diff --git a/private/access_vectors b/private/access_vectors
index 14e1712..898c884 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -282,6 +282,15 @@
 class unix_dgram_socket
 inherits socket
 
+class bpf
+{
+	map_create
+	map_read
+	map_write
+	prog_load
+	prog_run
+}
+
 #
 # Define the access vector interpretation for process-related objects
 #
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 790133e..ab4a49a 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -6,9 +6,11 @@
   ( adbd_exec
     bootloader_boot_reason_prop
     broadcastradio_service
+    cgroup_bpf
     crossprofileapps_service
     e2fs
     e2fs_exec
+    fs_bpf
     hal_broadcastradio_hwservice
     hal_cas_hwservice
     hal_lowpan_hwservice
@@ -25,8 +27,10 @@
     lowpan_service
     mediaprovider_tmpfs
     netd_stable_secret_prop
+    network_watchlist_data_file
     network_watchlist_service
     package_native_service
+    perfprofd_service
     property_info
     slice_service
     stats
diff --git a/private/file_contexts b/private/file_contexts
index 7d1457a..992bdc3 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -384,6 +384,7 @@
 /data/misc/logd(/.*)?           u:object_r:misc_logd_file:s0
 /data/misc/media(/.*)?          u:object_r:media_data_file:s0
 /data/misc/net(/.*)?            u:object_r:net_data_file:s0
+/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
 /data/misc/recovery(/.*)?       u:object_r:recovery_data_file:s0
 /data/misc/shared_relro(/.*)?   u:object_r:shared_relro_file:s0
 /data/misc/sms(/.*)?            u:object_r:radio_data_file:s0
diff --git a/private/genfs_contexts b/private/genfs_contexts
index e0cafa4..c07cd4c 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -84,6 +84,7 @@
 # selinuxfs booleans can be individually labeled.
 genfscon selinuxfs / u:object_r:selinuxfs:s0
 genfscon cgroup / u:object_r:cgroup:s0
+genfscon cgroup2 / u:object_r:cgroup_bpf:s0
 # sysfs labels can be set by userspace.
 genfscon sysfs / u:object_r:sysfs:s0
 genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
@@ -173,3 +174,4 @@
 genfscon functionfs / u:object_r:functionfs:s0
 genfscon usbfs / u:object_r:usbfs:s0
 genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
+genfscon bpf / u:object_r:fs_bpf:s0
diff --git a/private/security_classes b/private/security_classes
index 2cfc768..251b721 100644
--- a/private/security_classes
+++ b/private/security_classes
@@ -35,6 +35,7 @@
 class key_socket
 class unix_stream_socket
 class unix_dgram_socket
+class bpf
 
 # sysv-ipc-related classes
 class sem
diff --git a/private/service_contexts b/private/service_contexts
index 10d8d09..b8d05e2 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -111,6 +111,7 @@
 overlay                                   u:object_r:overlay_service:s0
 package                                   u:object_r:package_service:s0
 package_native                            u:object_r:package_native_service:s0
+perfprofd                                 u:object_r:perfprofd_service:s0
 permission                                u:object_r:permission_service:s0
 persistent_data_block                     u:object_r:persistent_data_block_service:s0
 phone_msim                                u:object_r:radio_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index 46becd0..df24104 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -267,6 +267,8 @@
 # Check SELinux permissions.
 selinux_check_access(system_server)
 
+allow system_server sysfs_type:dir search;
+
 r_dir_file(system_server, sysfs_android_usb)
 allow system_server sysfs_android_usb:file w_file_perms;
 
@@ -379,6 +381,10 @@
 allow system_server adb_keys_file:dir create_dir_perms;
 allow system_server adb_keys_file:file create_file_perms;
 
+# Manage /data/misc/network_watchlist
+allow system_server network_watchlist_data_file:dir create_dir_perms;
+allow system_server network_watchlist_data_file:file create_file_perms;
+
 # Manage /data/misc/sms.
 # TODO:  Split into a separate type?
 allow system_server radio_data_file:dir create_dir_perms;
@@ -719,6 +725,11 @@
   allow system_server zygote_exec:file rx_file_perms;
 ')
 
+# allow system_server to read the eBPF maps that stores the traffic stats information amd clean up
+# the map after snapshot is recorded
+allow system_server fs_bpf:file write;
+allow system_server netd:bpf { map_read map_write };
+
 # ART Profiles.
 # Allow system_server to open profile snapshots for read.
 # System server never reads the actual content. It passes the descriptor to
diff --git a/private/webview_zygote.te b/private/webview_zygote.te
index f85d40c..78fa5f0 100644
--- a/private/webview_zygote.te
+++ b/private/webview_zygote.te
@@ -54,6 +54,9 @@
 # Check SELinux permissions.
 selinux_check_access(webview_zygote)
 
