]] char** argv) {
+    android::base::InitLogging(argv);
+    gflags::ParseCommandLineFlags(&argc, &argv, true);
+
+    if (FLAGS_out.empty()) {
+        LOG(ERROR) << "Missing -out argument.";
+        return 1;
+    }
+    if (FLAGS_base.empty()) {
+        LOG(ERROR) << "Missing -base argument.";
+        return 1;
+    }
+    if (FLAGS_cow.empty()) {
+        LOG(ERROR) << "missing -out argument.";
+        return 1;
+    }
+    if (!FLAGS_num_sectors) {
+        LOG(ERROR) << "missing -num_sectors argument.";
+        return 1;
+    }
+
+    android::snapshot::Extractor extractor(FLAGS_base, FLAGS_cow);
+    if (!extractor.Init()) {
+        return 1;
+    }
+    if (!extractor.Extract(FLAGS_num_sectors, FLAGS_out)) {
+        return 1;
+    }
+    return 0;
+}
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/extractor.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/extractor.cpp
new file mode 100644
index 0000000..c5718d5
--- /dev/null
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/extractor.cpp
@@ -0,0 +1,90 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "extractor.h"
+
+#include <fcntl.h>
+#include <linux/fs.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <iostream>
+#include <memory>
+
+#include <android-base/file.h>
+#include <android-base/properties.h>
+#include <android-base/unique_fd.h>
+
+using android::base::unique_fd;
+using namespace std::string_literals;
+
+namespace android {
+namespace snapshot {
+
+Extractor::Extractor(const std::string& base_path, const std::string& cow_path)
+    : base_path_(base_path), cow_path_(cow_path), control_name_("test") {}
+
+bool Extractor::Init() {
+    auto opener = factory_.CreateTestOpener(control_name_);
+    handler_ = std::make_shared<SnapshotHandler>(control_name_, cow_path_, base_path_, base_path_,
+                                                 opener, 1, false, false);
+    if (!handler_->InitCowDevice()) {
+        return false;
+    }
+    if (!handler_->InitializeWorkers()) {
+        return false;
+    }
+
+    read_worker_ = std::make_unique<ReadWorker>(cow_path_, base_path_, control_name_, base_path_,
+                                                handler_->GetSharedPtr(), opener);
+    if (!read_worker_->Init()) {
+        return false;
+    }
+    block_server_ = static_cast<TestBlockServer*>(read_worker_->block_server());
+
+    handler_thread_ = std::async(std::launch::async, &SnapshotHandler::Start, handler_.get());
+    return true;
+}
+
+Extractor::~Extractor() {
+    factory_.DeleteQueue(control_name_);
+}
+
+bool Extractor::Extract(off_t num_sectors, const std::string& out_path) {
+    unique_fd out_fd(open(out_path.c_str(), O_RDWR | O_CLOEXEC | O_TRUNC | O_CREAT, 0664));
+    if (out_fd < 0) {
+        PLOG(ERROR) << "Could not open for writing: " << out_path;
+        return false;
+    }
+
+    for (off_t i = 0; i < num_sectors; i++) {
+        if (!read_worker_->RequestSectors(i, 512)) {
+            LOG(ERROR) << "Read sector " << i << " failed.";
+            return false;
+        }
+        std::string result = std::move(block_server_->sent_io());
+        off_t offset = i * 512;
+        if (!android::base::WriteFullyAtOffset(out_fd, result.data(), result.size(), offset)) {
+            PLOG(ERROR) << "write failed";
+            return false;
+        }
+    }
+    return true;
+}
+
+}  // namespace snapshot
+}  // namespace android
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/extractor.h b/fs_mgr/libsnapshot/snapuserd/user-space-merge/extractor.h
new file mode 100644
index 0000000..65285b1
--- /dev/null
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/extractor.h
@@ -0,0 +1,51 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+
+#include <string>
+#include <thread>
+
+#include <android-base/unique_fd.h>
+#include "merge_worker.h"
+#include "read_worker.h"
+#include "snapuserd_core.h"
+#include "testing/host_harness.h"
+
+namespace android {
+namespace snapshot {
+
+class Extractor final {
+  public:
+    Extractor(const std::string& base_path, const std::string& cow_path);
+    ~Extractor();
+
+    bool Init();
+    bool Extract(off_t num_sectors, const std::string& out_path);
+
+  private:
+    std::string base_path_;
+    std::string cow_path_;
+
+    TestBlockServerFactory factory_;
+    HostTestHarness harness_;
+    std::string control_name_;
+    std::shared_ptr<SnapshotHandler> handler_;
+    std::unique_ptr<ReadWorker> read_worker_;
+    std::future<bool> handler_thread_;
+    TestBlockServer* block_server_ = nullptr;
+};
+
+}  // namespace snapshot
+}  // namespace android
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/read_worker.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/read_worker.cpp
index b9ecfa5..5cb13e8 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/read_worker.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/read_worker.cpp
@@ -283,7 +283,8 @@
                 // We found the sector in mapping. Check the type of COW OP and
                 // process it.
                 if (!ProcessCowOp(it->second, buffer)) {
-                    SNAP_LOG(ERROR) << "ProcessCowOp failed";
+                    SNAP_LOG(ERROR)
+                            << "ProcessCowOp failed, sector = " << sector << ", size = " << sz;
                     return false;
                 }
 
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.cpp
index c295851..8208d67 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.cpp
@@ -16,8 +16,6 @@
 
 #include "snapuserd_core.h"
 
-#include <sys/utsname.h>
-
 #include <android-base/chrono_utils.h>
 #include <android-base/properties.h>
 #include <android-base/scopeguard.h>
@@ -26,6 +24,7 @@
 
 #include "merge_worker.h"
 #include "read_worker.h"
+#include "utility.h"
 
 namespace android {
 namespace snapshot {
@@ -83,6 +82,10 @@
     SNAP_LOG(DEBUG) << "Merge-complete %: " << merge_completion_percentage_
                     << " num_merge_ops: " << ch->num_merge_ops
                     << " total-ops: " << reader_->get_num_total_data_ops();
+
+    if (ch->num_merge_ops == reader_->get_num_total_data_ops()) {
+        MarkMergeComplete();
+    }
 }
 
 bool SnapshotHandler::CommitMerge(int num_merge_ops) {
@@ -173,6 +176,10 @@
     }
 
     SNAP_LOG(INFO) << "Merge-ops: " << header.num_merge_ops;
+    if (header.num_merge_ops) {
+        resume_merge_ = true;
+        SNAP_LOG(INFO) << "Resume Snapshot-merge";
+    }
 
     if (!MmapMetadata()) {
         SNAP_LOG(ERROR) << "mmap failed";
@@ -295,6 +302,11 @@
     if (ra_thread_) {
         ra_thread_status =
                 std::async(std::launch::async, &ReadAhead::RunThread, read_ahead_thread_.get());
+        // If this is a merge-resume path, wait until RA thread is fully up as
+        // the data has to be re-constructed from the scratch space.
+        if (resume_merge_ && ShouldReconstructDataFromCow()) {
+            WaitForRaThreadToStart();
+        }
     }
 
     // Launch worker threads
@@ -307,7 +319,9 @@
             std::async(std::launch::async, &MergeWorker::Run, merge_thread_.get());
 
     // Now that the worker threads are up, scan the partitions.
-    if (perform_verification_) {
+    // If the snapshot-merge is being resumed, there is no need to scan as the
+    // current slot is already marked as boot complete.
+    if (perform_verification_ && !resume_merge_) {
         update_verify_->VerifyUpdatePartition();
     }
 
@@ -406,22 +420,7 @@
 }
 
 bool SnapshotHandler::IsIouringSupported() {
-    struct utsname uts;
-    unsigned int major, minor;
-
-    if ((uname(&uts) != 0) || (sscanf(uts.release, "%u.%u", &major, &minor) != 2)) {
-        SNAP_LOG(ERROR) << "Could not parse the kernel version from uname. "
-                        << " io_uring not supported";
-        return false;
-    }
-
-    // We will only support kernels from 5.6 onwards as IOSQE_ASYNC flag and
-    // IO_URING_OP_READ/WRITE opcodes were introduced only on 5.6 kernel
-    if (major >= 5) {
-        if (major == 5 && minor < 6) {
-            return false;
-        }
-    } else {
+    if (!KernelSupportsIoUring()) {
         return false;
     }
 
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.h b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.h
index e401c11..fa1e7a0 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.h
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_core.h
@@ -43,7 +43,6 @@
 #include <libdm/dm.h>
 #include <libsnapshot/cow_reader.h>
 #include <libsnapshot/cow_writer.h>
-#include <liburing.h>
 #include <snapuserd/block_server.h>
 #include <snapuserd/snapuserd_buffer.h>
 #include <snapuserd/snapuserd_kernel.h>
@@ -147,6 +146,8 @@
     void WakeupMonitorMergeThread();
     void WaitForMergeComplete();
     bool WaitForMergeBegin();
+    void RaThreadStarted();
+    void WaitForRaThreadToStart();
     void NotifyRAForMergeReady();
     bool WaitForMergeReady();
     void MergeFailed();
@@ -158,6 +159,7 @@
 
     bool ShouldReconstructDataFromCow() { return populate_data_from_cow_; }
     void FinishReconstructDataFromCow() { populate_data_from_cow_ = false; }
+    void MarkMergeComplete();
     // Return the snapshot status
     std::string GetMergeStatus();
 
@@ -221,6 +223,7 @@
     // Read-ahead related
     bool populate_data_from_cow_ = false;
     bool ra_thread_ = false;
+    bool ra_thread_started_ = false;
     int total_ra_blocks_merged_ = 0;
     MERGE_IO_TRANSITION io_state_ = MERGE_IO_TRANSITION::INVALID;
     std::unique_ptr<ReadAhead> read_ahead_thread_;
@@ -242,8 +245,9 @@
     bool scratch_space_ = false;
     int num_worker_threads_ = kNumWorkerThreads;
     bool perform_verification_ = true;
+    bool resume_merge_ = false;
+    bool merge_complete_ = false;
 
-    std::unique_ptr<struct io_uring> ring_;
     std::unique_ptr<UpdateVerify> update_verify_;
     std::shared_ptr<IBlockServerOpener> block_server_opener_;
 };
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp
index d2128c5..998d233 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp
@@ -206,6 +206,7 @@
         return false;
     }
 
+    snapuserd_->RaThreadStarted();
     SNAP_LOG(INFO) << "ReconstructDataFromCow success";
     notify_read_ahead_failed.Cancel();
     return true;
@@ -716,9 +717,13 @@
     total_ra_blocks_completed_ += total_blocks_merged_;
     snapuserd_->SetMergedBlockCountForNextCommit(total_blocks_merged_);
 
-    // Flush the data only if we have a overlapping blocks in the region
+    // Flush the scratch data - Technically, we should flush only for overlapping
+    // blocks; However, since this region is mmap'ed, the dirty pages can still
+    // get flushed to disk at any random point in time. Instead, make sure
+    // the data in scratch is in the correct state before merge thread resumes.
+    //
     // Notify the Merge thread to resume merging this window
-    if (!snapuserd_->ReadAheadIOCompleted(overlap_)) {
+    if (!snapuserd_->ReadAheadIOCompleted(true)) {
         SNAP_LOG(ERROR) << "ReadAheadIOCompleted failed...";
         snapuserd_->ReadAheadIOFailed();
         return false;
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_test.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_test.cpp
index 620ecbd..bed71cf 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_test.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_test.cpp
@@ -47,8 +47,6 @@
 #include "testing/temp_device.h"
 #include "utility.h"
 
-DEFINE_string(force_config, "", "Force testing mode with iouring disabled");
-
 namespace android {
 namespace snapshot {
 
@@ -62,7 +60,7 @@
 using testing::AssertionResult;
 using testing::AssertionSuccess;
 
-class SnapuserdTestBase : public ::testing::Test {
+class SnapuserdTestBase : public ::testing::TestWithParam<bool> {
   protected:
     void SetUp() override;
     void TearDown() override;
@@ -235,9 +233,11 @@
     bool Merge();
     void ValidateMerge();
     void ReadSnapshotDeviceAndValidate();
+    void ReadSnapshotAndValidateOverlappingBlocks();
     void Shutdown();
     void MergeInterrupt();
     void MergeInterruptFixed(int duration);
+    void MergeInterruptAndValidate(int duration);
     void MergeInterruptRandomly(int max_duration);
     bool StartMerge();
     void CheckMergeCompletion();
@@ -358,6 +358,76 @@
     ASSERT_EQ(memcmp(snapuserd_buffer.get(), (char*)orig_buffer_.get() + (size_ * 4), size_), 0);
 }
 
