Merge "Add sepolicy for edgetpu_tachyon_service to report metrics" into main
diff --git a/audio/aidl.mk b/audio/aidl.mk
index 7dd56bc..68458dd 100644
--- a/audio/aidl.mk
+++ b/audio/aidl.mk
@@ -16,7 +16,11 @@
libhapticgeneratoraidl \
BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/aidl
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio
+ifeq ($(AUDIO_USE_DPTX_SEPOLICY),true)
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio/dptx
+else
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio/drmdp
+endif
include device/google/gs-common/audio/common.mk
diff --git a/audio/hidl_zuma.mk b/audio/hidl_zuma.mk
index 6fb3449..64ad2ba 100644
--- a/audio/hidl_zuma.mk
+++ b/audio/hidl_zuma.mk
@@ -42,7 +42,7 @@
endif
BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hidl
-BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/audio/sepolicy/hdmi_audio/drmdp
include device/google/gs-common/audio/common.mk
diff --git a/audio/sepolicy/hdmi_audio/dptx/genfs_contexts b/audio/sepolicy/hdmi_audio/dptx/genfs_contexts
new file mode 100644
index 0000000..64803be
--- /dev/null
+++ b/audio/sepolicy/hdmi_audio/dptx/genfs_contexts
@@ -0,0 +1 @@
+genfscon sysfs /devices/platform/dwc_dptx-audio/extcon/hdmi_audio u:object_r:sysfs_extcon:s0
diff --git a/audio/sepolicy/hdmi_audio/genfs_contexts b/audio/sepolicy/hdmi_audio/drmdp/genfs_contexts
similarity index 100%
rename from audio/sepolicy/hdmi_audio/genfs_contexts
rename to audio/sepolicy/hdmi_audio/drmdp/genfs_contexts
diff --git a/chre/sepolicy/hal_contexthub_default.te b/chre/sepolicy/hal_contexthub_default.te
index 87e3a42..50e7ca3 100644
--- a/chre/sepolicy/hal_contexthub_default.te
+++ b/chre/sepolicy/hal_contexthub_default.te
@@ -35,3 +35,6 @@
# Allow binder calls with clients
binder_call(hal_contexthub_default, hal_sensors_default)
+
+# Allow access for AoC properties.
+get_prop(hal_contexthub_default, vendor_aoc_prop)
diff --git a/gps/pixel/sepolicy/hal_gnss_pixel.te b/gps/pixel/sepolicy/hal_gnss_pixel.te
index e3e4d92..b9e1bd4 100644
--- a/gps/pixel/sepolicy/hal_gnss_pixel.te
+++ b/gps/pixel/sepolicy/hal_gnss_pixel.te
@@ -24,3 +24,6 @@
# Allow access ssrdump information
allow hal_gnss_pixel sscoredump_vendor_data_crashinfo_file:file r_file_perms;
allow hal_gnss_pixel sscoredump_vendor_data_crashinfo_file:dir r_dir_perms;
+
+# Allow pixel gnss access vendor_gps_file
+allow hal_gnss_pixel vendor_gps_file:file create_file_perms;
diff --git a/gril/aidl/2.1/compatibility_matrix.xml b/gril/aidl/2.1/compatibility_matrix.xml
new file mode 100644
index 0000000..c1ce8f9
--- /dev/null
+++ b/gril/aidl/2.1/compatibility_matrix.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix version="1.0" type="framework">
+ <hal format="aidl" optional="true">
+ <name>vendor.google.radio_ext</name>
+ <version>3</version>
+ <interface>
+ <name>IRadioExt</name>
+ <instance>default</instance>
+ </interface>
+ </hal>
+</compatibility-matrix>
diff --git a/gril/aidl/2.1/gril_aidl.mk b/gril/aidl/2.1/gril_aidl.mk
new file mode 100644
index 0000000..d5bc3fc
--- /dev/null
+++ b/gril/aidl/2.1/gril_aidl.mk
@@ -0,0 +1,4 @@
+PRODUCT_PACKAGES += vendor.google.radioext@1.0-service
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/gril/aidl/2.1/compatibility_matrix.xml
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/aidl/2.1/sepolicy
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/gril/common/sepolicy
diff --git a/gril/aidl/2.1/sepolicy/file_contexts b/gril/aidl/2.1/sepolicy/file_contexts
new file mode 100644
index 0000000..9973b80
--- /dev/null
+++ b/gril/aidl/2.1/sepolicy/file_contexts
@@ -0,0 +1 @@
+/vendor/bin/hw/vendor\.google\.radioext@1\.0-service u:object_r:hal_aidl_radio_ext_exec:s0
diff --git a/gril/aidl/2.1/sepolicy/grilservice_app.te b/gril/aidl/2.1/sepolicy/grilservice_app.te
new file mode 100644
index 0000000..812c8a2
--- /dev/null
