Snap for 10900817 from 617052a2cb2685aa3c18296402a5c2e25379cfef to sdk-release Change-Id: Ia26b947c0d3925663bb94fe0753207b77c382b74

commit: 75f51227025d109cc14fd75ebeb92ebdfcd4e780 [log] [tgz]
author: Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Oct 04 14:42:18 2023 +0000
committer: Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Oct 04 14:42:18 2023 +0000
tree: cf09b1a48e2676b3ec397b269c8c70ab6c40d6bf
parent: a21a50d4e390ae64046a0c491bcdbb2b05ccfcde [diff]
parent: 617052a2cb2685aa3c18296402a5c2e25379cfef [diff]
diff --git a/.dockerignore b/.dockerignore
index 7765ca9..06cff52 100644
--- a/.dockerignore
+++ b/.dockerignore

@@ -3,5 +3,6 @@
 **/*
 **/.*
 !rebuild-internal.sh
+!policy-inliner.sh
 !manifest.xml
 !custom.xml

diff --git a/Android.bp b/Android.bp
index 65691c2..f53720a 100644
--- a/Android.bp
+++ b/Android.bp

@@ -14,88 +14,154 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-cc_prebuilt_binary {
-  name: "common_crosvm",
-  stem: "crosvm",
-  srcs: ["scripts/crosvm"],
-  defaults: ["cuttlefish_host_only"],
-}
-// NOTE: Using cc_prebuilt_binary because cc_prebuilt_library can't handle stem on pie
+// NOTE: Using cc_prebuilt_binary because cc_prebuilt_library will add
+//       unwanted .so file extensions when installing shared libraries
 
 cc_prebuilt_binary {
   name: "aarch64_linux_gnu_crosvm",
   srcs: ["aarch64-linux-gnu/bin/crosvm"],
   stem: "crosvm",
   relative_install_path: "aarch64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+cc_prebuilt_binary {
+  name: "aarch64_linux_gnu_libdrm.so.2_for_crosvm",
+  srcs: ["aarch64-linux-gnu/bin/libdrm.so.2"],
+  stem: "libdrm.so.2",
+  relative_install_path: "aarch64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
   name: "aarch64_linux_gnu_libepoxy.so.0_for_crosvm",
   srcs: ["aarch64-linux-gnu/bin/libepoxy.so.0"],
   stem: "libepoxy.so.0",
   relative_install_path: "aarch64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+cc_prebuilt_binary {
+  name: "aarch64_linux_gnu_libffi.so.7_for_crosvm",
+  srcs: ["aarch64-linux-gnu/bin/libffi.so.7"],
+  stem: "libffi.so.7",
+  relative_install_path: "aarch64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
   name: "aarch64_linux_gnu_libgbm.so.1_for_crosvm",
   srcs: ["aarch64-linux-gnu/bin/libgbm.so.1"],
   stem: "libgbm.so.1",
   relative_install_path: "aarch64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+cc_prebuilt_binary {
+  name: "aarch64_linux_gnu_libgfxstream_backend.so_for_crosvm",
+  srcs: ["aarch64-linux-gnu/bin/libgfxstream_backend.so"],
+  stem: "libgfxstream_backend.so",
+  relative_install_path: "aarch64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
   name: "aarch64_linux_gnu_libminijail.so_for_crosvm",
   srcs: ["aarch64-linux-gnu/bin/libminijail.so"],
   stem: "libminijail.so",
   relative_install_path: "aarch64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
-}
-cc_prebuilt_binary {
-  name: "aarch64_linux_gnu_libvirglrenderer.so.0_for_crosvm",
-  srcs: ["aarch64-linux-gnu/bin/libvirglrenderer.so.0"],
-  stem: "libvirglrenderer.so.0",
-  relative_install_path: "aarch64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
   name: "aarch64_linux_gnu_libvirglrenderer.so.1_for_crosvm",
   srcs: ["aarch64-linux-gnu/bin/libvirglrenderer.so.1"],
   stem: "libvirglrenderer.so.1",
   relative_install_path: "aarch64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
-  name: "x86_64_linux_gnu_libandroid_emu_shared.so_for_crosvm",
-  srcs: ["x86_64-linux-gnu/bin/libandroid-emu-shared.so"],
-  stem: "libandroid-emu-shared.so",
+  name: "aarch64_linux_gnu_libwayland_client.so.0_for_crosvm",
+  srcs: ["aarch64-linux-gnu/bin/libwayland-client.so.0"],
+  stem: "libwayland-client.so.0",
+  relative_install_path: "aarch64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+// Note: This is commented out to avoid a conflict with the binary built
+// from external/crosvm. This should be uncommented out when backporting to
+// older branches with just use the prebuilt and which do not build from
+// source.
+//cc_prebuilt_binary {
+//  name: "x86_64_linux_gnu_crosvm",
+//  srcs: ["x86_64-linux-gnu/bin/crosvm"],
+//  stem: "crosvm",
+//  relative_install_path: "x86_64-linux-gnu",
+//  defaults: ["cuttlefish_host"],
+//  check_elf_files: false,
+//}
+cc_prebuilt_binary {
+  name: "x86_64_linux_gnu_libdrm.so.2_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libdrm.so.2"],
+  stem: "libdrm.so.2",
   relative_install_path: "x86_64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
-  name: "x86_64_linux_gnu_libc++.so.1_for_crosvm",
-  srcs: ["x86_64-linux-gnu/bin/libc++.so.1"],
-  stem: "libc++.so.1",
+  name: "x86_64_linux_gnu_libepoxy.so.0_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libepoxy.so.0"],
+  stem: "libepoxy.so.0",
   relative_install_path: "x86_64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
-  name: "x86_64_linux_gnu_libemugl_common.so_for_crosvm",
-  srcs: ["x86_64-linux-gnu/bin/libemugl_common.so"],
-  stem: "libemugl_common.so",
+  name: "x86_64_linux_gnu_libffi.so.7_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libffi.so.7"],
+  stem: "libffi.so.7",
   relative_install_path: "x86_64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+cc_prebuilt_binary {
+  name: "x86_64_linux_gnu_libgbm.so.1_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libgbm.so.1"],
+  stem: "libgbm.so.1",
+  relative_install_path: "x86_64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
   name: "x86_64_linux_gnu_libgfxstream_backend.so_for_crosvm",
   srcs: ["x86_64-linux-gnu/bin/libgfxstream_backend.so"],
   stem: "libgfxstream_backend.so",
   relative_install_path: "x86_64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }
 cc_prebuilt_binary {
-  name: "x86_64_linux_gnu_libOpenglRender.so_for_crosvm",
-  srcs: ["x86_64-linux-gnu/bin/libOpenglRender.so"],
-  stem: "libOpenglRender.so",
+  name: "x86_64_linux_gnu_libminijail.so_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libminijail.so"],
+  stem: "libminijail.so",
   relative_install_path: "x86_64-linux-gnu",
-  defaults: ["cuttlefish_host_only"],
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+cc_prebuilt_binary {
+  name: "x86_64_linux_gnu_libvirglrenderer.so.1_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libvirglrenderer.so.1"],
+  stem: "libvirglrenderer.so.1",
+  relative_install_path: "x86_64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
+}
+cc_prebuilt_binary {
+  name: "x86_64_linux_gnu_libwayland_client.so.0_for_crosvm",
+  srcs: ["x86_64-linux-gnu/bin/libwayland-client.so.0"],
+  stem: "libwayland-client.so.0",
+  relative_install_path: "x86_64-linux-gnu",
+  defaults: ["cuttlefish_host"],
+  check_elf_files: false,
 }

diff --git a/Dockerfile b/Dockerfile
index dee59ae..ef636d7 100644
--- a/Dockerfile
+++ b/Dockerfile

@@ -1,3 +1,5 @@
+# NOTE: For now, don't be tempted to bump this to bullseye-slim, as Oxygen
+# still uses a glibc based on Debian 10, not Debian 11
 FROM debian:buster-slim AS docker_vmm
 
 ENV container docker
@@ -52,36 +54,4 @@
 
 USER root
 
-# Containers built from this image are meant to persist, once started.  A user
-# account is created on them where the work of building crosvm is carried out,
-# persistently.
-
-RUN apt-get update \
-    && apt-get install -y systemd \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* \
-    && rm -f /var/run/nologin
-
-RUN rm -f /lib/systemd/system/multi-user.target.wants/* \
-    /etc/systemd/system/*.wants/* \
-    /lib/systemd/system/local-fs.target.wants/* \
-    /lib/systemd/system/sockets.target.wants/*udev* \
-    /lib/systemd/system/sockets.target.wants/*initctl* \
-    /lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup* \
-    /lib/systemd/system/systemd-update-utmp*
-
-VOLUME [ "/sys/fs/cgroup" ]
-
-CMD ["/lib/systemd/systemd"]
-
-RUN apt update \
-    && apt install -y apt-utils sudo dpkg-dev coreutils \
-       openssh-server openssh-client psmisc iptables iproute2 dnsmasq \
-       net-tools rsyslog equivs
-
-RUN apt install -y dialog
-
-RUN sed -i -r -e 's/^#{0,1}\s*PasswordAuthentication\s+(yes|no)/PasswordAuthentication yes/g' /etc/ssh/sshd_config \
-    && sed -i -r -e 's/^#{0,1}\s*PermitEmptyPasswords\s+(yes|no)/PermitEmptyPasswords yes/g' /etc/ssh/sshd_config \
-    && sed -i -r -e 's/^#{0,1}\s*ChallengeResponseAuthentication\s+(yes|no)/ChallengeResponseAuthentication no/g' /etc/ssh/sshd_config \
-    && sed -i -r -e 's/^#{0,1}\s*UsePAM\s+(yes|no)/UsePAM no/g' /etc/ssh/sshd_config
+CMD ["sleep", "1d"]

diff --git a/OWNERS b/OWNERS
index 1944029..18f33d5 100644
--- a/OWNERS
+++ b/OWNERS

@@ -1,11 +1,17 @@
-# Current team members
 adelva@google.com
+chadreynolds@google.com
+ellisr@google.com
+jaeman@google.com
+jaewan@google.com
 jemoreira@google.com
+jeongik@google.com
+kwstephenkim@google.com
 malchev@google.com
-muntsinger@google.com
+moelsherif@google.com
 natsu@google.com
 rammuthiah@google.com
 schuffelen@google.com
-
-# Former team members
-ghartman@google.com
+seungjaeyoo@google.com
+sorama@google.com
+weihsu@google.com
+dimorinny@google.com

diff --git a/README.txt b/README.txt
new file mode 100644
index 0000000..c800890
--- /dev/null
+++ b/README.txt

@@ -0,0 +1,31 @@
+# Prebuilts
+
+## How to update
+
+From your AOSP repo:
+
+```
+./device/google/cuttlefish_vmm/rebuild.sh \
+  --docker \
+  --docker_arch aarch64
+```
+
+If you need to make edits and iterate afterward:
+
+./device/google/cuttlefish_vmm/rebuild.sh \
+  --docker \
+  --docker_arch aarch64 \
+  --reuse
+```
+
+## Why do we need these?
+
+The Android toolchain builds the Cuttlefish host tools for ARM using musl
+which is not compatible with most userspace GPU drivers which are built
+using glibc (see b/200592498).
+
+The vhost-user protocol allows VMMs to run individual virtual devices in
+separate host processes. By using vhost-user-gpu, the Cuttlefish host tools
+can run just the Virtio GPU device in a separate subprocess using a Crosvm
+binary and Gfxstream library built for the host architecture. This directory
+contains prebuilts for Crosvm and Gfxstream for this purpose.

diff --git a/aarch64-linux-gnu/Android.bp b/aarch64-linux-gnu/Android.bp
new file mode 100644
index 0000000..0d305d0
--- /dev/null
+++ b/aarch64-linux-gnu/Android.bp

@@ -0,0 +1,196 @@
+// Autogenerated via gen_android_bp.sh
+//
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+prebuilt_usr_share_host {
+  name: "9p_device.policy_at_aarch64",
+  src: "etc/seccomp/9p_device.policy",
+  filename: "9p_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "balloon_device.policy_at_aarch64",
+  src: "etc/seccomp/balloon_device.policy",
+  filename: "balloon_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "battery.policy_at_aarch64",
+  src: "etc/seccomp/battery.policy",
+  filename: "battery.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "block_device.policy_at_aarch64",
+  src: "etc/seccomp/block_device.policy",
+  filename: "block_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "coiommu_device.policy_at_aarch64",
+  src: "etc/seccomp/coiommu_device.policy",
+  filename: "coiommu_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "common_device.policy_at_aarch64",
+  src: "etc/seccomp/common_device.policy",
+  filename: "common_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "cras_audio_device.policy_at_aarch64",
+  src: "etc/seccomp/cras_audio_device.policy",
+  filename: "cras_audio_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "cras_snd_device.policy_at_aarch64",
+  src: "etc/seccomp/cras_snd_device.policy",
+  filename: "cras_snd_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "fs_device.policy_at_aarch64",
+  src: "etc/seccomp/fs_device.policy",
+  filename: "fs_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "gpu_common.policy_at_aarch64",
+  src: "etc/seccomp/gpu_common.policy",
+  filename: "gpu_common.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "gpu_device.policy_at_aarch64",
+  src: "etc/seccomp/gpu_device.policy",
+  filename: "gpu_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "gpu_render_server.policy_at_aarch64",
+  src: "etc/seccomp/gpu_render_server.policy",
+  filename: "gpu_render_server.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "input_device.policy_at_aarch64",
+  src: "etc/seccomp/input_device.policy",
+  filename: "input_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "net_device.policy_at_aarch64",
+  src: "etc/seccomp/net_device.policy",
+  filename: "net_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "null_audio_device.policy_at_aarch64",
+  src: "etc/seccomp/null_audio_device.policy",
+  filename: "null_audio_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "pmem_device.policy_at_aarch64",
+  src: "etc/seccomp/pmem_device.policy",
+  filename: "pmem_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "rng_device.policy_at_aarch64",
+  src: "etc/seccomp/rng_device.policy",
+  filename: "rng_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "serial_device.policy_at_aarch64",
+  src: "etc/seccomp/serial_device.policy",
+  filename: "serial_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "serial.policy_at_aarch64",
+  src: "etc/seccomp/serial.policy",
+  filename: "serial.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "snd_cras_device.policy_at_aarch64",
+  src: "etc/seccomp/snd_cras_device.policy",
+  filename: "snd_cras_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "snd_null_device.policy_at_aarch64",
+  src: "etc/seccomp/snd_null_device.policy",
+  filename: "snd_null_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "tpm_device.policy_at_aarch64",
+  src: "etc/seccomp/tpm_device.policy",
+  filename: "tpm_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_net_device.policy_at_aarch64",
+  src: "etc/seccomp/vhost_net_device.policy",
+  filename: "vhost_net_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_scmi_device.policy_at_aarch64",
+  src: "etc/seccomp/vhost_scmi_device.policy",
+  filename: "vhost_scmi_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_vsock_device.policy_at_aarch64",
+  src: "etc/seccomp/vhost_vsock_device.policy",
+  filename: "vhost_vsock_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "video_device.policy_at_aarch64",
+  src: "etc/seccomp/video_device.policy",
+  filename: "video_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vios_audio_device.policy_at_aarch64",
+  src: "etc/seccomp/vios_audio_device.policy",
+  filename: "vios_audio_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "wl_device.policy_at_aarch64",
+  src: "etc/seccomp/wl_device.policy",
+  filename: "wl_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "xhci_device.policy_at_aarch64",
+  src: "etc/seccomp/xhci_device.policy",
+  filename: "xhci_device.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "xhci.policy_at_aarch64",
+  src: "etc/seccomp/xhci.policy",
+  filename: "xhci.policy",
+  sub_dir: "cuttlefish/aarch64-linux-gnu/seccomp",
+}

diff --git a/aarch64-linux-gnu/Cargo.lock b/aarch64-linux-gnu/Cargo.lock
index 551ded5..12ef722 100644
--- a/aarch64-linux-gnu/Cargo.lock
+++ b/aarch64-linux-gnu/Cargo.lock

@@ -1,22 +1,31 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "aarch64"
 version = "0.1.0"
 dependencies = [
  "arch",
  "base",
- "data_model",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
  "devices",
+ "gdbstub",
+ "gdbstub_arch",
  "hypervisor",
+ "jail",
  "kernel_cmdline",
- "kvm",
- "kvm_sys",
+ "kernel_loader",
  "libc",
+ "memoffset 0.6.5",
  "minijail",
+ "rand",
  "remain",
  "resources",
+ "swap",
  "sync",
+ "thiserror",
  "vm_control",
  "vm_memory",
 ]
@@ -25,54 +34,248 @@
 name = "acpi_tables"
 version = "0.1.0"
 dependencies = [
- "data_model",
+ "tempfile",
+ "zerocopy",
 ]
 
 [[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anti_tamper"
+version = "0.1.0"
+dependencies = [
+ "base",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb07d2053ccdbe10e2af2995a2f116c1330396493dc1269f6a91d0ae82e19704"
+
+[[package]]
+name = "arbitrary"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f44124848854b941eafdb34f05b3bcf59472f643c7e151eba7c2b69daa469ed5"
+
+[[package]]
 name = "arch"
 version = "0.1.0"
 dependencies = [
  "acpi_tables",
+ "anyhow",
  "base",
+ "cfg-if",
+ "cros_fdt",
+ "cros_tracing",
  "devices",
+ "gdbstub",
+ "gdbstub_arch",
  "hypervisor",
+ "jail",
  "kernel_cmdline",
  "libc",
  "minijail",
+ "power_monitor",
+ "remain",
  "resources",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "swap",
  "sync",
+ "thiserror",
  "vm_control",
  "vm_memory",
+ "winapi",
 ]
 
 [[package]]
+name = "argh"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab257697eb9496bf75526f0217b5ed64636a9cfafa78b8365c71bd283fcef93e"
+dependencies = [
+ "argh_derive",
+ "argh_shared",
+]
+
+[[package]]
+name = "argh_derive"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b382dbd3288e053331f03399e1db106c9fb0d8562ad62cb04859ae926f324fa6"
+dependencies = [
+ "argh_shared",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "argh_helpers"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 2.0.33",
+]
+
+[[package]]
+name = "argh_shared"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cb94155d965e3d37ffbbe7cc5b82c3dd79dd33bd48e536f73d2cfb8d85506f"
+
+[[package]]
 name = "assertions"
 version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d2db826478dd8333d60f91c74ff8f0b3d01252a32631f004b11fbb18c941036"
+
+[[package]]
+name = "async-task"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a40729d2133846d9ed0ea60a8b9541bccddab49cd30f0715a1da672fe9a2524"
 
 [[package]]
 name = "async-trait"
-version = "0.1.38"
+version = "0.1.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1a4a2f97ce50c9d0282c1468816208588441492b40d813b2e0419c22c05e7f"
+checksum = "96cf8829f67d2eab0b2dfa42c5d0ef737e0724e4a82b01b3e292456202b19716"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
 ]
 
 [[package]]
 name = "audio_streams"
 version = "0.1.0"
 dependencies = [
- "sync",
- "sys_util",
+ "async-trait",
+ "futures",
+ "remain",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "audio_streams_conformance_test"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "audio_streams",
+ "cfg-if",
+ "cros_async",
+ "libcras",
+ "minijail",
+ "remain",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "audio_util"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "audio_streams",
+ "base",
+ "thiserror",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "balloon_control"
+version = "0.1.0"
+dependencies = [
+ "serde",
 ]
 
 [[package]]
 name = "base"
 version = "0.1.0"
 dependencies = [
- "sys_util",
+ "audio_streams",
+ "base_event_token_derive",
+ "cfg-if",
+ "chrono",
+ "data_model 0.1.1-alpha.1",
+ "env_logger",
+ "libc",
+ "libtest-mimic",
+ "log",
+ "minijail",
+ "once_cell",
+ "protobuf",
+ "rand",
+ "regex",
+ "remain",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "uuid",
+ "win_util",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "base_event_token_derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 2.0.33",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.60.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "062dddbc1ba4aca46de6338e2bf87771414c335f7b2f2036e8f3e9befebf88e6"
+dependencies = [
+ "bitflags 1.3.2",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "peeking_take_while",
+ "proc-macro2",
+ "quote 1.0.33",
+ "regex",
+ "rustc-hash",
+ "shlex",
 ]
 
 [[package]]
@@ -87,47 +290,357 @@
 version = "0.1.0"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 2.0.33",
 ]
 
 [[package]]
 name = "bitflags"
-version = "1.2.1"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbe3c979c178231552ecba20214a8272df4e09f232a87aef4320cf06539aded"
+
+[[package]]
+name = "bitreader"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d84ea71c85d1fe98fe67a9b9988b1695bc24c0b0d3bfb18d4c510f44b4b09941"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "broker_ipc"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "broker_ipc_product",
+ "crash_report",
+ "metrics",
+ "serde",
+]
+
+[[package]]
+name = "broker_ipc_product"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "crash_report",
+ "serde",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0b3de4a0c5e67e16066a0715723abd91edc2f9001d09c46e1dca929351e130e"
+
+[[package]]
+name = "catapult_converter"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
+[[package]]
+name = "cbindgen"
+version = "0.24.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6358dedf60f4d9b8db43ad187391afe959746101346fe51bb978126bec61dfb"
+dependencies = [
+ "clap 3.2.23",
+ "heck",
+ "indexmap",
+ "log",
+ "proc-macro2",
+ "quote 1.0.33",
+ "serde",
+ "serde_json",
+ "syn 1.0.103",
+ "tempfile",
+ "toml",
+]
 
 [[package]]
 name = "cc"
-version = "1.0.25"
+version = "1.0.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f159dfd43363c4d08055a07703eb7a3406b0dac4d0584d96965a3262db3c9d16"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+dependencies = [
+ "jobserver",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
 
 [[package]]
 name = "cfg-if"
-version = "0.1.10"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "cras-sys"
+name = "chrono"
+version = "0.4.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
+dependencies = [
+ "libc",
+ "num-integer",
+ "num-traits",
+ "serde",
+ "time",
+ "winapi",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa2e27ae6ab525c3d369ded447057bca5438d86dc3a68f6faafb8269ba82ebf3"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_lex 0.2.4",
+ "indexmap",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap"
+version = "4.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d7ae14b20b94cb02149ed21a86c423859cbe18dc7ed69845cace50e52b40a5"
+dependencies = [
+ "bitflags 1.3.2",
+ "clap_derive",
+ "clap_lex 0.3.2",
+ "is-terminal",
+ "once_cell",
+ "strsim",
+ "termcolor",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44bec8e5c9d09e439c4335b1af0abaab56dcf3b94999a936e1bb47b9134288f0"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "350b9cf31731f9957399229e9b2adc51eeabdfbe9d71d9a0552275fd12710d09"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "crash_report"
 version = "0.1.0"
 dependencies = [
- "audio_streams",
- "data_model",
+ "anyhow",
+ "base",
+ "serde",
+ "win_util",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "cros-codecs"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "277a30a0ddadfa014380ee30cc60330d260369855417c492fa94421d7c7e9229"
+dependencies = [
+ "anyhow",
+ "bitreader",
+ "byteorder",
+ "bytes",
+ "crc32fast",
+ "cros-libva",
+ "enumn",
+ "log",
+ "thiserror",
+]
+
+[[package]]
+name = "cros-libva"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc78ee9952d72572d126ef28338857d12c08a013ba39b77fd8e20201837def3e"
+dependencies = [
+ "bitflags 1.3.2",
+ "log",
+ "pkg-config",
+ "thiserror",
 ]
 
 [[package]]
 name = "cros_async"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
+ "anyhow",
+ "async-task",
+ "async-trait",
+ "audio_streams",
  "base",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
  "futures",
+ "futures-executor",
+ "futures-util",
+ "intrusive-collections",
  "io_uring",
  "libc",
+ "once_cell",
  "paste",
  "pin-utils",
- "syscall_defines",
+ "remain",
+ "serde",
+ "serde_keyvalue",
+ "slab",
+ "smallvec",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "cros_fdt"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "cros_tracing"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_tracing_types",
+ "libtest-mimic",
+ "once_cell",
+ "perfetto",
+ "sync",
+]
+
+[[package]]
+name = "cros_tracing_types"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "lazy_static",
+ "sync",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46bd5f3f85273295a9d14aedfb86f6aadbff6d8f5295c4a9edb08e819dcf5695"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset 0.8.0",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51887d4adc7b564537b15adcfb307936f8075dfcd5f00dde9a9f1d29383682bc"
+dependencies = [
+ "cfg-if",
+ "once_cell",
 ]
 
 [[package]]
@@ -136,42 +649,121 @@
 dependencies = [
  "aarch64",
  "acpi_tables",
+ "anti_tamper",
+ "anyhow",
  "arch",
- "assertions",
+ "argh",
+ "argh_helpers",
  "audio_streams",
  "base",
  "bit_field",
+ "broker_ipc",
+ "cfg-if",
+ "crash_report",
+ "cros_async",
+ "cros_tracing",
+ "crosvm_cli",
  "crosvm_plugin",
- "data_model",
+ "ctrlc",
+ "data_model 0.1.0",
  "devices",
  "disk",
+ "document-features",
  "enumn",
- "gpu_buffer",
- "gpu_renderer",
+ "futures",
+ "gdbstub",
+ "gdbstub_arch",
+ "gpu_display",
  "hypervisor",
+ "jail",
  "kernel_cmdline",
  "kernel_loader",
  "kvm",
  "kvm_sys",
  "libc",
  "libcras",
+ "log",
+ "merge",
+ "metrics",
  "minijail",
- "msg_socket",
  "net_util",
+ "once_cell",
  "p9",
  "protobuf",
  "protos",
- "rand_ish",
+ "rand",
  "remain",
  "resources",
+ "riscv64",
+ "rutabaga_gfx",
+ "sandbox",
+ "scudo",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "smallvec",
+ "static_assertions",
+ "swap",
  "sync",
+ "tempfile",
+ "thiserror",
+ "tube_transporter",
  "vhost",
  "vm_control",
  "vm_memory",
+ "win_audio",
+ "win_util",
+ "winapi",
  "x86_64",
 ]
 
 [[package]]
+name = "crosvm-fuzz"
+version = "0.0.1"
+dependencies = [
+ "base",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "devices",
+ "disk",
+ "fuse",
+ "hypervisor",
+ "kernel_loader",
+ "libc",
+ "libfuzzer-sys",
+ "p9",
+ "rand",
+ "rand_core",
+ "tempfile",
+ "usb_util",
+ "vm_memory",
+]
+
+[[package]]
+name = "crosvm_cli"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "crosvm_control"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cbindgen",
+ "cc",
+ "libc",
+ "swap",
+ "tempfile",
+ "vm_control",
+]
+
+[[package]]
 name = "crosvm_plugin"
 version = "0.17.0"
 dependencies = [
@@ -184,11 +776,57 @@
 ]
 
 [[package]]
+name = "ctrlc"
+version = "3.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbcf33c2a618cbe41ee43ae6e9f2e48368cd9f9db2896f10167d8d762679f639"
+dependencies = [
+ "nix",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
 name = "data_model"
 version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c0d4dcbc04881739a8916b96a84154517eb4230e1c889d45bcaefad7e66dcd2"
 dependencies = [
  "assertions",
+]
+
+[[package]]
+name = "data_model"
+version = "0.1.1-alpha.1"
+dependencies = [
+ "cfg-if",
  "libc",
+ "remain",
+ "serde",
+ "static_assertions",
+ "thiserror",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8bcdd56d2e5c4ed26a529c5a9029f5db8290d433497506f958eae3be148eb6"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "derive-into-owned"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "576fce04d31d592013a5887ba8d9c3830adff329e5096d7e1eb5e8e61262ca62"
+dependencies = [
+ "quote 0.3.15",
+ "syn 0.11.11",
 ]
 
 [[package]]
@@ -196,42 +834,78 @@
 version = "0.1.0"
 dependencies = [
  "acpi_tables",
+ "anyhow",
+ "argh",
+ "async-task",
+ "async-trait",
  "audio_streams",
+ "audio_util",
+ "balloon_control",
  "base",
  "bit_field",
- "bitflags",
+ "broker_ipc",
+ "bytes",
+ "cfg-if",
+ "chrono",
+ "crc32fast",
+ "cros-codecs",
  "cros_async",
- "data_model",
+ "cros_tracing",
+ "crosvm_cli",
+ "data_model 0.1.1-alpha.1",
+ "dbus",
  "disk",
+ "downcast-rs",
  "enumn",
- "gpu_buffer",
+ "ffmpeg",
+ "fuse",
+ "futures",
  "gpu_display",
- "gpu_renderer",
  "hypervisor",
  "kvm_sys",
  "libc",
  "libcras",
+ "libtest-mimic",
+ "libvda",
  "linux_input_sys",
+ "memoffset 0.6.5",
+ "metrics",
  "minijail",
- "msg_on_socket_derive",
- "msg_socket",
+ "named-lock",
  "net_sys",
  "net_util",
+ "num-traits",
+ "once_cell",
  "p9",
+ "power_monitor",
+ "protobuf",
  "protos",
- "rand_ish",
+ "rand",
  "remain",
  "resources",
+ "rutabaga_gfx",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "smallvec",
+ "swap",
  "sync",
- "syscall_defines",
- "tempfile 3.0.7",
+ "system_api",
+ "tempfile",
+ "thiserror",
  "tpm2",
+ "tube_transporter",
  "usb_util",
  "vfio_sys",
  "vhost",
  "virtio_sys",
  "vm_control",
  "vm_memory",
+ "vmm_vhost",
+ "win_audio",
+ "win_util",
+ "winapi",
+ "zerocopy",
 ]
 
 [[package]]
@@ -240,30 +914,202 @@
 dependencies = [
  "async-trait",
  "base",
+ "cfg-if",
+ "crc32fast",
  "cros_async",
- "data_model",
+ "data_model 0.1.1-alpha.1",
  "futures",
  "libc",
  "protobuf",
  "protos",
  "remain",
+ "serde",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "uuid",
  "vm_memory",
+ "zerocopy",
 ]
 
 [[package]]
-name = "enumn"
+name = "document-features"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3267e1ade4f1f6ddd35fed44a04b6514e244ffeda90c6a14a9ee30f9c9fd7a1"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
+
+[[package]]
+name = "e2e_tests"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "base",
+ "fixture",
+ "libc",
+ "net_sys",
+ "net_util",
+ "prebuilts",
+ "rand",
+ "tempfile",
+]
+
+[[package]]
+name = "either"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"
+
+[[package]]
+name = "enumn"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052bc8773a98bd051ff37db74a8a25f00e6bfa2cbd03373390c72e9f7afbf344"
+dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b2cf0344971ee6c64c31be0d530793fba457d322dfec2810c453d0ef228f9c3"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "errno"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "euclid"
+version = "0.22.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52c2ef4a78da0ba68fbe1fd920627411096d2ac478f7f4c9f3a54ba6705bade"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "ffmpeg"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "libc",
+ "pkg-config",
+ "thiserror",
+]
+
+[[package]]
+name = "fixture"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "arch",
+ "base",
+ "cfg-if",
+ "crc32fast",
+ "libc",
+ "log",
+ "prebuilts",
+ "rand",
+ "shlex",
+ "tempfile",
+ "url",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fuse"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "bitflags 2.3.2",
+ "cros_tracing",
+ "crossbeam-utils",
+ "data_model 0.1.1-alpha.1",
+ "enumn",
+ "libc",
+ "remain",
+ "thiserror",
+ "zerocopy",
 ]
 
 [[package]]
 name = "futures"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e05b85ec287aac0dc34db7d4a569323df697f9c55b99b15d6b4ef8cde49f613"
+checksum = "f73fe65f54d1e12b726f517d3e2135ca3125a437b6d998caf1962961f7172d9e"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -276,9 +1122,9 @@
 
 [[package]]
 name = "futures-channel"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f366ad74c28cca6ba456d95e6422883cfb4b252a83bed929c83abfdbbf2967d5"
+checksum = "c3083ce4b914124575708913bca19bfe887522d6e2e6d0952943f5eac4a74010"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -286,59 +1132,56 @@
 
 [[package]]
 name = "futures-core"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59f5fff90fd5d971f936ad674802482ba441b6f09ba5e15fd8b39145582ca399"
+checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10d6bb888be1153d3abeb9006b11b02cf5e9b209fda28693c31ae1e4e012e314"
+checksum = "9420b90cfa29e327d0429f19be13e7ddb68fa1cccb09d65e5706b8c7a749b8a6"
 dependencies = [
  "futures-core",
  "futures-task",
  "futures-util",
+ "num_cpus",
 ]
 
 [[package]]
 name = "futures-io"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de27142b013a8e869c14957e6d2edeef89e97c289e69d042ee3a49acd8b51789"
+checksum = "fc4045962a5a5e935ee2fdedaa4e08284547402885ab326734432bed5d12966b"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0b5a30a4328ab5473878237c447333c093297bded83a4983d10f4deea240d39"
+checksum = "33c1e13800337f4d4d7a316bf45a567dbcb6ffe087f16424852d97e97a91f512"
 dependencies = [
- "proc-macro-hack",
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f2032893cb734c7a05d85ce0cc8b8c4075278e93b24b66f9de99d6eb0fa8acc"
+checksum = "21163e139fa306126e6eedaf49ecdb4588f939600f0b1e770f4205ee4b7fa868"
 
 [[package]]
 name = "futures-task"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdb66b5f09e22019b1ab0830f7785bcea8e7a42148683f99214f73f8ec21a626"
-dependencies = [
- "once_cell",
-]
+checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"
 
 [[package]]
 name = "futures-util"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8764574ff08b701a084482c3c7031349104b07ac897393010494beaa18ce32c6"
+checksum = "d8b7abd5d659d9b90c8cba917f6ec750a74e2dc23902ef9cd4cc8c8b22e6036a"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -347,94 +1190,246 @@
  "futures-sink",
  "futures-task",
  "memchr",
- "pin-project",
+ "pin-project-lite",
  "pin-utils",
- "proc-macro-hack",
- "proc-macro-nested",
  "slab",
 ]
 
 [[package]]
-name = "getopts"
-version = "0.2.21"
+name = "gdbstub"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
+checksum = "32c95766e0414f8bfc1d07055574c621b67739466d6ba516c4fef8e99d30d2e6"
 dependencies = [
- "unicode-width",
+ "bitflags 1.3.2",
+ "cfg-if",
+ "log",
+ "managed",
+ "num-traits",
+ "paste",
+]
+
+[[package]]
+name = "gdbstub_arch"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eecb536c55c43593a00dde9074dbbdb0e81ce5f20dbca921400f8779c21dea9c"
+dependencies = [
+ "gdbstub",
+ "num-traits",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.1.14"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7abc8dd8451921606d809ba32e95b6111925cd2906060d2dcc29c070220503eb"
+checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
 ]
 
 [[package]]
-name = "gpu_buffer"
-version = "0.1.0"
-dependencies = [
- "base",
- "data_model",
-]
+name = "glob"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
 
 [[package]]
 name = "gpu_display"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "base",
  "cc",
- "data_model",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "euclid",
  "libc",
  "linux_input_sys",
+ "metrics",
+ "num-traits",
+ "pkg-config",
+ "remain",
+ "serde",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "which",
+ "win_util",
+ "winapi",
+ "zerocopy",
 ]
 
 [[package]]
-name = "gpu_renderer"
-version = "0.1.0"
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
 dependencies = [
- "base",
- "data_model",
  "libc",
- "vm_memory",
 ]
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.15"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3deed196b6e7f9e44a2ae8d94225d80302d81208b1bb673fd21fe634645c85a9"
-dependencies = [
- "libc",
-]
+checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hypervisor"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "base",
  "bit_field",
- "data_model",
+ "bitflags 2.3.2",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
+ "downcast-rs",
  "enumn",
+ "fnv",
+ "gdbstub",
+ "gdbstub_arch",
  "kvm",
  "kvm_sys",
  "libc",
- "msg_socket",
+ "memoffset 0.6.5",
+ "once_cell",
+ "serde",
+ "serde_json",
  "sync",
+ "tempfile",
+ "thiserror",
  "vm_memory",
+ "win_util",
+ "winapi",
+ "windows",
+]
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "intrusive-collections"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe531a7789d7120f3e17d4f3f2cd95f54418ba7354f60b7b622b6644a07888a"
+dependencies = [
+ "memoffset 0.5.6",
+]
+
+[[package]]
+name = "io-lifetimes"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
+dependencies = [
+ "libc",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
 name = "io_uring"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "base",
+ "data_model 0.1.1-alpha.1",
  "libc",
- "syscall_defines",
+ "remain",
+ "sync",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b6b32576413a8e69b90e952e4a026476040d81017b80445deda5f2d3921857"
+dependencies = [
+ "hermit-abi 0.3.1",
+ "io-lifetimes",
+ "rustix",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+
+[[package]]
+name = "jail"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "libc",
+ "minijail",
+ "once_cell",
+ "rayon",
+ "serde",
+ "serde_keyvalue",
+ "static_assertions",
+ "which",
+ "zerocopy",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af25a77299a7f711a01975c35a6a424eb6862092cc2d6c72c4ed6cbc56dfc1fa"
+dependencies = [
+ "libc",
 ]
 
 [[package]]
@@ -442,6 +1437,8 @@
 version = "0.1.0"
 dependencies = [
  "libc",
+ "remain",
+ "thiserror",
 ]
 
 [[package]]
@@ -449,8 +1446,14 @@
 version = "0.1.0"
 dependencies = [
  "base",
+ "data_model 0.1.1-alpha.1",
  "libc",
+ "remain",
+ "resources",
+ "tempfile",
+ "thiserror",
  "vm_memory",
+ "zerocopy",
 ]
 
 [[package]]
@@ -458,10 +1461,9 @@
 version = "0.1.0"
 dependencies = [
  "base",
- "data_model",
+ "data_model 0.1.1-alpha.1",
  "kvm_sys",
  "libc",
- "msg_socket",
  "sync",
  "vm_memory",
 ]
@@ -471,53 +1473,228 @@
 version = "0.1.0"
 dependencies = [
  "base",
+ "data_model 0.1.1-alpha.1",
  "libc",
 ]
 
 [[package]]
-name = "libc"
-version = "0.2.76"
+name = "lazy_static"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "755456fae044e6fa1ebbbd1b3e902ae19e73097ed4ed87bb79934a867c007bc3"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
 
 [[package]]
 name = "libcras"
 version = "0.1.0"
 dependencies = [
  "audio_streams",
- "cras-sys",
- "data_model",
- "libc",
- "sys_util",
+ "serde",
 ]
 
 [[package]]
+name = "libdbus-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c185b5b7ad900923ef3a8ff594083d4d9b5aea80bb4f32b8342363138c0d456b"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae185684fe19814afd066da15a7cc41e126886c21282934225d9fc847582da58"
+dependencies = [
+ "arbitrary",
+ "cc",
+ "once_cell",
+]
+
+[[package]]
+name = "libloading"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "efbc0f03f9a775e9f6aed295c6a1ba2253c5757a9e03d55c6caa46a681abcddd"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "libslirp-sys"
+version = "4.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2772370ce9b7fa05c7eae0bd033005e139a64d52cee498a7905b3eb5d243c5f4"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libtest-mimic"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7b603516767d1ab23d0de09d023e62966c3322f7148297c35cf3d97aa8b37fa"
+dependencies = [
+ "clap 4.1.8",
+ "termcolor",
+ "threadpool",
+]
+
+[[package]]
+name = "libvda"
+version = "0.1.0"
+dependencies = [
+ "enumn",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
+
+[[package]]
 name = "linux_input_sys"
 version = "0.1.0"
 dependencies = [
  "base",
- "data_model",
+ "data_model 0.1.1-alpha.1",
  "libc",
+ "zerocopy",
+]
+
+[[package]]
+name = "litrs"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9275e0933cf8bb20f008924c0cb07a0692fe54d8064996520bf998de9eb79aa"
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg",
+ "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.11"
+version = "0.4.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
-name = "memchr"
-version = "2.3.3"
+name = "managed"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
+checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "merge"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10bbef93abb1da61525bbc45eeaff6473a41907d19f8f9aa5168d214e10693e9"
+dependencies = [
+ "merge_derive",
+ "num-traits",
+]
+
+[[package]]
+name = "merge_derive"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "209d075476da2e63b4b29e72a2ef627b840589588e71400a25e3565c4f849d07"
+dependencies = [
+ "proc-macro-error",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "metrics"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "chrono",
+ "libc",
+ "proto_build_tools",
+ "protobuf",
+ "serde",
+ "serde_json",
+ "sync",
+ "win_util",
+ "winapi",
+ "wmi",
+]
 
 [[package]]
 name = "minijail"
-version = "0.2.1"
+version = "0.2.3"
 dependencies = [
  "libc",
  "minijail-sys",
@@ -525,32 +1702,31 @@
 
 [[package]]
 name = "minijail-sys"
-version = "0.0.11"
+version = "0.0.13"
 dependencies = [
  "libc",
  "pkg-config",
+ "which",
 ]
 
 [[package]]
-name = "msg_on_socket_derive"
-version = "0.1.0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
-name = "msg_socket"
-version = "0.1.0"
+name = "named-lock"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b4a84f3731e71a5792fca72324356bf700c8959d31a2ac34134b25989f254c3"
 dependencies = [
- "base",
- "cros_async",
- "data_model",
- "futures",
  "libc",
- "msg_on_socket_derive",
- "sync",
+ "once_cell",
+ "parking_lot",
+ "thiserror",
+ "widestring 1.0.2",
+ "winapi",
 ]
 
 [[package]]
@@ -558,69 +1734,222 @@
 version = "0.1.0"
 dependencies = [
  "base",
+ "libc",
 ]
 
 [[package]]
 name = "net_util"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "base",
- "data_model",
+ "cfg-if",
+ "cros_async",
  "libc",
+ "libslirp-sys",
+ "metrics",
  "net_sys",
+ "pcap-file",
+ "prebuilts",
+ "remain",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "thiserror",
+ "virtio_sys",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "nix"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+ "static_assertions",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
 ]
 
 [[package]]
 name = "num_cpus"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.1.19",
  "libc",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.4.1"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "260e51e7efe62b592207e9e13a68e43692a7a279171d6ba57abd208bf23645ad"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "openssl"
+version = "0.10.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97ea2d98598bf9ada7ea6ee8a30fb74f9156b63bbe495d64ec2b87c269d2dda3"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "992bac49bdbab4423199c654a5515bd2a6c6a23bf03f2dd3bdb7e5ae6259bc69"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
 
 [[package]]
 name = "p9"
 version = "0.1.0"
 dependencies = [
  "libc",
+ "serde",
  "wire_format_derive",
 ]
 
 [[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1ef8814b5c993410bb3adfad7a5ed269563e4a2f90c41f5d85be7fb47133bf"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-sys 0.42.0",
+]
+
+[[package]]
 name = "paste"
-version = "1.0.0"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ddc8e145de01d9180ac7b78b9676f95a9c2447f6a88b2c2a04702211bc5d71"
+checksum = "0c520e05135d6e763148b6426a837e239041653ba7becd2e538c076c738025fc"
 
 [[package]]
-name = "pin-project"
-version = "0.4.23"
+name = "pcap-file"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca4433fff2ae79342e497d9f8ee990d174071408f28f726d6d83af93e58e48aa"
+checksum = "6ad13fed1a83120159aea81b265074f21d753d157dd16b10cc3790ecba40a341"
 dependencies = [
- "pin-project-internal",
+ "byteorder",
+ "derive-into-owned",
+ "thiserror",
 ]
 
 [[package]]
-name = "pin-project-internal"
-version = "0.4.23"
+name = "peeking_take_while"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c0e815c3ee9a031fdf5af21c10aa17c573c9c6a566328d99e3936c34e36461f"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "perfetto"
+version = "0.1.0"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_tracing_types",
+ "data_model 0.1.1-alpha.1",
+ "once_cell",
+ "openssl",
+ "proto_build_tools",
+ "protobuf",
+ "serde",
+ "sync",
+ "zerocopy",
 ]
 
 [[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
 name = "pin-utils"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -628,81 +1957,126 @@
 
 [[package]]
 name = "pkg-config"
-version = "0.3.18"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
 
 [[package]]
-name = "poll_token_derive"
+name = "power_monitor"
 version = "0.1.0"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "base",
+ "dbus",
+ "proto_build_tools",
+ "protobuf",
+ "remain",
+ "thiserror",
 ]
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.9"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c36fa947111f5c62a733b652544dd0016a43ce89619538a8ef92724a6f501a20"
+checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
 
 [[package]]
-name = "proc-macro-hack"
-version = "0.5.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99c605b9a0adc77b7211c6b1f722dcb613d68d66859a44f3d485a6da332b0598"
+name = "prebuilts"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "named-lock",
+]
 
 [[package]]
-name = "proc-macro-nested"
-version = "0.1.6"
+name = "proc-macro-error"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba180dafb9038b050a4c280019bbedf9f2467b61e5d892dcad585bb57aadc5a"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "version_check",
+]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.19"
+version = "1.0.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f5f085b5d71e2188cb8271e5da0161ad52c3f227a661a3c135fdf28e258b12"
+checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
 dependencies = [
- "unicode-xid",
+ "unicode-ident",
+]
+
+[[package]]
+name = "proto_build_tools"
+version = "0.1.0"
+dependencies = [
+ "protobuf-codegen",
 ]
 
 [[package]]
 name = "protobuf"
-version = "2.17.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb14183cc7f213ee2410067e1ceeadba2a7478a59432ff0747a335202798b1e2"
-
-[[package]]
-name = "protobuf-codegen"
-version = "2.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3360a1e017386e7d9fc65f7425bef9bcf1e62871f8b5a7b0570ef2ff5073f9a0"
+checksum = "b55bad9126f378a853655831eb7363b7b01b81d19f8cb1218861086ca4a1a61e"
 dependencies = [
- "protobuf",
+ "once_cell",
+ "protobuf-support",
+ "thiserror",
 ]
 
 [[package]]
-name = "protoc"
-version = "2.17.0"
+name = "protobuf-codegen"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93daf2f02fa5b0fca2798a24c5a77b6e0d262dc9c386335e04ddbd25ca8237e9"
+checksum = "0dd418ac3c91caa4032d37cb80ff0d44e2ebe637b2fb243b6234bf89cdac4901"
 dependencies = [
+ "anyhow",
+ "once_cell",
+ "protobuf",
+ "protobuf-parse",
+ "regex",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "protobuf-parse"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d39b14605eaa1f6a340aec7f320b34064feb26c93aec35d6a9a2272a8ddfa49"
+dependencies = [
+ "anyhow",
+ "indexmap",
  "log",
+ "protobuf",
+ "protobuf-support",
+ "tempfile",
+ "thiserror",
  "which",
 ]
 
 [[package]]
-name = "protoc-rust"
-version = "2.17.0"
+name = "protobuf-support"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61d4df67d09fc026da7cdf2d039e0340d4a09775f65d4216762886d2f1a1f245"
+checksum = "a5d4d7b8601c814cfb36bcebb79f0e61e45e1e93640cf778837833bbed05c372"
 dependencies = [
- "protobuf",
- "protobuf-codegen",
- "protoc",
- "tempfile 3.1.0",
+ "thiserror",
 ]
 
 [[package]]
@@ -710,47 +2084,41 @@
 version = "0.1.0"
 dependencies = [
  "kvm_sys",
+ "proto_build_tools",
  "protobuf",
- "protoc-rust",
-]
-
-[[package]]
-name = "qcow_utils"
-version = "0.1.0"
-dependencies = [
- "base",
- "disk",
- "getopts",
- "libc",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.7"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
+checksum = "7a6e920b65c65f10b2ae65c831a81a073a89edd28c7cce89475bff467ab4167a"
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "rand"
-version = "0.7.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
- "getrandom",
  "libc",
  "rand_chacha",
  "rand_core",
- "rand_hc",
 ]
 
 [[package]]
 name = "rand_chacha"
-version = "0.2.2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
  "rand_core",
@@ -758,41 +2126,70 @@
 
 [[package]]
 name = "rand_core"
-version = "0.5.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
 dependencies = [
  "getrandom",
 ]
 
 [[package]]
-name = "rand_hc"
-version = "0.2.0"
+name = "rayon"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
 dependencies = [
- "rand_core",
+ "either",
+ "rayon-core",
 ]
 
 [[package]]
-name = "rand_ish"
-version = "0.1.0"
+name = "rayon-core"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
 
 [[package]]
 name = "redox_syscall"
-version = "0.1.57"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
+checksum = "534cfe58d6a18cc17120fbf4635d53d14691c1fe4d951064df9bd326178d7d5a"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
 
 [[package]]
 name = "remain"
-version = "0.2.2"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ba1e78fa68412cb93ef642fd4d20b9a941be49ee9333875ebaf13112673ea7"
+checksum = "5704e2cda92fd54202f05430725317ba0ea7d0c96b246ca0a92e45177127ba3b"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
 ]
 
 [[package]]
@@ -809,87 +2206,386 @@
 version = "0.1.0"
 dependencies = [
  "base",
- "gpu_buffer",
  "libc",
- "msg_socket",
+ "remain",
+ "serde",
+ "thiserror",
 ]
 
 [[package]]
-name = "slab"
-version = "0.4.2"
+name = "riscv64"
+version = "0.1.0"
+dependencies = [
+ "arch",
+ "base",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
+ "devices",
+ "gdbstub",
+ "gdbstub_arch",
+ "hypervisor",
+ "kernel_cmdline",
+ "kvm",
+ "kvm_sys",
+ "libc",
+ "minijail",
+ "rand",
+ "remain",
+ "resources",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "vm_memory",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustix"
+version = "0.36.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
+dependencies = [
+ "bitflags 1.3.2",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "rutabaga_gfx"
+version = "0.1.2"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "libc",
+ "log",
+ "nix",
+ "pkg-config",
+ "remain",
+ "thiserror",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
+
+[[package]]
+name = "sandbox"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "prebuilts",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "scudo"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12bfcb1ca07a487406afea13bdb7a2f3cf88e67b39c20dfd64e1801909b5c688"
+dependencies = [
+ "libc",
+ "scudo-proc-macros",
+ "scudo-sys",
+]
+
+[[package]]
+name = "scudo-proc-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3267c900aee8fbc8451235b70c5e2dae96bb19110eabc325be5d5dfed8e7461"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "scudo-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcdbdfb28236bf083b47d0babb07e486bb003ed85011072b023ea4ed27760ddb"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc855a42c7967b7c369eb5860f7164ef1f6f81c20c7cc1141f2a604e18723b03"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f2122636b9fe3b81f1cb25099fcf2d3f542cdb1d45940d56c713158884a05da"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_keyvalue"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "nom",
+ "num-traits",
+ "remain",
+ "serde",
+ "serde_keyvalue_derive",
+ "thiserror",
+]
+
+[[package]]
+name = "serde_keyvalue_derive"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 2.0.33",
+]
+
+[[package]]
+name = "shlex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+
+[[package]]
+name = "slab"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fd0db749597d91ff862fd1d55ea87f7855a744a8425a64695b6fca237d1dad1"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "swap"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_tracing",
+ "data_model 0.1.1-alpha.1",
+ "jail",
+ "libc",
+ "libtest-mimic",
+ "num_cpus",
+ "once_cell",
+ "remain",
+ "serde",
+ "serde_json",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "userfaultfd",
+ "userfaultfd-sys",
+ "vm_memory",
+]
 
 [[package]]
 name = "syn"
-version = "1.0.39"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d8d6567fe7c7f8835a3a98af4208f3846fba258c1bc3c31d6e506239f11f9"
+checksum = "d3b891b9015c88c576343b9b3e41c2c11a51c219ef067b264bd9c8aa9b441dad"
 dependencies = [
- "proc-macro2",
- "quote",
+ "quote 0.3.15",
+ "synom",
  "unicode-xid",
 ]
 
 [[package]]
-name = "sync"
-version = "0.1.0"
-
-[[package]]
-name = "sys_util"
-version = "0.1.0"
-dependencies = [
- "data_model",
- "libc",
- "poll_token_derive",
- "sync",
- "syscall_defines",
- "tempfile 3.0.7",
-]
-
-[[package]]
-name = "syscall_defines"
-version = "0.1.0"
-
-[[package]]
-name = "tempfile"
-version = "3.0.7"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.1.0"
+name = "syn"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
+checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9caece70c63bfba29ec2fed841a09851b14a235c60010fa4de58089b6c025668"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync"
+version = "0.1.99"
+
+[[package]]
+name = "synom"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a393066ed9010ebaed60b9eafa373d4b1baac186dd7e008555b0f702b51945b6"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "system_api"
+version = "0.1.0"
+dependencies = [
+ "dbus",
+ "protobuf",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
 dependencies = [
  "cfg-if",
+ "fastrand",
  "libc",
- "rand",
  "redox_syscall",
  "remove_dir_all",
  "winapi",
 ]
 
 [[package]]
-name = "thiserror"
-version = "1.0.20"
+name = "termcolor"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfdd070ccd8ccb78f4ad66bf1982dc37f620ef696c6b5028fe2ed83dd3d0d08"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a9cd18aa97d5c45c6603caea1da6628790b37f7a34b6ca89522331c5180fed0"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.20"
+version = "1.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd80fc12f73063ac132ac92aceea36734f04a1d93c1240c6944e23a3b8841793"
+checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "threadpool"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+dependencies = [
+ "num_cpus",
+]
+
+[[package]]
+name = "time"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+
+[[package]]
+name = "toml"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82e1a7758622a465f8cee077614c73484dac5b836c02ff6a40d5d1010324d7"
+dependencies = [
+ "serde",
 ]
 
 [[package]]
@@ -903,21 +2599,61 @@
 name = "tpm2-sys"
 version = "0.1.0"
 dependencies = [
- "num_cpus",
+ "anyhow",
  "pkg-config",
 ]
 
 [[package]]
-name = "unicode-width"
-version = "0.1.8"
+name = "tube_transporter"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model 0.1.1-alpha.1",
+ "rand",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+checksum = "099b7128301d285f79ddd55b9a83d5e6b9e97c92e0ea0daebee7263e932de992"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15c61ba63f9235225a22310255a29b806b907c9b8c964bcbd0a2c70f3f2deea7"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
 
 [[package]]
 name = "unicode-xid"
-version = "0.2.1"
+version = "0.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
+checksum = "8c1f860d7d29cf02cb2f3f359fd35991af3d30bac52c57d265a3c461074cb4dc"
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
 
 [[package]]
 name = "usb_sys"
@@ -930,29 +2666,80 @@
 name = "usb_util"
 version = "0.1.0"
 dependencies = [
- "assertions",
  "base",
- "data_model",
+ "data_model 0.1.1-alpha.1",
  "libc",
  "remain",
+ "static_assertions",
+ "thiserror",
  "usb_sys",
+ "zerocopy",
 ]
 
 [[package]]
+name = "userfaultfd"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2320ae2edd0b11cf05dcd53614e5c72cb9f9ac9aab1b4ff4fe4f1cc4f92e3592"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "nix",
+ "thiserror",
+ "userfaultfd-sys",
+]
+
+[[package]]
+name = "userfaultfd-sys"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2cbcf2717fa856a7226499babbbccb07353ea2fc2b27defd38bd13b1227cc78"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cfg-if",
+]
+
+[[package]]
+name = "uuid"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1674845326ee10d37ca60470760d4288a6f80f304007d92e5c53bab78c9cfd79"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
 name = "vfio_sys"
 version = "0.1.0"
 dependencies = [
  "base",
+ "zerocopy",
 ]
 
 [[package]]
 name = "vhost"
 version = "0.1.0"
 dependencies = [
- "assertions",
  "base",
  "libc",
  "net_util",
+ "remain",
+ "static_assertions",
+ "thiserror",
  "virtio_sys",
  "vm_memory",
 ]
@@ -962,47 +2749,151 @@
 version = "0.1.0"
 dependencies = [
  "base",
+ "data_model 0.1.1-alpha.1",
+ "zerocopy",
 ]
 
 [[package]]
 name = "vm_control"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "balloon_control",
  "base",
- "data_model",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "gdbstub",
+ "gdbstub_arch",
  "hypervisor",
  "libc",
- "msg_socket",
+ "once_cell",
+ "protos",
+ "remain",
  "resources",
+ "rutabaga_gfx",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "swap",
  "sync",
+ "thiserror",
+ "vm_control_product",
  "vm_memory",
+ "winapi",
+]
+
+[[package]]
+name = "vm_control_product"
+version = "0.1.0"
+dependencies = [
+ "serde",
 ]
 
 [[package]]
 name = "vm_memory"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "base",
+ "bitflags 2.3.2",
+ "cfg-if",
  "cros_async",
- "data_model",
+ "data_model 0.1.1-alpha.1",
  "libc",
- "syscall_defines",
+ "remain",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "zerocopy",
+]
+
+[[package]]
+name = "vmm_vhost"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "bitflags 2.3.2",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "enumn",
+ "libc",
+ "remain",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror",
+ "tube_transporter",
+ "zerocopy",
 ]
 
 [[package]]
 name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
+version = "0.10.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "which"
-version = "4.0.2"
+version = "4.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c14ef7e1b8b8ecfc75d5eca37949410046e66f15d185c01d70824f1f8111ef"
+checksum = "5c4fb54e6113b6a8772ee41c3404fb0301ac79604489467e0a9ce1f3e97c24ae"
 dependencies = [
+ "either",
+ "lazy_static",
  "libc",
+]
+
+[[package]]
+name = "widestring"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17882f045410753661207383517a6f62ec3dbeb6a4ed2acce01f0728238d1983"
+
+[[package]]
+name = "widestring"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+
+[[package]]
+name = "win_audio"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "audio_streams",
+ "audio_util",
+ "base",
+ "cros_async",
+ "libc",
+ "metrics",
+ "once_cell",
+ "prebuilts",
+ "sync",
  "thiserror",
+ "win_util",
+ "winapi",
+ "wio",
+]
+
+[[package]]
+name = "win_util"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "enumn",
+ "libc",
+ "once_cell",
+ "serde",
+ "winapi",
+ "windows",
 ]
 
 [[package]]
@@ -1022,18 +2913,174 @@
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
+name = "windows"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1c4bd0a50ac6020f65184721f758dba47bb9fbc2133df715ec74a237b26794a"
+dependencies = [
+ "windows_aarch64_msvc 0.39.0",
+ "windows_i686_gnu 0.39.0",
+ "windows_i686_msvc 0.39.0",
+ "windows_x86_64_gnu 0.39.0",
+ "windows_x86_64_msvc 0.39.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc 0.42.1",
+ "windows_i686_gnu 0.42.1",
+ "windows_i686_msvc 0.42.1",
+ "windows_x86_64_gnu 0.42.1",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc 0.42.1",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc 0.42.1",
+ "windows_i686_gnu 0.42.1",
+ "windows_i686_msvc 0.42.1",
+ "windows_x86_64_gnu 0.42.1",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc 0.42.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7711666096bd4096ffa835238905bb33fb87267910e154b18b44eaabb340f2"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "763fc57100a5f7042e3057e7e8d9bdd7860d330070251a73d003563a3bb49e1b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bc7cbfe58828921e10a9f446fcaaf649204dcfe6c1ddd712c5eebae6bda1106"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6868c165637d653ae1e8dc4d82c25d4f97dd6605eaa8d784b5c6e0ab2a252b65"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4d40883ae9cae962787ca76ba76390ffa29214667a111db9e0a1ad8377e809"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
+
+[[package]]
+name = "wio"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d129932f4644ac2396cb456385cbf9e63b5b30c6e8dc4820bdca4eb082037a5"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
 name = "wire_format_derive"
 version = "0.1.0"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 2.0.33",
+]
+
+[[package]]
+name = "wmi"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "757a458f9bfab0542c11feed99bd492cbe23add50515bd8eecf8c6973673d32d"
+dependencies = [
+ "chrono",
+ "log",
+ "serde",
+ "thiserror",
+ "widestring 0.5.1",
+ "winapi",
 ]
 
