diff --git a/adb/Android.bp b/adb/Android.bp
index 5073568..675525c 100644
--- a/adb/Android.bp
+++ b/adb/Android.bp
@@ -696,10 +696,10 @@
     test_suites: ["general-tests"],
     version: {
         py2: {
-            enabled: true,
+            enabled: false,
         },
         py3: {
-            enabled: false,
+            enabled: true,
         },
     },
 }
diff --git a/adb/test_device.py b/adb/test_device.py
index 083adce..6a9ff89 100755
--- a/adb/test_device.py
+++ b/adb/test_device.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2015 The Android Open Source Project
@@ -81,6 +81,13 @@
         self.device = adb.get_device()
 
 
+class AbbTest(DeviceTest):
+    def test_smoke(self):
+        result = subprocess.run(['adb', 'abb'], capture_output=True)
+        self.assertEqual(1, result.returncode)
+        expected_output = b"cmd: No service specified; use -l to list all services\n"
+        self.assertEqual(expected_output, result.stderr)
+
 class ForwardReverseTest(DeviceTest):
     def _test_no_rebind(self, description, direction_list, direction,
                        direction_no_rebind, direction_remove_all):
@@ -246,7 +253,7 @@
                     # Accept the client connection.
                     accepted_connection, addr = listener.accept()
                     with contextlib.closing(accepted_connection) as server:
-                        data = 'hello'
+                        data = b'hello'
 
                         # Send data into the port setup by adb forward.
                         client.sendall(data)
@@ -254,7 +261,7 @@
                         client.close()
 
                         # Verify that the data came back via adb reverse.
-                        self.assertEqual(data, server.makefile().read())
+                        self.assertEqual(data, server.makefile().read().encode("utf8"))
         finally:
             if reverse_setup:
                 self.device.reverse_remove(forward_spec)
@@ -268,7 +275,7 @@
 
         Args:
           shell_args: List of string arguments to `adb shell`.
-          input: String input to send to the interactive shell.
+          input: bytes input to send to the interactive shell.
 
         Returns:
           The remote exit code.
@@ -286,7 +293,7 @@
         # Closing host-side stdin doesn't trigger a PTY shell to exit so we need
         # to explicitly add an exit command to close the session from the device
         # side, plus the necessary newline to complete the interactive command.
-        proc.communicate(input + '; exit\n')
+        proc.communicate(input + b'; exit\n')
         return proc.returncode
 
     def test_cat(self):
@@ -419,7 +426,7 @@
         self.assertEqual('foo' + self.device.linesep, result[1])
         self.assertEqual('bar' + self.device.linesep, result[2])
 
-        self.assertEqual(17, self._interactive_shell([], 'exit 17'))
+        self.assertEqual(17, self._interactive_shell([], b'exit 17'))
 
         # -x flag should disable shell protocol.
         result = self.device.shell_nocheck(
@@ -428,7 +435,7 @@
         self.assertEqual('foo{0}bar{0}'.format(self.device.linesep), result[1])
         self.assertEqual('', result[2])
 
-        self.assertEqual(0, self._interactive_shell(['-x'], 'exit 17'))
+        self.assertEqual(0, self._interactive_shell(['-x'], b'exit 17'))
 
     def test_non_interactive_sigint(self):
         """Tests that SIGINT in a non-interactive shell kills the process.
@@ -447,7 +454,7 @@
                 self.device.adb_cmd + shlex.split('shell echo $$; sleep 60'),
                 stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT)
-        remote_pid = sleep_proc.stdout.readline().strip()
+        remote_pid = sleep_proc.stdout.readline().strip().decode("utf8")
         self.assertIsNone(sleep_proc.returncode, 'subprocess terminated early')
         proc_query = shlex.split('ps {0} | grep {0}'.format(remote_pid))
 
@@ -469,9 +476,10 @@
                                     'on this device')
 
         # Test both small and large inputs.
-        small_input = 'foo'
-        large_input = '\n'.join(c * 100 for c in (string.ascii_letters +
-                                                  string.digits))
+        small_input = b'foo'
+        characters = [c.encode("utf8") for c in string.ascii_letters + string.digits]
+        large_input = b'\n'.join(characters)
+
 
         for input in (small_input, large_input):
             proc = subprocess.Popen(self.device.adb_cmd + ['shell', 'cat'],
@@ -480,7 +488,7 @@
                                     stderr=subprocess.PIPE)
             stdout, stderr = proc.communicate(input)
             self.assertEqual(input.splitlines(), stdout.splitlines())
-            self.assertEqual('', stderr)
+            self.assertEqual(b'', stderr)
 
     def test_sighup(self):
         """Ensure that SIGHUP gets sent upon non-interactive ctrl-c"""
@@ -502,7 +510,7 @@
                                           stdin=subprocess.PIPE,
                                           stdout=subprocess.PIPE)
 
