Snap for 11286485 from 54b95a77df17a0e064bc32abd8cb29a725ebf9a6 to emu-34-release

Change-Id: Idf40d9fa35f8247102b00e5805561f484457e3df

48 files changed, 845 insertions, 109 deletions

diff --git a/build/Android.bp b/build/Android.bp
index 4644730c3..fb57c2f26 100644
--- a/build/Android.bp
+++ b/build/Android.bp
@@ -143,8 +143,10 @@ cvd_host_tools = [
     "screen_recording_server",
     "secure_env",
     "sefcontext_compile",
+    "cvd_send_id_disclosure",
     "cvd_send_sms",
     "cvd_update_location",
+    "cvd_update_security_algorithm",
     "cvd_import_locations",
     "simg2img",
     "socket_vsock_proxy",
diff --git a/common/libs/utils/base64.cpp b/common/libs/utils/base64.cpp
index da9d189c8..2f1441dce 100644
--- a/common/libs/utils/base64.cpp
+++ b/common/libs/utils/base64.cpp
@@ -22,7 +22,7 @@
 #include <string>
 #include <vector>
 
-#include <openssl/base64.h>
+#include <openssl/evp.h>
 
 namespace cuttlefish {
 
diff --git a/common/libs/utils/subprocess.cpp b/common/libs/utils/subprocess.cpp
index 3309ca2f0..f20460911 100644
--- a/common/libs/utils/subprocess.cpp
+++ b/common/libs/utils/subprocess.cpp
@@ -150,6 +150,15 @@ SubprocessOptions SubprocessOptions::InGroup(bool in_group) && {
   return *this;
 }
 
+SubprocessOptions& SubprocessOptions::Strace(std::string s) & {
+  strace_ = std::move(s);
+  return *this;
+}
+SubprocessOptions SubprocessOptions::Strace(std::string s) && {
+  strace_ = std::move(s);
+  return *this;
+}
+
 Subprocess::Subprocess(Subprocess&& subprocess)
     : pid_(subprocess.pid_.load()),
       started_(subprocess.started_),
@@ -370,6 +379,18 @@ Command Command::AddPrerequisite(
 Subprocess Command::Start(SubprocessOptions options) const {
   auto cmd = ToCharPointers(command_);
 
+  if (!options.Strace().empty()) {
+    auto strace_args = {
+        "/usr/bin/strace",
+        "--daemonize",
+        "--output-separately",  // Add .pid suffix
+        "--follow-forks",
+        "-o",  // Write to a separate file.
+        options.Strace().c_str(),
+    };
+    cmd.insert(cmd.begin(), strace_args);
+  }
+
   if (!validate_redirects(redirects_, inherited_fds_)) {
     return Subprocess(-1, {});
   }
diff --git a/common/libs/utils/subprocess.h b/common/libs/utils/subprocess.h
index 09a2c045f..8a1f60793 100644
--- a/common/libs/utils/subprocess.h
+++ b/common/libs/utils/subprocess.h
@@ -117,14 +117,19 @@ class SubprocessOptions {
   SubprocessOptions& InGroup(bool in_group) &;
   SubprocessOptions InGroup(bool in_group) &&;
 
+  SubprocessOptions& Strace(std::string strace_output_path) &;
+  SubprocessOptions Strace(std::string strace_output_path) &&;
+
   bool Verbose() const { return verbose_; }
   bool ExitWithParent() const { return exit_with_parent_; }
   bool InGroup() const { return in_group_; }
+  const std::string& Strace() const { return strace_; }
 
  private:
   bool verbose_;
   bool exit_with_parent_;
   bool in_group_;
+  std::string strace_;
 };
 
 // An executable command. Multiple subprocesses can be started from the same
diff --git a/guest/hals/nfc/src/nfc.rs b/guest/hals/nfc/src/nfc.rs
index a5a679741..71e3986bf 100644
--- a/guest/hals/nfc/src/nfc.rs
+++ b/guest/hals/nfc/src/nfc.rs
@@ -193,7 +193,6 @@ impl NfcService {
                     }
                 } else {
                     info!("Nfc service is closed. Dropping incoming packets");
-                    break;
                 }
             }
         });
diff --git a/host/commands/assemble_cvd/bootconfig_args.cpp b/host/commands/assemble_cvd/bootconfig_args.cpp
index 60d8c31f1..36c512355 100644
--- a/host/commands/assemble_cvd/bootconfig_args.cpp
+++ b/host/commands/assemble_cvd/bootconfig_args.cpp
@@ -191,7 +191,12 @@ Result<std::unordered_map<std::string, std::string>> BootconfigArgsFromConfig(
     bootconfig_args["androidboot.ramdisk_hotswapped"] = "1";
   }
 
-  for (const std::string& kv : config.extra_bootconfig_args()) {
+  std::vector<std::string> args = instance.extra_bootconfig_args();
+
+  LOG(DEBUG) << "Parsing extra_bootconfig_args of size:" << args.size()
+             << "; Contents: " << android::base::Join(args, "\n");
+
+  for (const std::string& kv : args) {
     if (kv.empty()) {
       continue;
     }
diff --git a/host/commands/assemble_cvd/flags.cc b/host/commands/assemble_cvd/flags.cc
index fc125dd6c..f2c37d36e 100644
--- a/host/commands/assemble_cvd/flags.cc
+++ b/host/commands/assemble_cvd/flags.cc
@@ -292,6 +292,10 @@ DEFINE_vec(enable_bootanimation,
            fmt::format("{}", CF_DEFAULTS_ENABLE_BOOTANIMATION),
            "Whether to enable the boot animation.");
 
+DEFINE_vec(extra_bootconfig_args_base64, CF_DEFAULTS_EXTRA_BOOTCONFIG_ARGS,
+           "This is base64 encoded version of extra_bootconfig_args"
+           "Used for multi device clusters.");
+
 DEFINE_string(qemu_binary_dir, CF_DEFAULTS_QEMU_BINARY_DIR,
               "Path to the directory containing the qemu binary to use");
 DEFINE_string(crosvm_binary, CF_DEFAULTS_CROSVM_BINARY,
@@ -461,6 +465,9 @@ DEFINE_bool(snapshot_compatible, false,
 DEFINE_vec(mcu_config_path, CF_DEFAULTS_MCU_CONFIG_PATH,
            "configuration file for the MCU emulator");
 
+DEFINE_string(straced_host_executables, CF_DEFAULTS_STRACED_HOST_EXECUTABLES,
+              "Comma-separated list of executable names to run under strace "
+              "to collect their system call information.");
 
 DECLARE_string(assembly_dir);
 DECLARE_string(boot_image);
@@ -933,7 +940,6 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
       std::set<std::string>(secure_hals.begin(), secure_hals.end()));
 
   tmp_config_obj.set_extra_kernel_cmdline(FLAGS_extra_kernel_cmdline);
-  tmp_config_obj.set_extra_bootconfig_args(FLAGS_extra_bootconfig_args);
 
   if (FLAGS_track_host_tools_crc) {
     tmp_config_obj.set_host_tools_version(HostToolsCrc());
@@ -1047,6 +1053,10 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
       start_gnss_proxy));
   std::vector<bool> enable_bootanimation_vec =
       CF_EXPECT(GET_FLAG_BOOL_VALUE(enable_bootanimation));
+
+  std::vector<std::string> extra_bootconfig_args_base64_vec =
+      CF_EXPECT(GET_FLAG_STR_VALUE(extra_bootconfig_args_base64));
+
   std::vector<bool> record_screen_vec = CF_EXPECT(GET_FLAG_BOOL_VALUE(
       record_screen));
   std::vector<std::string> gem5_debug_file_vec =
@@ -1069,8 +1079,8 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
       CF_EXPECT(GET_FLAG_STR_VALUE(udp_port_range));
   std::vector<bool> vhost_net_vec = CF_EXPECT(GET_FLAG_BOOL_VALUE(
       vhost_net));
-  std::vector<bool> vhost_user_vsock_vec =
-      CF_EXPECT(GET_FLAG_BOOL_VALUE(vhost_user_vsock));
+  std::vector<std::string> vhost_user_vsock_vec =
+      CF_EXPECT(GET_FLAG_STR_VALUE(vhost_user_vsock));
   std::vector<std::string> ril_dns_vec =
       CF_EXPECT(GET_FLAG_STR_VALUE(ril_dns));
 
@@ -1180,6 +1190,10 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
   tmp_config_obj.set_pica_uci_port(7000 + pica_instance_num);
   LOG(DEBUG) << "launch pica: " << (FLAGS_pica_instance_num <= 0);
 
+  auto straced = android::base::Tokenize(FLAGS_straced_host_executables, ",");
+  std::set<std::string> straced_set(straced.begin(), straced.end());
+  tmp_config_obj.set_straced_host_executables(straced_set);
+
   // Environment specific configs
   // Currently just setting for the default environment
   auto environment_name =
@@ -1251,6 +1265,16 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
     instance.set_enable_audio(enable_audio_vec[instance_index]);
     instance.set_enable_gnss_grpc_proxy(start_gnss_proxy_vec[instance_index]);
     instance.set_enable_bootanimation(enable_bootanimation_vec[instance_index]);
+
+    instance.set_extra_bootconfig_args(FLAGS_extra_bootconfig_args);
+    if (!extra_bootconfig_args_base64_vec[instance_index].empty()) {
+      std::vector<uint8_t> decoded_args;
+      CF_EXPECT(DecodeBase64(extra_bootconfig_args_base64_vec[instance_index],
+                             &decoded_args));
+      std::string decoded_args_str(decoded_args.begin(), decoded_args.end());
+      instance.set_extra_bootconfig_args(decoded_args_str);
+    }
+
     instance.set_record_screen(record_screen_vec[instance_index]);
     instance.set_gem5_debug_file(gem5_debug_file_vec[instance_index]);
     instance.set_protected_vm(protected_vm_vec[instance_index]);
@@ -1269,16 +1293,31 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
 
     instance.set_vhost_net(vhost_net_vec[instance_index]);
 
