Snap for 11819808 from 6eb896f855ed0e8e25ea123edd569a239ebab28e to emu-35-1-releaseemu-35-1-release

Change-Id: Ib246d29e8805bc142f96240d06d8bffe406a2473

52 files changed, 793 insertions, 639 deletions

diff --git a/common/libs/utils/Android.bp b/common/libs/utils/Android.bp
index ee5d565e1..6ac56bfc7 100644
--- a/common/libs/utils/Android.bp
+++ b/common/libs/utils/Android.bp
@@ -30,6 +30,7 @@ cc_library {
         "network.cpp",
         "proc_file_utils.cpp",
         "shared_fd_flag.cpp",
+        "signals.cpp",
         "subprocess.cpp",
         "tcp_socket.cpp",
         "tee_logging.cpp",
diff --git a/common/libs/utils/signals.cpp b/common/libs/utils/signals.cpp
new file mode 100644
index 000000000..ab6fb9388
--- /dev/null
+++ b/common/libs/utils/signals.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "common/libs/utils/signals.h"
+
+#include <errno.h>
+#include <signal.h>
+#include <string.h>
+
+#include <vector>
+
+#include <android-base/logging.h>
+
+namespace cuttlefish {
+
+SignalMasker::SignalMasker(sigset_t signals) {
+  auto res = sigprocmask(SIG_SETMASK, &signals, &old_mask_);
+  auto err = errno;
+  CHECK(res == 0) << "Failed to set thread's blocked signal mask: "
+                  << strerror(err);
+}
+
+SignalMasker::~SignalMasker() {
+  auto res = sigprocmask(SIG_SETMASK, &old_mask_, NULL);
+  auto err = errno;
+  CHECK(res == 0) << "Failed to reset thread's blocked signal mask: "
+                  << strerror(err);
+}
+
+void ChangeSignalHandlers(void (*handler)(int), std::vector<int> signals) {
+  struct sigaction act;
+  act.sa_handler = handler;
+  sigemptyset(&act.sa_mask);
+  for (auto signal: signals) {
+    sigaddset(&act.sa_mask, signal);
+  }
+  act.sa_flags = 0;
+
+  for (auto signal : signals) {
+    sigaction(signal, &act, NULL);
+  }
+}
+
+}  // namespace cuttlefish
+
diff --git a/common/libs/utils/signals.h b/common/libs/utils/signals.h
new file mode 100644
index 000000000..4eb68437d
--- /dev/null
+++ b/common/libs/utils/signals.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <signal.h>
+
+#include <vector>
+
+namespace cuttlefish {
+
+/**
+ * Blocks signals for the current thread for the lifetime of the object.
+ *
+ * Provides a RAII interface to sigprocmask.
+ */
+class SignalMasker {
+ public:
+  /**
+   * Blocks the given signals until the object is destroyed.
+   */
+  SignalMasker(sigset_t signals);
+  SignalMasker(const SignalMasker&) = delete;
+  SignalMasker(SignalMasker&&) = delete;
+  SignalMasker operator=(const SignalMasker&) = delete;
+  SignalMasker operator=(SignalMasker&&) = delete;
+  ~SignalMasker();
+
+ private:
+  sigset_t old_mask_;
+};
+
+void ChangeSignalHandlers(void(*handler)(int), std::vector<int> signals);
+
+}  // namespace cuttlefish
diff --git a/common/libs/utils/subprocess.cpp b/common/libs/utils/subprocess.cpp
index 40b13c3cf..2ef5957d3 100644
--- a/common/libs/utils/subprocess.cpp
+++ b/common/libs/utils/subprocess.cpp
@@ -230,7 +230,7 @@ int Subprocess::Wait(siginfo_t* infop, int options) {
     return -1;
   }
   *infop = {};
-  auto retval = waitid(P_PID, pid_, infop, options);
+  auto retval = TEMP_FAILURE_RETRY(waitid(P_PID, pid_, infop, options));
   // We don't want to wait twice for the same process
   bool exited = infop->si_code == CLD_EXITED || infop->si_code == CLD_DUMPED;
   bool reaped = !(options & WNOWAIT);
diff --git a/guest/hals/ril/reference-ril/reference-ril.c b/guest/hals/ril/reference-ril/reference-ril.c
index b7915e109..c946db0f4 100644
--- a/guest/hals/ril/reference-ril/reference-ril.c
+++ b/guest/hals/ril/reference-ril/reference-ril.c
@@ -918,6 +918,10 @@ static void requestOrSendDataCallList(int cid, RIL_Token *t)
             continue;
 
         i = ncid - 1;
+
+        if (i >= n || i < 0)
+            goto error;
+
         // Assume no error
         responses[i].status = 0;
 
@@ -1054,14 +1058,21 @@ static void requestOrSendDataCallList(int cid, RIL_Token *t)
         &input, (responses) ? &responses[i].dnses : &sskip);  // dns_prim_addr
     if (err < 0) goto error;
 
+    size_t response_size = 0;
+    RIL_Data_Call_Response_v11 *presponse = NULL;
+    if (responses) {
+        if (i >= n || i < 0)
+            goto error;
+        presponse = &responses[i];
+        response_size = sizeof(*presponse);
+    }
+
     if (t != NULL)
       RIL_onRequestComplete(*t, RIL_E_SUCCESS,
-                            (responses != NULL) ? (responses + i) : responses,
-                            sizeof(RIL_Data_Call_Response_v11));
+                            presponse, response_size);
     else
         RIL_onUnsolicitedResponse(RIL_UNSOL_DATA_CALL_LIST_CHANGED,
-                                  responses,
-                                  n * sizeof(RIL_Data_Call_Response_v11));
+                                  responses, n * response_size);
 
     at_response_free(p_response);
     return;
diff --git a/host/commands/assemble_cvd/assemble_cvd.cc b/host/commands/assemble_cvd/assemble_cvd.cc
index 37d931af0..0f73d4d42 100644
--- a/host/commands/assemble_cvd/assemble_cvd.cc
+++ b/host/commands/assemble_cvd/assemble_cvd.cc
@@ -304,6 +304,32 @@ Result<const CuttlefishConfig*> InitFilesystemAndCreateConfig(
     const std::string snapshot_path = FLAGS_snapshot_path;
     if (!snapshot_path.empty()) {
       CF_EXPECT(RestoreHostFiles(config.root_dir(), snapshot_path));
+
+      // Add a delimiter to each log file so that we can clearly tell what
+      // happened before vs after the restore.
+      const std::string snapshot_delimiter =
+          "\n\n\n"
+          "============ SNAPSHOT RESTORE POINT ============\n"
+          "Lines above are pre-snapshot.\n"
+          "Lines below are post-restore.\n"
+          "================================================\n"
+          "\n\n\n";
+      for (const auto& instance : config.Instances()) {
+        const auto log_files =
+            CF_EXPECT(DirectoryContents(instance.PerInstanceLogPath("")));
+        for (const auto& filename : log_files) {
+          if (filename == "." || filename == "..") {
+            continue;
+          }
+          const std::string path = instance.PerInstanceLogPath(filename);
+          auto fd = SharedFD::Open(path, O_WRONLY | O_APPEND);
+          CF_EXPECT(fd->IsOpen(),
+                    "failed to open " << path << ": " << fd->StrError());
+          const ssize_t n = WriteAll(fd, snapshot_delimiter);
+          CF_EXPECT(n == snapshot_delimiter.size(),
+                    "failed to write to " << path << ": " << fd->StrError());
+        }
+      }
     }
 
     // take the max value of modem_simulator_instance_number in each instance
diff --git a/host/commands/assemble_cvd/bootconfig_args.cpp b/host/commands/assemble_cvd/bootconfig_args.cpp
index b757102f3..baa1d9030 100644
--- a/host/commands/assemble_cvd/bootconfig_args.cpp
+++ b/host/commands/assemble_cvd/bootconfig_args.cpp
@@ -111,8 +111,7 @@ Result<std::unordered_map<std::string, std::string>> BootconfigArgsFromConfig(
         std::to_string(instance.tombstone_receiver_port());
   }
 
-  const auto enable_confui =
-      (config.vm_manager() == QemuManager::name() ? 0 : 1);
+  const auto enable_confui = (config.vm_manager() == VmmMode::kQemu ? 0 : 1);
   bootconfig_args["androidboot.enable_confirmationui"] =
       std::to_string(enable_confui);
 
@@ -173,7 +172,7 @@ Result<std::unordered_map<std::string, std::string>> BootconfigArgsFromConfig(
   if (instance.target_arch() == Arch::X86 ||
       instance.target_arch() == Arch::X86_64) {
     bootconfig_args["androidboot.hypervisor.version"] =
-        "cf-" + config.vm_manager();
+        "cf-" + ToString(config.vm_manager());
     bootconfig_args["androidboot.hypervisor.vm.supported"] = "1";
   } else {
     bootconfig_args["androidboot.hypervisor.vm.supported"] = "0";
diff --git a/host/commands/assemble_cvd/disk/gem5_image_unpacker.cpp b/host/commands/assemble_cvd/disk/gem5_image_unpacker.cpp
index f4d91f876..b60bd39ba 100644
--- a/host/commands/assemble_cvd/disk/gem5_image_unpacker.cpp
+++ b/host/commands/assemble_cvd/disk/gem5_image_unpacker.cpp
@@ -26,7 +26,7 @@ namespace cuttlefish {
 
 Result<void> Gem5ImageUnpacker(const CuttlefishConfig& config,
                                KernelRamdiskRepacker& /* dependency */) {
-  if (config.vm_manager() != vm_manager::Gem5Manager::name()) {
+  if (config.vm_manager() != VmmMode::kGem5) {
     return {};
   }
   // TODO: b/281130788 - This should accept InstanceSpecific as an argument
diff --git a/host/commands/assemble_cvd/disk/generate_persistent_bootconfig.cpp b/host/commands/assemble_cvd/disk/generate_persistent_bootconfig.cpp
index 7960b631b..04ebafa87 100644
--- a/host/commands/assemble_cvd/disk/generate_persistent_bootconfig.cpp
+++ b/host/commands/assemble_cvd/disk/generate_persistent_bootconfig.cpp
@@ -78,7 +78,7 @@ Result<void> GeneratePersistentBootconfig(
                                 << bootconfig_path
                                 << "` failed:" << bootconfig_fd->StrError());
 
-  if (config.vm_manager() == vm_manager::Gem5Manager::name()) {
+  if (config.vm_manager() == VmmMode::kGem5) {
     const off_t bootconfig_size_bytes_gem5 =
         AlignToPowerOf2(bytesWritten, PARTITION_SIZE_SHIFT);
     CF_EXPECT(bootconfig_fd->Truncate(bootconfig_size_bytes_gem5) == 0);
diff --git a/host/commands/assemble_cvd/disk/initialize_instance_composite_disk.cc b/host/commands/assemble_cvd/disk/initialize_instance_composite_disk.cc
index 6658a2bd8..ed6d36aa7 100644
--- a/host/commands/assemble_cvd/disk/initialize_instance_composite_disk.cc
+++ b/host/commands/assemble_cvd/disk/initialize_instance_composite_disk.cc
@@ -84,7 +84,7 @@ std::vector<ImagePartition> PersistentAPCompositeDiskConfig(
 }  // namespace
 
 bool IsVmManagerQemu(const CuttlefishConfig& config) {
-  return config.vm_manager() == vm_manager::QemuManager::name();
+  return config.vm_manager() == VmmMode::kQemu;
 }
 Result<void> InitializeInstanceCompositeDisk(
     const CuttlefishConfig& config,
diff --git a/host/commands/assemble_cvd/disk/kernel_ramdisk_repacker.cpp b/host/commands/assemble_cvd/disk/kernel_ramdisk_repacker.cpp
index 46d49a549..6268d8604 100644
--- a/host/commands/assemble_cvd/disk/kernel_ramdisk_repacker.cpp
+++ b/host/commands/assemble_cvd/disk/kernel_ramdisk_repacker.cpp
@@ -136,7 +136,8 @@ class KernelRamdiskRepackerImpl : public KernelRamdiskRepacker {
     // large to be repacked. Skip repack of boot.img on Gem5, as we need to be
     // able to extract the ramdisk.img in a later stage and so this step must
     // not fail (..and the repacked kernel wouldn't be used anyway).
-    if (instance_.kernel_path().size() && config_.vm_manager() != Gem5Manager::name()) {
+    if (instance_.kernel_path().size() &&
+        config_.vm_manager() != VmmMode::kGem5) {
       CF_EXPECT(RepackBootImage(avb_, instance_.kernel_path(), instance_.boot_image(),
                                 instance_.new_boot_image(), instance_.instance_dir()),
                 "Failed to regenerate the boot image with the new kernel");
diff --git a/host/commands/assemble_cvd/disk_builder.cpp b/host/commands/assemble_cvd/disk_builder.cpp
index b7f6b4198..d6ee26ba4 100644
--- a/host/commands/assemble_cvd/disk_builder.cpp
+++ b/host/commands/assemble_cvd/disk_builder.cpp
@@ -91,11 +91,11 @@ DiskBuilder DiskBuilder::CrosvmPath(std::string crosvm_path) && {
   return *this;
 }
 
-DiskBuilder& DiskBuilder::VmManager(std::string vm_manager) & {
+DiskBuilder& DiskBuilder::VmManager(VmmMode vm_manager) & {
   vm_manager_ = std::move(vm_manager);
   return *this;
 }
-DiskBuilder DiskBuilder::VmManager(std::string vm_manager) && {
+DiskBuilder DiskBuilder::VmManager(VmmMode vm_manager) && {
   vm_manager_ = std::move(vm_manager);
   return *this;
 }
@@ -139,7 +139,7 @@ DiskBuilder DiskBuilder::ResumeIfPossible(bool resume_if_possible) && {
 Result<std::string> DiskBuilder::TextConfig() {
   std::ostringstream disk_conf;
 
-  CF_EXPECT(!vm_manager_.empty(), "Missing vm_manager");
+  CF_EXPECT(vm_manager_ != VmmMode::kUnknown, "Missing vm_manager");
   disk_conf << vm_manager_ << "\n";
 
   CF_EXPECT(!partitions_.empty() ^ !entire_disk_.empty(),
@@ -195,8 +195,8 @@ Result<bool> DiskBuilder::BuildCompositeDiskIfNecessary() {
     return false;
   }
 
-  CF_EXPECT(!vm_manager_.empty());
-  if (vm_manager_ == vm_manager::CrosvmManager::name()) {
+  CF_EXPECT(vm_manager_ != VmmMode::kUnknown);
+  if (vm_manager_ == VmmMode::kCrosvm) {
     CF_EXPECT(!header_path_.empty(), "No header path");
     CF_EXPECT(!footer_path_.empty(), "No footer path");
     CreateCompositeDisk(partitions_, AbsolutePath(header_path_),
diff --git a/host/commands/assemble_cvd/disk_builder.h b/host/commands/assemble_cvd/disk_builder.h
index 424a5ad63..6b3be7bd0 100644
--- a/host/commands/assemble_cvd/disk_builder.h
+++ b/host/commands/assemble_cvd/disk_builder.h
@@ -42,8 +42,8 @@ class DiskBuilder {
   DiskBuilder& CrosvmPath(std::string crosvm_path) &;
   DiskBuilder CrosvmPath(std::string crosvm_path) &&;
 
-  DiskBuilder& VmManager(std::string vm_manager) &;
-  DiskBuilder VmManager(std::string vm_manager) &&;
+  DiskBuilder& VmManager(VmmMode vm_manager) &;
+  DiskBuilder VmManager(VmmMode vm_manager) &&;
 