+void SnapuserdTest::ReadSnapshotAndValidateOverlappingBlocks() {
+    // Open COW device
+    unique_fd fd(open(cow_system_->path, O_RDONLY));
+    ASSERT_GE(fd, 0);
+
+    CowReader reader;
+    ASSERT_TRUE(reader.Parse(fd));
+
+    const auto& header = reader.GetHeader();
+    size_t total_mapped_addr_length = header.prefix.header_size + BUFFER_REGION_DEFAULT_SIZE;
+
+    ASSERT_GE(header.prefix.major_version, 2);
+
+    void* mapped_addr = mmap(NULL, total_mapped_addr_length, PROT_READ, MAP_SHARED, fd.get(), 0);
+    ASSERT_NE(mapped_addr, MAP_FAILED);
+
+    bool populate_data_from_scratch = false;
+    struct BufferState* ra_state =
+            reinterpret_cast<struct BufferState*>((char*)mapped_addr + header.prefix.header_size);
+    if (ra_state->read_ahead_state == kCowReadAheadDone) {
+        populate_data_from_scratch = true;
+    }
+
+    size_t num_merge_ops = header.num_merge_ops;
+    // We have some partial merge operations completed.
+    // To test the merge-resume path, forcefully corrupt the data of the base
+    // device for the offsets where the merge is still pending.
+    if (num_merge_ops && populate_data_from_scratch) {
+        std::string corrupt_buffer(4096, 0);
+        // Corrupt two blocks from the point where the merge has to be resumed by
+        // writing down zeroe's.
+        //
+        // Now, since this is a merge-resume path, the "correct" data should be
+        // in the scratch space of the COW device. When there is an I/O request
+        // from the snapshot device, the data has to be retrieved from the
+        // scratch space. If not and I/O is routed to the base device, we
+        // may end up with corruption.
+        off_t corrupt_offset = (num_merge_ops + 2) * 4096;
+
+        if (corrupt_offset < size_) {
+            ASSERT_EQ(android::base::WriteFullyAtOffset(base_fd_, (void*)corrupt_buffer.c_str(),
+                                                        4096, corrupt_offset),
+                      true);
+            corrupt_offset -= 4096;
+            ASSERT_EQ(android::base::WriteFullyAtOffset(base_fd_, (void*)corrupt_buffer.c_str(),
+                                                        4096, corrupt_offset),
+                      true);
+            fsync(base_fd_.get());
+        }
+    }
+
+    // Time to read the snapshot device.
+    unique_fd snapshot_fd(open(dmuser_dev_->GetPath().c_str(), O_RDONLY | O_DIRECT | O_SYNC));
+    ASSERT_GE(snapshot_fd, 0);
+
+    void* buff_addr;
+    ASSERT_EQ(posix_memalign(&buff_addr, 4096, size_), 0);
+
+    std::unique_ptr<void, decltype(&::free)> snapshot_buffer(buff_addr, ::free);
+
+    // Scan the entire snapshot device and read the data and verify data
+    // integrity. Since the base device was forcefully corrupted, the data from
+    // this scan should be retrieved from scratch space of the COW partition.
+    //
+    // Furthermore, after the merge is complete, base device data is again
+    // verified as the aforementioned corrupted blocks aren't persisted.
+    ASSERT_EQ(ReadFullyAtOffset(snapshot_fd, snapshot_buffer.get(), size_, 0), true);
+    ASSERT_EQ(memcmp(snapshot_buffer.get(), orig_buffer_.get(), size_), 0);
+}
+
 void SnapuserdTest::CreateCowDeviceWithCopyOverlap_2() {
     auto writer = CreateCowDeviceInternal();
     ASSERT_NE(writer, nullptr);
@@ -555,16 +625,11 @@
 }
 
 void SnapuserdTest::InitCowDevice() {
-    bool use_iouring = true;
-    if (FLAGS_force_config == "iouring_disabled") {
-        use_iouring = false;
-    }
-
     auto factory = harness_->GetBlockServerFactory();
     auto opener = factory->CreateOpener(system_device_ctrl_name_);
     auto handler =
             handlers_->AddHandler(system_device_ctrl_name_, cow_system_->path, base_dev_->GetPath(),
-                                  base_dev_->GetPath(), opener, 1, use_iouring, false);
+                                  base_dev_->GetPath(), opener, 1, GetParam(), false);
     ASSERT_NE(handler, nullptr);
     ASSERT_NE(handler->snapuserd(), nullptr);
 #ifdef __ANDROID__
@@ -665,6 +730,20 @@
     ASSERT_TRUE(Merge());
 }
 
+void SnapuserdTest::MergeInterruptAndValidate(int duration) {
+    ASSERT_TRUE(StartMerge());
+
+    for (int i = 0; i < 15; i++) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(duration));
+        ASSERT_NO_FATAL_FAILURE(SimulateDaemonRestart());
+        ReadSnapshotAndValidateOverlappingBlocks();
+        ASSERT_TRUE(StartMerge());
+    }
+
+    ASSERT_NO_FATAL_FAILURE(SimulateDaemonRestart());
+    ASSERT_TRUE(Merge());
+}
+
 void SnapuserdTest::MergeInterrupt() {
     // Interrupt merge at various intervals
     ASSERT_TRUE(StartMerge());
@@ -694,7 +773,7 @@
     ASSERT_TRUE(Merge());
 }
 
-TEST_F(SnapuserdTest, Snapshot_IO_TEST) {
+TEST_P(SnapuserdTest, Snapshot_IO_TEST) {
     if (!harness_->HasUserDevice()) {
         GTEST_SKIP() << "Skipping snapshot read; not supported";
     }
@@ -708,7 +787,7 @@
     ASSERT_NO_FATAL_FAILURE(ReadSnapshotDeviceAndValidate());
 }
 
-TEST_F(SnapuserdTest, Snapshot_MERGE_IO_TEST) {
+TEST_P(SnapuserdTest, Snapshot_MERGE_IO_TEST) {
     if (!harness_->HasUserDevice()) {
         GTEST_SKIP() << "Skipping snapshot read; not supported";
     }
@@ -722,7 +801,7 @@
     read_future.wait();
 }
 
-TEST_F(SnapuserdTest, Snapshot_MERGE_IO_TEST_1) {
+TEST_P(SnapuserdTest, Snapshot_MERGE_IO_TEST_1) {
     if (!harness_->HasUserDevice()) {
         GTEST_SKIP() << "Skipping snapshot read; not supported";
     }
@@ -737,49 +816,58 @@
     read_future.wait();
 }
 
-TEST_F(SnapuserdTest, Snapshot_Merge_Resume) {
+TEST_P(SnapuserdTest, Snapshot_Merge_Resume) {
     ASSERT_NO_FATAL_FAILURE(SetupDefault());
     ASSERT_NO_FATAL_FAILURE(MergeInterrupt());
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_COPY_Overlap_TEST_1) {
+TEST_P(SnapuserdTest, Snapshot_COPY_Overlap_TEST_1) {
     ASSERT_NO_FATAL_FAILURE(SetupCopyOverlap_1());
     ASSERT_TRUE(Merge());
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_COPY_Overlap_TEST_2) {
+TEST_P(SnapuserdTest, Snapshot_COPY_Overlap_TEST_2) {
     ASSERT_NO_FATAL_FAILURE(SetupCopyOverlap_2());
     ASSERT_TRUE(Merge());
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_COPY_Overlap_Merge_Resume_TEST) {
+TEST_P(SnapuserdTest, Snapshot_COPY_Overlap_Merge_Resume_TEST) {
     ASSERT_NO_FATAL_FAILURE(SetupCopyOverlap_1());
     ASSERT_NO_FATAL_FAILURE(MergeInterrupt());
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_Merge_Crash_Fixed_Ordered) {
+TEST_P(SnapuserdTest, Snapshot_COPY_Overlap_Merge_Resume_IO_Validate_TEST) {
+    if (!harness_->HasUserDevice()) {
+        GTEST_SKIP() << "Skipping snapshot read; not supported";
+    }
+    ASSERT_NO_FATAL_FAILURE(SetupCopyOverlap_2());
+    ASSERT_NO_FATAL_FAILURE(MergeInterruptAndValidate(2));
+    ValidateMerge();
+}
+
+TEST_P(SnapuserdTest, Snapshot_Merge_Crash_Fixed_Ordered) {
     ASSERT_NO_FATAL_FAILURE(SetupOrderedOps());
     ASSERT_NO_FATAL_FAILURE(MergeInterruptFixed(300));
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_Merge_Crash_Random_Ordered) {
+TEST_P(SnapuserdTest, Snapshot_Merge_Crash_Random_Ordered) {
     ASSERT_NO_FATAL_FAILURE(SetupOrderedOps());
     ASSERT_NO_FATAL_FAILURE(MergeInterruptRandomly(500));
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_Merge_Crash_Fixed_Inverted) {
+TEST_P(SnapuserdTest, Snapshot_Merge_Crash_Fixed_Inverted) {
     ASSERT_NO_FATAL_FAILURE(SetupOrderedOpsInverted());
     ASSERT_NO_FATAL_FAILURE(MergeInterruptFixed(50));
     ValidateMerge();
 }
 
-TEST_F(SnapuserdTest, Snapshot_Merge_Crash_Random_Inverted) {
+TEST_P(SnapuserdTest, Snapshot_Merge_Crash_Random_Inverted) {
     ASSERT_NO_FATAL_FAILURE(SetupOrderedOpsInverted());
     ASSERT_NO_FATAL_FAILURE(MergeInterruptRandomly(50));
     ValidateMerge();
@@ -846,7 +934,7 @@
 }
 
 // This test mirrors ReadSnapshotDeviceAndValidate.
-TEST_F(HandlerTest, Read) {
+TEST_P(HandlerTest, Read) {
     std::unique_ptr<uint8_t[]> snapuserd_buffer = std::make_unique<uint8_t[]>(size_);
 
     // COPY
@@ -875,20 +963,41 @@
     ASSERT_EQ(memcmp(snapuserd_buffer.get(), (char*)orig_buffer_.get() + (size_ * 4), size_), 0);
 }
 
-TEST_F(HandlerTest, ReadUnalignedSector) {
+TEST_P(HandlerTest, ReadUnalignedSector) {
     std::unique_ptr<uint8_t[]> snapuserd_buffer = std::make_unique<uint8_t[]>(BLOCK_SZ);
 
     ASSERT_TRUE(ReadSectors(1, BLOCK_SZ, snapuserd_buffer.get()));
     ASSERT_EQ(memcmp(snapuserd_buffer.get(), orig_buffer_.get() + SECTOR_SIZE, BLOCK_SZ), 0);
 }
 
-TEST_F(HandlerTest, ReadUnalignedSize) {
+TEST_P(HandlerTest, ReadUnalignedSize) {
     std::unique_ptr<uint8_t[]> snapuserd_buffer = std::make_unique<uint8_t[]>(SECTOR_SIZE);
 
     ASSERT_TRUE(ReadSectors(0, SECTOR_SIZE, snapuserd_buffer.get()));
     ASSERT_EQ(memcmp(snapuserd_buffer.get(), orig_buffer_.get(), SECTOR_SIZE), 0);
 }
 
+std::vector<bool> GetIoUringConfigs() {
+#if __ANDROID__
+    if (!android::base::GetBoolProperty("ro.virtual_ab.io_uring.enabled", false)) {
+        return {false};
+    }
+#endif
+    if (!KernelSupportsIoUring()) {
+        return {false};
+    }
+    return {false, true};
+}
+
+std::string IoUringConfigName(const testing::TestParamInfo<SnapuserdTest::ParamType>& info) {
+    return info.param ? "io_uring" : "sync";
+}
+
+INSTANTIATE_TEST_SUITE_P(Io, SnapuserdTest, ::testing::ValuesIn(GetIoUringConfigs()),
+                         IoUringConfigName);
+INSTANTIATE_TEST_SUITE_P(Io, HandlerTest, ::testing::ValuesIn(GetIoUringConfigs()),
+                         IoUringConfigName);
+
 }  // namespace snapshot
 }  // namespace android
 
