diff --git a/fs_mgr/libsnapshot/Android.bp b/fs_mgr/libsnapshot/Android.bp
index b373d99..b239f31 100644
--- a/fs_mgr/libsnapshot/Android.bp
+++ b/fs_mgr/libsnapshot/Android.bp
@@ -28,6 +28,7 @@
         "liblog",
     ],
     static_libs: [
+        "libbrotli",
         "libdm",
         "libfstab",
         "libsnapshot_cow",
@@ -109,6 +110,9 @@
     defaults: ["libsnapshot_defaults"],
     srcs: [":libsnapshot_sources"],
     recovery_available: true,
+    cflags: [
+        "-DLIBSNAPSHOT_NO_COW_WRITE",
+    ],
     static_libs: [
         "libfs_mgr",
     ],
@@ -122,6 +126,9 @@
     ],
     srcs: [":libsnapshot_sources"],
     recovery_available: true,
+    cflags: [
+        "-DLIBSNAPSHOT_NO_COW_WRITE",
+    ],
     static_libs: [
         "libfs_mgr",
     ],
@@ -244,6 +251,7 @@
     static_libs: [
         "android.hardware.boot@1.0",
         "android.hardware.boot@1.1",
+        "libbrotli",
         "libfs_mgr",
         "libgsi",
         "libgmock",
@@ -276,9 +284,11 @@
         "snapshotctl.cpp",
     ],
     static_libs: [
+        "libbrotli",
         "libfstab",
         "libsnapshot",
         "libsnapshot_cow",
+        "libz",
         "update_metadata-protos",
     ],
     shared_libs: [
@@ -332,6 +342,7 @@
     ],
     static_libs: [
         "libbase",
+        "libbrotli",
         "libcrypto_static",
         "libcutils",
         "libext2_uuid",
@@ -345,6 +356,7 @@
         "libsnapshot_cow",
         "libsnapshot_test_helpers",
         "libprotobuf-mutator",
+        "libz",
     ],
     header_libs: [
         "libchrome",
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/mock_snapshot.h b/fs_mgr/libsnapshot/include/libsnapshot/mock_snapshot.h
index 13f19aa..6dee3d4 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/mock_snapshot.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/mock_snapshot.h
@@ -39,7 +39,9 @@
                  std::string* snapshot_path),
                 (override));
     MOCK_METHOD(std::unique_ptr<ISnapshotWriter>, OpenSnapshotWriter,
-                (const android::fs_mgr::CreateLogicalPartitionParams& params), (override));
+                (const android::fs_mgr::CreateLogicalPartitionParams& params,
+                 const std::optional<std::string>&),
+                (override));
     MOCK_METHOD(bool, UnmapUpdateSnapshot, (const std::string& target_partition_name), (override));
     MOCK_METHOD(bool, NeedSnapshotsInFirstStageMount, (), (override));
     MOCK_METHOD(bool, CreateLogicalAndSnapshotPartitions,
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h b/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h
index 1bc972e..4bbdca3 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/snapshot.h
@@ -182,9 +182,12 @@
                                    std::string* snapshot_path) = 0;
 
     // Create an ISnapshotWriter to build a snapshot against a target partition. The partition name
-    // must be suffixed.
+    // must be suffixed. If a source partition exists, it must be specified as well. The source
+    // partition will only be used if raw bytes are needed. The source partition should be an
+    // absolute path to the device, not a partition name.
     virtual std::unique_ptr<ISnapshotWriter> OpenSnapshotWriter(
-            const android::fs_mgr::CreateLogicalPartitionParams& params) = 0;
+            const android::fs_mgr::CreateLogicalPartitionParams& params,
+            const std::optional<std::string>& source_device) = 0;
 
     // Unmap a snapshot device or CowWriter that was previously opened with MapUpdateSnapshot,
     // OpenSnapshotWriter. All outstanding open descriptors, writers, or
@@ -300,7 +303,8 @@
     bool MapUpdateSnapshot(const CreateLogicalPartitionParams& params,
                            std::string* snapshot_path) override;
     std::unique_ptr<ISnapshotWriter> OpenSnapshotWriter(
-            const android::fs_mgr::CreateLogicalPartitionParams& params) override;
+            const android::fs_mgr::CreateLogicalPartitionParams& params,
+            const std::optional<std::string>& source_device) override;
     bool UnmapUpdateSnapshot(const std::string& target_partition_name) override;
     bool NeedSnapshotsInFirstStageMount() override;
     bool CreateLogicalAndSnapshotPartitions(
@@ -532,22 +536,22 @@
         // Target/base device (eg system_b), always present.
         std::string target_device;
 
-        // COW path (eg system_cow). Not present if no COW is needed.
-        std::string cow_device;
+        // COW name (eg system_cow). Not present if no COW is needed.
+        std::string cow_device_name;
 