   DiskBuilder& ConfigPath(std::string config_path) &;
   DiskBuilder ConfigPath(std::string config_path) &&;
@@ -70,7 +70,7 @@ class DiskBuilder {
   std::string entire_disk_;
   std::string header_path_;
   std::string footer_path_;
-  std::string vm_manager_;
+  VmmMode vm_manager_ = VmmMode::kUnknown;
   std::string crosvm_path_;
   std::string config_path_;
   std::string composite_disk_path_;
diff --git a/host/commands/assemble_cvd/disk_flags.cc b/host/commands/assemble_cvd/disk_flags.cc
index 6f23e0323..d7fac9688 100644
--- a/host/commands/assemble_cvd/disk_flags.cc
+++ b/host/commands/assemble_cvd/disk_flags.cc
@@ -625,7 +625,7 @@ Result<void> InitializeSdCard(
   CF_EXPECT(CreateBlankImage(instance.sdcard_path(),
                              instance.blank_sdcard_image_mb(), "sdcard"),
             "Failed to create \"" << instance.sdcard_path() << "\"");
-  if (config.vm_manager() == "qemu_cli") {
+  if (config.vm_manager() == VmmMode::kQemu) {
     const std::string crosvm_path = instance.crosvm_binary();
     CreateQcowOverlay(crosvm_path, instance.sdcard_path(),
                       instance.sdcard_overlay_path());
@@ -927,8 +927,7 @@ Result<void> DiskImageFlagsVectorization(CuttlefishConfig& config, const Fetcher
     // Repacking a boot.img changes boot_image and vendor_boot_image paths
     const CuttlefishConfig& const_config = const_cast<const CuttlefishConfig&>(config);
     const CuttlefishConfig::InstanceSpecific const_instance = const_config.ForInstance(num);
-    if (cur_kernel_path.size() &&
-        config.vm_manager() != Gem5Manager::name()) {
+    if (cur_kernel_path.size() && config.vm_manager() != VmmMode::kGem5) {
       const std::string new_boot_image_path =
           const_instance.PerInstancePath("boot_repacked.img");
       // change the new flag value to corresponding instance
@@ -1078,7 +1077,7 @@ Result<void> CreateDynamicDiskFiles(const FetcherConfig& fetcher_config,
     }
     // Gem5 Simulate per-instance what the bootloader would usually do
     // Since on other devices this runs every time, just do it here every time
-    if (config.vm_manager() == Gem5Manager::name()) {
+    if (config.vm_manager() == VmmMode::kGem5) {
       RepackGem5BootImage(instance.PerInstancePath("initrd.img"),
                           instance.persistent_bootconfig_path(),
                           config.assembly_dir(), instance.initramfs_path());
diff --git a/host/commands/assemble_cvd/flags.cc b/host/commands/assemble_cvd/flags.cc
index eef579c82..0bbc749f4 100644
--- a/host/commands/assemble_cvd/flags.cc
+++ b/host/commands/assemble_cvd/flags.cc
@@ -973,11 +973,12 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
   // TODO(weihsu), b/250988697: moved bootconfig_supported and hctr2_supported
   // into each instance, but target_arch is still in todo
   // target_arch should be in instance later
-  auto vmm = GetVmManager(vm_manager_vec[0], guest_configs[0].target_arch);
+  auto vmm_mode = CF_EXPECT(ParseVmm(vm_manager_vec[0]));
+  auto vmm = GetVmManager(vmm_mode, guest_configs[0].target_arch);
   if (!vmm) {
     LOG(FATAL) << "Invalid vm_manager: " << vm_manager_vec[0];
   }
-  tmp_config_obj.set_vm_manager(vm_manager_vec[0]);
+  tmp_config_obj.set_vm_manager(vmm_mode);
   tmp_config_obj.set_ap_vm_manager(vm_manager_vec[0] + "_openwrt");
 
   auto secure_hals_strs =
@@ -1373,7 +1374,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
       std::set<Arch> default_on_arch = {Arch::Arm64};
       if (guest_configs[instance_index].vhost_user_vsock) {
         instance.set_vhost_user_vsock(true);
-      } else if (tmp_config_obj.vm_manager() == CrosvmManager::name() &&
+      } else if (tmp_config_obj.vm_manager() == VmmMode::kCrosvm &&
                  default_on_arch.find(
                      guest_configs[instance_index].target_arch) !=
                      default_on_arch.end()) {
@@ -1383,7 +1384,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
       }
     } else if (vhost_user_vsock_vec[instance_index] ==
                kVhostUserVsockModeTrue) {
-      CHECK(tmp_config_obj.vm_manager() == CrosvmManager::name())
+      CHECK(tmp_config_obj.vm_manager() == VmmMode::kCrosvm)
           << "For now, only crosvm supports vhost_user_vsock";
       instance.set_vhost_user_vsock(true);
     } else if (vhost_user_vsock_vec[instance_index] ==
@@ -1552,7 +1553,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
     const std::string gpu_mode = CF_EXPECT(ConfigureGpuSettings(
         gpu_mode_vec[instance_index], gpu_vhost_user_mode_vec[instance_index],
         gpu_renderer_features_vec[instance_index],
-        gpu_context_types_vec[instance_index], vm_manager_vec[instance_index],
+        gpu_context_types_vec[instance_index], vmm_mode,
         guest_configs[instance_index], instance));
     calculated_gpu_mode_vec[instance_index] = gpu_mode_vec[instance_index];
 
@@ -1633,7 +1634,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
     bool os_overlay = true;
     os_overlay &= !protected_vm_vec[instance_index];
     // Gem5 already uses CoW wrappers around disk images
-    os_overlay &= vm_manager_vec[0] != Gem5Manager::name();
+    os_overlay &= vmm_mode != VmmMode::kGem5;
     os_overlay &= FLAGS_use_overlay;
     if (os_overlay) {
       auto path = const_instance.PerInstancePath("overlay.img");
@@ -1644,13 +1645,14 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
 
     bool persistent_disk = true;
     persistent_disk &= !protected_vm_vec[instance_index];
-    persistent_disk &= vm_manager_vec[0] != Gem5Manager::name();
+    persistent_disk &= vmm_mode != VmmMode::kGem5;
     if (persistent_disk) {
 #ifdef __APPLE__
       const std::string persistent_composite_img_base =
           "persistent_composite.img";
 #else
-      const bool is_vm_qemu_cli = (tmp_config_obj.vm_manager() == "qemu_cli");
+      const bool is_vm_qemu_cli =
+          (tmp_config_obj.vm_manager() == VmmMode::kQemu);
       const std::string persistent_composite_img_base =
           is_vm_qemu_cli ? "persistent_composite_overlay.img"
                          : "persistent_composite.img";
@@ -1666,7 +1668,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
     sdcard &= use_sdcard_vec[instance_index];
     sdcard &= !protected_vm_vec[instance_index];
     if (sdcard) {
-      if (tmp_config_obj.vm_manager() == "qemu_cli") {
+      if (tmp_config_obj.vm_manager() == VmmMode::kQemu) {
         virtual_disk_paths.push_back(const_instance.sdcard_overlay_path());
       } else {
         virtual_disk_paths.push_back(const_instance.sdcard_path());
@@ -1765,7 +1767,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
     auto external_network_mode = CF_EXPECT(
         ParseExternalNetworkMode(device_external_network_vec[instance_index]));
     CF_EXPECT(external_network_mode == ExternalNetworkMode::kTap ||
-                  vm_manager_vec[instance_index] == QemuManager::name(),
+                  vmm_mode == VmmMode::kQemu,
               "TODO(b/286284441): slirp only works on QEMU");
     instance.set_external_network_mode(external_network_mode);
 
@@ -1824,7 +1826,7 @@ Result<CuttlefishConfig> InitializeCuttlefishConfiguration(
           .ForEnvironment(environment_name);
   CF_EXPECT(CheckSnapshotCompatible(
                 FLAGS_snapshot_compatible &&
-                    (tmp_config_obj.vm_manager() == CrosvmManager::name()) &&
+                    (tmp_config_obj.vm_manager() == VmmMode::kCrosvm) &&
                     instance_nums.size() == 1,
                 calculated_gpu_mode_vec),
             "The set of flags is incompatible with snapshot");
@@ -2057,23 +2059,27 @@ Result<std::vector<GuestConfig>> GetGuestConfigAndSetDefaults() {
   }
   if (FLAGS_vm_manager == "") {
     if (IsHostCompatible(guest_configs[0].target_arch)) {
-      FLAGS_vm_manager = CrosvmManager::name();
+      FLAGS_vm_manager = ToString(VmmMode::kCrosvm);
     } else {
-      FLAGS_vm_manager = QemuManager::name();
+      FLAGS_vm_manager = ToString(VmmMode::kQemu);
     }
   }
-  // TODO(weihsu), b/250988697:
-  // Currently, all instances should use same vmm
+
   std::vector<std::string> vm_manager_vec =
       android::base::Split(FLAGS_vm_manager, ",");
+
+  // TODO(weihsu), b/250988697:
+  // Currently, all instances should use same vmm
+  auto vmm = CF_EXPECT(ParseVmm(vm_manager_vec[0]));
+
   // get flag default values and store into map
   auto name_to_default_value = CurrentFlagsToDefaultValue();
 
-  if (vm_manager_vec[0] == QemuManager::name()) {
+  if (vmm == VmmMode::kQemu) {
     CF_EXPECT(SetDefaultFlagsForQemu(guest_configs[0].target_arch, name_to_default_value));
-  } else if (vm_manager_vec[0] == CrosvmManager::name()) {
+  } else if (vmm == VmmMode::kCrosvm) {
     CF_EXPECT(SetDefaultFlagsForCrosvm(guest_configs, name_to_default_value));
-  } else if (vm_manager_vec[0] == Gem5Manager::name()) {
+  } else if (vmm == VmmMode::kGem5) {
     // TODO: Get the other architectures working
     if (guest_configs[0].target_arch != Arch::Arm64) {
       return CF_ERR("Gem5 only supports ARM64");
@@ -2082,7 +2088,7 @@ Result<std::vector<GuestConfig>> GetGuestConfigAndSetDefaults() {
   } else {
     return CF_ERR("Unknown Virtual Machine Manager: " << FLAGS_vm_manager);
   }
-  if (vm_manager_vec[0] != Gem5Manager::name()) {
+  if (vmm != VmmMode::kGem5) {
     // After SetCommandLineOptionWithMode in SetDefaultFlagsForCrosvm/Qemu,
     // default flag values changed, need recalculate name_to_default_value
     name_to_default_value = CurrentFlagsToDefaultValue();
diff --git a/host/commands/assemble_cvd/flags_defaults.h b/host/commands/assemble_cvd/flags_defaults.h
index 34d69b38b..f1072fbfa 100644
--- a/host/commands/assemble_cvd/flags_defaults.h
+++ b/host/commands/assemble_cvd/flags_defaults.h
@@ -90,7 +90,8 @@
 #define CF_DEFAULTS_USE_RANDOM_SERIAL false
 #define CF_DEFAULTS_SERIAL_NUMBER \
   cuttlefish::ForCurrentInstance("CUTTLEFISHCVD")
-#define CF_DEFAULTS_SECURE_HALS "keymint,gatekeeper,oemlock"
+#define CF_DEFAULTS_SECURE_HALS \
+  "oemlock,guest_keymint_insecure,guest_gatekeeper_insecure"
 #define CF_DEFAULTS_PROTECTED_VM false
 #define CF_DEFAULTS_MTE false
 
diff --git a/host/commands/assemble_cvd/graphics_flags.cc b/host/commands/assemble_cvd/graphics_flags.cc
index e5e7e4424..d843f5118 100644
--- a/host/commands/assemble_cvd/graphics_flags.cc
+++ b/host/commands/assemble_cvd/graphics_flags.cc
@@ -24,9 +24,8 @@
 #include <google/protobuf/text_format.h>
 
 #include "common/libs/utils/contains.h"
+#include "common/libs/utils/subprocess.h"
 #include "host/libs/config/cuttlefish_config.h"
-#include "host/libs/vm_manager/crosvm_manager.h"
-#include "host/libs/vm_manager/qemu_manager.h"
 
 #ifdef __APPLE__
 #define CF_UNUSED_ON_MACOS [[maybe_unused]]
@@ -232,7 +231,7 @@ GetNeededVhostUserGpuHostRendererFeatures(
 
 #ifndef __APPLE__
 Result<std::string> SelectGpuMode(
-    const std::string& gpu_mode_arg, const std::string& vm_manager,
+    const std::string& gpu_mode_arg, VmmMode vmm,
     const GuestConfig& guest_config,
     const gfxstream::proto::GraphicsAvailability& graphics_availability) {
   if (gpu_mode_arg != kGpuModeAuto && gpu_mode_arg != kGpuModeDrmVirgl &&
@@ -260,7 +259,7 @@ Result<std::string> SelectGpuMode(
       LOG(INFO) << "GPU auto mode: detected prerequisites for accelerated "
                 << "rendering support.";
 
-      if (vm_manager == vm_manager::QemuManager::name() && !UseQemuPrebuilt()) {
+      if (vmm == VmmMode::kQemu && !UseQemuPrebuilt()) {
         LOG(INFO) << "Not using QEMU prebuilt (QEMU 8+): selecting guest swiftshader";
         return kGpuModeGuestSwiftshader;
       } else if (!guest_config.gfxstream_supported) {
@@ -290,7 +289,7 @@ Result<std::string> SelectGpuMode(
                     "--gpu_mode=auto or --gpu_mode=guest_swiftshader.";
     }
 
-    if (vm_manager == vm_manager::QemuManager::name() && !UseQemuPrebuilt()) {
+    if (vmm == VmmMode::kQemu && !UseQemuPrebuilt()) {
       LOG(INFO) << "Not using QEMU prebuilt (QEMU 8+): selecting guest swiftshader";
       return kGpuModeGuestSwiftshader;
     }
@@ -301,7 +300,7 @@ Result<std::string> SelectGpuMode(
 
 Result<bool> SelectGpuVhostUserMode(const std::string& gpu_mode,
                                     const std::string& gpu_vhost_user_mode_arg,
-                                    const std::string& vm_manager) {
+                                    VmmMode vmm) {
   CF_EXPECT(gpu_vhost_user_mode_arg == kGpuVhostUserModeAuto ||
             gpu_vhost_user_mode_arg == kGpuVhostUserModeOn ||
             gpu_vhost_user_mode_arg == kGpuVhostUserModeOff);
@@ -313,9 +312,9 @@ Result<bool> SelectGpuVhostUserMode(const std::string& gpu_mode,
       return false;
     }
 
-    if (vm_manager != vm_manager::CrosvmManager::name()) {
-      LOG(INFO) << "GPU vhost user auto mode: not yet supported with "
-                << vm_manager << ". Not enabling vhost user gpu.";
+    if (vmm != VmmMode::kCrosvm) {
+      LOG(INFO) << "GPU vhost user auto mode: not yet supported with " << vmm
+                << ". Not enabling vhost user gpu.";
       return false;
     }
 
@@ -490,12 +489,12 @@ static std::unordered_set<std::string> kSupportedGpuContexts{
 Result<std::string> ConfigureGpuSettings(
     const std::string& gpu_mode_arg, const std::string& gpu_vhost_user_mode_arg,
     const std::string& gpu_renderer_features_arg,
-    std::string& gpu_context_types_arg, const std::string& vm_manager,
+    std::string& gpu_context_types_arg, VmmMode vmm,
     const GuestConfig& guest_config,
     CuttlefishConfig::MutableInstanceSpecific& instance) {
 #ifdef __APPLE__
   (void)gpu_vhost_user_mode_arg;
-  (void)vm_manager;
+  (void)vmm;
   (void)guest_config;
   CF_EXPECT(gpu_mode_arg == kGpuModeAuto ||
             gpu_mode_arg == kGpuModeGuestSwiftshader ||
@@ -521,10 +520,10 @@ Result<std::string> ConfigureGpuSettings(
                << graphics_availability.DebugString();
   }
 
