diff --git a/bootstat/bootstat.cpp b/bootstat/bootstat.cpp
index 844357c..3b8866e 100644
--- a/bootstat/bootstat.cpp
+++ b/bootstat/bootstat.cpp
@@ -459,6 +459,8 @@
     {"reboot,sys_ldo_ok,pmic,main", 227},
     {"reboot,sys_ldo_ok,pmic,sub", 228},
     {"reboot,smpl_timeout,pmic,main", 229},
+    {"reboot,ota,.*", 230},
+    {"reboot,periodic,.*", 231},
 };
 
 // Converts a string value representing the reason the system booted to an
diff --git a/debuggerd/client/debuggerd_client.cpp b/debuggerd/client/debuggerd_client.cpp
index c9e097e..bd1e91d 100644
--- a/debuggerd/client/debuggerd_client.cpp
+++ b/debuggerd/client/debuggerd_client.cpp
@@ -276,6 +276,13 @@
       return false;
     }
 
+    // WARNING: It's not possible to replace the below with a splice call.
+    // Due to the way debuggerd does many small writes across the pipe,
+    // this would cause splice to copy a page for each write. The second
+    // pipe fills up based on the number of pages being copied, even
+    // though there is not much data being transferred per page. When
+    // the second pipe is full, everything stops since there is nothing
+    // reading the second pipe to clear it.
     char buf[1024];
     rc = TEMP_FAILURE_RETRY(read(pipe_read.get(), buf, sizeof(buf)));
     if (rc == 0) {
diff --git a/debuggerd/client/debuggerd_client_test.cpp b/debuggerd/client/debuggerd_client_test.cpp
index ebb8d86..33ff05f 100644
--- a/debuggerd/client/debuggerd_client_test.cpp
+++ b/debuggerd/client/debuggerd_client_test.cpp
@@ -18,6 +18,7 @@
 
 #include <fcntl.h>
 #include <stdio.h>
+#include <sys/eventfd.h>
 #include <unistd.h>
 
 #include <chrono>
@@ -51,23 +52,35 @@
 
 TEST(debuggerd_client, race) {
   static int THREAD_COUNT = getThreadCount();
+
+  // Semaphore incremented once per thread started.
+  unique_fd barrier(eventfd(0, EFD_SEMAPHORE));
+  ASSERT_NE(-1, barrier.get());
+
   pid_t forkpid = fork();
-
   ASSERT_NE(-1, forkpid);
-
   if (forkpid == 0) {
     // Spawn a bunch of threads, to make crash_dump take longer.
     std::vector<std::thread> threads;
+    threads.reserve(THREAD_COUNT);
     for (int i = 0; i < THREAD_COUNT; ++i) {
-      threads.emplace_back([]() {
-        while (true) {
-          std::this_thread::sleep_for(60s);
+      threads.emplace_back([&barrier]() {
+        uint64_t count = 1;
+        ASSERT_NE(-1, write(barrier.get(), &count, sizeof(count)));
+        for (;;) {
+          pause();
         }
       });
     }
+    for (;;) {
+      pause();
+    }
+  }
 
-    std::this_thread::sleep_for(60s);
-    exit(0);
+  // Wait for the child to spawn all of its threads.
+  for (int i = 0; i < THREAD_COUNT; ++i) {
+    uint64_t count;
+    ASSERT_NE(-1, read(barrier.get(), &count, sizeof(count)));
   }
 
   unique_fd pipe_read, pipe_write;
@@ -77,9 +90,6 @@
   constexpr int PIPE_SIZE = 16 * 1024 * 1024;
   ASSERT_EQ(PIPE_SIZE, fcntl(pipe_read.get(), F_SETPIPE_SZ, PIPE_SIZE));
 
-  // Wait for a bit to let the child spawn all of its threads.
-  std::this_thread::sleep_for(1s);
-
   ASSERT_TRUE(
       debuggerd_trigger_dump(forkpid, kDebuggerdNativeBacktrace, 60000, std::move(pipe_write)));
   // Immediately kill the forked child, to make sure that the dump didn't return early.
diff --git a/debuggerd/debuggerd.cpp b/debuggerd/debuggerd.cpp
index e20e8d9..26726cf 100644
--- a/debuggerd/debuggerd.cpp
+++ b/debuggerd/debuggerd.cpp
@@ -41,22 +41,6 @@
   _exit(exit_code);
 }
 
-static std::thread spawn_redirect_thread(unique_fd fd) {
-  return std::thread([fd{ std::move(fd) }]() {
-    while (true) {
-      char buf[BUFSIZ];
-      ssize_t rc = TEMP_FAILURE_RETRY(read(fd.get(), buf, sizeof(buf)));
-      if (rc <= 0) {
-        return;
-      }
-
-      if (!android::base::WriteFully(STDOUT_FILENO, buf, rc)) {
-        return;
-      }
-    }
-  });
-}
-
 int main(int argc, char* argv[]) {
   if (argc <= 1) usage(0);
   if (argc > 3) usage(1);
@@ -107,14 +91,11 @@
     }
   }
 
-  unique_fd piperead, pipewrite;
-  if (!Pipe(&piperead, &pipewrite)) {
-    err(1, "failed to create pipe");
+  unique_fd output_fd(fcntl(STDOUT_FILENO, F_DUPFD_CLOEXEC, 0));
+  if (output_fd.get() == -1) {
+    err(1, "failed to fcntl dup stdout");
   }
-
-  std::thread redirect_thread = spawn_redirect_thread(std::move(piperead));
-  if (!debuggerd_trigger_dump(proc_info.pid, dump_type, 0, std::move(pipewrite))) {
-    redirect_thread.join();
+  if (!debuggerd_trigger_dump(proc_info.pid, dump_type, 0, std::move(output_fd))) {
     if (pid == proc_info.pid) {
       errx(1, "failed to dump process %d", pid);
     } else {
@@ -122,6 +103,5 @@
     }
   }
 
-  redirect_thread.join();
   return 0;
 }
diff --git a/debuggerd/debuggerd_test.cpp b/debuggerd/debuggerd_test.cpp
index 39d7fff..4cd6193 100644
--- a/debuggerd/debuggerd_test.cpp
+++ b/debuggerd/debuggerd_test.cpp
@@ -2759,3 +2759,48 @@
   ASSERT_BACKTRACE_FRAME(result, "raise_debugger_signal");
   ASSERT_NOT_MATCH(result, kLogMessage);
 }
+
+// Disable this test since there is a high liklihood that this would
+// be flaky since it requires 500 messages being in the log.
+TEST_F(CrasherTest, DISABLED_max_log_messages) {
+  StartProcess([]() {
+    for (size_t i = 0; i < 600; i++) {
+      LOG(INFO) << "Message number " << i;
+    }
+    abort();
+  });
+
+  unique_fd output_fd;
+  StartIntercept(&output_fd);
+  FinishCrasher();
+  AssertDeath(SIGABRT);
+  int intercept_result;
+  FinishIntercept(&intercept_result);
+  ASSERT_EQ(1, intercept_result) << "tombstoned reported failure";
+
+  std::string result;
+  ConsumeFd(std::move(output_fd), &result);
+  ASSERT_NOT_MATCH(result, "Message number 99");
+  ASSERT_MATCH(result, "Message number 100");
+  ASSERT_MATCH(result, "Message number 599");
+}
+
+TEST_F(CrasherTest, log_with_newline) {
+  StartProcess([]() {
+    LOG(INFO) << "This line has a newline.\nThis is on the next line.";
+    abort();
+  });
+
+  unique_fd output_fd;
+  StartIntercept(&output_fd);
+  FinishCrasher();
+  AssertDeath(SIGABRT);
+  int intercept_result;
+  FinishIntercept(&intercept_result);
+  ASSERT_EQ(1, intercept_result) << "tombstoned reported failure";
+
+  std::string result;
+  ConsumeFd(std::move(output_fd), &result);
+  ASSERT_MATCH(result, ":\\s*This line has a newline.");
+  ASSERT_MATCH(result, ":\\s*This is on the next line.");
+}
diff --git a/debuggerd/handler/debuggerd_handler.cpp b/debuggerd/handler/debuggerd_handler.cpp
index baa5bfb..c6a535a 100644
--- a/debuggerd/handler/debuggerd_handler.cpp
+++ b/debuggerd/handler/debuggerd_handler.cpp
@@ -566,20 +566,23 @@
     process_info = g_callbacks.get_process_info();
   }
 
-  // GWP-ASan catches use-after-free and heap-buffer-overflow by using PROT_NONE
-  // guard pages, which lead to SEGV. Normally, debuggerd prints a bug report
-  // and the process terminates, but in some cases, we actually want to print
-  // the bug report and let the signal handler return, and restart the process.
-  // In order to do that, we need to disable GWP-ASan's guard pages. The
-  // following callbacks handle this case.
-  gwp_asan_callbacks_t gwp_asan_callbacks = g_callbacks.get_gwp_asan_callbacks();
-  if (signal_number == SIGSEGV && signal_has_si_addr(info) &&
-      gwp_asan_callbacks.debuggerd_needs_gwp_asan_recovery &&
-      gwp_asan_callbacks.debuggerd_gwp_asan_pre_crash_report &&
-      gwp_asan_callbacks.debuggerd_gwp_asan_post_crash_report &&
-      gwp_asan_callbacks.debuggerd_needs_gwp_asan_recovery(info->si_addr)) {
-    gwp_asan_callbacks.debuggerd_gwp_asan_pre_crash_report(info->si_addr);
-    process_info.recoverable_gwp_asan_crash = true;
+  gwp_asan_callbacks_t gwp_asan_callbacks = {};
+  if (g_callbacks.get_gwp_asan_callbacks != nullptr) {
+    // GWP-ASan catches use-after-free and heap-buffer-overflow by using PROT_NONE
+    // guard pages, which lead to SEGV. Normally, debuggerd prints a bug report
+    // and the process terminates, but in some cases, we actually want to print
+    // the bug report and let the signal handler return, and restart the process.
+    // In order to do that, we need to disable GWP-ASan's guard pages. The
+    // following callbacks handle this case.
+    gwp_asan_callbacks = g_callbacks.get_gwp_asan_callbacks();
+    if (signal_number == SIGSEGV && signal_has_si_addr(info) &&
+        gwp_asan_callbacks.debuggerd_needs_gwp_asan_recovery &&
+        gwp_asan_callbacks.debuggerd_gwp_asan_pre_crash_report &&
+        gwp_asan_callbacks.debuggerd_gwp_asan_post_crash_report &&
+        gwp_asan_callbacks.debuggerd_needs_gwp_asan_recovery(info->si_addr)) {
+      gwp_asan_callbacks.debuggerd_gwp_asan_pre_crash_report(info->si_addr);
+      process_info.recoverable_gwp_asan_crash = true;
+    }
   }
 
   // If sival_int is ~0, it means that the fallback handler has been called
@@ -764,6 +767,7 @@
 bool debuggerd_handle_signal(int signal_number, siginfo_t* info, void* context) {
   if (signal_number != SIGSEGV || !signal_has_si_addr(info)) return false;
 
+  if (g_callbacks.get_gwp_asan_callbacks == nullptr) return false;
   gwp_asan_callbacks_t gwp_asan_callbacks = g_callbacks.get_gwp_asan_callbacks();
   if (gwp_asan_callbacks.debuggerd_needs_gwp_asan_recovery == nullptr ||
       gwp_asan_callbacks.debuggerd_gwp_asan_pre_crash_report == nullptr ||
diff --git a/debuggerd/libdebuggerd/tombstone_proto.cpp b/debuggerd/libdebuggerd/tombstone_proto.cpp
index acd814e..7b2e068 100644
--- a/debuggerd/libdebuggerd/tombstone_proto.cpp
+++ b/debuggerd/libdebuggerd/tombstone_proto.cpp
@@ -70,6 +70,9 @@
 
 using android::base::StringPrintf;
 
+// The maximum number of messages to save in the protobuf per file.
+static constexpr size_t kMaxLogMessages = 500;
+
 // Use the demangler from libc++.
 extern "C" char* __cxa_demangle(const char*, char*, size_t*, int* status);
 
@@ -491,8 +494,8 @@
 }
 
 static void dump_log_file(Tombstone* tombstone, const char* logger, pid_t pid) {
-  logger_list* logger_list =
-      android_logger_list_open(android_name_to_log_id(logger), ANDROID_LOG_NONBLOCK, 0, pid);
+  logger_list* logger_list = android_logger_list_open(android_name_to_log_id(logger),
+                                                      ANDROID_LOG_NONBLOCK, kMaxLogMessages, pid);
 
   LogBuffer buffer;
 
diff --git a/debuggerd/seccomp_policy/crash_dump.riscv64.policy b/debuggerd/seccomp_policy/crash_dump.riscv64.policy
index 21887ab..281e231 100644
--- a/debuggerd/seccomp_policy/crash_dump.riscv64.policy
+++ b/debuggerd/seccomp_policy/crash_dump.riscv64.policy
@@ -19,12 +19,13 @@
 faccessat: 1
 recvmsg: 1
 recvfrom: 1
+sysinfo: 1
 process_vm_readv: 1
 tgkill: 1
 rt_sigprocmask: 1
 rt_sigaction: 1
 rt_tgsigqueueinfo: 1
-prctl: arg0 == PR_GET_NO_NEW_PRIVS || arg0 == 0x53564d41 || arg0 == PR_PAC_RESET_KEYS
+prctl: arg0 == PR_GET_NO_NEW_PRIVS || arg0 == 0x53564d41
 madvise: 1
 mprotect: arg2 in 0x1|0x2
 munmap: 1
diff --git a/fastboot/Android.bp b/fastboot/Android.bp
index 7794c4b..56cac88 100644
--- a/fastboot/Android.bp
+++ b/fastboot/Android.bp
@@ -196,6 +196,7 @@
         "libfastbootshim",
         "libsnapshot_cow",
         "liblz4",
+        "libzstd",
         "libsnapshot_nobinder",
         "update_metadata-protos",
         "liburing",
diff --git a/fastboot/fastboot.cpp b/fastboot/fastboot.cpp
index f09616a..bec4ef1 100644
--- a/fastboot/fastboot.cpp
+++ b/fastboot/fastboot.cpp
@@ -775,7 +775,7 @@
 
 #endif
 
-static unique_fd unzip_to_file(ZipArchiveHandle zip, const char* entry_name) {
+static unique_fd UnzipToFile(ZipArchiveHandle zip, const char* entry_name) {
     unique_fd fd(make_temporary_fd(entry_name));
 
     ZipEntry64 zip_entry;
@@ -1487,13 +1487,20 @@
     return partition;
 }
 
-void do_flash(const char* pname, const char* fname, const bool apply_vbmeta) {
+void do_flash(const char* pname, const char* fname, const bool apply_vbmeta,
+              const FlashingPlan* fp) {
     verbose("Do flash %s %s", pname, fname);
     struct fastboot_buffer buf;
 
