diff --git a/Android.bp b/Android.bp
index dc6761c..9905e73 100644
--- a/Android.bp
+++ b/Android.bp
@@ -146,7 +146,7 @@
 // policy and subsequent removal of CIL policy that should not be exported.
 se_policy_conf {
     name: "reqd_policy_mask.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: reqd_mask_policy,
     installable: false,
 }
@@ -182,7 +182,7 @@
 //
 se_policy_conf {
     name: "pub_policy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         system_ext_public_policy +
         product_public_policy +
@@ -202,7 +202,7 @@
 
 se_policy_conf {
     name: "system_ext_pub_policy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         system_ext_public_policy +
         reqd_mask_policy,
@@ -221,7 +221,7 @@
 
 se_policy_conf {
     name: "plat_pub_policy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         reqd_mask_policy,
     installable: false,
@@ -410,7 +410,7 @@
 // policy and the platform public policy files in order to use checkpolicy.
 se_policy_conf {
     name: "vendor_sepolicy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         system_ext_public_policy +
         product_public_policy +
@@ -452,7 +452,7 @@
 // policy and the platform public policy files in order to use checkpolicy.
 se_policy_conf {
     name: "odm_sepolicy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         system_ext_public_policy +
         product_public_policy +
@@ -793,7 +793,7 @@
 
 se_policy_conf {
     name: "base_plat_pub_policy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         reqd_mask_policy,
     build_variant: "user",
@@ -813,7 +813,7 @@
 
 se_policy_conf {
     name: "base_product_pub_policy.conf",
-    defaults: ["se_policy_conf_public_flags_defaults"],
+    defaults: ["se_policy_conf_flags_defaults"],
     srcs: plat_public_policy +
         system_ext_public_policy +
         product_public_policy +
@@ -953,3 +953,352 @@
         },
     },
 }
+
+phony {
+    name: "selinux_policy_system_ext",
+    required: [
+        //"ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY" check included in system_ext_pub_policy.cil
+        "system_ext_mapping_file",
+        //"ifdef HAS_SYSTEM_EXT_SEPOLICY" check included in .cil
+        "system_ext_sepolicy.cil",
+    ] + [
+        //"ifdef HAS_SYSTEM_EXT_SEPOLICY" check included in .cil
+        "system_ext_29.0.cil",
+        "system_ext_30.0.cil",
+        "system_ext_31.0.cil",
+        "system_ext_32.0.cil",
+        "system_ext_33.0.cil",
+        "system_ext_34.0.cil",
+    ] + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+        "202404": [],
+        default: [
+            "system_ext_202404.cil",
+        ],
+    }) +
+    select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
+        true: ["system_ext_sepolicy_and_mapping.sha256"],
+        default: [],
+    }) + [
+        "system_ext_file_contexts",
+        "system_ext_file_contexts_test",
+        "system_ext_keystore2_key_contexts",
+        "system_ext_hwservice_contexts",
+        "system_ext_hwservice_contexts_test",
+        "system_ext_property_contexts",
+        "system_ext_property_contexts_test",
+        "system_ext_seapp_contexts",
+        "system_ext_service_contexts",
+        "system_ext_service_contexts_test",
+        "system_ext_mac_permissions.xml",
+        "system_ext_bug_map",
+        // $(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
+        "system_ext_29.0.compat.cil",
+        "system_ext_30.0.compat.cil",
+        "system_ext_31.0.compat.cil",
+        "system_ext_32.0.compat.cil",
+        "system_ext_33.0.compat.cil",
+        "system_ext_34.0.compat.cil",
+    ] + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+        "202404": [],
+        default: [
+            "system_ext_202404.compat.cil",
+        ],
+    }),
+    system_ext_specific: true,
+}
+
+phony {
+    name: "selinux_policy_product",
+    required: [
+        "product_mapping_file",
+        "product_sepolicy.cil",
+        // "ifdef HAS_PRODUCT_PUBLIC_SEPOLICY" check included in .cil
+        "product_29.0.cil",
+        "product_30.0.cil",
+        "product_31.0.cil",
+        "product_32.0.cil",
+        "product_33.0.cil",
+        "product_34.0.cil",
+        "product_file_contexts",
+        // "ifdef HAS_PRODUCT_SEPOLICY_DIR" in Android.mk can be ignored.
+        "product_file_contexts_test",
+        "product_keystore2_key_contexts",
+        "product_hwservice_contexts",
+        "product_hwservice_contexts_test",
+        "product_property_contexts",
+        "product_property_contexts_test",
+        "product_seapp_contexts",
+        "product_service_contexts",
+        "product_service_contexts_test",
+        "product_mac_permissions.xml",
+    ] + select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
+        true: ["product_sepolicy_and_mapping.sha256"],
+        default: [],
+    }) + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+        "202404": [],
+        default: [
+            "product_202404.cil",
+        ],
+    }),
+}
+
+phony {
+    name: "selinux_policy_nonsystem",
+    required: [
+        "plat_pub_versioned.cil",
+        "vendor_sepolicy.cil",
+        "plat_sepolicy_vers.txt",
+        "vendor_file_contexts",
+        "vendor_file_contexts_test",
+        "vendor_keystore2_key_contexts",
+        "vendor_mac_permissions.xml",
+        "vendor_property_contexts",
+        "vendor_property_contexts_test",
+        "vendor_seapp_contexts",
+        "vendor_service_contexts",
+        "vendor_service_contexts_test",
+        "vendor_hwservice_contexts",
+        "vendor_hwservice_contexts_test",
+        "vendor_bug_map",
+        "vndservice_contexts",
+        "vndservice_contexts_test",
+        "odm_sepolicy.cil",
+        "odm_file_contexts",
+        "odm_file_contexts_test",
+        "odm_seapp_contexts",
+        "odm_property_contexts",
+        "odm_property_contexts_test",
+        "odm_service_contexts",
+        "odm_service_contexts_test",
+        "odm_hwservice_contexts",
+        "odm_hwservice_contexts_test",
+        "odm_mac_permissions.xml",
+        "selinux_policy_system_ext",
+        "selinux_policy_product",
+        // Builds an additional userdebug sepolicy into the debug ramdisk.
+        "userdebug_plat_sepolicy.cil",
+    ] + select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
+        true: [
+            "precompiled_sepolicy",
+            "precompiled_sepolicy.plat_sepolicy_and_mapping.sha256",
+            "precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256",
+            "precompiled_sepolicy.product_sepolicy_and_mapping.sha256",
+        ],
+        default: [],
+    }),
+}
+
+phony {
+    name: "selinux_policy_system",
+    required: [
+        "29.0.compat.cil",
+        "30.0.compat.cil",
+        "31.0.compat.cil",
+        "32.0.compat.cil",
+        "33.0.compat.cil",
+        "34.0.compat.cil",
+        "build_sepolicy",
+        "fuzzer_bindings_test",
+        "plat_29.0.cil",
+        "plat_30.0.cil",
+        "plat_31.0.cil",
+        "plat_32.0.cil",
+        "plat_33.0.cil",
+        "plat_34.0.cil",
+        "plat_bug_map",
+        "plat_file_contexts",
+        "plat_file_contexts_data_test",
+        "plat_file_contexts_test",
+        "plat_hwservice_contexts",
+        "plat_hwservice_contexts_test",
+        "plat_keystore2_key_contexts",
+        "plat_mac_permissions.xml",
+        "plat_mapping_file",
+        "plat_property_contexts",
+        "plat_property_contexts_test",
+        "plat_seapp_contexts",
+        "plat_sepolicy.cil",
+        "plat_service_contexts",
+        "plat_service_contexts_test",
+        "searchpolicy",
+        "secilc",
+    ] + select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+        "202404": [],
+        default: [
+            "202404.compat.cil",
+            "plat_202404.cil",
+        ],
+    }) + select(soong_config_variable("ANDROID", "PRODUCT_PRECOMPILED_SEPOLICY"), {
+        true: ["plat_sepolicy_and_mapping.sha256"],
+        default: [],
+    }) + select((
+        soong_config_variable("ANDROID", "ASAN_ENABLED"),
+        product_variable("selinux_ignore_neverallows"),
+    ), {
+        (true, true): [
+        ],
+        (default, default): [
+            "sepolicy_compat_test",
+            "sepolicy_test",
+            "sepolicy_dev_type_test",
+            "treble_sepolicy_tests_29.0",
+            "treble_sepolicy_tests_30.0",
+            "treble_sepolicy_tests_31.0",
+            "treble_sepolicy_tests_32.0",
+            "treble_sepolicy_tests_33.0",
+            "treble_sepolicy_tests_34.0",
+        ],
+    }) + select((
+        soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+        soong_config_variable("ANDROID", "ASAN_ENABLED"),
+        product_variable("selinux_ignore_neverallows"),
+    ), {
+        ("202404", true, true): [],
+        (default, true, true): [],
+        (default, default, default): [
+            "treble_sepolicy_tests_202404",
+        ],
+    }) + select(soong_config_variable("ANDROID", "RELEASE_BOARD_API_LEVEL_FROZEN"), {
+        true: ["se_freeze_test"],
+        default: [],
+    }),
+}
+
+phony {
+    name: "selinux_policy",
+    required: [
+        // Runs checkfc against merged service_contexts files
+        "merged_hwservice_contexts_test",
+        "merged_service_contexts_test",
+        "selinux_policy_nonsystem",
+        "selinux_policy_system",
+    ],
+}
+
+// selinux_policy is a main goal and triggers lots of tests.
+// Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
+// By setting as droidcore's dependency, tests will run on normal builds.
+phony_rule {
+    name: "droidcore",
+    phony_deps: ["selinux_policy"],
+}
+
+//-----------------------------------------------------------------------------
+// TODO - remove this.   Keep around until we get the filesystem creation stuff
+// taken care of.
+//
+// The file_contexts.bin is built in the following way:
+// 1. Collect all file_contexts files in THIS repository and process them with
+//    m4 into a tmp file called file_contexts.local.tmp.
+// 2. Collect all device specific file_contexts files and process them with m4
+//    into a tmp file called file_contexts.device.tmp.
+// 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
+//    file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
+// 4. Concatenate file_contexts.local.tmp and  file_contexts.device.sorted.tmp
+//    into file_contexts.concat.tmp.
+// 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
+//    file_contexts.bin.
+//
+//  Note: That a newline file is placed between each file_context file found to
+//        ensure a proper build when an fc file is missing an ending newline.
+//---
+// 1. Collect all file_contexts files in THIS repository and process them with
+//    m4 into a tmp file called file_contexts.local.tmp.
+genrule {
+    name: "file_contexts.local.tmp",
+    srcs: [
+        ":plat_file_contexts",
+        ":system_ext_file_contexts",
+        ":product_file_contexts",
+    ],
+    tools: [
+        "m4",
+    ],
+    out: ["file_contexts.local.tmp"],
+    cmd: "$(location m4) --fatal-warnings " +
+        "-s $(in) > $(out)",
+}
+
+// 2. Collect all device specific file_contexts files and process them with m4
+//    into a tmp file called file_contexts.device.tmp.
+PRIVATE_ADDITIONAL_M4DEFS = select(soong_config_variable("ANDROID", "ADDITIONAL_M4DEFS"), {
+    any @ m4defs: m4defs,
+    default: "",
+})
+genrule {
+    name: "file_contexts.device.tmp",
+    srcs: [
+        ":vendor_file_contexts",
+        ":odm_file_contexts",
+    ],
+    tools: [
+        "m4",
+    ],
+    out: ["file_contexts.device.tmp"],
+    cmd: "$(location m4) --fatal-warnings " +
+        "-s " + PRIVATE_ADDITIONAL_M4DEFS +
+        " $(in) > $(out)",
+}
+
+// 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
+//    file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
+genrule {
+    name: "file_contexts.device.sorted.tmp",
+    srcs: [
+        ":file_contexts.device.tmp",
+        ":precompiled_sepolicy",
+    ],
+    tools: [
+        "checkfc",
+        "fc_sort",
+    ],
+    out: ["file_contexts.device.sorted.tmp"],
+    cmd: "$(location checkfc) " +
+        "-e $(location :precompiled_sepolicy) " +
+        "$(location :file_contexts.device.tmp) && " +
+        "$(location fc_sort) " +
+        "-i $(location :file_contexts.device.tmp) " +
+        "-o $(out)",
+}
+
+// 4. Concatenate file_contexts.local.tmp and  file_contexts.device.sorted.tmp
+//    into file_contexts.concat.tmp.
+genrule {
+    name: "file_contexts.concat.tmp",
+    srcs: [
+        ":file_contexts.local.tmp",
+        ":file_contexts.device.sorted.tmp",
+    ],
+    tools: [
+        "m4",
+    ],
+    out: ["file_contexts.concat.tmp"],
+    cmd: "$(location m4) --fatal-warnings " +
+        "-s $(location :file_contexts.local.tmp) " +
+        "$(location :file_contexts.device.sorted.tmp) > $(out)",
+}
+
+// 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
+//    file_contexts.bin.
+genrule {
+    name: "file_contexts_bin_gen",
+    srcs: [
+        ":file_contexts.concat.tmp",
+        ":precompiled_sepolicy",
+    ],
+    tools: [
+        "checkfc",
+        "sefcontext_compile",
+    ],
+    out: ["file_contexts.bin"],
+    cmd: "$(location checkfc) " +
+        "$(location :precompiled_sepolicy) " +
+        "$(location :file_contexts.concat.tmp) && " +
+        "$(location sefcontext_compile) " +
+        "-o $(out) $(location :file_contexts.concat.tmp)",
+}
+
+prebuilt_etc {
+    name: "file_contexts.bin",
+    src: ":file_contexts_bin_gen",
+}
diff --git a/Android.mk b/Android.mk
index 378102b..6474b2a 100644
--- a/Android.mk
+++ b/Android.mk
@@ -6,12 +6,6 @@
 $(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
 endif
 
-ifdef BOARD_SEPOLICY_M4DEFS
-LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
-else
-LOCAL_ADDITIONAL_M4DEFS :=
-endif
-
 # sepolicy is now divided into multiple portions:
 # public - policy exported on which non-platform policy developers may write
 #   additional policy.  types and attributes are versioned and included in
@@ -178,388 +172,7 @@
 