 [[package]]
@@ -1041,19 +3088,50 @@
 version = "0.1.0"
 dependencies = [
  "acpi_tables",
+ "anyhow",
  "arch",
- "assertions",
  "base",
- "data_model",
+ "cfg-if",
+ "chrono",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
  "devices",
+ "gdbstub_arch",
  "hypervisor",
+ "jail",
  "kernel_cmdline",
  "kernel_loader",
  "libc",
  "minijail",
+ "once_cell",
+ "rand",
  "remain",
  "resources",
+ "swap",
  "sync",
+ "thiserror",
  "vm_control",
  "vm_memory",
+ "zerocopy",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "332f188cc1bcf1fe1064b8c58d150f497e697f49774aa846f2dc949d9a25f236"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6505e6815af7de1746a08f69c69606bb45695a17149517680f3b2149713b19a3"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
 ]

diff --git a/aarch64-linux-gnu/bin/crosvm b/aarch64-linux-gnu/bin/crosvm
index a5db6d4..82d2901 100755
--- a/aarch64-linux-gnu/bin/crosvm
+++ b/aarch64-linux-gnu/bin/crosvm
Binary files differ

diff --git a/aarch64-linux-gnu/bin/crosvm.debug b/aarch64-linux-gnu/bin/crosvm.debug
new file mode 100755
index 0000000..9dd4039
--- /dev/null
+++ b/aarch64-linux-gnu/bin/crosvm.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libdrm.so b/aarch64-linux-gnu/bin/libdrm.so
new file mode 120000
index 0000000..85b602a
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libdrm.so

@@ -0,0 +1 @@
+libdrm.so.2
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libdrm.so.2 b/aarch64-linux-gnu/bin/libdrm.so.2
deleted file mode 100755
index d6fc7cd..0000000
--- a/aarch64-linux-gnu/bin/libdrm.so.2
+++ /dev/null
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libdrm.so.2 b/aarch64-linux-gnu/bin/libdrm.so.2
new file mode 120000
index 0000000..6df23e6
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libdrm.so.2

@@ -0,0 +1 @@
+libdrm.so.2.4.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libdrm.so.2.4.0 b/aarch64-linux-gnu/bin/libdrm.so.2.4.0
new file mode 100755
index 0000000..a533c06
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libdrm.so.2.4.0
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libdrm.so.2.4.0.debug b/aarch64-linux-gnu/bin/libdrm.so.2.4.0.debug
new file mode 100755
index 0000000..1421ba7
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libdrm.so.2.4.0.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libepoxy.so.0 b/aarch64-linux-gnu/bin/libepoxy.so.0
new file mode 120000
index 0000000..8b15853
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libepoxy.so.0

@@ -0,0 +1 @@
+libepoxy.so.0.0.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libepoxy.so.0.0.0 b/aarch64-linux-gnu/bin/libepoxy.so.0.0.0
new file mode 100755
index 0000000..d4e722c
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libepoxy.so.0.0.0
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libepoxy.so.0 b/aarch64-linux-gnu/bin/libepoxy.so.0.0.0.debug
similarity index 65%
rename from aarch64-linux-gnu/bin/libepoxy.so.0
rename to aarch64-linux-gnu/bin/libepoxy.so.0.0.0.debug
index 88bd3b2..28f64c4 100755
--- a/aarch64-linux-gnu/bin/libepoxy.so.0
+++ b/aarch64-linux-gnu/bin/libepoxy.so.0.0.0.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libffi.so b/aarch64-linux-gnu/bin/libffi.so
new file mode 120000
index 0000000..ad96e9b
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libffi.so

@@ -0,0 +1 @@
+libffi.so.7.1.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libffi.so.7 b/aarch64-linux-gnu/bin/libffi.so.7
new file mode 120000
index 0000000..ad96e9b
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libffi.so.7

@@ -0,0 +1 @@
+libffi.so.7.1.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libffi.so.7.1.0 b/aarch64-linux-gnu/bin/libffi.so.7.1.0
new file mode 100755
index 0000000..2c641f4
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libffi.so.7.1.0
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libffi.so.7.1.0.debug b/aarch64-linux-gnu/bin/libffi.so.7.1.0.debug
new file mode 100755
index 0000000..c4fbc9a
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libffi.so.7.1.0.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libgbm.so b/aarch64-linux-gnu/bin/libgbm.so
index 93a9fe6..4f33bf3 120000
--- a/aarch64-linux-gnu/bin/libgbm.so
+++ b/aarch64-linux-gnu/bin/libgbm.so

@@ -1 +1 @@
-libgbm.so.1
\ No newline at end of file
+libminigbm.so.1.0.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libgbm.so.1 b/aarch64-linux-gnu/bin/libgbm.so.1
deleted file mode 100755
index 1c298a6..0000000
--- a/aarch64-linux-gnu/bin/libgbm.so.1
+++ /dev/null
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libgbm.so.1 b/aarch64-linux-gnu/bin/libgbm.so.1
new file mode 120000
index 0000000..4f33bf3
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libgbm.so.1

@@ -0,0 +1 @@
+libminigbm.so.1.0.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libgfxstream_backend.so b/aarch64-linux-gnu/bin/libgfxstream_backend.so
new file mode 100755
index 0000000..f2cd5ca
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libgfxstream_backend.so
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libgfxstream_backend.so.debug b/aarch64-linux-gnu/bin/libgfxstream_backend.so.debug
new file mode 100755
index 0000000..0544590
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libgfxstream_backend.so.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libminigbm.so.1.0.0 b/aarch64-linux-gnu/bin/libminigbm.so.1.0.0
new file mode 100755
index 0000000..d4a5051
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libminigbm.so.1.0.0
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libminigbm.so.1.0.0.debug b/aarch64-linux-gnu/bin/libminigbm.so.1.0.0.debug
new file mode 100755
index 0000000..680b90b
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libminigbm.so.1.0.0.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libminijail.so b/aarch64-linux-gnu/bin/libminijail.so
index 14ff014..f3b63ef 100755
--- a/aarch64-linux-gnu/bin/libminijail.so
+++ b/aarch64-linux-gnu/bin/libminijail.so
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libminijail.so.debug b/aarch64-linux-gnu/bin/libminijail.so.debug
new file mode 100755
index 0000000..fa23d82
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libminijail.so.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libvirglrenderer.so.0 b/aarch64-linux-gnu/bin/libvirglrenderer.so.0
deleted file mode 100755
index dd6a697..0000000
--- a/aarch64-linux-gnu/bin/libvirglrenderer.so.0
+++ /dev/null
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libvirglrenderer.so.1 b/aarch64-linux-gnu/bin/libvirglrenderer.so.1
deleted file mode 100755
index fe7a9b8..0000000
--- a/aarch64-linux-gnu/bin/libvirglrenderer.so.1
+++ /dev/null
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libvirglrenderer.so.1 b/aarch64-linux-gnu/bin/libvirglrenderer.so.1
new file mode 120000
index 0000000..742de35
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libvirglrenderer.so.1

@@ -0,0 +1 @@
+libvirglrenderer.so.1.7.7
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libvirglrenderer.so.1.7.7 b/aarch64-linux-gnu/bin/libvirglrenderer.so.1.7.7
new file mode 100755
index 0000000..f5c40d1
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libvirglrenderer.so.1.7.7
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libvirglrenderer.so.1.7.7.debug b/aarch64-linux-gnu/bin/libvirglrenderer.so.1.7.7.debug
new file mode 100755
index 0000000..63ae7cb
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libvirglrenderer.so.1.7.7.debug
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libwayland-client.so b/aarch64-linux-gnu/bin/libwayland-client.so
new file mode 120000
index 0000000..f202436
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libwayland-client.so

@@ -0,0 +1 @@
+libwayland-client.so.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libwayland-client.so.0 b/aarch64-linux-gnu/bin/libwayland-client.so.0
new file mode 120000
index 0000000..d31eeb3
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libwayland-client.so.0

@@ -0,0 +1 @@
+libwayland-client.so.0.3.0
\ No newline at end of file

diff --git a/aarch64-linux-gnu/bin/libwayland-client.so.0.3.0 b/aarch64-linux-gnu/bin/libwayland-client.so.0.3.0
new file mode 100755
index 0000000..517e4ca
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libwayland-client.so.0.3.0
Binary files differ

diff --git a/aarch64-linux-gnu/bin/libwayland-client.so.0.3.0.debug b/aarch64-linux-gnu/bin/libwayland-client.so.0.3.0.debug
new file mode 100755
index 0000000..99b6386
--- /dev/null
+++ b/aarch64-linux-gnu/bin/libwayland-client.so.0.3.0.debug
Binary files differ

diff --git a/aarch64-linux-gnu/builder-packages.txt b/aarch64-linux-gnu/builder-packages.txt
index 61ca7f8..d702bd5 100644
--- a/aarch64-linux-gnu/builder-packages.txt
+++ b/aarch64-linux-gnu/builder-packages.txt

@@ -1,128 +1,145 @@
 adduser	3.118
-apt	1.8.2.1
-apt-utils	1.8.2.1
+apt	1.8.2.3
 autoconf	2.69-11
 automake	1:1.16.1-4
-autopoint	0.19.8.1-9
 autotools-dev	20180224.1
-base-files	10.3+deb10u5
+base-files	10.3+deb10u13
 base-passwd	3.5.46
 bash	5.0-4
 binutils	2.31.1-16
 binutils-aarch64-linux-gnu	2.31.1-16
 binutils-common:arm64	2.31.1-16
-bsd-mailx	8.1.2-0.20180807cvs-1
-bsdmainutils	11.1.2+b1
 bsdutils	1:2.33.1-0.1
 build-essential	12.6
-bzip2	1.0.6-9.2~deb10u1
-ca-certificates	20200601~deb10u1
-cmake	3.13.4-1
-cmake-data	3.13.4-1
+bzip2	1.0.6-9.2~deb10u2
+ca-certificates	20200601~deb10u2
 coreutils	8.30-3
 cpp	4:8.3.0-1
 cpp-8	8.3.0-6
-cron	3.0pl1-134+deb10u1
-curl	7.64.0-4+deb10u1
+curl	7.64.0-4+deb10u6
 dash	0.5.10.2-5
-dbus	1.12.20-0+deb10u1
-debconf	1.5.71
-debhelper	12.1.1
-debian-archive-keyring	2019.1
+dblatex	0.3.10-2
+dblatex-doc	0.3.10-2
+dbus	1.12.24-0+deb10u1
+debconf	1.5.71+deb10u1
+debian-archive-keyring	2019.1+deb10u2
 debianutils	4.8.6.1
-dh-autoreconf	19
 dh-python	3.20190308
-dh-strip-nondeterminism	1.1.2-1
-dialog	1.3-20190211-1
 diffutils	1:3.7-3
-dirmngr	2.2.12-1+deb10u1
-dmsetup	2:1.02.155-3
-dns-root-data	2019031302
-dnsmasq	2.80-1
-dnsmasq-base	2.80-1
-dpkg	1.19.7
-dpkg-dev	1.19.7
-dwz	0.12-3
+dirmngr	2.2.12-1+deb10u2
+distro-info-data	0.41+deb10u7
+docbook-xml	4.5-8
+docbook-xsl	1.79.1+dfsg-2
+doxygen	1.8.13-10
+dpkg	1.19.8
+dpkg-dev	1.19.8
 e2fsprogs	1.44.5-1+deb10u3
-equivs	2.2.0
-exim4-base	4.92-8+deb10u4
-exim4-config	4.92-8+deb10u4
-exim4-daemon-light	4.92-8+deb10u4
 fakeroot	1.23-1
 fdisk	2.33.1-0.1
-file	1:5.35-4+deb10u1
+file	1:5.35-4+deb10u2
 findutils	4.6.0+git+20190209-2
+fontconfig	2.13.1-2
+fontconfig-config	2.13.1-2
+fonts-dejavu-core	2.37-1
+fonts-droid-fallback	1:6.0.1r16-1.1
+fonts-gfs-baskerville	1.1-5
+fonts-gfs-porson	1.1-6
+fonts-lato	2.0-2
+fonts-liberation	1:1.07.4-9
+fonts-lmodern	2.004.5-6
+fonts-noto-mono	20181227-1
+fonts-texgyre	20180621-3
 g++	4:8.3.0-1
 g++-8	8.3.0-6
 gcc	4:8.3.0-1
 gcc-8	8.3.0-6
 gcc-8-base:arm64	8.3.0-6
-gettext	0.19.8.1-9
-gettext-base	0.19.8.1-9
+ghostscript	9.27~dfsg-2+deb10u8
 gir1.2-glib-2.0:arm64	1.58.3-2
-git	1:2.20.1-2+deb10u3
-git-man	1:2.20.1-2+deb10u3
-gnupg	2.2.12-1+deb10u1
-gnupg-l10n	2.2.12-1+deb10u1
-gnupg-utils	2.2.12-1+deb10u1
-gpg	2.2.12-1+deb10u1
-gpg-agent	2.2.12-1+deb10u1
-gpg-wks-client	2.2.12-1+deb10u1
-gpg-wks-server	2.2.12-1+deb10u1
-gpgconf	2.2.12-1+deb10u1
-gpgsm	2.2.12-1+deb10u1
-gpgv	2.2.12-1+deb10u1
+git	1:2.20.1-2+deb10u8
+git-man	1:2.20.1-2+deb10u8
+gnupg	2.2.12-1+deb10u2
+gnupg-l10n	2.2.12-1+deb10u2
+gnupg-utils	2.2.12-1+deb10u2
+gpg	2.2.12-1+deb10u2
+gpg-agent	2.2.12-1+deb10u2
+gpg-wks-client	2.2.12-1+deb10u2
+gpg-wks-server	2.2.12-1+deb10u2
+gpgconf	2.2.12-1+deb10u2
+gpgsm	2.2.12-1+deb10u2
+gpgv	2.2.12-1+deb10u2
+graphviz	2.40.1-6+deb10u1
 grep	3.3-1
-groff-base	1.22.4-3
-gzip	1.9-3
+gsfonts	1:8.11+urwcyr1.0.7~pre44-4.4
+gzip	1.9-3+deb10u1
 hostname	3.21
+icu-devtools	63.1-6+deb10u3
 init-system-helpers	1.56+nmu1
-intltool-debian	0.35.0+20060710.5
-iproute2	4.20.0-2
-iptables	1.8.2-4
-krb5-locales	1.17-3
+iso-codes	4.2-1
+javascript-common	11
+krb5-locales	1.17-3+deb10u5
 less	487-0.1+b1
 libacl1:arm64	2.2.53-4
+libalgorithm-c3-perl	0.10-1
 libalgorithm-diff-perl	1.19.03-2
 libalgorithm-diff-xs-perl	0.04-5+b1
 libalgorithm-merge-perl	0.08-3
 libapparmor1:arm64	2.13.2-10
-libapt-inst2.0:arm64	1.8.2.1
-libapt-pkg5.0:arm64	1.8.2.1
-libarchive-cpio-perl	0.10-1
-libarchive-zip-perl	1.64-1
-libarchive13:arm64	3.3.3-4+deb10u1
-libargon2-1:arm64	0~20171227-0.2
+libapt-inst2.0:arm64	1.8.2.3
+libapt-pkg5.0:arm64	1.8.2.3
 libasan5:arm64	8.3.0-6
 libassuan0:arm64	2.5.2-1
-libatm1:arm64	1:2.5.1-2
 libatomic1:arm64	8.3.0-6
 libattr1:arm64	1:2.4.48-4
 libaudit-common	1:2.8.4-3
 libaudit1:arm64	1:2.8.4-3
+libauthen-sasl-perl	2.1600-1
+libavahi-client3:arm64	0.7-4+deb10u3
+libavahi-common-data:arm64	0.7-4+deb10u3
+libavahi-common3:arm64	0.7-4+deb10u3
+libb-hooks-endofscope-perl	0.24-1
+libb-hooks-op-check-perl	0.22-1+b1
 libbinutils:arm64	2.31.1-16
 libblkid1:arm64	2.33.1-0.1
-libbsd0:arm64	0.9.1-2
-libbz2-1.0:arm64	1.0.6-9.2~deb10u1
-libc-bin	2.28-10
-libc-dev-bin	2.28-10
-libc6:arm64	2.28-10
-libc6-dev:arm64	2.28-10
+libbrotli1:arm64	1.0.7-2+deb10u1
+libbsd0:arm64	0.9.1-2+deb10u1
+libbz2-1.0:arm64	1.0.6-9.2~deb10u2
+libc-bin	2.28-10+deb10u2
+libc-dev-bin	2.28-10+deb10u2
+libc6:arm64	2.28-10+deb10u2
+libc6-dev:arm64	2.28-10+deb10u2
+libcairo2:arm64	1.16.0-4+deb10u1
 libcap-dev:arm64	1:2.25-2
 libcap-ng0:arm64	0.7.9-2
 libcap2:arm64	1:2.25-2
-libcap2-bin	1:2.25-2
 libcc1-0:arm64	8.3.0-6
+libcdt5	2.40.1-6+deb10u1
+libcgraph6	2.40.1-6+deb10u1
+libclang1-6.0:arm64	1:6.0.1-10
+libclass-c3-perl	0.34-1
+libclass-c3-xs-perl	0.14-1+b3
+libclass-data-inheritable-perl	0.08-3
+libclass-method-modifiers-perl	2.12-1
+libclass-xsaccessor-perl	1.19-3+b2
 libcom-err2:arm64	1.44.5-1+deb10u3
-libcroco3:arm64	0.6.12-3
-libcryptsetup12:arm64	2:2.1.0-5+deb10u2
-libcurl3-gnutls:arm64	7.64.0-4+deb10u1
-libcurl4:arm64	7.64.0-4+deb10u1
+libcups2:arm64	2.2.10-6+deb10u8
+libcupsfilters1:arm64	1.21.6-5+deb10u1
+libcupsimage2:arm64	2.2.10-6+deb10u8
+libcurl3-gnutls:arm64	7.64.0-4+deb10u6
+libcurl4:arm64	7.64.0-4+deb10u6
+libdata-dump-perl	1.23-1
+libdata-optlist-perl	0.110-1
+libdatrie1:arm64	0.2.12-2
 libdb5.3:arm64	5.3.28+dfsg1-0.5
-libdbus-1-3:arm64	1.12.20-0+deb10u1
+libdbus-1-3:arm64	1.12.24-0+deb10u1
 libdebconfclient0:arm64	0.249
-libdevmapper1.02.1:arm64	2:1.02.155-3
-libdpkg-perl	1.19.7
+libdevel-callchecker-perl	0.008-1
+libdevel-caller-perl	2.06-2+b1
+libdevel-globaldestruction-perl	0.14-1
+libdevel-lexalias-perl	0.05-2+b1
+libdevel-stacktrace-perl	2.0300-1
+libdist-checkconflicts-perl	0.11-1
+libdpkg-perl	1.19.8
 libdrm-amdgpu1:arm64	2.4.97-1
 libdrm-common	2.4.97-1
 libdrm-dev:arm64	2.4.97-1
@@ -132,29 +149,42 @@
 libdrm-radeon1:arm64	2.4.97-1
 libdrm-tegra0:arm64	2.4.97-1
 libdrm2:arm64	2.4.97-1
+libdynaloader-functions-perl	0.003-1
 libedit2:arm64	3.1-20181209-1
 libegl-mesa0:arm64	18.3.6-2+deb10u1
 libegl1:arm64	1.1.0-1
 libegl1-mesa-dev:arm64	18.3.6-2+deb10u1
 libelf1:arm64	0.176-1.1
+libemail-date-format-perl	1.005-1
+libencode-locale-perl	1.05-1
 liberror-perl	0.17027-2
-libestr0:arm64	0.1.10-2.1
-libevent-2.1-6:arm64	2.1.8-stable-4
-libexpat1:arm64	2.2.6-2+deb10u1
-libexpat1-dev:arm64	2.2.6-2+deb10u1
+libeval-closure-perl	0.14-1
+libexception-class-perl	1.44-1
+libexpat1:arm64	2.2.6-2+deb10u6
+libexpat1-dev:arm64	2.2.6-2+deb10u6
 libext2fs2:arm64	1.44.5-1+deb10u3
 libfakeroot:arm64	1.23-1
-libfastjson4:arm64	0.99.8-2
 libfdisk1:arm64	2.33.1-0.1
-libfdt-dev	1.4.7-3
-libfdt1:arm64	1.4.7-3
+libfdt-dev	1.4.7-4
+libfdt1:arm64	1.4.7-4
 libffi6:arm64	3.2.1-9
+libfile-basedir-perl	0.08-1
+libfile-desktopentry-perl	0.22-1
 libfile-fcntllock-perl	0.22-3+b5
-libfile-stripnondeterminism-perl	1.1.2-1
+libfile-homedir-perl	1.004-1
+libfile-listing-perl	6.04-1
+libfile-mimeinfo-perl	0.29-1
+libfile-which-perl	1.23-1
+libfont-afm-perl	1.20-2
+libfontconfig1:arm64	2.13.1-2
+libfontenc1:arm64	1:1.1.3-1+b2
+libfreetype6:arm64	2.9.1-3+deb10u3
+libfribidi0:arm64	1.0.5-3.1+deb10u2
 libgbm1:arm64	18.3.6-2+deb10u1
 libgcc-8-dev:arm64	8.3.0-6
 libgcc1:arm64	1:8.3.0-6
-libgcrypt20:arm64	1.8.4-5
+libgcrypt20:arm64	1.8.4-5+deb10u1
+libgd3:arm64	2.2.5-5.2
 libgdbm-compat4:arm64	1.18.1-4
 libgdbm6:arm64	1.18.1-4
 libgirepository-1.0-1:arm64	1.58.3-2
@@ -165,106 +195,157 @@
 libgles1:arm64	1.1.0-1
 libgles2:arm64	1.1.0-1
 libgles2-mesa-dev:arm64	18.3.6-2+deb10u1
-libglib2.0-0:arm64	2.58.3-2+deb10u2
-libglib2.0-data	2.58.3-2+deb10u2
+libglib2.0-0:arm64	2.58.3-2+deb10u4
+libglib2.0-data	2.58.3-2+deb10u4
 libglvnd-core-dev:arm64	1.1.0-1
 libglvnd-dev:arm64	1.1.0-1
 libglvnd0:arm64	1.1.0-1
 libglx-mesa0:arm64	18.3.6-2+deb10u1
 libglx0:arm64	1.1.0-1
-libgmp10:arm64	2:6.1.2+dfsg-4
-libgnutls-dane0:arm64	3.6.7-4+deb10u5
-libgnutls30:arm64	3.6.7-4+deb10u5
+libgmp10:arm64	2:6.1.2+dfsg-4+deb10u1
+libgnutls30:arm64	3.6.7-4+deb10u10
 libgomp1:arm64	8.3.0-6
 libgpg-error0:arm64	1.35-1
 libgpm2:arm64	1.20.7-5
-libgssapi-krb5-2:arm64	1.17-3
-libhogweed4:arm64	3.4.1-1
-libicu63:arm64	63.1-6+deb10u1
+libgraphite2-3:arm64	1.3.13-7
+libgs9:arm64	9.27~dfsg-2+deb10u8
+libgs9-common	9.27~dfsg-2+deb10u8
+libgssapi-krb5-2:arm64	1.17-3+deb10u5
+libgts-0.7-5:arm64	0.7.6+darcs121130-4
+libgts-bin	0.7.6+darcs121130-4
+libgvc6	2.40.1-6+deb10u1
+libgvpr2	2.40.1-6+deb10u1
+libharfbuzz-icu0:arm64	2.3.1-1
+libharfbuzz0b:arm64	2.3.1-1
+libhogweed4:arm64	3.4.1-1+deb10u1
+libhtml-form-perl	6.03-1
+libhtml-format-perl	2.12-1
+libhtml-parser-perl	3.72-3+b3
+libhtml-tagset-perl	3.20-3
+libhtml-tree-perl	5.07-2
+libhttp-cookies-perl	6.04-1
+libhttp-daemon-perl	6.01-3+deb10u1
+libhttp-date-perl	6.02-1
+libhttp-message-perl	6.18-1
+libhttp-negotiate-perl	6.01-1
+libice6:arm64	2:1.0.9-2
+libicu-dev:arm64	63.1-6+deb10u3
+libicu63:arm64	63.1-6+deb10u3
 libidn11:arm64	1.33-2.2
 libidn2-0:arm64	2.0.5-1+deb10u1
-libip4tc0:arm64	1.8.2-4
-libip6tc0:arm64	1.8.2-4
-libiptc0:arm64	1.8.2-4
+libijs-0.35:arm64	0.35-14
+libio-html-perl	1.001-1
+libio-socket-ssl-perl	2.060-3
+libio-stringy-perl	2.111-3
+libipc-shareable-perl	0.61-2
+libipc-system-simple-perl	1.25-4
 libisl19:arm64	0.20-2
 libitm1:arm64	8.3.0-6
-libjansson4:arm64	2.12-1
-libjson-c3:arm64	0.12.1+ds-2+deb10u1
-libjsoncpp1:arm64	1.7.4-3
-libk5crypto3:arm64	1.17-3
+libjbig0:arm64	2.1-3.1+b2
+libjbig2dec0:arm64	0.16-1+deb10u1
+libjpeg62-turbo:arm64	1:1.5.2-2+deb10u1
+libjs-jquery	3.3.1~dfsg-3+deb10u1
+libk5crypto3:arm64	1.17-3+deb10u5
 libkeyutils1:arm64	1.6-6
-libkmod2:arm64	26-1
-libkrb5-3:arm64	1.17-3
-libkrb5support0:arm64	1.17-3
-libksba8:arm64	1.3.5-2
-libldap-2.4-2:arm64	2.4.47+dfsg-3+deb10u2
-libldap-common	2.4.47+dfsg-3+deb10u2
-libllvm7:arm64	1:7.0.1-8
+libkpathsea6:arm64	2018.20181218.49446-1+deb10u2
+libkrb5-3:arm64	1.17-3+deb10u5
+libkrb5support0:arm64	1.17-3+deb10u5
+libksba8:arm64	1.3.5-2+deb10u2
+liblab-gamut1	2.40.1-6+deb10u1
+liblcms2-2:arm64	2.9-3
+libldap-2.4-2:arm64	2.4.47+dfsg-3+deb10u7
+libldap-common	2.4.47+dfsg-3+deb10u7
+libllvm6.0:arm64	1:6.0.1-10
+libllvm7:arm64	1:7.0.1-8+deb10u2
 liblocale-gettext-perl	1.07-3+b4
-liblockfile-bin	1.14-1.1
-liblockfile1:arm64	1.14-1.1
-liblognorm5:arm64	2.0.5-1
+liblog-dispatch-perl	2.68-1
+liblog-log4perl-perl	1.49-1
 liblsan0:arm64	8.3.0-6
 libltdl-dev:arm64	2.4.6-9
 libltdl7:arm64	2.4.6-9
-liblz4-1:arm64	1.8.3-1
-liblzma5:arm64	5.2.4-1
-libmagic-mgc	1:5.35-4+deb10u1
-libmagic1:arm64	1:5.35-4+deb10u1
+liblwp-mediatypes-perl	6.02-1
+liblwp-protocol-https-perl	6.07-2
+liblz4-1:arm64	1.8.3-1+deb10u1
+liblzma5:arm64	5.2.4-1+deb10u1
+libmagic-mgc	1:5.35-4+deb10u2
+libmagic1:arm64	1:5.35-4+deb10u2
 libmail-sendmail-perl	0.80-1
-libmnl0:arm64	1.0.4-2
+libmailtools-perl	2.18-1
+libmime-charset-perl	1.012.2-1
+libmime-lite-perl	3.030-2
+libmime-types-perl	2.17-1
+libmodule-implementation-perl	0.09-1
+libmodule-runtime-perl	0.016-1
 libmount1:arm64	2.33.1-0.1
 libmpc3:arm64	1.1.0-1
 libmpdec2:arm64	2.4.2-2
 libmpfr6:arm64	4.0.2-1
-libncurses6:arm64	6.1+20181013-2+deb10u2
-libncursesw6:arm64	6.1+20181013-2+deb10u2
-libnetfilter-conntrack3:arm64	1.0.7-1
-libnettle6:arm64	3.4.1-1
-libnfnetlink0:arm64	1.0.1-3+b1
-libnftables0:arm64	0.9.0-2
-libnftnl11:arm64	1.1.2-2
+libmro-compat-perl	0.13-1
+libnamespace-autoclean-perl	0.28-1
+libnamespace-clean-perl	0.27-1
+libncurses6:arm64	6.1+20181013-2+deb10u3
+libncursesw6:arm64	6.1+20181013-2+deb10u3
+libnet-dbus-perl	1.1.0-5+b1
+libnet-http-perl	6.18-1
+libnet-smtp-ssl-perl	1.04-1
+libnet-ssleay-perl	1.85-2+deb10u1
+libnettle6:arm64	3.4.1-1+deb10u1
 libnghttp2-14:arm64	1.36.0-2+deb10u1
 libnpth0:arm64	1.6-1
-libnss-systemd:arm64	241-7~deb10u4
 libopengl0:arm64	1.1.0-1
-libp11-kit0:arm64	0.23.15-2
-libpam-cap:arm64	1:2.25-2
+libopenjp2-7:arm64	2.3.0-2+deb10u2
+libp11-kit0:arm64	0.23.15-2+deb10u1
+libpackage-stash-perl	0.38-1
+libpackage-stash-xs-perl	0.29-1
+libpadwalker-perl	2.3-1+b1
 libpam-modules:arm64	1.3.1-5
 libpam-modules-bin	1.3.1-5
 libpam-runtime	1.3.1-5
-libpam-systemd:arm64	241-7~deb10u4
 libpam0g:arm64	1.3.1-5
+libpango-1.0-0:arm64	1.42.4-8~deb10u1
+libpangocairo-1.0-0:arm64	1.42.4-8~deb10u1
+libpangoft2-1.0-0:arm64	1.42.4-8~deb10u1
+libpaper-utils	1.1.28
+libpaper1:arm64	1.1.28
+libparams-classify-perl	0.015-1+b1
+libparams-util-perl	1.07-3+b4
+libparams-validationcompiler-perl	0.30-1
+libpathplan4	2.40.1-6+deb10u1
 libpciaccess-dev:arm64	0.14-1
 libpciaccess0:arm64	0.14-1
-libpcre2-8-0:arm64	10.32-5
+libpcre2-8-0:arm64	10.32-5+deb10u1
 libpcre3:arm64	2:8.39-12
 libperl5.28:arm64	5.28.1-6+deb10u1
-libpipeline1:arm64	1.5.1-2
-libpopt0:arm64	1.16-12
-libprocps7:arm64	2:3.3.15-2
-libprotobuf-dev:arm64	3.6.1.3-2
-libprotobuf-lite17:arm64	3.6.1.3-2
-libprotobuf17:arm64	3.6.1.3-2
-libprotoc17:arm64	3.6.1.3-2
+libpixman-1-0:arm64	0.36.0-1+deb10u1
+libpng16-16:arm64	1.6.36-6
+libpotrace0:arm64	1.15-1
+libprotobuf-dev:arm64	3.6.1.3-2+deb10u1
+libprotobuf-lite17:arm64	3.6.1.3-2+deb10u1
+libprotobuf17:arm64	3.6.1.3-2+deb10u1
+libprotoc17:arm64	3.6.1.3-2+deb10u1
 libpsl5:arm64	0.20.2-2
+libptexenc1:arm64	2018.20181218.49446-1+deb10u2
 libpthread-stubs0-dev:arm64	0.4-1
 libpython-stdlib:arm64	2.7.16-1
 libpython2-stdlib:arm64	2.7.16-1
-libpython2.7-minimal:arm64	2.7.16-2+deb10u1
-libpython2.7-stdlib:arm64	2.7.16-2+deb10u1
+libpython2.7-minimal:arm64	2.7.16-2+deb10u2
+libpython2.7-stdlib:arm64	2.7.16-2+deb10u2
 libpython3-dev:arm64	3.7.3-1
 libpython3-stdlib:arm64	3.7.3-1
-libpython3.7:arm64	3.7.3-2+deb10u2
-libpython3.7-dev:arm64	3.7.3-2+deb10u2
-libpython3.7-minimal:arm64	3.7.3-2+deb10u2
-libpython3.7-stdlib:arm64	3.7.3-2+deb10u2
+libpython3.7:arm64	3.7.3-2+deb10u5
+libpython3.7-dev:arm64	3.7.3-2+deb10u5
+libpython3.7-minimal:arm64	3.7.3-2+deb10u5
+libpython3.7-stdlib:arm64	3.7.3-2+deb10u5
 libreadline7:arm64	7.0-5
-librhash0:arm64	1.3.8-1
+libreadonly-perl	2.050-1
+libref-util-perl	0.204-1
+libref-util-xs-perl	0.117-1+b1
+librole-tiny-perl	2.000006-1
 librtmp1:arm64	2.4+20151223.gitfa8646d.1-2
-libsasl2-2:arm64	2.1.27+dfsg-1+deb10u1
-libsasl2-modules:arm64	2.1.27+dfsg-1+deb10u1
-libsasl2-modules-db:arm64	2.1.27+dfsg-1+deb10u1
+libruby2.5:arm64	2.5.5-3+deb10u6
+libsasl2-2:arm64	2.1.27+dfsg-1+deb10u2
+libsasl2-modules:arm64	2.1.27+dfsg-1+deb10u2
+libsasl2-modules-db:arm64	2.1.27+dfsg-1+deb10u2
 libseccomp2:arm64	2.3.3-4
 libselinux1:arm64	2.8-1+b1
 libsemanage-common	2.8-2
@@ -273,44 +354,74 @@
 libsensors5:arm64	1:3.5.0-3
 libsepol1:arm64	2.8-1
 libsigsegv2:arm64	2.12-2
+libsm6:arm64	2:1.2.3-1
 libsmartcols1:arm64	2.33.1-0.1
-libsqlite3-0:arm64	3.27.2-3
+libsombok3:arm64	2.4.0-2
+libspecio-perl	0.43-1
+libsqlite3-0:arm64	3.27.2-3+deb10u2
 libss2:arm64	1.44.5-1+deb10u3
-libssh2-1:arm64	1.8.0-2.1
-libssl-dev:arm64	1.1.1d-0+deb10u3
-libssl1.1:arm64	1.1.1d-0+deb10u3
+libssh2-1:arm64	1.8.0-2.1+deb10u1
+libssl-dev:arm64	1.1.1n-0+deb10u6
+libssl1.1:arm64	1.1.1n-0+deb10u6
 libstdc++-8-dev:arm64	8.3.0-6
 libstdc++6:arm64	8.3.0-6
+libsub-exporter-perl	0.987-1
+libsub-exporter-progressive-perl	0.001013-1
+libsub-identify-perl	0.14-1+b1
+libsub-install-perl	0.928-1
+libsub-name-perl	0.21-1+b3
+libsub-quote-perl	2.005001-1
+libsynctex2:arm64	2018.20181218.49446-1+deb10u2
 libsys-hostname-long-perl	1.5-1
-libsystemd0:arm64	241-7~deb10u4
-libtasn1-6:arm64	4.13-3
-libtinfo6:arm64	6.1+20181013-2+deb10u2
+libsystemd0:arm64	241-7~deb10u10
+libtasn1-6:arm64	4.13-3+deb10u1
+libtcl8.6:arm64	8.6.9+dfsg-2
+libteckit0:arm64	2.5.8+ds2-5
+libtexlua52:arm64	2018.20181218.49446-1+deb10u2
+libtexlua53:arm64	2018.20181218.49446-1+deb10u2
+libtext-iconv-perl	1.7-5+b6
+libtext-unidecode-perl	1.30-1
+libthai-data	0.1.28-2
+libthai0:arm64	0.1.28-2
+libtie-ixhash-perl	1.23-2
+libtiff5:arm64	4.1.0+git191117-2~deb10u8
+libtimedate-perl	2.3000-2+deb10u1
+libtinfo6:arm64	6.1+20181013-2+deb10u3
+libtk8.6:arm64	8.6.9-2
 libtool	2.4.6-9
+libtry-tiny-perl	0.30-1
 libtsan0:arm64	8.3.0-6
 libubsan1:arm64	8.3.0-6
-libuchardet0:arm64	0.0.6-3
-libudev1:arm64	241-7~deb10u4
-libunbound8:arm64	1.9.0-2+deb10u2
+libudev1:arm64	241-7~deb10u10
+libunicode-linebreak-perl	0.0.20190101-1
 libunistring2:arm64	0.9.10-1
+liburi-perl	1.76-1
 libusb-1.0-0:arm64	2:1.0.22-2
 libusb-1.0-0-dev:arm64	2:1.0.22-2
 libusb-1.0-doc	2:1.0.22-2
+libutempter0:arm64	1.1.6-3
 libuuid1:arm64	2.33.1-0.1
-libuv1:arm64	1.24.1-1
+libvariable-magic-perl	0.62-1+b1
 libwayland-bin	1.16.0-1
 libwayland-client0:arm64	1.16.0-1
 libwayland-cursor0:arm64	1.16.0-1
 libwayland-dev:arm64	1.16.0-1
 libwayland-egl1:arm64	1.16.0-1
 libwayland-server0:arm64	1.16.0-1
-libwrap0:arm64	7.6.q-28
-libx11-6:arm64	2:1.6.7-1
-libx11-data	2:1.6.7-1
-libx11-dev:arm64	2:1.6.7-1
-libx11-xcb-dev:arm64	2:1.6.7-1
-libx11-xcb1:arm64	2:1.6.7-1
+libwebp6:arm64	0.6.1-2+deb10u2
+libwoff1:arm64	1.0.2-1
+libwww-perl	6.36-2
+libwww-robotrules-perl	6.02-1
+libx11-6:arm64	2:1.6.7-1+deb10u3
+libx11-data	2:1.6.7-1+deb10u3
+libx11-dev:arm64	2:1.6.7-1+deb10u3
+libx11-protocol-perl	0.56-7
+libx11-xcb-dev:arm64	2:1.6.7-1+deb10u3
+libx11-xcb1:arm64	2:1.6.7-1+deb10u3
+libxapian30:arm64	1.4.11-1+deb10u1
 libxau-dev:arm64	1:1.0.8-1+b2
 libxau6:arm64	1:1.0.8-1+b2
+libxaw7:arm64	2:1.0.13-1+b2
 libxcb-dri2-0:arm64	1.13.1-2
 libxcb-dri2-0-dev:arm64	1.13.1-2
 libxcb-dri3-0:arm64	1.13.1-2
@@ -325,35 +436,65 @@
 libxcb-render0-dev:arm64	1.13.1-2
 libxcb-shape0:arm64	1.13.1-2
 libxcb-shape0-dev:arm64	1.13.1-2
+libxcb-shm0:arm64	1.13.1-2
 libxcb-sync-dev:arm64	1.13.1-2
 libxcb-sync1:arm64	1.13.1-2
 libxcb-xfixes0:arm64	1.13.1-2
 libxcb-xfixes0-dev:arm64	1.13.1-2
 libxcb1:arm64	1.13.1-2
 libxcb1-dev:arm64	1.13.1-2
+libxcomposite1:arm64	1:0.4.4-2
+libxcursor1:arm64	1:1.1.15-2
 libxdamage-dev:arm64	1:1.1.4-3+b3
 libxdamage1:arm64	1:1.1.4-3+b3
 libxdmcp-dev:arm64	1:1.1.2-3
 libxdmcp6:arm64	1:1.1.2-3
+libxdot4	2.40.1-6+deb10u1
 libxext-dev:arm64	2:1.3.3-1+b2
 libxext6:arm64	2:1.3.3-1+b2
 libxfixes-dev:arm64	1:5.0.3-1
 libxfixes3:arm64	1:5.0.3-1
-libxml2:arm64	2.9.4+dfsg1-7+b3
+libxft2:arm64	2.3.2-2
+libxi6:arm64	2:1.7.9-1
+libxinerama1:arm64	2:1.1.4-2
+libxml-libxml-perl	2.0134+dfsg-1
+libxml-namespacesupport-perl	1.12-1
+libxml-parser-perl	2.44-4
+libxml-sax-base-perl	1.09-1
+libxml-sax-expat-perl	0.51-1
+libxml-sax-perl	1.00+dfsg-1
+libxml-twig-perl	1:3.50-1.1
+libxml-xpathengine-perl	0.14-1
+libxml2:arm64	2.9.4+dfsg1-7+deb10u6
+libxml2-dev:arm64	2.9.4+dfsg1-7+deb10u6
+libxml2-utils	2.9.4+dfsg1-7+deb10u6
+libxmu6:arm64	2:1.1.2-2+b3
 libxmuu1:arm64	2:1.1.2-2+b3
+libxpm4:arm64	1:3.5.12-1+deb10u1
+libxrandr2:arm64	2:1.5.1-1
+libxrender1:arm64	1:0.9.10-1
 libxshmfence-dev:arm64	1.3-1
 libxshmfence1:arm64	1.3-1
-libxtables12:arm64	1.8.2-4
+libxslt1.1:arm64	1.1.32-2.2~deb10u2
+libxss1:arm64	1:1.2.3-1
+libxt6:arm64	1:1.1.5-1+b3
+libxtst6:arm64	2:1.2.3-1
+libxv1:arm64	2:1.0.11-1
+libxxf86dga1:arm64	2:1.1.4-1+b3
 libxxf86vm-dev:arm64	1:1.1.4-1+b2
 libxxf86vm1:arm64	1:1.1.4-1+b2
-libzstd1:arm64	1.3.8+dfsg-3
-linux-libc-dev:arm64	4.19.132-1
+libxxhash0:arm64	0.6.5-2
+libyaml-0-2:arm64	0.2.1-1
+libyaml-tiny-perl	1.73-1
+libzstd1:arm64	1.3.8+dfsg-3+deb10u2
+libzzip-0-13:arm64	0.13.62-3.2+deb10u1
+linux-libc-dev:arm64	4.19.289-2
+lmodern	2.004.5-6
 login	1:4.5-1.1
-logrotate	3.14.0-4
 lsb-base	10.2019051400
+lsb-release	10.2019051400
 m4	1.4.18-2
 make	4.2.1-1.2
-man-db	2.8.5-2
 manpages	4.16-2
 manpages-dev	4.16-2
 mawk	1.3.3-17+b3
@@ -361,41 +502,38 @@
 mime-support	3.62
 mount	2.33.1-0.1
 nasm	2.14-1
-ncurses-base	6.1+20181013-2+deb10u2
-ncurses-bin	6.1+20181013-2+deb10u2
-ncurses-term	6.1+20181013-2+deb10u2
-net-tools	1.60+git20180626.aebd88e-1
+ncurses-base	6.1+20181013-2+deb10u3
+ncurses-bin	6.1+20181013-2+deb10u3
 netbase	5.6
-nftables	0.9.0-2
 ninja-build	1.8.2-1
-openssh-client	1:7.9p1-10+deb10u2
-openssh-server	1:7.9p1-10+deb10u2
-openssh-sftp-server	1:7.9p1-10+deb10u2
-openssl	1.1.1d-0+deb10u3
+openssh-client	1:7.9p1-10+deb10u3
+openssl	1.1.1n-0+deb10u6
 passwd	1:4.5-1.1
 patch	2.7.6-3+deb10u1
 perl	5.28.1-6+deb10u1
 perl-base	5.28.1-6+deb10u1
 perl-modules-5.28	5.28.1-6+deb10u1
+perl-openssl-defaults:arm64	3
 pinentry-curses	1.1.0-2
 pkg-config	0.29-6
-po-debconf	1.0.21
-procps	2:3.3.15-2
-protobuf-compiler	3.6.1.3-2
-psmisc	23.2-1
-publicsuffix	20190415.1030-1
+poppler-data	0.4.9-2
+preview-latex-style	11.91-2
+protobuf-compiler	3.6.1.3-2+deb10u1
+publicsuffix	20220811.1734-0+deb10u1
 python	2.7.16-1
+python-apt	1.8.4.3
+python-apt-common	1.8.4.3
 python-minimal	2.7.16-1
 python-pip-whl	18.1-5
 python2	2.7.16-1
 python2-minimal	2.7.16-1
-python2.7	2.7.16-2+deb10u1
-python2.7-minimal	2.7.16-2+deb10u1
+python2.7	2.7.16-2+deb10u2
+python2.7-minimal	2.7.16-2+deb10u2
 python3	3.7.3-1
 python3-asn1crypto	0.24.0-1
 python3-cffi-backend	1.12.2-1
 python3-crypto	2.6.1-9+b1
-python3-cryptography	2.6.1-3+deb10u2
+python3-cryptography	2.6.1-3+deb10u4
 python3-dbus	1.2.8-3
 python3-dev	3.7.3-1
 python3-distutils	3.7.3-1
@@ -412,22 +550,58 @@
 python3-six	1.12.0-1
 python3-wheel	0.32.3-2
 python3-xdg	0.25-5
-python3.7	3.7.3-2+deb10u2
-python3.7-dev	3.7.3-2+deb10u2
-python3.7-minimal	3.7.3-2+deb10u2
+python3.7	3.7.3-2+deb10u5
+python3.7-dev	3.7.3-2+deb10u5
+python3.7-minimal	3.7.3-2+deb10u5
+rake	12.3.1-3+deb10u1
 readline-common	7.0-5
-rsyslog	8.1901.0-1
+ruby	1:2.5.1
+ruby-did-you-mean	1.2.1-1
+ruby-minitest	5.11.3-1
+ruby-net-telnet	0.1.1-2
+ruby-power-assert	1.1.1-1
+ruby-test-unit	3.2.8-1
+ruby-xmlrpc	0.3.0-2
+ruby2.5	2.5.5-3+deb10u6
+rubygems-integration	1.11+deb10u1
 sed	4.7-1
 sensible-utils	0.0.12
+sgml-base	1.29
+sgml-data	2.0.11
 shared-mime-info	1.10-1
-sudo	1.8.27-1+deb10u2
-systemd	241-7~deb10u4
-systemd-sysv	241-7~deb10u4
+sudo	1.8.27-1+deb10u5
 sysvinit-utils	2.93-8
+t1utils	1.41-3
 tar	1.30+dfsg-6
-tzdata	2020a-0+deb10u1
+tcl	8.6.9+1
+tcl8.6	8.6.9+dfsg-2
+tex-common	6.11
+tex-gyre	20180621-3
+texinfo	6.5.0.dfsg.1-4+b1
+texlive	2018.20190227-2
+texlive-base	2018.20190227-2
+texlive-bibtex-extra	2018.20190227-2
+texlive-binaries	2018.20181218.49446-1+deb10u2
+texlive-extra-utils	2018.20190227-2
+texlive-fonts-recommended	2018.20190227-2
+texlive-lang-greek	2018.20190227-2
+texlive-latex-base	2018.20190227-2
+texlive-latex-extra	2018.20190227-2
+texlive-latex-recommended	2018.20190227-2
+texlive-pictures	2018.20190227-2
+texlive-plain-generic	2018.20190227-2
+texlive-science	2018.20190227-2
+tipa	2:1.3-20
+tk	8.6.9+1
+tk8.6	8.6.9-2
+tzdata	2021a-0+deb10u11
 ucf	3.0038+nmu1
+unzip	6.0-23+deb10u3
 util-linux	2.33.1-0.1
+wayland-protocols	1.17-1
+x11-common	1:7.7+19
+x11-utils	7.7+4
+x11-xserver-utils	7.7+8
 x11proto-core-dev	2018.4-4
 x11proto-damage-dev	1:2018.4-4
 x11proto-dev	2018.4-4
@@ -435,10 +609,19 @@
 x11proto-xext-dev	2018.4-4
 x11proto-xf86vidmode-dev	2018.4-4
 xauth	1:1.0.10-1
+xbitmaps	1.1.1-2
 xdg-user-dirs	0.17-2
+xdg-utils	1.1.3-1+deb10u1
+xfonts-encodings	1:1.0.4-2
+xfonts-utils	1:7.7+6
+xml-core	0.18+nmu1
+xmlto	0.0.28-2.1
 xorg-sgml-doctools	1:1.11-1
+xsltproc	1.1.32-2.2~deb10u2
+xterm	344-1+deb10u2
 xtrans-dev	1.3.5-1
 xutils-dev	1:7.7+5+b1
-xz-utils	5.2.4-1
-zlib1g:arm64	1:1.2.11.dfsg-1
-zlib1g-dev:arm64	1:1.2.11.dfsg-1
+xz-utils	5.2.4-1+deb10u1
+zip	3.0-11+b1
+zlib1g:arm64	1:1.2.11.dfsg-1+deb10u2
+zlib1g-dev:arm64	1:1.2.11.dfsg-1+deb10u2

diff --git a/aarch64-linux-gnu/cargo_version.txt b/aarch64-linux-gnu/cargo_version.txt
index 08467d7..cba8cdb 100644
--- a/aarch64-linux-gnu/cargo_version.txt
+++ b/aarch64-linux-gnu/cargo_version.txt

@@ -1,4 +1,8 @@
-cargo 1.45.1 (f242df6ed 2020-07-22)
-release: 1.45.1
-commit-hash: f242df6edb897f6f69d393a22bb257f5af0f52d0
-commit-date: 2020-07-22
+cargo 1.68.2 (6feb7c9cf 2023-03-26)
+release: 1.68.2
+commit-hash: 6feb7c9cfc0c5604732dba75e4c3b2dbea38e8d8
+commit-date: 2023-03-26
+host: aarch64-unknown-linux-gnu
+libgit2: 1.5.0 (sys:0.16.0 vendored)
+libcurl: 7.86.0-DEV (sys:0.4.59+curl-7.86.0 vendored ssl:OpenSSL/1.1.1q)
+os: Debian 10 (buster) [64-bit]

diff --git a/aarch64-linux-gnu/etc/seccomp/9p_device.policy b/aarch64-linux-gnu/etc/seccomp/9p_device.policy
new file mode 100644
index 0000000..3f1c8ab
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/9p_device.policy

@@ -0,0 +1,94 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+openat: 1
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+pread64: 1
+pwrite64: 1
+statx: 1
+fstat: 1
+ioctl: arg1 == FIOCLEX
+getdents64: 1
+fdatasync: 1
+fsync: 1
+mkdirat: 1
+renameat: 1
+linkat: 1
+unlinkat: 1
+socket: arg0 == AF_UNIX
+utimensat: 1
+fchmod: 1
+fchmodat: 1
+fchown: 1
+fchownat: 1
+fstatfs: 1
+newfstatat: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/balloon_device.policy b/aarch64-linux-gnu/etc/seccomp/balloon_device.policy
new file mode 100644
index 0000000..389fcd7
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/balloon_device.policy

@@ -0,0 +1,73 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/battery.policy b/aarch64-linux-gnu/etc/seccomp/battery.policy
new file mode 100644
index 0000000..0cbbabf
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/battery.policy

@@ -0,0 +1,75 @@
+# Copyright 2020 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+connect: 1
+geteuid: 1
+getsockname: 1
+prctl: arg0 == PR_SET_NAME
+socket: arg0 == AF_UNIX

diff --git a/aarch64-linux-gnu/etc/seccomp/block_device.policy b/aarch64-linux-gnu/etc/seccomp/block_device.policy
new file mode 100644
index 0000000..590b02f
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/block_device.policy

@@ -0,0 +1,85 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+fallocate: 1
+fdatasync: 1
+fstat: 1
+fsync: 1
+openat: return ENOENT
+newfstatat: 1
+preadv: 1
+pwrite64: 1
+pwritev: 1
+statx: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/coiommu_device.policy b/aarch64-linux-gnu/etc/seccomp/coiommu_device.policy
new file mode 100644
index 0000000..7614835
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/coiommu_device.policy

@@ -0,0 +1,77 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# VFIO_IOMMU_MAP/UNMAP_DMA
+ioctl: arg1 == 0x3B71 || arg1 == 0x3B72
+prctl: arg0 == PR_SET_NAME
+timerfd_create: 1
+timerfd_settime: 1
+timerfd_gettime: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/common_device.policy b/aarch64-linux-gnu/etc/seccomp/common_device.policy
new file mode 100644
index 0000000..de67dc8
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/common_device.policy

@@ -0,0 +1,54 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+clone3: 1
+rseq: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/cras_audio_device.policy b/aarch64-linux-gnu/etc/seccomp/cras_audio_device.policy
new file mode 100644
index 0000000..133aee4
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/cras_audio_device.policy

@@ -0,0 +1,80 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+socketpair: arg0 == AF_UNIX
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/cras_snd_device.policy b/aarch64-linux-gnu/etc/seccomp/cras_snd_device.policy
new file mode 100644
index 0000000..e995fc4
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/cras_snd_device.policy

@@ -0,0 +1,67 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+openat: return ENOENT
+socket: arg0 == AF_UNIX
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+connect: 1
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
+clone3: 1
+rseq: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/fs_device.policy b/aarch64-linux-gnu/etc/seccomp/fs_device.policy
new file mode 100644
index 0000000..5dacd31
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/fs_device.policy

@@ -0,0 +1,121 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+copy_file_range: 1
+fallocate: 1
+fchdir: 1
+fchmod: 1
+fchmodat: 1
+fchown: 1
+fchownat: 1
+fdatasync: 1
+fgetxattr: 1
+getxattr: 1
+fsetxattr: 1
+setxattr: 1
+flistxattr: 1
+listxattr: 1
+fremovexattr: 1
+removexattr: 1
+fsync: 1
+newfstatat: 1
+fstatfs: 1
+getdents64: 1
+getegid: 1
+geteuid: 1
+getrandom: 1
+# Use constants for verity ioctls since minijail doesn't understand them yet.
+# 0x40806685 = FS_IOC_ENABLE_VERITY
+# 0xc0046686 = FS_IOC_MEASURE_VERITY
+ioctl: arg1 == FS_IOC_FSGETXATTR || \
+arg1 == FS_IOC_FSSETXATTR || \
+arg1 == FS_IOC_GETFLAGS || \
+arg1 == FS_IOC_SETFLAGS || \
+arg1 == FS_IOC_GET_ENCRYPTION_POLICY_EX || \
+arg1 == 0x40806685 || \
+arg1 == 0xc0046686
+linkat: 1
+mkdirat: 1
+mknodat: 1
+openat: 1
+preadv: 1
+pwritev: 1
+renameat2: 1
+setresgid: 1
+setresuid: 1
+symlinkat: 1
+umask: 1
+unlinkat: 1
+utimensat: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_SECUREBITS || arg0 == PR_GET_SECUREBITS
+capget: 1
+capset: 1
+unshare: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/gpu_common.policy b/aarch64-linux-gnu/etc/seccomp/gpu_common.policy
new file mode 100644
index 0000000..abe3d3e
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/gpu_common.policy

@@ -0,0 +1,97 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Required for perfetto tracing
+getsockopt: 1
+shutdown: 1
+
+## Rules specific to gpu
+connect: 1
+getrandom: 1
+lseek: 1
+ftruncate: 1
+statx: 1
+fstat: 1
+newfstatat: 1
+getdents64: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
+ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543
+
+# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
+memfd_create: arg1 == 3
+
+## mmap/mprotect differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+openat: 1
+
+## Rules specific to pvr
+geteuid: 1
+getuid: 1
+fcntl: 1
+tgkill: 1
+
+# Rules specific to Mesa.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Vulkan loader / layers
+faccessat: 1
+faccessat2: 1
+getgid: 1
+getegid: 1
+clone3: 1
+rseq: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/gpu_device.policy b/aarch64-linux-gnu/etc/seccomp/gpu_device.policy
new file mode 100644
index 0000000..fdfa4fd
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/gpu_device.policy

@@ -0,0 +1,116 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Required for perfetto tracing
+getsockopt: 1
+shutdown: 1
+
+## Rules specific to gpu
+connect: 1
+getrandom: 1
+lseek: 1
+ftruncate: 1
+statx: 1
+fstat: 1
+newfstatat: 1
+getdents64: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
+# (from vmm-swap below) 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# (from wl_device) arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC || arg1 == SYNC_IOC_FILE_INFO || arg1 & DRM_IOCTL_BASE
+ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543 || arg1 == 0xc018aa3f || arg1 == 0xaa00 || arg1 == 0x5421 || arg1 == 0x40086200 || arg1 == 0xc0383e04 || arg1 & 0x6400
+
+# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL
+memfd_create: arg1 == 3 || arg1 == 11
+
+## mmap/mprotect differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+openat: 1
+
+## Rules specific to pvr
+geteuid: 1
+getuid: 1
+fcntl: 1
+tgkill: 1
+
+# Rules specific to Mesa.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Mesa's u_trace thread
+setpriority: 1
+
+# Rules for Vulkan loader / layers
+faccessat: 1
+faccessat2: 1
+getgid: 1
+getegid: 1
+
+## Rules for vmm-swap
+userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+socket: arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC && arg2 == 0
+clone: arg0 & CLONE_THREAD

diff --git a/aarch64-linux-gnu/etc/seccomp/gpu_render_server.policy b/aarch64-linux-gnu/etc/seccomp/gpu_render_server.policy
new file mode 100644
index 0000000..5158712
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/gpu_render_server.policy

@@ -0,0 +1,126 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Required for perfetto tracing
+getsockopt: 1
+shutdown: 1
+
+## Rules specific to gpu
+connect: 1
+getrandom: 1
+lseek: 1
+ftruncate: 1
+statx: 1
+fstat: 1
+newfstatat: 1
+getdents64: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
+# (from vmm-swap below) 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# (from wl_device) arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC || arg1 == SYNC_IOC_FILE_INFO || arg1 & DRM_IOCTL_BASE
+ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543 || arg1 == 0xc018aa3f || arg1 == 0xaa00 || arg1 == 0x5421 || arg1 == 0x40086200 || arg1 == 0xc0383e04 || arg1 & 0x6400
+
+# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL
+memfd_create: arg1 == 3 || arg1 == 11
+
+## mmap/mprotect differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+openat: 1
+
+## Rules specific to pvr
+geteuid: 1
+getuid: 1
+fcntl: 1
+tgkill: 1
+
+# Rules specific to Mesa.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Mesa's u_trace thread
+setpriority: 1
+
+# Rules for Vulkan loader / layers
+faccessat: 1
+faccessat2: 1
+getgid: 1
+getegid: 1
+
+## Rules for vmm-swap
+userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# allow fork() and waitid()
+clone: 1
+waitid: 1
+
+# allow SOCK_STREAM and SOCK_DGRAM (syslog)
+socket: arg0 == AF_UNIX && arg2 == 0
+
+# allow socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC)
+socketpair: arg0 == AF_UNIX && arg1 == SOCK_SEQPACKET|SOCK_CLOEXEC && arg2 == 0
+
+# allow signalfd()
+signalfd4: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/input_device.policy b/aarch64-linux-gnu/etc/seccomp/input_device.policy
new file mode 100644
index 0000000..cc0f81d
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/input_device.policy

