Merge "Add sepolicy for simpleperf_boot."
diff --git a/Android.bp b/Android.bp
index df1e264..0ca82a6 100644
--- a/Android.bp
+++ b/Android.bp
@@ -865,6 +865,9 @@
         "sepolicy_neverallows",
         "sepolicy_neverallows_vendor",
     ],
+    dist: {
+        targets: ["base-sepolicy-files-for-mapping"],
+    },
 }
 
 // policy for recovery
@@ -933,6 +936,9 @@
     name: "base_plat_sepolicy",
     srcs: [":base_plat_sepolicy.cil"],
     installable: false,
+    dist: {
+        targets: ["base-sepolicy-files-for-mapping"],
+    },
 }
 
 se_policy_conf {
@@ -1003,6 +1009,9 @@
     filter_out: [":reqd_policy_mask.cil"],
     secilc_check: false,
     installable: false,
+    dist: {
+        targets: ["base-sepolicy-files-for-mapping"],
+    },
 }
 
 se_policy_conf {
diff --git a/build/soong/bug_map.go b/build/soong/bug_map.go
index 91c6347..00df33c 100644
--- a/build/soong/bug_map.go
+++ b/build/soong/bug_map.go
@@ -104,7 +104,7 @@
 		OutputFile: android.OptionalPathForPath(b.installSource),
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
-				entries.SetPath("LOCAL_MODULE_PATH", b.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", b.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", b.stem())
 			},
 		},
diff --git a/build/soong/cil_compat_map.go b/build/soong/cil_compat_map.go
index 59d1172..78e870e 100644
--- a/build/soong/cil_compat_map.go
+++ b/build/soong/cil_compat_map.go
@@ -172,7 +172,7 @@
 		Class:      "ETC",
 	}
 	ret.Extra = append(ret.Extra, func(w io.Writer, outputFile android.Path) {
-		fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", c.installPath.ToMakePath().String())
+		fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", c.installPath.String())
 		if c.properties.Stem != nil {
 			fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", String(c.properties.Stem))
 		}
diff --git a/build/soong/compat_cil.go b/build/soong/compat_cil.go
index 3044425..6a1925d 100644
--- a/build/soong/compat_cil.go
+++ b/build/soong/compat_cil.go
@@ -109,7 +109,7 @@
 		OutputFile: android.OptionalPathForPath(c.installSource),
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
-				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
 			},
 		},
diff --git a/build/soong/policy.go b/build/soong/policy.go
index 2b190e6..4becbc1 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -255,7 +255,7 @@
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
 				entries.SetBool("LOCAL_UNINSTALLABLE_MODULE", !c.installable())
-				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
 			},
 		},
@@ -410,7 +410,7 @@
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
 				entries.SetBool("LOCAL_UNINSTALLABLE_MODULE", !c.Installable())
-				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
 			},
 		},
@@ -546,7 +546,7 @@
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
 				entries.SetBool("LOCAL_UNINSTALLABLE_MODULE", !c.Installable())
-				entries.SetPath("LOCAL_MODULE_PATH", c.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", c.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", c.stem())
 			},
 		},
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index c55fba2..b30f35e 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -192,7 +192,7 @@
 		SubName:    nameSuffix,
 		Extra: []android.AndroidMkExtraFunc{
 			func(w io.Writer, outputFile android.Path) {
-				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", m.installPath.ToMakePath().String())
+				fmt.Fprintln(w, "LOCAL_MODULE_PATH :=", m.installPath.String())
 				fmt.Fprintln(w, "LOCAL_INSTALLED_MODULE_STEM :=", m.stem())
 			},
 		},
diff --git a/build/soong/sepolicy_vers.go b/build/soong/sepolicy_vers.go
index 9d1fe78..ca40173 100644
--- a/build/soong/sepolicy_vers.go
+++ b/build/soong/sepolicy_vers.go
@@ -97,7 +97,7 @@
 		OutputFile: android.OptionalPathForPath(v.installSource),
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
-				entries.SetPath("LOCAL_MODULE_PATH", v.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", v.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", v.stem())
 			},
 		},
diff --git a/build/soong/versioned_policy.go b/build/soong/versioned_policy.go
index dc07910..c316d2a 100644
--- a/build/soong/versioned_policy.go
+++ b/build/soong/versioned_policy.go
@@ -172,7 +172,7 @@
 		ExtraEntries: []android.AndroidMkExtraEntriesFunc{
 			func(ctx android.AndroidMkExtraEntriesContext, entries *android.AndroidMkEntries) {
 				entries.SetBool("LOCAL_UNINSTALLABLE_MODULE", !m.installable())
-				entries.SetPath("LOCAL_MODULE_PATH", m.installPath.ToMakePath())
+				entries.SetPath("LOCAL_MODULE_PATH", m.installPath)
 				entries.SetString("LOCAL_INSTALLED_MODULE_STEM", m.installSource.Base())
 			},
 		},
diff --git a/microdroid/system/private/access_vectors b/microdroid/system/private/access_vectors
index 22f2ffa..477f78f 100644
--- a/microdroid/system/private/access_vectors
+++ b/microdroid/system/private/access_vectors
@@ -746,6 +746,16 @@
 	use_dev_id
 }
 
+class diced
+{
+	demote
+	demote_self
+	derive
+	get_attestation_chain
+	use_seal
+	use_sign
+}
+
 class drmservice {
 	consumeRights
 	setPlaybackStatus
diff --git a/microdroid/system/private/compos.te b/microdroid/system/private/compos.te
index 174eda3..e8960ef 100644
--- a/microdroid/system/private/compos.te
+++ b/microdroid/system/private/compos.te
@@ -2,22 +2,18 @@
 type compos, domain, coredomain, microdroid_payload;
 type compos_exec, exec_type, file_type, system_file_type;
 
+# Expose RPC Binder service over vsock
 allow compos self:vsock_socket { create_socket_perms_no_ioctl listen accept };
 
-# Allow using keystore and authfs_service binder services
+# Allow using various binder services
 binder_use(compos);
-use_keystore(compos);
-allow compos authfs_binder_service:service_manager find;
+allow compos {
+    authfs_binder_service
+    dice_node_service
+}:service_manager find;
 binder_call(compos, authfs_service);
-
-# Allow payloads to use and manage their keys
-allow compos vm_payload_key:keystore2_key {
-    delete
-    get_info
-    manage_blob
-    rebind
-    use
-};
+binder_call(compos, diced);
+allow compos diced:diced { get_attestation_chain derive };
 
 # Read artifacts created by odrefresh and create signature files.
 allow compos authfs_fuse:dir rw_dir_perms;
@@ -35,6 +31,4 @@
 dontaudit compos self:global_capability_class_set dac_override;
 
