diff --git a/apex/com.android.bluetooth.updatable-file_contexts b/apex/com.android.bluetooth.updatable-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.bluetooth.updatable-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.cronet-file_contexts b/apex/com.android.cronet-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.cronet-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.incremental-file_contexts b/apex/com.android.incremental-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.incremental-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.sdkext-file_contexts b/apex/com.android.sdkext-file_contexts
index f3a65d4..2d59dda 100644
--- a/apex/com.android.sdkext-file_contexts
+++ b/apex/com.android.sdkext-file_contexts
@@ -1 +1,2 @@
 (/.*)?                u:object_r:system_file:s0
+/bin/derive_sdk       u:object_r:derive_sdk_exec:s0
diff --git a/apex/com.android.telephony-file_contexts b/apex/com.android.telephony-file_contexts
new file mode 100644
index 0000000..f3a65d4
--- /dev/null
+++ b/apex/com.android.telephony-file_contexts
@@ -0,0 +1 @@
+(/.*)?                u:object_r:system_file:s0
diff --git a/prebuilts/api/29.0/public/init.te b/prebuilts/api/29.0/public/init.te
index 69c11d6..2d52f59 100644
--- a/prebuilts/api/29.0/public/init.te
+++ b/prebuilts/api/29.0/public/init.te
@@ -363,6 +363,7 @@
   sysfs_leds
   sysfs_power
   sysfs_fs_f2fs
+  sysfs_dm
 }:file w_file_perms;
 
 allow init {
diff --git a/private/apexd.te b/private/apexd.te
index 31371d9..1e1ccc5 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -11,6 +11,10 @@
 allow apexd apex_metadata_file:dir create_dir_perms;
 allow apexd apex_metadata_file:file create_file_perms;
 
+# Allow apexd to create directories for snapshots of apex data
+allow apexd apex_rollback_data_file:dir create_dir_perms;
+allow apexd apex_rollback_data_file:file create_file_perms;
+
 # allow apexd to create loop devices with /dev/loop-control
 allow apexd loop_control_device:chr_file rw_file_perms;
 # allow apexd to access loop devices
@@ -122,3 +126,9 @@
 neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
 neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
 neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms;
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
index c447715..5eddc4e 100644
--- a/private/compat/29.0/29.0.cil
+++ b/private/compat/29.0/29.0.cil
@@ -1143,7 +1143,7 @@
 (typeattributeset default_android_hwservice_29_0 (default_android_hwservice))
 (typeattributeset default_android_service_29_0 (default_android_service))
 (typeattributeset default_android_vndservice_29_0 (default_android_vndservice))
-(typeattributeset default_prop_29_0 (default_prop))
+(typeattributeset default_prop_29_0 (default_prop apk_verity_prop))
 (typeattributeset dev_cpu_variant_29_0 (dev_cpu_variant))
 (typeattributeset device_29_0 (device))
 (typeattributeset device_config_activity_manager_native_boot_prop_29_0 (device_config_activity_manager_native_boot_prop))
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 383ff3c..cbe20fe 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -5,6 +5,9 @@
 (typeattribute new_objects)
 (typeattributeset new_objects
   ( new_objects
+    apex_module_data_file
+    apex_rollback_data_file
+    app_integrity_service
     app_search_service
     auth_service
     ashmem_libcutils_device
@@ -19,6 +22,7 @@
     gmscore_app
     hal_can_bus_hwservice
     hal_can_controller_hwservice
+    hal_rebootescrow_service
     hal_tv_tuner_hwservice
     hal_vibrator_service
     init_svc_debug_prop
@@ -31,7 +35,9 @@
     mediatranscoding_exec
     mediatranscoding_tmpfs
     linker_prop
+    linkerconfig_file
     mock_ota_prop
+    module_sdkext_prop
     ota_metadata_file
     ota_prop
     art_apex_dir
@@ -39,9 +45,12 @@
     system_group_file
     system_jvmti_agent_prop
     system_passwd_file
+    tethering_service
     timezonedetector_service
+    usb_serial_device
     userspace_reboot_prop
     userspace_reboot_exported_prop
+    vehicle_hal_prop
     vendor_apex_file
     vendor_boringssl_self_test
     vendor_install_recovery
diff --git a/private/derive_sdk.te b/private/derive_sdk.te
new file mode 100644
index 0000000..98cda20
--- /dev/null
+++ b/private/derive_sdk.te
@@ -0,0 +1,12 @@
+
+# Domain for derive_sdk
+type derive_sdk, domain, coredomain;
+type derive_sdk_exec, system_file_type, exec_type, file_type;
+init_daemon_domain(derive_sdk)
+
+# Read /apex
+allow derive_sdk apex_mnt_dir:dir r_dir_perms;
+
+# Prop rules: writable by derive_sdk, readable by bootclasspath (apps)
+set_prop(derive_sdk, module_sdkext_prop)
+neverallow {domain -init -derive_sdk} module_sdkext_prop:property_service set;
diff --git a/private/domain.te b/private/domain.te
index 2389ec9..2b53563 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -45,6 +45,9 @@
 # Allow to read properties for linker
 get_prop(domain, linker_prop);
 