@@ -0,0 +1,75 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+ioctl: 1
+getsockname: 1
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/net_device.policy b/aarch64-linux-gnu/etc/seccomp/net_device.policy
new file mode 100644
index 0000000..b04f891
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/net_device.policy

@@ -0,0 +1,79 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# TUNSETOFFLOAD
+ioctl: arg1 == 0x400454d0
+openat: return ENOENT
+
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/null_audio_device.policy b/aarch64-linux-gnu/etc/seccomp/null_audio_device.policy
new file mode 100644
index 0000000..5f4c949
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/null_audio_device.policy

@@ -0,0 +1,75 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+prlimit64: 1
+setrlimit: 1
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/pmem_device.policy b/aarch64-linux-gnu/etc/seccomp/pmem_device.policy
new file mode 100644
index 0000000..c443d13
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/pmem_device.policy

@@ -0,0 +1,75 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+fdatasync: 1
+fsync: 1
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/rng_device.policy b/aarch64-linux-gnu/etc/seccomp/rng_device.policy
new file mode 100644
index 0000000..ed79f0c
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/rng_device.policy

@@ -0,0 +1,74 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+getrandom: 1
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/serial.policy b/aarch64-linux-gnu/etc/seccomp/serial.policy
new file mode 100644
index 0000000..00540d6
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/serial.policy

@@ -0,0 +1,13 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Syscalls specific to the serial device. This policy file is not meant to be used directly, but
+# rather to be included from another one.
+
+connect: 1
+bind: 1
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME
+clone3: 1
+rseq: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/serial_device.policy b/aarch64-linux-gnu/etc/seccomp/serial_device.policy
new file mode 100644
index 0000000..c3a2af0
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/serial_device.policy

@@ -0,0 +1,83 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a serial device used as a regular, in-VMM virtio device.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Syscalls specific to the serial device. This policy file is not meant to be used directly, but
+# rather to be included from another one.
+
+connect: 1
+bind: 1
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/snd_cras_device.policy b/aarch64-linux-gnu/etc/seccomp/snd_cras_device.policy
new file mode 100644
index 0000000..feaad9d
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/snd_cras_device.policy

@@ -0,0 +1,82 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+openat: return ENOENT
+socket: arg0 == AF_UNIX
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+connect: 1
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/snd_null_device.policy b/aarch64-linux-gnu/etc/seccomp/snd_null_device.policy
new file mode 100644
index 0000000..e6e4e90
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/snd_null_device.policy

@@ -0,0 +1,82 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+openat: return ENOENT
+socket: arg0 == AF_UNIX
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+connect: 1
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/swap_monitor.policy b/aarch64-linux-gnu/etc/seccomp/swap_monitor.policy
new file mode 100644
index 0000000..08918c4
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/swap_monitor.policy

@@ -0,0 +1,62 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+chdir: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+fallocate: 1
+fchdir: 1
+fcntl: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getdents64: 1
+getpid: 1
+gettid: 1
+# 0xc020aa00 = UFFDIO_REGISTER, 0x8010aa01 == UFFDIO_UNREGISTER, 0x8010aa02 == UFFDIO_WAKE, 0xc028aa03 == UFFDIO_COPY, 0xc020aa04 == UFFDIO_ZEROPAGE
+ioctl: arg1 == 0xc020aa00 || arg1 == 0x8010aa01 || arg1 == 0x8010aa02 || arg1 == 0xc028aa03 || arg1 == 0xc020aa04
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_WILLNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_MERGEABLE || arg2 == MADV_REMOVE
+memfd_create: 1
+mlock2: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+munlock: 1
+munmap: 1
+newfstatat: 1
+openat: return ENOENT
+pipe2: 1
+ppoll: 1
+prctl: arg0 == PR_SET_NAME
+pwrite64: 1
+read: 1
+readlinkat: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sendmsg: 1
+set_robust_list: 1
+sigaltstack: 1
+socket: 1
+statx: 1
+timerfd_create: 1
+timerfd_settime: 1
+timerfd_gettime: 1
+tgkill: arg2 == SIGABRT
+write: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/tpm_device.policy b/aarch64-linux-gnu/etc/seccomp/tpm_device.policy
new file mode 100644
index 0000000..1b1f67b
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/tpm_device.policy

@@ -0,0 +1,82 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+chdir: 1
+fstat: 1
+fsync: 1
+getrandom: 1
+getuid: 1
+mkdirat: 1
+newfstatat: 1
+openat: 1
+prctl: arg0 == PR_SET_NAME
+socket: return EACCES
+statx: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/vhost_net_device.policy b/aarch64-linux-gnu/etc/seccomp/vhost_net_device.policy
new file mode 100644
index 0000000..6199c8c
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/vhost_net_device.policy

@@ -0,0 +1,91 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Whitelist vhost_net ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+# arg1 == VHOST_NET_SET_BACKEND
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22 || arg1 == 0x4008af30
+openat: return ENOENT
+
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/vhost_scmi_device.policy b/aarch64-linux-gnu/etc/seccomp/vhost_scmi_device.policy
new file mode 100644
index 0000000..2c00571
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/vhost_scmi_device.policy

@@ -0,0 +1,89 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Allow vhost_scmi ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/vhost_vsock_device.policy b/aarch64-linux-gnu/etc/seccomp/vhost_vsock_device.policy
new file mode 100644
index 0000000..28dae1c
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/vhost_vsock_device.policy

@@ -0,0 +1,92 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Whitelist vhost_vsock ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+# arg1 == VHOST_VSOCK_SET_GUEST_CID ||
+# arg1 == VHOST_VSOCK_SET_RUNNING
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22 || arg1 == 0x4008af60 || arg1 == 0x4004af61
+openat: return ENOENT
+
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/etc/seccomp/video_device.policy b/aarch64-linux-gnu/etc/seccomp/video_device.policy
new file mode 100644
index 0000000..7b7dab0
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/video_device.policy

@@ -0,0 +1,88 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+connect: 1
+newfstatat: 1
+faccessat: 1
+getegid: 1
+geteuid: 1
+getgid: 1
+getrandom: 1
+getsockname: 1
+getuid: 1
+# ioctl: arg1 == DRM_IOCTL_*
+ioctl: arg1 & 0x6400
+openat: 1
+setpriority: 1
+socket: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+# for libmojo used by libvda
+process_vm_readv: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/vios_audio_device.policy b/aarch64-linux-gnu/etc/seccomp/vios_audio_device.policy
new file mode 100644
index 0000000..2d13c80
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/vios_audio_device.policy

@@ -0,0 +1,77 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+openat: return ENOENT
+prlimit64: 1
+sched_setscheduler: 1
+setrlimit: 1
+prctl: arg0 == PR_SET_NAME
+statx: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/wl_device.policy b/aarch64-linux-gnu/etc/seccomp/wl_device.policy
new file mode 100644
index 0000000..d053689
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/wl_device.policy

@@ -0,0 +1,119 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Required for perfetto tracing
+getsockopt: 1
+shutdown: 1
+
+## Rules specific to gpu
+connect: 1
+getrandom: 1
+lseek: 1
+ftruncate: 1
+statx: 1
+fstat: 1
+newfstatat: 1
+getdents64: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
+# (from vmm-swap below) 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# (from wl_device) arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC || arg1 == SYNC_IOC_FILE_INFO || arg1 & DRM_IOCTL_BASE
+ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543 || arg1 == 0xc018aa3f || arg1 == 0xaa00 || arg1 == 0x5421 || arg1 == 0x40086200 || arg1 == 0xc0383e04 || arg1 & 0x6400
+
+# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL
+memfd_create: arg1 == 3 || arg1 == 11
+
+## mmap/mprotect differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+openat: 1
+
+## Rules specific to pvr
+geteuid: 1
+getuid: 1
+fcntl: 1
+tgkill: 1
+
+# Rules specific to Mesa.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Mesa's u_trace thread
+setpriority: 1
+
+# Rules for Vulkan loader / layers
+faccessat: 1
+faccessat2: 1
+getgid: 1
+getegid: 1
+
+## Rules for vmm-swap
+userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+clone: arg0 & CLONE_THREAD
+# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
+socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
+# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC || arg1 == SYNC_IOC_FILE_INFO || arg1 & DRM_IOCTL_BASE
+# ioctl: arg1 == 0x5421 || arg1 == 0x40086200 || arg1 == 0xc0383e04 || arg1 & 0x6400

diff --git a/aarch64-linux-gnu/etc/seccomp/xhci.policy b/aarch64-linux-gnu/etc/seccomp/xhci.policy
new file mode 100644
index 0000000..6f7e5b4
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/xhci.policy

@@ -0,0 +1,78 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getpid: 1
+gettimeofday: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+pipe2: 1
+ppoll: 1
+prctl: arg0 == PR_SET_NAME
+read: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+
+statx: 1
+readlinkat: 1
+getdents64: 1
+name_to_handle_at: 1
+faccessat: 1
+gettid: 1
+clock_gettime: 1
+timerfd_create: 1
+getsockname: 1
+openat: 1
+setsockopt: 1
+bind: 1
+fcntl: 1
+socket: arg0 == AF_NETLINK
+uname: 1
+# The following ioctls are:
+# 0x4004550d == USBDEVFS_REAPURBNDELAY32
+# 0x550b == USBDEVFS_DISCARDURB
+# 0x8004550f == USBDEVFS_CLAIMINTERFACE
+# 0x80045510 == USBDEVFS_RELEASEINTERFACE
+# 0x8004551a == USBDEVFS_GET_CAPABILITIES
+# 0x802c550a == USBDEVFS_SUBMITURB
+# 0xc0105500 == USBDEVFS_CONTROL
+# 0x5514 == USBDEVFS_RESET
+# 0x80045505 == USBDEVFS_SETCONFIGURATION
+# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
+# 0x40085511 == USBDEVFS_CONNECTINFO
+# 0x80185520 == USBDEVFS_CONNINFO_EX
+ioctl: arg1 == 0xc0105500 || arg1 == 0x802c550a || arg1 == 0x8004551a || arg1 == 0x4004550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520
+fstat: 1
+getrandom: 1
+lseek: 1
+clone3: 1
+rseq: 1

diff --git a/aarch64-linux-gnu/etc/seccomp/xhci_device.policy b/aarch64-linux-gnu/etc/seccomp/xhci_device.policy
new file mode 100644
index 0000000..7d67e2b
--- /dev/null
+++ b/aarch64-linux-gnu/etc/seccomp/xhci_device.policy

@@ -0,0 +1,105 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+statx: 1
+getdents64: 1
+name_to_handle_at: 1
+faccessat: 1
+faccessat2: 1
+newfstatat: 1
+timerfd_create: 1
+getsockname: 1
+openat: 1
+setsockopt: 1
+bind: 1
+socket: arg0 == AF_NETLINK
+# The following ioctls are:
+# 0x4008550d == USBDEVFS_REAPURBNDELAY
+# 0x550b == USBDEVFS_DISCARDURB
+# 0x8004550f == USBDEVFS_CLAIMINTERFACE
+# 0x80045510 == USBDEVFS_RELEASEINTERFACE
+# 0x80045515 == USBDEVFS_CLEAR_HALT
+# 0x8004551a == USBDEVFS_GET_CAPABILITIES
+# 0x8038550a == USBDEVFS_SUBMITURB
+# 0xc0185500 == USBDEVFS_CONTROL
+# 0x5514 == USBDEVFS_RESET
+# 0x80045505 == USBDEVFS_SETCONFIGURATION
+# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
+# 0x40085511 == USBDEVFS_CONNECTINFO
+# 0x80185520 == USBDEVFS_CONNINFO_EX
+# 0x551f == USBDEVFS_GET_SPEED
+# 0x8008551c == USBDEVFS_ALLOC_STREAMS
+# 0x8008551d == USBDEVFS_FREE_STREAMS
+# 0x80085504 == USBDEVFS_SETINTERFACE
+ioctl: arg1 == 0xc0185500 || arg1 == 0x8038550a || arg1 == 0x8004551a || arg1 == 0x4008550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520 || arg1 == 0x551f || arg1 == 0x8008551c || arg1 == 0x8008551d || arg1 == 0x80085504
+fstat: 1
+getrandom: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/aarch64-linux-gnu/rustup_show.txt b/aarch64-linux-gnu/rustup_show.txt
index 509de09..b08a93d 100644
--- a/aarch64-linux-gnu/rustup_show.txt
+++ b/aarch64-linux-gnu/rustup_show.txt

@@ -1,4 +1,15 @@
 Default host: aarch64-unknown-linux-gnu
+rustup home:  /home/natsu/.rustup
 
-stable-aarch64-unknown-linux-gnu (overridden by '/source/platform/crosvm/rust-toolchain')
-rustc 1.45.2 (d3fb005a3 2020-07-31)
+installed toolchains
+--------------------
+
+1.65.0-aarch64-unknown-linux-gnu (default)
+1.68.2-aarch64-unknown-linux-gnu
+
+active toolchain
+----------------
+
+1.68.2-aarch64-unknown-linux-gnu (overridden by '/source/platform/crosvm/rust-toolchain')
+rustc 1.68.2 (9eb3afe9e 2023-03-27)
+

diff --git a/check_links.sh b/check_links.sh
deleted file mode 100755
index cfcb797..0000000
--- a/check_links.sh
+++ /dev/null

@@ -1,28 +0,0 @@
-#!/bin/bash
-
-# Checks that, when we define a local library, we use it everywhere
-
-pushd "$(dirname "$0")" >/dev/null 2>&1
-base="$(pwd)"
-popd >/dev/null 2>&1
-
-local_libraries=( \
-  $(find "${base}"/x86_64-linux-gnu/bin \
-         "${base}"/aarch64-linux-gnu/bin \
-         -type f -print)
-)
-
-exit_code=0
-
-for check_links_for in "${local_libraries[@]}"; do
-  library_stub="$(basename "${check_links_for}")"
-  library_stub="${library_stub/.*/}"
-  for library_to_check in "${local_libraries[@]}"; do
-    bad_links="$(ldd "${library_to_check}" | grep "${library_stub}" | grep -v "${base}" )"
-    if [[ -n "${bad_links}" ]]; then
-      echo ${library_to_check} has bad link to ${library_stub}: ${bad_links}
-      exit_code=2
-    fi
-  done
-done
-exit ${exit_code}

diff --git a/gen_android_bp.sh b/gen_android_bp.sh
index f85936a..3590a2b 100755
--- a/gen_android_bp.sh
+++ b/gen_android_bp.sh

@@ -31,6 +31,9 @@
 }
 
 my_name=`basename $0`
+seccomp_archs=("x86_64" "aarch64")
+# under get_arch_dir() in cuttlefish_vmm, where is seccomp?
+subdir="etc/seccomp"
 
 # define arch dir pattern: e.g. ${ARCH}-linux-gnu
 function get_arch_dir() {
@@ -46,6 +49,20 @@
   echo "${blueprint_dir}/Android.bp"
 }
 
+# utility function to enumerate policy files
+#
+# 1: seccomp dir to scan
+function scan_policy_name() {
+  local seccomp_dir=$1
+  (
+    # pushd but no output to stdout/stderr
+    # the output is taken and used by the caller
+    pushd $seccomp_dir > /dev/null 2>&1
+    ls -1
+    popd > /dev/null 2>&1
+  )
+}
+
 # starting from old Android.bp
 function gen_license() {
   local year=${1:-"2019"}
@@ -93,7 +110,7 @@
     # a long opt like --srcs="some" is actually:
     # - + - + "srcs=some"
     # that's a short option '-' just like h, and
-    # the OPTARGS of the option '-' is srcs=some 
+    # the OPTARGS of the option '-' is srcs=some
     if [[ "$op" != "-" ]]; then
       >&2 echo "gen_module does take long options with = only"
       exit 8
@@ -113,22 +130,34 @@
   echo "}"
 }
 
+function gen_android_bp4seccomp() {
+  local arch="$1"
+  local arch_dir="$(get_arch_dir ${arch})"
+  local seccomp_dir="${arch_dir}/${subdir}"
+  local where_in_etc_on_user_machine="cuttlefish/${arch_dir}/seccomp"
+  gen_license 2019
+  for i in $(scan_policy_name $seccomp_dir); do
+    # first two are: e.g. prebuilt_usr_share_host and whitespace for intentation
+    local base_name="$(basename $i)"
+    gen_module "prebuilt_usr_share_host" '  ' \
+      --name="\"${base_name}_at_${arch}\"" \
+      --src="\"${subdir}/${base_name}\"" \
+      --filename="\"${base_name}\"" \
+      --sub_dir="\"${where_in_etc_on_user_machine}\""
+  done
+}
+
 function gen_main_android_bp() {
   gen_license 2019
 
-  gen_module "cc_prebuilt_binary" '  ' \
-    --name="\"common_crosvm\"" \
-    --stem="\"crosvm"\" \
-    --srcs="[\"scripts/crosvm\"]" \
-    --defaults="[\"cuttlefish_host_only\"]"
-
   cat <<EOF
-// NOTE: Using cc_prebuilt_binary because cc_prebuilt_library can't handle stem on pie
+// NOTE: Using cc_prebuilt_binary because cc_prebuilt_library will add
+//       unwanted .so file extensions when installing shared libraries
 
 EOF
 
-for i in */bin/*; do
-  if [[ ! -L "$i" ]]; then
+for arch_dir in $(get_arch_dir aarch64) $(get_arch_dir x86_64); do
+  for i in $(echo $arch_dir/bin/{crosvm,lib{minijail.so,gfxstream_backend.so,*.so{.0,.1,.2,.7}}} | xargs -n1 | sort); do
     name="${i//\//_}"
     name="${name//-/_}"
     name="${name/_bin_/_}"
@@ -140,15 +169,21 @@
     fi
 
     gen_module "cc_prebuilt_binary" '  ' \
-    --name="\"${name}\"" \
-    --srcs="[\"$i\"]" \
-    --stem="\"$stem"\" \
-    --relative_install_path="\"${path}\"" \
-    --defaults="[\"cuttlefish_host_only\"]"
-  fi
+      --name="\"${name}\"" \
+      --srcs="[\"$i\"]" \
+      --stem="\"$stem"\" \
+      --relative_install_path="\"${path}\"" \
+      --defaults="[\"cuttlefish_host\"]" \
+      --check_elf_files="false"
+  done
 done
 }
 
 # main
 check_location
 gen_main_android_bp > $(get_output_file ${DIR})
+for arch in ${seccomp_archs[@]}; do
+  arch_dir=$(get_arch_dir ${arch})
+  outfile="$(get_output_file ${arch_dir})"
+  gen_android_bp4seccomp $arch > $outfile
+done

diff --git a/generate-gfxstream-manifest.sh b/generate-gfxstream-manifest.sh
deleted file mode 100755
index 835f4a9..0000000
--- a/generate-gfxstream-manifest.sh
+++ /dev/null

@@ -1,31 +0,0 @@
-#!/bin/bash
-# Copyright 2020 - The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the',  help='License');
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an',  help='AS IS' BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Modifies an input manifest.xml to point to a particular Android build
-# id of gfxstream
-
-set -e
-
-BUILD_ID=$1
-INPUT_MANIFEST=$2
-
-/google/data/ro/projects/android/fetch_artifact \
-    --bid ${BUILD_ID} \
-    --target gfxstream_sdk_tools_linux "manifest_${BUILD_ID}.xml"
-
-# Check the output and use it to replace the INPUT_MANIFEST
-./update-manifest-gfxstream.py \
-    manifest_${BUILD_ID}.xml \
-    ${INPUT_MANIFEST}

diff --git a/manifest.xml b/manifest.xml
index 6b865db..953213a 100644
--- a/manifest.xml
+++ b/manifest.xml

@@ -1,49 +1,24 @@
 <?xml version='1.0' encoding='utf-8'?>
 <manifest>
   <remote fetch=".." name="aosp" review="https://android-review.googlesource.com/"/>
-  <default remote="aosp" revision="master" sync-j="4"/>
+  <default remote="aosp" revision="main" sync-j="4"/>
   <manifest-server url="http://android-smartsync.corp.google.com/android.googlesource.com/manifestserver"/>
-  <project groups="crosvm" name="platform/external/adhd" path="platform/adhd" revision="64dd57d5e94e3d12043438436ca39d42550cab25"/>
-  <project groups="crosvm" name="platform/external/crosvm" path="platform/crosvm" revision="153efcdb527b9c7b88bce82e448ac1a506b7b9c8"/>
-  <project groups="crosvm" name="platform/external/libdrm" path="external/libdrm" revision="0fc19b7021453b02110a6327ecbb0b2ce85aa84b"/>
-  <project groups="crosvm" name="platform/external/libepoxy" path="third_party/libepoxy" revision="97d96203c4227939a9e6509ef9b5b425b489025d"/>
-  <project groups="crosvm" name="platform/external/minigbm" path="third_party/minigbm" revision="30d997f31d2e7bd542bfdf7676c5715c2b537feb"/>
-  <project groups="crosvm" name="platform/external/minijail" path="platform/minijail" revision="3b58ccb3072c5908c79d65339e886b344f49c5d1"/>
-  <project groups="crosvm" name="platform/external/virglrenderer" path="third_party/virglrenderer" revision="6c1801aaa54d005d5cf5ef0cbe153f776b50dd6b"/>
-  <project groups="crosvm" name="platform/tools/repohooks" path="tools/repohooks" revision="3798d7e067b927a16dc9e47bc6af949f9a2f4e20"/>
-  <repo-hooks enabled-list="pre-upload" in-project="platform/tools/repohooks"/>
-  <project groups="gfxstream" name="platform/external/ffmpeg" path="external/ffmpeg" revision="5c6f92dd1b16590153367ce79ed9b098cace354f"/>
-  <project groups="gfxstream" name="platform/external/boringssl" path="external/boringssl" revision="ba9db8781ec11859132f543aebff5d6093214751"/>
-  <project groups="gfxstream" name="platform/prebuilts/ninja/linux-x86" path="prebuilts/ninja/linux-x86" revision="7ef4cb95e1ed4305e99f03a8e8ad28d26134a45b"/>
-  <project groups="gfxstream" name="device/generic/vulkan-cereal" path="device/generic/vulkan-cereal" revision="ea978cef5a41c292dd9bd0ce9bf08648e76ca030"/>
-  <project groups="gfxstream" name="platform/external/protobuf" path="external/protobuf" revision="ca15ad7fb89a626c0d2a98240b11a2523727f9be"/>
-  <project groups="gfxstream" name="platform/external/libusb" path="external/libusb" revision="ad0473413edec14805e59599ff537eba0f5b8d33"/>
-  <project groups="gfxstream" name="platform/external/grpc-grpc" path="external/grpc" revision="0d80ea35ba09d0462ca13f236cc9ddc3fb749c57"/>
-  <project groups="gfxstream" name="platform/external/googletest" path="external/googletest" revision="38e8cf709f2461c458dc487a3455022900af783a"/>
-  <project groups="gfxstream" name="platform/external/tinyobjloader" path="external/tinyobjloader" revision="d16a940067fbc191364fc1d3e2a2d907209c9320"/>
-  <project groups="gfxstream" name="device/generic/goldfish-opengl" path="device/generic/goldfish-opengl" revision="3eb1c73065464bcf703069e48bd6b17a31bd8fc8"/>
-  <project groups="gfxstream" name="platform/external/libffi" path="external/libffi" revision="30bc66eb2043d8434e94f29beda87001e58c2a34"/>
-  <project groups="gfxstream" name="platform/external/angle" path="external/angle" revision="61ed0a943789204b9cc14074afdfb8587a345ef8"/>
-  <project groups="gfxstream" name="platform/external/libpng" path="external/libpng" revision="5d19b1bb0f5694f2ae47b3cc2ccfeb571764b439"/>
-  <project groups="gfxstream" name="platform/external/lz4" path="external/lz4" revision="1a184fdeb99f4cc11b774ac5b0b824b38105ec6c"/>
-  <project groups="gfxstream" name="platform/external/nasm" path="external/nasm" revision="645e4f02c622ba67eb754000cc00c9db8be31f85"/>
-  <project groups="gfxstream" name="platform/external/curl" path="external/curl" revision="1da4b04273638c8afe6f88bd7a7ccfb693640773"/>
-  <project groups="gfxstream" name="platform/external/libyuv" path="external/libyuv" revision="2ee3028b36ac61abed29cbb379a411a98fe31677"/>
-  <project groups="gfxstream" name="platform/prebuilts/android-emulator-build/protobuf" path="prebuilts/android-emulator-build/protobuf" revision="8e2a5472dd374e6c971d30eb3d00898a8c1a25c8"/>
-  <project groups="gfxstream" name="platform/prebuilts/clang/host/linux-x86" path="prebuilts/clang/host/linux-x86" revision="0e9e7035bf8ad42437c6156e5950eab13655b26c"/>
-  <project groups="gfxstream" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8" revision="90e45fec56fdeac84c9eb174c63fa6e748c6faa9"/>
-  <project groups="gfxstream" name="platform/prebuilts/android-emulator-build/common" path="prebuilts/android-emulator-build/common" revision="8314f26e316eaf90496cba19ecedd69aeb00b895"/>
-  <project groups="gfxstream" name="platform/prebuilts/android-emulator-build/mesa" path="prebuilts/android-emulator-build/mesa" revision="be7c00f399b415511d73308f0af0c0310512aced"/>
-  <project groups="gfxstream" name="platform/external/google-breakpad" path="external/google-breakpad" revision="a1414818b9f9810a3b45f1f55d9c00f5116ec7d9"/>
-  <project groups="gfxstream" name="platform/external/deqp" path="external/deqp" revision="ee2101f344ad88ceee4e15ce4afcf2eab2df3c9d"/>
-  <project groups="gfxstream" name="platform/prebuilts/android-emulator-build/curl" path="prebuilts/android-emulator-build/curl" revision="06f0905068b9ebfdd2d11b4d310c36b68c2fbe2f"/>
-  <project groups="gfxstream" name="platform/external/zlib" path="external/zlib" revision="7656f9eff09cc38244978773777ee64b7b31155d"/>
-  <project groups="gfxstream" name="platform/prebuilts/android-emulator-build/mesa-deps" path="prebuilts/android-emulator-build/mesa-deps" revision="17837fdb1889014fa01cbbbda56afc9b6034815f"/>
-  <project groups="gfxstream" name="platform/external/libvpx" path="external/libvpx" revision="62332cf39b0302e240acb10ed78d61d5ea282a39"/>
-  <project groups="gfxstream" name="platform/external/c-ares" path="external/cares" revision="b88261c9132d21c234dfbf36db3c6c3f5780051a"/>
-  <project groups="gfxstream" name="platform/external/qemu" path="external/qemu" revision="57b6653ba209c69ca762704c3245339189b175b2"/>
-  <project groups="gfxstream" name="platform/external/astc-codec" path="external/astc-codec" revision="17ae36822a8084f45ae51f9031e81f8318254f33"/>
-  <project groups="gfxstream" name="platform/prebuilts/android-emulator-build/qemu-android-deps" path="prebuilts/android-emulator-build/qemu-android-deps" revision="715d3bed0a3dc4f9980528c9bfb81469f2d3cbab"/>
-  <project groups="gfxstream" name="platform/external/google-benchmark" path="external/google-benchmark" revision="db1632fadc79df388a2a7248157c965ee40248a1"/>
-  <project groups="gfxstream" name="platform/prebuilts/cmake/linux-x86" path="prebuilts/cmake/linux-x86" revision="40dcb6f55bd2e8731e3e4f1a1721f7ff0fb83cb1"/>
+
+  <!-- Crosvm Dependencies -->
+  <project groups="crosvm" name="platform/external/crosvm" path="platform/crosvm" revision="2d9ca89b00cb6177d09ca570bd6f0f1ba362054a"/>
+  <project groups="crosvm" name="platform/external/libdrm" path="external/libdrm" revision="061d95fa324fb69af15c28d39464cd1297f2f1ba"/>
+  <project groups="crosvm" name="platform/external/libepoxy" path="third_party/libepoxy" revision="d2758901de61a18f099696d04e5b33bb790cc456"/>
+  <project groups="crosvm" name="platform/external/libffi" path="third_party/libffi" revision="479bc8d487cc34eac90a0fd1ca16ce1f23285ea1"/>
+  <project groups="crosvm" name="platform/external/minigbm" path="platform/minigbm" revision="b198c6e2337f78dd291f2d4ff78b04c8a3b897b1"/>
+  <project groups="crosvm" name="platform/external/minijail" path="platform/minijail" revision="916b5cd78488cf9deb09f58cea6ed3557134c1ea"/>
+  <project groups="crosvm" name="platform/external/virglrenderer" path="third_party/virglrenderer" revision="e94347008e35f09bdf3ca54ee392c377dfa34896"/>
+  <project groups="crosvm" name="platform/external/wayland" path="third_party/wayland" revision="ed5af8bd00d3f791cde20cee8ea15ffb7d6cfabd"/>
+
+  <!-- Gfxstream Dependencies -->
+  <project groups="gfxstream" name="platform/external/angle" path="external/angle" revision="2662abb218d15807856f25b93e100bdb10e0db45"/>
+  <project groups="gfxstream" name="platform/external/flatbuffers" path="external/flatbuffers" revision="ecd19dd48a97b9e89fc9f387de5dce7e679e8077"/>
+  <project groups="gfxstream" name="platform/external/lz4" path="external/lz4" revision="99b28c87054679e66517c9c3c89fe99654e15cfc"/>
+  <project groups="gfxstream" name="platform/hardware/google/aemu" path="hardware/google/aemu" revision="7d90df6fd73d2ab0513fc3f726f5b43be75c6651"/>
+  <project groups="gfxstream" name="platform/hardware/google/gfxstream" path="hardware/google/gfxstream" revision="8386badba01f2699a0b3e08f1d35a83c148c1990"/>
+
 </manifest>

diff --git a/qemu/README.md b/qemu/README.md
new file mode 100644
index 0000000..878bcd3
--- /dev/null
+++ b/qemu/README.md

@@ -0,0 +1,97 @@
+# Experimental QEMU8 build system
+
+This is a build of QEMU8 from scratch on Linux, using AOSP-specific compiler
+toolchain and sysroot (based on an old glibc-2.17 to ensure the generated
+binaries run on a vast number of distributions).
+
+## Getting the sources and prebuilts:
+
+The source tree is composed of ~50 multiple git containing source and prebuilt
+tools. This take tens of minutes since it downloads large prebuilts like the
+Clang toolchain or the GCC sysroot.
+
+```sh
+mkdir cuttlefish_vmm
+cd cuttlefish_vmm
+repo init --manifest-url https://android.googlesource.com/device/google/cuttlefish_vmm \
+  --manifest-name=qemu/manifest.xml
+repo sync -j 12
+```
+
+The `qemu/manifest.xml` enumerates the dependencies. For each of them it
+reproduces the hierarchy of git submodules. See below how to regenerate this
+file from git metadata.
+
+## Local build (Linux only):
+
+Just call `qemu/scripts/rebuild.sh`, specifying a build directory
+where all build outputs will be placed. In case of success,
+the qemu static binaries will be under
+`$BUILD_DIR/qemu-portable.tar.gz`.
+
+```sh
+qemu/scripts/rebuild.sh --build-dir /tmp/qemu-build
+```
+
+The `--run-tests` option can be used to run the QEMU test
+suite just after the build. Note that this currently hangs.
+
+##  Container build (Linux only):
+
+Ensure podman or docker is installed (podman is preferred
+since it will allow you to run containers without being
+root). See Annex A for important configuration information.
+
+The build has been tested with a small Debian10 image e.g.:
+
+```sh
+mkdir /tmp/qemu-build
+podman run --interactive --tty --name qemu-build \
+   --volume .:/src:O \
+   --volume /tmp/qemu-build:/out \
+   docker.io/debian:10-slim
+apt-get update
+apt-get -qy install autoconf libtool texinfo
+/src/qemu/scripts/rebuild.sh --build-dir /out --run-tests
+```
+
+Note: `/src` is mounted with a file overlay so that cargo can write
+`third_party/crossvm/rutabaga_gfx/ffi/Cargo.lock` file. We didn't find
+a way to prevent cargo from writing it.
+
+## Clone the repository with git submodules
+
+The alternateway to get the source and dependencies is to rely on submodules.
+
+```sh
+git clone sso://experimental-qemu-build-internal.googlesource.com/qemu-build qemu
+cd qemu
+git submodule update --init --depth 1 --recursive --jobs 4
+```
+
+This makes possible to upvert a dependency such as `qemu` and
+regenerate the repo manifest from the submodule tree.
+
+```sh
+python3 qemu/scripts/genrepo.py . --repo_manifest qemu/manifest.xml
+```
+
+## Check your code before submit
+
+The following script run pytype and pyformat.
+
+```sh
+scripts/check.sh
+```
+
+## Regenerate Cargo crates list
+
+Cargo crates are checked-in as part of the source tree and enumerated by
+`qemu/third_party/.cargo/config.toml`. This file hase be regenerated when
+`qemu/third_party/rust/crate` changes with the following command line:
+
+```sh
+ls qemu/third_party/rust/crates | awk '
+  BEGIN {print "[patch.crates-io]"}
+  {print $1 " = { path = \"rust/crates/" $1 "\" }"}' > qemu/third_party/.cargo/config.toml
+```
\ No newline at end of file

diff --git a/qemu/manifest.xml b/qemu/manifest.xml
new file mode 100644
index 0000000..2a4465e
--- /dev/null
+++ b/qemu/manifest.xml

@@ -0,0 +1,59 @@
+<manifest>
+  <remote name="aosp" fetch="sso://android.googlesource.com" review="sso://android/" />
+  <remote name="experimental-qemu-build-internal" fetch="sso://experimental-qemu-build-internal" />
+  <default sync-j="16" revision="main" remote="aosp" />
+  <project path="." name="qemu-build" revision="main" remote="experimental-qemu-build-internal" />
+  <project path="qemu/prebuilts/build-tools" name="platform/prebuilts/build-tools" revision="86f778561ed3cc3c46ca5c7fd9f2c591d054cc70" clone-depth="1" />
+  <project path="qemu/prebuilts/clang" name="platform/prebuilts/clang/host/linux-x86" revision="12cd8a5633acf5e7f2c22e26a282574cfcfac37b" clone-depth="1" />
+  <project path="qemu/prebuilts/cmake" name="platform/prebuilts/cmake/linux-x86" revision="001ed46e3703c78cbc3838adfe4c14ba279f9ff7" clone-depth="1" />
+  <project path="qemu/prebuilts/gcc" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8" revision="f7b0d5b0ee369864d5ac3e96ae24ec9e2b6a52da" clone-depth="1" />
+  <project path="qemu/prebuilts/ninja" name="platform/prebuilts/ninja/linux-x86" revision="8a10824f74fe0e22af9bf314a837f5b70e2bb67f" clone-depth="1" />
+  <project path="qemu/prebuilts/rust" name="platform/prebuilts/rust" revision="420a45125a091ddc1bd09b4c6fb39306fdc0c5b5" clone-depth="1" />
+  <project path="qemu/third_party/aemu" name="platform/hardware/google/aemu" revision="c6d126587b36707f6e041ee41f3f9e7213c0cf0a" />
+  <project path="qemu/third_party/bzip2" name="platform/external/bzip2" revision="af971b5524a392944a8fd1423b1860f3ab2919ec" />
+  <project path="qemu/third_party/crosvm" name="platform/external/crosvm" revision="aac1641f1ca541cb13941396f08474db590deea7" />
+  <project path="qemu/third_party/crosvm/third_party/virglrenderer" name="platform/external/virglrenderer" revision="4770f706db2d0e7731264cb36a659c764c7787f1" />
+  <project path="qemu/third_party/egl" name="platform/external/egl-registry" revision="9ab603608d6b165f79f17eee9ee1ced861625893" />
+  <project path="qemu/third_party/flatbuffers" name="platform/external/flatbuffers" revision="baf9b3a15e291a0c76850a50f994c5947c3f5e5e" />
+  <project path="qemu/third_party/gfxstream" name="platform/hardware/google/gfxstream" revision="8a105d876b234453ee1aa64a1e127c3259b6a58a" />
+  <project path="qemu/third_party/glib" name="platform/external/bluetooth/glib" revision="180713772f4e7bcdddf2c793f2f34a498184ed15" />
+  <project path="qemu/third_party/glib/subprojects/gvdb" name="platform/external/gvdb" revision="0854af0fdb6d527a8d1999835ac2c5059976c210" />
+  <project path="qemu/third_party/googletest" name="platform/external/googletest" revision="276e32ec333e05bff6dc7d20218a8d9152623222">
+    <linkfile src="." dest="qemu/third_party/qemu/roms/edk2/UnitTestFrameworkPkg/Library/GoogleTestLib/googletest" />
+  </project>
+  <project path="qemu/third_party/libdrm" name="platform/external/libdrm" revision="ed0a0cde4ea44f6295786900a9f42afd78713677" />
+  <project path="qemu/third_party/libffi" name="platform/external/libffi" revision="a8011b453bea48ac68b8c37545b4f04aaf6a9ffc" />
+  <project path="qemu/third_party/libpciaccess" name="platform/external/libpciaccess" revision="c716a921b7b970ff1fcd4ad34974877c29d103f0" />
+  <project path="qemu/third_party/libslirp" name="trusty/external/qemu-libslirp" revision="3ad1710a96678fe79066b1469cead4058713a1d9" />
+  <project path="qemu/third_party/meson" name="trusty/external/qemu-meson" revision="f341097c7e7914c250133bd58feb4985d1fbdcd6" />
+  <project path="qemu/third_party/patchelf" name="platform/external/patchelf" revision="519766900c63f3cf227c9a38fc7aa8a53fc4f90c" />
+  <project path="qemu/third_party/pcre" name="platform/external/pcre" revision="2113dcc6cb9e262c9a204203bc6bf1129a6fdc7c" />
+  <project path="qemu/third_party/pixman" name="platform/external/pixman" revision="37216a32839f59e8dcaa4c3951b3fcfc3f07852c" />
+  <project path="qemu/third_party/pkg-config" name="platform/external/pkg-config" revision="d97db4fae4c1cd099b506970b285dc2afd818ea2" />
+  <project path="qemu/third_party/python" name="platform/prebuilts/python/linux-x86" revision="008e82161a393ca8f7ac80f0683d6650ca03b347" />
+  <project path="qemu/third_party/qemu" name="platform/external/qemu" revision="7214504926af832486b6af97b7b9e17e8cbdb377" />
+  <project path="qemu/third_party/qemu/roms/u-boot" name="platform/external/u-boot" revision="840658b093976390e9537724f802281c9c8439f5" />
+  <project path="qemu/third_party/rust/crates/anyhow" name="platform/external/rust/crates/anyhow" revision="bb04cc54d8262ffe33cba59fa600bfbfe7e1d4ef" />
+  <project path="qemu/third_party/rust/crates/bitflags" name="platform/external/rust/crates/bitflags" revision="834363264dbcc07e346cdb999432ec6763c1ac09" />
+  <project path="qemu/third_party/rust/crates/byteorder" name="platform/external/rust/crates/byteorder" revision="3717e50a4895f69a726d1489254d9c4ad612c28b" />
+  <project path="qemu/third_party/rust/crates/cfg-if" name="platform/external/rust/crates/cfg-if" revision="6370d7a0025c7ae60eb5b427fc4d10a3c72e04bb" />
+  <project path="qemu/third_party/rust/crates/libc" name="platform/external/rust/crates/libc" revision="db73f80a4493567b524f3cd53fa016a01a51f394" />
+  <project path="qemu/third_party/rust/crates/log" name="platform/external/rust/crates/log" revision="eeec3f50acc9f32074dbfb3751dcf96115c95b8d" />
+  <project path="qemu/third_party/rust/crates/memoffset" name="platform/external/rust/crates/memoffset" revision="abfcb00917a1a40c50a50fbc07dde252e538b991" />
+  <project path="qemu/third_party/rust/crates/nix" name="platform/external/rust/crates/nix" revision="11ba04ed31a8486a1c5088289cebfb2d0346e770" />
+  <project path="qemu/third_party/rust/crates/once_cell" name="platform/external/rust/crates/once_cell" revision="4a9d8e8ee32e8ff0c1fea38c19cc50f33068910e" />
+  <project path="qemu/third_party/rust/crates/pin-utils" name="platform/external/rust/crates/pin-utils" revision="c8ba00eb24a92081deb6ae0a43aaea058726a996" />
+  <project path="qemu/third_party/rust/crates/proc-macro2" name="platform/external/rust/crates/proc-macro2" revision="9ed73418c7e5818f08b66b5841571044657d1da8" />
+  <project path="qemu/third_party/rust/crates/quote" name="platform/external/rust/crates/quote" revision="dd3eb25a252380e79a0596797f2c6b548f7a0437" />
+  <project path="qemu/third_party/rust/crates/remain" name="platform/external/rust/crates/remain" revision="c8dec4cae5ccde149efe992dc4de78da4def39c7" />
+  <project path="qemu/third_party/rust/crates/serde" name="platform/external/rust/crates/serde" revision="70c714b4b2b3411fd213f9910fc506d540af1dac" />
+  <project path="qemu/third_party/rust/crates/serde_derive" name="platform/external/rust/crates/serde_derive" revision="d535ca65fe5ee5fd73b8866046f50eb843ece831" />
+  <project path="qemu/third_party/rust/crates/static_assertions" name="platform/external/rust/crates/static_assertions" revision="fe7b4bbcd8a77faca169e2b04ee4982f4ada6a13" />
+  <project path="qemu/third_party/rust/crates/syn" name="platform/external/rust/crates/syn" revision="a29266e70bb35b140b448a8c90cf43115eea5209" />
+  <project path="qemu/third_party/rust/crates/thiserror" name="platform/external/rust/crates/thiserror" revision="d7214a2d978d1a96b8f75d21c7ae3801c6fa5fbc" />
+  <project path="qemu/third_party/rust/crates/thiserror-impl" name="platform/external/rust/crates/thiserror-impl" revision="8dfcac285d12d2ed2e299437fd8db886fb8e5a83" />
+  <project path="qemu/third_party/rust/crates/unicode-ident" name="platform/external/rust/crates/unicode-ident" revision="2114a5cf0e82708cff6885a24be1995903c94738" />
+  <project path="qemu/third_party/rust/crates/zerocopy" name="platform/external/rust/crates/zerocopy" revision="e28011fefae1a9014f99b01e95a8dbc0ce838206" />
+  <project path="qemu/third_party/rust/crates/zerocopy-derive" name="platform/external/rust/crates/zerocopy-derive" revision="b93d75504c6840e116d1d36809ef24a1087e071d" />
+  <project path="qemu/third_party/zlib" name="platform/external/zlib" revision="81774276a9cbf47177a1b7555bb6e3ec73bdcd25" />
+</manifest>
\ No newline at end of file

diff --git a/qemu/scripts/check.sh b/qemu/scripts/check.sh
new file mode 100755
index 0000000..a6babdc
--- /dev/null
+++ b/qemu/scripts/check.sh

@@ -0,0 +1,28 @@
+
+#!/usr/bash
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+readonly script="$(dirname $0)/*.py"
+readonly white='\033[1;37m'
+readonly nocolor='\033[0m' # No Color
+
+[[ $(type -P "pyformat") ]] || (echo "Run: pip install pyformat"; exit 1)
+echo -e "${white}[ Run pyformat ]${nocolor}"
+pyformat --in_place ${script}
+
+[[ $(type -P "pytype") ]] || (echo "Run: pip install pytype"; exit 1)
+echo -e "${white}[ Run pytype ]${nocolor}"
+pytype ${script}

diff --git a/qemu/scripts/genrepo.py b/qemu/scripts/genrepo.py
new file mode 100644
index 0000000..2d653db
--- /dev/null
+++ b/qemu/scripts/genrepo.py

@@ -0,0 +1,286 @@
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Generates an xml manifest for the `repo` tool.
+
+It enumerates all git submodules recursively, and
+creates a `project` entry in the manifest, pointing
+at the repository's url and hash.
+
+Repository's url are remapped to point either at AOSP
+or at experimental-qemu-build-internal when the AOSP
+repository is not ready.
+
+Some submodules are not used by the build and are not mapped.
+
+Nested repositories are relocated into ./third_party and a
+symlink is created to recreate the structure.
+"""
+
+import argparse
+import dataclasses
+import os
+import subprocess
+import sys
+import textwrap
+import xml.etree.ElementTree as ET
+
+# Host name of AOSP Git on borg repositories.
+# See rpc://android.googlesource.com/{repo name}
+AOSP_HOST = "android.googlesource.com"
+
+# Submodules that are not used by the build.
+REPO_TO_SKIP = {
+    "https://boringssl.googlesource.com/boringssl",
+    "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
+    "https://chromium.googlesource.com/chromiumos/platform/minigbm",
+    "https://chromium.googlesource.com/chromiumos/platform/minijail",
+    "https://chromium.googlesource.com/chromiumos/third_party/tpm2",
+    "https://chromium.googlesource.com/crosvm/perfetto/",
+    "https://github.com/akheron/jansson",
+    "https://github.com/google/brotli",
+    "https://github.com/google/wycheproof",
+    "https://github.com/kkos/oniguruma",
+    "https://github.com/krb5/krb5",
+    "https://github.com/openssl/openssl",
+    "https://github.com/pyca/cryptography.git",
+    "https://github.com/tianocore/edk2-cmocka.git",
+    "https://github.com/ucb-bar/berkeley-softfloat-3.git",
+    "https://gitlab.com/libvirt/libvirt-ci.git",
+    "https://gitlab.com/qemu-project/edk2.git",
+    "https://gitlab.com/qemu-project/ipxe.git",
+    "https://gitlab.com/qemu-project/libvfio-user.git",
+    "https://gitlab.com/qemu-project/openbios.git",
+    "https://gitlab.com/qemu-project/opensbi.git",
+    "https://gitlab.com/qemu-project/qboot.git",
+    "https://gitlab.com/qemu-project/qemu-palcode.git",
+    "https://gitlab.com/qemu-project/QemuMacDrivers.git",
+    "https://gitlab.com/qemu-project/seabios-hppa.git",
+    "https://gitlab.com/qemu-project/seabios.git/",
+    "https://gitlab.com/qemu-project/skiboot.git",
+    "https://gitlab.com/qemu-project/SLOF.git",
+    "https://gitlab.com/qemu-project/u-boot-sam460ex.git",
+    "https://gitlab.com/qemu-project/vbootrom.git",
+}
+
+# Replaces repositories URLs.
+REPO_MAPPING = {
+    # Submodules remapped to android AOSP.
+    "git://anongit.freedesktop.org/git/pixman.git": (
+        "https://android.googlesource.com/platform/external/pixman"
+    ),
+    "https://boringssl.googlesource.com/boringssl": (
+        "https://android.googlesource.com/platform/external/boringssl"
+    ),
+    "https://chromium.googlesource.com/chromiumos/third_party/virglrenderer": (
+        "https://android.googlesource.com/platform/external/virglrenderer"
+    ),
+    "https://chromium.googlesource.com/crosvm/crosvm": (
+        "https://android.googlesource.com/platform/external/crosvm"
+    ),
+    "https://github.com/google/googletest.git": (
+        "https://android.googlesource.com/platform/external/googletest"
+    ),
+    "https://github.com/mesonbuild/meson.git": (
+        "https://android.googlesource.com/trusty/external/qemu-meson"
+    ),
+    "https://gitlab.com/qemu-project/dtc.git": (
+        "https://android.googlesource.com/platform/external/dtc"
+    ),
+    "https://gitlab.com/qemu-project/meson.git": (
+        "https://android.googlesource.com/trusty/external/qemu-meson"
+    ),
+    "https://gitlab.com/qemu-project/u-boot.git": (  # Can probably be removed.
+        "https://android.googlesource.com/platform/external/u-boot"
+    ),
+    "https://gitlab.freedesktop.org/slirp/libslirp.git": (
+        "https://android.googlesource.com/trusty/external/qemu-libslirp"
+    ),
+    "https://gitlab.gnome.org/GNOME/glib.git": (
+        "https://android.googlesource.com/platform/external/bluetooth/glib"
+    ),
+    "https://github.com/KhronosGroup/EGL-Registry.git": (
+        "https://android.googlesource.com/platform/external/egl-registry"
+    ),
+    "https://gitlab.com/qemu-project/berkeley-softfloat-3.git": "https://android.googlesource.com/platform/external/berkeley-softfloat-3",
+    "https://gitlab.com/qemu-project/berkeley-testfloat-3.git": "https://android.googlesource.com/platform/external/berkeley-testfloat-3",
+    "https://salsa.debian.org/xorg-team/lib/libpciaccess.git": (
+        "https://android.googlesource.com/platform/external/libpciaccess"
+    ),
+    "https://gitlab.com/qemu-project/keycodemapdb.git": (
+        "https://android.googlesource.com/trusty/external/qemu-keycodemapdb"
+    ),
+    "https://gitlab.gnome.org/GNOME/gvdb.git": (
+        "https://android.googlesource.com/platform/external/gvdb"
+    ),
+}
+
+
+@dataclasses.dataclass
+class Submodule:
+  """Occurrence of a module in the tree."""
+
+  path: str
+  origin_url: str
+  hash: str
+
+
+@dataclasses.dataclass
+class Project:
+  """Project in a repo manifest."""
+
+  origin_url: str
+  gob_host: str
+  gob_path: str
+  revision: str
+  shallow: bool
+  linkat: list
+
+
+def GetAllSubmodules(path):
+  """Yields a Submodule for each module recursively found in the specified repo."""
+  origin = (
+      subprocess.check_output(["git", "remote", "get-url", "origin"])
+      .decode()
+      .strip()
+  )
+  yield Submodule(".", origin, "main")
+
+  output = subprocess.check_output([
+      "git",
+      "submodule",
+      "foreach",
+      "--recursive",
+      "-q",
+      "echo ${displaypath} $(git remote get-url origin) ${sha1}",
+  ])
+  for line in output.decode().strip().split("\n"):
+    yield Submodule(*line.split(" "))
+
+
+def MatchProject(url):
+  prefix_to_remote = {
+      "https://android.googlesource.com/": AOSP_HOST,
+      "persistent-https://android.git.corp.google.com/": AOSP_HOST,
+      "sso://experimental-qemu-build-internal/": (
+          "experimental-qemu-build-internal"
+      ),
+  }
+  for prefix, remote in prefix_to_remote.items():
+    if url.startswith(prefix):
+      return remote, url.removeprefix(prefix)
+  raise ValueError(
+      f"Url {url} could neither be mapped to AOSP to"
+      " experimental-qemu-build-internal. If this is a new submodule, verify"
+      " if it is used by the build. If it is, we should import it to AOSP. If"
+      " not, add it to the REPO_TO_SKIP."
+  )
+
+
+def main():
+  parser = argparse.ArgumentParser(description=__doc__)
+  parser.add_argument("input", help="git root directory")
+  parser.add_argument(
+      "--repo_manifest",
+      type=argparse.FileType("w"),
+      help="output repo tool manifest",
+  )
+
+  args = parser.parse_args()
+
+  submodules = list(GetAllSubmodules(args.input))
+
+  # Build a list of rep project.
+  project_by_name = {}
+  for module in submodules:
+    repo_url = module.origin_url
+    # Skip unused code repositories.
+    if repo_url in REPO_TO_SKIP:
+      continue
+    # Remap repository to their new location or to None.
+    if repo_url in REPO_MAPPING:
+      repo_url = REPO_MAPPING[repo_url]
+    gob_host, gob_path = MatchProject(repo_url)
+    # Add the repository instance to the list merging by gob_path
+    if gob_path not in project_by_name:
+      project_by_name[gob_path] = Project(
+          origin_url=module.origin_url,
+          gob_host=gob_host,
+          gob_path=gob_path,
+          revision=module.hash,
+          shallow=module.path.startswith("qemu/prebuilts/"),
+          linkat=[],
+      )
+
+    assert project_by_name[gob_path].gob_host == gob_host
+    project_by_name[gob_path].linkat.append(module.path)
+
+  GenerateRepoManifest(project_by_name.values(), args.repo_manifest)
+
+
+def SimpleName(project):
+  return project.gob_path.replace("/", "_")
+
+
+def GenerateRepoManifest(projects, out):
+  # Generate repo manifest xml.
+  manifest = ET.Element("manifest")
+  ET.SubElement(
+      manifest,
+      "remote",
+      name="aosp",
+      fetch="sso://android.googlesource.com",
+      review="sso://android/",
+  )
+  ET.SubElement(
+      manifest,
+      "remote",
+      name="experimental-qemu-build-internal",
+      fetch="sso://experimental-qemu-build-internal",
+  )
+  ET.SubElement(
+      manifest,
+      "default",
+      attrib={"sync-j": "16"},
+      revision="main",
+      remote="aosp",
+  )
+
+  for project in projects:
+    # The project is instantiated only once.
+    elem = ET.SubElement(
+        manifest,
+        "project",
+        path=project.linkat[0],
+        name=project.gob_path,
+        revision=project.revision,
+    )
+    if project.gob_host != AOSP_HOST:
+      elem.attrib["remote"] = project.gob_host
+    else:
+      pass  # Use the default value which is AOSP.
+
+    if project.shallow:
+      elem.attrib["clone-depth"] = "1"
+
+    for linkat in project.linkat[1:]:
+      ET.SubElement(elem, "linkfile", src=".", dest=linkat)
+
+  tree = ET.ElementTree(manifest)
+  ET.indent(tree)
+  tree.write(out, encoding="unicode")
+
+
+if __name__ == "__main__":
+  sys.exit(main())

diff --git a/qemu/scripts/rebuild.py b/qemu/scripts/rebuild.py
new file mode 100755
index 0000000..f78e45e
--- /dev/null
+++ b/qemu/scripts/rebuild.py

