diff --git a/Android.bp b/Android.bp
index 55951e2..8fa57ca 100644
--- a/Android.bp
+++ b/Android.bp
@@ -634,3 +634,104 @@
     relative_install_path: "selinux/mapping",
     installable: false,
 }
+
+///////////////////////////////////////////////////////////////////
+genrule {
+    name: "microdroid_pub_policy.cil_gen",
+    srcs: [
+        ":microdroid_sepolicy_public_and_reqd_mask_build_files",
+        ":microdroid_reqd_policy_mask.cil_gen",
+    ],
+    tools: ["m4", "checkpolicy", "build_sepolicy"],
+    out: ["pub_policy.cil"],
+    cmd: policy_to_conf_flags + " -s $(locations :microdroid_sepolicy_public_and_reqd_mask_build_files) > $(out).conf && " +
+        "$(location checkpolicy) -C -M -c 30 -o $(out) $(out).conf && " +
+        "$(location build_sepolicy) filter_out -f $(location :microdroid_reqd_policy_mask.cil_gen) -t $(out)",
+    visibility: ["//visibility:private"],
+}
+
+genrule {
+    name: "microdroid_plat_pub_versioned.cil_gen",
+    srcs: [":microdroid_pub_policy.cil_gen"],
+    tools: ["version_policy"],
+    out: ["plat_pub_versioned.cil"],
+    cmd: "$(location version_policy) " +
+        "-b $(location :microdroid_pub_policy.cil_gen) " +
+        "-t $(location :microdroid_pub_policy.cil_gen) " +
+        "-n 10000.0 " +
+        "-o $(out)",
+    visibility: ["//visibility:private"],
+}
+
+filegroup {
+    name: "microdroid_vendor_sepolicy_build_files",
+    srcs: [
+        "reqd_mask/security_classes",
+        "reqd_mask/initial_sids",
+        "reqd_mask/access_vectors",
+        "public/global_macros",
+        "public/neverallow_macros",
+        "reqd_mask/mls_macros",
+        "reqd_mask/mls_decl",
+        "reqd_mask/mls",
+        "public/te_macros",
+        "public/attributes",
+        "public/ioctl_defines",
+        "public/ioctl_macros",
+        "public/*.te",
+        "reqd_mask/*.te",
+        "vendor/*.te",
+        "reqd_mask/roles_decl",
+        "public/roles",
+        "reqd_mask/roles",
+        "reqd_mask/users",
+        "reqd_mask/initial_sid_contexts",
+    ],
+}
+
+genrule {
+    name: "microdroid_vendor_sepolicy.cil_gen",
+    srcs: [
+        ":microdroid_vendor_sepolicy_build_files",
+        ":microdroid_plat_pub_versioned.cil_gen",
+        ":microdroid_pub_policy.cil_gen",
+        ":microdroid_reqd_policy_mask.cil_gen",
+    ],
+    tools: [
+        "m4",
+        "build_sepolicy",
+        "checkpolicy",
+        "secilc",
+        "version_policy",
+    ],
+    out: ["vendor_sepolicy.cil"],
+    cmd: policy_to_conf_flags + " -s $(locations :microdroid_vendor_sepolicy_build_files) > $(out).conf && " +
+        "$(location build_sepolicy) " +
+        "--android_host_path $$(dirname $(location build_sepolicy)) " +
+        "build_cil " +
+        "--input_policy_conf $(out).conf " +
+        "--checkpolicy_env ASAN_OPTIONS=detect_leaks=0 " +
+        "--base_policy $(location :microdroid_pub_policy.cil_gen) " +
+        "--filter_out_files $(location :microdroid_plat_pub_versioned.cil_gen) " +
+        "--reqd_mask $(location :microdroid_reqd_policy_mask.cil_gen) " +
+        "--treble_sepolicy_vers 10000.0 " +
+        "--policy_vers 30 " +
+        "--output_cil $(out)",
+    visibility: ["//visibility:private"],
+}
+
+prebuilt_etc {
+    name: "microdroid_vendor_sepolicy.cil",
+    src: ":microdroid_vendor_sepolicy.cil_gen",
+    filename: "vendor_sepolicy.cil",
+    relative_install_path: "selinux",
+    installable: false,
+}
+
+prebuilt_etc {
+    name: "microdroid_plat_pub_versioned.cil",
+    src: ":microdroid_plat_pub_versioned.cil_gen",
+    filename: "plat_pub_versioned.cil",
+    relative_install_path: "selinux",
+    installable: false,
+}
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index 3793195..835f901 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -22,6 +22,7 @@
     ctl_snapuserd_prop
     debugfs_kprobes
     debugfs_mm_events_tracing
+    debugfs_bootreceiver_tracing
     device_config_profcollect_native_boot_prop
     device_config_connectivity_prop
     device_config_swcodec_native_prop
diff --git a/private/coredomain.te b/private/coredomain.te
index de9b953..9fe82d3 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -11,6 +11,7 @@
 get_prop(coredomain, localization_prop)
 get_prop(coredomain, pm_prop)
 get_prop(coredomain, radio_control_prop)
+get_prop(coredomain, rollback_test_prop)
 get_prop(coredomain, setupwizard_prop)
 get_prop(coredomain, sqlite_log_prop)
 get_prop(coredomain, storagemanager_config_prop)
diff --git a/private/genfs_contexts b/private/genfs_contexts
index 21a1ae9..79b0313 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -177,6 +177,8 @@
 