-    if (!load_buf(fname, &buf)) {
+    if (fp->source) {
+        unique_fd fd = fp->source->OpenFile(fname);
+        if (fd < 0 || !load_buf_fd(std::move(fd), &buf)) {
+            die("could not load '%s': %s", fname, strerror(errno));
+        }
+    } else if (!load_buf(fname, &buf)) {
         die("cannot load '%s': %s", fname, strerror(errno));
     }
+
     if (is_logical(pname)) {
         fb->ResizePartition(pname, std::to_string(buf.image_size));
     }
@@ -1592,7 +1599,7 @@
     if (img_name.empty()) {
         img_name = partition + ".img";
     }
-    return std::make_unique<FlashTask>(slot, partition, img_name, apply_vbmeta);
+    return std::make_unique<FlashTask>(slot, partition, img_name, apply_vbmeta, fp);
 }
 
 std::unique_ptr<RebootTask> ParseRebootCommand(const FlashingPlan* fp,
@@ -1639,14 +1646,22 @@
     return task;
 }
 
-void AddResizeTasks(const FlashingPlan* fp, std::vector<std::unique_ptr<Task>>* tasks) {
+bool AddResizeTasks(const FlashingPlan* fp, std::vector<std::unique_ptr<Task>>* tasks) {
     // expands "resize-partitions" into individual commands : resize {os_partition_1}, resize
     // {os_partition_2}, etc.
     std::vector<std::unique_ptr<Task>> resize_tasks;
     std::optional<size_t> loc;
+    std::vector<char> contents;
+    if (!fp->source->ReadFile("super_empty.img", &contents)) {
+        return false;
+    }
+    auto metadata = android::fs_mgr::ReadFromImageBlob(contents.data(), contents.size());
+    if (!metadata) {
+        return false;
+    }
     for (size_t i = 0; i < tasks->size(); i++) {
         if (auto flash_task = tasks->at(i)->AsFlashTask()) {
-            if (should_flash_in_userspace(flash_task->GetPartitionAndSlot())) {
+            if (should_flash_in_userspace(*metadata.get(), flash_task->GetPartitionAndSlot())) {
                 if (!loc) {
                     loc = i;
                 }
@@ -1658,15 +1673,15 @@
     // if no logical partitions (although should never happen since system will always need to be
     // flashed)
     if (!loc) {
-        return;
+        return false;
     }
     tasks->insert(tasks->begin() + loc.value(), std::make_move_iterator(resize_tasks.begin()),
                   std::make_move_iterator(resize_tasks.end()));
-    return;
+    return true;
 }
 
 static bool IsIgnore(const std::vector<std::string>& command) {
-    if (command[0][0] == '#') {
+    if (command.size() == 0 || command[0][0] == '#') {
         return true;
     }
     return false;
@@ -1743,21 +1758,13 @@
         }
         tasks.insert(it, std::move(flash_super_task));
     } else {
-        AddResizeTasks(fp, &tasks);
+        if (!AddResizeTasks(fp, &tasks)) {
+            LOG(WARNING) << "Failed to add resize tasks";
+        };
     }
     return tasks;
 }
 
-std::vector<std::unique_ptr<Task>> ParseFastbootInfo(const FlashingPlan* fp, std::ifstream& fs) {
-    std::string text;
-    std::vector<std::string> file;
-    // Get os_partitions that need to be resized
-    while (std::getline(fs, text)) {
-        file.emplace_back(text);
-    }
-    return ParseFastbootInfo(fp, file);
-}
-
 FlashAllTool::FlashAllTool(FlashingPlan* fp) : fp_(fp) {}
 
 void FlashAllTool::Flash() {
@@ -1777,27 +1784,8 @@
 
     CancelSnapshotIfNeeded();
 
-    std::string path = find_item_given_name("fastboot-info.txt");
-    std::ifstream stream(path);
-    if (!stream || stream.eof()) {
-        LOG(VERBOSE) << "Flashing from hardcoded images. fastboot-info.txt is empty or does not "
-                        "exist";
-        HardcodedFlash();
-        return;
-    }
-
-    std::vector<std::unique_ptr<Task>> tasks = ParseFastbootInfo(fp_, stream);
-    if (tasks.empty()) {
-        LOG(FATAL) << "Invalid fastboot-info.txt file.";
-    }
-    LOG(VERBOSE) << "Flashing from fastboot-info.txt";
-    for (auto& task : tasks) {
-        task->Run();
-    }
-    if (fp_->wants_wipe) {
-        // avoid adding duplicate wipe tasks in fastboot main code.
-        fp_->wants_wipe = false;
-    }
+    HardcodedFlash();
+    return;
 }
 
 void FlashAllTool::CheckRequirements() {
@@ -1930,7 +1918,7 @@
 }
 
 unique_fd ZipImageSource::OpenFile(const std::string& name) const {
-    return unzip_to_file(zip_, name.c_str());
+    return UnzipToFile(zip_, name.c_str());
 }
 
 static void do_update(const char* filename, FlashingPlan* fp) {
@@ -2115,7 +2103,7 @@
 }
 
 static bool wipe_super(const android::fs_mgr::LpMetadata& metadata, const std::string& slot,
-                       std::string* message) {
+                       std::string* message, const FlashingPlan* fp) {
     auto super_device = GetMetadataSuperBlockDevice(metadata);
     auto block_size = metadata.geometry.logical_block_size;
     auto super_bdev_name = android::fs_mgr::GetBlockDevicePartitionName(*super_device);
@@ -2155,7 +2143,7 @@
 
         auto image_path = temp_dir.path + "/"s + image_name;
         auto flash = [&](const std::string& partition_name) {
-            do_flash(partition_name.c_str(), image_path.c_str(), false);
+            do_flash(partition_name.c_str(), image_path.c_str(), false, fp);
         };
         do_for_partitions(partition, slot, flash, force_slot);
 
@@ -2164,7 +2152,8 @@
     return true;
 }
 
-static void do_wipe_super(const std::string& image, const std::string& slot_override) {
+static void do_wipe_super(const std::string& image, const std::string& slot_override,
+                          const FlashingPlan* fp) {
     if (access(image.c_str(), R_OK) != 0) {
         die("Could not read image: %s", image.c_str());
     }
@@ -2179,7 +2168,7 @@
     }
 
     std::string message;
-    if (!wipe_super(*metadata.get(), slot, &message)) {
+    if (!wipe_super(*metadata.get(), slot, &message, fp)) {
         die(message);
     }
 }
@@ -2476,7 +2465,7 @@
             }
             if (fname.empty()) die("cannot determine image filename for '%s'", pname.c_str());
 
-            FlashTask task(fp->slot_override, pname, fname, is_vbmeta_partition(pname));
+            FlashTask task(fp->slot_override, pname, fname, is_vbmeta_partition(pname), fp.get());
             task.Run();
         } else if (command == "flash:raw") {
             std::string partition = next_arg(&args);
@@ -2571,7 +2560,7 @@
             } else {
                 image = next_arg(&args);
             }
-            do_wipe_super(image, fp->slot_override);
+            do_wipe_super(image, fp->slot_override, fp.get());
         } else if (command == "snapshot-update") {
             std::string arg;
             if (!args.empty()) {
diff --git a/fastboot/fastboot.h b/fastboot/fastboot.h
index 80b77a0..abdf636 100644
--- a/fastboot/fastboot.h
+++ b/fastboot/fastboot.h
@@ -124,7 +124,8 @@
 
 bool should_flash_in_userspace(const std::string& partition_name);
 bool is_userspace_fastboot();
-void do_flash(const char* pname, const char* fname, const bool apply_vbmeta);
+void do_flash(const char* pname, const char* fname, const bool apply_vbmeta,
+              const FlashingPlan* fp);
 void do_for_partitions(const std::string& part, const std::string& slot,
                        const std::function<void(const std::string&)>& func, bool force_slot);
 std::string find_item(const std::string& item);
@@ -143,7 +144,7 @@
                                            const std::vector<std::string>& parts);
 std::unique_ptr<Task> ParseFastbootInfoLine(const FlashingPlan* fp,
                                             const std::vector<std::string>& command);
-void AddResizeTasks(const FlashingPlan* fp, std::vector<std::unique_ptr<Task>>& tasks);
+bool AddResizeTasks(const FlashingPlan* fp, std::vector<std::unique_ptr<Task>>& tasks);
 std::vector<std::unique_ptr<Task>> ParseFastbootInfo(const FlashingPlan* fp,
                                                      const std::vector<std::string>& file);
 
diff --git a/fastboot/task.cpp b/fastboot/task.cpp
index ce46e91..9ce2cfd 100644
--- a/fastboot/task.cpp
+++ b/fastboot/task.cpp
@@ -26,9 +26,9 @@
 #include "util.h"
 
 using namespace std::string_literals;
-FlashTask::FlashTask(const std::string& _slot, const std::string& _pname, const std::string& _fname,
-                     const bool apply_vbmeta)
-    : pname_(_pname), fname_(_fname), slot_(_slot), apply_vbmeta_(apply_vbmeta) {}
+FlashTask::FlashTask(const std::string& slot, const std::string& pname, const std::string& fname,
+                     const bool apply_vbmeta, const FlashingPlan* fp)
+    : pname_(pname), fname_(fname), slot_(slot), apply_vbmeta_(apply_vbmeta), fp_(fp) {}
 
 void FlashTask::Run() {
     auto flash = [&](const std::string& partition) {
@@ -41,7 +41,7 @@
                 "And try again. If you are intentionally trying to "
                 "overwrite a fixed partition, use --force.");
         }
-        do_flash(partition.c_str(), fname_.c_str(), apply_vbmeta_);
+        do_flash(partition.c_str(), fname_.c_str(), apply_vbmeta_, fp_);
     };
     do_for_partitions(pname_, slot_, flash, true);
 }
@@ -214,11 +214,9 @@
 
     for (const auto& task : tasks) {
         if (auto flash_task = task->AsFlashTask()) {
-            if (should_flash_in_userspace(flash_task->GetPartitionAndSlot())) {
-                auto partition = flash_task->GetPartitionAndSlot();
-                if (!helper->AddPartition(partition, flash_task->GetImageName(), false)) {
-                    return nullptr;
-                }
+            auto partition = flash_task->GetPartitionAndSlot();
+            if (!helper->AddPartition(partition, flash_task->GetImageName(), false)) {
+                return nullptr;
             }
         }
     }
diff --git a/fastboot/task.h b/fastboot/task.h
index 34e3e92..82e8ebf 100644
--- a/fastboot/task.h
+++ b/fastboot/task.h
@@ -46,7 +46,7 @@
 class FlashTask : public Task {
   public:
     FlashTask(const std::string& slot, const std::string& pname, const std::string& fname,
-              const bool apply_vbmeta);
+              const bool apply_vbmeta, const FlashingPlan* fp);
     virtual FlashTask* AsFlashTask() override { return this; }
 
     std::string GetPartition() { return pname_; }
@@ -60,6 +60,7 @@
     const std::string fname_;
     const std::string slot_;
     const bool apply_vbmeta_;
+    const FlashingPlan* fp_;
 };
 
 class RebootTask : public Task {
@@ -118,7 +119,7 @@
 
 class DeleteTask : public Task {
   public:
-    DeleteTask(const FlashingPlan* _fp, const std::string& _pname);
+    DeleteTask(const FlashingPlan* fp, const std::string& pname);
     void Run() override;
 
   private:
diff --git a/fs_mgr/fs_mgr_overlayfs.cpp b/fs_mgr/fs_mgr_overlayfs.cpp
index ef436e5..f04fc8d 100644
--- a/fs_mgr/fs_mgr_overlayfs.cpp
+++ b/fs_mgr/fs_mgr_overlayfs.cpp
@@ -1083,7 +1083,7 @@
         return 0;
     }
 
-    auto ideal_size = std::min(super_info.size, uint64_t(s.f_frsize * s.f_bfree * 0.85));
+    auto ideal_size = std::min(super_info.size, uint64_t(uint64_t(s.f_frsize) * s.f_bfree * 0.85));
 
     // Align up to the filesystem block size.
     if (auto remainder = ideal_size % s.f_bsize; remainder > 0) {
diff --git a/fs_mgr/libdm/dm.cpp b/fs_mgr/libdm/dm.cpp
index deffae1..1e8c14f 100644
--- a/fs_mgr/libdm/dm.cpp
+++ b/fs_mgr/libdm/dm.cpp
@@ -243,6 +243,25 @@
     return true;
 }
 
+bool DeviceMapper::GetDeviceNameAndUuid(dev_t dev, std::string* name, std::string* uuid) {
+    struct dm_ioctl io;
+    InitIo(&io, {});
+    io.dev = dev;
+
+    if (ioctl(fd_, DM_DEV_STATUS, &io) < 0) {
+        PLOG(ERROR) << "Failed to find device dev: " << major(dev) << ":" << minor(dev);
+        return false;
+    }
+
+    if (name) {
+        *name = io.name;
+    }
+    if (uuid) {
+        *uuid = io.uuid;
+    }
+    return true;
+}
+
 std::optional<DeviceMapper::Info> DeviceMapper::GetDetailedInfo(const std::string& name) const {
     struct dm_ioctl io;
     InitIo(&io, name);
diff --git a/fs_mgr/libdm/dm_test.cpp b/fs_mgr/libdm/dm_test.cpp
index 788cf51..c522eaf 100644
--- a/fs_mgr/libdm/dm_test.cpp
+++ b/fs_mgr/libdm/dm_test.cpp
@@ -30,6 +30,7 @@
 #include <thread>
 
 #include <android-base/file.h>
+#include <android-base/logging.h>
 #include <android-base/scopeguard.h>
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
@@ -42,16 +43,40 @@
 using namespace std;
 using namespace std::chrono_literals;
 using namespace android::dm;
-using unique_fd = android::base::unique_fd;
+using android::base::make_scope_guard;
+using android::base::unique_fd;
 
-TEST(libdm, HasMinimumTargets) {
+class DmTest : public ::testing::Test {
+  protected:
+    void SetUp() override {
+        const testing::TestInfo* const test_info =
+                testing::UnitTest::GetInstance()->current_test_info();
+        test_name_ = test_info->name();
+        test_full_name_ = test_info->test_suite_name() + "/"s + test_name_;
+
+        LOG(INFO) << "Starting test: " << test_full_name_;
+    }
+    void TearDown() override {
+        LOG(INFO) << "Tearing down test: " << test_full_name_;
+
+        auto& dm = DeviceMapper::Instance();
+        ASSERT_TRUE(dm.DeleteDeviceIfExists(test_name_));
+
+        LOG(INFO) << "Teardown complete for test: " << test_full_name_;
+    }
+
+    std::string test_name_;
+    std::string test_full_name_;
+};
+
+TEST_F(DmTest, HasMinimumTargets) {
     DmTargetTypeInfo info;
 