@@ -0,0 +1,1004 @@
+# Copyright (C) 2023 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""A script to rebuild QEMU from scratch on Linux."""
+
+import argparse
+import os
+from pathlib import Path
+import shlex
+import shutil
+import subprocess
+import sys
+from typing import Any
+from typing import Callable
+from typing import Dict
+from typing import List
+from typing import Sequence
+
+
+def copy_file(src: Path, dst: Path) -> None:
+  log("  COPY_FILE %s --> %s" % (src, dst))
+  os.makedirs(dst.parent, exist_ok=True)
+  shutil.copy2(src, dst)
+
+
+def log(msg: str) -> None:
+  print(msg)
+
+
+def create_dev_environment(
+    build_dir: Path, install_dir: Path, prebuilts_dir: Path, clang_dir: Path
+) -> Dict[str, str]:
+  sysroot = str(build_dir / "sysroot")
+  binprefix = "%s/" % (clang_dir / "bin")
+  env = os.environ.copy()
+  path = env["PATH"]
+  ld_library_path = env.get("LD_LIBRARY_PATH", "")
+  env.update({
+      "CC": f"{binprefix}clang --sysroot={sysroot}",
+      "CXX": f"{binprefix}clang++ --sysroot={sysroot} -stdlib=libc++",
+      # FIXME: this file does not exist.
+      "LD": f"{binprefix}llvm-ld --sysroot={sysroot}",
+      "AR": f"{binprefix}llvm-ar",
+      "NM": f"{binprefix}llvm-nm",
+      "PKG_CONFIG_PATH": ":".join([
+          f"{install_dir}/usr/local/lib/pkgconfig",
+          f"{install_dir}/usr/lib/x86_64-linux-gnu/pkgconfig",
+          f"{install_dir}/usr/lib/pkgconfig",
+      ]),
+      "PATH": f"{install_dir}/usr/bin:{path}",
+      "LD_LIBRARY_PATH": ":".join([
+          f"{install_dir}/usr/lib/x86_64-linux-gnu",
+          f"{install_dir}/usr/lib",
+          f"{clang_dir}/lib:{ld_library_path}",
+      ]),
+      # Required to ensure that configure scripts that do not rely
+      # on pkg-config find their dependencies properly.
+      "CFLAGS": f"-I{install_dir}/usr/include",
+      "LDFLAGS": f"-Wl,-L{install_dir}/usr/lib",
+  })
+  return env
+
+
+_CLANG_VERSION = "r487747"
+
+
+def generate_shell_command(
+    cmd_args: Sequence[str],
+    build_dir: Path | None,
+    env: Dict[str, str] | None = None,
+    base_env: Dict[str, str] | None = None,
+) -> str:
+  """Generate a shell command that can be printed or written to a script.
+
+  Arguments:
+    cmd_args: A list of strings for the command arguments.
+    build_dir: An optional path to a build directory. None if the command must
+      run in the current one.
+    env: An optional dictionary of environment variable definitions
+    base_env: An optional base environment. Values in env will be compared to
+      it, and only differences will appear in the result. If None then
+      os.environ will be used.
+
+  Returns:
+    A single string that can be printed or written to a script.
+    All command arguments and variable values will be properly quoted.
+  """
+  if base_env is None:
+    base_env = dict(os.environ)
+  environ = []
+  if env:
+    environ = [
+        "%s=%s" % (k, shlex.quote(v))
+        for k, v in sorted(env.items())
+        if k not in base_env or base_env[k] != v
+    ]
+  result = ""
+  result_wrap = False
+  if build_dir:
+    result += f"cd {build_dir} && "
+    result_wrap = True
+  if environ:
+    result += " ".join(environ) + " "
+
+  result += " ".join(shlex.quote(c) for c in cmd_args)
+  if result_wrap:
+    result = f"({result})"
+  return result
+
+
+def run_command(
+    cmd_args: Sequence[Any],
+    build_dir: Path | None = None,
+    env: Dict[str, str] | None = None,
+) -> None:
+  # Convert arguments to strings, to support Path items directly.
+  cmd_args = [str(c) for c in cmd_args]
+
+  # Log a copy pastable command to help with iteration.
+  log(generate_shell_command(cmd_args, build_dir, env) + "\n")
+  subprocess.run(cmd_args, cwd=build_dir, env=env).check_returncode()
+
+
+##########################################################################
+##########################################################################
+#####
+#####  B U I L D   C O N F I G
+#####
+##########################################################################
+##########################################################################
+
+
+class BuildConfig(object):
+  """Global build configuration object that is passed to all functions
+
+  that implement a specific task build instructions below.
+
+  This provides readonly directory paths, a default development
+  environment used to launch all action commands, and ways to augment it
+  with custom modifications (e.g. to add specific compiler flags).
+
+  Usage is the following:
+
+     1) Create instance, passing the path of the build directory, and
+        the path to the read-only top directory project.
+
+     2) Later, the instance is passed to each build function, which will
+        be able to call its various methods to perform the operations
+        required for its task, e.g. unpacking archives, applying patches
+        or running commands.
+  """
+
+  def __init__(self, build_dir: Path, top_dir: Path):
+    self._build_dir = build_dir
+    self._sysroot_dir = build_dir / "sysroot"
+    self._install_dir = build_dir / "dest-install"
+    self._prebuilts_dir = top_dir / "prebuilts"
+    self._clang_dir = self._prebuilts_dir / "clang" / f"clang-{_CLANG_VERSION}"
+    self._third_party_dir = top_dir / "third_party"
+    self._env = create_dev_environment(
+        self._build_dir,
+        self._install_dir,
+        self._prebuilts_dir,
+        self._clang_dir,
+    )
+
+    # By default, run commands directly. Subclasses can override
+    # this value to record the commands instead, for example
+    # to write them to a script or into a Makefile or Ninja build plan.
+    self._runner = run_command
+
+  def enable_ccache(self) -> None:
+    for varname in ("CC", "CXX"):
+      self._env[varname] = "ccache " + self._env[varname]
+
+  @property
+  def build_dir(self) -> Path:
+    return self._build_dir
+
+  @property
+  def install_dir(self) -> Path:
+    return self._install_dir
+
+  @property
+  def prebuilts_dir(self) -> Path:
+    return self._prebuilts_dir
+
+  @property
+  def clang_dir(self) -> Path:
+    return self._clang_dir
+
+  @property
+  def sysroot_dir(self) -> Path:
+    return self._sysroot_dir
+
+  @property
+  def third_party_dir(self) -> Path:
+    return self._third_party_dir
+
+  def env_copy(self):
+    """Return a copy of the current environment dictionary."""
+    return self._env.copy()
+
+  def env_copy_with(self, new_values: Dict[str, str]) -> Dict[str, str]:
+    """Return a copy of the current environment, updated with new variables."""
+    env = self._env.copy()
+    env.update(new_values)
+    return env
+
+  def env_with_DESTDIR(self, dest_dir: Path | None = None) -> Dict[str, str]:
+    """Return a copy of the current environment, with DESTDIR set to
+
+    the installation directory.
+    """
+    return self.env_copy_with({"DESTDIR": str(dest_dir or self._install_dir)})
+
+  def make_subdir(self, subdir: Path) -> Path:
+    path = self.build_dir / subdir
+    self._runner(["rm", "-rf", path], self.build_dir, None)
+    self._runner(["mkdir", "-p", path], self.build_dir, None)
+    return path
+
+  def run(
+      self,
+      args: Sequence[Path | str],
+      sub_build_dir: Path | None = None,
+      env: Dict[str, str] | None = None,
+  ) -> None:
+    """Run a command in |sub_build_dir|, with optional |env|."""
+    cur_dir = self.build_dir
+    if sub_build_dir:
+      cur_dir = cur_dir / sub_build_dir
+    if env is None:
+      env = self.env_copy()
+    self._runner(args, cur_dir, env)
+
+  def run_make_build(
+      self, sub_build_dir: Path | None = None, extra_args: List[str] = []
+  ) -> None:
+    """Run `make -j<numcpus>` in |sub_build_dir|."""
+    self.run(["make", f"-j{os.cpu_count()}"] + extra_args, sub_build_dir)
+
+  def run_make_install(
+      self,
+      sub_build_dir: Path | None = None,
+      use_DESTDIR: bool = False,
+      dest_dir: Path | None = None,
+  ) -> None:
+    """Run `make install` in |sub_build_dir|.
+
+    If use_DESTDIR is True, set DESTDIR env variable.
+    """
+    env = None
+    if use_DESTDIR:
+      env = self.env_with_DESTDIR(dest_dir=dest_dir)
+    self.run(["make", "install"], sub_build_dir, env)
+
+  def copy_file(self, src_path: Path, dst_path: Path):
+    if dst_path.is_dir():
+      raise ValueError(
+          f"Misuse: dst_path ({dst_path}) points at an existing directory."
+      )
+    self._runner(["mkdir", "-p", dst_path.parent], None, None)
+    self._runner(["cp", "-f", src_path, dst_path], None, None)
+
+  def copy_dir(self, src_dir: Path, dst_dir: Path):
+    self._runner(["mkdir", "-p", dst_dir.parent], None, None)
+    self._runner(
+        ["cp", "-rfL", "--no-target-directory", src_dir, dst_dir], None, None
+    )
+
+
+##########################################################################
+##########################################################################
+#####
+#####  B U I L D   S E Q U E N C  E R
+#####
+#####  A |Project| can register build tasks and their dependencies.
+#####  Then it can return a build plan to be executed in sequence.
+#####
+##########################################################################
+##########################################################################
+
+BuildTaskFn = Callable[[BuildConfig], None]
+
+
+class Project:
+  # Type of a build task function that takes a single |BuildConfig| argument.
+
+  def __init__(self):
+    self.tasks = {}
+
+  def task(self, deps: List[BuildTaskFn]):
+    """Decorator that registers a |BuildTaskFn| and its dependencies."""
+
+    def decorator(fn: BuildTaskFn) -> BuildTaskFn:
+      for dep in deps:
+        if dep not in self.tasks:
+          raise ValueError(
+              f"Task {fn} depends on {dep}, but {dep} is was not yet defined."
+              " Did you forgot to annotate it?"
+          )
+      if fn in self.tasks:
+        raise ValueError(f"Task {fn} already defined.")
+      self.tasks[fn] = deps
+      return fn
+
+    return decorator
+
+  def get_build_task_list(
+      self, task_function: BuildTaskFn
+  ) -> List[BuildTaskFn]:
+    """Returns the transitive dependency list of the current task."""
+    # Rely on the fact that:
+    # a - function are registered in topological order
+    # b - python dictionaries are iterated in insertion order.
+    task_list = list(self.tasks.keys())
+    return task_list[: task_list.index(task_function) + 1]
+
+
+project = Project()
+
+##########################################################################
+##########################################################################
+#####
+#####  I N D I V I D U A L   T A S K S
+#####
+#####  Each build_task_for_xxx() function below should only access a single
+#####  BuildConfig argument, be decorated with `project.task` and enumerate
+#####  the tasks it depends on.
+#####
+#####  These functions should also only use the BuildConfig methods
+#####  to do their work, i.e. they shall not directly modify the
+#####  filesystem or environment in any way.
+#####
+##########################################################################
+##########################################################################
+
+
+@project.task([])
+def build_task_for_sysroot(build: BuildConfig):
+  # populate_sysroot(build.build_dir / 'sysroot', build.prebuilts_dir),
+  dst_sysroot = build.build_dir / "sysroot"
+  dst_sysroot_lib_dir = dst_sysroot / "usr" / "lib"
+
+  # Copy the content of the sysroot first.
+  src_sysroot_dir = build.prebuilts_dir / "gcc/sysroot"
+  build.copy_dir(src_sysroot_dir / "usr", dst_sysroot / "usr")
+
+  # Add the static gcc runtime libraries and C runtime objects.
+  static_libgcc_dir = build.prebuilts_dir / "gcc/lib/gcc/x86_64-linux/4.8.3"
+  for lib in [
+      "libgcc.a",
+      "libgcc_eh.a",
+      "crtbegin.o",
+      "crtbeginS.o",
+      "crtbeginT.o",
+      "crtend.o",
+      "crtendS.o",
+  ]:
+    build.copy_file(static_libgcc_dir / lib, dst_sysroot_lib_dir / lib)
+
+  # Add the shared gcc runtime libraries.
+  # Do we need libatomic.so and others?
+  shared_libgcc_dir = build.prebuilts_dir / "gcc/x86_64-linux/lib64"
+  for lib in ["libgcc_s.so", "libgcc_s.so.1", "libstdc++.a", "libstdc++.so"]:
+    build.copy_file(shared_libgcc_dir / lib, dst_sysroot_lib_dir / lib)
+
+
+@project.task([build_task_for_sysroot])
+def build_task_for_ninja(build: BuildConfig):
+  build.copy_file(
+      build.prebuilts_dir / "ninja" / "ninja",
+      build.install_dir / "usr" / "bin" / "ninja",
+  )
+
+
+@project.task([])
+def build_task_for_python(build: BuildConfig):
+  src_python_dir = build.third_party_dir / "python"
+  dst_python_dir = build.install_dir / "usr"
+  for d in ("bin", "lib", "share"):
+    build.copy_dir(src_python_dir / d, dst_python_dir / d)
+
+
+@project.task(
+    [build_task_for_sysroot, build_task_for_ninja, build_task_for_python]
+)
+def build_task_for_meson(build: BuildConfig):
+  meson_packager = (
+      build.third_party_dir / "meson" / "packaging" / "create_zipapp.py"
+  )
+  build.run([
+      "python3",
+      "-S",
+      meson_packager,
+      "--outfile=%s" % (build.install_dir / "usr" / "bin" / "meson"),
+      "--interpreter",
+      "/usr/bin/env python3",
+      build.third_party_dir / "meson",
+  ])
+
+
+@project.task([])
+def build_task_for_rust(build: BuildConfig):
+  log("Install prebuilt rust.")
+  src_rust_dir = build.prebuilts_dir / "rust" / "linux-x86" / "1.65.0"
+  dst_rust_dir = build.install_dir / "usr"
+  for d in ("bin", "lib", "lib64", "share"):
+    src_dir = src_rust_dir / d
+    dst_dir = dst_rust_dir / d
+    build.copy_dir(src_dir, dst_dir)
+
+
+@project.task([build_task_for_sysroot])
+def build_task_for_make(build: BuildConfig) -> None:
+  build.copy_file(
+      build.prebuilts_dir / "build-tools" / "linux-x86" / "bin" / "make",
+      build.install_dir / "usr" / "bin" / "make",
+  )
+
+
+@project.task([])
+def build_task_for_cmake(build: BuildConfig):
+  log("Install Cmake prebuilt.")
+  build.copy_file(
+      build.prebuilts_dir / "cmake" / "bin" / "cmake",
+      build.install_dir / "usr" / "bin" / "cmake",
+  )
+  build.copy_dir(
+      build.prebuilts_dir / "cmake" / "share",
+      build.install_dir / "usr" / "share",
+  )
+
+
+@project.task([build_task_for_make])
+def build_task_for_bzip2(build: BuildConfig):
+  build_dir = build.make_subdir(Path("bzip2"))
+  build.copy_dir(build.third_party_dir / "bzip2", build_dir)
+  env = build.env_copy()
+  build.run(
+      [
+          "make",
+          f"-j{os.cpu_count()}",
+          "CC=%s" % env["CC"],
+          "AR=%s" % env["AR"],
+          "CFLAGS=%s -O2 -D_FILE_OFFSET_BITS=64" % env["CFLAGS"],
+          "LDFLAGS=%s" % env["LDFLAGS"],
+      ],
+      build_dir,
+  )
+  build.run(
+      [
+          "make",
+          "install",
+          f"PREFIX={build.install_dir}/usr",
+      ],
+      build_dir,
+  )
+
+
+@project.task([build_task_for_make])
+def build_task_for_pkg_config(build: BuildConfig):
+  build_dir = build.make_subdir(Path("pkg-config"))
+  build.copy_dir(build.third_party_dir / "pkg-config", build_dir)
+  build.run(
+      [
+          "sed",
+          "-i",
+          "s/m4_copy(/m4_copy_force(/g",
+          "glib/m4macros/glib-gettext.m4",
+      ],
+      build_dir,
+  )
+  # Run configure separately so that we can pass "--with-internal-glib".
+  build.run(["./autogen.sh", "--no-configure"], build_dir)
+
+  cmd_env = build.env_copy()
+  cmd_env["CFLAGS"] += " -Wno-int-conversion"
+  cmd_args = [
+      "./configure",
+      "--prefix=%s/usr" % build.install_dir,
+      "--disable-shared",
+      "--with-internal-glib",
+  ]
+  build.run(cmd_args, build_dir, cmd_env)
+  build.run_make_build(build_dir)
+  build.run_make_install(build_dir)
+
+
+@project.task([build_task_for_make])
+def build_task_for_patchelf(build: BuildConfig):
+  build_dir = build.make_subdir(Path("patchelf"))
+  build.copy_dir(build.third_party_dir / "patchelf", build_dir)
+  # Run configure separately so that we can pass "--with-internal-glib".
+  build.run(["./bootstrap.sh"], build_dir)
+  build.run(
+      [
+          "./configure",
+          "--prefix=%s/usr" % build.install_dir,
+      ],
+      build_dir,
+  )
+  build.run_make_build(build_dir)
+  build.run_make_install(build_dir)
+
+
+@project.task([build_task_for_make, build_task_for_cmake])
+def build_task_for_zlib(build: BuildConfig):
+  lib_name = "zlib"
+  src_dir = build.third_party_dir / lib_name
+  build_dir = build.make_subdir(Path(lib_name))
+
+  # `--undefined-version` workaround the pickiness of lld.
+  # Some symbols of the link script are not found which
+  # is an error for lld and not for ld.
+
+  # `-Wunused-command-line-argument` remove annoying warnings
+  # introduces by adding a linker flag to all the clang
+  # invocations.
+
+  # `--no-deprecated-non-prototype` removes warning due
+  # to the use of deprecated C features.
+  env = build.env_copy()
+  env["CC"] += " -Wl,--undefined-version -Wno-unused-command-line-argument"
+  env["CC"] += " -Wno-deprecated-non-prototype"
+
+  cmd_args = [
+      "cmake",
+      f"-DCMAKE_INSTALL_PREFIX={build.install_dir}/usr",
+      src_dir,
+  ]
+  build.run(cmd_args, build_dir, env=env)
+  build.run_make_build(build_dir)
+  build.run_make_install(build_dir, use_DESTDIR=False)
+
+
+@project.task([build_task_for_make, build_task_for_bzip2])
+def build_task_for_libpcre2(build: BuildConfig):
+  build_dir = build.make_subdir(Path("pcre"))
+  build.copy_dir(build.third_party_dir / "pcre", build_dir)
+
+  cmd_args = [
+      "./configure",
+      "--prefix=/usr",
+      "--disable-shared",
+  ]
+  build.run(cmd_args, build_dir)
+  build.run_make_build(build_dir)
+  build.run_make_install(build_dir, use_DESTDIR=True)
+
+
+@project.task([build_task_for_make])
+def build_task_for_libffi(build: BuildConfig):
+  build_dir = build.make_subdir(Path("libffi"))
+  build.copy_dir(build.third_party_dir / "libffi", build_dir)
+
+  build.run(["./autogen.sh"], build_dir)
+
+  cmd_args = [
+      "./configure",
+      "--prefix=/usr",
+      "--disable-shared",
+  ]
+  build.run(cmd_args, build_dir)
+  build.run_make_build(build_dir)
+  build.run_make_install(build_dir, use_DESTDIR=True)
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_meson,
+    build_task_for_libffi,
+    build_task_for_libpcre2,
+    build_task_for_zlib,
+    build_task_for_pkg_config,
+])
+def build_task_for_glib(build: BuildConfig):
+  src_dir = build.third_party_dir / "glib"
+  build_dir = build.make_subdir(Path("glib"))
+
+  # --prefix=$DESTDIR is required to ensure the pkg-config .pc files contain
+  #     the right absolute path.
+  #
+  # --includedir=$DESTDIR/include is required to avoid installs to
+  #     /out/dest-install/out/dest-install/usr/include!
+  #
+  build.run(
+      [
+          "meson",
+          "setup",
+          "--default-library=static",
+          "--prefix=%s/usr" % build.install_dir,
+          "--includedir=%s/usr/include" % build.install_dir,
+          "--libdir=%s/usr/lib" % build.install_dir,
+          "--buildtype=release",
+          "--wrap-mode=nofallback",
+          build_dir,
+          src_dir,
+      ],
+  )
+
+  build.run(["ninja", "install"], build_dir)
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_meson,
+    build_task_for_pkg_config,
+])
+def build_task_for_pixman(build: BuildConfig):
+
+  src_dir = build.third_party_dir / "pixman"
+  build_dir = build.make_subdir(Path("pixman"))
+  cmd_args = [
+      "meson",
+      "setup",
+      "--prefix=%s/usr" % build.install_dir,
+      "--includedir=%s/usr/include" % build.install_dir,
+      "--libdir=%s/usr/lib" % build.install_dir,
+      "--default-library=static",
+      "-Dtests=disabled",
+      "--buildtype=release",
+      build_dir,
+      src_dir,
+  ]
+  env = build.env_copy()
+  env["CC"] += " -ldl -Wno-implicit-function-declaration"
+  build.run(cmd_args, env=env)
+  build.run(
+      [
+          "meson",
+          "compile",
+      ],
+      build_dir,
+  )
+  build.run(
+      [
+          "meson",
+          "install",
+      ],
+      build_dir,
+  )
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_glib,
+])
+def build_task_for_libslirp(build: BuildConfig):
+  src_dir = build.third_party_dir / "libslirp"
+  build_dir = build.make_subdir(Path("libslirp"))
+
+  cmd_args = [
+      "meson",
+      "setup",
+      "--prefix=%s/usr" % build.install_dir,
+      "--includedir=%s/usr/include" % build.install_dir,
+      "--libdir=%s/usr/lib" % build.install_dir,
+      "--default-library=static",
+      "--buildtype=release",
+      build_dir,
+      src_dir,
+  ]
+  build.run(cmd_args, src_dir)
+  build.run(["ninja", "install"], build_dir)
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_cmake,
+])
+def build_task_for_googletest(build: BuildConfig):
+  dir_name = Path("googletest")
+  build.make_subdir(dir_name)
+  cmd_args = [
+      "cmake",
+      f"-DCMAKE_INSTALL_PREFIX={build.install_dir}/usr",
+      build.third_party_dir / dir_name,
+  ]
+  build.run(cmd_args, dir_name)
+  build.run_make_build(dir_name)
+  build.run_make_install(dir_name, use_DESTDIR=False)
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_cmake,
+    build_task_for_googletest,
+])
+def build_task_for_aemu_base(build: BuildConfig):
+  dir_name = Path("aemu")
+  build.make_subdir(dir_name)
+  # Options from third_party/aemu/rebuild.sh
+  cmd_args = [
+      "cmake",
+      "-DAEMU_COMMON_GEN_PKGCONFIG=ON",
+      "-DAEMU_COMMON_BUILD_CONFIG=gfxstream",
+      "-DENABLE_VKCEREAL_TESTS=ON",  # `ON` for `aemu-base-testing-support`.
+      f"-DCMAKE_INSTALL_PREFIX={build.install_dir}/usr",
+      build.third_party_dir / dir_name,
+  ]
+  build.run(cmd_args, dir_name)
+  build.run_make_build(dir_name)
+  build.run_make_install(dir_name, use_DESTDIR=False)
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_cmake,
+])
+def build_task_for_flatbuffers(build: BuildConfig):
+  dir_name = Path("flatbuffers")
+  build.make_subdir(dir_name)
+  cmd_args = [
+      "cmake",
+      f"-DCMAKE_INSTALL_PREFIX={build.install_dir}/usr",
+      build.third_party_dir / dir_name,
+  ]
+  build.run(cmd_args, dir_name)
+  build.run_make_build(dir_name)
+  build.run_make_install(dir_name, use_DESTDIR=False)
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_meson,
+])
+def build_task_for_libpciaccess(build: BuildConfig):
+  dir_name = Path("libpciaccess")
+  src_dir = build.third_party_dir / dir_name
+  build_dir = build.make_subdir(dir_name)
+
+  build.run(
+      [
+          "meson",
+          "setup",
+          "--prefix=%s/usr" % build.install_dir,
+          build_dir,
+          src_dir,
+      ],
+  )
+  build.run(
+      [
+          "meson",
+          "compile",
+      ],
+      build_dir,
+  )
+  build.run(
+      [
+          "meson",
+          "install",
+      ],
+      build_dir,
+  )
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_meson,
+    build_task_for_libpciaccess,
+])
+def build_task_for_libdrm(build: BuildConfig):
+  dir_name = Path("libdrm")
+  src_dir = build.third_party_dir / dir_name
+  build_dir = build.make_subdir(dir_name)
+
+  build.run(
+      [
+          "meson",
+          "setup",
+          f"--prefix={build.install_dir}/usr",
+          build_dir,
+          src_dir,
+      ],
+  )
+  build.run(
+      [
+          "meson",
+          "compile",
+      ],
+      build_dir,
+  )
+  build.run(
+      [
+          "meson",
+          "install",
+      ],
+      build_dir,
+  )
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_meson,
+    build_task_for_aemu_base,
+    build_task_for_flatbuffers,
+    build_task_for_libdrm,
+])
+def build_task_for_gfxstream(build: BuildConfig):
+  dir_name = Path("gfxstream-build")
+  out_dir = build.make_subdir(dir_name)
+  cmd_args = [
+      "cmake",
+      "-DDEPENDENCY_RESOLUTION=SYSTEM",
+      build.third_party_dir / dir_name,
+  ]
+  build.run(cmd_args, dir_name)
+  build.run_make_build(dir_name, ["gfxstream_backend"])
+  build.copy_file(
+      build.clang_dir / "lib" / "libc++.so.1",
+      build.install_dir / "usr" / "lib" / "libc++.so.1",
+  )
+  build.copy_file(
+      out_dir / "libgfxstream_backend.so",
+      build.install_dir / "usr" / "lib" / "libgfxstream_backend.so",
+  )
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_rust,
+    build_task_for_gfxstream,
+])
+def build_task_for_rutabaga(build: BuildConfig):
+  out_dir = build.make_subdir(Path("rutabaga"))
+  cmd_args = [
+      build.install_dir / "usr/bin/cargo",
+      "build",
+      "--offline",
+      "--features=gfxstream",
+      "--release",
+  ]
+  env = {
+      "CARGO_TARGET_DIR": str(out_dir),
+      "GFXSTREAM_PATH": str(build.build_dir / "gfxstream-build"),
+      "PATH": f"{build.install_dir}/usr/bin:{os.environ['PATH']}",
+      "CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER": (
+          f"{build.clang_dir}/bin/clang"
+      ),
+      "RUSTFLAGS": (
+          f"-Clink-arg=--sysroot={build.sysroot_dir} -Clink-arg=-Wl,-rpath,$ORIGIN"
+      ),
+  }
+  rutabaga_src_dir = build.third_party_dir / "crosvm" / "rutabaga_gfx" / "ffi"
+  build.run(cmd_args, rutabaga_src_dir, env)
+  build.copy_file(
+      out_dir / "release" / "librutabaga_gfx_ffi.so",
+      build.install_dir / "usr" / "lib" / "librutabaga_gfx_ffi.so",
+  )
+  build.copy_file(
+      rutabaga_src_dir / "src" / "share" / "rutabaga_gfx_ffi.pc",
+      build.install_dir / "usr" / "lib" / "pkgconfig" / "rutabaga_gfx_ffi.pc",
+  )
+  build.copy_file(
+      rutabaga_src_dir / "src" / "include" / "rutabaga_gfx_ffi.h",
+      build.install_dir
+      / "usr"
+      / "include"
+      / "rutabaga_gfx"
+      / "rutabaga_gfx_ffi.h",
+  )
+
+
+@project.task([
+    build_task_for_make,
+    build_task_for_libslirp,
+    build_task_for_glib,
+    build_task_for_pixman,
+    build_task_for_zlib,
+    build_task_for_pkg_config,
+    build_task_for_rutabaga,
+    build_task_for_gfxstream,
+])
+def build_task_for_qemu(build: BuildConfig):
+  target_list = [
+      "riscv64-softmmu",
+      # "x86_64-softmmu",
+  ]
+  src_dir = build.third_party_dir / "qemu"
+  build_dir = build.make_subdir(Path("qemu"))
+  cmd_args: List[str | Path] = [
+      src_dir.resolve() / "configure",
+      "--prefix=/usr",
+      "--target-list=%s" % ",".join(target_list),
+      "--disable-plugins",
+      # `gfxstream` is is only capable to output a dynamic library for now
+      # `libgfxstream_backend.so`
+      # "--static",
+      # "--with-git-submodules=ignore",
+  ]
+  build.run(cmd_args, build_dir)
+  build.run_make_build(build_dir)
+
+
+@project.task([
+    build_task_for_qemu,
+    build_task_for_patchelf,
+])
+def build_task_for_qemu_portable(build: BuildConfig):
+  package_dir = build.make_subdir(Path("qemu-portable"))
+  # Install to a new directory rather than to the common taks install dir.
+  build.run_make_install(
+      build.build_dir / "qemu", use_DESTDIR=True, dest_dir=package_dir
+  )
+  bin_dir = package_dir / "usr" / "bin"
+  build.run(["patchelf", "--set-rpath", "$ORIGIN"] + list(bin_dir.glob("*")))
+
+  files = [
+      "dest-install/usr/lib/libz.so.1",
+      "dest-install/usr/lib/librutabaga_gfx_ffi.so",
+      "dest-install/usr/lib/libgfxstream_backend.so",
+      "dest-install/usr/lib/libc++.so.1",
+  ]
+  build.run(["cp", "-t", bin_dir] + files)
+  build.run(["tar", "-czvf", "qemu-portable.tar.gz", package_dir])
+
+
+@project.task([
+    build_task_for_qemu_portable,
+])
+def build_task_for_qemu_test(build: BuildConfig):
+  build.run(["make", "test"], build.build_dir / "qemu")
+
+
+##########################################################################
+##########################################################################
+#####
+#####  B U I L D   T A S K S
+#####
+##########################################################################
+##########################################################################
+
+
+def main() -> int:
+  parser = argparse.ArgumentParser(description=__doc__)
+  parser.add_argument("--build-dir", required=True, help="Build directory.")
+  parser.add_argument("--ccache", action="store_true", help="Enable ccache.")
+  parser.add_argument(
+      "--run-tests",
+      action="store_true",
+      help="Run QEMU test suite after the build.",
+  )
+  parser.add_argument(
+      "tasks",
+      metavar="T",
+      type=str,
+      nargs="*",
+      help="run task by names in the specified order",
+  )
+  args = parser.parse_args()
+
+  build_dir = Path(args.build_dir)
+
+  top_dir = Path(os.path.dirname(__file__)).parent
+  build_config = BuildConfig(build_dir, top_dir)
+
+  if args.ccache:
+    build_config.enable_ccache()
+
+  if args.tasks:
+    for task in args.tasks:
+      globals()[task](build_config)
+  else:
+    if build_dir.exists():
+      print("Cleaning up build directory...")
+      for f in os.listdir(build_dir):
+        path = build_dir / f
+        if os.path.isfile(path):
+          os.remove(path)
+        else:
+          shutil.rmtree(path)
+    else:
+      os.makedirs(build_dir)
+
+    # Compute the build plan to get 'qemu'
+    build_tasks = project.get_build_task_list(
+        build_task_for_qemu_test
+        if args.run_tests
+        else build_task_for_qemu_portable
+    )
+
+    print("BUILD PLAN: %s" % ", ".join([t.__name__ for t in build_tasks]))
+
+    for task in build_tasks:
+      task(build_config)
+
+  return 0
+
+
+if __name__ == "__main__":
+  sys.exit(main())

diff --git a/qemu/scripts/rebuild.sh b/qemu/scripts/rebuild.sh
new file mode 100755
index 0000000..9e00370
--- /dev/null
+++ b/qemu/scripts/rebuild.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+SCRIPT_DIR="$(dirname "$0")"
+export PYTHONPATH=
+export PYTHONHOME=
+exec "${SCRIPT_DIR}/../third_party/python/bin/python3" -S "${SCRIPT_DIR}"/rebuild.py "$@"

diff --git a/qemu/third_party/.cargo/config.toml b/qemu/third_party/.cargo/config.toml
new file mode 100644
index 0000000..23c7e2e
--- /dev/null
+++ b/qemu/third_party/.cargo/config.toml

@@ -0,0 +1,26 @@
+[patch.crates-io]
+anyhow = { path = "rust/crates/anyhow" }
+autocfg = { path = "rust/crates/autocfg" }
+bitflags = { path = "rust/crates/bitflags" }
+byteorder = { path = "rust/crates/byteorder" }
+cfg-if = { path = "rust/crates/cfg-if" }
+libc = { path = "rust/crates/libc" }
+log = { path = "rust/crates/log" }
+memoffset = { path = "rust/crates/memoffset" }
+nix = { path = "rust/crates/nix" }
+once_cell = { path = "rust/crates/once_cell" }
+pin-utils = { path = "rust/crates/pin-utils" }
+pkg-config = { path = "rust/crates/pkg-config" }
+proc-macro2 = { path = "rust/crates/proc-macro2" }
+quote = { path = "rust/crates/quote" }
+remain = { path = "rust/crates/remain" }
+serde = { path = "rust/crates/serde" }
+serde_derive = { path = "rust/crates/serde_derive" }
+static_assertions = { path = "rust/crates/static_assertions" }
+syn = { path = "rust/crates/syn" }
+thiserror = { path = "rust/crates/thiserror" }
+thiserror-impl = { path = "rust/crates/thiserror-impl" }
+unicode-ident = { path = "rust/crates/unicode-ident" }
+winapi = { path = "rust/crates/winapi" }
+zerocopy = { path = "rust/crates/zerocopy" }
+zerocopy-derive = { path = "rust/crates/zerocopy-derive" }

diff --git a/qemu/third_party/gfxstream-build/CMakeLists.txt b/qemu/third_party/gfxstream-build/CMakeLists.txt
new file mode 100644
index 0000000..9504b8f
--- /dev/null
+++ b/qemu/third_party/gfxstream-build/CMakeLists.txt

@@ -0,0 +1,12 @@
+cmake_minimum_required(VERSION 3.22)
+project(gfx-streaming-kit)
+
+# The shared library will search for `.so` dependencies
+# in the same directory as the file. This is useful to
+# find libc++.so.1
+set(CMAKE_BUILD_WITH_INSTALL_RPATH true)
+set(CMAKE_INSTALL_RPATH "$ORIGIN")
+add_library(gfxstream_egl_headers INTERFACE)
+target_include_directories(gfxstream_egl_headers INTERFACE "egl/api")
+
+add_subdirectory(gfxstream)
\ No newline at end of file

diff --git a/qemu/third_party/gfxstream-build/egl b/qemu/third_party/gfxstream-build/egl
new file mode 120000
index 0000000..34539d4
--- /dev/null
+++ b/qemu/third_party/gfxstream-build/egl

@@ -0,0 +1 @@
+../egl
\ No newline at end of file

diff --git a/qemu/third_party/gfxstream-build/gfxstream b/qemu/third_party/gfxstream-build/gfxstream
new file mode 120000
index 0000000..b40b293
--- /dev/null
+++ b/qemu/third_party/gfxstream-build/gfxstream

@@ -0,0 +1 @@
+../gfxstream
\ No newline at end of file

diff --git a/qemu/third_party/rust/crates/autocfg/Cargo.toml b/qemu/third_party/rust/crates/autocfg/Cargo.toml
new file mode 100644
index 0000000..c2f7d35
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "autocfg"
+version = "1.1.0"
+authors = ["Josh Stone <cuviper@gmail.com>"]
+license = "Apache-2.0 OR MIT"
+repository = "https://github.com/cuviper/autocfg"
+documentation = "https://docs.rs/autocfg/"
+description = "Automatic cfg for Rust compiler features"
+readme = "README.md"
+keywords = ["rustc", "build", "autoconf"]
+categories = ["development-tools::build-utils"]
+exclude = ["/.github/**", "/bors.toml"]
+
+[dependencies]

diff --git a/qemu/third_party/rust/crates/autocfg/LICENSE-APACHE b/qemu/third_party/rust/crates/autocfg/LICENSE-APACHE
new file mode 100644
index 0000000..16fe87b
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

diff --git a/qemu/third_party/rust/crates/autocfg/LICENSE-MIT b/qemu/third_party/rust/crates/autocfg/LICENSE-MIT
new file mode 100644
index 0000000..44fbc4d
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/LICENSE-MIT

@@ -0,0 +1,25 @@
+Copyright (c) 2018 Josh Stone
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

diff --git a/qemu/third_party/rust/crates/autocfg/README.md b/qemu/third_party/rust/crates/autocfg/README.md
new file mode 100644
index 0000000..fa02067
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/README.md

@@ -0,0 +1,95 @@
+autocfg
+=======
+
+[![autocfg crate](https://img.shields.io/crates/v/autocfg.svg)](https://crates.io/crates/autocfg)
+[![autocfg documentation](https://docs.rs/autocfg/badge.svg)](https://docs.rs/autocfg)
+![minimum rustc 1.0](https://img.shields.io/badge/rustc-1.0+-red.svg)
+![build status](https://github.com/cuviper/autocfg/workflows/master/badge.svg)
+
+A Rust library for build scripts to automatically configure code based on
+compiler support.  Code snippets are dynamically tested to see if the `rustc`
+will accept them, rather than hard-coding specific version support.
+
+
+## Usage
+
+Add this to your `Cargo.toml`:
+
+```toml
+[build-dependencies]
+autocfg = "1"
+```
+
+Then use it in your `build.rs` script to detect compiler features.  For
+example, to test for 128-bit integer support, it might look like:
+
+```rust
+extern crate autocfg;
+
+fn main() {
+    let ac = autocfg::new();
+    ac.emit_has_type("i128");
+
+    // (optional) We don't need to rerun for anything external.
+    autocfg::rerun_path("build.rs");
+}
+```
+
+If the type test succeeds, this will write a `cargo:rustc-cfg=has_i128` line
+for Cargo, which translates to Rust arguments `--cfg has_i128`.  Then in the
+rest of your Rust code, you can add `#[cfg(has_i128)]` conditions on code that
+should only be used when the compiler supports it.
+
+
+## Release Notes
+
+- 1.1.0 (2022-02-07)
+  - Use `CARGO_ENCODED_RUSTFLAGS` when it is set.
+
+- 1.0.1 (2020-08-20)
+  - Apply `RUSTFLAGS` for more `--target` scenarios, by @adamreichold.
+
+- 1.0.0 (2020-01-08)
+  - 🎉 Release 1.0! 🎉 (no breaking changes)
+  - Add `probe_expression` and `emit_expression_cfg` to test arbitrary expressions.
+  - Add `probe_constant` and `emit_constant_cfg` to test arbitrary constant expressions.
+
+- 0.1.7 (2019-10-20)
+  - Apply `RUSTFLAGS` when probing `$TARGET != $HOST`, mainly for sysroot, by @roblabla.
+
+- 0.1.6 (2019-08-19)
+  - Add `probe`/`emit_sysroot_crate`, by @leo60228.
+
+- 0.1.5 (2019-07-16)
+  - Mask some warnings from newer rustc.
+
+- 0.1.4 (2019-05-22)
+  - Relax `std`/`no_std` probing to a warning instead of an error.
+  - Improve `rustc` bootstrap compatibility.
+
+- 0.1.3 (2019-05-21)
+  - Auto-detects if `#![no_std]` is needed for the `$TARGET`.
+
+- 0.1.2 (2019-01-16)
+  - Add `rerun_env(ENV)` to print `cargo:rerun-if-env-changed=ENV`.
+  - Add `rerun_path(PATH)` to print `cargo:rerun-if-changed=PATH`.
+
+
+## Minimum Rust version policy
+
+This crate's minimum supported `rustc` version is `1.0.0`.  Compatibility is
+its entire reason for existence, so this crate will be extremely conservative
+about raising this requirement.  If this is ever deemed necessary, it will be
+treated as a major breaking change for semver purposes.
+
+
+## License
+
+This project is licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   https://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or
+   https://opensource.org/licenses/MIT)
+
+at your option.

diff --git a/qemu/third_party/rust/crates/autocfg/bors.toml b/qemu/third_party/rust/crates/autocfg/bors.toml
new file mode 100644
index 0000000..4ff6203
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/bors.toml

@@ -0,0 +1,21 @@
+status = [
+  "Test (1.0.0)",
+  "Test (1.5.0)",
+  "Test (1.10.0)",
+  "Test (1.15.0)",
+  "Test (1.20.0)",
+  "Test (1.25.0)",
+  "Test (1.30.0)",
+  "Test (1.35.0)",
+  "Test (1.40.0)",
+  "Test (1.45.0)",
+  "Test (1.50.0)",
+  "Test (1.55.0)",
+  "Test (1.60.0)",
+  "Test (stable)",
+  "Test (beta)",
+  "Test (nightly)",
+  "No Std",
+  "Missing Target",
+  "Format",
+]

diff --git a/qemu/third_party/rust/crates/autocfg/examples/integers.rs b/qemu/third_party/rust/crates/autocfg/examples/integers.rs
new file mode 100644
index 0000000..23d4cba
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/examples/integers.rs

@@ -0,0 +1,9 @@
+extern crate autocfg;
+
+fn main() {
+    // Normally, cargo will set `OUT_DIR` for build scripts.
+    let ac = autocfg::AutoCfg::with_dir("target").unwrap();
+    for i in 3..8 {
+        ac.emit_has_type(&format!("i{}", 1 << i));
+    }
+}

diff --git a/qemu/third_party/rust/crates/autocfg/examples/paths.rs b/qemu/third_party/rust/crates/autocfg/examples/paths.rs
new file mode 100644
index 0000000..b7a6ca7
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/examples/paths.rs

@@ -0,0 +1,22 @@
+extern crate autocfg;
+
+fn main() {
+    // Normally, cargo will set `OUT_DIR` for build scripts.
+    let ac = autocfg::AutoCfg::with_dir("target").unwrap();
+
+    // since ancient times...
+    ac.emit_has_path("std::vec::Vec");
+    ac.emit_path_cfg("std::vec::Vec", "has_vec");
+
+    // rustc 1.10.0
+    ac.emit_has_path("std::panic::PanicInfo");
+    ac.emit_path_cfg("std::panic::PanicInfo", "has_panic_info");
+
+    // rustc 1.20.0
+    ac.emit_has_path("std::mem::ManuallyDrop");
+    ac.emit_path_cfg("std::mem::ManuallyDrop", "has_manually_drop");
+
+    // rustc 1.25.0
+    ac.emit_has_path("std::ptr::NonNull");
+    ac.emit_path_cfg("std::ptr::NonNull", "has_non_null");
+}

diff --git a/qemu/third_party/rust/crates/autocfg/examples/traits.rs b/qemu/third_party/rust/crates/autocfg/examples/traits.rs
new file mode 100644
index 0000000..c1ca003
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/examples/traits.rs

@@ -0,0 +1,26 @@
+extern crate autocfg;
+
+fn main() {
+    // Normally, cargo will set `OUT_DIR` for build scripts.
+    let ac = autocfg::AutoCfg::with_dir("target").unwrap();
+
+    // since ancient times...
+    ac.emit_has_trait("std::ops::Add");
+    ac.emit_trait_cfg("std::ops::Add", "has_ops");
+
+    // trait parameters have to be provided
+    ac.emit_has_trait("std::borrow::Borrow<str>");
+    ac.emit_trait_cfg("std::borrow::Borrow<str>", "has_borrow");
+
+    // rustc 1.8.0
+    ac.emit_has_trait("std::ops::AddAssign");
+    ac.emit_trait_cfg("std::ops::AddAssign", "has_assign_ops");
+
+    // rustc 1.12.0
+    ac.emit_has_trait("std::iter::Sum");
+    ac.emit_trait_cfg("std::iter::Sum", "has_sum");
+
+    // rustc 1.28.0
+    ac.emit_has_trait("std::alloc::GlobalAlloc");
+    ac.emit_trait_cfg("std::alloc::GlobalAlloc", "has_global_alloc");
+}

diff --git a/qemu/third_party/rust/crates/autocfg/examples/versions.rs b/qemu/third_party/rust/crates/autocfg/examples/versions.rs
new file mode 100644
index 0000000..992919b
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/examples/versions.rs

@@ -0,0 +1,9 @@
+extern crate autocfg;
+
+fn main() {
+    // Normally, cargo will set `OUT_DIR` for build scripts.
+    let ac = autocfg::AutoCfg::with_dir("target").unwrap();
+    for i in 0..100 {
+        ac.emit_rustc_version(1, i);
+    }
+}

diff --git a/qemu/third_party/rust/crates/autocfg/src/error.rs b/qemu/third_party/rust/crates/autocfg/src/error.rs
new file mode 100644
index 0000000..4624835
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/src/error.rs

@@ -0,0 +1,69 @@
+use std::error;
+use std::fmt;
+use std::io;
+use std::num;
+use std::str;
+
+/// A common error type for the `autocfg` crate.
+#[derive(Debug)]
+pub struct Error {
+    kind: ErrorKind,
+}
+
+impl error::Error for Error {
+    fn description(&self) -> &str {
+        "AutoCfg error"
+    }
+
+    fn cause(&self) -> Option<&error::Error> {
+        match self.kind {
+            ErrorKind::Io(ref e) => Some(e),
+            ErrorKind::Num(ref e) => Some(e),
+            ErrorKind::Utf8(ref e) => Some(e),
+            ErrorKind::Other(_) => None,
+        }
+    }
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+        match self.kind {
+            ErrorKind::Io(ref e) => e.fmt(f),
+            ErrorKind::Num(ref e) => e.fmt(f),
+            ErrorKind::Utf8(ref e) => e.fmt(f),
+            ErrorKind::Other(s) => s.fmt(f),
+        }
+    }
+}
+
+#[derive(Debug)]
+enum ErrorKind {
+    Io(io::Error),
+    Num(num::ParseIntError),
+    Utf8(str::Utf8Error),
+    Other(&'static str),
+}
+
+pub fn from_io(e: io::Error) -> Error {
+    Error {
+        kind: ErrorKind::Io(e),
+    }
+}
+
+pub fn from_num(e: num::ParseIntError) -> Error {
+    Error {
+        kind: ErrorKind::Num(e),
+    }
+}
+
+pub fn from_utf8(e: str::Utf8Error) -> Error {
+    Error {
+        kind: ErrorKind::Utf8(e),
+    }
+}
+
+pub fn from_str(s: &'static str) -> Error {
+    Error {
+        kind: ErrorKind::Other(s),
+    }
+}

diff --git a/qemu/third_party/rust/crates/autocfg/src/lib.rs b/qemu/third_party/rust/crates/autocfg/src/lib.rs
new file mode 100644
index 0000000..cbe393a
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/src/lib.rs

@@ -0,0 +1,453 @@
+//! A Rust library for build scripts to automatically configure code based on
+//! compiler support.  Code snippets are dynamically tested to see if the `rustc`
+//! will accept them, rather than hard-coding specific version support.
+//!
+//!
+//! ## Usage
+//!
+//! Add this to your `Cargo.toml`:
+//!
+//! ```toml
+//! [build-dependencies]
+//! autocfg = "1"
+//! ```
+//!
+//! Then use it in your `build.rs` script to detect compiler features.  For
+//! example, to test for 128-bit integer support, it might look like:
+//!
+//! ```rust
+//! extern crate autocfg;
+//!
+//! fn main() {
+//! #   // Normally, cargo will set `OUT_DIR` for build scripts.
+//! #   std::env::set_var("OUT_DIR", "target");
+//!     let ac = autocfg::new();
+//!     ac.emit_has_type("i128");
+//!
+//!     // (optional) We don't need to rerun for anything external.
+//!     autocfg::rerun_path("build.rs");
+//! }
+//! ```
+//!
+//! If the type test succeeds, this will write a `cargo:rustc-cfg=has_i128` line
+//! for Cargo, which translates to Rust arguments `--cfg has_i128`.  Then in the
+//! rest of your Rust code, you can add `#[cfg(has_i128)]` conditions on code that
+//! should only be used when the compiler supports it.
+//!
+//! ## Caution
+//!
+//! Many of the probing methods of `AutoCfg` document the particular template they
+//! use, **subject to change**. The inputs are not validated to make sure they are
+//! semantically correct for their expected use, so it's _possible_ to escape and
+//! inject something unintended. However, such abuse is unsupported and will not
+//! be considered when making changes to the templates.
+
+#![deny(missing_debug_implementations)]
+#![deny(missing_docs)]
+// allow future warnings that can't be fixed while keeping 1.0 compatibility
+#![allow(unknown_lints)]
+#![allow(bare_trait_objects)]
+#![allow(ellipsis_inclusive_range_patterns)]
+
+/// Local macro to avoid `std::try!`, deprecated in Rust 1.39.
+macro_rules! try {
+    ($result:expr) => {
+        match $result {
+            Ok(value) => value,
+            Err(error) => return Err(error),
+        }
+    };
+}
+
+use std::env;
+use std::ffi::OsString;
+use std::fs;
+use std::io::{stderr, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+#[allow(deprecated)]
+use std::sync::atomic::ATOMIC_USIZE_INIT;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+mod error;
+pub use error::Error;
+
+mod version;
+use version::Version;
+
+#[cfg(test)]
+mod tests;
+
+/// Helper to detect compiler features for `cfg` output in build scripts.
+#[derive(Clone, Debug)]
+pub struct AutoCfg {
+    out_dir: PathBuf,
+    rustc: PathBuf,
+    rustc_version: Version,
+    target: Option<OsString>,
+    no_std: bool,
+    rustflags: Vec<String>,
+}
+
+/// Writes a config flag for rustc on standard out.
+///
+/// This looks like: `cargo:rustc-cfg=CFG`
+///
+/// Cargo will use this in arguments to rustc, like `--cfg CFG`.
+pub fn emit(cfg: &str) {
+    println!("cargo:rustc-cfg={}", cfg);
+}
+
+/// Writes a line telling Cargo to rerun the build script if `path` changes.
+///
+/// This looks like: `cargo:rerun-if-changed=PATH`
+///
+/// This requires at least cargo 0.7.0, corresponding to rustc 1.6.0.  Earlier
+/// versions of cargo will simply ignore the directive.
+pub fn rerun_path(path: &str) {
+    println!("cargo:rerun-if-changed={}", path);
+}
+
+/// Writes a line telling Cargo to rerun the build script if the environment
+/// variable `var` changes.
+///
+/// This looks like: `cargo:rerun-if-env-changed=VAR`
+///
+/// This requires at least cargo 0.21.0, corresponding to rustc 1.20.0.  Earlier
+/// versions of cargo will simply ignore the directive.
+pub fn rerun_env(var: &str) {
+    println!("cargo:rerun-if-env-changed={}", var);
+}
+
+/// Create a new `AutoCfg` instance.
+///
+/// # Panics
+///
+/// Panics if `AutoCfg::new()` returns an error.
+pub fn new() -> AutoCfg {
+    AutoCfg::new().unwrap()
+}
+
+impl AutoCfg {
+    /// Create a new `AutoCfg` instance.
+    ///
+    /// # Common errors
+    ///
+    /// - `rustc` can't be executed, from `RUSTC` or in the `PATH`.
+    /// - The version output from `rustc` can't be parsed.
+    /// - `OUT_DIR` is not set in the environment, or is not a writable directory.
+    ///
+    pub fn new() -> Result<Self, Error> {
+        match env::var_os("OUT_DIR") {
+            Some(d) => Self::with_dir(d),
+            None => Err(error::from_str("no OUT_DIR specified!")),
+        }
+    }
+
+    /// Create a new `AutoCfg` instance with the specified output directory.
+    ///
+    /// # Common errors
+    ///
+    /// - `rustc` can't be executed, from `RUSTC` or in the `PATH`.
+    /// - The version output from `rustc` can't be parsed.
+    /// - `dir` is not a writable directory.
+    ///
+    pub fn with_dir<T: Into<PathBuf>>(dir: T) -> Result<Self, Error> {
+        let rustc = env::var_os("RUSTC").unwrap_or_else(|| "rustc".into());
+        let rustc: PathBuf = rustc.into();
+        let rustc_version = try!(Version::from_rustc(&rustc));
+
+        let target = env::var_os("TARGET");
+
+        // Sanity check the output directory
+        let dir = dir.into();
+        let meta = try!(fs::metadata(&dir).map_err(error::from_io));
+        if !meta.is_dir() || meta.permissions().readonly() {
+            return Err(error::from_str("output path is not a writable directory"));
+        }
+
+        let mut ac = AutoCfg {
+            rustflags: rustflags(&target, &dir),
+            out_dir: dir,
+            rustc: rustc,
+            rustc_version: rustc_version,
+            target: target,
+            no_std: false,
+        };
+
+        // Sanity check with and without `std`.
+        if !ac.probe("").unwrap_or(false) {
+            ac.no_std = true;
+            if !ac.probe("").unwrap_or(false) {
+                // Neither worked, so assume nothing...
+                ac.no_std = false;
+                let warning = b"warning: autocfg could not probe for `std`\n";
+                stderr().write_all(warning).ok();
+            }
+        }
+        Ok(ac)
+    }
+
+    /// Test whether the current `rustc` reports a version greater than
+    /// or equal to "`major`.`minor`".
+    pub fn probe_rustc_version(&self, major: usize, minor: usize) -> bool {
+        self.rustc_version >= Version::new(major, minor, 0)
+    }
+
+    /// Sets a `cfg` value of the form `rustc_major_minor`, like `rustc_1_29`,
+    /// if the current `rustc` is at least that version.
+    pub fn emit_rustc_version(&self, major: usize, minor: usize) {
+        if self.probe_rustc_version(major, minor) {
+            emit(&format!("rustc_{}_{}", major, minor));
+        }
+    }
+
+    fn probe<T: AsRef<[u8]>>(&self, code: T) -> Result<bool, Error> {
+        #[allow(deprecated)]
+        static ID: AtomicUsize = ATOMIC_USIZE_INIT;
+
+        let id = ID.fetch_add(1, Ordering::Relaxed);
+        let mut command = Command::new(&self.rustc);
+        command
+            .arg("--crate-name")
+            .arg(format!("probe{}", id))
+            .arg("--crate-type=lib")
+            .arg("--out-dir")
+            .arg(&self.out_dir)
+            .arg("--emit=llvm-ir");
+
+        if let Some(target) = self.target.as_ref() {
+            command.arg("--target").arg(target);
+        }
+
+        command.args(&self.rustflags);
+
+        command.arg("-").stdin(Stdio::piped());
+        let mut child = try!(command.spawn().map_err(error::from_io));
+        let mut stdin = child.stdin.take().expect("rustc stdin");
+
+        if self.no_std {
+            try!(stdin.write_all(b"#![no_std]\n").map_err(error::from_io));
+        }
+        try!(stdin.write_all(code.as_ref()).map_err(error::from_io));
+        drop(stdin);
+
+        let status = try!(child.wait().map_err(error::from_io));
+        Ok(status.success())
+    }
+
+    /// Tests whether the given sysroot crate can be used.
+    ///
+    /// The test code is subject to change, but currently looks like:
+    ///
+    /// ```ignore
+    /// extern crate CRATE as probe;
+    /// ```
+    pub fn probe_sysroot_crate(&self, name: &str) -> bool {
+        self.probe(format!("extern crate {} as probe;", name)) // `as _` wasn't stabilized until Rust 1.33
+            .unwrap_or(false)
+    }
+
+    /// Emits a config value `has_CRATE` if `probe_sysroot_crate` returns true.
+    pub fn emit_sysroot_crate(&self, name: &str) {
+        if self.probe_sysroot_crate(name) {
+            emit(&format!("has_{}", mangle(name)));
+        }
+    }
+
+    /// Tests whether the given path can be used.
+    ///
+    /// The test code is subject to change, but currently looks like:
+    ///
+    /// ```ignore
+    /// pub use PATH;
+    /// ```
+    pub fn probe_path(&self, path: &str) -> bool {
+        self.probe(format!("pub use {};", path)).unwrap_or(false)
+    }
+
+    /// Emits a config value `has_PATH` if `probe_path` returns true.
+    ///
+    /// Any non-identifier characters in the `path` will be replaced with
+    /// `_` in the generated config value.
+    pub fn emit_has_path(&self, path: &str) {
+        if self.probe_path(path) {
+            emit(&format!("has_{}", mangle(path)));
+        }
+    }
+
+    /// Emits the given `cfg` value if `probe_path` returns true.
+    pub fn emit_path_cfg(&self, path: &str, cfg: &str) {
+        if self.probe_path(path) {
+            emit(cfg);
+        }
+    }
+
+    /// Tests whether the given trait can be used.
+    ///
+    /// The test code is subject to change, but currently looks like:
+    ///
+    /// ```ignore
+    /// pub trait Probe: TRAIT + Sized {}
+    /// ```
+    pub fn probe_trait(&self, name: &str) -> bool {
+        self.probe(format!("pub trait Probe: {} + Sized {{}}", name))
+            .unwrap_or(false)
+    }
+
+    /// Emits a config value `has_TRAIT` if `probe_trait` returns true.
+    ///
+    /// Any non-identifier characters in the trait `name` will be replaced with
+    /// `_` in the generated config value.
+    pub fn emit_has_trait(&self, name: &str) {
+        if self.probe_trait(name) {
+            emit(&format!("has_{}", mangle(name)));
+        }
+    }
+
+    /// Emits the given `cfg` value if `probe_trait` returns true.
+    pub fn emit_trait_cfg(&self, name: &str, cfg: &str) {
+        if self.probe_trait(name) {
+            emit(cfg);
+        }
+    }
+
+    /// Tests whether the given type can be used.
+    ///
+    /// The test code is subject to change, but currently looks like:
+    ///
+    /// ```ignore
+    /// pub type Probe = TYPE;
+    /// ```
+    pub fn probe_type(&self, name: &str) -> bool {
+        self.probe(format!("pub type Probe = {};", name))
+            .unwrap_or(false)
+    }
+
+    /// Emits a config value `has_TYPE` if `probe_type` returns true.
+    ///
+    /// Any non-identifier characters in the type `name` will be replaced with
+    /// `_` in the generated config value.
+    pub fn emit_has_type(&self, name: &str) {
+        if self.probe_type(name) {
+            emit(&format!("has_{}", mangle(name)));
+        }
+    }
+
+    /// Emits the given `cfg` value if `probe_type` returns true.
+    pub fn emit_type_cfg(&self, name: &str, cfg: &str) {
+        if self.probe_type(name) {
+            emit(cfg);
+        }
+    }
+
+    /// Tests whether the given expression can be used.
+    ///
+    /// The test code is subject to change, but currently looks like:
+    ///
+    /// ```ignore
+    /// pub fn probe() { let _ = EXPR; }
+    /// ```
+    pub fn probe_expression(&self, expr: &str) -> bool {
+        self.probe(format!("pub fn probe() {{ let _ = {}; }}", expr))
+            .unwrap_or(false)
+    }
+
+    /// Emits the given `cfg` value if `probe_expression` returns true.
+    pub fn emit_expression_cfg(&self, expr: &str, cfg: &str) {
+        if self.probe_expression(expr) {
+            emit(cfg);
+        }
+    }
+
+    /// Tests whether the given constant expression can be used.
+    ///
+    /// The test code is subject to change, but currently looks like:
+    ///
+    /// ```ignore
+    /// pub const PROBE: () = ((), EXPR).0;
+    /// ```
+    pub fn probe_constant(&self, expr: &str) -> bool {
+        self.probe(format!("pub const PROBE: () = ((), {}).0;", expr))
+            .unwrap_or(false)
+    }
+
+    /// Emits the given `cfg` value if `probe_constant` returns true.
+    pub fn emit_constant_cfg(&self, expr: &str, cfg: &str) {
+        if self.probe_constant(expr) {
+            emit(cfg);
+        }
+    }
+}
+
+fn mangle(s: &str) -> String {
+    s.chars()
+        .map(|c| match c {
+            'A'...'Z' | 'a'...'z' | '0'...'9' => c,
+            _ => '_',
+        })
+        .collect()
+}
+
+fn dir_contains_target(
+    target: &Option<OsString>,
+    dir: &Path,
+    cargo_target_dir: Option<OsString>,
+) -> bool {
+    target
+        .as_ref()
+        .and_then(|target| {
+            dir.to_str().and_then(|dir| {
+                let mut cargo_target_dir = cargo_target_dir
+                    .map(PathBuf::from)
+                    .unwrap_or_else(|| PathBuf::from("target"));
+                cargo_target_dir.push(target);
+
+                cargo_target_dir
+                    .to_str()
+                    .map(|cargo_target_dir| dir.contains(&cargo_target_dir))
+            })
+        })
+        .unwrap_or(false)
+}
+
+fn rustflags(target: &Option<OsString>, dir: &Path) -> Vec<String> {
+    // Starting with rust-lang/cargo#9601, shipped in Rust 1.55, Cargo always sets
+    // CARGO_ENCODED_RUSTFLAGS for any host/target build script invocation. This
+    // includes any source of flags, whether from the environment, toml config, or
+    // whatever may come in the future. The value is either an empty string, or a
+    // list of arguments separated by the ASCII unit separator (US), 0x1f.
+    if let Ok(a) = env::var("CARGO_ENCODED_RUSTFLAGS") {
+        return if a.is_empty() {
+            Vec::new()
+        } else {
+            a.split('\x1f').map(str::to_string).collect()
+        };
+    }
+
+    // Otherwise, we have to take a more heuristic approach, and we don't
+    // support values from toml config at all.
+    //
+    // Cargo only applies RUSTFLAGS for building TARGET artifact in
+    // cross-compilation environment. Sadly, we don't have a way to detect
+    // when we're building HOST artifact in a cross-compilation environment,
+    // so for now we only apply RUSTFLAGS when cross-compiling an artifact.
+    //
+    // See https://github.com/cuviper/autocfg/pull/10#issuecomment-527575030.
+    if *target != env::var_os("HOST")
+        || dir_contains_target(target, dir, env::var_os("CARGO_TARGET_DIR"))
+    {
+        if let Ok(rustflags) = env::var("RUSTFLAGS") {
+            // This is meant to match how cargo handles the RUSTFLAGS environment variable.
+            // See https://github.com/rust-lang/cargo/blob/69aea5b6f69add7c51cca939a79644080c0b0ba0/src/cargo/core/compiler/build_context/target_info.rs#L434-L441
+            return rustflags
+                .split(' ')
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map(str::to_string)
+                .collect();
+        }
+    }
+
+    Vec::new()
+}

diff --git a/qemu/third_party/rust/crates/autocfg/src/tests.rs b/qemu/third_party/rust/crates/autocfg/src/tests.rs
new file mode 100644
index 0000000..d3b1fbb
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/src/tests.rs