 genfscon debugfs /tracing/instances                   u:object_r:debugfs_tracing_instances:s0
 genfscon tracefs /instances                           u:object_r:debugfs_tracing_instances:s0
+genfscon debugfs /tracing/instances/bootreceiver      u:object_r:debugfs_bootreceiver_tracing:s0
+genfscon tracefs /instances/bootreceiver              u:object_r:debugfs_bootreceiver_tracing:s0
 genfscon debugfs /tracing/instances/mm_events         u:object_r:debugfs_mm_events_tracing:s0
 genfscon tracefs /instances/mm_events                 u:object_r:debugfs_mm_events_tracing:s0
 genfscon debugfs /tracing/instances/wifi              u:object_r:debugfs_wifi_tracing:s0
diff --git a/private/init.te b/private/init.te
index 348673b..4e8289a 100644
--- a/private/init.te
+++ b/private/init.te
@@ -83,3 +83,6 @@
 
 # Only init can set keystore.boot_level
 neverallow { -init } keystore_listen_prop:property_service set;
+
+# Allow accessing /sys/kernel/tracing/instances/bootreceiver to set up tracing.
+allow init debugfs_bootreceiver_tracing:file w_file_perms;
diff --git a/private/property.te b/private/property.te
index 34c0fd8..88f3ec0 100644
--- a/private/property.te
+++ b/private/property.te
@@ -21,6 +21,7 @@
 system_internal_prop(lower_kptr_restrict_prop)
 system_internal_prop(netd_stable_secret_prop)
 system_internal_prop(pm_prop)
+system_internal_prop(rollback_test_prop)
 system_internal_prop(setupwizard_prop)
 system_internal_prop(system_adbd_prop)
 system_internal_prop(suspend_prop)
@@ -556,3 +557,9 @@
 # Only one of system_property_type and vendor_property_type can be assigned.
 # Property types having both attributes won't be accessible from anywhere.
 neverallow domain system_and_vendor_property_type:{file property_service} *;
+
+neverallow {
+  # Only allow init and shell to set rollback_test_prop
+  -init
+  -shell
+} rollback_test_prop:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index 22e0ff6..1854bd7 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -1122,3 +1122,7 @@
 # SOC related props
 ro.soc.manufacturer u:object_r:soc_prop:s0 exact string
 ro.soc.model        u:object_r:soc_prop:s0 exact string
+
+# set to true when running rollback tests to disable fallback-to-copy when enabling rollbacks
+# to detect failures where hard linking should work otherwise
+persist.rollback.is_test u:object_r:rollback_test_prop:s0 exact bool
diff --git a/private/shell.te b/private/shell.te
index 94a2c2e..a99ada8 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -94,6 +94,9 @@
 # userspace reboot
 set_prop(shell, userspace_reboot_test_prop)
 
+# Allow shell to set this property used for rollback tests
+set_prop(shell, rollback_test_prop)
+
 # Allow shell to get encryption policy of /data/local/tmp/, for CTS
 allowxperm shell shell_data_file:dir ioctl {
   FS_IOC_GET_ENCRYPTION_POLICY
diff --git a/private/system_server.te b/private/system_server.te
index 7d26410..349a0b8 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1030,6 +1030,10 @@
 allow system_server debugfs_wifi_tracing:dir search;
 allow system_server debugfs_wifi_tracing:file rw_file_perms;
 
+# Allow BootReceiver to watch trace error_report events.
+allow system_server debugfs_bootreceiver_tracing:dir search;
+allow system_server debugfs_bootreceiver_tracing:file r_file_perms;
+
 # Allow system_server to read tracepoint ids in order to attach BPF programs to them.
 allow system_server debugfs_tracing:file r_file_perms;
 
diff --git a/public/file.te b/public/file.te
index 4e17f12..243148f 100644
--- a/public/file.te
+++ b/public/file.te
@@ -557,6 +557,9 @@
 # vndservice_contexts file
 type vndservice_contexts_file, file_type;
 
+# /sys/kernel/tracing/instances/bootreceiver for monitoring kernel memory corruptions.
+type debugfs_bootreceiver_tracing, fs_type, debugfs_type;
+
 # Allow files to be created in their appropriate filesystems.
 allow fs_type self:filesystem associate;
 allow cgroup tmpfs:filesystem associate;
diff --git a/public/hal_wifi_supplicant.te b/public/hal_wifi_supplicant.te
index e19ad1c..7361af1 100644
--- a/public/hal_wifi_supplicant.te
+++ b/public/hal_wifi_supplicant.te
@@ -21,6 +21,7 @@
 allowxperm hal_wifi_supplicant self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
 
 use_keystore(hal_wifi_supplicant)
+binder_use(hal_wifi_supplicant_server)
 
 # Allow the WI-FI HAL to use keys in the keystore namespace wifi_key.
 allow hal_wifi_supplicant wifi_key:keystore2_key {