diff --git a/citadel/file_contexts b/citadel/file_contexts
index 5376def..a253a3d 100644
--- a/citadel/file_contexts
+++ b/citadel/file_contexts
@@ -4,7 +4,10 @@
 /vendor/bin/hw/android\.hardware\.keymaster@4\.1-service\.citadel  u:object_r:hal_keymaster_citadel_exec:s0
 /vendor/bin/hw/android\.hardware\.rebootescrow-service\.citadel    u:object_r:hal_rebootescrow_citadel_exec:s0
 /vendor/bin/hw/android\.hardware\.weaver@1\.0-service\.citadel     u:object_r:hal_weaver_citadel_exec:s0
+/vendor/bin/hw/android\.hardware\.weaver-service\.citadel          u:object_r:hal_weaver_citadel_exec:s0
 /vendor/bin/hw/android\.hardware\.identity@1\.0-service\.citadel   u:object_r:hal_identity_citadel_exec:s0
+/vendor/bin/hw/android\.hardware\.authsecret-service\.citadel         u:object_r:hal_authsecret_citadel_exec:s0
+/vendor/bin/hw/android\.hardware\.oemlock-service\.citadel         u:object_r:hal_oemlock_citadel_exec:s0
 /vendor/bin/hw/citadel_updater                                     u:object_r:citadel_updater_exec:s0
 /vendor/bin/hw/citadeld                                            u:object_r:citadeld_exec:s0
 /vendor/bin/hw/init_citadel                                        u:object_r:init_citadel_exec:s0
diff --git a/citadel/hal_authsecret_citadel.te b/citadel/hal_authsecret_citadel.te
new file mode 100644
index 0000000..029d957
--- /dev/null
+++ b/citadel/hal_authsecret_citadel.te
@@ -0,0 +1,9 @@
+type hal_authsecret_citadel, domain;
+type hal_authsecret_citadel_exec, exec_type, vendor_file_type, file_type;
+
+vndbinder_use(hal_authsecret_citadel)
+binder_call(hal_authsecret_citadel, citadeld)
+allow hal_authsecret_citadel citadeld_service:service_manager find;
+
+hal_server_domain(hal_authsecret_citadel, hal_authsecret)
+init_daemon_domain(hal_authsecret_citadel)
diff --git a/citadel/hal_oemlock_citadel.te b/citadel/hal_oemlock_citadel.te
new file mode 100644
index 0000000..d3ff719
--- /dev/null
+++ b/citadel/hal_oemlock_citadel.te
@@ -0,0 +1,9 @@
+type hal_oemlock_citadel, domain;
+type hal_oemlock_citadel_exec, exec_type, vendor_file_type, file_type;
+
+vndbinder_use(hal_oemlock_citadel)
+binder_call(hal_oemlock_citadel, citadeld)
+allow hal_oemlock_citadel citadeld_service:service_manager find;
+
+hal_server_domain(hal_oemlock_citadel, hal_oemlock)
+init_daemon_domain(hal_oemlock_citadel)
diff --git a/citadel/vndservice.te b/citadel/vndservice.te
index a756bce..880c09c 100644
--- a/citadel/vndservice.te
+++ b/citadel/vndservice.te
@@ -1,2 +1 @@
 type citadeld_service, vndservice_manager_type;
-type hal_power_stats_vendor_service,      vndservice_manager_type;
diff --git a/common/vendor/te_macros b/common/vendor/te_macros
new file mode 100644
index 0000000..c9a9c04
--- /dev/null
+++ b/common/vendor/te_macros
@@ -0,0 +1,17 @@
+#####################################
+# pixel_bugreport(domain_name)
+# Defines a new domain for executables under /vendor/bin/dump
+# Grants permissions to interact with dumpstate and write to bugreport.
+# See go/pixel-defrag for more details.
+define(`pixel_bugreport', `
+type $1, domain;
+type $1_exec, exec_type, vendor_file_type, file_type;
+typeattribute $1 hal_dumpstate;
+domain_auto_trans(hal_dumpstate_default, $1_exec, $1)
+
+allow $1 dumpstate:fd use;
+allow $1 dumpstate:fifo_file { write getattr };
+allow $1 hal_dumpstate_default:fd use;
+allow $1 shell_data_file:file { write getattr };
+')
+
diff --git a/debugpolicy/file.te b/debugpolicy/file.te
index 604ba50..e2ef397 100644
--- a/debugpolicy/file.te
+++ b/debugpolicy/file.te
@@ -1,2 +1,2 @@
 # sysfs
-type sysfs_dpm_variant, sysfs_type, fs_type; # dpm variant
+type sysfs_dpm, sysfs_type, fs_type; # dpm
diff --git a/debugpolicy/genfs_contexts b/debugpolicy/genfs_contexts
index d30809d..b36e9f1 100644
--- a/debugpolicy/genfs_contexts
+++ b/debugpolicy/genfs_contexts
@@ -1 +1,2 @@
-genfscon sysfs /firmware/devicetree/base/dpm/variant u:object_r:sysfs_dpm_variant:s0
+genfscon sysfs /firmware/devicetree/base/dpm/variant u:object_r:sysfs_dpm:s0
+genfscon sysfs /firmware/devicetree/base/dpm/version u:object_r:sysfs_dpm:s0
diff --git a/debugpolicy/init_dpm.te b/debugpolicy/init_dpm.te
index b91c561..3a4f936 100644
--- a/debugpolicy/init_dpm.te
+++ b/debugpolicy/init_dpm.te
@@ -5,7 +5,7 @@
 