         // dm-snapshot instance. Not present in Update mode for VABC.
         std::string snapshot_device;
     };
 
     // Helpers for OpenSnapshotWriter.
-    std::unique_ptr<ISnapshotWriter> OpenCompressedSnapshotWriter(LockedFile* lock,
-                                                                  const std::string& partition_name,
-                                                                  const SnapshotStatus& status,
-                                                                  const SnapshotPaths& paths);
-    std::unique_ptr<ISnapshotWriter> OpenKernelSnapshotWriter(LockedFile* lock,
-                                                              const std::string& partition_name,
-                                                              const SnapshotStatus& status,
-                                                              const SnapshotPaths& paths);
+    std::unique_ptr<ISnapshotWriter> OpenCompressedSnapshotWriter(
+            LockedFile* lock, const std::optional<std::string>& source_device,
+            const std::string& partition_name, const SnapshotStatus& status,
+            const SnapshotPaths& paths);
+    std::unique_ptr<ISnapshotWriter> OpenKernelSnapshotWriter(
+            LockedFile* lock, const std::optional<std::string>& source_device,
+            const std::string& partition_name, const SnapshotStatus& status,
+            const SnapshotPaths& paths);
 
     // Map the base device, COW devices, and snapshot device.
     bool MapPartitionWithSnapshot(LockedFile* lock, CreateLogicalPartitionParams params,
@@ -626,6 +630,9 @@
     bool GetMappedImageDeviceStringOrPath(const std::string& device_name,
                                           std::string* device_string_or_mapped_path);
 
+    // Same as above, but for paths only (no major:minor device strings).
+    bool GetMappedImageDevicePath(const std::string& device_name, std::string* device_path);
+
     std::string gsid_dir_;
     std::string metadata_dir_;
     std::unique_ptr<IDeviceInfo> device_;
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/snapshot_stub.h b/fs_mgr/libsnapshot/include/libsnapshot/snapshot_stub.h
index cda2bee..ed790a0 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/snapshot_stub.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/snapshot_stub.h
@@ -37,7 +37,8 @@
     bool MapUpdateSnapshot(const android::fs_mgr::CreateLogicalPartitionParams& params,
                            std::string* snapshot_path) override;
     std::unique_ptr<ISnapshotWriter> OpenSnapshotWriter(
-            const android::fs_mgr::CreateLogicalPartitionParams& params) override;
+            const android::fs_mgr::CreateLogicalPartitionParams& params,
+            const std::optional<std::string>& source_device) override;
     bool UnmapUpdateSnapshot(const std::string& target_partition_name) override;
     bool NeedSnapshotsInFirstStageMount() override;
     bool CreateLogicalAndSnapshotPartitions(
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/snapshot_writer.h b/fs_mgr/libsnapshot/include/libsnapshot/snapshot_writer.h
index bf57a00..e25ec07 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/snapshot_writer.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/snapshot_writer.h
@@ -33,13 +33,41 @@
 
     // Set the source device. This is used for AddCopy() operations, if the
     // underlying writer needs the original bytes (for example if backed by
-    // dm-snapshot or if writing directly to an unsnapshotted region).
-    void SetSourceDevice(android::base::unique_fd&& source_fd);
+    // dm-snapshot or if writing directly to an unsnapshotted region). The
+    // device is only opened on the first operation that requires it.
+    void SetSourceDevice(const std::string& source_device);
 
     virtual std::unique_ptr<FileDescriptor> OpenReader() = 0;
 
   protected:
+    android::base::borrowed_fd GetSourceFd();
+
+  private:
     android::base::unique_fd source_fd_;
+    std::optional<std::string> source_device_;
+};
+
+// Send writes to a COW or a raw device directly, based on a threshold.
+class CompressedSnapshotWriter : public ISnapshotWriter {
+  public:
+    CompressedSnapshotWriter(const CowOptions& options);
+
+    // Sets the COW device, if needed.
+    bool SetCowDevice(android::base::unique_fd&& cow_device);
+
+    bool Flush() override;
+    uint64_t GetCowSize() override;
+    std::unique_ptr<FileDescriptor> OpenReader() override;
+
+  protected:
+    bool EmitCopy(uint64_t new_block, uint64_t old_block) override;
+    bool EmitRawBlocks(uint64_t new_block_start, const void* data, size_t size) override;
+    bool EmitZeroBlocks(uint64_t new_block_start, uint64_t num_blocks) override;
+
+  private:
+    android::base::unique_fd cow_device_;
+
+    std::unique_ptr<CowWriter> cow_;
 };
 
