Snap for 12872597 from 417ef69506 to mainline-tzdata6-release

Change-Id: Ife96f810a815e35cda53005492cda00e3afb4696

radio/file_contexts

@@ -12,7 +12,6 @@
 /vendor/bin/hw/vendor\.google\.radioext@1\.0-service                        u:object_r:hal_radioext_default_exec:s0
 /vendor/bin/liboemservice_proxy_default                                     u:object_r:liboemservice_proxy_default_exec:s0
 /vendor/bin/copy_efs_files_to_data                                                            u:object_r:copy_efs_files_to_data_exec:s0
-/vendor/bin/shared_modem_platform                                           u:object_r:modem_svc_sit_exec:s0
 
 # Config files
 /vendor/etc/modem_ml_models\.conf                                           u:object_r:modem_config_file:s0

radio/modem_svc_sit.te

@@ -38,9 +38,6 @@ get_prop(modem_svc_sit, hwservicemanager_prop)
 # logging property
 get_prop(modem_svc_sit, vendor_logger_prop)
 
-# Modem SVC will register the default instance of the AIDL ISharedModemPlatform hal.
-hal_server_domain(modem_svc_sit, hal_shared_modem_platform)
-
 # Write trace data to the Perfetto traced daemon. This requires connecting to
 # its producer socket and obtaining a (per-process) tmpfs fd.
 perfetto_producer(modem_svc_sit)

tracking_denials/bluetooth.te

@@ -0,0 +1,2 @@
+# b/382362125
+dontaudit bluetooth default_android_service:service_manager { find };

tracking_denials/bug_map

@@ -1,16 +1,18 @@
+aconfigd apex_info_file file b/381326735
+bluetooth audio_config_prop file b/379245855
 dump_modem sscoredump_vendor_data_coredump_file dir b/361725982
 dump_modem sscoredump_vendor_data_logcat_file dir b/361725982
 dumpstate app_zygote process b/288049050
 edgetpu_vendor_server shell_data_file dir b/369475225
 edgetpu_vendor_server shell_data_file dir b/369475363
 hal_bluetooth_btlinux vendor_default_prop property_service b/350832030
-hal_fingerprint_default default_android_service service_manager b/376602341
+hal_camera_default aconfig_storage_metadata_file dir b/383013471
 hal_radioext_default radio_vendor_data_file file b/312590044
-hal_vibrator_default default_android_service service_manager b/314054292
-hal_vibrator_default default_android_service service_manager b/367943515
 incidentd debugfs_wakeup_sources file b/288049561
 incidentd incidentd anon_inode b/288049561
+init init capability b/379207041
 insmod-sh insmod-sh key b/274374722
+insmod-sh vendor_edgetpu_debugfs dir b/385858993
 kernel dm_device blk_file b/319403445
 modem_svc_sit hal_radioext_default process b/364446415
 modem_svc_sit modem_ml_svc_sit file b/360060606
@@ -18,15 +20,21 @@ modem_svc_sit modem_ml_svc_sit file b/360060992
 mtectrl unlabeled dir b/264483752
 pixelstats_vendor block_device dir b/369540673
 pixelstats_vendor block_device dir b/369540836
+platform_app radio_vendor_data_file dir b/380756119
 platform_app vendor_fw_file dir b/372121912
 platform_app vendor_rild_prop file b/372121912
+priv_app audio_config_prop file b/379246064
+radio audio_config_prop file b/379245771
 ramdump ramdump capability b/369475700
+ramdump_app default_prop file b/386149375
+ramdump_app privapp_data_file lnk_file b/385858590
 shell sysfs_net file b/330081782
 ssr_detector_app default_prop file b/340722729
 system_server sysfs_batteryinfo file b/294967729
 system_server vendor_default_prop file b/366116488
 system_suspend sysfs_batteryinfo dir b/317316633
 system_suspend sysfs_touch_gti dir b/350832258
+untrusted_app audio_config_prop file b/379245754
 vendor_init default_prop file b/315104235
 vendor_init default_prop file b/315104803
 vendor_init default_prop file b/323087197
@@ -34,3 +42,5 @@ vendor_init default_prop file b/323087490
 vendor_init default_prop property_service b/315104235
 vendor_init default_prop property_service b/359428180
 vendor_init vendor_volte_mif_off property_service b/316816642
+zygote aconfig_storage_metadata_file dir b/383949325
+zygote zygote capability b/379207101

vendor/debug_camera_app.te

@@ -1,3 +1,4 @@
+# File containing sepolicies for GCA-Eng & GCA-Next.
 userdebug_or_eng(`
 	# Allows GCA-Eng & GCA-Next access the GXP device and properties.
 	allow debug_camera_app gxp_device:chr_file rw_file_perms;
@@ -9,4 +10,7 @@ userdebug_or_eng(`
 