 # Allow domain transition into odrefresh and dex2oat.
-# TODO(b/209008712): Remove dex2oat once the migration is done.
 domain_auto_trans(compos, odrefresh_exec, odrefresh)
-domain_auto_trans(compos, dex2oat_exec, dex2oat)
diff --git a/microdroid/system/private/diced.te b/microdroid/system/private/diced.te
new file mode 100644
index 0000000..5cf06bd
--- /dev/null
+++ b/microdroid/system/private/diced.te
@@ -0,0 +1,21 @@
+type diced, domain, coredomain;
+type diced_exec, system_file_type, exec_type, file_type;
+
+# diced can be started by init
+init_daemon_domain(diced)
+
+# diced can talk to dice HAL
+hal_client_domain(diced, hal_dice)
+
+# diced hosts AIDL services
+binder_use(diced)
+binder_service(diced)
+add_service(diced, dice_node_service)
+add_service(diced, dice_maintenance_service)
+
+# diced can check SELinux permissions.
+selinux_check_access(diced)
+
+# diced is using bootstrap bionic
+allow diced system_bootstrap_lib_file:dir r_dir_perms;
+allow diced system_bootstrap_lib_file:file { execute read open getattr map };
diff --git a/microdroid/system/private/file_contexts b/microdroid/system/private/file_contexts
index 933c63f..c1f69b0 100644
--- a/microdroid/system/private/file_contexts
+++ b/microdroid/system/private/file_contexts
@@ -106,7 +106,8 @@
 /system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
 /system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
 /system/bin/bootstrap/linkerconfig u:object_r:linkerconfig_exec:s0
-/system/bin/servicemanager	u:object_r:servicemanager_exec:s0
+/system/bin/diced.microdroid		u:object_r:diced_exec:s0
+/system/bin/servicemanager.microdroid	u:object_r:servicemanager_exec:s0
 /system/bin/hwservicemanager	u:object_r:hwservicemanager_exec:s0
 /system/bin/init		u:object_r:init_exec:s0
 /system/bin/keystore2	u:object_r:keystore_exec:s0
diff --git a/microdroid/system/private/microdroid_manager.te b/microdroid/system/private/microdroid_manager.te
index 736a135..442b091 100644
--- a/microdroid/system/private/microdroid_manager.te
+++ b/microdroid/system/private/microdroid_manager.te
@@ -41,6 +41,12 @@
 allow microdroid_manager system_bootstrap_lib_file:dir r_dir_perms;
 allow microdroid_manager system_bootstrap_lib_file:file { execute read open getattr map };
 
+# microdroid_manager can talk to diced over binder
+binder_use(microdroid_manager)
+binder_call(microdroid_manager, diced)
+allow microdroid_manager { dice_node_service dice_maintenance_service }:service_manager find;
+allow microdroid_manager diced:diced { derive demote_self };
+
 # microdroid_manager create /apex/vm-payload-metadata for apexd
 # TODO(b/199371341) create a new label for the file so that only microdroid_manager can create it.
 allow microdroid_manager apex_mnt_dir:dir w_dir_perms;
diff --git a/microdroid/system/private/security_classes b/microdroid/system/private/security_classes
index 200b030..0d3cc80 100644
--- a/microdroid/system/private/security_classes
+++ b/microdroid/system/private/security_classes
@@ -163,5 +163,8 @@
 # Keystore 2.0 key permissions
 class keystore2_key             # userspace
 
+# Diced permissions
+class diced                     # userspace
+
 class drmservice                # userspace
 # FLASK
diff --git a/microdroid/system/private/service_contexts b/microdroid/system/private/service_contexts
index 3489055..6499423 100644
--- a/microdroid/system/private/service_contexts
+++ b/microdroid/system/private/service_contexts
@@ -1,3 +1,4 @@
+android.hardware.security.dice.IDiceDevice/default                   u:object_r:hal_dice_service:s0
 android.hardware.security.keymint.IKeyMintDevice/default             u:object_r:hal_keymint_service:s0
 android.hardware.security.keymint.IRemotelyProvisionedComponent/default u:object_r:hal_remotelyprovisionedcomponent_service:s0
 android.hardware.security.secureclock.ISecureClock/default             u:object_r:hal_secureclock_service:s0
@@ -8,6 +9,8 @@
 android.security.apc                      u:object_r:apc_service:s0
 android.security.authorization            u:object_r:authorization_service:s0
 android.security.compat                   u:object_r:keystore_compat_hal_service:s0
+android.security.dice.IDiceMaintenance    u:object_r:dice_maintenance_service:s0
+android.security.dice.IDiceNode           u:object_r:dice_node_service:s0
 android.security.identity                 u:object_r:credstore_service:s0
 android.security.keystore                 u:object_r:keystore_service:s0
 android.security.legacykeystore           u:object_r:legacykeystore_service:s0
diff --git a/microdroid/system/private/servicemanager.te b/microdroid/system/private/servicemanager.te
index 5dad3c1..8e0f13c 100644
--- a/microdroid/system/private/servicemanager.te
+++ b/microdroid/system/private/servicemanager.te
@@ -25,3 +25,7 @@
 add_service(servicemanager, service_manager_service)
 
 set_prop(servicemanager, ctl_interface_start_prop)
+
+# servicemanager is using bootstrap bionic
+allow servicemanager system_bootstrap_lib_file:dir r_dir_perms;
+allow servicemanager system_bootstrap_lib_file:file { execute read open getattr map };
diff --git a/microdroid/system/public/attributes b/microdroid/system/public/attributes
index 6479c55..e3258ae 100644
--- a/microdroid/system/public/attributes
+++ b/microdroid/system/public/attributes
@@ -298,6 +298,7 @@
 hal_attribute(configstore);
 hal_attribute(confirmationui);
 hal_attribute(contexthub);
+hal_attribute(dice);
 hal_attribute(drm);
 hal_attribute(evs);
 hal_attribute(face);
diff --git a/microdroid/system/public/hal_dice.te b/microdroid/system/public/hal_dice.te
new file mode 100644
index 0000000..92222c5
--- /dev/null
+++ b/microdroid/system/public/hal_dice.te
@@ -0,0 +1,4 @@
+binder_call(hal_dice_client, hal_dice_server)
+
+hal_attribute_service(hal_dice, hal_dice_service)
+binder_call(hal_dice_server, servicemanager)
diff --git a/microdroid/system/public/type.te b/microdroid/system/public/type.te
index 0ee9f89..6329656 100644
--- a/microdroid/system/public/type.te
+++ b/microdroid/system/public/type.te
@@ -6,6 +6,9 @@
 type credstore_service, app_api_service, service_manager_type;
 type default_android_hwservice, hwservice_manager_type, protected_hwservice;
 type default_android_service, service_manager_type;
+type dice_maintenance_service,  service_manager_type;
+type dice_node_service,         service_manager_type;
+type hal_dice_service, protected_service, vendor_service, service_manager_type;
 type hal_keymint_service, protected_service, vendor_service, service_manager_type;
 type hal_remotelyprovisionedcomponent_service, protected_service, vendor_service, service_manager_type;
 type hidl_allocator_hwservice, hwservice_manager_type, coredomain_hwservice;
diff --git a/microdroid/vendor/file_contexts b/microdroid/vendor/file_contexts
index 0aa85cf..2dee390 100644
--- a/microdroid/vendor/file_contexts
+++ b/microdroid/vendor/file_contexts
@@ -35,4 +35,5 @@
 