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp
index f3e0019..2ad4ea1 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp
@@ -366,10 +366,36 @@
     }
 }
 
+void SnapshotHandler::RaThreadStarted() {
+    std::unique_lock<std::mutex> lock(lock_);
+    ra_thread_started_ = true;
+}
+
+void SnapshotHandler::WaitForRaThreadToStart() {
+    auto now = std::chrono::system_clock::now();
+    auto deadline = now + 3s;
+    {
+        std::unique_lock<std::mutex> lock(lock_);
+        while (!ra_thread_started_) {
+            auto status = cv.wait_until(lock, deadline);
+            if (status == std::cv_status::timeout) {
+                SNAP_LOG(ERROR) << "Read-ahead thread did not start";
+                return;
+            }
+        }
+    }
+}
+
+void SnapshotHandler::MarkMergeComplete() {
+    std::lock_guard<std::mutex> lock(lock_);
+    merge_complete_ = true;
+}
+
 std::string SnapshotHandler::GetMergeStatus() {
     bool merge_not_initiated = false;
     bool merge_monitored = false;
     bool merge_failed = false;
+    bool merge_complete = false;
 
     {
         std::lock_guard<std::mutex> lock(lock_);
@@ -385,10 +411,9 @@
         if (io_state_ == MERGE_IO_TRANSITION::MERGE_FAILED) {
             merge_failed = true;
         }
-    }
 
-    struct CowHeader* ch = reinterpret_cast<struct CowHeader*>(mapped_addr_);
-    bool merge_complete = (ch->num_merge_ops == reader_->get_num_total_data_ops());
+        merge_complete = merge_complete_;
+    }
 
     if (merge_not_initiated) {
         // Merge was not initiated yet; however, we have merge completion
@@ -424,7 +449,6 @@
         return "snapshot-merge-failed";
     }
 
-    // Merge complete
     if (merge_complete) {
         return "snapshot-merge-complete";
     }
@@ -618,7 +642,6 @@
     std::unordered_map<uint64_t, void*>::iterator it = read_ahead_buffer_map_.find(block);
 
     if (it == read_ahead_buffer_map_.end()) {
-        SNAP_LOG(ERROR) << "Block: " << block << " not found in RA buffer";
         return false;
     }
 
@@ -642,6 +665,13 @@
         MERGE_GROUP_STATE state = blk_state->merge_state_;
         switch (state) {
             case MERGE_GROUP_STATE::GROUP_MERGE_PENDING: {
+                // If this is a merge-resume path, check if the data is
+                // available from scratch space. Data from scratch space takes
+                // higher precedence than from source device for overlapping
+                // blocks.
+                if (resume_merge_ && GetRABuffer(&lock, new_block, buffer)) {
+                    return (MERGE_GROUP_STATE::GROUP_MERGE_IN_PROGRESS);
+                }
                 blk_state->num_ios_in_progress += 1;  // ref count
                 [[fallthrough]];
             }
diff --git a/fs_mgr/libsnapshot/snapuserd/utility.cpp b/fs_mgr/libsnapshot/snapuserd/utility.cpp
index a84a7c1..fcdb69d 100644
--- a/fs_mgr/libsnapshot/snapuserd/utility.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/utility.cpp
@@ -15,6 +15,7 @@
 #include "utility.h"
 
 #include <sys/resource.h>
+#include <sys/utsname.h>
 #include <unistd.h>
 
 #include <android-base/file.h>
@@ -32,5 +33,19 @@
 #endif
 }
 
+bool KernelSupportsIoUring() {
+    struct utsname uts {};
+    unsigned int major, minor;
+
+    uname(&uts);
+    if (sscanf(uts.release, "%u.%u", &major, &minor) != 2) {
+        return false;
+    }
+
+    // We will only support kernels from 5.6 onwards as IOSQE_ASYNC flag and
+    // IO_URING_OP_READ/WRITE opcodes were introduced only on 5.6 kernel
+    return major > 5 || (major == 5 && minor >= 6);
+}
+
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/snapuserd/utility.h b/fs_mgr/libsnapshot/snapuserd/utility.h
index 58ec3e6..255aee1 100644
--- a/fs_mgr/libsnapshot/snapuserd/utility.h
+++ b/fs_mgr/libsnapshot/snapuserd/utility.h
@@ -18,6 +18,7 @@
 namespace snapshot {
 
 bool SetThreadPriority(int priority);
+bool KernelSupportsIoUring();
 
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/tools/Android.bp b/fs_mgr/libsnapshot/tools/Android.bp
index 0f08286..a1c92c0 100644
--- a/fs_mgr/libsnapshot/tools/Android.bp
+++ b/fs_mgr/libsnapshot/tools/Android.bp
@@ -23,17 +23,18 @@
 
 
 cc_binary {
-    name: "basic_v2_cow_writer",
+    name: "write_cow",
     host_supported: true,
     defaults: [
         "fs_mgr_defaults",
         "libsnapshot_cow_defaults",
     ],
 
-    srcs: ["basic_v2_cow_writer.cpp"],
+    srcs: ["write_cow.cpp"],
 
     static_libs: [
         "libsnapshot_cow",
+        "libgflags",
     ],
 
     shared_libs: [
diff --git a/fs_mgr/libsnapshot/tools/basic_v2_cow_writer.cpp b/fs_mgr/libsnapshot/tools/basic_v2_cow_writer.cpp
deleted file mode 100644
index 72fb0f5..0000000
--- a/fs_mgr/libsnapshot/tools/basic_v2_cow_writer.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-//
-// Copyright (C) 2023 The Android Open Source Project
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-//
-#include <android-base/file.h>
-#include <android-base/logging.h>
-#include <libsnapshot/cow_compress.h>
-#include <libsnapshot/cow_format.h>
-#include <libsnapshot/cow_writer.h>
-#include <filesystem>
-
-#include "android-base/unique_fd.h"
-
-using namespace android::snapshot;
-
-// This writes a simple cow v2 file in the current directory. This file will serve as testdata for
-// ensuring our v3 cow reader will be able to read a cow file created by the v2 writer.
-//
-// WARNING: We should not be overriding this test file, as it will serve as historic marker for what
-// a device with old writer_v2 will write as a cow.
-void write_cow_v2() {
-    CowOptions options;
-    options.cluster_ops = 5;
-    options.num_merge_ops = 1;
-    std::string data = "This is some data, believe it";
-    data.resize(options.block_size, '\0');
-
-    char cwd_buffer[1024];
-    size_t cwd_buffer_size = sizeof(cwd_buffer);
-
-    // Get the current working directory path.
-    char* err = getcwd(cwd_buffer, cwd_buffer_size);
-    if (!err) {
-        LOG(ERROR) << "Couldn't get current directory";
-    }
-    android::base::unique_fd fd(open(strcat(cwd_buffer, "/cow_v2"), O_CREAT | O_RDWR, 0666));
-    if (fd.get() == -1) {
-        LOG(FATAL) << "couldn't open tmp_cow";
-    }
-    std::unique_ptr<ICowWriter> writer = CreateCowWriter(2, options, std::move(fd));
-    writer->AddCopy(0, 5);
-    writer->AddRawBlocks(2, data.data(), data.size());
-    writer->AddLabel(1);
-    writer->AddXorBlocks(50, data.data(), data.size(), 24, 10);
-    writer->AddZeroBlocks(5, 10);
-    writer->AddLabel(2);
-    writer->Finalize();
-}
-
-int main() {
-    write_cow_v2();
-}
diff --git a/fs_mgr/libsnapshot/tools/write_cow.cpp b/fs_mgr/libsnapshot/tools/write_cow.cpp
new file mode 100644
index 0000000..bd51174
--- /dev/null
+++ b/fs_mgr/libsnapshot/tools/write_cow.cpp
@@ -0,0 +1,114 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+#include <android-base/file.h>
+#include <android-base/logging.h>
+#include <libsnapshot/cow_compress.h>
+#include <libsnapshot/cow_format.h>
+#include <libsnapshot/cow_writer.h>
+
+#include <gflags/gflags.h>
+#include <iostream>
+
+#include "android-base/unique_fd.h"
+
+DEFINE_bool(silent, false, "Run silently");
+DEFINE_int32(writer_version, 2, "which version of COW writer to be used");
+DEFINE_bool(write_legacy, false,
+            "Writes a legacy cow_v2 in current directory, this cow was used to test backwards "
+            "compatibility between version 2 and version 3");
+DEFINE_bool(write_header, false, "Test reading/writing just the header");
+using namespace android::snapshot;
+
+// This writes a simple cow v2 file in the current directory. This file will serve as testdata for
+// ensuring our v3 cow reader will be able to read a cow file created by the v2 writer.
+//
+// WARNING: We should not be overriding this test file, as it will serve as historic marker for what
+// a device with old writer_v2 will write as a cow.
+static void write_legacy_cow_v2() {
+    CowOptions options;
+    options.cluster_ops = 5;
+    options.num_merge_ops = 1;
+    std::string data = "This is some data, believe it";
+    data.resize(options.block_size, '\0');
+
+    char cwd_buffer[1024];
+    size_t cwd_buffer_size = sizeof(cwd_buffer);
+
+    // Get the current working directory path.
+    char* err = getcwd(cwd_buffer, cwd_buffer_size);
+    if (!err) {
+        LOG(ERROR) << "Couldn't get current directory";
+    }
+    android::base::unique_fd fd(open(strcat(cwd_buffer, "/cow_v2"), O_CREAT | O_RDWR, 0666));
+    if (fd.get() == -1) {
+        LOG(FATAL) << "couldn't open tmp_cow";
+    }
+    std::unique_ptr<ICowWriter> writer = CreateCowWriter(2, options, std::move(fd));
+    writer->AddCopy(0, 5);
+    writer->AddRawBlocks(2, data.data(), data.size());
+    writer->AddLabel(1);
+    writer->AddXorBlocks(50, data.data(), data.size(), 24, 10);
+    writer->AddZeroBlocks(5, 10);
+    writer->AddLabel(2);
+    writer->Finalize();
+}
+
+static bool WriteCow(const std::string& path) {
+    android::base::unique_fd fd(open(path.c_str(), O_RDONLY));
+    fd.reset(open(path.c_str(), O_RDWR | O_CREAT | O_TRUNC, 0664));
+    if (fd < 0) {
+        PLOG(ERROR) << "could not open " << path << " for writing";
+        return false;
+    }
+    CowOptions options;
+    std::string data = "This is some data, believe it";
+    data.resize(options.block_size, '\0');
+
+    std::unique_ptr<ICowWriter> writer =
+            CreateCowWriter(FLAGS_writer_version, options, std::move(fd));
+    if (!writer) {
+        return false;
+    }
+
+    writer->AddCopy(0, 5);
+    writer->AddRawBlocks(2, data.data(), data.size());
+    writer->AddLabel(1);
+    writer->AddXorBlocks(50, data.data(), data.size(), 24, 10);
+    writer->AddZeroBlocks(5, 10);
+    writer->AddLabel(2);
+    writer->Finalize();
+
+    if (!FLAGS_silent) {
+        std::cout << "Writing COW with writer v" << FLAGS_writer_version << "\n";
+    }
+
+    return true;
+}
+
+int main(int argc, char** argv) {
+    gflags::ParseCommandLineFlags(&argc, &argv, true);
+    if (FLAGS_write_legacy) {
+        write_legacy_cow_v2();
+        return 0;
+    }
+    if (argc < 2) {
+        gflags::ShowUsageWithFlags(argv[0]);
+        return 1;
+    }
+    if (!WriteCow(argv[1])) {
+        return 1;
+    }
+}
diff --git a/init/Android.bp b/init/Android.bp
index 4c25ad7..e5512e6 100644
--- a/init/Android.bp
+++ b/init/Android.bp
@@ -389,10 +389,6 @@
     ],
 
     static_executable: true,
-    lto: {
-        // b/169004486 ThinLTO breaks x86 static executables.
-        never: true,
-    },
     system_shared_libs: [],
 
     cflags: [
diff --git a/init/persistent_properties.cpp b/init/persistent_properties.cpp
index 8db7267..8efb72c 100644
--- a/init/persistent_properties.cpp
+++ b/init/persistent_properties.cpp
@@ -46,13 +46,6 @@
 
 constexpr const char kLegacyPersistentPropertyDir[] = "/data/property";
 