+# Read access to sdkext props
+get_prop(domain, module_sdkext_prop)
+
 # For now, everyone can access core property files
 # Device specific properties are not granted by default
 not_compatible_property(`
diff --git a/private/file.te b/private/file.te
index 09bfe29..4492002 100644
--- a/private/file.te
+++ b/private/file.te
@@ -21,9 +21,6 @@
 # of application data.
 type rollback_data_file, file_type, data_file_type, core_data_file_type;
 
-# /dev/linkerconfig(/.*)?
-type linkerconfig_file, file_type;
-
 # /data/gsi/ota
 type ota_image_data_file, file_type, data_file_type, core_data_file_type;
 
diff --git a/private/file_contexts b/private/file_contexts
index 69b6c58..c8d9327 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -101,7 +101,6 @@
 /dev/iio:device[0-9]+   u:object_r:iio_device:s0
 /dev/ion		u:object_r:ion_device:s0
 /dev/keychord   u:object_r:keychord_device:s0
-/dev/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0
 /dev/loop-control	u:object_r:loop_control_device:s0
 /dev/modem.*		u:object_r:radio_device:s0
 /dev/mtp_usb		u:object_r:mtp_device:s0
@@ -164,6 +163,8 @@
 /dev/tty		u:object_r:owntty_device:s0
 /dev/tty[0-9]*		u:object_r:tty_device:s0
 /dev/ttyS[0-9]*		u:object_r:serial_device:s0
+/dev/ttyUSB[0-9]*	u:object_r:usb_serial_device:s0
+/dev/ttyACM[0-9]*	u:object_r:usb_serial_device:s0
 /dev/tun		u:object_r:tun_device:s0
 /dev/uhid		u:object_r:uhid_device:s0
 /dev/uinput		u:object_r:uhid_device:s0
@@ -179,6 +180,10 @@
 /dev/__properties__ u:object_r:properties_device:s0
 /dev/__properties__/property_info   u:object_r:property_info:s0
 #############################
+# Linker configuration
+#
+/linkerconfig(/.*)?          u:object_r:linkerconfig_file:s0
+#############################
 # System files
 #
 /system(/.*)?		u:object_r:system_file:s0
@@ -495,6 +500,8 @@
 