+# Directory listing in /system.
+allow webview_zygote system_file:dir r_dir_perms;
+
 #####
 ##### Neverallow
 #####
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 6f1fa69..5dc6894 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -253,11 +253,6 @@
 # Allow dumpstate to run top
 allow dumpstate proc_stat:file r_file_perms;
 
-# Allow dumpstate to read backlight details
-allow dumpstate sysfs_leds:lnk_file r_file_perms;
-allow dumpstate sysfs_leds:file r_file_perms;
-allow dumpstate sysfs_leds:dir search;
-
 # Allow dumpstate to talk to installd over binder
 binder_call(dumpstate, installd);
 
diff --git a/public/file.te b/public/file.te
index 81bb1f1..cdaaf22 100644
--- a/public/file.te
+++ b/public/file.te
@@ -60,6 +60,7 @@
 type proc_zoneinfo, fs_type;
 type selinuxfs, fs_type, mlstrustedobject;
 type cgroup, fs_type, mlstrustedobject;
+type cgroup_bpf, fs_type;
 type sysfs, fs_type, sysfs_type, mlstrustedobject;
 type sysfs_android_usb, fs_type, sysfs_type;
 type sysfs_uio, sysfs_type, fs_type;
@@ -81,6 +82,7 @@
 type sysfs_usb, sysfs_type, file_type, mlstrustedobject;
 type sysfs_wakeup_reasons, fs_type, sysfs_type;
 type sysfs_fs_ext4_features, sysfs_type, fs_type;
+type fs_bpf, fs_type, sysfs_type;
 type configfs, fs_type;
 # /sys/devices/system/cpu
 type sysfs_devices_system_cpu, fs_type, sysfs_type;
@@ -234,6 +236,7 @@
 type media_rw_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 type misc_user_data_file, file_type, data_file_type, core_data_file_type;
 type net_data_file, file_type, data_file_type, core_data_file_type;
+type network_watchlist_data_file, file_type, data_file_type, core_data_file_type;
 type nfc_data_file, file_type, data_file_type, core_data_file_type;
 type radio_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 type recovery_data_file, file_type, data_file_type, core_data_file_type;
@@ -363,6 +366,7 @@
 # Allow files to be created in their appropriate filesystems.
 allow fs_type self:filesystem associate;
 allow cgroup tmpfs:filesystem associate;
+allow cgroup_bpf tmpfs:filesystem associate;
 allow sysfs_type sysfs:filesystem associate;
 allow debugfs_type { debugfs debugfs_tracing }:filesystem associate;
 allow file_type labeledfs:filesystem associate;
diff --git a/public/init.te b/public/init.te
index 450afd8..ad3ef49 100644
--- a/public/init.te
+++ b/public/init.te
@@ -69,6 +69,10 @@
 # Create and mount on directories in /.
 allow init rootfs:dir create_dir_perms;
 allow init { rootfs cache_file cgroup storage_file system_data_file system_file vendor_file postinstall_mnt_dir }:dir mounton;
+allow init cgroup_bpf:dir { create mounton };
+
+# Mount bpf fs on sys/fs/bpf
+allow init fs_bpf:dir mounton;
 
 # Mount on /dev/usb-ffs/adb.
 allow init device:dir mounton;
@@ -301,13 +305,16 @@
   sysfs_android_usb
   sysfs_leds
   sysfs_power
-  sysfs_zram
 }:file w_file_perms;
 
 allow init {
   sysfs_dt_firmware_android
 }:file r_file_perms;
 
+allow init {
+  sysfs_zram
+}:file rw_file_perms;
+
 # init chmod/chown access to /sys files.
 allow init {
   sysfs_android_usb
diff --git a/public/netd.te b/public/netd.te
index fa03dbd..225ada9 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -7,6 +7,7 @@
 allowxperm netd self:udp_socket ioctl priv_sock_ioctls;
 
 r_dir_file(netd, cgroup)
+r_dir_file(netd, cgroup_bpf)
 allow netd system_server:fd use;
 
 allow netd self:global_capability_class_set { net_admin net_raw kill };
@@ -57,6 +58,9 @@
 # TODO: added to match above sysfs rule. Remove me?
 allow netd sysfs_usb:file write;
 