+++ b/gril/aidl/2.1/sepolicy/grilservice_app.te
@@ -0,0 +1,4 @@
+# allow grilservice_app to find hal_radio_ext_service
+allow grilservice_app hal_radio_ext_service:service_manager find;
+binder_call(grilservice_app, hal_aidl_radio_ext)
+binder_call(grilservice_app, twoshay)
diff --git a/gril/aidl/2.1/sepolicy/hal_aidl_radio_ext.te b/gril/aidl/2.1/sepolicy/hal_aidl_radio_ext.te
new file mode 100644
index 0000000..eaff153
--- /dev/null
+++ b/gril/aidl/2.1/sepolicy/hal_aidl_radio_ext.te
@@ -0,0 +1,36 @@
+# hal_aidl_radio_ext domain
+type hal_aidl_radio_ext, domain;
+type hal_aidl_radio_ext_exec, vendor_file_type, exec_type, file_type;
+
+init_daemon_domain(hal_aidl_radio_ext)
+
+get_prop(hal_aidl_radio_ext, hwservicemanager_prop)
+get_prop(hal_aidl_radio_ext, telephony_modemtype_prop)
+set_prop(hal_aidl_radio_ext, vendor_gril_prop)
+
+binder_call(hal_aidl_radio_ext, servicemanager)
+binder_call(hal_aidl_radio_ext, grilservice_app)
+binder_call(hal_aidl_radio_ext, hal_bluetooth_btlinux)
+
+add_service(hal_aidl_radio_ext, hal_radio_ext_service)
+
+# RW /dev/oem_ipc0
+allow hal_aidl_radio_ext radio_device:chr_file rw_file_perms;
+
+# RW MIPI Freq files
+allow hal_aidl_radio_ext radio_vendor_data_file:dir create_dir_perms;
+allow hal_aidl_radio_ext radio_vendor_data_file:file create_file_perms;
+
+# Bluetooth
+allow hal_aidl_radio_ext hal_bluetooth_coexistence_hwservice:hwservice_manager find;
+allow hal_aidl_radio_ext hal_bluetooth_coexistence_service:service_manager find;
+
+# Allow access to the backlight driver to set ssc_mode
+allow hal_aidl_radio_ext sysfs_leds:dir search;
+allow hal_aidl_radio_ext sysfs_leds:file rw_file_perms;
+
+# legacy/zuma/vendor
+allow hal_aidl_radio_ext sysfs_display:file rw_file_perms;
+
+# Allow access to read display port info
+allow hal_aidl_radio_ext sysfs:file r_file_perms;
diff --git a/gril/aidl/2.1/sepolicy/hal_camera_default.te b/gril/aidl/2.1/sepolicy/hal_camera_default.te
new file mode 100644
index 0000000..61f8001
--- /dev/null
+++ b/gril/aidl/2.1/sepolicy/hal_camera_default.te
@@ -0,0 +1,2 @@
+# allow hal_camera_default to binder call hal_aidl_radio_ext
+binder_call(hal_camera_default, hal_aidl_radio_ext);
diff --git a/gril/aidl/2.1/sepolicy/twoshay.te b/gril/aidl/2.1/sepolicy/twoshay.te
new file mode 100644
index 0000000..f7d3fe1
--- /dev/null
+++ b/gril/aidl/2.1/sepolicy/twoshay.te
@@ -0,0 +1,2 @@
+# allow twoshay to binder call hal_aidl_radio_ext
+binder_call(twoshay, hal_aidl_radio_ext)
diff --git a/input/gia/aidl/compatibility_matrix.xml b/input/gia/aidl/compatibility_matrix.xml
new file mode 100644
index 0000000..1a348ea
--- /dev/null
+++ b/input/gia/aidl/compatibility_matrix.xml
@@ -0,0 +1,10 @@
+<compatibility-matrix type="framework" version="1.0">
+ <hal format="aidl" optional="true">
+ <name>com.google.input.gia.core</name>
+ <interface>
+ <name>IGiaService</name>
+ <instance>default</instance>
+ </interface>
+ <version>1</version>
+ </hal>
+</compatibility-matrix>
\ No newline at end of file
diff --git a/input/gia/aidl/manifest.xml b/input/gia/aidl/manifest.xml
new file mode 100644
index 0000000..98303c8
--- /dev/null
+++ b/input/gia/aidl/manifest.xml
@@ -0,0 +1,10 @@
+<manifest type="device" version="1.0">
+ <hal format="aidl" optional="true">
+ <name>com.google.input.gia.core</name>
+ <interface>
+ <name>IGiaService</name>
+ <instance>default</instance>
+ </interface>
+ <version>1</version>
+ </hal>
+</manifest>
\ No newline at end of file
diff --git a/input/gia/gia.mk b/input/gia/gia.mk
new file mode 100644
index 0000000..ea079ca
--- /dev/null
+++ b/input/gia/gia.mk
@@ -0,0 +1,11 @@
+BOARD_VENDOR_SEPOLICY_DIRS += device/google/gs-common/input/gia/sepolicy
+
+PRODUCT_PACKAGES += gia
+PRODUCT_PACKAGES += com.google.input.gia.giaservicemanager
+
+PRODUCT_SOONG_NAMESPACES += vendor/google/interfaces
+PRODUCT_SOONG_NAMESPACES += vendor/google/input/gia/core