     DeviceMapper& dm = DeviceMapper::Instance();
     ASSERT_TRUE(dm.GetTargetByName("linear", &info));
 }
 
-TEST(libdm, DmLinear) {
+TEST_F(DmTest, DmLinear) {
     unique_fd tmp1(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp1, 0);
     unique_fd tmp2(CreateTempFile("file_2", 4096));
@@ -127,7 +152,7 @@
     ASSERT_TRUE(dev.Destroy());
 }
 
-TEST(libdm, DmSuspendResume) {
+TEST_F(DmTest, DmSuspendResume) {
     unique_fd tmp1(CreateTempFile("file_suspend_resume", 512));
     ASSERT_GE(tmp1, 0);
 
@@ -156,7 +181,7 @@
     ASSERT_EQ(dm.GetState(dev.name()), DmDeviceState::ACTIVE);
 }
 
-TEST(libdm, DmVerityArgsAvb2) {
+TEST_F(DmTest, DmVerityArgsAvb2) {
     std::string device = "/dev/block/platform/soc/1da4000.ufshc/by-name/vendor_a";
     std::string algorithm = "sha1";
     std::string digest = "4be7e823b8c40f7bd5c8ccd5123f0722c5baca21";
@@ -178,7 +203,7 @@
     EXPECT_EQ(target.GetParameterString(), expected);
 }
 
-TEST(libdm, DmSnapshotArgs) {
+TEST_F(DmTest, DmSnapshotArgs) {
     DmTargetSnapshot target1(0, 512, "base", "cow", SnapshotStorageMode::Persistent, 8);
     if (DmTargetSnapshot::ReportsOverflow("snapshot")) {
         EXPECT_EQ(target1.GetParameterString(), "base cow PO 8");
@@ -200,7 +225,7 @@
     EXPECT_EQ(target3.name(), "snapshot-merge");
 }
 
-TEST(libdm, DmSnapshotOriginArgs) {
+TEST_F(DmTest, DmSnapshotOriginArgs) {
     DmTargetSnapshotOrigin target(0, 512, "base");
     EXPECT_EQ(target.GetParameterString(), "base");
     EXPECT_EQ(target.name(), "snapshot-origin");
@@ -330,7 +355,7 @@
     return true;
 }
 
-TEST(libdm, DmSnapshot) {
+TEST_F(DmTest, DmSnapshot) {
     if (!CheckSnapshotAvailability()) {
         return;
     }
@@ -374,7 +399,7 @@
     ASSERT_EQ(read, data);
 }
 
-TEST(libdm, DmSnapshotOverflow) {
+TEST_F(DmTest, DmSnapshotOverflow) {
     if (!CheckSnapshotAvailability()) {
         return;
     }
@@ -421,7 +446,7 @@
     }
 }
 
-TEST(libdm, ParseStatusText) {
+TEST_F(DmTest, ParseStatusText) {
     DmTargetSnapshot::Status status;
 
     // Bad inputs
@@ -448,7 +473,7 @@
     EXPECT_TRUE(DmTargetSnapshot::ParseStatusText("Overflow", &status));
 }
 
-TEST(libdm, DmSnapshotMergePercent) {
+TEST_F(DmTest, DmSnapshotMergePercent) {
     DmTargetSnapshot::Status status;
 
     // Correct input
@@ -502,7 +527,7 @@
     EXPECT_LE(DmTargetSnapshot::MergePercent(status, 0), 0.0);
 }
 
-TEST(libdm, CryptArgs) {
+TEST_F(DmTest, CryptArgs) {
     DmTargetCrypt target1(0, 512, "sha1", "abcdefgh", 50, "/dev/loop0", 100);
     ASSERT_EQ(target1.name(), "crypt");
     ASSERT_TRUE(target1.Valid());
@@ -518,7 +543,7 @@
               "iv_large_sectors sector_size:64");
 }
 
-TEST(libdm, DefaultKeyArgs) {
+TEST_F(DmTest, DefaultKeyArgs) {
     DmTargetDefaultKey target(0, 4096, "aes-xts-plain64", "abcdef0123456789", "/dev/loop0", 0);
     target.SetSetDun();
     ASSERT_EQ(target.name(), "default-key");
@@ -529,7 +554,7 @@
               "iv_large_sectors");
 }
 
-TEST(libdm, DefaultKeyLegacyArgs) {
+TEST_F(DmTest, DefaultKeyLegacyArgs) {
     DmTargetDefaultKey target(0, 4096, "AES-256-XTS", "abcdef0123456789", "/dev/loop0", 0);
     target.SetUseLegacyOptionsFormat();
     ASSERT_EQ(target.name(), "default-key");
@@ -537,7 +562,7 @@
     ASSERT_EQ(target.GetParameterString(), "AES-256-XTS abcdef0123456789 /dev/loop0 0");
 }
 
-TEST(libdm, DeleteDeviceWithTimeout) {
+TEST_F(DmTest, DeleteDeviceWithTimeout) {
     unique_fd tmp(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp, 0);
     LoopDevice loop(tmp, 10s);
@@ -561,7 +586,7 @@
     ASSERT_EQ(ENOENT, errno);
 }
 
-TEST(libdm, IsDmBlockDevice) {
+TEST_F(DmTest, IsDmBlockDevice) {
     unique_fd tmp(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp, 0);
     LoopDevice loop(tmp, 10s);
@@ -580,7 +605,7 @@
     ASSERT_FALSE(dm.IsDmBlockDevice(loop.device()));
 }
 
-TEST(libdm, GetDmDeviceNameByPath) {
+TEST_F(DmTest, GetDmDeviceNameByPath) {
     unique_fd tmp(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp, 0);
     LoopDevice loop(tmp, 10s);
@@ -601,7 +626,7 @@
     ASSERT_EQ("libdm-test-dm-linear", *name);
 }
 
-TEST(libdm, GetParentBlockDeviceByPath) {
+TEST_F(DmTest, GetParentBlockDeviceByPath) {
     unique_fd tmp(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp, 0);
     LoopDevice loop(tmp, 10s);
@@ -621,7 +646,7 @@
     ASSERT_EQ(loop.device(), *sub_block_device);
 }
 
-TEST(libdm, DeleteDeviceDeferredNoReferences) {
+TEST_F(DmTest, DeleteDeviceDeferredNoReferences) {
     unique_fd tmp(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp, 0);
     LoopDevice loop(tmp, 10s);
@@ -647,7 +672,7 @@
     ASSERT_EQ(ENOENT, errno);
 }
 
-TEST(libdm, DeleteDeviceDeferredWaitsForLastReference) {
+TEST_F(DmTest, DeleteDeviceDeferredWaitsForLastReference) {
     unique_fd tmp(CreateTempFile("file_1", 4096));
     ASSERT_GE(tmp, 0);
     LoopDevice loop(tmp, 10s);
@@ -682,7 +707,7 @@
     ASSERT_EQ(ENOENT, errno);
 }
 
-TEST(libdm, CreateEmptyDevice) {
+TEST_F(DmTest, CreateEmptyDevice) {
     DeviceMapper& dm = DeviceMapper::Instance();
     ASSERT_TRUE(dm.CreateEmptyDevice("empty-device"));
     auto guard =
@@ -692,9 +717,7 @@
     ASSERT_EQ(DmDeviceState::SUSPENDED, dm.GetState("empty-device"));
 }
 
-TEST(libdm, UeventAfterLoadTable) {
-    static const char* kDeviceName = "libdm-test-uevent-load-table";
-
+TEST_F(DmTest, UeventAfterLoadTable) {
     struct utsname u;
     ASSERT_EQ(uname(&u), 0);
 
@@ -706,18 +729,31 @@
     }
 
     DeviceMapper& dm = DeviceMapper::Instance();
-    ASSERT_TRUE(dm.CreateEmptyDevice(kDeviceName));
+    ASSERT_TRUE(dm.CreateEmptyDevice(test_name_));
 
     DmTable table;
     table.Emplace<DmTargetError>(0, 1);
-    ASSERT_TRUE(dm.LoadTable(kDeviceName, table));
+    ASSERT_TRUE(dm.LoadTable(test_name_, table));
 
     std::string ignore_path;
-    ASSERT_TRUE(dm.WaitForDevice(kDeviceName, 5s, &ignore_path));
+    ASSERT_TRUE(dm.WaitForDevice(test_name_, 5s, &ignore_path));
 
-    auto info = dm.GetDetailedInfo(kDeviceName);
+    auto info = dm.GetDetailedInfo(test_name_);
     ASSERT_TRUE(info.has_value());
     ASSERT_TRUE(info->IsSuspended());
 
-    ASSERT_TRUE(dm.DeleteDevice(kDeviceName));
+    ASSERT_TRUE(dm.DeleteDevice(test_name_));
+}
+
+TEST_F(DmTest, GetNameAndUuid) {
+    auto& dm = DeviceMapper::Instance();
+    ASSERT_TRUE(dm.CreatePlaceholderDevice(test_name_));
+
+    dev_t dev;
+    ASSERT_TRUE(dm.GetDeviceNumber(test_name_, &dev));
+
+    std::string name, uuid;
+    ASSERT_TRUE(dm.GetDeviceNameAndUuid(dev, &name, &uuid));
+    ASSERT_EQ(name, test_name_);
+    ASSERT_FALSE(uuid.empty());
 }
diff --git a/fs_mgr/libdm/include/libdm/dm.h b/fs_mgr/libdm/include/libdm/dm.h
index dbef8f9..3e7ecc6 100644
--- a/fs_mgr/libdm/include/libdm/dm.h
+++ b/fs_mgr/libdm/include/libdm/dm.h
@@ -298,6 +298,8 @@
     // a placeholder table containing dm-error.
     bool CreatePlaceholderDevice(const std::string& name);
 
+    bool GetDeviceNameAndUuid(dev_t dev, std::string* name, std::string* uuid);
+
   private:
     // Maximum possible device mapper targets registered in the kernel.
     // This is only used to read the list of targets from kernel so we allocate
diff --git a/fs_mgr/libfiemap/fiemap_writer.cpp b/fs_mgr/libfiemap/fiemap_writer.cpp
index 275388e..06e210e 100644
--- a/fs_mgr/libfiemap/fiemap_writer.cpp
+++ b/fs_mgr/libfiemap/fiemap_writer.cpp
@@ -458,9 +458,34 @@
             return FiemapStatus::Error();
     }
 
-    if (fallocate(file_fd, 0, 0, file_size)) {
-        PLOG(ERROR) << "Failed to allocate space for file: " << file_path << " size: " << file_size;
-        return FiemapStatus::FromErrno(errno);
+    // F2FS can return EAGAIN and partially fallocate. Keep trying to fallocate,
+    // and if we don't make forward progress, return ENOSPC.
+    std::optional<off_t> prev_size;
+    while (true) {
+        if (fallocate(file_fd, 0, 0, file_size) == 0) {
+            break;
+        }
+        if (errno != EAGAIN) {
+            PLOG(ERROR) << "Failed to allocate space for file: " << file_path
+                        << " size: " << file_size;
+            return FiemapStatus::FromErrno(errno);
+        }
+
+        struct stat s;
+        if (fstat(file_fd, &s) < 0) {
+            PLOG(ERROR) << "Failed to fstat after fallocate failure: " << file_path;
+            return FiemapStatus::FromErrno(errno);
+        }
+        if (!prev_size) {
+            prev_size = {s.st_size};
+            continue;
+        }
+        if (*prev_size >= s.st_size) {
+            LOG(ERROR) << "Fallocate retry failed, got " << s.st_size << ", asked for "
+                       << file_size;
+            return FiemapStatus(FiemapStatus::ErrorCode::NO_SPACE);
+        }
+        LOG(INFO) << "Retrying fallocate, got " << s.st_size << ", asked for " << file_size;
     }
 
     if (need_explicit_writes) {
diff --git a/fs_mgr/libfiemap/include/libfiemap/fiemap_status.h b/fs_mgr/libfiemap/include/libfiemap/fiemap_status.h
index d7b2cf1..1365ba4 100644
--- a/fs_mgr/libfiemap/include/libfiemap/fiemap_status.h
+++ b/fs_mgr/libfiemap/include/libfiemap/fiemap_status.h
@@ -56,8 +56,7 @@
     // For logging and debugging only.
     std::string string() const;
 
-  protected:
-    FiemapStatus(ErrorCode code) : error_code_(code) {}
+    explicit FiemapStatus(ErrorCode code) : error_code_(code) {}
 
   private:
     ErrorCode error_code_;
diff --git a/fs_mgr/libsnapshot/Android.bp b/fs_mgr/libsnapshot/Android.bp
index 3dd1f1a..d3bd904 100644
--- a/fs_mgr/libsnapshot/Android.bp
+++ b/fs_mgr/libsnapshot/Android.bp
@@ -163,6 +163,7 @@
         "libbrotli",
         "libz",
         "liblz4",
+        "libzstd",
     ],
     export_include_dirs: ["include"],
 }
diff --git a/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h b/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
index 6baf4be..c3ca00a 100644
--- a/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
+++ b/fs_mgr/libsnapshot/include/libsnapshot/cow_format.h
@@ -157,7 +157,8 @@
     kCowCompressNone = 0,
     kCowCompressGz = 1,
     kCowCompressBrotli = 2,
-    kCowCompressLz4 = 3
+    kCowCompressLz4 = 3,
+    kCowCompressZstd = 4,
 };
 
 static constexpr uint8_t kCowReadAheadNotStarted = 0;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_compress.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/cow_compress.cpp
index d06c904..a4a0ad6 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_compress.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_compress.cpp
@@ -29,6 +29,7 @@
 #include <libsnapshot/cow_writer.h>
 #include <lz4.h>
 #include <zlib.h>
+#include <zstd.h>
 
 namespace android {
 namespace snapshot {
@@ -40,6 +41,8 @@
         return {kCowCompressBrotli};
     } else if (name == "lz4") {
         return {kCowCompressLz4};
+    } else if (name == "zstd") {
+        return {kCowCompressZstd};
     } else if (name == "none" || name.empty()) {
         return {kCowCompressNone};
     } else {
@@ -112,6 +115,23 @@
             }
             return buffer;
         }
+        case kCowCompressZstd: {
+            std::basic_string<uint8_t> buffer(ZSTD_compressBound(length), '\0');
+            const auto compressed_size =
+                    ZSTD_compress(buffer.data(), buffer.size(), data, length, 0);
+            if (compressed_size <= 0) {
+                LOG(ERROR) << "ZSTD compression failed " << compressed_size;
+                return {};
+            }
+            // Don't run compression if the compressed output is larger
+            if (compressed_size >= length) {
+                buffer.resize(length);
+                memcpy(buffer.data(), data, length);
+            } else {
+                buffer.resize(compressed_size);
+            }
+            return buffer;
+        }
         default:
             LOG(ERROR) << "unhandled compression type: " << compression;
             break;
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.cpp
index 3d34413..da90cc0 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.cpp
@@ -17,12 +17,15 @@
 #include "cow_decompress.h"
 