 // Write directly to a dm-snapshot device.
@@ -52,7 +80,7 @@
 
     bool Flush() override;
     uint64_t GetCowSize() override { return cow_size_; }
-    virtual std::unique_ptr<FileDescriptor> OpenReader() override;
+    std::unique_ptr<FileDescriptor> OpenReader() override;
 
   protected:
     bool EmitRawBlocks(uint64_t new_block_start, const void* data, size_t size) override;
diff --git a/fs_mgr/libsnapshot/snapshot.cpp b/fs_mgr/libsnapshot/snapshot.cpp
index 8112b5f..6574457 100644
--- a/fs_mgr/libsnapshot/snapshot.cpp
+++ b/fs_mgr/libsnapshot/snapshot.cpp
@@ -271,7 +271,7 @@
         return false;
     }
 
-    if (!EnsureNoOverflowSnapshot(lock.get())) {
+    if (!IsCompressionEnabled() && !EnsureNoOverflowSnapshot(lock.get())) {
         LOG(ERROR) << "Cannot ensure there are no overflow snapshots.";
         return false;
     }
@@ -1716,7 +1716,7 @@
         return false;
     }
     if (paths) {
-        paths->cow_device = cow_device;
+        paths->cow_device_name = cow_name;
     }
 
     remaining_time = GetRemainingTime(params.timeout_ms, begin);
@@ -1724,6 +1724,7 @@
 
     if (context == SnapshotContext::Update && IsCompressionEnabled()) {
         // Stop here, we can't run dm-user yet, the COW isn't built.
+        created_devices.Release();
         return true;
     }
 
@@ -2470,7 +2471,15 @@
 }
 
 std::unique_ptr<ISnapshotWriter> SnapshotManager::OpenSnapshotWriter(
-        const android::fs_mgr::CreateLogicalPartitionParams& params) {
+        const android::fs_mgr::CreateLogicalPartitionParams& params,
+        const std::optional<std::string>& source_device) {
+#if defined(LIBSNAPSHOT_NO_COW_WRITE)
+    (void)params;
+    (void)source_device;
+
+    LOG(ERROR) << "Snapshots cannot be written in first-stage init or recovery";
+    return nullptr;
+#else
     // First unmap any existing mapping.
     auto lock = LockShared();
     if (!lock) return nullptr;
@@ -2486,7 +2495,7 @@
     }
 
     SnapshotStatus status;
-    if (!paths.cow_device.empty()) {
+    if (!paths.cow_device_name.empty()) {
         if (!ReadSnapshotStatus(lock.get(), params.GetPartitionName(), &status)) {
             return nullptr;
         }
@@ -2501,20 +2510,57 @@
     }
 
     if (IsCompressionEnabled()) {
-        return OpenCompressedSnapshotWriter(lock.get(), params.GetPartitionName(), status, paths);
+        return OpenCompressedSnapshotWriter(lock.get(), source_device, params.GetPartitionName(),
+                                            status, paths);
     }
-    return OpenKernelSnapshotWriter(lock.get(), params.GetPartitionName(), status, paths);
+    return OpenKernelSnapshotWriter(lock.get(), source_device, params.GetPartitionName(), status,
+                                    paths);
+#endif
 }
 
+#if !defined(LIBSNAPSHOT_NO_COW_WRITE)
 std::unique_ptr<ISnapshotWriter> SnapshotManager::OpenCompressedSnapshotWriter(
-        LockedFile*, const std::string&, const SnapshotStatus&, const SnapshotPaths&) {
-    LOG(ERROR) << "OpenSnapshotWriter not yet implemented for compression";
-    return nullptr;
+        LockedFile* lock, const std::optional<std::string>& source_device,
+        [[maybe_unused]] const std::string& partition_name, const SnapshotStatus& status,
+        const SnapshotPaths& paths) {
+    CHECK(lock);
+
+    CowOptions cow_options;
+    cow_options.compression = "gz";
+    cow_options.max_blocks = {status.device_size() / cow_options.block_size};
+
+    // Currently we don't support partial snapshots, since partition_cow_creator
+    // never creates this scenario.
+    CHECK(status.snapshot_size() == status.device_size());
+
+    auto writer = std::make_unique<CompressedSnapshotWriter>(cow_options);
+    if (source_device) {
+        writer->SetSourceDevice(*source_device);
+    }
+
+    std::string cow_path;
+    if (!GetMappedImageDevicePath(paths.cow_device_name, &cow_path)) {
+        LOG(ERROR) << "Could not determine path for " << paths.cow_device_name;
+        return nullptr;
+    }
+
+    unique_fd cow_fd(open(cow_path.c_str(), O_RDWR | O_CLOEXEC));
+    if (cow_fd < 0) {
+        PLOG(ERROR) << "OpenCompressedSnapshotWriter: open " << cow_path;
+        return nullptr;
+    }
+    if (!writer->SetCowDevice(std::move(cow_fd))) {
+        LOG(ERROR) << "Could not create COW writer from " << cow_path;
+        return nullptr;
+    }
+
+    return writer;
 }
 
 std::unique_ptr<ISnapshotWriter> SnapshotManager::OpenKernelSnapshotWriter(
-        LockedFile* lock, [[maybe_unused]] const std::string& partition_name,
-        const SnapshotStatus& status, const SnapshotPaths& paths) {
+        LockedFile* lock, const std::optional<std::string>& source_device,
+        [[maybe_unused]] const std::string& partition_name, const SnapshotStatus& status,
+        const SnapshotPaths& paths) {
     CHECK(lock);
 