-    if (vhost_user_vsock_vec[instance_index] &&
-        tmp_config_obj.vm_manager() != CrosvmManager::name()) {
-      LOG(WARNING) << "vhost_user_vsock is available only in crosvm.";
+    // end of wifi, bluetooth, connectivity setup
+
+    if (vhost_user_vsock_vec[instance_index] == kVhostUserVsockModeAuto) {
+      std::set<Arch> default_on_arch = {Arch::Arm64};
+      if (tmp_config_obj.vm_manager() == CrosvmManager::name() &&
+          default_on_arch.find(guest_configs[instance_index].target_arch) !=
+              default_on_arch.end()) {
+        instance.set_vhost_user_vsock(true);
+      } else {
+        instance.set_vhost_user_vsock(false);
+      }
+    } else if (vhost_user_vsock_vec[instance_index] ==
+               kVhostUserVsockModeTrue) {
+      CHECK(tmp_config_obj.vm_manager() == CrosvmManager::name())
+          << "For now, only crosvm supports vhost_user_vsock";
+      instance.set_vhost_user_vsock(true);
+    } else if (vhost_user_vsock_vec[instance_index] ==
+               kVhostUserVsockModeFalse) {
       instance.set_vhost_user_vsock(false);
     } else {
-      instance.set_vhost_user_vsock(vhost_user_vsock_vec[instance_index]);
+      CHECK(false)
+          << "--vhost_user_vsock should be one of 'auto', 'true', 'false', but "
+          << vhost_user_vsock_vec[instance_index];
     }
 
-    // end of wifi, bluetooth, connectivity setup
-
     if (use_random_serial_vec[instance_index]) {
       instance.set_serial_number(
           RandomSerialNumber("CFCVD" + std::to_string(num)));
diff --git a/host/commands/assemble_cvd/flags_defaults.h b/host/commands/assemble_cvd/flags_defaults.h
index aac68a8e4..67a353e12 100644
--- a/host/commands/assemble_cvd/flags_defaults.h
+++ b/host/commands/assemble_cvd/flags_defaults.h
@@ -42,7 +42,7 @@
 #define CF_DEFAULTS_DAEMON false
 #define CF_DEFAULTS_VM_MANAGER CF_DEFAULTS_DYNAMIC_STRING
 #define CF_DEFAULTS_VSOCK_GUEST_CID cuttlefish::GetDefaultVsockCid()
-#define CF_DEFAULTS_VHOST_USER_VSOCK false
+#define CF_DEFAULTS_VHOST_USER_VSOCK cuttlefish::kVhostUserVsockModeAuto
 #define CF_DEFAULTS_ENABLE_MINIMAL_MODE false
 #define CF_DEFAULTS_RESTART_SUBPROCESSES false
 #define CF_DEFAULTS_SETUPWIZARD_MODE "DISABLED"
@@ -226,3 +226,6 @@
 
 // MCU emulator default configuration path
 #define CF_DEFAULTS_MCU_CONFIG_PATH CF_DEFAULTS_DYNAMIC_STRING
+
+// Which executables to run under strace by default
+#define CF_DEFAULTS_STRACED_HOST_EXECUTABLES ""
diff --git a/host/commands/cvd/client.cpp b/host/commands/cvd/client.cpp
index bbd738b1a..1dcda6481 100644
--- a/host/commands/cvd/client.cpp
+++ b/host/commands/cvd/client.cpp
@@ -35,7 +35,6 @@
 #include "host/commands/cvd/flag.h"
 #include "host/commands/cvd/frontline_parser.h"
 #include "host/commands/cvd/handle_reset.h"
-#include "host/commands/cvd/metrics/cvd_metrics_api.h"
 #include "host/commands/cvd/run_server.h"
 #include "host/libs/config/host_tools_version.h"
 
diff --git a/host/commands/cvd/interruptible_terminal.cpp b/host/commands/cvd/interruptible_terminal.cpp
index 3ffaf9678..8795eb764 100644
--- a/host/commands/cvd/interruptible_terminal.cpp
+++ b/host/commands/cvd/interruptible_terminal.cpp
@@ -44,9 +44,9 @@ Result<std::string> InterruptibleTerminal::ReadLine() {
   {
     std::lock_guard lock(terminal_mutex_);
     CF_EXPECT(interrupted_ == false, "Interrupted");
-    CF_EXPECTF(owner_tid_ == std::nullopt,
-               "This InterruptibleTerminal is already owned by {}",
-               owner_tid_.value());
+    CF_EXPECT(owner_tid_ == std::nullopt,
+              "This InterruptibleTerminal is already owned by "
+                  << owner_tid_.value());
     CF_EXPECT(stdin_fd_->IsOpen(),
               "The copy of client stdin fd has been already closed.");
     owner_tid_ = std::this_thread::get_id();
diff --git a/host/commands/cvd/main.cc b/host/commands/cvd/main.cc
index 2e1959a1c..f629f126e 100644
--- a/host/commands/cvd/main.cc
+++ b/host/commands/cvd/main.cc
@@ -36,7 +36,8 @@
 #include "host/commands/cvd/fetch/fetch_cvd.h"
 #include "host/commands/cvd/flag.h"
 #include "host/commands/cvd/frontline_parser.h"
-#include "host/commands/cvd/metrics/cvd_metrics_api.h"
+// TODO(315772518) Re-enable once metrics send is reenabled
+// #include "host/commands/cvd/metrics/cvd_metrics_api.h"
 #include "host/commands/cvd/run_server.h"
 #include "host/commands/cvd/server_constants.h"
 #include "host/libs/config/host_tools_version.h"
@@ -115,7 +116,9 @@ Result<void> CvdMain(int argc, char** argv, char** envp,
   }
 
   auto env = EnvpToMap(envp);
-  CvdMetrics::SendCvdMetrics(all_args);
+  // TODO(315772518) Re-enable once metrics send is skipped in a env
+  // without network support
+  // CvdMetrics::SendCvdMetrics(all_args);
 
   if (android::base::Basename(all_args[0]) == "fetch_cvd") {
     CF_EXPECT(FetchCvdMain(argc, argv));
diff --git a/host/commands/cvd/parser/cf_configs_common.cpp b/host/commands/cvd/parser/cf_configs_common.cpp
index 23460c3d4..e698179bb 100644
--- a/host/commands/cvd/parser/cf_configs_common.cpp
+++ b/host/commands/cvd/parser/cf_configs_common.cpp
@@ -24,6 +24,7 @@
 #include <android-base/strings.h>
 #include <json/json.h>
 
+#include "common/libs/utils/base64.h"
 #include "common/libs/utils/json.h"
 #include "common/libs/utils/result.h"
 
@@ -91,6 +92,20 @@ Result<std::string> GenerateGflag(const Json::Value& instances,
   return GenerateGflag(gflag_name, values);
 }
 
+Result<std::string> Base64EncodeGflag(
+    const Json::Value& instances, const std::string& gflag_name,
+    const std::vector<std::string>& selectors) {
+  auto values =
+      CF_EXPECTF(GetArrayValues<std::string>(instances, selectors),
+                 "Unable to produce values for gflag \"{}\"", gflag_name);
+  for (int i = 0; i < values.size(); i++) {
+    std::string out;
+    CF_EXPECT(EncodeBase64(values[i].c_str(), values[i].size(), &out));
+    values[i] = out;
+  }
+  return GenerateGflag(gflag_name, values);
+}
+
 std::vector<std::string> MergeResults(std::vector<std::string> first_list,
                                       std::vector<std::string> scond_list) {
   std::vector<std::string> result;
diff --git a/host/commands/cvd/parser/cf_configs_common.h b/host/commands/cvd/parser/cf_configs_common.h
index e06586848..4f216f4ea 100644
--- a/host/commands/cvd/parser/cf_configs_common.h
+++ b/host/commands/cvd/parser/cf_configs_common.h
@@ -94,6 +94,9 @@ std::string GenerateGflag(const std::string& gflag_name,
 Result<std::string> GenerateGflag(const Json::Value& instances,
                                   const std::string& gflag_name,
                                   const std::vector<std::string>& selectors);
+Result<std::string> Base64EncodeGflag(
+    const Json::Value& instances, const std::string& gflag_name,
+    const std::vector<std::string>& selectors);
 