+allow netd fs_bpf:dir  create_dir_perms;
+allow netd fs_bpf:file create_file_perms;
+
 # TODO: netd previously thought it needed these permissions to do WiFi related
 #       work.  However, after all the WiFi stuff is gone, we still need them.
 #       Why?
@@ -103,6 +107,9 @@
 # give netd permission to read and write netlink xfrm
 allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
 
+# give netd permission to use eBPF functionalities
+allow netd self:bpf { map_create map_read map_write prog_load prog_run };
+
 # Allow netd to register as hal server.
 add_hwservice(netd, system_net_netd_hwservice)
 hwbinder_use(netd)
diff --git a/public/perfprofd.te b/public/perfprofd.te
index cb4a144..1f4de31 100644
--- a/public/perfprofd.te
+++ b/public/perfprofd.te
@@ -96,4 +96,22 @@
   dontaudit perfprofd shell_data_file:dir *;
   dontaudit perfprofd shell_data_file:file *;
 
+  # Allow perfprofd to publish a binder service and make binder calls.
+  binder_use(perfprofd)
+  add_service(perfprofd, perfprofd_service)
+
+  # Use devpts for streams from cmd.
+  #
+  # This is normally granted to binderservicedomain, but this service
+  # has tighter restrictions on the callers (see below), so must enable
+  # this manually.
+  allow perfprofd devpts:chr_file rw_file_perms;
+
+  # Use socket & pipe supplied by su, for cmd perfprofd dump.
+  allow perfprofd su:unix_stream_socket { read write getattr sendto };
+  allow perfprofd su:fifo_file r_file_perms;
+
+  # For now, only allow su to communicate with us.
+  neverallow domain perfprofd:binder call;
+  neverallow perfprofd { domain -servicemanager -su }:binder call;
 ')
diff --git a/public/service.te b/public/service.te
index e48d4b7..704e245 100644
--- a/public/service.te
+++ b/public/service.te
@@ -20,6 +20,7 @@
 type mediadrmserver_service,    service_manager_type;
 type netd_service,              service_manager_type;
 type nfc_service,               service_manager_type;
+type perfprofd_service,         service_manager_type;
 type radio_service,             service_manager_type;
 type storaged_service,          service_manager_type;
 type surfaceflinger_service,    app_api_service, ephemeral_app_api_service, service_manager_type;
diff --git a/public/vendor_init.te b/public/vendor_init.te
index ace58ab..9aaa538 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -40,6 +40,7 @@
   -incident_data_file
   -keystore_data_file
   -misc_logd_file
+  -network_watchlist_data_file
   -nfc_data_file
   -property_data_file
   -radio_data_file
@@ -62,6 +63,7 @@
   -incident_data_file
   -keystore_data_file
   -misc_logd_file
+  -network_watchlist_data_file
   -nfc_data_file
   -property_data_file
   -radio_data_file
@@ -85,6 +87,7 @@
   -incident_data_file
   -keystore_data_file
   -misc_logd_file
+  -network_watchlist_data_file
   -nfc_data_file
   -property_data_file
   -radio_data_file
@@ -107,6 +110,7 @@
   -incident_data_file
   -keystore_data_file
   -misc_logd_file
+  -network_watchlist_data_file
   -nfc_data_file
   -property_data_file
   -radio_data_file
@@ -129,6 +133,7 @@
   -incident_data_file
   -keystore_data_file
   -misc_logd_file
+  -network_watchlist_data_file
   -nfc_data_file
   -property_data_file
   -radio_data_file
diff --git a/vendor/file_contexts b/vendor/file_contexts
index 38b3f1a..e2476c4 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -20,6 +20,7 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.health@1\.0-service         u:object_r:hal_health_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.ir@1\.0-service             u:object_r:hal_ir_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@3\.0-service      u:object_r:hal_keymaster_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.keymaster@4\.0-service      u:object_r:hal_keymaster_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.light@2\.0-service          u:object_r:hal_light_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.lowpan@1\.0-service         u:object_r:hal_lowpan_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.memtrack@1\.0-service       u:object_r:hal_memtrack_default_exec:s0
diff --git a/vendor/hal_drm_default.te b/vendor/hal_drm_default.te
index b79c3b5..0dac075 100644
--- a/vendor/hal_drm_default.te
+++ b/vendor/hal_drm_default.te
@@ -6,3 +6,5 @@
 
 allow hal_drm_default mediacodec:fd use;
 allow hal_drm_default { appdomain -isolated_app }:fd use;
+
+allow hal_drm_default hal_allocator_server:fd use;