 /bin/install-recovery\.sh u:object_r:vendor_install_recovery_exec:s0
 
+/bin/hw/android\.hardware\.security\.dice-service\.microdroid u:object_r:hal_dice_default_exec:s0
 /bin/hw/android\.hardware\.security\.keymint-service\.microdroid u:object_r:hal_keymint_default_exec:s0
diff --git a/microdroid/vendor/hal_dice_default.te b/microdroid/vendor/hal_dice_default.te
new file mode 100644
index 0000000..1508427
--- /dev/null
+++ b/microdroid/vendor/hal_dice_default.te
@@ -0,0 +1,9 @@
+type hal_dice_default, domain;
+hal_server_domain(hal_dice_default, hal_dice)
+
+type hal_dice_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_dice_default)
+
+# hal_dice_default is using bootstrap bionic
+allow hal_dice_default system_bootstrap_lib_file:dir r_dir_perms;
+allow hal_dice_default system_bootstrap_lib_file:file { execute read open getattr map };
diff --git a/private/bluetooth.te b/private/bluetooth.te
index 0e0cf7f..5522e32 100644
--- a/private/bluetooth.te
+++ b/private/bluetooth.te
@@ -62,6 +62,7 @@
 allow bluetooth system_api_service:service_manager find;
 allow bluetooth network_stack_service:service_manager find;
 allow bluetooth system_suspend_control_service:service_manager find;
+allow bluetooth hal_audio_service:service_manager find;
 
 # already open bugreport file descriptors may be shared with
 # the bluetooth process, from a file in
diff --git a/private/clatd.te b/private/clatd.te
index da6820c..57eee78 100644
--- a/private/clatd.te
+++ b/private/clatd.te
@@ -4,18 +4,10 @@
 
 net_domain(clatd)
 
-r_dir_file(clatd, proc_net_type)
-userdebug_or_eng(`
-  auditallow clatd proc_net_type:{ dir file lnk_file } { getattr open read };
-')
-
 # Access objects inherited from netd.
 allow clatd netd:fd use;
-allow clatd netd:fifo_file { read write };
 allow clatd netd:packet_socket { read write };
 allow clatd netd:rawip_socket { read write };
 
-allow clatd self:global_capability_class_set { net_admin net_raw setuid setgid };
-
 allow clatd self:netlink_route_socket nlmsg_write;
 allow clatd tun_device:chr_file rw_file_perms;
diff --git a/private/compat/32.0/32.0.ignore.cil b/private/compat/32.0/32.0.ignore.cil
index 43f8136..db019f0 100644
--- a/private/compat/32.0/32.0.ignore.cil
+++ b/private/compat/32.0/32.0.ignore.cil
@@ -22,9 +22,12 @@
     hal_contexthub_service
     hal_dice_service
     hal_dumpstate_service
+    hal_graphics_allocator_service
     hal_graphics_composer_service
     hal_health_service
+    hal_input_processor_service
     hal_ir_service
+    hal_nfc_service
     hal_nlinterceptor_service
     hal_radio_config_service
     hal_radio_data_service
@@ -36,11 +39,13 @@
     hal_sensors_service
     hal_system_suspend_service
     hal_tv_tuner_service
+    hal_usb_service
     hal_uwb_service
     hal_vehicle_service
     hal_wifi_hostapd_service
     hal_wifi_supplicant_service
     locale_service
+    mtectrl
     nearby_service
     proc_watermark_boost_factor
     proc_watermark_scale_factor
@@ -56,4 +61,5 @@
     vendor_vm_data_file
     vendor_vm_file
     virtual_device_service
-  ))
+    wallpaper_effects_generation_service
+))
diff --git a/private/composd.te b/private/composd.te
index dd61e39..fd83ff4 100644
--- a/private/composd.te
+++ b/private/composd.te
@@ -5,7 +5,6 @@
 init_daemon_domain(composd)
 binder_use(composd)
 add_service(composd, compos_service)
-add_service(composd, compos_internal_service)
 
 # Call back into system server
 binder_call(composd, system_server)
diff --git a/private/crosvm.te b/private/crosvm.te
index 5106f87..b3d96c8 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -10,6 +10,9 @@
 neverallow { domain -crosvm -ueventd -virtualizationservice } kvm_device:chr_file ~getattr;
 neverallowxperm { domain -crosvm } kvm_device:chr_file ioctl ~{ KVM_CHECK_EXTENSION };
 
+# Let crosvm mlock VM memory and page tables.
+allow crosvm self:capability ipc_lock;
+
 # Let crosvm create temporary files.
 tmpfs_domain(crosvm)
 