 # Misc data
 /data/misc/adb(/.*)?            u:object_r:adb_keys_file:s0
+/data/misc/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+/data/misc/apexrollback(/.*)?   u:object_r:apex_rollback_data_file:s0
 /data/misc/apns(/.*)?           u:object_r:radio_data_file:s0
 /data/misc/audio(/.*)?          u:object_r:audio_data_file:s0
 /data/misc/audioserver(/.*)?    u:object_r:audioserver_data_file:s0
@@ -578,6 +585,14 @@
 /data/misc_de/[0-9]+/rollback(/.*)?       u:object_r:rollback_data_file:s0
 /data/misc_ce/[0-9]+/rollback(/.*)?       u:object_r:rollback_data_file:s0
 
+# Apex data directories
+/data/misc_de/[0-9]+/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+/data/misc_ce/[0-9]+/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+
+# Apex rollback directories
+/data/misc_de/[0-9]+/apexrollback(/.*)?   u:object_r:apex_rollback_data_file:s0
+/data/misc_ce/[0-9]+/apexrollback(/.*)?   u:object_r:apex_rollback_data_file:s0
+
 #############################
 # Expanded data files
 #
diff --git a/private/incidentd.te b/private/incidentd.te
index 26f436a..b806f6e 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -168,6 +168,7 @@
   -incident
   -incidentd
   userdebug_or_eng(`-perfetto')
+  -permissioncontroller_app
   -priv_app
   -statsd
   -system_app
diff --git a/private/init.te b/private/init.te
index 3edd021..463f098 100644
--- a/private/init.te
+++ b/private/init.te
@@ -30,6 +30,12 @@
   allow init su:process { siginh rlimitinh };
 ')
 
+# Allow init to figure out name of dm-device from it's /dev/block/dm-XX path.
+# This is useful in case of remounting ext4 userdata into checkpointing mode,
+# since it potentially requires tearing down dm-devices (e.g. dm-bow, dm-crypto)
+# that userdata is mounted onto.
+allow init sysfs_dm:file read;
+
 # Allow the BoringSSL self test to request a reboot upon failure
 set_prop(init, powerctl_prop)
 
diff --git a/private/installd.te b/private/installd.te
index 28f81a4..c89ba8b 100644
--- a/private/installd.te
+++ b/private/installd.te
@@ -37,6 +37,9 @@
 get_prop(installd, device_config_runtime_native_prop)
 get_prop(installd, device_config_runtime_native_boot_prop)
 
+# Allow installd to access apk verity feature flag (for legacy case).
+get_prop(installd, apk_verity_prop)
+
 # Allow installd to delete files in /data/staging
 allow installd staging_data_file:file unlink;
 allow installd staging_data_file:dir { open read remove_name rmdir search write };
diff --git a/private/iorapd.te b/private/iorapd.te
index ba8ece3..7f9bcee 100644
--- a/private/iorapd.te
+++ b/private/iorapd.te
@@ -4,3 +4,6 @@
 tmpfs_domain(iorapd)
 
 domain_auto_trans(iorapd, iorap_prefetcherd_exec, iorap_prefetcherd)
+
+# Allow iorapd to access the runtime native boot feature flag properties.
+get_prop(iorapd, device_config_runtime_native_boot_prop)
diff --git a/private/mediaserver.te b/private/mediaserver.te
index 195c3a5..c55e54a 100644
--- a/private/mediaserver.te
+++ b/private/mediaserver.te
@@ -2,6 +2,7 @@
 
 init_daemon_domain(mediaserver)
 tmpfs_domain(mediaserver)
+allow mediaserver appdomain_tmpfs:file { getattr map read write };
 