 	# Allows  GCA_Eng & GCA-Next to access the hw_jpeg /dev/video12.
 	allow debug_camera_app hw_jpg_device:chr_file rw_file_perms;
+
+	# Allow tachyon_service to communicate with GCA-Eng via binder.
+	binder_call(edgetpu_tachyon_server, debug_camera_app);
 ')

vendor/file_contexts

@@ -100,6 +100,7 @@ is_flag_disabled(RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT, `
 /dev/gxp                                                                    u:object_r:gxp_device:s0
 /dev/mali0                                                                  u:object_r:gpu_device:s0
 /dev/goodix_fp                                                              u:object_r:fingerprint_device:s0
+/dev/fth_fd                                                                 u:object_r:fingerprint_device:s0
 /dev/logbuffer_tcpm                                                         u:object_r:logbuffer_device:s0
 /dev/logbuffer_usbpd                                                        u:object_r:logbuffer_device:s0
 /dev/logbuffer_ssoc                                                         u:object_r:logbuffer_device:s0

vendor/genfs_contexts

@@ -290,6 +290,8 @@ genfscon sysfs /devices/platform/odm/odm:btbcm/wakeup
 genfscon sysfs /devices/platform/19440000.drmdsim/19440000.drmdsim.0/wakeup/                                              u:object_r:sysfs_wakeup:s0
 genfscon sysfs /devices/platform/19450000.drmdsim/19450000.drmdsim.0/wakeup/                                              u:object_r:sysfs_wakeup:s0
 genfscon sysfs /devices/platform/110f0000.drmdp/wakeup                                                                    u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/odm/odm:fps_touch_handler/power/wakeup                                                   u:object_r:sysfs_wakeup:s0
+genfscon sysfs /devices/platform/odm/odm:fps_touch_handler/wakeup                                                         u:object_r:sysfs_wakeup:s0
 
 # Trusty
 genfscon sysfs /module/trusty_virtio/parameters/use_high_wq               u:object_r:sysfs_trusty:s0
@@ -346,3 +348,8 @@ genfscon sysfs /devices/platform/13200000.ufs/pixel/boot_lun_enabled           u
 # CPU
 genfscon sysfs /kernel/metrics/cpuidle_histogram/cpuidle_histogram        u:object_r:sysfs_cpu:s0
 genfscon sysfs /kernel/metrics/cpuidle_histogram/cpucluster_histogram     u:object_r:sysfs_cpu:s0
+
+# USB
+starting_at_board_api(202504, `
+genfscon sysfs /devices/platform/11210000.usb/11210000.dwc3/udc/11210000.dwc3/state   u:object_r:sysfs_udc:s0
+')

vendor/google_camera_app.te

@@ -8,3 +8,6 @@ allow google_camera_app edgetpu_device:chr_file { getattr read write ioctl map }
 
 # Allows GCA to access the hw_jpeg /dev/video12.
 allow google_camera_app hw_jpg_device:chr_file rw_file_perms;
+
+# Allow tachyon service to communicate with google_camera_app via binder.
+binder_call(edgetpu_tachyon_server, google_camera_app);

vendor/gpu.te

@@ -0,0 +1,10 @@
+# Policy to enable only production gpu ioctls.
+is_flag_enabled(RELEASE_PIXEL_MALI_SEPOLICY_ENABLED, `
+  # Allow gpu ioctls used in production.
+  allowxperm appdomain gpu_device:chr_file ioctl { unpriv_gpu_ioctls instrumentation_gpu_ioctls };
+  # Audit gpu ioctl commands which have been deprecated,
+  # or are intended for development of the GPU.
+  auditallow appdomain gpu_device:chr_file ioctl;
+  allowxperm appdomain gpu_device:chr_file ioctl { debug_gpu_ioctls deprecated_gpu_ioctls };
+  auditallowxperm appdomain gpu_device:chr_file ioctl { debug_gpu_ioctls deprecated_gpu_ioctls };
+')

vendor/hal_usb_impl.te

@@ -20,6 +20,9 @@ hal_client_domain(hal_usb_impl, hal_thermal);
 # For monitoring usb sysfs attributes
 allow hal_usb_impl sysfs_wakeup:dir search;
 allow hal_usb_impl sysfs_wakeup:file r_file_perms;
+starting_at_board_api(202504, `
+allow hal_usb_impl sysfs_udc:file r_file_perms;
+')
 