 #include <array>
+#include <cstring>
 #include <utility>
+#include <vector>
 
 #include <android-base/logging.h>
 #include <brotli/decode.h>
 #include <lz4.h>
 #include <zlib.h>
+#include <zstd.h>
 
 namespace android {
 namespace snapshot {
@@ -336,9 +339,56 @@
     }
 };
 
+class ZstdDecompressor final : public IDecompressor {
+  public:
+    ssize_t Decompress(void* buffer, size_t buffer_size, size_t decompressed_size,
+                       size_t ignore_bytes = 0) override {
+        if (buffer_size < decompressed_size - ignore_bytes) {
+            LOG(INFO) << "buffer size " << buffer_size
+                      << " is not large enough to hold decompressed data. Decompressed size "
+                      << decompressed_size << ", ignore_bytes " << ignore_bytes;
+            return -1;
+        }
+        if (ignore_bytes == 0) {
+            if (!Decompress(buffer, decompressed_size)) {
+                return -1;
+            }
+            return decompressed_size;
+        }
+        std::vector<unsigned char> ignore_buf(decompressed_size);
+        if (!Decompress(buffer, decompressed_size)) {
+            return -1;
+        }
+        memcpy(buffer, ignore_buf.data() + ignore_bytes, buffer_size);
+        return decompressed_size;
+    }
+    bool Decompress(void* output_buffer, const size_t output_size) {
+        std::string input_buffer;
+        input_buffer.resize(stream_->Size());
+        size_t bytes_read = stream_->Read(input_buffer.data(), input_buffer.size());
+        if (bytes_read != input_buffer.size()) {
+            LOG(ERROR) << "Failed to read all input at once. Expected: " << input_buffer.size()
+                       << " actual: " << bytes_read;
+            return false;
+        }
+        const auto bytes_decompressed = ZSTD_decompress(output_buffer, output_size,
+                                                        input_buffer.data(), input_buffer.size());
+        if (bytes_decompressed != output_size) {
+            LOG(ERROR) << "Failed to decompress ZSTD block, expected output size: " << output_size
+                       << ", actual: " << bytes_decompressed;
+            return false;
+        }
+        return true;
+    }
+};
+
 std::unique_ptr<IDecompressor> IDecompressor::Lz4() {
     return std::make_unique<Lz4Decompressor>();
 }
 
+std::unique_ptr<IDecompressor> IDecompressor::Zstd() {
+    return std::make_unique<ZstdDecompressor>();
+}
+
 }  // namespace snapshot
 }  // namespace android
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.h b/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.h
index 9e83f3c..52b3d76 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.h
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_decompress.h
@@ -47,6 +47,7 @@
     static std::unique_ptr<IDecompressor> Gz();
     static std::unique_ptr<IDecompressor> Brotli();
     static std::unique_ptr<IDecompressor> Lz4();
+    static std::unique_ptr<IDecompressor> Zstd();
 
     static std::unique_ptr<IDecompressor> FromString(std::string_view compressor);
 
diff --git a/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp b/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
index 4c5a8bf..6749cf1 100644
--- a/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
+++ b/fs_mgr/libsnapshot/libsnapshot_cow/cow_reader.cpp
@@ -30,6 +30,7 @@
 #include <zlib.h>
 
 #include "cow_decompress.h"
+#include "libsnapshot/cow_format.h"
 
 namespace android {
 namespace snapshot {
@@ -777,6 +778,11 @@
         case kCowCompressBrotli:
             decompressor = IDecompressor::Brotli();
             break;
+        case kCowCompressZstd:
+            if (header_.block_size != op->data_length) {
+                decompressor = IDecompressor::Zstd();
+            }
+            break;
         case kCowCompressLz4:
             if (header_.block_size != op->data_length) {
                 decompressor = IDecompressor::Lz4();
diff --git a/fs_mgr/libsnapshot/snapuserd/Android.bp b/fs_mgr/libsnapshot/snapuserd/Android.bp
index 1e03683..9fe567a 100644
--- a/fs_mgr/libsnapshot/snapuserd/Android.bp
+++ b/fs_mgr/libsnapshot/snapuserd/Android.bp
@@ -112,6 +112,7 @@
         "liblz4",
         "libext4_utils",
         "liburing",
+        "libzstd",
     ],
 
     header_libs: [
diff --git a/gatekeeperd/gatekeeperd.cpp b/gatekeeperd/gatekeeperd.cpp
index e5241b5..7987167 100644
--- a/gatekeeperd/gatekeeperd.cpp
+++ b/gatekeeperd/gatekeeperd.cpp
@@ -144,14 +144,22 @@
     }
 }
 
-uint32_t GateKeeperProxy::adjust_userId(uint32_t userId) {
+Status GateKeeperProxy::adjust_userId(uint32_t userId, uint32_t* hw_userId) {
     static constexpr uint32_t kGsiOffset = 1000000;
-    CHECK(userId < kGsiOffset);
-    CHECK((aidl_hw_device != nullptr) || (hw_device != nullptr));
-    if (is_running_gsi) {
-        return userId + kGsiOffset;
+    if (userId >= kGsiOffset) {
+        return Status::fromExceptionCode(Status::EX_ILLEGAL_ARGUMENT);
     }
-    return userId;
+
+    if ((aidl_hw_device == nullptr) && (hw_device == nullptr)) {
+        return Status::fromExceptionCode(Status::EX_ILLEGAL_STATE);
+    }
+
+    if (is_running_gsi) {
+        *hw_userId = userId + kGsiOffset;
+        return Status::ok();
+    }
+    *hw_userId = userId;
+    return Status::ok();
 }
 
 #define GK_ERROR *gkResponse = GKResponse::error(), Status::ok()
@@ -201,7 +209,12 @@
     android::hardware::hidl_vec<uint8_t> newPwd;
     newPwd.setToExternal(const_cast<uint8_t*>(desiredPassword.data()), desiredPassword.size());
 
-    uint32_t hw_userId = adjust_userId(userId);
+    uint32_t hw_userId = 0;
+    Status result = adjust_userId(userId, &hw_userId);
+    if (!result.isOk()) {
+        return result;
+    }
+
     uint64_t secureUserId = 0;
     if (aidl_hw_device) {
         // AIDL gatekeeper service
@@ -300,7 +313,12 @@
         }
     }
 
-    uint32_t hw_userId = adjust_userId(userId);
+    uint32_t hw_userId = 0;
+    Status result = adjust_userId(userId, &hw_userId);
+    if (!result.isOk()) {
+        return result;
+    }
+
     android::hardware::hidl_vec<uint8_t> curPwdHandle;
     curPwdHandle.setToExternal(const_cast<uint8_t*>(enrolledPasswordHandle.data()),
                                enrolledPasswordHandle.size());
@@ -410,7 +428,12 @@
     }
     clear_sid(userId);
 
-    uint32_t hw_userId = adjust_userId(userId);
+    uint32_t hw_userId = 0;
+    Status result = adjust_userId(userId, &hw_userId);
+    if (!result.isOk()) {
+        return result;
+    }
+
     if (aidl_hw_device) {
         aidl_hw_device->deleteUser(hw_userId);
     } else if (hw_device) {
diff --git a/gatekeeperd/gatekeeperd.h b/gatekeeperd/gatekeeperd.h
index 29873da..b1f08c6 100644
--- a/gatekeeperd/gatekeeperd.h
+++ b/gatekeeperd/gatekeeperd.h
@@ -47,7 +47,7 @@
 
     // This should only be called on userIds being passed to the GateKeeper HAL. It ensures that
     // secure storage shared across a GSI image and a host image will not overlap.
-    uint32_t adjust_userId(uint32_t userId);
+    Status adjust_userId(uint32_t userId, uint32_t* hw_userId);
 
 #define GK_ERROR *gkResponse = GKResponse::error(), Status::ok()
 
diff --git a/healthd/BatteryMonitor.cpp b/healthd/BatteryMonitor.cpp
index f68d65a..bd7955a 100644
--- a/healthd/BatteryMonitor.cpp
+++ b/healthd/BatteryMonitor.cpp
@@ -244,6 +244,8 @@
         value = BatteryHealth::UNSPECIFIED_FAILURE;
     else if (status == BatteryMonitor::BH_NOT_AVAILABLE)
         value = BatteryHealth::NOT_AVAILABLE;
+    else if (status == BatteryMonitor::BH_INCONSISTENT)
+        value = BatteryHealth::INCONSISTENT;
     else
         value = BatteryHealth::UNKNOWN;
 
diff --git a/healthd/include/healthd/BatteryMonitor.h b/healthd/include/healthd/BatteryMonitor.h
index a4c013b..e9998ba 100644
--- a/healthd/include/healthd/BatteryMonitor.h
+++ b/healthd/include/healthd/BatteryMonitor.h
@@ -63,6 +63,7 @@
         BH_NEEDS_REPLACEMENT,
         BH_FAILED,
         BH_NOT_AVAILABLE,
+        BH_INCONSISTENT,
     };
 
     BatteryMonitor();
diff --git a/init/Android.bp b/init/Android.bp
index 7b52903..41c7a95 100644
--- a/init/Android.bp
+++ b/init/Android.bp
@@ -169,6 +169,7 @@
         "libfsverity_init",
         "liblmkd_utils",
         "liblz4",
+        "libzstd",
         "libmini_keyctl_static",
         "libmodprobe",
         "libprocinfo",
@@ -370,6 +371,7 @@
         "libprotobuf-cpp-lite",
         "libsnapshot_cow",
         "liblz4",
+        "libzstd",
         "libsnapshot_init",
         "update_metadata-protos",
         "libprocinfo",
diff --git a/init/devices.cpp b/init/devices.cpp
index 39442a0..d29ffd6 100644
--- a/init/devices.cpp
+++ b/init/devices.cpp
@@ -32,6 +32,7 @@
 #include <android-base/logging.h>
 #include <android-base/stringprintf.h>
 #include <android-base/strings.h>
+#include <libdm/dm.h>
 #include <private/android_filesystem_config.h>
 #include <selinux/android.h>
 #include <selinux/selinux.h>
@@ -112,17 +113,14 @@
 // the supplied buffer with the dm module's instantiated name.
 // If it doesn't start with a virtual block device, or there is some
 // error, return false.
-static bool FindDmDevice(const std::string& path, std::string* name, std::string* uuid) {
-    if (!StartsWith(path, "/devices/virtual/block/dm-")) return false;
+static bool FindDmDevice(const Uevent& uevent, std::string* name, std::string* uuid) {
+    if (!StartsWith(uevent.path, "/devices/virtual/block/dm-")) return false;
+    if (uevent.action == "remove") return false;  // Avoid error spam from ioctl
 
-    if (!ReadFileToString("/sys" + path + "/dm/name", name)) {
-        return false;
-    }
-    ReadFileToString("/sys" + path + "/dm/uuid", uuid);
+    dev_t dev = makedev(uevent.major, uevent.minor);
 
-    *name = android::base::Trim(*name);
-    *uuid = android::base::Trim(*uuid);
-    return true;
+    auto& dm = android::dm::DeviceMapper::Instance();
+    return dm.GetDeviceNameAndUuid(dev, name, uuid);
 }
 
 Permissions::Permissions(const std::string& name, mode_t perm, uid_t uid, gid_t gid,
@@ -392,7 +390,7 @@
         type = "pci";
     } else if (FindVbdDevicePrefix(uevent.path, &device)) {
         type = "vbd";
-    } else if (FindDmDevice(uevent.path, &partition, &uuid)) {
+    } else if (FindDmDevice(uevent, &partition, &uuid)) {
         std::vector<std::string> symlinks = {"/dev/block/mapper/" + partition};
         if (!uuid.empty()) {
             symlinks.emplace_back("/dev/block/mapper/by-uuid/" + uuid);
diff --git a/init/firmware_handler.cpp b/init/firmware_handler.cpp
index b9fa58c..3c012fe 100644
--- a/init/firmware_handler.cpp
+++ b/init/firmware_handler.cpp
@@ -33,6 +33,7 @@
 #include <android-base/chrono_utils.h>
 #include <android-base/file.h>
 #include <android-base/logging.h>
+#include <android-base/properties.h>
 #include <android-base/scopeguard.h>
 #include <android-base/strings.h>
 #include <android-base/unique_fd.h>
@@ -43,6 +44,7 @@
 using android::base::Timer;
 using android::base::Trim;
 using android::base::unique_fd;
+using android::base::WaitForProperty;
 using android::base::WriteFully;
 
 namespace android {
@@ -82,6 +84,33 @@
     return access("/dev/.booting", F_OK) == 0;
 }
 
+static bool IsApexActivated() {
+    static bool apex_activated = []() {
+        // Wait for com.android.runtime.apex activation
+        // Property name and value must be kept in sync with system/apexd/apex/apex_constants.h
+        // 60s is the default firmware sysfs fallback timeout. (/sys/class/firmware/timeout)
+        if (!WaitForProperty("apexd.status", "activated", 60s)) {
+            LOG(ERROR) << "Apexd activation wait timeout";
+            return false;
+        }
+        return true;
+    }();
+
+    return apex_activated;
+}
+
+static bool NeedsRerunExternalHandler() {
+    static bool first = true;
+
+    // Rerun external handler only on the first try and when apex is activated
+    if (first) {
+        first = false;
+        return IsApexActivated();
+    }
+
+    return first;
+}
+
 ExternalFirmwareHandler::ExternalFirmwareHandler(std::string devpath, uid_t uid, gid_t gid,
                                                  std::string handler_path)
     : devpath(std::move(devpath)), uid(uid), gid(gid), handler_path(std::move(handler_path)) {
@@ -210,6 +239,11 @@
 
             auto result = RunExternalHandler(external_handler.handler_path, external_handler.uid,
                                              external_handler.gid, uevent);
+            if (!result.ok() && NeedsRerunExternalHandler()) {
+                auto res = RunExternalHandler(external_handler.handler_path, external_handler.uid,
+                                              external_handler.gid, uevent);
+                result = std::move(res);
+            }
             if (!result.ok()) {
                 LOG(ERROR) << "Using default firmware; External firmware handler failed: "
                            << result.error();
diff --git a/init/init.cpp b/init/init.cpp
index be1ebee..da63fdc 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -1043,6 +1043,12 @@
     SetProperty(gsi::kGsiBootedProp, is_running);
     auto is_installed = android::gsi::IsGsiInstalled() ? "1" : "0";
     SetProperty(gsi::kGsiInstalledProp, is_installed);
+    if (android::gsi::IsGsiRunning()) {
+        std::string dsu_slot;
+        if (android::gsi::GetActiveDsu(&dsu_slot)) {
+            SetProperty(gsi::kDsuSlotProp, dsu_slot);
+        }
+    }
 
     am.QueueBuiltinAction(SetupCgroupsAction, "SetupCgroups");
     am.QueueBuiltinAction(SetKptrRestrictAction, "SetKptrRestrict");
diff --git a/init/test_kill_services/init_kill_services_test.cpp b/init/test_kill_services/init_kill_services_test.cpp
index 5355703..d9fcd9d 100644
--- a/init/test_kill_services/init_kill_services_test.cpp
+++ b/init/test_kill_services/init_kill_services_test.cpp
@@ -16,14 +16,23 @@
 