-void AddPersistentProperty(const std::string& name, const std::string& value,
-                           PersistentProperties* persistent_properties) {
-    auto persistent_property_record = persistent_properties->add_properties();
-    persistent_property_record->set_name(name);
-    persistent_property_record->set_value(value);
-}
-
 Result<PersistentProperties> LoadLegacyPersistentProperties() {
     std::unique_ptr<DIR, decltype(&closedir)> dir(opendir(kLegacyPersistentPropertyDir), closedir);
     if (!dir) {
@@ -161,9 +154,9 @@
         return Error() << "Unable to parse persistent property file: Could not parse protobuf";
     }
     for (auto& prop : persistent_properties.properties()) {
-        if (!StartsWith(prop.name(), "persist.")) {
+        if (!StartsWith(prop.name(), "persist.") && !StartsWith(prop.name(), "next_boot.")) {
             return Error() << "Unable to load persistent property file: property '" << prop.name()
-                           << "' doesn't start with 'persist.'";
+                           << "' doesn't start with 'persist.' or 'next_boot.'";
         }
     }
     return persistent_properties;
@@ -171,6 +164,13 @@
 
 }  // namespace
 
+void AddPersistentProperty(const std::string& name, const std::string& value,
+                           PersistentProperties* persistent_properties) {
+    auto persistent_property_record = persistent_properties->add_properties();
+    persistent_property_record->set_name(name);
+    persistent_property_record->set_value(value);
+}
+
 Result<PersistentProperties> LoadPersistentPropertyFile() {
     auto file_contents = ReadPersistentPropertyFile();
     if (!file_contents.ok()) return file_contents.error();
diff --git a/init/persistent_properties.h b/init/persistent_properties.h
index 3845a0d..a6f80e6 100644
--- a/init/persistent_properties.h
+++ b/init/persistent_properties.h
@@ -25,6 +25,8 @@
 namespace android {
 namespace init {
 
+void AddPersistentProperty(const std::string& name, const std::string& value,
+                           PersistentProperties* persistent_properties);
 PersistentProperties LoadPersistentProperties();
 void WritePersistentProperty(const std::string& name, const std::string& value);
 
diff --git a/init/property_service.cpp b/init/property_service.cpp
index 2064fae..38cbea3 100644
--- a/init/property_service.cpp
+++ b/init/property_service.cpp
@@ -412,9 +412,8 @@
         }
     }
 
-    // Don't write properties to disk until after we have read all default
-    // properties to prevent them from being overwritten by default values.
-    if (socket && persistent_properties_loaded && StartsWith(name, "persist.")) {
+    bool need_persist = StartsWith(name, "persist.") || StartsWith(name, "next_boot.");
+    if (socket && persistent_properties_loaded && need_persist) {
         if (persist_write_thread) {
             persist_write_thread->Write(name, value, std::move(*socket));
             return {};
@@ -1398,11 +1397,43 @@
         case InitMessage::kLoadPersistentProperties: {
             load_override_properties();
             // Read persistent properties after all default values have been loaded.
+            // Apply staged and persistent properties
+            bool has_staged_prop = false;
+            auto const staged_prefix = std::string_view("next_boot.");
+            auto const staged_persist_prefix = std::string_view("next_boot.persist.");
+            auto persist_props_map = std::unordered_map<std::string, std::string>();
+
             auto persistent_properties = LoadPersistentProperties();
-            for (const auto& persistent_property_record : persistent_properties.properties()) {
-                InitPropertySet(persistent_property_record.name(),
-                                persistent_property_record.value());
+            for (const auto& property_record : persistent_properties.properties()) {
+                auto const& prop_name = property_record.name();
+                auto const& prop_value = property_record.value();
+
+                if (StartsWith(prop_name, staged_prefix)) {
+                  has_staged_prop = true;
+                  auto actual_prop_name = prop_name.substr(staged_prefix.size());
+                  InitPropertySet(actual_prop_name, prop_value);
+                  if (StartsWith(prop_name, staged_persist_prefix)) {
+                    persist_props_map[actual_prop_name] = prop_value;
+                  }
+                } else if (!persist_props_map.count(prop_name)) {
+                  InitPropertySet(prop_name, prop_value);
+                }
             }
+
+            // Update persist prop file if there are staged props
+            if (has_staged_prop) {
+                PersistentProperties updated_persist_props;
+                for (auto const& [prop_name, prop_value] : persist_props_map) {
+                    AddPersistentProperty(prop_name, prop_value, &updated_persist_props);
+                }
+
+                // write current updated persist prop file
+                auto result = WritePersistentPropertyFile(updated_persist_props);
+                if (!result.ok()) {
+                    LOG(ERROR) << "Could not store persistent property: " << result.error();
+                }
+            }
+
             // Apply debug ramdisk special settings after persistent properties are loaded.
             if (android::base::GetBoolProperty("ro.force.debuggable", false)) {
                 // Always enable usb adb if device is booted with debug ramdisk.
@@ -1461,8 +1492,6 @@
             work_.pop_front();
         }
 
-        std::this_thread::sleep_for(1s);
-
         // Perform write/fsync outside the lock.
         WritePersistentProperty(std::get<0>(item), std::get<1>(item));
         NotifyPropertyChange(std::get<0>(item), std::get<1>(item));
diff --git a/init/rlimit_parser.cpp b/init/rlimit_parser.cpp
index 476a46a..c2a3fa1 100644
--- a/init/rlimit_parser.cpp
+++ b/init/rlimit_parser.cpp
@@ -30,10 +30,14 @@
 // Builtins and service definitions both have their arguments start at 1 and finish at 3.
 Result<std::pair<int, rlimit>> ParseRlimit(const std::vector<std::string>& args) {
     static const std::vector<std::pair<const char*, int>> text_to_resources = {
-        {"cpu", 0},       {"fsize", 1}, {"data", 2},    {"stack", 3},
-        {"core", 4},      {"rss", 5},   {"nproc", 6},   {"nofile", 7},
-        {"memlock", 8},   {"as", 9},    {"locks", 10},  {"sigpending", 11},
-        {"msgqueue", 12}, {"nice", 13}, {"rtprio", 14}, {"rttime", 15},
+            {"cpu", RLIMIT_CPU},           {"fsize", RLIMIT_FSIZE},
+            {"data", RLIMIT_DATA},         {"stack", RLIMIT_STACK},
+            {"core", RLIMIT_CORE},         {"rss", RLIMIT_RSS},
+            {"nproc", RLIMIT_NPROC},       {"nofile", RLIMIT_NOFILE},
+            {"memlock", RLIMIT_MEMLOCK},   {"as", RLIMIT_AS},
+            {"locks", RLIMIT_LOCKS},       {"sigpending", RLIMIT_SIGPENDING},
+            {"msgqueue", RLIMIT_MSGQUEUE}, {"nice", RLIMIT_NICE},
+            {"rtprio", RLIMIT_RTPRIO},     {"rttime", RLIMIT_RTTIME},
     };
 
     int resource;
@@ -49,6 +53,8 @@
         std::string resource_string;
         if (StartsWith(args[1], "RLIM_")) {
             resource_string = args[1].substr(5);
+        } else if (StartsWith(args[1], "RLIMIT_")) {
+            resource_string = args[1].substr(7);
         } else {
             resource_string = args[1];
         }
diff --git a/init/rlimit_parser_test.cpp b/init/rlimit_parser_test.cpp
index 3c3f848..a6955f6 100644
--- a/init/rlimit_parser_test.cpp
+++ b/init/rlimit_parser_test.cpp
@@ -67,6 +67,7 @@
                     {{"rtprio", "10", "10"}, {14, {10, 10}}},
                     {{"rttime", "10", "10"}, {15, {10, 10}}},
 
+                    // For some reason, we spelled these wrong.
                     {{"RLIM_CPU", "10", "10"}, {0, {10, 10}}},
                     {{"RLIM_FSIZE", "10", "10"}, {1, {10, 10}}},
                     {{"RLIM_DATA", "10", "10"}, {2, {10, 10}}},
@@ -84,6 +85,24 @@
                     {{"RLIM_RTPRIO", "10", "10"}, {14, {10, 10}}},
                     {{"RLIM_RTTIME", "10", "10"}, {15, {10, 10}}},
 
+                    // These are the correct spellings.
+                    {{"RLIMIT_CPU", "10", "10"}, {0, {10, 10}}},
+                    {{"RLIMIT_FSIZE", "10", "10"}, {1, {10, 10}}},
+                    {{"RLIMIT_DATA", "10", "10"}, {2, {10, 10}}},
+                    {{"RLIMIT_STACK", "10", "10"}, {3, {10, 10}}},
+                    {{"RLIMIT_CORE", "10", "10"}, {4, {10, 10}}},
+                    {{"RLIMIT_RSS", "10", "10"}, {5, {10, 10}}},
+                    {{"RLIMIT_NPROC", "10", "10"}, {6, {10, 10}}},
+                    {{"RLIMIT_NOFILE", "10", "10"}, {7, {10, 10}}},
+                    {{"RLIMIT_MEMLOCK", "10", "10"}, {8, {10, 10}}},
+                    {{"RLIMIT_AS", "10", "10"}, {9, {10, 10}}},
+                    {{"RLIMIT_LOCKS", "10", "10"}, {10, {10, 10}}},
+                    {{"RLIMIT_SIGPENDING", "10", "10"}, {11, {10, 10}}},
+                    {{"RLIMIT_MSGQUEUE", "10", "10"}, {12, {10, 10}}},
+                    {{"RLIMIT_NICE", "10", "10"}, {13, {10, 10}}},
+                    {{"RLIMIT_RTPRIO", "10", "10"}, {14, {10, 10}}},
+                    {{"RLIMIT_RTTIME", "10", "10"}, {15, {10, 10}}},
+
                     {{"0", "10", "10"}, {0, {10, 10}}},
                     {{"1", "10", "10"}, {1, {10, 10}}},
                     {{"2", "10", "10"}, {2, {10, 10}}},
@@ -113,6 +132,7 @@
             {{"100", "10", "10"}, "Resource '100' over the maximum resource value '16'"},
             {{"bad_string", "10", "10"}, "Could not parse resource 'bad_string'"},
             {{"RLIM_", "10", "10"}, "Could not parse resource 'RLIM_'"},
+            {{"RLIMIT_", "10", "10"}, "Could not parse resource 'RLIMIT_'"},
             {{"cpu", "abc", "10"}, "Could not parse soft limit 'abc'"},
             {{"cpu", "10", "abc"}, "Could not parse hard limit 'abc'"},
             {{"cpu", "unlimit", "10"}, "Could not parse soft limit 'unlimit'"},
diff --git a/libcutils/socket_local_unix.h b/libcutils/socket_local_unix.h
index 45b9856..ea98c08 100644
--- a/libcutils/socket_local_unix.h
+++ b/libcutils/socket_local_unix.h
@@ -17,6 +17,8 @@
 #ifndef __SOCKET_LOCAL_H
 #define __SOCKET_LOCAL_H
 