-        self.assertEqual("Waiting\n", process.stdout.readline())
+        self.assertEqual(b"Waiting\n", process.stdout.readline())
         process.send_signal(signal.SIGINT)
         process.wait()
 
@@ -533,7 +541,7 @@
             threads.append(thread)
         for thread in threads:
             thread.join()
-        for i, success in result.iteritems():
+        for i, success in result.items():
             self.assertTrue(success)
 
     def disabled_test_parallel(self):
@@ -546,24 +554,24 @@
 
         n_procs = 2048
         procs = dict()
-        for i in xrange(0, n_procs):
+        for i in range(0, n_procs):
             procs[i] = subprocess.Popen(
                 ['adb', 'shell', 'read foo; echo $foo; read rc; exit $rc'],
                 stdin=subprocess.PIPE,
                 stdout=subprocess.PIPE
             )
 
-        for i in xrange(0, n_procs):
+        for i in range(0, n_procs):
             procs[i].stdin.write("%d\n" % i)
 
-        for i in xrange(0, n_procs):
+        for i in range(0, n_procs):
             response = procs[i].stdout.readline()
             assert(response == "%d\n" % i)
 
-        for i in xrange(0, n_procs):
+        for i in range(0, n_procs):
             procs[i].stdin.write("%d\n" % (i % 256))
 
-        for i in xrange(0, n_procs):
+        for i in range(0, n_procs):
             assert(procs[i].wait() == i % 256)
 
 
@@ -602,14 +610,14 @@
     def test_install_argument_escaping(self):
         """Make sure that install argument escaping works."""
         # http://b/20323053, http://b/3090932.
-        for file_suffix in ('-text;ls;1.apk', "-Live Hold'em.apk"):
+        for file_suffix in (b'-text;ls;1.apk', b"-Live Hold'em.apk"):
             tf = tempfile.NamedTemporaryFile('wb', suffix=file_suffix,
                                              delete=False)
             tf.close()
 
             # Installing bogus .apks fails if the device supports exit codes.
             try:
-                output = self.device.install(tf.name)
+                output = self.device.install(tf.name.decode("utf8"))
             except subprocess.CalledProcessError as e:
                 output = e.output
 
@@ -712,7 +720,7 @@
     max_size = 16 * (1 << 10)
 
     files = []
-    for _ in xrange(num_files):
+    for _ in range(num_files):
         file_handle = tempfile.NamedTemporaryFile(dir=in_dir, delete=False)
 
         size = random.randrange(min_size, max_size, 1024)
@@ -731,7 +739,7 @@
     max_size = 16 * (1 << 10)
 
     files = []
-    for file_num in xrange(num_files):
+    for file_num in range(num_files):
         size = random.randrange(min_size, max_size, 1024)
 
         base_name = prefix + str(file_num)
@@ -878,7 +886,7 @@
             subdir_temp_files = make_random_host_files(in_dir=subdir,
                                                        num_files=4)
 
-            paths = map(lambda temp_file: temp_file.full_path, temp_files)
+            paths = [x.full_path for x in temp_files]
             paths.append(subdir)
             self.device._simple_call(['push'] + paths + [self.DEVICE_TEMP_DIR])
 
@@ -907,7 +915,7 @@
         Bug: http://b/26816782
         """
         with tempfile.NamedTemporaryFile() as tmp_file:
-            tmp_file.write('\0' * 1024 * 1024)
+            tmp_file.write(b'\0' * 1024 * 1024)
             tmp_file.flush()
             try:
                 self.device.push(local=tmp_file.name, remote='/system/')
@@ -915,8 +923,8 @@
             except subprocess.CalledProcessError as e:
                 output = e.output
 
-            self.assertTrue('Permission denied' in output or
-                            'Read-only file system' in output)
+            self.assertTrue(b'Permission denied' in output or
+                            b'Read-only file system' in output)
 
     @requires_non_root
     def test_push_directory_creation(self):
@@ -925,7 +933,7 @@
         Bug: http://b/110953234
         """
         with tempfile.NamedTemporaryFile() as tmp_file:
-            tmp_file.write('\0' * 1024 * 1024)
+            tmp_file.write(b'\0' * 1024 * 1024)
             tmp_file.flush()
             remote_path = self.DEVICE_TEMP_DIR + '/test_push_directory_creation'
             self.device.shell(['rm', '-rf', remote_path])
@@ -967,7 +975,7 @@
         except subprocess.CalledProcessError as e:
             output = e.output
 
-        self.assertIn('Permission denied', output)
+        self.assertIn(b'Permission denied', output)
 
         self.device.shell(['rm', '-f', self.DEVICE_TEMP_FILE])
 
@@ -1166,7 +1174,7 @@
             subdir_temp_files = make_random_device_files(
                 self.device, in_dir=subdir, num_files=4, prefix='subdir_')
 