 userdebug_or_eng(`
 allow init_dpm vendor_toolbox_exec:file execute_no_trans;
-allow init_dpm sysfs_dpm_variant:file r_file_perms;
+allow init_dpm sysfs_dpm:file r_file_perms;
 allow init_dpm block_device:dir search;
 allow init_dpm dpm_block_device:blk_file rw_file_perms;
 ')
diff --git a/googlebattery/hal_googlebattery.te b/googlebattery/hal_googlebattery.te
index 005e47c..2cc3a7c 100644
--- a/googlebattery/hal_googlebattery.te
+++ b/googlebattery/hal_googlebattery.te
@@ -4,12 +4,12 @@
 init_daemon_domain(hal_googlebattery)
 
 r_dir_file(hal_googlebattery, sysfs_batteryinfo)
-r_dir_file(hal_googlebattery, sysfs_wlc)
+
 
 allow hal_googlebattery sysfs_batteryinfo:file rw_file_perms;
 allow hal_googlebattery self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
 allow hal_googlebattery sysfs_chargelevel:file rw_file_perms;
-allow hal_googlebattery sysfs_wlc:file rw_file_perms;
+
 
 set_prop(hal_googlebattery, vendor_battery_defender_prop)
 
diff --git a/input/dumpstate.te b/input/dumpstate.te
index 748ff35..38aa25e 100644
--- a/input/dumpstate.te
+++ b/input/dumpstate.te
@@ -1,2 +1,2 @@
 binder_call(dumpstate, twoshay)
-
+allow dumpstate touch_context_service:service_manager find;
diff --git a/input/genfs_contexts b/input/genfs_contexts
deleted file mode 100644
index 19f57be..0000000
--- a/input/genfs_contexts
+++ /dev/null
@@ -1,2 +0,0 @@
-# Touch
-genfscon sysfs /devices/virtual/goog_touch_interface        u:object_r:sysfs_touch:s0
diff --git a/input/platform_app.te b/input/platform_app.te
index 17cc511..2d47236 100644
--- a/input/platform_app.te
+++ b/input/platform_app.te
@@ -1,2 +1,3 @@
 allow platform_app touch_context_service:service_manager find;
+allow platform_app gril_antenna_tuning_service:service_manager find;
 binder_call(platform_app, twoshay)
diff --git a/input/service.te b/input/service.te
index 989cd1b..d521666 100644
--- a/input/service.te
+++ b/input/service.te
@@ -1 +1,2 @@
+type gril_antenna_tuning_service, service_manager_type, hal_service_type;
 type touch_context_service, service_manager_type, hal_service_type;
diff --git a/input/service_contexts b/input/service_contexts
index 95e70f8..ed69aef 100644
--- a/input/service_contexts
+++ b/input/service_contexts
@@ -1 +1,2 @@
+com.google.input.algos.gril.IGrilAntennaTuningService/default              u:object_r:gril_antenna_tuning_service:s0
 com.google.input.ITouchContextService/default              u:object_r:touch_context_service:s0
diff --git a/input/twoshay.te b/input/twoshay.te
index 0511f3d..3d48318 100644
--- a/input/twoshay.te
+++ b/input/twoshay.te
@@ -8,6 +8,7 @@
 