@@ -0,0 +1,174 @@
+use super::AutoCfg;
+use std::env;
+use std::path::Path;
+
+impl AutoCfg {
+    fn core_std(&self, path: &str) -> String {
+        let krate = if self.no_std { "core" } else { "std" };
+        format!("{}::{}", krate, path)
+    }
+
+    fn assert_std(&self, probe_result: bool) {
+        assert_eq!(!self.no_std, probe_result);
+    }
+
+    fn assert_min(&self, major: usize, minor: usize, probe_result: bool) {
+        assert_eq!(self.probe_rustc_version(major, minor), probe_result);
+    }
+
+    fn for_test() -> Result<Self, super::error::Error> {
+        match env::var_os("TESTS_TARGET_DIR") {
+            Some(d) => Self::with_dir(d),
+            None => Self::with_dir("target"),
+        }
+    }
+}
+
+#[test]
+fn autocfg_version() {
+    let ac = AutoCfg::for_test().unwrap();
+    println!("version: {:?}", ac.rustc_version);
+    assert!(ac.probe_rustc_version(1, 0));
+}
+
+#[test]
+fn version_cmp() {
+    use super::version::Version;
+    let v123 = Version::new(1, 2, 3);
+
+    assert!(Version::new(1, 0, 0) < v123);
+    assert!(Version::new(1, 2, 2) < v123);
+    assert!(Version::new(1, 2, 3) == v123);
+    assert!(Version::new(1, 2, 4) > v123);
+    assert!(Version::new(1, 10, 0) > v123);
+    assert!(Version::new(2, 0, 0) > v123);
+}
+
+#[test]
+fn probe_add() {
+    let ac = AutoCfg::for_test().unwrap();
+    let add = ac.core_std("ops::Add");
+    let add_rhs = add.clone() + "<i32>";
+    let add_rhs_output = add.clone() + "<i32, Output = i32>";
+    let dyn_add_rhs_output = "dyn ".to_string() + &*add_rhs_output;
+    assert!(ac.probe_path(&add));
+    assert!(ac.probe_trait(&add));
+    assert!(ac.probe_trait(&add_rhs));
+    assert!(ac.probe_trait(&add_rhs_output));
+    ac.assert_min(1, 27, ac.probe_type(&dyn_add_rhs_output));
+}
+
+#[test]
+fn probe_as_ref() {
+    let ac = AutoCfg::for_test().unwrap();
+    let as_ref = ac.core_std("convert::AsRef");
+    let as_ref_str = as_ref.clone() + "<str>";
+    let dyn_as_ref_str = "dyn ".to_string() + &*as_ref_str;
+    assert!(ac.probe_path(&as_ref));
+    assert!(ac.probe_trait(&as_ref_str));
+    assert!(ac.probe_type(&as_ref_str));
+    ac.assert_min(1, 27, ac.probe_type(&dyn_as_ref_str));
+}
+
+#[test]
+fn probe_i128() {
+    let ac = AutoCfg::for_test().unwrap();
+    let i128_path = ac.core_std("i128");
+    ac.assert_min(1, 26, ac.probe_path(&i128_path));
+    ac.assert_min(1, 26, ac.probe_type("i128"));
+}
+
+#[test]
+fn probe_sum() {
+    let ac = AutoCfg::for_test().unwrap();
+    let sum = ac.core_std("iter::Sum");
+    let sum_i32 = sum.clone() + "<i32>";
+    let dyn_sum_i32 = "dyn ".to_string() + &*sum_i32;
+    ac.assert_min(1, 12, ac.probe_path(&sum));
+    ac.assert_min(1, 12, ac.probe_trait(&sum));
+    ac.assert_min(1, 12, ac.probe_trait(&sum_i32));
+    ac.assert_min(1, 12, ac.probe_type(&sum_i32));
+    ac.assert_min(1, 27, ac.probe_type(&dyn_sum_i32));
+}
+
+#[test]
+fn probe_std() {
+    let ac = AutoCfg::for_test().unwrap();
+    ac.assert_std(ac.probe_sysroot_crate("std"));
+}
+
+#[test]
+fn probe_alloc() {
+    let ac = AutoCfg::for_test().unwrap();
+    ac.assert_min(1, 36, ac.probe_sysroot_crate("alloc"));
+}
+
+#[test]
+fn probe_bad_sysroot_crate() {
+    let ac = AutoCfg::for_test().unwrap();
+    assert!(!ac.probe_sysroot_crate("doesnt_exist"));
+}
+
+#[test]
+fn probe_no_std() {
+    let ac = AutoCfg::for_test().unwrap();
+    assert!(ac.probe_type("i32"));
+    assert!(ac.probe_type("[i32]"));
+    ac.assert_std(ac.probe_type("Vec<i32>"));
+}
+
+#[test]
+fn probe_expression() {
+    let ac = AutoCfg::for_test().unwrap();
+    assert!(ac.probe_expression(r#""test".trim_left()"#));
+    ac.assert_min(1, 30, ac.probe_expression(r#""test".trim_start()"#));
+    ac.assert_std(ac.probe_expression("[1, 2, 3].to_vec()"));
+}
+
+#[test]
+fn probe_constant() {
+    let ac = AutoCfg::for_test().unwrap();
+    assert!(ac.probe_constant("1 + 2 + 3"));
+    ac.assert_min(1, 33, ac.probe_constant("{ let x = 1 + 2 + 3; x * x }"));
+    ac.assert_min(1, 39, ac.probe_constant(r#""test".len()"#));
+}
+
+#[test]
+fn dir_does_not_contain_target() {
+    assert!(!super::dir_contains_target(
+        &Some("x86_64-unknown-linux-gnu".into()),
+        Path::new("/project/target/debug/build/project-ea75983148559682/out"),
+        None,
+    ));
+}
+
+#[test]
+fn dir_does_contain_target() {
+    assert!(super::dir_contains_target(
+        &Some("x86_64-unknown-linux-gnu".into()),
+        Path::new(
+            "/project/target/x86_64-unknown-linux-gnu/debug/build/project-0147aca016480b9d/out"
+        ),
+        None,
+    ));
+}
+
+#[test]
+fn dir_does_not_contain_target_with_custom_target_dir() {
+    assert!(!super::dir_contains_target(
+        &Some("x86_64-unknown-linux-gnu".into()),
+        Path::new("/project/custom/debug/build/project-ea75983148559682/out"),
+        Some("custom".into()),
+    ));
+}
+
+#[test]
+fn dir_does_contain_target_with_custom_target_dir() {
+    assert!(super::dir_contains_target(
+        &Some("x86_64-unknown-linux-gnu".into()),
+        Path::new(
+            "/project/custom/x86_64-unknown-linux-gnu/debug/build/project-0147aca016480b9d/out"
+        ),
+        Some("custom".into()),
+    ));
+}

diff --git a/qemu/third_party/rust/crates/autocfg/src/version.rs b/qemu/third_party/rust/crates/autocfg/src/version.rs
new file mode 100644
index 0000000..4302e09
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/src/version.rs

@@ -0,0 +1,66 @@
+use std::path::Path;
+use std::process::Command;
+use std::str;
+
+use super::{error, Error};
+
+/// A version structure for making relative comparisons.
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Version {
+    major: usize,
+    minor: usize,
+    patch: usize,
+}
+
+impl Version {
+    /// Creates a `Version` instance for a specific `major.minor.patch` version.
+    pub fn new(major: usize, minor: usize, patch: usize) -> Self {
+        Version {
+            major: major,
+            minor: minor,
+            patch: patch,
+        }
+    }
+
+    pub fn from_rustc(rustc: &Path) -> Result<Self, Error> {
+        // Get rustc's verbose version
+        let output = try!(Command::new(rustc)
+            .args(&["--version", "--verbose"])
+            .output()
+            .map_err(error::from_io));
+        if !output.status.success() {
+            return Err(error::from_str("could not execute rustc"));
+        }
+        let output = try!(str::from_utf8(&output.stdout).map_err(error::from_utf8));
+
+        // Find the release line in the verbose version output.
+        let release = match output.lines().find(|line| line.starts_with("release: ")) {
+            Some(line) => &line["release: ".len()..],
+            None => return Err(error::from_str("could not find rustc release")),
+        };
+
+        // Strip off any extra channel info, e.g. "-beta.N", "-nightly"
+        let version = match release.find('-') {
+            Some(i) => &release[..i],
+            None => release,
+        };
+
+        // Split the version into semver components.
+        let mut iter = version.splitn(3, '.');
+        let major = try!(iter
+            .next()
+            .ok_or_else(|| error::from_str("missing major version")));
+        let minor = try!(iter
+            .next()
+            .ok_or_else(|| error::from_str("missing minor version")));
+        let patch = try!(iter
+            .next()
+            .ok_or_else(|| error::from_str("missing patch version")));
+
+        Ok(Version::new(
+            try!(major.parse().map_err(error::from_num)),
+            try!(minor.parse().map_err(error::from_num)),
+            try!(patch.parse().map_err(error::from_num)),
+        ))
+    }
+}

diff --git a/qemu/third_party/rust/crates/autocfg/tests/rustflags.rs b/qemu/third_party/rust/crates/autocfg/tests/rustflags.rs
new file mode 100644
index 0000000..f054546
--- /dev/null
+++ b/qemu/third_party/rust/crates/autocfg/tests/rustflags.rs

@@ -0,0 +1,33 @@
+extern crate autocfg;
+
+use std::env;
+
+/// Tests that autocfg uses the RUSTFLAGS or CARGO_ENCODED_RUSTFLAGS
+/// environment variables when running rustc.
+#[test]
+fn test_with_sysroot() {
+    // Use the same path as this test binary.
+    let dir = env::current_exe().unwrap().parent().unwrap().to_path_buf();
+    env::set_var("OUT_DIR", &format!("{}", dir.display()));
+
+    // If we have encoded rustflags, they take precedence, even if empty.
+    env::set_var("CARGO_ENCODED_RUSTFLAGS", "");
+    env::set_var("RUSTFLAGS", &format!("-L {}", dir.display()));
+    let ac = autocfg::AutoCfg::new().unwrap();
+    assert!(ac.probe_sysroot_crate("std"));
+    assert!(!ac.probe_sysroot_crate("autocfg"));
+
+    // Now try again with useful encoded args.
+    env::set_var(
+        "CARGO_ENCODED_RUSTFLAGS",
+        &format!("-L\x1f{}", dir.display()),
+    );
+    let ac = autocfg::AutoCfg::new().unwrap();
+    assert!(ac.probe_sysroot_crate("autocfg"));
+
+    // Try the old-style RUSTFLAGS, ensuring HOST != TARGET.
+    env::remove_var("CARGO_ENCODED_RUSTFLAGS");
+    env::set_var("HOST", "lol");
+    let ac = autocfg::AutoCfg::new().unwrap();
+    assert!(ac.probe_sysroot_crate("autocfg"));
+}

diff --git a/qemu/third_party/rust/crates/pkg-config/CHANGELOG.md b/qemu/third_party/rust/crates/pkg-config/CHANGELOG.md
new file mode 100644
index 0000000..3ea463d
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/CHANGELOG.md

@@ -0,0 +1,163 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.3.26] - 2022-10-26
+
+### Added
+
+- Support for handling full paths to libraries in addition to normal `-l`
+  linker flags (#134).
+
+## [0.3.25] - 2022-03-31
+
+### Added
+
+- Support for parsing `-Wl` linker arguments from the `Libs` lines and
+  passing them to the linker as well as making them available via
+  `Library::ld_args` (#131).
+
+### Changed
+
+- Use SPDX license format and remove obsolete badge info (#129).
+
+## [0.3.24] - 2021-12-11
+
+### Fixed
+
+- Re-add `target_supported()`, which was accidentally removed in 0.3.15 (#128).
+
+## [0.3.23] - 2021-12-06
+
+### Changed
+
+- Improve error messages when a `pkg-config` package can't be found (#127).
+
+## [0.3.22] - 2021-10-24
+
+### Fixed
+
+- `pkg-config` compiles again with Rust 1.30 or newer. 0.3.21 accidentally
+  made use of API only available since 1.40 (#124, #125).
+
+### Changed
+
+- Switched from Travis to GitHub Actions for the CI. Travis is dysfunctional
+  since quite some time (#126).
+
+## [0.3.21] - 2021-10-22
+
+### Fixed
+
+- Tests succeed again on macOS (#122).
+
+### Changed
+
+- Improve error message in case of missing pkg-config and provide instructions
+  how it can be installed (#121).
+
+## [0.3.20] - 2021-09-25
+
+### Fixed
+
+- Use target-specific pkg-config consistently everywhere (#121, #118).
+
+## [0.3.19] - 2020-10-13
+
+### Added
+
+- Add `README.md` to be displayed on crates.io (#111).
+
+- Support for `-isystem`, `-iquote` and `-idirafter` include flags (#115).
+
+### Changed
+
+- Improve documentation for cross-compilation (#113).
+
+- Allow overriding system root via the `PKG_CONFIG_SYSROOT_DIR` or `SYSROOT`
+  environment variable (#82).
+
+## [0.3.18] - 2020-07-11
+
+### Fixed
+
+- Use `env::var_os()` almost everywhere to handle non-UTF8 paths in
+  environment variables, and also improve error handling around environment
+  variable handling (#106).
+
+### Changed
+
+- Default the `env_metadata` build parameter to `true` instead of `false`.
+  Whenever a pkg-config related environment variable changes it would make
+  sense to rebuild crates that use pkg-config, or otherwise changes might not
+  be picked up. As such the previous default didn't make much sense (#105).
+
+## [0.3.17] - 2019-11-02
+
+### Fixed
+
+- Fix support for multiple version number constraints (#95)
+
+## [0.3.16] - 2019-09-09
+
+### Changed
+- Stop using deprecated functions and require Rust 1.30 (#84)
+
+### Fixed
+- Fix repository URL in README.md
+- Fix various clippy warnings
+
+### Added
+- Run `cargo fmt` as part of the CI (#89)
+- Derive `Clone` for `Library` and `Debug` for `Config (#91)
+- Add support for `PKG_CONFIG_ALLOW_SYSTEM_CFLAGS` and enable by default (#93)
+
+## [0.3.15] - 2019-07-25
+
+### Changed
+- Changes minimum documented rust version to 1.28 (#76)
+
+### Fixed
+- Fix Travis CI badge url (#78)
+- Fix project name in README.md (#81)
+
+### Added
+- Support specifying range of versions (#75)
+- Allow cross-compilation if pkg-config is customized (#44, #86)
+
+## [0.3.14] - 2018-08-28
+
+### Fixed
+- Don't append .lib suffix on MSVC builds (#72)
+
+## [0.3.13] - 2018-08-06
+
+### Fixed
+- Fix MSVC support to actually work and consider library paths too (#71)
+
+## [0.3.12] - 2018-06-18
+
+### Added
+- Support for MSVC (#70)
+- Document and test Rust 1.13 as minimally supported version (#66)
+
+## [0.3.11] - 2018-04-24
+
+### Fixed
+- Re-added AsciiExt import (#65)
+
+## [0.3.10] - 2018-04-23
+
+### Added
+- Allow static linking of /usr/ on macOS (#42)
+- Add support for parsing `-Wl,` style framework flags (#48)
+- Parse defines in `pkg-config` output (#49)
+- Rerun on `PKG_CONFIG_PATH` changes (#50)
+- Introduce target-scoped variables (#58)
+- Respect pkg-config escaping rules used with --cflags and --libs (#61)
+
+### Changed
+- Use `?` instead of `try!()` in the codebase (#63)

diff --git a/qemu/third_party/rust/crates/pkg-config/Cargo.toml b/qemu/third_party/rust/crates/pkg-config/Cargo.toml
new file mode 100644
index 0000000..abd63e3
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/Cargo.toml

@@ -0,0 +1,27 @@
+# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
+#
+# When uploading crates to the registry Cargo will automatically
+# "normalize" Cargo.toml files for maximal compatibility
+# with all versions of Cargo and also rewrite `path` dependencies
+# to registry (e.g., crates.io) dependencies.
+#
+# If you are reading this file be aware that the original Cargo.toml
+# will likely look very different (and much more reasonable).
+# See Cargo.toml.orig for the original contents.
+
+[package]
+name = "pkg-config"
+version = "0.3.26"
+authors = ["Alex Crichton <alex@alexcrichton.com>"]
+description = """
+A library to run the pkg-config system tool at build time in order to be used in
+Cargo build scripts.
+"""
+documentation = "https://docs.rs/pkg-config"
+readme = "README.md"
+keywords = ["build-dependencies"]
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/rust-lang/pkg-config-rs"
+
+[dev-dependencies.lazy_static]
+version = "1"

diff --git a/qemu/third_party/rust/crates/pkg-config/Cargo.toml.orig b/qemu/third_party/rust/crates/pkg-config/Cargo.toml.orig
new file mode 100644
index 0000000..335a0bd
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/Cargo.toml.orig

@@ -0,0 +1,17 @@
+[package]
+
+name = "pkg-config"
+version = "0.3.26"
+authors = ["Alex Crichton <alex@alexcrichton.com>"]
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/rust-lang/pkg-config-rs"
+documentation = "https://docs.rs/pkg-config"
+readme = "README.md"
+description = """
+A library to run the pkg-config system tool at build time in order to be used in
+Cargo build scripts.
+"""
+keywords = ["build-dependencies"]
+
+[dev-dependencies]
+lazy_static = "1"

diff --git a/qemu/third_party/rust/crates/pkg-config/LICENSE-APACHE b/qemu/third_party/rust/crates/pkg-config/LICENSE-APACHE
new file mode 100644
index 0000000..16fe87b
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

diff --git a/qemu/third_party/rust/crates/pkg-config/LICENSE-MIT b/qemu/third_party/rust/crates/pkg-config/LICENSE-MIT
new file mode 100644
index 0000000..39e0ed6
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/LICENSE-MIT

@@ -0,0 +1,25 @@
+Copyright (c) 2014 Alex Crichton
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

diff --git a/qemu/third_party/rust/crates/pkg-config/README.md b/qemu/third_party/rust/crates/pkg-config/README.md
new file mode 100644
index 0000000..61f1244
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/README.md

@@ -0,0 +1,79 @@
+# pkg-config-rs
+
+[![Build Status](https://github.com/rust-lang/pkg-config-rs/actions/workflows/ci.yml/badge.svg)](https://github.com/rust-lang/pkg-config-rs/actions)
+[![Rust](https://img.shields.io/badge/rust-1.30%2B-blue.svg?maxAge=3600)](https://github.com/rust-lang/pkg-config-rs/)
+
+[Documentation](https://docs.rs/pkg-config)
+
+A simple library meant to be used as a build dependency with Cargo packages in
+order to use the system `pkg-config` tool (if available) to determine where a
+library is located.
+
+You can use this crate directly to probe for specific libraries, or use
+[system-deps](https://github.com/gdesmott/system-deps) to declare all your
+`pkg-config` dependencies in `Cargo.toml`.
+
+This library requires Rust 1.30+.
+
+# Example
+
+Find the system library named `foo`, with minimum version 1.2.3:
+
+```rust
+extern crate pkg_config;
+
+fn main() {
+    pkg_config::Config::new().atleast_version("1.2.3").probe("foo").unwrap();
+}
+```
+
+Find the system library named `foo`, with no version requirement (not
+recommended):
+
+```rust
+extern crate pkg_config;
+
+fn main() {
+    pkg_config::probe_library("foo").unwrap();
+}
+```
+
+# External configuration via target-scoped environment variables
+
+In cross-compilation context, it is useful to manage separately `PKG_CONFIG_PATH`
+and a few other variables for the `host` and the `target` platform.
+
+The supported variables are: `PKG_CONFIG_PATH`, `PKG_CONFIG_LIBDIR`, and
+`PKG_CONFIG_SYSROOT_DIR`.
+
+Each of these variables can also be supplied with certain prefixes and suffixes, in the following prioritized order:
+
+1. `<var>_<target>` - for example, `PKG_CONFIG_PATH_x86_64-unknown-linux-gnu`
+2. `<var>_<target_with_underscores>` - for example, `PKG_CONFIG_PATH_x86_64_unknown_linux_gnu`
+3. `<build-kind>_<var>` - for example, `HOST_PKG_CONFIG_PATH` or `TARGET_PKG_CONFIG_PATH`
+4. `<var>` - a plain `PKG_CONFIG_PATH`
+
+This crate will allow `pkg-config` to be used in cross-compilation
+if `PKG_CONFIG_SYSROOT_DIR` or `PKG_CONFIG` is set. You can set `PKG_CONFIG_ALLOW_CROSS=1`
+to bypass the compatibility check, but please note that enabling use of `pkg-config` in
+cross-compilation without appropriate sysroot and search paths set is likely to break builds.
+
+Some Rust sys crates support building vendored libraries from source, which may be a work
+around for lack of cross-compilation support in `pkg-config`.
+
+# License
+
+This project is licensed under either of
+
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   https://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or
+   https://opensource.org/licenses/MIT)
+
+at your option.
+
+### Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally submitted
+for inclusion in pkg-config-rs by you, as defined in the Apache-2.0 license, shall be
+dual licensed as above, without any additional terms or conditions.

diff --git a/qemu/third_party/rust/crates/pkg-config/src/lib.rs b/qemu/third_party/rust/crates/pkg-config/src/lib.rs
new file mode 100644
index 0000000..f04b344
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/src/lib.rs

@@ -0,0 +1,972 @@
+//! A build dependency for Cargo libraries to find system artifacts through the
+//! `pkg-config` utility.
+//!
+//! This library will shell out to `pkg-config` as part of build scripts and
+//! probe the system to determine how to link to a specified library. The
+//! `Config` structure serves as a method of configuring how `pkg-config` is
+//! invoked in a builder style.
+//!
+//! A number of environment variables are available to globally configure how
+//! this crate will invoke `pkg-config`:
+//!
+//! * `FOO_NO_PKG_CONFIG` - if set, this will disable running `pkg-config` when
+//!   probing for the library named `foo`.
+//!
+//! * `PKG_CONFIG_ALLOW_CROSS` - The `pkg-config` command usually doesn't
+//!   support cross-compilation, and this crate prevents it from selecting
+//!   incompatible versions of libraries.
+//!   Setting `PKG_CONFIG_ALLOW_CROSS=1` disables this protection, which is
+//!   likely to cause linking errors, unless `pkg-config` has been configured
+//!   to use appropriate sysroot and search paths for the target platform.
+//!
+//! There are also a number of environment variables which can configure how a
+//! library is linked to (dynamically vs statically). These variables control
+//! whether the `--static` flag is passed. Note that this behavior can be
+//! overridden by configuring explicitly on `Config`. The variables are checked
+//! in the following order:
+//!
+//! * `FOO_STATIC` - pass `--static` for the library `foo`
+//! * `FOO_DYNAMIC` - do not pass `--static` for the library `foo`
+//! * `PKG_CONFIG_ALL_STATIC` - pass `--static` for all libraries
+//! * `PKG_CONFIG_ALL_DYNAMIC` - do not pass `--static` for all libraries
+//!
+//! After running `pkg-config` all appropriate Cargo metadata will be printed on
+//! stdout if the search was successful.
+//!
+//! # Example
+//!
+//! Find the system library named `foo`, with minimum version 1.2.3:
+//!
+//! ```no_run
+//! fn main() {
+//!     pkg_config::Config::new().atleast_version("1.2.3").probe("foo").unwrap();
+//! }
+//! ```
+//!
+//! Find the system library named `foo`, with no version requirement (not
+//! recommended):
+//!
+//! ```no_run
+//! fn main() {
+//!     pkg_config::probe_library("foo").unwrap();
+//! }
+//! ```
+//!
+//! Configure how library `foo` is linked to.
+//!
+//! ```no_run
+//! fn main() {
+//!     pkg_config::Config::new().atleast_version("1.2.3").statik(true).probe("foo").unwrap();
+//! }
+//! ```
+
+#![doc(html_root_url = "https://docs.rs/pkg-config/0.3")]
+
+use std::collections::HashMap;
+use std::env;
+use std::error;
+use std::ffi::{OsStr, OsString};
+use std::fmt;
+use std::io;
+use std::ops::{Bound, RangeBounds};
+use std::path::PathBuf;
+use std::process::{Command, Output};
+use std::str;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    statik: Option<bool>,
+    min_version: Bound<String>,
+    max_version: Bound<String>,
+    extra_args: Vec<OsString>,
+    cargo_metadata: bool,
+    env_metadata: bool,
+    print_system_libs: bool,
+    print_system_cflags: bool,
+}
+
+#[derive(Clone, Debug)]
+pub struct Library {
+    /// Libraries specified by -l
+    pub libs: Vec<String>,
+    /// Library search paths specified by -L
+    pub link_paths: Vec<PathBuf>,
+    /// Library file paths specified without -l
+    pub link_files: Vec<PathBuf>,
+    /// Darwin frameworks specified by -framework
+    pub frameworks: Vec<String>,
+    /// Darwin framework search paths specified by -F
+    pub framework_paths: Vec<PathBuf>,
+    /// C/C++ header include paths specified by -I
+    pub include_paths: Vec<PathBuf>,
+    /// Linker options specified by -Wl
+    pub ld_args: Vec<Vec<String>>,
+    /// C/C++ definitions specified by -D
+    pub defines: HashMap<String, Option<String>>,
+    /// Version specified by .pc file's Version field
+    pub version: String,
+    /// Ensure that this struct can only be created via its private `[Library::new]` constructor.
+    /// Users of this crate can only access the struct via `[Config::probe]`.
+    _priv: (),
+}
+
+/// Represents all reasons `pkg-config` might not succeed or be run at all.
+pub enum Error {
+    /// Aborted because of `*_NO_PKG_CONFIG` environment variable.
+    ///
+    /// Contains the name of the responsible environment variable.
+    EnvNoPkgConfig(String),
+
+    /// Detected cross compilation without a custom sysroot.
+    ///
+    /// Ignore the error with `PKG_CONFIG_ALLOW_CROSS=1`,
+    /// which may let `pkg-config` select libraries
+    /// for the host's architecture instead of the target's.
+    CrossCompilation,
+
+    /// Failed to run `pkg-config`.
+    ///
+    /// Contains the command and the cause.
+    Command { command: String, cause: io::Error },
+
+    /// `pkg-config` did not exit successfully after probing a library.
+    ///
+    /// Contains the command and output.
+    Failure { command: String, output: Output },
+
+    /// `pkg-config` did not exit successfully on the first attempt to probe a library.
+    ///
+    /// Contains the command and output.
+    ProbeFailure {
+        name: String,
+        command: String,
+        output: Output,
+    },
+
+    #[doc(hidden)]
+    // please don't match on this, we're likely to add more variants over time
+    __Nonexhaustive,
+}
+
+impl error::Error for Error {}
+
+impl fmt::Debug for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+        // Failed `unwrap()` prints Debug representation, but the default debug format lacks helpful instructions for the end users
+        <Error as fmt::Display>::fmt(self, f)
+    }
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter) -> Result<(), fmt::Error> {
+        match *self {
+            Error::EnvNoPkgConfig(ref name) => write!(f, "Aborted because {} is set", name),
+            Error::CrossCompilation => f.write_str(
+                "pkg-config has not been configured to support cross-compilation.\n\
+                \n\
+                Install a sysroot for the target platform and configure it via\n\
+                PKG_CONFIG_SYSROOT_DIR and PKG_CONFIG_PATH, or install a\n\
+                cross-compiling wrapper for pkg-config and set it via\n\
+                PKG_CONFIG environment variable.",
+            ),
+            Error::Command {
+                ref command,
+                ref cause,
+            } => {
+                match cause.kind() {
+                    io::ErrorKind::NotFound => {
+                        let crate_name =
+                            std::env::var("CARGO_PKG_NAME").unwrap_or_else(|_| "sys".to_owned());
+                        let instructions = if cfg!(target_os = "macos") || cfg!(target_os = "ios") {
+                            "Try `brew install pkg-config` if you have Homebrew.\n"
+                        } else if cfg!(unix) {
+                            "Try `apt install pkg-config`, or `yum install pkg-config`,\n\
+                            or `pkg install pkg-config`, or `apk add pkgconfig` \
+                            depending on your distribution.\n"
+                        } else {
+                            "" // There's no easy fix for Windows users
+                        };
+                        write!(f, "Could not run `{command}`\n\
+                        The pkg-config command could not be found.\n\
+                        \n\
+                        Most likely, you need to install a pkg-config package for your OS.\n\
+                        {instructions}\
+                        \n\
+                        If you've already installed it, ensure the pkg-config command is one of the\n\
+                        directories in the PATH environment variable.\n\
+                        \n\
+                        If you did not expect this build to link to a pre-installed system library,\n\
+                        then check documentation of the {crate_name} crate for an option to\n\
+                        build the library from source, or disable features or dependencies\n\
+                        that require pkg-config.", command = command, instructions = instructions, crate_name = crate_name)
+                    }
+                    _ => write!(f, "Failed to run command `{}`, because: {}", command, cause),
+                }
+            }
+            Error::ProbeFailure {
+                ref name,
+                ref command,
+                ref output,
+            } => {
+                write!(
+                    f,
+                    "`{}` did not exit successfully: {}\nerror: could not find system library '{}' required by the '{}' crate\n",
+                    command, output.status, name, env::var("CARGO_PKG_NAME").unwrap_or_default(),
+                )?;
+                format_output(output, f)
+            }
+            Error::Failure {
+                ref command,
+                ref output,
+            } => {
+                write!(
+                    f,
+                    "`{}` did not exit successfully: {}",
+                    command, output.status
+                )?;
+                format_output(output, f)
+            }
+            Error::__Nonexhaustive => panic!(),
+        }
+    }
+}
+
+fn format_output(output: &Output, f: &mut fmt::Formatter) -> fmt::Result {
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    if !stdout.is_empty() {
+        write!(f, "\n--- stdout\n{}", stdout)?;
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    if !stderr.is_empty() {
+        write!(f, "\n--- stderr\n{}", stderr)?;
+    }
+    Ok(())
+}
+
+/// Deprecated in favor of the probe_library function
+#[doc(hidden)]
+pub fn find_library(name: &str) -> Result<Library, String> {
+    probe_library(name).map_err(|e| e.to_string())
+}
+
+/// Simple shortcut for using all default options for finding a library.
+pub fn probe_library(name: &str) -> Result<Library, Error> {
+    Config::new().probe(name)
+}
+
+#[doc(hidden)]
+#[deprecated(note = "use config.target_supported() instance method instead")]
+pub fn target_supported() -> bool {
+    Config::new().target_supported()
+}
+
+/// Run `pkg-config` to get the value of a variable from a package using
+/// `--variable`.
+///
+/// The content of `PKG_CONFIG_SYSROOT_DIR` is not injected in paths that are
+/// returned by `pkg-config --variable`, which makes them unsuitable to use
+/// during cross-compilation unless specifically designed to be used
+/// at that time.
+pub fn get_variable(package: &str, variable: &str) -> Result<String, Error> {
+    let arg = format!("--variable={}", variable);
+    let cfg = Config::new();
+    let out = run(cfg.command(package, &[&arg]))?;
+    Ok(str::from_utf8(&out).unwrap().trim_end().to_owned())
+}
+
+impl Config {
+    /// Creates a new set of configuration options which are all initially set
+    /// to "blank".
+    pub fn new() -> Config {
+        Config {
+            statik: None,
+            min_version: Bound::Unbounded,
+            max_version: Bound::Unbounded,
+            extra_args: vec![],
+            print_system_cflags: true,
+            print_system_libs: true,
+            cargo_metadata: true,
+            env_metadata: true,
+        }
+    }
+
+    /// Indicate whether the `--static` flag should be passed.
+    ///
+    /// This will override the inference from environment variables described in
+    /// the crate documentation.
+    pub fn statik(&mut self, statik: bool) -> &mut Config {
+        self.statik = Some(statik);
+        self
+    }
+
+    /// Indicate that the library must be at least version `vers`.
+    pub fn atleast_version(&mut self, vers: &str) -> &mut Config {
+        self.min_version = Bound::Included(vers.to_string());
+        self.max_version = Bound::Unbounded;
+        self
+    }
+
+    /// Indicate that the library must be equal to version `vers`.
+    pub fn exactly_version(&mut self, vers: &str) -> &mut Config {
+        self.min_version = Bound::Included(vers.to_string());
+        self.max_version = Bound::Included(vers.to_string());
+        self
+    }
+
+    /// Indicate that the library's version must be in `range`.
+    pub fn range_version<'a, R>(&mut self, range: R) -> &mut Config
+    where
+        R: RangeBounds<&'a str>,
+    {
+        self.min_version = match range.start_bound() {
+            Bound::Included(vers) => Bound::Included(vers.to_string()),
+            Bound::Excluded(vers) => Bound::Excluded(vers.to_string()),
+            Bound::Unbounded => Bound::Unbounded,
+        };
+        self.max_version = match range.end_bound() {
+            Bound::Included(vers) => Bound::Included(vers.to_string()),
+            Bound::Excluded(vers) => Bound::Excluded(vers.to_string()),
+            Bound::Unbounded => Bound::Unbounded,
+        };
+        self
+    }
+
+    /// Add an argument to pass to pkg-config.
+    ///
+    /// It's placed after all of the arguments generated by this library.
+    pub fn arg<S: AsRef<OsStr>>(&mut self, arg: S) -> &mut Config {
+        self.extra_args.push(arg.as_ref().to_os_string());
+        self
+    }
+
+    /// Define whether metadata should be emitted for cargo allowing it to
+    /// automatically link the binary. Defaults to `true`.
+    pub fn cargo_metadata(&mut self, cargo_metadata: bool) -> &mut Config {
+        self.cargo_metadata = cargo_metadata;
+        self
+    }
+
+    /// Define whether metadata should be emitted for cargo allowing to
+    /// automatically rebuild when environment variables change. Defaults to
+    /// `true`.
+    pub fn env_metadata(&mut self, env_metadata: bool) -> &mut Config {
+        self.env_metadata = env_metadata;
+        self
+    }
+
+    /// Enable or disable the `PKG_CONFIG_ALLOW_SYSTEM_LIBS` environment
+    /// variable.
+    ///
+    /// This env var is enabled by default.
+    pub fn print_system_libs(&mut self, print: bool) -> &mut Config {
+        self.print_system_libs = print;
+        self
+    }
+
+    /// Enable or disable the `PKG_CONFIG_ALLOW_SYSTEM_CFLAGS` environment
+    /// variable.
+    ///
+    /// This env var is enabled by default.
+    pub fn print_system_cflags(&mut self, print: bool) -> &mut Config {
+        self.print_system_cflags = print;
+        self
+    }
+
+    /// Deprecated in favor fo the `probe` function
+    #[doc(hidden)]
+    pub fn find(&self, name: &str) -> Result<Library, String> {
+        self.probe(name).map_err(|e| e.to_string())
+    }
+
+    /// Run `pkg-config` to find the library `name`.
+    ///
+    /// This will use all configuration previously set to specify how
+    /// `pkg-config` is run.
+    pub fn probe(&self, name: &str) -> Result<Library, Error> {
+        let abort_var_name = format!("{}_NO_PKG_CONFIG", envify(name));
+        if self.env_var_os(&abort_var_name).is_some() {
+            return Err(Error::EnvNoPkgConfig(abort_var_name));
+        } else if !self.target_supported() {
+            return Err(Error::CrossCompilation);
+        }
+
+        let mut library = Library::new();
+
+        let output = run(self.command(name, &["--libs", "--cflags"])).map_err(|e| match e {
+            Error::Failure { command, output } => Error::ProbeFailure {
+                name: name.to_owned(),
+                command,
+                output,
+            },
+            other => other,
+        })?;
+        library.parse_libs_cflags(name, &output, self);
+
+        let output = run(self.command(name, &["--modversion"]))?;
+        library.parse_modversion(str::from_utf8(&output).unwrap());
+
+        Ok(library)
+    }
+
+    /// True if pkg-config is used for the host system, or configured for cross-compilation
+    pub fn target_supported(&self) -> bool {
+        let target = env::var_os("TARGET").unwrap_or_default();
+        let host = env::var_os("HOST").unwrap_or_default();
+
+        // Only use pkg-config in host == target situations by default (allowing an
+        // override).
+        if host == target {
+            return true;
+        }
+
+        // pkg-config may not be aware of cross-compilation, and require
+        // a wrapper script that sets up platform-specific prefixes.
+        match self.targeted_env_var("PKG_CONFIG_ALLOW_CROSS") {
+            // don't use pkg-config if explicitly disabled
+            Some(ref val) if val == "0" => false,
+            Some(_) => true,
+            None => {
+                // if not disabled, and pkg-config is customized,
+                // then assume it's prepared for cross-compilation
+                self.targeted_env_var("PKG_CONFIG").is_some()
+                    || self.targeted_env_var("PKG_CONFIG_SYSROOT_DIR").is_some()
+            }
+        }
+    }
+
+    /// Deprecated in favor of the top level `get_variable` function
+    #[doc(hidden)]
+    pub fn get_variable(package: &str, variable: &str) -> Result<String, String> {
+        get_variable(package, variable).map_err(|e| e.to_string())
+    }
+
+    fn targeted_env_var(&self, var_base: &str) -> Option<OsString> {
+        match (env::var("TARGET"), env::var("HOST")) {
+            (Ok(target), Ok(host)) => {
+                let kind = if host == target { "HOST" } else { "TARGET" };
+                let target_u = target.replace("-", "_");
+
+                self.env_var_os(&format!("{}_{}", var_base, target))
+                    .or_else(|| self.env_var_os(&format!("{}_{}", var_base, target_u)))
+                    .or_else(|| self.env_var_os(&format!("{}_{}", kind, var_base)))
+                    .or_else(|| self.env_var_os(var_base))
+            }
+            (Err(env::VarError::NotPresent), _) | (_, Err(env::VarError::NotPresent)) => {
+                self.env_var_os(var_base)
+            }
+            (Err(env::VarError::NotUnicode(s)), _) | (_, Err(env::VarError::NotUnicode(s))) => {
+                panic!(
+                    "HOST or TARGET environment variable is not valid unicode: {:?}",
+                    s
+                )
+            }
+        }
+    }
+
+    fn env_var_os(&self, name: &str) -> Option<OsString> {
+        if self.env_metadata {
+            println!("cargo:rerun-if-env-changed={}", name);
+        }
+        env::var_os(name)
+    }
+
+    fn is_static(&self, name: &str) -> bool {
+        self.statik.unwrap_or_else(|| self.infer_static(name))
+    }
+
+    fn command(&self, name: &str, args: &[&str]) -> Command {
+        let exe = self
+            .targeted_env_var("PKG_CONFIG")
+            .unwrap_or_else(|| OsString::from("pkg-config"));
+        let mut cmd = Command::new(exe);
+        if self.is_static(name) {
+            cmd.arg("--static");
+        }
+        cmd.args(args).args(&self.extra_args);
+
+        if let Some(value) = self.targeted_env_var("PKG_CONFIG_PATH") {
+            cmd.env("PKG_CONFIG_PATH", value);
+        }
+        if let Some(value) = self.targeted_env_var("PKG_CONFIG_LIBDIR") {
+            cmd.env("PKG_CONFIG_LIBDIR", value);
+        }
+        if let Some(value) = self.targeted_env_var("PKG_CONFIG_SYSROOT_DIR") {
+            cmd.env("PKG_CONFIG_SYSROOT_DIR", value);
+        }
+        if self.print_system_libs {
+            cmd.env("PKG_CONFIG_ALLOW_SYSTEM_LIBS", "1");
+        }
+        if self.print_system_cflags {
+            cmd.env("PKG_CONFIG_ALLOW_SYSTEM_CFLAGS", "1");
+        }
+        cmd.arg(name);
+        match self.min_version {
+            Bound::Included(ref version) => {
+                cmd.arg(&format!("{} >= {}", name, version));
+            }
+            Bound::Excluded(ref version) => {
+                cmd.arg(&format!("{} > {}", name, version));
+            }
+            _ => (),
+        }
+        match self.max_version {
+            Bound::Included(ref version) => {
+                cmd.arg(&format!("{} <= {}", name, version));
+            }
+            Bound::Excluded(ref version) => {
+                cmd.arg(&format!("{} < {}", name, version));
+            }
+            _ => (),
+        }
+        cmd
+    }
+
+    fn print_metadata(&self, s: &str) {
+        if self.cargo_metadata {
+            println!("cargo:{}", s);
+        }
+    }
+
+    fn infer_static(&self, name: &str) -> bool {
+        let name = envify(name);
+        if self.env_var_os(&format!("{}_STATIC", name)).is_some() {
+            true
+        } else if self.env_var_os(&format!("{}_DYNAMIC", name)).is_some() {
+            false
+        } else if self.env_var_os("PKG_CONFIG_ALL_STATIC").is_some() {
+            true
+        } else if self.env_var_os("PKG_CONFIG_ALL_DYNAMIC").is_some() {
+            false
+        } else {
+            false
+        }
+    }
+}
+
+// Implement Default manually since Bound does not implement Default.
+impl Default for Config {
+    fn default() -> Config {
+        Config {
+            statik: None,
+            min_version: Bound::Unbounded,
+            max_version: Bound::Unbounded,
+            extra_args: vec![],
+            print_system_cflags: false,
+            print_system_libs: false,
+            cargo_metadata: false,
+            env_metadata: false,
+        }
+    }
+}
+
+impl Library {
+    fn new() -> Library {
+        Library {
+            libs: Vec::new(),
+            link_paths: Vec::new(),
+            link_files: Vec::new(),
+            include_paths: Vec::new(),
+            ld_args: Vec::new(),
+            frameworks: Vec::new(),
+            framework_paths: Vec::new(),
+            defines: HashMap::new(),
+            version: String::new(),
+            _priv: (),
+        }
+    }
+
+    /// Extract the &str to pass to cargo:rustc-link-lib from a filename (just the file name, not including directories)
+    /// using target-specific logic.
+    fn extract_lib_from_filename<'a>(target: &str, filename: &'a str) -> Option<&'a str> {
+        fn test_suffixes<'b>(filename: &'b str, suffixes: &[&str]) -> Option<&'b str> {
+            for suffix in suffixes {
+                if filename.ends_with(suffix) {
+                    return Some(&filename[..filename.len() - suffix.len()]);
+                }
+            }
+            None
+        }
+
+        let prefix = "lib";
+        if target.contains("msvc") {
+            // According to link.exe documentation:
+            // https://learn.microsoft.com/en-us/cpp/build/reference/link-input-files?view=msvc-170
+            //
+            //   LINK doesn't use file extensions to make assumptions about the contents of a file.
+            //   Instead, LINK examines each input file to determine what kind of file it is.
+            //
+            // However, rustc appends `.lib` to the string it receives from the -l command line argument,
+            // which it receives from Cargo via cargo:rustc-link-lib:
+            // https://github.com/rust-lang/rust/blob/657f246812ab2684e3c3954b1c77f98fd59e0b21/compiler/rustc_codegen_ssa/src/back/linker.rs#L828
+            // https://github.com/rust-lang/rust/blob/657f246812ab2684e3c3954b1c77f98fd59e0b21/compiler/rustc_codegen_ssa/src/back/linker.rs#L843
+            // So the only file extension that works for MSVC targets is `.lib`
+            return test_suffixes(filename, &[".lib"]);
+        } else if target.contains("windows") && target.contains("gnu") {
+            // GNU targets for Windows, including gnullvm, use `LinkerFlavor::Gcc` internally in rustc,
+            // which tells rustc to use the GNU linker. rustc does not prepend/append to the string it
+            // receives via the -l command line argument before passing it to the linker:
+            // https://github.com/rust-lang/rust/blob/657f246812ab2684e3c3954b1c77f98fd59e0b21/compiler/rustc_codegen_ssa/src/back/linker.rs#L446
+            // https://github.com/rust-lang/rust/blob/657f246812ab2684e3c3954b1c77f98fd59e0b21/compiler/rustc_codegen_ssa/src/back/linker.rs#L457
+            // GNU ld can work with more types of files than just the .lib files that MSVC's link.exe needs.
+            // GNU ld will prepend the `lib` prefix to the filename if necessary, so it is okay to remove
+            // the `lib` prefix from the filename. The `.a` suffix *requires* the `lib` prefix.
+            // https://sourceware.org/binutils/docs-2.39/ld.html#index-direct-linking-to-a-dll
+            if filename.starts_with(prefix) {
+                let filename = &filename[prefix.len()..];
+                return test_suffixes(filename, &[".dll.a", ".dll", ".lib", ".a"]);
+            } else {
+                return test_suffixes(filename, &[".dll.a", ".dll", ".lib"]);
+            }
+        } else if target.contains("apple") {
+            if filename.starts_with(prefix) {
+                let filename = &filename[prefix.len()..];
+                return test_suffixes(filename, &[".a", ".so", ".dylib"]);
+            }
+            return None;
+        } else {
+            if filename.starts_with(prefix) {
+                let filename = &filename[prefix.len()..];
+                return test_suffixes(filename, &[".a", ".so"]);
+            }
+            return None;
+        }
+    }
+
+    fn parse_libs_cflags(&mut self, name: &str, output: &[u8], config: &Config) {
+        let mut is_msvc = false;
+        let target = env::var("TARGET");
+        if let Ok(target) = &target {
+            if target.contains("msvc") {
+                is_msvc = true;
+            }
+        }
+
+        let system_roots = if cfg!(target_os = "macos") {
+            vec![PathBuf::from("/Library"), PathBuf::from("/System")]
+        } else {
+            let sysroot = config
+                .env_var_os("PKG_CONFIG_SYSROOT_DIR")
+                .or_else(|| config.env_var_os("SYSROOT"))
+                .map(PathBuf::from);
+
+            if cfg!(target_os = "windows") {
+                if let Some(sysroot) = sysroot {
+                    vec![sysroot]
+                } else {
+                    vec![]
+                }
+            } else {
+                vec![sysroot.unwrap_or_else(|| PathBuf::from("/usr"))]
+            }
+        };
+
+        let mut dirs = Vec::new();
+        let statik = config.is_static(name);
+
+        let words = split_flags(output);
+
+        // Handle single-character arguments like `-I/usr/include`
+        let parts = words
+            .iter()
+            .filter(|l| l.len() > 2)
+            .map(|arg| (&arg[0..2], &arg[2..]));
+        for (flag, val) in parts {
+            match flag {
+                "-L" => {
+                    let meta = format!("rustc-link-search=native={}", val);
+                    config.print_metadata(&meta);
+                    dirs.push(PathBuf::from(val));
+                    self.link_paths.push(PathBuf::from(val));
+                }
+                "-F" => {
+                    let meta = format!("rustc-link-search=framework={}", val);
+                    config.print_metadata(&meta);
+                    self.framework_paths.push(PathBuf::from(val));
+                }
+                "-I" => {
+                    self.include_paths.push(PathBuf::from(val));
+                }
+                "-l" => {
+                    // These are provided by the CRT with MSVC
+                    if is_msvc && ["m", "c", "pthread"].contains(&val) {
+                        continue;
+                    }
+
+                    if statik && is_static_available(val, &system_roots, &dirs) {
+                        let meta = format!("rustc-link-lib=static={}", val);
+                        config.print_metadata(&meta);
+                    } else {
+                        let meta = format!("rustc-link-lib={}", val);
+                        config.print_metadata(&meta);
+                    }
+
+                    self.libs.push(val.to_string());
+                }
+                "-D" => {
+                    let mut iter = val.split('=');
+                    self.defines.insert(
+                        iter.next().unwrap().to_owned(),
+                        iter.next().map(|s| s.to_owned()),
+                    );
+                }
+                _ => {}
+            }
+        }
+
+        // Handle multi-character arguments with space-separated value like `-framework foo`
+        let mut iter = words.iter().flat_map(|arg| {
+            if arg.starts_with("-Wl,") {
+                arg[4..].split(',').collect()
+            } else {
+                vec![arg.as_ref()]
+            }
+        });
+        while let Some(part) = iter.next() {
+            match part {
+                "-framework" => {
+                    if let Some(lib) = iter.next() {
+                        let meta = format!("rustc-link-lib=framework={}", lib);
+                        config.print_metadata(&meta);
+                        self.frameworks.push(lib.to_string());
+                    }
+                }
+                "-isystem" | "-iquote" | "-idirafter" => {
+                    if let Some(inc) = iter.next() {
+                        self.include_paths.push(PathBuf::from(inc));
+                    }
+                }
+                _ => {
+                    let path = std::path::Path::new(part);
+                    if path.is_file() {
+                        // Cargo doesn't have a means to directly specify a file path to link,
+                        // so split up the path into the parent directory and library name.
+                        // TODO: pass file path directly when link-arg library type is stabilized
+                        // https://github.com/rust-lang/rust/issues/99427
+                        if let (Some(dir), Some(file_name), Ok(target)) =
+                            (path.parent(), path.file_name(), &target)
+                        {
+                            match Self::extract_lib_from_filename(
+                                target,
+                                &file_name.to_string_lossy(),
+                            ) {
+                                Some(lib_basename) => {
+                                    let link_search =
+                                        format!("rustc-link-search={}", dir.display());
+                                    config.print_metadata(&link_search);
+
+                                    let link_lib = format!("rustc-link-lib={}", lib_basename);
+                                    config.print_metadata(&link_lib);
+                                    self.link_files.push(PathBuf::from(path));
+                                }
+                                None => {
+                                    println!("cargo:warning=File path {} found in pkg-config file for {}, but could not extract library base name to pass to linker command line", path.display(), name);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        let mut linker_options = words.iter().filter(|arg| arg.starts_with("-Wl,"));
+        while let Some(option) = linker_options.next() {
+            let mut pop = false;
+            let mut ld_option = vec![];
+            for subopt in option[4..].split(',') {
+                if pop {
+                    pop = false;
+                    continue;
+                }
+
+                if subopt == "-framework" {
+                    pop = true;
+                    continue;
+                }
+
+                ld_option.push(subopt);
+            }
+
+            let meta = format!("rustc-link-arg=-Wl,{}", ld_option.join(","));
+            config.print_metadata(&meta);
+
+            self.ld_args
+                .push(ld_option.into_iter().map(String::from).collect());
+        }
+    }
+
+    fn parse_modversion(&mut self, output: &str) {
+        self.version.push_str(output.lines().nth(0).unwrap().trim());
+    }
+}
+
+fn envify(name: &str) -> String {
+    name.chars()
+        .map(|c| c.to_ascii_uppercase())
+        .map(|c| if c == '-' { '_' } else { c })
+        .collect()
+}
+
+/// System libraries should only be linked dynamically
+fn is_static_available(name: &str, system_roots: &[PathBuf], dirs: &[PathBuf]) -> bool {
+    let libname = format!("lib{}.a", name);
+
+    dirs.iter().any(|dir| {
+        !system_roots.iter().any(|sys| dir.starts_with(sys)) && dir.join(&libname).exists()
+    })
+}
+
+fn run(mut cmd: Command) -> Result<Vec<u8>, Error> {
+    match cmd.output() {
+        Ok(output) => {
+            if output.status.success() {
+                Ok(output.stdout)
+            } else {
+                Err(Error::Failure {
+                    command: format!("{:?}", cmd),
+                    output,
+                })
+            }
+        }
+        Err(cause) => Err(Error::Command {
+            command: format!("{:?}", cmd),
+            cause,
+        }),
+    }
+}
+
+/// Split output produced by pkg-config --cflags and / or --libs into separate flags.
+///
+/// Backslash in output is used to preserve literal meaning of following byte.  Different words are
+/// separated by unescaped space. Other whitespace characters generally should not occur unescaped
+/// at all, apart from the newline at the end of output. For compatibility with what others
+/// consumers of pkg-config output would do in this scenario, they are used here for splitting as
+/// well.
+fn split_flags(output: &[u8]) -> Vec<String> {
+    let mut word = Vec::new();
+    let mut words = Vec::new();
+    let mut escaped = false;
+
+    for &b in output {
+        match b {
+            _ if escaped => {
+                escaped = false;
+                word.push(b);
+            }
+            b'\\' => escaped = true,
+            b'\t' | b'\n' | b'\r' | b' ' => {
+                if !word.is_empty() {
+                    words.push(String::from_utf8(word).unwrap());
+                    word = Vec::new();
+                }
+            }
+            _ => word.push(b),
+        }
+    }
+
+    if !word.is_empty() {
+        words.push(String::from_utf8(word).unwrap());
+    }
+
+    words
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[cfg(target_os = "macos")]
+    fn system_library_mac_test() {
+        use std::path::Path;
+
+        let system_roots = vec![PathBuf::from("/Library"), PathBuf::from("/System")];
+
+        assert!(!is_static_available(
+            "PluginManager",
+            &system_roots,
+            &[PathBuf::from("/Library/Frameworks")]
+        ));
+        assert!(!is_static_available(
+            "python2.7",
+            &system_roots,
+            &[PathBuf::from(
+                "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/config"
+            )]
+        ));
+        assert!(!is_static_available(
+            "ffi_convenience",
+            &system_roots,
+            &[PathBuf::from(
+                "/Library/Ruby/Gems/2.0.0/gems/ffi-1.9.10/ext/ffi_c/libffi-x86_64/.libs"
+            )]
+        ));
+
+        // Homebrew is in /usr/local, and it's not a part of the OS
+        if Path::new("/usr/local/lib/libpng16.a").exists() {
+            assert!(is_static_available(
+                "png16",
+                &system_roots,
+                &[PathBuf::from("/usr/local/lib")]
+            ));
+
+            let libpng = Config::new()
+                .range_version("1".."99")
+                .probe("libpng16")
+                .unwrap();
+            assert!(libpng.version.find('\n').is_none());
+        }
+    }
+
+    #[test]
+    #[cfg(target_os = "linux")]
+    fn system_library_linux_test() {
+        assert!(!is_static_available(
+            "util",
+            &[PathBuf::from("/usr")],
+            &[PathBuf::from("/usr/lib/x86_64-linux-gnu")]
+        ));
+        assert!(!is_static_available(
+            "dialog",
+            &[PathBuf::from("/usr")],
+            &[PathBuf::from("/usr/lib")]
+        ));
+    }
+
+    fn test_library_filename(target: &str, filename: &str) {
+        assert_eq!(
+            Library::extract_lib_from_filename(target, filename),
+            Some("foo")
+        );
+    }
+
+    #[test]
+    fn link_filename_linux() {
+        let target = "x86_64-unknown-linux-gnu";
+        test_library_filename(target, "libfoo.a");
+        test_library_filename(target, "libfoo.so");
+    }
+
+    #[test]
+    fn link_filename_apple() {
+        let target = "x86_64-apple-darwin";
+        test_library_filename(target, "libfoo.a");
+        test_library_filename(target, "libfoo.so");
+        test_library_filename(target, "libfoo.dylib");
+    }
+
+    #[test]
+    fn link_filename_msvc() {
+        let target = "x86_64-pc-windows-msvc";
+        // static and dynamic libraries have the same .lib suffix
+        test_library_filename(target, "foo.lib");
+    }
+
+    #[test]
+    fn link_filename_mingw() {
+        let target = "x86_64-pc-windows-gnu";
+        test_library_filename(target, "foo.lib");
+        test_library_filename(target, "libfoo.a");
+        test_library_filename(target, "foo.dll");
+        test_library_filename(target, "foo.dll.a");
+    }
+}

diff --git a/qemu/third_party/rust/crates/pkg-config/tests/escape.pc b/qemu/third_party/rust/crates/pkg-config/tests/escape.pc
new file mode 100644
index 0000000..701c4bf
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/tests/escape.pc

@@ -0,0 +1,5 @@
+Name: Escape
+Version: 4.2.0
+Description: Escape utility library
+Libs: -Llink\ path\ with\ spaces
+Cflags: -Iinclude\ path\ with\ spaces -DA=\"escaped\ string\'\ literal\" -DB=ESCAPED\ IDENTIFIER -DFOX=🦊

diff --git a/qemu/third_party/rust/crates/pkg-config/tests/foo.pc b/qemu/third_party/rust/crates/pkg-config/tests/foo.pc
new file mode 100644
index 0000000..ce63ceb
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/tests/foo.pc

@@ -0,0 +1,16 @@
+prefix=/usr
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include/valgrind
+arch=amd64
+os=linux
+platform=amd64-linux
+valt_load_address=0x38000000
+
+Name: Valgrind
+Description: A dynamic binary instrumentation framework
+Version: 3.10.0.SVN
+Requires:
+Libs: -L${libdir}/valgrind -lcoregrind-amd64-linux -lvex-amd64-linux -lgcc
+Cflags: -I${includedir} -isystem /usr/foo
+

diff --git a/qemu/third_party/rust/crates/pkg-config/tests/framework.pc b/qemu/third_party/rust/crates/pkg-config/tests/framework.pc
new file mode 100644
index 0000000..fec17f4
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/tests/framework.pc

@@ -0,0 +1,16 @@
+prefix=/usr
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include/valgrind
+arch=amd64
+os=linux
+platform=amd64-linux
+valt_load_address=0x38000000
+
+Name: Valgrind
+Description: A dynamic binary instrumentation framework
+Version: 3.10.0.SVN
+Requires:
+Libs: -F${libdir} -framework foo -Wl,-framework,bar -Wl,-framework -Wl,baz -Wl,-framework,foobar,-framework,foobaz
+Cflags: -I${includedir}
+

diff --git a/qemu/third_party/rust/crates/pkg-config/tests/rpath.pc b/qemu/third_party/rust/crates/pkg-config/tests/rpath.pc
new file mode 100644
index 0000000..7c36c5c
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/tests/rpath.pc

@@ -0,0 +1,7 @@
+prefix=/usr/local
+
+Name: rpath
+Version: 4.2.0
+Description: RPath example library
+Libs: -L${prefix}/lib -Wl,-rpath,${prefix}/lib -lrpath
+Cflags: -I${prefix}/include

diff --git a/qemu/third_party/rust/crates/pkg-config/tests/test.rs b/qemu/third_party/rust/crates/pkg-config/tests/test.rs
new file mode 100644
index 0000000..4e04ac0
--- /dev/null
+++ b/qemu/third_party/rust/crates/pkg-config/tests/test.rs

