Add sphal namespace to swcodec apex

Add sphal namespace for swcodec apex, and keep the search/
permitted paths in sync with system's sphal/vndk namespaces.

This change also removes libz.so from the list of shared libs
linking from default to platform namespace.

bug: 129552044
bug: 129095969

test: cts-tradefed run singleCommand cts -d --module CtsMediaTestCases --test android.media.cts.DecoderTest#testVp9HdrStaticMetadata

Change-Id: Id3148dacde43e4bd9c1782ffd67acb21ef095811
diff --git a/apex/ld.config.txt b/apex/ld.config.txt
index 2daeeac..b6896f5 100644
--- a/apex/ld.config.txt
+++ b/apex/ld.config.txt
@@ -8,7 +8,7 @@
 dir.swcodec = /apex/com.android.media.swcodec/bin/
 
 [swcodec]
-additional.namespaces = platform
+additional.namespaces = platform,sphal
 
 ###############################################################################
 # "default" namespace
@@ -22,35 +22,12 @@
 namespace.default.search.paths      = /apex/com.android.media.swcodec/${LIB}
 namespace.default.asan.search.paths = /apex/com.android.media.swcodec/${LIB}
 
-# Keep the below in sync with "sphal" namespace in system's /etc/ld.config.txt
-# Codec2 has dependencies on some SP-hals (eg. android.hardware.graphics.mapper@2.0)
-# These are dlopen'ed by libvndksupport.so.
-namespace.default.search.paths += /odm/${LIB}
-namespace.default.search.paths += /vendor/${LIB}
-
-namespace.default.permitted.paths  = /odm/${LIB}
-namespace.default.permitted.paths += /vendor/${LIB}
-namespace.default.permitted.paths += /vendor/${LIB}/hw
-namespace.default.permitted.paths += /system/vendor/${LIB}
-
-namespace.default.asan.search.paths += /data/asan/odm/${LIB}
-namespace.default.asan.search.paths +=           /odm/${LIB}
-namespace.default.asan.search.paths += /data/asan/vendor/${LIB}
-namespace.default.asan.search.paths +=           /vendor/${LIB}
-
-namespace.default.asan.permitted.paths  = /data/asan/odm/${LIB}
-namespace.default.asan.permitted.paths +=           /odm/${LIB}
-namespace.default.asan.permitted.paths += /data/asan/vendor/${LIB}
-namespace.default.asan.permitted.paths +=           /vendor/${LIB}
-
 namespace.default.links = platform
 
 # TODO: replace the following when apex has a way to auto-generate this list
 # namespace.default.link.platform.shared_libs  = %LLNDK_LIBRARIES%
 # namespace.default.link.platform.shared_libs += %SANITIZER_RUNTIME_LIBRARIES%
 namespace.default.link.platform.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.asan-i686-android.so:libclang_rt.asan-x86_64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
-# FIXME: b/129552044
-namespace.default.link.platform.shared_libs += libz.so
 