+#include <sys/socket.h>
+
 #define FILESYSTEM_SOCKET_PREFIX "/tmp/" 
 #define ANDROID_RESERVED_SOCKET_PREFIX "/dev/socket/"
 
diff --git a/libcutils/sockets_windows.cpp b/libcutils/sockets_windows.cpp
index 4adb796..99a2e2d 100644
--- a/libcutils/sockets_windows.cpp
+++ b/libcutils/sockets_windows.cpp
@@ -35,7 +35,7 @@
 // can be extremely tricky and cause deadlock when using threads or atexit().
 //
 // Both adb (1) and Chrome (2) purposefully avoid WSACleanup() with no issues.
-// (1) https://android.googlesource.com/platform/system/core.git/+/master/adb/sysdeps_win32.cpp
+// (1) https://android.googlesource.com/platform/packages/modules/adb.git/+/main/sysdeps_win32.cpp
 // (2) https://code.google.com/p/chromium/codesearch#chromium/src/net/base/winsock_init.cc
 bool initialize_windows_sockets() {
     // There's no harm in calling WSAStartup() multiple times but no benefit
diff --git a/libprocessgroup/processgroup.cpp b/libprocessgroup/processgroup.cpp
index 4506439..cc2565f 100644
--- a/libprocessgroup/processgroup.cpp
+++ b/libprocessgroup/processgroup.cpp
@@ -219,7 +219,7 @@
 
     while (retries--) {
         ret = rmdir(uid_pid_path.c_str());
-        if (!ret || errno != EBUSY) break;
+        if (!ret || errno != EBUSY || !retries) break;
         std::this_thread::sleep_for(5ms);
     }
 
diff --git a/libprocessgroup/profiles/cgroups.json b/libprocessgroup/profiles/cgroups.json
index d013ec8..3e4393d 100644
--- a/libprocessgroup/profiles/cgroups.json
+++ b/libprocessgroup/profiles/cgroups.json
@@ -1,6 +1,13 @@
 {
   "Cgroups": [
     {
+      "Controller": "blkio",
+      "Path": "/dev/blkio",
+      "Mode": "0775",
+      "UID": "system",
+      "GID": "system"
+    },
+    {
       "Controller": "cpu",
       "Path": "/dev/cpuctl",
       "Mode": "0755",
@@ -32,12 +39,6 @@
       {
         "Controller": "freezer",
         "Path": "."
-      },
-      {
-        "Controller": "io",
-        "Path": ".",
-        "NeedsActivation": true,
-        "Optional": true
       }
     ]
   }
diff --git a/libprocessgroup/profiles/task_profiles.json b/libprocessgroup/profiles/task_profiles.json
index 12f7b44..1fc66ba 100644
--- a/libprocessgroup/profiles/task_profiles.json
+++ b/libprocessgroup/profiles/task_profiles.json
@@ -76,24 +76,6 @@
       "Name": "FreezerState",
       "Controller": "freezer",
       "File": "cgroup.freeze"
-    },
-    {
-      "Name": "BfqWeight",
-      "Controller": "io",
-      "File": "blkio.bfq.weight",
-      "FileV2": "io.bfq.weight"
-    },
-    {
-      "Name": "CfqGroupIdle",
-      "Controller": "io",
-      "File": "blkio.group_idle",
-      "FileV2": "io.group_idle"
-    },
-    {
-      "Name": "CfqWeight",
-      "Controller": "io",
-      "File": "blkio.weight",
-      "FileV2": "io.weight"
     }
   ],
 
@@ -457,30 +439,11 @@
       "Name": "LowIoPriority",
       "Actions": [
         {
-          "Name": "SetAttribute",
+          "Name": "JoinCgroup",
           "Params":
           {
-            "Name": "BfqWeight",
-            "Value": "10",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqGroupIdle",
-            "Value": "0",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqWeight",
-            "Value": "200",
-            "Optional": "true"
+            "Controller": "blkio",
+            "Path": "background"
           }
         }
       ]
@@ -489,30 +452,11 @@
       "Name": "NormalIoPriority",
       "Actions": [
         {
-          "Name": "SetAttribute",
+          "Name": "JoinCgroup",
           "Params":
           {
-            "Name": "BfqWeight",
-            "Value": "100",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqGroupIdle",
-            "Value": "0",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqWeight",
-            "Value": "1000",
-            "Optional": "true"
+            "Controller": "blkio",
+            "Path": ""
           }
         }
       ]
@@ -521,30 +465,11 @@
       "Name": "HighIoPriority",
       "Actions": [
         {
-          "Name": "SetAttribute",
+          "Name": "JoinCgroup",
           "Params":
           {
-            "Name": "BfqWeight",
-            "Value": "100",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqGroupIdle",
-            "Value": "0",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqWeight",
-            "Value": "1000",
-            "Optional": "true"
+            "Controller": "blkio",
+            "Path": ""
           }
         }
       ]
@@ -553,30 +478,11 @@
       "Name": "MaxIoPriority",
       "Actions": [
         {
-          "Name": "SetAttribute",
+          "Name": "JoinCgroup",
           "Params":
           {
-            "Name": "BfqWeight",
-            "Value": "100",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqGroupIdle",
-            "Value": "0",
-            "Optional": "true"
-          }
-        },
-        {
-          "Name": "SetAttribute",
-          "Params":
-          {
-            "Name": "CfqWeight",
-            "Value": "1000",
-            "Optional": "true"
+            "Controller": "blkio",
+            "Path": ""
           }
         }
       ]
diff --git a/libstats/OWNERS b/libstats/OWNERS
index d391679..efd3686 100644
--- a/libstats/OWNERS
+++ b/libstats/OWNERS
@@ -1,8 +1,8 @@
 jeffreyhuang@google.com
-jtnguyen@google.com
+monicamwang@google.com
 muhammadq@google.com
+rayhdez@google.com
 sharaienko@google.com
 singhtejinder@google.com
 tsaichristine@google.com
 yaochen@google.com
-yro@google.com
diff --git a/libutils/Android.bp b/libutils/Android.bp
index 2c05fbc..b3ddda3 100644
--- a/libutils/Android.bp
+++ b/libutils/Android.bp
@@ -132,25 +132,19 @@
     ],
     native_bridge_supported: true,
 
+    whole_static_libs: ["libutils_binder"],
+
     srcs: [
-        "Errors.cpp",
         "FileMap.cpp",
         "JenkinsHash.cpp",
         "LightRefBase.cpp",
         "NativeHandle.cpp",
         "Printer.cpp",
-        "RefBase.cpp",
-        "SharedBuffer.cpp",
         "StopWatch.cpp",
-        "String8.cpp",
-        "String16.cpp",
-        "StrongPointer.cpp",
         "SystemClock.cpp",
         "Threads.cpp",
         "Timers.cpp",
         "Tokenizer.cpp",
-        "Unicode.cpp",
-        "VectorImpl.cpp",
         "misc.cpp",
     ],
 
@@ -208,7 +202,6 @@
     defaults: ["libutils_impl_defaults"],
 
     cflags: [
-        "-DCALLSTACKS=1",
         "-DDEBUG_POLL_AND_WAKE=1",
         "-DDEBUG_REFS=1",
         "-DDEBUG_TOKENIZER=1",
@@ -275,24 +268,6 @@
 }
 
 cc_fuzz {
-    name: "libutils_fuzz_string8",
-    defaults: ["libutils_fuzz_defaults"],
-    srcs: ["String8_fuzz.cpp"],
-}
-
-cc_fuzz {
-    name: "libutils_fuzz_string16",
-    defaults: ["libutils_fuzz_defaults"],
-    srcs: ["String16_fuzz.cpp"],
-}
-
-cc_fuzz {
-    name: "libutils_fuzz_vector",
-    defaults: ["libutils_fuzz_defaults"],
-    srcs: ["Vector_fuzz.cpp"],
-}
-
-cc_fuzz {
     name: "libutils_fuzz_printer",
     defaults: ["libutils_fuzz_defaults"],
     srcs: ["Printer_fuzz.cpp"],
@@ -317,12 +292,6 @@
 }
 
 cc_fuzz {
-    name: "libutils_fuzz_refbase",
-    defaults: ["libutils_fuzz_defaults"],
-    srcs: ["RefBase_fuzz.cpp"],
-}
-
-cc_fuzz {
     name: "libutils_fuzz_lrucache",
     defaults: ["libutils_fuzz_defaults"],
     srcs: ["LruCache_fuzz.cpp"],
@@ -341,18 +310,11 @@
     srcs: [
         "BitSet_test.cpp",
         "CallStack_test.cpp",
-        "Errors_test.cpp",
         "FileMap_test.cpp",
         "LruCache_test.cpp",
         "Mutex_test.cpp",
-        "SharedBuffer_test.cpp",
         "Singleton_test.cpp",
-        "String16_test.cpp",
-        "String8_test.cpp",
-        "StrongPointer_test.cpp",
         "Timers_test.cpp",
-        "Unicode_test.cpp",
-        "Vector_test.cpp",
     ],
 
     target: {
@@ -374,7 +336,6 @@
         linux: {
             srcs: [
                 "Looper_test.cpp",
-                "RefBase_test.cpp",
             ],
         },
         host: {
@@ -428,9 +389,3 @@
     shared_libs: ["libutils_test_singleton1"],
     header_libs: ["libutils_headers"],
 }
-
-cc_benchmark {
-    name: "libutils_benchmark",
-    srcs: ["Vector_benchmark.cpp"],
-    shared_libs: ["libutils"],
-}
diff --git a/libutils/CallStack.cpp b/libutils/CallStack.cpp
index 11f2c92..fe827eb 100644
--- a/libutils/CallStack.cpp
+++ b/libutils/CallStack.cpp
@@ -18,7 +18,7 @@
 
 #include <utils/Printer.h>
 #include <utils/Errors.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 #include <unwindstack/AndroidUnwinder.h>
 
diff --git a/libutils/FileMap.cpp b/libutils/FileMap.cpp
index 0abb861..3acbce9 100644
--- a/libutils/FileMap.cpp
+++ b/libutils/FileMap.cpp
@@ -21,7 +21,7 @@
 #define LOG_TAG "filemap"
 
 #include <utils/FileMap.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 #if defined(__MINGW32__) && !defined(__USE_MINGW_ANSI_STDIO)
 # define PRId32 "I32d"
diff --git a/libutils/Printer.cpp b/libutils/Printer.cpp
index c9ae210..4bd49f1 100644
--- a/libutils/Printer.cpp
+++ b/libutils/Printer.cpp
@@ -19,7 +19,7 @@
 
 #include <utils/Printer.h>
 #include <utils/String8.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 #include <stdlib.h>
 
diff --git a/libutils/StopWatch.cpp b/libutils/StopWatch.cpp
index 28e2d76..c88d60f 100644
--- a/libutils/StopWatch.cpp
+++ b/libutils/StopWatch.cpp
@@ -24,7 +24,7 @@
 #endif
 #include <inttypes.h>
 
-#include <utils/Log.h>
+#include <log/log.h>
 
 namespace android {
 
diff --git a/libutils/SystemClock.cpp b/libutils/SystemClock.cpp
index 9c71141..df3a898 100644
--- a/libutils/SystemClock.cpp
+++ b/libutils/SystemClock.cpp
@@ -30,7 +30,7 @@
 #include <cutils/compiler.h>
 
 #include <utils/Timers.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 namespace android {
 
diff --git a/libutils/TEST_MAPPING b/libutils/TEST_MAPPING
index c8ef45c..472146f 100644
--- a/libutils/TEST_MAPPING
+++ b/libutils/TEST_MAPPING
@@ -2,6 +2,9 @@
   "presubmit": [
     {
       "name": "libutils_test"
+    },
+    {
+      "name": "libutils_binder_test"
     }
   ]
 }
diff --git a/libutils/Threads.cpp b/libutils/Threads.cpp
index e756fec..90ea29b 100644
--- a/libutils/Threads.cpp
+++ b/libutils/Threads.cpp
@@ -34,7 +34,7 @@
 #include <sys/prctl.h>
 #endif
 
-#include <utils/Log.h>
+#include <log/log.h>
 
 #if defined(__ANDROID__)
 #include <processgroup/processgroup.h>
diff --git a/libutils/Timers.cpp b/libutils/Timers.cpp
index 4cfac57..98082c9 100644
--- a/libutils/Timers.cpp
+++ b/libutils/Timers.cpp
@@ -21,7 +21,7 @@
 #include <time.h>
 
 #include <android-base/macros.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 static constexpr size_t clock_id_max = 5;
 
diff --git a/libutils/Tokenizer.cpp b/libutils/Tokenizer.cpp
index 9fc955c..aa097ae 100644
--- a/libutils/Tokenizer.cpp
+++ b/libutils/Tokenizer.cpp
@@ -19,7 +19,7 @@
 #include <utils/Tokenizer.h>
 #include <fcntl.h>
 #include <sys/stat.h>
-#include <utils/Log.h>
+#include <log/log.h>
 