@@ -0,0 +1,323 @@
+extern crate pkg_config;
+#[macro_use]
+extern crate lazy_static;
+
+use pkg_config::Error;
+use std::env;
+use std::path::PathBuf;
+use std::sync::Mutex;
+
+lazy_static! {
+    static ref LOCK: Mutex<()> = Mutex::new(());
+}
+
+fn reset() {
+    for (k, _) in env::vars() {
+        if k.contains("DYNAMIC")
+            || k.contains("STATIC")
+            || k.contains("PKG_CONFIG_ALLOW_CROSS")
+            || k.contains("PKG_CONFIG_SYSROOT_DIR")
+            || k.contains("FOO_NO_PKG_CONFIG")
+        {
+            env::remove_var(&k);
+        }
+    }
+    env::remove_var("TARGET");
+    env::remove_var("HOST");
+    env::set_var(
+        "PKG_CONFIG_PATH",
+        &env::current_dir().unwrap().join("tests"),
+    );
+}
+
+fn find(name: &str) -> Result<pkg_config::Library, Error> {
+    pkg_config::probe_library(name)
+}
+
+#[test]
+fn cross_disabled() {
+    let _g = LOCK.lock();
+    reset();
+    env::set_var("TARGET", "foo");
+    env::set_var("HOST", "bar");
+    match find("foo") {
+        Err(Error::CrossCompilation) => {}
+        x => panic!("Error::CrossCompilation expected, found `{:?}`", x),
+    }
+}
+
+#[test]
+fn cross_enabled() {
+    let _g = LOCK.lock();
+    reset();
+    env::set_var("TARGET", "foo");
+    env::set_var("HOST", "bar");
+    env::set_var("PKG_CONFIG_ALLOW_CROSS", "1");
+    find("foo").unwrap();
+}
+
+#[test]
+fn cross_enabled_if_customized() {
+    let _g = LOCK.lock();
+    reset();
+    env::set_var("TARGET", "foo");
+    env::set_var("HOST", "bar");
+    env::set_var("PKG_CONFIG_SYSROOT_DIR", "/tmp/cross-test");
+    find("foo").unwrap();
+}
+
+#[test]
+fn cross_disabled_if_customized() {
+    let _g = LOCK.lock();
+    reset();
+    env::set_var("TARGET", "foo");
+    env::set_var("HOST", "bar");
+    env::set_var("PKG_CONFIG_ALLOW_CROSS", "0");
+    env::set_var("PKG_CONFIG_SYSROOT_DIR", "/tmp/cross-test");
+    match find("foo") {
+        Err(Error::CrossCompilation) => {}
+        _ => panic!("expected CrossCompilation failure"),
+    }
+}
+
+#[test]
+fn package_disabled() {
+    let _g = LOCK.lock();
+    reset();
+    env::set_var("FOO_NO_PKG_CONFIG", "1");
+    match find("foo") {
+        Err(Error::EnvNoPkgConfig(name)) => assert_eq!(name, "FOO_NO_PKG_CONFIG"),
+        x => panic!("Error::EnvNoPkgConfig expected, found `{:?}`", x),
+    }
+}
+
+#[test]
+fn output_ok() {
+    let _g = LOCK.lock();
+    reset();
+    let lib = find("foo").unwrap();
+    assert!(lib.libs.contains(&"gcc".to_string()));
+    assert!(lib.libs.contains(&"coregrind-amd64-linux".to_string()));
+    assert!(lib.link_paths.contains(&PathBuf::from("/usr/lib/valgrind")));
+    assert!(lib
+        .include_paths
+        .contains(&PathBuf::from("/usr/include/valgrind")));
+    assert!(lib.include_paths.contains(&PathBuf::from("/usr/foo")));
+}
+
+#[test]
+fn escapes() {
+    let _g = LOCK.lock();
+    reset();
+    let lib = find("escape").unwrap();
+    assert!(lib
+        .include_paths
+        .contains(&PathBuf::from("include path with spaces")));
+    assert!(lib
+        .link_paths
+        .contains(&PathBuf::from("link path with spaces")));
+    assert_eq!(
+        lib.defines.get("A"),
+        Some(&Some("\"escaped string' literal\"".to_owned()))
+    );
+    assert_eq!(
+        lib.defines.get("B"),
+        Some(&Some("ESCAPED IDENTIFIER".to_owned()))
+    );
+    assert_eq!(lib.defines.get("FOX"), Some(&Some("🦊".to_owned())));
+}
+
+#[test]
+fn framework() {
+    let _g = LOCK.lock();
+    reset();
+    let lib = find("framework").unwrap();
+    assert!(lib.frameworks.contains(&"foo".to_string()));
+    assert!(lib.frameworks.contains(&"bar".to_string()));
+    assert!(lib.frameworks.contains(&"baz".to_string()));
+    assert!(lib.frameworks.contains(&"foobar".to_string()));
+    assert!(lib.frameworks.contains(&"foobaz".to_string()));
+    assert!(lib.framework_paths.contains(&PathBuf::from("/usr/lib")));
+}
+
+#[test]
+fn get_variable() {
+    let _g = LOCK.lock();
+    reset();
+    let prefix = pkg_config::get_variable("foo", "prefix").unwrap();
+    assert_eq!(prefix, "/usr");
+}
+
+#[test]
+fn version() {
+    let _g = LOCK.lock();
+    reset();
+    assert_eq!(&find("foo").unwrap().version[..], "3.10.0.SVN");
+}
+
+#[test]
+fn atleast_version_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .atleast_version("3.10")
+        .probe("foo")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn atleast_version_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .atleast_version("3.11")
+        .probe("foo")
+        .unwrap();
+}
+
+#[test]
+fn exactly_version_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .exactly_version("3.10.0.SVN")
+        .probe("foo")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn exactly_version_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .exactly_version("3.10.0")
+        .probe("foo")
+        .unwrap();
+}
+
+#[test]
+fn range_version_range_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version("4.2.0".."4.4.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn range_version_range_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version("4.0.0".."4.2.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+fn range_version_range_inclusive_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version("4.0.0"..="4.2.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn range_version_range_inclusive_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version("3.8.0"..="4.0.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+fn range_version_range_from_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version("4.0.0"..)
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn range_version_range_from_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version("4.4.0"..)
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+fn range_version_range_to_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version(.."4.4.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn range_version_range_to_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version(.."4.2.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+fn range_version_range_to_inclusive_ok() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version(..="4.2.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+#[should_panic]
+fn range_version_range_to_inclusive_ng() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version(..="4.0.0")
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+fn range_version_full() {
+    let _g = LOCK.lock();
+    reset();
+    pkg_config::Config::new()
+        .range_version(..)
+        .probe("escape")
+        .unwrap();
+}
+
+#[test]
+fn rpath() {
+    let _g = LOCK.lock();
+    reset();
+    let lib = find("rpath").unwrap();
+    assert!(lib
+        .ld_args
+        .contains(&vec!["-rpath".to_string(), "/usr/local/lib".to_string(),]));
+}

diff --git a/qemu/third_party/rust/crates/winapi/Cargo.toml b/qemu/third_party/rust/crates/winapi/Cargo.toml
new file mode 100644
index 0000000..4032ac4
--- /dev/null
+++ b/qemu/third_party/rust/crates/winapi/Cargo.toml

@@ -0,0 +1,40 @@
+[package]
+name = "winapi"
+version = "0.3.9"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+
+[features]
+consoleapi = []
+errhandlingapi = []
+everything = []
+fileapi = []
+handleapi = []
+impl-default = []
+libloaderapi = []
+minwinbase = []
+minwindef = []
+ntdef = []
+oaidl = []
+objbase = []
+objidlbase = []
+oleauto = []
+processenv = []
+processthreadsapi = []
+profileapi = []
+std = []
+synchapi = []
+sysinfoapi = []
+timezoneapi = []
+unknwnbase = []
+wbemcli = []
+winbase = []
+wincon = []
+winerror = []
+winnt = []
+winsock2 = []
+wtypes = []
+wtypesbase = []

diff --git a/qemu/third_party/rust/crates/winapi/src/main.rs b/qemu/third_party/rust/crates/winapi/src/main.rs
new file mode 100644
index 0000000..7072b02
--- /dev/null
+++ b/qemu/third_party/rust/crates/winapi/src/main.rs

@@ -0,0 +1,4 @@
+// Empty placeholder for autocfg crate that is not used
+// in practice by the build, but is required by cargo.
+fn main() {
+}

diff --git a/rebuild-docker.sh b/rebuild-docker.sh
index 1a5a477..560efcc 100755
--- a/rebuild-docker.sh
+++ b/rebuild-docker.sh

@@ -82,6 +82,7 @@
         docker buildx inspect --bootstrap
         for _target in ${_docker_target[@]}; do
           docker buildx build \
+            --progress plain \
             --platform ${map_uname_to_docker_builder_arch[${_arch}]} \
             --target ${_target} \
             -f ${_dockerfile} \
@@ -108,14 +109,14 @@
       if [[ -n "$(container_exists ${_container_name})" ]]; then
         docker rm -f ${_container_name}
       fi
-      docker run -d \
-        --privileged \
+      docker run \
+        -d \
+        --platform ${map_uname_to_docker_builder_arch[${_arch}]} \
         --name ${_container_name} \
         -h ${_container_name} \
         ${_docker_source} \
         ${_docker_working} \
         ${_docker_output} \
-        -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
         ${_docker_image}:latest
     fi
 #  else
@@ -135,7 +136,7 @@
       /static/rebuild-internal.sh ${_prepare_source[@]} ${_build_or_retry}
     docker pause ${_container_name}
   else
-    docker run -it --rm \
+    $docker_run -it --rm \
       --user ${_user} \
       ${_docker_flags[@]} \
       ${_docker_source} \

diff --git a/rebuild-internal.sh b/rebuild-internal.sh
index 7fdecd4..8d75828 100755
--- a/rebuild-internal.sh
+++ b/rebuild-internal.sh

@@ -6,6 +6,10 @@
 
 : ${TOOLS_DIR:="$(pwd)/tools"}
 
+# Stable is usually too old for crosvm, but make sure you bump this
+# up as far as you can each time this script is touched..
+RUST_TOOLCHAIN_VER=1.65.0
+
 setup_env() {
   : ${SOURCE_DIR:="$(pwd)/source"}
   : ${WORKING_DIR:="$(pwd)/working"}
@@ -15,13 +19,13 @@
   : ${OUTPUT_DIR:="$(pwd)/${ARCH}-linux-gnu"}
   OUTPUT_BIN_DIR="${OUTPUT_DIR}/bin"
   OUTPUT_ETC_DIR="${OUTPUT_DIR}/etc"
-  OUTPUT_LIB_DIR="${OUTPUT_DIR}/bin"
+  OUTPUT_SECCOMP_DIR="${OUTPUT_ETC_DIR}/seccomp"
 
   export PATH="${PATH}:${TOOLS_DIR}:${HOME}/.local/bin"
   export PKG_CONFIG_PATH="${WORKING_DIR}/usr/lib/pkgconfig"
 }
 
-set -o errexit
+set -e
 set -x
 
 fatal_echo() {
@@ -34,17 +38,15 @@
   cd
   rm -rf .cargo
   # Sometimes curl hangs. When it does, retry
-  retry curl -LO \
-    "https://static.rust-lang.org/rustup/archive/1.14.0/$(uname -m)-unknown-linux-gnu/rustup-init"
-  # echo "0077ff9c19f722e2be202698c037413099e1188c0c233c12a2297bf18e9ff6e7 *rustup-init" | sha256sum -c -
+  retry curl -L \
+    --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup-init
   chmod +x rustup-init
-  ./rustup-init -y --no-modify-path
+  ./rustup-init -y --no-modify-path --default-toolchain ${RUST_TOOLCHAIN_VER}
   source $HOME/.cargo/env
   if [[ -n "$1" ]]; then
     rustup target add "$1"
   fi
-  rustup component add rustfmt-preview
-  rm rustup-init
+  rm -f rustup-init
 
   if [[ -n "$1" ]]; then
   cat >>~/.cargo/config <<EOF
@@ -56,28 +58,32 @@
 
 install_packages() {
   echo Installing packages...
+
   sudo dpkg --add-architecture arm64
   sudo apt-get update
   sudo apt-get install -y \
+      "$@" \
       autoconf \
       automake \
       build-essential \
-      "$@" \
-      cmake \
       curl \
-      gcc \
+      doxygen \
       g++ \
+      gcc \
       git \
+      graphviz \
       libcap-dev \
-      libfdt-dev \
       libegl1-mesa-dev \
+      libfdt-dev \
       libgl1-mesa-dev \
       libgles2-mesa-dev \
       libpciaccess-dev \
       libssl-dev \
       libtool \
       libusb-1.0-0-dev \
+      libwayland-bin \
       libwayland-dev \
+      libxml2-dev \
       make \
       nasm \
       ninja-build \
@@ -86,14 +92,26 @@
       python \
       python3 \
       python3-pip \
+      texinfo \
+      wayland-protocols \
+      xmlto \
       xutils-dev # Needed to pacify autogen.sh for libepoxy
   mkdir -p "${TOOLS_DIR}"
+
   curl https://storage.googleapis.com/git-repo-downloads/repo > "${TOOLS_DIR}/repo"
   chmod a+x "${TOOLS_DIR}/repo"
 
+  # Gfxstream needs a new-ish version of CMake
+  mkdir -p "${TOOLS_DIR}/cmake"
+  cd "${TOOLS_DIR}/cmake"
+  curl -O -L https://cmake.org/files/v3.22/cmake-3.22.1-linux-$(uname -m).sh
+  chmod +x cmake-3.22.1-linux-$(uname -m).sh
+  sudo ./cmake-3.22.1-linux-$(uname -m).sh --skip-license --exclude-subdir --prefix=/usr/local
+  cmake --version
+
   # Meson getting started guide mentions that the distro version is frequently
   # outdated and recommends installing via pip.
-  pip3 install meson
+  pip3 install --no-warn-script-location meson
 
   # Tools for building gfxstream
   pip3 install absl-py
@@ -139,7 +157,7 @@
   fi
 
   cp ${CUSTOM_MANIFEST} manifest.xml
-  repo init --partial-clone -q -u https://android.googlesource.com/platform/manifest -m ../../manifest.xml
+  repo init --depth=1 -q -u https://android.googlesource.com/platform/manifest -m $PWD/manifest.xml
   repo sync
 }
 
@@ -158,9 +176,22 @@
   fetch_source
 }
 
+# $1 = installed library filename
+debuglink() {
+  objcopy --only-keep-debug "${OUTPUT_BIN_DIR}/$1" "${OUTPUT_BIN_DIR}/$1.debug"
+  strip --strip-debug "${OUTPUT_BIN_DIR}/$1"
+  cd "${OUTPUT_BIN_DIR}"
+  objcopy --add-gnu-debuglink="$1.debug" "$1"
+  cd -
+}
+
 compile_libdrm() {
   cd "${SOURCE_DIR}/external/libdrm"
 
+  # Ensure pkg-config file supplies rpath to dependent libraries
+  grep "install_rpath" meson.build || \
+    sed -i "s|install : true,|install : true, install_rpath : '\$ORIGIN',|" meson.build
+
   meson build \
     --libdir="${WORKING_DIR}/usr/lib" \
     --prefix="${WORKING_DIR}/usr" \
@@ -174,10 +205,10 @@
     -Dvmwgfx=false
 
   cd build
-
   ninja install
 
-  cp "${WORKING_DIR}"/usr/lib/libdrm.so.2 "${OUTPUT_LIB_DIR}"
+  cp -a "${WORKING_DIR}"/usr/lib/libdrm.so* "${OUTPUT_BIN_DIR}"
+  debuglink libdrm.so.2.4.0
 }
 
 compile_minijail() {
@@ -185,15 +216,33 @@
 
   cd "${SOURCE_DIR}/platform/minijail"
 
-  make -j OUT="${WORKING_DIR}"
+  if ! grep '^# cuttlefish_vmm-rebuild-mark' Makefile; then
+    # Link minijail-sys rust crate dynamically to minijail
+    sed -i '/BUILD_STATIC_LIBS/d' rust/minijail-sys/build.rs
+    sed -i 's,static=minijail.pic,dylib=minijail,' rust/minijail-sys/build.rs
 
-  cp "${WORKING_DIR}/libminijail.so" "${OUTPUT_LIB_DIR}"
+    # Use Android prebuilt C files instead of generating them
+    sed -i 's,\(.*\.gen\.c: \),DISABLED_\1,' Makefile
+    cat >>Makefile <<EOF
+libconstants.gen.c: \$(SRC)/linux-x86/libconstants.gen.c
+	@cp \$< \$@
+libsyscalls.gen.c: \$(SRC)/linux-x86/libsyscalls.gen.c
+	@cp \$< \$@
+# cuttlefish_vmm-rebuild-mark
+EOF
+  fi
+
+  make -j OUT="${WORKING_DIR}"
+  cp "${WORKING_DIR}"/libminijail.so "${WORKING_DIR}"/usr/lib
+
+  cp -a "${WORKING_DIR}"/usr/lib/libminijail.so "${OUTPUT_BIN_DIR}"
+  debuglink libminijail.so
 }
 
 compile_minigbm() {
   echo "Compiling Minigbm..."
 
-  cd "${SOURCE_DIR}/third_party/minigbm"
+  cd "${SOURCE_DIR}/platform/minigbm"
 
   # Minigbm's package config file has a default hard-coded path. Update here so
   # that dependent packages can find the files.
@@ -201,7 +250,8 @@
 
   # The gbm used by upstream linux distros is not compatible with crosvm, which must use Chrome OS's
   # minigbm.
-  local cpp_flags=()
+  local cpp_flags=(-I/working/usr/include -I/working/usr/include/libdrm)
+  local ld_flags=(-Wl,-soname,libgbm.so.1 -Wl,-rpath,\\\$\$ORIGIN -L/working/usr/lib)
   local make_flags=()
   local minigbm_drv=(${MINIGBM_DRV})
   for drv in "${minigbm_drv[@]}"; do
@@ -213,9 +263,12 @@
     "${make_flags[@]}" \
     CPPFLAGS="${cpp_flags[*]}" \
     DESTDIR="${WORKING_DIR}" \
+    LDFLAGS="${ld_flags[*]}" \
     OUT="${WORKING_DIR}"
 
-  cp ${WORKING_DIR}/usr/lib/libgbm.so.1 "${OUTPUT_LIB_DIR}"
+  cp -a "${WORKING_DIR}"/usr/lib/libminigbm.so* "${OUTPUT_BIN_DIR}"
+  cp -a "${WORKING_DIR}"/usr/lib/libgbm.so* "${OUTPUT_BIN_DIR}"
+  debuglink libminigbm.so.1.0.0
 }
 
 compile_epoxy() {
@@ -229,86 +282,155 @@
     -Degl=yes
 
   cd build
-
   ninja install
 
-  cp "${WORKING_DIR}"/usr/lib/libepoxy.so.0 "${OUTPUT_LIB_DIR}"
+  cp -a "${WORKING_DIR}"/usr/lib/libepoxy.so* "${OUTPUT_BIN_DIR}"
+  debuglink libepoxy.so.0.0.0
 }
 
 compile_virglrenderer() {
   echo "Compiling VirglRenderer..."
 
-    # Note: depends on libepoxy
+  # Note: depends on libepoxy
   cd "${SOURCE_DIR}/third_party/virglrenderer"
 
-  # Meson doesn't like gbm's version code.
-  sed -i "s|_gbm_ver = '0.0.0'|_gbm_ver = '0'|" meson.build
-
   # Meson needs to have dependency information for header lookup.
   sed -i "s|cc.has_header('epoxy/egl.h')|cc.has_header('epoxy/egl.h', dependencies: epoxy_dep)|" meson.build
 
-  # Need to figure out the right way to pass this down...
+  # Ensure pkg-config file supplies rpath to dependent libraries
   grep "install_rpath" src/meson.build || \
-    sed -i "s|install : true|install : true, install_rpath : '\$ORIGIN',|" src/meson.build
+    sed -i "s|install : true|install : true, install_rpath : '\$ORIGIN'|" src/meson.build
 
   meson build \
     --libdir="${WORKING_DIR}/usr/lib" \
     --prefix="${WORKING_DIR}/usr" \
     -Dplatforms=egl \
-    -Dminigbm_allocation=false \
-    -Dunstable_apis=true
+    -Dminigbm_allocation=false
 
   cd build
-
   ninja install
 
-  cp "${WORKING_DIR}/usr/lib/libvirglrenderer.so.1" "${OUTPUT_LIB_DIR}"
+  cp -a "${WORKING_DIR}"/usr/lib/libvirglrenderer.so* "${OUTPUT_BIN_DIR}"
+  debuglink libvirglrenderer.so.1.7.7
+}
 
-  cd "${OUTPUT_LIB_DIR}"
-  ln -s -f "libvirglrenderer.so.1" "libvirglrenderer.so"
+compile_libffi() {
+  cd "${SOURCE_DIR}/third_party/libffi"
+
+  ./autogen.sh
+  ./configure \
+    --prefix="${WORKING_DIR}/usr" \
+    --libdir="${WORKING_DIR}/usr/lib"
+  make && make check && make install
+
+  cp -a "${WORKING_DIR}"/usr/lib/libffi.so* "${OUTPUT_BIN_DIR}"
+  debuglink libffi.so.7.1.0
+}
+
+compile_wayland() {
+  cd "${SOURCE_DIR}/third_party/wayland"
+
+  # Need to figure out the right way to pass this down...
+  sed -i "s|install: true\$|install: true, install_rpath : '\$ORIGIN'|" src/meson.build
+
+  meson build \
+    --libdir="${WORKING_DIR}/usr/lib" \
+    --prefix="${WORKING_DIR}/usr"
+  ninja -C build/ install
+
+  cp -a "${WORKING_DIR}"/usr/lib/libwayland-client.so* "${OUTPUT_BIN_DIR}"
+  debuglink libwayland-client.so.0.3.0
 }
 
 compile_gfxstream() {
   echo "Compiling gfxstream..."
 
-    # Note: depends on libepoxy
-  cd "${SOURCE_DIR}/external/qemu"
+  local dist_dir="${SOURCE_DIR}/hardware/google/gfxstream/build"
+  [ -d "${dist_dir}" ] && rm -rf "${dist_dir}"
+  mkdir "${dist_dir}"
+  cd "${dist_dir}"
 
-  # TODO: Fix or remove network unit tests that are failing in docker,
-  # so we can take out "notests"
-  python3 android/build/python/cmake.py --gfxstream_only --notests
-  local dist_dir="${SOURCE_DIR}/external/qemu/objs/distribution/emulator/lib64"
+  cmake .. -G Ninja -DDEPENDENCY_RESOLUTION=AOSP
+  ninja
+  chmod +x "${dist_dir}"/libgfxstream_backend.so
+  cp -a "${dist_dir}"/libgfxstream_backend.so "${WORKING_DIR}"/usr/lib
 
-  cp "${dist_dir}/libc++.so.1" "${OUTPUT_LIB_DIR}"
-  cp "${dist_dir}/libandroid-emu-shared.so" "${OUTPUT_LIB_DIR}"
-  cp "${dist_dir}/libemugl_common.so" "${OUTPUT_LIB_DIR}"
-  cp "${dist_dir}/libOpenglRender.so" "${OUTPUT_LIB_DIR}"
-  cp "${dist_dir}/libgfxstream_backend.so" "${OUTPUT_LIB_DIR}"
+  cp -a "${WORKING_DIR}"/usr/lib/libgfxstream_backend.so "${OUTPUT_BIN_DIR}"
+  debuglink libgfxstream_backend.so
 }
 
 compile_crosvm() {
   echo "Compiling Crosvm..."
 
   source "${HOME}/.cargo/env"
+
+  # Workaround for aosp/1412815
+  cd "${SOURCE_DIR}/platform/crosvm/protos/src"
+  if ! grep '^mod generated {$' lib.rs; then
+    cat >>lib.rs <<EOF
+mod generated {
+    include!(concat!(env!("OUT_DIR"), "/generated.rs"));
+}
+EOF
+  fi
+  sed -i "s/pub use cdisk_spec_proto::cdisk_spec/pub use generated::cdisk_spec/" lib.rs
+
   cd "${SOURCE_DIR}/platform/crosvm"
 
-  local crosvm_features=audio,gpu,composite-disk,virtio-gpu-next
+  # Workaround for minijail-sys prepending -L/usr/lib/$arch dir
+  # which breaks the preferred search path for libdrm.so
+  sed -i '0,/pkg_config::Config::new().probe("libdrm")?;/{/pkg_config::Config::new().probe("libdrm")?;/d;}' rutabaga_gfx/build.rs
 
+  local crosvm_features=audio,gdb,gpu,composite-disk,usb,virgl_renderer
   if [[ $BUILD_GFXSTREAM -eq 1 ]]; then
       crosvm_features+=,gfxstream
   fi
 
-  RUSTFLAGS="-C link-arg=-Wl,-rpath,\$ORIGIN -C link-arg=-L${OUTPUT_LIB_DIR}" \
+  GFXSTREAM_PATH="${WORKING_DIR}/usr/lib" \
+  CROSVM_USE_SYSTEM_VIRGLRENDERER=1 \
+  RUSTFLAGS="-C link-arg=-Wl,-rpath,\$ORIGIN -C link-arg=${WORKING_DIR}/usr/lib/libdrm.so" \
     cargo build --features ${crosvm_features}
 
   # Save the outputs
   cp Cargo.lock "${OUTPUT_DIR}"
   cp target/debug/crosvm "${OUTPUT_BIN_DIR}"
+  debuglink crosvm
 
   cargo --version --verbose > "${OUTPUT_DIR}/cargo_version.txt"
   rustup show > "${OUTPUT_DIR}/rustup_show.txt"
 }
 
+compile_crosvm_seccomp() {
+  echo "Processing Crosvm Seccomp..."
+
+  cd "${SOURCE_DIR}/platform/crosvm"
+  case ${ARCH} in
+    x86_64) subdir="${ARCH}" ;;
+    amd64) subdir="x86_64" ;;
+    arm64) subdir="aarch64" ;;
+    aarch64) subdir="${ARCH}" ;;
+    *)
+      echo "${ARCH} is not supported"
+      exit 15
+  esac
+
+  inlined_policy_list="\
+    jail/seccomp/$subdir/common_device.policy \
+    jail/seccomp/$subdir/gpu_common.policy \
+    jail/seccomp/$subdir/serial.policy \
+    jail/seccomp/$subdir/net.policy \
+    jail/seccomp/$subdir/block.policy \
+    jail/seccomp/$subdir/vvu.policy \
+    jail/seccomp/$subdir/vhost_user.policy \
+    jail/seccomp/$subdir/vhost_vsock.policy"
+  for policy_file in "jail/seccomp/$subdir/"*.policy; do
+    [[ "$inlined_policy_list" = *"$policy_file"* ]] && continue
+    jail/seccomp/policy-inliner.sh $inlined_policy_list <"$policy_file" | \
+      grep -ve "^@frequency" \
+      >"${OUTPUT_SECCOMP_DIR}"/$(basename "$policy_file")
+  done
+}
+
 compile() {
   echo "Compiling..."
   mkdir -p \
@@ -316,31 +438,31 @@
     "${OUTPUT_DIR}" \
     "${OUTPUT_BIN_DIR}" \
     "${OUTPUT_ETC_DIR}" \
-    "${OUTPUT_LIB_DIR}"
+    "${OUTPUT_SECCOMP_DIR}"
 
   if [[ $BUILD_CROSVM -eq 1 ]]; then
-      compile_libdrm
-      compile_minijail
-      compile_minigbm
-      compile_epoxy
-      compile_virglrenderer
+    compile_libdrm
+    compile_minijail
+    compile_minigbm
+    compile_epoxy
+    compile_virglrenderer
+    compile_libffi # wayland depends on it
+    compile_wayland
   fi
 
-  # TODO: Finish the aarch64 cross/native gfxstream build
   if [[ $BUILD_GFXSTREAM -eq 1 ]]; then
-      compile_gfxstream
+    compile_gfxstream
   fi
 
-  if [[ $BUILD_CROSVM -eq 1 ]]; then
-      compile_crosvm
-  fi
+  compile_crosvm
+  compile_crosvm_seccomp
 
   dpkg-query -W > "${OUTPUT_DIR}/builder-packages.txt"
   echo "Results in ${OUTPUT_DIR}"
 }
 
 aarch64_retry() {
-  MINIGBM_DRV="RADEON VC4" BUILD_CROSVM=1 compile
+  BUILD_CROSVM=1 BUILD_GFXSTREAM=1 compile
 }
 
 aarch64_build() {
@@ -349,7 +471,7 @@
 }
 
 x86_64_retry() {
-  MINIGBM_DRV="I915 RADEON VC4" BUILD_GFXSTREAM=1 compile
+  MINIGBM_DRV="I915 RADEON VC4" BUILD_CROSVM=1 BUILD_GFXSTREAM=1 compile
 }
 
 x86_64_build() {

diff --git a/rebuild.sh b/rebuild.sh
index 32fc36c..91b1a5f 100755
--- a/rebuild.sh
+++ b/rebuild.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
 
-set -e
-
 # Common code to build a host image on GCE
 
 # INTERNAL_extra_source may be set to a directory containing the source for
@@ -36,11 +34,11 @@
 # GCE options
 
 DEFINE_boolean gce false "Build on a GCE instance"
+DEFINE_string gce_arch "$(uname -m)" "Target architecture"
 DEFINE_string gce_project "$(gcloud config get-value project)" "Project to use" "p"
-DEFINE_string gce_source_image_family debian-10 "Image familty to use as the base" "s"
-DEFINE_string gce_source_image_project debian-cloud "Project holding the base image" "m"
 DEFINE_string gce_instance "${USER}-build" "Instance name to create for the build" "i"
 DEFINE_string gce_user cuttlefish_crosvm_builder "User name to use on GCE when doing the build"
+DEFINE_integer gce_vcpus 4 "Instance size (vcpus) to create"
 DEFINE_string gce_zone "$(gcloud config get-value compute/zone)" "Zone to use" "z"
 
 # Common options
@@ -49,6 +47,8 @@
 DEFINE_boolean reuse false "Set to true to reuse a previously-set-up instance."
 DEFINE_boolean reuse_resync false "Reuse a previously-set-up instance, but clean and re-sync the sources. Overrides --reuse if both are specified."
 
+set -e
+
 SSH_FLAGS=(${INTERNAL_IP})
 
 wait_for_instance() {
@@ -159,6 +159,25 @@
 
 function build_on_gce() {
   check_common_docker_options
+  if [[ "${FLAGS_gce_arch}" != "${FLAGS_docker_arch}" ]]; then
+    echo Docker arch must match gce arch 1>&2
+    fail=1
+  fi
+  local _image_family=""
+  local _machine_type=""
+  case "${FLAGS_gce_arch}" in
+    aarch64)
+      _image_family=debian-11-arm64
+      _machine_type=t2a-standard
+      ;;
+    x86_64)
+      _image_family=debian-11
+      _machine_type=n1-standard
+      ;;
+    *) echo Invalid value ${FLAGS_gce_arch} for --gce_arch 1>&2
+      fail=1
+      ;;
+  esac
   if [[ -z "${FLAGS_gce_instance}" ]]; then
     echo Must specify instance 1>&2
     fail=1
@@ -193,20 +212,19 @@
     gcloud compute disks create \
       "${delete_instances[@]/%/-disk}" \
       "${project_zone_flags[@]}" \
-      --image-project="${FLAGS_gce_source_image_project}" \
-      --image-family="${FLAGS_gce_source_image_family}"
+      --image-project="debian-cloud" \
+      --image-family="${_image_family}"
     gcloud compute images create \
       "${delete_instances[@]/%/-image}" \
       --source-disk "${delete_instances[@]/%/-disk}" \
-      --project "${FLAGS_gce_project}" --source-disk-zone "${FLAGS_gce_zone}" \
-      --licenses "https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx"
+      --project "${FLAGS_gce_project}" --source-disk-zone "${FLAGS_gce_zone}"
     gcloud compute instances create \
       "${delete_instances[@]}" \
       "${project_zone_flags[@]}" \
       --image "${delete_instances[@]/%/-image}" \
       --boot-disk-size=200GB \
-      --machine-type=n1-standard-8 \
-      --min-cpu-platform "Intel Skylake"
+      --machine-type="${_machine_type}-${FLAGS_gce_vcpus}" \
+      --network-interface=nic-type=GVNIC
 
     wait_for_instance "${FLAGS_gce_instance}" "${project_zone_flags[@]}"
 
@@ -214,7 +232,7 @@
     gcloud beta compute ssh "${SSH_FLAGS[@]}" \
         "${project_zone_flags[@]}" \
         "${FLAGS_gce_user}@${FLAGS_gce_instance}" -- \
-        'curl -fsSL https://get.docker.com | /bin/bash'
+        'curl --retry 10 --retry-all-errors -fsSL https://get.docker.com | /bin/bash'
     gcloud beta compute ssh "${SSH_FLAGS[@]}" \
         "${project_zone_flags[@]}" \
         "${FLAGS_gce_user}@${FLAGS_gce_instance}" -- \

diff --git a/scripts/crosvm b/scripts/crosvm
deleted file mode 100755
index 6b4029a..0000000
--- a/scripts/crosvm
+++ /dev/null

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-export LD_PRELOAD=libdrm.so.2
-exec "$(dirname "$0")/$(uname -m)-linux-gnu/$(basename "$0")" "${@}"

diff --git a/update-manifest-gfxstream.py b/update-manifest-gfxstream.py
deleted file mode 100755
index 6d60064..0000000
--- a/update-manifest-gfxstream.py
+++ /dev/null

@@ -1,122 +0,0 @@
-#!/usr/bin/python3
-# Copyright 2020 - The Android Open Source Project
-#
-# Licensed under the Apache License, Version 2.0 (the',  help='License');
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an',  help='AS IS' BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# Script that makes it easy to have the docker build correspond to a particular
-# gfxstream Android build id
-
-import os
-import subprocess
-import sys
-import lxml.etree as etree
-
-gfxstream_manifest_filename = sys.argv[1]
-target_manifest_filename = sys.argv[2]
-
-# Don't need to check out the entire emulator repo to build gfxstream
-gfxstream_projects = set([
-  "device/generic/goldfish-opengl",
-  "device/generic/vulkan-cereal",
-  "platform/external/angle",
-  "platform/external/astc-codec",
-  "platform/external/boringssl",
-  "platform/external/c-ares",
-  "platform/external/curl",
-  "platform/external/deqp",
-  "platform/external/ffmpeg",
-  "platform/external/googletest",
-  "platform/external/google-benchmark",
-  "platform/external/google-breakpad",
-  "platform/external/grpc-grpc",
-  "platform/external/libffi",
-  "platform/external/libvpx",
-  "platform/external/libyuv",
-  "platform/external/libpng",
-  "platform/external/libusb",
-  "platform/external/lz4",
-  "platform/external/protobuf",
-  "platform/external/qemu",
-  "platform/external/tinyobjloader",
-  "platform/external/nasm",
-  "platform/external/zlib",
-  "platform/prebuilts/android-emulator-build/common",
-  "platform/prebuilts/android-emulator-build/curl",
-  "platform/prebuilts/android-emulator-build/mesa",
-  "platform/prebuilts/android-emulator-build/mesa-deps",
-  "platform/prebuilts/android-emulator-build/protobuf",
-  "platform/prebuilts/android-emulator-build/qemu-android-deps",
-  "platform/prebuilts/clang/host/linux-x86",
-  "platform/prebuilts/cmake/linux-x86",
-  "platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.17-4.8",
-  "platform/prebuilts/ninja/linux-x86",
-])
-
-def generate_filtered_gfxstream_projects(filename):
-    outs = []
-
-    out = etree.Element("manifest")
-
-    t = etree.parse(filename)
-    r = t.getroot()
-
-    for e in r.findall("project"):
-        if e.attrib["name"] in gfxstream_projects:
-            outp = etree.SubElement(out, "project")
-            outs.append(outp)
-            outp.set("groups", "gfxstream")
-            outp.set("name", e.attrib["name"])
-            outp.set("path", e.attrib["path"])
-            outp.set("revision", e.attrib["revision"])
-
-    return dict(map(lambda e: (e.attrib["name"], e), outs))
-
-def update_projects(current_gfxstream_projects, target_manifest_filename):
-    target_root = etree.parse( \
-        target_manifest_filename,
-        etree.XMLParser(remove_blank_text=True)).getroot()
-
-    found_projects = []
-
-    for e in target_root.findall("project"):
-        if e.attrib["name"] in gfxstream_projects:
-            e.set("revision", current_gfxstream_projects[e.attrib["name"]].attrib["revision"])
-            found_projects.append(e.attrib["name"])
-
-    projects_to_add = gfxstream_projects - set(found_projects)
-
-    for p in projects_to_add:
-        project_element = current_gfxstream_projects[p]
-        outp = etree.SubElement(target_root, "project")
-        outp.set("groups", project_element.attrib["groups"])
-        outp.set("name", project_element.attrib["name"])
-        outp.set("path", project_element.attrib["path"])
-        outp.set("revision", project_element.attrib["revision"])
-
-    return target_root
-
-print("Generating...")
-output_string = etree.tostring( \
-    update_projects(
-        generate_filtered_gfxstream_projects(gfxstream_manifest_filename),
-        target_manifest_filename),
-    pretty_print=True,
-    xml_declaration=True,encoding="utf-8")
-
-print("Result: ")
-print(output_string.decode())
-print("Writing result to %s" % target_manifest_filename)
-
-fh = open(target_manifest_filename, 'wb')
-fh.write(output_string)
-fh.close()

diff --git a/x86_64-linux-gnu/Android.bp b/x86_64-linux-gnu/Android.bp
new file mode 100644
index 0000000..2d8355a
--- /dev/null
+++ b/x86_64-linux-gnu/Android.bp

@@ -0,0 +1,274 @@
+// Autogenerated via gen_android_bp.sh
+//
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+prebuilt_usr_share_host {
+  name: "9p_device.policy_at_x86_64",
+  src: "etc/seccomp/9p_device.policy",
+  filename: "9p_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "balloon_device.policy_at_x86_64",
+  src: "etc/seccomp/balloon_device.policy",
+  filename: "balloon_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "battery.policy_at_x86_64",
+  src: "etc/seccomp/battery.policy",
+  filename: "battery.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "block_device.policy_at_x86_64",
+  src: "etc/seccomp/block_device.policy",
+  filename: "block_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "block_device_vhost_user.policy_at_x86_64",
+  src: "etc/seccomp/block_device_vhost_user.policy",
+  filename: "block_device_vhost_user.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "block_device_vvu.policy_at_x86_64",
+  src: "etc/seccomp/block_device_vvu.policy",
+  filename: "block_device_vvu.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "coiommu_device.policy_at_x86_64",
+  src: "etc/seccomp/coiommu_device.policy",
+  filename: "coiommu_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "coiommu.policy_at_x86_64",
+  src: "etc/seccomp/coiommu.policy",
+  filename: "coiommu.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "common_device.policy_at_x86_64",
+  src: "etc/seccomp/common_device.policy",
+  filename: "common_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "cras_audio_device.policy_at_x86_64",
+  src: "etc/seccomp/cras_audio_device.policy",
+  filename: "cras_audio_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "cras_snd_device.policy_at_x86_64",
+  src: "etc/seccomp/cras_snd_device.policy",
+  filename: "cras_snd_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "fs_device.policy_at_x86_64",
+  src: "etc/seccomp/fs_device.policy",
+  filename: "fs_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "gpu_common.policy_at_x86_64",
+  src: "etc/seccomp/gpu_common.policy",
+  filename: "gpu_common.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "gpu_device.policy_at_x86_64",
+  src: "etc/seccomp/gpu_device.policy",
+  filename: "gpu_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "gpu_render_server.policy_at_x86_64",
+  src: "etc/seccomp/gpu_render_server.policy",
+  filename: "gpu_render_server.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "input_device.policy_at_x86_64",
+  src: "etc/seccomp/input_device.policy",
+  filename: "input_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "iommu_device.policy_at_x86_64",
+  src: "etc/seccomp/iommu_device.policy",
+  filename: "iommu_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "jail_warden.policy_at_x86_64",
+  src: "etc/seccomp/jail_warden.policy",
+  filename: "jail_warden.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "net_device.policy_at_x86_64",
+  src: "etc/seccomp/net_device.policy",
+  filename: "net_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "net_device_vhost_user.policy_at_x86_64",
+  src: "etc/seccomp/net_device_vhost_user.policy",
+  filename: "net_device_vhost_user.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "null_audio_device.policy_at_x86_64",
+  src: "etc/seccomp/null_audio_device.policy",
+  filename: "null_audio_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "pmem_device.policy_at_x86_64",
+  src: "etc/seccomp/pmem_device.policy",
+  filename: "pmem_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "rng_device.policy_at_x86_64",
+  src: "etc/seccomp/rng_device.policy",
+  filename: "rng_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "serial_device.policy_at_x86_64",
+  src: "etc/seccomp/serial_device.policy",
+  filename: "serial_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "serial_device_vhost_user.policy_at_x86_64",
+  src: "etc/seccomp/serial_device_vhost_user.policy",
+  filename: "serial_device_vhost_user.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "serial_device_vvu.policy_at_x86_64",
+  src: "etc/seccomp/serial_device_vvu.policy",
+  filename: "serial_device_vvu.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "serial.policy_at_x86_64",
+  src: "etc/seccomp/serial.policy",
+  filename: "serial.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "snd_cras_device.policy_at_x86_64",
+  src: "etc/seccomp/snd_cras_device.policy",
+  filename: "snd_cras_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "snd_null_device.policy_at_x86_64",
+  src: "etc/seccomp/snd_null_device.policy",
+  filename: "snd_null_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "swap_monitor.policy_at_x86_64",
+  src: "etc/seccomp/swap_monitor.policy",
+  filename: "swap_monitor.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "tpm_device.policy_at_x86_64",
+  src: "etc/seccomp/tpm_device.policy",
+  filename: "tpm_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vfio_device.policy_at_x86_64",
+  src: "etc/seccomp/vfio_device.policy",
+  filename: "vfio_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_net_device.policy_at_x86_64",
+  src: "etc/seccomp/vhost_net_device.policy",
+  filename: "vhost_net_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_vsock_device.policy_at_x86_64",
+  src: "etc/seccomp/vhost_vsock_device.policy",
+  filename: "vhost_vsock_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_vsock_device_vhost_user.policy_at_x86_64",
+  src: "etc/seccomp/vhost_vsock_device_vhost_user.policy",
+  filename: "vhost_vsock_device_vhost_user.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vhost_vsock_device_vvu.policy_at_x86_64",
+  src: "etc/seccomp/vhost_vsock_device_vvu.policy",
+  filename: "vhost_vsock_device_vvu.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "video_device.policy_at_x86_64",
+  src: "etc/seccomp/video_device.policy",
+  filename: "video_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vios_audio_device.policy_at_x86_64",
+  src: "etc/seccomp/vios_audio_device.policy",
+  filename: "vios_audio_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vtpm_proxy_device.policy_at_x86_64",
+  src: "etc/seccomp/vtpm_proxy_device.policy",
+  filename: "vtpm_proxy_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "vvu_proxy_device.policy_at_x86_64",
+  src: "etc/seccomp/vvu_proxy_device.policy",
+  filename: "vvu_proxy_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "wl_device.policy_at_x86_64",
+  src: "etc/seccomp/wl_device.policy",
+  filename: "wl_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "xhci_device.policy_at_x86_64",
+  src: "etc/seccomp/xhci_device.policy",
+  filename: "xhci_device.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}
+prebuilt_usr_share_host {
+  name: "xhci.policy_at_x86_64",
+  src: "etc/seccomp/xhci.policy",
+  filename: "xhci.policy",
+  sub_dir: "cuttlefish/x86_64-linux-gnu/seccomp",
+}

diff --git a/x86_64-linux-gnu/Cargo.lock b/x86_64-linux-gnu/Cargo.lock
index fa6fb2f..a194fce 100644
--- a/x86_64-linux-gnu/Cargo.lock
+++ b/x86_64-linux-gnu/Cargo.lock

@@ -1,56 +1,281 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
+version = 3
+
 [[package]]
 name = "aarch64"
 version = "0.1.0"
 dependencies = [
  "arch",
- "data_model",
+ "base",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
  "devices",
- "io_jail",
+ "gdbstub",
+ "gdbstub_arch",
+ "hypervisor",
+ "jail",
  "kernel_cmdline",
- "kvm",
- "kvm_sys",
+ "kernel_loader",
  "libc",
+ "memoffset 0.6.5",
+ "minijail",
+ "rand",
  "remain",
  "resources",
+ "swap",
  "sync",
- "sys_util",
+ "thiserror",
  "vm_control",
+ "vm_memory",
 ]
 
 [[package]]
 name = "acpi_tables"
 version = "0.1.0"
 dependencies = [
- "data_model",
+ "tempfile",
+ "zerocopy",
 ]
 
 [[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anti_tamper"
+version = "0.1.0"
+dependencies = [
+ "base",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb07d2053ccdbe10e2af2995a2f116c1330396493dc1269f6a91d0ae82e19704"
+
+[[package]]
+name = "arbitrary"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f44124848854b941eafdb34f05b3bcf59472f643c7e151eba7c2b69daa469ed5"
+
+[[package]]
 name = "arch"
 version = "0.1.0"
 dependencies = [
+ "acpi_tables",
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_fdt",
+ "cros_tracing",
  "devices",
- "io_jail",
+ "gdbstub",
+ "gdbstub_arch",
+ "hypervisor",
+ "jail",
  "kernel_cmdline",
- "kvm",
  "libc",
+ "minijail",
+ "power_monitor",
+ "remain",
  "resources",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "swap",
  "sync",
- "sys_util",
+ "thiserror",
  "vm_control",
+ "vm_memory",
+ "winapi",
 ]
 
 [[package]]
+name = "argh"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab257697eb9496bf75526f0217b5ed64636a9cfafa78b8365c71bd283fcef93e"
+dependencies = [
+ "argh_derive",
+ "argh_shared",
+]
+
+[[package]]
+name = "argh_derive"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b382dbd3288e053331f03399e1db106c9fb0d8562ad62cb04859ae926f324fa6"
+dependencies = [
+ "argh_shared",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "argh_helpers"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "argh_shared"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cb94155d965e3d37ffbbe7cc5b82c3dd79dd33bd48e536f73d2cfb8d85506f"
+
+[[package]]
 name = "assertions"
 version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d2db826478dd8333d60f91c74ff8f0b3d01252a32631f004b11fbb18c941036"
+
+[[package]]
+name = "async-task"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a40729d2133846d9ed0ea60a8b9541bccddab49cd30f0715a1da672fe9a2524"
+
+[[package]]
+name = "async-trait"
+version = "0.1.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96cf8829f67d2eab0b2dfa42c5d0ef737e0724e4a82b01b3e292456202b19716"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
 
 [[package]]
 name = "audio_streams"
 version = "0.1.0"
 dependencies = [
+ "async-trait",
+ "futures",
+ "remain",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "audio_streams_conformance_test"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "audio_streams",
+ "cfg-if",
+ "cros_async",
+ "libcras",
+ "minijail",
+ "remain",
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "audio_util"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "audio_streams",
+ "base",
+ "thiserror",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "balloon_control"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "base"
+version = "0.1.0"
+dependencies = [
+ "audio_streams",
+ "base_event_token_derive",
+ "cfg-if",
+ "chrono",
+ "data_model 0.1.1-alpha.1",
+ "env_logger",
+ "libc",
+ "libtest-mimic",
+ "log",
+ "minijail",
+ "once_cell",
+ "protobuf",
+ "rand",
+ "regex",
+ "remain",
+ "serde",
+ "serde_json",
+ "smallvec",
  "sync",
- "sys_util",
+ "tempfile",
+ "thiserror",
+ "uuid",
+ "win_util",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "base_event_token_derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.60.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "062dddbc1ba4aca46de6338e2bf87771414c335f7b2f2036e8f3e9befebf88e6"
+dependencies = [
+ "bitflags 1.3.2",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "peeking_take_while",
+ "proc-macro2",
+ "quote 1.0.33",
+ "regex",
+ "rustc-hash",
+ "shlex",
 ]
 
 [[package]]
@@ -65,45 +290,357 @@
 version = "0.1.0"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 2.0.32",
 ]
 
 [[package]]
 name = "bitflags"
-version = "1.2.1"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbe3c979c178231552ecba20214a8272df4e09f232a87aef4320cf06539aded"
+
+[[package]]
+name = "bitreader"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d84ea71c85d1fe98fe67a9b9988b1695bc24c0b0d3bfb18d4c510f44b4b09941"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "broker_ipc"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "broker_ipc_product",
+ "crash_report",
+ "metrics",
+ "serde",
+]
+
+[[package]]
+name = "broker_ipc_product"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "crash_report",
+ "serde",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0b3de4a0c5e67e16066a0715723abd91edc2f9001d09c46e1dca929351e130e"
+
+[[package]]
+name = "catapult_converter"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
+[[package]]
+name = "cbindgen"
+version = "0.24.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6358dedf60f4d9b8db43ad187391afe959746101346fe51bb978126bec61dfb"
+dependencies = [
+ "clap 3.2.23",
+ "heck",
+ "indexmap",
+ "log",
+ "proc-macro2",
+ "quote 1.0.33",
+ "serde",
+ "serde_json",
+ "syn 1.0.103",
+ "tempfile",
+ "toml",
+]
 
 [[package]]
 name = "cc"
-version = "1.0.25"
+version = "1.0.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f159dfd43363c4d08055a07703eb7a3406b0dac4d0584d96965a3262db3c9d16"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+dependencies = [
+ "jobserver",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
 
 [[package]]
 name = "cfg-if"
-version = "0.1.10"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
-name = "cras-sys"
+name = "chrono"
+version = "0.4.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
+dependencies = [
+ "libc",
+ "num-integer",
+ "num-traits",
+ "serde",
+ "time",
+ "winapi",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa2e27ae6ab525c3d369ded447057bca5438d86dc3a68f6faafb8269ba82ebf3"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_lex 0.2.4",
+ "indexmap",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap"
+version = "4.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d7ae14b20b94cb02149ed21a86c423859cbe18dc7ed69845cace50e52b40a5"
+dependencies = [
+ "bitflags 1.3.2",
+ "clap_derive",
+ "clap_lex 0.3.2",
+ "is-terminal",
+ "once_cell",
+ "strsim",
+ "termcolor",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44bec8e5c9d09e439c4335b1af0abaab56dcf3b94999a936e1bb47b9134288f0"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "350b9cf31731f9957399229e9b2adc51eeabdfbe9d71d9a0552275fd12710d09"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "crash_report"
 version = "0.1.0"
 dependencies = [
- "audio_streams",
- "data_model",
+ "anyhow",
+ "base",
+ "serde",
+ "win_util",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "cros-codecs"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "277a30a0ddadfa014380ee30cc60330d260369855417c492fa94421d7c7e9229"
+dependencies = [
+ "anyhow",
+ "bitreader",
+ "byteorder",
+ "bytes",
+ "crc32fast",
+ "cros-libva",
+ "enumn",
+ "log",
+ "thiserror",
+]
+
+[[package]]
+name = "cros-libva"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc78ee9952d72572d126ef28338857d12c08a013ba39b77fd8e20201837def3e"
+dependencies = [
+ "bitflags 1.3.2",
+ "log",
+ "pkg-config",
+ "thiserror",
 ]
 
 [[package]]
 name = "cros_async"
+version = "0.1.1"
+dependencies = [
+ "anyhow",
+ "async-task",
+ "async-trait",
+ "audio_streams",
+ "base",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "futures",
+ "futures-executor",
+ "futures-util",
+ "intrusive-collections",
+ "io_uring",
+ "libc",
+ "once_cell",
+ "paste",
+ "pin-utils",
+ "remain",
+ "serde",
+ "serde_keyvalue",
+ "slab",
+ "smallvec",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "cros_fdt"
 version = "0.1.0"
 dependencies = [
- "futures",
- "libc",
- "paste",
- "sys_util",
- "syscall_defines",
+ "anyhow",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "cros_tracing"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_tracing_types",
+ "libtest-mimic",
+ "once_cell",
+ "perfetto",
+ "sync",
+]
+
+[[package]]
+name = "cros_tracing_types"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "lazy_static",
+ "sync",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a33c2bf77f2df06183c3aa30d1e96c0695a313d4f9c453cc3762a6db39f99200"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6fd6f855243022dcecf8702fef0c297d4338e226845fe067f6341ad9fa0cef"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46bd5f3f85273295a9d14aedfb86f6aadbff6d8f5295c4a9edb08e819dcf5695"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset 0.8.0",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51887d4adc7b564537b15adcfb307936f8075dfcd5f00dde9a9f1d29383682bc"
+dependencies = [
+ "cfg-if",
+ "once_cell",
 ]
 
 [[package]]
@@ -112,124 +649,467 @@
 dependencies = [
  "aarch64",
  "acpi_tables",
+ "anti_tamper",
+ "anyhow",
  "arch",
- "assertions",
+ "argh",
+ "argh_helpers",
  "audio_streams",
+ "base",
  "bit_field",
+ "broker_ipc",
+ "cfg-if",
+ "crash_report",
+ "cros_async",
+ "cros_tracing",
+ "crosvm_cli",
  "crosvm_plugin",
- "data_model",
+ "ctrlc",
+ "data_model 0.1.0",
  "devices",
  "disk",
+ "document-features",
  "enumn",
- "gpu_buffer",
- "gpu_renderer",
- "io_jail",
+ "futures",
+ "gdbstub",
+ "gdbstub_arch",
+ "gpu_display",
+ "hypervisor",
+ "jail",
  "kernel_cmdline",
  "kernel_loader",
  "kvm",
  "kvm_sys",
  "libc",
  "libcras",
- "minijail-sys",
- "msg_socket",
+ "log",
+ "merge",
+ "metrics",
+ "minijail",
  "net_util",
+ "once_cell",
  "p9",
  "protobuf",
  "protos",
- "rand_ish",
+ "rand",
  "remain",
  "resources",
+ "riscv64",
+ "rutabaga_gfx",
+ "sandbox",
+ "scudo",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "smallvec",
+ "static_assertions",
+ "swap",
  "sync",
- "sys_util",
+ "tempfile",
+ "thiserror",
+ "tube_transporter",
  "vhost",
  "vm_control",
+ "vm_memory",
+ "win_audio",
+ "win_util",
+ "winapi",
  "x86_64",
 ]
 
 [[package]]
+name = "crosvm-fuzz"
+version = "0.0.1"
+dependencies = [
+ "base",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "devices",
+ "disk",
+ "fuse",
+ "hypervisor",
+ "kernel_loader",
+ "libc",
+ "libfuzzer-sys",
+ "p9",
+ "rand",
+ "rand_core",
+ "tempfile",
+ "usb_util",
+ "vm_memory",
+]
+
+[[package]]
+name = "crosvm_cli"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "crosvm_control"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cbindgen",
+ "cc",
+ "libc",
+ "swap",
+ "tempfile",
+ "vm_control",
+]
+
+[[package]]
 name = "crosvm_plugin"
 version = "0.17.0"
 dependencies = [
+ "base",
  "kvm",
  "kvm_sys",
  "libc",
  "protobuf",
  "protos",
- "sys_util",
+]
+
+[[package]]
+name = "ctrlc"
+version = "3.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbcf33c2a618cbe41ee43ae6e9f2e48368cd9f9db2896f10167d8d762679f639"
+dependencies = [
+ "nix",
+ "windows-sys 0.45.0",
 ]
 
 [[package]]
 name = "data_model"
 version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c0d4dcbc04881739a8916b96a84154517eb4230e1c889d45bcaefad7e66dcd2"
 dependencies = [
  "assertions",
 ]
 
 [[package]]
+name = "data_model"
+version = "0.1.1-alpha.1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "remain",
+ "serde",
+ "static_assertions",
+ "thiserror",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8bcdd56d2e5c4ed26a529c5a9029f5db8290d433497506f958eae3be148eb6"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "derive-into-owned"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "576fce04d31d592013a5887ba8d9c3830adff329e5096d7e1eb5e8e61262ca62"
+dependencies = [
+ "quote 0.3.15",
+ "syn 0.11.11",
+]
+
+[[package]]
 name = "devices"
 version = "0.1.0"
 dependencies = [
+ "acpi_tables",
+ "anyhow",
+ "argh",
+ "async-task",
+ "async-trait",
  "audio_streams",
+ "audio_util",
+ "balloon_control",
+ "base",
  "bit_field",
- "bitflags",
- "data_model",
+ "broker_ipc",
+ "bytes",
+ "cfg-if",
+ "chrono",
+ "crc32fast",
+ "cros-codecs",
+ "cros_async",
+ "cros_tracing",
+ "crosvm_cli",
+ "data_model 0.1.1-alpha.1",
+ "dbus",
  "disk",
+ "downcast-rs",
  "enumn",
- "gpu_buffer",
+ "ffmpeg",
+ "fuse",
+ "futures",
  "gpu_display",
- "gpu_renderer",
- "io_jail",
- "kvm",
+ "hypervisor",
  "kvm_sys",
  "libc",
  "libcras",
+ "libtest-mimic",
+ "libvda",
  "linux_input_sys",
- "msg_on_socket_derive",
- "msg_socket",
+ "memoffset 0.6.5",
+ "metrics",
+ "minijail",
+ "named-lock",
  "net_sys",
  "net_util",
+ "num-traits",
+ "once_cell",
  "p9",
+ "power_monitor",
+ "protobuf",
  "protos",
+ "rand",
  "remain",
  "resources",
+ "rutabaga_gfx",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "smallvec",
+ "swap",
  "sync",
- "sys_util",
- "syscall_defines",
- "tempfile 3.0.7",
+ "system_api",
+ "tempfile",
+ "thiserror",
  "tpm2",
+ "tube_transporter",
  "usb_util",
  "vfio_sys",
  "vhost",
  "virtio_sys",
  "vm_control",
+ "vm_memory",
+ "vmm_vhost",
+ "win_audio",
+ "win_util",
+ "winapi",
+ "zerocopy",
 ]
 
 [[package]]
 name = "disk"
 version = "0.1.0"
 dependencies = [
- "data_model",
+ "async-trait",
+ "base",
+ "cfg-if",
+ "crc32fast",
+ "cros_async",
+ "data_model 0.1.1-alpha.1",
+ "futures",
  "libc",
  "protobuf",
  "protos",
  "remain",
- "sys_util",
+ "serde",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "uuid",
+ "vm_memory",
+ "zerocopy",
 ]
 
 [[package]]
-name = "enumn"
+name = "document-features"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3267e1ade4f1f6ddd35fed44a04b6514e244ffeda90c6a14a9ee30f9c9fd7a1"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
+
+[[package]]
+name = "e2e_tests"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "base",
+ "fixture",
+ "libc",
+ "net_sys",
+ "net_util",
+ "prebuilts",
+ "rand",
+ "tempfile",
+]
+
+[[package]]
+name = "either"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"
+
+[[package]]
+name = "enumn"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052bc8773a98bd051ff37db74a8a25f00e6bfa2cbd03373390c72e9f7afbf344"
+dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b2cf0344971ee6c64c31be0d530793fba457d322dfec2810c453d0ef228f9c3"
+dependencies = [
+ "atty",
+ "humantime",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "errno"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "euclid"
+version = "0.22.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52c2ef4a78da0ba68fbe1fd920627411096d2ac478f7f4c9f3a54ba6705bade"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "ffmpeg"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "libc",
+ "pkg-config",
+ "thiserror",
+]
+
+[[package]]
+name = "fixture"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "arch",
+ "base",
+ "cfg-if",
+ "crc32fast",
+ "libc",
+ "log",
+ "prebuilts",
+ "rand",
+ "shlex",
+ "tempfile",
+ "url",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fuse"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "bitflags 2.3.2",
+ "cros_tracing",
+ "crossbeam-utils",
+ "data_model 0.1.1-alpha.1",
+ "enumn",
+ "libc",
+ "remain",
+ "thiserror",
+ "zerocopy",
 ]
 
 [[package]]
 name = "futures"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e05b85ec287aac0dc34db7d4a569323df697f9c55b99b15d6b4ef8cde49f613"
+checksum = "f73fe65f54d1e12b726f517d3e2135ca3125a437b6d998caf1962961f7172d9e"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -242,9 +1122,9 @@
 
 [[package]]
 name = "futures-channel"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f366ad74c28cca6ba456d95e6422883cfb4b252a83bed929c83abfdbbf2967d5"
+checksum = "c3083ce4b914124575708913bca19bfe887522d6e2e6d0952943f5eac4a74010"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -252,59 +1132,56 @@
 
 [[package]]
 name = "futures-core"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59f5fff90fd5d971f936ad674802482ba441b6f09ba5e15fd8b39145582ca399"
+checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10d6bb888be1153d3abeb9006b11b02cf5e9b209fda28693c31ae1e4e012e314"
+checksum = "9420b90cfa29e327d0429f19be13e7ddb68fa1cccb09d65e5706b8c7a749b8a6"
 dependencies = [
  "futures-core",
  "futures-task",
  "futures-util",
+ "num_cpus",
 ]
 