-  const std::string gpu_mode = CF_EXPECT(SelectGpuMode(
-      gpu_mode_arg, vm_manager, guest_config, graphics_availability));
-  const bool enable_gpu_vhost_user = CF_EXPECT(
-      SelectGpuVhostUserMode(gpu_mode, gpu_vhost_user_mode_arg, vm_manager));
+  const std::string gpu_mode = CF_EXPECT(
+      SelectGpuMode(gpu_mode_arg, vmm, guest_config, graphics_availability));
+  const bool enable_gpu_vhost_user =
+      CF_EXPECT(SelectGpuVhostUserMode(gpu_mode, gpu_vhost_user_mode_arg, vmm));
 
   if (gpu_mode == kGpuModeGfxstream ||
       gpu_mode == kGpuModeGfxstreamGuestAngle ||
diff --git a/host/commands/assemble_cvd/graphics_flags.h b/host/commands/assemble_cvd/graphics_flags.h
index 63a4df13e..83297243f 100644
--- a/host/commands/assemble_cvd/graphics_flags.h
+++ b/host/commands/assemble_cvd/graphics_flags.h
@@ -27,7 +27,7 @@ namespace cuttlefish {
 Result<std::string> ConfigureGpuSettings(
     const std::string& gpu_mode_arg, const std::string& gpu_vhost_user_mode_arg,
     const std::string& gpu_renderer_features_arg,
-    std::string& gpu_context_types_arg, const std::string& vm_manager,
+    std::string& gpu_context_types_arg, VmmMode vmm,
     const GuestConfig& guest_config,
     CuttlefishConfig::MutableInstanceSpecific& instance);
 
diff --git a/host/commands/metrics/events.cc b/host/commands/metrics/events.cc
index 3d3a7c14a..ec0147e9a 100644
--- a/host/commands/metrics/events.cc
+++ b/host/commands/metrics/events.cc
@@ -94,10 +94,10 @@ cuttlefish::MetricsEvent::VmmType GetVmmManager() {
   auto config = cuttlefish::CuttlefishConfig::Get();
   CHECK(config) << "Could not open cuttlefish config";
   auto vmm = config->vm_manager();
-  if (vmm == cuttlefish::vm_manager::CrosvmManager::name()) {
+  if (vmm == cuttlefish::VmmMode::kCrosvm) {
     return cuttlefish::MetricsEvent::CUTTLEFISH_VMM_TYPE_CROSVM;
   }
-  if (vmm == cuttlefish::vm_manager::QemuManager::name()) {
+  if (vmm == cuttlefish::VmmMode::kQemu) {
     return cuttlefish::MetricsEvent::CUTTLEFISH_VMM_TYPE_QEMU;
   }
   return cuttlefish::MetricsEvent::CUTTLEFISH_VMM_TYPE_UNSPECIFIED;
diff --git a/host/commands/modem_simulator/main.cpp b/host/commands/modem_simulator/main.cpp
index a979c3662..c22d11d77 100644
--- a/host/commands/modem_simulator/main.cpp
+++ b/host/commands/modem_simulator/main.cpp
@@ -92,7 +92,7 @@ int ModemSimulatorMain(int argc, char** argv) {
   }
 
   auto nvram_config = NvramConfig::Get();
-  auto nvram_config_file = nvram_config->ConfigFileLocation();
+  const auto nvram_config_file = nvram_config->ConfigFileLocation();
 
   // Start channel monitor, wait for RIL to connect
   int32_t modem_id = 0;
diff --git a/host/commands/modem_simulator/network_service.cpp b/host/commands/modem_simulator/network_service.cpp
index 25a2f97d4..03d0a59a9 100644
--- a/host/commands/modem_simulator/network_service.cpp
+++ b/host/commands/modem_simulator/network_service.cpp
@@ -160,18 +160,15 @@ void NetworkService::InitializeNetworkOperator() {
     current_operator_numeric_ = operator_list_.begin()->numeric;
     operator_list_.begin()->operator_state = NetworkOperator::OPER_STATE_CURRENT;
   } else if (oper_selection_mode_ == OperatorSelectionMode::OPER_SELECTION_MANUAL_AUTOMATIC) {
-    auto iter = operator_list_.begin();
-    for (; iter != operator_list_.end(); ++iter) {
-      if (iter->numeric == current_operator_numeric_) {
-        break;
+    for (auto& iter : operator_list_) {
+      if (iter.numeric == current_operator_numeric_) {
+        iter.operator_state = NetworkOperator::OPER_STATE_CURRENT;
+        return;
       }
     }
-    if (iter == operator_list_.end()) {
-      current_operator_numeric_ = operator_list_.begin()->numeric;
-      operator_list_.begin()->operator_state = NetworkOperator::OPER_STATE_CURRENT;
-    } else {
-      iter->operator_state = NetworkOperator::OPER_STATE_CURRENT;
-    }
+    current_operator_numeric_ = operator_list_.begin()->numeric;
+    operator_list_.begin()->operator_state =
+        NetworkOperator::OPER_STATE_CURRENT;
   }
 }
 
diff --git a/host/commands/modem_simulator/nvram_config.cpp b/host/commands/modem_simulator/nvram_config.cpp
index 22b337329..021ba7391 100644
--- a/host/commands/modem_simulator/nvram_config.cpp
+++ b/host/commands/modem_simulator/nvram_config.cpp
@@ -45,11 +45,9 @@ static constexpr bool kDefaultEmergencyMode = false;
  * Returns nullptr if there was an error loading from file
  */
 NvramConfig* NvramConfig::BuildConfigImpl(size_t num_instances, int sim_type) {
-  auto nvram_config_path =
-      cuttlefish::modem::DeviceConfig::PerInstancePath("modem_nvram.json");
-
   auto ret = new NvramConfig(num_instances, sim_type);
   if (ret) {
+    const auto nvram_config_path = ConfigFileLocation();
     if (!cuttlefish::FileExists(nvram_config_path) ||
         !cuttlefish::FileHasContent(nvram_config_path.c_str())) {
       ret->InitDefaultNvramConfig();
@@ -82,7 +80,7 @@ void NvramConfig::InitNvramConfigService(size_t num_instances, int sim_type) {
 
 void NvramConfig::SaveToFile() {
   auto nvram_config = Get();
-  auto nvram_config_file = nvram_config->ConfigFileLocation();
+  const auto nvram_config_file = ConfigFileLocation();
   nvram_config->SaveToFile(nvram_config_file);
 }
 
@@ -101,7 +99,7 @@ NvramConfig::InstanceSpecific NvramConfig::ForInstance(int num) const {
   return InstanceSpecific(this, std::to_string(num));
 }
 
-std::string NvramConfig::ConfigFileLocation() const {
+/* static */ std::string NvramConfig::ConfigFileLocation() {
   return cuttlefish::AbsolutePath(
       cuttlefish::modem::DeviceConfig::PerInstancePath("modem_nvram.json"));
 }
diff --git a/host/commands/modem_simulator/nvram_config.h b/host/commands/modem_simulator/nvram_config.h
index fc51c80fb..bf4370a0a 100644
--- a/host/commands/modem_simulator/nvram_config.h
+++ b/host/commands/modem_simulator/nvram_config.h
@@ -32,7 +32,7 @@ class NvramConfig {
   ~NvramConfig();
   NvramConfig& operator=(NvramConfig&&);
 
-  std::string ConfigFileLocation() const;
+  static std::string ConfigFileLocation();
   // Saves the configuration object in a file
   bool SaveToFile(const std::string& file) const;
 
diff --git a/host/commands/run_cvd/Android.bp b/host/commands/run_cvd/Android.bp
index 1ac066b5c..faacebb10 100644
--- a/host/commands/run_cvd/Android.bp
+++ b/host/commands/run_cvd/Android.bp
@@ -41,7 +41,7 @@ cc_binary_host {
         "launch/pica.cpp",
         "launch/screen_recording_server.cpp",
         "launch/secure_env.cpp",
-        "launch/secure_env_files.cpp",
+        "launch/snapshot_control_files.cpp",
         "launch/webrtc_recorder.cpp",
         "launch/streamer.cpp",
         "launch/netsim_server.cpp",
diff --git a/host/commands/run_cvd/boot_state_machine.cc b/host/commands/run_cvd/boot_state_machine.cc
index 242c0a5e3..14c7252e6 100644
--- a/host/commands/run_cvd/boot_state_machine.cc
+++ b/host/commands/run_cvd/boot_state_machine.cc
@@ -21,6 +21,7 @@
 #include <memory>
 #include <thread>
 
+#include <android-base/file.h>
 #include <android-base/logging.h>
 #include <gflags/gflags.h>
 
@@ -231,6 +232,34 @@ class CvdBootStateMachine : public SetupFeature, public KernelLogPipeConsumer {
                 << "Error writing to adbd restore pipe: "
                 << restore_adbd_pipe->StrError() << ". This is unrecoverable.";
 
+            auto SubtoolPath = [](const std::string& subtool_name) {
+              auto my_own_dir = android::base::GetExecutableDirectory();
+              std::stringstream subtool_path_stream;
+              subtool_path_stream << my_own_dir << "/" << subtool_name;
+              auto subtool_path = subtool_path_stream.str();
+              if (my_own_dir.empty() || !FileExists(subtool_path)) {
+                return HostBinaryPath(subtool_name);
+              }
+              return subtool_path;
+            };
+            const auto adb_bin_path = SubtoolPath("adb");
+            CHECK(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(),
+                           "wait-for-device"},
+                          SubprocessOptions(), WEXITED)
+                      .ok())
+                << "Failed to suspend bluetooth manager.";
+            CHECK(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(),
+                           "shell", "cmd", "bluetooth_manager", "enable"},
+                          SubprocessOptions(), WEXITED)
+                      .ok());
+            CHECK(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(),
+                           "shell", "svc", "wifi", "enable"},
+                          SubprocessOptions(), WEXITED)
+                      .ok());
+            CHECK(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(),
+                           "shell", "cmd", "uwb", "enable-uwb"},
+                          SubprocessOptions(), WEXITED)
+                      .ok());
             // Done last so that adb is more likely to be ready.
             CHECK(cuttlefish::WriteAll(restore_complete_pipe_write, "1") == 1)
                 << "Error writing to restore complete pipe: "
diff --git a/host/commands/run_cvd/launch/launch.h b/host/commands/run_cvd/launch/launch.h
index 3be989c89..4d939844a 100644
--- a/host/commands/run_cvd/launch/launch.h
+++ b/host/commands/run_cvd/launch/launch.h
@@ -26,7 +26,7 @@
 #include "host/commands/run_cvd/launch/auto_cmd.h"
 #include "host/commands/run_cvd/launch/grpc_socket_creator.h"
 #include "host/commands/run_cvd/launch/log_tee_creator.h"
-#include "host/commands/run_cvd/launch/secure_env_files.h"
+#include "host/commands/run_cvd/launch/snapshot_control_files.h"
 #include "host/commands/run_cvd/launch/webrtc_recorder.h"
 #include "host/commands/run_cvd/launch/wmediumd_server.h"
 #include "host/libs/config/command_source.h"
@@ -111,7 +111,7 @@ Result<std::optional<MonitorCommand>> ScreenRecordingServer(GrpcSocketCreator&);
 
 Result<MonitorCommand> SecureEnv(const CuttlefishConfig&,
                                  const CuttlefishConfig::InstanceSpecific&,
-                                 AutoSecureEnvFiles::Type&,
+                                 AutoSnapshotControlFiles::Type&,
                                  KernelLogPipeProvider&);
 
 Result<MonitorCommand> TombstoneReceiver(
diff --git a/host/commands/run_cvd/launch/open_wrt.cpp b/host/commands/run_cvd/launch/open_wrt.cpp
index 0ca4a9cc6..5b84a3b00 100644
--- a/host/commands/run_cvd/launch/open_wrt.cpp
+++ b/host/commands/run_cvd/launch/open_wrt.cpp
@@ -123,7 +123,7 @@ class OpenWrt : public CommandSource {
     auto openwrt_args = OpenwrtArgsFromConfig(instance_);
     switch (instance_.ap_boot_flow()) {
       case APBootFlow::Grub:
-        if (config_.vm_manager() == "qemu_cli") {
+        if (config_.vm_manager() == VmmMode::kQemu) {
           ap_cmd.AddReadWriteDisk(
               instance_.persistent_ap_composite_overlay_path());
         } else {
@@ -156,7 +156,7 @@ class OpenWrt : public CommandSource {
   std::string Name() const override { return "OpenWrt"; }
   bool Enabled() const override {
     return instance_.ap_boot_flow() != APBootFlow::None &&
-           config_.vm_manager() == vm_manager::CrosvmManager::name();
+           config_.vm_manager() == VmmMode::kCrosvm;
   }
 
  private:
diff --git a/host/commands/run_cvd/launch/secure_env.cpp b/host/commands/run_cvd/launch/secure_env.cpp
index 23a5b040d..5f499fad7 100644
--- a/host/commands/run_cvd/launch/secure_env.cpp
+++ b/host/commands/run_cvd/launch/secure_env.cpp
@@ -24,7 +24,7 @@
 #include <fruit/fruit.h>
 
 #include "common/libs/utils/result.h"
-#include "host/commands/run_cvd/launch/secure_env_files.h"
+#include "host/commands/run_cvd/launch/snapshot_control_files.h"
 #include "host/libs/config/command_source.h"
 #include "host/libs/config/known_paths.h"
 
@@ -33,13 +33,13 @@ namespace cuttlefish {
 Result<MonitorCommand> SecureEnv(
     const CuttlefishConfig& config,
     const CuttlefishConfig::InstanceSpecific& instance,
-    AutoSecureEnvFiles::Type& secure_env_files,
+    AutoSnapshotControlFiles::Type& snapshot_control_files,
     KernelLogPipeProvider& kernel_log_pipe_provider) {
   Command command(SecureEnvBinary());
   command.AddParameter("-confui_server_fd=",
-                       secure_env_files->confui_server_fd);
+                       snapshot_control_files->confui_server_fd);
   command.AddParameter("-snapshot_control_fd=",
-                       secure_env_files->snapshot_control_fd);
+                       snapshot_control_files->secure_env_snapshot_control_fd);
 
   std::vector<std::string> fifo_paths = {
       instance.PerInstanceInternalPath("keymaster_fifo_vm.in"),
diff --git a/host/commands/run_cvd/launch/secure_env_files.cpp b/host/commands/run_cvd/launch/snapshot_control_files.cpp
index 2a88d4b71..d9fc80b35 100644
--- a/host/commands/run_cvd/launch/secure_env_files.cpp
+++ b/host/commands/run_cvd/launch/snapshot_control_files.cpp
@@ -13,13 +13,13 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include "host/commands/run_cvd/launch/secure_env_files.h"
+#include "host/commands/run_cvd/launch/snapshot_control_files.h"
 
 #include <unistd.h>
 
 namespace cuttlefish {
 
-Result<SecureEnvFiles> SecureEnvFiles::Create(
+Result<SnapshotControlFiles> SnapshotControlFiles::Create(
     const CuttlefishConfig::InstanceSpecific& instance) {
   auto confui_socket_path =
       instance.PerInstanceInternalUdsPath("confui_sign.sock");
@@ -34,7 +34,7 @@ Result<SecureEnvFiles> SecureEnvFiles::Create(
   CF_EXPECT(SharedFD::SocketPair(AF_UNIX, SOCK_STREAM, 0, &snapshot_control_fd,
                                  &run_cvd_to_secure_env_fd));
 