 #ifndef DEBUG_TOKENIZER
 // Enables debug output for the tokenizer.
diff --git a/libutils/binder/Android.bp b/libutils/binder/Android.bp
new file mode 100644
index 0000000..e2eddb3
--- /dev/null
+++ b/libutils/binder/Android.bp
@@ -0,0 +1,126 @@
+package {
+    default_applicable_licenses: ["system_core_libutils_license"],
+}
+
+cc_defaults {
+    name: "libutils_binder_impl_defaults",
+    defaults: [
+        "libutils_defaults",
+        "apex-lowest-min-sdk-version",
+    ],
+    native_bridge_supported: true,
+
+    srcs: [
+        "Errors.cpp",
+        "RefBase.cpp",
+        "SharedBuffer.cpp",
+        "String16.cpp",
+        "String8.cpp",
+        "StrongPointer.cpp",
+        "Unicode.cpp",
+        "VectorImpl.cpp",
+    ],
+
+    apex_available: [
+        "//apex_available:anyapex",
+        "//apex_available:platform",
+    ],
+
+    afdo: true,
+}
+
+cc_library {
+    name: "libutils_binder",
+    defaults: ["libutils_binder_impl_defaults"],
+}
+
+cc_library {
+    name: "libutils_binder_test_compile",
+    defaults: ["libutils_binder_impl_defaults"],
+
+    cflags: [
+        "-DDEBUG_REFS=1",
+    ],
+
+    visibility: [":__subpackages__"],
+}
+
+cc_fuzz {
+    name: "libutils_fuzz_string8",
+    defaults: ["libutils_fuzz_defaults"],
+    srcs: ["String8_fuzz.cpp"],
+}
+
+cc_fuzz {
+    name: "libutils_fuzz_string16",
+    defaults: ["libutils_fuzz_defaults"],
+    srcs: ["String16_fuzz.cpp"],
+}
+
+cc_fuzz {
+    name: "libutils_fuzz_vector",
+    defaults: ["libutils_fuzz_defaults"],
+    srcs: ["Vector_fuzz.cpp"],
+}
+
+cc_fuzz {
+    name: "libutils_fuzz_refbase",
+    defaults: ["libutils_fuzz_defaults"],
+    srcs: ["RefBase_fuzz.cpp"],
+}
+
+cc_test {
+    name: "libutils_binder_test",
+    host_supported: true,
+
+    srcs: [
+        "Errors_test.cpp",
+        "SharedBuffer_test.cpp",
+        "String16_test.cpp",
+        "String8_test.cpp",
+        "StrongPointer_test.cpp",
+        "Unicode_test.cpp",
+        "Vector_test.cpp",
+    ],
+
+    target: {
+        android: {
+            shared_libs: [
+                "libbase",
+                "libcutils",
+                "liblog",
+                "liblzma",
+                "libutils", // which includes libutils_binder
+                "libz",
+            ],
+        },
+        linux: {
+            srcs: [
+                "RefBase_test.cpp",
+            ],
+        },
+        host: {
+            static_libs: [
+                "libbase",
+                "liblog",
+                "liblzma",
+                "libutils", // which includes libutils_binder
+            ],
+        },
+    },
+
+    cflags: [
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        "-Wthread-safety",
+    ],
+
+    test_suites: ["device-tests"],
+}
+
+cc_benchmark {
+    name: "libutils_binder_benchmark",
+    srcs: ["Vector_benchmark.cpp"],
+    shared_libs: ["libutils"],
+}
diff --git a/libutils/Errors.cpp b/libutils/binder/Errors.cpp
similarity index 100%
rename from libutils/Errors.cpp
rename to libutils/binder/Errors.cpp
diff --git a/libutils/Errors_test.cpp b/libutils/binder/Errors_test.cpp
similarity index 100%
rename from libutils/Errors_test.cpp
rename to libutils/binder/Errors_test.cpp
diff --git a/libutils/FuzzFormatTypes.h b/libutils/binder/FuzzFormatTypes.h
similarity index 100%
rename from libutils/FuzzFormatTypes.h
rename to libutils/binder/FuzzFormatTypes.h
diff --git a/libutils/RefBase.cpp b/libutils/binder/RefBase.cpp
similarity index 98%
rename from libutils/RefBase.cpp
rename to libutils/binder/RefBase.cpp
index e0a2846..c7055fb 100644
--- a/libutils/RefBase.cpp
+++ b/libutils/binder/RefBase.cpp
@@ -18,6 +18,7 @@
 // #define LOG_NDEBUG 0
 
 #include <memory>
+#include <mutex>
 
 #include <android-base/macros.h>
 
@@ -27,8 +28,6 @@
 #include <utils/RefBase.h>
 #include <utils/String8.h>
 
-#include <utils/Mutex.h>
-
 #ifndef __unused
 #define __unused __attribute__((__unused__))
 #endif
@@ -310,7 +309,7 @@
         String8 text;
 
         {
-            Mutex::Autolock _l(mMutex);
+            std::lock_guard<std::mutex> _l(mMutex);
             char buf[128];
             snprintf(buf, sizeof(buf),
                      "Strong references on RefBase %p (weakref_type %p):\n",
@@ -353,7 +352,7 @@
     void addRef(ref_entry** refs, const void* id, int32_t mRef)
     {
         if (mTrackEnabled) {
-            AutoMutex _l(mMutex);
+            std::lock_guard<std::mutex> _l(mMutex);
 
             ref_entry* ref = new ref_entry;
             // Reference count at the time of the snapshot, but before the
@@ -372,7 +371,7 @@
     void removeRef(ref_entry** refs, const void* id)
     {
         if (mTrackEnabled) {
-            AutoMutex _l(mMutex);
+            std::lock_guard<std::mutex> _l(mMutex);
 
             ref_entry* const head = *refs;
             ref_entry* ref = head;
@@ -406,7 +405,7 @@
     void renameRefsId(ref_entry* r, const void* old_id, const void* new_id)
     {
         if (mTrackEnabled) {
-            AutoMutex _l(mMutex);
+            std::lock_guard<std::mutex> _l(mMutex);
             ref_entry* ref = r;
             while (ref != NULL) {
                 if (ref->id == old_id) {
@@ -434,7 +433,7 @@
         }
     }
 
-    mutable Mutex mMutex;
+    mutable std::mutex mMutex;
     ref_entry* mStrongRefs;
     ref_entry* mWeakRefs;
 
diff --git a/libutils/RefBase_fuzz.cpp b/libutils/binder/RefBase_fuzz.cpp
similarity index 99%
rename from libutils/RefBase_fuzz.cpp
rename to libutils/binder/RefBase_fuzz.cpp
index 8291be9..05f47a0 100644
--- a/libutils/RefBase_fuzz.cpp
+++ b/libutils/binder/RefBase_fuzz.cpp
@@ -19,7 +19,7 @@
 #include <thread>
 
 #include "fuzzer/FuzzedDataProvider.h"
-#include "utils/Log.h"
+#include "log/log.h"
 #include "utils/RWLock.h"
 #include "utils/RefBase.h"
 #include "utils/StrongPointer.h"
diff --git a/libutils/RefBase_test.cpp b/libutils/binder/RefBase_test.cpp
similarity index 100%
rename from libutils/RefBase_test.cpp
rename to libutils/binder/RefBase_test.cpp
diff --git a/libutils/SharedBuffer.cpp b/libutils/binder/SharedBuffer.cpp
similarity index 100%
rename from libutils/SharedBuffer.cpp
rename to libutils/binder/SharedBuffer.cpp
diff --git a/libutils/SharedBuffer.h b/libutils/binder/SharedBuffer.h
similarity index 100%
rename from libutils/SharedBuffer.h
rename to libutils/binder/SharedBuffer.h
diff --git a/libutils/SharedBuffer_test.cpp b/libutils/binder/SharedBuffer_test.cpp
similarity index 100%
rename from libutils/SharedBuffer_test.cpp
rename to libutils/binder/SharedBuffer_test.cpp
diff --git a/libutils/String16.cpp b/libutils/binder/String16.cpp
similarity index 99%
rename from libutils/String16.cpp
rename to libutils/binder/String16.cpp
index 38d483e..07a3d23 100644
--- a/libutils/String16.cpp
+++ b/libutils/binder/String16.cpp
@@ -16,7 +16,7 @@
 
 #include <utils/String16.h>
 
-#include <utils/Log.h>
+#include <log/log.h>
 
 #include <ctype.h>
 
diff --git a/libutils/String16_fuzz.cpp b/libutils/binder/String16_fuzz.cpp
similarity index 100%
rename from libutils/String16_fuzz.cpp
rename to libutils/binder/String16_fuzz.cpp
diff --git a/libutils/String16_test.cpp b/libutils/binder/String16_test.cpp
similarity index 100%
rename from libutils/String16_test.cpp
rename to libutils/binder/String16_test.cpp
diff --git a/libutils/String8.cpp b/libutils/binder/String8.cpp
similarity index 99%
rename from libutils/String8.cpp
rename to libutils/binder/String8.cpp
index 4301f0e..6a75484 100644
--- a/libutils/String8.cpp
+++ b/libutils/binder/String8.cpp
@@ -20,7 +20,7 @@
 #include <utils/String8.h>
 
 #include <utils/Compat.h>
-#include <utils/Log.h>
+#include <log/log.h>
 #include <utils/String16.h>
 
 #include <ctype.h>
diff --git a/libutils/String8_fuzz.cpp b/libutils/binder/String8_fuzz.cpp
similarity index 100%
rename from libutils/String8_fuzz.cpp
rename to libutils/binder/String8_fuzz.cpp
diff --git a/libutils/String8_test.cpp b/libutils/binder/String8_test.cpp
similarity index 99%
rename from libutils/String8_test.cpp
rename to libutils/binder/String8_test.cpp
index e1fd13a..6f7882a 100644
--- a/libutils/String8_test.cpp
+++ b/libutils/binder/String8_test.cpp
@@ -16,7 +16,7 @@
 
 #define LOG_TAG "String8_test"
 
-#include <utils/Log.h>
+#include <log/log.h>
 #include <utils/String8.h>
 #include <utils/String16.h>
 
diff --git a/libutils/StrongPointer.cpp b/libutils/binder/StrongPointer.cpp
similarity index 100%
rename from libutils/StrongPointer.cpp
rename to libutils/binder/StrongPointer.cpp
diff --git a/libutils/StrongPointer_test.cpp b/libutils/binder/StrongPointer_test.cpp
similarity index 100%
rename from libutils/StrongPointer_test.cpp
rename to libutils/binder/StrongPointer_test.cpp
diff --git a/libutils/Unicode.cpp b/libutils/binder/Unicode.cpp
similarity index 100%
rename from libutils/Unicode.cpp
rename to libutils/binder/Unicode.cpp
diff --git a/libutils/Unicode_test.cpp b/libutils/binder/Unicode_test.cpp
similarity index 100%
rename from libutils/Unicode_test.cpp
rename to libutils/binder/Unicode_test.cpp
diff --git a/libutils/VectorImpl.cpp b/libutils/binder/VectorImpl.cpp
similarity index 100%
rename from libutils/VectorImpl.cpp
rename to libutils/binder/VectorImpl.cpp
diff --git a/libutils/Vector_benchmark.cpp b/libutils/binder/Vector_benchmark.cpp
similarity index 100%
rename from libutils/Vector_benchmark.cpp
rename to libutils/binder/Vector_benchmark.cpp
diff --git a/libutils/Vector_fuzz.cpp b/libutils/binder/Vector_fuzz.cpp
similarity index 99%
rename from libutils/Vector_fuzz.cpp
rename to libutils/binder/Vector_fuzz.cpp
index 6fd2baf..3cef487 100644
--- a/libutils/Vector_fuzz.cpp
+++ b/libutils/binder/Vector_fuzz.cpp
@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 #include <fuzzer/FuzzedDataProvider.h>
-#include <utils/Log.h>
+#include <log/log.h>
 #include <utils/Vector.h>
 