 [[package]]
 name = "futures-io"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de27142b013a8e869c14957e6d2edeef89e97c289e69d042ee3a49acd8b51789"
+checksum = "fc4045962a5a5e935ee2fdedaa4e08284547402885ab326734432bed5d12966b"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0b5a30a4328ab5473878237c447333c093297bded83a4983d10f4deea240d39"
+checksum = "33c1e13800337f4d4d7a316bf45a567dbcb6ffe087f16424852d97e97a91f512"
 dependencies = [
- "proc-macro-hack",
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f2032893cb734c7a05d85ce0cc8b8c4075278e93b24b66f9de99d6eb0fa8acc"
+checksum = "21163e139fa306126e6eedaf49ecdb4588f939600f0b1e770f4205ee4b7fa868"
 
 [[package]]
 name = "futures-task"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdb66b5f09e22019b1ab0830f7785bcea8e7a42148683f99214f73f8ec21a626"
-dependencies = [
- "once_cell",
-]
+checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"
 
 [[package]]
 name = "futures-util"
-version = "0.3.5"
+version = "0.3.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8764574ff08b701a084482c3c7031349104b07ac897393010494beaa18ce32c6"
+checksum = "d8b7abd5d659d9b90c8cba917f6ec750a74e2dc23902ef9cd4cc8c8b22e6036a"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -313,76 +1190,246 @@
  "futures-sink",
  "futures-task",
  "memchr",
- "pin-project",
+ "pin-project-lite",
  "pin-utils",
- "proc-macro-hack",
- "proc-macro-nested",
  "slab",
 ]
 
 [[package]]
-name = "getopts"
-version = "0.2.21"
+name = "gdbstub"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
+checksum = "32c95766e0414f8bfc1d07055574c621b67739466d6ba516c4fef8e99d30d2e6"
 dependencies = [
- "unicode-width",
+ "bitflags 1.3.2",
+ "cfg-if",
+ "log",
+ "managed",
+ "num-traits",
+ "paste",
+]
+
+[[package]]
+name = "gdbstub_arch"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eecb536c55c43593a00dde9074dbbdb0e81ce5f20dbca921400f8779c21dea9c"
+dependencies = [
+ "gdbstub",
+ "num-traits",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.1.14"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7abc8dd8451921606d809ba32e95b6111925cd2906060d2dcc29c070220503eb"
+checksum = "4eb1a864a501629691edf6c15a593b7a51eebaa1e8468e9ddc623de7c9b58ec6"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
 ]
 
 [[package]]
-name = "gpu_buffer"
-version = "0.1.0"
-dependencies = [
- "data_model",
- "sys_util",
-]
+name = "glob"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b919933a397b79c37e33b77bb2aa3dc8eb6e165ad809e58ff75bc7db2e34574"
 
 [[package]]
 name = "gpu_display"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "base",
  "cc",
- "data_model",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "euclid",
  "libc",
  "linux_input_sys",
- "sys_util",
+ "metrics",
+ "num-traits",
+ "pkg-config",
+ "remain",
+ "serde",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "which",
+ "win_util",
+ "winapi",
+ "zerocopy",
 ]
 
 [[package]]
-name = "gpu_renderer"
-version = "0.1.0"
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
 dependencies = [
- "data_model",
  "libc",
- "sys_util",
 ]
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.15"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3deed196b6e7f9e44a2ae8d94225d80302d81208b1bb673fd21fe634645c85a9"
+checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "hypervisor"
+version = "0.1.0"
 dependencies = [
+ "anyhow",
+ "base",
+ "bit_field",
+ "bitflags 2.3.2",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
+ "downcast-rs",
+ "enumn",
+ "fnv",
+ "gdbstub",
+ "gdbstub_arch",
+ "kvm",
+ "kvm_sys",
  "libc",
+ "memoffset 0.6.5",
+ "once_cell",
+ "serde",
+ "serde_json",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "vm_memory",
+ "win_util",
+ "winapi",
+ "windows",
 ]
 
 [[package]]
-name = "io_jail"
-version = "0.1.0"
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "intrusive-collections"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe531a7789d7120f3e17d4f3f2cd95f54418ba7354f60b7b622b6644a07888a"
+dependencies = [
+ "memoffset 0.5.6",
+]
+
+[[package]]
+name = "io-lifetimes"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
 dependencies = [
  "libc",
- "minijail-sys",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "io_uring"
+version = "0.1.1"
+dependencies = [
+ "base",
+ "data_model 0.1.1-alpha.1",
+ "libc",
+ "remain",
+ "sync",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b6b32576413a8e69b90e952e4a026476040d81017b80445deda5f2d3921857"
+dependencies = [
+ "hermit-abi 0.3.1",
+ "io-lifetimes",
+ "rustix",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+
+[[package]]
+name = "jail"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "libc",
+ "minijail",
+ "once_cell",
+ "rayon",
+ "serde",
+ "serde_keyvalue",
+ "static_assertions",
+ "which",
+ "zerocopy",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af25a77299a7f711a01975c35a6a424eb6862092cc2d6c72c4ed6cbc56dfc1fa"
+dependencies = [
+ "libc",
 ]
 
 [[package]]
@@ -390,173 +1437,519 @@
 version = "0.1.0"
 dependencies = [
  "libc",
+ "remain",
+ "thiserror",
 ]
 
 [[package]]
 name = "kernel_loader"
 version = "0.1.0"
 dependencies = [
+ "base",
+ "data_model 0.1.1-alpha.1",
  "libc",
- "sys_util",
+ "remain",
+ "resources",
+ "tempfile",
+ "thiserror",
+ "vm_memory",
+ "zerocopy",
 ]
 
 [[package]]
 name = "kvm"
 version = "0.1.0"
 dependencies = [
- "data_model",
+ "base",
+ "data_model 0.1.1-alpha.1",
  "kvm_sys",
  "libc",
- "msg_socket",
- "sys_util",
+ "sync",
+ "vm_memory",
 ]
 
 [[package]]
 name = "kvm_sys"
 version = "0.1.0"
 dependencies = [
+ "base",
+ "data_model 0.1.1-alpha.1",
  "libc",
- "sys_util",
 ]
 
 [[package]]
-name = "libc"
-version = "0.2.74"
+name = "lazy_static"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2f02823cf78b754822df5f7f268fb59822e7296276d3e069d8e8cb26a14bd10"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
 
 [[package]]
 name = "libcras"
 version = "0.1.0"
 dependencies = [
  "audio_streams",
- "cras-sys",
- "data_model",
- "libc",
- "sys_util",
+ "serde",
 ]
 
 [[package]]
-name = "linux_input_sys"
-version = "0.1.0"
-dependencies = [
- "data_model",
- "libc",
- "sys_util",
-]
-
-[[package]]
-name = "log"
-version = "0.4.11"
+name = "libdbus-sys"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+checksum = "c185b5b7ad900923ef3a8ff594083d4d9b5aea80bb4f32b8342363138c0d456b"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libfuzzer-sys"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae185684fe19814afd066da15a7cc41e126886c21282934225d9fc847582da58"
+dependencies = [
+ "arbitrary",
+ "cc",
+ "once_cell",
+]
+
+[[package]]
+name = "libloading"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "efbc0f03f9a775e9f6aed295c6a1ba2253c5757a9e03d55c6caa46a681abcddd"
 dependencies = [
  "cfg-if",
+ "winapi",
 ]
 
 [[package]]
-name = "memchr"
-version = "2.3.3"
+name = "libslirp-sys"
+version = "4.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
+checksum = "2772370ce9b7fa05c7eae0bd033005e139a64d52cee498a7905b3eb5d243c5f4"
+dependencies = [
+ "pkg-config",
+]
 
 [[package]]
-name = "minijail-sys"
-version = "0.0.11"
+name = "libtest-mimic"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7b603516767d1ab23d0de09d023e62966c3322f7148297c35cf3d97aa8b37fa"
 dependencies = [
+ "clap 4.1.8",
+ "termcolor",
+ "threadpool",
+]
+
+[[package]]
+name = "libvda"
+version = "0.1.0"
+dependencies = [
+ "enumn",
  "libc",
  "pkg-config",
 ]
 
 [[package]]
-name = "msg_on_socket_derive"
+name = "linux-raw-sys"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
+
+[[package]]
+name = "linux_input_sys"
 version = "0.1.0"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "base",
+ "data_model 0.1.1-alpha.1",
+ "libc",
+ "zerocopy",
 ]
 
 [[package]]
-name = "msg_socket"
+name = "litrs"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9275e0933cf8bb20f008924c0cb07a0692fe54d8064996520bf998de9eb79aa"
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "managed"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "merge"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10bbef93abb1da61525bbc45eeaff6473a41907d19f8f9aa5168d214e10693e9"
+dependencies = [
+ "merge_derive",
+ "num-traits",
+]
+
+[[package]]
+name = "merge_derive"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "209d075476da2e63b4b29e72a2ef627b840589588e71400a25e3565c4f849d07"
+dependencies = [
+ "proc-macro-error",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "metrics"
 version = "0.1.0"
 dependencies = [
- "cros_async",
- "data_model",
- "futures",
+ "anyhow",
+ "base",
+ "cfg-if",
+ "chrono",
  "libc",
- "msg_on_socket_derive",
- "sys_util",
+ "proto_build_tools",
+ "protobuf",
+ "serde",
+ "serde_json",
+ "sync",
+ "win_util",
+ "winapi",
+ "wmi",
+]
+
+[[package]]
+name = "minijail"
+version = "0.2.3"
+dependencies = [
+ "libc",
+ "minijail-sys",
+]
+
+[[package]]
+name = "minijail-sys"
+version = "0.0.13"
+dependencies = [
+ "libc",
+ "pkg-config",
+ "which",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "named-lock"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b4a84f3731e71a5792fca72324356bf700c8959d31a2ac34134b25989f254c3"
+dependencies = [
+ "libc",
+ "once_cell",
+ "parking_lot",
+ "thiserror",
+ "widestring 1.0.2",
+ "winapi",
 ]
 
 [[package]]
 name = "net_sys"
 version = "0.1.0"
 dependencies = [
- "sys_util",
+ "base",
+ "libc",
 ]
 
 [[package]]
 name = "net_util"
 version = "0.1.0"
 dependencies = [
- "data_model",
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_async",
  "libc",
+ "libslirp-sys",
+ "metrics",
  "net_sys",
- "sys_util",
+ "pcap-file",
+ "prebuilts",
+ "remain",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "thiserror",
+ "virtio_sys",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "nix"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+ "static_assertions",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg",
 ]
 
 [[package]]
 name = "num_cpus"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.1.19",
  "libc",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.4.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b631f7e854af39a1739f401cf34a8a013dfe09eac4fa4dba91e9768bd28168d"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "openssl"
+version = "0.10.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97ea2d98598bf9ada7ea6ee8a30fb74f9156b63bbe495d64ec2b87c269d2dda3"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "992bac49bdbab4423199c654a5515bd2a6c6a23bf03f2dd3bdb7e5ae6259bc69"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
 
 [[package]]
 name = "p9"
 version = "0.1.0"
 dependencies = [
  "libc",
+ "serde",
  "wire_format_derive",
 ]
 
 [[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1ef8814b5c993410bb3adfad7a5ed269563e4a2f90c41f5d85be7fb47133bf"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-sys 0.42.0",
+]
+
+[[package]]
 name = "paste"
-version = "1.0.0"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6ddc8e145de01d9180ac7b78b9676f95a9c2447f6a88b2c2a04702211bc5d71"
+checksum = "0c520e05135d6e763148b6426a837e239041653ba7becd2e538c076c738025fc"
 
 [[package]]
-name = "pin-project"
-version = "0.4.23"
+name = "pcap-file"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca4433fff2ae79342e497d9f8ee990d174071408f28f726d6d83af93e58e48aa"
+checksum = "6ad13fed1a83120159aea81b265074f21d753d157dd16b10cc3790ecba40a341"
 dependencies = [
- "pin-project-internal",
+ "byteorder",
+ "derive-into-owned",
+ "thiserror",
 ]
 
 [[package]]
-name = "pin-project-internal"
-version = "0.4.23"
+name = "peeking_take_while"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c0e815c3ee9a031fdf5af21c10aa17c573c9c6a566328d99e3936c34e36461f"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "perfetto"
+version = "0.1.0"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_tracing_types",
+ "data_model 0.1.1-alpha.1",
+ "once_cell",
+ "openssl",
+ "proto_build_tools",
+ "protobuf",
+ "serde",
+ "sync",
+ "zerocopy",
 ]
 
 [[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
 name = "pin-utils"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -564,81 +1957,126 @@
 
 [[package]]
 name = "pkg-config"
-version = "0.3.18"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
 
 [[package]]
-name = "poll_token_derive"
+name = "power_monitor"
 version = "0.1.0"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn",
+ "base",
+ "dbus",
+ "proto_build_tools",
+ "protobuf",
+ "remain",
+ "thiserror",
 ]
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.8"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "237a5ed80e274dbc66f86bd59c1e25edc039660be53194b5fe0a482e0f2612ea"
+checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
 
 [[package]]
-name = "proc-macro-hack"
-version = "0.5.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99c605b9a0adc77b7211c6b1f722dcb613d68d66859a44f3d485a6da332b0598"
+name = "prebuilts"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "named-lock",
+]
 
 [[package]]
-name = "proc-macro-nested"
-version = "0.1.6"
+name = "proc-macro-error"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba180dafb9038b050a4c280019bbedf9f2467b61e5d892dcad585bb57aadc5a"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "version_check",
+]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.19"
+version = "1.0.66"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f5f085b5d71e2188cb8271e5da0161ad52c3f227a661a3c135fdf28e258b12"
+checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
 dependencies = [
- "unicode-xid",
+ "unicode-ident",
+]
+
+[[package]]
+name = "proto_build_tools"
+version = "0.1.0"
+dependencies = [
+ "protobuf-codegen",
 ]
 
 [[package]]
 name = "protobuf"
-version = "2.17.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb14183cc7f213ee2410067e1ceeadba2a7478a59432ff0747a335202798b1e2"
-
-[[package]]
-name = "protobuf-codegen"
-version = "2.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3360a1e017386e7d9fc65f7425bef9bcf1e62871f8b5a7b0570ef2ff5073f9a0"
+checksum = "b55bad9126f378a853655831eb7363b7b01b81d19f8cb1218861086ca4a1a61e"
 dependencies = [
- "protobuf",
+ "once_cell",
+ "protobuf-support",
+ "thiserror",
 ]
 
 [[package]]
-name = "protoc"
-version = "2.17.0"
+name = "protobuf-codegen"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93daf2f02fa5b0fca2798a24c5a77b6e0d262dc9c386335e04ddbd25ca8237e9"
+checksum = "0dd418ac3c91caa4032d37cb80ff0d44e2ebe637b2fb243b6234bf89cdac4901"
 dependencies = [
+ "anyhow",
+ "once_cell",
+ "protobuf",
+ "protobuf-parse",
+ "regex",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "protobuf-parse"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d39b14605eaa1f6a340aec7f320b34064feb26c93aec35d6a9a2272a8ddfa49"
+dependencies = [
+ "anyhow",
+ "indexmap",
  "log",
+ "protobuf",
+ "protobuf-support",
+ "tempfile",
+ "thiserror",
  "which",
 ]
 
 [[package]]
-name = "protoc-rust"
-version = "2.17.0"
+name = "protobuf-support"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61d4df67d09fc026da7cdf2d039e0340d4a09775f65d4216762886d2f1a1f245"
+checksum = "a5d4d7b8601c814cfb36bcebb79f0e61e45e1e93640cf778837833bbed05c372"
 dependencies = [
- "protobuf",
- "protobuf-codegen",
- "protoc",
- "tempfile 3.1.0",
+ "thiserror",
 ]
 
 [[package]]
@@ -646,47 +2084,41 @@
 version = "0.1.0"
 dependencies = [
  "kvm_sys",
+ "proto_build_tools",
  "protobuf",
- "protoc-rust",
-]
-
-[[package]]
-name = "qcow_utils"
-version = "0.1.0"
-dependencies = [
- "disk",
- "getopts",
- "libc",
- "sys_util",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.7"
+version = "0.3.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
+checksum = "7a6e920b65c65f10b2ae65c831a81a073a89edd28c7cce89475bff467ab4167a"
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "rand"
-version = "0.7.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
- "getrandom",
  "libc",
  "rand_chacha",
  "rand_core",
- "rand_hc",
 ]
 
 [[package]]
 name = "rand_chacha"
-version = "0.2.2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
  "rand_core",
@@ -694,41 +2126,70 @@
 
 [[package]]
 name = "rand_core"
-version = "0.5.1"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+checksum = "d34f1408f55294453790c48b2f1ebbb1c5b4b7563eb1f418bcfcfdbb06ebb4e7"
 dependencies = [
  "getrandom",
 ]
 
 [[package]]
-name = "rand_hc"
-version = "0.2.0"
+name = "rayon"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+checksum = "1d2df5196e37bcc87abebc0053e20787d73847bb33134a69841207dd0a47f03b"
 dependencies = [
- "rand_core",
+ "either",
+ "rayon-core",
 ]
 
 [[package]]
-name = "rand_ish"
-version = "0.1.0"
+name = "rayon-core"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b8f95bd6966f5c87776639160a66bd8ab9895d9d4ab01ddba9fc60661aebe8d"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
 
 [[package]]
 name = "redox_syscall"
-version = "0.1.57"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
+checksum = "534cfe58d6a18cc17120fbf4635d53d14691c1fe4d951064df9bd326178d7d5a"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
 
 [[package]]
 name = "remain"
-version = "0.2.2"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ba1e78fa68412cb93ef642fd4d20b9a941be49ee9333875ebaf13112673ea7"
+checksum = "5704e2cda92fd54202f05430725317ba0ea7d0c96b246ca0a92e45177127ba3b"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
 ]
 
 [[package]]
@@ -744,88 +2205,387 @@
 name = "resources"
 version = "0.1.0"
 dependencies = [
- "gpu_buffer",
+ "base",
  "libc",
- "msg_socket",
- "sys_util",
+ "remain",
+ "serde",
+ "thiserror",
 ]
 
 [[package]]
-name = "slab"
-version = "0.4.2"
+name = "riscv64"
+version = "0.1.0"
+dependencies = [
+ "arch",
+ "base",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
+ "devices",
+ "gdbstub",
+ "gdbstub_arch",
+ "hypervisor",
+ "kernel_cmdline",
+ "kvm",
+ "kvm_sys",
+ "libc",
+ "minijail",
+ "rand",
+ "remain",
+ "resources",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "vm_memory",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustix"
+version = "0.36.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
+dependencies = [
+ "bitflags 1.3.2",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "rutabaga_gfx"
+version = "0.1.2"
+dependencies = [
+ "anyhow",
+ "cfg-if",
+ "libc",
+ "log",
+ "nix",
+ "pkg-config",
+ "remain",
+ "thiserror",
+ "winapi",
+ "zerocopy",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
+
+[[package]]
+name = "sandbox"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "prebuilts",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "scudo"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12bfcb1ca07a487406afea13bdb7a2f3cf88e67b39c20dfd64e1801909b5c688"
+dependencies = [
+ "libc",
+ "scudo-proc-macros",
+ "scudo-sys",
+]
+
+[[package]]
+name = "scudo-proc-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3267c900aee8fbc8451235b70c5e2dae96bb19110eabc325be5d5dfed8e7461"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "scudo-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcdbdfb28236bf083b47d0babb07e486bb003ed85011072b023ea4ed27760ddb"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc855a42c7967b7c369eb5860f7164ef1f6f81c20c7cc1141f2a604e18723b03"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.140"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f2122636b9fe3b81f1cb25099fcf2d3f542cdb1d45940d56c713158884a05da"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_keyvalue"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "nom",
+ "num-traits",
+ "remain",
+ "serde",
+ "serde_keyvalue_derive",
+ "thiserror",
+]
+
+[[package]]
+name = "serde_keyvalue_derive"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "shlex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43b2853a4d09f215c24cc5489c992ce46052d359b5109343cbafbf26bc62f8a3"
+
+[[package]]
+name = "slab"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fd0db749597d91ff862fd1d55ea87f7855a744a8425a64695b6fca237d1dad1"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "swap"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "cfg-if",
+ "cros_tracing",
+ "data_model 0.1.1-alpha.1",
+ "jail",
+ "libc",
+ "libtest-mimic",
+ "num_cpus",
+ "once_cell",
+ "remain",
+ "serde",
+ "serde_json",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "userfaultfd",
+ "userfaultfd-sys",
+ "vm_memory",
+]
 
 [[package]]
 name = "syn"
-version = "1.0.38"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e69abc24912995b3038597a7a593be5053eb0fb44f3cc5beec0deb421790c1f4"
+checksum = "d3b891b9015c88c576343b9b3e41c2c11a51c219ef067b264bd9c8aa9b441dad"
 dependencies = [
- "proc-macro2",
- "quote",
+ "quote 0.3.15",
+ "synom",
  "unicode-xid",
 ]
 
 [[package]]
-name = "sync"
-version = "0.1.0"
-
-[[package]]
-name = "sys_util"
-version = "0.1.0"
-dependencies = [
- "data_model",
- "libc",
- "poll_token_derive",
- "sync",
- "syscall_defines",
- "tempfile 3.0.7",
-]
-
-[[package]]
-name = "syscall_defines"
-version = "0.1.0"
-
-[[package]]
-name = "tempfile"
-version = "3.0.7"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.1.0"
+name = "syn"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
+checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239814284fd6f1a4ffe4ca893952cdd93c224b6a1571c9a9eadd670295c0c9e2"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync"
+version = "0.1.99"
+
+[[package]]
+name = "synom"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a393066ed9010ebaed60b9eafa373d4b1baac186dd7e008555b0f702b51945b6"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "system_api"
+version = "0.1.0"
+dependencies = [
+ "dbus",
+ "protobuf",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
 dependencies = [
  "cfg-if",
+ "fastrand",
  "libc",
- "rand",
  "redox_syscall",
  "remove_dir_all",
  "winapi",
 ]
 
 [[package]]
-name = "thiserror"
-version = "1.0.20"
+name = "termcolor"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dfdd070ccd8ccb78f4ad66bf1982dc37f620ef696c6b5028fe2ed83dd3d0d08"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a9cd18aa97d5c45c6603caea1da6628790b37f7a34b6ca89522331c5180fed0"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.20"
+version = "1.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd80fc12f73063ac132ac92aceea36734f04a1d93c1240c6944e23a3b8841793"
+checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 1.0.103",
+]
+
+[[package]]
+name = "threadpool"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+dependencies = [
+ "num_cpus",
+]
+
+[[package]]
+name = "time"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+
+[[package]]
+name = "toml"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82e1a7758622a465f8cee077614c73484dac5b836c02ff6a40d5d1010324d7"
+dependencies = [
+ "serde",
 ]
 
 [[package]]
@@ -839,93 +2599,301 @@
 name = "tpm2-sys"
 version = "0.1.0"
 dependencies = [
- "num_cpus",
+ "anyhow",
  "pkg-config",
 ]
 
 [[package]]
-name = "unicode-width"
-version = "0.1.8"
+name = "tube_transporter"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model 0.1.1-alpha.1",
+ "rand",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "win_util",
+ "winapi",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+checksum = "099b7128301d285f79ddd55b9a83d5e6b9e97c92e0ea0daebee7263e932de992"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15c61ba63f9235225a22310255a29b806b907c9b8c964bcbd0a2c70f3f2deea7"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
 
 [[package]]
 name = "unicode-xid"
-version = "0.2.1"
+version = "0.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
+checksum = "8c1f860d7d29cf02cb2f3f359fd35991af3d30bac52c57d265a3c461074cb4dc"
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
 
 [[package]]
 name = "usb_sys"
 version = "0.1.0"
 dependencies = [
- "sys_util",
+ "base",
 ]
 
 [[package]]
 name = "usb_util"
 version = "0.1.0"
 dependencies = [
- "assertions",
- "data_model",
+ "base",
+ "data_model 0.1.1-alpha.1",
  "libc",
  "remain",
- "sys_util",
+ "static_assertions",
+ "thiserror",
  "usb_sys",
+ "zerocopy",
 ]
 
 [[package]]
+name = "userfaultfd"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2320ae2edd0b11cf05dcd53614e5c72cb9f9ac9aab1b4ff4fe4f1cc4f92e3592"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "nix",
+ "thiserror",
+ "userfaultfd-sys",
+]
+
+[[package]]
+name = "userfaultfd-sys"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2cbcf2717fa856a7226499babbbccb07353ea2fc2b27defd38bd13b1227cc78"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cfg-if",
+]
+
+[[package]]
+name = "uuid"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1674845326ee10d37ca60470760d4288a6f80f304007d92e5c53bab78c9cfd79"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
 name = "vfio_sys"
 version = "0.1.0"
 dependencies = [
- "sys_util",
+ "base",
+ "zerocopy",
 ]
 
 [[package]]
 name = "vhost"
 version = "0.1.0"
 dependencies = [
- "assertions",
+ "base",
  "libc",
  "net_util",
- "sys_util",
+ "remain",
+ "static_assertions",
+ "thiserror",
  "virtio_sys",
+ "vm_memory",
 ]
 
 [[package]]
 name = "virtio_sys"
 version = "0.1.0"
 dependencies = [
- "sys_util",
+ "base",
+ "data_model 0.1.1-alpha.1",
+ "zerocopy",
 ]
 
 [[package]]
 name = "vm_control"
 version = "0.1.0"
 dependencies = [
- "data_model",
- "kvm",
+ "anyhow",
+ "balloon_control",
+ "base",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "gdbstub",
+ "gdbstub_arch",
+ "hypervisor",
  "libc",
- "msg_socket",
+ "once_cell",
+ "protos",
+ "remain",
  "resources",
+ "rutabaga_gfx",
+ "serde",
+ "serde_json",
+ "serde_keyvalue",
+ "swap",
  "sync",
- "sys_util",
+ "thiserror",
+ "vm_control_product",
+ "vm_memory",
+ "winapi",
+]
+
+[[package]]
+name = "vm_control_product"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "vm_memory"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "bitflags 2.3.2",
+ "cfg-if",
+ "cros_async",
+ "data_model 0.1.1-alpha.1",
+ "libc",
+ "remain",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "zerocopy",
+]
+
+[[package]]
+name = "vmm_vhost"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "bitflags 2.3.2",
+ "cfg-if",
+ "data_model 0.1.1-alpha.1",
+ "enumn",
+ "libc",
+ "remain",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror",
+ "tube_transporter",
+ "zerocopy",
 ]
 
 [[package]]
 name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
+version = "0.10.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "which"
-version = "4.0.2"
+version = "4.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87c14ef7e1b8b8ecfc75d5eca37949410046e66f15d185c01d70824f1f8111ef"
+checksum = "5c4fb54e6113b6a8772ee41c3404fb0301ac79604489467e0a9ce1f3e97c24ae"
 dependencies = [
+ "either",
+ "lazy_static",
  "libc",
+]
+
+[[package]]
+name = "widestring"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17882f045410753661207383517a6f62ec3dbeb6a4ed2acce01f0728238d1983"
+
+[[package]]
+name = "widestring"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "653f141f39ec16bba3c5abe400a0c60da7468261cc2cbf36805022876bc721a8"
+
+[[package]]
+name = "win_audio"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "audio_streams",
+ "audio_util",
+ "base",
+ "cros_async",
+ "libc",
+ "metrics",
+ "once_cell",
+ "prebuilts",
+ "sync",
  "thiserror",
+ "win_util",
+ "winapi",
+ "wio",
+]
+
+[[package]]
+name = "win_util"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "enumn",
+ "libc",
+ "once_cell",
+ "serde",
+ "winapi",
+ "windows",
 ]
 
 [[package]]
@@ -945,18 +2913,174 @@
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
 [[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
+name = "windows"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1c4bd0a50ac6020f65184721f758dba47bb9fbc2133df715ec74a237b26794a"
+dependencies = [
+ "windows_aarch64_msvc 0.39.0",
+ "windows_i686_gnu 0.39.0",
+ "windows_i686_msvc 0.39.0",
+ "windows_x86_64_gnu 0.39.0",
+ "windows_x86_64_msvc 0.39.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc 0.42.1",
+ "windows_i686_gnu 0.42.1",
+ "windows_i686_msvc 0.42.1",
+ "windows_x86_64_gnu 0.42.1",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc 0.42.1",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2522491fbfcd58cc84d47aeb2958948c4b8982e9a2d8a2a35bbaed431390e7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc 0.42.1",
+ "windows_i686_gnu 0.42.1",
+ "windows_i686_msvc 0.42.1",
+ "windows_x86_64_gnu 0.42.1",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc 0.42.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7711666096bd4096ffa835238905bb33fb87267910e154b18b44eaabb340f2"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "763fc57100a5f7042e3057e7e8d9bdd7860d330070251a73d003563a3bb49e1b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bc7cbfe58828921e10a9f446fcaaf649204dcfe6c1ddd712c5eebae6bda1106"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6868c165637d653ae1e8dc4d82c25d4f97dd6605eaa8d784b5c6e0ab2a252b65"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4d40883ae9cae962787ca76ba76390ffa29214667a111db9e0a1ad8377e809"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
+
+[[package]]
+name = "wio"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d129932f4644ac2396cb456385cbf9e63b5b30c6e8dc4820bdca4eb082037a5"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
 name = "wire_format_derive"
 version = "0.1.0"
 dependencies = [
  "proc-macro2",
- "quote",
- "syn",
+ "quote 1.0.33",
+ "syn 2.0.32",
+]
+
+[[package]]
+name = "wmi"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "757a458f9bfab0542c11feed99bd492cbe23add50515bd8eecf8c6973673d32d"
+dependencies = [
+ "chrono",
+ "log",
+ "serde",
+ "thiserror",
+ "widestring 0.5.1",
+ "winapi",
 ]
 
 [[package]]
@@ -964,19 +3088,50 @@
 version = "0.1.0"
 dependencies = [
  "acpi_tables",
+ "anyhow",
  "arch",
- "assertions",
- "data_model",
+ "base",
+ "cfg-if",
+ "chrono",
+ "cros_fdt",
+ "data_model 0.1.1-alpha.1",
  "devices",
- "io_jail",
+ "gdbstub_arch",
+ "hypervisor",
+ "jail",
  "kernel_cmdline",
  "kernel_loader",
- "kvm",
- "kvm_sys",
  "libc",
+ "minijail",
+ "once_cell",
+ "rand",
  "remain",
  "resources",
+ "swap",
  "sync",
- "sys_util",
+ "thiserror",
  "vm_control",
+ "vm_memory",
+ "zerocopy",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "332f188cc1bcf1fe1064b8c58d150f497e697f49774aa846f2dc949d9a25f236"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6505e6815af7de1746a08f69c69606bb45695a17149517680f3b2149713b19a3"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.33",
+ "syn 1.0.103",
 ]

diff --git a/x86_64-linux-gnu/bin/crosvm b/x86_64-linux-gnu/bin/crosvm
new file mode 100755
index 0000000..a0f73fb
--- /dev/null
+++ b/x86_64-linux-gnu/bin/crosvm
Binary files differ

diff --git a/x86_64-linux-gnu/bin/crosvm.debug b/x86_64-linux-gnu/bin/crosvm.debug
new file mode 100755
index 0000000..c644984
--- /dev/null
+++ b/x86_64-linux-gnu/bin/crosvm.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libOpenglRender.so b/x86_64-linux-gnu/bin/libOpenglRender.so
deleted file mode 100644
index 0aa3532..0000000
--- a/x86_64-linux-gnu/bin/libOpenglRender.so
+++ /dev/null
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libandroid-emu-shared.so b/x86_64-linux-gnu/bin/libandroid-emu-shared.so
deleted file mode 100644
index eb1239f..0000000
--- a/x86_64-linux-gnu/bin/libandroid-emu-shared.so
+++ /dev/null
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libc++.so.1 b/x86_64-linux-gnu/bin/libc++.so.1
deleted file mode 100644
index cb15bbb..0000000
--- a/x86_64-linux-gnu/bin/libc++.so.1
+++ /dev/null
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libdrm.so b/x86_64-linux-gnu/bin/libdrm.so
new file mode 120000
index 0000000..85b602a
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libdrm.so

@@ -0,0 +1 @@
+libdrm.so.2
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libdrm.so.2 b/x86_64-linux-gnu/bin/libdrm.so.2
new file mode 120000
index 0000000..6df23e6
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libdrm.so.2

@@ -0,0 +1 @@
+libdrm.so.2.4.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libdrm.so.2.4.0 b/x86_64-linux-gnu/bin/libdrm.so.2.4.0
new file mode 100755
index 0000000..032d57d
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libdrm.so.2.4.0
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libdrm.so.2.4.0.debug b/x86_64-linux-gnu/bin/libdrm.so.2.4.0.debug
new file mode 100755
index 0000000..021ce92
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libdrm.so.2.4.0.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libemugl_common.so b/x86_64-linux-gnu/bin/libemugl_common.so
deleted file mode 100644
index 3bb8545..0000000
--- a/x86_64-linux-gnu/bin/libemugl_common.so
+++ /dev/null
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libepoxy.so b/x86_64-linux-gnu/bin/libepoxy.so
new file mode 120000
index 0000000..7cebfbf
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libepoxy.so

@@ -0,0 +1 @@
+libepoxy.so.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libepoxy.so.0 b/x86_64-linux-gnu/bin/libepoxy.so.0
new file mode 120000
index 0000000..8b15853
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libepoxy.so.0

@@ -0,0 +1 @@
+libepoxy.so.0.0.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libepoxy.so.0.0.0 b/x86_64-linux-gnu/bin/libepoxy.so.0.0.0
new file mode 100755
index 0000000..1539b4c
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libepoxy.so.0.0.0
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libepoxy.so.0.0.0.debug b/x86_64-linux-gnu/bin/libepoxy.so.0.0.0.debug
new file mode 100755
index 0000000..7138b65
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libepoxy.so.0.0.0.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libffi.so b/x86_64-linux-gnu/bin/libffi.so
new file mode 120000
index 0000000..ad96e9b
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libffi.so

@@ -0,0 +1 @@
+libffi.so.7.1.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libffi.so.7 b/x86_64-linux-gnu/bin/libffi.so.7
new file mode 120000
index 0000000..ad96e9b
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libffi.so.7

@@ -0,0 +1 @@
+libffi.so.7.1.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libffi.so.7.1.0 b/x86_64-linux-gnu/bin/libffi.so.7.1.0
new file mode 100755
index 0000000..2fc5431
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libffi.so.7.1.0
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libffi.so.7.1.0.debug b/x86_64-linux-gnu/bin/libffi.so.7.1.0.debug
new file mode 100755
index 0000000..54d6b8d
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libffi.so.7.1.0.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libgbm.so b/x86_64-linux-gnu/bin/libgbm.so
new file mode 120000
index 0000000..4f33bf3
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libgbm.so

@@ -0,0 +1 @@
+libminigbm.so.1.0.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libgbm.so.1 b/x86_64-linux-gnu/bin/libgbm.so.1
new file mode 120000
index 0000000..4f33bf3
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libgbm.so.1

@@ -0,0 +1 @@
+libminigbm.so.1.0.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libgfxstream_backend.so b/x86_64-linux-gnu/bin/libgfxstream_backend.so
old mode 100644
new mode 100755
index 6386010..1d7450d
--- a/x86_64-linux-gnu/bin/libgfxstream_backend.so
+++ b/x86_64-linux-gnu/bin/libgfxstream_backend.so
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libgfxstream_backend.so.debug b/x86_64-linux-gnu/bin/libgfxstream_backend.so.debug
new file mode 100755
index 0000000..d9de321
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libgfxstream_backend.so.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libminigbm.so.1.0.0 b/x86_64-linux-gnu/bin/libminigbm.so.1.0.0
new file mode 100755
index 0000000..47eeb25
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libminigbm.so.1.0.0
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libminigbm.so.1.0.0.debug b/x86_64-linux-gnu/bin/libminigbm.so.1.0.0.debug
new file mode 100755
index 0000000..0f527ff
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libminigbm.so.1.0.0.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libminijail.so b/x86_64-linux-gnu/bin/libminijail.so
new file mode 100755
index 0000000..dedc376
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libminijail.so
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libminijail.so.debug b/x86_64-linux-gnu/bin/libminijail.so.debug
new file mode 100755
index 0000000..92ae4ad
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libminijail.so.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libvirglrenderer.so b/x86_64-linux-gnu/bin/libvirglrenderer.so
new file mode 120000
index 0000000..a764d77
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libvirglrenderer.so

@@ -0,0 +1 @@
+libvirglrenderer.so.1
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libvirglrenderer.so.1 b/x86_64-linux-gnu/bin/libvirglrenderer.so.1
new file mode 120000
index 0000000..742de35
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libvirglrenderer.so.1

@@ -0,0 +1 @@
+libvirglrenderer.so.1.7.7
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libvirglrenderer.so.1.7.7 b/x86_64-linux-gnu/bin/libvirglrenderer.so.1.7.7
new file mode 100755
index 0000000..59c493b
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libvirglrenderer.so.1.7.7
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libvirglrenderer.so.1.7.7.debug b/x86_64-linux-gnu/bin/libvirglrenderer.so.1.7.7.debug
new file mode 100755
index 0000000..cee95b3
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libvirglrenderer.so.1.7.7.debug
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libwayland-client.so b/x86_64-linux-gnu/bin/libwayland-client.so
new file mode 120000
index 0000000..f202436
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libwayland-client.so

@@ -0,0 +1 @@
+libwayland-client.so.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libwayland-client.so.0 b/x86_64-linux-gnu/bin/libwayland-client.so.0
new file mode 120000
index 0000000..d31eeb3
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libwayland-client.so.0

@@ -0,0 +1 @@
+libwayland-client.so.0.3.0
\ No newline at end of file

diff --git a/x86_64-linux-gnu/bin/libwayland-client.so.0.3.0 b/x86_64-linux-gnu/bin/libwayland-client.so.0.3.0
new file mode 100755
index 0000000..cc5739f
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libwayland-client.so.0.3.0
Binary files differ

diff --git a/x86_64-linux-gnu/bin/libwayland-client.so.0.3.0.debug b/x86_64-linux-gnu/bin/libwayland-client.so.0.3.0.debug
new file mode 100755
index 0000000..930437f
--- /dev/null
+++ b/x86_64-linux-gnu/bin/libwayland-client.so.0.3.0.debug
Binary files differ

diff --git a/x86_64-linux-gnu/builder-packages.txt b/x86_64-linux-gnu/builder-packages.txt
index cedc957..dfe786f 100644
--- a/x86_64-linux-gnu/builder-packages.txt
+++ b/x86_64-linux-gnu/builder-packages.txt