diff --git a/private/file_contexts b/private/file_contexts
index 4a04532..784bc6d 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -296,7 +296,6 @@
 /system/bin/racoon	u:object_r:racoon_exec:s0
 /system/xbin/su		u:object_r:su_exec:s0
 /system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
-/system/bin/clatd	u:object_r:clatd_exec:s0
 /system/bin/linker(64)? u:object_r:system_linker_exec:s0
 /system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
 /system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
@@ -309,6 +308,7 @@
 /system/bin/lpdumpd        u:object_r:lpdumpd_exec:s0
 /system/bin/rss_hwm_reset	u:object_r:rss_hwm_reset_exec:s0
 /system/bin/perfetto        u:object_r:perfetto_exec:s0
+/system/bin/mtectrl         u:object_r:mtectrl_exec:s0
 /system/bin/traced        u:object_r:traced_exec:s0
 /system/bin/traced_perf        u:object_r:traced_perf_exec:s0
 /system/bin/traced_probes        u:object_r:traced_probes_exec:s0
diff --git a/private/genfs_contexts b/private/genfs_contexts
index a7cdeb8..cb28221 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -262,6 +262,7 @@
 genfscon tracefs /events/power/clock_set_rate/                           u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/power/cpu_frequency_limits/                     u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/power/gpu_frequency/                            u:object_r:debugfs_tracing:s0
+genfscon tracefs /events/power/gpu_work_period/                          u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/power/suspend_resume/                           u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/cpufreq_interactive/                            u:object_r:debugfs_tracing:s0
 genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/          u:object_r:debugfs_tracing:s0
@@ -326,6 +327,7 @@
 genfscon debugfs /tracing/events/power/clock_set_rate/                           u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/power/cpu_frequency_limits/                     u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/power/gpu_frequency/                            u:object_r:debugfs_tracing:s0
+genfscon debugfs /tracing/events/power/gpu_work_period/                          u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/power/suspend_resume/                           u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/cpufreq_interactive/                            u:object_r:debugfs_tracing:s0
 genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/          u:object_r:debugfs_tracing:s0
diff --git a/private/gpuservice.te b/private/gpuservice.te
index 2e4254c..f20d932 100644
--- a/private/gpuservice.te
+++ b/private/gpuservice.te
@@ -51,11 +51,12 @@
 neverallow gpuservice self:perf_event ~{ cpu kernel open write };
 
 # Needed for interact with bpf fs.
+# Write is needed to open read/write bpf maps.
 allow gpuservice fs_bpf:dir search;
-allow gpuservice fs_bpf:file read;
+allow gpuservice fs_bpf:file { read write };
 
-# Needed for enable the bpf program and read the map.
-allow gpuservice bpfloader:bpf { map_read prog_run };
+# Needed for enabling bpf programs and accessing bpf maps (read-only and read/write).
+allow gpuservice bpfloader:bpf { map_read map_write prog_run };
 
 # Needed for getting a prop to ensure bpf programs loaded.
 get_prop(gpuservice, bpf_progs_loaded_prop)
diff --git a/private/mtectrl.te b/private/mtectrl.te
new file mode 100644
index 0000000..a89edda
--- /dev/null
+++ b/private/mtectrl.te
@@ -0,0 +1,9 @@
+# mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader.
+type mtectrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(mtectrl)
+
+# mtectrl communicates the request to the bootloader via the misc partition.
+allow mtectrl misc_block_device:blk_file w_file_perms;
+allow mtectrl block_device:dir r_dir_perms;
+read_fstab(mtectrl)
diff --git a/private/odrefresh.te b/private/odrefresh.te
index 9febf45..d716309 100644
--- a/private/odrefresh.te
+++ b/private/odrefresh.te
@@ -45,24 +45,6 @@
 get_prop(odrefresh, device_config_runtime_native_prop)
 get_prop(odrefresh, device_config_runtime_native_boot_prop)
 
-# Use inherited stdin/stdout/stderr from composd which exec()'s
-# odrefesh.
-allow odrefresh composd:fd use;
-
-# Run binaries from the CompOS APEX in the same domain
-allow odrefresh system_file:file execute_no_trans;
-
-# Make binder calls back to composd
-binder_use(odrefresh)
-allow odrefresh compos_internal_service:service_manager find;
-binder_call(odrefresh, composd)
-
-# Run fd_server in its own domain
-domain_auto_trans(odrefresh, fd_server_exec, compos_fd_server)
-
-# And kill it via SIGTERM
-allow odrefresh compos_fd_server:process signal;
-
 # Do not audit unused resources from parent processes (adb, shell, su).
 # These appear to be unnecessary for odrefresh.
 dontaudit odrefresh { adbd shell }:fd use;
diff --git a/private/service.te b/private/service.te
index 7e33715..cd2cec6 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,5 +1,5 @@
+type ambient_context_service,       app_api_service, system_server_service, service_manager_type;
 type attention_service,             system_server_service, service_manager_type;
-type compos_internal_service,       service_manager_type;
 type compos_service,                service_manager_type;
 type dynamic_system_service,        system_api_service, system_server_service, service_manager_type;
 type gsi_service,                   service_manager_type;
@@ -15,4 +15,5 @@
 type statscompanion_service,        system_server_service, service_manager_type;
 type statsmanager_service,          system_api_service, system_server_service, service_manager_type;
 type tracingproxy_service,          system_server_service, service_manager_type;
+type transparency_service,          system_server_service, service_manager_type;
 type uce_service,                   service_manager_type;
diff --git a/private/service_contexts b/private/service_contexts
index 2e79abb..b5e3407 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -3,17 +3,21 @@
 android.hardware.automotive.audiocontrol.IAudioControl/default       u:object_r:hal_audiocontrol_service:s0
 android.hardware.biometrics.face.IFace/default                       u:object_r:hal_face_service:s0
 android.hardware.biometrics.fingerprint.IFingerprint/default         u:object_r:hal_fingerprint_service:s0
+android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default u:object_r:hal_audio_service:s0
 android.hardware.contexthub.IContextHub/default                      u:object_r:hal_contexthub_service:s0
 android.hardware.dumpstate.IDumpstateDevice/default                  u:object_r:hal_dumpstate_service:s0
 android.hardware.gnss.IGnss/default                                  u:object_r:hal_gnss_service:s0
+android.hardware.graphics.allocator.IAllocator/default               u:object_r:hal_graphics_allocator_service:s0
 android.hardware.graphics.composer3.IComposer/default                u:object_r:hal_graphics_composer_service:s0
 android.hardware.health.storage.IStorage/default                     u:object_r:hal_health_storage_service:s0
 android.hardware.health.IHealth/default                              u:object_r:hal_health_service:s0
 android.hardware.identity.IIdentityCredentialStore/default           u:object_r:hal_identity_service:s0
+android.hardware.input.processor.IInputProcessor/default           u:object_r:hal_input_processor_service:s0
 android.hardware.ir.IConsumerIr/default                              u:object_r:hal_ir_service:s0
 android.hardware.light.ILights/default                               u:object_r:hal_light_service:s0
 android.hardware.memtrack.IMemtrack/default                          u:object_r:hal_memtrack_service:s0
 android.hardware.net.nlinterceptor.IInterceptor/default              u:object_r:hal_nlinterceptor_service:s0
+android.hardware.nfc.INfc/default                                    u:object_r:hal_nfc_service:s0
 android.hardware.oemlock.IOemLock/default                            u:object_r:hal_oemlock_service:s0
 android.hardware.power.IPower/default                                u:object_r:hal_power_service:s0
 android.hardware.power.stats.IPowerStats/default                     u:object_r:hal_power_stats_service:s0
@@ -45,6 +49,7 @@
 android.hardware.sensors.ISensors/default                            u:object_r:hal_sensors_service:s0
 android.hardware.soundtrigger3.ISoundTriggerHw/default               u:object_r:hal_audio_service:s0
 android.hardware.tv.tuner.ITuner/default                             u:object_r:hal_tv_tuner_service:s0
+android.hardware.usb.IUsb/default                                    u:object_r:hal_usb_service:s0
 android.hardware.uwb.IUwb/default                                    u:object_r:hal_uwb_service:s0
 android.hardware.vibrator.IVibrator/default                          u:object_r:hal_vibrator_service:s0
 android.hardware.vibrator.IVibratorManager/default                   u:object_r:hal_vibrator_service:s0
@@ -80,8 +85,8 @@
 android.security.remoteprovisioning       u:object_r:remoteprovisioning_service:s0
 android.service.gatekeeper.IGateKeeperService    u:object_r:gatekeeper_service:s0
 android.system.composd                    u:object_r:compos_service:s0
-android.system.composd.internal           u:object_r:compos_internal_service:s0
 android.system.virtualizationservice      u:object_r:virtualization_service:s0
+ambient_context                           u:object_r:ambient_context_service:s0
 app_binding                               u:object_r:app_binding_service:s0
 app_hibernation                           u:object_r:app_hibernation_service:s0
 app_integrity                             u:object_r:app_integrity_service:s0
@@ -327,7 +332,8 @@
 timezone                                  u:object_r:timezone_service:s0
 thermalservice                            u:object_r:thermal_service:s0
 tracing.proxy                             u:object_r:tracingproxy_service:s0
-translation                              u:object_r:translation_service:s0
+translation                               u:object_r:translation_service:s0
+transparency                              u:object_r:transparency_service:s0
 trust                                     u:object_r:trust_service:s0
 tv_iapp                                   u:object_r:tv_iapp_service:s0
 tv_input                                  u:object_r:tv_input_service:s0
@@ -350,6 +356,7 @@
 vpn_management                            u:object_r:vpn_management_service:s0
 vrmanager                                 u:object_r:vr_manager_service:s0
 wallpaper                                 u:object_r:wallpaper_service:s0
+wallpaper_effects_generation              u:object_r:wallpaper_effects_generation_service:s0
 webviewupdate                             u:object_r:webviewupdate_service:s0
 wifip2p                                   u:object_r:wifip2p_service:s0
 wifiscanner                               u:object_r:wifiscanner_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index d2b4091..6e108df 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -296,6 +296,7 @@
 hal_client_domain(system_server, hal_graphics_allocator)
 hal_client_domain(system_server, hal_health)
 hal_client_domain(system_server, hal_input_classifier)
+hal_client_domain(system_server, hal_input_processor)
 hal_client_domain(system_server, hal_ir)
 hal_client_domain(system_server, hal_light)
 hal_client_domain(system_server, hal_memtrack)
@@ -402,7 +403,7 @@
 # Check SELinux permissions.
 selinux_check_access(system_server)
 