 #################################
 
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := selinux_policy
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_TAGS := optional
-LOCAL_REQUIRED_MODULES += \
-    selinux_policy_nonsystem \
-    selinux_policy_system \
-
-# Runs checkfc against merged service_contexts files
-LOCAL_REQUIRED_MODULES += \
-    merged_service_contexts_test \
-    merged_hwservice_contexts_test
-
-include $(BUILD_PHONY_PACKAGE)
-
-# selinux_policy is a main goal and triggers lots of tests.
-# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
-# By setting as droidcore's dependency, tests will run on normal builds.
-droidcore: selinux_policy
-
-include $(CLEAR_VARS)
-LOCAL_MODULE := selinux_policy_system
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-# These build targets are not used on non-Treble devices. However, we build these to avoid
-# divergence between Treble and non-Treble devices.
-LOCAL_REQUIRED_MODULES += \
-    plat_mapping_file \
-    $(addprefix plat_,$(addsuffix .cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
-    $(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
-    plat_sepolicy.cil \
-    secilc \
-
-ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
-LOCAL_REQUIRED_MODULES += plat_sepolicy_and_mapping.sha256
-endif
-
-LOCAL_REQUIRED_MODULES += \
-    build_sepolicy \
-    plat_file_contexts \
-    plat_file_contexts_test \
-    plat_keystore2_key_contexts \
-    plat_mac_permissions.xml \
-    plat_property_contexts \
-    plat_property_contexts_test \
-    plat_seapp_contexts \
-    plat_service_contexts \
-    plat_service_contexts_test \
-    plat_hwservice_contexts \
-    plat_hwservice_contexts_test \
-    fuzzer_bindings_test \
-    plat_bug_map \
-    searchpolicy \
-
-ifneq ($(with_asan),true)
-ifneq ($(SELINUX_IGNORE_NEVERALLOWS),true)
-LOCAL_REQUIRED_MODULES += \
-    sepolicy_compat_test \
-
-# HACK: sepolicy_test is implemented as genrule
-# genrule modules aren't installable, so LOCAL_REQUIRED_MODULES doesn't work.
-# Instead, use LOCAL_ADDITIONAL_DEPENDENCIES with intermediate output
-LOCAL_ADDITIONAL_DEPENDENCIES += $(call intermediates-dir-for,ETC,sepolicy_test)/sepolicy_test
-LOCAL_ADDITIONAL_DEPENDENCIES += $(call intermediates-dir-for,ETC,sepolicy_dev_type_test)/sepolicy_dev_type_test
-
-LOCAL_REQUIRED_MODULES += \
-    $(addprefix treble_sepolicy_tests_,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS)) \
-
-endif  # SELINUX_IGNORE_NEVERALLOWS
-endif  # with_asan
-
-ifeq ($(RELEASE_BOARD_API_LEVEL_FROZEN),true)
-LOCAL_REQUIRED_MODULES += \
-    se_freeze_test
-endif
-
-include $(BUILD_PHONY_PACKAGE)
-
-#################################
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := selinux_policy_system_ext
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-# Include precompiled policy, unless told otherwise.
-ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
-ifdef HAS_SYSTEM_EXT_SEPOLICY
-LOCAL_REQUIRED_MODULES += system_ext_sepolicy_and_mapping.sha256
-endif
-endif
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY
-LOCAL_REQUIRED_MODULES += system_ext_sepolicy.cil
-endif
-
-ifdef HAS_SYSTEM_EXT_PUBLIC_SEPOLICY
-LOCAL_REQUIRED_MODULES += \
-    system_ext_mapping_file
-
-system_ext_compat_files := $(call build_policy, $(sepolicy_compat_files), $(SYSTEM_EXT_PRIVATE_POLICY))
-
-LOCAL_REQUIRED_MODULES += $(addprefix system_ext_, $(notdir $(system_ext_compat_files)))
-
-endif
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-LOCAL_REQUIRED_MODULES += \
-    system_ext_file_contexts \
-    system_ext_file_contexts_test \
-    system_ext_keystore2_key_contexts \
-    system_ext_hwservice_contexts \
-    system_ext_hwservice_contexts_test \
-    system_ext_property_contexts \
-    system_ext_property_contexts_test \
-    system_ext_seapp_contexts \
-    system_ext_service_contexts \
-    system_ext_service_contexts_test \
-    system_ext_mac_permissions.xml \
-    system_ext_bug_map \
-    $(addprefix system_ext_,$(addsuffix .compat.cil,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS))) \
-
-endif
-
-include $(BUILD_PHONY_PACKAGE)
-
-#################################
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := selinux_policy_product
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-# Include precompiled policy, unless told otherwise.
-ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
-ifdef HAS_PRODUCT_SEPOLICY
-LOCAL_REQUIRED_MODULES += product_sepolicy_and_mapping.sha256
-endif
-endif
-
-ifdef HAS_PRODUCT_SEPOLICY
-LOCAL_REQUIRED_MODULES += product_sepolicy.cil
-endif
-
-ifdef HAS_PRODUCT_PUBLIC_SEPOLICY
-LOCAL_REQUIRED_MODULES += \
-    product_mapping_file
-
-product_compat_files := $(call build_policy, $(sepolicy_compat_files), $(PRODUCT_PRIVATE_POLICY))
-
-LOCAL_REQUIRED_MODULES += $(addprefix product_, $(notdir $(product_compat_files)))
-
-endif
-
-ifdef HAS_PRODUCT_SEPOLICY_DIR
-LOCAL_REQUIRED_MODULES += \
-    product_file_contexts \
-    product_file_contexts_test \
-    product_keystore2_key_contexts \
-    product_hwservice_contexts \
-    product_hwservice_contexts_test \
-    product_property_contexts \
-    product_property_contexts_test \
-    product_seapp_contexts \
-    product_service_contexts \
-    product_service_contexts_test \
-    product_mac_permissions.xml \
-
-endif
-
-include $(BUILD_PHONY_PACKAGE)
-
-#################################
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := selinux_policy_nonsystem
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-# Include precompiled policy, unless told otherwise.
-ifneq ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
-LOCAL_REQUIRED_MODULES += \
-    precompiled_sepolicy \
-    precompiled_sepolicy.plat_sepolicy_and_mapping.sha256
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY
-LOCAL_REQUIRED_MODULES += precompiled_sepolicy.system_ext_sepolicy_and_mapping.sha256
-endif
-
-ifdef HAS_PRODUCT_SEPOLICY
-LOCAL_REQUIRED_MODULES += precompiled_sepolicy.product_sepolicy_and_mapping.sha256
-endif
-
-endif # ($(PRODUCT_PRECOMPILED_SEPOLICY),false)
-
-
-# These build targets are not used on non-Treble devices. However, we build these to avoid
-# divergence between Treble and non-Treble devices.
-LOCAL_REQUIRED_MODULES += \
-    plat_pub_versioned.cil \
-    vendor_sepolicy.cil \
-    plat_sepolicy_vers.txt \
-
-LOCAL_REQUIRED_MODULES += \
-    vendor_file_contexts \
-    vendor_file_contexts_test \
-    vendor_keystore2_key_contexts \
-    vendor_mac_permissions.xml \
-    vendor_property_contexts \
-    vendor_property_contexts_test \
-    vendor_seapp_contexts \
-    vendor_service_contexts \
-    vendor_service_contexts_test \
-    vendor_hwservice_contexts \
-    vendor_hwservice_contexts_test \
-    vendor_bug_map \
-    vndservice_contexts \
-    vndservice_contexts_test \
-
-ifdef BOARD_ODM_SEPOLICY_DIRS
-LOCAL_REQUIRED_MODULES += \
-    odm_sepolicy.cil \
-    odm_file_contexts \
-    odm_file_contexts_test \
-    odm_seapp_contexts \
-    odm_property_contexts \
-    odm_property_contexts_test \
-    odm_service_contexts \
-    odm_service_contexts_test \
-    odm_hwservice_contexts \
-    odm_hwservice_contexts_test \
-    odm_mac_permissions.xml
-endif
-
-LOCAL_REQUIRED_MODULES += selinux_policy_system_ext
-LOCAL_REQUIRED_MODULES += selinux_policy_product
-
-# Builds an addtional userdebug sepolicy into the debug ramdisk.
-LOCAL_REQUIRED_MODULES += \
-    userdebug_plat_sepolicy.cil \
-
-include $(BUILD_PHONY_PACKAGE)
-
-##################################
-# Policy files are now built with Android.bp. Grab them from intermediate.
-# See Android.bp for details of policy files.
-#
-built_sepolicy := $(call intermediates-dir-for,ETC,precompiled_sepolicy)/precompiled_sepolicy
-
-##################################
-# TODO - remove this.   Keep around until we get the filesystem creation stuff taken care of.
-#
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := file_contexts.bin
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# The file_contexts.bin is built in the following way:
-# 1. Collect all file_contexts files in THIS repository and process them with
-#    m4 into a tmp file called file_contexts.local.tmp.
-# 2. Collect all device specific file_contexts files and process them with m4
-#    into a tmp file called file_contexts.device.tmp.
-# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
-#    file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
-# 4. Concatenate file_contexts.local.tmp and  file_contexts.device.sorted.tmp
-#    into file_contexts.concat.tmp.
-# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
-#    file_contexts.bin.
-#
-#  Note: That a newline file is placed between each file_context file found to
-#        ensure a proper build when an fc file is missing an ending newline.
-
-local_fc_files := $(call intermediates-dir-for,ETC,plat_file_contexts)/plat_file_contexts
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-local_fc_files += $(call intermediates-dir-for,ETC,system_ext_file_contexts)/system_ext_file_contexts
-endif
-
-ifdef HAS_PRODUCT_SEPOLICY_DIR
-local_fc_files += $(call intermediates-dir-for,ETC,product_file_contexts)/product_file_contexts
-endif
-
-###########################################################
-## Collect file_contexts files into a single tmp file with m4
-##
-## $(1): list of file_contexts files
-## $(2): filename into which file_contexts files are merged
-###########################################################
-
-define _merge-fc-files
-$(2): $(1) $(M4)
-	$(hide) mkdir -p $$(dir $$@)
-	$(hide) $(M4) --fatal-warnings -s $(1) > $$@
-endef
-
-define merge-fc-files
-$(eval $(call _merge-fc-files,$(1),$(2)))
-endef
-
-file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
-$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
-
-device_fc_files += $(call intermediates-dir-for,ETC,vendor_file_contexts)/vendor_file_contexts
-
-ifdef BOARD_ODM_SEPOLICY_DIRS
-device_fc_files += $(call intermediates-dir-for,ETC,odm_file_contexts)/odm_file_contexts
-endif
-
-file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
-$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
-$(file_contexts.device.tmp): $(device_fc_files) $(M4)
-	@mkdir -p $(dir $@)
-	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
-
-file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
-$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
-  $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
-	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
-
-file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
-$(call merge-fc-files,\
-  $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp),$(file_contexts.concat.tmp))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
-	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
-
-local_fc_files :=
-device_fc_files :=
-file_contexts.concat.tmp :=
-file_contexts.device.sorted.tmp :=
-file_contexts.device.tmp :=
-file_contexts.local.tmp :=
-
-##################################
-# Tests for Treble compatibility of current platform policy and vendor policy of
-# given release version.
-
-ver := $(PLATFORM_SEPOLICY_VERSION)
-ifneq ($(wildcard $(LOCAL_PATH)/prebuilts/api/$(PLATFORM_SEPOLICY_VERSION)),)
-# If PLATFORM_SEPOLICY_VERSION is already frozen, use prebuilts for compat test
-base_plat_pub_policy.cil    := $(call intermediates-dir-for,ETC,$(ver)_plat_pub_policy.cil)/$(ver)_plat_pub_policy.cil
-base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,$(ver)_product_pub_policy.cil)/$(ver)_product_pub_policy.cil
-else
-# If not, use ToT for compat test
-base_plat_pub_policy.cil    := $(call intermediates-dir-for,ETC,base_plat_pub_policy.cil)/base_plat_pub_policy.cil
-base_product_pub_policy.cil := $(call intermediates-dir-for,ETC,base_product_pub_policy.cil)/base_product_pub_policy.cil
-endif
-ver :=
-
-$(foreach v,$(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
-  $(eval version_under_treble_tests := $(v)) \
-  $(eval include $(LOCAL_PATH)/treble_sepolicy_tests_for_release.mk) \
-)
-
-base_plat_pub_policy.cil :=
-base_product_pub_policy.cil :=
-
-#################################
-
 
 build_policy :=
-built_sepolicy :=
 sepolicy_build_files :=
 with_asan :=
diff --git a/apex/Android.bp b/apex/Android.bp
index 5b2a75e..304eb85 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -293,3 +293,31 @@
         "com.android.configinfrastructure-file_contexts",
     ],
 }
+
+filegroup {
+    name: "com.android.biometrics.virtual.fingerprint-file_contexts",
+    srcs: [
+        "com.android.biometrics.virtual.fingerprint-file_contexts",
+    ],
+}
+
+filegroup {
+    name: "com.android.uprobestats-file_contexts",
+    srcs: [
+        "com.android.uprobestats-file_contexts",
+    ],
+}
+
+filegroup {
+    name: "com.android.biometrics.virtual.face-file_contexts",
+    srcs: [
+        "com.android.biometrics.virtual.face-file_contexts",
+    ],
+}
+
+filegroup {
+    name: "com.android.documentsuibundle-file_contexts",
+    srcs: [
+        "com.android.documentsuibundle-file_contexts",
+    ],
+}
diff --git a/apex/com.android.biometrics.virtual.face-file_contexts b/apex/com.android.biometrics.virtual.face-file_contexts
new file mode 100644
index 0000000..07fc0a8
--- /dev/null
+++ b/apex/com.android.biometrics.virtual.face-file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                                          u:object_r:vendor_file:s0
+/etc(/.*)?                                      u:object_r:vendor_configs_file:s0
+/bin/hw/android\.hardware\.biometrics\.face-service\.example u:object_r:virtual_face_exec:s0
diff --git a/apex/com.android.biometrics.virtual.fingerprint-file_contexts b/apex/com.android.biometrics.virtual.fingerprint-file_contexts
new file mode 100644
index 0000000..940934b
--- /dev/null
+++ b/apex/com.android.biometrics.virtual.fingerprint-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                  u:object_r:system_file:s0
+/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.example u:object_r:virtual_fingerprint_exec:s0
diff --git a/apex/com.android.documentsuibundle-file_contexts b/apex/com.android.documentsuibundle-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.documentsuibundle-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.uprobestats-file_contexts b/apex/com.android.uprobestats-file_contexts
new file mode 100644
index 0000000..01de3e2
--- /dev/null
+++ b/apex/com.android.uprobestats-file_contexts
@@ -0,0 +1,3 @@
+(/.*)?                         u:object_r:system_file:s0
+/bin/uprobestats               u:object_r:uprobestats_exec:s0
+
diff --git a/build/soong/compat_cil.go b/build/soong/compat_cil.go
index fef2e69..d02d61e 100644
--- a/build/soong/compat_cil.go
+++ b/build/soong/compat_cil.go
@@ -119,7 +119,7 @@
 func compatTestFactory() android.SingletonModule {
 	f := &compatTestModule{}
 	f.AddProperties(&f.properties)
-	android.InitAndroidModule(f)
+	android.InitAndroidArchModule(f, android.DeviceSupported, android.MultilibCommon)
 	android.AddLoadHook(f, func(ctx android.LoadHookContext) {
 		f.loadHook(ctx)
 	})
diff --git a/build/soong/policy.go b/build/soong/policy.go
index 4476f94..8bdf01b 100644
--- a/build/soong/policy.go
+++ b/build/soong/policy.go
@@ -91,8 +91,8 @@
 	// Desired number of MLS categories. Defaults to 1024
 	Mls_cats *int64
 
-	// Board api level of policy files. Set "vendor" for RELEASE_BOARD_API_LEVEL, "system" for
-	// turning off the guard, or a direct version string (e.g. "202404"). Defaults to "system"
+	// Board api level of policy files. Set "current" for RELEASE_BOARD_API_LEVEL, or a direct
+	// version string (e.g. "202404"). Defaults to "current"
 	Board_api_level *string
 }
 
@@ -224,20 +224,6 @@
 	return proptools.IntDefault(c.properties.Mls_cats, MlsCats)
 }
 
-func (c *policyConf) boardApiLevel(ctx android.ModuleContext) string {
-	level := proptools.StringDefault(c.properties.Board_api_level, "system")
-
-	if level == "system" {
-		// aribtrary value greater than any other vendor API levels
-		return "1000000"
-	} else if level == "vendor" {
-		return ctx.Config().VendorApiLevel()
-	} else {
-		return level
-	}
-
-}
-
 func findPolicyConfOrder(name string) int {
 	for idx, pattern := range policyConfOrder {
 		// We could use regexp but it seems like an overkill
@@ -279,7 +265,7 @@
 		FlagWithArg("-D target_requires_insecure_execmem_for_swiftshader=", strconv.FormatBool(ctx.DeviceConfig().RequiresInsecureExecmemForSwiftshader())).
 		FlagWithArg("-D target_enforce_debugfs_restriction=", c.enforceDebugfsRestrictions(ctx)).
 		FlagWithArg("-D target_recovery=", strconv.FormatBool(c.isTargetRecovery())).
-		FlagWithArg("-D target_board_api_level=", c.boardApiLevel(ctx)).
+		Flag(boardApiLevelToM4Macro(ctx, c.properties.Board_api_level)).
 		Flags(flagsToM4Macros(flags)).
 		Flag("-s").
 		Inputs(srcs).
diff --git a/build/soong/selinux.go b/build/soong/selinux.go
index f811231..51ff732 100644
--- a/build/soong/selinux.go
+++ b/build/soong/selinux.go
@@ -16,6 +16,7 @@
 
 import (
 	"github.com/google/blueprint"
+	"github.com/google/blueprint/proptools"
 
 	"android/soong/android"
 )
@@ -50,3 +51,12 @@
 	}
 	return flagMacros
 }
+
+// boardApiLevel returns the M4 argument containing the target board API level.
+func boardApiLevelToM4Macro(ctx android.ModuleContext, apiLevel *string) string {
+	level := proptools.StringDefault(apiLevel, "current")
+	if level == "current" {
+		level = ctx.Config().VendorApiLevel()
+	}
+	return "-D target_board_api_level=" + level
+}
diff --git a/build/soong/selinux_contexts.go b/build/soong/selinux_contexts.go
index d4c81e8..fd1cd34 100644
--- a/build/soong/selinux_contexts.go
+++ b/build/soong/selinux_contexts.go
@@ -46,6 +46,10 @@
 
 	// Make this module available when building for recovery
 	Recovery_available *bool
+
+	// Board api level of policy files. Set "current" for RELEASE_BOARD_API_LEVEL, or a direct
+	// version string (e.g. "202404"). Defaults to "current"
+	Board_api_level *string
 }
 
 type seappProperties struct {
@@ -288,6 +292,7 @@
 		Tool(ctx.Config().PrebuiltBuildTool(ctx, "m4")).
 		Text("--fatal-warnings -s").
 		FlagForEachArg("-D", ctx.DeviceConfig().SepolicyM4Defs()).
+		Flag(boardApiLevelToM4Macro(ctx, m.properties.Board_api_level)).
 		Flags(flagsToM4Macros(flags)).
 		Inputs(inputsWithNewline).
 		FlagWithOutput("> ", builtContext)
diff --git a/build/soong/sepolicy_neverallow.go b/build/soong/sepolicy_neverallow.go
index 78cbc84..c2a21dd 100644
--- a/build/soong/sepolicy_neverallow.go
+++ b/build/soong/sepolicy_neverallow.go
@@ -57,7 +57,7 @@
 func neverallowTestFactory() android.Module {
 	n := &neverallowTestModule{}
 	n.AddProperties(&n.properties)
-	android.InitAndroidModule(n)
+	android.InitAndroidArchModule(n, android.DeviceSupported, android.MultilibCommon)
 	android.AddLoadHook(n, func(ctx android.LoadHookContext) {
 		n.loadHook(ctx)
 	})
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 726bbbc..e81e8c8 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -45,8 +45,10 @@
 		"android.hardware.automotive.audiocontrol.IAudioControl/default":          EXCEPTION_NO_FUZZER,
 		"android.hardware.biometrics.face.IFace/default":                          EXCEPTION_NO_FUZZER,
 		"android.hardware.biometrics.face.IFace/virtual":                          EXCEPTION_NO_FUZZER,
+		"android.hardware.biometrics.face.virtualhal.IVirtualHal/virtual":         EXCEPTION_NO_FUZZER,
 		"android.hardware.biometrics.fingerprint.IFingerprint/default":            EXCEPTION_NO_FUZZER,
 		"android.hardware.biometrics.fingerprint.IFingerprint/virtual":            EXCEPTION_NO_FUZZER,
+		"android.hardware.biometrics.fingerprint.virtualhal.IVirtualHal/virtual":  EXCEPTION_NO_FUZZER,
 		"android.hardware.bluetooth.audio.IBluetoothAudioProviderFactory/default": EXCEPTION_NO_FUZZER,
 		"android.hardware.broadcastradio.IBroadcastRadio/amfm":                    []string{"android.hardware.broadcastradio-service.default_fuzzer"},
 		"android.hardware.broadcastradio.IBroadcastRadio/dab":                     []string{"android.hardware.broadcastradio-service.default_fuzzer"},
@@ -163,6 +165,7 @@
 		"adaptive_auth":       EXCEPTION_NO_FUZZER,
 		"adb":                 EXCEPTION_NO_FUZZER,
 		"adservices_manager":  EXCEPTION_NO_FUZZER,
+		"advanced_protection": EXCEPTION_NO_FUZZER,
 		"aidl_lazy_test_1":    EXCEPTION_NO_FUZZER,
 		"aidl_lazy_test_2":    EXCEPTION_NO_FUZZER,
 		"aidl_lazy_test_quit": EXCEPTION_NO_FUZZER,
@@ -347,6 +350,7 @@
 		"media_communication":                    EXCEPTION_NO_FUZZER,
 		"media_metrics":                          EXCEPTION_NO_FUZZER,
 		"media_projection":                       EXCEPTION_NO_FUZZER,
+		"media_quality":                          EXCEPTION_NO_FUZZER,
 		"media_resource_monitor":                 EXCEPTION_NO_FUZZER,
 		"media_router":                           EXCEPTION_NO_FUZZER,
 		"media_session":                          EXCEPTION_NO_FUZZER,
@@ -396,6 +400,7 @@
 		"radio.phonesubinfo":                     EXCEPTION_NO_FUZZER,
 		"radio.phone":                            EXCEPTION_NO_FUZZER,
 		"radio.sms":                              EXCEPTION_NO_FUZZER,
+		"ranging":                                EXCEPTION_NO_FUZZER,
 		"rcs":                                    EXCEPTION_NO_FUZZER,
 		"reboot_readiness":                       EXCEPTION_NO_FUZZER,
 		"recovery":                               EXCEPTION_NO_FUZZER,
@@ -406,6 +411,7 @@
 		"restrictions":                           EXCEPTION_NO_FUZZER,
 		"rkpd.registrar":                         EXCEPTION_NO_FUZZER,
 		"rkpd.refresh":                           EXCEPTION_NO_FUZZER,
+		"rkp_cert_processor.service":             EXCEPTION_NO_FUZZER,
 		"role":                                   EXCEPTION_NO_FUZZER,
 		"rollback":                               EXCEPTION_NO_FUZZER,
 		"rttmanager":                             EXCEPTION_NO_FUZZER,
@@ -468,6 +474,7 @@
 		"time_zone_detector":                     EXCEPTION_NO_FUZZER,
 		"thermalservice":                         EXCEPTION_NO_FUZZER,
 		"tracing.proxy":                          EXCEPTION_NO_FUZZER,
+		"tradeinmode":                            EXCEPTION_NO_FUZZER,
 		"translation":                            EXCEPTION_NO_FUZZER,
 		"transparency":                           EXCEPTION_NO_FUZZER,
 		"trust":                                  EXCEPTION_NO_FUZZER,
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index 3e95ff8..936a524 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -3,7 +3,7 @@
 # It can be passed to checkfc to confirm that the regular expressions in
 # file_contexts are matching the intended paths.
 /                                                                 rootfs
-/adb_keys                                                         adb_keys_file
+/adb_keys                                                         system_file
 /build.prop                                                       rootfs
 /default.prop                                                     rootfs
 /fstab.persist                                                    rootfs
@@ -326,6 +326,7 @@
 /system/bin/tcpdump                                               tcpdump_exec
 /system/bin/tune2fs                                               fsck_exec
 /system/bin/resize2fs                                             fsck_exec
+/system/bin/rkp_cert_processor                                    rkp_cert_processor_exec
 /system/bin/toolbox                                               toolbox_exec
 /system/bin/toybox                                                toolbox_exec
 /system/bin/ld.mc                                                 rs_exec
@@ -409,6 +410,7 @@
 /system/bin/traced_perf                                           traced_perf_exec
 /system/bin/traced_probes                                         traced_probes_exec
 /system/bin/traced_relay                                          traced_exec
+/system/bin/tradeinmode                                           tradeinmode_exec
 /system/bin/heapprofd                                             heapprofd_exec
 /system/bin/uncrypt                                               uncrypt_exec
 /system/bin/update_verifier                                       update_verifier_exec
@@ -417,7 +419,6 @@
 /system/bin/cppreopts.sh                                          cppreopts_exec
 /system/bin/preloads_copy.sh                                      preloads_copy_exec
 /system/bin/preopt2cachename                                      preopt2cachename_exec
-/system/bin/viewcompiler                                          viewcompiler_exec
 /system/bin/sgdisk                                                sgdisk_exec
 /system/bin/blkid                                                 blkid_exec
 /system/bin/flags_health_check                                    flags_health_check_exec
@@ -486,6 +487,7 @@
 /system/bin/android.automotive.evs.manager@1.99                   evsmanagerd_exec
 /system/bin/uprobestats                                           uprobestats_exec
 /system/bin/trace_redactor                                        trace_redactor_exec
+/system/bin/bert_collector                                        bert_collector_exec
 
