diff --git a/Android.bp b/Android.bp
index 7d36b86..d1ef861 100644
--- a/Android.bp
+++ b/Android.bp
@@ -1004,6 +1004,7 @@
             "system_ext_202404.compat.cil",
         ],
     }),
+    system_ext_specific: true,
 }
 
 phony {
@@ -1039,6 +1040,7 @@
             "product_202404.cil",
         ],
     }),
+    product_specific: true,
 }
 
 phony {
@@ -1085,6 +1087,7 @@
         ],
         default: [],
     }),
+    vendor: true,
 }
 
 phony {
@@ -1162,3 +1165,142 @@
         default: [],
     }),
 }
+
+phony {
+    name: "selinux_policy",
+    required: [
+        // Runs checkfc against merged service_contexts files
+        "merged_hwservice_contexts_test",
+        "merged_service_contexts_test",
+        "selinux_policy_nonsystem",
+        "selinux_policy_system",
+    ],
+}
+
+// selinux_policy is a main goal and triggers lots of tests.
+// Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
+// By setting as droidcore's dependency, tests will run on normal builds.
+phony_rule {
+    name: "droidcore",
+    phony_deps: ["selinux_policy"],
+}
+
+//-----------------------------------------------------------------------------
+// TODO - remove this.   Keep around until we get the filesystem creation stuff
+// taken care of.
+//
+// The file_contexts.bin is built in the following way:
+// 1. Collect all file_contexts files in THIS repository and process them with
+//    m4 into a tmp file called file_contexts.local.tmp.
+// 2. Collect all device specific file_contexts files and process them with m4
+//    into a tmp file called file_contexts.device.tmp.
+// 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
+//    file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
+// 4. Concatenate file_contexts.local.tmp and  file_contexts.device.sorted.tmp
+//    into file_contexts.concat.tmp.
+// 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
+//    file_contexts.bin.
+//
+//  Note: That a newline file is placed between each file_context file found to
+//        ensure a proper build when an fc file is missing an ending newline.
+//---
+// 1. Collect all file_contexts files in THIS repository and process them with
+//    m4 into a tmp file called file_contexts.local.tmp.
+genrule {
+    name: "file_contexts.local.tmp",
+    srcs: [
+        ":plat_file_contexts",
+        ":system_ext_file_contexts",
+        ":product_file_contexts",
+    ],
+    tools: [
+        "m4",
+    ],
+    out: ["file_contexts.local.tmp"],
+    cmd: "$(location m4) --fatal-warnings " +
+        "-s $(in) > $(out)",
+}
+
+// 2. Collect all device specific file_contexts files and process them with m4
+//    into a tmp file called file_contexts.device.tmp.
+PRIVATE_ADDITIONAL_M4DEFS = select(soong_config_variable("ANDROID", "ADDITIONAL_M4DEFS"), {
+    any @ m4defs: m4defs,
+    default: "",
+})
+genrule {
+    name: "file_contexts.device.tmp",
+    srcs: [
+        ":vendor_file_contexts",
+        ":odm_file_contexts",
+    ],
+    tools: [
+        "m4",
+    ],
+    out: ["file_contexts.device.tmp"],
+    cmd: "$(location m4) --fatal-warnings " +
+        "-s " + PRIVATE_ADDITIONAL_M4DEFS +
+        " $(in) > $(out)",
+}
+
+// 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
+//    file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
+genrule {
+    name: "file_contexts.device.sorted.tmp",
+    srcs: [
+        ":file_contexts.device.tmp",
+        ":precompiled_sepolicy",
+    ],
+    tools: [
+        "checkfc",
+        "fc_sort",
+    ],
+    out: ["file_contexts.device.sorted.tmp"],
+    cmd: "$(location checkfc) " +
+        "-e $(location :precompiled_sepolicy) " +
+        "$(location :file_contexts.device.tmp) && " +
+        "$(location fc_sort) " +
+        "-i $(location :file_contexts.device.tmp) " +
+        "-o $(out)",
+}
+
+// 4. Concatenate file_contexts.local.tmp and  file_contexts.device.sorted.tmp
+//    into file_contexts.concat.tmp.
+genrule {
+    name: "file_contexts.concat.tmp",
+    srcs: [
+        ":file_contexts.local.tmp",
+        ":file_contexts.device.sorted.tmp",
+    ],
+    tools: [
+        "m4",
+    ],
+    out: ["file_contexts.concat.tmp"],
+    cmd: "$(location m4) --fatal-warnings " +
+        "-s $(location :file_contexts.local.tmp) " +
+        "$(location :file_contexts.device.sorted.tmp) > $(out)",
+}
+
+// 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
+//    file_contexts.bin.
+genrule {
+    name: "file_contexts_bin_gen",
+    srcs: [
+        ":file_contexts.concat.tmp",
+        ":precompiled_sepolicy",
+    ],
+    tools: [
+        "checkfc",
+        "sefcontext_compile",
+    ],
+    out: ["file_contexts.bin"],
+    cmd: "$(location checkfc) " +
+        "$(location :precompiled_sepolicy) " +
+        "$(location :file_contexts.concat.tmp) && " +
+        "$(location sefcontext_compile) " +
+        "-o $(out) $(location :file_contexts.concat.tmp)",
+}
+
+prebuilt_etc {
+    name: "file_contexts.bin",
+    src: ":file_contexts_bin_gen",
+}
diff --git a/Android.mk b/Android.mk
deleted file mode 100644
index 9dfc531..0000000
--- a/Android.mk
+++ /dev/null
@@ -1,314 +0,0 @@
-LOCAL_PATH:= $(call my-dir)
-
-include $(CLEAR_VARS)
-
-ifdef BOARD_SEPOLICY_UNION
-$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
-endif
-
-ifdef BOARD_SEPOLICY_M4DEFS
-LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
-else
-LOCAL_ADDITIONAL_M4DEFS :=
-endif
-
-# sepolicy is now divided into multiple portions:
-# public - policy exported on which non-platform policy developers may write
-#   additional policy.  types and attributes are versioned and included in
-#   delivered non-platform policy, which is to be combined with platform policy.
-# private - platform-only policy required for platform functionality but which
-#  is not exported to vendor policy developers and as such may not be assumed
-#  to exist.
-# vendor - vendor-only policy required for vendor functionality. This policy can
-#  reference the public policy but cannot reference the private policy. This
-#  policy is for components which are produced from the core/non-vendor tree and
-#  placed into a vendor partition.
-# mapping - This contains policy statements which map the attributes
-#  exposed in the public policy of previous versions to the concrete types used
-#  in this policy to ensure that policy targeting attributes from public
-#  policy from an older platform version continues to work.
-
-# build process for device:
-# 1) convert policies to CIL:
-#    - private + public platform policy to CIL
-#    - mapping file to CIL (should already be in CIL form)
-#    - non-platform public policy to CIL
-#    - non-platform public + private policy to CIL
-# 2) attributize policy
-#    - run script which takes non-platform public and non-platform combined