-            paths = map(lambda temp_file: temp_file.full_path, temp_files)
+            paths = [x.full_path for x in temp_files]
             paths.append(subdir)
             self.device._simple_call(['pull'] + paths + [host_dir])
 
@@ -1355,7 +1363,7 @@
         """
         # The values that trigger things are 507 (512 - 5 bytes from shell protocol) + 1024*n
         # Probe some surrounding values as well, for the hell of it.
-        for base in [512] + range(1024, 1024 * 16, 1024):
+        for base in [512] + list(range(1024, 1024 * 16, 1024)):
             for offset in [-6, -5, -4]:
                 length = base + offset
                 cmd = ['dd', 'if=/dev/zero', 'bs={}'.format(length), 'count=1', '2>/dev/null;'
@@ -1390,10 +1398,10 @@
 
                 sock = socket.create_connection(("localhost", local_port))
                 with contextlib.closing(sock):
-                    bytesWritten = sock.send("a" * size)
+                    bytesWritten = sock.send(b"a" * size)
                     self.assertEqual(size, bytesWritten)
                     readBytes = sock.recv(4096)
-                    self.assertEqual("foo\n", readBytes)
+                    self.assertEqual(b"foo\n", readBytes)
 
                 thread.join()
         finally:
@@ -1424,13 +1432,13 @@
 
         s.sendall(adb_length_prefixed(transport_string))
         response = s.recv(4)
-        self.assertEquals(b"OKAY", response)
+        self.assertEqual(b"OKAY", response)
 
         shell_string = "shell:sleep 0.5; dd if=/dev/zero bs=1m count=1 status=none; echo foo"
         s.sendall(adb_length_prefixed(shell_string))
 
         response = s.recv(4)
-        self.assertEquals(b"OKAY", response)
+        self.assertEqual(b"OKAY", response)
 
         # Spawn a thread that dumps garbage into the socket until failure.
         def spam():
@@ -1453,7 +1461,7 @@
                 break
             received += read
 
-        self.assertEquals(1024 * 1024 + len("foo\n"), len(received))
+        self.assertEqual(1024 * 1024 + len("foo\n"), len(received))
         thread.join()
 
 
diff --git a/fs_mgr/libfs_avb/Android.bp b/fs_mgr/libfs_avb/Android.bp
index bf51fe7..8fb9697 100644
--- a/fs_mgr/libfs_avb/Android.bp
+++ b/fs_mgr/libfs_avb/Android.bp
@@ -31,6 +31,7 @@
     static_libs: [
         "libavb",
         "libdm",
+        "libgsi",
         "libfstab",
     ],
     export_static_lib_headers: [
diff --git a/fs_mgr/libfs_avb/fs_avb.cpp b/fs_mgr/libfs_avb/fs_avb.cpp
index ed623bc..5d504ab 100644
--- a/fs_mgr/libfs_avb/fs_avb.cpp
+++ b/fs_mgr/libfs_avb/fs_avb.cpp
@@ -33,6 +33,7 @@
 #include <android-base/strings.h>
 #include <libavb/libavb.h>
 #include <libdm/dm.h>
+#include <libgsi/libgsi.h>
 
 #include "avb_ops.h"
 #include "avb_util.h"
@@ -266,6 +267,18 @@
     return avb_handle;
 }
 
+static bool IsAvbPermissive() {
+    if (IsDeviceUnlocked()) {
+        // Manually putting a file under metadata partition can enforce AVB verification.
+        if (!access(DSU_METADATA_PREFIX "avb_enforce", F_OK)) {
+            LINFO << "Enforcing AVB verification when the device is unlocked";
+            return false;
+        }
+        return true;
+    }
+    return false;
+}
+
 AvbUniquePtr AvbHandle::LoadAndVerifyVbmeta(const FstabEntry& fstab_entry,
                                             const std::vector<std::string>& preload_avb_key_blobs) {
     // At least one of the following should be provided for public key matching.
@@ -275,7 +288,7 @@
     }
 
     // Binds allow_verification_error and rollback_protection to device unlock state.
-    bool allow_verification_error = IsDeviceUnlocked();
+    bool allow_verification_error = IsAvbPermissive();
     bool rollback_protection = !allow_verification_error;
 
     std::string public_key_data;
@@ -364,15 +377,15 @@
     return LoadAndVerifyVbmeta("vbmeta", fs_mgr_get_slot_suffix(), fs_mgr_get_other_slot_suffix(),
                                {} /* expected_public_key, already checked by bootloader */,
                                HashAlgorithm::kSHA256,
-                               IsDeviceUnlocked(), /* allow_verification_error */
-                               true,               /* load_chained_vbmeta */
+                               IsAvbPermissive(), /* allow_verification_error */
+                               true,              /* load_chained_vbmeta */
                                false, /* rollback_protection, already checked by bootloader */
                                nullptr /* custom_device_path */);
 }
 