 /vendor                                                           vendor_file
 /vendor/does_not_exist                                            vendor_file
@@ -724,6 +726,9 @@
 /system/product/lib64                                             system_lib_file
 /system/product/lib64/does_not_exist                              system_lib_file
 
+/product/etc/security/adb_keys                                    adb_keys_file
+/system/product/etc/security/adb_keys                             adb_keys_file
+
 /system_ext                                                       system_file
 /system_ext/does_not_exist                                        system_file
 /system/system_ext                                                system_file
@@ -775,8 +780,7 @@
 /system/system_ext/bin/canhalconfigurator                         canhalconfigurator_exec
 /system/system_ext/bin/canhalconfigurator-aidl                    canhalconfigurator_exec
 
-/system_ext/bin/custom_vm_setup                                   custom_vm_setup_exec
-/system/system_ext/bin/custom_vm_setup                            custom_vm_setup_exec
+/system/bin/linux_vm_setup                                        linux_vm_setup_exec
 
 /system_ext/lib                                                   system_lib_file
 /system_ext/lib/does_not_exist                                    system_lib_file
diff --git a/flagging/Android.bp b/flagging/Android.bp
index 3dc73e5..bd97a16 100644
--- a/flagging/Android.bp
+++ b/flagging/Android.bp
@@ -23,6 +23,7 @@
         "RELEASE_AVF_ENABLE_LLPVM_CHANGES",
         "RELEASE_AVF_ENABLE_NETWORK",
         "RELEASE_AVF_ENABLE_MICROFUCHSIA",
+        "RELEASE_RANGING_STACK",
         "RELEASE_READ_FROM_NEW_STORAGE",
         "RELEASE_SUPERVISION_SERVICE",
         "RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE",
@@ -42,13 +43,6 @@
     build_flags: ["all_selinux_flags"],
 }
 
-se_policy_conf_defaults {
-    name: "se_policy_conf_public_flags_defaults",
-    srcs: [":sepolicy_flagging_macros"],
-    build_flags: ["all_selinux_flags"],
-    board_api_level: "vendor",
-}
-
 contexts_defaults {
     name: "contexts_flags_defaults",
     srcs: [":sepolicy_flagging_macros"],
diff --git a/flagging/flagging_macros b/flagging/flagging_macros
index baf26c3..44cd33a 100644
--- a/flagging/flagging_macros
+++ b/flagging/flagging_macros
@@ -9,16 +9,15 @@
 define(`is_flag_disabled', `ifelse(target_flag_$1, `true', , `$2')')
 
 ####################################
-# starting_at_board_api(api_level, rules)
+# starting_at_board_api(api_level, rules_if_api_level)
 #
-# This macro conditionally exposes SELinux rules within system/sepolicy/public,
-# ensuring they are available to vendors only when the board API level is at or
-# above the specified 'api_level'.
-#
-# * Platform sepolicy: Rules are always enabled, regardless of API level.
-# * Vendor sepolicy: Rules are enabled only when the board API level meets or
-#                    exceeds the value provided in 'api_level'.
-#
-# Apply this macro to public types and attributes (in system/sepolicy/public) to
-# restrict vendor access based on board API level.
+# This macro conditionally exposes SELinux rules ensuring they are available
+# only when the board API level is at or above the specified 'api_level'.
 define(`starting_at_board_api', `ifelse(eval(target_board_api_level >= $1), 1, `$2')')
+
+####################################
+# until_board_api(api_level, rules_if_lower_api_level)
+#
+# This macro conditionally exposes SELinux rules ensuring they are available
+# only when the board API level is below the specified 'api_level'.
+define(`until_board_api', `ifelse(eval(target_board_api_level < $1), 1, `$2')')
diff --git a/private/aconfigd.te b/private/aconfigd.te
index 97e7493..1601e61 100644
--- a/private/aconfigd.te
+++ b/private/aconfigd.te
@@ -1,15 +1,9 @@
 # aconfigd -- manager for aconfig flags
-type aconfigd, domain;
+type aconfigd, domain, coredomain;
 type aconfigd_exec, exec_type, file_type, system_file_type;
 
-typeattribute aconfigd coredomain;
-
 init_daemon_domain(aconfigd)
 
-# only init is allowed to enter the aconfigd domain
-neverallow { domain -init } aconfigd:process transition;
-neverallow * aconfigd:process dyntransition;
-
 allow aconfigd metadata_file:dir search;
 
 allow aconfigd {
@@ -22,17 +16,15 @@
     aconfig_storage_flags_metadata_file
 }:file create_file_perms;
 
-allow aconfigd aconfigd_socket:unix_stream_socket { accept listen getattr read write };
-allow aconfigd aconfigd_socket:sock_file rw_file_perms;
-
 # allow aconfigd to access shell_data_file for atest
 userdebug_or_eng(`
     allow aconfigd shell_data_file:dir search;
     allow aconfigd shell_data_file:file { getattr read open map };
 ')
 
-# allow aconfigd to log to the kernel.
-allow aconfigd kmsg_device:chr_file w_file_perms;
+# allow aconfigd to log to the kernel dmesg via a file descriptor
+# passed from init to aconfigd
+allow aconfigd kmsg_device:chr_file write;
 
 # allow aconfigd to read vendor partition storage files
 allow aconfigd vendor_aconfig_storage_file:file r_file_perms;
@@ -41,3 +33,11 @@
 # allow aconfigd to read /apex dir
 allow aconfigd apex_mnt_dir:dir r_dir_perms;
 allow aconfigd apex_mnt_dir:file r_file_perms;
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd domain
+neverallow { domain -init } aconfigd:process transition;
+neverallow * aconfigd:process dyntransition;
diff --git a/private/adbd.te b/private/adbd.te
index 154a04c..b87b319 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -2,13 +2,17 @@
 
 typeattribute adbd coredomain;
 typeattribute adbd mlstrustedsubject;
+typeattribute adbd adbd_common;
 
 init_daemon_domain(adbd)
 
 domain_auto_trans(adbd, shell_exec, shell)
 
+# Allow adb to setcon() to tradeinmode.
+allow adbd self:process setcurrent;
+allow adbd adbd_tradeinmode:process dyntransition;
+
 userdebug_or_eng(`
-  allow adbd self:process setcurrent;
   allow adbd su:process dyntransition;
 ')
 
@@ -40,18 +44,8 @@
 # ignore spurious denials for adbd when disk space is low.
 dontaudit adbd self:global_capability_class_set sys_resource;
 
-# adbd probes for vsock support. Do not generate denials when
-# this occurs. (b/123569840)
-dontaudit adbd self:{ socket vsock_socket } create;
-
-# Allow adbd inside vm to forward vm's vsock.
-allow adbd self:vsock_socket { create_socket_perms_no_ioctl listen accept };
-
 # Create and use network sockets.
 net_domain(adbd)
-# Connect to mdnsd via mdnsd socket.
-unix_socket_connect(adbd, mdnsd, mdnsd)
-
 # Access /dev/usb-ffs/adb/ep0
 allow adbd functionfs:dir search;
 allow adbd functionfs:file rw_file_perms;
@@ -60,13 +54,6 @@
   FUNCTIONFS_CLEAR_HALT
 };
 
-# Use a pseudo tty.
-allow adbd devpts:chr_file rw_file_perms;
-
-# adb push/pull /data/local/tmp.
-allow adbd shell_data_file:dir create_dir_perms;
-allow adbd shell_data_file:file create_file_perms;
-
 # adb pull /data/local/traces/*
 allow adbd trace_data_file:dir r_dir_perms;
 allow adbd trace_data_file:file r_file_perms;
@@ -95,26 +82,11 @@
 set_prop(adbd, powerctl_prop)
 get_prop(adbd, ffs_config_prop)
 set_prop(adbd, ffs_control_prop)
-
-# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
-set_prop(adbd, adbd_prop)
-set_prop(adbd, adbd_config_prop)
+set_prop(adbd, adbd_tradeinmode_prop)
 
 # Allow adbd start/stop mdnsd via ctl.start
 set_prop(adbd, ctl_mdnsd_prop)
 
-# Access device logging gating property
-get_prop(adbd, device_logging_prop)
-
-# Read device's serial number from system properties
-get_prop(adbd, serialno_prop)
-
-# Read whether or not Test Harness Mode is enabled
-get_prop(adbd, test_harness_prop)
-
-# Read persist.adb.tls_server.enable property
-get_prop(adbd, system_adbd_prop)
-
 # Read device's overlayfs related properties and files
 userdebug_or_eng(`
   get_prop(adbd, persistent_properties_ready_prop)
@@ -215,6 +187,10 @@
 allow adbd shell:unix_stream_socket { read write shutdown };
 allow adbd shell:fd use;
 
+# adb push/pull /data/local/tmp.
+allow adbd shell_data_file:dir create_dir_perms;
+allow adbd shell_data_file:file create_file_perms;
+
 # Allow pull /vendor/apex files for CTS tests
 r_dir_file(adbd, vendor_apex_file)
 
@@ -239,10 +215,15 @@
 ###
 
 # No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
-# transitions to the shell domain (except when it crashes). In particular, we
-# never want to see a transition from adbd to su (aka "adb root")
-neverallow adbd { domain -crash_dump -shell }:process transition;
-neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition;
+# transitions to the shell or tradeinmode domain (except when it crashes). In
+# particular, we never want to see a transition from adbd to su (aka "adb root")
+neverallow adbd { domain -crash_dump -shell -adbd_tradeinmode }:process transition;
+neverallow adbd {
+    domain
+    userdebug_or_eng(`-su')
+    recovery_only(`-shell')
+    -adbd_tradeinmode
+}:process dyntransition;
 
 # Only init is allowed to enter the adbd domain via exec()
 neverallow { domain -init } adbd:process transition;
diff --git a/private/adbd_common.te b/private/adbd_common.te
new file mode 100644
index 0000000..c24b029
--- /dev/null
+++ b/private/adbd_common.te
@@ -0,0 +1,31 @@
+### ADB daemon common rules.
+### Put things here that are needed for both adbd proper and adbd in trade-in mode.
+
+# Connect to mdnsd via mdnsd socket.
+unix_socket_connect(adbd_common, mdnsd, mdnsd)
+
+# adbd probes for vsock support. Do not generate denials when
+# this occurs. (b/123569840)
+dontaudit adbd_common self:{ socket vsock_socket } create;
+
+# Allow adbd inside vm to forward vm's vsock.
+allow adbd_common self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+
+# Access device logging gating property
+get_prop(adbd_common, device_logging_prop)
+
+# Use a pseudo tty.
+allow adbd_common devpts:chr_file rw_file_perms;
+
+# Read persist.adb.tls_server.enable property
+get_prop(adbd_common, system_adbd_prop)
+
+# Read whether or not Test Harness Mode is enabled
+get_prop(adbd_common, test_harness_prop)
+
+# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
+set_prop(adbd_common, adbd_prop)
+set_prop(adbd_common, adbd_config_prop)
+
+# Read device's serial number from system properties
+get_prop(adbd_common, serialno_prop)
diff --git a/private/adbd_tradeinmode.te b/private/adbd_tradeinmode.te
new file mode 100644
index 0000000..42fdec4
--- /dev/null
+++ b/private/adbd_tradeinmode.te
@@ -0,0 +1,26 @@
+### ADB in trade-in mode
+type adbd_tradeinmode, domain, coredomain, adbd_common;
+
+# Create and use network sockets.
+net_domain(adbd_tradeinmode)
+
+# Run /system/bin/tradeinmode
+domain_auto_trans(adbd_tradeinmode, tradeinmode_exec, tradeinmode)
+
+# Baseline rules to make adbd work after setcon().
+allow adbd_tradeinmode adbd:unix_stream_socket {
+    rw_socket_perms_no_ioctl
+    listen
+    accept
+};
+allow adbd_tradeinmode adbd:fd use;
+allow adbd_tradeinmode adbd:unix_dgram_socket { connect write };
+allow adbd_tradeinmode functionfs:dir r_dir_perms;
+allow adbd_tradeinmode functionfs:file rw_file_perms;
+allow adbd_tradeinmode proc_uptime:file r_file_perms;
+allow adbd_tradeinmode rootfs:dir r_dir_perms;
+
+set_prop(adbd_tradeinmode, ffs_control_prop)
+
+# Allow changing persist.adb.tradeinmode when testing.
+userdebug_or_eng(`set_prop(adbd_tradeinmode, shell_prop)')
diff --git a/private/apexd.te b/private/apexd.te
index e7ad3b9..450b563 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -95,6 +95,8 @@
 allow apexd staging_data_file:file { r_file_perms link };
 # # Allow relabeling file created in /data/apex/decompressed
 allow apexd staging_data_file:file relabelto;
+# Allow renaming files in /data/apex/decompressed (from .ota.apex to .decompressed.apex)
+allow apexd staging_data_file:file rename;
 
 # allow apexd to read files from /vendor/apex
 r_dir_file(apexd, vendor_apex_file)
@@ -189,6 +191,9 @@
 
 # Allow apexd to write to statsd.
 unix_socket_send(apexd, statsdw, statsd)
+# Allow apexd to call
+allow apexd statsbootstrap_service:service_manager find;
+binder_call(apexd, system_server) # system_server serves statsbootstrap_service
 
 ###
 ### Neverallow rules
diff --git a/private/app.te b/private/app.te
index cc69e5e..6362c7d 100644
--- a/private/app.te
+++ b/private/app.te
@@ -167,6 +167,8 @@
 
 use_credstore({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })
 
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } persistent_data_block_service:service_manager find;
+
 # For app fuse.
 pdx_client({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, display_client)
 pdx_client({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }, display_manager)
@@ -641,12 +643,6 @@
     apk_tmp_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
-neverallow { appdomain -untrusted_app_all -platform_app -priv_app -isolated_app_all }
-    { apk_tmp_file apk_private_tmp_file }:dir_file_class_set *;
-
-neverallow { untrusted_app_all isolated_app_all } { apk_tmp_file apk_private_tmp_file }:{ devfile_class_set dir fifo_file lnk_file sock_file } *;
-neverallow { untrusted_app_all isolated_app_all } { apk_tmp_file apk_private_tmp_file }:file ~{ getattr read map };
-
 # Access to factory files.
 neverallow appdomain efs_file:dir_file_class_set write;
 neverallow { appdomain -shell } efs_file:dir_file_class_set read;
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index bf723c5..0e2b01c 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -45,6 +45,10 @@
 neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
 neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
 
+# Do not allow untrusted apps to modify temporarily staged APKs.
+neverallow all_untrusted_apps { apk_tmp_file apk_private_tmp_file }:{ devfile_class_set dir fifo_file lnk_file sock_file } *;
+neverallow all_untrusted_apps { apk_tmp_file apk_private_tmp_file }:file ~{ getattr read map };
+
 # net.dns properties are not a public API. Disallow untrusted apps from reading this property.
 neverallow { all_untrusted_apps } net_dns_prop:file read;
 
diff --git a/private/artd.te b/private/artd.te
index bc4a7a2..15d7969 100644
--- a/private/artd.te
+++ b/private/artd.te
@@ -40,6 +40,8 @@
 allow artd mnt_expand_file:dir { getattr search };
 allow artd apk_data_file:dir { rw_dir_perms create setattr relabelfrom };
 allow artd apk_data_file:file r_file_perms;
+allow artd apk_tmp_file:dir { rw_dir_perms create setattr relabelfrom };
+allow artd apk_tmp_file:file r_file_perms;
 
 # Read access to vendor APKs ({/vendor,/odm}/{app,priv-app}/...).
 r_dir_file(artd, vendor_app_file)
diff --git a/private/attributes b/private/attributes
index fe50b0d..2d6181d 100644
--- a/private/attributes
+++ b/private/attributes
@@ -15,3 +15,5 @@
 attribute sdk_sandbox_all;
 # The SDK sandbox domains for the current SDK level.
 attribute sdk_sandbox_current;
+# Common to adbd and adbd_tradeinmode.
+attribute adbd_common;
diff --git a/private/bert_collector.te b/private/bert_collector.te
new file mode 100644
index 0000000..b11bd76
--- /dev/null
+++ b/private/bert_collector.te
@@ -0,0 +1,12 @@
+type bert_collector, domain, coredomain;
+type bert_collector_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(bert_collector)
+
+r_dir_file(bert_collector, sysfs_firmware_acpi_tables)
+
+binder_use(bert_collector)
+binder_call(bert_collector, system_server)
+
+allow bert_collector dropbox_service:service_manager find;
+allow bert_collector proc_version:file r_file_perms;
diff --git a/private/cameraserver.te b/private/cameraserver.te
index b143f58..16c1f3d 100644
--- a/private/cameraserver.te
+++ b/private/cameraserver.te
@@ -14,7 +14,7 @@
 binder_service(cameraserver)
 
 hal_client_domain(cameraserver, hal_camera)
-
+allow cameraserver hal_camera_server:process signal;
 hal_client_domain(cameraserver, hal_graphics_allocator)
 
 allow cameraserver ion_device:chr_file rw_file_perms;
diff --git a/private/compat/202404/202404.cil b/private/compat/202404/202404.cil
index 869deb6..5ba9b3f 100644
--- a/private/compat/202404/202404.cil
+++ b/private/compat/202404/202404.cil
@@ -1,5 +1,7 @@
 ;; This type may or may not already exist in vendor policy. Re-define it here (duplicate
 ;; definitions in CIL will be ignored) - so we can reference it in 202404.cil.
+(type virtual_fingerprint_hal_prop)
+(type otapreopt_chroot)
 (type vendor_hidraw_device)
 (typeattributeset dev_type (vendor_hidraw_device))
 
@@ -2723,7 +2725,7 @@
 (typeattributeset virtual_device_native_service_202404 (virtual_device_native_service))
 (typeattributeset virtual_device_service_202404 (virtual_device_service))
 (typeattributeset virtual_face_hal_prop_202404 (virtual_face_hal_prop))
-(typeattributeset virtual_fingerprint_hal_prop_202404 (virtual_fingerprint_hal_prop))
+(typeattributeset virtual_fingerprint_hal_prop_202404 (virtual_fingerprint_hal_prop virtual_fingerprint_prop))
 (typeattributeset virtual_touchpad_202404 (virtual_touchpad))
 (typeattributeset virtual_touchpad_exec_202404 (virtual_touchpad_exec))
 (typeattributeset virtual_touchpad_service_202404 (virtual_touchpad_service))
diff --git a/private/compat/202404/202404.ignore.cil b/private/compat/202404/202404.ignore.cil
index 2b3adc0..8bb0a2d 100644
--- a/private/compat/202404/202404.ignore.cil
+++ b/private/compat/202404/202404.ignore.cil
@@ -5,15 +5,21 @@
 (typeattribute new_objects)
 (typeattributeset new_objects
   ( new_objects
+    bluetooth_finder_prop
     profcollectd_etr_prop
-    fs_bpf_lmkd_memevents_rb
-    fs_bpf_lmkd_memevents_prog
     fstype_prop
     binderfs_logs_transactions
     binderfs_logs_transaction_history
-    proc_compaction_proactiveness
     proc_cgroups
+    ranging_service
     supervision_service
     sysfs_udc
     app_function_service
+    virtual_fingerprint
+    virtual_fingerprint_exec
+    virtual_face
+    virtual_face_exec
+    media_quality_service
+    advanced_protection_service
+    sysfs_firmware_acpi_tables
   ))
diff --git a/private/compat/33.0/33.0.ignore.cil b/private/compat/33.0/33.0.ignore.cil
index 352aecf..a43f0fd 100644
--- a/private/compat/33.0/33.0.ignore.cil
+++ b/private/compat/33.0/33.0.ignore.cil
@@ -81,6 +81,7 @@
     usb_uvc_enabled_prop
     virtual_face_hal_prop
     virtual_fingerprint_hal_prop
+    virtual_fingerprint_prop
     hal_gatekeeper_service
     hal_broadcastradio_service
     hal_confirmationui_service
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index 6c52dba..3132c5a 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -52,4 +52,5 @@
     aconfigd_socket
     enable_16k_pages_prop
     proc_cgroups
+    media_quality_service
   ))
diff --git a/private/coredomain.te b/private/coredomain.te
index 93cbff5..8a46a08 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -220,6 +220,7 @@
   neverallow {
     coredomain
     -adbd
+    -adbd_tradeinmode
     -init
     -mediaprovider
     -system_server
diff --git a/private/crash_dump.te b/private/crash_dump.te
index 45d5722..a9a802c 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -19,13 +19,7 @@
 }:process { ptrace signal sigchld sigstop sigkill };
 
 userdebug_or_eng(`
-  allow crash_dump {
-    apexd
-    keystore
-    llkd
-    logd
-    vold
-  }:process { ptrace signal sigchld sigstop sigkill };
+  allow crash_dump { apexd llkd logd vold }:process { ptrace signal sigchld sigstop sigkill };
 ')
 