 # allocate and use graphic buffers
 hal_client_domain(mediaserver, hal_graphics_allocator)
diff --git a/private/permissioncontroller_app.te b/private/permissioncontroller_app.te
index 9d88248..41b11f1 100644
--- a/private/permissioncontroller_app.te
+++ b/private/permissioncontroller_app.te
@@ -37,3 +37,9 @@
 allow permissioncontroller_app surfaceflinger_service:service_manager find;
 allow permissioncontroller_app telecom_service:service_manager find;
 allow permissioncontroller_app trust_service:service_manager find;
+
+# Allow the app to request and collect incident reports.
+# (Also requires DUMP and PACKAGE_USAGE_STATS permissions)
+allow permissioncontroller_app incident_service:service_manager find;
+binder_call(permissioncontroller_app, incidentd)
+allow permissioncontroller_app incidentd:fifo_file { read write };
diff --git a/private/platform_app.te b/private/platform_app.te
index 45de3cb..72bfe71 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -68,6 +68,7 @@
 allow platform_app vr_manager_service:service_manager find;
 allow platform_app gpu_service:service_manager find;
 allow platform_app stats_service:service_manager find;
+allow platform_app tethering_service:service_manager find;
 userdebug_or_eng(`
   allow platform_app platform_compat_service:service_manager find;
 ')
diff --git a/private/priv_app.te b/private/priv_app.te
index a9e9980..c776907 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -52,6 +52,7 @@
 allow priv_app radio_service:service_manager find;
 allow priv_app recovery_service:service_manager find;
 allow priv_app stats_service:service_manager find;
+allow priv_app tethering_service:service_manager find;
 
 # Allow privileged apps to interact with gpuservice
 binder_call(priv_app, gpuservice)
diff --git a/private/property_contexts b/private/property_contexts
index d909dfc..b2b6abc 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -224,3 +224,7 @@
 
 # Property to set/clear the warm reset flag after an OTA update.
 ota.warm_reset  u:object_r:ota_prop:s0
+
+# Module properties
+com.android.sdkext.                  u:object_r:module_sdkext_prop:s0
+persist.com.android.sdkext.          u:object_r:module_sdkext_prop:s0
diff --git a/private/radio.te b/private/radio.te
index a86403e..4d48c93 100644
--- a/private/radio.te
+++ b/private/radio.te
@@ -7,6 +7,9 @@
 # Telephony code contains time / time zone detection logic so it reads the associated properties.
 get_prop(radio, time_prop)
 
+# allow telephony to access platform compat to log permission denials
+allow radio platform_compat_service:service_manager find;
+
 allow radio uce_service:service_manager find;
 
 # Manage /data/misc/emergencynumberdb
diff --git a/private/service_contexts b/private/service_contexts
index 1902a48..4361982 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -1,3 +1,4 @@
+android.hardware.rebootescrow.IRebootEscrow/default u:object_r:hal_rebootescrow_service:s0
 android.hardware.vibrator.IVibrator/default u:object_r:hal_vibrator_service:s0
 
 accessibility                             u:object_r:accessibility_service:s0
@@ -10,6 +11,7 @@
 android.security.keystore                 u:object_r:keystore_service:s0
 android.service.gatekeeper.IGateKeeperService    u:object_r:gatekeeper_service:s0
 app_binding                               u:object_r:app_binding_service:s0
+app_integrity                             u:object_r:app_integrity_service:s0
 app_prediction                            u:object_r:app_prediction_service:s0
 app_search                                u:object_r:app_search_service:s0
 apexservice                               u:object_r:apex_service:s0
@@ -197,6 +199,7 @@
 telephony.registry                        u:object_r:registry_service:s0
 telephony_ims                             u:object_r:radio_service:s0
 testharness                               u:object_r:testharness_service:s0
+tethering                                 u:object_r:tethering_service:s0
 textclassification                        u:object_r:textclassification_service:s0
 textservices                              u:object_r:textservices_service:s0
 time_detector                             u:object_r:timedetector_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index fa59ef8..d28ef7a 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -37,10 +37,12 @@
 allow system_server zygote:process sigchld;
 
 # May kill zygote on crashes.
-allow system_server zygote:process sigkill;
-allow system_server crash_dump:process sigkill;
-allow system_server webview_zygote:process sigkill;
-allow system_server app_zygote:process sigkill;
+allow system_server {
+  app_zygote
+  crash_dump
+  webview_zygote
+  zygote
+}:process { sigkill signull };
 