-allow system_server sysfs_type:dir search;
+allow system_server sysfs_type:dir r_dir_perms;
 
 r_dir_file(system_server, sysfs_android_usb)
 allow system_server sysfs_android_usb:file w_file_perms;
@@ -917,6 +918,7 @@
 	clear_ns
 	clear_uid
 	get_state
+	list
 	lock
 	migrate_any_key
 	pull_metrics
diff --git a/private/virtualizationservice.te b/private/virtualizationservice.te
index d304ae6..c4f2cd9 100644
--- a/private/virtualizationservice.te
+++ b/private/virtualizationservice.te
@@ -55,17 +55,22 @@
 # Run derive_classpath in our domain
 allow virtualizationservice derive_classpath_exec:file rx_file_perms;
 allow virtualizationservice apex_mnt_dir:dir r_dir_perms;
+# Ignore harmless denials on /proc/self/fd
+dontaudit virtualizationservice self:dir write;
 
 # Let virtualizationservice to accept vsock connection from the guest VMs
 allow virtualizationservice self:vsock_socket { create_socket_perms_no_ioctl listen accept };
 
 # Allow virtualization to ioctl on dev/kvm only to check if protected VM is supported or not.
-allow virtualizationservice kvm_device:chr_file { open read write };
+allow virtualizationservice kvm_device:chr_file { open read write ioctl };
 allowxperm virtualizationservice kvm_device:chr_file ioctl KVM_CHECK_EXTENSION;
 
 # Allow virtualizationservice to read/write its own sysprop. Only the process can do so.
 set_prop(virtualizationservice, virtualizationservice_prop)
 
+# Allow writing stats to statsd
+unix_socket_send(virtualizationservice, statsdw, statsd)
+
 neverallow {
   domain
   -init
diff --git a/public/attributes b/public/attributes
index 07eecfc..b97bffc 100644
--- a/public/attributes
+++ b/public/attributes
@@ -347,6 +347,7 @@
 hal_attribute(health_storage);
 hal_attribute(identity);
 hal_attribute(input_classifier);
+hal_attribute(input_processor);
 hal_attribute(ir);
 hal_attribute(keymaster);
 hal_attribute(keymint);
diff --git a/public/domain.te b/public/domain.te
index e7853ec..9b8aefd 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -627,6 +627,7 @@
   -vold
   -recovery
   -ueventd
+  -mtectrl
 } misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
 
 # Only (hw|vnd|)servicemanager should be able to register with binder as the context manager
diff --git a/public/dumpstate.te b/public/dumpstate.te
index b1f186c..3f9a127 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -147,6 +147,7 @@
 dump_hal(hal_graphics_allocator)
 dump_hal(hal_light)
 dump_hal(hal_neuralnetworks)
+dump_hal(hal_nfc)
 dump_hal(hal_thermal)
 dump_hal(hal_power)
 dump_hal(hal_power_stats)
@@ -253,6 +254,7 @@
   -apex_service
   -dumpstate_service
   -gatekeeper_service
+  -hal_wifi_supplicant_service
   -virtual_touchpad_service
   -vold_service
   -default_android_service
@@ -262,6 +264,7 @@
   apex_service
   dumpstate_service
   gatekeeper_service
+  hal_wifi_supplicant_service
   virtual_touchpad_service
   vold_service
 }:service_manager find;
diff --git a/public/hal_graphics_allocator.te b/public/hal_graphics_allocator.te
index 3ec6b96..b6d5d92 100644
--- a/public/hal_graphics_allocator.te
+++ b/public/hal_graphics_allocator.te
@@ -12,3 +12,8 @@
 