 binder_use(twoshay)
 add_service(twoshay, touch_context_service)
+add_service(twoshay, gril_antenna_tuning_service)
 binder_call(twoshay, platform_app)
 
 allow twoshay fwk_stats_service:service_manager find;
diff --git a/pixelstats/pixelstats_vendor.te b/pixelstats/pixelstats_vendor.te
index 34da9df..d0850b1 100644
--- a/pixelstats/pixelstats_vendor.te
+++ b/pixelstats/pixelstats_vendor.te
@@ -11,8 +11,9 @@
 allow pixelstats_vendor sysfs_batteryinfo:file w_file_perms;
 allow pixelstats_vendor self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
 
+allow pixelstats_vendor mnt_vendor_file:dir search;
 allow pixelstats_vendor sysfs_scsi_devices_0000:dir search;
-allow pixelstats_vendor sysfs_scsi_devices_0000:file r_file_perms;
+allow pixelstats_vendor sysfs_scsi_devices_0000:file rw_file_perms;
 allow pixelstats_vendor sysfs_fs_f2fs:dir search;
 allow pixelstats_vendor sysfs_fs_f2fs:file rw_file_perms;
 get_prop(pixelstats_vendor, boottime_public_prop)
diff --git a/power-libperfmgr/file_contexts b/power-libperfmgr/file_contexts
index 027be7a..8ab659f 100644
--- a/power-libperfmgr/file_contexts
+++ b/power-libperfmgr/file_contexts
@@ -1,5 +1,5 @@
 /vendor/bin/hw/android\.hardware\.power-service\.pixel-libperfmgr                 u:object_r:hal_power_default_exec:s0
-/vendor/bin/hw/android\.hardware\.power@1\.3-service\.pixel-libperfmgr            u:object_r:hal_power_default_exec:s0
+/vendor/bin/sendhint                                                              u:object_r:sendhint_vendor_exec:s0
 
 /dev/cpu_dma_latency                                                              u:object_r:latency_device:s0
 /dev/socket/pps                                                                   u:object_r:pps_socket:s0
diff --git a/power-libperfmgr/sendhint.te b/power-libperfmgr/sendhint.te
new file mode 100644
index 0000000..e453abe
--- /dev/null
+++ b/power-libperfmgr/sendhint.te
@@ -0,0 +1,8 @@
+# sendhint vendor
+type sendhint_vendor, domain;
+
+type sendhint_vendor_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(sendhint_vendor)
+hal_client_domain(sendhint_vendor, hal_power);
+# sendhint writes directly to kmsg during the boot process
+allow sendhint_vendor kmsg_device:chr_file { getattr w_file_perms };
diff --git a/powerstats/vndservice.te b/powerstats/vndservice.te
new file mode 100644
index 0000000..b4386f8
--- /dev/null
+++ b/powerstats/vndservice.te
@@ -0,0 +1 @@
+type hal_power_stats_vendor_service, vndservice_manager_type;
diff --git a/ramdump/file_contexts b/ramdump/file_contexts
index 590e61b..2f51f74 100644
--- a/ramdump/file_contexts
+++ b/ramdump/file_contexts
@@ -1 +1,2 @@
 /vendor/bin/ramdump                       u:object_r:ramdump_exec:s0
+/vendor/bin/ramdump32                     u:object_r:ramdump_exec:s0
diff --git a/thermal/hal_thermal_default.te b/thermal/hal_thermal_default.te
index 2498b20..45ccf3a 100644
--- a/thermal/hal_thermal_default.te
+++ b/thermal/hal_thermal_default.te
@@ -10,3 +10,7 @@
 
 # read thermal_config
 get_prop(hal_thermal_default, vendor_thermal_prop)
+
+# Needed for reporting thermal stats event
+allow hal_thermal_default fwk_stats_service:service_manager find;
+binder_call(hal_thermal_default, servicemanager)