 # Read /system/bin/app_process.
 allow system_server zygote_exec:file r_file_perms;
@@ -110,6 +112,8 @@
 
 # Kill apps.
 allow system_server appdomain:process { getpgid sigkill signal };
+# signull allowed for kill(pid, 0) existence test.
+allow system_server appdomain:process { signull };
 
 # Set scheduling info for apps.
 allow system_server appdomain:process { getsched setsched };
@@ -222,6 +226,7 @@
 hal_client_domain(system_server, hal_omx)
 hal_client_domain(system_server, hal_power)
 hal_client_domain(system_server, hal_power_stats)
+hal_client_domain(system_server, hal_rebootescrow)
 hal_client_domain(system_server, hal_sensors)
 hal_client_domain(system_server, hal_tetheroffload)
 hal_client_domain(system_server, hal_thermal)
@@ -639,6 +644,9 @@
 # Read the property that mocks an OTA
 get_prop(system_server, mock_ota_prop)
 
+# Read the property as feature flag for protecting apks with fs-verity.
+get_prop(system_server, apk_verity_prop)
+
 # Create a socket for connections from debuggerd.
 allow system_server system_ndebug_socket:sock_file create_file_perms;
 
@@ -1010,6 +1018,9 @@
 allow system_server apex_service:service_manager find;
 allow system_server apexd:binder call;
 
+# Allow system server to scan /apex for flattened APEXes
+allow system_server apex_mnt_dir:dir r_dir_perms;
+
 # Allow system server to communicate to system-suspend's control interface
 allow system_server system_suspend_control_service:service_manager find;
 binder_call(system_server, system_suspend)
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 348d3ce..b287bdc 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -14,6 +14,8 @@
   vendor_data_file
 }:dir { open read write add_name remove_name rmdir relabelfrom };
 allow vold_prepare_subdirs {
+    apex_module_data_file
+    apex_rollback_data_file
     backup_data_file
     face_vendor_data_file
     fingerprint_vendor_data_file
@@ -23,6 +25,8 @@
     vold_data_file
 }:dir { create_dir_perms relabelto };
 allow vold_prepare_subdirs {
+    apex_module_data_file
+    apex_rollback_data_file
     backup_data_file
     face_vendor_data_file
     fingerprint_vendor_data_file
@@ -32,5 +36,6 @@
     system_data_file
     vold_data_file
 }:file { getattr unlink };
+allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
 
 dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;
diff --git a/public/attributes b/public/attributes
index b600ea4..0fd2be2 100644
--- a/public/attributes
+++ b/public/attributes
@@ -325,6 +325,7 @@
 hal_attribute(omx);
 hal_attribute(power);
 hal_attribute(power_stats);
+hal_attribute(rebootescrow);
 hal_attribute(secure_element);
 hal_attribute(sensors);
 hal_attribute(telephony);
diff --git a/public/file.te b/public/file.te
index 401e016..4d14df7 100644
--- a/public/file.te
+++ b/public/file.te
@@ -179,6 +179,8 @@
 type vendor_task_profiles_file, vendor_file_type, file_type;
 # Type for /system/apex/com.android.art
 type art_apex_dir, system_file_type, file_type;
+# /linkerconfig(/.*)?
+type linkerconfig_file, file_type;
 