 # allow to run with real-time scheduling policy
 allow hal_graphics_allocator self:global_capability_class_set sys_nice;
+
+# IAllocator stable-aidl
+hal_attribute_service(hal_graphics_allocator, hal_graphics_allocator_service)
+binder_call(hal_graphics_allocator_server, servicemanager)
+binder_call(hal_graphics_allocator_client, servicemanager)
diff --git a/public/hal_input_processor.te b/public/hal_input_processor.te
new file mode 100644
index 0000000..77d1d70
--- /dev/null
+++ b/public/hal_input_processor.te
@@ -0,0 +1,5 @@
+# HwBinder IPC from client to server
+binder_call(hal_input_processor_client, hal_input_processor_server)
+binder_call(hal_input_processor_server, servicemanager)
+
+hal_attribute_service(hal_input_processor, hal_input_processor_service)
diff --git a/public/hal_nfc.te b/public/hal_nfc.te
index 7cef4a1..3d0202b 100644
--- a/public/hal_nfc.te
+++ b/public/hal_nfc.te
@@ -1,8 +1,10 @@
 # HwBinder IPC from client to server, and callbacks
 binder_call(hal_nfc_client, hal_nfc_server)
 binder_call(hal_nfc_server, hal_nfc_client)
+binder_call(hal_nfc_server, servicemanager)
 
 hal_attribute_hwservice(hal_nfc, hal_nfc_hwservice)
+hal_attribute_service(hal_nfc, hal_nfc_service)
 
 # Set NFC properties (used by bcm2079x HAL).
 set_prop(hal_nfc, nfc_prop)
diff --git a/public/hal_usb.te b/public/hal_usb.te
index 38bc49a..45cafaa 100644
--- a/public/hal_usb.te
+++ b/public/hal_usb.te
@@ -2,6 +2,9 @@
 binder_call(hal_usb_client, hal_usb_server)
 binder_call(hal_usb_server, hal_usb_client)
 
+hal_attribute_service(hal_usb, hal_usb_service)
+binder_call(hal_usb_server, servicemanager)
+
 hal_attribute_hwservice(hal_usb, hal_usb_hwservice)
 
 allow hal_usb self:netlink_kobject_uevent_socket create;
diff --git a/public/hal_wifi_supplicant.te b/public/hal_wifi_supplicant.te
index b4ff7aa..b531a22 100644
--- a/public/hal_wifi_supplicant.te
+++ b/public/hal_wifi_supplicant.te
@@ -5,8 +5,6 @@
 hal_attribute_hwservice(hal_wifi_supplicant, hal_wifi_supplicant_hwservice)
 hal_attribute_service(hal_wifi_supplicant, hal_wifi_supplicant_service)
 
-binder_call(hal_wifi_supplicant_server, servicemanager)
-
 # in addition to ioctls allowlisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls.
 allowxperm hal_wifi_supplicant self:udp_socket ioctl priv_sock_ioctls;
 
diff --git a/public/mtectrl.te b/public/mtectrl.te
new file mode 100644
index 0000000..2fb8a96
--- /dev/null
+++ b/public/mtectrl.te
@@ -0,0 +1 @@
+type mtectrl, domain, coredomain;
diff --git a/public/service.te b/public/service.te
index 0e9488c..99db2d3 100644
--- a/public/service.te
+++ b/public/service.te
@@ -157,7 +157,7 @@
 type midi_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type mount_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type music_recognition_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
-type nearby_service, system_server_service, service_manager_type;
+type nearby_service, system_api_service, system_server_service, service_manager_type;
 type netpolicy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type netstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type network_management_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -243,6 +243,7 @@
 type vpn_management_service, app_api_service, system_server_service, service_manager_type;
 type vr_manager_service, system_server_service, service_manager_type;
 type wallpaper_service, app_api_service, system_server_service, service_manager_type;
+type wallpaper_effects_generation_service, app_api_service, system_server_service, service_manager_type;
 type webviewupdate_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type wifip2p_service, app_api_service, system_server_service, service_manager_type;
 type wifiscanner_service, system_api_service, system_server_service, service_manager_type;
@@ -270,15 +271,18 @@
 type hal_face_service, vendor_service, protected_service, service_manager_type;
 type hal_fingerprint_service, vendor_service, protected_service, service_manager_type;
 type hal_gnss_service, vendor_service, protected_service, service_manager_type;
+type hal_graphics_allocator_service, vendor_service, service_manager_type;
 type hal_graphics_composer_service, vendor_service, protected_service, service_manager_type;
 type hal_health_service, vendor_service, protected_service, service_manager_type;
 type hal_health_storage_service, vendor_service, protected_service, service_manager_type;
 type hal_identity_service, vendor_service, protected_service, service_manager_type;
+type hal_input_processor_service, vendor_service, protected_service, service_manager_type;
 type hal_ir_service, vendor_service, protected_service, service_manager_type;
 type hal_keymint_service, vendor_service, protected_service, service_manager_type;
 type hal_light_service, vendor_service, protected_service, service_manager_type;
 type hal_memtrack_service, vendor_service, protected_service, service_manager_type;
 type hal_neuralnetworks_service, vendor_service, service_manager_type;
+type hal_nfc_service, vendor_service, protected_service, service_manager_type;
 type hal_oemlock_service, vendor_service, protected_service, service_manager_type;
 type hal_power_service, vendor_service, protected_service, service_manager_type;
 type hal_power_stats_service, vendor_service, protected_service, service_manager_type;
@@ -296,6 +300,7 @@
 type hal_sharedsecret_service, vendor_service, protected_service, service_manager_type;
 type hal_system_suspend_service, protected_service, service_manager_type;
 type hal_tv_tuner_service, vendor_service, protected_service, service_manager_type;
+type hal_usb_service, vendor_service, protected_service, service_manager_type;
 type hal_uwb_service, vendor_service, protected_service, service_manager_type;
 type hal_vehicle_service, vendor_service, protected_service, service_manager_type;
 type hal_vibrator_service, vendor_service, protected_service, service_manager_type;
diff --git a/tests/Android.bp b/tests/Android.bp
index 78a631f..8ca952d 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -25,34 +25,46 @@
     },
 }
 
