diff --git a/private/atrace.te b/private/atrace.te
index cbb5b7c..2ab8c69 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -33,6 +33,7 @@
   -installd_service
   -iorapd_service
   -lpdump_service
+  -mdns_service
   -netd_service
   -stats_service
   -tracingproxy_service
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 78cd37e..650117e 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -17,6 +17,8 @@
 
 set_prop(bpfloader, bpf_progs_loaded_prop)
 
+allow bpfloader bpfloader_exec:file execute_no_trans;
+
 ###
 ### Neverallow rules
 ###
diff --git a/private/compat/31.0/31.0.ignore.cil b/private/compat/31.0/31.0.ignore.cil
index 2ae6a5f..29378d4 100644
--- a/private/compat/31.0/31.0.ignore.cil
+++ b/private/compat/31.0/31.0.ignore.cil
@@ -21,13 +21,7 @@
     hal_dumpstate_service
     hal_graphics_composer_service
     hal_health_service
-    hal_radio_config_service
-    hal_radio_data_service
-    hal_radio_messaging_service
-    hal_radio_modem_service
-    hal_radio_network_service
-    hal_radio_sim_service
-    hal_radio_voice_service
+    hal_radio_service
     hal_sensors_service
     hal_system_suspend_service
     hal_tv_tuner_service
diff --git a/private/compat/32.0/32.0.ignore.cil b/private/compat/32.0/32.0.ignore.cil
index db019f0..ffd148f 100644
--- a/private/compat/32.0/32.0.ignore.cil
+++ b/private/compat/32.0/32.0.ignore.cil
@@ -29,13 +29,7 @@
     hal_ir_service
     hal_nfc_service
     hal_nlinterceptor_service
-    hal_radio_config_service
-    hal_radio_data_service
-    hal_radio_messaging_service
-    hal_radio_modem_service
-    hal_radio_network_service
-    hal_radio_sim_service
-    hal_radio_voice_service
+    hal_radio_service
     hal_sensors_service
     hal_system_suspend_service
     hal_tv_tuner_service
@@ -45,6 +39,7 @@
     hal_wifi_hostapd_service
     hal_wifi_supplicant_service
     locale_service
+    mdns_service
     mtectrl
     nearby_service
     proc_watermark_boost_factor
diff --git a/private/file_contexts b/private/file_contexts
index 784bc6d..422d83a 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -365,6 +365,7 @@
 /system/bin/stats                u:object_r:stats_exec:s0
 /system/bin/statsd               u:object_r:statsd_exec:s0
 /system/bin/bpfloader            u:object_r:bpfloader_exec:s0
+/system/bin/btfloader            u:object_r:bpfloader_exec:s0
 /system/bin/watchdogd            u:object_r:watchdogd_exec:s0
 /system/bin/apexd                u:object_r:apexd_exec:s0
 /system/bin/gsid                 u:object_r:gsid_exec:s0
diff --git a/private/netutils_wrapper.te b/private/netutils_wrapper.te
index ca3b515..cdc342d 100644
--- a/private/netutils_wrapper.te
+++ b/private/netutils_wrapper.te
@@ -17,6 +17,7 @@
 # For netutils (ndc) to be able to talk to netd
 allow netutils_wrapper netd_service:service_manager find;
 allow netutils_wrapper dnsresolver_service:service_manager find;
+allow netutils_wrapper mdns_service:service_manager find;
 binder_use(netutils_wrapper);
 binder_call(netutils_wrapper, netd);
 
diff --git a/private/network_stack.te b/private/network_stack.te
index 09a98b5..2546888 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -22,6 +22,7 @@
 
