Merge "Fix module-file name collisions"
diff --git a/core/config_sanitizers.mk b/core/config_sanitizers.mk
index a0ff119..35c632c 100644
--- a/core/config_sanitizers.mk
+++ b/core/config_sanitizers.mk
@@ -161,17 +161,19 @@
   my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
 endif
 
-# Also disable CFI if ASAN is enabled.
+# Also disable CFI and MTE if ASAN is enabled.
 ifneq ($(filter address,$(my_sanitize)),)
   my_sanitize := $(filter-out cfi,$(my_sanitize))
+  my_sanitize := $(filter-out memtag_stack,$(my_sanitize))
+  my_sanitize := $(filter-out memtag_heap,$(my_sanitize))
   my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
 endif
 
 # Disable memtag for host targets. Host executables in AndroidMk files are
 # deprecated, but some partners still have them floating around.
 ifdef LOCAL_IS_HOST_MODULE
-  my_sanitize := $(filter-out memtag_heap,$(my_sanitize))
-  my_sanitize_diag := $(filter-out memtag_heap,$(my_sanitize_diag))
+  my_sanitize := $(filter-out memtag_heap memtag_stack,$(my_sanitize))
+  my_sanitize_diag := $(filter-out memtag_heap memtag_stack,$(my_sanitize_diag))
 endif
 
 # Disable sanitizers which need the UBSan runtime for host targets.
@@ -205,10 +207,13 @@
 ifneq ($(filter arm x86 x86_64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
   my_sanitize := $(filter-out hwaddress,$(my_sanitize))
   my_sanitize := $(filter-out memtag_heap,$(my_sanitize))
+  my_sanitize := $(filter-out memtag_stack,$(my_sanitize))
 endif
 
 ifneq ($(filter hwaddress,$(my_sanitize)),)
   my_sanitize := $(filter-out address,$(my_sanitize))
+  my_sanitize := $(filter-out memtag_stack,$(my_sanitize))
+  my_sanitize := $(filter-out memtag_heap,$(my_sanitize))
   my_sanitize := $(filter-out thread,$(my_sanitize))
   my_sanitize := $(filter-out cfi,$(my_sanitize))
 endif
@@ -224,21 +229,27 @@
   endif
 endif
 
-ifneq ($(filter memtag_heap,$(my_sanitize)),)
-  # Add memtag ELF note.
-  ifneq ($(filter EXECUTABLES NATIVE_TESTS,$(LOCAL_MODULE_CLASS)),)
-    ifneq ($(filter memtag_heap,$(my_sanitize_diag)),)
-      my_whole_static_libraries += note_memtag_heap_sync
-    else
-      my_whole_static_libraries += note_memtag_heap_async
-    endif
+ifneq ($(filter memtag_heap memtag_stack,$(my_sanitize)),)
+  ifneq ($(filter memtag_heap,$(my_sanitize_diag)),)
+    my_cflags += -fsanitize-memtag-mode=sync
+    my_sanitize_diag := $(filter-out memtag_heap,$(my_sanitize_diag))
+  else
+    my_cflags += -fsanitize-memtag-mode=async
   endif
-  # This is all that memtag_heap does - it is not an actual -fsanitize argument.
-  # Remove it from the list.
+endif
+
+ifneq ($(filter memtag_heap,$(my_sanitize)),)
+  my_cflags += -fsanitize=memtag-heap
   my_sanitize := $(filter-out memtag_heap,$(my_sanitize))
 endif
 
-my_sanitize_diag := $(filter-out memtag_heap,$(my_sanitize_diag))
+ifneq ($(filter memtag_stack,$(my_sanitize)),)
+  my_cflags += -fsanitize=memtag-stack
+  my_cflags += -march=armv8a+memtag
+  my_ldflags += -march=armv8a+memtag
+  my_asflags += -march=armv8a+memtag
+  my_sanitize := $(filter-out memtag_stack,$(my_sanitize))
+endif
 
 # TSAN is not supported on 32-bit architectures. For non-multilib cases, make
 # its use an error. For multilib cases, don't use it for the 32-bit case.
diff --git a/target/product/base_system.mk b/target/product/base_system.mk
index 04a5ba2..cfda1e3 100644
--- a/target/product/base_system.mk
+++ b/target/product/base_system.mk
@@ -69,6 +69,7 @@
     com.android.neuralnetworks \
     com.android.scheduling \
     com.android.sdkext \
+    com.android.sepolicy \
     com.android.tethering \
     com.android.tzdata \
     com.android.uwb \
@@ -375,6 +376,7 @@
 PRODUCT_PACKAGES_DEBUG := \
     adb_keys \
     arping \
+    com.android.sepolicy.cert-debug.der \
     dmuserd \
     idlcli \
     init-debug.rc \