 # Read ART APEX data directory
@@ -106,8 +100,15 @@
   core_data_file_type
   vendor_file_type
 }:dir search;
-dontaudit crash_dump system_data_file:{ lnk_file file } read;
-dontaudit crash_dump property_type:file read;
+# Crash dump might try to read files that are mapped into the crashed process's
+# memory space to extract useful binary information such as the ELF header. See
+# system/core/debuggerd/libdebuggerd/tombstone_proto.cpp:dump_mappings.
+# Ignore these accesses.
+dontaudit crash_dump {
+  app_data_file_type
+  property_type
+  system_data_file
+}:{ lnk_file file } { read open };
 
 get_prop(crash_dump, misctrl_prop)
 
@@ -128,7 +129,6 @@
   init
   kernel
   keystore
-  userdebug_or_eng(`-keystore')
   llkd
   userdebug_or_eng(`-llkd')
   logd
diff --git a/private/crosvm.te b/private/crosvm.te
index 6f07391..ccfffa0 100644
--- a/private/crosvm.te
+++ b/private/crosvm.te
@@ -20,10 +20,16 @@
 tmpfs_domain(crosvm)
 
 # Let crosvm receive file descriptors from VirtualizationService.
-allow crosvm virtualizationmanager:fd use;
+allow crosvm {
+  virtualizationmanager
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:fd use;
 
 # Allow sending VirtualizationService the failure reason and console/log from the VM via pipe.
-allow crosvm virtualizationmanager:fifo_file write;
+allow crosvm {
+  virtualizationmanager
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:fifo_file write;
 
 # Let crosvm read the composite disk images (virtualizationservice_data_file), APEXes
 # (staging_data_file), APKs (apk_data_file and shell_data_file where the latter is for test apks in
@@ -62,7 +68,10 @@
 #   read, write, getattr: listener socket polling
 #   accept: listener socket accepting new connection
 # Note that the open permission is not given as the socket is passed by FD.
-allow crosvm virtualizationmanager:unix_stream_socket { accept read write getattr getopt };
+allow crosvm {
+  virtualizationmanager
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:unix_stream_socket { accept read write getattr getopt };
 
 # Let crosvm open test artifacts under /data/local/tmp with file path. (e.g. custom pvmfw.img)
 userdebug_or_eng(`
@@ -121,7 +130,10 @@
 # crosvm tries to read serial device, including the write-only pipe from virtualizationmanager (to
 # forward console/log to the host logcat).
 # crosvm only needs write permission, so dontaudit read
-dontaudit crosvm virtualizationmanager:fifo_file { read getattr };
+dontaudit crosvm {
+  virtualizationmanager
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `early_virtmgr')
+}:fifo_file { read getattr };
 
 # Required for crosvm to start gdb-server to enable debugging of guest kernel.
 allow crosvm self:tcp_socket { bind create read setopt write accept listen };
@@ -134,7 +146,6 @@
 allow crosvm vfio_device:dir r_dir_perms;
 
 # Allow crosvm to access VM DTBO via a file created by virtualizationmanager.
-allow crosvm virtualizationmanager:fd use;
 allow crosvm virtualizationservice_data_file:file read;
 
 is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
@@ -146,6 +157,9 @@
     allow crosvm vmnic:fd use;
 ')
 
+# Early VMs may print messages to kmsg_debug_device.
+allow crosvm kmsg_debug_device:chr_file w_file_perms;
+
 # Don't allow crosvm to open files that it doesn't own.
 # This is important because a malicious application could try to start a VM with a composite disk
 # image referring by name to files which it doesn't have permission to open, trying to get crosvm to
@@ -194,4 +208,6 @@
   domain
   -crosvm
   -virtualizationmanager
+
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, `-early_virtmgr')
 } crosvm_exec:file no_x_file_perms;
diff --git a/private/custom_vm_setup.te b/private/custom_vm_setup.te
deleted file mode 100644
index c14f5e0..0000000
--- a/private/custom_vm_setup.te
+++ /dev/null
@@ -1,6 +0,0 @@
-type custom_vm_setup, domain, coredomain;
-type custom_vm_setup_exec, system_file_type, exec_type, file_type;
-
-is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
-  init_daemon_domain(custom_vm_setup)
-')
diff --git a/private/domain.te b/private/domain.te
index 94f96d9..75bcdf9 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -84,6 +84,10 @@
 # /dev/binder can be accessed by ... everyone! :)
 allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;
 get_prop({domain -hwservicemanager -vndservicemanager }, servicemanager_prop)
+# Checking for the existance of the hwservicemanager binary is done in the client API
+# isHwServiceManagerInstalled
+dontaudit domain hwservicemanager_exec:file r_file_perms;
+
 
 # Restrict binder ioctls to an allowlist. Additional ioctl commands may be
 # added to individual domains, but this sets safe defaults for all processes.
@@ -342,6 +346,10 @@
 allow domain sysfs_pgsize_migration:dir search;
 allow domain sysfs_pgsize_migration:file r_file_perms;
 
+# Linker is executed from the context of the process requesting the dynamic linking,
+# so this prop must be "world-readable".
+get_prop(domain, bionic_linker_16kb_app_compat_prop)
+
 # Allow everyone to read media server-configurable flags, so that libstagefright can be
 # configured using server-configurable flags
 get_prop(domain, device_config_media_native_prop)
@@ -493,7 +501,7 @@
 get_prop(domain, surfaceflinger_prop)
 get_prop(domain, telephony_status_prop)
 get_prop(domain, timezone_prop)
-get_prop({domain -untrusted_app_all -isolated_app_all -ephemeral_app },  userdebug_or_eng_prop)
+get_prop({domain -untrusted_app_all -isolated_app_all -ephemeral_app -app_zygote },  userdebug_or_eng_prop)
 get_prop(domain, vendor_socket_hook_prop)
 get_prop(domain, vndk_prop)
 get_prop(domain, vold_status_prop)
@@ -808,6 +816,7 @@
 neverallow {
   domain
   -adbd
+  -adbd_tradeinmode
   -dumpstate
   -fastbootd
   -hal_camera_server
@@ -1355,10 +1364,17 @@
 } shell:process { transition dyntransition };
 
 # Only domains spawned from zygote, runas and simpleperf_app_runner may have
-# the appdomain attribute. simpleperf is excluded as a domain transitioned to
-# when running an app-scoped profiling session.
+# the appdomain attribute.
+#
+# simpleperf is excluded as a domain transitioned to when running an app-scoped
+# profiling session.
+#
+# tradeinmode is excluded; it is only run when adbd is in trade-in mode,
+# transitioned from the limited adbd_tradeinmode context. It is a wrapper
+# around "am" to avoid exposing the shell context when adbd is in trade-in
+# mode.
 neverallow { domain -simpleperf_app_runner -runas -app_zygote -webview_zygote -zygote } {
-  appdomain -shell -simpleperf userdebug_or_eng(`-su')
+  appdomain -shell -simpleperf userdebug_or_eng(`-su') -tradeinmode
 }:process { transition dyntransition };
 
 # Minimize read access to shell- or app-writable symlinks.
@@ -1768,10 +1784,14 @@
   -crosvm
 } staging_data_file:file *;
 neverallow { domain -init -system_server -installd} staging_data_file:dir no_w_dir_perms;
-# apexd needs the link and unlink permissions, so list every `no_w_file_perms`
-# except for `link` and `unlink`.
-neverallow { domain -init -system_server } staging_data_file:file
-  { append create relabelfrom rename setattr write no_x_file_perms };
+# apexd needs the link/unlink/rename permissions
+neverallow { domain -init -system_server -installd -apexd } staging_data_file:file {
+  no_w_file_perms no_x_file_perms
+};
+neverallow apexd staging_data_file:file {
+  append create relabelfrom setattr write # no_w_file_perms -link -unlink -rename
+  no_x_file_perms
+};
 
 neverallow {
     domain
diff --git a/private/early_virtmgr.te b/private/early_virtmgr.te
index 484077c..e244be2 100644
--- a/private/early_virtmgr.te
+++ b/private/early_virtmgr.te
@@ -6,8 +6,61 @@
 
     use_bootstrap_libs(early_virtmgr)
 
+    # Let early_virtmgr create files and directories inside /mnt/vm/early.
     allow early_virtmgr vm_data_file:dir create_dir_perms;
     allow early_virtmgr vm_data_file:file create_file_perms;
+    allow early_virtmgr vm_data_file:sock_file create_file_perms;
+
+    # Allow early_virtmgr to communicate use, read and write over the adb connection.
+    allow early_virtmgr adbd:fd use;
+    allow early_virtmgr adbd:unix_stream_socket { getattr read write };
+
+    # Allow writing VM logs to the shell console
+    allow early_virtmgr devpts:chr_file { read write getattr ioctl };
+
+    # Let the early_virtmgr domain use Binder.
+    binder_use(early_virtmgr)
+
+    # When early_virtmgr execs a file with the crosvm_exec label, run it in the crosvm domain.
+    domain_auto_trans(early_virtmgr, crosvm_exec, crosvm)
+
+    # Let early_virtmgr kill crosvm.
+    allow early_virtmgr crosvm:process sigkill;
+
+    # Allow early_virtmgr to read apex-info-list.xml and access the APEX files listed there.
+    allow early_virtmgr apex_info_file:file r_file_perms;
+    allow early_virtmgr apex_data_file:dir search;
+
+    # Ignore harmless denials on /proc/self/fd
+    dontaudit early_virtmgr self:dir write;
+
+    # Let early_virtmgr to accept vsock connection from the guest VMs
+    allow early_virtmgr self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+
+    # Allow early_virtmgr to inspect all hypervisor capabilities.
+    get_prop(early_virtmgr, hypervisor_prop)
+    get_prop(early_virtmgr, hypervisor_pvmfw_prop)
+    get_prop(early_virtmgr, hypervisor_restricted_prop)
+    get_prop(early_virtmgr, hypervisor_virtualizationmanager_prop)
+
+    # Allow early_virtmgr to read file system DT for VM reference DT and AVF debug policy
+    r_dir_file(early_virtmgr, proc_dt_avf)
+    r_dir_file(early_virtmgr, sysfs_dt_avf)
+
+    # early_virtmgr to be client of secretkeeper HAL. It ferries SecretManagement messages from pVM
+    # to HAL.
+    hal_client_domain(early_virtmgr, hal_secretkeeper);
+
+    # Allow reading files under /proc/[crosvm pid]/, for collecting CPU & memory usage inside VM.
+    r_dir_file(early_virtmgr, crosvm);
+
+    # Allow early_virtmgr to:
+    # 1) bind to a vsock port less than 1024, because early VMs use static CIDs less than 1024
+    # 2) call RLIMIT_MEMLOCK for itself
+    allow early_virtmgr self:global_capability_class_set { net_bind_service ipc_lock sys_resource };
+
+    # early_virtmgr may print messages to kmsg_debug_device.
+    allow early_virtmgr kmsg_debug_device:chr_file w_file_perms;
 
     ###
     ### Neverallow rules
@@ -16,4 +69,7 @@
     # Only crosvm and early_virtmgr can access vm_data_file
     neverallow { domain -crosvm -early_virtmgr -init } vm_data_file:dir no_w_dir_perms;
     neverallow { domain -crosvm -early_virtmgr } vm_data_file:file no_rw_file_perms;
+
+    # No other domains can accept vsock connection from the guest VMs
+    neverallow { domain -early_virtmgr } early_virtmgr:vsock_socket { accept bind create connect listen };
 ')
diff --git a/private/ferrochrome_app.te b/private/ferrochrome_app.te
deleted file mode 100644
index e12c84c..0000000
--- a/private/ferrochrome_app.te
+++ /dev/null
@@ -1,11 +0,0 @@
-type ferrochrome_app, domain;
-typeattribute ferrochrome_app coredomain;
-
-app_domain(ferrochrome_app)
-
-allow ferrochrome_app app_api_service:service_manager find;
-allow ferrochrome_app system_api_service:service_manager find;
-
-# TODO(b/348113995): after remove sysprop usage, we can use just (priv_)app.te
-set_prop(ferrochrome_app, debug_prop);
-get_prop(ferrochrome_app, debug_prop);
diff --git a/private/file.te b/private/file.te
index 038e899..662d5cc 100644
--- a/private/file.te
+++ b/private/file.te
@@ -9,6 +9,7 @@
 type fs_bpf_netd_shared, fs_type, bpffs_type;
 type fs_bpf_loader, fs_type, bpffs_type;
 type fs_bpf_uprobestats, fs_type, bpffs_type;
+type fs_bpf_memevents, fs_type, bpffs_type;
 
 # /data/misc/storaged
 type storaged_data_file, file_type, data_file_type, core_data_file_type;
@@ -181,6 +182,9 @@
 # Type for /sys/kernel/mm/pgsize_migration/enabled
 type sysfs_pgsize_migration, fs_type, sysfs_type;
 
+# /sys/firmware/acpi/tables
+type sysfs_firmware_acpi_tables, fs_type, sysfs_type;
+
 # Allow files to be created in their appropriate filesystems.
 allow fs_type self:filesystem associate;
 allow cgroup tmpfs:filesystem associate;
@@ -213,3 +217,30 @@
 
 # /data/misc_ce/userId/storage_area_keys
 type storage_area_key_file, file_type, data_file_type, core_data_file_type;
+
+
+# Types added in 202504 in public/file.te
+until_board_api(202504, `
+    type binderfs_logs_transactions, fs_type;
+    type binderfs_logs_transaction_history, fs_type;
+')
+
+until_board_api(202504, `
+    type proc_cgroups, fs_type, proc_type;
+')
+
+until_board_api(202504, `
+    type sysfs_udc, fs_type, sysfs_type;
+')
+
+until_board_api(202504, `
+    type fs_bpf_lmkd_memevents_rb, fs_type, bpffs_type;
+    type fs_bpf_lmkd_memevents_prog, fs_type, bpffs_type;
+')
+
+until_board_api(202504, `
+    # boot otas for 16KB developer option
+    type vendor_boot_ota_file, vendor_file_type, file_type;
+')
+## END Types added in 202504 in public/file.te
+
diff --git a/private/file_contexts b/private/file_contexts
index 394d3b7..f837b70 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -24,7 +24,7 @@
 /                   u:object_r:rootfs:s0
 
 # Data files
-/adb_keys           u:object_r:adb_keys_file:s0
+/adb_keys           u:object_r:system_file:s0
 /build\.prop        u:object_r:rootfs:s0
 /default\.prop      u:object_r:rootfs:s0
 /fstab\..*          u:object_r:rootfs:s0
@@ -362,7 +362,8 @@
 /system/bin/virtual_camera          u:object_r:virtual_camera_exec:s0
 /system/bin/hw/android\.frameworks\.bufferhub@1\.0-service    u:object_r:fwk_bufferhub_exec:s0
 /system/bin/hw/android\.system\.suspend-service               u:object_r:system_suspend_exec:s0
-/(system|system_ext|product)/etc/aconfig(/.*)?                u:object_r:system_aconfig_storage_file:s0
+/system/bin/rkp_cert_processor          u:object_r:rkp_cert_processor_exec:s0
+/system/etc/aconfig(/.*)?               u:object_r:system_aconfig_storage_file:s0
 /system/etc/cgroups\.json               u:object_r:cgroup_desc_file:s0
 /system/etc/task_profiles/cgroups_[0-9]+\.json               u:object_r:cgroup_desc_api_file:s0
 /system/etc/event-log-tags              u:object_r:system_event_log_tags_file:s0
@@ -407,6 +408,9 @@
 /system/bin/evsmanagerd          u:object_r:evsmanagerd_exec:s0
 /system/bin/android\.automotive\.evs\.manager@1\.[0-9]+ u:object_r:evsmanagerd_exec:s0
 /system/bin/uprobestats           u:object_r:uprobestats_exec:s0
+/system/bin/bert_collector        u:object_r:bert_collector_exec:s0
+/system/bin/linux_vm_setup        u:object_r:linux_vm_setup_exec:s0
+/system/bin/tradeinmode           u:object_r:tradeinmode_exec:s0
 
 #############################
 # Vendor files
@@ -507,6 +511,9 @@
 
 /(product|system/product)/lib(64)?(/.*)?                         u:object_r:system_lib_file:s0
 
+/(product|system/product)/etc/security/adb_keys                 u:object_r:adb_keys_file:s0
+/(product|system/product)/etc/aconfig(/.*)?                     u:object_r:system_aconfig_storage_file:s0
+
 #############################
 # SystemExt files
 #
@@ -531,12 +538,12 @@
 /(system_ext|system/system_ext)/bin/hwservicemanager         u:object_r:hwservicemanager_exec:s0
 /(system_ext|system/system_ext)/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
 
-/(system_ext|system/system_ext)/bin/custom_vm_setup       u:object_r:custom_vm_setup_exec:s0
-
 /(system_ext|system/system_ext)/bin/canhalconfigurator(-aidl)? u:object_r:canhalconfigurator_exec:s0
 
 /(system_ext|system/system_ext)/lib(64)?(/.*)?      u:object_r:system_lib_file:s0
 
+/(system_ext|system/system_ext)/etc/aconfig(/.*)?                u:object_r:system_aconfig_storage_file:s0
+
 #############################
 # VendorDlkm files
 # This includes VENDOR Dynamically Loadable Kernel Modules and other misc files.
diff --git a/private/fsck.te b/private/fsck.te
index 5eeb39f..90f7e51 100644
--- a/private/fsck.te
+++ b/private/fsck.te
@@ -2,6 +2,9 @@
 
 init_daemon_domain(fsck)
 
+# fsck can run before apex is ready.
+use_bootstrap_libs(fsck)
+
 allow fsck metadata_block_device:blk_file rw_file_perms;
 
 # /dev/__null__ created by init prior to policy load,
diff --git a/private/fsck_untrusted.te b/private/fsck_untrusted.te
index 682831f..4b55a57 100644
--- a/private/fsck_untrusted.te
+++ b/private/fsck_untrusted.te
@@ -1,5 +1,7 @@
 typeattribute fsck_untrusted coredomain;
 