 # Default type for directories search for
 # HAL implementations
@@ -330,6 +332,8 @@
 
 # /data/misc subdirectories
 type adb_keys_file, file_type, data_file_type, core_data_file_type;
+type apex_module_data_file, file_type, data_file_type, core_data_file_type;
+type apex_rollback_data_file, file_type, data_file_type, core_data_file_type;
 type audio_data_file, file_type, data_file_type, core_data_file_type;
 type audioserver_data_file, file_type, data_file_type, core_data_file_type;
 type bluetooth_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/public/hal_can.te b/public/hal_can.te
index c75495b..eb68e46 100644
--- a/public/hal_can.te
+++ b/public/hal_can.te
@@ -7,3 +7,6 @@
 binder_call(hal_can_bus_client, hal_can_bus_server)
 add_hwservice(hal_can_bus_server, hal_can_bus_hwservice)
 allow hal_can_bus_client hal_can_bus_hwservice:hwservice_manager find;
+
+# USB serial type for SLCAN
+type usb_serial_device, dev_type;
diff --git a/public/hal_rebootescrow.te b/public/hal_rebootescrow.te
new file mode 100644
index 0000000..4352630
--- /dev/null
+++ b/public/hal_rebootescrow.te
@@ -0,0 +1,7 @@
+# HwBinder IPC from client to server
+binder_call(hal_rebootescrow_client, hal_rebootescrow_server)
+
+add_service(hal_rebootescrow_server, hal_rebootescrow_service)
+binder_use(hal_rebootescrow_server)
+
+allow hal_rebootescrow_client hal_rebootescrow_service:service_manager find;
diff --git a/public/hal_vibrator.te b/public/hal_vibrator.te
index 40d9c6b..a34621d 100644
--- a/public/hal_vibrator.te
+++ b/public/hal_vibrator.te
@@ -9,6 +9,8 @@
 
 allow hal_vibrator_client hal_vibrator_service:service_manager find;
 
+allow hal_vibrator_server dumpstate:fifo_file write;
+
 # vibrator sysfs rw access
 allow hal_vibrator sysfs_vibrator:file rw_file_perms;
 allow hal_vibrator sysfs_vibrator:dir search;
diff --git a/public/init.te b/public/init.te
index 2d0db1e..014fb60 100644
--- a/public/init.te
+++ b/public/init.te
@@ -86,6 +86,7 @@
     rootfs
     cache_file
     cgroup
+    linkerconfig_file
     storage_file
     mnt_user_file
     system_data_file
@@ -382,6 +383,7 @@
   sysfs_leds
   sysfs_power
   sysfs_fs_f2fs
+  sysfs_dm
 }:file w_file_perms;
 
 allow init {
diff --git a/public/property.te b/public/property.te
index 8abd404..6716332 100644
--- a/public/property.te
+++ b/public/property.te
@@ -60,6 +60,7 @@
 
 # Properties which can't be written outside system
 system_restricted_prop(linker_prop)
+system_restricted_prop(module_sdkext_prop)
 system_restricted_prop(nnapi_ext_deny_product_prop)
 system_restricted_prop(restorecon_prop)
 system_restricted_prop(system_boot_reason_prop)
@@ -98,6 +99,7 @@
 