 std::vector<std::string> MergeResults(std::vector<std::string> first_list,
                                       std::vector<std::string> scond_list);
diff --git a/host/commands/cvd/parser/cf_flags_validator.cpp b/host/commands/cvd/parser/cf_flags_validator.cpp
index b353b20a7..b9bd83e76 100644
--- a/host/commands/cvd/parser/cf_flags_validator.cpp
+++ b/host/commands/cvd/parser/cf_flags_validator.cpp
@@ -83,6 +83,7 @@ const auto& kRoot = *new ConfigNode{.type = objectValue, .children = {
             {"build", ConfigNode{.type = stringValue}},
           }}},
           {"enable_bootanimation", ConfigNode{.type = booleanValue}},
+          {"extra_bootconfig_args", ConfigNode{.type = stringValue}},
           {"build", ConfigNode{.type = stringValue}},
           {"bootloader", ConfigNode{.type = objectValue, .children = {
             {"build", ConfigNode{.type = stringValue}},
@@ -133,7 +134,6 @@ const auto& kRoot = *new ConfigNode{.type = objectValue, .children = {
   {"common", ConfigNode{.type = objectValue, .children = {
     {"group_name", ConfigNode{.type = stringValue}},
     {"host_package", ConfigNode{.type = stringValue}},
-    {"bootconfig_args", ConfigNode{.type = stringValue}},
   }}},
 },
 };
diff --git a/host/commands/cvd/parser/instance/cf_boot_configs.cpp b/host/commands/cvd/parser/instance/cf_boot_configs.cpp
index df7b9ae06..0955b0aba 100644
--- a/host/commands/cvd/parser/instance/cf_boot_configs.cpp
+++ b/host/commands/cvd/parser/instance/cf_boot_configs.cpp
@@ -30,6 +30,8 @@ Result<void> InitBootConfigs(Json::Value& instances) {
   for (auto& instance : instances) {
     CF_EXPECT(InitConfig(instance, CF_DEFAULTS_ENABLE_BOOTANIMATION,
                          {"boot", "enable_bootanimation"}));
+    CF_EXPECT(InitConfig(instance, CF_DEFAULTS_EXTRA_BOOTCONFIG_ARGS,
+                         {"boot", "extra_bootconfig_args"}));
   }
   return {};
 }
@@ -37,6 +39,9 @@ Result<void> InitBootConfigs(Json::Value& instances) {
 Result<std::vector<std::string>> GenerateBootFlags(
     const Json::Value& instances) {
   std::vector<std::string> result;
+  result.emplace_back(
+      CF_EXPECT(Base64EncodeGflag(instances, "extra_bootconfig_args_base64",
+                                  {"boot", "extra_bootconfig_args"})));
   result.emplace_back(CF_EXPECT(GenerateGflag(
       instances, "enable_bootanimation", {"boot", "enable_bootanimation"})));
   return result;
diff --git a/host/commands/cvd/parser/launch_cvd_parser.cpp b/host/commands/cvd/parser/launch_cvd_parser.cpp
index 41b8868d8..f65fd5a51 100644
--- a/host/commands/cvd/parser/launch_cvd_parser.cpp
+++ b/host/commands/cvd/parser/launch_cvd_parser.cpp
@@ -37,9 +37,6 @@ Result<std::vector<std::string>> GenerateCfFlags(const Json::Value& root) {
       "num_instances", {std::to_string(root["instances"].size())}));
   result.emplace_back(GenerateGflag(
       "netsim_bt", {CF_EXPECT(GetValue<std::string>(root, {"netsim_bt"}))}));
-  result.emplace_back(GenerateGflag(
-      "extra_bootconfig_args",
-      {CF_EXPECT(GetValue<std::string>(root, {"common", "bootconfig_args"}))}));
   result = MergeResults(result, CF_EXPECT(GenerateMetricsFlags(root)));
   result = MergeResults(result,
                         CF_EXPECT(GenerateInstancesFlags(root["instances"])));
@@ -48,8 +45,6 @@ Result<std::vector<std::string>> GenerateCfFlags(const Json::Value& root) {
 