     CowOptions cow_options;
@@ -2529,11 +2575,16 @@
         return nullptr;
     }
 
+    if (source_device) {
+        writer->SetSourceDevice(*source_device);
+    }
+
     uint64_t cow_size = status.cow_partition_size() + status.cow_file_size();
     writer->SetSnapshotDevice(std::move(fd), cow_size);
 
     return writer;
 }
+#endif  // !defined(LIBSNAPSHOT_NO_COW_WRITE)
 
 bool SnapshotManager::UnmapUpdateSnapshot(const std::string& target_partition_name) {
     auto lock = LockShared();
@@ -2872,6 +2923,22 @@
     return SnapshotMergeStats::GetInstance(*this);
 }
 
+// This is only to be used in recovery or normal Android (not first-stage init).
+// We don't guarantee dm paths are available in first-stage init, because ueventd
+// isn't running yet.
+bool SnapshotManager::GetMappedImageDevicePath(const std::string& device_name,
+                                               std::string* device_path) {
+    auto& dm = DeviceMapper::Instance();
+
+    // Try getting the device string if it is a device mapper device.
+    if (dm.GetState(device_name) != DmDeviceState::INVALID) {
+        return dm.GetDmDevicePathByName(device_name, device_path);
+    }
+
+    // Otherwise, get path from IImageManager.
+    return images_->GetMappedImageDevice(device_name, device_path);
+}
+
 bool SnapshotManager::GetMappedImageDeviceStringOrPath(const std::string& device_name,
                                                        std::string* device_string_or_mapped_path) {
     auto& dm = DeviceMapper::Instance();
diff --git a/fs_mgr/libsnapshot/snapshot_stub.cpp b/fs_mgr/libsnapshot/snapshot_stub.cpp
index 41f5da4..5be3c10 100644
--- a/fs_mgr/libsnapshot/snapshot_stub.cpp
+++ b/fs_mgr/libsnapshot/snapshot_stub.cpp
@@ -131,7 +131,7 @@
 }
 
 std::unique_ptr<ISnapshotWriter> SnapshotManagerStub::OpenSnapshotWriter(
-        const CreateLogicalPartitionParams&) {
+        const CreateLogicalPartitionParams&, const std::optional<std::string>&) {
     LOG(ERROR) << __FUNCTION__ << " should never be called.";
     return nullptr;
 }
diff --git a/fs_mgr/libsnapshot/snapshot_test.cpp b/fs_mgr/libsnapshot/snapshot_test.cpp
index 77226ad..7327629 100644
--- a/fs_mgr/libsnapshot/snapshot_test.cpp
+++ b/fs_mgr/libsnapshot/snapshot_test.cpp
@@ -903,7 +903,7 @@
                 .partition_opener = opener_.get(),
         };
 
-        auto result = sm->OpenSnapshotWriter(params);
+        auto result = sm->OpenSnapshotWriter(params, {});
         if (!result) {
             return AssertionFailure() << "Cannot open snapshot for writing: " << name;
         }
diff --git a/fs_mgr/libsnapshot/snapshot_writer.cpp b/fs_mgr/libsnapshot/snapshot_writer.cpp
index 584f15e..19aa80e 100644
--- a/fs_mgr/libsnapshot/snapshot_writer.cpp
+++ b/fs_mgr/libsnapshot/snapshot_writer.cpp
@@ -24,13 +24,64 @@
 namespace android {
 namespace snapshot {
 
+using android::base::borrowed_fd;
 using android::base::unique_fd;
 using chromeos_update_engine::FileDescriptor;
 
 ISnapshotWriter::ISnapshotWriter(const CowOptions& options) : ICowWriter(options) {}
 