 # Properties with no restrictions
 system_public_prop(audio_prop)
+system_public_prop(apk_verity_prop)
 system_public_prop(bluetooth_a2dp_offload_prop)
 system_public_prop(bluetooth_audio_hal_prop)
 system_public_prop(bluetooth_prop)
@@ -138,6 +140,7 @@
 system_public_prop(radio_prop)
 system_public_prop(serialno_prop)
 system_public_prop(system_prop)
+system_public_prop(vehicle_hal_prop)
 system_public_prop(vendor_security_patch_level_prop)
 system_public_prop(wifi_log_prop)
 system_public_prop(wifi_prop)
@@ -613,6 +616,7 @@
     -heapprofd_prop
     -hwservicemanager_prop
     -last_boot_reason_prop
+    -module_sdkext_prop
     -system_lmk_prop
     -linker_prop
     -log_prop
diff --git a/public/property_contexts b/public/property_contexts
index 2951d33..f30ae56 100644
--- a/public/property_contexts
+++ b/public/property_contexts
@@ -98,6 +98,7 @@
 pm.dexopt.install u:object_r:exported_pm_prop:s0 exact string
 pm.dexopt.shared u:object_r:exported_pm_prop:s0 exact string
 ro.af.client_heap_size_kbyte u:object_r:exported3_default_prop:s0 exact int
+ro.apk_verity.mode u:object_r:apk_verity_prop:s0 exact int
 ro.audio.monitorRotation u:object_r:exported3_default_prop:s0 exact bool
 ro.bluetooth.a2dp_offload.supported u:object_r:bluetooth_a2dp_offload_prop:s0 exact bool
 ro.boot.vendor.overlay.theme u:object_r:exported_overlay_prop:s0 exact string
@@ -157,6 +158,7 @@
 ro.telephony.call_ring.multiple u:object_r:exported3_default_prop:s0 exact bool
 ro.telephony.default_cdma_sub u:object_r:exported3_default_prop:s0 exact int
 ro.telephony.default_network u:object_r:exported3_default_prop:s0 exact string
+ro.vehicle.hal u:object_r:vehicle_hal_prop:s0 exact string
 ro.vendor.build.security_patch u:object_r:vendor_security_patch_level_prop:s0 exact string
 ro.zram.mark_idle_delay_mins u:object_r:exported3_default_prop:s0 exact int
 ro.zram.first_wb_delay_mins u:object_r:exported3_default_prop:s0 exact int
@@ -175,6 +177,7 @@
 vold.post_fs_data_done u:object_r:exported2_vold_prop:s0 exact int
 vts.native_server.on u:object_r:exported3_default_prop:s0 exact bool
 wlan.driver.status u:object_r:exported_wifi_prop:s0 exact enum ok unloaded
+zram.force_writeback u:object_r:exported3_default_prop:s0 exact bool
 
 # vendor-init-readable
 apexd.status u:object_r:apexd_prop:s0 exact enum starting ready
@@ -253,6 +256,7 @@
 ro.build.version.incremental u:object_r:exported2_default_prop:s0 exact string
 ro.build.version.preview_sdk u:object_r:exported2_default_prop:s0 exact int
 ro.build.version.release u:object_r:exported2_default_prop:s0 exact string
+ro.build.version.extensions. u:object_r:module_sdkext_prop:s0 prefix int
 ro.build.version.sdk u:object_r:exported2_default_prop:s0 exact int
 ro.build.version.security_patch u:object_r:exported2_default_prop:s0 exact string
 ro.crypto.state u:object_r:exported_vold_prop:s0 exact string
@@ -365,6 +369,7 @@
 ro.odm.build.date u:object_r:exported_default_prop:s0 exact string
 ro.odm.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.odm.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.odm.build.version.incremental u:object_r:exported_default_prop:s0 exact string
 ro.oem.key1 u:object_r:exported_default_prop:s0 exact string
 ro.product.board u:object_r:exported_default_prop:s0 exact string
 ro.product.cpu.abilist32 u:object_r:exported_default_prop:s0 exact string
@@ -384,6 +389,7 @@
 ro.vendor.build.date u:object_r:exported_default_prop:s0 exact string
 ro.vendor.build.date.utc u:object_r:exported_default_prop:s0 exact int
 ro.vendor.build.fingerprint u:object_r:exported_default_prop:s0 exact string
+ro.vendor.build.version.incremental u:object_r:exported_default_prop:s0 exact string
 ro.vndk.lite u:object_r:exported_default_prop:s0 exact bool
 ro.vndk.version u:object_r:exported_default_prop:s0 exact string
 ro.vts.coverage u:object_r:exported_default_prop:s0 exact int
diff --git a/public/service.te b/public/service.te
index 31575c5..9163e3b 100644
--- a/public/service.te
+++ b/public/service.te
@@ -45,6 +45,7 @@
 type adb_service, system_api_service, system_server_service, service_manager_type;
 type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type app_binding_service, system_server_service, service_manager_type;
+type app_integrity_service, system_api_service, system_server_service, service_manager_type;
 type app_prediction_service, app_api_service, system_server_service, service_manager_type;
 type app_search_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type appops_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
@@ -192,11 +193,13 @@
 type window_service, system_api_service, system_server_service, service_manager_type;
 type inputflinger_service, system_api_service, system_server_service, service_manager_type;
 type wpantund_service, system_api_service, service_manager_type;
+type tethering_service, system_server_service, service_manager_type;
 