 #include <gtest/gtest.h>
 
+#include <android-base/logging.h>
 #include <android-base/properties.h>
 
 #include <iostream>
 
 using ::android::base::GetProperty;
 using ::android::base::SetProperty;
+using ::android::base::WaitForProperty;
+using std::literals::chrono_literals::operator""s;
 
 void ExpectKillingServiceRecovers(const std::string& service_name) {
+    // b/280514080 - servicemanager will restart apexd, and apexd will restart the
+    // system when crashed. This is fine as the device recovers, but it causes
+    // flakes in this test.
+    ASSERT_TRUE(WaitForProperty("init.svc.apexd", "stopped", 60s)) << "apexd won't stop";
+
+    LOG(INFO) << "hello " << service_name << "!";
     const std::string status_prop = "init.svc." + service_name;
     const std::string pid_prop = "init.svc_debug_pid." + service_name;
 
@@ -32,6 +41,7 @@
     ASSERT_EQ("running", GetProperty(status_prop, "")) << status_prop;
     ASSERT_NE("", initial_pid) << pid_prop;
 
+    LOG(INFO) << "okay, now goodbye " << service_name;
     EXPECT_EQ(0, system(("kill -9 " + initial_pid).c_str()));
 
     constexpr size_t kMaxWaitMilliseconds = 10000;
@@ -42,11 +52,16 @@
     for (size_t retry = 0; retry < kRetryTimes; retry++) {
         const std::string& pid = GetProperty(pid_prop, "");
         if (pid != initial_pid && pid != "") break;
+        LOG(INFO) << "I said goodbye " << service_name << "!";
         usleep(kRetryWaitMilliseconds * 1000);
     }
 
+    LOG(INFO) << "are you still there " << service_name << "?";
+
     // svc_debug_pid is set after svc property
     EXPECT_EQ("running", GetProperty(status_prop, ""));
+
+    LOG(INFO) << "I'm done with " << service_name;
 }
 