+use_bootstrap_libs(fsck)
+
 # Inherit and use pty created by android_fork_execvp_ext().
 allow fsck_untrusted devpts:chr_file { read write ioctl getattr };
 
diff --git a/private/genfs_contexts b/private/genfs_contexts
index de2b139..e300d78 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -94,7 +94,6 @@
 genfscon proc /sys/vm/watermark_boost_factor u:object_r:proc_watermark_boost_factor:s0
 genfscon proc /sys/vm/watermark_scale_factor u:object_r:proc_watermark_scale_factor:s0
 genfscon proc /sys/vm/percpu_pagelist_high_fraction u:object_r:proc_percpu_pagelist_high_fraction:s0
-genfscon proc /sys/vm/compaction_proactiveness u:object_r:proc_compaction_proactiveness:s0
 genfscon proc /timer_list u:object_r:proc_timer:s0
 genfscon proc /timer_stats u:object_r:proc_timer:s0
 genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
@@ -150,6 +149,7 @@
 genfscon sysfs /devices/virtual/net             u:object_r:sysfs_net:s0
 genfscon sysfs /devices/virtual/switch          u:object_r:sysfs_switch:s0
 genfscon sysfs /devices/virtual/wakeup          u:object_r:sysfs_wakeup:s0
+genfscon sysfs /firmware/acpi/tables              u:object_r:sysfs_firmware_acpi_tables:s0
 genfscon sysfs /firmware/devicetree/base/avf u:object_r:sysfs_dt_avf:s0
 genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
 genfscon sysfs /fs/ext4/features                  u:object_r:sysfs_fs_ext4_features:s0
@@ -331,13 +331,11 @@
 
 genfscon bpf / u:object_r:fs_bpf:s0
 genfscon bpf /loader u:object_r:fs_bpf_loader:s0
-genfscon bpf /map_bpfMemEvents_lmkd_rb u:object_r:fs_bpf_lmkd_memevents_rb:s0
+genfscon bpf /memevents u:object_r:fs_bpf_memevents:s0
 genfscon bpf /net_private u:object_r:fs_bpf_net_private:s0
 genfscon bpf /net_shared u:object_r:fs_bpf_net_shared:s0
 genfscon bpf /netd_readonly u:object_r:fs_bpf_netd_readonly:s0
 genfscon bpf /netd_shared u:object_r:fs_bpf_netd_shared:s0
-genfscon bpf /prog_bpfMemEvents_tracepoint_vmscan_mm_vmscan_direct_reclaim_begin_lmkd u:object_r:fs_bpf_lmkd_memevents_prog:s0
-genfscon bpf /prog_bpfMemEvents_tracepoint_vmscan_mm_vmscan_direct_reclaim_end_lmkd u:object_r:fs_bpf_lmkd_memevents_prog:s0
 genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0
 genfscon bpf /vendor u:object_r:fs_bpf_vendor:s0
 genfscon bpf /uprobestats u:object_r:fs_bpf_uprobestats:s0
diff --git a/private/gmscore_app.te b/private/gmscore_app.te
index 90194f9..fa3420a 100644
--- a/private/gmscore_app.te
+++ b/private/gmscore_app.te
@@ -156,6 +156,9 @@
 get_prop(gmscore_app, quick_start_prop)
 neverallow { domain -init -dumpstate -vendor_init -gmscore_app } quick_start_prop:file no_rw_file_perms;
 
+# Allow GmsCore to read Bluetotoh Power Off Finder property
+get_prop(gmscore_app, bluetooth_finder_prop)
+
 # Do not allow getting permission-protected network information from sysfs.
 neverallow gmscore_app sysfs_net:file *;
 
diff --git a/private/hal_bluetooth.te b/private/hal_bluetooth.te
index 53bbef2..2e03ea2 100644
--- a/private/hal_bluetooth.te
+++ b/private/hal_bluetooth.te
@@ -24,6 +24,7 @@
 # Allow write access to bluetooth-specific properties
 set_prop(hal_bluetooth, bluetooth_a2dp_offload_prop)
 set_prop(hal_bluetooth, bluetooth_audio_hal_prop)
+set_prop(hal_bluetooth, bluetooth_finder_prop)
 set_prop(hal_bluetooth, bluetooth_prop)
 set_prop(hal_bluetooth, exported_bluetooth_prop)
 
diff --git a/private/hal_face.te b/private/hal_face.te
index e14666a..5e43953 100644
--- a/private/hal_face.te
+++ b/private/hal_face.te
@@ -11,5 +11,5 @@
 allow hal_face ion_device:chr_file r_file_perms;
 
 # Allow read/write access to the face template directory.
-allow hal_face face_vendor_data_file:file create_file_perms;
-allow hal_face face_vendor_data_file:dir rw_dir_perms;
+allow {hal_face -coredomain} face_vendor_data_file:file create_file_perms;
+allow {hal_face -coredomain} face_vendor_data_file:dir rw_dir_perms;
diff --git a/private/hal_fingerprint.te b/private/hal_fingerprint.te
index a1d68be..3295cc7 100644
--- a/private/hal_fingerprint.te
+++ b/private/hal_fingerprint.te
@@ -15,6 +15,6 @@
 
 r_dir_file(hal_fingerprint, cgroup)
 r_dir_file(hal_fingerprint, cgroup_v2)
-r_dir_file(hal_fingerprint, sysfs)
+r_dir_file({hal_fingerprint -coredomain}, sysfs)
 
 
diff --git a/private/hal_keymint.te b/private/hal_keymint.te
index ba29956..6c7b577 100644
--- a/private/hal_keymint.te
+++ b/private/hal_keymint.te
@@ -4,5 +4,5 @@
 hal_attribute_service(hal_keymint, hal_remotelyprovisionedcomponent_service)
 binder_call(hal_keymint_server, servicemanager)
 
-allow hal_keymint_server tee_device:chr_file rw_file_perms;
-allow hal_keymint_server ion_device:chr_file r_file_perms;
+allow { hal_keymint_server -coredomain } tee_device:chr_file rw_file_perms;
+allow { hal_keymint_server -coredomain } ion_device:chr_file r_file_perms;
diff --git a/private/hal_keymint_system.te b/private/hal_keymint_system.te
new file mode 100644
index 0000000..0a20870
--- /dev/null
+++ b/private/hal_keymint_system.te
@@ -0,0 +1,7 @@
+type hal_keymint_system, domain, coredomain;
+hal_server_domain(hal_keymint_system, hal_keymint)
+
+type hal_keymint_system_exec, exec_type, system_file_type, file_type;
+init_daemon_domain(hal_keymint_system)
+
+allow hal_keymint_system self:vsock_socket { create_socket_perms_no_ioctl };
diff --git a/private/init.te b/private/init.te
index 8ab1aab..dbb3f02 100644
--- a/private/init.te
+++ b/private/init.te
@@ -82,6 +82,9 @@
 set_prop(init, init_perf_lsm_hooks_prop)
 set_prop(init, vts_status_prop)
 
+# Allow init to set 16kb app compatibility props
+set_prop(init, bionic_linker_16kb_app_compat_prop)
+
 # Allow accessing /sys/kernel/tracing/instances/bootreceiver to set up tracing.
 allow init debugfs_bootreceiver_tracing:file w_file_perms;
 
@@ -462,6 +465,7 @@
 allow init debugfs_tracing_instances:dir create_dir_perms;
 allow init debugfs_tracing_instances:file w_file_perms;
 allow init debugfs_wifi_tracing:file w_file_perms;
+allow init debugfs_wifi_tracing:dir create_dir_perms;
 
 # chown/chmod on pseudo files.
 allow init {
@@ -576,6 +580,7 @@
 allow init {
   sysfs_android_usb
   sysfs_dm_verity
+  sysfs_firmware_acpi_tables
   sysfs_leds
   sysfs_power
   sysfs_fs_f2fs
diff --git a/private/isolated_app_all.te b/private/isolated_app_all.te
index 12b1794..43f1ac6 100644
--- a/private/isolated_app_all.te
+++ b/private/isolated_app_all.te
@@ -70,7 +70,7 @@
 }:service_manager find;
 
 # Isolated apps shouldn't be able to access the driver directly.
-neverallow isolated_app_all gpu_device:chr_file { rw_file_perms execute };
+neverallow { isolated_app_all -isolated_compute_app } gpu_device:chr_file { rw_file_perms execute };
 
 # Do not allow isolated_apps access to /cache
 neverallow isolated_app_all cache_file:dir ~{ r_dir_perms };
diff --git a/private/isolated_compute_app.te b/private/isolated_compute_app.te
index 5d4070d..f34850e 100644
--- a/private/isolated_compute_app.te
+++ b/private/isolated_compute_app.te
@@ -32,6 +32,12 @@
 # Allow access to the toybox: b/275024392
 allow isolated_compute_app toolbox_exec:file rx_file_perms;
 
+# Grant GPU access to isolated_compute_app as it is required for acceleration.
+allow isolated_compute_app gpu_device:chr_file rw_file_perms;
+allow isolated_compute_app gpu_device:dir r_dir_perms;
+allow isolated_compute_app sysfs_gpu:file r_file_perms;
+
+
 #####
 ##### Neverallow
 #####
diff --git a/private/keystore.te b/private/keystore.te
index 53e5dd3..50542b0 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -20,6 +20,9 @@
 # Allow keystore to check if the system is rkp only.
 get_prop(keystore, remote_prov_prop)
 
+# Allow keystore to check whether to post-process RKP certificates
+get_prop(keystore, remote_prov_cert_prop)
+
 # Allow keystore to check rkpd feature flags
 get_prop(keystore, device_config_remote_key_provisioning_native_prop)
 
@@ -45,6 +48,7 @@
 binder_use(keystore)
 binder_service(keystore)
 binder_call(keystore, remote_provisioning_service_server)
+binder_call(keystore, rkp_cert_processor)
 binder_call(keystore, system_server)
 binder_call(keystore, wificond)
 
@@ -54,8 +58,9 @@
 
 add_service(keystore, keystore_service)
 allow keystore sec_key_att_app_id_provider_service:service_manager find;
-allow keystore dropbox_service:service_manager find;
 allow keystore remote_provisioning_service:service_manager find;
+allow keystore rkp_cert_processor_service:service_manager find;
+
 add_service(keystore, apc_service)
 add_service(keystore, keystore_compat_hal_service)
 add_service(keystore, authorization_service)
@@ -88,8 +93,7 @@
 neverallow { domain -keystore -init } keystore_data_file:dir *;
 neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
 
-# TODO(b/186868271): Remove the crash dump exception soon-ish (maybe by May 14, 2021?)
-neverallow { domain userdebug_or_eng(`-crash_dump') } keystore:process ptrace;
+neverallow * keystore:process ptrace;
 
 # Only keystore can set keystore.crash_count system property. Since init is allowed to set any
 # system property, an exception is added for init as well.
diff --git a/private/linux_vm_setup.te b/private/linux_vm_setup.te
new file mode 100644
index 0000000..ba483e8
--- /dev/null
+++ b/private/linux_vm_setup.te
@@ -0,0 +1,6 @@
+type linux_vm_setup, domain, coredomain;
+type linux_vm_setup_exec, system_file_type, exec_type, file_type;
+
+is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
+  init_daemon_domain(linux_vm_setup)
+')
diff --git a/private/lmkd.te b/private/lmkd.te
index 8d22552..97dc398 100644
--- a/private/lmkd.te
+++ b/private/lmkd.te
@@ -19,9 +19,9 @@
 allow lmkd fs_bpf:file read;
 allow lmkd bpfloader:bpf { map_read map_write prog_run };
 
-# Needed for polling directly from the bpf ring buffer's fd
-allow lmkd fs_bpf_lmkd_memevents_rb:file { read write };
-allow lmkd fs_bpf_lmkd_memevents_prog:file read;
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow lmkd fs_bpf_memevents:file { read write };
+allow lmkd fs_bpf_memevents:dir search;
 
 allow lmkd self:global_capability_class_set { dac_override dac_read_search sys_resource kill };
 
diff --git a/private/nfc.te b/private/nfc.te
index f1a08f7..7050d5a 100644
--- a/private/nfc.te
+++ b/private/nfc.te
@@ -33,3 +33,6 @@
 # the nfc process, from a file in
 # /data/data/com.android.shell/files/bugreports/bugreport-*.
 allow nfc shell_data_file:file read;
+
+# Allow to check whether security logging is enabled.
+get_prop(nfc, device_logging_prop)
diff --git a/private/otapreopt_chroot.te b/private/otapreopt_chroot.te
index 73e170b..2aeab0b 100644
--- a/private/otapreopt_chroot.te
+++ b/private/otapreopt_chroot.te
@@ -1,4 +1,5 @@
 # otapreopt_chroot executable
+starting_at_board_api(202504, `type otapreopt_chroot, domain;')
 typeattribute otapreopt_chroot coredomain;
 type otapreopt_chroot_exec, exec_type, file_type, system_file_type;
 
diff --git a/private/platform_app.te b/private/platform_app.te
index 320624c..e60dcdd 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -99,6 +99,7 @@
 allow platform_app system_api_service:service_manager find;
 allow platform_app vr_manager_service:service_manager find;
 allow platform_app stats_service:service_manager find;
+allow platform_app tradeinmode_service:service_manager find;
 
 # Allow platform apps to log via statsd.
 binder_call(platform_app, statsd)
diff --git a/private/priv_app.te b/private/priv_app.te
index bb5da7c..1ef5be1 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -136,6 +136,9 @@
 # Allow priv_apps to check whether Dynamic System Update is enabled
 get_prop(priv_app, dynamic_system_prop)
 
+# Allow privileged apps to read trade in mode property
+get_prop(priv_app, adbd_tradeinmode_prop)
+
 # suppress denials for non-API accesses.
 dontaudit priv_app exec_type:file getattr;
 dontaudit priv_app device:dir read;
diff --git a/private/profman.te b/private/profman.te
index 7071334..d1ce926 100644
--- a/private/profman.te
+++ b/private/profman.te
@@ -6,6 +6,7 @@
 allow profman {
   system_file
   apk_data_file
+  apk_tmp_file
   vendor_app_file
 }:file { getattr read map lock };
 
@@ -23,6 +24,7 @@
 allow profman asec_apk_file:file { read map };
 allow profman apk_data_file:file { getattr read map };
 allow profman apk_data_file:dir { getattr read search };
+allow profman apk_tmp_file:dir { getattr read search };
 
 allow profman oemfs:file { read map };
 # Reading an APK opens a ZipArchive, which unpack to tmpfs.
diff --git a/private/property.te b/private/property.te
index 1f94608..c746cb3 100644
--- a/private/property.te
+++ b/private/property.te
@@ -1,5 +1,6 @@
 # Properties used only in /system
 system_internal_prop(adbd_prop)
+system_internal_prop(adbd_tradeinmode_prop)
 system_internal_prop(apexd_payload_metadata_prop)
 system_internal_prop(ctl_snapuserd_prop)
 system_internal_prop(crashrecovery_prop)
@@ -19,6 +20,7 @@
 system_internal_prop(device_config_swcodec_native_prop)
 system_internal_prop(device_config_tethering_u_or_later_native_prop)
 system_internal_prop(dmesgd_start_prop)
+system_internal_prop(bert_collector_start_prop)
 system_internal_prop(fastbootd_protocol_prop)
 system_internal_prop(gsid_prop)
 system_internal_prop(init_perf_lsm_hooks_prop)
@@ -43,6 +45,7 @@
 system_internal_prop(profcollectd_node_id_prop)
 system_internal_prop(radio_cdma_ecm_prop)
 system_internal_prop(remote_prov_prop)
+system_internal_prop(remote_prov_cert_prop)
 system_internal_prop(rollback_test_prop)
 system_internal_prop(setupwizard_prop)
 system_internal_prop(snapshotctl_prop)
@@ -68,9 +71,11 @@
 system_internal_prop(hidl_memory_prop)
 system_internal_prop(suspend_debug_prop)
 system_internal_prop(system_service_enable_prop)
+system_internal_prop(ctl_artd_pre_reboot_prop)
 
 
 # Properties which can't be written outside system
+system_restricted_prop(bionic_linker_16kb_app_compat_prop)
 system_restricted_prop(device_config_virtualization_framework_native_prop)
 system_restricted_prop(fstype_prop)
 system_restricted_prop(log_file_logger_prop)
@@ -78,6 +83,18 @@
 system_restricted_prop(persist_sysui_ranking_update_prop)
 system_restricted_prop(page_size_prop)
 
+# Properties with no restrictions
+until_board_api(202504, `
+    system_public_prop(bluetooth_finder_prop)
+    system_public_prop(virtual_fingerprint_prop)
+')
+
+# These types will be public starting at board api 202504
+until_board_api(202504, `
+    system_restricted_prop(enable_16k_pages_prop)
+    system_restricted_prop(profcollectd_etr_prop)
+')
+
 # Properties which should only be written by vendor_init
 system_vendor_config_prop(avf_virtualizationservice_prop)
 system_vendor_config_prop(high_barometer_quality_prop)
@@ -493,6 +510,7 @@
   -init
   -vendor_init
   -adbd
+  -adbd_tradeinmode
   -system_server
 } {
   adbd_config_prop
@@ -503,6 +521,7 @@
   domain
   -init
   -adbd
+  -adbd_tradeinmode
 } {
   adbd_prop
 }:property_service set;
@@ -769,6 +788,11 @@
 } remote_prov_prop:property_service set;
 
 neverallow {
+  domain
+  -init
+} remote_prov_cert_prop:property_service set;
+
+neverallow {
   # Only allow init and shell to set rollback_test_prop
   domain
   -init
@@ -834,3 +858,9 @@
   -init
   -vendor_init
 } pm_archiving_enabled_prop:property_service set;
+
+neverallow {
+  domain
+  -init
+  userdebug_or_eng(`-su')
+} bionic_linker_16kb_app_compat_prop:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index f631f8f..ea2df66 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -51,6 +51,7 @@
 security.lower_kptr_restrict u:object_r:lower_kptr_restrict_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tls.port    u:object_r:adbd_prop:s0
+persist.adb.tradeinmode u:object_r:adbd_tradeinmode_prop:s0
 persist.adb.wifi.       u:object_r:adbd_prop:s0
 persist.adb.tls_server.enable  u:object_r:system_adbd_prop:s0
 
@@ -202,6 +203,11 @@
 ctl.stop$snapuserd      u:object_r:ctl_snapuserd_prop:s0
 ctl.restart$snapuserd   u:object_r:ctl_snapuserd_prop:s0
 
+# Restrict access to starting/stopping artd_pre_reboot.
+ctl.start$artd_pre_reboot          u:object_r:ctl_artd_pre_reboot_prop:s0
+ctl.stop$artd_pre_reboot           u:object_r:ctl_artd_pre_reboot_prop:s0
+ctl.restart$artd_pre_reboot        u:object_r:ctl_artd_pre_reboot_prop:s0
+
 # NFC properties
 nfc.                    u:object_r:nfc_prop:s0
 