 // TODO(b/128807537): removes this function.
 AvbUniquePtr AvbHandle::Open() {
-    bool is_device_unlocked = IsDeviceUnlocked();
+    bool allow_verification_error = IsAvbPermissive();
 
     AvbUniquePtr avb_handle(new AvbHandle());
     if (!avb_handle) {
@@ -381,8 +394,9 @@
     }
 
     FsManagerAvbOps avb_ops;
-    AvbSlotVerifyFlags flags = is_device_unlocked ? AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR
-                                                  : AVB_SLOT_VERIFY_FLAGS_NONE;
+    AvbSlotVerifyFlags flags = allow_verification_error
+                                       ? AVB_SLOT_VERIFY_FLAGS_ALLOW_VERIFICATION_ERROR
+                                       : AVB_SLOT_VERIFY_FLAGS_NONE;
     AvbSlotVerifyResult verify_result =
             avb_ops.AvbSlotVerify(fs_mgr_get_slot_suffix(), flags, &avb_handle->vbmeta_images_);
 
@@ -405,9 +419,8 @@
             break;
         case AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION:
         case AVB_SLOT_VERIFY_RESULT_ERROR_PUBLIC_KEY_REJECTED:
-            if (!is_device_unlocked) {
-                LERROR << "ERROR_VERIFICATION / PUBLIC_KEY_REJECTED isn't allowed "
-                       << "if the device is LOCKED";
+            if (!allow_verification_error) {
+                LERROR << "ERROR_VERIFICATION / PUBLIC_KEY_REJECTED isn't allowed ";
                 return nullptr;
             }
             avb_handle->status_ = AvbHandleStatus::kVerificationError;
diff --git a/healthd/healthd_mode_charger.h b/healthd/healthd_mode_charger.h
index 370ca86..6e569ee 100644
--- a/healthd/healthd_mode_charger.h
+++ b/healthd/healthd_mode_charger.h
@@ -72,7 +72,7 @@
     int64_t next_pwr_check_ = 0;
     int64_t wait_batt_level_timestamp_ = 0;
 
-    key_state keys_[KEY_MAX + 1];
+    key_state keys_[KEY_MAX + 1] = {};
 
     animation batt_anim_;
     GRSurface* surf_unknown_ = nullptr;
diff --git a/init/test_utils/include/init-test-utils/service_utils.h b/init/test_utils/include/init-test-utils/service_utils.h
index 3ec61d4..f9366ea 100644
--- a/init/test_utils/include/init-test-utils/service_utils.h
+++ b/init/test_utils/include/init-test-utils/service_utils.h
@@ -20,12 +20,20 @@
 #include <set>
 
 #include <android-base/result.h>
-#include <hidl-util/FqInstance.h>
 
 namespace android {
 namespace init {
 
-using ServiceInterfacesMap = std::map<std::string, std::set<android::FqInstance>>;
+// this is service name -> interface declaration
+//
+// So, for:
+//     service foo ..
+//         interface aidl baz
+//         interface android.hardware.foo@1.0 IFoo
+//
+// We have:
+//     foo -> { aidl/baz, android.hardware.foo@1.0/IFoo }
+using ServiceInterfacesMap = std::map<std::string, std::set<std::string>>;
 android::base::Result<ServiceInterfacesMap> GetOnDeviceServiceInterfacesMap();
 
 }  // namespace init
diff --git a/init/test_utils/service_utils.cpp b/init/test_utils/service_utils.cpp
index bc00702..ae68679 100644
--- a/init/test_utils/service_utils.cpp
+++ b/init/test_utils/service_utils.cpp
@@ -47,14 +47,7 @@
     for (const auto& service : service_list.services()) {
         // Create an entry for all services, including services that may not
         // have any declared interfaces.
-        result[service->name()] = std::set<android::FqInstance>();
-        for (const auto& intf : service->interfaces()) {
-            android::FqInstance fqInstance;
-            if (!fqInstance.setTo(intf)) {
-                return android::base::Error() << "Unable to parse interface: '" << intf << "'";
-            }
-            result[service->name()].insert(fqInstance);
-        }
+        result[service->name()] = service->interfaces();
     }
     return result;
 }
diff --git a/libcutils/KernelLibcutilsTest.xml b/libcutils/KernelLibcutilsTest.xml
index e27fac6..40e4ef4 100644
--- a/libcutils/KernelLibcutilsTest.xml
+++ b/libcutils/KernelLibcutilsTest.xml
@@ -13,7 +13,7 @@
      See the License for the specific language governing permissions and
      limitations under the License.
 -->
-<configuration description="Runs libcutils_test_static.">
+<configuration description="Runs KernelLibcutilsTest.">
     <option name="test-suite-tag" value="apct" />
     <option name="test-suite-tag" value="apct-native" />
 
@@ -22,12 +22,12 @@
 
     <target_preparer class="com.android.tradefed.targetprep.PushFilePreparer">
         <option name="cleanup" value="true" />
-        <option name="push" value="libcutils_test_static->/data/local/tmp/libcutils_test_static" />
+        <option name="push" value="KernelLibcutilsTest->/data/local/tmp/KernelLibcutilsTest" />
     </target_preparer>
 