 class InitKillServicesTest : public ::testing::TestWithParam<std::string> {};
diff --git a/libdiskconfig/Android.bp b/libdiskconfig/Android.bp
deleted file mode 100644
index f523d4e..0000000
--- a/libdiskconfig/Android.bp
+++ /dev/null
@@ -1,36 +0,0 @@
-package {
-    default_applicable_licenses: ["Android-Apache-2.0"],
-}
-
-cc_library {
-    name: "libdiskconfig",
-    vendor_available: true,
-    vndk: {
-        enabled: true,
-    },
-    srcs: [
-        "diskconfig.c",
-        "diskutils.c",
-        "write_lst.c",
-        "config_mbr.c",
-    ],
-
-    shared_libs: [
-        "libcutils",
-        "liblog",
-    ],
-    cflags: ["-Werror"],
-    export_include_dirs: ["include"],
-    local_include_dirs: ["include"],
-
-    target: {
-        darwin: {
-            enabled: false,
-        },
-        host_linux: {
-            cflags: [
-                "-D_LARGEFILE64_SOURCE",
-            ],
-        },
-    },
-}
diff --git a/libdiskconfig/config_mbr.c b/libdiskconfig/config_mbr.c
deleted file mode 100644
index ace9bbf..0000000
--- a/libdiskconfig/config_mbr.c
+++ /dev/null
@@ -1,351 +0,0 @@
-/* libs/diskconfig/diskconfig.c
- *
- * Copyright 2008, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "config_mbr"
-
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <diskconfig/diskconfig.h>
-#include <log/log.h>
-
-/* start and len are in LBA units */
-static void
-cfg_pentry(struct pc_partition *pentry, uint8_t status, uint8_t type,
-           uint32_t start, uint32_t len)
-{
-    if (len > 0) {
-        /* seems that somes BIOSens can get wedged on boot while verifying
-         * the mbr if these are 0 */
-        memset(&pentry->start, 0xff, sizeof(struct chs));
-        memset(&pentry->end, 0xff, sizeof(struct chs));
-    } else {
-        /* zero out the c/h/s entries.. they are not used */
-        memset(&pentry->start, 0, sizeof(struct chs));
-        memset(&pentry->end, 0, sizeof(struct chs));
-    }
-
-    pentry->status = status;
-    pentry->type = type;
-    pentry->start_lba = start;
-    pentry->len_lba = len;
-
-    ALOGI("Configuring pentry. status=0x%x type=0x%x start_lba=%u len_lba=%u",
-         pentry->status, pentry->type, pentry->start_lba, pentry->len_lba);
-}
-
-
-static inline uint32_t
-kb_to_lba(uint32_t len_kb, uint32_t sect_size)
-{
-    uint64_t lba;
-
-    lba = (uint64_t)len_kb * 1024;
-    /* bump it up to the next LBA boundary just in case  */
-    lba = (lba + (uint64_t)sect_size - 1) & ~((uint64_t)sect_size - 1);
-    lba /= (uint64_t)sect_size;
-    if (lba >= 0xffffffffULL)
-        ALOGE("Error converting kb -> lba. 32bit overflow, expect weirdness");
-    return (uint32_t)(lba & 0xffffffffULL);
-}
-
-
-static struct write_list *
-mk_pri_pentry(struct disk_info *dinfo, struct part_info *pinfo, int pnum,
-              uint32_t *lba)
-{
-    struct write_list *item;
-    struct pc_partition *pentry;
-
-    if (pnum >= PC_NUM_BOOT_RECORD_PARTS) {
-        ALOGE("Maximum number of primary partition exceeded.");
-        return NULL;
-    }
-
-    if (!(item = alloc_wl(sizeof(struct pc_partition)))) {
-        ALOGE("Unable to allocate memory for partition entry.");
-        return NULL;
-    }
-
-    {
-        /* DO NOT DEREFERENCE */
-        struct pc_boot_record *mbr = (void *)PC_MBR_DISK_OFFSET; 
-        /* grab the offset in mbr where to write this partition entry. */
-        item->offset = (loff_t)((uintptr_t)((uint8_t *)(&mbr->ptable[pnum])));
-    }
-
-    pentry = (struct pc_partition *) &item->data;
-
-    /* need a standard primary partition entry */
-    if (pinfo) {
-        /* need this to be 64 bit in case len_kb is large */
-        uint64_t len_lba; 
-
-        if (pinfo->len_kb != (uint32_t)-1) {
-            /* bump it up to the next LBA boundary just in case */
-            len_lba = ((uint64_t)pinfo->len_kb * 1024);
-            len_lba += ((uint64_t)dinfo->sect_size - 1);
-            len_lba &= ~((uint64_t)dinfo->sect_size - 1);
-            len_lba /= (uint64_t)dinfo->sect_size;
-        } else {
-            /* make it fill the rest of disk */
-            len_lba = dinfo->num_lba - *lba;
-        }
-
-        cfg_pentry(pentry, ((pinfo->flags & PART_ACTIVE_FLAG) ?
-                            PC_PART_ACTIVE : PC_PART_NORMAL),
-                   pinfo->type, *lba, (uint32_t)len_lba);
-
-        pinfo->start_lba = *lba;
-        *lba += (uint32_t)len_lba;
-    } else {
-        /* this should be made an extended partition, and should take
-         * up the rest of the disk as a primary partition */
-        cfg_pentry(pentry, PC_PART_NORMAL, PC_PART_TYPE_EXTENDED,
-                   *lba, dinfo->num_lba - *lba);
-
-        /* note that we do not update the *lba because we now have to
-         * create a chain of extended partition tables, and first one is at
-         * *lba */
-    }
-
-    return item;
-}
-
-
-/* This function configures an extended boot record at the beginning of an
- * extended partition. This creates a logical partition and a pointer to
- * the next EBR.
- *
- * ext_lba == The start of the toplevel extended partition (pointed to by the
- * entry in the MBR).
- */
-static struct write_list *
-mk_ext_pentry(struct disk_info *dinfo, struct part_info *pinfo, uint32_t *lba,
-              uint32_t ext_lba, struct part_info *pnext)
-{
-    struct write_list *item;
-    struct pc_boot_record *ebr;
-    uint32_t len; /* in lba units */
-
-    if (!(item = alloc_wl(sizeof(struct pc_boot_record)))) {
-        ALOGE("Unable to allocate memory for EBR.");
-        return NULL;
-    }
-
-    /* we are going to write the ebr at the current LBA, and then bump the
-     * lba counter since that is where the logical data partition will start */
-    item->offset = ((loff_t)(*lba)) * dinfo->sect_size;
-    (*lba)++;
-
-    ebr = (struct pc_boot_record *) &item->data;
-    memset(ebr, 0, sizeof(struct pc_boot_record));
-    ebr->mbr_sig = PC_BIOS_BOOT_SIG;
-
-    if (pinfo->len_kb != (uint32_t)-1)
-        len = kb_to_lba(pinfo->len_kb, dinfo->sect_size);
-    else {
-        if (pnext) {
-            ALOGE("Only the last partition can be specified to fill the disk "
-                 "(name = '%s')", pinfo->name);
-            goto fail;
-        }
-        len = dinfo->num_lba - *lba;
-        /* update the pinfo structure to reflect the new size, for
-         * bookkeeping */
-        pinfo->len_kb =
-            (uint32_t)(((uint64_t)len * (uint64_t)dinfo->sect_size) /
-                       ((uint64_t)1024));
-    }
-
-    cfg_pentry(&ebr->ptable[PC_EBR_LOGICAL_PART], PC_PART_NORMAL,
-               pinfo->type, 1, len);
-
-    pinfo->start_lba = *lba;
-    *lba += len;
-
-    /* If this is not the last partition, we have to create a link to the
-     * next extended partition.
-     *
-     * Otherwise, there's nothing to do since the "pointer entry" is
-     * already zero-filled.
-     */
-    if (pnext) {
-        /* The start lba for next partition is an offset from the beginning
-         * of the top-level extended partition */
-        uint32_t next_start_lba = *lba - ext_lba;
-        uint32_t next_len_lba;
-        if (pnext->len_kb != (uint32_t)-1)
-            next_len_lba = 1 + kb_to_lba(pnext->len_kb, dinfo->sect_size);
-        else
-            next_len_lba = dinfo->num_lba - *lba;
-        cfg_pentry(&ebr->ptable[PC_EBR_NEXT_PTR_PART], PC_PART_NORMAL,
-                   PC_PART_TYPE_EXTENDED, next_start_lba, next_len_lba);
-    }
-
-    return item;
-
-fail:
-    free_wl(item);
-    return NULL;
-}
-
-
-static struct write_list *
-mk_mbr_sig()
-{
-    struct write_list *item;
-    if (!(item = alloc_wl(sizeof(uint16_t)))) {
-        ALOGE("Unable to allocate memory for MBR signature.");
-        return NULL;
-    }
-
-    {
-        /* DO NOT DEREFERENCE */
-        struct pc_boot_record *mbr = (void *)PC_MBR_DISK_OFFSET;
-        /* grab the offset in mbr where to write mbr signature. */
-        item->offset = (loff_t)((uintptr_t)((uint8_t *)(&mbr->mbr_sig)));
-    }
-
-    *((uint16_t*)item->data) = PC_BIOS_BOOT_SIG;
-    return item;
-}
-
-struct write_list *
-config_mbr(struct disk_info *dinfo)
-{
-    struct part_info *pinfo;
-    uint32_t cur_lba = dinfo->skip_lba;
-    uint32_t ext_lba = 0;
-    struct write_list *wr_list = NULL;
-    struct write_list *temp_wr = NULL;
-    int cnt = 0;
-    int extended = 0;
-
-    if (!dinfo->part_lst)
-        return NULL;
-
-    for (cnt = 0; cnt < dinfo->num_parts; ++cnt) {
-        pinfo = &dinfo->part_lst[cnt];
-
-        /* Should we create an extedned partition? */
-        if (cnt == (PC_NUM_BOOT_RECORD_PARTS - 1)) {
-            if (cnt + 1 < dinfo->num_parts) {
-                extended = 1;
-                ext_lba = cur_lba;
-                if ((temp_wr = mk_pri_pentry(dinfo, NULL, cnt, &cur_lba)))
-                    wlist_add(&wr_list, temp_wr);
-                else {
-                    ALOGE("Cannot create primary extended partition.");
-                    goto fail;
-                }
-            }
-        }
-
-        /* if extended, need 1 lba for ebr */
-        if ((cur_lba + extended) >= dinfo->num_lba)
-            goto nospace;
-        else if (pinfo->len_kb != (uint32_t)-1) {
-            uint32_t sz_lba = (pinfo->len_kb / dinfo->sect_size) * 1024;
-            if ((cur_lba + sz_lba + extended) > dinfo->num_lba)
-                goto nospace;
-        }
-
-        if (!extended)
-            temp_wr = mk_pri_pentry(dinfo, pinfo, cnt, &cur_lba);
-        else {
-            struct part_info *pnext;
-            pnext = cnt + 1 < dinfo->num_parts ? &dinfo->part_lst[cnt+1] : NULL;
-            temp_wr = mk_ext_pentry(dinfo, pinfo, &cur_lba, ext_lba, pnext);
-        }
-
-        if (temp_wr)
-            wlist_add(&wr_list, temp_wr);
-        else {
-            ALOGE("Cannot create partition %d (%s).", cnt, pinfo->name);
-            goto fail;
-        }
-    }
-
-    /* fill in the rest of the MBR with empty parts (if needed). */
-    for (; cnt < PC_NUM_BOOT_RECORD_PARTS; ++cnt) {
-        struct part_info blank;
-        cur_lba = 0;
-        memset(&blank, 0, sizeof(struct part_info));
-        if (!(temp_wr = mk_pri_pentry(dinfo, &blank, cnt, &cur_lba))) {
-            ALOGE("Cannot create blank partition %d.", cnt);
-            goto fail;
-        }
-        wlist_add(&wr_list, temp_wr);
-    }
-
-    if ((temp_wr = mk_mbr_sig()))
-        wlist_add(&wr_list, temp_wr);
-    else {
-        ALOGE("Cannot set MBR signature");
-        goto fail;
-    }
-
-    return wr_list;
-
-nospace:
-    ALOGE("Not enough space to add parttion '%s'.", pinfo->name);
-
-fail:
-    wlist_free(wr_list);
-    return NULL;
-}
-
-
-/* Returns the device path of the partition referred to by 'name'
- * Must be freed by the caller.
- */
-char *
-find_mbr_part(struct disk_info *dinfo, const char *name)
-{
-    struct part_info *plist = dinfo->part_lst;
-    int num = 0;
-    char *dev_name = NULL;
-    int has_extended = (dinfo->num_parts > PC_NUM_BOOT_RECORD_PARTS);
-
-    for(num = 1; num <= dinfo->num_parts; ++num) {
-        if (!strcmp(plist[num-1].name, name))
-            break;
-    }
-
-    if (num > dinfo->num_parts)
-        return NULL;
-
-    if (has_extended && (num >= PC_NUM_BOOT_RECORD_PARTS))
-        num++;
-
-    if (!(dev_name = malloc(MAX_NAME_LEN))) {
-        ALOGE("Cannot allocate memory.");
-        return NULL;
-    }
-
-    num = snprintf(dev_name, MAX_NAME_LEN, "%s%d", dinfo->device, num);
-    if (num >= MAX_NAME_LEN) {
-        ALOGE("Device name is too long?!");
-        free(dev_name);
-        return NULL;
-    }
-
-    return dev_name;
-}
diff --git a/libdiskconfig/diskconfig.c b/libdiskconfig/diskconfig.c
deleted file mode 100644
index 5f34748..0000000
--- a/libdiskconfig/diskconfig.c
+++ /dev/null
@@ -1,535 +0,0 @@
-/* libs/diskconfig/diskconfig.c
- *
- * Copyright 2008, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "diskconfig"
-
-#include <errno.h>
-#include <fcntl.h>
-#include <inttypes.h>
-#include <linux/fs.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include <cutils/config_utils.h>
-#include <log/log.h>
-
-#include <diskconfig/diskconfig.h>
-
-static int
-parse_len(const char *str, uint64_t *plen)
-{
-    char tmp[64];
-    int len_str;
-    uint32_t multiple = 1;
-
-    strncpy(tmp, str, sizeof(tmp));
-    tmp[sizeof(tmp)-1] = '\0';
-    len_str = strlen(tmp);
-    if (!len_str) {
-        ALOGE("Invalid disk length specified.");
-        return 1;
-    }
-
-    switch(tmp[len_str - 1]) {
-        case 'M': case 'm':
-            /* megabyte */
-            multiple <<= 10;
-        case 'K': case 'k':
-            /* kilobytes */
-            multiple <<= 10;
-            tmp[len_str - 1] = '\0';
-            break;
-        default:
-            break;
-    }
-
-    *plen = strtoull(tmp, NULL, 0);
-    if (!*plen) {
-        ALOGE("Invalid length specified: %s", str);
-        return 1;
-    }
-
-    if (*plen == (uint64_t)-1) {
-        if (multiple > 1) {
-            ALOGE("Size modifier illegal when len is -1");
-            return 1;
-        }
-    } else {
-        /* convert len to kilobytes */
-        if (multiple > 1024)
-            multiple >>= 10;
-        *plen *= multiple;
-
-        if (*plen > 0xffffffffULL) {
-            ALOGE("Length specified is too large!: %"PRIu64" KB", *plen);
-            return 1;
-        }
-    }
-
-    return 0;
-}
-
-
-static int
-load_partitions(cnode *root, struct disk_info *dinfo)
-{
-    cnode *partnode;
-
-    dinfo->num_parts = 0;
-    for (partnode = root->first_child; partnode; partnode = partnode->next) {
-        struct part_info *pinfo = &dinfo->part_lst[dinfo->num_parts];
-        const char *tmp;
-
-        /* bleh, i will leak memory here, but i DONT CARE since
-         * the only right thing to do when this function fails
-         * is to quit */
-        pinfo->name = strdup(partnode->name);
-
-        if(config_bool(partnode, "active", 0))
-            pinfo->flags |= PART_ACTIVE_FLAG;
-
-        if (!(tmp = config_str(partnode, "type", NULL))) {
-            ALOGE("Partition type required: %s", pinfo->name);
-            return 1;
-        }
-
-        /* possible values are: linux, fat32 */
-        if (!strcmp(tmp, "linux")) {
-            pinfo->type = PC_PART_TYPE_LINUX;
-        } else if (!strcmp(tmp, "fat32")) {
-            pinfo->type = PC_PART_TYPE_FAT32;
-        } else {
-            ALOGE("Unsupported partition type found: %s", tmp);
-            return 1;
-        }
-
-        if ((tmp = config_str(partnode, "len", NULL)) != NULL) {
-            uint64_t len;
-            if (parse_len(tmp, &len))
-                return 1;
-            pinfo->len_kb = (uint32_t) len;
-        } else 
-            pinfo->len_kb = 0;
-
-        ++dinfo->num_parts;
-    }
-
-    return 0;
-}
-
-struct disk_info *
-load_diskconfig(const char *fn, char *path_override)
-{
-    struct disk_info *dinfo;
-    cnode *devroot;
-    cnode *partnode;
-    cnode *root = config_node("", "");
-    const char *tmp;
-
-    if (!(dinfo = malloc(sizeof(struct disk_info)))) {
-        ALOGE("Could not malloc disk_info");
-        return NULL;
-    }
-    memset(dinfo, 0, sizeof(struct disk_info));
-
-    if (!(dinfo->part_lst = malloc(MAX_NUM_PARTS * sizeof(struct part_info)))) {
-        ALOGE("Could not malloc part_lst");
-        goto fail;
-    }
-    memset(dinfo->part_lst, 0,
-           (MAX_NUM_PARTS * sizeof(struct part_info)));
-
-    config_load_file(root, fn);
-    if (root->first_child == NULL) {
-        ALOGE("Could not read config file %s", fn);
-        goto fail;
-    }
-
-    if (!(devroot = config_find(root, "device"))) {
-        ALOGE("Could not find device section in config file '%s'", fn);
-        goto fail;
-    }
-
-
-    if (!(tmp = config_str(devroot, "path", path_override))) {
-        ALOGE("device path is requried");
-        goto fail;
-    }
-    dinfo->device = strdup(tmp);
-
-    /* find the partition scheme */
-    if (!(tmp = config_str(devroot, "scheme", NULL))) {
-        ALOGE("partition scheme is required");
-        goto fail;
-    } else if (!strcmp(tmp, "mbr")) {
-        dinfo->scheme = PART_SCHEME_MBR;
-    } else if (!strcmp(tmp, "gpt")) {
-        ALOGE("'gpt' partition scheme not supported yet.");
-        goto fail;
-    } else {
-        ALOGE("Unknown partition scheme specified: %s", tmp);
-        goto fail;
-    }
-
-    /* grab the sector size (in bytes) */
-    tmp = config_str(devroot, "sector_size", "512");
-    dinfo->sect_size = strtol(tmp, NULL, 0);
-    if (!dinfo->sect_size) {
-        ALOGE("Invalid sector size: %s", tmp);
-        goto fail;
-    }
-
-    /* first lba where the partitions will start on disk */
-    if (!(tmp = config_str(devroot, "start_lba", NULL))) {
-        ALOGE("start_lba must be provided");
-        goto fail;
-    }
-
-    if (!(dinfo->skip_lba = strtol(tmp, NULL, 0))) {
-        ALOGE("Invalid starting LBA (or zero): %s", tmp);
-        goto fail;
-    }
-
-    /* Number of LBAs on disk */
-    if (!(tmp = config_str(devroot, "num_lba", NULL))) {
-        ALOGE("num_lba is required");
-        goto fail;
-    }
-    dinfo->num_lba = strtoul(tmp, NULL, 0);
-
-    if (!(partnode = config_find(devroot, "partitions"))) {
-        ALOGE("Device must specify partition list");
-        goto fail;
-    }
-
-    if (load_partitions(partnode, dinfo))
-        goto fail;
-
-    return dinfo;
-
-fail:
-    if (dinfo->part_lst)
-        free(dinfo->part_lst);
-    if (dinfo->device)
-        free(dinfo->device);
-    free(dinfo);
-    return NULL;
-}
-
-static int
-sync_ptable(int fd)
-{
-    struct stat stat;
-    int rv;
-
-    sync();
-
-    if (fstat(fd, &stat)) {
-       ALOGE("Cannot stat, errno=%d.", errno);
-       return -1;
-    }
-
-    if (S_ISBLK(stat.st_mode) && ((rv = ioctl(fd, BLKRRPART, NULL)) < 0)) {