-void ISnapshotWriter::SetSourceDevice(android::base::unique_fd&& source_fd) {
-    source_fd_ = std::move(source_fd);
+void ISnapshotWriter::SetSourceDevice(const std::string& source_device) {
+    source_device_ = {source_device};
+}
+
+borrowed_fd ISnapshotWriter::GetSourceFd() {
+    if (!source_device_) {
+        LOG(ERROR) << "Attempted to read from source device but none was set";
+        return borrowed_fd{-1};
+    }
+
+    if (source_fd_ < 0) {
+        source_fd_.reset(open(source_device_->c_str(), O_RDONLY | O_CLOEXEC));
+        if (source_fd_ < 0) {
+            PLOG(ERROR) << "open " << *source_device_;
+            return borrowed_fd{-1};
+        }
+    }
+    return source_fd_;
+}
+
+CompressedSnapshotWriter::CompressedSnapshotWriter(const CowOptions& options)
+    : ISnapshotWriter(options) {}
+
+bool CompressedSnapshotWriter::SetCowDevice(android::base::unique_fd&& cow_device) {
+    cow_device_ = std::move(cow_device);
+    cow_ = std::make_unique<CowWriter>(options_);
+
+    return cow_->Initialize(cow_device_);
+}
+bool CompressedSnapshotWriter::Flush() {
+    return cow_->Flush();
+}
+
+uint64_t CompressedSnapshotWriter::GetCowSize() {
+    return cow_->GetCowSize();
+}
+
+std::unique_ptr<FileDescriptor> CompressedSnapshotWriter::OpenReader() {
+    return nullptr;
+}
+
+bool CompressedSnapshotWriter::EmitCopy(uint64_t new_block, uint64_t old_block) {
+    return cow_->AddCopy(new_block, old_block);
+}
+
+bool CompressedSnapshotWriter::EmitRawBlocks(uint64_t new_block_start, const void* data,
+                                             size_t size) {
+    return cow_->AddRawBlocks(new_block_start, data, size);
+}
+
+bool CompressedSnapshotWriter::EmitZeroBlocks(uint64_t new_block_start, uint64_t num_blocks) {
+    return cow_->AddZeroBlocks(new_block_start, num_blocks);
 }
 
 OnlineKernelSnapshotWriter::OnlineKernelSnapshotWriter(const CowOptions& options)
@@ -75,9 +126,14 @@
 }
 
 bool OnlineKernelSnapshotWriter::EmitCopy(uint64_t new_block, uint64_t old_block) {
+    auto source_fd = GetSourceFd();
+    if (source_fd < 0) {
+        return false;
+    }
+
     std::string buffer(options_.block_size, 0);
     uint64_t offset = old_block * options_.block_size;
-    if (!android::base::ReadFullyAtOffset(source_fd_, buffer.data(), buffer.size(), offset)) {
+    if (!android::base::ReadFullyAtOffset(source_fd, buffer.data(), buffer.size(), offset)) {
         PLOG(ERROR) << "EmitCopy read";
         return false;
     }
diff --git a/include/backtrace b/include/backtrace
deleted file mode 120000
index 93ce2b1..0000000
--- a/include/backtrace
+++ /dev/null
@@ -1 +0,0 @@
-../libbacktrace/include/backtrace
\ No newline at end of file
diff --git a/init/Android.mk b/init/Android.mk
index ac31ef1..895f50f 100644
--- a/init/Android.mk
+++ b/init/Android.mk
@@ -78,6 +78,7 @@
 LOCAL_POST_INSTALL_CMD := mkdir -p \
     $(TARGET_RAMDISK_OUT)/debug_ramdisk \
     $(TARGET_RAMDISK_OUT)/dev \
+    $(TARGET_RAMDISK_OUT)/first_stage_ramdisk \
     $(TARGET_RAMDISK_OUT)/mnt \
     $(TARGET_RAMDISK_OUT)/proc \
     $(TARGET_RAMDISK_OUT)/second_stage_resources \
diff --git a/init/capabilities.cpp b/init/capabilities.cpp
index 0b9f161..ab6ff03 100644
--- a/init/capabilities.cpp
+++ b/init/capabilities.cpp
@@ -69,11 +69,12 @@
 #if defined(__BIONIC__)
         CAP_MAP_ENTRY(PERFMON),
         CAP_MAP_ENTRY(BPF),
+        CAP_MAP_ENTRY(CHECKPOINT_RESTORE),
 #endif
 };
 
 #if defined(__BIONIC__)
-static_assert(CAP_LAST_CAP == CAP_BPF, "CAP_LAST_CAP is not CAP_BPF");
+static_assert(CAP_LAST_CAP == CAP_CHECKPOINT_RESTORE, "CAP_LAST_CAP is not CAP_CHECKPOINT_RESTORE");
 #else
 static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ");
 #endif
diff --git a/init/devices.cpp b/init/devices.cpp
index 53ca875..f8eb16a 100644
--- a/init/devices.cpp
+++ b/init/devices.cpp
@@ -22,6 +22,7 @@
 #include <unistd.h>
 
 #include <chrono>
+#include <filesystem>
 #include <memory>
 #include <string>
 #include <thread>
@@ -439,6 +440,13 @@
             }
         }
         unlink(devpath.c_str());
+
+        if (android::base::StartsWith(devpath, "/dev/dm-user/")) {
+            std::error_code ec;
+            if (std::filesystem::is_empty("/dev/dm-user/", ec)) {
+                rmdir("/dev/dm-user");
+            }
+        }
     }
 }
 