     <test class="com.android.tradefed.testtype.GTest" >
         <option name="native-test-device-path" value="/data/local/tmp" />
-        <option name="module-name" value="libcutils_test_static" />
+        <option name="module-name" value="KernelLibcutilsTest" />
         <option name="include-filter" value="*AshmemTest*" />
     </test>
 </configuration>
diff --git a/libcutils/fs_config.cpp b/libcutils/fs_config.cpp
index fd9a3eb..c4e4f85 100644
--- a/libcutils/fs_config.cpp
+++ b/libcutils/fs_config.cpp
@@ -74,6 +74,8 @@
     { 00775, AID_MEDIA_RW,     AID_MEDIA_RW,     0, "data/media" },
     { 00750, AID_ROOT,         AID_SHELL,        0, "data/nativetest" },
     { 00750, AID_ROOT,         AID_SHELL,        0, "data/nativetest64" },
+    { 00750, AID_ROOT,         AID_SHELL,        0, "data/benchmarktest" },
+    { 00750, AID_ROOT,         AID_SHELL,        0, "data/benchmarktest64" },
     { 00775, AID_ROOT,         AID_ROOT,         0, "data/preloads" },
     { 00771, AID_SYSTEM,       AID_SYSTEM,       0, "data" },
     { 00755, AID_ROOT,         AID_SYSTEM,       0, "mnt" },
@@ -145,6 +147,8 @@
     { 00640, AID_ROOT,      AID_SHELL,     0, "data/nativetest64/tests.txt" },
     { 00750, AID_ROOT,      AID_SHELL,     0, "data/nativetest/*" },
     { 00750, AID_ROOT,      AID_SHELL,     0, "data/nativetest64/*" },
+    { 00750, AID_ROOT,      AID_SHELL,     0, "data/benchmarktest/*" },
+    { 00750, AID_ROOT,      AID_SHELL,     0, "data/benchmarktest64/*" },
     { 00600, AID_ROOT,      AID_ROOT,      0, "default.prop" }, // legacy
     { 00600, AID_ROOT,      AID_ROOT,      0, "system/etc/prop.default" },
     { 00600, AID_ROOT,      AID_ROOT,      0, "odm/build.prop" }, // legacy; only for P release
diff --git a/libstats/pull/Android.bp b/libstats/pull/Android.bp
index de59033..827e992 100644
--- a/libstats/pull/Android.bp
+++ b/libstats/pull/Android.bp
@@ -19,9 +19,6 @@
 // ==========================================================
 cc_library_shared {
     name: "libstatspull",
-    aidl: {
-        include_dirs: ["frameworks/base/core/java"],
-    },
     srcs: [
         "stats_pull_atom_callback.cpp",
     ],
@@ -31,11 +28,9 @@
     ],
     export_include_dirs: ["include"],
     shared_libs: [
-        //TODO: use libbinder_ndk. Remove libservices.
-        "libbinder",
+        "libbinder_ndk",
         "libstatssocket",
-        "libservices",
-        "statsd-aidl-cpp",
+        "statsd-aidl-ndk_platform",
     ],
     static_libs: [
         "liblog",
diff --git a/libstats/pull/stats_pull_atom_callback.cpp b/libstats/pull/stats_pull_atom_callback.cpp
index 9c497b8..27e9d29 100644
--- a/libstats/pull/stats_pull_atom_callback.cpp
+++ b/libstats/pull/stats_pull_atom_callback.cpp
@@ -15,18 +15,26 @@
  */
 
 #include <map>
+#include <thread>
 #include <vector>
 
 #include <stats_event.h>
 #include <stats_pull_atom_callback.h>
 
-#include <android/os/BnPullAtomCallback.h>
-#include <android/os/IPullAtomResultReceiver.h>
-#include <android/os/IStatsd.h>
-#include <android/util/StatsEventParcel.h>
-#include <binder/IServiceManager.h>
+#include <aidl/android/os/BnPullAtomCallback.h>
+#include <aidl/android/os/IPullAtomResultReceiver.h>
+#include <aidl/android/os/IStatsd.h>
+#include <aidl/android/util/StatsEventParcel.h>
+#include <android/binder_auto_utils.h>
+#include <android/binder_ibinder.h>
+#include <android/binder_manager.h>
 
-#include <thread>
+using Status = ::ndk::ScopedAStatus;
+using aidl::android::os::BnPullAtomCallback;
+using aidl::android::os::IPullAtomResultReceiver;
+using aidl::android::os::IStatsd;
+using aidl::android::util::StatsEventParcel;
+using ::ndk::SharedRefBase;
 
 struct AStatsEventList {
     std::vector<AStatsEvent*> data;
@@ -74,7 +82,7 @@
     metadata->additive_fields.assign(additive_fields, additive_fields + num_fields);
 }
 