-#      private + public policy and produces attributized and versioned
-#      non-platform policy
-# 3) combine policy files
-#    - combine mapping, platform and non-platform policy.
-#    - compile output binary policy file
-
-PLAT_PUBLIC_POLICY := $(LOCAL_PATH)/public
-PLAT_PRIVATE_POLICY := $(LOCAL_PATH)/private
-PLAT_VENDOR_POLICY := $(LOCAL_PATH)/vendor
-REQD_MASK_POLICY := $(LOCAL_PATH)/reqd_mask
-
-SYSTEM_EXT_PUBLIC_POLICY := $(SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS)
-SYSTEM_EXT_PRIVATE_POLICY := $(SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS)
-
-PRODUCT_PUBLIC_POLICY := $(PRODUCT_PUBLIC_SEPOLICY_DIRS)
-PRODUCT_PRIVATE_POLICY := $(PRODUCT_PRIVATE_SEPOLICY_DIRS)
-
-ifneq (,$(SYSTEM_EXT_PUBLIC_POLICY)$(SYSTEM_EXT_PRIVATE_POLICY))
-HAS_SYSTEM_EXT_SEPOLICY_DIR := true
-endif
-
-# TODO(b/119305624): Currently if the device doesn't have a product partition,
-# we install product sepolicy into /system/product. We do that because bits of
-# product sepolicy that's still in /system might depend on bits that have moved
-# to /product. Once we finish migrating product sepolicy out of system, change
-# it so that if no product partition is present, product sepolicy artifacts are
-# not built and installed at all.
-ifneq (,$(PRODUCT_PUBLIC_POLICY)$(PRODUCT_PRIVATE_POLICY))
-HAS_PRODUCT_SEPOLICY_DIR := true
-endif
-
-ifeq ($(SELINUX_IGNORE_NEVERALLOWS),true)
-ifeq ($(TARGET_BUILD_VARIANT),user)
-$(error SELINUX_IGNORE_NEVERALLOWS := true cannot be used in user builds)
-endif
-$(warning Be careful when using the SELINUX_IGNORE_NEVERALLOWS flag. \
-          It does not work in user builds and using it will \
-          not stop you from failing CTS.)
-endif
-
-# BOARD_SEPOLICY_DIRS was used for vendor/odm sepolicy customization before.
-# It has been replaced by BOARD_VENDOR_SEPOLICY_DIRS (mandatory) and
-# BOARD_ODM_SEPOLICY_DIRS (optional). BOARD_SEPOLICY_DIRS is still allowed for
-# backward compatibility, which will be merged into BOARD_VENDOR_SEPOLICY_DIRS.
-ifdef BOARD_SEPOLICY_DIRS
-BOARD_VENDOR_SEPOLICY_DIRS += $(BOARD_SEPOLICY_DIRS)
-endif
-
-###########################################################
-# Compute policy files to be used in policy build.
-# $(1): files to include
-# $(2): directories in which to find files
-###########################################################
-
-define build_policy
-$(strip $(foreach type, $(1), $(foreach file, $(addsuffix /$(type), $(2)), $(sort $(wildcard $(file))))))
-endef
-
-sepolicy_build_files := security_classes \
-                        initial_sids \
-                        access_vectors \
-                        global_macros \
-                        neverallow_macros \
-                        mls_macros \
-                        mls_decl \
-                        mls \
-                        policy_capabilities \
-                        te_macros \
-                        attributes \
-                        ioctl_defines \
-                        ioctl_macros \
-                        *.te \
-                        roles_decl \
-                        roles \
-                        users \
-                        initial_sid_contexts \
-                        fs_use \
-                        genfs_contexts \
-                        port_contexts
-
-sepolicy_compat_files := $(foreach ver, $(PLATFORM_SEPOLICY_COMPAT_VERSIONS), \
-                           $(addprefix compat/$(ver)/, $(addsuffix .cil, $(ver))))
-
-# Security classes and permissions defined outside of system/sepolicy.
-security_class_extension_files := $(call build_policy, security_classes access_vectors, \
-  $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY) \
-  $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY) \
-  $(BOARD_VENDOR_SEPOLICY_DIRS) $(BOARD_ODM_SEPOLICY_DIRS))
-
-ifneq (,$(strip $(security_class_extension_files)))
-  $(error Only platform SELinux policy may define classes and permissions: $(strip $(security_class_extension_files)))
-endif
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-  # Checks if there are public system_ext policy files.
-  policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY))
-  ifneq (,$(strip $(policy_files)))
-    HAS_SYSTEM_EXT_PUBLIC_SEPOLICY := true
-  endif
-  # Checks if there are public/private system_ext policy files.
-  policy_files := $(call build_policy, $(sepolicy_build_files), $(SYSTEM_EXT_PUBLIC_POLICY) $(SYSTEM_EXT_PRIVATE_POLICY))
-  ifneq (,$(strip $(policy_files)))
-    HAS_SYSTEM_EXT_SEPOLICY := true
-  endif
-endif # ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-
-ifdef HAS_PRODUCT_SEPOLICY_DIR
-  # Checks if there are public product policy files.
-  policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY))
-  ifneq (,$(strip $(policy_files)))
-    HAS_PRODUCT_PUBLIC_SEPOLICY := true
-  endif
-  # Checks if there are public/private product policy files.
-  policy_files := $(call build_policy, $(sepolicy_build_files), $(PRODUCT_PUBLIC_POLICY) $(PRODUCT_PRIVATE_POLICY))
-  ifneq (,$(strip $(policy_files)))
-    HAS_PRODUCT_SEPOLICY := true
-  endif
-endif # ifdef HAS_PRODUCT_SEPOLICY_DIR
-
-with_asan := false
-ifneq (,$(filter address,$(SANITIZE_TARGET)))
-  with_asan := true
-endif
-
-ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
-  #$(warning no product shipping level defined)
-else ifneq ($(call math_lt,29,$(PRODUCT_SHIPPING_API_LEVEL)),)
-  ifneq ($(BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW),)
-    $(error BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW cannot be set on a device shipping with R or later, and this is tested by CTS.)
-  endif
-endif
-
-ifeq ($(PRODUCT_SHIPPING_API_LEVEL),)
-  #$(warning no product shipping level defined)
-else ifneq ($(call math_lt,30,$(PRODUCT_SHIPPING_API_LEVEL)),)
-  ifneq ($(BUILD_BROKEN_ENFORCE_SYSPROP_OWNER),)
-    $(error BUILD_BROKEN_ENFORCE_SYSPROP_OWNER cannot be set on a device shipping with S or later, and this is tested by CTS.)
-  endif
-endif
-
-#################################
-
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := selinux_policy
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_TAGS := optional
-LOCAL_REQUIRED_MODULES += \
-    selinux_policy_nonsystem \
-    selinux_policy_system \
-
-# Runs checkfc against merged service_contexts files
-LOCAL_REQUIRED_MODULES += \
-    merged_service_contexts_test \
-    merged_hwservice_contexts_test
-
-include $(BUILD_PHONY_PACKAGE)
-
-# selinux_policy is a main goal and triggers lots of tests.
-# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
-# By setting as droidcore's dependency, tests will run on normal builds.
-droidcore: selinux_policy
-
-##################################
-# Policy files are now built with Android.bp. Grab them from intermediate.