-  return SecureEnvFiles{
+  return SnapshotControlFiles{
       confui_server_fd,
       snapshot_control_fd,
       run_cvd_to_secure_env_fd,
diff --git a/host/commands/run_cvd/launch/secure_env_files.h b/host/commands/run_cvd/launch/snapshot_control_files.h
index ed70ced66..dc0b391b0 100644
--- a/host/commands/run_cvd/launch/secure_env_files.h
+++ b/host/commands/run_cvd/launch/snapshot_control_files.h
@@ -24,15 +24,15 @@
 
 namespace cuttlefish {
 
-struct SecureEnvFiles {
+struct SnapshotControlFiles {
   SharedFD confui_server_fd;
-  SharedFD snapshot_control_fd;
+  SharedFD secure_env_snapshot_control_fd;
   SharedFD run_cvd_to_secure_env_fd;
 
-  static Result<SecureEnvFiles> Create(
+  static Result<SnapshotControlFiles> Create(
       const CuttlefishConfig::InstanceSpecific&);
 };
 
-using AutoSecureEnvFiles = AutoSetup<SecureEnvFiles::Create>;
+using AutoSnapshotControlFiles = AutoSetup<SnapshotControlFiles::Create>;
 
 }  // namespace cuttlefish
diff --git a/host/commands/run_cvd/launch/streamer.cpp b/host/commands/run_cvd/launch/streamer.cpp
index 3334efdf1..b27fb7bd8 100644
--- a/host/commands/run_cvd/launch/streamer.cpp
+++ b/host/commands/run_cvd/launch/streamer.cpp
@@ -94,7 +94,7 @@ class StreamerSockets : public virtual SetupFeature {
       : config_(config), instance_(instance) {}
 
   void AppendCommandArguments(Command& cmd) {
-    if (config_.vm_manager() == vm_manager::QemuManager::name()) {
+    if (config_.vm_manager() == VmmMode::kQemu) {
       cmd.AddParameter("-write_virtio_input");
     }
     if (!touch_servers_.empty()) {
@@ -126,7 +126,7 @@ class StreamerSockets : public virtual SetupFeature {
   // SetupFeature
   std::string Name() const override { return "StreamerSockets"; }
   bool Enabled() const override {
-    bool is_qemu = config_.vm_manager() == vm_manager::QemuManager::name();
+    bool is_qemu = config_.vm_manager() == VmmMode::kQemu;
     bool is_accelerated = instance_.gpu_mode() != kGpuModeGuestSwiftshader;
     return !(is_qemu && is_accelerated);
   }
@@ -261,7 +261,7 @@ class WebRtcServer : public virtual CommandSource,
 
     webrtc.UnsetFromEnvironment("http_proxy");
     sockets_.AppendCommandArguments(webrtc);
-    if (config_.vm_manager() == vm_manager::CrosvmManager::name()) {
+    if (config_.vm_manager() == VmmMode::kCrosvm) {
       webrtc.AddParameter("-switches_fd=", switches_server_);
     }
     // Currently there is no way to ensure the signaling server will already
@@ -300,7 +300,7 @@ class WebRtcServer : public virtual CommandSource,
   }
 
   Result<void> ResultSetup() override {
-    if (config_.vm_manager() == vm_manager::CrosvmManager::name()) {
+    if (config_.vm_manager() == VmmMode::kCrosvm) {
       switches_server_ =
           CreateUnixInputServer(instance_.switches_socket_path());
       CF_EXPECT(switches_server_->IsOpen(), switches_server_->StrError());
diff --git a/host/commands/run_cvd/main.cc b/host/commands/run_cvd/main.cc
index 35fcbd5cc..05bd8d2ac 100644
--- a/host/commands/run_cvd/main.cc
+++ b/host/commands/run_cvd/main.cc
@@ -163,7 +163,7 @@ fruit::Component<> runCvdComponent(
       .install(RootCanalComponent)
       .install(AutoCmd<Casimir>::Component)
       .install(NetsimServerComponent)
-      .install(AutoSecureEnvFiles::Component)
+      .install(AutoSnapshotControlFiles::Component)
       .install(AutoCmd<SecureEnv>::Component)
       .install(serverLoopComponent)
       .install(WebRtcRecorderComponent)
diff --git a/host/commands/run_cvd/server_loop.cpp b/host/commands/run_cvd/server_loop.cpp
index abe4e65e8..81fd0ee6f 100644
--- a/host/commands/run_cvd/server_loop.cpp
+++ b/host/commands/run_cvd/server_loop.cpp
@@ -18,7 +18,6 @@
 
 #include <fruit/fruit.h>
 
-#include "host/commands/run_cvd/launch/secure_env_files.h"
 #include "host/commands/run_cvd/launch/webrtc_recorder.h"
 #include "host/commands/run_cvd/server_loop_impl.h"
 #include "host/libs/config/cuttlefish_config.h"
@@ -29,11 +28,11 @@ namespace cuttlefish {
 
 ServerLoop::~ServerLoop() = default;
 
-fruit::Component<fruit::Required<const CuttlefishConfig,
-                                 const CuttlefishConfig::InstanceSpecific,
-                                 AutoSecureEnvFiles::Type,
-                                 WebRtcRecorder>,
-                 ServerLoop>
+fruit::Component<
+    fruit::Required<const CuttlefishConfig,
+                    const CuttlefishConfig::InstanceSpecific,
+                    AutoSnapshotControlFiles::Type, WebRtcRecorder>,
+    ServerLoop>
 serverLoopComponent() {
   using run_cvd_impl::ServerLoopImpl;
   return fruit::createComponent()
diff --git a/host/commands/run_cvd/server_loop.h b/host/commands/run_cvd/server_loop.h
index 9c28dfe2f..0ceeee0cb 100644
--- a/host/commands/run_cvd/server_loop.h
+++ b/host/commands/run_cvd/server_loop.h
@@ -18,7 +18,7 @@
 
 #include <fruit/fruit.h>
 
-#include "host/commands/run_cvd/launch/secure_env_files.h"
+#include "host/commands/run_cvd/launch/snapshot_control_files.h"
 #include "host/commands/run_cvd/launch/webrtc_recorder.h"
 #include "host/libs/config/cuttlefish_config.h"
 
@@ -30,10 +30,10 @@ class ServerLoop {
   virtual Result<void> Run() = 0;
 };
 
-fruit::Component<fruit::Required<const CuttlefishConfig,
-                                 const CuttlefishConfig::InstanceSpecific,
-                                 AutoSecureEnvFiles::Type,
-                                 WebRtcRecorder>,
-                 ServerLoop>
+fruit::Component<
+    fruit::Required<const CuttlefishConfig,
+                    const CuttlefishConfig::InstanceSpecific,
+                    AutoSnapshotControlFiles::Type, WebRtcRecorder>,
+    ServerLoop>
 serverLoopComponent();
 }
diff --git a/host/commands/run_cvd/server_loop_impl.cpp b/host/commands/run_cvd/server_loop_impl.cpp
index 61f1fa6bb..f5caa7c2d 100644
--- a/host/commands/run_cvd/server_loop_impl.cpp
+++ b/host/commands/run_cvd/server_loop_impl.cpp
@@ -63,11 +63,11 @@ bool ServerLoopImpl::CreateQcowOverlay(const std::string& crosvm_path,
 ServerLoopImpl::ServerLoopImpl(
     const CuttlefishConfig& config,
     const CuttlefishConfig::InstanceSpecific& instance,
-    AutoSecureEnvFiles::Type& secure_env_files,
+    AutoSnapshotControlFiles::Type& snapshot_control_files,
     WebRtcRecorder& webrtc_recorder)
     : config_(config),
       instance_(instance),
-      secure_env_files_(secure_env_files),
+      snapshot_control_files_(snapshot_control_files),
       webrtc_recorder_(webrtc_recorder),
       vm_name_to_control_sock_{InitializeVmToControlSockPath(instance)},
       device_status_{DeviceStatus::kUnknown} {}
@@ -93,7 +93,7 @@ Result<void> ServerLoopImpl::Run() {
     }
   }
   const auto& channel_to_secure_env =
-      secure_env_files_->run_cvd_to_secure_env_fd;
+      snapshot_control_files_->run_cvd_to_secure_env_fd;
   ProcessMonitor process_monitor(std::move(process_monitor_properties),
                                  channel_to_secure_env);
 
@@ -414,7 +414,7 @@ void ServerLoopImpl::RestartRunCvd(int notification_fd) {
 }
 
 Result<std::string> ServerLoopImpl::VmControlSocket() const {
-  CF_EXPECT_EQ(config_.vm_manager(), "crosvm",
+  CF_EXPECT_EQ(config_.vm_manager(), VmmMode::kCrosvm,
                "Other VMs but crosvm is not yet supported.");
   return instance_.CrosvmSocketPath();
 }
diff --git a/host/commands/run_cvd/server_loop_impl.h b/host/commands/run_cvd/server_loop_impl.h
index 1577f283e..dde74b05f 100644
--- a/host/commands/run_cvd/server_loop_impl.h
+++ b/host/commands/run_cvd/server_loop_impl.h
@@ -46,7 +46,7 @@ class ServerLoopImpl : public ServerLoop,
  public:
   INJECT(ServerLoopImpl(const CuttlefishConfig& config,
                         const CuttlefishConfig::InstanceSpecific& instance,
-                        AutoSecureEnvFiles::Type& secure_env_files,
+                        AutoSnapshotControlFiles::Type& snapshot_control_files,
                         WebRtcRecorder& webrtc_recorder));
 
   Result<void> LateInject(fruit::Injector<>& injector) override;
@@ -66,7 +66,7 @@ class ServerLoopImpl : public ServerLoop,
  private:
   bool Enabled() const override { return true; }
   std::unordered_set<SetupFeature*> Dependencies() const override {
-    return {&secure_env_files_};
+    return {&snapshot_control_files_};
   }
   Result<void> ResultSetup() override;
   Result<void> HandleExtended(const LauncherActionInfo& action_info,
@@ -93,7 +93,7 @@ class ServerLoopImpl : public ServerLoop,
   static std::unordered_map<std::string, std::string>
   InitializeVmToControlSockPath(const CuttlefishConfig::InstanceSpecific&);
   Result<std::string> VmControlSocket() const;
-  Result<void> TakeGuestSnapshot(const std::string&, const std::string&);
+  Result<void> TakeGuestSnapshot(VmmMode, const std::string&);
   Result<void> TakeCrosvmGuestSnapshot(const Json::Value&);
 
   const CuttlefishConfig& config_;
@@ -104,7 +104,7 @@ class ServerLoopImpl : public ServerLoop,
    * secure_env. The socket pairs are used to send suspend/resume to
    * secure_env, and get the responses.
    */
-  AutoSecureEnvFiles::Type& secure_env_files_;
+  AutoSnapshotControlFiles::Type& snapshot_control_files_;
   WebRtcRecorder& webrtc_recorder_;
   std::vector<CommandSource*> command_sources_;
   SharedFD server_;
diff --git a/host/commands/run_cvd/server_loop_impl_snapshot.cpp b/host/commands/run_cvd/server_loop_impl_snapshot.cpp
index c846e3726..9ed21a354 100644
--- a/host/commands/run_cvd/server_loop_impl_snapshot.cpp
+++ b/host/commands/run_cvd/server_loop_impl_snapshot.cpp
@@ -43,9 +43,9 @@ ServerLoopImpl::InitializeVmToControlSockPath(
     const CuttlefishConfig::InstanceSpecific& instance) {
   return std::unordered_map<std::string, std::string>{
       // TODO(kwstephenkim): add the following two lines to support QEMU
-      // {QemuManager::name(),
+      // {ToString(VmmMode::kQemu),
       // instance.PerInstanceInternalUdsPath("qemu_monitor.sock")},
-      {vm_manager::CrosvmManager::name(), instance.CrosvmSocketPath()},
+      {ToString(VmmMode::kCrosvm), instance.CrosvmSocketPath()},
       {cuttlefish::kApName, instance.OpenwrtCrosvmSocketPath()},
   };
 }
@@ -105,15 +105,16 @@ Result<void> ServerLoopImpl::SuspendGuest() {
     CF_EXPECT(SuspendCrosvm(openwrt_sock),
               "failed to suspend openwrt crosvm instance.");
   }
-  const auto vm_name = config_.vm_manager();
-  if (vm_name == vm_manager::CrosvmManager::name()) {
-    const auto& vm_sock = GetSocketPath(vm_name, vm_name_to_control_sock_);
+  const auto main_vmm = config_.vm_manager();
+  if (main_vmm == VmmMode::kCrosvm) {
+    const auto& vm_sock =
+        GetSocketPath(ToString(main_vmm), vm_name_to_control_sock_);
     if (vm_sock == "") {
-      return CF_ERR("The vm_manager " + vm_name + " is not supported yet");
+      return CF_ERR("The vm_manager " << main_vmm << " is not supported yet");
     }
     return SuspendCrosvm(vm_sock);
   } else {
-    return CF_ERR("The vm_manager " + vm_name + " is not supported yet");
+    return CF_ERR("The vm_manager " << main_vmm << " is not supported yet");
   }
 }
 
@@ -130,21 +131,36 @@ Result<void> ServerLoopImpl::ResumeGuest() {
     CF_EXPECT(ResumeCrosvm(openwrt_sock),
               "failed to resume openwrt crosvm instance.");
   }
-  const auto vm_name = config_.vm_manager();
-  if (vm_name == vm_manager::CrosvmManager::name()) {
-    const auto& vm_sock = GetSocketPath(vm_name, vm_name_to_control_sock_);
+  const auto main_vmm = config_.vm_manager();
+  if (main_vmm == VmmMode::kCrosvm) {
+    const auto& vm_sock =
+        GetSocketPath(ToString(main_vmm), vm_name_to_control_sock_);
     if (vm_sock == "") {
-      return CF_ERR("The vm_manager " + vm_name + " is not supported yet");
+      return CF_ERR("The vm_manager " << main_vmm << " is not supported yet");
     }
     return ResumeCrosvm(vm_sock);
   } else {
-    return CF_ERR("The vm_manager " + vm_name + " is not supported yet");
+    return CF_ERR("The vm_manager " << main_vmm << " is not supported yet");
   }
 }
 