-class StatsPullAtomCallbackInternal : public android::os::BnPullAtomCallback {
+class StatsPullAtomCallbackInternal : public BnPullAtomCallback {
   public:
     StatsPullAtomCallbackInternal(const AStatsManager_PullAtomCallback callback, void* cookie,
                                   const int64_t coolDownNs, const int64_t timeoutNs,
@@ -85,21 +93,19 @@
           mTimeoutNs(timeoutNs),
           mAdditiveFields(additiveFields) {}
 
-    ::android::binder::Status onPullAtom(
-            int32_t atomTag,
-            const ::android::sp<::android::os::IPullAtomResultReceiver>& resultReceiver) override {
+    Status onPullAtom(int32_t atomTag,
+                      const std::shared_ptr<IPullAtomResultReceiver>& resultReceiver) override {
         AStatsEventList statsEventList;
-        statsEventList.data.clear();
         int successInt = mCallback(atomTag, &statsEventList, mCookie);
         bool success = successInt == AStatsManager_PULL_SUCCESS;
 
         // Convert stats_events into StatsEventParcels.
-        std::vector<android::util::StatsEventParcel> parcels;
+        std::vector<StatsEventParcel> parcels;
         for (int i = 0; i < statsEventList.data.size(); i++) {
             size_t size;
             uint8_t* buffer = AStatsEvent_getBuffer(statsEventList.data[i], &size);
 
-            android::util::StatsEventParcel p;
+            StatsEventParcel p;
             // vector.assign() creates a copy, but this is inevitable unless
             // stats_event.h/c uses a vector as opposed to a buffer.
             p.buffer.assign(buffer, buffer + size);
@@ -110,7 +116,7 @@
         for (int i = 0; i < statsEventList.data.size(); i++) {
             AStatsEvent_release(statsEventList.data[i]);
         }
-        return android::binder::Status::ok();
+        return Status::ok();
     }
 
     const int64_t& getCoolDownNs() const { return mCoolDownNs; }
@@ -126,60 +132,55 @@
 };
 
 static std::mutex pullAtomMutex;
-static android::sp<android::os::IStatsd> sStatsd = nullptr;
+static std::shared_ptr<IStatsd> sStatsd = nullptr;
 
-static std::map<int32_t, android::sp<StatsPullAtomCallbackInternal>> mPullers;
-static android::sp<android::os::IStatsd> getStatsService();
+static std::map<int32_t, std::shared_ptr<StatsPullAtomCallbackInternal>> mPullers;
+static std::shared_ptr<IStatsd> getStatsService();
 
-class StatsDeathRecipient : public android::IBinder::DeathRecipient {
-  public:
-    StatsDeathRecipient() = default;
-    ~StatsDeathRecipient() override = default;
-
-    // android::IBinder::DeathRecipient override:
-    void binderDied(const android::wp<android::IBinder>& /* who */) override {
-        {
-            std::lock_guard<std::mutex> lock(pullAtomMutex);
-            sStatsd = nullptr;
-        }
-        android::sp<android::os::IStatsd> statsService = getStatsService();
-        if (statsService == nullptr) {
-            return;
-        }
-
-        std::map<int32_t, android::sp<StatsPullAtomCallbackInternal>> pullersCopy;
-        {
-            std::lock_guard<std::mutex> lock(pullAtomMutex);
-            pullersCopy = mPullers;
-        }
-        for (auto it : pullersCopy) {
-            statsService->registerNativePullAtomCallback(it.first, it.second->getCoolDownNs(),
-                                                         it.second->getTimeoutNs(),
-                                                         it.second->getAdditiveFields(), it.second);
-        }
+static void binderDied(void* /*cookie*/) {
+    {
+        std::lock_guard<std::mutex> lock(pullAtomMutex);
+        sStatsd = nullptr;
     }
-};
 
-static android::sp<StatsDeathRecipient> statsDeathRecipient = new StatsDeathRecipient();
+    std::shared_ptr<IStatsd> statsService = getStatsService();
+    if (statsService == nullptr) {
+        return;
+    }
 