-# See Android.bp for details of policy files.
-#
-built_sepolicy := $(call intermediates-dir-for,ETC,precompiled_sepolicy)/precompiled_sepolicy
-
-##################################
-# TODO - remove this.   Keep around until we get the filesystem creation stuff taken care of.
-#
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := file_contexts.bin
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# The file_contexts.bin is built in the following way:
-# 1. Collect all file_contexts files in THIS repository and process them with
-#    m4 into a tmp file called file_contexts.local.tmp.
-# 2. Collect all device specific file_contexts files and process them with m4
-#    into a tmp file called file_contexts.device.tmp.
-# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
-#    file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
-# 4. Concatenate file_contexts.local.tmp and  file_contexts.device.sorted.tmp
-#    into file_contexts.concat.tmp.
-# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
-#    file_contexts.bin.
-#
-#  Note: That a newline file is placed between each file_context file found to
-#        ensure a proper build when an fc file is missing an ending newline.
-
-local_fc_files := $(call intermediates-dir-for,ETC,plat_file_contexts)/plat_file_contexts
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-local_fc_files += $(call intermediates-dir-for,ETC,system_ext_file_contexts)/system_ext_file_contexts
-endif
-
-ifdef HAS_PRODUCT_SEPOLICY_DIR
-local_fc_files += $(call intermediates-dir-for,ETC,product_file_contexts)/product_file_contexts
-endif
-
-###########################################################
-## Collect file_contexts files into a single tmp file with m4
-##
-## $(1): list of file_contexts files
-## $(2): filename into which file_contexts files are merged
-###########################################################
-
-define _merge-fc-files
-$(2): $(1) $(M4)
-	$(hide) mkdir -p $$(dir $$@)
-	$(hide) $(M4) --fatal-warnings -s $(1) > $$@
-endef
-
-define merge-fc-files
-$(eval $(call _merge-fc-files,$(1),$(2)))
-endef
-
-file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
-$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
-
-device_fc_files += $(call intermediates-dir-for,ETC,vendor_file_contexts)/vendor_file_contexts
-
-ifdef BOARD_ODM_SEPOLICY_DIRS
-device_fc_files += $(call intermediates-dir-for,ETC,odm_file_contexts)/odm_file_contexts
-endif
-
-file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
-$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
-$(file_contexts.device.tmp): $(device_fc_files) $(M4)
-	@mkdir -p $(dir $@)
-	$(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
-
-file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
-$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
-  $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
-	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
-
-file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
-$(call merge-fc-files,\
-  $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp),$(file_contexts.concat.tmp))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
-	@mkdir -p $(dir $@)
-	$(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
-	$(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
-
-local_fc_files :=
-device_fc_files :=
-file_contexts.concat.tmp :=
-file_contexts.device.sorted.tmp :=
-file_contexts.device.tmp :=
-file_contexts.local.tmp :=
-
-#################################
-
-
-build_policy :=
-built_sepolicy :=
-sepolicy_build_files :=
-with_asan :=
diff --git a/apex/Android.bp b/apex/Android.bp
index a6d0853..304eb85 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -314,3 +314,10 @@
         "com.android.biometrics.virtual.face-file_contexts",
     ],
 }
+
+filegroup {
+    name: "com.android.documentsuibundle-file_contexts",
+    srcs: [
+        "com.android.documentsuibundle-file_contexts",
+    ],
+}
diff --git a/apex/com.android.documentsuibundle-file_contexts b/apex/com.android.documentsuibundle-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.documentsuibundle-file_contexts
@@ -0,0 +1,2 @@
+(/.*)?                u:object_r:system_file:s0
+/lib(64)?(/.*)        u:object_r:system_lib_file:s0
diff --git a/apex/com.android.uprobestats-file_contexts b/apex/com.android.uprobestats-file_contexts
index 01de3e2..994951b 100644
--- a/apex/com.android.uprobestats-file_contexts
+++ b/apex/com.android.uprobestats-file_contexts
@@ -1,3 +1,3 @@
 (/.*)?                         u:object_r:system_file:s0
 /bin/uprobestats               u:object_r:uprobestats_exec:s0
-
+/bin/uprobestatsbpfload        u:object_r:bpfloader_exec:s0
diff --git a/build/soong/service_fuzzer_bindings.go b/build/soong/service_fuzzer_bindings.go
index 4e2a0da..e81e8c8 100644
--- a/build/soong/service_fuzzer_bindings.go
+++ b/build/soong/service_fuzzer_bindings.go
@@ -350,6 +350,7 @@
 		"media_communication":                    EXCEPTION_NO_FUZZER,
 		"media_metrics":                          EXCEPTION_NO_FUZZER,
 		"media_projection":                       EXCEPTION_NO_FUZZER,
+		"media_quality":                          EXCEPTION_NO_FUZZER,
 		"media_resource_monitor":                 EXCEPTION_NO_FUZZER,
 		"media_router":                           EXCEPTION_NO_FUZZER,
 		"media_session":                          EXCEPTION_NO_FUZZER,
@@ -473,6 +474,7 @@
 		"time_zone_detector":                     EXCEPTION_NO_FUZZER,
 		"thermalservice":                         EXCEPTION_NO_FUZZER,
 		"tracing.proxy":                          EXCEPTION_NO_FUZZER,
+		"tradeinmode":                            EXCEPTION_NO_FUZZER,
 		"translation":                            EXCEPTION_NO_FUZZER,
 		"transparency":                           EXCEPTION_NO_FUZZER,
 		"trust":                                  EXCEPTION_NO_FUZZER,
diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test
index 7bda60c..b303bbb 100644
--- a/contexts/plat_file_contexts_test
+++ b/contexts/plat_file_contexts_test
@@ -410,6 +410,7 @@
 /system/bin/traced_perf                                           traced_perf_exec
 /system/bin/traced_probes                                         traced_probes_exec
 /system/bin/traced_relay                                          traced_exec
+/system/bin/tradeinmode                                           tradeinmode_exec
 /system/bin/heapprofd                                             heapprofd_exec
 /system/bin/uncrypt                                               uncrypt_exec
 /system/bin/update_verifier                                       update_verifier_exec
@@ -779,8 +780,7 @@
 /system/system_ext/bin/canhalconfigurator                         canhalconfigurator_exec
 /system/system_ext/bin/canhalconfigurator-aidl                    canhalconfigurator_exec
 