 allow network_stack app_api_service:service_manager find;
 allow network_stack dnsresolver_service:service_manager find;
+allow network_stack mdns_service:service_manager find;
 allow network_stack netd_service:service_manager find;
 allow network_stack network_watchlist_service:service_manager find;
 allow network_stack radio_service:service_manager find;
diff --git a/private/service_contexts b/private/service_contexts
index b5e3407..606a018 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -21,25 +21,25 @@
 android.hardware.oemlock.IOemLock/default                            u:object_r:hal_oemlock_service:s0
 android.hardware.power.IPower/default                                u:object_r:hal_power_service:s0
 android.hardware.power.stats.IPowerStats/default                     u:object_r:hal_power_stats_service:s0
-android.hardware.radio.config.IRadioConfig/default                   u:object_r:hal_radio_config_service:s0
-android.hardware.radio.data.IRadioData/slot1                         u:object_r:hal_radio_data_service:s0
-android.hardware.radio.data.IRadioData/slot2                         u:object_r:hal_radio_data_service:s0
-android.hardware.radio.data.IRadioData/slot3                         u:object_r:hal_radio_data_service:s0
-android.hardware.radio.messaging.IRadioMessaging/slot1               u:object_r:hal_radio_messaging_service:s0
-android.hardware.radio.messaging.IRadioMessaging/slot2               u:object_r:hal_radio_messaging_service:s0
-android.hardware.radio.messaging.IRadioMessaging/slot3               u:object_r:hal_radio_messaging_service:s0
-android.hardware.radio.modem.IRadioModem/slot1                       u:object_r:hal_radio_modem_service:s0
-android.hardware.radio.modem.IRadioModem/slot2                       u:object_r:hal_radio_modem_service:s0
-android.hardware.radio.modem.IRadioModem/slot3                       u:object_r:hal_radio_modem_service:s0
-android.hardware.radio.network.IRadioNetwork/slot1                   u:object_r:hal_radio_network_service:s0
-android.hardware.radio.network.IRadioNetwork/slot2                   u:object_r:hal_radio_network_service:s0
-android.hardware.radio.network.IRadioNetwork/slot3                   u:object_r:hal_radio_network_service:s0
-android.hardware.radio.sim.IRadioSim/slot1                           u:object_r:hal_radio_sim_service:s0
-android.hardware.radio.sim.IRadioSim/slot2                           u:object_r:hal_radio_sim_service:s0
-android.hardware.radio.sim.IRadioSim/slot3                           u:object_r:hal_radio_sim_service:s0
-android.hardware.radio.voice.IRadioVoice/slot1                       u:object_r:hal_radio_voice_service:s0
-android.hardware.radio.voice.IRadioVoice/slot2                       u:object_r:hal_radio_voice_service:s0
-android.hardware.radio.voice.IRadioVoice/slot3                       u:object_r:hal_radio_voice_service:s0
+android.hardware.radio.config.IRadioConfig/default                   u:object_r:hal_radio_service:s0
+android.hardware.radio.data.IRadioData/slot1                         u:object_r:hal_radio_service:s0
+android.hardware.radio.data.IRadioData/slot2                         u:object_r:hal_radio_service:s0
+android.hardware.radio.data.IRadioData/slot3                         u:object_r:hal_radio_service:s0
+android.hardware.radio.messaging.IRadioMessaging/slot1               u:object_r:hal_radio_service:s0
+android.hardware.radio.messaging.IRadioMessaging/slot2               u:object_r:hal_radio_service:s0
+android.hardware.radio.messaging.IRadioMessaging/slot3               u:object_r:hal_radio_service:s0
+android.hardware.radio.modem.IRadioModem/slot1                       u:object_r:hal_radio_service:s0
+android.hardware.radio.modem.IRadioModem/slot2                       u:object_r:hal_radio_service:s0
+android.hardware.radio.modem.IRadioModem/slot3                       u:object_r:hal_radio_service:s0
+android.hardware.radio.network.IRadioNetwork/slot1                   u:object_r:hal_radio_service:s0
+android.hardware.radio.network.IRadioNetwork/slot2                   u:object_r:hal_radio_service:s0
+android.hardware.radio.network.IRadioNetwork/slot3                   u:object_r:hal_radio_service:s0
+android.hardware.radio.sim.IRadioSim/slot1                           u:object_r:hal_radio_service:s0
+android.hardware.radio.sim.IRadioSim/slot2                           u:object_r:hal_radio_service:s0
+android.hardware.radio.sim.IRadioSim/slot3                           u:object_r:hal_radio_service:s0
+android.hardware.radio.voice.IRadioVoice/slot1                       u:object_r:hal_radio_service:s0
+android.hardware.radio.voice.IRadioVoice/slot2                       u:object_r:hal_radio_service:s0
+android.hardware.radio.voice.IRadioVoice/slot3                       u:object_r:hal_radio_service:s0
 android.hardware.rebootescrow.IRebootEscrow/default                  u:object_r:hal_rebootescrow_service:s0
 android.hardware.security.dice.IDiceDevice/default                   u:object_r:hal_dice_service:s0
 android.hardware.security.keymint.IKeyMintDevice/default             u:object_r:hal_keymint_service:s0
@@ -207,6 +207,7 @@
 logd                                      u:object_r:logd_service:s0
 looper_stats                              u:object_r:looper_stats_service:s0
 lpdump_service                            u:object_r:lpdump_service:s0
+mdns                                      u:object_r:mdns_service:s0
 media.aaudio                              u:object_r:audioserver_service:s0
 media.audio_flinger                       u:object_r:audioserver_service:s0
 media.audio_policy                        u:object_r:audioserver_service:s0
diff --git a/private/system_app.te b/private/system_app.te
index 460ad4b..8c1fdbf 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -89,6 +89,7 @@
   -installd_service
   -iorapd_service
   -lpdump_service
+  -mdns_service
   -netd_service
   -system_suspend_control_internal_service
   -system_suspend_control_service
@@ -103,6 +104,7 @@
   dumpstate_service
   installd_service
   iorapd_service
+  mdns_service
   netd_service
   virtual_touchpad_service
   vold_service
diff --git a/private/system_server.te b/private/system_server.te
index 6e108df..7e66c5a 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -869,6 +869,7 @@
 allow system_server keystore_maintenance_service:service_manager find;
 allow system_server keystore_metrics_service:service_manager find;
 allow system_server keystore_service:service_manager find;
+allow system_server mdns_service:service_manager find;
 allow system_server mediaserver_service:service_manager find;
 allow system_server mediametrics_service:service_manager find;
 allow system_server mediaextractor_service:service_manager find;
diff --git a/public/hal_telephony.te b/public/hal_telephony.te
index 8a1fbe5..e21796a 100644
--- a/public/hal_telephony.te
+++ b/public/hal_telephony.te
@@ -3,13 +3,7 @@
 binder_call(hal_telephony_server, hal_telephony_client)
 