-static android::sp<android::os::IStatsd> getStatsService() {
+    // Since we do not want to make an IPC with the lock held, we first create a
+    // copy of the data with the lock held before iterating through the map.
+    std::map<int32_t, std::shared_ptr<StatsPullAtomCallbackInternal>> pullersCopy;
+    {
+        std::lock_guard<std::mutex> lock(pullAtomMutex);
+        pullersCopy = mPullers;
+    }
+    for (const auto& it : pullersCopy) {
+        statsService->registerNativePullAtomCallback(it.first, it.second->getCoolDownNs(),
+                                                     it.second->getTimeoutNs(),
+                                                     it.second->getAdditiveFields(), it.second);
+    }
+}
+
+static ::ndk::ScopedAIBinder_DeathRecipient sDeathRecipient(
+        AIBinder_DeathRecipient_new(binderDied));
+
+static std::shared_ptr<IStatsd> getStatsService() {
     std::lock_guard<std::mutex> lock(pullAtomMutex);
     if (!sStatsd) {
-        // Fetch statsd.
-        const android::sp<android::IBinder> binder =
-                android::defaultServiceManager()->getService(android::String16("stats"));
-        if (!binder) {
-            return nullptr;
+        // Fetch statsd
+        ::ndk::SpAIBinder binder(AServiceManager_getService("stats"));
+        sStatsd = IStatsd::fromBinder(binder);
+        if (sStatsd) {
+            AIBinder_linkToDeath(binder.get(), sDeathRecipient.get(), /*cookie=*/nullptr);
         }
-        binder->linkToDeath(statsDeathRecipient);
-        sStatsd = android::interface_cast<android::os::IStatsd>(binder);
     }
     return sStatsd;
 }
 
 void registerStatsPullAtomCallbackBlocking(int32_t atomTag,
-                                           android::sp<StatsPullAtomCallbackInternal> cb) {
-    const android::sp<android::os::IStatsd> statsService = getStatsService();
+                                           std::shared_ptr<StatsPullAtomCallbackInternal> cb) {
+    const std::shared_ptr<IStatsd> statsService = getStatsService();
     if (statsService == nullptr) {
         // Statsd not available
         return;
@@ -190,7 +191,7 @@
 }
 
 void unregisterStatsPullAtomCallbackBlocking(int32_t atomTag) {
-    const android::sp<android::os::IStatsd> statsService = getStatsService();
+    const std::shared_ptr<IStatsd> statsService = getStatsService();
     if (statsService == nullptr) {
         // Statsd not available
         return;
@@ -211,8 +212,9 @@
         additiveFields = metadata->additive_fields;
     }
 
-    android::sp<StatsPullAtomCallbackInternal> callbackBinder = new StatsPullAtomCallbackInternal(
-            callback, cookie, coolDownNs, timeoutNs, additiveFields);
+    std::shared_ptr<StatsPullAtomCallbackInternal> callbackBinder =
+            SharedRefBase::make<StatsPullAtomCallbackInternal>(callback, cookie, coolDownNs,
+                                                               timeoutNs, additiveFields);
 
     {
         std::lock_guard<std::mutex> lg(pullAtomMutex);
diff --git a/libutils/Threads.cpp b/libutils/Threads.cpp
index 31ca138..540dcf4 100644
--- a/libutils/Threads.cpp
+++ b/libutils/Threads.cpp
@@ -18,8 +18,8 @@
 #define LOG_TAG "libutils.threads"
 
 #include <assert.h>
-#include <utils/Thread.h>
 #include <utils/AndroidThreads.h>
+#include <utils/Thread.h>
 
 #if !defined(_WIN32)
 # include <sys/resource.h>
@@ -36,7 +36,10 @@
 
 #include <utils/Log.h>
 
+#if defined(__ANDROID__)
+#include <processgroup/processgroup.h>
 #include <processgroup/sched_policy.h>
+#endif
 
 #if defined(__ANDROID__)
 # define __android_unused
@@ -64,6 +67,7 @@
 
 typedef void* (*android_pthread_entry)(void*);
 
+#if defined(__ANDROID__)
 struct thread_data_t {
     thread_func_t   entryFunction;
     void*           userData;
@@ -79,10 +83,11 @@
         char * name = t->threadName;
         delete t;
         setpriority(PRIO_PROCESS, 0, prio);
+
+        // A new thread will be in its parent's sched group by default,
+        // so we just need to handle the background case.
         if (prio >= ANDROID_PRIORITY_BACKGROUND) {
-            set_sched_policy(0, SP_BACKGROUND);
-        } else {
-            set_sched_policy(0, SP_FOREGROUND);
+            SetTaskProfiles(0, {"SCHED_SP_BACKGROUND"}, true);
         }
 
         if (name) {
@@ -92,6 +97,7 @@
         return f(u);
     }
 };
+#endif
 
 void androidSetThreadName(const char* name) {
 #if defined(__linux__)
@@ -300,11 +306,19 @@
 {
     int rc = 0;
     int lasterr = 0;
+    int curr_pri = getpriority(PRIO_PROCESS, tid);
+
+    if (curr_pri == pri) {
+        return rc;
+    }
 
     if (pri >= ANDROID_PRIORITY_BACKGROUND) {
-        rc = set_sched_policy(tid, SP_BACKGROUND);
-    } else if (getpriority(PRIO_PROCESS, tid) >= ANDROID_PRIORITY_BACKGROUND) {
-        rc = set_sched_policy(tid, SP_FOREGROUND);
+        rc = SetTaskProfiles(tid, {"SCHED_SP_BACKGROUND"}, true) ? 0 : -1;
+    } else if (curr_pri >= ANDROID_PRIORITY_BACKGROUND) {
+        SchedPolicy policy = SP_FOREGROUND;
+        // Change to the sched policy group of the process.
+        get_sched_policy(getpid(), &policy);
+        rc = SetTaskProfiles(tid, {get_sched_policy_profile_name(policy)}, true) ? 0 : -1;
     }
 