 # For metrics upload
 allow hal_usb_impl fwk_stats_service:service_manager find;

vendor/ioctl_defines

@@ -0,0 +1,73 @@
+define(`KBASE_IOCTL_VERSION_CHECK_JM', `0x8000')
+define(`KBASE_IOCTL_SET_FLAGS', `0x8001')
+define(`KBASE_IOCTL_JOB_SUBMIT', `0x8002')
+define(`KBASE_IOCTL_GET_GPUPROPS', `0x8003')
+define(`KBASE_IOCTL_POST_TERM', `0x8004')
+define(`KBASE_IOCTL_MEM_ALLOC', `0x8005')
+define(`KBASE_IOCTL_MEM_QUERY', `0x8006')
+define(`KBASE_IOCTL_MEM_FREE', `0x8007')
+define(`KBASE_IOCTL_HWCNT_READER_SETUP', `0x8008')
+define(`KBASE_IOCTL_DISJOINT_QUERY', `0x800c')
+define(`KBASE_IOCTL_GET_DDK_VERSION', `0x800d')
+define(`KBASE_IOCTL_MEM_JIT_INIT', `0x800e')
+define(`KBASE_IOCTL_MEM_SYNC', `0x800f')
+define(`KBASE_IOCTL_MEM_FIND_CPU_OFFSET', `0x8010')
+define(`KBASE_IOCTL_GET_CONTEXT_ID', `0x8011')
+define(`KBASE_IOCTL_TLSTREAM_ACQUIRE', `0x8012')
+define(`KBASE_IOCTL_TLSTREAM_FLUSH', `0x8013')
+define(`KBASE_IOCTL_MEM_COMMIT', `0x8014')
+define(`KBASE_IOCTL_MEM_ALIAS', `0x8015')
+define(`KBASE_IOCTL_MEM_IMPORT', `0x8016')
+define(`KBASE_IOCTL_MEM_FLAGS_CHANGE', `0x8017')
+define(`KBASE_IOCTL_STREAM_CREATE', `0x8018')
+define(`KBASE_IOCTL_FENCE_VALIDATE', `0x8019')
+define(`KBASE_IOCTL_MEM_PROFILE_ADD', `0x801b')
+define(`KBASE_IOCTL_SOFT_EVENT_UPDATE', `0x801c')
+define(`KBASE_IOCTL_STICKY_RESOURCE_MAP', `0x801d')
+define(`KBASE_IOCTL_STICKY_RESOURCE_UNMAP', `0x801e')
+define(`KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET', `0x801f')
+define(`KBASE_IOCTL_HWCNT_SET', `0x8020')
+define(`KBASE_IOCTL_CINSTR_GWT_START', `0x8021')
+define(`KBASE_IOCTL_CINSTR_GWT_STOP', `0x8022')
+define(`KBASE_IOCTL_CINSTR_GWT_DUMP', `0x8023')
+define(`KBASE_IOCTL_CS_QUEUE_REGISTER', `0x8024')
+define(`KBASE_IOCTL_CS_QUEUE_KICK', `0x8025')
+define(`KBASE_IOCTL_MEM_EXEC_INIT', `0x8026')
+define(`KBASE_IOCTL_CS_QUEUE_BIND', `0x8027')
+define(`KBASE_IOCTL_CS_QUEUE_REGISTER_EX', `0x8028')