 hal_attribute_hwservice(hal_telephony, hal_telephony_hwservice)
-hal_attribute_service(hal_telephony, hal_radio_config_service)
-hal_attribute_service(hal_telephony, hal_radio_data_service)
-hal_attribute_service(hal_telephony, hal_radio_messaging_service)
-hal_attribute_service(hal_telephony, hal_radio_modem_service)
-hal_attribute_service(hal_telephony, hal_radio_network_service)
-hal_attribute_service(hal_telephony, hal_radio_sim_service)
-hal_attribute_service(hal_telephony, hal_radio_voice_service)
+hal_attribute_service(hal_telephony, hal_radio_service)
 
 allowxperm hal_telephony_server self:udp_socket ioctl priv_sock_ioctls;
 
diff --git a/public/netd.te b/public/netd.te
index ff0bff6..899df88 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -87,6 +87,7 @@
 binder_use(netd)
 add_service(netd, netd_service)
 add_service(netd, dnsresolver_service)
+add_service(netd, mdns_service)
 allow netd dumpstate:fifo_file  { getattr write };
 
 # Allow netd to call into the system server so it can check permissions.
@@ -150,6 +151,16 @@
     -netutils_wrapper
 } dnsresolver_service:service_manager find;
 
+# only system_server, dumpstate and network stack app may find mdns service
+neverallow {
+    domain
+    -system_server
+    -dumpstate
+    -network_stack
+    -netd
+    -netutils_wrapper
+} mdns_service:service_manager find;
+
 # apps may not interact with netd over binder.
 neverallow { appdomain -network_stack } netd:binder call;
 neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call;
diff --git a/public/service.te b/public/service.te
index 99db2d3..23f144d 100644
--- a/public/service.te
+++ b/public/service.te
@@ -27,6 +27,7 @@
 type keystore_service,          service_manager_type;
 type legacykeystore_service,    service_manager_type;
 type lpdump_service,            service_manager_type;
+type mdns_service,              service_manager_type;
 type mediaserver_service,       service_manager_type;
 type mediametrics_service,      service_manager_type;
 type mediaextractor_service,    service_manager_type;
@@ -286,13 +287,7 @@
 type hal_oemlock_service, vendor_service, protected_service, service_manager_type;
 type hal_power_service, vendor_service, protected_service, service_manager_type;
 type hal_power_stats_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_config_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_data_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_messaging_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_modem_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_network_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_sim_service, vendor_service, protected_service, service_manager_type;
-type hal_radio_voice_service, vendor_service, protected_service, service_manager_type;
+type hal_radio_service, vendor_service, protected_service, service_manager_type;
 type hal_rebootescrow_service, vendor_service, protected_service, service_manager_type;
 type hal_remotelyprovisionedcomponent_service, vendor_service, protected_service, service_manager_type;
 type hal_sensors_service, vendor_service, protected_service, service_manager_type;
diff --git a/public/shell.te b/public/shell.te
index 60e3521..4175c86 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -85,6 +85,7 @@
   -incident_service
   -installd_service
   -iorapd_service
+  -mdns_service
   -netd_service
   -system_suspend_control_internal_service
   -system_suspend_control_service
diff --git a/public/traceur_app.te b/public/traceur_app.te
index 03c4944..1ab150d 100644
--- a/public/traceur_app.te
+++ b/public/traceur_app.te
@@ -12,6 +12,7 @@
   -installd_service
   -iorapd_service
   -lpdump_service
+  -mdns_service
   -netd_service
   -virtual_touchpad_service
   -vold_service