 ###
 ### HAL Services
 ###
 
+type hal_rebootescrow_service, vendor_service, service_manager_type;
 type hal_vibrator_service, vendor_service, service_manager_type;
 
 ###
diff --git a/public/su.te b/public/su.te
index f76a2a8..fa32a4b 100644
--- a/public/su.te
+++ b/public/su.te
@@ -86,6 +86,7 @@
   typeattribute su hal_nfc_client;
   typeattribute su hal_oemlock_client;
   typeattribute su hal_power_client;
+  typeattribute su hal_rebootescrow_client;
   typeattribute su hal_secure_element_client;
   typeattribute su hal_sensors_client;
   typeattribute su hal_telephony_client;
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 710ff71..a756dc1 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -221,6 +221,7 @@
       -nnapi_ext_deny_product_prop
       -init_svc_debug_prop
       -linker_prop
+      -module_sdkext_prop
       -userspace_reboot_exported_prop
       -userspace_reboot_prop
     })
@@ -229,6 +230,7 @@
 # Get file context
 allow vendor_init file_contexts_file:file r_file_perms;
 
+set_prop(vendor_init, apk_verity_prop)
 set_prop(vendor_init, bluetooth_a2dp_offload_prop)
 set_prop(vendor_init, bluetooth_audio_hal_prop)
 set_prop(vendor_init, cpu_variant_prop)
@@ -253,6 +255,7 @@
 set_prop(vendor_init, log_tag_prop)
 set_prop(vendor_init, log_prop)
 set_prop(vendor_init, serialno_prop)
+set_prop(vendor_init, vehicle_hal_prop)
 set_prop(vendor_init, vendor_default_prop)
 set_prop(vendor_init, vendor_security_patch_level_prop)
 set_prop(vendor_init, wifi_log_prop)
diff --git a/vendor/hal_can_socketcan.te b/vendor/hal_can_socketcan.te
index 9ee37fd..afa1311 100644
--- a/vendor/hal_can_socketcan.te
+++ b/vendor/hal_can_socketcan.te
@@ -16,7 +16,7 @@
 };
 
 # Communicating with SocketCAN interfaces and bringing them up/down
-allow hal_can_socketcan self:can_socket { bind create read write ioctl };
+allow hal_can_socketcan self:can_socket { bind create read write ioctl setopt };
 allowxperm hal_can_socketcan self:can_socket ioctl {
     SIOCGIFFLAGS
     SIOCSIFFLAGS
@@ -24,3 +24,13 @@
 
 # Un-publishing ICanBus interfaces
 allow hal_can_socketcan hidl_manager_hwservice:hwservice_manager find;
+
+allow hal_can_socketcan usb_serial_device:chr_file { ioctl read write open };
+allowxperm hal_can_socketcan usb_serial_device:chr_file ioctl {
+    TCGETS
+    TCSETSW
+    TIOCGSERIAL
+    TIOCSSERIAL
+    TIOCSETD
+    SIOCGIFNAME
+};
diff --git a/vendor/hal_rebootescrow_default.te b/vendor/hal_rebootescrow_default.te
new file mode 100644
index 0000000..c264e49
--- /dev/null
+++ b/vendor/hal_rebootescrow_default.te
@@ -0,0 +1,5 @@
+type hal_rebootescrow_default, domain;
+hal_server_domain(hal_rebootescrow_default, hal_rebootescrow)
+
+type hal_rebootescrow_default_exec, exec_type, vendor_file_type, file_type;
+init_daemon_domain(hal_rebootescrow_default)