-        ALOGE("Could not re-read partition table. REBOOT!. (errno=%d)", errno);
-        return -1;
-    }
-
-    return 0;
-}
-
-/* This function verifies that the disk info provided is valid, and if so,
- * returns an open file descriptor.
- *
- * This does not necessarily mean that it will later be successfully written
- * though. If we use the pc-bios partitioning scheme, we must use extended
- * partitions, which eat up some hd space. If the user manually provisioned
- * every single partition, but did not account for the extra needed space,
- * then we will later fail.
- *
- * TODO: Make validation more complete.
- */
-static int
-validate(struct disk_info *dinfo)
-{
-    int fd;
-    int sect_sz;
-    uint64_t disk_size;
-    uint64_t total_size;
-    int cnt;
-    struct stat stat;
-
-    if (!dinfo)
-        return -1;
-
-    if ((fd = open(dinfo->device, O_RDWR)) < 0) {
-        ALOGE("Cannot open device '%s' (errno=%d)", dinfo->device, errno);
-        return -1;
-    }
-
-    if (fstat(fd, &stat)) {
-        ALOGE("Cannot stat file '%s', errno=%d.", dinfo->device, errno);
-        goto fail;
-    }
-
-
-    /* XXX: Some of the code below is kind of redundant and should probably
-     * be refactored a little, but it will do for now. */
-
-    /* Verify that we can operate on the device that was requested.
-     * We presently only support block devices and regular file images. */
-    if (S_ISBLK(stat.st_mode)) {
-        /* get the sector size and make sure we agree */
-        if (ioctl(fd, BLKSSZGET, &sect_sz) < 0) {
-            ALOGE("Cannot get sector size (errno=%d)", errno);
-            goto fail;
-        }
-
-        if (!sect_sz || sect_sz != dinfo->sect_size) {
-            ALOGE("Device sector size is zero or sector sizes do not match!");
-            goto fail;
-        }
-
-        /* allow the user override the "disk size" if they provided num_lba */
-        if (!dinfo->num_lba) {
-            if (ioctl(fd, BLKGETSIZE64, &disk_size) < 0) {
-                ALOGE("Could not get block device size (errno=%d)", errno);
-                goto fail;
-            }
-            /* XXX: we assume that the disk has < 2^32 sectors :-) */
-            dinfo->num_lba = (uint32_t)(disk_size / (uint64_t)dinfo->sect_size);
-        } else
-            disk_size = (uint64_t)dinfo->num_lba * (uint64_t)dinfo->sect_size;
-    } else if (S_ISREG(stat.st_mode)) {
-        ALOGI("Requesting operation on a regular file, not block device.");
-        if (!dinfo->sect_size) {
-            ALOGE("Sector size for regular file images cannot be zero");
-            goto fail;
-        }
-        if (dinfo->num_lba)
-            disk_size = (uint64_t)dinfo->num_lba * (uint64_t)dinfo->sect_size;
-        else {
-            dinfo->num_lba = (uint32_t)(stat.st_size / dinfo->sect_size);
-            disk_size = (uint64_t)stat.st_size;
-        }
-    } else {
-        ALOGE("Device does not refer to a regular file or a block device!");
-        goto fail;
-    }
-
-#if 1
-    ALOGV("Device/file %s: size=%" PRIu64 " bytes, num_lba=%u, sect_size=%d",
-         dinfo->device, disk_size, dinfo->num_lba, dinfo->sect_size);
-#endif
-
-    /* since this is our offset into the disk, we start off with that as
-     * our size of needed partitions */
-    total_size = dinfo->skip_lba * dinfo->sect_size;
-
-    /* add up all the partition sizes and make sure it fits */
-    for (cnt = 0; cnt < dinfo->num_parts; ++cnt) {
-        struct part_info *part = &dinfo->part_lst[cnt];
-        if (part->len_kb != (uint32_t)-1) {
-            total_size += part->len_kb * 1024;
-        } else if (part->len_kb == 0) {
-            ALOGE("Zero-size partition '%s' is invalid.", part->name);
-            goto fail;
-        } else {
-            /* the partition requests the rest of the disk. */
-            if (cnt + 1 != dinfo->num_parts) {
-                ALOGE("Only the last partition in the list can request to fill "
-                     "the rest of disk.");
-                goto fail;
-            }
-        }
-
-        if ((part->type != PC_PART_TYPE_LINUX) &&
-            (part->type != PC_PART_TYPE_FAT32)) {
-            ALOGE("Unknown partition type (0x%x) encountered for partition "
-                 "'%s'\n", part->type, part->name);
-            goto fail;
-        }
-    }
-
-    /* only matters for disks, not files */
-    if (S_ISBLK(stat.st_mode) && total_size > disk_size) {
-        ALOGE("Total requested size of partitions (%"PRIu64") is greater than disk "
-             "size (%"PRIu64").", total_size, disk_size);
-        goto fail;
-    }
-
-    return fd;
-
-fail:
-    close(fd);
-    return -1;
-}
-
-static int
-validate_and_config(struct disk_info *dinfo, int *fd, struct write_list **lst)
-{
-    *lst = NULL;
-    *fd = -1;
-
-    if ((*fd = validate(dinfo)) < 0)
-        return 1;
-
-    switch (dinfo->scheme) {
-        case PART_SCHEME_MBR:
-            *lst = config_mbr(dinfo);
-            return *lst == NULL;
-        case PART_SCHEME_GPT:
-            /* not supported yet */
-        default:
-            ALOGE("Unknown partition scheme.");
-            break;
-    }
-
-    close(*fd);
-    *lst = NULL;
-    return 1;
-}
-
-/* validate and process the disk layout configuration.
- * This will cause an update to the partitions' start lba.
- *
- * Basically, this does the same thing as apply_disk_config in test mode,
- * except that wlist_commit is not called to print out the data to be
- * written.
- */
-int
-process_disk_config(struct disk_info *dinfo)
-{
-    struct write_list *lst;
-    int fd;
-
-    if (validate_and_config(dinfo, &fd, &lst) != 0)
-        return 1;
-
-    close(fd);
-    wlist_free(lst);
-    return 0;
-}
-
-
-int
-apply_disk_config(struct disk_info *dinfo, int test)
-{
-    int fd;
-    struct write_list *wr_lst = NULL;
-    int rv;
-
-    if (validate_and_config(dinfo, &fd, &wr_lst) != 0) {
-        ALOGE("Configuration is invalid.");
-        goto fail;
-    }
-
-    if ((rv = wlist_commit(fd, wr_lst, test)) >= 0)
-        rv = test ? 0 : sync_ptable(fd);
-
-    close(fd);
-    wlist_free(wr_lst);
-    return rv;
-
-fail:
-    close(fd);
-    if (wr_lst)
-        wlist_free(wr_lst);
-    return 1;
-}
-
-int
-dump_disk_config(struct disk_info *dinfo)
-{
-    int cnt;
-    struct part_info *part;
-
-    printf("Device: %s\n", dinfo->device);
-    printf("Scheme: ");
-    switch (dinfo->scheme) {
-        case PART_SCHEME_MBR:
-            printf("MBR");
-            break;
-        case PART_SCHEME_GPT:
-            printf("GPT (unsupported)");
-            break;
-        default:
-            printf("Unknown");
-            break;
-    }
-    printf ("\n");
-
-    printf("Sector size: %d\n", dinfo->sect_size);
-    printf("Skip leading LBAs: %u\n", dinfo->skip_lba);
-    printf("Number of LBAs: %u\n", dinfo->num_lba);
-    printf("Partitions:\n");
-
-    for (cnt = 0; cnt < dinfo->num_parts; ++cnt) {
-        part = &dinfo->part_lst[cnt];
-        printf("\tname = %s\n", part->name);
-        printf("\t\tflags = %s\n",
-               part->flags & PART_ACTIVE_FLAG ? "Active" : "None");
-        printf("\t\ttype = %s\n",
-               part->type == PC_PART_TYPE_LINUX ? "Linux" : "Unknown");
-        if (part->len_kb == (uint32_t)-1)
-            printf("\t\tlen = rest of disk\n");
-        else
-            printf("\t\tlen = %uKB\n", part->len_kb);
-    }
-    printf("Total number of partitions: %d\n", cnt);
-    printf("\n");
-
-    return 0;
-}
-
-struct part_info *
-find_part(struct disk_info *dinfo, const char *name)
-{
-    struct part_info *pinfo;
-    int cnt;
-
-    for (cnt = 0; cnt < dinfo->num_parts; ++cnt) {
-        pinfo = &dinfo->part_lst[cnt];
-        if (!strcmp(pinfo->name, name))
-            return pinfo;
-    }
-
-    return NULL;
-}
-
-/* NOTE: If the returned ptr is non-NULL, it must be freed by the caller. */
-char *
-find_part_device(struct disk_info *dinfo, const char *name)
-{
-    switch (dinfo->scheme) {
-        case PART_SCHEME_MBR:
-            return find_mbr_part(dinfo, name);
-        case PART_SCHEME_GPT:
-            ALOGE("GPT is presently not supported");
-            break;
-        default:
-            ALOGE("Unknown partition table scheme");
-            break;
-    }
-
-    return NULL;
-}
-
-
diff --git a/libdiskconfig/diskutils.c b/libdiskconfig/diskutils.c
deleted file mode 100644
index fe1b4c1..0000000
--- a/libdiskconfig/diskutils.c
+++ /dev/null
@@ -1,118 +0,0 @@
-/* libs/diskconfig/diskutils.c
- *
- * Copyright 2008, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "diskutils"
-
-#include <errno.h>
-#include <fcntl.h>
-#include <inttypes.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include <log/log.h>
-
-#include <diskconfig/diskconfig.h>
-
-int
-write_raw_image(const char *dst, const char *src, loff_t offset, int test)
-{
-    int dst_fd = -1;
-    int src_fd = -1;
-    uint8_t buffer[2048];
-    ssize_t nr_bytes;
-    ssize_t tmp;
-    int done = 0;
-    uint64_t total = 0;
-
-    ALOGI("Writing RAW image '%s' to '%s' (offset=%llu)", src, dst, (unsigned long long)offset);
-    if ((src_fd = open(src, O_RDONLY)) < 0) {
-        ALOGE("Could not open %s for reading (errno=%d).", src, errno);
-        goto fail;
-    }
-
-    if (!test) {
-        if ((dst_fd = open(dst, O_RDWR)) < 0) {
-            ALOGE("Could not open '%s' for read/write (errno=%d).", dst, errno);
-            goto fail;
-        }
-
-        if (lseek64(dst_fd, offset, SEEK_SET) != offset) {
-            ALOGE("Could not seek to offset %lld in %s.", (long long)offset, dst);
-            goto fail;
-        }
-    }
-
-    while (!done) {
-        if ((nr_bytes = read(src_fd, buffer, sizeof(buffer))) < 0) {
-            /* XXX: Should we not even bother with EINTR? */
-            if (errno == EINTR)
-                continue;
-            ALOGE("Error (%d) while reading from '%s'", errno, src);
-            goto fail;
-        }
-
-        if (!nr_bytes) {
-            /* we're done. */
-            done = 1;
-            break;
-        }
-
-        total += nr_bytes;
-
-        /* skip the write loop if we're testing */
-        if (test)
-            nr_bytes = 0;
-
-        while (nr_bytes > 0) {
-            if ((tmp = write(dst_fd, buffer, nr_bytes)) < 0) {
-                /* XXX: Should we not even bother with EINTR? */
-                if (errno == EINTR)
-                    continue;
-                ALOGE("Error (%d) while writing to '%s'", errno, dst);
-                goto fail;
-            }
-            if (!tmp)
-                continue;
-            nr_bytes -= tmp;
-        }
-    }
-
-    if (!done) {
-        ALOGE("Exited read/write loop without setting flag! WTF?!");
-        goto fail;
-    }
-
-    if (dst_fd >= 0)
-        fsync(dst_fd);
-
-    ALOGI("Wrote %" PRIu64 " bytes to %s @ %lld", total, dst, (long long)offset);
-
-    close(src_fd);
-    if (dst_fd >= 0)
-        close(dst_fd);
-    return 0;
-
-fail:
-    if (dst_fd >= 0)
-        close(dst_fd);
-    if (src_fd >= 0)
-        close(src_fd);
-    return 1;
-}
diff --git a/libdiskconfig/dump_diskconfig.c b/libdiskconfig/dump_diskconfig.c
deleted file mode 100644
index 3c4f620..0000000
--- a/libdiskconfig/dump_diskconfig.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/* libs/diskconfig/dump_diskconfig.c
- *
- * Copyright 2008, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "dump_diskconfig"
-
-#include <stdio.h>
-
-#include <log/log.h>
-
-#include "diskconfig.h"
-
-int
-main(int argc, char *argv[])
-{
-    struct disk_info *dinfo;
-
-    if (argc < 2) {
-        ALOGE("usage: %s <conf file>", argv[0]);
-        return 1;
-    }
-
-    if (!(dinfo = load_diskconfig(argv[1], NULL)))
-        return 1;
-
-    dump_disk_config(dinfo);
-
-    return 0;
-}
-
diff --git a/libdiskconfig/include/diskconfig/diskconfig.h b/libdiskconfig/include/diskconfig/diskconfig.h
deleted file mode 100644
index d45b99e..0000000
--- a/libdiskconfig/include/diskconfig/diskconfig.h
+++ /dev/null
@@ -1,130 +0,0 @@
-/* system/core/include/diskconfig/diskconfig.h
- *
- * Copyright 2008, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#ifndef __LIBS_DISKCONFIG_H
-#define __LIBS_DISKCONFIG_H
-
-#include <stdint.h>
-#include <sys/types.h>
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#define MAX_NAME_LEN                 512
-#define MAX_NUM_PARTS                16
-
-/* known partition schemes */
-#define PART_SCHEME_MBR              0x1
-#define PART_SCHEME_GPT              0x2
-
-/* PC Bios partition status */
-#define PC_PART_ACTIVE               0x80
-#define PC_PART_NORMAL               0x0
-
-/* Known (rather, used by us) partition types */
-#define PC_PART_TYPE_LINUX           0x83
-#define PC_PART_TYPE_EXTENDED        0x05
-#define PC_PART_TYPE_FAT32           0x0c
-
-#define PC_NUM_BOOT_RECORD_PARTS     4
-
-#define PC_EBR_LOGICAL_PART          0
-#define PC_EBR_NEXT_PTR_PART         1
-
-#define PC_BIOS_BOOT_SIG             0xAA55
-
-#define PC_MBR_DISK_OFFSET           0
-#define PC_MBR_SIZE                  512
-
-#define PART_ACTIVE_FLAG             0x1
-
-struct chs {
-    uint8_t head;
-    uint8_t sector;
-    uint8_t cylinder;
-} __attribute__((__packed__));
-
-/* 16 byte pc partition descriptor that sits in MBR and EPBR.
- * Note: multi-byte entities have little-endian layout on disk */
-struct pc_partition {
-    uint8_t status;     /* byte  0     */
-    struct chs start;   /* bytes 1-3   */
-    uint8_t type;       /* byte  4     */
-    struct chs end;     /* bytes 5-7   */
-    uint32_t start_lba; /* bytes 8-11  */
-    uint32_t len_lba;   /* bytes 12-15 */
-} __attribute__((__packed__));
-
-struct pc_boot_record {
-    uint8_t code[440];                                      /* bytes 0-439   */
-    uint32_t disk_sig;                                      /* bytes 440-443 */
-    uint16_t pad;                                           /* bytes 444-445 */
-    struct pc_partition ptable[PC_NUM_BOOT_RECORD_PARTS];   /* bytes 446-509 */
-    uint16_t mbr_sig;                                       /* bytes 510-511 */
-} __attribute__((__packed__));
-
-struct part_info {
-    char *name;
-    uint8_t flags;
-    uint8_t type;
-    uint32_t len_kb;       /* in 1K-bytes */
-    uint32_t start_lba;    /* the LBA where this partition begins */
-};
-
-struct disk_info {
-    char *device;
-    uint8_t scheme;
-    int sect_size;       /* expected sector size in bytes. MUST BE POWER OF 2 */
-    uint32_t skip_lba;   /* in sectors (1 unit of LBA) */
-    uint32_t num_lba;    /* the size of the disk in LBA units */
-    struct part_info *part_lst;
-    int num_parts;
-};
-
-struct write_list {
-    struct write_list *next;
-    loff_t offset;
-    uint32_t len;
-    uint8_t data[0];
-};
-
-
-struct write_list *alloc_wl(uint32_t data_len);
-void free_wl(struct write_list *item);
-struct write_list *wlist_add(struct write_list **lst, struct write_list *item);
-void wlist_free(struct write_list *lst);
-int wlist_commit(int fd, struct write_list *lst, int test);
-
-struct disk_info *load_diskconfig(const char *fn, char *path_override);
-int dump_disk_config(struct disk_info *dinfo);
-int apply_disk_config(struct disk_info *dinfo, int test);
-char *find_part_device(struct disk_info *dinfo, const char *name);
-int process_disk_config(struct disk_info *dinfo);
-struct part_info *find_part(struct disk_info *dinfo, const char *name);
-
-int write_raw_image(const char *dst, const char *src, loff_t offset, int test);
-
-/* For MBR partition schemes */
-struct write_list *config_mbr(struct disk_info *dinfo);
-char *find_mbr_part(struct disk_info *dinfo, const char *name);
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* __LIBS_DISKCONFIG_H */
diff --git a/libdiskconfig/write_lst.c b/libdiskconfig/write_lst.c
deleted file mode 100644
index c3d5c0a..0000000
--- a/libdiskconfig/write_lst.c
+++ /dev/null
@@ -1,92 +0,0 @@
-/* libs/diskconfig/write_lst.c
- *
- * Copyright 2008, The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#define LOG_TAG "write_lst"
-
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#include <diskconfig/diskconfig.h>
-#include <log/log.h>
-
-struct write_list *
-alloc_wl(uint32_t data_len)
-{
-    struct write_list *item;
-
-    if (!(item = malloc(sizeof(struct write_list) + data_len))) {
-        ALOGE("Unable to allocate memory.");
-        return NULL;
-    }
-
-    item->len = data_len;
-    return item;
-}
-
-void
-free_wl(struct write_list *item)
-{
-    if (item)
-        free(item);
-}
-
-struct write_list *
-wlist_add(struct write_list **lst, struct write_list *item)
-{
-    item->next = (*lst);
-    *lst = item;
-    return item;
-}
-
-void
-wlist_free(struct write_list *lst)
-{
-    struct write_list *temp_wr;
-    while (lst) {
-        temp_wr = lst->next;
-        free_wl(lst);
-        lst = temp_wr;
-    }
-}
-
-int
-wlist_commit(int fd, struct write_list *lst, int test)
-{
-    for(; lst; lst = lst->next) {
-        if (lseek64(fd, lst->offset, SEEK_SET) != (loff_t)lst->offset) {
-            ALOGE("Cannot seek to the specified position (%lld).", (long long)lst->offset);
-            goto fail;
-        }
-
-        if (!test) {
-            if (write(fd, lst->data, lst->len) != (int)lst->len) {
-                ALOGE("Failed writing %u bytes at position %lld.", lst->len,
-                     (long long)lst->offset);
-                goto fail;
-            }
-        } else
-            ALOGI("Would write %d bytes @ offset %lld.", lst->len, (long long)lst->offset);
-    }
-
-    return 0;
-
-fail:
-    return -1;
-}
diff --git a/libsysutils/Android.bp b/libsysutils/Android.bp
index 5f472b2..1b41a6b 100644
--- a/libsysutils/Android.bp
+++ b/libsysutils/Android.bp
@@ -29,6 +29,10 @@
         "liblog",
     ],
 