 #include <functional>
diff --git a/libutils/Vector_test.cpp b/libutils/binder/Vector_test.cpp
similarity index 100%
rename from libutils/Vector_test.cpp
rename to libutils/binder/Vector_test.cpp
diff --git a/libutils/include/utils/Errors.h b/libutils/binder/include/utils/Errors.h
similarity index 100%
rename from libutils/include/utils/Errors.h
rename to libutils/binder/include/utils/Errors.h
diff --git a/libutils/include/utils/RefBase.h b/libutils/binder/include/utils/RefBase.h
similarity index 100%
rename from libutils/include/utils/RefBase.h
rename to libutils/binder/include/utils/RefBase.h
diff --git a/libutils/include/utils/String16.h b/libutils/binder/include/utils/String16.h
similarity index 100%
rename from libutils/include/utils/String16.h
rename to libutils/binder/include/utils/String16.h
diff --git a/libutils/include/utils/String8.h b/libutils/binder/include/utils/String8.h
similarity index 100%
rename from libutils/include/utils/String8.h
rename to libutils/binder/include/utils/String8.h
diff --git a/libutils/include/utils/StrongPointer.h b/libutils/binder/include/utils/StrongPointer.h
similarity index 100%
rename from libutils/include/utils/StrongPointer.h
rename to libutils/binder/include/utils/StrongPointer.h
diff --git a/libutils/include/utils/Unicode.h b/libutils/binder/include/utils/Unicode.h
similarity index 100%
rename from libutils/include/utils/Unicode.h
rename to libutils/binder/include/utils/Unicode.h
diff --git a/libutils/include/utils/Vector.h b/libutils/binder/include/utils/Vector.h
similarity index 100%
rename from libutils/include/utils/Vector.h
rename to libutils/binder/include/utils/Vector.h
diff --git a/libutils/include/utils/VectorImpl.h b/libutils/binder/include/utils/VectorImpl.h
similarity index 100%
rename from libutils/include/utils/VectorImpl.h
rename to libutils/binder/include/utils/VectorImpl.h
diff --git a/libutils/include/utils/Errors.h b/libutils/include/utils/Errors.h
new file mode 120000
index 0000000..2eba10b
--- /dev/null
+++ b/libutils/include/utils/Errors.h
@@ -0,0 +1 @@
+../../binder/include/utils/Errors.h
\ No newline at end of file
diff --git a/libutils/include/utils/RefBase.h b/libutils/include/utils/RefBase.h
new file mode 120000
index 0000000..86d72b1
--- /dev/null
+++ b/libutils/include/utils/RefBase.h
@@ -0,0 +1 @@
+../../binder/include/utils/RefBase.h
\ No newline at end of file
diff --git a/libutils/include/utils/String16.h b/libutils/include/utils/String16.h
new file mode 120000
index 0000000..b88792f
--- /dev/null
+++ b/libutils/include/utils/String16.h
@@ -0,0 +1 @@
+../../binder/include/utils/String16.h
\ No newline at end of file
diff --git a/libutils/include/utils/String8.h b/libutils/include/utils/String8.h
new file mode 120000
index 0000000..fa5a082
--- /dev/null
+++ b/libutils/include/utils/String8.h
@@ -0,0 +1 @@
+../../binder/include/utils/String8.h
\ No newline at end of file
diff --git a/libutils/include/utils/StrongPointer.h b/libutils/include/utils/StrongPointer.h
new file mode 120000
index 0000000..fd8bc60
--- /dev/null
+++ b/libutils/include/utils/StrongPointer.h
@@ -0,0 +1 @@
+../../binder/include/utils/StrongPointer.h
\ No newline at end of file
diff --git a/libutils/include/utils/Unicode.h b/libutils/include/utils/Unicode.h
new file mode 120000
index 0000000..8a480bc
--- /dev/null
+++ b/libutils/include/utils/Unicode.h
@@ -0,0 +1 @@
+../../binder/include/utils/Unicode.h
\ No newline at end of file
diff --git a/libutils/include/utils/Vector.h b/libutils/include/utils/Vector.h
new file mode 120000
index 0000000..e1571ef
--- /dev/null
+++ b/libutils/include/utils/Vector.h
@@ -0,0 +1 @@
+../../binder/include/utils/Vector.h
\ No newline at end of file
diff --git a/libutils/include/utils/VectorImpl.h b/libutils/include/utils/VectorImpl.h
new file mode 120000
index 0000000..4726446
--- /dev/null
+++ b/libutils/include/utils/VectorImpl.h
@@ -0,0 +1 @@
+../../binder/include/utils/VectorImpl.h
\ No newline at end of file
diff --git a/libutils/misc.cpp b/libutils/misc.cpp
index f77e189..e1b5f01 100644
--- a/libutils/misc.cpp
+++ b/libutils/misc.cpp
@@ -20,7 +20,7 @@
 
 #include <pthread.h>
 
-#include <utils/Log.h>
+#include <log/log.h>
 #include <utils/Vector.h>
 
 #if defined(__ANDROID__) && !defined(__ANDROID_RECOVERY__)
diff --git a/rootdir/etc/linker.config.json b/rootdir/etc/linker.config.json
index 47f77b1..d72ac66 100644
--- a/rootdir/etc/linker.config.json
+++ b/rootdir/etc/linker.config.json
@@ -11,9 +11,6 @@
     "libsigchain.so",
     // TODO(b/122876336): Remove libpac.so once it's migrated to Webview
     "libpac.so",
-    // TODO(b/184872979): Remove libbinder_rpc_unstable.so once stablized and
-    // added to libbinder_ndk.
-    "libbinder_rpc_unstable.so",
     // TODO(b/120786417 or b/134659294): libicuuc.so
     // and libicui18n.so are kept for app compat.
     "libicui18n.so",
diff --git a/rootdir/etc/public.libraries.android.txt b/rootdir/etc/public.libraries.android.txt
index cacc47c..9be2ef6 100644
--- a/rootdir/etc/public.libraries.android.txt
+++ b/rootdir/etc/public.libraries.android.txt
@@ -1,4 +1,4 @@
-# See https://android.googlesource.com/platform/ndk/+/master/docs/PlatformApis.md
+# See https://android.googlesource.com/platform/ndk/+/main/docs/PlatformApis.md
 libandroid.so
 libaaudio.so
 libamidi.so
diff --git a/rootdir/etc/public.libraries.iot.txt b/rootdir/etc/public.libraries.iot.txt
index 77f8bb8..0513968 100644
--- a/rootdir/etc/public.libraries.iot.txt
+++ b/rootdir/etc/public.libraries.iot.txt
@@ -1,4 +1,4 @@
-# See https://android.googlesource.com/platform/ndk/+/master/docs/PlatformApis.md
+# See https://android.googlesource.com/platform/ndk/+/main/docs/PlatformApis.md
 libandroid.so
 libandroidthings.so
 libaaudio.so
diff --git a/rootdir/etc/public.libraries.wear.txt b/rootdir/etc/public.libraries.wear.txt
index ea1e234..5915dcb 100644
--- a/rootdir/etc/public.libraries.wear.txt
+++ b/rootdir/etc/public.libraries.wear.txt
@@ -1,4 +1,4 @@
-# See https://android.googlesource.com/platform/ndk/+/master/docs/PlatformApis.md
+# See https://android.googlesource.com/platform/ndk/+/main/docs/PlatformApis.md
 libandroid.so
 libaaudio.so
 libamidi.so
diff --git a/rootdir/init.rc b/rootdir/init.rc
index fb64736..317f809 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -219,6 +219,26 @@
     write /dev/stune/nnapi-hal/schedtune.boost 1
     write /dev/stune/nnapi-hal/schedtune.prefer_idle 1
 
+    # Create blkio group and apply initial settings.
+    # This feature needs kernel to support it, and the
+    # device's init.rc must actually set the correct values.
+    mkdir /dev/blkio/background
+    chown system system /dev/blkio
+    chown system system /dev/blkio/background
+    chown system system /dev/blkio/tasks
+    chown system system /dev/blkio/background/tasks
+    chown system system /dev/blkio/cgroup.procs
+    chown system system /dev/blkio/background/cgroup.procs
+    chmod 0664 /dev/blkio/tasks
+    chmod 0664 /dev/blkio/background/tasks
+    chmod 0664 /dev/blkio/cgroup.procs
+    chmod 0664 /dev/blkio/background/cgroup.procs
+    write /dev/blkio/blkio.weight 1000
+    write /dev/blkio/background/blkio.weight 200
+    write /dev/blkio/background/blkio.bfq.weight 10
+    write /dev/blkio/blkio.group_idle 0
+    write /dev/blkio/background/blkio.group_idle 0
+
     restorecon_recursive /mnt
 
     mount configfs none /config nodev noexec nosuid
diff --git a/trusty/apploader/fuzz/app_fuzzer.cpp b/trusty/apploader/fuzz/app_fuzzer.cpp
index aa0caca..0a037f9 100644
--- a/trusty/apploader/fuzz/app_fuzzer.cpp
+++ b/trusty/apploader/fuzz/app_fuzzer.cpp
@@ -43,10 +43,6 @@
         {0xb5, 0xe8, 0xa7, 0xe9, 0xef, 0x17, 0x3a, 0x97},
 };
 
-static inline uintptr_t RoundPageUp(uintptr_t val) {
-    return (val + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);
-}
-
 static bool SendLoadMsg(int chan, int dma_buf, size_t dma_buf_size) {
     apploader_header hdr = {
             .cmd = APPLOADER_CMD_LOAD_APPLICATION,
@@ -107,7 +103,7 @@
         android::trusty::fuzz::Abort();
     }
 
-    uint64_t shm_len = size ? RoundPageUp(size) : PAGE_SIZE;
+    uint64_t shm_len = size ? size : 4096;
     BufferAllocator alloc;
     unique_fd dma_buf(alloc.Alloc(kDmabufSystemHeapName, shm_len));
     if (dma_buf < 0) {
diff --git a/trusty/confirmationui/TrustyApp.cpp b/trusty/confirmationui/TrustyApp.cpp
index cee8655..2356eef 100644
--- a/trusty/confirmationui/TrustyApp.cpp
+++ b/trusty/confirmationui/TrustyApp.cpp
@@ -30,10 +30,6 @@
 
 using ::android::base::unique_fd;
 
-static inline uintptr_t RoundPageUp(uintptr_t val) {
-    return (val + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);
-}
-
 ssize_t TrustyApp::TrustyRpc(const uint8_t* obegin, const uint8_t* oend, uint8_t* ibegin,
                              uint8_t* iend) {
     uint32_t olen = oend - obegin;
@@ -99,7 +95,7 @@
         return;
     }
 
-    uint32_t shm_len = RoundPageUp(CONFIRMATIONUI_MAX_MSG_SIZE);
+    uint32_t shm_len = CONFIRMATIONUI_MAX_MSG_SIZE;
     BufferAllocator allocator;
     unique_fd dma_buf(allocator.Alloc("system", shm_len));
     if (dma_buf < 0) {
diff --git a/trusty/coverage/coverage.cpp b/trusty/coverage/coverage.cpp
index 3c6b5c5..8fc2f5c 100644
--- a/trusty/coverage/coverage.cpp
+++ b/trusty/coverage/coverage.cpp
@@ -43,10 +43,6 @@
 using std::to_string;
 using std::unique_ptr;
 
-static inline uintptr_t RoundPageUp(uintptr_t val) {
-    return (val + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);
-}
-
 CoverageRecord::CoverageRecord(string tipc_dev, struct uuid* uuid)
     : tipc_dev_(std::move(tipc_dev)),
       coverage_srv_fd_(-1),
@@ -136,7 +132,7 @@
         return Error() << "failed to open coverage client: " << ret.error();
     }
     record_len_ = resp.open_args.record_len;
-    shm_len_ = RoundPageUp(record_len_);
+    shm_len_ = record_len_;
 
     BufferAllocator allocator;
 
diff --git a/trusty/fuzz/include/trusty/fuzz/utils.h b/trusty/fuzz/include/trusty/fuzz/utils.h
index c906412..cf4962e 100644
--- a/trusty/fuzz/include/trusty/fuzz/utils.h
+++ b/trusty/fuzz/include/trusty/fuzz/utils.h
@@ -21,7 +21,7 @@
 #include <android-base/result.h>
 #include <android-base/unique_fd.h>
 
-#define TIPC_MAX_MSG_SIZE PAGE_SIZE
+#define TIPC_MAX_MSG_SIZE 4096
 
 namespace android {
 namespace trusty {
diff --git a/trusty/fuzz/tipc_fuzzer.cpp b/trusty/fuzz/tipc_fuzzer.cpp
index f265ced..edc2a79 100644
--- a/trusty/fuzz/tipc_fuzzer.cpp
+++ b/trusty/fuzz/tipc_fuzzer.cpp
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#include <android-base/result.h>
+#include <fuzzer/FuzzedDataProvider.h>
 #include <stdlib.h>
 #include <trusty/coverage/coverage.h>
 #include <trusty/coverage/uuid.h>
@@ -23,6 +25,7 @@
 #include <iostream>
 #include <memory>
 