+define(`KBASE_IOCTL_CS_QUEUE_TERMINATE', `0x8029')
+define(`KBASE_IOCTL_CS_QUEUE_GROUP_CREATE_1_6', `0x802a')
+define(`KBASE_IOCTL_CS_QUEUE_GROUP_TERMINATE', `0x802b')
+define(`KBASE_IOCTL_CS_EVENT_SIGNAL', `0x802c')
+define(`KBASE_IOCTL_KCPU_QUEUE_CREATE', `0x802d')
+define(`KBASE_IOCTL_KCPU_QUEUE_DELETE', `0x802e')
+define(`KBASE_IOCTL_KCPU_QUEUE_ENQUEUE', `0x802f')
+define(`KBASE_IOCTL_CS_TILER_HEAP_INIT', `0x8030')
+define(`KBASE_IOCTL_CS_TILER_HEAP_TERM', `0x8031')
+define(`KBASE_IOCTL_GET_CPU_GPU_TIMEINFO', `0x8032')
+define(`KBASE_IOCTL_CS_GET_GLB_IFACE', `0x8033')
+define(`KBASE_IOCTL_VERSION_CHECK_CSF', `0x8034')
+define(`KBASE_IOCTL_CS_CPU_QUEUE_DUMP', `0x8035')
+define(`KBASE_IOCTL_CONTEXT_PRIORITY_CHECK', `0x8036')
+define(`KBASE_IOCTL_SET_LIMITED_CORE_COUNT', `0x8037')
+define(`KBASE_IOCTL_KINSTR_PRFCNT_ENUM_INFO', `0x8038')
+define(`KBASE_IOCTL_KINSTR_PRFCNT_SETUP', `0x8039')
+define(`KBASE_IOCTL_CS_QUEUE_GROUP_CREATE', `0x803a')
+define(`KBASE_IOCTL_MEM_ALLOC_EX', `0x803b')
+define(`KBASE_IOCTL_READ_USER_PAGE', `0x803c')
+define(`KBASE_IOCTL_QUEUE_GROUP_CLEAR_FAULTS', `0x803d')
+define(`KBASE_IOCTL_APC_REQUEST', `0x8042')
+define(`KBASE_IOCTL_BUFFER_LIVENESS_UPDATE', `0x8043')
+define(`KBASE_HWCNT_READER_GET_HWVER', `0xBE00')
+define(`KBASE_HWCNT_READER_GET_BUFFER_SIZE', `0xBE01')
+define(`KBASE_HWCNT_READER_DUMP', `0xBE10')
+define(`KBASE_HWCNT_READER_CLEAR', `0xBE11')
+define(`KBASE_HWCNT_READER_GET_BUFFER', `0xBE20')
+define(`KBASE_HWCNT_READER_PUT_BUFFER', `0xBE21')
+define(`KBASE_HWCNT_READER_SET_INTERVAL', `0xBE30')
+define(`KBASE_HWCNT_READER_ENABLE_EVENT', `0xBE40')
+define(`KBASE_HWCNT_READER_DISABLE_EVENT', `0xBE41')
+define(`KBASE_HWCNT_READER_GET_API_VERSION', `0xBEFF')
+define(`KBASE_IOCTL_KINSTR_PRFCNT_CMD', `0xBF00')
+define(`KBASE_IOCTL_KINSTR_PRFCNT_GET_SAMPLE', `0xBF01')
+define(`KBASE_IOCTL_KINSTR_PRFCNT_PUT_SAMPLE', `0xBF10')