-/system_ext/bin/linux_vm_setup                                   linux_vm_setup_exec
-/system/system_ext/bin/linux_vm_setup                            linux_vm_setup_exec
+/system/bin/linux_vm_setup                                        linux_vm_setup_exec
 
 /system_ext/lib                                                   system_lib_file
 /system_ext/lib/does_not_exist                                    system_lib_file
@@ -1278,6 +1278,8 @@
 /metadata/watchdog/test                                           watchdog_metadata_file
 /metadata/repair-mode                                             repair_mode_metadata_file
 /metadata/repair-mode/test                                        repair_mode_metadata_file
+/metadata/tradeinmode                                             tradeinmode_metadata_file
+/metadata/tradeinmode/test                                        tradeinmode_metadata_file
 
 /mnt/asec                                                         asec_apk_file
 /mnt/asec/test                                                    asec_apk_file
diff --git a/private/aconfigd.te b/private/aconfigd.te
index 97e7493..1601e61 100644
--- a/private/aconfigd.te
+++ b/private/aconfigd.te
@@ -1,15 +1,9 @@
 # aconfigd -- manager for aconfig flags
-type aconfigd, domain;
+type aconfigd, domain, coredomain;
 type aconfigd_exec, exec_type, file_type, system_file_type;
 
-typeattribute aconfigd coredomain;
-
 init_daemon_domain(aconfigd)
 
-# only init is allowed to enter the aconfigd domain
-neverallow { domain -init } aconfigd:process transition;
-neverallow * aconfigd:process dyntransition;
-
 allow aconfigd metadata_file:dir search;
 
 allow aconfigd {
@@ -22,17 +16,15 @@
     aconfig_storage_flags_metadata_file
 }:file create_file_perms;
 
-allow aconfigd aconfigd_socket:unix_stream_socket { accept listen getattr read write };
-allow aconfigd aconfigd_socket:sock_file rw_file_perms;
-
 # allow aconfigd to access shell_data_file for atest
 userdebug_or_eng(`
     allow aconfigd shell_data_file:dir search;
     allow aconfigd shell_data_file:file { getattr read open map };
 ')
 
-# allow aconfigd to log to the kernel.
-allow aconfigd kmsg_device:chr_file w_file_perms;
+# allow aconfigd to log to the kernel dmesg via a file descriptor
+# passed from init to aconfigd
+allow aconfigd kmsg_device:chr_file write;
 
 # allow aconfigd to read vendor partition storage files
 allow aconfigd vendor_aconfig_storage_file:file r_file_perms;
@@ -41,3 +33,11 @@
 # allow aconfigd to read /apex dir
 allow aconfigd apex_mnt_dir:dir r_dir_perms;
 allow aconfigd apex_mnt_dir:file r_file_perms;
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd domain
+neverallow { domain -init } aconfigd:process transition;
+neverallow * aconfigd:process dyntransition;
diff --git a/private/adbd.te b/private/adbd.te
index a298f08..b87b319 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -2,13 +2,17 @@
 
 typeattribute adbd coredomain;
 typeattribute adbd mlstrustedsubject;
+typeattribute adbd adbd_common;
 
 init_daemon_domain(adbd)
 
 domain_auto_trans(adbd, shell_exec, shell)
 
+# Allow adb to setcon() to tradeinmode.
+allow adbd self:process setcurrent;
+allow adbd adbd_tradeinmode:process dyntransition;
+
 userdebug_or_eng(`
-  allow adbd self:process setcurrent;
   allow adbd su:process dyntransition;
 ')
 
@@ -78,6 +82,7 @@
 set_prop(adbd, powerctl_prop)
 get_prop(adbd, ffs_config_prop)
 set_prop(adbd, ffs_control_prop)
+set_prop(adbd, adbd_tradeinmode_prop)
 
 # Allow adbd start/stop mdnsd via ctl.start
 set_prop(adbd, ctl_mdnsd_prop)
@@ -182,6 +187,10 @@
 allow adbd shell:unix_stream_socket { read write shutdown };
 allow adbd shell:fd use;
 
+# adb push/pull /data/local/tmp.
+allow adbd shell_data_file:dir create_dir_perms;
+allow adbd shell_data_file:file create_file_perms;
+
 # Allow pull /vendor/apex files for CTS tests
 r_dir_file(adbd, vendor_apex_file)
 
@@ -206,10 +215,15 @@
 ###
 
 # No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
-# transitions to the shell domain (except when it crashes). In particular, we
-# never want to see a transition from adbd to su (aka "adb root")
-neverallow adbd { domain -crash_dump -shell }:process transition;
-neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition;
+# transitions to the shell or tradeinmode domain (except when it crashes). In
+# particular, we never want to see a transition from adbd to su (aka "adb root")
+neverallow adbd { domain -crash_dump -shell -adbd_tradeinmode }:process transition;
+neverallow adbd {
+    domain
+    userdebug_or_eng(`-su')
+    recovery_only(`-shell')
+    -adbd_tradeinmode
+}:process dyntransition;
 
 # Only init is allowed to enter the adbd domain via exec()
 neverallow { domain -init } adbd:process transition;
diff --git a/private/adbd_common.te b/private/adbd_common.te
index 6cf8e49..c24b029 100644
--- a/private/adbd_common.te
+++ b/private/adbd_common.te
@@ -2,34 +2,30 @@
 ### Put things here that are needed for both adbd proper and adbd in trade-in mode.
 