 Result<void> InitCvdConfigs(Json::Value& root) {
   CF_EXPECT(InitConfig(root, CF_DEFAULTS_NETSIM_BT, {"netsim_bt"}));
-  CF_EXPECT(InitConfig(root, CF_DEFAULTS_EXTRA_BOOTCONFIG_ARGS,
-                       {"common", "bootconfig_args"}));
   CF_EXPECT(InitMetricsConfigs(root));
   CF_EXPECT(InitInstancesConfigs(root["instances"]));
   return {};
diff --git a/host/commands/cvd_send_id_disclosure/Android.bp b/host/commands/cvd_send_id_disclosure/Android.bp
new file mode 100644
index 000000000..2184bd969
--- /dev/null
+++ b/host/commands/cvd_send_id_disclosure/Android.bp
@@ -0,0 +1,61 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_defaults {
+    name: "cvd_send_id_disclosure_defaults",
+    shared_libs: [
+        "libbase",
+        "libcuttlefish_fs",
+        "liblog",
+        "libcuttlefish_utils",
+        "libjsoncpp",
+    ],
+    defaults: ["cuttlefish_buildhost_only"],
+}
+
+cc_library {
+    name: "libcvd_id_disclosure_builder",
+    srcs: [
+        "cellular_identifier_disclosure_command_builder.cc",
+    ],
+    defaults: ["cvd_send_id_disclosure_defaults"],
+}
+
+cc_binary {
+    name: "cvd_send_id_disclosure",
+    static_libs: [
+        "libcuttlefish_host_config",
+        "libgflags",
+    ],
+    srcs: [
+        "main.cc",
+        "cellular_identifier_disclosure_command_builder.cc",
+    ],
+    defaults: ["cvd_send_id_disclosure_defaults"],
+}
+
+cc_test_host {
+    name: "cvd_send_id_disclosure_test",
+    srcs: [
+        "unittest/cellular_identifier_disclosure_command_builder_test.cc",
+    ],
+    shared_libs: [
+        "libcvd_id_disclosure_builder",
+    ],
+    defaults: ["cuttlefish_host", "cvd_send_id_disclosure_defaults"],
+}
diff --git a/host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.cc b/host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.cc
new file mode 100644
index 000000000..b9083d705
--- /dev/null
+++ b/host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.cc
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <fmt/format.h>
+#include <string>
+
+#include "host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.h"
+
+namespace cuttlefish {
+
+std::string GetATCommand(const std::string &plmn, int32_t identifierType,
+                         int32_t protocolMessage, bool isEmergency) {
+  return fmt::format("AT+REMOTEIDDISCLOSURE:\"{}\",{},{},{:d}\r", plmn,
+                     identifierType, protocolMessage, isEmergency);
+}
+}  // namespace cuttlefish
\ No newline at end of file
diff --git a/host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.h b/host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.h
new file mode 100644
index 000000000..0a920d614
--- /dev/null
+++ b/host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <string>
+
+namespace cuttlefish {
+
+/**
+ * Allows for the serialization of
+ * aidl::android::hardware::radio::network::CellularIdentifierDisclosure objects
+ * into an AT command that can be processed by the cuttlefish RIL to trigger
+ * unsolicited calls to
+ * aidl::android::hardware::radio::network::IRadioNetworkIndication::cellularIdentifierDisclosed.
+ */
+std::string GetATCommand(const std::string &plmn, int32_t identifierType,
+                         int32_t protocolMessage, bool isEmergency);
+
+}  // namespace cuttlefish
diff --git a/host/commands/cvd_send_id_disclosure/main.cc b/host/commands/cvd_send_id_disclosure/main.cc
new file mode 100644
index 000000000..b4fe0b289
--- /dev/null
+++ b/host/commands/cvd_send_id_disclosure/main.cc
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include <android-base/logging.h>
+#include <gflags/gflags.h>
+
+#include "common/libs/fs/shared_buf.h"
+#include "common/libs/fs/shared_fd.h"
+#include "host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.h"
+#include "host/libs/config/cuttlefish_config.h"
+
+DEFINE_int32(instance_num, cuttlefish::GetInstance(),
+             "Which instance to read the configs from");
+DEFINE_int32(modem_num, 0, "Which modem to send command to");
+DEFINE_int32(identifier, 1,
+             "The identifier type that was disclosed. See "
+             "android.hardware.radio.network.CellularIdentifier");
+DEFINE_int32(protocol_message, 1,
+             "The protocol message of the disclosure. See "
+             "android.hardware.radio.network.NasProtocolMessage");
+DEFINE_bool(is_emergency, false,
+            "Whether or not this disclosure occurred during an emergency call");
+DEFINE_string(plmn, "001001",
+              "The PLMN of the network on which the identifier was disclosed");
+
+namespace cuttlefish {
+namespace {
+
+void SendDisclosure(SharedFD fd) {
+  std::string command =
+      fmt::format("REM{}{}", FLAGS_modem_num,
+                  GetATCommand(FLAGS_plmn, FLAGS_identifier,
+                               FLAGS_protocol_message, FLAGS_is_emergency));
+
+  LOG(DEBUG) << "Attempting to send command: " << command;
+
+  long written = WriteAll(fd, command);
+  if (written != command.size()) {
+    LOG(FATAL) << "Failed to write data to shared fd. Tried to write "
+               << command.size() << " bytes, but only wrote " << written
+               << " bytes.";
+  }
+}
+
+int SendIdDisclosureMain(int argc, char **argv) {
+  ::android::base::InitLogging(argv, android::base::StderrLogger);
+  google::ParseCommandLineFlags(&argc, &argv, true);
+
+  auto config = CuttlefishConfig::Get();
+  if (!config) {
+    LOG(FATAL) << "Failed to obtain config object";
+  }
+
+  auto cf_config = config->ForInstance(FLAGS_instance_num);
+  std::string socket_name =
+      fmt::format("modem_simulator{}", cf_config.modem_simulator_host_id());
+
+  LOG(INFO) << "Connecting over local socket: " << socket_name;
+  SharedFD modem_simulator_fd =
+      cuttlefish::SharedFD::SocketLocalClient(socket_name, true, SOCK_STREAM);
+
+  SendDisclosure(modem_simulator_fd);
+
+  return 0;
+}
+
+}  // namespace
+}  // namespace cuttlefish
+
+int main(int argc, char **argv) {
+  return cuttlefish::SendIdDisclosureMain(argc, argv);
+}
\ No newline at end of file
diff --git a/host/commands/cvd_send_id_disclosure/unittest/cellular_identifier_disclosure_command_builder_test.cc b/host/commands/cvd_send_id_disclosure/unittest/cellular_identifier_disclosure_command_builder_test.cc
new file mode 100644
index 000000000..bd055a01e
--- /dev/null
+++ b/host/commands/cvd_send_id_disclosure/unittest/cellular_identifier_disclosure_command_builder_test.cc
@@ -0,0 +1,23 @@
+//
+// Copyright (C) 2020 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "host/commands/cvd_send_id_disclosure/cellular_identifier_disclosure_command_builder.h"
+
+#include <gtest/gtest.h>
+
+TEST(CommandBuilderTest, GetATCommand) {
+  std::string serialized = cuttlefish::GetATCommand("001001", 2, 3, false);
+  ASSERT_EQ("AT+REMOTEIDDISCLOSURE:\"001001\",2,3,0\r", serialized);
+}
diff --git a/host/commands/cvd_update_security_algorithm/Android.bp b/host/commands/cvd_update_security_algorithm/Android.bp
new file mode 100644
index 000000000..650e5898c
--- /dev/null
+++ b/host/commands/cvd_update_security_algorithm/Android.bp
@@ -0,0 +1,61 @@
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: ["Android-Apache-2.0"],
+}
+
+cc_defaults {
+    name: "cvd_update_security_algorithm_defaults",
+    shared_libs: [
+        "libbase",
+        "libcuttlefish_fs",
+        "liblog",
+        "libcuttlefish_utils",
+        "libjsoncpp",
+    ],
+    defaults: ["cuttlefish_buildhost_only"],
+}
+
+cc_library {
+    name: "libcvd_update_security_algorithm_builder",
+    srcs: [
+        "update_security_algorithm_command_builder.cc",
+    ],
+    defaults: ["cvd_update_security_algorithm_defaults"],
+}
+
+cc_binary {
+    name: "cvd_update_security_algorithm",
+    static_libs: [
+        "libcuttlefish_host_config",
+        "libgflags",
+    ],
+    srcs: [
+        "main.cc",
+        "update_security_algorithm_command_builder.cc",
+    ],
+    defaults: ["cvd_update_security_algorithm_defaults"],
+}
+
+cc_test_host {
+    name: "cvd_update_security_algorithm_test",
+    srcs: [
+        "unittest/update_security_algorithm_command_builder_test.cc",
+    ],
+    shared_libs: [
+        "libcvd_update_security_algorithm_builder",
+    ],
+    defaults: ["cuttlefish_host", "cvd_update_security_algorithm_defaults"],
+}
diff --git a/host/commands/cvd_update_security_algorithm/main.cc b/host/commands/cvd_update_security_algorithm/main.cc
new file mode 100644
index 000000000..7fdb9a3f7
--- /dev/null
+++ b/host/commands/cvd_update_security_algorithm/main.cc
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <string>
+
+#include <android-base/logging.h>
+#include <gflags/gflags.h>
+
+#include "common/libs/fs/shared_buf.h"
+#include "common/libs/fs/shared_fd.h"
+#include "host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.h"
+#include "host/libs/config/cuttlefish_config.h"
+
+DEFINE_int32(instance_num, cuttlefish::GetInstance(),
+             "Which instance to read the configs from");
+DEFINE_int32(modem_num, 0, "Which modem to send command to");
+DEFINE_int32(connection_event, 0,
+             "The tyoe if connection event. See "
+             "android.hardware.radio.network.ConnectionEvent");
+DEFINE_int32(encryption, 0,
+             "The encryption algorithm being used. See "
+             "android.hardware.radio.network.SecurityAlgorithm");
+DEFINE_int32(integrity, 0,
+             "The integrity algorithm being used. See "
+             "android.hardware.radio.network.SecurityAlgorithm");
+DEFINE_bool(is_unprotected_emergency, false,
+            "Whether the connection event is associated with an unprotected"
+            "emergency session");
+
+namespace cuttlefish {
+namespace {
+
+void UpdateSecurityAlgorithm(SharedFD fd) {
+  std::string command = fmt::format(
+      "REM{}{}", FLAGS_modem_num,
+      GetATCommand(FLAGS_connection_event, FLAGS_encryption, FLAGS_integrity,
+                   FLAGS_is_unprotected_emergency));
+
+  LOG(DEBUG) << "Attempting to send command: " << command;
+
+  long written = WriteAll(fd, command);
+  if (written != command.size()) {
+    LOG(FATAL) << "Failed to write data to shared fd. Tried to write "
+               << command.size() << " bytes, but only wrote " << written
+               << " bytes.";
+  }
+}
+
+int UpdateSecurityAlgorithmMain(int argc, char **argv) {
+  ::android::base::InitLogging(argv, android::base::StderrLogger);
+  google::ParseCommandLineFlags(&argc, &argv, true);
+
+  auto config = CuttlefishConfig::Get();
+  if (!config) {
+    LOG(FATAL) << "Failed to obtain config object";
+  }
+
+  auto cf_config = config->ForInstance(FLAGS_instance_num);
+  std::string socket_name =
+      fmt::format("modem_simulator{}", cf_config.modem_simulator_host_id());
+
+  LOG(INFO) << "Connecting over local socket: " << socket_name;
+  SharedFD modem_simulator_fd =
+      cuttlefish::SharedFD::SocketLocalClient(socket_name, true, SOCK_STREAM);
+
+  UpdateSecurityAlgorithm(modem_simulator_fd);
+
+  return 0;
+}
+
+}  // namespace
+}  // namespace cuttlefish
+
+int main(int argc, char **argv) {
+  return cuttlefish::UpdateSecurityAlgorithmMain(argc, argv);
+}
diff --git a/host/commands/cvd_update_security_algorithm/unittest/update_security_algorithm_command_builder_test.cc b/host/commands/cvd_update_security_algorithm/unittest/update_security_algorithm_command_builder_test.cc
new file mode 100644
index 000000000..9a776a212
--- /dev/null
+++ b/host/commands/cvd_update_security_algorithm/unittest/update_security_algorithm_command_builder_test.cc
@@ -0,0 +1,23 @@
+//
+// Copyright (C) 2023 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.h"
+
+#include <gtest/gtest.h>
+
+TEST(CommandBuilderTest, GetATCommand) {
+  std::string serialized = cuttlefish::GetATCommand(1, 2, 3, false);
+  ASSERT_EQ("AT+UPDATESECURITYALGORITHM:1,2,3,0\r", serialized);
+}
diff --git a/host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.cc b/host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.cc
new file mode 100644
index 000000000..2afe85320
--- /dev/null
+++ b/host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.cc
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.h"
+
+#include <string>
+
+#include <fmt/format.h>
+
+namespace cuttlefish {
+
+std::string GetATCommand(int32_t connection_event, int32_t encryption,
+                         int32_t integrity, bool is_unprotected_emergency) {
+  return fmt::format("AT+UPDATESECURITYALGORITHM:{},{},{},{:d}\r",
+                     connection_event, encryption, integrity,
+                     is_unprotected_emergency);
+}
+}  // namespace cuttlefish
diff --git a/host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.h b/host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.h
new file mode 100644
index 000000000..14c8e9ae2
--- /dev/null
+++ b/host/commands/cvd_update_security_algorithm/update_security_algorithm_command_builder.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <string>
+
+namespace cuttlefish {
+
+/**
+ * Constructs the AT command that updates the security algorithm that is
+ * reported by the cuttlefish RIL. The handler of the AT command will trigger
+ * unsolicited calls to
+ * aidl::android::hardware::radio::network::IRadioNetworkIndication::securityAlgorithmsUpdated.
+ */
+std::string GetATCommand(int32_t connection_event, int32_t encryption,
+                         int32_t integrity, bool is_unprotected_emergency);
+
+}  // namespace cuttlefish
diff --git a/host/commands/modem_simulator/network_service.cpp b/host/commands/modem_simulator/network_service.cpp
index 2334eb34b..d0c868921 100644
--- a/host/commands/modem_simulator/network_service.cpp
+++ b/host/commands/modem_simulator/network_service.cpp
@@ -108,6 +108,16 @@ std::vector<CommandHandler> NetworkService::InitializeCommandHandlers() {
                      [this](const Client& client, std::string& cmd) {
                        this->HandleReceiveRemoteVoiceDataReg(client, cmd);
                      }),
+      CommandHandler("+REMOTEIDDISCLOSURE",
+                     [this](const Client& client, std::string& cmd) {
+                       (void)client;
+                       this->HandleIdentifierDisclosure(cmd);
+                     }),
+      CommandHandler("+UPDATESECURITYALGORITHM",
+                     [this](const Client& client, std::string& cmd) {
+                       (void)client;
+                       this->HandleSecurityAlgorithmUpdate(cmd);
+                     }),
   };
   return (command_handlers);
 }
@@ -1245,6 +1255,16 @@ void NetworkService::HandleReceiveRemoteSignal(const Client& client,
   OnSignalStrengthChanged();
 }
 
+void NetworkService::HandleIdentifierDisclosure(const std::string& command) {
+  LOG(INFO) << "Handling disclosure event: " << command;
+  SendUnsolicitedCommand(command.substr(2));
+}
+
+void NetworkService::HandleSecurityAlgorithmUpdate(const std::string& command) {
+  LOG(INFO) << "Handling security algorithm update event: " << command;
+  SendUnsolicitedCommand(command.substr(2));
+}
+
 void NetworkService::OnSignalStrengthChanged() {
   SendUnsolicitedCommand(BuildCSQCommandResponse(GetCurrentSignalStrength()));
 }
diff --git a/host/commands/modem_simulator/network_service.h b/host/commands/modem_simulator/network_service.h
index 171cc115c..7fc69dfb4 100644
--- a/host/commands/modem_simulator/network_service.h
+++ b/host/commands/modem_simulator/network_service.h
@@ -307,6 +307,9 @@ class NetworkService : public ModemService, public std::enable_shared_from_this<
   };
 