 Result<void> ServerLoopImpl::HandleSuspend(ProcessMonitor& process_monitor) {
   // right order: guest -> host
   LOG(DEBUG) << "Suspending the guest..";
+  const auto adb_bin_path = SubtoolPath("adb");
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "cmd", "bluetooth_manager", "disable"},
+                    SubprocessOptions(), WEXITED));
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "cmd", "bluetooth_manager", "wait-for-state:STATE_OFF"},
+                    SubprocessOptions(), WEXITED));
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "svc", "wifi", "disable"},
+                    SubprocessOptions(), WEXITED));
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "cmd", "uwb", "disable-uwb"},
+                    SubprocessOptions(), WEXITED));
+  // right order: guest -> host
   CF_EXPECT(SuspendGuest());
   LOG(DEBUG) << "The guest is suspended.";
   CF_EXPECT(process_monitor.SuspendMonitoredProcesses(),
@@ -160,6 +176,17 @@ Result<void> ServerLoopImpl::HandleResume(ProcessMonitor& process_monitor) {
   LOG(DEBUG) << "The host processes are resumed.";
   LOG(DEBUG) << "Resuming the guest..";
   CF_EXPECT(ResumeGuest());
+  // Resume services after guest has resumed.
+  const auto adb_bin_path = SubtoolPath("adb");
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "cmd", "bluetooth_manager", "enable"},
+                    SubprocessOptions(), WEXITED));
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "svc", "wifi", "enable"},
+                    SubprocessOptions(), WEXITED));
+  CF_EXPECT(Execute({adb_bin_path, "-s", instance_.adb_ip_and_port(), "shell",
+                     "cmd", "uwb", "enable-uwb"},
+                    SubprocessOptions(), WEXITED));
   LOG(DEBUG) << "The guest resumed.";
   return {};
 }
@@ -215,7 +242,7 @@ Result<void> ServerLoopImpl::TakeCrosvmGuestSnapshot(
 /*
  * Parse json file at json_path, and take guest snapshot
  */
-Result<void> ServerLoopImpl::TakeGuestSnapshot(const std::string& vm_manager,
+Result<void> ServerLoopImpl::TakeGuestSnapshot(VmmMode vm_manager,
                                                const std::string& json_path) {
   // common code across vm_manager
   CF_EXPECTF(FileExists(json_path), "{} must exist but does not.", json_path);
@@ -226,7 +253,7 @@ Result<void> ServerLoopImpl::TakeGuestSnapshot(const std::string& vm_manager,
                std::string("Failed to read from ") + json_path);
   Json::Value meta_json = CF_EXPECTF(
       ParseJson(json_contents), "Failed to parse json: \n{}", json_contents);
-  CF_EXPECTF(vm_manager == "crosvm",
+  CF_EXPECTF(vm_manager == VmmMode::kCrosvm,
              "{}, which is not crosvm, is not yet supported.", vm_manager);
   CF_EXPECT(TakeCrosvmGuestSnapshot(meta_json),
             "TakeCrosvmGuestSnapshot() failed.");
diff --git a/host/libs/config/cuttlefish_config.cpp b/host/libs/config/cuttlefish_config.cpp
index 6de482552..091b59160 100644
--- a/host/libs/config/cuttlefish_config.cpp
+++ b/host/libs/config/cuttlefish_config.cpp
@@ -111,11 +111,12 @@ void CuttlefishConfig::set_root_dir(const std::string& root_dir) {
 }
 
 static constexpr char kVmManager[] = "vm_manager";
-std::string CuttlefishConfig::vm_manager() const {
-  return (*dictionary_)[kVmManager].asString();
+VmmMode CuttlefishConfig::vm_manager() const {
+  auto str = (*dictionary_)[kVmManager].asString();
+  return ParseVmm(str).value_or(VmmMode::kUnknown);
 }
-void CuttlefishConfig::set_vm_manager(const std::string& name) {
-  (*dictionary_)[kVmManager] = name;
+void CuttlefishConfig::set_vm_manager(VmmMode vmm) {
+  (*dictionary_)[kVmManager] = fmt::format("{}", vmm);
 }
 
 static constexpr char kApVmManager[] = "ap_vm_manager";
@@ -173,7 +174,9 @@ void CuttlefishConfig::set_crosvm_binary(const std::string& crosvm_binary) {
   (*dictionary_)[kCrosvmBinary] = crosvm_binary;
 }
 
-bool CuttlefishConfig::IsCrosvm() const { return vm_manager() == "crosvm"; }
+bool CuttlefishConfig::IsCrosvm() const {
+  return vm_manager() == VmmMode::kCrosvm;
+}
 
 static constexpr char kGem5DebugFlags[] = "gem5_debug_flags";
 std::string CuttlefishConfig::gem5_debug_flags() const {
diff --git a/host/libs/config/cuttlefish_config.h b/host/libs/config/cuttlefish_config.h
index 7fec650fd..ecc93ea03 100644
--- a/host/libs/config/cuttlefish_config.h
+++ b/host/libs/config/cuttlefish_config.h
@@ -52,6 +52,17 @@ enum class SecureHal {
   HostOemlockSecure,
 };
 
+enum class VmmMode {
+  kUnknown,
+  kCrosvm,
+  kGem5,
+  kQemu,
+};
+
+std::ostream& operator<<(std::ostream&, VmmMode);
+std::string ToString(VmmMode mode);
+Result<VmmMode> ParseVmm(std::string_view);
+
 enum class ExternalNetworkMode {
   kUnknown,
   kTap,
@@ -100,8 +111,8 @@ class CuttlefishConfig {
   std::string environments_uds_dir() const;
   std::string EnvironmentsUdsPath(const std::string&) const;
 
-  std::string vm_manager() const;
-  void set_vm_manager(const std::string& name);
+  VmmMode vm_manager() const;
+  void set_vm_manager(VmmMode vmm);
 
   std::string ap_vm_manager() const;
   void set_ap_vm_manager(const std::string& name);
@@ -1010,4 +1021,6 @@ extern const char* const kHwComposerNone;
 #if FMT_VERSION >= 90000
 template <>
 struct fmt::formatter<cuttlefish::ExternalNetworkMode> : ostream_formatter {};
+template <>
+struct fmt::formatter<cuttlefish::VmmMode> : ostream_formatter {};
 #endif
diff --git a/host/libs/config/cuttlefish_config_instance.cpp b/host/libs/config/cuttlefish_config_instance.cpp
index ace76e8ef..24b246417 100644
--- a/host/libs/config/cuttlefish_config_instance.cpp
+++ b/host/libs/config/cuttlefish_config_instance.cpp
@@ -62,6 +62,37 @@ Result<ExternalNetworkMode> ParseExternalNetworkMode(std::string_view str) {
   }
 }
 
+std::string ToString(VmmMode mode) {
+  std::stringstream ss;
+  ss << mode;
+  return ss.str();
+}
+
+std::ostream& operator<<(std::ostream& out, VmmMode vmm) {
+  switch (vmm) {
+    case VmmMode::kUnknown:
+      return out << "unknown";
+    case VmmMode::kCrosvm:
+      return out << "crosvm";
+    case VmmMode::kGem5:
+      return out << "gem5";
+    case VmmMode::kQemu:
+      return out << "qemu_cli";
+  }
+}
+
+Result<VmmMode> ParseVmm(std::string_view str) {
+  if (android::base::EqualsIgnoreCase(str, "crosvm")) {
+    return VmmMode::kCrosvm;
+  } else if (android::base::EqualsIgnoreCase(str, "gem5")) {
+    return VmmMode::kGem5;
+  } else if (android::base::EqualsIgnoreCase(str, "qemu_cli")) {
+    return VmmMode::kQemu;
+  } else {
+    return CF_ERRF("\"{}\" is not a valid Vmm.", str);
+  }
+}
+
 static constexpr char kInstanceDir[] = "instance_dir";
 CuttlefishConfig::MutableInstanceSpecific::MutableInstanceSpecific(
     CuttlefishConfig* config, const std::string& id)
@@ -1199,8 +1230,7 @@ bool CuttlefishConfig::InstanceSpecific::console() const {
 std::string CuttlefishConfig::InstanceSpecific::console_dev() const {
   auto can_use_virtio_console = !kgdb() && !use_bootloader();
   std::string console_dev;
-  if (can_use_virtio_console ||
-      config_->vm_manager() == vm_manager::Gem5Manager::name()) {
+  if (can_use_virtio_console || config_->vm_manager() == VmmMode::kGem5) {
     // If kgdb and the bootloader are disabled, the Android serial console
     // spawns on a virtio-console port. If the bootloader is enabled, virtio
     // console can't be used since uboot doesn't support it.
@@ -1210,7 +1240,7 @@ std::string CuttlefishConfig::InstanceSpecific::console_dev() const {
     // architectures emulate ns16550a/uart8250 instead.
     Arch target = target_arch();
     if ((target == Arch::Arm64 || target == Arch::Arm) &&
-        config_->vm_manager() != vm_manager::CrosvmManager::name()) {
+        config_->vm_manager() != VmmMode::kCrosvm) {
       console_dev = "ttyAMA0";
     } else {
       console_dev = "ttyS0";
diff --git a/host/libs/config/data_image.cpp b/host/libs/config/data_image.cpp
index 0849fd088..915728efc 100644
--- a/host/libs/config/data_image.cpp
+++ b/host/libs/config/data_image.cpp
@@ -271,7 +271,7 @@ class InitializeEspImageImpl : public InitializeEspImage {
       LOG(DEBUG) << "creating esp_image: " << instance_.ap_esp_image_path();
       CF_EXPECT(BuildAPImage());
     }
-    const auto is_not_gem5 = config_.vm_manager() != vm_manager::Gem5Manager::name();
+    const auto is_not_gem5 = config_.vm_manager() != VmmMode::kGem5;
     const auto esp_required_for_boot_flow = EspRequiredForBootFlow();
     if (is_not_gem5 && esp_required_for_boot_flow) {
       LOG(DEBUG) << "creating esp_image: " << instance_.esp_image_path();
diff --git a/host/libs/config/kernel_args.cpp b/host/libs/config/kernel_args.cpp
index 91e0bbd0e..f5bdf7dc0 100644
--- a/host/libs/config/kernel_args.cpp
+++ b/host/libs/config/kernel_args.cpp
@@ -42,7 +42,7 @@ std::vector<std::string> VmManagerKernelCmdline(
     const CuttlefishConfig& config,
     const CuttlefishConfig::InstanceSpecific& instance) {
   std::vector<std::string> vm_manager_cmdline;
-  if (config.vm_manager() == QemuManager::name()) {
+  if (config.vm_manager() == VmmMode::kQemu) {
     Arch target_arch = instance.target_arch();
     if (target_arch == Arch::Arm64 || target_arch == Arch::Arm) {
       if (instance.enable_kernel_log()) {
diff --git a/host/libs/vm_manager/Android.bp b/host/libs/vm_manager/Android.bp
index 7cd03297f..1bc3ee0be 100644
--- a/host/libs/vm_manager/Android.bp
+++ b/host/libs/vm_manager/Android.bp
@@ -24,6 +24,7 @@ cc_library {
         "crosvm_manager.cpp",
         "gem5_manager.cpp",
         "host_configuration.cpp",
+        "pci.cpp",
         "qemu_manager.cpp",
         "vm_manager.cpp",
     ],
diff --git a/host/libs/vm_manager/crosvm_builder.cpp b/host/libs/vm_manager/crosvm_builder.cpp
index cb863db32..4f51e331c 100644
--- a/host/libs/vm_manager/crosvm_builder.cpp
+++ b/host/libs/vm_manager/crosvm_builder.cpp
@@ -28,6 +28,17 @@
 #include "host/libs/config/known_paths.h"
 
 namespace cuttlefish {
+namespace {
+
+std::string MacCrosvmArgument(std::optional<std::string_view> mac) {
+  return mac.has_value() ? fmt::format(",mac={}", mac.value()) : "";
+}
+
+std::string PciCrosvmArgument(std::optional<pci::Address> pci) {
+  return pci.has_value() ? fmt::format(",pci-address={}", pci.value().Id()) : "";
+}
+
+}
 
 CrosvmBuilder::CrosvmBuilder() : command_("crosvm") {}
 
@@ -104,10 +115,12 @@ void CrosvmBuilder::AddSerial(const std::string& output,
 }
 
 #ifdef __linux__
-SharedFD CrosvmBuilder::AddTap(const std::string& tap_name) {
+SharedFD CrosvmBuilder::AddTap(const std::string& tap_name,
+                               std::optional<std::string_view> mac,
+                               const std::optional<pci::Address>& pci) {
   auto tap_fd = OpenTapInterface(tap_name);
   if (tap_fd->IsOpen()) {
-    command_.AddParameter("--net=tap-fd=", tap_fd);
+    command_.AddParameter("--net=tap-fd=", tap_fd, MacCrosvmArgument(mac), PciCrosvmArgument(pci));
   } else {
     LOG(ERROR) << "Unable to connect to \"" << tap_name
                << "\": " << tap_fd->StrError();
@@ -115,16 +128,6 @@ SharedFD CrosvmBuilder::AddTap(const std::string& tap_name) {
   return tap_fd;
 }
 
-SharedFD CrosvmBuilder::AddTap(const std::string& tap_name, const std::string& mac) {
-  auto tap_fd = OpenTapInterface(tap_name);
-  if (tap_fd->IsOpen()) {
-    command_.AddParameter("--net=tap-fd=", tap_fd, ",mac=\"", mac, "\"");
-  } else {
-    LOG(ERROR) << "Unable to connect to \"" << tap_name
-               << "\": " << tap_fd->StrError();
-  }
-  return tap_fd;
-}
 #endif
 
 int CrosvmBuilder::HvcNum() { return hvc_num_; }
diff --git a/host/libs/vm_manager/crosvm_builder.h b/host/libs/vm_manager/crosvm_builder.h
index e2f722e03..123d01a6a 100644
--- a/host/libs/vm_manager/crosvm_builder.h
+++ b/host/libs/vm_manager/crosvm_builder.h
@@ -15,12 +15,14 @@
 
 #pragma once
 
+#include <optional>
 #include <string>
 #include <utility>
 
 #include "common/libs/fs/shared_fd.h"
 #include "common/libs/utils/result.h"
 #include "common/libs/utils/subprocess.h"
+#include "host/libs/vm_manager/pci.h"
 
 namespace cuttlefish {
 
@@ -48,8 +50,9 @@ class CrosvmBuilder {
   void AddSerial(const std::string& output, const std::string& input);
 
 #ifdef __linux__
-  SharedFD AddTap(const std::string& tap_name);
-  SharedFD AddTap(const std::string& tap_name, const std::string& mac);
+  SharedFD AddTap(const std::string& tap_name,
+                  std::optional<std::string_view> mac = std::nullopt,
+                  const std::optional<pci::Address>& pci = std::nullopt);
 #endif
 
   int HvcNum();
diff --git a/host/libs/vm_manager/crosvm_manager.cpp b/host/libs/vm_manager/crosvm_manager.cpp
index 899e39653..529a660cc 100644
--- a/host/libs/vm_manager/crosvm_manager.cpp
+++ b/host/libs/vm_manager/crosvm_manager.cpp
@@ -582,10 +582,16 @@ Result<std::vector<MonitorCommand>> CrosvmManager::StartCommands(
   // having to pass arguments to crosvm via a wrapper script.
 #ifdef __linux__
   if (!gpu_capture_enabled) {
-    // The ordering of tap devices is important. Make sure any change here
-    // is reflected in ethprime u-boot variable
-    crosvm_cmd.AddTap(instance.mobile_tap_name(), instance.mobile_mac());
-    crosvm_cmd.AddTap(instance.ethernet_tap_name(), instance.ethernet_mac());
+    // The PCI ordering of tap devices is important. Make sure any change here
+    // is reflected in ethprime u-boot variable.
+    // TODO(b/218364216, b/322862402): Crosvm occupies 32 PCI devices first and only then uses PCI
+    // functions which may break order. The final solution is going to be a PCI allocation strategy
+    // that will guarantee the ordering. For now, hardcode PCI network devices to unoccupied
+    // functions.
+    const pci::Address mobile_pci = pci::Address(0, VmManager::kNetPciDeviceNum, 1);
+    const pci::Address ethernet_pci = pci::Address(0, VmManager::kNetPciDeviceNum, 2);
+    crosvm_cmd.AddTap(instance.mobile_tap_name(), instance.mobile_mac(), mobile_pci);
+    crosvm_cmd.AddTap(instance.ethernet_tap_name(), instance.ethernet_mac(), ethernet_pci);
 
     if (!config.virtio_mac80211_hwsim() && environment.enable_wifi()) {
       wifi_tap = crosvm_cmd.AddTap(instance.wifi_tap_name());
diff --git a/host/libs/vm_manager/pci.cpp b/host/libs/vm_manager/pci.cpp
new file mode 100644
index 000000000..9b57fcfd1
--- /dev/null
+++ b/host/libs/vm_manager/pci.cpp
@@ -0,0 +1,37 @@
+//
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "host/libs/vm_manager/pci.h"
+
+#include <android-base/logging.h>
+
+namespace cuttlefish {
+namespace pci {
+namespace {
+constexpr unsigned int kMaxBus = 255;
+constexpr unsigned int kMaxDevice = 31;
+constexpr unsigned int kMaxFunction = 7;
+}  // namespace
+
+Address::Address(unsigned int bus, unsigned int device, unsigned int function)
+    : bus_(bus), device_(device), function_(function) {
+  if (bus_ > kMaxBus || device_ > kMaxDevice || function_ > kMaxFunction) {
+    LOG(FATAL) << "Failed to create PCI address instance with bus: " << bus_
+               << " device: " << device_ << " function: " << function_;
+  }
+}
+
+}  // namespace pci
+}  // namespace cuttlefish
\ No newline at end of file
diff --git a/host/libs/vm_manager/pci.h b/host/libs/vm_manager/pci.h
new file mode 100644
index 000000000..47ca0769a
--- /dev/null
+++ b/host/libs/vm_manager/pci.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <fmt/core.h>
+
+namespace cuttlefish {
+namespace pci {
+
+class Address {
+ public:
+  Address(unsigned int bus, unsigned int device, unsigned int function);
+
+  unsigned int Bus() const { return bus_; };
+  unsigned int Device() const { return device_; }
+  unsigned int Function() const { return function_; }
+  std::string Id() const {
+    return fmt::format("{:02x}:{:02x}.{:01x}", bus_, device_, function_);
+  }
+
+ private:
+  unsigned int bus_;
+  unsigned int device_;
+  unsigned int function_;
+};
+
+}  // namespace pci
+}  // namespace cuttlefish
diff --git a/host/libs/vm_manager/vm_manager.cpp b/host/libs/vm_manager/vm_manager.cpp
index c916b13e8..7860d3cb2 100644
--- a/host/libs/vm_manager/vm_manager.cpp
+++ b/host/libs/vm_manager/vm_manager.cpp
@@ -37,21 +37,22 @@
 namespace cuttlefish {
 namespace vm_manager {
 