 # Connect to mdnsd via mdnsd socket.
-unix_socket_connect(adbd, mdnsd, mdnsd)
+unix_socket_connect(adbd_common, mdnsd, mdnsd)
 
 # adbd probes for vsock support. Do not generate denials when
 # this occurs. (b/123569840)
-dontaudit { adbd } self:{ socket vsock_socket } create;
+dontaudit adbd_common self:{ socket vsock_socket } create;
 
 # Allow adbd inside vm to forward vm's vsock.
-allow { adbd } self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+allow adbd_common self:vsock_socket { create_socket_perms_no_ioctl listen accept };
 
 # Access device logging gating property
-get_prop(adbd, device_logging_prop)
+get_prop(adbd_common, device_logging_prop)
 
 # Use a pseudo tty.
-allow { adbd } devpts:chr_file rw_file_perms;
-
-# adb push/pull /data/local/tmp.
-allow { adbd } shell_data_file:dir create_dir_perms;
-allow { adbd } shell_data_file:file create_file_perms;
+allow adbd_common devpts:chr_file rw_file_perms;
 
 # Read persist.adb.tls_server.enable property
-get_prop(adbd, system_adbd_prop)
+get_prop(adbd_common, system_adbd_prop)
 
 # Read whether or not Test Harness Mode is enabled
-get_prop(adbd, test_harness_prop)
+get_prop(adbd_common, test_harness_prop)
 
 # Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
-set_prop(adbd, adbd_prop)
-set_prop(adbd, adbd_config_prop)
+set_prop(adbd_common, adbd_prop)
+set_prop(adbd_common, adbd_config_prop)
 
 # Read device's serial number from system properties
-get_prop(adbd, serialno_prop)
+get_prop(adbd_common, serialno_prop)
diff --git a/private/adbd_tradeinmode.te b/private/adbd_tradeinmode.te
new file mode 100644
index 0000000..42fdec4
--- /dev/null
+++ b/private/adbd_tradeinmode.te
@@ -0,0 +1,26 @@
+### ADB in trade-in mode
+type adbd_tradeinmode, domain, coredomain, adbd_common;
+
+# Create and use network sockets.
+net_domain(adbd_tradeinmode)
+
+# Run /system/bin/tradeinmode
+domain_auto_trans(adbd_tradeinmode, tradeinmode_exec, tradeinmode)
+
+# Baseline rules to make adbd work after setcon().
+allow adbd_tradeinmode adbd:unix_stream_socket {
+    rw_socket_perms_no_ioctl
+    listen
+    accept
+};
+allow adbd_tradeinmode adbd:fd use;
+allow adbd_tradeinmode adbd:unix_dgram_socket { connect write };
+allow adbd_tradeinmode functionfs:dir r_dir_perms;
+allow adbd_tradeinmode functionfs:file rw_file_perms;
+allow adbd_tradeinmode proc_uptime:file r_file_perms;
+allow adbd_tradeinmode rootfs:dir r_dir_perms;
+
+set_prop(adbd_tradeinmode, ffs_control_prop)
+
+# Allow changing persist.adb.tradeinmode when testing.
+userdebug_or_eng(`set_prop(adbd_tradeinmode, shell_prop)')
diff --git a/private/app.te b/private/app.te
index 6362c7d..b9a6d85 100644
--- a/private/app.te
+++ b/private/app.te
@@ -159,7 +159,7 @@
 control_logd({ appdomain -ephemeral_app -sdk_sandbox_all })
 
 # application inherit logd write socket (urge is to deprecate this long term)
-allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info rebind update };
+allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info grant rebind update };
 
 allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_maintenance_service:service_manager find;
 
diff --git a/private/attributes b/private/attributes
index fe50b0d..2d6181d 100644
--- a/private/attributes
+++ b/private/attributes
@@ -15,3 +15,5 @@
 attribute sdk_sandbox_all;
 # The SDK sandbox domains for the current SDK level.
 attribute sdk_sandbox_current;
+# Common to adbd and adbd_tradeinmode.
+attribute adbd_common;
diff --git a/private/compat/202404/202404.ignore.cil b/private/compat/202404/202404.ignore.cil
index 9ac4963..8bb0a2d 100644
--- a/private/compat/202404/202404.ignore.cil
+++ b/private/compat/202404/202404.ignore.cil
@@ -19,6 +19,7 @@
     virtual_fingerprint_exec
     virtual_face
     virtual_face_exec
+    media_quality_service
     advanced_protection_service
     sysfs_firmware_acpi_tables
   ))
diff --git a/private/compat/34.0/34.0.ignore.cil b/private/compat/34.0/34.0.ignore.cil
index 6c52dba..3132c5a 100644
--- a/private/compat/34.0/34.0.ignore.cil
+++ b/private/compat/34.0/34.0.ignore.cil
@@ -52,4 +52,5 @@
     aconfigd_socket
     enable_16k_pages_prop
     proc_cgroups
+    media_quality_service
   ))
diff --git a/private/coredomain.te b/private/coredomain.te
index 93cbff5..8a46a08 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -220,6 +220,7 @@
   neverallow {
     coredomain
     -adbd
+    -adbd_tradeinmode
     -init
     -mediaprovider
     -system_server
diff --git a/private/crash_dump.te b/private/crash_dump.te
index b2d3bd5..a9a802c 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -19,13 +19,7 @@
 }:process { ptrace signal sigchld sigstop sigkill };
 
 userdebug_or_eng(`
-  allow crash_dump {
-    apexd
-    keystore
-    llkd
-    logd
-    vold
-  }:process { ptrace signal sigchld sigstop sigkill };
+  allow crash_dump { apexd llkd logd vold }:process { ptrace signal sigchld sigstop sigkill };
 ')
 
 # Read ART APEX data directory
@@ -135,7 +129,6 @@
   init
   kernel
   keystore
-  userdebug_or_eng(`-keystore')
   llkd
   userdebug_or_eng(`-llkd')
   logd
diff --git a/private/domain.te b/private/domain.te
index 03bcb85..75bcdf9 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -816,6 +816,7 @@
 neverallow {
   domain
   -adbd
+  -adbd_tradeinmode
   -dumpstate
   -fastbootd
   -hal_camera_server
@@ -1363,10 +1364,17 @@
 } shell:process { transition dyntransition };
 