@@ -314,6 +320,7 @@
 apexd.config.dm_create.timeout           u:object_r:apexd_config_prop:s0 exact uint
 apexd.config.loop_wait.attempts          u:object_r:apexd_config_prop:s0 exact uint
 apexd.config.boot_activation.threads     u:object_r:apexd_config_prop:s0 exact uint
+apexd.config.loopback.readahead          u:object_r:apexd_config_prop:s0 exact uint
 persist.apexd.          u:object_r:apexd_prop:s0
 persist.vendor.apex.    u:object_r:apexd_select_prop:s0
 ro.boot.vendor.apex.    u:object_r:apexd_select_prop:s0
@@ -582,6 +589,7 @@
 persist.bluetooth.btsnoopenable                             u:object_r:exported_bluetooth_prop:s0 exact bool
 persist.bluetooth.btsnoopdefaultmode                        u:object_r:bluetooth_prop:s0 exact enum empty disabled filtered full
 persist.bluetooth.btsnooplogmode                            u:object_r:bluetooth_prop:s0 exact enum empty disabled filtered full
+persist.bluetooth.finder.supported                          u:object_r:bluetooth_finder_prop:s0 exact bool
 persist.bluetooth.snooplogfilter.headers.enabled            u:object_r:bluetooth_prop:s0 exact bool
 persist.bluetooth.snooplogfilter.profiles.a2dp.enabled      u:object_r:bluetooth_prop:s0 exact bool
 persist.bluetooth.snooplogfilter.profiles.map               u:object_r:bluetooth_prop:s0 exact enum empty disabled fullfilter header magic
@@ -666,6 +674,7 @@
 bluetooth.core.le.inquiry_scan_window                u:object_r:bluetooth_config_prop:s0 exact uint
 
 bluetooth.core.le.vendor_capabilities.enabled        u:object_r:bluetooth_config_prop:s0 exact bool
+bluetooth.hfp.software_datapath.enabled              u:object_r:bluetooth_config_prop:s0 exact bool
 bluetooth.sco.disable_enhanced_connection            u:object_r:bluetooth_config_prop:s0 exact bool
 bluetooth.sco.managed_by_audio                       u:object_r:bluetooth_config_prop:s0 exact bool
 bluetooth.core.le.dsa_transport_preference           u:object_r:bluetooth_config_prop:s0 exact string
@@ -862,6 +871,8 @@
 
 dmesgd.start u:object_r:dmesgd_start_prop:s0 exact bool
 
+acpi.bert_collector.start u:object_r:bert_collector_start_prop:s0 exact bool
+
 odsign.key.done u:object_r:odsign_prop:s0 exact bool
 odsign.verification.done u:object_r:odsign_prop:s0 exact bool
 odsign.verification.success u:object_r:odsign_prop:s0 exact bool
@@ -1005,6 +1016,7 @@
 ro.build.date.utc                         u:object_r:build_prop:s0 exact int
 ro.build.description                      u:object_r:build_prop:s0 exact string
 ro.build.display.id                       u:object_r:build_prop:s0 exact string
+ro.build.critical_issues.fixed_issues.long_list u:object_r:build_prop:s0 exact string
 ro.build.flavor                           u:object_r:build_prop:s0 exact string
 ro.build.host                             u:object_r:build_prop:s0 exact string
 ro.build.id                               u:object_r:build_prop:s0 exact string
@@ -1267,6 +1279,8 @@
 ro.bionic.arch            u:object_r:cpu_variant_prop:s0 exact string
 ro.bionic.cpu_variant     u:object_r:cpu_variant_prop:s0 exact string
 
+bionic.linker.16kb.app_compat.enabled u:object_r:bionic_linker_16kb_app_compat_prop:s0 exact bool
+
 ro.board.platform u:object_r:exported_default_prop:s0 exact string
 
 ro.boot.fake_battery         u:object_r:exported_default_prop:s0 exact int
@@ -1529,6 +1543,9 @@
 # Hostname for the remote provisioning server a device should communicate with
 remote_provisioning.hostname u:object_r:remote_prov_prop:s0 exact string
 
+# Support for post-processing RKP certificates
+remote_provisioning.use_cert_processor u:object_r:remote_prov_cert_prop:s0 exact bool
+
 # Connection Timeout for remote provisioning step
 remote_provisioning.connect_timeout_millis u:object_r:remote_prov_prop:s0 exact int
 
@@ -1602,6 +1619,7 @@
 
 # bootanimation properties
 ro.bootanim.quiescent.enabled u:object_r:bootanim_config_prop:s0 exact bool
+ro.product.bootanim.file u:object_r:bootanim_config_prop:s0 exact string
 
 # dck properties
 ro.gms.dck.eligible_wcc u:object_r:dck_prop:s0 exact int
@@ -1639,32 +1657,32 @@
 vendor.face.virtual.operation_authenticate_duration u:object_r:virtual_face_hal_prop:s0 exact int
 
 # properties for the virtual Fingerprint HAL
-persist.vendor.fingerprint.virtual.type u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-persist.vendor.fingerprint.virtual.enrollments u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-persist.vendor.fingerprint.virtual.lockout u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-persist.vendor.fingerprint.virtual.authenticator_id u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-persist.vendor.fingerprint.virtual.sensor_location u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-persist.vendor.fingerprint.virtual.sensor_id u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-persist.vendor.fingerprint.virtual.sensor_strength u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-persist.vendor.fingerprint.virtual.max_enrollments u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-persist.vendor.fingerprint.virtual.navigation_guesture u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-persist.vendor.fingerprint.virtual.detect_interaction u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-persist.vendor.fingerprint.virtual.udfps.display_touch u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-persist.vendor.fingerprint.virtual.udfps.control_illumination u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-persist.vendor.fingerprint.virtual.lockout_enable u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-persist.vendor.fingerprint.virtual.lockout_timed_threshold u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-persist.vendor.fingerprint.virtual.lockout_timed_duration u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-persist.vendor.fingerprint.virtual.lockout_permanent_threshold u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-vendor.fingerprint.virtual.enrollment_hit u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-vendor.fingerprint.virtual.next_enrollment u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-vendor.fingerprint.virtual.challenge u:object_r:virtual_fingerprint_hal_prop:s0 exact int
-vendor.fingerprint.virtual.operation_authenticate_fails u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-vendor.fingerprint.virtual.operation_detect_interaction_fails u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-vendor.fingerprint.virtual.operation_enroll_fails u:object_r:virtual_fingerprint_hal_prop:s0 exact bool
-vendor.fingerprint.virtual.operation_authenticate_latency u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-vendor.fingerprint.virtual.operation_detect_interaction_latency u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-vendor.fingerprint.virtual.operation_enroll_latency u:object_r:virtual_fingerprint_hal_prop:s0 exact string
-vendor.fingerprint.virtual.operation_authenticate_duration u:object_r:virtual_fingerprint_hal_prop:s0 exact int
+persist.vendor.fingerprint.virtual.type u:object_r:virtual_fingerprint_prop:s0 exact string
+persist.vendor.fingerprint.virtual.enrollments u:object_r:virtual_fingerprint_prop:s0 exact string
+persist.vendor.fingerprint.virtual.lockout u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.authenticator_id u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.sensor_location u:object_r:virtual_fingerprint_prop:s0 exact string
+persist.vendor.fingerprint.virtual.sensor_id u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.sensor_strength u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.max_enrollments u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.navigation_guesture u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.detect_interaction u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.udfps.display_touch u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.udfps.control_illumination u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.lockout_enable u:object_r:virtual_fingerprint_prop:s0 exact bool
+persist.vendor.fingerprint.virtual.lockout_timed_threshold u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.lockout_timed_duration u:object_r:virtual_fingerprint_prop:s0 exact int
+persist.vendor.fingerprint.virtual.lockout_permanent_threshold u:object_r:virtual_fingerprint_prop:s0 exact int
+vendor.fingerprint.virtual.enrollment_hit u:object_r:virtual_fingerprint_prop:s0 exact int
+vendor.fingerprint.virtual.next_enrollment u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.challenge u:object_r:virtual_fingerprint_prop:s0 exact int
+vendor.fingerprint.virtual.operation_authenticate_fails u:object_r:virtual_fingerprint_prop:s0 exact bool
+vendor.fingerprint.virtual.operation_detect_interaction_fails u:object_r:virtual_fingerprint_prop:s0 exact bool
+vendor.fingerprint.virtual.operation_enroll_fails u:object_r:virtual_fingerprint_prop:s0 exact bool
+vendor.fingerprint.virtual.operation_authenticate_latency u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.operation_detect_interaction_latency u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.operation_enroll_latency u:object_r:virtual_fingerprint_prop:s0 exact string
+vendor.fingerprint.virtual.operation_authenticate_duration u:object_r:virtual_fingerprint_prop:s0 exact int
 
 # properties for tuner
 ro.tuner.lazyhal    u:object_r:tuner_config_prop:s0 exact bool
diff --git a/private/rkp_cert_processor.te b/private/rkp_cert_processor.te
new file mode 100644
index 0000000..578bd4c
--- /dev/null
+++ b/private/rkp_cert_processor.te
@@ -0,0 +1,12 @@
+# Cert processor service
+type rkp_cert_processor, domain, coredomain;
+type rkp_cert_processor_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(rkp_cert_processor)
+net_domain(rkp_cert_processor)
+
+binder_use(rkp_cert_processor)
+
+add_service(rkp_cert_processor, rkp_cert_processor_service)
+
+use_bootstrap_libs(rkp_cert_processor)
diff --git a/private/sdk_sandbox_all.te b/private/sdk_sandbox_all.te
index b4c655b..41b2799 100644
--- a/private/sdk_sandbox_all.te
+++ b/private/sdk_sandbox_all.te
@@ -124,3 +124,25 @@
 # Only dirs should be created at sdk_sandbox_all_system_data_file level
 neverallow { domain -init } sdk_sandbox_system_data_file:file *;
 
+# Restrict unix stream sockets for IPC.
+neverallow sdk_sandbox_all {
+    domain
+    -sdk_sandbox_all
+    -netd
+    -logd
+    -adbd
+    userdebug_or_eng(`-su')
+    # needed for profiling
+    -traced
+    -traced_perf
+    -heapprofd
+    # fallback crash handling for processes that can't exec crash_dump.
+    -tombstoned
+    # needed to connect to PRNG seeder daemon.
+    -prng_seeder
+}:unix_stream_socket connectto;
+neverallow {
+    domain
+    -adbd
+    -sdk_sandbox_all
+} sdk_sandbox_all:unix_stream_socket connectto;
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 907861c..ce49fc4 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -223,4 +223,5 @@
 user=_app fromRunAs=true domain=runas_app levelFrom=user
 user=_app isPrivApp=true name=com.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
 user=_app isPrivApp=true name=com.google.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
-user=_app isPrivApp=true name=com.android.virtualization.ferrochrome domain=ferrochrome_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.android.virtualization.terminal domain=vmlauncher_app type=privapp_data_file levelFrom=all
+user=_app isPrivApp=true name=com.google.android.virtualization.terminal domain=vmlauncher_app type=privapp_data_file levelFrom=all
diff --git a/private/service.te b/private/service.te
index 63259c6..08a032a 100644
--- a/private/service.te
+++ b/private/service.te
@@ -1,5 +1,10 @@
 type adaptive_auth_service,          system_server_service, service_manager_type;
 type ambient_context_service,        app_api_service, system_server_service, service_manager_type;
+
+# These types will be public starting at board api 202504
+until_board_api(202504, `
+    type app_function_service, app_api_service, system_server_service, service_manager_type;
+')
 type attention_service,              system_server_service, service_manager_type;
 type bg_install_control_service,     system_api_service, system_server_service, service_manager_type;
 type compos_service,                 service_manager_type;
@@ -17,16 +22,21 @@
 type resolver_service,               system_server_service, service_manager_type;
 type rkpd_registrar_service,         service_manager_type;
 type rkpd_refresh_service,           service_manager_type;
+type rkp_cert_processor_service,     service_manager_type;
 type safety_center_service,          app_api_service, system_api_service, system_server_service, service_manager_type;
 type stats_service,                  service_manager_type;
 type statsbootstrap_service,         system_server_service, service_manager_type;
 type statscompanion_service,         system_server_service, service_manager_type;
 type statsmanager_service,           system_api_service, system_server_service, service_manager_type;
+until_board_api(202504, `
+    type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
 
 is_flag_enabled(RELEASE_SUPERVISION_SERVICE, `
     type supervision_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 ')
 type tracingproxy_service,          system_server_service, service_manager_type;
+type tradeinmode_service,           system_server_service, service_manager_type;
 type transparency_service,          system_server_service, service_manager_type;
 
 is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
diff --git a/private/service_contexts b/private/service_contexts
index 71abb42..8cab6ea 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -26,8 +26,10 @@
 android.hardware.automotive.vehicle.IVehicle/default                 u:object_r:hal_vehicle_service:s0
 android.hardware.biometrics.face.IFace/default                       u:object_r:hal_face_service:s0
 android.hardware.biometrics.face.IFace/virtual                       u:object_r:hal_face_service:s0
+android.hardware.biometrics.face.virtualhal.IVirtualHal/virtual      u:object_r:hal_face_service:s0
 android.hardware.biometrics.fingerprint.IFingerprint/default         u:object_r:hal_fingerprint_service:s0
 android.hardware.biometrics.fingerprint.IFingerprint/virtual         u:object_r:hal_fingerprint_service:s0
+android.hardware.biometrics.fingerprint.virtualhal.IVirtualHal/virtual u:object_r:hal_fingerprint_service:s0
 android.hardware.bluetooth.IBluetoothHci/default                     u:object_r:hal_bluetooth_service:s0
 android.hardware.bluetooth.finder.IBluetoothFinder/default           u:object_r:hal_bluetooth_service:s0
 is_flag_enabled(RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE, `
@@ -144,6 +146,9 @@
 adaptive_auth                             u:object_r:adaptive_auth_service:s0
 adb                                       u:object_r:adb_service:s0
 adservices_manager                        u:object_r:adservices_manager_service:s0
+starting_at_board_api(202504, `
+    advanced_protection                       u:object_r:advanced_protection_service:s0
+')
 aidl_lazy_test_1                          u:object_r:aidl_lazy_test_service:s0
 aidl_lazy_test_2                          u:object_r:aidl_lazy_test_service:s0
 aidl_lazy_test_quit                       u:object_r:aidl_lazy_test_service:s0
@@ -332,6 +337,7 @@
 media_communication                       u:object_r:media_communication_service:s0
 media_metrics                             u:object_r:media_metrics_service:s0
 media_projection                          u:object_r:media_projection_service:s0
+media_quality                             u:object_r:media_quality_service:s0
 media_resource_monitor                    u:object_r:media_session_service:s0
 media_router                              u:object_r:media_router_service:s0
 media_session                             u:object_r:media_session_service:s0
@@ -381,6 +387,9 @@
 radio.phonesubinfo                        u:object_r:radio_service:s0
 radio.phone                               u:object_r:radio_service:s0
 radio.sms                                 u:object_r:radio_service:s0
+is_flag_enabled(RELEASE_RANGING_STACK, `
+    ranging                               u:object_r:ranging_service:s0
+')
 rcs                                       u:object_r:radio_service:s0
 reboot_readiness                          u:object_r:reboot_readiness_service:s0
 recovery                                  u:object_r:recovery_service:s0
@@ -391,6 +400,7 @@
 restrictions                              u:object_r:restrictions_service:s0
 rkpd.registrar                            u:object_r:rkpd_registrar_service:s0
 rkpd.refresh                              u:object_r:rkpd_refresh_service:s0
+rkp_cert_processor.service                u:object_r:rkp_cert_processor_service:s0
 role                                      u:object_r:role_service:s0
 rollback                                  u:object_r:rollback_service:s0
 rttmanager                                u:object_r:rttmanager_service:s0
@@ -457,6 +467,7 @@
 thermalservice                            u:object_r:thermal_service:s0
 thread_network                            u:object_r:threadnetwork_service:s0
 tracing.proxy                             u:object_r:tracingproxy_service:s0
+tradeinmode                               u:object_r:tradeinmode_service:s0
 translation                               u:object_r:translation_service:s0
 transparency                              u:object_r:transparency_service:s0
 trust                                     u:object_r:trust_service:s0
diff --git a/private/shell.te b/private/shell.te
index 18e3462..839178c 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -273,12 +273,6 @@
 # TODO (b/350628688): Remove this once it's safe to do so.
 allow shell oatdump_exec:file rx_file_perms;
 
-# Allow shell access to socket for test
-userdebug_or_eng(`
-    allow shell aconfigd_socket:sock_file write;
-    allow shell aconfigd:unix_stream_socket connectto;
-')
-
 # Create and use network sockets.
 net_domain(shell)
 
@@ -479,7 +473,7 @@
 allow shell vendor_shell_exec:file rx_file_perms;
 
 is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
-  allow shell custom_vm_setup_exec:file { entrypoint r_file_perms };
+  allow shell linux_vm_setup_exec:file { entrypoint r_file_perms };
 ')
 
 # Everything is labeled as rootfs in recovery mode. Allow shell to
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index be3244e..1e0e1ef 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -140,6 +140,8 @@
 allow surfaceflinger statsmanager_service:service_manager find;
 # TODO(146461633): remove this once native pullers talk to StatsManagerService
 binder_call(surfaceflinger, statsd);
+# Allow pushing atoms to the stats bootstrap atom service
+allow surfaceflinger statsbootstrap_service:service_manager find;
 
 # Allow to use files supplied by hal_evs
 allow surfaceflinger hal_evs:fd use;
@@ -147,10 +149,6 @@
 # Allow to use release fence fds supplied by hal_camera
 allow surfaceflinger hal_camera:fd use;
 
-# Allow pushing jank event atoms to statsd
-userdebug_or_eng(`
-    unix_socket_send(surfaceflinger, statsdw, statsd)
-')
 
 # Surfaceflinger should not be reading default vendor-defined properties.
 dontaudit surfaceflinger vendor_default_prop:file read;
diff --git a/private/system_app.te b/private/system_app.te
index e0ed8c3..0b6ffe2 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -151,7 +151,7 @@
   proc_version
 }:file r_file_perms;
 
-# Settings app writes to /dev/stune/foreground/tasks.
+# Allow system apps to modify cgroup attributes and migrate processes
 allow system_app cgroup:file w_file_perms;
 allow system_app cgroup_v2:file w_file_perms;
 allow system_app cgroup_v2:dir w_dir_perms;
diff --git a/private/system_server.te b/private/system_server.te
index 0385df3..6a13816 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -774,6 +774,7 @@
 set_prop(system_server, ctl_default_prop)
 set_prop(system_server, ctl_bugreport_prop)
 set_prop(system_server, ctl_gsid_prop)
+set_prop(system_server, ctl_artd_pre_reboot_prop)
 
 # cppreopt property
 set_prop(system_server, cppreopt_prop)
@@ -1133,9 +1134,9 @@
 
 # Connect to adbd and use a socket transferred from it.
 # Used for e.g. jdwp.
-allow system_server adbd:unix_stream_socket connectto;
-allow system_server adbd:fd use;
-allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
+allow system_server adbd_common:unix_stream_socket connectto;
+allow system_server adbd_common:fd use;
+allow system_server adbd_common:unix_stream_socket { getattr getopt ioctl read write shutdown };
 
 # Read service.adb.tls.port, persist.adb.wifi. properties
 get_prop(system_server, adbd_prop)
@@ -1143,6 +1144,9 @@
 # Set persist.adb.tls_server.enable property
 set_prop(system_server, system_adbd_prop)
 
+# Set service.adbd.tradeinmode from ITradeInService.
+set_prop(system_server, adbd_tradeinmode_prop)
+
 # Allow invoking tools like "timeout"
 allow system_server toolbox_exec:file rx_file_perms;
 
@@ -1236,6 +1240,10 @@
 # calls if (fd.isSocket$()) if (isLingerSocket(fd)) ...
 dontaudit system_server self:key_socket getopt;
 
+# Needed to interact with memevents-eBPF and receive notifications for memory events
+allow system_server fs_bpf_memevents:dir search;
+allow system_server fs_bpf_memevents:file { read write };
+
 # Allow system_server to start clatd in its own domain and kill it.
 domain_auto_trans(system_server, clatd_exec, clatd)
 allow system_server clatd:process { sigkill signal };
@@ -1442,6 +1450,9 @@
 # Allow system server to read /apex/apex-info-list.xml
 allow system_server apex_info_file:file r_file_perms;
 
+# Allow system_server to communicate with tradeinmode.
+binder_call(system_server, tradeinmode)
+
 # Allow system server to communicate to system-suspend's control interface
 allow system_server system_suspend_control_internal_service:service_manager find;
 allow system_server system_suspend_control_service:service_manager find;
diff --git a/private/tradeinmode.te b/private/tradeinmode.te
new file mode 100644
index 0000000..05315a4
--- /dev/null
+++ b/private/tradeinmode.te
@@ -0,0 +1,26 @@
+### trade-in mode
+
+type tradeinmode, domain, coredomain;
+type tradeinmode_exec, exec_type, file_type, system_file_type;
+
+allow tradeinmode adbd_tradeinmode:fd use;
+
+allow tradeinmode adbd_tradeinmode:unix_stream_socket { read write ioctl };
+allow tradeinmode devpts:chr_file rw_file_perms;
+
+# Allow executing am/content without a domain transition.
+allow tradeinmode system_file:file rx_file_perms;
+allow tradeinmode zygote_exec:file rx_file_perms;
+allow tradeinmode apex_info_file:file r_file_perms;
+
+allow tradeinmode activity_service:service_manager find;
+
+get_prop(tradeinmode, odsign_prop)
+get_prop(tradeinmode, build_attestation_prop)
+
+# Needed to start activities through "am".
+binder_call(tradeinmode, system_server)
+binder_call(tradeinmode, servicemanager)
+
+# Needed to run "content".
+binder_call(tradeinmode, platform_app)
diff --git a/private/vendor_init.te b/private/vendor_init.te
index 72157ad..84ec60e 100644
--- a/private/vendor_init.te
+++ b/private/vendor_init.te
@@ -221,9 +221,6 @@
 # Write to /proc/sys/vm/page-cluster
 allow vendor_init proc_page_cluster:file w_file_perms;
 