-std::unique_ptr<VmManager> GetVmManager(const std::string& name, Arch arch) {
+std::unique_ptr<VmManager> GetVmManager(VmmMode vmm_mode, Arch arch) {
   std::unique_ptr<VmManager> vmm;
-  if (name == QemuManager::name()) {
+  if (vmm_mode == VmmMode::kQemu) {
     vmm.reset(new QemuManager(arch));
-  } else if (name == Gem5Manager::name()) {
+  } else if (vmm_mode == VmmMode::kGem5) {
     vmm.reset(new Gem5Manager(arch));
-  } else if (name == CrosvmManager::name()) {
+  } else if (vmm_mode == VmmMode::kCrosvm) {
     vmm.reset(new CrosvmManager());
   }
   if (!vmm) {
-    LOG(ERROR) << "Invalid VM manager: " << name;
+    LOG(ERROR) << "Invalid VM manager: " << vmm_mode;
     return {};
   }
   if (!vmm->IsSupported()) {
-    LOG(ERROR) << "VM manager " << name << " is not supported on this machine.";
+    LOG(ERROR) << "VM manager " << vmm_mode
+               << " is not supported on this machine.";
     return {};
   }
   return vmm;
diff --git a/host/libs/vm_manager/vm_manager.h b/host/libs/vm_manager/vm_manager.h
index 29fb68a8e..9b704771c 100644
--- a/host/libs/vm_manager/vm_manager.h
+++ b/host/libs/vm_manager/vm_manager.h
@@ -80,6 +80,8 @@ class VmManager {
   // the persistent disk
   static const int kDefaultNumBootDevices = 2;
 
+  static constexpr const int kNetPciDeviceNum = 1;
+
   // LINT.IfChange(virtio_gpu_pci_address)
   static constexpr const int kGpuPciSlotNum = 2;
   // LINT.ThenChange(../../../shared/sepolicy/vendor/genfs_contexts:virtio_gpu_pci_address)
@@ -116,7 +118,7 @@ fruit::Component<fruit::Required<const CuttlefishConfig,
                  VmManager>
 VmManagerComponent();
 
-std::unique_ptr<VmManager> GetVmManager(const std::string&, Arch arch);
+std::unique_ptr<VmManager> GetVmManager(VmmMode vmm, Arch arch);
 
 Result<std::unordered_map<std::string, std::string>>
 ConfigureMultipleBootDevices(const std::string& pci_path, int pci_offset,
diff --git a/shared/tv/device_vendor.mk b/shared/tv/device_vendor.mk
index 77e6a493a..f6e10ab4a 100644
--- a/shared/tv/device_vendor.mk
+++ b/shared/tv/device_vendor.mk
@@ -25,7 +25,7 @@ $(call inherit-product, device/google/cuttlefish/shared/graphics/device_vendor.m
 $(call inherit-product, device/google/cuttlefish/shared/swiftshader/device_vendor.mk)
 $(call inherit-product, device/google/cuttlefish/shared/virgl/device_vendor.mk)
 $(call inherit-product, device/google/cuttlefish/shared/device.mk)
-$(call inherit-product, vendor/google/tv/gcbs/projects/reference-v4/dtvstack.mk)
+$(call inherit-product-if-exists, vendor/google/tv/gcbs/projects/reference-v4/dtvstack.mk)
 
 # Loads the camera HAL and which set of cameras is required.
 $(call inherit-product, device/google/cuttlefish/shared/camera/device_vendor.mk)
diff --git a/system_image/Android.bp b/system_image/Android.bp
index 65abbd5f2..c8347dd71 100644
--- a/system_image/Android.bp
+++ b/system_image/Android.bp
@@ -62,114 +62,279 @@ android_symlinks = [
     },
 ]
 