     if (rc) {
diff --git a/libutils/include/utils/String16.h b/libutils/include/utils/String16.h
index adc3e7d..c0e3f1e 100644
--- a/libutils/include/utils/String16.h
+++ b/libutils/include/utils/String16.h
@@ -17,7 +17,8 @@
 #ifndef ANDROID_STRING16_H
 #define ANDROID_STRING16_H
 
-#include <string> // for std::string
+#include <iostream>
+#include <string>
 
 #include <utils/Errors.h>
 #include <utils/String8.h>
@@ -25,18 +26,10 @@
 
 // ---------------------------------------------------------------------------
 
-extern "C" {
-
-}
-
-// ---------------------------------------------------------------------------
-
 namespace android {
 
 // ---------------------------------------------------------------------------
 
-class String8;
-
 template <size_t N>
 class StaticString16;
 
@@ -203,6 +196,11 @@
 // require any change to the underlying SharedBuffer contents or reference count.
 ANDROID_TRIVIAL_MOVE_TRAIT(String16)
 
+static inline std::ostream& operator<<(std::ostream& os, const String16& str) {
+    os << String8(str).c_str();
+    return os;
+}
+
 // ---------------------------------------------------------------------------
 
 /*
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 1be3a3b..f695d89 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -114,15 +114,6 @@
     symlink /proc/self/fd/1 /dev/stdout
     symlink /proc/self/fd/2 /dev/stderr
 
-    symlink /system/bin /bin
-    symlink /system/etc /etc
-
-    # Backward compatibility.
-    symlink /sys/kernel/debug /d
-
-    # Link /vendor to /system/vendor for devices without a vendor partition.
-    symlink /system/vendor /vendor
-
     # Create energy-aware scheduler tuning nodes
     mkdir /dev/stune/foreground
     mkdir /dev/stune/background
@@ -144,6 +135,14 @@
     chmod 0664 /dev/stune/top-app/tasks
     chmod 0664 /dev/stune/rt/tasks
 
+    # Create an stune group for NNAPI HAL processes
+    mkdir /dev/stune/nnapi-hal
+    chown system system /dev/stune/nnapi-hal
+    chown system system /dev/stune/nnapi-hal/tasks
+    chmod 0664 /dev/stune/nnapi-hal/tasks
+    write /dev/stune/nnapi-hal/schedtune.boost 1
+    write /dev/stune/nnapi-hal/schedtune.prefer_idle 1
+
     # Create blkio group and apply initial settings.
     # This feature needs kernel to support it, and the
     # device's init.rc must actually set the correct values.
@@ -211,7 +210,6 @@
     mkdir /mnt/runtime/full/self 0755 root root
 
     # Symlink to keep legacy apps working in multi-user world
-    symlink /storage/self/primary /sdcard
     symlink /storage/self/primary /mnt/sdcard
     symlink /mnt/user/0/primary /mnt/runtime/default/self/primary
 
@@ -614,6 +612,8 @@
     mkdir /data/misc/apexdata 0711 root root
     mkdir /data/misc/apexrollback 0700 root root
     mkdir /data/misc/snapshotctl_log 0770 root root
+    # create location to store pre-reboot information
+    mkdir /data/misc/prereboot 0700 system system
 
     mkdir /data/preloads 0775 system system encryption=None
 
@@ -764,6 +764,9 @@
     # IOCTLs on ashmem fds any more.
     setprop sys.use_memfd false
 
+    # Explicitly disable FUSE
+    setprop persist.sys.fuse false
+
     # Set fscklog permission
     chown root system /dev/fscklogs/log
     chmod 0770 /dev/fscklogs/log
diff --git a/storaged/main.cpp b/storaged/main.cpp
index e35bd6f..a7bda14 100644
--- a/storaged/main.cpp
+++ b/storaged/main.cpp
@@ -46,11 +46,6 @@
 
 // Function of storaged's main thread
 void* storaged_main(void* /* unused */) {
-    storaged_sp = new storaged_t();
-
-    storaged_sp->init();
-    storaged_sp->report_storage_info();
-
     LOG(INFO) << "storaged: Start";
 
     for (;;) {
@@ -123,6 +118,9 @@
 
     if (flag_main_service) { // start main thread
         // Start the main thread of storaged
+        storaged_sp = new storaged_t();
+        storaged_sp->init();
+        storaged_sp->report_storage_info();
         pthread_t storaged_main_thread;
         errno = pthread_create(&storaged_main_thread, NULL, storaged_main, NULL);
         if (errno != 0) {