+python_library_host {
+    name: "mini_cil_parser",
+    srcs: ["mini_parser.py"],
+}
+
+python_library_host {
+    name: "pysepolwrap",
+    srcs: [
+        "fc_sort.py",
+        "policy.py",
+    ],
+}
+
 python_binary_host {
     name: "treble_sepolicy_tests",
     srcs: [
-        "fc_sort.py",
-        "mini_parser.py",
-        "policy.py",
         "treble_sepolicy_tests.py",
     ],
+    libs: [
+        "mini_cil_parser",
+        "pysepolwrap",
+    ],
     data: [":libsepolwrap"],
 }
 
 python_binary_host {
     name: "sepolicy_tests",
     srcs: [
-        "fc_sort.py",
-        "policy.py",
         "sepolicy_tests.py",
     ],
+    libs: ["pysepolwrap"],
     data: [":libsepolwrap"],
 }
 
 python_binary_host {
     name: "searchpolicy",
     srcs: [
-        "fc_sort.py",
-        "policy.py",
         "searchpolicy.py",
     ],
+    libs: ["pysepolwrap"],
     required: ["libsepolwrap"],
 }
 
@@ -60,8 +72,8 @@
     name: "combine_maps",
     srcs: [
         "combine_maps.py",
-        "mini_parser.py",
     ],
+    libs: ["mini_cil_parser"],
 }
 
 python_binary_host {
diff --git a/tools/Android.bp b/tools/Android.bp
index c480dc2..fcf375d 100644
--- a/tools/Android.bp
+++ b/tools/Android.bp
@@ -63,3 +63,10 @@
     name: "insertkeys",
     srcs: ["insertkeys.py"],
 }
+
+python_binary_host {
+    name: "sepolicy_generate_compat",
+    srcs: ["sepolicy_generate_compat.py"],
+    libs: ["mini_cil_parser", "pysepolwrap"],
+    data: [":libsepolwrap"],
+}
diff --git a/tools/sepolicy_generate_compat.py b/tools/sepolicy_generate_compat.py
new file mode 100644
index 0000000..317a00e
--- /dev/null
+++ b/tools/sepolicy_generate_compat.py
@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+
+# Copyright 2022 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse
+import distutils.ccompiler
+import glob
+import logging
+import mini_parser
+import os
+import policy
+import shutil
+import subprocess
+import tempfile
+import zipfile
+"""This tool generates a mapping file for {ver} core sepolicy."""
+
+temp_dir = ''
+
+
+def check_run(cmd, cwd=None):
+    if cwd:
+        logging.debug('Running cmd at %s: %s' % (cwd, cmd))
+    else:
+        logging.debug('Running cmd: %s' % cmd)
+    subprocess.run(cmd, cwd=cwd, check=True)
+
+
+def check_output(cmd):
+    logging.debug('Running cmd: %s' % cmd)
+    return subprocess.run(cmd, check=True, stdout=subprocess.PIPE)
+
+
+def get_android_build_top():
+    ANDROID_BUILD_TOP = os.getenv('ANDROID_BUILD_TOP')
+    if not ANDROID_BUILD_TOP:
+        sys.exit(
+            'Error: Missing ANDROID_BUILD_TOP env variable. Please run '
+            '\'. build/envsetup.sh; lunch <build target>\'. Exiting script.')
+    return ANDROID_BUILD_TOP
+
+
+def fetch_artifact(branch, build, pattern, destination='.'):
+    """Fetches build artifacts from Android Build server.
+
+    Args:
+      branch: string, branch to pull build artifacts from
+      build: string, build ID or "latest"
+      pattern: string, pattern of build artifact file name
+      destination: string, destination to pull build artifact to
+    """
+    fetch_artifact_path = '/google/data/ro/projects/android/fetch_artifact'
+    cmd = [
+        fetch_artifact_path, '--branch', branch, '--target',
+        'aosp_arm64-userdebug'
+    ]
+    if build == 'latest':
+        cmd.append('--latest')
+    else:
+        cmd.extend(['--bid', build])
+    cmd.extend([pattern, destination])
+    check_run(cmd)
+
+
+def extract_mapping_file_from_img(img_path, ver, destination='.'):
+    """ Extracts system/etc/selinux/mapping/{ver}.cil from system.img file.
+
+    Args:
+      img_path: string, path to system.img file
+      ver: string, version of designated mapping file
+      destination: string, destination to pull the mapping file to
+
+    Returns:
+      string, path to extracted mapping file
+    """
+
+    cmd = [
+        'debugfs', '-R',
+        'cat system/etc/selinux/mapping/%s.cil' % ver, img_path
+    ]
+    path = os.path.join(destination, '%s.cil' % ver)
+    with open(path, 'wb') as f:
+        logging.debug('Extracting %s.cil to %s' % (ver, destination))
+        f.write(check_output(cmd).stdout)
+    return path
+
+
+def download_mapping_file(branch, build, ver, destination='.'):
+    """ Downloads system/etc/selinux/mapping/{ver}.cil from Android Build server.
+
+    Args:
+      branch: string, branch to pull build artifacts from (e.g. "sc-v2-dev")
+      build: string, build ID or "latest"
+      ver: string, version of designated mapping file (e.g. "32.0")
+      destination: string, destination to pull build artifact to
+
+    Returns:
+      string, path to extracted mapping file
+    """
+    logging.info('Downloading %s mapping file from branch %s build %s...' %
+                 (ver, branch, build))
+    artifact_pattern = 'aosp_arm64-img-*.zip'
+    fetch_artifact(branch, build, artifact_pattern, temp_dir)
+
+    # glob must succeed
+    zip_path = glob.glob(os.path.join(temp_dir, artifact_pattern))[0]
+    with zipfile.ZipFile(zip_path) as zip_file:
+        logging.debug('Extracting system.img to %s' % temp_dir)
+        zip_file.extract('system.img', temp_dir)
+
+    system_img_path = os.path.join(temp_dir, 'system.img')
+    return extract_mapping_file_from_img(system_img_path, ver, destination)
+
+
+def build_base_files(target_version):
+    """ Builds needed base policy files from the source code.
+
+    Args:
+      target_version: string, target version to gerenate the mapping file
+
+    Returns:
+      (string, string, string), paths to base policy, old policy, and pub policy
+      cil
+    """
+    logging.info('building base sepolicy files')
+    build_top = get_android_build_top()
+
+    cmd = [
+        'build/soong/soong_ui.bash',
+        '--make-mode',
+        'dist',
+        'base-sepolicy-files-for-mapping',
+        'TARGET_PRODUCT=aosp_arm64',
+        'TARGET_BUILD_VARIANT=userdebug',
+    ]
+    check_run(cmd, cwd=build_top)
+
+    dist_dir = os.path.join(build_top, 'out', 'dist')
+    base_policy_path = os.path.join(dist_dir, 'base_plat_sepolicy')
+    old_policy_path = os.path.join(dist_dir,
+                                   '%s_plat_sepolicy' % target_version)
+    pub_policy_cil_path = os.path.join(dist_dir, 'base_plat_pub_policy.cil')
+
+    return base_policy_path, old_policy_path, pub_policy_cil_path
+
+
+def get_args():
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        '--branch',
+        required=True,
+        help='Branch to pull build from. e.g. "sc-v2-dev"')
+    parser.add_argument('--build', required=True, help='Build ID, or "latest"')
+    parser.add_argument(
+        '--target-version',
+        required=True,
+        help='Target version of designated mapping file. e.g. "32.0"')
+    parser.add_argument(
+        '--latest-version',
+        required=True,
+        help='Latest version for mapping of newer types. e.g. "31.0"')
+    parser.add_argument(
+        '-v',
+        '--verbose',
+        action='count',
+        default=0,
+        help='Increase output verbosity, e.g. "-v", "-vv".')
+    return parser.parse_args()
+
+
+def main():
+    args = get_args()
+
+    verbosity = min(args.verbose, 2)
+    logging.basicConfig(
+        format='%(levelname)-8s [%(filename)s:%(lineno)d] %(message)s',
+        level=(logging.WARNING, logging.INFO, logging.DEBUG)[verbosity])
+
+    global temp_dir
+    temp_dir = tempfile.mkdtemp()
+
+    try:
+        libpath = os.path.join(
+            os.path.dirname(os.path.realpath(__file__)), 'libsepolwrap' +
+            distutils.ccompiler.new_compiler().shared_lib_extension)
+        if not os.path.exists(libpath):
+            sys.exit(
+                'Error: libsepolwrap does not exist. Is this binary corrupted?\n'
+            )
+
+        build_top = get_android_build_top()
+        sepolicy_path = os.path.join(build_top, 'system', 'sepolicy')
+        target_compat_path = os.path.join(sepolicy_path, 'private', 'compat',
+                                          args.target_version)
+
+        # Step 1. Download system/etc/selinux/mapping/{ver}.cil, and remove types/typeattributes
+        mapping_file = download_mapping_file(args.branch, args.build,
+                                             args.target_version)
+        mapping_file_cil = mini_parser.MiniCilParser(mapping_file)
+        mapping_file_cil.types = set()
+        mapping_file_cil.typeattributes = set()
+
+        # Step 2. Build base policy files and parse latest mapping files
+        base_policy_path, old_policy_path, pub_policy_cil_path = build_base_files(
+            args.target_version)
+        base_policy = policy.Policy(base_policy_path, None, libpath)
+        old_policy = policy.Policy(old_policy_path, None, libpath)
+        pub_policy_cil = mini_parser.MiniCilParser(pub_policy_cil_path)
+
+        all_types = base_policy.GetAllTypes(False)
+        old_all_types = old_policy.GetAllTypes(False)
+        pub_types = pub_policy_cil.types
+
+        # Step 3. Find new types and removed types
+        new_types = pub_types & (all_types - old_all_types)
+        removed_types = (mapping_file_cil.pubtypes - mapping_file_cil.types) & (
+            old_all_types - all_types)
+
+        logging.info('new types: %s' % new_types)
+        logging.info('removed types: %s' % removed_types)
+
+        # TODO: Step 4. Map new types and removed types appropriately
+    finally:
+        logging.info('Deleting temporary dir: {}'.format(temp_dir))
+        shutil.rmtree(temp_dir)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/treble_sepolicy_tests_for_release.mk b/treble_sepolicy_tests_for_release.mk
index 011001b..6a56d58 100644
--- a/treble_sepolicy_tests_for_release.mk
+++ b/treble_sepolicy_tests_for_release.mk
@@ -85,6 +85,9 @@
 	$(hide) cat $(PRIVATE_ADDITIONAL_CIL_FILES) >> $@
 	$(hide) $(HOST_OUT_EXECUTABLES)/secilc -m -M true -G -c $(POLICYVERS) $(PRIVATE_NEVERALLOW_ARG) $@ -o $@ -f /dev/null
 