+    header_libs: [
+        "bpf_headers",
+    ],
+
     export_include_dirs: ["include"],
 
     tidy: true,
diff --git a/libsysutils/src/NetlinkEvent.cpp b/libsysutils/src/NetlinkEvent.cpp
index 515cc10..cd9db54 100644
--- a/libsysutils/src/NetlinkEvent.cpp
+++ b/libsysutils/src/NetlinkEvent.cpp
@@ -37,10 +37,12 @@
 #include <sys/utsname.h>
 
 #include <android-base/parseint.h>
+#include <bpf/KernelUtils.h>
 #include <log/log.h>
 #include <sysutils/NetlinkEvent.h>
 
 using android::base::ParseInt;
+using android::bpf::isKernel64Bit;
 
 /* From kernel's net/netfilter/xt_quota2.c */
 const int LOCAL_QLOG_NL_EVENT = 112;
@@ -138,60 +140,6 @@
 static_assert(sizeof(ulog_packet_msg32_t) == 168);
 static_assert(sizeof(ulog_packet_msg64_t) == 192);
 
-// Figure out the bitness of userspace.
-// Trivial and known at compile time.
-static bool isUserspace64bit(void) {
-    return sizeof(long) == 8;
-}
-
-// Figure out the bitness of the kernel.
-static bool isKernel64Bit(void) {
-    // a 64-bit userspace requires a 64-bit kernel
-    if (isUserspace64bit()) return true;
-
-    static bool init = false;
-    static bool cache = false;
-    if (init) return cache;
-
-    // Retrieve current personality - on Linux this system call *cannot* fail.
-    int p = personality(0xffffffff);
-    // But if it does just assume kernel and userspace (which is 32-bit) match...
-    if (p == -1) return false;
-
-    // This will effectively mask out the bottom 8 bits, and switch to 'native'
-    // personality, and then return the previous personality of this thread
-    // (likely PER_LINUX or PER_LINUX32) with any extra options unmodified.
-    int q = personality((p & ~PER_MASK) | PER_LINUX);
-    // Per man page this theoretically could error out with EINVAL,
-    // but kernel code analysis suggests setting PER_LINUX cannot fail.
-    // Either way, assume kernel and userspace (which is 32-bit) match...
-    if (q != p) return false;
-
-    struct utsname u;
-    (void)uname(&u);  // only possible failure is EFAULT, but u is on stack.
-
-    // Switch back to previous personality.
-    // Theoretically could fail with EINVAL on arm64 with no 32-bit support,
-    // but then we wouldn't have fetched 'p' from the kernel in the first place.
-    // Either way there's nothing meaningul we can do in case of error.
-    // Since PER_LINUX32 vs PER_LINUX only affects uname.machine it doesn't
-    // really hurt us either.  We're really just switching back to be 'clean'.
-    (void)personality(p);
-
-    // Possible values of utsname.machine observed on x86_64 desktop (arm via qemu):
-    //   x86_64 i686 aarch64 armv7l
-    // additionally observed on arm device:
-    //   armv8l
-    // presumably also might just be possible:
-    //   i386 i486 i586
-    // and there might be other weird arm32 cases.
-    // We note that the 64 is present in both 64-bit archs,
-    // and in general is likely to be present in only 64-bit archs.
-    cache = !!strstr(u.machine, "64");
-    init = true;
-    return cache;
-}
-
 /******************************************************************************/
 
 NetlinkEvent::NetlinkEvent() {
diff --git a/libutils/RefBase_test.cpp b/libutils/RefBase_test.cpp
index aed3b9b..d675598 100644
--- a/libutils/RefBase_test.cpp
+++ b/libutils/RefBase_test.cpp
@@ -28,7 +28,7 @@
 
 using namespace android;
 
-static constexpr int NITERS = 1000000;
+static constexpr int NITERS = 500000;
 
 static constexpr int INITIAL_STRONG_VALUE = 1 << 28;  // Mirroring RefBase definition.
 
diff --git a/toolbox/modprobe.cpp b/toolbox/modprobe.cpp
index 17f8156..17d4e31 100644
--- a/toolbox/modprobe.cpp
+++ b/toolbox/modprobe.cpp
@@ -85,6 +85,26 @@
     }
 }
 
+// Find directories in format of "/lib/modules/x.y.z-*".
+static int KernelVersionNameFilter(const dirent* de) {
+    unsigned int major, minor;
+    static std::string kernel_version;
+    utsname uts;
+
+    if (kernel_version.empty()) {
+        if ((uname(&uts) != 0) || (sscanf(uts.release, "%u.%u", &major, &minor) != 2)) {
+            LOG(ERROR) << "Could not parse the kernel version from uname";
+            return 0;
+        }
+        kernel_version = android::base::StringPrintf("%u.%u", major, minor);
+    }
+
+    if (android::base::StartsWith(de->d_name, kernel_version)) {
+        return 1;
+    }
+    return 0;
+}
+
 }  // anonymous namespace
 
 extern "C" int modprobe_main(int argc, char** argv) {
@@ -192,9 +212,22 @@
     }
 
     if (mod_dirs.empty()) {
-        utsname uts;
-        uname(&uts);
-        mod_dirs.emplace_back(android::base::StringPrintf("/lib/modules/%s", uts.release));
+        static constexpr auto LIB_MODULES_PREFIX = "/lib/modules/";
+        dirent** kernel_dirs = NULL;
+
+        int n = scandir(LIB_MODULES_PREFIX, &kernel_dirs, KernelVersionNameFilter, NULL);
+        if (n == -1) {
+            PLOG(ERROR) << "Failed to scan dir " << LIB_MODULES_PREFIX;
+            return EXIT_FAILURE;
+        } else if (n > 0) {
+            while (n--) {
+                mod_dirs.emplace_back(LIB_MODULES_PREFIX + std::string(kernel_dirs[n]->d_name));
+            }
+        }
+        free(kernel_dirs);
+
+        // Allow modules to be directly inside /lib/modules
+        mod_dirs.emplace_back(LIB_MODULES_PREFIX);
     }
 
     LOG(DEBUG) << "mode is " << mode;
@@ -212,11 +245,6 @@
             return EXIT_FAILURE;
         }
     }
-    if (mod_dirs.empty()) {
-        LOG(ERROR) << "No module configuration directories given.";
-        print_usage();
-        return EXIT_FAILURE;
-    }
     if (parameter_count && modules.size() > 1) {
         LOG(ERROR) << "Only one module may be loaded when specifying module parameters.";
         print_usage();
diff --git a/trusty/confirmationui/fuzz/Android.bp b/trusty/confirmationui/fuzz/Android.bp
index 4780943..96804bd 100644
--- a/trusty/confirmationui/fuzz/Android.bp
+++ b/trusty/confirmationui/fuzz/Android.bp
@@ -26,7 +26,8 @@
         "-DTRUSTY_APP_FILENAME=\"confirmationui.syms.elf\"",
     ],
     fuzz_config: {
-       cc: ["trong@google.com"],
+       cc: ["mikemcternan@google.com"],
+       componentid: 1290237,
     },
 
 }
@@ -40,7 +41,8 @@
         "libdmabufheap",
     ],
     fuzz_config: {
-       cc: ["trong@google.com"],
+       cc: ["mikemcternan@google.com"],
+       componentid: 1290237,
     },
 
     // The initial corpus for this fuzzer was derived by dumping messages from/to
diff --git a/trusty/keymaster/set_attestation_ids/set_attestation_ids.cpp b/trusty/keymaster/set_attestation_ids/set_attestation_ids.cpp
index e944167..6b8f90f 100644
--- a/trusty/keymaster/set_attestation_ids/set_attestation_ids.cpp
+++ b/trusty/keymaster/set_attestation_ids/set_attestation_ids.cpp
@@ -17,8 +17,10 @@
 #include <getopt.h>
 
 #include <string>
+#include <vector>
 
 #include <android-base/properties.h>
+#include <android-base/strings.h>
 #include <trusty_keymaster/ipc/trusty_keymaster_ipc.h>
 
 namespace {
@@ -34,14 +36,66 @@
         {"model", required_argument, nullptr, 'm'},
         {"imei", required_argument, nullptr, 'i'},
         {"meid", required_argument, nullptr, 'c'},
+        {"imei2", required_argument, nullptr, '2'},
         {0, 0, 0, 0},
 };
 
+std::string TELEPHONY_CMD_GET_IMEI = "cmd phone get-imei ";
+
+// Run a shell command and collect the output of it. If any error, set an empty string as the
+// output.
+std::string exec_command(const std::string& command) {
+    char buffer[128];
+    std::string result = "";
+
+    FILE* pipe = popen(command.c_str(), "r");
+    if (!pipe) {
+        fprintf(stderr, "popen('%s') failed\n", command.c_str());
+        return result;
+    }
+
+    while (!feof(pipe)) {
+        if (fgets(buffer, 128, pipe) != NULL) {
+            result += buffer;
+        }
+    }
+
+    pclose(pipe);
+    return result;
+}
+
+// Get IMEI using Telephony service shell command. If any error while executing the command
+// then empty string will be returned as output.
+std::string get_imei(int slot) {
+    std::string cmd = TELEPHONY_CMD_GET_IMEI + std::to_string(slot);
+    std::string output = exec_command(cmd);
+
+    if (output.empty()) {
+        fprintf(stderr, "Retrieve IMEI command ('%s') failed\n", cmd.c_str());
+        return "";
+    }
+
+    std::vector<std::string> out =
+            ::android::base::Tokenize(::android::base::Trim(output), "Device IMEI:");
+
+    if (out.size() != 1) {
+        fprintf(stderr, "Error parsing command ('%s') output '%s'\n", cmd.c_str(), output.c_str());
+        return "";
+    }
+
+    std::string imei = ::android::base::Trim(out[0]);
+    if (imei.compare("null") == 0) {
+        fprintf(stderr, "IMEI value from command ('%s') is null, skipping", cmd.c_str());
+        return "";
+    }
+    return imei;
+}
+
 std::string buf2string(const keymaster::Buffer& buf) {
     return std::string(reinterpret_cast<const char*>(buf.peek_read()), buf.available_read());
 }
 
-void print_usage(const char* prog, const keymaster::SetAttestationIdsRequest& req) {
+void print_usage(const char* prog, const keymaster::SetAttestationIdsKM3Request& req) {
     fprintf(stderr,
             "Usage: %s [options]\n"
             "\n"
@@ -55,34 +109,53 @@
             "  -m, --model <val>          set model (default '%s')\n"
             "  -i, --imei <val>           set IMEI (default '%s')\n"
             "  -c, --meid <val>           set MEID (default '%s')\n"
+            "  -2, --imei2 <val>          set second IMEI (default '%s')\n"
             "\n",
-            prog, buf2string(req.brand).c_str(), buf2string(req.device).c_str(),
-            buf2string(req.product).c_str(), buf2string(req.serial).c_str(),
-            buf2string(req.manufacturer).c_str(), buf2string(req.model).c_str(),
-            buf2string(req.imei).c_str(), buf2string(req.meid).c_str());
+            prog, buf2string(req.base.brand).c_str(), buf2string(req.base.device).c_str(),
+            buf2string(req.base.product).c_str(), buf2string(req.base.serial).c_str(),
+            buf2string(req.base.manufacturer).c_str(), buf2string(req.base.model).c_str(),
+            buf2string(req.base.imei).c_str(), buf2string(req.base.meid).c_str(),
+            buf2string(req.second_imei).c_str());
+}
+
+void set_to(keymaster::Buffer* buf, const std::string& value) {
+    if (!value.empty()) {
+        buf->Reinitialize(value.data(), value.size());
+    }
 }
 
 void set_from_prop(keymaster::Buffer* buf, const std::string& prop) {
     std::string prop_value = ::android::base::GetProperty(prop, /* default_value = */ "");
-    if (!prop_value.empty()) {
-        buf->Reinitialize(prop_value.data(), prop_value.size());
-    }
+    set_to(buf, prop_value);
 }
 
-void populate_ids(keymaster::SetAttestationIdsRequest* req) {
+void populate_base_ids(keymaster::SetAttestationIdsRequest* req) {
     set_from_prop(&req->brand, "ro.product.brand");
     set_from_prop(&req->device, "ro.product.device");
     set_from_prop(&req->product, "ro.product.name");
     set_from_prop(&req->serial, "ro.serialno");
     set_from_prop(&req->manufacturer, "ro.product.manufacturer");
     set_from_prop(&req->model, "ro.product.model");
+    std::string imei = get_imei(0);
+    set_to(&req->imei, imei);
+}
+
+void populate_ids(keymaster::SetAttestationIdsKM3Request* req) {
+    populate_base_ids(&req->base);
+
+    // - "What about IMEI?"
+    // - "You've already had it."
+    // - "We've had one, yes. What about second IMEI?"
+    // - "I don't think he knows about second IMEI, Pip."
+    std::string imei2 = get_imei(1);
+    set_to(&req->second_imei, imei2);
 }
 
 }  // namespace
 
 int main(int argc, char** argv) {
     // By default, set attestation IDs to the values in userspace properties.
-    keymaster::SetAttestationIdsRequest req(/* ver = */ 4);
+    keymaster::SetAttestationIdsKM3Request req(/* ver = */ 4);
     populate_ids(&req);
 
     while (true) {
@@ -94,28 +167,31 @@
 
         switch (c) {
             case 'b':
-                req.brand.Reinitialize(optarg, strlen(optarg));
+                req.base.brand.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'd':
-                req.device.Reinitialize(optarg, strlen(optarg));
+                req.base.device.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'p':
-                req.product.Reinitialize(optarg, strlen(optarg));
+                req.base.product.Reinitialize(optarg, strlen(optarg));
                 break;
             case 's':
-                req.serial.Reinitialize(optarg, strlen(optarg));
+                req.base.serial.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'M':
-                req.manufacturer.Reinitialize(optarg, strlen(optarg));
+                req.base.manufacturer.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'm':
-                req.model.Reinitialize(optarg, strlen(optarg));
+                req.base.model.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'i':
-                req.imei.Reinitialize(optarg, strlen(optarg));
+                req.base.imei.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'c':
-                req.meid.Reinitialize(optarg, strlen(optarg));
+                req.base.meid.Reinitialize(optarg, strlen(optarg));
+                break;
+            case '2':
+                req.second_imei.Reinitialize(optarg, strlen(optarg));
                 break;
             case 'h':
                 print_usage(argv[0], req);
@@ -144,19 +220,33 @@
            "  manufacturer: %s\n"
            "  model:        %s\n"
            "  IMEI:         %s\n"
-           "  MEID:         %s\n",
-           buf2string(req.brand).c_str(), buf2string(req.device).c_str(),
-           buf2string(req.product).c_str(), buf2string(req.serial).c_str(),
-           buf2string(req.manufacturer).c_str(), buf2string(req.model).c_str(),
-           buf2string(req.imei).c_str(), buf2string(req.meid).c_str());
+           "  MEID:         %s\n"
+           "  SECOND_IMEI:  %s\n\n",
+           buf2string(req.base.brand).c_str(), buf2string(req.base.device).c_str(),
+           buf2string(req.base.product).c_str(), buf2string(req.base.serial).c_str(),
+           buf2string(req.base.manufacturer).c_str(), buf2string(req.base.model).c_str(),
+           buf2string(req.base.imei).c_str(), buf2string(req.base.meid).c_str(),
+           buf2string(req.second_imei).c_str());
+    fflush(stdout);
 
     keymaster::EmptyKeymasterResponse rsp(/* ver = */ 4);
-    ret = trusty_keymaster_send(KM_SET_ATTESTATION_IDS, req, &rsp);
-    if (ret) {
-        fprintf(stderr, "SET_ATTESTATION_IDS failed: %d\n", ret);
-        trusty_keymaster_disconnect();
-        return EXIT_FAILURE;
+    const char* msg;
+    if (req.second_imei.available_read() == 0) {
+        // No SECOND_IMEI set, use base command.
+        ret = trusty_keymaster_send(KM_SET_ATTESTATION_IDS, req.base, &rsp);
+        msg = "SET_ATTESTATION_IDS";
+    } else {
+        // SECOND_IMEI is set, use updated command.
+        ret = trusty_keymaster_send(KM_SET_ATTESTATION_IDS_KM3, req, &rsp);
+        msg = "SET_ATTESTATION_IDS_KM3";
     }
+    trusty_keymaster_disconnect();
 
-    return EXIT_SUCCESS;
+    if (ret) {
+        fprintf(stderr, "%s failed: %d\n", msg, ret);
+        return EXIT_FAILURE;
+    } else {
+        printf("done\n");
+        return EXIT_SUCCESS;
+    }
 }