-# Write to /proc/sys/vm/compaction_proactiveness
-allow vendor_init proc_compaction_proactiveness:file w_file_perms;
-
 # Write to sysfs nodes.
 allow vendor_init sysfs_type:dir r_dir_perms;
 allow vendor_init sysfs_type:lnk_file read;
diff --git a/private/virtual_camera.te b/private/virtual_camera.te
index 0faf0c5..c4fa6a1 100644
--- a/private/virtual_camera.te
+++ b/private/virtual_camera.te
@@ -28,9 +28,7 @@
 # Allow virtual_camera to use fd from apps
 allow virtual_camera { appdomain -isolated_app }:fd use;
 
-# Allow virtual_camera to use fd from surface flinger
-allow virtual_camera surfaceflinger:fd use;
-allow virtual_camera surfaceflinger:binder call;
+binder_call(virtual_camera, surfaceflinger);
 
 # Only allow virtual_camera to add a virtual_camera_service and no one else.
 add_service(virtual_camera, virtual_camera_service);
@@ -41,7 +39,7 @@
 # Allow virtual_camera to use GPU
 allow virtual_camera gpu_device:chr_file rw_file_perms;
 allow virtual_camera gpu_device:dir r_dir_perms;
-allow virtual_camera sysfs_gpu:file r_file_perms;
+r_dir_file(virtual_camera, sysfs_gpu)
 
 # Allow virtual camera to use graphics composer fd-s (fences).
 allow virtual_camera hal_graphics_composer:fd use;
diff --git a/private/virtual_face.te b/private/virtual_face.te
new file mode 100644
index 0000000..0e33d6b
--- /dev/null
+++ b/private/virtual_face.te
@@ -0,0 +1,6 @@
+# biometric virtual face sensor
+type virtual_face, domain;
+type virtual_face_exec, system_file_type, exec_type, file_type;
+hal_server_domain(virtual_face, hal_face)
+typeattribute virtual_face coredomain;
+init_daemon_domain(virtual_face)
diff --git a/private/virtual_fingerprint.te b/private/virtual_fingerprint.te
new file mode 100644
index 0000000..be20e24
--- /dev/null
+++ b/private/virtual_fingerprint.te
@@ -0,0 +1,7 @@
+# biometric virtual fingerprint sensor
+type virtual_fingerprint, domain;
+type virtual_fingerprint_exec, system_file_type, exec_type, file_type;
+hal_server_domain(virtual_fingerprint, hal_fingerprint)
+typeattribute virtual_fingerprint coredomain;
+init_daemon_domain(virtual_fingerprint)
+set_prop(virtual_fingerprint, virtual_fingerprint_prop)
diff --git a/private/virtualizationmanager.te b/private/virtualizationmanager.te
index 9b3cfcf..023e3e9 100644
--- a/private/virtualizationmanager.te
+++ b/private/virtualizationmanager.te
@@ -70,12 +70,24 @@
 # Allow virtualizationmanager to be read custom pvmfw.img configuration
 userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_pvmfw_prop)')
 dontaudit virtualizationmanager hypervisor_pvmfw_prop:file read;
-neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_pvmfw_prop:file no_rw_file_perms;
+neverallow {
+  domain
+  -init
+  -dumpstate
+  userdebug_or_eng(`-virtualizationmanager')
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr)
+} hypervisor_pvmfw_prop:file no_rw_file_perms;
 
 # Allow virtualizationmanager to be read custom virtualizationmanager configuration
 userdebug_or_eng(`get_prop(virtualizationmanager, hypervisor_virtualizationmanager_prop)')
 dontaudit virtualizationmanager hypervisor_virtualizationmanager_prop:file read;
-neverallow { domain -init -dumpstate userdebug_or_eng(`-virtualizationmanager') } hypervisor_virtualizationmanager_prop:file no_rw_file_perms;
+neverallow {
+  domain
+  -init
+  -dumpstate
+  userdebug_or_eng(`-virtualizationmanager')
+  is_flag_enabled(RELEASE_AVF_ENABLE_EARLY_VM, -early_virtmgr)
+} hypervisor_virtualizationmanager_prop:file no_rw_file_perms;
 
 # Allow virtualizationmanager service to talk to tombstoned to push guest ramdumps
 unix_socket_connect(virtualizationmanager, tombstoned_crash, tombstoned)
diff --git a/private/vmlauncher_app.te b/private/vmlauncher_app.te
index f0f372b..71c9f3f 100644
--- a/private/vmlauncher_app.te
+++ b/private/vmlauncher_app.te
@@ -2,6 +2,7 @@
 typeattribute vmlauncher_app coredomain;
 
 app_domain(vmlauncher_app)
+net_domain(vmlauncher_app)
 
 allow vmlauncher_app app_api_service:service_manager find;
 allow vmlauncher_app system_api_service:service_manager find;
@@ -10,6 +11,8 @@
 allow vmlauncher_app shell_data_file:file { read open write };
 virtualizationservice_use(vmlauncher_app)
 
+allow vmlauncher_app fsck_exec:file { r_file_perms execute execute_no_trans };
+
 is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
   # TODO(b/332677707): remove them when display service uses binder RPC.
   allow vmlauncher_app virtualization_service:service_manager find;
@@ -23,3 +26,6 @@
   # Allow other processes to access the pts.
   allow vmlauncher_app vmlauncher_app_devpts:chr_file setattr;
 ')
+
+# TODO(b/372664601): Remove this when we don't need linux_vm_setup
+set_prop(vmlauncher_app, debug_prop);
diff --git a/public/device.te b/public/device.te
index beafdf2..835b532 100644
--- a/public/device.te
+++ b/public/device.te
@@ -25,7 +25,7 @@
 type console_device, dev_type;
 type fscklogs, dev_type;
 # GPU (used by most UI apps)
-type gpu_device, dev_type, mlstrustedobject;
+type gpu_device, dev_type, mlstrustedobject, isolated_compute_allowed_device;
 type graphics_device, dev_type;
 type hw_random_device, dev_type;
 type input_device, dev_type;
diff --git a/public/file.te b/public/file.te
index b28ca85..4f187ec 100644
--- a/public/file.te
+++ b/public/file.te
@@ -23,11 +23,6 @@
 type proc_kpageflags, fs_type, proc_type;
 type proc_watermark_boost_factor, fs_type, proc_type;
 type proc_percpu_pagelist_high_fraction, fs_type, proc_type;
-
-starting_at_board_api(202504, `
-    type proc_compaction_proactiveness, fs_type, proc_type;
-')
-
 # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
 type usermodehelper, fs_type, proc_type;
 type sysfs_usermodehelper, fs_type, sysfs_type;
@@ -155,12 +150,6 @@
 type fs_bpf_tethering, fs_type, bpffs_type;
 type fs_bpf_vendor, fs_type, bpffs_type;
 
-starting_at_board_api(202504, `
-    type fs_bpf_lmkd_memevents_rb, fs_type, bpffs_type;
-    type fs_bpf_lmkd_memevents_prog, fs_type, bpffs_type;
-')
-
-
 type configfs, fs_type;
 # /sys/devices/cs_etm
 type sysfs_devices_cs_etm, fs_type, sysfs_type;
diff --git a/public/otapreopt_chroot.te b/public/otapreopt_chroot.te
index 8a625f5..eb340c8 100644
--- a/public/otapreopt_chroot.te
+++ b/public/otapreopt_chroot.te
@@ -1,7 +1,7 @@
 # otapreopt_chroot seclabel
 
 # TODO: Only present to allow mediatek/wembley-sepolicy to see it for validation reasons.
-type otapreopt_chroot, domain;
+until_board_api(202504, `type otapreopt_chroot, domain;')
 
 # system/sepolicy/public is for vendor-facing type and attribute definitions.
 # DO NOT ADD allow, neverallow, or dontaudit statements here.
diff --git a/public/property.te b/public/property.te
index 47a1bde..fa89cbb 100644
--- a/public/property.te
+++ b/public/property.te
@@ -212,6 +212,9 @@
 system_public_prop(audio_prop)
 system_public_prop(bluetooth_a2dp_offload_prop)
 system_public_prop(bluetooth_audio_hal_prop)
+starting_at_board_api(202504, `
+    system_public_prop(bluetooth_finder_prop)
+')
 system_public_prop(bluetooth_prop)
 system_public_prop(bpf_progs_loaded_prop)
 system_public_prop(charger_status_prop)
@@ -273,10 +276,13 @@
 vendor_internal_prop(rebootescrow_hal_prop)
 
 # Properties used in the default Face HAL implementations
-vendor_internal_prop(virtual_face_hal_prop)
+system_public_prop(virtual_face_hal_prop)
 
 # Properties used in the default Fingerprint HAL implementations
 vendor_internal_prop(virtual_fingerprint_hal_prop)
+starting_at_board_api(202504, `
+    system_public_prop(virtual_fingerprint_prop)
+')
 
 vendor_public_prop(persist_vendor_debug_wifi_prop)
 
diff --git a/public/service.te b/public/service.te
index 0982629..cc9b1ab 100644
--- a/public/service.te
+++ b/public/service.te
@@ -66,6 +66,9 @@
 type activity_task_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type adb_service, system_api_service, system_server_service, service_manager_type;
 type adservices_manager_service, system_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+    type advanced_protection_service, app_api_service, system_server_service, service_manager_type;
+')
 type alarm_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type app_binding_service, system_server_service, service_manager_type;
 starting_at_board_api(202504, `
@@ -173,6 +176,9 @@
 type media_communication_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_metrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_projection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+    type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
 type media_router_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_session_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type meminfo_service, system_api_service, system_server_service, service_manager_type;
@@ -198,13 +204,16 @@
 type permission_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type permissionmgr_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type permission_checker_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
-type persistent_data_block_service, system_api_service, system_server_service, service_manager_type;
+type persistent_data_block_service, app_api_service, system_api_service, system_server_service, service_manager_type;
 type pinner_service, system_server_service, service_manager_type;
 type powerstats_service, app_api_service, system_server_service, service_manager_type;
 type power_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type print_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type processinfo_service, system_server_service, service_manager_type;
 type procstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+is_flag_enabled(RELEASE_RANGING_STACK, `
+    type ranging_service, app_api_service, system_server_service, service_manager_type;
+')
 type reboot_readiness_service, app_api_service, system_server_service, service_manager_type;
 type recovery_service, system_server_service, service_manager_type;
 type registry_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
diff --git a/public/te_macros b/public/te_macros
index 6d7533a..e446f56 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -203,6 +203,34 @@
 allow $1 virtualizationservice_data_file:file { getattr read };
 ')
 
+####################################
+# early_virtmgr_use(domain)
+# Allow domain to create and communicate with an early virtual machine using
+# early_virtmgr.
+define(`early_virtmgr_use', `
+# Transition to early_virtmgr when the client executes it.
+domain_auto_trans($1, early_virtmgr_exec, early_virtmgr)
+# Allow early_virtmgr to communicate over UDS with the client.
+allow { early_virtmgr crosvm } $1:unix_stream_socket { ioctl getattr read write };
+# Let the client pass file descriptors to early_virtmgr and on to crosvm.
+allow { early_virtmgr crosvm } $1:fd use;
+allow { early_virtmgr crosvm } $1_tmpfs:file rw_file_perms;
+# Let the client use file descriptors created by early_virtmgr.
+allow $1 early_virtmgr:fd use;
+# Allow piping console log to the client
+allow { early_virtmgr crosvm } $1:fifo_file { ioctl getattr read write };
+# Allow client to read/write vsock created by early_virtmgr to communicate with the VM
+# that it created. Notice that we do not grant permission to create a vsock;
+# the client can only connect to VMs that it owns.
+allow $1 early_virtmgr:vsock_socket { getattr getopt read write };
+# Allow client to inspect hypervisor capabilities
+get_prop($1, hypervisor_prop)
+# Allow early_virtmgr to read the path of the client using /proc/{PID}/exe
+allow early_virtmgr $1:dir search;
+allow early_virtmgr $1:file read;
+allow early_virtmgr $1:lnk_file read;
+')
+
 #####################################
 # app_domain(domain)
 # Allow a base set of permissions required for all apps.
diff --git a/tests/sepolicy_freeze_test.py b/tests/sepolicy_freeze_test.py
index fa05eb1..b9b935c 100644
--- a/tests/sepolicy_freeze_test.py
+++ b/tests/sepolicy_freeze_test.py
@@ -48,6 +48,10 @@
     removed_attributes = prebuilt_policy.typeattributes - current_policy.typeattributes
     added_attributes = current_policy.typeattributes - prebuilt_policy.typeattributes
 
+    # TODO(b/330670954): remove this once all internal references are removed.
+    if "proc_compaction_proactiveness" in added_types:
+        added_types.remove("proc_compaction_proactiveness")
+
     if removed_types:
         results += "The following public types were removed:\n" + ", ".join(removed_types) + "\n"
 
diff --git a/tests/sepolicy_tests.py b/tests/sepolicy_tests.py
index af47938..2791c53 100644
--- a/tests/sepolicy_tests.py
+++ b/tests/sepolicy_tests.py
@@ -44,6 +44,10 @@
         "/system/product/vendor_overlay/",
         "/system/system_ext/overlay/",
         "/system_ext/overlay/",
+
+        # adb_keys_file hasn't been a system_file_type
+        "/product/etc/security/adb_keys",
+        "/system/product/etc/security/adb_keys",
     ]
 
     return pol.AssertPathTypesHaveAttr(partitions, exceptions, "system_file_type")
@@ -182,6 +186,7 @@
         # access given from technical_debt.cil
         "codec2_config_prop" : ["file"],
         "device_config_nnapi_native_prop":["file"],
+        "gpu_device": ["dir"],
         "hal_allocator_default":["binder", "fd"],
         "hal_codec2": ["binder", "fd"],
         "hal_codec2_hwservice":["hwservice_manager"],
@@ -206,6 +211,7 @@
         "media_variant_prop":["file"],
         "nnapi_ext_deny_product_prop":["file"],
         "servicemanager":["fd"],
+        "sysfs_gpu": ["file"],
         "toolbox_exec": ["file"],
         # extra types being granted to isolated_compute_app
         "isolated_compute_allowed":["service_manager", "chr_file"],
diff --git a/tools/Android.bp b/tools/Android.bp
index f8935a6..e216652 100644
--- a/tools/Android.bp
+++ b/tools/Android.bp
@@ -44,7 +44,7 @@
     name: "checkfc",
     defaults: ["sepolicy_tools_defaults"],
     srcs: ["checkfc.c"],
-    shared_libs: ["libselinux"],
+    static_libs: ["libselinux"],
 }
 
 cc_binary_host {
diff --git a/tools/checkfc.c b/tools/checkfc.c
index 051e24b..904f02f 100644
--- a/tools/checkfc.c
+++ b/tools/checkfc.c
@@ -304,6 +304,7 @@
     }
 
     char line[1024];
+    bool non_matching_entries = false;
     while (fgets(line, sizeof(line), test_data)) {
         char *path;
         char *expected_type;
@@ -331,6 +332,7 @@
         if (strcmp(found_type, expected_type)) {
             fprintf(stderr, "Incorrect type for %s: resolved to %s, expected %s\n",
                     path, found_type, expected_type);
+            non_matching_entries = true;
         }
 
         free(found_context);
@@ -340,6 +342,10 @@
     }
     fclose(test_data);
 
+    if (non_matching_entries) {
+        exit(1);
+    }
+
     // Prints the coverage of file_contexts on the test data. It includes
     // warnings for rules that have not been hit by any test example.
     union selinux_callback cb;
diff --git a/tools/finalize-vintf-resources.sh b/tools/finalize-vintf-resources.sh
index 68ce0e5..cdf82f1 100755
--- a/tools/finalize-vintf-resources.sh
+++ b/tools/finalize-vintf-resources.sh
@@ -22,16 +22,20 @@
 top=$1
 ver=$2
 
-mkdir -p "$top/system/sepolicy/prebuilts/api/${ver}/"
-cp -r "$top/system/sepolicy/public/" "$top/system/sepolicy/prebuilts/api/${ver}/"
-cp -r "$top/system/sepolicy/private/" "$top/system/sepolicy/prebuilts/api/${ver}/"
+prebuilt_dir=$top/system/sepolicy/prebuilts/api/$ver
+mkdir -p "$prebuilt_dir"
+cp -r "$top/system/sepolicy/public/" "$prebuilt_dir"
+cp -r "$top/system/sepolicy/private/" "$prebuilt_dir"
 