vendor/ioctl_macros

@@ -0,0 +1,83 @@
+define(`unpriv_gpu_ioctls', `{
+  KBASE_IOCTL_VERSION_CHECK_JM
+  KBASE_IOCTL_SET_FLAGS
+  KBASE_IOCTL_JOB_SUBMIT
+  KBASE_IOCTL_GET_GPUPROPS
+  KBASE_IOCTL_POST_TERM
+  KBASE_IOCTL_MEM_ALLOC
+  KBASE_IOCTL_MEM_QUERY
+  KBASE_IOCTL_MEM_FREE
+  KBASE_IOCTL_DISJOINT_QUERY
+  KBASE_IOCTL_GET_DDK_VERSION
+  KBASE_IOCTL_MEM_JIT_INIT
+  KBASE_IOCTL_MEM_SYNC
+  KBASE_IOCTL_MEM_FIND_CPU_OFFSET
+  KBASE_IOCTL_GET_CONTEXT_ID
+  KBASE_IOCTL_MEM_COMMIT
+  KBASE_IOCTL_MEM_ALIAS
+  KBASE_IOCTL_MEM_IMPORT
+  KBASE_IOCTL_MEM_FLAGS_CHANGE
+  KBASE_IOCTL_STREAM_CREATE
+  KBASE_IOCTL_FENCE_VALIDATE
+  KBASE_IOCTL_MEM_PROFILE_ADD
+  KBASE_IOCTL_SOFT_EVENT_UPDATE
+  KBASE_IOCTL_STICKY_RESOURCE_MAP
+  KBASE_IOCTL_STICKY_RESOURCE_UNMAP
+  KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET
+  KBASE_IOCTL_CS_QUEUE_REGISTER
+  KBASE_IOCTL_CS_QUEUE_KICK
+  KBASE_IOCTL_MEM_EXEC_INIT
+  KBASE_IOCTL_CS_QUEUE_BIND
+  KBASE_IOCTL_CS_QUEUE_REGISTER_EX
+  KBASE_IOCTL_CS_QUEUE_TERMINATE
+  KBASE_IOCTL_CS_QUEUE_GROUP_TERMINATE
+  KBASE_IOCTL_CS_EVENT_SIGNAL
+  KBASE_IOCTL_KCPU_QUEUE_CREATE
+  KBASE_IOCTL_KCPU_QUEUE_DELETE
+  KBASE_IOCTL_KCPU_QUEUE_ENQUEUE
+  KBASE_IOCTL_CS_TILER_HEAP_INIT
+  KBASE_IOCTL_CS_TILER_HEAP_TERM
+  KBASE_IOCTL_GET_CPU_GPU_TIMEINFO
+  KBASE_IOCTL_CS_GET_GLB_IFACE
+  KBASE_IOCTL_VERSION_CHECK_CSF
+  KBASE_IOCTL_CS_CPU_QUEUE_DUMP
+  KBASE_IOCTL_CONTEXT_PRIORITY_CHECK
+  KBASE_IOCTL_SET_LIMITED_CORE_COUNT
+  KBASE_IOCTL_CS_QUEUE_GROUP_CREATE
+  KBASE_IOCTL_MEM_ALLOC_EX
+  KBASE_IOCTL_READ_USER_PAGE
+  KBASE_IOCTL_QUEUE_GROUP_CLEAR_FAULTS
+  KBASE_IOCTL_APC_REQUEST
+  KBASE_IOCTL_BUFFER_LIVENESS_UPDATE
+}')
+
+define(`instrumentation_gpu_ioctls', `{
+  KBASE_IOCTL_KINSTR_PRFCNT_ENUM_INFO
+  KBASE_IOCTL_KINSTR_PRFCNT_SETUP
+  KBASE_IOCTL_TLSTREAM_ACQUIRE
+  KBASE_IOCTL_TLSTREAM_FLUSH
+  KBASE_IOCTL_KINSTR_PRFCNT_CMD
+  KBASE_IOCTL_KINSTR_PRFCNT_GET_SAMPLE
+  KBASE_IOCTL_KINSTR_PRFCNT_PUT_SAMPLE
+}')
+
+define(`debug_gpu_ioctls', `{
+  KBASE_IOCTL_HWCNT_SET
+  KBASE_IOCTL_CINSTR_GWT_START
+  KBASE_IOCTL_CINSTR_GWT_STOP
+  KBASE_IOCTL_CINSTR_GWT_DUMP
+}')
+
+define(`deprecated_gpu_ioctls', `{
+  KBASE_HWCNT_READER_GET_HWVER
+  KBASE_HWCNT_READER_GET_BUFFER_SIZE
+  KBASE_HWCNT_READER_DUMP
+  KBASE_HWCNT_READER_CLEAR
+  KBASE_HWCNT_READER_GET_BUFFER
+  KBASE_HWCNT_READER_PUT_BUFFER
+  KBASE_HWCNT_READER_SET_INTERVAL
+  KBASE_HWCNT_READER_ENABLE_EVENT
+  KBASE_HWCNT_READER_DISABLE_EVENT
+  KBASE_HWCNT_READER_GET_API_VERSION
+  KBASE_IOCTL_CS_QUEUE_GROUP_CREATE_1_6
+}')

zuma-sepolicy.mk

@@ -1,6 +1,6 @@
 # sepolicy that are shared among devices using zuma
 BOARD_SEPOLICY_DIRS += device/google/zuma-sepolicy/vendor
-BOARD_SEPOLICY_DIRS += device/google/zuma-sepolicy/radio
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/zuma-sepolicy/radio
 PRODUCT_PRIVATE_SEPOLICY_DIRS += device/google/zuma-sepolicy/radio/private
 
 # unresolved SELinux error log with bug tracking