   KeepSignalStrengthChangingLoop keep_signal_strength_changing_loop_;
+
+  void HandleIdentifierDisclosure(const std::string& command);
+  void HandleSecurityAlgorithmUpdate(const std::string& command);
 };
 
 }  // namespace cuttlefish
diff --git a/host/commands/run_cvd/main.cc b/host/commands/run_cvd/main.cc
index 1607978d9..d8db44185 100644
--- a/host/commands/run_cvd/main.cc
+++ b/host/commands/run_cvd/main.cc
@@ -254,7 +254,9 @@ Result<void> RunCvdMain(int argc, char** argv) {
     CF_EXPECT(late_injected->LateInject(injector));
   }
 
-  MetricsReceiver::LogMetricsVMStart();
+  if (config->enable_metrics() == cuttlefish::CuttlefishConfig::Answer::kYes) {
+    MetricsReceiver::LogMetricsVMStart();
+  }
 
   auto instance_bindings = injector.getMultibindings<InstanceLifecycle>();
   CF_EXPECT(instance_bindings.size() == 1);
diff --git a/host/commands/run_cvd/server_loop_impl.cpp b/host/commands/run_cvd/server_loop_impl.cpp
index 825cd88c1..1dd88fcfb 100644
--- a/host/commands/run_cvd/server_loop_impl.cpp
+++ b/host/commands/run_cvd/server_loop_impl.cpp
@@ -79,9 +79,11 @@ Result<void> ServerLoopImpl::LateInject(fruit::Injector<>& injector) {
 
 Result<void> ServerLoopImpl::Run() {
   // Monitor and restart host processes supporting the CVD
-  ProcessMonitor::Properties process_monitor_properties;
-  process_monitor_properties.RestartSubprocesses(
-      instance_.restart_subprocesses());
+  auto process_monitor_properties =
+      ProcessMonitor::Properties()
+          .RestartSubprocesses(instance_.restart_subprocesses())
+          .StraceLogDir(instance_.PerInstanceLogPath(""))
+          .StraceCommands(config_.straced_host_executables());
 
   for (auto& command_source : command_sources_) {
     if (command_source->Enabled()) {
diff --git a/host/commands/secure_env/rust/ffi.rs b/host/commands/secure_env/rust/ffi.rs
index cfd33a2ef..b39dbdbed 100644
--- a/host/commands/secure_env/rust/ffi.rs
+++ b/host/commands/secure_env/rust/ffi.rs
@@ -38,10 +38,12 @@ pub unsafe extern "C" fn kmr_ta_main(
     trm: *mut libc::c_void,
     snapshot_socket_fd: OwnedFd,
 ) {
-    let security_level = match security_level {
-        x if x == SecurityLevel::TrustedEnvironment as i32 => SecurityLevel::TrustedEnvironment,
-        x if x == SecurityLevel::Strongbox as i32 => SecurityLevel::Strongbox,
-        x if x == SecurityLevel::Software as i32 => SecurityLevel::Software,
+    let security_level = match SecurityLevel::n(security_level) {
+        Some(
+            x @ (SecurityLevel::Software
+            | SecurityLevel::TrustedEnvironment
+            | SecurityLevel::Strongbox),
+        ) => x,
         _ => {
             error!("unexpected security level {}, running as SOFTWARE", security_level);
             SecurityLevel::Software
diff --git a/host/commands/stop/main.cc b/host/commands/stop/main.cc
index 69449a67d..206b5806f 100644
--- a/host/commands/stop/main.cc
+++ b/host/commands/stop/main.cc
@@ -269,6 +269,11 @@ int main(int argc, char** argv) {
      */
     return 134;
   }
-  cuttlefish::MetricsReceiver::LogMetricsVMStop();
+
+  if (cuttlefish::CuttlefishConfig::Get()->enable_metrics() ==
+      cuttlefish::CuttlefishConfig::Answer::kYes) {
+    cuttlefish::MetricsReceiver::LogMetricsVMStop();
+  }
+
   return cuttlefish::StopCvdMain(wait_for_launcher, clear_instance_dirs);
 }
diff --git a/host/commands/tombstone_receiver/main.cpp b/host/commands/tombstone_receiver/main.cpp
index 8d68fe37a..310dbe688 100644
--- a/host/commands/tombstone_receiver/main.cpp
+++ b/host/commands/tombstone_receiver/main.cpp
@@ -21,6 +21,7 @@
 #include <fstream>
 
 #include "common/libs/fs/shared_fd.h"
+#include "common/libs/fs/shared_select.h"
 #include "common/libs/utils/flag_parser.h"
 #include "common/libs/utils/shared_fd_flag.h"
 #include "host/libs/config/logging.h"
@@ -48,6 +49,7 @@ static std::string next_tombstone_path(const std::string& dir) {
 }
 
 static constexpr size_t CHUNK_RECV_MAX_LEN = 1024;
+static constexpr size_t TIMEOUT_SEC = 3;
 
 int TombstoneReceiverMain(int argc, char** argv) {
   DefaultSubprocessLogging(argv);
@@ -82,17 +84,40 @@ int TombstoneReceiverMain(int argc, char** argv) {
     auto conn = SharedFD::Accept(*server_fd);
     std::ofstream file(next_tombstone_path(tombstone_dir),
                        std::ofstream::out | std::ofstream::binary);
+    auto acc = 0;
+    auto cnt = 0;
 
+    SharedFDSet read_set;
+    read_set.Set(conn);
+
+    SharedFDSet error_set;
+    error_set.Set(conn);
     while (file.is_open()) {
-      char buff[CHUNK_RECV_MAX_LEN];
-      auto bytes_read = conn->Read(buff, sizeof(buff));
-      if (bytes_read <= 0) {
-        // reset the other side if it's still connected
+      struct timeval timeout = {TIMEOUT_SEC, 0};
+      auto val = Select(&read_set, nullptr, &error_set, &timeout);
+      if (val == 0) {
+        LOG(DEBUG) << "timeout";
+        break;
+      }
+      if (read_set.IsSet(conn)) {
+        char buff[CHUNK_RECV_MAX_LEN];
+        auto bytes_read = conn->Recv(buff, sizeof(buff), 0);
+        acc += bytes_read;
+        if (bytes_read <= 0) {
+          // reset the other side if it's still connected
+          break;
+        } else {
+          file.write(buff, bytes_read);
+          cnt++;
+        }
+      }
+
+      if (error_set.IsSet(conn)) {
+        LOG(DEBUG) << "error";
         break;
-      } else {
-        file.write(buff, bytes_read);
       }
     }
+    LOG(DEBUG) << "done: " << acc << " bytes via " << cnt;
   }
 
   return 0;
diff --git a/host/cvd_test_configs/local_tests/local_bootconfig.json b/host/cvd_test_configs/local_tests/local_bootconfig.json
new file mode 100644
index 000000000..77d85688e
--- /dev/null
+++ b/host/cvd_test_configs/local_tests/local_bootconfig.json
@@ -0,0 +1,15 @@
+{
+  "common": {
+    "host_package": "/tmp/linux-x86"
+  },
+  "instances": [
+    {
+      "disk": {
+        "default_build": "/tmp/vsoc_x86_64"
+      },
+      "boot": {
+        "extra_bootconfig_args": "androidboot.W=X androidboot.Y=Z"
+      }
+    }
+  ]
+}
diff --git a/host/libs/config/cuttlefish_config.cpp b/host/libs/config/cuttlefish_config.cpp
index ae24886b7..8fda6e9e2 100644
--- a/host/libs/config/cuttlefish_config.cpp
+++ b/host/libs/config/cuttlefish_config.cpp
@@ -45,6 +45,10 @@ const char* kInstances = "instances";
 
 }  // namespace
 
+const char* const kVhostUserVsockModeAuto = "auto";
+const char* const kVhostUserVsockModeTrue = "true";
+const char* const kVhostUserVsockModeFalse = "false";
+
 const char* const kGpuModeAuto = "auto";
 const char* const kGpuModeDrmVirgl = "drm_virgl";
 const char* const kGpuModeGfxstream = "gfxstream";
@@ -454,23 +458,6 @@ std::vector<std::string> CuttlefishConfig::extra_kernel_cmdline() const {
   return cmdline;
 }
 
-static constexpr char kExtraBootconfigArgs[] = "extra_bootconfig_args";
-void CuttlefishConfig::set_extra_bootconfig_args(
-    const std::string& extra_bootconfig_args) {
-  Json::Value args_json_obj(Json::arrayValue);
-  for (const auto& arg : android::base::Split(extra_bootconfig_args, " ")) {
-    args_json_obj.append(arg);
-  }
-  (*dictionary_)[kExtraBootconfigArgs] = args_json_obj;
-}
-std::vector<std::string> CuttlefishConfig::extra_bootconfig_args() const {
-  std::vector<std::string> bootconfig;
-  for (const Json::Value& arg : (*dictionary_)[kExtraBootconfigArgs]) {
-    bootconfig.push_back(arg.asString());
-  }
-  return bootconfig;
-}
-
 static constexpr char kVirtioMac80211Hwsim[] = "virtio_mac80211_hwsim";
 void CuttlefishConfig::set_virtio_mac80211_hwsim(bool virtio_mac80211_hwsim) {
   (*dictionary_)[kVirtioMac80211Hwsim] = virtio_mac80211_hwsim;
@@ -552,6 +539,23 @@ void CuttlefishConfig::set_snapshot_path(const std::string& snapshot_path) {
   (*dictionary_)[kSnapshotPath] = snapshot_path;
 }
 