@@ -496,6 +504,8 @@
     } else if (StartsWith(uevent.subsystem, "usb")) {
         // ignore other USB events
         return;
+    } else if (uevent.subsystem == "misc" && StartsWith(uevent.device_name, "dm-user/")) {
+        devpath = "/dev/dm-user/" + uevent.device_name.substr(8);
     } else {
         devpath = "/dev/" + Basename(uevent.path);
     }
diff --git a/libmodprobe/libmodprobe.cpp b/libmodprobe/libmodprobe.cpp
index ceabf62..b3ae937 100644
--- a/libmodprobe/libmodprobe.cpp
+++ b/libmodprobe/libmodprobe.cpp
@@ -66,6 +66,7 @@
         deps.emplace_back(prefix + args[0].substr(0, pos));
     } else {
         LOG(ERROR) << "dependency lines must start with name followed by ':'";
+        return false;
     }
 
     // Remaining items are dependencies of our module
diff --git a/libmodprobe/libmodprobe_test.cpp b/libmodprobe/libmodprobe_test.cpp
index 5919c49..d50c10d 100644
--- a/libmodprobe/libmodprobe_test.cpp
+++ b/libmodprobe/libmodprobe_test.cpp
@@ -179,3 +179,16 @@
     m.EnableBlocklist(true);
     EXPECT_FALSE(m.LoadWithAliases("test4", true));
 }
+
+TEST(libmodprobe, ModuleDepLineWithoutColonIsSkipped) {
+    TemporaryDir dir;
+    auto dir_path = std::string(dir.path);
+    ASSERT_TRUE(android::base::WriteStringToFile(
+            "no_colon.ko no_colon.ko\n", dir_path + "/modules.dep", 0600, getuid(), getgid()));
+
+    kernel_cmdline = "";
+    test_modules = {dir_path + "/no_colon.ko"};
+
+    Modprobe m({dir.path});
+    EXPECT_FALSE(m.LoadWithAliases("no_colon", true));
+}
diff --git a/libutils/Android.bp b/libutils/Android.bp
index dd9fea0..e53e89b 100644
--- a/libutils/Android.bp
+++ b/libutils/Android.bp
@@ -43,7 +43,13 @@
             header_libs: ["libbacktrace_headers"],
             export_header_lib_headers: ["libbacktrace_headers"],
         },
+        linux_glibc: {
+            header_libs: ["libbacktrace_headers"],
+            export_header_lib_headers: ["libbacktrace_headers"],
+        },
         linux_bionic: {
+            header_libs: ["libbacktrace_headers"],
+            export_header_lib_headers: ["libbacktrace_headers"],
             enabled: true,
         },
         windows: {
diff --git a/libutils/RefBase.cpp b/libutils/RefBase.cpp
index ae10789..8e45226 100644
--- a/libutils/RefBase.cpp
+++ b/libutils/RefBase.cpp
@@ -21,9 +21,9 @@
 
 #include <android-base/macros.h>
 
-#include <utils/RefBase.h>
+#include <log/log.h>
 
-#include <utils/CallStack.h>
+#include <utils/RefBase.h>
 
 #include <utils/Mutex.h>
 
@@ -55,6 +55,17 @@
 // case.
 #define DEBUG_REFBASE_DESTRUCTION 1
 
+#if !defined(_WIN32) && !defined(__APPLE__)
+// CallStack is only supported on linux type platforms.
+#define CALLSTACK_ENABLED 1
+#else
+#define CALLSTACK_ENABLED 0
+#endif
+
+#if CALLSTACK_ENABLED
+#include <utils/CallStack.h>
+#endif
+
 // ---------------------------------------------------------------------------
 
 namespace android {
@@ -185,7 +196,7 @@
         , mRetain(false)
     {
     }
-    
+
     ~weakref_impl()
     {
         bool dumpStack = false;
@@ -196,7 +207,7 @@
             while (refs) {
                 char inc = refs->ref >= 0 ? '+' : '-';
                 ALOGD("\t%c ID %p (ref %d):", inc, refs->id, refs->ref);
-#if DEBUG_REFS_CALLSTACK_ENABLED
+#if DEBUG_REFS_CALLSTACK_ENABLED && CALLSTACK_ENABLED
                 CallStack::logStack(LOG_TAG, refs->stack.get());
 #endif
                 refs = refs->next;
@@ -210,7 +221,7 @@
             while (refs) {
                 char inc = refs->ref >= 0 ? '+' : '-';
                 ALOGD("\t%c ID %p (ref %d):", inc, refs->id, refs->ref);
-#if DEBUG_REFS_CALLSTACK_ENABLED
+#if DEBUG_REFS_CALLSTACK_ENABLED && CALLSTACK_ENABLED
                 CallStack::logStack(LOG_TAG, refs->stack.get());
 #endif
                 refs = refs->next;
@@ -218,7 +229,9 @@
         }
         if (dumpStack) {
             ALOGE("above errors at:");
+#if CALLSTACK_ENABLED
             CallStack::logStack(LOG_TAG);
+#endif
         }
     }
 