 # Only domains spawned from zygote, runas and simpleperf_app_runner may have
-# the appdomain attribute. simpleperf is excluded as a domain transitioned to
-# when running an app-scoped profiling session.
+# the appdomain attribute.
+#
+# simpleperf is excluded as a domain transitioned to when running an app-scoped
+# profiling session.
+#
+# tradeinmode is excluded; it is only run when adbd is in trade-in mode,
+# transitioned from the limited adbd_tradeinmode context. It is a wrapper
+# around "am" to avoid exposing the shell context when adbd is in trade-in
+# mode.
 neverallow { domain -simpleperf_app_runner -runas -app_zygote -webview_zygote -zygote } {
-  appdomain -shell -simpleperf userdebug_or_eng(`-su')
+  appdomain -shell -simpleperf userdebug_or_eng(`-su') -tradeinmode
 }:process { transition dyntransition };
 
 # Minimize read access to shell- or app-writable symlinks.
diff --git a/private/ferrochrome_app.te b/private/ferrochrome_app.te
deleted file mode 100644
index e12c84c..0000000
--- a/private/ferrochrome_app.te
+++ /dev/null
@@ -1,11 +0,0 @@
-type ferrochrome_app, domain;
-typeattribute ferrochrome_app coredomain;
-
-app_domain(ferrochrome_app)
-
-allow ferrochrome_app app_api_service:service_manager find;
-allow ferrochrome_app system_api_service:service_manager find;
-
-# TODO(b/348113995): after remove sysprop usage, we can use just (priv_)app.te
-set_prop(ferrochrome_app, debug_prop);
-get_prop(ferrochrome_app, debug_prop);
diff --git a/private/file.te b/private/file.te
index 662d5cc..60aa5d5 100644
--- a/private/file.te
+++ b/private/file.te
@@ -218,6 +218,8 @@
 # /data/misc_ce/userId/storage_area_keys
 type storage_area_key_file, file_type, data_file_type, core_data_file_type;
 
+# /metadata/tradeinmode files
+type tradeinmode_metadata_file, file_type;
 
 # Types added in 202504 in public/file.te
 until_board_api(202504, `
diff --git a/private/file_contexts b/private/file_contexts
index 496e954..f605e66 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -409,6 +409,8 @@
 /system/bin/android\.automotive\.evs\.manager@1\.[0-9]+ u:object_r:evsmanagerd_exec:s0
 /system/bin/uprobestats           u:object_r:uprobestats_exec:s0
 /system/bin/bert_collector        u:object_r:bert_collector_exec:s0
+/system/bin/linux_vm_setup        u:object_r:linux_vm_setup_exec:s0
+/system/bin/tradeinmode           u:object_r:tradeinmode_exec:s0
 
 #############################
 # Vendor files
@@ -536,8 +538,6 @@
 /(system_ext|system/system_ext)/bin/hwservicemanager         u:object_r:hwservicemanager_exec:s0
 /(system_ext|system/system_ext)/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
 
-/(system_ext|system/system_ext)/bin/linux_vm_setup       u:object_r:linux_vm_setup_exec:s0
-
 /(system_ext|system/system_ext)/bin/canhalconfigurator(-aidl)? u:object_r:canhalconfigurator_exec:s0
 
 /(system_ext|system/system_ext)/lib(64)?(/.*)?      u:object_r:system_lib_file:s0
@@ -889,6 +889,7 @@
 /metadata/aconfig(/.*)?    u:object_r:aconfig_storage_metadata_file:s0
 /metadata/aconfig/flags(/.*)?    u:object_r:aconfig_storage_flags_metadata_file:s0
 /metadata/aconfig_test_missions(/.*)?    u:object_r:aconfig_test_mission_files:s0
+/metadata/tradeinmode(/.*)?    u:object_r:tradeinmode_metadata_file:s0
 
 ############################
 # mount point for ota metadata
diff --git a/private/keystore.te b/private/keystore.te
index 3a1c242..50542b0 100644
--- a/private/keystore.te
+++ b/private/keystore.te
@@ -93,8 +93,7 @@
 neverallow { domain -keystore -init } keystore_data_file:dir *;
 neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
 
-# TODO(b/186868271): Remove the crash dump exception soon-ish (maybe by May 14, 2021?)
-neverallow { domain userdebug_or_eng(`-crash_dump') } keystore:process ptrace;
+neverallow * keystore:process ptrace;
 
 # Only keystore can set keystore.crash_count system property. Since init is allowed to set any
 # system property, an exception is added for init as well.
diff --git a/private/platform_app.te b/private/platform_app.te
index 320624c..e60dcdd 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -99,6 +99,7 @@
 allow platform_app system_api_service:service_manager find;
 allow platform_app vr_manager_service:service_manager find;
 allow platform_app stats_service:service_manager find;
+allow platform_app tradeinmode_service:service_manager find;
 
 # Allow platform apps to log via statsd.
 binder_call(platform_app, statsd)
diff --git a/private/priv_app.te b/private/priv_app.te
index bb5da7c..1ef5be1 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -136,6 +136,9 @@
 # Allow priv_apps to check whether Dynamic System Update is enabled
 get_prop(priv_app, dynamic_system_prop)
 
+# Allow privileged apps to read trade in mode property
+get_prop(priv_app, adbd_tradeinmode_prop)
+
 # suppress denials for non-API accesses.
 dontaudit priv_app exec_type:file getattr;
 dontaudit priv_app device:dir read;
diff --git a/private/property.te b/private/property.te
index 40beca5..fc44117 100644
--- a/private/property.te
+++ b/private/property.te
@@ -1,7 +1,9 @@
 # Properties used only in /system
 system_internal_prop(adbd_prop)
+system_internal_prop(adbd_tradeinmode_prop)
 system_internal_prop(apexd_payload_metadata_prop)
 system_internal_prop(ctl_snapuserd_prop)
+system_internal_prop(ctl_uprobestats_prop)
 system_internal_prop(crashrecovery_prop)
 system_internal_prop(debug_tracing_desktop_mode_visible_tasks_prop)
 system_internal_prop(device_config_core_experiments_team_internal_prop)
@@ -509,6 +511,7 @@
   -init
   -vendor_init
   -adbd
+  -adbd_tradeinmode
   -system_server
 } {
   adbd_config_prop
@@ -519,6 +522,7 @@
   domain
   -init
   -adbd
+  -adbd_tradeinmode
 } {
   adbd_prop
 }:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index 999a69a..7664d75 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -51,6 +51,7 @@
 security.lower_kptr_restrict u:object_r:lower_kptr_restrict_prop:s0
 service.adb.root        u:object_r:shell_prop:s0
 service.adb.tls.port    u:object_r:adbd_prop:s0
+persist.adb.tradeinmode u:object_r:adbd_tradeinmode_prop:s0
 persist.adb.wifi.       u:object_r:adbd_prop:s0
 persist.adb.tls_server.enable  u:object_r:system_adbd_prop:s0
 