+static constexpr char kStracedExecutables[] = "straced_host_executables";
+void CuttlefishConfig::set_straced_host_executables(
+    const std::set<std::string>& straced_host_executables) {
+  Json::Value args_json_obj(Json::arrayValue);
+  for (const auto& arg : straced_host_executables) {
+    args_json_obj.append(arg);
+  }
+  (*dictionary_)[kStracedExecutables] = args_json_obj;
+}
+std::set<std::string> CuttlefishConfig::straced_host_executables() const {
+  std::set<std::string> straced_host_executables;
+  for (const Json::Value& arg : (*dictionary_)[kStracedExecutables]) {
+    straced_host_executables.insert(arg.asString());
+  }
+  return straced_host_executables;
+}
+
 /*static*/ CuttlefishConfig* CuttlefishConfig::BuildConfigImpl(
     const std::string& path) {
   auto ret = new CuttlefishConfig();
diff --git a/host/libs/config/cuttlefish_config.h b/host/libs/config/cuttlefish_config.h
index 6d2b5a27f..2e5d81599 100644
--- a/host/libs/config/cuttlefish_config.h
+++ b/host/libs/config/cuttlefish_config.h
@@ -194,9 +194,6 @@ class CuttlefishConfig {
   void set_extra_kernel_cmdline(const std::string& extra_cmdline);
   std::vector<std::string> extra_kernel_cmdline() const;
 
-  void set_extra_bootconfig_args(const std::string& extra_bootconfig_args);
-  std::vector<std::string> extra_bootconfig_args() const;
-
   // A directory containing the SSL certificates for the signaling server
   void set_webrtc_certs_dir(const std::string& certs_dir);
   std::string webrtc_certs_dir() const;
@@ -263,6 +260,9 @@ class CuttlefishConfig {
   std::string snapshot_path() const;
   void set_snapshot_path(const std::string& snapshot_path);
 
+  std::set<std::string> straced_host_executables() const;
+  void set_straced_host_executables(const std::set<std::string>& executables);
+
   bool IsCrosvm() const;
 
   class InstanceSpecific;
@@ -552,6 +552,7 @@ class CuttlefishConfig {
     bool enable_audio() const;
     bool enable_gnss_grpc_proxy() const;
     bool enable_bootanimation() const;
+    std::vector<std::string> extra_bootconfig_args() const;
     bool record_screen() const;
     std::string gem5_debug_file() const;
     bool protected_vm() const;
@@ -751,6 +752,7 @@ class CuttlefishConfig {
     void set_enable_audio(bool enable);
     void set_enable_gnss_grpc_proxy(const bool enable_gnss_grpc_proxy);
     void set_enable_bootanimation(const bool enable_bootanimation);
+    void set_extra_bootconfig_args(const std::string& extra_bootconfig_args);
     void set_record_screen(bool record_screen);
     void set_gem5_debug_file(const std::string& gem5_debug_file);
     void set_protected_vm(bool protected_vm);
@@ -935,6 +937,11 @@ class CuttlefishConfig {
   CuttlefishConfig& operator=(const CuttlefishConfig&) = delete;
 };
 
+// Vhost-user-vsock modes
+extern const char* const kVhostUserVsockModeAuto;
+extern const char* const kVhostUserVsockModeTrue;
+extern const char* const kVhostUserVsockModeFalse;
+
 // GPU modes
 extern const char* const kGpuModeAuto;
 extern const char* const kGpuModeDrmVirgl;
diff --git a/host/libs/config/cuttlefish_config_instance.cpp b/host/libs/config/cuttlefish_config_instance.cpp
index 04d287aaf..30b782068 100644
--- a/host/libs/config/cuttlefish_config_instance.cpp
+++ b/host/libs/config/cuttlefish_config_instance.cpp
@@ -807,6 +807,26 @@ void CuttlefishConfig::MutableInstanceSpecific::set_enable_bootanimation(
   (*Dictionary())[kEnableBootAnimation] = enable_bootanimation;
 }
 
+static constexpr char kExtraBootconfigArgsInstanced[] = "extra_bootconfig_args";
+std::vector<std::string>
+CuttlefishConfig::InstanceSpecific::extra_bootconfig_args() const {
+  std::string extra_bootconfig_args_str =
+      (*Dictionary())[kExtraBootconfigArgsInstanced].asString();
+  std::vector<std::string> bootconfig;
+  if (!extra_bootconfig_args_str.empty()) {
+    for (const auto& arg :
+         android::base::Split(extra_bootconfig_args_str, " ")) {
+      bootconfig.push_back(arg);
+    }
+  }
+  return bootconfig;
+}
+
+void CuttlefishConfig::MutableInstanceSpecific::set_extra_bootconfig_args(
+    const std::string& transport) {
+  (*Dictionary())[kExtraBootconfigArgsInstanced] = transport;
+}
+
 static constexpr char kRecordScreen[] = "record_screen";
 void CuttlefishConfig::MutableInstanceSpecific::set_record_screen(
     bool record_screen) {
diff --git a/host/libs/process_monitor/process_monitor.cc b/host/libs/process_monitor/process_monitor.cc
index a70021d9c..3dc97fe26 100644
--- a/host/libs/process_monitor/process_monitor.cc
+++ b/host/libs/process_monitor/process_monitor.cc
@@ -42,6 +42,7 @@
 
 #include "common/libs/fs/shared_buf.h"
 #include "common/libs/fs/shared_select.h"
+#include "common/libs/utils/contains.h"
 #include "common/libs/utils/result.h"
 #include "common/libs/utils/subprocess.h"
 #include "host/libs/command_util/runner/defs.h"
@@ -87,17 +88,6 @@ void LogSubprocessExit(const std::string& name, const siginfo_t& infop) {
   }
 }
 
-Result<void> StartSubprocesses(std::vector<MonitorEntry>& entries) {
-  LOG(DEBUG) << "Starting monitored subprocesses";
-  for (auto& monitored : entries) {
-    LOG(INFO) << monitored.cmd->GetShortName();
-    auto options = SubprocessOptions().InGroup(true);
-    monitored.proc.reset(new Subprocess(monitored.cmd->Start(options)));
-    CF_EXPECT(monitored.proc->Started(), "Failed to start subprocess");
-  }
-  return {};
-}
-
 Result<void> MonitorLoop(const std::atomic_bool& running,
                          std::mutex& properties_mutex,
                          const bool restart_subprocesses,
@@ -245,6 +235,26 @@ Result<void> SuspendResumeImpl(std::vector<MonitorEntry>& monitor_entries,
 
 }  // namespace
 
+Result<void> ProcessMonitor::StartSubprocesses(
+    ProcessMonitor::Properties& properties) {
+  LOG(DEBUG) << "Starting monitored subprocesses";
+  for (auto& monitored : properties.entries_) {
+    LOG(INFO) << monitored.cmd->GetShortName();
+    auto options = SubprocessOptions().InGroup(true);
+    std::string short_name = monitored.cmd->GetShortName();
+    auto last_slash = short_name.find_last_of('/');
+    if (last_slash != std::string::npos) {
+      short_name = short_name.substr(last_slash + 1);
+    }
+    if (Contains(properties_.strace_commands_, short_name)) {
+      options.Strace(properties.strace_log_dir_ + "/strace-" + short_name);
+    }
+    monitored.proc.reset(new Subprocess(monitored.cmd->Start(options)));
+    CF_EXPECT(monitored.proc->Started(), "Failed to start subprocess");
+  }
+  return {};
+}
+
 Result<void> ProcessMonitor::ReadMonitorSocketLoop(std::atomic_bool& running) {
   LOG(DEBUG) << "Waiting for a `stop` message from the parent";
   while (running.load()) {
@@ -310,6 +320,26 @@ ProcessMonitor::Properties ProcessMonitor::Properties::AddCommand(
   return std::move(AddCommand(std::move(cmd)));
 }
 
+ProcessMonitor::Properties& ProcessMonitor::Properties::StraceCommands(
+    std::set<std::string> strace) & {
+  strace_commands_ = std::move(strace);
+  return *this;
+}
+ProcessMonitor::Properties ProcessMonitor::Properties::StraceCommands(
+    std::set<std::string> strace) && {
+  return std::move(StraceCommands(std::move(strace)));
+}
+
+ProcessMonitor::Properties& ProcessMonitor::Properties::StraceLogDir(
+    std::string log_dir) & {
+  strace_log_dir_ = std::move(log_dir);
+  return *this;
+}
+ProcessMonitor::Properties ProcessMonitor::Properties::StraceLogDir(
+    std::string log_dir) && {
+  return std::move(StraceLogDir(std::move(log_dir)));
+}
+
 ProcessMonitor::ProcessMonitor(ProcessMonitor::Properties&& properties,
                                const SharedFD& secure_env_fd)
     : properties_(std::move(properties)),
@@ -403,7 +433,7 @@ Result<void> ProcessMonitor::MonitorRoutine() {
 #endif
 