@@ -1,63 +1,60 @@
 adduser	3.118
-apt	1.8.2.1
-apt-utils	1.8.2.1
+apt	1.8.2.3
 autoconf	2.69-11
 automake	1:1.16.1-4
-autopoint	0.19.8.1-9
 autotools-dev	20180224.1
-base-files	10.3+deb10u3
+base-files	10.3+deb10u13
 base-passwd	3.5.46
 bash	5.0-4
 binutils	2.31.1-16
 binutils-aarch64-linux-gnu	2.31.1-16
 binutils-common:amd64	2.31.1-16
 binutils-x86-64-linux-gnu	2.31.1-16
-bsd-mailx	8.1.2-0.20180807cvs-1
-bsdmainutils	11.1.2+b1
 bsdutils	1:2.33.1-0.1
 build-essential	12.6
-bzip2	1.0.6-9.2~deb10u1
-ca-certificates	20200601~deb10u1
-cmake	3.13.4-1
-cmake-data	3.13.4-1
+bzip2	1.0.6-9.2~deb10u2
+ca-certificates	20200601~deb10u2
 coreutils	8.30-3
 cpp	4:8.3.0-1
 cpp-8	8.3.0-6
 cpp-8-aarch64-linux-gnu	8.3.0-2cross1
 cpp-aarch64-linux-gnu	4:8.3.0-1
-cron	3.0pl1-134+deb10u1
 cross-config	2.6.15-3
 crossbuild-essential-arm64	12.6
-curl	7.64.0-4+deb10u1
+curl	7.64.0-4+deb10u6
 dash	0.5.10.2-5
-dbus	1.12.20-0+deb10u1
-debconf	1.5.71
-debhelper	12.1.1
-debian-archive-keyring	2019.1
+dblatex	0.3.10-2
+dblatex-doc	0.3.10-2
+dbus	1.12.24-0+deb10u1
+debconf	1.5.71+deb10u1
+debian-archive-keyring	2019.1+deb10u2
 debianutils	4.8.6.1
-dh-autoreconf	19
 dh-python	3.20190308
-dh-strip-nondeterminism	1.1.2-1
-dialog	1.3-20190211-1
 diffutils	1:3.7-3
-dirmngr	2.2.12-1+deb10u1
-dmsetup	2:1.02.155-3
-dns-root-data	2019031302
-dnsmasq	2.80-1
-dnsmasq-base	2.80-1
-dpkg	1.19.7
+dirmngr	2.2.12-1+deb10u2
+distro-info-data	0.41+deb10u7
+docbook-xml	4.5-8
+docbook-xsl	1.79.1+dfsg-2
+doxygen	1.8.13-10
+dpkg	1.19.8
 dpkg-cross	2.6.15-3
-dpkg-dev	1.19.7
-dwz	0.12-3
+dpkg-dev	1.19.8
 e2fsprogs	1.44.5-1+deb10u3
-equivs	2.2.0
-exim4-base	4.92-8+deb10u4
-exim4-config	4.92-8+deb10u4
-exim4-daemon-light	4.92-8+deb10u4
 fakeroot	1.23-1
 fdisk	2.33.1-0.1
-file	1:5.35-4+deb10u1
+file	1:5.35-4+deb10u2
 findutils	4.6.0+git+20190209-2
+fontconfig	2.13.1-2
+fontconfig-config	2.13.1-2
+fonts-dejavu-core	2.37-1
+fonts-droid-fallback	1:6.0.1r16-1.1
+fonts-gfs-baskerville	1.1-5
+fonts-gfs-porson	1.1-6
+fonts-lato	2.0-2
+fonts-liberation	1:1.07.4-9
+fonts-lmodern	2.004.5-6
+fonts-noto-mono	20181227-1
+fonts-texgyre	20180621-3
 g++	4:8.3.0-1
 g++-8	8.3.0-6
 g++-8-aarch64-linux-gnu	8.3.0-2cross1
@@ -69,81 +66,99 @@
 gcc-8-base:amd64	8.3.0-6
 gcc-8-cross-base	8.3.0-2cross1
 gcc-aarch64-linux-gnu	4:8.3.0-1
-gettext	0.19.8.1-9
-gettext-base	0.19.8.1-9
+ghostscript	9.27~dfsg-2+deb10u8
 gir1.2-glib-2.0:amd64	1.58.3-2
-git	1:2.20.1-2+deb10u3
-git-man	1:2.20.1-2+deb10u3
-gnupg	2.2.12-1+deb10u1
-gnupg-l10n	2.2.12-1+deb10u1
-gnupg-utils	2.2.12-1+deb10u1
-gpg	2.2.12-1+deb10u1
-gpg-agent	2.2.12-1+deb10u1
-gpg-wks-client	2.2.12-1+deb10u1
-gpg-wks-server	2.2.12-1+deb10u1
-gpgconf	2.2.12-1+deb10u1
-gpgsm	2.2.12-1+deb10u1
-gpgv	2.2.12-1+deb10u1
+git	1:2.20.1-2+deb10u8
+git-man	1:2.20.1-2+deb10u8
+gnupg	2.2.12-1+deb10u2
+gnupg-l10n	2.2.12-1+deb10u2
+gnupg-utils	2.2.12-1+deb10u2
+gpg	2.2.12-1+deb10u2
+gpg-agent	2.2.12-1+deb10u2
+gpg-wks-client	2.2.12-1+deb10u2
+gpg-wks-server	2.2.12-1+deb10u2
+gpgconf	2.2.12-1+deb10u2
+gpgsm	2.2.12-1+deb10u2
+gpgv	2.2.12-1+deb10u2
+graphviz	2.40.1-6+deb10u1
 grep	3.3-1
-groff-base	1.22.4-3
-gzip	1.9-3
+gsfonts	1:8.11+urwcyr1.0.7~pre44-4.4
+gzip	1.9-3+deb10u1
 hostname	3.21
+icu-devtools	63.1-6+deb10u3
 init-system-helpers	1.56+nmu1
-intltool-debian	0.35.0+20060710.5
-iproute2	4.20.0-2
-iptables	1.8.2-4
-krb5-locales	1.17-3
+iso-codes	4.2-1
+javascript-common	11
+krb5-locales	1.17-3+deb10u5
 less	487-0.1+b1
 libacl1:amd64	2.2.53-4
+libalgorithm-c3-perl	0.10-1
 libalgorithm-diff-perl	1.19.03-2
 libalgorithm-diff-xs-perl	0.04-5+b1
 libalgorithm-merge-perl	0.08-3
 libapparmor1:amd64	2.13.2-10
-libapt-inst2.0:amd64	1.8.2.1
-libapt-pkg5.0:amd64	1.8.2
-libarchive-cpio-perl	0.10-1
-libarchive-zip-perl	1.64-1
-libarchive13:amd64	3.3.3-4+deb10u1
-libargon2-1:amd64	0~20171227-0.2
+libapt-inst2.0:amd64	1.8.2.3
+libapt-pkg5.0:amd64	1.8.2.3
 libasan5:amd64	8.3.0-6
 libasan5-arm64-cross	8.3.0-2cross1
 libassuan0:amd64	2.5.2-1
-libatm1:amd64	1:2.5.1-2
 libatomic1:amd64	8.3.0-6
 libatomic1-arm64-cross	8.3.0-2cross1
 libattr1:amd64	1:2.4.48-4
 libaudit-common	1:2.8.4-3
 libaudit1:amd64	1:2.8.4-3
 libauthen-sasl-perl	2.1600-1
+libavahi-client3:amd64	0.7-4+deb10u3
+libavahi-common-data:amd64	0.7-4+deb10u3
+libavahi-common3:amd64	0.7-4+deb10u3
+libb-hooks-endofscope-perl	0.24-1
+libb-hooks-op-check-perl	0.22-1+b1
 libbinutils:amd64	2.31.1-16
 libblkid1:amd64	2.33.1-0.1
-libbsd0:amd64	0.9.1-2
-libbz2-1.0:amd64	1.0.6-9.2~deb10u1
-libc-bin	2.28-10
-libc-dev-bin	2.28-10
-libc6:amd64	2.28-10
+libbrotli1:amd64	1.0.7-2+deb10u1
+libbsd0:amd64	0.9.1-2+deb10u1
+libbz2-1.0:amd64	1.0.6-9.2~deb10u2
+libc-bin	2.28-10+deb10u2
+libc-dev-bin	2.28-10+deb10u2
+libc6:amd64	2.28-10+deb10u2
 libc6-arm64-cross	2.28-7cross1
-libc6-dev:amd64	2.28-10
+libc6-dev:amd64	2.28-10+deb10u2
 libc6-dev-arm64-cross	2.28-7cross1
+libcairo2:amd64	1.16.0-4+deb10u1
 libcap-dev:amd64	1:2.25-2
 libcap-ng0:amd64	0.7.9-2
 libcap2:amd64	1:2.25-2
-libcap2-bin	1:2.25-2
 libcc1-0:amd64	8.3.0-6
+libcdt5	2.40.1-6+deb10u1
+libcgraph6	2.40.1-6+deb10u1
+libclang1-6.0:amd64	1:6.0.1-10
+libclass-c3-perl	0.34-1
+libclass-c3-xs-perl	0.14-1+b3
+libclass-data-inheritable-perl	0.08-3
+libclass-method-modifiers-perl	2.12-1
+libclass-xsaccessor-perl	1.19-3+b2
 libcom-err2:amd64	1.44.5-1+deb10u3
 libconfig-auto-perl	0.44-1
 libconfig-inifiles-perl	3.000001-1
-libcroco3:amd64	0.6.12-3
-libcryptsetup12:amd64	2:2.1.0-5+deb10u2
-libcurl3-gnutls:amd64	7.64.0-4+deb10u1
-libcurl4:amd64	7.64.0-4+deb10u1
+libcups2:amd64	2.2.10-6+deb10u8
+libcupsfilters1:amd64	1.21.6-5+deb10u1
+libcupsimage2:amd64	2.2.10-6+deb10u8
+libcurl3-gnutls:amd64	7.64.0-4+deb10u6
+libcurl4:amd64	7.64.0-4+deb10u6
 libdata-dump-perl	1.23-1
+libdata-optlist-perl	0.110-1
+libdatrie1:amd64	0.2.12-2
 libdb5.3:amd64	5.3.28+dfsg1-0.5
-libdbus-1-3:amd64	1.12.20-0+deb10u1
+libdbus-1-3:amd64	1.12.24-0+deb10u1
 libdebconfclient0:amd64	0.249
 libdebian-dpkgcross-perl	2.6.15-3
-libdevmapper1.02.1:amd64	2:1.02.155-3
-libdpkg-perl	1.19.7
+libdevel-callchecker-perl	0.008-1
+libdevel-caller-perl	2.06-2+b1
+libdevel-globaldestruction-perl	0.14-1
+libdevel-lexalias-perl	0.05-2+b1
+libdevel-stacktrace-perl	2.0300-1
+libdist-checkconflicts-perl	0.11-1
+libdpkg-perl	1.19.8
 libdrm-amdgpu1:amd64	2.4.97-1
 libdrm-common	2.4.97-1
 libdrm-dev:amd64	2.4.97-1
@@ -151,36 +166,44 @@
 libdrm-nouveau2:amd64	2.4.97-1
 libdrm-radeon1:amd64	2.4.97-1
 libdrm2:amd64	2.4.97-1
+libdynaloader-functions-perl	0.003-1
 libedit2:amd64	3.1-20181209-1
 libegl-mesa0:amd64	18.3.6-2+deb10u1
 libegl1:amd64	1.1.0-1
 libegl1-mesa-dev:amd64	18.3.6-2+deb10u1
 libelf1:amd64	0.176-1.1
+libemail-date-format-perl	1.005-1
 libencode-locale-perl	1.05-1
 liberror-perl	0.17027-2
-libestr0:amd64	0.1.10-2.1
-libevent-2.1-6:amd64	2.1.8-stable-4
-libexpat1:amd64	2.2.6-2+deb10u1
-libexpat1-dev:amd64	2.2.6-2+deb10u1
+libeval-closure-perl	0.14-1
+libexception-class-perl	1.44-1
+libexpat1:amd64	2.2.6-2+deb10u6
+libexpat1-dev:amd64	2.2.6-2+deb10u6
 libext2fs2:amd64	1.44.5-1+deb10u3
 libfakeroot:amd64	1.23-1
-libfastjson4:amd64	0.99.8-2
 libfdisk1:amd64	2.33.1-0.1
-libfdt-dev	1.4.7-3
-libfdt1:amd64	1.4.7-3
+libfdt-dev	1.4.7-4
+libfdt1:amd64	1.4.7-4
 libffi6:amd64	3.2.1-9
+libfile-basedir-perl	0.08-1
+libfile-desktopentry-perl	0.22-1
 libfile-fcntllock-perl	0.22-3+b5
 libfile-homedir-perl	1.004-1
 libfile-listing-perl	6.04-1
-libfile-stripnondeterminism-perl	1.1.2-1
+libfile-mimeinfo-perl	0.29-1
 libfile-which-perl	1.23-1
 libfont-afm-perl	1.20-2
+libfontconfig1:amd64	2.13.1-2
+libfontenc1:amd64	1:1.1.3-1+b2
+libfreetype6:amd64	2.9.1-3+deb10u3
+libfribidi0:amd64	1.0.5-3.1+deb10u2
 libgbm1:amd64	18.3.6-2+deb10u1
 libgcc-8-dev:amd64	8.3.0-6
 libgcc-8-dev-arm64-cross	8.3.0-2cross1
 libgcc1:amd64	1:8.3.0-6
 libgcc1-arm64-cross	1:8.3.0-2cross1
-libgcrypt20:amd64	1.8.4-5
+libgcrypt20:amd64	1.8.4-5+deb10u1
+libgd3:amd64	2.2.5-5.2
 libgdbm-compat4:amd64	1.18.1-4
 libgdbm6:amd64	1.18.1-4
 libgirepository-1.0-1:amd64	1.58.3-2
@@ -191,129 +214,163 @@
 libgles1:amd64	1.1.0-1
 libgles2:amd64	1.1.0-1
 libgles2-mesa-dev:amd64	18.3.6-2+deb10u1
-libglib2.0-0:amd64	2.58.3-2+deb10u2
-libglib2.0-data	2.58.3-2+deb10u2
+libglib2.0-0:amd64	2.58.3-2+deb10u4
+libglib2.0-data	2.58.3-2+deb10u4
 libglvnd-core-dev:amd64	1.1.0-1
 libglvnd-dev:amd64	1.1.0-1
 libglvnd0:amd64	1.1.0-1
 libglx-mesa0:amd64	18.3.6-2+deb10u1
 libglx0:amd64	1.1.0-1
-libgmp10:amd64	2:6.1.2+dfsg-4
-libgnutls-dane0:amd64	3.6.7-4+deb10u5
-libgnutls30:amd64	3.6.7-4+deb10u5
+libgmp10:amd64	2:6.1.2+dfsg-4+deb10u1
+libgnutls30:amd64	3.6.7-4+deb10u10
 libgomp1:amd64	8.3.0-6
 libgomp1-arm64-cross	8.3.0-2cross1
 libgpg-error0:amd64	1.35-1
 libgpm2:amd64	1.20.7-5
-libgssapi-krb5-2:amd64	1.17-3
-libhogweed4:amd64	3.4.1-1
+libgraphite2-3:amd64	1.3.13-7
+libgs9:amd64	9.27~dfsg-2+deb10u8
+libgs9-common	9.27~dfsg-2+deb10u8
+libgssapi-krb5-2:amd64	1.17-3+deb10u5
+libgts-0.7-5:amd64	0.7.6+darcs121130-4
+libgts-bin	0.7.6+darcs121130-4
+libgvc6	2.40.1-6+deb10u1
+libgvpr2	2.40.1-6+deb10u1
+libharfbuzz-icu0:amd64	2.3.1-1
+libharfbuzz0b:amd64	2.3.1-1
+libhogweed4:amd64	3.4.1-1+deb10u1
 libhtml-form-perl	6.03-1
 libhtml-format-perl	2.12-1
 libhtml-parser-perl	3.72-3+b3
 libhtml-tagset-perl	3.20-3
 libhtml-tree-perl	5.07-2
 libhttp-cookies-perl	6.04-1
-libhttp-daemon-perl	6.01-3
+libhttp-daemon-perl	6.01-3+deb10u1
 libhttp-date-perl	6.02-1
 libhttp-message-perl	6.18-1
 libhttp-negotiate-perl	6.01-1
-libicu63:amd64	63.1-6+deb10u1
+libice6:amd64	2:1.0.9-2
+libicu-dev:amd64	63.1-6+deb10u3
+libicu63:amd64	63.1-6+deb10u3
 libidn11:amd64	1.33-2.2
 libidn2-0:amd64	2.0.5-1+deb10u1
+libijs-0.35:amd64	0.35-14
 libio-html-perl	1.001-1
 libio-socket-ssl-perl	2.060-3
 libio-string-perl	1.08-3
-libip4tc0:amd64	1.8.2-4
-libip6tc0:amd64	1.8.2-4
-libiptc0:amd64	1.8.2-4
+libio-stringy-perl	2.111-3
+libipc-shareable-perl	0.61-2
+libipc-system-simple-perl	1.25-4
 libisl19:amd64	0.20-2
 libitm1:amd64	8.3.0-6
 libitm1-arm64-cross	8.3.0-2cross1
-libjansson4:amd64	2.12-1
-libjson-c3:amd64	0.12.1+ds-2+deb10u1
-libjsoncpp1:amd64	1.7.4-3
-libk5crypto3:amd64	1.17-3
+libjbig0:amd64	2.1-3.1+b2
+libjbig2dec0:amd64	0.16-1+deb10u1
+libjpeg62-turbo:amd64	1:1.5.2-2+deb10u1
+libjs-jquery	3.3.1~dfsg-3+deb10u1
+libk5crypto3:amd64	1.17-3+deb10u5
 libkeyutils1:amd64	1.6-6
-libkmod2:amd64	26-1
-libkrb5-3:amd64	1.17-3
-libkrb5support0:amd64	1.17-3
-libksba8:amd64	1.3.5-2
-libldap-2.4-2:amd64	2.4.47+dfsg-3+deb10u2
-libldap-common	2.4.47+dfsg-3+deb10u2
-libllvm7:amd64	1:7.0.1-8
+libkpathsea6:amd64	2018.20181218.49446-1+deb10u2
+libkrb5-3:amd64	1.17-3+deb10u5
+libkrb5support0:amd64	1.17-3+deb10u5
+libksba8:amd64	1.3.5-2+deb10u2
+liblab-gamut1	2.40.1-6+deb10u1
+liblcms2-2:amd64	2.9-3
+libldap-2.4-2:amd64	2.4.47+dfsg-3+deb10u7
+libldap-common	2.4.47+dfsg-3+deb10u7
+libllvm6.0:amd64	1:6.0.1-10
+libllvm7:amd64	1:7.0.1-8+deb10u2
 liblocale-gettext-perl	1.07-3+b4
-liblockfile-bin	1.14-1.1
-liblockfile1:amd64	1.14-1.1
-liblognorm5:amd64	2.0.5-1
+liblog-dispatch-perl	2.68-1
+liblog-log4perl-perl	1.49-1
 liblsan0:amd64	8.3.0-6
 liblsan0-arm64-cross	8.3.0-2cross1
 libltdl-dev:amd64	2.4.6-9
 libltdl7:amd64	2.4.6-9
 liblwp-mediatypes-perl	6.02-1
 liblwp-protocol-https-perl	6.07-2
-liblz4-1:amd64	1.8.3-1
-liblzma5:amd64	5.2.4-1
-libmagic-mgc	1:5.35-4+deb10u1
-libmagic1:amd64	1:5.35-4+deb10u1
+liblz4-1:amd64	1.8.3-1+deb10u1
+liblzma5:amd64	5.2.4-1+deb10u1
+libmagic-mgc	1:5.35-4+deb10u2
+libmagic1:amd64	1:5.35-4+deb10u2
 libmail-sendmail-perl	0.80-1
 libmailtools-perl	2.18-1
-libmnl0:amd64	1.0.4-2
+libmime-charset-perl	1.012.2-1
+libmime-lite-perl	3.030-2
+libmime-types-perl	2.17-1
+libmodule-implementation-perl	0.09-1
+libmodule-runtime-perl	0.016-1
 libmount1:amd64	2.33.1-0.1
 libmpc3:amd64	1.1.0-1
 libmpdec2:amd64	2.4.2-2
 libmpfr6:amd64	4.0.2-1
 libmpx2:amd64	8.3.0-6
-libncurses6:amd64	6.1+20181013-2+deb10u2
-libncursesw6:amd64	6.1+20181013-2+deb10u2
+libmro-compat-perl	0.13-1
+libnamespace-autoclean-perl	0.28-1
+libnamespace-clean-perl	0.27-1
+libncurses6:amd64	6.1+20181013-2+deb10u3
+libncursesw6:amd64	6.1+20181013-2+deb10u3
+libnet-dbus-perl	1.1.0-5+b1
 libnet-http-perl	6.18-1
 libnet-smtp-ssl-perl	1.04-1
-libnet-ssleay-perl	1.85-2+b1
-libnetfilter-conntrack3:amd64	1.0.7-1
-libnettle6:amd64	3.4.1-1
-libnfnetlink0:amd64	1.0.1-3+b1
-libnftables0:amd64	0.9.0-2
-libnftnl11:amd64	1.1.2-2
+libnet-ssleay-perl	1.85-2+deb10u1
+libnettle6:amd64	3.4.1-1+deb10u1
 libnghttp2-14:amd64	1.36.0-2+deb10u1
 libnpth0:amd64	1.6-1
-libnss-systemd:amd64	241-7~deb10u4
 libopengl0:amd64	1.1.0-1
-libp11-kit0:amd64	0.23.15-2
-libpam-cap:amd64	1:2.25-2
+libopenjp2-7:amd64	2.3.0-2+deb10u2
+libp11-kit0:amd64	0.23.15-2+deb10u1
+libpackage-stash-perl	0.38-1
+libpackage-stash-xs-perl	0.29-1
+libpadwalker-perl	2.3-1+b1
 libpam-modules:amd64	1.3.1-5
 libpam-modules-bin	1.3.1-5
 libpam-runtime	1.3.1-5
-libpam-systemd:amd64	241-7~deb10u4
 libpam0g:amd64	1.3.1-5
+libpango-1.0-0:amd64	1.42.4-8~deb10u1
+libpangocairo-1.0-0:amd64	1.42.4-8~deb10u1
+libpangoft2-1.0-0:amd64	1.42.4-8~deb10u1
+libpaper-utils	1.1.28
+libpaper1:amd64	1.1.28
+libparams-classify-perl	0.015-1+b1
+libparams-util-perl	1.07-3+b4
+libparams-validationcompiler-perl	0.30-1
+libpathplan4	2.40.1-6+deb10u1
+libpciaccess-dev:amd64	0.14-1
 libpciaccess0:amd64	0.14-1
-libpcre2-8-0:amd64	10.32-5
+libpcre2-8-0:amd64	10.32-5+deb10u1
 libpcre3:amd64	2:8.39-12
 libperl5.28:amd64	5.28.1-6+deb10u1
-libpipeline1:amd64	1.5.1-2
-libpopt0:amd64	1.16-12
-libprocps7:amd64	2:3.3.15-2
-libprotobuf-dev:amd64	3.6.1.3-2
-libprotobuf-lite17:amd64	3.6.1.3-2
-libprotobuf17:amd64	3.6.1.3-2
-libprotoc17:amd64	3.6.1.3-2
+libpixman-1-0:amd64	0.36.0-1+deb10u1
+libpng16-16:amd64	1.6.36-6
+libpotrace0:amd64	1.15-1
+libprotobuf-dev:amd64	3.6.1.3-2+deb10u1
+libprotobuf-lite17:amd64	3.6.1.3-2+deb10u1
+libprotobuf17:amd64	3.6.1.3-2+deb10u1
+libprotoc17:amd64	3.6.1.3-2+deb10u1
 libpsl5:amd64	0.20.2-2
+libptexenc1:amd64	2018.20181218.49446-1+deb10u2
 libpthread-stubs0-dev:amd64	0.4-1
 libpython-stdlib:amd64	2.7.16-1
 libpython2-stdlib:amd64	2.7.16-1
-libpython2.7-minimal:amd64	2.7.16-2+deb10u1
-libpython2.7-stdlib:amd64	2.7.16-2+deb10u1
+libpython2.7-minimal:amd64	2.7.16-2+deb10u2
+libpython2.7-stdlib:amd64	2.7.16-2+deb10u2
 libpython3-dev:amd64	3.7.3-1
 libpython3-stdlib:amd64	3.7.3-1
-libpython3.7:amd64	3.7.3-2+deb10u2
-libpython3.7-dev:amd64	3.7.3-2+deb10u2
-libpython3.7-minimal:amd64	3.7.3-2+deb10u2
-libpython3.7-stdlib:amd64	3.7.3-2+deb10u2
+libpython3.7:amd64	3.7.3-2+deb10u5
+libpython3.7-dev:amd64	3.7.3-2+deb10u5
+libpython3.7-minimal:amd64	3.7.3-2+deb10u5
+libpython3.7-stdlib:amd64	3.7.3-2+deb10u5
 libquadmath0:amd64	8.3.0-6
 libreadline7:amd64	7.0-5
-librhash0:amd64	1.3.8-1
+libreadonly-perl	2.050-1
+libref-util-perl	0.204-1
+libref-util-xs-perl	0.117-1+b1
+librole-tiny-perl	2.000006-1
 librtmp1:amd64	2.4+20151223.gitfa8646d.1-2
-libsasl2-2:amd64	2.1.27+dfsg-1+deb10u1
-libsasl2-modules:amd64	2.1.27+dfsg-1+deb10u1
-libsasl2-modules-db:amd64	2.1.27+dfsg-1+deb10u1
+libruby2.5:amd64	2.5.5-3+deb10u6
+libsasl2-2:amd64	2.1.27+dfsg-1+deb10u2
+libsasl2-modules:amd64	2.1.27+dfsg-1+deb10u2
+libsasl2-modules-db:amd64	2.1.27+dfsg-1+deb10u2
 libseccomp2:amd64	2.3.3-4
 libselinux1:amd64	2.8-1+b1
 libsemanage-common	2.8-2
@@ -322,53 +379,79 @@
 libsensors5:amd64	1:3.5.0-3
 libsepol1:amd64	2.8-1
 libsigsegv2:amd64	2.12-2
+libsm6:amd64	2:1.2.3-1
 libsmartcols1:amd64	2.33.1-0.1
-libsqlite3-0:amd64	3.27.2-3
+libsombok3:amd64	2.4.0-2
+libspecio-perl	0.43-1
+libsqlite3-0:amd64	3.27.2-3+deb10u2
 libss2:amd64	1.44.5-1+deb10u3
-libssh2-1:amd64	1.8.0-2.1
-libssl-dev:amd64	1.1.1d-0+deb10u3
-libssl1.1:amd64	1.1.1d-0+deb10u3
+libssh2-1:amd64	1.8.0-2.1+deb10u1
+libssl-dev:amd64	1.1.1n-0+deb10u6
+libssl1.1:amd64	1.1.1n-0+deb10u6
 libstdc++-8-dev:amd64	8.3.0-6
 libstdc++-8-dev-arm64-cross	8.3.0-2cross1
 libstdc++6:amd64	8.3.0-6
 libstdc++6-arm64-cross	8.3.0-2cross1
+libsub-exporter-perl	0.987-1
+libsub-exporter-progressive-perl	0.001013-1
+libsub-identify-perl	0.14-1+b1
+libsub-install-perl	0.928-1
+libsub-name-perl	0.21-1+b3
+libsub-quote-perl	2.005001-1
+libsynctex2:amd64	2018.20181218.49446-1+deb10u2
 libsys-hostname-long-perl	1.5-1
-libsystemd0:amd64	241-7~deb10u4
-libtasn1-6:amd64	4.13-3
+libsystemd0:amd64	241-7~deb10u10
+libtasn1-6:amd64	4.13-3+deb10u1
+libtcl8.6:amd64	8.6.9+dfsg-2
+libteckit0:amd64	2.5.8+ds2-5
+libtexlua52:amd64	2018.20181218.49446-1+deb10u2
+libtexlua53:amd64	2018.20181218.49446-1+deb10u2
+libtexluajit2:amd64	2018.20181218.49446-1+deb10u2
+libtext-iconv-perl	1.7-5+b7
+libtext-unidecode-perl	1.30-1
+libthai-data	0.1.28-2
+libthai0:amd64	0.1.28-2
+libtie-ixhash-perl	1.23-2
+libtiff5:amd64	4.1.0+git191117-2~deb10u8
 libtimedate-perl	2.3000-2+deb10u1
-libtinfo6:amd64	6.1+20181013-2+deb10u2
+libtinfo6:amd64	6.1+20181013-2+deb10u3
+libtk8.6:amd64	8.6.9-2
 libtool	2.4.6-9
 libtry-tiny-perl	0.30-1
 libtsan0:amd64	8.3.0-6
 libtsan0-arm64-cross	8.3.0-2cross1
 libubsan1:amd64	8.3.0-6
 libubsan1-arm64-cross	8.3.0-2cross1
-libuchardet0:amd64	0.0.6-3
-libudev1:amd64	241-7~deb10u3
-libunbound8:amd64	1.9.0-2+deb10u2
+libudev1:amd64	241-7~deb10u10
+libunicode-linebreak-perl	0.0.20190101-1
 libunistring2:amd64	0.9.10-1
 liburi-perl	1.76-1
 libusb-1.0-0:amd64	2:1.0.22-2
 libusb-1.0-0-dev:amd64	2:1.0.22-2
 libusb-1.0-doc	2:1.0.22-2
+libutempter0:amd64	1.1.6-3
 libuuid1:amd64	2.33.1-0.1
-libuv1:amd64	1.24.1-1
+libvariable-magic-perl	0.62-1+b1
 libwayland-bin	1.16.0-1
 libwayland-client0:amd64	1.16.0-1
 libwayland-cursor0:amd64	1.16.0-1
 libwayland-dev:amd64	1.16.0-1
 libwayland-egl1:amd64	1.16.0-1
 libwayland-server0:amd64	1.16.0-1
-libwrap0:amd64	7.6.q-28
+libwebp6:amd64	0.6.1-2+deb10u2
+libwoff1:amd64	1.0.2-1
 libwww-perl	6.36-2
 libwww-robotrules-perl	6.02-1
-libx11-6:amd64	2:1.6.7-1
-libx11-data	2:1.6.7-1
-libx11-dev:amd64	2:1.6.7-1
-libx11-xcb-dev:amd64	2:1.6.7-1
-libx11-xcb1:amd64	2:1.6.7-1
+libx11-6:amd64	2:1.6.7-1+deb10u3
+libx11-data	2:1.6.7-1+deb10u3
+libx11-dev:amd64	2:1.6.7-1+deb10u3
+libx11-protocol-perl	0.56-7
+libx11-xcb-dev:amd64	2:1.6.7-1+deb10u3
+libx11-xcb1:amd64	2:1.6.7-1+deb10u3
+libxapian30:amd64	1.4.11-1+deb10u1
 libxau-dev:amd64	1:1.0.8-1+b2
 libxau6:amd64	1:1.0.8-1+b2
+libxaw7:amd64	2:1.0.13-1+b2
 libxcb-dri2-0:amd64	1.13.1-2
 libxcb-dri2-0-dev:amd64	1.13.1-2
 libxcb-dri3-0:amd64	1.13.1-2
@@ -383,20 +466,27 @@
 libxcb-render0-dev:amd64	1.13.1-2
 libxcb-shape0:amd64	1.13.1-2
 libxcb-shape0-dev:amd64	1.13.1-2
+libxcb-shm0:amd64	1.13.1-2
 libxcb-sync-dev:amd64	1.13.1-2
 libxcb-sync1:amd64	1.13.1-2
 libxcb-xfixes0:amd64	1.13.1-2
 libxcb-xfixes0-dev:amd64	1.13.1-2
 libxcb1:amd64	1.13.1-2
 libxcb1-dev:amd64	1.13.1-2
+libxcomposite1:amd64	1:0.4.4-2
+libxcursor1:amd64	1:1.1.15-2
 libxdamage-dev:amd64	1:1.1.4-3+b3
 libxdamage1:amd64	1:1.1.4-3+b3
 libxdmcp-dev:amd64	1:1.1.2-3
 libxdmcp6:amd64	1:1.1.2-3
+libxdot4	2.40.1-6+deb10u1
 libxext-dev:amd64	2:1.3.3-1+b2
 libxext6:amd64	2:1.3.3-1+b2
 libxfixes-dev:amd64	1:5.0.3-1
 libxfixes3:amd64	1:5.0.3-1
+libxft2:amd64	2.3.2-2
+libxi6:amd64	2:1.7.9-1
+libxinerama1:amd64	2:1.1.4-2
 libxml-libxml-perl	2.0134+dfsg-1
 libxml-namespacesupport-perl	1.12-1
 libxml-parser-perl	2.44-4
@@ -404,25 +494,41 @@
 libxml-sax-expat-perl	0.51-1
 libxml-sax-perl	1.00+dfsg-1
 libxml-simple-perl	2.25-1
-libxml2:amd64	2.9.4+dfsg1-7+b3
+libxml-twig-perl	1:3.50-1.1
+libxml-xpathengine-perl	0.14-1
+libxml2:amd64	2.9.4+dfsg1-7+deb10u6
+libxml2-dev:amd64	2.9.4+dfsg1-7+deb10u6
+libxml2-utils	2.9.4+dfsg1-7+deb10u6
+libxmu6:amd64	2:1.1.2-2+b3
 libxmuu1:amd64	2:1.1.2-2+b3
+libxpm4:amd64	1:3.5.12-1+deb10u1
+libxrandr2:amd64	2:1.5.1-1
+libxrender1:amd64	1:0.9.10-1
 libxshmfence-dev:amd64	1.3-1
 libxshmfence1:amd64	1.3-1
-libxtables12:amd64	1.8.2-4
+libxslt1.1:amd64	1.1.32-2.2~deb10u2
+libxss1:amd64	1:1.2.3-1
+libxt6:amd64	1:1.1.5-1+b3
+libxtst6:amd64	2:1.2.3-1
+libxv1:amd64	2:1.0.11-1
+libxxf86dga1:amd64	2:1.1.4-1+b3
 libxxf86vm-dev:amd64	1:1.1.4-1+b2
 libxxf86vm1:amd64	1:1.1.4-1+b2
+libxxhash0:amd64	0.6.5-2
 libyaml-0-2:amd64	0.2.1-1
 libyaml-libyaml-perl	0.76+repack-1
 libyaml-perl	1.27-1
-libzstd1:amd64	1.3.8+dfsg-3
-linux-libc-dev:amd64	4.19.132-1
+libyaml-tiny-perl	1.73-1
+libzstd1:amd64	1.3.8+dfsg-3+deb10u2
+libzzip-0-13:amd64	0.13.62-3.2+deb10u1
+linux-libc-dev:amd64	4.19.289-2
 linux-libc-dev-arm64-cross	4.19.20-1cross1
+lmodern	2.004.5-6
 login	1:4.5-1.1
-logrotate	3.14.0-4
 lsb-base	10.2019051400
+lsb-release	10.2019051400
 m4	1.4.18-2
 make	4.2.1-1.2
-man-db	2.8.5-2
 manpages	4.16-2
 manpages-dev	4.16-2
 mawk	1.3.3-17+b3
@@ -430,17 +536,12 @@
 mime-support	3.62
 mount	2.33.1-0.1
 nasm	2.14-1
-ncurses-base	6.1+20181013-2+deb10u2
-ncurses-bin	6.1+20181013-2+deb10u2
-ncurses-term	6.1+20181013-2+deb10u2
-net-tools	1.60+git20180626.aebd88e-1
+ncurses-base	6.1+20181013-2+deb10u3
+ncurses-bin	6.1+20181013-2+deb10u3
 netbase	5.6
-nftables	0.9.0-2
 ninja-build	1.8.2-1
-openssh-client	1:7.9p1-10+deb10u2
-openssh-server	1:7.9p1-10+deb10u2
-openssh-sftp-server	1:7.9p1-10+deb10u2
-openssl	1.1.1d-0+deb10u3
+openssh-client	1:7.9p1-10+deb10u3
+openssl	1.1.1n-0+deb10u6
 passwd	1:4.5-1.1
 patch	2.7.6-3+deb10u1
 perl	5.28.1-6+deb10u1
@@ -449,23 +550,24 @@
 perl-openssl-defaults:amd64	3
 pinentry-curses	1.1.0-2
 pkg-config	0.29-6
-po-debconf	1.0.21
-procps	2:3.3.15-2
-protobuf-compiler	3.6.1.3-2
-psmisc	23.2-1
-publicsuffix	20190415.1030-1
+poppler-data	0.4.9-2
+preview-latex-style	11.91-2
+protobuf-compiler	3.6.1.3-2+deb10u1
+publicsuffix	20220811.1734-0+deb10u1
 python	2.7.16-1
+python-apt	1.8.4.3
+python-apt-common	1.8.4.3
 python-minimal	2.7.16-1
 python-pip-whl	18.1-5
 python2	2.7.16-1
 python2-minimal	2.7.16-1
-python2.7	2.7.16-2+deb10u1
-python2.7-minimal	2.7.16-2+deb10u1
+python2.7	2.7.16-2+deb10u2
+python2.7-minimal	2.7.16-2+deb10u2
 python3	3.7.3-1
 python3-asn1crypto	0.24.0-1
 python3-cffi-backend	1.12.2-1
 python3-crypto	2.6.1-9+b1
-python3-cryptography	2.6.1-3+deb10u2
+python3-cryptography	2.6.1-3+deb10u4
 python3-dbus	1.2.8-3
 python3-dev	3.7.3-1
 python3-distutils	3.7.3-1
@@ -482,22 +584,58 @@
 python3-six	1.12.0-1
 python3-wheel	0.32.3-2
 python3-xdg	0.25-5
-python3.7	3.7.3-2+deb10u2
-python3.7-dev	3.7.3-2+deb10u2
-python3.7-minimal	3.7.3-2+deb10u2
+python3.7	3.7.3-2+deb10u5
+python3.7-dev	3.7.3-2+deb10u5
+python3.7-minimal	3.7.3-2+deb10u5
+rake	12.3.1-3+deb10u1
 readline-common	7.0-5
-rsyslog	8.1901.0-1
+ruby	1:2.5.1
+ruby-did-you-mean	1.2.1-1
+ruby-minitest	5.11.3-1
+ruby-net-telnet	0.1.1-2
+ruby-power-assert	1.1.1-1
+ruby-test-unit	3.2.8-1
+ruby-xmlrpc	0.3.0-2
+ruby2.5	2.5.5-3+deb10u6
+rubygems-integration	1.11+deb10u1
 sed	4.7-1
 sensible-utils	0.0.12
+sgml-base	1.29
+sgml-data	2.0.11
 shared-mime-info	1.10-1
-sudo	1.8.27-1+deb10u2
-systemd	241-7~deb10u4
-systemd-sysv	241-7~deb10u4
+sudo	1.8.27-1+deb10u5
 sysvinit-utils	2.93-8
+t1utils	1.41-3
 tar	1.30+dfsg-6
-tzdata	2019c-0+deb10u1
+tcl	8.6.9+1
+tcl8.6	8.6.9+dfsg-2
+tex-common	6.11
+tex-gyre	20180621-3
+texinfo	6.5.0.dfsg.1-4+b1
+texlive	2018.20190227-2
+texlive-base	2018.20190227-2
+texlive-bibtex-extra	2018.20190227-2
+texlive-binaries	2018.20181218.49446-1+deb10u2
+texlive-extra-utils	2018.20190227-2
+texlive-fonts-recommended	2018.20190227-2
+texlive-lang-greek	2018.20190227-2
+texlive-latex-base	2018.20190227-2
+texlive-latex-extra	2018.20190227-2
+texlive-latex-recommended	2018.20190227-2
+texlive-pictures	2018.20190227-2
+texlive-plain-generic	2018.20190227-2
+texlive-science	2018.20190227-2
+tipa	2:1.3-20
+tk	8.6.9+1
+tk8.6	8.6.9-2
+tzdata	2021a-0+deb10u11
 ucf	3.0038+nmu1
+unzip	6.0-23+deb10u3
 util-linux	2.33.1-0.1
+wayland-protocols	1.17-1
+x11-common	1:7.7+19
+x11-utils	7.7+4
+x11-xserver-utils	7.7+8
 x11proto-core-dev	2018.4-4
 x11proto-damage-dev	1:2018.4-4
 x11proto-dev	2018.4-4
@@ -505,10 +643,19 @@
 x11proto-xext-dev	2018.4-4
 x11proto-xf86vidmode-dev	2018.4-4
 xauth	1:1.0.10-1
+xbitmaps	1.1.1-2
 xdg-user-dirs	0.17-2
+xdg-utils	1.1.3-1+deb10u1
+xfonts-encodings	1:1.0.4-2
+xfonts-utils	1:7.7+6
+xml-core	0.18+nmu1
+xmlto	0.0.28-2.1
 xorg-sgml-doctools	1:1.11-1
+xsltproc	1.1.32-2.2~deb10u2
+xterm	344-1+deb10u2
 xtrans-dev	1.3.5-1
 xutils-dev	1:7.7+5+b1
-xz-utils	5.2.4-1
-zlib1g:amd64	1:1.2.11.dfsg-1
-zlib1g-dev:amd64	1:1.2.11.dfsg-1
+xz-utils	5.2.4-1+deb10u1
+zip	3.0-11+b1
+zlib1g:amd64	1:1.2.11.dfsg-1+deb10u2
+zlib1g-dev:amd64	1:1.2.11.dfsg-1+deb10u2

diff --git a/x86_64-linux-gnu/builder_image.txt b/x86_64-linux-gnu/builder_image.txt
index c14aef9..a2ef946 100644
--- a/x86_64-linux-gnu/builder_image.txt
+++ b/x86_64-linux-gnu/builder_image.txt

@@ -1 +1 @@
-sourceImage: https://www.googleapis.com/compute/v1/projects/cloud-android-testing/global/images/jemoreira-build-image
+sourceImage: https://www.googleapis.com/compute/v1/projects/google.com:android-treehugger-developer/global/images/jemoreira-build-image

diff --git a/x86_64-linux-gnu/cargo_version.txt b/x86_64-linux-gnu/cargo_version.txt
index 08467d7..7068d78 100644
--- a/x86_64-linux-gnu/cargo_version.txt
+++ b/x86_64-linux-gnu/cargo_version.txt

@@ -1,4 +1,8 @@
-cargo 1.45.1 (f242df6ed 2020-07-22)
-release: 1.45.1
-commit-hash: f242df6edb897f6f69d393a22bb257f5af0f52d0
-commit-date: 2020-07-22
+cargo 1.68.2 (6feb7c9cf 2023-03-26)
+release: 1.68.2
+commit-hash: 6feb7c9cfc0c5604732dba75e4c3b2dbea38e8d8
+commit-date: 2023-03-26
+host: x86_64-unknown-linux-gnu
+libgit2: 1.5.0 (sys:0.16.0 vendored)
+libcurl: 7.86.0-DEV (sys:0.4.59+curl-7.86.0 vendored ssl:OpenSSL/1.1.1q)
+os: Debian 10 (buster) [64-bit]

diff --git a/x86_64-linux-gnu/etc/seccomp/9p_device.policy b/x86_64-linux-gnu/etc/seccomp/9p_device.policy
new file mode 100644
index 0000000..f835082
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/9p_device.policy

@@ -0,0 +1,100 @@
+# Copyright 2018 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+open: 1
+openat: 1
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+pwrite64: 1
+stat: 1
+statx: 1
+fstat: 1
+ioctl: arg1 == FIOCLEX
+linkat: 1
+unlinkat: 1
+renameat: 1
+pread64: 1
+getdents64: 1
+mkdirat: 1
+rmdir: 1
+fsync: 1
+fdatasync: 1
+utimensat: 1
+fchmod: 1
+fchmodat: 1
+fchown: 1
+fchownat: 1
+fstatfs: 1
+newfstatat: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/balloon_device.policy b/x86_64-linux-gnu/etc/seccomp/balloon_device.policy
new file mode 100644
index 0000000..775bc98
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/balloon_device.policy

@@ -0,0 +1,78 @@
+# Copyright 2017 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/battery.policy b/x86_64-linux-gnu/etc/seccomp/battery.policy
new file mode 100644
index 0000000..3fba1b9
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/battery.policy

@@ -0,0 +1,88 @@
+# Copyright 2020 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Syscalls used by power_monitor's powerd implementation.
+clock_getres: 1
+connect: 1
+getegid: 1
+geteuid: 1
+getrandom: 1
+getresgid: 1
+getresuid: 1
+getsockname: 1
+openat: 1
+socket: arg0 == AF_UNIX
+# tgkill: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/block_device.policy b/x86_64-linux-gnu/etc/seccomp/block_device.policy
new file mode 100644
index 0000000..2b0a5a5
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/block_device.policy

@@ -0,0 +1,96 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a block device used as a regular, in-VMM virtio device.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+fallocate: 1
+fdatasync: 1
+fstat: 1
+fsync: 1
+open: return ENOENT
+openat: return ENOENT
+newfstatat: 1
+pread64: 1
+preadv: 1
+pwrite64: 1
+pwritev: 1
+statx: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG

diff --git a/x86_64-linux-gnu/etc/seccomp/block_device_vhost_user.policy b/x86_64-linux-gnu/etc/seccomp/block_device_vhost_user.policy
new file mode 100644
index 0000000..a3b716f
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/block_device_vhost_user.policy

@@ -0,0 +1,6 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a block device used as a vhost-user backend.
+

diff --git a/x86_64-linux-gnu/etc/seccomp/block_device_vvu.policy b/x86_64-linux-gnu/etc/seccomp/block_device_vvu.policy
new file mode 100644
index 0000000..e9f8484
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/block_device_vvu.policy

@@ -0,0 +1,109 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a block device used as a vvu backend.
+
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for the vhost-user transport over VVU.
+
+ioctl: arg1 == TCGETS || arg1 == TCSETS
+# b/239779171: Temporarily disabled as it is also in common_device.policy.
+# rseq: 1
+# b/239779171: Temporarily disabled as it conflicts with block's definition.
+# pread64: 1
+# pwrite64: 1
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+fallocate: 1
+fdatasync: 1
+fstat: 1
+fsync: 1
+open: return ENOENT
+openat: return ENOENT
+newfstatat: 1
+pread64: 1
+preadv: 1
+pwrite64: 1
+pwritev: 1
+statx: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG

diff --git a/x86_64-linux-gnu/etc/seccomp/coiommu.policy b/x86_64-linux-gnu/etc/seccomp/coiommu.policy
new file mode 100644
index 0000000..d2e4c62
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/coiommu.policy

@@ -0,0 +1,63 @@
+# Copyright 2022 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# VFIO_IOMMU_MAP/UNMAP_DMA
+ioctl: arg1 == 0x3B71 || arg1 == 0x3B72
+prctl: arg0 == PR_SET_NAME
+timerfd_create: 1
+timerfd_settime: 1
+timerfd_gettime: 1
+clone3: 1
+rseq: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/coiommu_device.policy b/x86_64-linux-gnu/etc/seccomp/coiommu_device.policy
new file mode 100644
index 0000000..5d1b3a2
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/coiommu_device.policy

@@ -0,0 +1,81 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# VFIO_IOMMU_MAP/UNMAP_DMA
+ioctl: arg1 == 0x3B71 || arg1 == 0x3B72
+prctl: arg0 == PR_SET_NAME
+timerfd_create: 1
+timerfd_settime: 1
+timerfd_gettime: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/common_device.policy b/x86_64-linux-gnu/etc/seccomp/common_device.policy
new file mode 100644
index 0000000..e1d76d9
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/common_device.policy

@@ -0,0 +1,57 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@frequency ./common_device.frequency
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+clone3: 1
+rseq: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/cras_audio_device.policy b/x86_64-linux-gnu/etc/seccomp/cras_audio_device.policy
new file mode 100644
index 0000000..6196001
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/cras_audio_device.policy

@@ -0,0 +1,85 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+open: return ENOENT
+openat: return ENOENT
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/cras_snd_device.policy b/x86_64-linux-gnu/etc/seccomp/cras_snd_device.policy
new file mode 100644
index 0000000..ef86153
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/cras_snd_device.policy

@@ -0,0 +1,70 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+open: return ENOENT
+openat: return ENOENT
+socket: arg0 == AF_UNIX
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+connect: 1
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
+clone3: 1
+rseq: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/fs_device.policy b/x86_64-linux-gnu/etc/seccomp/fs_device.policy
new file mode 100644
index 0000000..58ba8fe
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/fs_device.policy

@@ -0,0 +1,128 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+copy_file_range: 1
+fallocate: 1
+fchdir: 1
+fchmod: 1
+fchmodat: 1
+fchown: 1
+fchownat: 1
+fdatasync: 1
+fgetxattr: 1
+getxattr: 1
+fsetxattr: 1
+setxattr: 1
+flistxattr: 1
+listxattr: 1
+fremovexattr: 1
+removexattr: 1
+fstatfs: 1
+fsync: 1
+getdents64: 1
+getegid: 1
+geteuid: 1
+getrandom: 1
+# Use constants for verity ioctls since minijail doesn't understand them yet.
+# 0x40806685 = FS_IOC_ENABLE_VERITY
+# 0xc0046686 = FS_IOC_MEASURE_VERITY
+ioctl: arg1 == FS_IOC_FSGETXATTR || \
+arg1 == FS_IOC_FSSETXATTR || \
+arg1 == FS_IOC_GETFLAGS || \
+arg1 == FS_IOC_SETFLAGS || \
+arg1 == FS_IOC_GET_ENCRYPTION_POLICY_EX || \
+arg1 == 0x40806685 || \
+arg1 == 0xc0046686
+linkat: 1
+mkdir: 1
+mkdirat: 1
+mknodat: 1
+newfstatat: 1
+open: return ENOENT
+openat: 1
+preadv: 1
+pwritev: 1
+renameat2: 1
+setresgid: 1
+setresuid: 1
+symlinkat: 1
+statx: 1
+umask: 1
+unlinkat: 1
+utimensat: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_SECUREBITS || arg0 == PR_GET_SECUREBITS
+capget: 1
+capset: 1
+unshare: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/fw_cfg_device.policy b/x86_64-linux-gnu/etc/seccomp/fw_cfg_device.policy
new file mode 100644
index 0000000..cb372c3
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/fw_cfg_device.policy

@@ -0,0 +1,78 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+prctl: arg0 == PR_SET_NAME
+open: return ENOENT
+openat: return ENOENT

diff --git a/x86_64-linux-gnu/etc/seccomp/gpu_common.policy b/x86_64-linux-gnu/etc/seccomp/gpu_common.policy
new file mode 100644
index 0000000..fabfa4c
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/gpu_common.policy

@@ -0,0 +1,108 @@
+# Copyright 2021 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Rules specific to gpu
+connect: 1
+# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS
+fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_SETFD || arg1 == F_GETFL || \
+arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034
+fstat: 1
+# Used to set of size new memfd.
+ftruncate: 1
+getdents: 1
+getdents64: 1
+geteuid: 1
+getrandom: 1
+getuid: 1
+# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST
+ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543
+lseek: 1
+lstat: 1
+# Used for sharing memory with wayland. Also internally by Intel anv.
+# arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING or simply MFD_CLOEXEC.
+memfd_create: arg1 == 3 || arg1 == 1
+# mmap/mprotect/open/openat differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+open: 1
+openat: 1
+stat: 1
+statx: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# Required for perfetto tracing
+# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
+getsockopt: 1
+shutdown: 1
+
+# Rules for Mesa's shader binary cache.
+flock: 1
+mkdir: 1
+newfstatat: 1
+rename: 1
+setpriority: 1
+unlink: 1
+
+# Rules specific to AMD gpus.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Vulkan loader / layers
+access: 1
+getgid: 1
+getegid: 1
+clone3: 1
+rseq: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/gpu_device.policy b/x86_64-linux-gnu/etc/seccomp/gpu_device.policy
new file mode 100644
index 0000000..8b05758
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/gpu_device.policy

@@ -0,0 +1,127 @@
+# Copyright 2018 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Rules specific to gpu
+connect: 1
+# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS
+fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_GETFD || arg1 == F_SETFD || \
+       arg1 == F_GETFL || arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034
+fstat: 1
+# Used to set of size new memfd.
+ftruncate: 1
+getdents: 1
+getdents64: 1
+geteuid: 1
+getrandom: 1
+getuid: 1
+# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST
+ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543 || arg1 == 0x5421 || arg1 == 0xc0383e04 || arg1 == 0xc018aa3f || arg1 == 0xaa00
+lseek: 1
+lstat: 1
+# Used for sharing memory with wayland. Also internally by Intel anv.
+# arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING with or without MFD_NOEXEC_SEAL, or simply MFD_CLOEXEC.
+memfd_create: arg1 == 3 || arg1 == 11 || arg1 == 1
+# mmap/mprotect/open/openat differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+open: 1
+openat: 1
+stat: 1
+statx: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# Required for perfetto tracing
+# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
+getsockopt: 1
+shutdown: 1
+
+# Rules for Mesa's shader binary cache.
+fallocate: 1
+flock: 1
+inotify_add_watch: 1
+inotify_init1: 1
+inotify_rm_watch: 1
+mkdir: 1
+newfstatat: 1
+rename: 1
+setpriority: 1
+unlink: 1
+
+# Rules specific to AMD gpus.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Vulkan loader / layers
+access: 1
+getgid: 1
+getegid: 1
+
+## Rules for vmm-swap
+userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+socket: arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC && arg2 == 0
+clone: arg0 & CLONE_THREAD

diff --git a/x86_64-linux-gnu/etc/seccomp/gpu_render_server.policy b/x86_64-linux-gnu/etc/seccomp/gpu_render_server.policy
new file mode 100644
index 0000000..12201a7
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/gpu_render_server.policy

@@ -0,0 +1,137 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Rules specific to gpu
+connect: 1
+# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS
+fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_GETFD || arg1 == F_SETFD || \
+       arg1 == F_GETFL || arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034
+fstat: 1
+# Used to set of size new memfd.
+ftruncate: 1
+getdents: 1
+getdents64: 1
+geteuid: 1
+getrandom: 1
+getuid: 1
+# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST
+ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543 || arg1 == 0x5421 || arg1 == 0xc0383e04 || arg1 == 0xc018aa3f || arg1 == 0xaa00
+lseek: 1
+lstat: 1
+# Used for sharing memory with wayland. Also internally by Intel anv.
+# arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING with or without MFD_NOEXEC_SEAL, or simply MFD_CLOEXEC.
+memfd_create: arg1 == 3 || arg1 == 11 || arg1 == 1
+# mmap/mprotect/open/openat differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+open: 1
+openat: 1
+stat: 1
+statx: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# Required for perfetto tracing
+# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
+getsockopt: 1
+shutdown: 1
+
+# Rules for Mesa's shader binary cache.
+fallocate: 1
+flock: 1
+inotify_add_watch: 1
+inotify_init1: 1
+inotify_rm_watch: 1
+mkdir: 1
+newfstatat: 1
+rename: 1
+setpriority: 1
+unlink: 1
+
+# Rules specific to AMD gpus.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Vulkan loader / layers
+access: 1
+getgid: 1
+getegid: 1
+
+## Rules for vmm-swap
+userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# allow fork() and waitid()
+clone: 1
+waitid: 1
+
+# allow SOCK_STREAM and SOCK_DGRAM (syslog)
+socket: arg0 == AF_UNIX && arg2 == 0
+
+# allow socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC)
+socketpair: arg0 == AF_UNIX && arg1 == SOCK_SEQPACKET|SOCK_CLOEXEC && arg2 == 0
+
+# allow signalfd()
+signalfd4: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/input_device.policy b/x86_64-linux-gnu/etc/seccomp/input_device.policy
new file mode 100644
index 0000000..e991c03
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/input_device.policy

@@ -0,0 +1,80 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+ioctl: 1
+getsockname: 1
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/iommu_device.policy b/x86_64-linux-gnu/etc/seccomp/iommu_device.policy
new file mode 100644
index 0000000..a9ec51e
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/iommu_device.policy

@@ -0,0 +1,82 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+prctl: arg0 == PR_SET_NAME
+open: return ENOENT
+openat: return ENOENT
+
+# 0x3B71: VFIO_IOMMU_MAP_DMA
+# 0x3B72: VFIO_IOMMU_UNMAP_DMA
+ioctl: arg1 == 0x3B71 || arg1 == 0x3B72

diff --git a/x86_64-linux-gnu/etc/seccomp/jail_warden.policy b/x86_64-linux-gnu/etc/seccomp/jail_warden.policy
new file mode 100644
index 0000000..a5345cc
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/jail_warden.policy

@@ -0,0 +1,119 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules for jail_warden, which is union of the rules for the devices it creates,
+# rules for creating devices, and rules for jailing devices.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+capget: 1
+capset: 1
+chdir: 1
+chroot: 1
+clone: 1
+fchdir: 1
+getdents64: 1
+#ioctl: FIONBIO, SIOCGIFMTU, SIOCSIFFLAGS, SIOCGIFFLAGS, TCGETS, TUNSETIFF
+# TUNSETVNETHDRSZ, TUNSETOFFLOAD, UFFDIO_API, USERFAULTFD_IOC_NEW
+ioctl: arg1 == 0x5421 || \
+arg1 == 0x8921 || \
+arg1 == 0x8914 || \
+arg1 == 0x8913 || \
+arg1 == 0x5401 || \
+arg1 == 0x400454ca || \
+arg1 == 0x400454d8 || \
+arg1 == 0x400454d0 || \
+arg1 == 0xc018aa3f || \
+arg1 == 0xaa00
+madvise: 1
+mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
+mount: 1
+mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
+newfstatat: 1
+openat: 1
+pivot_root: 1
+prctl: arg0 == PR_SET_NO_NEW_PRIVS || \
+arg0 == PR_SET_SECUREBITS || \
+arg0 == PR_SET_SECCOMP || \
+arg0 == PR_CAPBSET_DROP || \
+arg0 == PR_SET_NAME
+prlimit64: 1
+setsid: 1
+setsockopt: 1
+socket: arg0 == AF_INET || arg0 == AF_UNIX
+socketpair: 1
+statx: 1
+# ANDROID: already exists in common_device.policy
+# tgkill: 1
+umount2: 1 # Create jail
+unshare: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/net_device.policy b/x86_64-linux-gnu/etc/seccomp/net_device.policy
new file mode 100644
index 0000000..5b32d70
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/net_device.policy

@@ -0,0 +1,83 @@
+# Copyright 2017 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# TUNSETOFFLOAD
+ioctl: arg1 == 0x400454d0
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG

diff --git a/x86_64-linux-gnu/etc/seccomp/net_device_vhost_user.policy b/x86_64-linux-gnu/etc/seccomp/net_device_vhost_user.policy
new file mode 100644
index 0000000..ed332c2
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/net_device_vhost_user.policy

@@ -0,0 +1,6 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a network device used as a vhost-user backend.
+

diff --git a/x86_64-linux-gnu/etc/seccomp/null_audio_device.policy b/x86_64-linux-gnu/etc/seccomp/null_audio_device.policy
new file mode 100644
index 0000000..b6bc048
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/null_audio_device.policy

@@ -0,0 +1,81 @@
+# Copyright 2017 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+open: return ENOENT
+openat: return ENOENT
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/pmem_device.policy b/x86_64-linux-gnu/etc/seccomp/pmem_device.policy
new file mode 100644
index 0000000..c7fe5b0
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/pmem_device.policy

@@ -0,0 +1,80 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+fdatasync: 1
+fsync: 1
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/rng_device.policy b/x86_64-linux-gnu/etc/seccomp/rng_device.policy
new file mode 100644
index 0000000..ca8d59b
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/rng_device.policy

@@ -0,0 +1,79 @@
+# Copyright 2017 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+getrandom: 1
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/serial.policy b/x86_64-linux-gnu/etc/seccomp/serial.policy
new file mode 100644
index 0000000..e2ba66b
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/serial.policy

@@ -0,0 +1,14 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Syscalls specific to the serial device. This policy file is not meant to be used directly, but
+# rather to be included from another one.
+
+connect: 1
+bind: 1
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME
+clone3: 1
+rseq: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/serial_device.policy b/x86_64-linux-gnu/etc/seccomp/serial_device.policy
new file mode 100644
index 0000000..029db64
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/serial_device.policy

@@ -0,0 +1,88 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a serial device used as a regular, in-VMM virtio device.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Syscalls specific to the serial device. This policy file is not meant to be used directly, but
+# rather to be included from another one.
+
+connect: 1
+bind: 1
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG

diff --git a/x86_64-linux-gnu/etc/seccomp/serial_device_vhost_user.policy b/x86_64-linux-gnu/etc/seccomp/serial_device_vhost_user.policy
new file mode 100644
index 0000000..b7de7d3
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/serial_device_vhost_user.policy

@@ -0,0 +1,6 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a serial device used as a vhost-user backend.
+

diff --git a/x86_64-linux-gnu/etc/seccomp/serial_device_vvu.policy b/x86_64-linux-gnu/etc/seccomp/serial_device_vvu.policy
new file mode 100644
index 0000000..1c143b2
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/serial_device_vvu.policy

@@ -0,0 +1,105 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a serial device used as a vvu backend.
+
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for the vhost-user transport over VVU.
+
+ioctl: arg1 == TCGETS || arg1 == TCSETS
+# b/239779171: Temporarily disabled as it is also in common_device.policy.
+# rseq: 1
+# b/239779171: Temporarily disabled as it conflicts with block's definition.
+# pread64: 1
+# pwrite64: 1
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Syscalls specific to the serial device. This policy file is not meant to be used directly, but
+# rather to be included from another one.
+
+connect: 1
+bind: 1
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG
+
+# From vvu.policy
+pread64: 1
+pwrite64: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/snd_cras_device.policy b/x86_64-linux-gnu/etc/seccomp/snd_cras_device.policy
new file mode 100644
index 0000000..3d41d4f
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/snd_cras_device.policy

@@ -0,0 +1,87 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+open: return ENOENT
+openat: return ENOENT
+socket: arg0 == AF_UNIX
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+connect: 1
+prlimit64: 1
+setrlimit: 1
+sched_setscheduler: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/snd_null_device.policy b/x86_64-linux-gnu/etc/seccomp/snd_null_device.policy
new file mode 100644
index 0000000..93e6a91
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/snd_null_device.policy

@@ -0,0 +1,84 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+openat: return ENOENT
+socket: arg0 == AF_UNIX
+socketpair: arg0 == AF_UNIX
+prctl: arg0 == PR_SET_NAME
+connect: 1
+prlimit64: 1
+sched_setscheduler: 1
+timerfd_create: 1
+timerfd_settime: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/swap_monitor.policy b/x86_64-linux-gnu/etc/seccomp/swap_monitor.policy
new file mode 100644
index 0000000..90b9de8
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/swap_monitor.policy

@@ -0,0 +1,63 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+chdir: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+fallocate: 1
+fchdir: 1
+fcntl: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getdents64: 1
+getpid: 1
+gettid: 1
+# 0xc020aa00 = UFFDIO_REGISTER, 0x8010aa01 == UFFDIO_UNREGISTER, 0x8010aa02 == UFFDIO_WAKE, 0xc028aa03 == UFFDIO_COPY, 0xc020aa04 == UFFDIO_ZEROPAGE
+ioctl: arg1 == 0xc020aa00 || arg1 == 0x8010aa01 || arg1 == 0x8010aa02 || arg1 == 0xc028aa03 || arg1 == 0xc020aa04
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_WILLNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_MERGEABLE || arg2 == MADV_REMOVE
+memfd_create: 1
+mlock2: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+munlock: 1
+munmap: 1
+newfstatat: 1
+openat: return ENOENT
+pipe2: 1
+ppoll: 1
+prctl: arg0 == PR_SET_NAME
+pwrite64: 1
+read: 1
+readlink: 1
+readlinkat: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sendmsg: 1
+set_robust_list: 1
+sigaltstack: 1
+socket: 1
+statx: 1
+timerfd_create: 1
+timerfd_settime: 1
+timerfd_gettime: 1
+tgkill: arg2 == SIGABRT
+write: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/tpm_device.policy b/x86_64-linux-gnu/etc/seccomp/tpm_device.policy
new file mode 100644
index 0000000..d0723e0
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/tpm_device.policy

@@ -0,0 +1,88 @@
+# Copyright 2018 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+chdir: 1
+fstat: 1
+fsync: 1
+getrandom: 1
+getuid: 1
+mkdir: 1
+newfstatat: 1
+open: 1
+openat: 1
+prctl: arg0 == PR_SET_NAME
+socket: return EACCES
+stat: 1
+statx: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/vfio_device.policy b/x86_64-linux-gnu/etc/seccomp/vfio_device.policy
new file mode 100644
index 0000000..e67d852
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vfio_device.policy

@@ -0,0 +1,91 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# 0x3B6E: VFIO_DEVICE_SET_IRQS
+# 0x3B71: VFIO_IOMMU_MAP_DMA
+# 0x3B72: VFIO_IOMMU_UNMAP_DMA
+# 0x3B75: VFIO_DEVICE_FEATURE
+# 0x3B76: VFIO_DEVICE_ACPI_DSM
+ioctl: arg1 == 0x3B6E || \
+arg1 == 0x3B71 || \
+arg1 == 0x3B72 || \
+arg1 == 0x3B75 || \
+arg1 == 0x3B76
+msync: 1
+open: return ENOENT
+openat: return ENOENT
+pread64: 1
+pwrite64: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/vhost_net_device.policy b/x86_64-linux-gnu/etc/seccomp/vhost_net_device.policy
new file mode 100644
index 0000000..70f1235
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vhost_net_device.policy

@@ -0,0 +1,95 @@
+# Copyright 2017 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Whitelist vhost_net ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+# arg1 == VHOST_NET_SET_BACKEND
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22 || arg1 == 0x4008af30
+open: return ENOENT
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device.policy b/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device.policy
new file mode 100644
index 0000000..3e73e63
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device.policy

@@ -0,0 +1,89 @@
+# Copyright 2017 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a vhost-vsock device used as a regular, in-VMM virtio device.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for the vhost-user transport over a socket.
+
+# FIONBIO: for setting non-blocking mode over the socket.
+# TCGETS/TCSETS: used on FD 0, probably for serial.
+# b/239779171: try moving this to the serial device once we can extend ioctls across policy files.
+ioctl: arg1 == FIONBIO || arg1 == TCGETS || arg1 == TCSETS
+# For accepting a client connection over the socket.
+accept4: 1
+

diff --git a/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device_vhost_user.policy b/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device_vhost_user.policy
new file mode 100644
index 0000000..81045b1
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device_vhost_user.policy

@@ -0,0 +1,6 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a vhost-vsock device used as a vhost-user backend.
+

diff --git a/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device_vvu.policy b/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device_vvu.policy
new file mode 100644
index 0000000..28f2860
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vhost_vsock_device_vvu.policy

@@ -0,0 +1,123 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for a block device used as a vvu backend.
+
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Policy file for the vhost-user transport over VVU.
+
+ioctl: arg1 == TCGETS || arg1 == TCSETS
+# b/239779171: Temporarily disabled as it is also in common_device.policy.
+# rseq: 1
+# b/239779171: Temporarily disabled as it conflicts with block's definition.
+# pread64: 1
+# pwrite64: 1
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Syscalls specific to the vhost_vsock device. This policy file is not meant to be used directly,
+# but rather to be included from another one.
+
+# Allow vhost_vsock ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+# arg1 == VHOST_VSOCK_SET_GUEST_CID ||
+# arg1 == VHOST_VSOCK_SET_RUNNING
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22 || arg1 == 0x4008af60 || arg1 == 0x4004af61
+connect: 1
+open: return ENOENT
+openat: return ENOENT
+# PDEATHSIG is necessary for jailing as a vhost-user device.
+prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG
+
+# From vvu.policy
+pread64: 1
+pwrite64: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/video_device.policy b/x86_64-linux-gnu/etc/seccomp/video_device.policy
new file mode 100644
index 0000000..7aa0d54
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/video_device.policy

@@ -0,0 +1,109 @@
+# Copyright 2020 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with mmap and mprotect removed because the video device needs
+# to allow more arguments for them.
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# Syscalls specific to video devices.
+clock_getres: 1
+connect: 1
+getdents: 1
+getdents64: 1
+getegid: 1
+geteuid: 1
+getgid: 1
+getresgid: 1
+getresuid: 1
+getsockname: 1
+getuid: 1
+# ioctl: arg1 == DRM_IOCTL_*
+ioctl: arg1 & 0x6400
+memfd_create: 1
+newfstatat: 1
+openat: 1
+setpriority: 1
+socket: arg0 == AF_UNIX
+stat: 1
+fstat: 1
+fstatfs: 1
+statx: 1
+
+# Rules needed for minigbm on AMD devices.
+getrandom: 1
+lstat: 1
+# mmap/mprotect differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+sched_setaffinity: 1
+sched_setscheduler: arg1 == SCHED_IDLE || arg1 == SCHED_BATCH
+
+# Required by mesa on AMD GPU
+kcmp: 1
+sysinfo: 1
+
+prctl: arg0 == PR_SET_NAME
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+## Rules for vmm-swap
+#userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+#ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Required by VAAPI backend
+access: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/vios_audio_device.policy b/x86_64-linux-gnu/etc/seccomp/vios_audio_device.policy
new file mode 100644
index 0000000..19d5074
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vios_audio_device.policy

@@ -0,0 +1,82 @@
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+open: return ENOENT
+openat: return ENOENT
+prlimit64: 1
+sched_setscheduler: 1
+setrlimit: 1
+prctl: arg0 == PR_SET_NAME
+statx: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/vtpm_proxy_device.policy b/x86_64-linux-gnu/etc/seccomp/vtpm_proxy_device.policy
new file mode 100644
index 0000000..1f7ada9
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vtpm_proxy_device.policy

@@ -0,0 +1,89 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+# Syscalls needed by dbus request.
+clock_getres: 1
+connect: 1
+getegid: 1
+geteuid: 1
+getrandom: 1
+getresgid: 1
+getresuid: 1
+getsockname: 1
+open: 1
+openat: 1
+socket: arg0 == AF_UNIX
+# tgkill: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/etc/seccomp/vvu_proxy_device.policy b/x86_64-linux-gnu/etc/seccomp/vvu_proxy_device.policy
new file mode 100644
index 0000000..860c8c8
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/vvu_proxy_device.policy

@@ -0,0 +1,83 @@
+# Copyright 2022 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+accept4: 1
+bind: 1
+fstat: 1
+getdents64: 1
+ioctl: arg1 == SIOCGIFFLAGS || arg1 == SIOCSIFFLAGS || arg1 == TCGETS
+prctl: arg0 == PR_SET_NAME
+socket: arg0 == AF_UNIX
+socketpair: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/wl_device.policy b/x86_64-linux-gnu/etc/seccomp/wl_device.policy
new file mode 100644
index 0000000..48e0426
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/wl_device.policy

@@ -0,0 +1,130 @@
+# Copyright 2018 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2021 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clock_gettime: 1
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+uname: 1
+
+# Rules specific to gpu
+connect: 1
+# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS
+fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_GETFD || arg1 == F_SETFD || \
+       arg1 == F_GETFL || arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034
+fstat: 1
+# Used to set of size new memfd.
+ftruncate: 1
+getdents: 1
+getdents64: 1
+geteuid: 1
+getrandom: 1
+getuid: 1
+# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST
+ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543 || arg1 == 0x5421 || arg1 == 0xc0383e04 || arg1 == 0xc018aa3f || arg1 == 0xaa00
+lseek: 1
+lstat: 1
+# Used for sharing memory with wayland. Also internally by Intel anv.
+# arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING with or without MFD_NOEXEC_SEAL, or simply MFD_CLOEXEC.
+memfd_create: arg1 == 3 || arg1 == 11 || arg1 == 1
+# mmap/mprotect/open/openat differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+open: 1
+openat: 1
+stat: 1
+statx: 1
+sysinfo: 1
+fstatfs: 1
+prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
+
+# Required for perfetto tracing
+# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
+getsockopt: 1
+shutdown: 1
+
+# Rules for Mesa's shader binary cache.
+fallocate: 1
+flock: 1
+inotify_add_watch: 1
+inotify_init1: 1
+inotify_rm_watch: 1
+mkdir: 1
+newfstatat: 1
+rename: 1
+setpriority: 1
+unlink: 1
+
+# Rules specific to AMD gpus.
+sched_setscheduler: 1
+sched_setaffinity: 1
+kcmp: 1
+
+# Rules for Vulkan loader / layers
+access: 1
+getgid: 1
+getegid: 1
+
+## Rules for vmm-swap
+userfaultfd: 1
+# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+clone: arg0 & CLONE_THREAD
+# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
+socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
+# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC || arg1 == SYNC_IOC_FILE_INFO || arg1 & DRM_IOCTL_BASE
+# ioctl: arg1 == 0x5421 || arg1 == 0x40086200 || arg1 == 0xc0383e04 || arg1 & 0x6400

diff --git a/x86_64-linux-gnu/etc/seccomp/xhci.policy b/x86_64-linux-gnu/etc/seccomp/xhci.policy
new file mode 100644
index 0000000..bc6f421
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/xhci.policy

@@ -0,0 +1,96 @@
+# Copyright 2018 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_enter: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+lstat: 1
+timerfd_create: 1
+name_to_handle_at: 1
+access: 1
+faccessat: 1
+faccessat2: 1
+getsockname: 1
+pipe: 1
+setsockopt: 1
+bind: 1
+open: return ENOENT
+openat: 1
+socket: arg0 == AF_NETLINK
+stat: 1
+statx: 1
+# The following ioctls are:
+# 0x4008550d == USBDEVFS_REAPURBNDELAY
+# 0x41045508 == USBDEVFS_GETDRIVER
+# 0x550b == USBDEVFS_DISCARDURB
+# 0x8004550f == USBDEVFS_CLAIMINTERFACE
+# 0x80045510 == USBDEVFS_RELEASEINTERFACE
+# 0x80045515 == USBDEVFS_CLEAR_HALT
+# 0x8004551a == USBDEVFS_GET_CAPABILITIES
+# 0x8038550a == USBDEVFS_SUBMITURB
+# 0xc0185500 == USBDEVFS_CONTROL
+# 0x5514 == USBDEVFS_RESET
+# 0x80045505 == USBDEVFS_SETCONFIGURATION
+# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
+# 0x40085511 == USBDEVFS_CONNECTINFO
+# 0x80185520 == USBDEVFS_CONNINFO_EX
+ioctl: arg1 == 0xc0185500 || arg1 == 0x41045508 || arg1 == 0x8004550f || arg1 == 0x4008550d || arg1 == 0x8004551a || arg1 == 0x550b || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x8038550a || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520
+fstat: 1
+newfstatat: 1
+getrandom: 1
+getdents: 1
+getdents64: 1
+lseek: 1
+prctl: arg0 == PR_SET_NAME
+clone3: 1
+rseq: 1

diff --git a/x86_64-linux-gnu/etc/seccomp/xhci_device.policy b/x86_64-linux-gnu/etc/seccomp/xhci_device.policy
new file mode 100644
index 0000000..5fc3d6d
--- /dev/null
+++ b/x86_64-linux-gnu/etc/seccomp/xhci_device.policy

@@ -0,0 +1,116 @@
+# Copyright 2018 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+poll: 1
+ppoll: 1
+read: 1
+readlink: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+# arg2 == SIGABRT -- ANDROID(b/270404912): modified to 1 - duplicate error.
+tgkill: 1
+write: 1
+writev: 1
+fcntl: 1
+uname: 1
+
+# ANDROID(b/271625758): disabled to fix duplicate syscall error.
+# ## Rules for vmm-swap
+# userfaultfd: 1
+# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
+# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
+
+lstat: 1
+timerfd_create: 1
+name_to_handle_at: 1
+access: 1
+faccessat: 1
+faccessat2: 1
+getsockname: 1
+pipe: 1
+setsockopt: 1
+bind: 1
+open: return ENOENT
+openat: 1
+socket: arg0 == AF_NETLINK
+stat: 1
+statx: 1
+# The following ioctls are:
+# 0x4008550d == USBDEVFS_REAPURBNDELAY
+# 0x41045508 == USBDEVFS_GETDRIVER
+# 0x550b == USBDEVFS_DISCARDURB
+# 0x8004550f == USBDEVFS_CLAIMINTERFACE
+# 0x80045510 == USBDEVFS_RELEASEINTERFACE
+# 0x80045515 == USBDEVFS_CLEAR_HALT
+# 0x8004551a == USBDEVFS_GET_CAPABILITIES
+# 0x8038550a == USBDEVFS_SUBMITURB
+# 0xc0185500 == USBDEVFS_CONTROL
+# 0x5514 == USBDEVFS_RESET
+# 0x80045505 == USBDEVFS_SETCONFIGURATION
+# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
+# 0x40085511 == USBDEVFS_CONNECTINFO
+# 0x80185520 == USBDEVFS_CONNINFO_EX
+# 0x551f == USBDEVFS_GET_SPEED
+# 0x8008551c == USBDEVFS_ALLOC_STREAMS
+# 0x8008551d == USBDEVFS_FREE_STREAMS
+# 0x80085504 == USBDEVFS_SETINTERFACE
+ioctl: arg1 == 0xc0185500 || arg1 == 0x41045508 || arg1 == 0x8004550f || arg1 == 0x4008550d || arg1 == 0x8004551a || arg1 == 0x550b || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x8038550a || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520 || arg1 == 0x551f || arg1 == 0x8008551c || arg1 == 0x8008551d || arg1 == 0x80085504
+fstat: 1
+newfstatat: 1
+getrandom: 1
+getdents: 1
+getdents64: 1
+prctl: arg0 == PR_SET_NAME

diff --git a/x86_64-linux-gnu/rustup_show.txt b/x86_64-linux-gnu/rustup_show.txt
index 775cdf2..c555aa5 100644
--- a/x86_64-linux-gnu/rustup_show.txt
+++ b/x86_64-linux-gnu/rustup_show.txt

@@ -1,14 +1,15 @@
 Default host: x86_64-unknown-linux-gnu
+rustup home:  /home/natsu/.rustup
 
-installed targets for active toolchain
---------------------------------------
+installed toolchains
+--------------------
 
-aarch64-unknown-linux-gnu
-x86_64-unknown-linux-gnu
+1.65.0-x86_64-unknown-linux-gnu (default)
+1.68.2-x86_64-unknown-linux-gnu
 
 active toolchain
 ----------------
 
-stable-x86_64-unknown-linux-gnu (overridden by '/source/platform/crosvm/rust-toolchain')
-rustc 1.45.2 (d3fb005a3 2020-07-31)
+1.68.2-x86_64-unknown-linux-gnu (overridden by '/source/platform/crosvm/rust-toolchain')
+rustc 1.68.2 (9eb3afe9e 2023-03-27)
commit	75f51227025d109cc14fd75ebeb92ebdfcd4e780	[log] [tgz]
author	Android Build Coastguard Worker <android-build-coastguard-worker@google.com>	Wed Oct 04 14:42:18 2023 +0000
committer	Android Build Coastguard Worker <android-build-coastguard-worker@google.com>	Wed Oct 04 14:42:18 2023 +0000
tree	cf09b1a48e2676b3ec397b269c8c70ab6c40d6bf
parent	a21a50d4e390ae64046a0c491bcdbb2b05ccfcde [diff]
parent	617052a2cb2685aa3c18296402a5c2e25379cfef [diff]