@@ -261,8 +274,7 @@
         renameRefsId(mWeakRefs, old_id, new_id);
     }
 
-    void trackMe(bool track, bool retain)
-    { 
+    void trackMe(bool track, bool retain) {
         mTrackEnabled = track;
         mRetain = retain;
     }
@@ -306,7 +318,7 @@
     {
         ref_entry* next;
         const void* id;
-#if DEBUG_REFS_CALLSTACK_ENABLED
+#if DEBUG_REFS_CALLSTACK_ENABLED && CALLSTACK_ENABLED
         CallStack::CallStackUPtr stack;
 #endif
         int32_t ref;
@@ -323,7 +335,7 @@
             // decrement the reference count.
             ref->ref = mRef;
             ref->id = id;
-#if DEBUG_REFS_CALLSTACK_ENABLED
+#if DEBUG_REFS_CALLSTACK_ENABLED && CALLSTACK_ENABLED
             ref->stack = CallStack::getCurrent(2);
 #endif
             ref->next = *refs;
@@ -335,7 +347,7 @@
     {
         if (mTrackEnabled) {
             AutoMutex _l(mMutex);
-            
+
             ref_entry* const head = *refs;
             ref_entry* ref = head;
             while (ref != NULL) {
@@ -359,7 +371,9 @@
                 ref = ref->next;
             }
 
+#if CALLSTACK_ENABLED
             CallStack::logStack(LOG_TAG);
+#endif
         }
     }
 
@@ -385,7 +399,7 @@
             snprintf(buf, sizeof(buf), "\t%c ID %p (ref %d):\n",
                      inc, refs->id, refs->ref);
             out->append(buf);
-#if DEBUG_REFS_CALLSTACK_ENABLED
+#if DEBUG_REFS_CALLSTACK_ENABLED && CALLSTACK_ENABLED
             out->append(CallStack::stackToString("\t\t", refs->stack.get()));
 #else
             out->append("\t\t(call stacks disabled)");
@@ -412,7 +426,7 @@
 {
     weakref_impl* const refs = mRefs;
     refs->incWeak(id);
-    
+
     refs->addStrongRef(id);
     const int32_t c = refs->mStrong.fetch_add(1, std::memory_order_relaxed);
     ALOG_ASSERT(c > 0, "incStrong() called on %p after last strong ref", refs);
@@ -468,7 +482,7 @@
     // TODO: Better document assumptions.
     weakref_impl* const refs = mRefs;
     refs->incWeak(id);
-    
+
     refs->addStrongRef(id);
     const int32_t c = refs->mStrong.fetch_add(1, std::memory_order_relaxed);
     ALOG_ASSERT(c >= 0, "forceIncStrong called on %p after ref count underflow",
@@ -550,7 +564,7 @@
 bool RefBase::weakref_type::attemptIncStrong(const void* id)
 {
     incWeak(id);
-    
+
     weakref_impl* const impl = static_cast<weakref_impl*>(this);
     int32_t curCount = impl->mStrong.load(std::memory_order_relaxed);
 
@@ -567,7 +581,7 @@
         // the strong count has changed on us, we need to re-assert our
         // situation. curCount was updated by compare_exchange_weak.
     }
-    
+
     if (curCount <= 0 || curCount == INITIAL_STRONG_VALUE) {
         // we're now in the harder case of either:
         // - there never was a strong reference on us
@@ -624,7 +638,7 @@
             }
         }
     }
-    
+
     impl->addStrongRef(id);
 
 #if PRINT_REFS
@@ -719,7 +733,10 @@
         // Treating this as fatal is prone to causing boot loops. For debugging, it's
         // better to treat as non-fatal.
         ALOGD("RefBase: Explicit destruction, weak count = %d (in %p)", mRefs->mWeak.load(), this);
+
+#if CALLSTACK_ENABLED
         CallStack::logStack(LOG_TAG);
+#endif
 #else
         LOG_ALWAYS_FATAL("RefBase: Explicit destruction, weak count = %d", mRefs->mWeak.load());
 #endif
diff --git a/libutils/SharedBuffer_test.cpp b/libutils/SharedBuffer_test.cpp
index 33a4e0c..3f960d2 100644
--- a/libutils/SharedBuffer_test.cpp
+++ b/libutils/SharedBuffer_test.cpp
@@ -23,36 +23,45 @@
 
 #include "SharedBuffer.h"
 
-TEST(SharedBufferTest, TestAlloc) {
-  EXPECT_DEATH(android::SharedBuffer::alloc(SIZE_MAX), "");
-  EXPECT_DEATH(android::SharedBuffer::alloc(SIZE_MAX - sizeof(android::SharedBuffer)), "");
+extern "C" void __hwasan_init() __attribute__((weak));
+#define SKIP_WITH_HWASAN \
+    if (&__hwasan_init != 0) GTEST_SKIP()
 