@@ -202,6 +203,11 @@
 ctl.stop$snapuserd      u:object_r:ctl_snapuserd_prop:s0
 ctl.restart$snapuserd   u:object_r:ctl_snapuserd_prop:s0
 
+# Restrict access to control uprobestats
+ctl.start$uprobestats     u:object_r:ctl_uprobestats_prop:s0
+ctl.stop$uprobestats      u:object_r:ctl_uprobestats_prop:s0
+ctl.restart$uprobestats   u:object_r:ctl_uprobestats_prop:s0
+
 # Restrict access to starting/stopping artd_pre_reboot.
 ctl.start$artd_pre_reboot          u:object_r:ctl_artd_pre_reboot_prop:s0
 ctl.stop$artd_pre_reboot           u:object_r:ctl_artd_pre_reboot_prop:s0
@@ -597,6 +603,12 @@
 persist.bluetooth.factoryreset                              u:object_r:bluetooth_prop:s0 exact bool
 persist.bluetooth.leaudio.allow_list                        u:object_r:bluetooth_prop:s0 exact string
 
+bluetooth.a2dp.source.sbc_priority.config            u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.aac_priority.config            u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.aptx_priority.config           u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.aptx_hd_priority.config        u:object_r:bluetooth_config_prop:s0 exact int
+bluetooth.a2dp.source.ldac_priority.config           u:object_r:bluetooth_config_prop:s0 exact int
+
 bluetooth.hardware.power.operating_voltage_mv        u:object_r:bluetooth_config_prop:s0 exact int
 bluetooth.hardware.power.idle_cur_ma                 u:object_r:bluetooth_config_prop:s0 exact int
 bluetooth.hardware.power.tx_cur_ma                   u:object_r:bluetooth_config_prop:s0 exact int
diff --git a/private/seapp_contexts b/private/seapp_contexts
index 0b857de..ce49fc4 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -225,5 +225,3 @@
 user=_app isPrivApp=true name=com.google.android.virtualization.vmlauncher domain=vmlauncher_app type=privapp_data_file levelFrom=all
 user=_app isPrivApp=true name=com.android.virtualization.terminal domain=vmlauncher_app type=privapp_data_file levelFrom=all
 user=_app isPrivApp=true name=com.google.android.virtualization.terminal domain=vmlauncher_app type=privapp_data_file levelFrom=all
-user=_app isPrivApp=true name=com.android.virtualization.linuxinstaller domain=ferrochrome_app type=privapp_data_file levelFrom=all
-user=_app isPrivApp=true name=com.android.virtualization.ferrochrome domain=ferrochrome_app type=privapp_data_file levelFrom=all
diff --git a/private/service.te b/private/service.te
index 1f31477..08a032a 100644
--- a/private/service.te
+++ b/private/service.te
@@ -28,11 +28,15 @@
 type statsbootstrap_service,         system_server_service, service_manager_type;
 type statscompanion_service,         system_server_service, service_manager_type;
 type statsmanager_service,           system_api_service, system_server_service, service_manager_type;
+until_board_api(202504, `
+    type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
 
 is_flag_enabled(RELEASE_SUPERVISION_SERVICE, `
     type supervision_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 ')
 type tracingproxy_service,          system_server_service, service_manager_type;
+type tradeinmode_service,           system_server_service, service_manager_type;
 type transparency_service,          system_server_service, service_manager_type;
 
 is_flag_enabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
diff --git a/private/service_contexts b/private/service_contexts
index 37652ae..8cab6ea 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -337,6 +337,7 @@
 media_communication                       u:object_r:media_communication_service:s0
 media_metrics                             u:object_r:media_metrics_service:s0
 media_projection                          u:object_r:media_projection_service:s0
+media_quality                             u:object_r:media_quality_service:s0
 media_resource_monitor                    u:object_r:media_session_service:s0
 media_router                              u:object_r:media_router_service:s0
 media_session                             u:object_r:media_session_service:s0
@@ -466,6 +467,7 @@
 thermalservice                            u:object_r:thermal_service:s0
 thread_network                            u:object_r:threadnetwork_service:s0
 tracing.proxy                             u:object_r:tracingproxy_service:s0
+tradeinmode                               u:object_r:tradeinmode_service:s0
 translation                               u:object_r:translation_service:s0
 transparency                              u:object_r:transparency_service:s0
 trust                                     u:object_r:trust_service:s0
diff --git a/private/shell.te b/private/shell.te
index a6e9975..839178c 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -273,12 +273,6 @@
 # TODO (b/350628688): Remove this once it's safe to do so.
 allow shell oatdump_exec:file rx_file_perms;
 
-# Allow shell access to socket for test
-userdebug_or_eng(`
-    allow shell aconfigd_socket:sock_file write;
-    allow shell aconfigd:unix_stream_socket connectto;
-')
-
 # Create and use network sockets.
 net_domain(shell)
 
diff --git a/private/statsd.te b/private/statsd.te
index b932bc6..8b77c1e 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -41,6 +41,8 @@
 
 # Allow statsd to trigger uprobestats via property.
 set_prop(statsd, uprobestats_start_with_config_prop);
+# Allow statsd to start the uprobestats service.
+set_prop(statsd, ctl_uprobestats_prop)
 binder_use(statsd)
 
 # Allow statsd to scan through /proc/pid for all processes.
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index f6f1d9b..1e0e1ef 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -85,9 +85,14 @@
 # Use socket supplied by adbd, for cmd gpu vkjson etc.
 allow surfaceflinger adbd:unix_stream_socket { read write getattr };
 
-# Allow reading and writing to sockets used for BLAST buffer releases
+# Allow reading and writing to sockets used for BLAST buffer releases.
+# SurfaceFlinger never reads from these sockets but needs read permissions in order to receive
+# the file descriptors over binder. There's no mechanism to mark a socket as write-only.
+# shutdown is used to close the read-end of the sockets that are sent to SurfaceFlinger. See
+# b/353597444
 allow surfaceflinger { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all }:unix_stream_socket { read write };
 allow surfaceflinger bootanim:unix_stream_socket { read write };
+allow surfaceflinger automotive_display_service:unix_stream_socket { read write };
 