 ###############################################################################
 # "platform" namespace
@@ -74,3 +51,78 @@
 # possible.
 namespace.platform.permitted.paths = /apex/com.android.runtime/${LIB}/bionic
 namespace.platform.asan.permitted.paths = /apex/com.android.runtime/${LIB}/bionic
+
+###############################################################################
+# "sphal" namespace
+#
+###############################################################################
+namespace.sphal.isolated = true
+namespace.sphal.visible = true
+
+# Keep the below in sync with "sphal" namespace in system's /etc/ld.config.txt
+# Codec2 has dependencies on some SP-hals (eg. android.hardware.graphics.mapper@2.0)
+# These are dlopen'ed by libvndksupport.so.
+namespace.sphal.search.paths  = /odm/${LIB}
+namespace.sphal.search.paths += /vendor/${LIB}
+
+namespace.sphal.permitted.paths  = /odm/${LIB}
+namespace.sphal.permitted.paths += /vendor/${LIB}
+namespace.sphal.permitted.paths += /vendor/${LIB}/hw
+namespace.sphal.permitted.paths += /system/vendor/${LIB}
+
+namespace.sphal.asan.search.paths  = /data/asan/odm/${LIB}
+namespace.sphal.asan.search.paths +=           /odm/${LIB}
+namespace.sphal.asan.search.paths += /data/asan/vendor/${LIB}
+namespace.sphal.asan.search.paths +=           /vendor/${LIB}
+
+namespace.sphal.asan.permitted.paths  = /data/asan/odm/${LIB}
+namespace.sphal.asan.permitted.paths +=           /odm/${LIB}
+namespace.sphal.asan.permitted.paths += /data/asan/vendor/${LIB}
+namespace.sphal.asan.permitted.paths +=           /vendor/${LIB}
+
+# Keep the below in sync with "vndk" namespace in system's /etc/ld.config.txt
+# System's sphal namespace links to vndk namespace for %VNDK_SAMEPROCESS_LIBRARIES%,
+# since we don't have a good way to auto-expand %VNDK_SAMEPROCESS_LIBRARIES%,
+# we'll add the vndk paths below.
+
+namespace.sphal.search.paths += /odm/${LIB}/vndk-sp
+namespace.sphal.search.paths += /vendor/${LIB}/vndk-sp
+namespace.sphal.search.paths += /system/${LIB}/vndk-sp${VNDK_VER}
+
+namespace.sphal.permitted.paths += /odm/${LIB}/hw
+namespace.sphal.permitted.paths += /odm/${LIB}/egl
+namespace.sphal.permitted.paths += /vendor/${LIB}/hw
+namespace.sphal.permitted.paths += /vendor/${LIB}/egl
+namespace.sphal.permitted.paths += /system/vendor/${LIB}/hw
+namespace.sphal.permitted.paths += /system/vendor/${LIB}/egl
+# This is exceptionally required since android.hidl.memory@1.0-impl.so is here
+namespace.sphal.permitted.paths += /system/${LIB}/vndk-sp${VNDK_VER}/hw
+
+namespace.sphal.asan.search.paths += /data/asan/odm/${LIB}/vndk-sp
+namespace.sphal.asan.search.paths +=           /odm/${LIB}/vndk-sp
+namespace.sphal.asan.search.paths += /data/asan/vendor/${LIB}/vndk-sp
+namespace.sphal.asan.search.paths +=           /vendor/${LIB}/vndk-sp
+namespace.sphal.asan.search.paths += /data/asan/system/${LIB}/vndk-sp${VNDK_VER}
+namespace.sphal.asan.search.paths +=           /system/${LIB}/vndk-sp${VNDK_VER}
+
+namespace.sphal.asan.permitted.paths += /data/asan/odm/${LIB}/hw
+namespace.sphal.asan.permitted.paths +=           /odm/${LIB}/hw
+namespace.sphal.asan.permitted.paths += /data/asan/odm/${LIB}/egl
+namespace.sphal.asan.permitted.paths +=           /odm/${LIB}/egl
+namespace.sphal.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
+namespace.sphal.asan.permitted.paths +=           /vendor/${LIB}/hw
+namespace.sphal.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
+namespace.sphal.asan.permitted.paths +=           /vendor/${LIB}/egl
+
+namespace.sphal.asan.permitted.paths += /data/asan/system/${LIB}/vndk-sp${VNDK_VER}/hw
+namespace.sphal.asan.permitted.paths +=           /system/${LIB}/vndk-sp${VNDK_VER}/hw
+
+# Once in this namespace, access to libraries in /system/lib is restricted. Only
+# libs listed here can be used.
+namespace.sphal.links = platform
+
+# TODO: replace the following when apex has a way to auto-generate this list
+# namespace.sphal.link.platform.shared_libs  = %LLNDK_LIBRARIES%
+# namespace.sphal.link.platform.shared_libs += %SANITIZER_RUNTIME_LIBRARIES%
+namespace.sphal.link.platform.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libc.so:libcgrouprc.so:libclang_rt.asan-aarch64-android.so:libclang_rt.asan-arm-android.so:libclang_rt.hwasan-aarch64-android.so:libclang_rt.asan-i686-android.so:libclang_rt.asan-x86_64-android.so:libdl.so:libft2.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
+