+phony {
+    name: "fonts",
+    required: [
+        "AndroidClock.ttf",
+        "CarroisGothicSC-Regular.ttf",
+        "ComingSoon.ttf",
+        "CutiveMono.ttf",
+        "DancingScript-Regular.ttf",
+        "DroidSansMono.ttf",
+        "NotoColorEmoji.ttf",
+        "NotoColorEmojiFlags.ttf",
+        "NotoColorEmojiLegacy.ttf",
+        "NotoNaskhArabic-Bold.ttf",
+        "NotoNaskhArabic-Regular.ttf",
+        "NotoNaskhArabicUI-Bold.ttf",
+        "NotoNaskhArabicUI-Regular.ttf",
+        "NotoSansAdlam-VF.ttf",
+        "NotoSansAhom-Regular.otf",
+        "NotoSansAnatolianHieroglyphs-Regular.otf",
+        "NotoSansArmenian-VF.ttf",
+        "NotoSansAvestan-Regular.ttf",
+        "NotoSansBalinese-Regular.ttf",
+        "NotoSansBamum-Regular.ttf",
+        "NotoSansBassaVah-Regular.otf",
+        "NotoSansBatak-Regular.ttf",
+        "NotoSansBengali-VF.ttf",
+        "NotoSansBengaliUI-VF.ttf",
+        "NotoSansBhaiksuki-Regular.otf",
+        "NotoSansBrahmi-Regular.ttf",
+        "NotoSansBuginese-Regular.ttf",
+        "NotoSansBuhid-Regular.ttf",
+        "NotoSansCJK-Regular.ttc",
+        "NotoSansCanadianAboriginal-Regular.ttf",
+        "NotoSansCarian-Regular.ttf",
+        "NotoSansChakma-Regular.otf",
+        "NotoSansCham-Bold.ttf",
+        "NotoSansCham-Regular.ttf",
+        "NotoSansCherokee-Regular.ttf",
+        "NotoSansCoptic-Regular.ttf",
+        "NotoSansCuneiform-Regular.ttf",
+        "NotoSansCypriot-Regular.ttf",
+        "NotoSansDeseret-Regular.ttf",
+        "NotoSansDevanagari-VF.ttf",
+        "NotoSansDevanagariUI-VF.ttf",
+        "NotoSansEgyptianHieroglyphs-Regular.ttf",
+        "NotoSansElbasan-Regular.otf",
+        "NotoSansEthiopic-VF.ttf",
+        "NotoSansGeorgian-VF.ttf",
+        "NotoSansGlagolitic-Regular.ttf",
+        "NotoSansGothic-Regular.ttf",
+        "NotoSansGrantha-Regular.ttf",
+        "NotoSansGujarati-Bold.ttf",
+        "NotoSansGujarati-Regular.ttf",
+        "NotoSansGujaratiUI-Bold.ttf",
+        "NotoSansGujaratiUI-Regular.ttf",
+        "NotoSansGunjalaGondi-Regular.otf",
+        "NotoSansGurmukhi-VF.ttf",
+        "NotoSansGurmukhiUI-VF.ttf",
+        "NotoSansHanifiRohingya-Regular.otf",
+        "NotoSansHanunoo-Regular.ttf",
+        "NotoSansHatran-Regular.otf",
+        "NotoSansHebrew-Bold.ttf",
+        "NotoSansHebrew-Regular.ttf",
+        "NotoSansImperialAramaic-Regular.ttf",
+        "NotoSansInscriptionalPahlavi-Regular.ttf",
+        "NotoSansInscriptionalParthian-Regular.ttf",
+        "NotoSansJavanese-Regular.otf",
+        "NotoSansKaithi-Regular.ttf",
+        "NotoSansKannada-VF.ttf",
+        "NotoSansKannadaUI-VF.ttf",
+        "NotoSansKayahLi-Regular.ttf",
+        "NotoSansKharoshthi-Regular.ttf",
+        "NotoSansKhmer-VF.ttf",
+        "NotoSansKhmerUI-Bold.ttf",
+        "NotoSansKhmerUI-Regular.ttf",
+        "NotoSansKhojki-Regular.otf",
+        "NotoSansLao-Bold.ttf",
+        "NotoSansLao-Regular.ttf",
+        "NotoSansLaoUI-Bold.ttf",
+        "NotoSansLaoUI-Regular.ttf",
+        "NotoSansLepcha-Regular.ttf",
+        "NotoSansLimbu-Regular.ttf",
+        "NotoSansLinearA-Regular.otf",
+        "NotoSansLinearB-Regular.ttf",
+        "NotoSansLisu-Regular.ttf",
+        "NotoSansLycian-Regular.ttf",
+        "NotoSansLydian-Regular.ttf",
+        "NotoSansMalayalam-VF.ttf",
+        "NotoSansMalayalamUI-VF.ttf",
+        "NotoSansMandaic-Regular.ttf",
+        "NotoSansManichaean-Regular.otf",
+        "NotoSansMarchen-Regular.otf",
+        "NotoSansMasaramGondi-Regular.otf",
+        "NotoSansMedefaidrin-VF.ttf",
+        "NotoSansMeeteiMayek-Regular.ttf",
+        "NotoSansMeroitic-Regular.otf",
+        "NotoSansMiao-Regular.otf",
+        "NotoSansModi-Regular.ttf",
+        "NotoSansMongolian-Regular.ttf",
+        "NotoSansMro-Regular.otf",
+        "NotoSansMultani-Regular.otf",
+        "NotoSansMyanmar-Bold.otf",
+        "NotoSansMyanmar-Medium.otf",
+        "NotoSansMyanmar-Regular.otf",
+        "NotoSansMyanmarUI-Bold.otf",
+        "NotoSansMyanmarUI-Medium.otf",
+        "NotoSansMyanmarUI-Regular.otf",
+        "NotoSansNKo-Regular.ttf",
+        "NotoSansNabataean-Regular.otf",
+        "NotoSansNewTaiLue-Regular.ttf",
+        "NotoSansNewa-Regular.otf",
+        "NotoSansOgham-Regular.ttf",
+        "NotoSansOlChiki-Regular.ttf",
+        "NotoSansOldItalic-Regular.ttf",
+        "NotoSansOldNorthArabian-Regular.otf",
+        "NotoSansOldPermic-Regular.otf",
+        "NotoSansOldPersian-Regular.ttf",
+        "NotoSansOldSouthArabian-Regular.ttf",
+        "NotoSansOldTurkic-Regular.ttf",
+        "NotoSansOriya-Bold.ttf",
+        "NotoSansOriya-Regular.ttf",
+        "NotoSansOriyaUI-Bold.ttf",
+        "NotoSansOriyaUI-Regular.ttf",
+        "NotoSansOsage-Regular.ttf",
+        "NotoSansOsmanya-Regular.ttf",
+        "NotoSansPahawhHmong-Regular.otf",
+        "NotoSansPalmyrene-Regular.otf",
+        "NotoSansPauCinHau-Regular.otf",
+        "NotoSansPhagsPa-Regular.ttf",
+        "NotoSansPhoenician-Regular.ttf",
+        "NotoSansRejang-Regular.ttf",
+        "NotoSansRunic-Regular.ttf",
+        "NotoSansSamaritan-Regular.ttf",
+        "NotoSansSaurashtra-Regular.ttf",
+        "NotoSansSharada-Regular.otf",
+        "NotoSansShavian-Regular.ttf",
+        "NotoSansSinhala-VF.ttf",
+        "NotoSansSinhalaUI-VF.ttf",
+        "NotoSansSoraSompeng-Regular.otf",
+        "NotoSansSoyombo-VF.ttf",
+        "NotoSansSundanese-Regular.ttf",
+        "NotoSansSylotiNagri-Regular.ttf",
+        "NotoSansSymbols-Regular-Subsetted.ttf",
+        "NotoSansSymbols-Regular-Subsetted2.ttf",
+        "NotoSansSyriacEastern-Regular.ttf",
+        "NotoSansSyriacEstrangela-Regular.ttf",
+        "NotoSansSyriacWestern-Regular.ttf",
+        "NotoSansTagalog-Regular.ttf",
+        "NotoSansTagbanwa-Regular.ttf",
+        "NotoSansTaiLe-Regular.ttf",
+        "NotoSansTaiTham-Regular.ttf",
+        "NotoSansTaiViet-Regular.ttf",
+        "NotoSansTakri-VF.ttf",
+        "NotoSansTamil-VF.ttf",
+        "NotoSansTamilUI-VF.ttf",
+        "NotoSansTelugu-VF.ttf",
+        "NotoSansTeluguUI-VF.ttf",
+        "NotoSansThaana-Bold.ttf",
+        "NotoSansThaana-Regular.ttf",
+        "NotoSansThai-Bold.ttf",
+        "NotoSansThai-Regular.ttf",
+        "NotoSansThaiUI-Bold.ttf",
+        "NotoSansThaiUI-Regular.ttf",
+        "NotoSansTifinagh-Regular.otf",
+        "NotoSansUgaritic-Regular.ttf",
+        "NotoSansVai-Regular.ttf",
+        "NotoSansWancho-Regular.otf",
+        "NotoSansWarangCiti-Regular.otf",
+        "NotoSansYi-Regular.ttf",
+        "NotoSerif-Bold.ttf",
+        "NotoSerif-BoldItalic.ttf",
+        "NotoSerif-Italic.ttf",
+        "NotoSerif-Regular.ttf",
+        "NotoSerifArmenian-VF.ttf",
+        "NotoSerifBengali-VF.ttf",
+        "NotoSerifCJK-Regular.ttc",
+        "NotoSerifDevanagari-VF.ttf",
+        "NotoSerifDogra-Regular.ttf",
+        "NotoSerifEthiopic-VF.ttf",
+        "NotoSerifGeorgian-VF.ttf",
+        "NotoSerifGujarati-VF.ttf",
+        "NotoSerifGurmukhi-VF.ttf",
+        "NotoSerifHebrew-Bold.ttf",
+        "NotoSerifHebrew-Regular.ttf",
+        "NotoSerifKannada-VF.ttf",
+        "NotoSerifKhmer-Bold.otf",
+        "NotoSerifKhmer-Regular.otf",
+        "NotoSerifLao-Bold.ttf",
+        "NotoSerifLao-Regular.ttf",
+        "NotoSerifMalayalam-VF.ttf",
+        "NotoSerifMyanmar-Bold.otf",
+        "NotoSerifMyanmar-Regular.otf",
+        "NotoSerifNyiakengPuachueHmong-VF.ttf",
+        "NotoSerifSinhala-VF.ttf",
+        "NotoSerifTamil-VF.ttf",
+        "NotoSerifTelugu-VF.ttf",
+        "NotoSerifThai-Bold.ttf",
+        "NotoSerifThai-Regular.ttf",
+        "NotoSerifTibetan-VF.ttf",
+        "NotoSerifYezidi-VF.ttf",
+        "Roboto-Regular.ttf",
+        "RobotoFlex-Regular.ttf",
+        "RobotoStatic-Regular.ttf",
+        "SourceSansPro-Bold.ttf",
+        "SourceSansPro-BoldItalic.ttf",
+        "SourceSansPro-Italic.ttf",
+        "SourceSansPro-Regular.ttf",
+        "SourceSansPro-SemiBold.ttf",
+        "SourceSansPro-SemiBoldItalic.ttf",
+        "font_fallback.xml",
+        "fonts.xml",
+    ],
+}
+
 android_system_image {
     name: "aosp_cf_system_x86_64",
+
+    partition_name: "system",
+    base_dir: "system",
+    dirs: android_rootdirs,
+    symlinks: android_symlinks,
+    file_contexts: ":plat_file_contexts",
+    linker_config_src: "linker.config.json",
+    fsverity: {
+        inputs: [
+            "etc/boot-image.prof",
+            "etc/dirty-image-objects",
+            "etc/preloaded-classes",
+            "etc/classpaths/*.pb",
+            "framework/*",
+            "framework/*/*", // framework/{arch}
+            "framework/oat/*/*", // framework/oat/{arch}
+        ],
+        libs: [":framework-res{.export-package.apk}"],
+    },
+    build_logtags: true,
+
     use_avb: true,
     avb_private_key: ":microdroid_sign_key",
     avb_algorithm: "SHA256_RSA4096",
     avb_hash_algorithm: "sha256",
-    partition_name: "system",
+
     deps: [
-        "abb",
         "abx",
-        "abx2xml",
         "aconfigd",
-        "adb_debug.prop",
-        "adevice_fingerprint",
         "aflags",
-        "aidl_lazy_cb_test_server",
-        "aidl_lazy_test_server",
         "am",
         "android_build_prop",
         "android_vintf_manifest",
-        "android.hardware.audio.common-util",
-        "android.hardware.audio.common-V3-ndk",
-        "android.hardware.audio.common@5.0-util",
-        "android.hardware.audio.common@5.0",
-        "android.hardware.audio.common@6.0-util",
-        "android.hardware.audio.common@6.0",
-        "android.hardware.audio.core-V2-ndk",
-        "android.hardware.audio.core.sounddose-V2-ndk",
-        "android.hardware.audio.effect-V2-ndk",
-        "android.hardware.audio.effect.service-aidl.example",
-        "android.hardware.audio.effect@5.0-util",
-        "android.hardware.audio.effect@5.0",
-        "android.hardware.audio.effect@6.0-util",
-        "android.hardware.audio.effect@6.0",
-        "android.hardware.audio.effect@7.0-impl",
-        "android.hardware.audio.service-aidl.example",
-        "android.hardware.audio@5.0-util",
-        "android.hardware.audio@5.0",
-        "android.hardware.audio@6.0-util",
-        "android.hardware.audio@6.0",
-        "android.hardware.biometrics.fingerprint@2.1",
-        "android.hardware.bluetooth.audio-impl",
-        "android.hardware.boot-service.default_recovery",
-        "android.hardware.common.fmq-V1-ndk",
-        "android.hardware.fastboot@1.1-impl-mock",
-        "android.hardware.graphics.allocator-service.minigbm",
-        "android.hardware.graphics.mapper@4.0-impl.minigbm",
-        "android.hardware.health-service.cuttlefish_recovery",
-        "android.hardware.health-V2-ndk",
-        "android.hardware.health-V3-ndk",
-        "android.hardware.power.stats-V1-cpp",
-        "android.hardware.radio.config@1.0",
-        "android.hardware.radio.deprecated@1.0",
-        "android.hardware.radio@1.0",
-        "android.hardware.radio@1.1",
-        "android.hardware.radio@1.2",
-        "android.hardware.radio@1.3",
-        "android.hardware.radio@1.4",
-        "android.hardware.secure_element@1.0",
-        "android.hardware.security.secretkeeper-service.nonsecure",
-        "android.hidl.allocator@1.0-service",
-        "android.hidl.memory.token@1.0",
-        "android.hidl.memory@1.0",
-        "android.hidl.safe_union@1.0",
-        "android.media.audio.common.types-V3-ndk",
         "android.system.suspend-service",
-        "AndroidClock.ttf",
         "apexd",
         "app_process",
         "appops",
         "appwidget",
-        "arping",
         "atrace",
-        "audio.primary.default",
         "audioserver",
-        "auditctl",
-        "av-audio-types-aidl-V1-ndk",
-        "avbctl",
-        "awk",
-        "bc",
         "bcc",
         "blank_screen",
         "blkid",
         "bmgr",
         "bootanimation",
-        "bootctl",
         "bootstat",
         "boringssl_self_test",
         "bpfloader",
         "bu",
-        "bugreport_procdump",
         "bugreport",
         "bugreportz",
-        "bzip2",
-        "cacerts",
         "cameraserver",
-        "CarroisGothicSC-Regular.ttf",
         "cgroups.json",
-        "cgroups.recovery.json",
-        "checkpoint_gc",
         "cmd",
-        "ComingSoon.ttf",
         "content",
         "cppreopts.sh",
         "credstore",
-        "CutiveMono.ttf",
-        "cuttlefish_sensor_injection",
-        "DancingScript-Regular.ttf",
         "debuggerd",
         "device_config",
         "dirty-image-objects",
@@ -177,45 +342,30 @@ android_system_image {
         "dmabuf_dump",
         "dmctl",
         "dmesgd",
-        "dmuserd",
         "dnsmasq",
         "dpm",
-        "DroidSansMono.ttf",
         "dump.erofs",
         "dumpstate",
-        "dumpsys_vendor",
         "dumpsys",
         "e2freefrag",
         "e2fsck",
         "e2fsdroid",
         "etc_hosts",
-        "evemu-record",
         "extra_free_kbytes",
         "fastbootd",
         "flags_health_check",
-        "font_fallback.xml",
-        "fonts.xml",
         "framework-audio_effects.xml",
         "framework-sysconfig.xml",
         "fsck_msdos",
         "fsck.erofs",
-        "fsck.exfat",
         "fsck.f2fs",
-        "fstab.cf.ext4.cts",
-        "fstab.cf.ext4.hctr2",
-        "fstab.cf.f2fs.cts",
-        "fstab.cf.f2fs.hctr2",
         "fstab.postinstall",
         "fsverity_init",
         "fsverity-release-cert-der",
         "gatekeeperd",
         "gpu_counter_producer",
         "gpuservice",
-        "group_odm",
-        "group_product",
-        "group_system_ext",
         "group_system",
-        "group_vendor",
         "gsi_tool",
         "gsid",
         "heapprofd_client",
@@ -224,8 +374,7 @@ android_system_image {
         "hiddenapi-package-whitelist.xml",
         "hidl_lazy_cb_test_server",
         "hidl_lazy_test_server",
-        "hwservicemanager",
-        "idlcli",
+        "idc_data",
         "idmap2",
         "idmap2d",
         "ime",
@@ -233,7 +382,6 @@ android_system_image {
         "incident-helper-cmd",
         "incident",
         "incidentd",
-        "init-debug.rc",
         "init_first_stage",
         "init.boringssl.zygote64_32.rc",
         "init.boringssl.zygote64.rc",
@@ -247,52 +395,30 @@ android_system_image {
         "initial-package-stopped-states.xml",
         "input",
         "installd",
-        "iotop",
         "ip",
-        "iperf3",
         "iptables",
-        "iw",
         "kcmdlinectrl",
+        "keychars_data",
+        "keylayout_data",
         "keystore_cli_v2",
         "keystore2",
-        "layertracegenerator",
-        "ld.config.recovery.txt",
         "ld.mc",
-        "ldd",
-        "lib_renderControl_enc",
         "libaaudio",
-        "libadbd_auth",
-        "libadbd_fs",
         "libalarm_jni",
         "libamidi",
         "libandroid_runtime",
         "libandroid_servers",
         "libandroid",
-        "libandroidemu",
         "libandroidfw",
         "libartpalette-system",
         "libasyncio",
-        "libasyncio",
-        "libaudio_aidl_conversion_common_ndk_cpp",
-        "libaudio_aidl_conversion_common_ndk",
-        "libaudio_aidl_conversion_common_ndk",
-        "libaudio_aidl_conversion_core_ndk",
-        "libaudio_aidl_conversion_effect_ndk",
         "libaudio-resampler",
-        "libaudioaidlcommon",
-        "libaudioaidlcommon",
         "libaudioeffect_jni",
         "libaudiohal_deathhandler",
         "libaudiohal",
-        "libaudiohal@5.0",
-        "libaudiohal@6.0",
-        "libaudiohal@7.0",
-        "libaudiohal@7.1",
-        "libaudiohal@aidl",
         "libaudiopolicyengineconfigurable",
         "libaudiopreprocessing",
         "libaudioutils",
-        "libaudioutils",
         "libbinder_ndk",
         "libbinder_rpc_unstable",
         "libbinder",
@@ -311,11 +437,8 @@ android_system_image {
         "libcups",
         "libcutils",
         "libdmabufheap",
-        "libdmabufheap",
         "libdownmix",
         "libdrm",
-        "libdrm",
-        "libdrm",
         "libdrmclearkeyplugin",
         "libdrmframework_jni",
         "libdrmframework",
@@ -323,9 +446,7 @@ android_system_image {
         "libeffectproxy",
         "libeffects",
         "libeffectsconfig",
-        "libeffectsconfig",
         "libEGL_angle",
-        "libEGL_emulation",
         "libEGL",
         "libepoxy",
         "libETC1",
@@ -341,12 +462,8 @@ android_system_image {
         "libgatekeeper",
         "libgbm",
         "libGLESv1_CM_angle",
-        "libGLESv1_CM_emulation",
         "libGLESv1_CM",
-        "libGLESv1_enc",
         "libGLESv2_angle",
-        "libGLESv2_emulation",
-        "libGLESv2_enc",
         "libGLESv2",
         "libGLESv3",
         "libgralloctypes",
@@ -357,7 +474,6 @@ android_system_image {
         "libhardware",
         "libhidcommand_jni",
         "libhidlmemory",
-        "libhidlmemory",
         "libhidltransport",
         "libhwbinder",
         "libincident",
@@ -374,7 +490,6 @@ android_system_image {
         "liblp",
         "liblz4",
         "libmedia_helper",
-        "libmedia_helper",
         "libmedia_jni",
         "libmedia",
         "libmediandk",
@@ -387,10 +502,7 @@ android_system_image {
         "libnetlink",
         "libnetutils",
         "libneuralnetworks_packageinfo",
-        "libnfc_nci_jni",
         "libnl",
-        "libOpenglCodecCommon",
-        "libOpenglSystemCommon",
         "libOpenMAXAL",
         "libOpenSLES",
         "libpdfium",
@@ -398,7 +510,6 @@ android_system_image {
         "libpolicy-subsystem",
         "libpower",
         "libpowermanager",
-        "libprintspooler_jni",
         "libprocessgroup_setup",
         "libprotobuf-cpp-full",
         "libradio_metadata",
@@ -418,14 +529,10 @@ android_system_image {
         "libsonivox",
         "libsoundpool",
         "libspeexresampler",
-        "libspeexresampler",
-        "libspeexresampler",
         "libsqlite",