+PRODUCT_SOONG_NAMESPACES += vendor/google/input/gia/core-servicemanager
+
+DEVICE_MANIFEST_FILE += device/google/gs-common/input/gia/aidl/manifest.xml
+DEVICE_PRODUCT_COMPATIBILITY_MATRIX_FILE += device/google/gs-common/input/gia/aidl/compatibility_matrix.xml
diff --git a/input/gia/sepolicy/attributes b/input/gia/sepolicy/attributes
new file mode 100644
index 0000000..1d61ad3
--- /dev/null
+++ b/input/gia/sepolicy/attributes
@@ -0,0 +1,2 @@
+# This macro produces: define hal_gia, hal_gia_client, hal_gia_server
+hal_attribute(gia)
diff --git a/input/gia/sepolicy/file_contexts b/input/gia/sepolicy/file_contexts
new file mode 100644
index 0000000..99d6857
--- /dev/null
+++ b/input/gia/sepolicy/file_contexts
@@ -0,0 +1,2 @@
+# chmod +x in SEPolicy language
+/vendor/bin/gia u:object_r:gia_exec:s0
diff --git a/input/gia/sepolicy/gia.te b/input/gia/sepolicy/gia.te
new file mode 100644
index 0000000..2c84e7c
--- /dev/null
+++ b/input/gia/sepolicy/gia.te
@@ -0,0 +1,18 @@
+# SEPolicies for GIA (Google Input interface Abstraction layer)
+type gia, domain;
+type gia_exec, exec_type, vendor_file_type, file_type;
+
+# Macro transferring gia_exec to the gia domain
+init_daemon_domain(gia)
+
+# let this domain use the hal service
+hal_client_domain(gia, hal_gia)
+# allow binder communication with service_manager
+binder_use(gia)
+
+# let this domain serve the hal service
+hal_server_domain(gia, hal_gia)
+
+# allow gia for accessing touch related system file-nodes
+allow gia sysfs_touch_gti:dir r_dir_perms;
+allow gia sysfs_touch_gti:file rw_file_perms;
diff --git a/input/gia/sepolicy/hal_gia.te b/input/gia/sepolicy/hal_gia.te
new file mode 100644
index 0000000..b75c9fb
--- /dev/null
+++ b/input/gia/sepolicy/hal_gia.te
@@ -0,0 +1,8 @@
+# allow binder connection from client to server
+binder_call(hal_gia_client, hal_gia_server)
+
+# allow client to find the service & allow server to register the service
+hal_attribute_service(hal_gia, hal_gia_service)
+
+# allow binder communication from server to service_manager
+binder_use(hal_gia_server)
diff --git a/input/gia/sepolicy/service.te b/input/gia/sepolicy/service.te
new file mode 100644
index 0000000..aed1135
--- /dev/null
+++ b/input/gia/sepolicy/service.te
@@ -0,0 +1,2 @@
+# Declares GIA related services
+type hal_gia_service, hal_service_type, protected_service, service_manager_type;
diff --git a/input/gia/sepolicy/service_contexts b/input/gia/sepolicy/service_contexts
new file mode 100644
index 0000000..b1773ec
--- /dev/null
+++ b/input/gia/sepolicy/service_contexts
@@ -0,0 +1,2 @@
+# Attaches GIA services to the cooresponding SEPolicy group
+com.google.input.gia.core.IGiaService/default u:object_r:hal_gia_service:s0
diff --git a/mediacodec/vpu/sepolicy/mediacodec_google.te b/mediacodec/vpu/sepolicy/mediacodec_google.te
index 99a3c8d..cf9dfc5 100644
--- a/mediacodec/vpu/sepolicy/mediacodec_google.te
+++ b/mediacodec/vpu/sepolicy/mediacodec_google.te
@@ -13,6 +13,7 @@
allow mediacodec_google dmabuf_system_heap_device:chr_file r_file_perms;
allow mediacodec_google video_device:chr_file { read write open ioctl map };
+allow mediacodec_google gpu_device:chr_file rw_file_perms;
# mediacodec_google should never execute any executable without a domain transition
neverallow mediacodec_google { file_type fs_type }:file execute_no_trans;
diff --git a/storage/init.storage.rc b/storage/init.storage.rc
index 9e4acd4..943c483 100644
--- a/storage/init.storage.rc
+++ b/storage/init.storage.rc
@@ -42,10 +42,13 @@
# UFS
write /dev/sys/block/bootdevice/clkgate_enable 0
+ write /dev/sys/block/bootdevice/wb_on 0
+ write /dev/sys/block/bootdevice/enable_wb_buf_flush 0
on property:sys.boot_completed=1
# Health Storage HAL
chown system system /dev/sys/block/bootdevice/manual_gc
+ write /dev/sys/block/bootdevice/manual_gc 0
# Pixelstats
chown system system /dev/sys/block/bootdevice/slowio_read_cnt