   LOG(DEBUG) << "Monitoring subprocesses";
-  CF_EXPECT(StartSubprocesses(properties_.entries_));
+  CF_EXPECT(StartSubprocesses(properties_));
 
   std::atomic_bool running(true);
 
diff --git a/host/libs/process_monitor/process_monitor.h b/host/libs/process_monitor/process_monitor.h
index 0dade1c6c..d0b0aabe8 100644
--- a/host/libs/process_monitor/process_monitor.h
+++ b/host/libs/process_monitor/process_monitor.h
@@ -18,6 +18,8 @@
 #include <atomic>
 #include <memory>
 #include <mutex>
+#include <set>
+#include <string>
 #include <thread>
 #include <utility>
 #include <vector>
@@ -49,6 +51,12 @@ class ProcessMonitor {
     Properties& AddCommand(MonitorCommand) &;
     Properties AddCommand(MonitorCommand) &&;
 
+    Properties& StraceCommands(std::set<std::string>) &;
+    Properties StraceCommands(std::set<std::string>) &&;
+
+    Properties& StraceLogDir(std::string) &;
+    Properties StraceLogDir(std::string) &&;
+
     template <typename T>
     Properties& AddCommands(T commands) & {
       for (auto& command : commands) {
@@ -65,6 +73,8 @@ class ProcessMonitor {
    private:
     bool restart_subprocesses_;
     std::vector<MonitorEntry> entries_;
+    std::set<std::string> strace_commands_;
+    std::string strace_log_dir_;
 
     friend class ProcessMonitor;
   };
@@ -83,6 +93,7 @@ class ProcessMonitor {
   Result<void> ResumeMonitoredProcesses();
 
  private:
+  Result<void> StartSubprocesses(Properties& properties);
   Result<void> MonitorRoutine();
   Result<void> ReadMonitorSocketLoop(std::atomic_bool&);
   /*
diff --git a/host/libs/vm_manager/crosvm_manager.cpp b/host/libs/vm_manager/crosvm_manager.cpp
index 6c2781434..05d38d63e 100644
--- a/host/libs/vm_manager/crosvm_manager.cpp
+++ b/host/libs/vm_manager/crosvm_manager.cpp
@@ -241,6 +241,8 @@ Result<VhostUserDeviceCommands> BuildVhostUserGpu(
 
   // Why does this need JSON instead of just following the normal flags style...
   Json::Value gpu_params_json;
+  gpu_params_json["pci-address"] =
+      fmt::format("00:{:0>2x}.0", VmManager::kGpuPciSlotNum);
   if (gpu_mode == kGpuModeGfxstream) {
     gpu_params_json["context-types"] = "gfxstream-gles:gfxstream-vulkan";
     gpu_params_json["egl"] = true;
@@ -337,7 +339,9 @@ Result<void> ConfigureGpu(const CuttlefishConfig& config, Command* crosvm_cmd) {
   const std::string gpu_udmabuf_string =
       instance.enable_gpu_udmabuf() ? ",udmabuf=true" : "";
 
-  const std::string gpu_common_string = gpu_udmabuf_string + gpu_pci_bar_size;
+  const std::string gpu_common_string =
+      fmt::format(",pci-address=00:{:0>2x}.0", VmManager::kGpuPciSlotNum) +
+      gpu_udmabuf_string + gpu_pci_bar_size;
   const std::string gpu_common_3d_string =
       gpu_common_string + ",egl=true,surfaceless=true,glx=false" + gles_string;
 
diff --git a/host/libs/vm_manager/qemu_manager.cpp b/host/libs/vm_manager/qemu_manager.cpp
index 4887d7e52..58127943f 100644
--- a/host/libs/vm_manager/qemu_manager.cpp
+++ b/host/libs/vm_manager/qemu_manager.cpp
@@ -489,9 +489,10 @@ Result<std::vector<MonitorCommand>> QemuManager::StartCommands(
       }
     }
 
-    qemu_cmd.AddParameter(gpu_device, ",id=gpu0",
-                          ",xres=", display_config.width,
-                          ",yres=", display_config.height);
+    qemu_cmd.AddParameter(
+        gpu_device, ",id=gpu0",
+        fmt::format(",addr={:0>2x}.0", VmManager::kGpuPciSlotNum),
+        ",xres=", display_config.width, ",yres=", display_config.height);
   }
 
   if (!instance.console()) {
diff --git a/host/libs/vm_manager/vm_manager.h b/host/libs/vm_manager/vm_manager.h
index 850921704..b3fa4be6c 100644
--- a/host/libs/vm_manager/vm_manager.h
+++ b/host/libs/vm_manager/vm_manager.h
@@ -80,6 +80,10 @@ class VmManager {
   // the persistent disk
   static const int kDefaultNumBootDevices = 2;
 
+  // LINT.IfChange(virtio_gpu_pci_address)
+  static constexpr const int kGpuPciSlotNum = 2;
+  // LINT.ThenChange(../../../shared/sepolicy/vendor/genfs_contexts:virtio_gpu_pci_address)
+
   virtual ~VmManager() = default;
 
   virtual bool IsSupported() = 0;
diff --git a/host/libs/web/credential_source.cc b/host/libs/web/credential_source.cc
index 83119e7a1..963235c2c 100644
--- a/host/libs/web/credential_source.cc
+++ b/host/libs/web/credential_source.cc
@@ -21,6 +21,7 @@
 #include <android-base/strings.h>
 #include <json/json.h>
 #include <openssl/bio.h>
+#include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
 
diff --git a/shared/config/media_codecs_performance.xml b/shared/config/media_codecs_performance.xml
index f3c5c485a..a6b69d111 100644
--- a/shared/config/media_codecs_performance.xml
+++ b/shared/config/media_codecs_performance.xml
@@ -185,6 +185,16 @@
             <!-- MANUALLY ADJUSTED -->
             <Limit name="measured-frame-rate-1920x1080" range="17-54" />
         </MediaCodec>
+        <MediaCodec name="c2.android.av1-dav1d.decoder" type="video/av01" update="true">
+            <!-- MANUALLY ADJUSTED -->
+            <Limit name="measured-frame-rate-320x180" range="156-362" />
+            <!-- MANUALLY ADJUSTED -->
+            <Limit name="measured-frame-rate-640x360" range="63-162" />
+            <!-- MANUALLY ADJUSTED -->
+            <Limit name="measured-frame-rate-1280x720" range="40-110" />
+            <!-- MANUALLY ADJUSTED -->
+            <Limit name="measured-frame-rate-1920x1080" range="17-54" />
+        </MediaCodec>
         <MediaCodec name="OMX.google.h263.decoder" type="video/3gpp" update="true">
             <!-- 3 runs, min 1246 max 1390 gmean 1342 -->
             <Limit name="measured-frame-rate-176x144" range="1246-1390" />
diff --git a/shared/device.mk b/shared/device.mk
index 30ad25d89..8f83f595d 100644
--- a/shared/device.mk
+++ b/shared/device.mk
@@ -176,8 +176,6 @@ PRODUCT_PACKAGES += \
 PRODUCT_PACKAGES += \
     aidl_lazy_test_server \
     aidl_lazy_cb_test_server \
-    hidl_lazy_test_server \
-    hidl_lazy_cb_test_server
 
 # Runtime Resource Overlays
 PRODUCT_PACKAGES += com.google.aosp_cf.rros
@@ -227,7 +225,6 @@ PRODUCT_COPY_FILES += \
     frameworks/av/services/audiopolicy/config/r_submix_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/r_submix_audio_policy_configuration.xml \
     frameworks/av/services/audiopolicy/config/surround_sound_configuration_5_0.xml:$(TARGET_COPY_OUT_VENDOR)/etc/surround_sound_configuration_5_0.xml \
     frameworks/av/services/audiopolicy/config/usb_audio_policy_configuration.xml:$(TARGET_COPY_OUT_VENDOR)/etc/usb_audio_policy_configuration.xml \
-    frameworks/native/data/etc/android.hardware.audio.low_latency.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.audio.low_latency.xml \
     frameworks/native/data/etc/android.hardware.ethernet.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.ethernet.xml \
     frameworks/native/data/etc/android.hardware.usb.accessory.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.usb.accessory.xml \
     frameworks/native/data/etc/android.hardware.usb.host.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.usb.host.xml \
@@ -276,18 +273,8 @@ PRODUCT_PACKAGES += \
 PRODUCT_PACKAGES += \
     com.android.hardware.authsecret
 
-#
-# Audio HAL
-# Note: aidl services are loaded, however they are not fully functional yet,
-#       and are not used by the framework, only by VTS tests.
-#
 ifndef LOCAL_AUDIO_PRODUCT_PACKAGE
 LOCAL_AUDIO_PRODUCT_PACKAGE := \
-    android.hardware.audio.service \
-    android.hardware.audio@7.1-impl.ranchu \
-    android.hardware.audio.effect@7.0-impl \
-    android.hardware.audio.service-aidl.example \
-    android.hardware.audio.effect.service-aidl.example \
     libaecsw \
     libagc1sw \
     libagc2sw \
@@ -309,9 +296,22 @@ LOCAL_AUDIO_PRODUCT_PACKAGE := \
     libvirtualizersw \
     libvisualizeraidl \
     libvolumesw
+#
+# Still use HIDL Audio HAL on 'next'
+#
+ifeq ($(RELEASE_AIDL_USE_UNFROZEN),true)
+LOCAL_AUDIO_PRODUCT_PACKAGE += \
+    android.hardware.audio.service-aidl.example \
+    android.hardware.audio.effect.service-aidl.example
+else
+LOCAL_AUDIO_PRODUCT_PACKAGE += \
+    android.hardware.audio.service \
+    android.hardware.audio@7.1-impl.ranchu \
+    android.hardware.audio.effect@7.0-impl
 DEVICE_MANIFEST_FILE += \
     device/google/cuttlefish/guest/hals/audio/effects/manifest.xml
 endif
+endif
 
 ifndef LOCAL_AUDIO_PRODUCT_COPY_FILES
 LOCAL_AUDIO_PRODUCT_COPY_FILES := \
@@ -615,8 +615,4 @@ PRODUCT_CHECK_VENDOR_SEAPP_VIOLATIONS := true
 