         "libsquashfs_utils",
         "libssl",
         "libstagefright_foundation",
-        "libstagefright_foundation",
-        "libstagefright_foundation",
         "libstagefright_httplive",
         "libstagefright_omx",
         "libstagefright",
@@ -460,235 +567,31 @@ android_system_image {
         "logcat",
         "logcatd",
         "logd",
-        "logpersist.start",
-        "logtagd.rc",
-        "logwrapper",
         "lpdump",
         "lpdumpd",
         "lshal",
         "make_f2fs",
-        "mapper.minigbm",
         "mdnsd",
         "media_profiles_V1_0.dtd",
         "mediacodec.policy",
         "mediaextractor",
         "mediametrics",
         "migrate_legacy_obb_data",
-        "mini-keyctl",
         "misctrl",
         "mke2fs",
         "mkfs.erofs",
-        "mkfs.exfat",
         "mm_events",
         "monkey",
         "mtectrl",
         "ndc",
         "netd",
         "netutils-wrapper-1.0",
-        "newfs_msdos",
-        "NotoColorEmoji.ttf",
-        "NotoColorEmojiFlags.ttf",
-        "NotoColorEmojiLegacy.ttf",
-        "NotoNaskhArabic-Bold.ttf",
-        "NotoNaskhArabic-Regular.ttf",
-        "NotoNaskhArabicUI-Bold.ttf",
-        "NotoNaskhArabicUI-Regular.ttf",
-        "NotoSansAdlam-VF.ttf",
-        "NotoSansAhom-Regular.otf",
-        "NotoSansAnatolianHieroglyphs-Regular.otf",
-        "NotoSansArmenian-VF.ttf",
-        "NotoSansAvestan-Regular.ttf",
-        "NotoSansBalinese-Regular.ttf",
-        "NotoSansBamum-Regular.ttf",
-        "NotoSansBassaVah-Regular.otf",
-        "NotoSansBatak-Regular.ttf",
-        "NotoSansBengali-VF.ttf",
-        "NotoSansBengaliUI-VF.ttf",
-        "NotoSansBhaiksuki-Regular.otf",
-        "NotoSansBrahmi-Regular.ttf",
-        "NotoSansBuginese-Regular.ttf",
-        "NotoSansBuhid-Regular.ttf",
-        "NotoSansCanadianAboriginal-Regular.ttf",
-        "NotoSansCarian-Regular.ttf",
-        "NotoSansChakma-Regular.otf",
-        "NotoSansCham-Bold.ttf",
-        "NotoSansCham-Regular.ttf",
-        "NotoSansCherokee-Regular.ttf",
-        "NotoSansCJK-Regular.ttc",
-        "NotoSansCoptic-Regular.ttf",
-        "NotoSansCuneiform-Regular.ttf",
-        "NotoSansCypriot-Regular.ttf",
-        "NotoSansDeseret-Regular.ttf",
-        "NotoSansDevanagari-VF.ttf",
-        "NotoSansDevanagariUI-VF.ttf",
-        "NotoSansEgyptianHieroglyphs-Regular.ttf",
-        "NotoSansElbasan-Regular.otf",
-        "NotoSansEthiopic-VF.ttf",
-        "NotoSansGeorgian-VF.ttf",
-        "NotoSansGlagolitic-Regular.ttf",
-        "NotoSansGothic-Regular.ttf",
-        "NotoSansGrantha-Regular.ttf",
-        "NotoSansGujarati-Bold.ttf",
-        "NotoSansGujarati-Regular.ttf",
-        "NotoSansGujaratiUI-Bold.ttf",
-        "NotoSansGujaratiUI-Regular.ttf",
-        "NotoSansGunjalaGondi-Regular.otf",
-        "NotoSansGurmukhi-VF.ttf",
-        "NotoSansGurmukhiUI-VF.ttf",
-        "NotoSansHanifiRohingya-Regular.otf",
-        "NotoSansHanunoo-Regular.ttf",
-        "NotoSansHatran-Regular.otf",
-        "NotoSansHebrew-Bold.ttf",
-        "NotoSansHebrew-Regular.ttf",
-        "NotoSansImperialAramaic-Regular.ttf",
-        "NotoSansInscriptionalPahlavi-Regular.ttf",
-        "NotoSansInscriptionalParthian-Regular.ttf",
-        "NotoSansJavanese-Regular.otf",
-        "NotoSansKaithi-Regular.ttf",
-        "NotoSansKannada-VF.ttf",
-        "NotoSansKannadaUI-VF.ttf",
-        "NotoSansKayahLi-Regular.ttf",
-        "NotoSansKharoshthi-Regular.ttf",
-        "NotoSansKhmer-VF.ttf",
-        "NotoSansKhmerUI-Bold.ttf",
-        "NotoSansKhmerUI-Regular.ttf",
-        "NotoSansKhojki-Regular.otf",
-        "NotoSansLao-Bold.ttf",
-        "NotoSansLao-Regular.ttf",
-        "NotoSansLaoUI-Bold.ttf",
-        "NotoSansLaoUI-Regular.ttf",
-        "NotoSansLepcha-Regular.ttf",
-        "NotoSansLimbu-Regular.ttf",
-        "NotoSansLinearA-Regular.otf",
-        "NotoSansLinearB-Regular.ttf",
-        "NotoSansLisu-Regular.ttf",
-        "NotoSansLycian-Regular.ttf",
-        "NotoSansLydian-Regular.ttf",
-        "NotoSansMalayalam-VF.ttf",
-        "NotoSansMalayalamUI-VF.ttf",
-        "NotoSansMandaic-Regular.ttf",
-        "NotoSansManichaean-Regular.otf",
-        "NotoSansMarchen-Regular.otf",
-        "NotoSansMasaramGondi-Regular.otf",
-        "NotoSansMedefaidrin-VF.ttf",
-        "NotoSansMeeteiMayek-Regular.ttf",
-        "NotoSansMeroitic-Regular.otf",
-        "NotoSansMiao-Regular.otf",
-        "NotoSansModi-Regular.ttf",
-        "NotoSansMongolian-Regular.ttf",
-        "NotoSansMro-Regular.otf",
-        "NotoSansMultani-Regular.otf",
-        "NotoSansMyanmar-Bold.otf",
-        "NotoSansMyanmar-Medium.otf",
-        "NotoSansMyanmar-Regular.otf",
-        "NotoSansMyanmarUI-Bold.otf",
-        "NotoSansMyanmarUI-Medium.otf",
-        "NotoSansMyanmarUI-Regular.otf",
-        "NotoSansNabataean-Regular.otf",
-        "NotoSansNewa-Regular.otf",
-        "NotoSansNewTaiLue-Regular.ttf",
-        "NotoSansNKo-Regular.ttf",
-        "NotoSansOgham-Regular.ttf",
-        "NotoSansOlChiki-Regular.ttf",
-        "NotoSansOldItalic-Regular.ttf",
-        "NotoSansOldNorthArabian-Regular.otf",
-        "NotoSansOldPermic-Regular.otf",
-        "NotoSansOldPersian-Regular.ttf",
-        "NotoSansOldSouthArabian-Regular.ttf",
-        "NotoSansOldTurkic-Regular.ttf",
-        "NotoSansOriya-Bold.ttf",
-        "NotoSansOriya-Regular.ttf",
-        "NotoSansOriyaUI-Bold.ttf",
-        "NotoSansOriyaUI-Regular.ttf",
-        "NotoSansOsage-Regular.ttf",
-        "NotoSansOsmanya-Regular.ttf",
-        "NotoSansPahawhHmong-Regular.otf",
-        "NotoSansPalmyrene-Regular.otf",
-        "NotoSansPauCinHau-Regular.otf",
-        "NotoSansPhagsPa-Regular.ttf",
-        "NotoSansPhoenician-Regular.ttf",
-        "NotoSansRejang-Regular.ttf",
-        "NotoSansRunic-Regular.ttf",
-        "NotoSansSamaritan-Regular.ttf",
-        "NotoSansSaurashtra-Regular.ttf",
-        "NotoSansSharada-Regular.otf",
-        "NotoSansShavian-Regular.ttf",
-        "NotoSansSinhala-VF.ttf",
-        "NotoSansSinhalaUI-VF.ttf",
-        "NotoSansSoraSompeng-Regular.otf",
-        "NotoSansSoyombo-VF.ttf",
-        "NotoSansSundanese-Regular.ttf",
-        "NotoSansSylotiNagri-Regular.ttf",
-        "NotoSansSymbols-Regular-Subsetted.ttf",
-        "NotoSansSymbols-Regular-Subsetted2.ttf",
-        "NotoSansSyriacEastern-Regular.ttf",
-        "NotoSansSyriacEstrangela-Regular.ttf",
-        "NotoSansSyriacWestern-Regular.ttf",
-        "NotoSansTagalog-Regular.ttf",
-        "NotoSansTagbanwa-Regular.ttf",
-        "NotoSansTaiLe-Regular.ttf",
-        "NotoSansTaiTham-Regular.ttf",
-        "NotoSansTaiViet-Regular.ttf",
-        "NotoSansTakri-VF.ttf",
-        "NotoSansTamil-VF.ttf",
-        "NotoSansTamilUI-VF.ttf",
-        "NotoSansTelugu-VF.ttf",
-        "NotoSansTeluguUI-VF.ttf",
-        "NotoSansThaana-Bold.ttf",
-        "NotoSansThaana-Regular.ttf",
-        "NotoSansThai-Bold.ttf",
-        "NotoSansThai-Regular.ttf",
-        "NotoSansThaiUI-Bold.ttf",
-        "NotoSansThaiUI-Regular.ttf",
-        "NotoSansTifinagh-Regular.otf",
-        "NotoSansUgaritic-Regular.ttf",
-        "NotoSansVai-Regular.ttf",
-        "NotoSansWancho-Regular.otf",
-        "NotoSansWarangCiti-Regular.otf",
-        "NotoSansYi-Regular.ttf",
-        "NotoSerif-Bold.ttf",
-        "NotoSerif-BoldItalic.ttf",
-        "NotoSerif-Italic.ttf",
-        "NotoSerif-Regular.ttf",
-        "NotoSerifArmenian-VF.ttf",
-        "NotoSerifBengali-VF.ttf",
-        "NotoSerifCJK-Regular.ttc",
-        "NotoSerifDevanagari-VF.ttf",
-        "NotoSerifDogra-Regular.ttf",
-        "NotoSerifEthiopic-VF.ttf",
-        "NotoSerifGeorgian-VF.ttf",
-        "NotoSerifGujarati-VF.ttf",
-        "NotoSerifGurmukhi-VF.ttf",
-        "NotoSerifHebrew-Bold.ttf",
-        "NotoSerifHebrew-Regular.ttf",
-        "NotoSerifKannada-VF.ttf",
-        "NotoSerifKhmer-Bold.otf",
-        "NotoSerifKhmer-Regular.otf",
-        "NotoSerifLao-Bold.ttf",
-        "NotoSerifLao-Regular.ttf",
-        "NotoSerifMalayalam-VF.ttf",
-        "NotoSerifMyanmar-Bold.otf",
-        "NotoSerifMyanmar-Regular.otf",
-        "NotoSerifNyiakengPuachueHmong-VF.ttf",
-        "NotoSerifSinhala-VF.ttf",
-        "NotoSerifTamil-VF.ttf",
-        "NotoSerifTelugu-VF.ttf",
-        "NotoSerifThai-Bold.ttf",
-        "NotoSerifThai-Regular.ttf",
-        "NotoSerifTibetan-VF.ttf",
-        "NotoSerifYezidi-VF.ttf",
         "odsign",
-        "ot-cli-ftd",
-        "ot-ctl",
         "otapreopt_chroot",
         "otapreopt_script",
         "otapreopt_slot",
         "otapreopt",
-        "passwd_odm",
-        "passwd_product",
-        "passwd_system_ext",
         "passwd_system",
-        "passwd_vendor",
         "perfetto",
         "ping",
         "ping6",
@@ -697,11 +600,8 @@ android_system_image {
         "pm",
         "power.default",
         "preinstalled-packages-asl-files.xml",
-        "preinstalled-packages-platform-aosp-product.xml",
         "preinstalled-packages-platform-generic-system.xml",
-        "preinstalled-packages-platform-handheld-product.xml",
         "preinstalled-packages-platform-handheld-system.xml",
-        "preinstalled-packages-platform-telephony-product.xml",
         "preinstalled-packages-platform.xml",
         "preinstalled-packages-strict-signature.xml",
         "preloaded-classes",
@@ -712,24 +612,13 @@ android_system_image {
         "printflags",
         "privapp-permissions-platform.xml",
         "prng_seeder",
-        "procrank",
-        "profcollectctl",
-        "profcollectd",
-        "reboot",
-        "record_binder",
         "recovery-persist",
         "recovery-refresh",
-        "recovery",
-        "remount",
         "requestsync",
         "resize2fs",
-        "Roboto-Regular.ttf",
-        "RobotoFlex-Regular.ttf",
-        "RobotoStatic-Regular.ttf",
         "rss_hwm_reset",
         "run-as",
         "sample_camera_extensions.xml",
-        "sanitizer-status",
         "schedtest",
         "screencap",
         "screenrecord",
@@ -738,68 +627,36 @@ android_system_image {
         "sensorservice",
         "server_configurable_flags",
         "service",
-        "servicedispatcher",
-        "servicemanager.recovery",
         "servicemanager",
-        "settaskprofile",
         "settings",
         "sfdo",
         "sgdisk",
-        "sh",
-        "showmap",
-        "simpleperf_app_runner",
-        "simpleperf",
         "sload_f2fs",
         "sm",
         "snapshotctl",
         "snapuserd_ramdisk",
         "snapuserd",
         "socket_vsock_proxy",
-        "SourceSansPro-Bold.ttf",
-        "SourceSansPro-BoldItalic.ttf",
-        "SourceSansPro-Italic.ttf",
-        "SourceSansPro-Regular.ttf",
-        "SourceSansPro-SemiBold.ttf",
-        "SourceSansPro-SemiBoldItalic.ttf",
-        "sqlite3",
-        "ss",
-        "start_with_lockagent",
         "storaged",
-        "strace",
         "surfaceflinger",
         "suspend_blocker",
         "svc",
         "task_profiles.json",
         "tc",
-        "tcpdump",
         "telecom",
-        "tinycap",
-        "tinyhostless",
-        "tinymix",
-        "tinypcminfo",
-        "tinyplay",
         "tombstone_producer",
         "tombstone_transmit",
         "tombstoned",
         "toolbox",
-        "toybox",
-        "toybox",
         "traced_perf",
         "traced_probes",
         "traced",
-        "tracepath",
-        "tracepath6",
-        "traceroute6",
         "trigger_perfetto",
         "tune2fs",
         "ueventd.rc",
         "uiautomator",
         "uinput",
         "uncrypt",
-        "unwind_info",
-        "unwind_reg_info",
-        "unwind_symbols",
-        "update_engine_client",
         "update_engine_sideload",
         "update_engine",
         "update_verifier",
@@ -814,9 +671,7 @@ android_system_image {
         "wifi.rc",
         "wificond",
         "wm",
-        "xml2abx",
         "xtables.lock",
-        "ziptool",
     ],
     multilib: {
         common: {
@@ -859,57 +714,12 @@ android_system_image {
                 "com.android.cellbroadcast",
                 "com.android.compos",
                 "com.android.future.usb.accessory",
-                "com.android.hardware.authsecret",
-                "com.android.hardware.biometrics.face.virtual",
-                "com.android.hardware.biometrics.fingerprint.virtual",
-                "com.android.hardware.boot",
-                "com.android.hardware.cas",
-                "com.android.hardware.contexthub",
-                "com.android.hardware.dumpstate",
-                "com.android.hardware.gnss",
-                "com.android.hardware.input.processor",
-                "com.android.hardware.keymint.rust_cf_remote",
-                "com.android.hardware.keymint.rust_nonsecure",
-                "com.android.hardware.memtrack",
-                "com.android.hardware.net.nlinterceptor",
-                "com.android.hardware.neuralnetworks",
-                "com.android.hardware.power",
-                "com.android.hardware.rebootescrow",
-                "com.android.hardware.secure_element",
-                "com.android.hardware.security.authgraph",
-                "com.android.hardware.sensors",
-                "com.android.hardware.tetheroffload",
-                "com.android.hardware.thermal",
-                "com.android.hardware.threadnetwork",
-                "com.android.hardware.usb",
-                "com.android.hardware.uwb",
-                "com.android.hardware.vibrator",
-                "com.android.hardware.wifi",
-                "com.android.i18n",
-                "com.android.ipsec",
-                "com.android.hardware.gatekeeper.cf_remote",
-                "com.android.hardware.gatekeeper.nonsecure",
-                "com.android.hardware.keymint.rust_cf_remote",
-                "com.android.hardware.keymint.rust_nonsecure",
                 "com.android.location.provider",
                 "com.android.media.remotedisplay.xml",
                 "com.android.media.remotedisplay",
                 "com.android.mediadrm.signer",
                 "com.android.nfc_extras",
                 "com.android.runtime",
-                "com.google.cf.bt",
-                "com.google.cf.confirmationui",
-                "com.google.cf.health.storage",
-                "com.google.cf.health",
-                "com.google.cf.identity",
-                "com.google.cf.input.config",
-                "com.google.cf.ir",
-                "com.google.cf.light",
-                "com.google.cf.nfc",
-                "com.google.cf.oemlock",
-                "com.google.cf.rild",
-                "com.google.cf.vulkan",
-                "com.google.cf.wifi",
                 "CompanionDeviceManager",
                 "Contacts",
                 "ContactsProvider",
@@ -928,6 +738,7 @@ android_system_image {
                 "ext",
                 "ExternalStorageProvider",
                 "ExtShared",
+                "fonts",
                 "framework-graphics",
                 "framework-location",
                 "framework-minus-apex-install-dependencies",
@@ -984,9 +795,7 @@ android_system_image {
                 "SettingsIntelligence",
                 "SettingsProvider",
                 "SharedStorageBackup",
-                "shell_and_utilities_recovery",
                 "shell_and_utilities_system",
-                "shell_and_utilities_vendor",
                 "Shell",
                 "SimAppDialog",
                 "SoundPicker",
@@ -1024,46 +833,52 @@ android_system_image {
             ],
         },
     },
-    base_dir: "system",
-    dirs: android_rootdirs,
-    symlinks: android_symlinks,
-    file_contexts: ":plat_file_contexts",
-    linker_config_src: "linker.config.json",
-    arch: {
-        x86: {
-            multilib: {
-                common: {
-                    deps: [
-                        "com.android.wifi",
-                    ],
-                },
-            },
-        },
-        x86_64: {
+    product_variables: {
+        debuggable: {
             deps: [
-                "libgfxstream_backend",
+                "adevice_fingerprint",
+                "arping",
+                "avbctl",
+                "bootctl",
+                "dmuserd",
+                "evemu-record",
+                "idlcli",
+                "init-debug.rc",
+                "iotop",
+                "iperf3",
+                "iw",
+                "layertracegenerator",
+                "logpersist.start",
+                "logtagd.rc",
+                "ot-cli-ftd",
+                "ot-ctl",
+                "procrank",
+                "profcollectctl",
+                "profcollectd",
+                "record_binder",
+                "sanitizer-status",
+                "servicedispatcher",
+                "showmap",
+                "sqlite3",
+                "ss",
+                "start_with_lockagent",
+                "strace",
+                "su",
+                "tinycap",
+                "tinyhostless",
+                "tinymix",
+                "tinypcminfo",
+                "tinyplay",
+                "tracepath",
+                "tracepath6",
+                "traceroute6",
+                "unwind_info",
+                "unwind_reg_info",
+                "unwind_symbols",
+                "update_engine_client",
             ],
-            multilib: {
-                common: {
-                    deps: [
-                        "com.android.wifi",
-                    ],
-                },
-            },
         },
     },
-    fsverity: {
-        inputs: [
-            "etc/boot-image.prof",
-            "etc/dirty-image-objects",
-            "etc/preloaded-classes",
-            "etc/classpaths/*.pb",
-            "framework/*",
-            "framework/*/*", // framework/{arch}
-            "framework/oat/*/*", // framework/oat/{arch}
-        ],
-        libs: [":framework-res{.export-package.apk}"],
-    },
 }
 
 prebuilt_etc {