-cat > "$top/system/sepolicy/prebuilts/api/${ver}/Android.bp" <<EOF
+cat > "$prebuilt_dir/Android.bp" <<EOF
 // Automatically generated file, do not edit!
 se_policy_conf {
     name: "${ver}_plat_pub_policy.conf",
     defaults: ["se_policy_conf_flags_defaults"],
-    srcs: [":se_build_files{.plat_public_${ver}}", ":se_build_files{.reqd_mask}"],
+    srcs: [
+        ":se_build_files{.plat_public_${ver}}",
+        ":se_build_files{.reqd_mask}",
+    ],
     installable: false,
     build_variant: "user",
 }
@@ -96,3 +100,26 @@
     },
 }
 EOF
+
+# Build general_sepolicy.conf, plat_sepolicy.cil, and mapping file for CTS
+DIST_DIR=out/dist $top/build/soong/soong_ui.bash --make-mode dist sepolicy_finalize bpmodify
+
+cp "$top/out/dist/plat_sepolicy.cil" "$prebuilt_dir/${ver}_plat_sepolicy.cil"
+cp "$top/out/dist/general_sepolicy.conf" "$prebuilt_dir/${ver}_general_sepolicy.conf"
+cp "$top/out/dist/$ver.cil" "$prebuilt_dir/${ver}_mapping.cil"
+
+cat >> "$prebuilt_dir/Android.bp" <<EOF
+
+filegroup {
+    name: "${ver}_sepolicy_cts_data",
+    srcs: [
+        "${ver}_general_sepolicy.conf",
+        "${ver}_plat_sepolicy.cil",
+        "${ver}_mapping.cil",
+    ],
+}
+EOF
+
+bpmodify="$top/out/host/linux-x86/bin/bpmodify"
+$bpmodify -a ":${ver}_sepolicy_cts_data" -m prebuilt_sepolicy_cts_data -property srcs -w \
+    $top/system/sepolicy/tests/Android.bp
diff --git a/treble_sepolicy_tests_for_release.mk b/treble_sepolicy_tests_for_release.mk
deleted file mode 100644
index 2e9d68f..0000000
--- a/treble_sepolicy_tests_for_release.mk
+++ /dev/null
@@ -1,81 +0,0 @@
-version := $(version_under_treble_tests)
-
-include $(CLEAR_VARS)
-# For Treble builds run tests verifying that processes are properly labeled and
-# permissions granted do not violate the treble model.  Also ensure that treble
-# compatibility guarantees are upheld between SELinux version bumps.
-LOCAL_MODULE := treble_sepolicy_tests_$(version)
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := FAKE
-LOCAL_MODULE_TAGS := optional
-
-IS_TREBLE_TEST_ENABLED_PARTNER := false
-ifeq ($(filter 26.0 27.0 28.0 29.0,$(version)),)
-ifneq (,$(BOARD_SYSTEM_EXT_PREBUILT_DIR)$(BOARD_PRODUCT_PREBUILT_DIR))
-IS_TREBLE_TEST_ENABLED_PARTNER := true
-endif # (,$(BOARD_SYSTEM_EXT_PREBUILT_DIR)$(BOARD_PRODUCT_PREBUILT_DIR))
-endif # ($(filter 26.0 27.0 28.0 29.0,$(version)),)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# $(version)_plat - the platform policy shipped as part of the $(version) release.  This is
-# built to enable us to determine the diff between the current policy and the
-# $(version) policy, which will be used in tests to make sure that compatibility has
-# been maintained by our mapping files.
-built_$(version)_plat_sepolicy_cil := $(call intermediates-dir-for,ETC,$(version)_plat_policy.cil)/$(version)_plat_policy.cil
-
-$(version)_mapping.cil := $(call intermediates-dir-for,ETC,plat_$(version).cil)/plat_$(version).cil
-$(version)_mapping.ignore.cil := \
-    $(call intermediates-dir-for,ETC,$(version).ignore.cil)/$(version).ignore.cil
-ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-ifneq (,$(BOARD_SYSTEM_EXT_PREBUILT_DIR))
-$(version)_mapping.cil += \
-    $(call intermediates-dir-for,ETC,system_ext_$(version).cil)/system_ext_$(version).cil
-$(version)_mapping.ignore.cil += \
-    $(call intermediates-dir-for,ETC,system_ext_$(version).ignore.cil)/system_ext_$(version).ignore.cil
-endif # (,$(BOARD_SYSTEM_EXT_PREBUILT_DIR))
-ifneq (,$(BOARD_PRODUCT_PREBUILT_DIR))
-$(version)_mapping.cil += \
-    $(call intermediates-dir-for,ETC,product_$(version).cil)/product_$(version).cil
-$(version)_mapping.ignore.cil += \
-    $(call intermediates-dir-for,ETC,product_$(version).ignore.cil)/product_$(version).ignore.cil
-endif # (,$(BOARD_PRODUCT_PREBUILT_DIR))
-endif #($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-
-# $(version)_mapping.combined.cil - a combination of the mapping file used when
-# combining the current platform policy with nonplatform policy based on the
-# $(version) policy release and also a special ignored file that exists purely for
-# these tests.
-intermediates := $(TARGET_OUT_INTERMEDIATES)/ETC/$(LOCAL_MODULE)_intermediates
-$(version)_mapping.combined.cil := $(intermediates)/$(version)_mapping.combined.cil
-$($(version)_mapping.combined.cil): $($(version)_mapping.cil) $($(version)_mapping.ignore.cil)
-	mkdir -p $(dir $@)
-	cat $^ > $@
-
-ifeq ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-public_cil_files := $(base_product_pub_policy.cil)
-else
-public_cil_files := $(base_plat_pub_policy.cil)
-endif # ($(IS_TREBLE_TEST_ENABLED_PARTNER),true)
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY_OLD := $(built_$(version)_plat_sepolicy_cil)
-$(LOCAL_BUILT_MODULE): PRIVATE_COMBINED_MAPPING := $($(version)_mapping.combined.cil)
-$(LOCAL_BUILT_MODULE): PRIVATE_PLAT_PUB_SEPOLICY := $(public_cil_files)
-$(LOCAL_BUILT_MODULE): $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
-  $(public_cil_files) \
-  $(built_$(version)_plat_sepolicy_cil) $($(version)_mapping.combined.cil)
-	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/treble_sepolicy_tests \
-                -b $(PRIVATE_PLAT_PUB_SEPOLICY) -m $(PRIVATE_COMBINED_MAPPING) \
-                -o $(PRIVATE_SEPOLICY_OLD)
-	$(hide) touch $@
-
-built_sepolicy_files :=
-public_cil_files :=
-$(version)_mapping.cil :=
-$(version)_mapping.combined.cil :=
-$(version)_mapping.ignore.cil :=
-built_$(version)_plat_sepolicy :=
-version :=
-version_under_treble_tests :=
diff --git a/treble_sepolicy_tests_for_release/Android.bp b/treble_sepolicy_tests_for_release/Android.bp
new file mode 100644
index 0000000..7256deb
--- /dev/null
+++ b/treble_sepolicy_tests_for_release/Android.bp
@@ -0,0 +1,448 @@
+// Copyright (C) 2024 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package {
+    default_applicable_licenses: [
+        "Android-Apache-2.0",
+        "system_sepolicy_license",
+    ],
+}
+
+//////////////////////////////////
+// Tests for Treble compatibility of current platform policy and vendor policy of
+// given release version.
+//////////////////////////////////
+genrule {
+    name: "29.0_mapping.combined.cil",
+    srcs: [
+        ":plat_29.0.cil",
+        ":29.0.ignore.cil",
+    ],
+    out: ["29.0_mapping.combined.cil"],
+    cmd: "cat $(location :plat_29.0.cil) $(location :29.0.ignore.cil) > $(out)",
+}
+
+genrule {
+    name: "treble_sepolicy_tests_29.0",
+    srcs: [
+        ":29.0_plat_policy.cil",
+        ":29.0_mapping.combined.cil",
+        ":29.0_plat_pub_policy.cil",
+    ],
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_29.0"],
+    cmd: "$(location treble_sepolicy_tests) " +
+        "-b $(location :29.0_plat_pub_policy.cil) " +
+        "-m $(location :29.0_mapping.combined.cil) " +
+        "-o $(location :29.0_plat_policy.cil) && " +
+        "touch $(out)",
+}
+
+genrule {
+    name: "30.0_mapping.combined.cil",
+    srcs: [
+        ":plat_30.0.cil",
+        ":30.0.ignore.cil",
+    ] + select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+        true: [
+            ":system_ext_30.0.cil",
+            ":system_ext_30.0.ignore.cil",
+        ],
+        default: [],
+    }) + select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+        true: [
+            ":product_30.0.cil",
+            ":product_30.0.ignore.cil",
+        ],
+        default: [],
+    }),
+    out: ["30.0_mapping.combined.cil"],
+    cmd: "cat $(location :plat_30.0.cil) " +
+        "$(location :30.0.ignore.cil) " +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+            true: "$(location :system_ext_30.0.cil) " +
+                "$(location :system_ext_30.0.ignore.cil) ",
+            default: "",
+        }) +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+            true: "$(location :product_30.0.cil) " +
+                "$(location :product_30.0.ignore.cil) ",
+            default: "",
+        }) +
+        "> $(out)",
+}
+
+genrule {
+    name: "treble_sepolicy_tests_30.0",
+    srcs: [
+        ":30.0_plat_policy.cil",
+        ":30.0_mapping.combined.cil",
+    ] + select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): [":30.0_plat_pub_policy.cil"],
+        (default, default): [":30.0_product_pub_policy.cil"],
+    }),
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_30.0"],
+    cmd: select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): "$(location treble_sepolicy_tests) " +
+            "-b $(location :30.0_plat_pub_policy.cil) " +
+            "-m $(location :30.0_mapping.combined.cil) " +
+            "-o $(location :30.0_plat_policy.cil) && " +
+            "touch $(out)",
+        (default, default): "$(location treble_sepolicy_tests) " +
+            "-b $(location :30.0_product_pub_policy.cil) " +
+            "-m $(location :30.0_mapping.combined.cil) " +
+            "-o $(location :30.0_plat_policy.cil) && " +
+            "touch $(out)",
+    }),
+}
+
+genrule {
+    name: "31.0_mapping.combined.cil",
+    srcs: [
+        ":plat_31.0.cil",
+        ":31.0.ignore.cil",
+    ] + select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+        true: [
+            ":system_ext_31.0.cil",
+            ":system_ext_31.0.ignore.cil",
+        ],
+        default: [],
+    }) + select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+        true: [
+            ":product_31.0.cil",
+            ":product_31.0.ignore.cil",
+        ],
+        default: [],
+    }),
+    out: ["31.0_mapping.combined.cil"],
+    cmd: "cat $(location :plat_31.0.cil) " +
+        "$(location :31.0.ignore.cil) " +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+            true: "$(location :system_ext_31.0.cil) " +
+                "$(location :system_ext_31.0.ignore.cil) ",
+            default: "",
+        }) +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+            true: "$(location :product_31.0.cil) " +
+                "$(location :product_31.0.ignore.cil) ",
+            default: "",
+        }) +
+        "> $(out)",
+}
+
+genrule {
+    name: "treble_sepolicy_tests_31.0",
+    srcs: [
+        ":31.0_plat_policy.cil",
+        ":31.0_mapping.combined.cil",
+    ] + select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): [":31.0_plat_pub_policy.cil"],
+        (default, default): [":31.0_product_pub_policy.cil"],
+    }),
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_31.0"],
+    cmd: select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): "$(location treble_sepolicy_tests) " +
+            "-b $(location :31.0_plat_pub_policy.cil) " +
+            "-m $(location :31.0_mapping.combined.cil) " +
+            "-o $(location :31.0_plat_policy.cil) && " +
+            "touch $(out)",
+        (default, default): "$(location treble_sepolicy_tests) " +
+            "-b $(location :31.0_product_pub_policy.cil) " +
+            "-m $(location :31.0_mapping.combined.cil) " +
+            "-o $(location :31.0_plat_policy.cil) && " +
+            "touch $(out)",
+    }),
+}
+
+genrule {
+    name: "32.0_mapping.combined.cil",
+    srcs: [
+        ":plat_32.0.cil",
+        ":32.0.ignore.cil",
+    ] + select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+        true: [
+            ":system_ext_32.0.cil",
+            ":system_ext_32.0.ignore.cil",
+        ],
+        default: [],
+    }) + select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+        true: [
+            ":product_32.0.cil",
+            ":product_32.0.ignore.cil",
+        ],
+        default: [],
+    }),
+    out: ["32.0_mapping.combined.cil"],
+    cmd: "cat $(location :plat_32.0.cil) " +
+        "$(location :32.0.ignore.cil) " +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+            true: "$(location :system_ext_32.0.cil) " +
+                "$(location :system_ext_32.0.ignore.cil) ",
+            default: "",
+        }) +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+            true: "$(location :product_32.0.cil) " +
+                "$(location :product_32.0.ignore.cil) ",
+            default: "",
+        }) +
+        "> $(out)",
+}
+
+genrule {
+    name: "treble_sepolicy_tests_32.0",
+    srcs: [
+        ":32.0_plat_policy.cil",
+        ":32.0_mapping.combined.cil",
+    ] + select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): [":32.0_plat_pub_policy.cil"],
+        (default, default): [":32.0_product_pub_policy.cil"],
+    }),
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_32.0"],
+    cmd: select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): "$(location treble_sepolicy_tests) " +
+            "-b $(location :32.0_plat_pub_policy.cil) " +
+            "-m $(location :32.0_mapping.combined.cil) " +
+            "-o $(location :32.0_plat_policy.cil) && " +
+            "touch $(out)",
+        (default, default): "$(location treble_sepolicy_tests) " +
+            "-b $(location :32.0_product_pub_policy.cil) " +
+            "-m $(location :32.0_mapping.combined.cil) " +
+            "-o $(location :32.0_plat_policy.cil) && " +
+            "touch $(out)",
+    }),
+}
+
+genrule {
+    name: "33.0_mapping.combined.cil",
+    srcs: [
+        ":plat_33.0.cil",
+        ":33.0.ignore.cil",
+    ] + select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+        true: [
+            ":system_ext_33.0.cil",
+            ":system_ext_33.0.ignore.cil",
+        ],
+        default: [],
+    }) + select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+        true: [
+            ":product_33.0.cil",
+            ":product_33.0.ignore.cil",
+        ],
+        default: [],
+    }),
+    out: ["33.0_mapping.combined.cil"],
+    cmd: "cat $(location :plat_33.0.cil) " +
+        "$(location :33.0.ignore.cil) " +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+            true: "$(location :system_ext_33.0.cil) " +
+                "$(location :system_ext_33.0.ignore.cil) ",
+            default: "",
+        }) +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+            true: "$(location :product_33.0.cil) " +
+                "$(location :product_33.0.ignore.cil) ",
+            default: "",
+        }) +
+        "> $(out)",
+}
+
+genrule {
+    name: "treble_sepolicy_tests_33.0",
+    srcs: [
+        ":33.0_plat_policy.cil",
+        ":33.0_mapping.combined.cil",
+    ] + select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): [":33.0_plat_pub_policy.cil"],
+        (default, default): [":33.0_product_pub_policy.cil"],
+    }),
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_33.0"],
+    cmd: select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): "$(location treble_sepolicy_tests) " +
+            "-b $(location :33.0_plat_pub_policy.cil) " +
+            "-m $(location :33.0_mapping.combined.cil) " +
+            "-o $(location :33.0_plat_policy.cil) && " +
+            "touch $(out)",
+        (default, default): "$(location treble_sepolicy_tests) " +
+            "-b $(location :33.0_product_pub_policy.cil) " +
+            "-m $(location :33.0_mapping.combined.cil) " +
+            "-o $(location :33.0_plat_policy.cil) && " +
+            "touch $(out)",
+    }),
+}
+
+genrule {
+    name: "34.0_mapping.combined.cil",
+    srcs: [
+        ":plat_34.0.cil",
+        ":34.0.ignore.cil",
+    ] + select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+        true: [
+            ":system_ext_34.0.cil",
+            ":system_ext_34.0.ignore.cil",
+        ],
+        default: [],
+    }) + select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+        true: [
+            ":product_34.0.cil",
+            ":product_34.0.ignore.cil",
+        ],
+        default: [],
+    }),
+    out: ["34.0_mapping.combined.cil"],
+    cmd: "cat $(location :plat_34.0.cil) " +
+        "$(location :34.0.ignore.cil) " +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"), {
+            true: "$(location :system_ext_34.0.cil) " +
+                "$(location :system_ext_34.0.ignore.cil) ",
+            default: "",
+        }) +
+        select(soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"), {
+            true: "$(location :product_34.0.cil) " +
+                "$(location :product_34.0.ignore.cil) ",
+            default: "",
+        }) +
+        "> $(out)",
+}
+
+genrule {
+    name: "treble_sepolicy_tests_34.0",
+    srcs: [
+        ":34.0_plat_policy.cil",
+        ":34.0_mapping.combined.cil",
+    ] + select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): [":34.0_plat_pub_policy.cil"],
+        (default, default): [":34.0_product_pub_policy.cil"],
+    }),
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_34.0"],
+    cmd: select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): "$(location treble_sepolicy_tests) " +
+            "-b $(location :34.0_plat_pub_policy.cil) " +
+            "-m $(location :34.0_mapping.combined.cil) " +
+            "-o $(location :34.0_plat_policy.cil) && " +
+            "touch $(out)",
+        (default, default): "$(location treble_sepolicy_tests) " +
+            "-b $(location :34.0_product_pub_policy.cil) " +
+            "-m $(location :34.0_mapping.combined.cil) " +
+            "-o $(location :34.0_plat_policy.cil) && " +
+            "touch $(out)",
+    }),
+}
+
+genrule {
+    name: "202404_mapping.combined.cil",
+    srcs: select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+        "202404": [
+        ],
+        default: [
+            ":plat_202404.cil",
+            ":202404.ignore.cil",
+        ],
+    }) + select((
+        soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+    ), {
+        ("202404", true): [],
+        ("202404", default): [],
+        (default, true): [
+            ":system_ext_202404.cil",
+            ":system_ext_202404.ignore.cil",
+        ],
+        (default, default): [],
+    }) + select((
+        soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        ("202404", true): [],
+        ("202404", default): [],
+        (default, true): [
+            ":product_202404.cil",
+            ":product_202404.ignore.cil",
+        ],
+        (default, default): [],
+    }),
+    out: ["202404_mapping.combined.cil"],
+    cmd: select(soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"), {
+        "202404": "touch $(out)",
+        default: "cat $(in) > $(out)",
+    }),
+}
+
+genrule {
+    name: "treble_sepolicy_tests_202404",
+    srcs: [
+        ":202404_plat_policy.cil",
+        ":202404_mapping.combined.cil",
+    ] + select((
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        (false, false): [":202404_plat_pub_policy.cil"],
+        (default, default): [":202404_product_pub_policy.cil"],
+    }),
+    tools: ["treble_sepolicy_tests"],
+    out: ["treble_sepolicy_tests_202404"],
+    cmd: select((
+        soong_config_variable("ANDROID", "PLATFORM_SEPOLICY_VERSION"),
+        soong_config_variable("ANDROID", "HAS_BOARD_SYSTEM_EXT_PREBUILT_DIR"),
+        soong_config_variable("ANDROID", "HAS_BOARD_PRODUCT_PREBUILT_DIR"),
+    ), {
+        ("202404", false, false): "touch $(out)",
+        ("202404", default, default): "touch $(out)",
+        (default, false, false): "$(location treble_sepolicy_tests) " +
+            "-b $(location :202404_plat_pub_policy.cil) " +
+            "-m $(location :202404_mapping.combined.cil) " +
+            "-o $(location :202404_plat_policy.cil) && " +
+            "touch $(out)",
+        (default, default, default): "$(location treble_sepolicy_tests) " +
+            "-b $(location :202404_product_pub_policy.cil) " +
+            "-m $(location :202404_mapping.combined.cil) " +
+            "-o $(location :202404_plat_policy.cil) && " +
+            "touch $(out)",
+    }),
+}
diff --git a/vendor/file_contexts b/vendor/file_contexts
index edd1c71..6f99d90 100644
--- a/vendor/file_contexts
+++ b/vendor/file_contexts
@@ -24,9 +24,10 @@
 /(vendor|system/vendor)/bin/hw/android\.hardware\.bluetooth\.lmp_event-service\.default    u:object_r:hal_bluetooth_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face@1\.[0-9]+-service\.example u:object_r:hal_face_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face-service\.example u:object_r:hal_face_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.face-service\.default u:object_r:hal_face_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.1-service u:object_r:hal_fingerprint_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint@2\.2-service\.example u:object_r:hal_fingerprint_default_exec:s0
-/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.example u:object_r:hal_fingerprint_default_exec:s0
+/(vendor|system/vendor)/bin/hw/android\.hardware\.biometrics\.fingerprint-service\.default u:object_r:hal_fingerprint_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.boot@1\.[0-9]+-service      u:object_r:hal_bootctl_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.boot-service.default      u:object_r:hal_bootctl_default_exec:s0
 /(vendor|system/vendor)/bin/hw/android\.hardware\.broadcastradio@\d+\.\d+-service u:object_r:hal_broadcastradio_default_exec:s0
@@ -164,7 +165,7 @@
 /(vendor|system/vendor)/lib(64)?/android\.hardware\.common-V2-ndk\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/android\.hardware\.common\.fmq-V1-ndk\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/android\.hardware\.graphics\.allocator-V2-ndk\.so u:object_r:same_process_hal_file:s0
-/(vendor|system/vendor)/lib(64)?/android\.hardware\.graphics\.common-V5-ndk\.so u:object_r:same_process_hal_file:s0
+/(vendor|system/vendor)/lib(64)?/android\.hardware\.graphics\.common-V[0-9]+-ndk\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/android\.hardware\.graphics\.common@1\.0\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/android\.hardware\.graphics\.common@1\.1\.so u:object_r:same_process_hal_file:s0
 /(vendor|system/vendor)/lib(64)?/android\.hardware\.graphics\.common@1\.2\.so u:object_r:same_process_hal_file:s0
diff --git a/vendor/hal_fingerprint_default.te b/vendor/hal_fingerprint_default.te
index e380ebd..0bcc26d 100644
--- a/vendor/hal_fingerprint_default.te
+++ b/vendor/hal_fingerprint_default.te
@@ -7,7 +7,9 @@
 # android.frameworks.sensorservice through libsensorndkbridge
 allow hal_fingerprint_default fwk_sensor_service:service_manager find;
 
-set_prop(hal_fingerprint_default, virtual_fingerprint_hal_prop)
+starting_at_board_api(202504, `
+  set_prop(hal_fingerprint_default, virtual_fingerprint_prop)
+')
 
 userdebug_or_eng(`
   # Allow fingerprint hal to read app-created pipes (to respond shell commands from test apps)