 PRODUCT_CHECK_DEV_TYPE_VIOLATIONS := true
 
-ifeq ($(RELEASE_DEPRECATE_VNDK),true)
-KEEP_VNDK ?= false
-endif
-
-TARGET_BOARD_FASTBOOT_INFO_FILE = device/google/cuttlefish/shared/fastboot-info.txt
\ No newline at end of file
+TARGET_BOARD_FASTBOOT_INFO_FILE = device/google/cuttlefish/shared/fastboot-info.txt
diff --git a/shared/sepolicy/vendor/genfs_contexts b/shared/sepolicy/vendor/genfs_contexts
index e58a5212e..08350b49e 100644
--- a/shared/sepolicy/vendor/genfs_contexts
+++ b/shared/sepolicy/vendor/genfs_contexts
@@ -1,13 +1,15 @@
 dnl Run "m4 genfs_contexts" to test
 dnl
 dnl # $1 = pci prefix
-dnl # $2 = pci ID start (hex)
 pushdef(`cf_pci_gpu_device', `dnl
-genfscon sysfs $1/0000:00:eval($2, 16, 2).0/device u:object_r:sysfs_gpu:s0
-genfscon sysfs $1/0000:00:eval($2, 16, 2).0/subsystem_device u:object_r:sysfs_gpu:s0
-genfscon sysfs $1/0000:00:eval($2, 16, 2).0/subsystem_vendor u:object_r:sysfs_gpu:s0
-genfscon sysfs $1/0000:00:eval($2, 16, 2).0/uevent u:object_r:sysfs_gpu:s0
-genfscon sysfs $1/0000:00:eval($2, 16, 2).0/vendor u:object_r:sysfs_gpu:s0
+# VMM is configured to always assign the GPU to PCI address 00:02.0 (if present).
+# LINT.IfChange(virtio_gpu_pci_address)
+genfscon sysfs $1/0000:00:0000:00:02.0/device u:object_r:sysfs_gpu:s0
+genfscon sysfs $1/0000:00:0000:00:02.0/subsystem_device u:object_r:sysfs_gpu:s0
+genfscon sysfs $1/0000:00:0000:00:02.0/subsystem_vendor u:object_r:sysfs_gpu:s0
+genfscon sysfs $1/0000:00:0000:00:02.0/uevent u:object_r:sysfs_gpu:s0
+genfscon sysfs $1/0000:00:0000:00:02.0/vendor u:object_r:sysfs_gpu:s0
+# LINT.ThenChange(../../../host/libs/vm_manager/vm_manager.h:virtio_gpu_pci_address)
 dnl')dnl
 dnl
 dnl # $1 = rtc prefix
@@ -20,7 +22,7 @@ genfscon sysfs $1/rtc/rtc$2/alarmtimer.0.auto/wakeup u:object_r:sysfs_wakeup:s0
 dnl')dnl
 dnl
 # crosvm (x86)
-cf_pci_gpu_device(/devices/pci0000:00, 0x2)
+cf_pci_gpu_device(/devices/pci0000:00)
 ## find /sys/devices/platform/* -type d -name 'rtc[0-9]' | sed 's,/rtc[0-9],,'
 genfscon sysfs /devices/platform/rtc_cmos/rtc u:object_r:sysfs_rtc:s0
 ## find /sys/devices/LNXSYSTM:00/* -type d -name 'wakeup[0-9]*'
@@ -39,33 +41,33 @@ genfscon sysfs /devices/virtual/mac80211_hwsim/hwsim0/net u:object_r:sysfs_net:s
 genfscon sysfs /devices/virtual/mac80211_hwsim/hwsim1/net u:object_r:sysfs_net:s0
 
 # crosvm (arm64)
-cf_pci_gpu_device(/devices/platform/10000.pci/pci0000:00, 0x2)
+cf_pci_gpu_device(/devices/platform/10000.pci/pci0000:00)
 ## find /sys/devices/platform/* -type d -name 'rtc[0-9]' | sed 's,/rtc[0-9],,'
 genfscon sysfs /devices/platform/2000.rtc/rtc u:object_r:sysfs_rtc:s0
 ## find /sys/devices/platform/* -type d -name 'wakeup[0-9]'
 ## arm64 2000.rtc on crosvm does not currently expose a wakeup node
 
 # qemu (x86)
-#cf_pci_gpu_device(/devices/pci0000:00, 0x2) - duplicated with crosvm(x86)
+#cf_pci_gpu_device(/devices/pci0000:00) - duplicated with crosvm(x86)
 ## find /sys/devices/platform/* -type d -name 'rtc[0-9]' | sed 's,/rtc[0-9],,'
 genfscon sysfs /devices/pnp0/00:04/rtc u:object_r:sysfs_rtc:s0
 ## find /sys/devices/platform/* -type d -name 'wakeup[0-9][0-9]'
 cf_rtc_wakeup_alarmtimer(/devices/pnp0/00:04, 0, 19)
 
 # qemu (arm64)
-cf_pci_gpu_device(/devices/platform/4010000000.pcie/pci0000:00, 0x2)
+cf_pci_gpu_device(/devices/platform/4010000000.pcie/pci0000:00)
 ## find /sys/devices/platform/* -type d -name 'rtc[0-9]' | sed 's,/rtc[0-9],,'
 genfscon sysfs /devices/platform/9010000.pl031/rtc u:object_r:sysfs_rtc:s0
 ## find /sys/devices/platform/* -type d -name 'wakeup[0-9]'
 cf_rtc_wakeup_alarmtimer(/devices/platform/9010000.pl031, 0, 0)
 
 # qemu (arm)
-cf_pci_gpu_device(/devices/platform/3f000000.pcie/pci0000:00, 0x2)
+cf_pci_gpu_device(/devices/platform/3f000000.pcie/pci0000:00)
 genfscon sysfs /devices/platform/rtc-test.1/wakeup/wakeup2 u:object_r:sysfs_wakeup:s0
 genfscon sysfs /devices/platform/rtc-test.2/wakeup/wakeup3 u:object_r:sysfs_wakeup:s0
 
 # qemu (riscv64)
-cf_pci_gpu_device(/devices/platform/soc/30000000.pci/pci0000:00, 0x2)
+cf_pci_gpu_device(/devices/platform/soc/30000000.pci/pci0000:00)
 
 # common on all platforms / vm managers
 genfscon sysfs /devices/platform/rtc-test.0/rtc u:object_r:sysfs_rtc:s0
diff --git a/tests/hal/hal_implementation_test.cpp b/tests/hal/hal_implementation_test.cpp
index cd2fc610a..b3e052f3f 100644
--- a/tests/hal/hal_implementation_test.cpp
+++ b/tests/hal/hal_implementation_test.cpp
@@ -57,10 +57,12 @@ static const std::set<std::string> kKnownMissingHidl = {
     "android.hardware.audio@4.0",
     "android.hardware.audio@5.0",
     "android.hardware.audio@6.0",
+    "android.hardware.audio@7.1", // converted to AIDL, see b/264712385
     "android.hardware.audio.effect@2.0",
     "android.hardware.audio.effect@4.0",
     "android.hardware.audio.effect@5.0",
     "android.hardware.audio.effect@6.0",
+    "android.hardware.audio.effect@7.0", // converted to AIDL, see b/264712385
     "android.hardware.authsecret@1.0", // converted to AIDL, see b/182976659
     "android.hardware.automotive.audiocontrol@1.0",
     "android.hardware.automotive.audiocontrol@2.0",
@@ -140,6 +142,7 @@ static const std::set<std::string> kKnownMissingHidl = {
     "android.hidl.base@1.0",
     "android.hidl.memory.token@1.0",
     "android.hidl.memory@1.0", // Deprecated (see b/205764958)
+    "android.hidl.token@1.0", // deprecated (see b/218588089)
     "android.system.net.netd@1.1", // Converted to AIDL (see b/205764585)
     "android.system.suspend@1.0", // Converted to AIDL (see b/170260236)
     "android.system.wifi.keystore@1.0", // Converted to AIDL (see b/205764502)
diff --git a/tools/testing/gen_local_configs.sh b/tools/testing/gen_local_configs.sh
index 02da9e6e5..18863c86e 100755
--- a/tools/testing/gen_local_configs.sh
+++ b/tools/testing/gen_local_configs.sh
@@ -1,10 +1,16 @@
 
-# Run this script to generate.json files in
+# This utility generates .json files in
 # /tmp that match current AOSP build environment for testing.
+# These configs are used for cvd multi-vd testing.
 
-# Usage : run this script within the same shell /
+# Usage:
+# - First ensure you are within the same shell /
 # environment as a successful AOSP build.(or init
-# the environment via `lunch`, then execute this script)
+# the environment via `lunch` in new shell)
+# - Then navigate to the folder:
+# cd /device/google/cuttlefish/host/cvd_test_configs/local_tests
+# - Run this script
+# ../../../tools/testing/gen_local_configs.sh
 
 if [[ -z "${ANDROID_PRODUCT_OUT}" ]] || [[ -z "${ANDROID_HOST_OUT}" ]]; then
   echo "ANDROID_PRODUCT_OUT and ANDROID_HOST_OUT must be defined for this script to work. Did you run lunch?"