+using android::base::Result;
 using android::trusty::coverage::CoverageRecord;
 using android::trusty::fuzz::ExtraCounters;
 using android::trusty::fuzz::TrustyApp;
@@ -41,7 +44,14 @@
 #error "Binary file name must be parameterized using -DTRUSTY_APP_FILENAME."
 #endif
 
-static TrustyApp kTrustyApp(TIPC_DEV, TRUSTY_APP_PORT);
+#ifdef TRUSTY_APP_MAX_CONNECTIONS
+constexpr size_t MAX_CONNECTIONS = TRUSTY_APP_MAX_CONNECTIONS;
+#else
+constexpr size_t MAX_CONNECTIONS = 1;
+#endif
+
+static_assert(MAX_CONNECTIONS >= 1);
+
 static std::unique_ptr<CoverageRecord> record;
 
 extern "C" int LLVMFuzzerInitialize(int* /* argc */, char*** /* argv */) {
@@ -53,7 +63,8 @@
     }
 
     /* Make sure lazy-loaded TAs have started and connected to coverage service. */
-    auto ret = kTrustyApp.Connect();
+    TrustyApp ta(TIPC_DEV, TRUSTY_APP_PORT);
+    auto ret = ta.Connect();
     if (!ret.ok()) {
         std::cerr << ret.error() << std::endl;
         exit(-1);
@@ -73,24 +84,56 @@
     return 0;
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-    static uint8_t buf[TIPC_MAX_MSG_SIZE];
+Result<void> testOneInput(FuzzedDataProvider& provider) {
+    std::vector<TrustyApp> trustyApps;
 
+    while (provider.remaining_bytes() > 0) {
+        if (trustyApps.size() < MAX_CONNECTIONS && provider.ConsumeBool()) {
+            auto& ta = trustyApps.emplace_back(TIPC_DEV, TRUSTY_APP_PORT);
+            const auto result = ta.Connect();
+            if (!result.ok()) {
+                return result;
+            }
+        } else {
+            const auto i = provider.ConsumeIntegralInRange<size_t>(0, trustyApps.size());
+            std::swap(trustyApps[i], trustyApps.back());
+
+            if (provider.ConsumeBool()) {
+                auto& ta = trustyApps.back();
+
+                const auto data = provider.ConsumeRandomLengthString();
+                auto result = ta.Write(data.data(), data.size());
+                if (!result.ok()) {
+                    return result;
+                }
+
+                std::array<uint8_t, TIPC_MAX_MSG_SIZE> buf;
+                result = ta.Read(buf.data(), buf.size());
+                if (!result.ok()) {
+                    return result;
+                }
+
+                // Reconnect to ensure that the service is still up.
+                ta.Disconnect();
+                result = ta.Connect();
+                if (!result.ok()) {
+                    std::cerr << result.error() << std::endl;
+                    android::trusty::fuzz::Abort();
+                    return result;
+                }
+            } else {
+                trustyApps.pop_back();
+            }
+        }
+    }
+    return {};
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     ExtraCounters counters(record.get());
     counters.Reset();
 
-    auto ret = kTrustyApp.Write(data, size);
-    if (ret.ok()) {
-        ret = kTrustyApp.Read(&buf, sizeof(buf));
-    }
-
-    // Reconnect to ensure that the service is still up
-    kTrustyApp.Disconnect();
-    ret = kTrustyApp.Connect();
-    if (!ret.ok()) {
-        std::cerr << ret.error() << std::endl;
-        android::trusty::fuzz::Abort();
-    }
-
-    return ret.ok() ? 0 : -1;
+    FuzzedDataProvider provider(data, size);
+    const auto result = testOneInput(provider);
+    return result.ok() ? 0 : -1;
 }
diff --git a/trusty/keymaster/include/trusty_keymaster/ipc/trusty_keymaster_ipc.h b/trusty/keymaster/include/trusty_keymaster/ipc/trusty_keymaster_ipc.h
index 16207e6..efad254 100644
--- a/trusty/keymaster/include/trusty_keymaster/ipc/trusty_keymaster_ipc.h
+++ b/trusty/keymaster/include/trusty_keymaster/ipc/trusty_keymaster_ipc.h
@@ -22,9 +22,9 @@
 
 __BEGIN_DECLS
 
-const uint32_t TRUSTY_KEYMASTER_RECV_BUF_SIZE = 2 * PAGE_SIZE;
+const uint32_t TRUSTY_KEYMASTER_RECV_BUF_SIZE = 2 * 4096;
 const uint32_t TRUSTY_KEYMASTER_SEND_BUF_SIZE =
-        (PAGE_SIZE - sizeof(struct keymaster_message) - 16 /* tipc header */);
+        (4096 - sizeof(struct keymaster_message) - 16 /* tipc header */);
 
 int trusty_keymaster_connect(void);
 int trusty_keymaster_call(uint32_t cmd, void* in, uint32_t in_size, uint8_t* out,
diff --git a/trusty/libtrusty/tipc-test/tipc_test.c b/trusty/libtrusty/tipc-test/tipc_test.c
index 81c9881..0f50787 100644
--- a/trusty/libtrusty/tipc-test/tipc_test.c
+++ b/trusty/libtrusty/tipc-test/tipc_test.c
@@ -44,6 +44,7 @@
 static const char *closer3_name = "com.android.ipc-unittest.srv.closer3";
 static const char *main_ctrl_name = "com.android.ipc-unittest.ctrl";
 static const char* receiver_name = "com.android.trusty.memref.receiver";
+static const size_t memref_chunk_size = 4096;
 
 static const char* _sopts = "hsvDS:t:r:m:b:";
 /* clang-format off */
@@ -878,7 +879,7 @@
     volatile char* buf = MAP_FAILED;
     BufferAllocator* allocator = NULL;
 
-    const size_t num_pages = 10;
+    const size_t num_chunks = 10;
 
     fd = tipc_connect(dev_name, receiver_name);
     if (fd < 0) {
@@ -894,7 +895,7 @@
         goto cleanup;
     }
 
-    size_t buf_size = PAGE_SIZE * num_pages;
+    size_t buf_size = memref_chunk_size * num_chunks;
     dma_buf = DmabufHeapAlloc(allocator, "system", buf_size, 0, 0 /* legacy align */);
     if (dma_buf < 0) {
         ret = dma_buf;
@@ -927,13 +928,17 @@
     tipc_close(fd);
 
     ret = 0;
-    for (size_t skip = 0; skip < num_pages; skip++) {
-        ret |= strcmp("Hello from Trusty!", (const char*)&buf[skip * PAGE_SIZE]) ? (-1) : 0;
+    for (size_t skip = 0; skip < num_chunks; skip++) {
+        int cmp = strcmp("Hello from Trusty!",
+                         (const char*)&buf[skip * memref_chunk_size]) ? (-1) : 0;
+        if (cmp)
+            fprintf(stderr, "Failed: Unexpected content at page %zu in dmabuf\n", skip);
+        ret |= cmp;
     }
 
 cleanup:
     if (buf != MAP_FAILED) {
-        munmap((char*)buf, PAGE_SIZE);
+        munmap((char*)buf, buf_size);
     }
     close(dma_buf);
     if (allocator) {
diff --git a/trusty/line-coverage/coverage.cpp b/trusty/line-coverage/coverage.cpp
index 57b7025..5f7b3a3 100644
--- a/trusty/line-coverage/coverage.cpp
+++ b/trusty/line-coverage/coverage.cpp
@@ -50,10 +50,6 @@
 using ::android::base::Error;
 using ::std::string;
 
-static inline uintptr_t RoundPageUp(uintptr_t val) {
-    return (val + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);
-}
-
 CoverageRecord::CoverageRecord(string tipc_dev, struct uuid* uuid)
     : tipc_dev_(std::move(tipc_dev)),
       coverage_srv_fd_(-1),
@@ -129,7 +125,7 @@
         return Error() << "failed to open coverage client: " << ret.error();
     }
     record_len_ = resp.open_args.record_len;
-    shm_len_ = RoundPageUp(record_len_);
+    shm_len_ = record_len_;
 
     BufferAllocator allocator;
 
diff --git a/trusty/stats/test/README.md b/trusty/stats/test/README.md
index 45e6af8..175409e 100644
--- a/trusty/stats/test/README.md
+++ b/trusty/stats/test/README.md
@@ -1,8 +1,8 @@
 # Development Notes
 
-*    First get [repo_pull.py and gerrit.py](https://android.googlesource.com/platform/development/+/master/tools/repo_pull/) from aosp.
+*    First get [repo_pull.py and gerrit.py](https://android.googlesource.com/platform/development/+/main/tools/repo_pull/) from aosp.
 
-*    Although this repo is not currently in Trusty’s manifest, it’s sufficient to copy these two python scripts to the root of the Trusty project and run them from there. Make sure to follow the [repo_pull installation](https://android.googlesource.com/platform/development/+/master/tools/repo_pull/#installation) steps if necessary.
+*    Although this repo is not currently in Trusty’s manifest, it’s sufficient to copy these two python scripts to the root of the Trusty project and run them from there. Make sure to follow the [repo_pull installation](https://android.googlesource.com/platform/development/+/main/tools/repo_pull/#installation) steps if necessary.
 
 ## Build
 
diff --git a/trusty/utils/acvp/trusty_modulewrapper.cpp b/trusty/utils/acvp/trusty_modulewrapper.cpp
index 70ffb52..817b600 100644
--- a/trusty/utils/acvp/trusty_modulewrapper.cpp
+++ b/trusty/utils/acvp/trusty_modulewrapper.cpp
@@ -21,15 +21,17 @@
 #include <android-base/result.h>
 #include <android-base/unique_fd.h>
 #include <errno.h>
+#include <iostream>
 #include <log/log.h>
 #include <modulewrapper.h>
 #include <openssl/span.h>
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 #include <sys/mman.h>
 #include <trusty/tipc.h>
 #include <unistd.h>
-#include <iostream>
+#include <algorithm>
 
 #include "acvp_ipc.h"
 
@@ -41,9 +43,6 @@
 using android::base::unique_fd;
 using android::base::WriteFully;
 
-static inline size_t AlignUpToPage(size_t size) {
-    return (size + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);
-}
 
 namespace {
 
@@ -103,15 +102,12 @@
     struct acvp_req request;
     request.num_args = args.size();
 
-    size_t total_args_size = 0;
+    int total_args_size = 0;
     for (auto arg : args) {
         total_args_size += arg.size();
     }
 
-    shm_size_ = ACVP_MIN_SHARED_MEMORY;
-    if (total_args_size > shm_size_) {
-        shm_size_ = AlignUpToPage(total_args_size);
-    }
+    shm_size_ = std::max(ACVP_MIN_SHARED_MEMORY, total_args_size);
     request.buffer_size = shm_size_;
 
     struct iovec iov = {
@@ -208,6 +204,11 @@
     return {};
 }
 
+static bool EqString(bssl::Span<const uint8_t> cmd, const char *str) {
+    return cmd.size() == strlen(str) &&
+           memcmp(str, cmd.data(), cmd.size()) == 0;
+}
+
 int main() {
     for (;;) {
         auto buffer = bssl::acvp::RequestBuffer::New();
@@ -217,17 +218,24 @@
             return EXIT_FAILURE;
         }
 
-        ModuleWrapper wrapper;
-        auto res = wrapper.SendMessage(args);
-        if (!res.ok()) {
-            std::cerr << res.error() << std::endl;
-            return EXIT_FAILURE;
-        }
+        if (EqString(args[0], "flush")) {
+            if (!bssl::acvp::FlushBuffer(STDOUT_FILENO)) {
+                ALOGE("Could not flush the buffer to stdout\n");
+                return EXIT_FAILURE;
+            }
+        } else {
+            ModuleWrapper wrapper;
+            auto res = wrapper.SendMessage(args);
+            if (!res.ok()) {
+                std::cerr << res.error() << std::endl;
+                return EXIT_FAILURE;
+            }
 
-        res = wrapper.ForwardResponse();
-        if (!res.ok()) {
-            std::cerr << res.error() << std::endl;
-            return EXIT_FAILURE;
+            res = wrapper.ForwardResponse();
+            if (!res.ok()) {
+                std::cerr << res.error() << std::endl;
+                return EXIT_FAILURE;
+            }
         }
     }