-  // Make sure we don't die here.
-  // Check that null is returned, as we are asking for the whole address space.
-  android::SharedBuffer* buf =
-      android::SharedBuffer::alloc(SIZE_MAX - sizeof(android::SharedBuffer) - 1);
-  ASSERT_EQ(nullptr, buf);
-
-  buf = android::SharedBuffer::alloc(0);
-  ASSERT_NE(nullptr, buf);
-  ASSERT_EQ(0U, buf->size());
-  buf->release();
+TEST(SharedBufferTest, alloc_death) {
+    EXPECT_DEATH(android::SharedBuffer::alloc(SIZE_MAX), "");
+    EXPECT_DEATH(android::SharedBuffer::alloc(SIZE_MAX - sizeof(android::SharedBuffer)), "");
 }
 
-TEST(SharedBufferTest, TestEditResize) {
-  android::SharedBuffer* buf = android::SharedBuffer::alloc(10);
-  EXPECT_DEATH(buf->editResize(SIZE_MAX - sizeof(android::SharedBuffer)), "");
-  buf = android::SharedBuffer::alloc(10);
-  EXPECT_DEATH(buf->editResize(SIZE_MAX), "");
+TEST(SharedBufferTest, alloc_null) {
+    // Big enough to fail, not big enough to abort.
+    SKIP_WITH_HWASAN;  // hwasan has a 2GiB allocation limit.
+    ASSERT_EQ(nullptr, android::SharedBuffer::alloc(SIZE_MAX / 2));
+}
 
-  buf = android::SharedBuffer::alloc(10);
-  // Make sure we don't die here.
-  // Check that null is returned, as we are asking for the whole address space.
-  buf = buf->editResize(SIZE_MAX - sizeof(android::SharedBuffer) - 1);
-  ASSERT_EQ(nullptr, buf);
+TEST(SharedBufferTest, alloc_zero_size) {
+    android::SharedBuffer* buf = android::SharedBuffer::alloc(0);
+    ASSERT_NE(nullptr, buf);
+    ASSERT_EQ(0U, buf->size());
+    buf->release();
+}
 
-  buf = android::SharedBuffer::alloc(10);
-  buf = buf->editResize(0);
-  ASSERT_EQ(0U, buf->size());
-  buf->release();
+TEST(SharedBufferTest, editResize_death) {
+    android::SharedBuffer* buf = android::SharedBuffer::alloc(10);
+    EXPECT_DEATH(buf->editResize(SIZE_MAX - sizeof(android::SharedBuffer)), "");
+    buf = android::SharedBuffer::alloc(10);
+    EXPECT_DEATH(buf->editResize(SIZE_MAX), "");
+}
+
+TEST(SharedBufferTest, editResize_null) {
+    // Big enough to fail, not big enough to abort.
+    SKIP_WITH_HWASAN;  // hwasan has a 2GiB allocation limit.
+    android::SharedBuffer* buf = android::SharedBuffer::alloc(10);
+    ASSERT_EQ(nullptr, buf->editResize(SIZE_MAX / 2));
+}
+
+TEST(SharedBufferTest, editResize_zero_size) {
+    android::SharedBuffer* buf = android::SharedBuffer::alloc(10);
+    buf = buf->editResize(0);
+    ASSERT_EQ(0U, buf->size());
+    buf->release();
 }
diff --git a/rootdir/avb/Android.mk b/rootdir/avb/Android.mk
index 3978593..9892ae7 100644
--- a/rootdir/avb/Android.mk
+++ b/rootdir/avb/Android.mk
@@ -2,6 +2,8 @@
 
 ifeq ($(BOARD_USES_RECOVERY_AS_BOOT),true)
   my_gsi_avb_keys_path := $(TARGET_RECOVERY_ROOT_OUT)/first_stage_ramdisk/avb
+else ifeq ($(BOARD_MOVE_GSI_AVB_KEYS_TO_VENDOR_BOOT),true)
+  my_gsi_avb_keys_path := $(TARGET_VENDOR_RAMDISK_OUT)/avb
 else
   my_gsi_avb_keys_path := $(TARGET_RAMDISK_OUT)/avb
 endif
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 3146f36..d5b1d72 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -1011,8 +1011,8 @@
     write /proc/sys/vm/extra_free_kbytes ${sys.sysctl.extra_free_kbytes}
 
 # "tcp_default_init_rwnd" Is too long!
-on property:sys.sysctl.tcp_def_init_rwnd=*
-    write /proc/sys/net/ipv4/tcp_default_init_rwnd ${sys.sysctl.tcp_def_init_rwnd}
+on property:net.tcp_def_init_rwnd=*
+    write /proc/sys/net/ipv4/tcp_default_init_rwnd ${net.tcp_def_init_rwnd}
 
 # perf_event_open syscall security:
 # Newer kernels have the ability to control the use of the syscall via SELinux