 # Allow a dumpstate triggered screenshot
 binder_call(surfaceflinger, dumpstate)
@@ -135,6 +140,8 @@
 allow surfaceflinger statsmanager_service:service_manager find;
 # TODO(146461633): remove this once native pullers talk to StatsManagerService
 binder_call(surfaceflinger, statsd);
+# Allow pushing atoms to the stats bootstrap atom service
+allow surfaceflinger statsbootstrap_service:service_manager find;
 
 # Allow to use files supplied by hal_evs
 allow surfaceflinger hal_evs:fd use;
@@ -142,10 +149,6 @@
 # Allow to use release fence fds supplied by hal_camera
 allow surfaceflinger hal_camera:fd use;
 
-# Allow pushing jank event atoms to statsd
-userdebug_or_eng(`
-    unix_socket_send(surfaceflinger, statsdw, statsd)
-')
 
 # Surfaceflinger should not be reading default vendor-defined properties.
 dontaudit surfaceflinger vendor_default_prop:file read;
diff --git a/private/system_server.te b/private/system_server.te
index fc4faef..f39668e 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1134,9 +1134,9 @@
 
 # Connect to adbd and use a socket transferred from it.
 # Used for e.g. jdwp.
-allow system_server adbd:unix_stream_socket connectto;
-allow system_server adbd:fd use;
-allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
+allow system_server adbd_common:unix_stream_socket connectto;
+allow system_server adbd_common:fd use;
+allow system_server adbd_common:unix_stream_socket { getattr getopt ioctl read write shutdown };
 
 # Read service.adb.tls.port, persist.adb.wifi. properties
 get_prop(system_server, adbd_prop)
@@ -1144,6 +1144,9 @@
 # Set persist.adb.tls_server.enable property
 set_prop(system_server, system_adbd_prop)
 
+# Set service.adbd.tradeinmode from ITradeInService.
+set_prop(system_server, adbd_tradeinmode_prop)
+
 # Allow invoking tools like "timeout"
 allow system_server toolbox_exec:file rx_file_perms;
 
@@ -1447,6 +1450,9 @@
 # Allow system server to read /apex/apex-info-list.xml
 allow system_server apex_info_file:file r_file_perms;
 
+# Allow system_server to communicate with tradeinmode.
+binder_call(system_server, tradeinmode)
+
 # Allow system server to communicate to system-suspend's control interface
 allow system_server system_suspend_control_internal_service:service_manager find;
 allow system_server system_suspend_control_service:service_manager find;
@@ -1498,6 +1504,10 @@
 allow system_server password_slot_metadata_file:dir rw_dir_perms;
 allow system_server password_slot_metadata_file:file create_file_perms;
 
+# Allow TradeInMode service rw access to /metadata/tradeinmode.
+allow system_server tradeinmode_metadata_file:dir rw_dir_perms;
+allow system_server tradeinmode_metadata_file:file create_file_perms;
+
 allow system_server userspace_reboot_metadata_file:dir create_dir_perms;
 allow system_server userspace_reboot_metadata_file:file create_file_perms;
 
@@ -1673,6 +1683,9 @@
 neverallow { domain -init -system_server } crashrecovery_prop:property_service set;
 neverallow { domain -init -dumpstate -system_server } crashrecovery_prop:file no_rw_file_perms;
 
+# Do not allow anything other than system_server and init to touch /metadata/tradeinmode.
+neverallow { domain -init -system_server } tradeinmode_metadata_file:file no_rw_file_perms;
+
 neverallow {
   domain
   -init
diff --git a/private/tradeinmode.te b/private/tradeinmode.te
new file mode 100644
index 0000000..05315a4
--- /dev/null
+++ b/private/tradeinmode.te
@@ -0,0 +1,26 @@
+### trade-in mode
+
+type tradeinmode, domain, coredomain;
+type tradeinmode_exec, exec_type, file_type, system_file_type;
+
+allow tradeinmode adbd_tradeinmode:fd use;
+
+allow tradeinmode adbd_tradeinmode:unix_stream_socket { read write ioctl };
+allow tradeinmode devpts:chr_file rw_file_perms;
+
+# Allow executing am/content without a domain transition.
+allow tradeinmode system_file:file rx_file_perms;
+allow tradeinmode zygote_exec:file rx_file_perms;
+allow tradeinmode apex_info_file:file r_file_perms;
+
+allow tradeinmode activity_service:service_manager find;
+
+get_prop(tradeinmode, odsign_prop)
+get_prop(tradeinmode, build_attestation_prop)
+
+# Needed to start activities through "am".
+binder_call(tradeinmode, system_server)
+binder_call(tradeinmode, servicemanager)
+
+# Needed to run "content".
+binder_call(tradeinmode, platform_app)
diff --git a/private/vendor_init.te b/private/vendor_init.te
index 84ec60e..0a2d62c 100644
--- a/private/vendor_init.te
+++ b/private/vendor_init.te
@@ -115,6 +115,7 @@
   -userspace_reboot_metadata_file
   -aconfig_storage_metadata_file
   -aconfig_storage_flags_metadata_file
+  -tradeinmode_metadata_file
   enforce_debugfs_restriction(`-debugfs_type')
 }:file { create getattr open read write setattr relabelfrom unlink map };
 
diff --git a/private/vmlauncher_app.te b/private/vmlauncher_app.te
index c76c117..71c9f3f 100644
--- a/private/vmlauncher_app.te
+++ b/private/vmlauncher_app.te
@@ -11,6 +11,8 @@
 allow vmlauncher_app shell_data_file:file { read open write };
 virtualizationservice_use(vmlauncher_app)
 
+allow vmlauncher_app fsck_exec:file { r_file_perms execute execute_no_trans };
+
 is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
   # TODO(b/332677707): remove them when display service uses binder RPC.
   allow vmlauncher_app virtualization_service:service_manager find;
@@ -24,3 +26,6 @@
   # Allow other processes to access the pts.
   allow vmlauncher_app vmlauncher_app_devpts:chr_file setattr;
 ')
+
+# TODO(b/372664601): Remove this when we don't need linux_vm_setup
+set_prop(vmlauncher_app, debug_prop);
diff --git a/public/service.te b/public/service.te
index 9d77fb9..cc9b1ab 100644
--- a/public/service.te
+++ b/public/service.te
@@ -176,6 +176,9 @@
 type media_communication_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_metrics_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_projection_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+starting_at_board_api(202504, `
+    type media_quality_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
+')
 type media_router_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type media_session_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
 type meminfo_service, system_api_service, system_server_service, service_manager_type;