+# TODO(b/214336258): move to Soong
+$(call dist-for-goals,base-sepolicy-files-for-mapping,$(built_$(version)_plat_sepolicy):$(version)_plat_sepolicy)
+
 $(version)_plat_policy.conf :=
 
 # $(version)_compat - the current plat_sepolicy.cil built with the compatibility file
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 4fc0460..9e19a6a 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -10,7 +10,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.can@1\.0-service  u:object_r:hal_can_socketcan_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.evs@1\.[0-9]-service  u:object_r:hal_evs_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@2\.0-((default|emulator)-)*(service|protocan-service)  u:object_r:hal_vehicle_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@V1-default-service u:object_r:hal_vehicle_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.automotive\.vehicle@V1-(default|emulator)-service u:object_r:hal_vehicle_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service      u:object_r:hal_bluetooth_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth@1\.[0-9]+-service\.btlinux    u:object_r:hal_bluetooth_btlinux_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0
@@ -25,6 +25,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service-lazy_64  u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-service-lazy     u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-external-service          u:object_r:hal_camera_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.camera\.provider@2\.[0-9]+-external-service-lazy     u:object_r:hal_camera_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.configstore@1\.[0-9]+-service    u:object_r:hal_configstore_default_exec:s0
 /(vendor|sustem/vendor)/bin/hw/android\.hardware\.confirmationui@1\.0-service u:object_r:hal_confirmationui_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.contexthub@1\.[0-9]+-service     u:object_r:hal_contexthub_default_exec:s0
@@ -51,6 +52,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health\.storage-service\.default   u:object_r:hal_health_storage_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.identity-service.example u:object_r:hal_identity_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.input\.classifier@1\.0-service     u:object_r:hal_input_classifier_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.input\.processor-service     u:object_r:hal_input_processor_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.ir@1\.0-service             u:object_r:hal_ir_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.ir-service\.example          u:object_r:hal_ir_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@3\.0-service      u:object_r:hal_keymaster_default_exec:s0
@@ -87,6 +89,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner@1\.[01]-service   u:object_r:hal_tv_tuner_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.tuner-service\.example  u:object_r:hal_tv_tuner_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb@1\.0-service            u:object_r:hal_usb_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.usb-service\.example        u:object_r:hal_usb_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.usb\.gadget@1\.1-service    u:object_r:hal_usb_gadget_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.uwb-service                 u:object_r:hal_uwb_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@1\.0-service       u:object_r:hal_vibrator_default_exec:s0
diff --git a/vendor/hal_input_processor_default.te b/vendor/hal_input_processor_default.te
new file mode 100644
index 0000000..33a5c41
--- /dev/null
+++ b/vendor/hal_input_processor_default.te
@@ -0,0 +1,5 @@
+type hal_input_processor_default, domain;
+hal_server_domain(hal_input_processor_default, hal_input_processor)
+
+type hal_input_processor_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_input_processor_default)