Snap for 12664851 from 94560a2cfac7252990e1bb844a1ae31deebb07ea to 25Q1-release

Change-Id: I3745b6ecc7675324a2a049881cc85e103dd61dad
diff --git a/fs_mgr/fs_mgr.cpp b/fs_mgr/fs_mgr.cpp
index e4d6986..9f52f44 100644
--- a/fs_mgr/fs_mgr.cpp
+++ b/fs_mgr/fs_mgr.cpp
@@ -822,9 +822,6 @@
     if (read_only) {
         mountflags |= MS_RDONLY;
     }
-    if (!fs_mgr_set_blk_ro(source, read_only)) {
-        PLOG(ERROR) << "Failed to set " << source << " as " << (read_only ? "RO" : "RW");
-    }
     int ret = 0;
     int save_errno = 0;
     int gc_allowance = 0;
@@ -879,6 +876,9 @@
     }
     PINFO << __FUNCTION__ << "(source=" << source << source_missing << ",target=" << target
           << target_missing << ",type=" << entry.fs_type << ")=" << ret;
+    if ((ret == 0) && (mountflags & MS_RDONLY) != 0) {
+        fs_mgr_set_blk_ro(source);
+    }
     if (ret == 0) {
         android::base::SetProperty("ro.boottime.init.mount." + Basename(target),
                                    std::to_string(t.duration().count()));
diff --git a/fs_mgr/libsnapshot/snapuserd/Android.bp b/fs_mgr/libsnapshot/snapuserd/Android.bp
index 97cfe76..639116e 100644
--- a/fs_mgr/libsnapshot/snapuserd/Android.bp
+++ b/fs_mgr/libsnapshot/snapuserd/Android.bp
@@ -89,7 +89,6 @@
         "libprocessgroup_util",
         "libjsoncpp",
     ],
-    include_dirs: ["bionic/libc/kernel"],
     export_include_dirs: ["include"],
     header_libs: [
         "libcutils_headers",
@@ -144,7 +143,6 @@
         "libstorage_literals_headers",
     ],
 
-    include_dirs: ["bionic/libc/kernel"],
     system_shared_libs: [],
 
     // snapuserd is started during early boot by first-stage init. At that
@@ -226,7 +224,6 @@
         "libz",
     ],
     include_dirs: [
-        "bionic/libc/kernel",
         ".",
     ],
     header_libs: [
@@ -324,7 +321,6 @@
         "libz",
     ],
     include_dirs: [
-        "bionic/libc/kernel",
         ".",
     ],
     header_libs: [
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/merge_worker.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/merge_worker.cpp
index 486548c..a0c5c66 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/merge_worker.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/merge_worker.cpp
@@ -582,7 +582,6 @@
     pthread_setname_np(pthread_self(), "MergeWorker");
 
     if (!snapuserd_->WaitForMergeBegin()) {
-        SNAP_LOG(ERROR) << "Merge terminated early...";
         return true;
     }
     auto merge_thread_priority = android::base::GetUintProperty<uint32_t>(
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp
index 9a1d441..3007d45 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_readahead.cpp
@@ -702,7 +702,7 @@
     // window. If there is a crash during this time frame, merge should resume
     // based on the contents of the scratch space.
     if (!snapuserd_->WaitForMergeReady()) {
-        SNAP_LOG(ERROR) << "ReadAhead failed to wait for merge ready";
+        SNAP_LOG(VERBOSE) << "ReadAhead failed to wait for merge ready";
         return false;
     }
 
diff --git a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp
index 2ad4ea1..714c641 100644
--- a/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp
+++ b/fs_mgr/libsnapshot/snapuserd/user-space-merge/snapuserd_transitions.cpp
@@ -202,7 +202,7 @@
     cv.wait(lock, [this]() -> bool { return MergeInitiated() || IsMergeBeginError(io_state_); });
 
     if (IsMergeBeginError(io_state_)) {
-        SNAP_LOG(ERROR) << "WaitForMergeBegin failed with state: " << io_state_;
+        SNAP_LOG(VERBOSE) << "WaitForMergeBegin failed with state: " << io_state_;
         return false;
     }
 
@@ -276,7 +276,9 @@
         if (io_state_ == MERGE_IO_TRANSITION::MERGE_FAILED ||
             io_state_ == MERGE_IO_TRANSITION::MERGE_COMPLETE ||
             io_state_ == MERGE_IO_TRANSITION::IO_TERMINATED) {
-            SNAP_LOG(ERROR) << "Wait for merge ready failed: " << io_state_;
+            if (io_state_ == MERGE_IO_TRANSITION::MERGE_FAILED) {
+                SNAP_LOG(ERROR) << "Wait for merge ready failed: " << io_state_;
+            }
             return false;
         }
         return true;
diff --git a/init/devices.cpp b/init/devices.cpp
index 2cdecec..fafa58f 100644
--- a/init/devices.cpp
+++ b/init/devices.cpp
@@ -193,9 +193,11 @@
     BlockDeviceInfo info;
 
     if (!boot_part_uuid_.empty()) {
-        // Only use the more specific "MMC" or "SCSI" match if a partition UUID
-        // was passed. Old bootloaders that aren't passing the partition UUID
-        // instead pass the path to the closest "platform" device. It would
+        // Only use the more specific "MMC" / "NVME" / "SCSI" match if a
+        // partition UUID was passed.
+        //
+        // Old bootloaders that aren't passing the partition UUID instead
+        // pass the path to the closest "platform" device. It would
         // break them if we chose this deeper (more specific) path.
         //
         // When we have a UUID we _want_ the more specific path since it can
@@ -204,6 +206,8 @@
         // classify them both the same by using the path to the USB controller.
         if (FindMmcDevice(uevent_path, &info.str)) {
             info.type = "mmc";
+        } else if (FindNvmeDevice(uevent_path, &info.str)) {
+            info.type = "nvme";
         } else if (FindScsiDevice(uevent_path, &info.str)) {
             info.type = "scsi";
         }
@@ -325,6 +329,14 @@
     return FindSubsystemDevice(path, mmc_device_path, subsystem_paths);
 }
 
+bool DeviceHandler::FindNvmeDevice(const std::string& path, std::string* nvme_device_path) const {
+    const std::set<std::string> subsystem_paths = {
+            sysfs_mount_point_ + "/class/nvme",
+    };
+
+    return FindSubsystemDevice(path, nvme_device_path, subsystem_paths);
+}
+
 bool DeviceHandler::FindScsiDevice(const std::string& path, std::string* scsi_device_path) const {
     const std::set<std::string> subsystem_paths = {
             sysfs_mount_point_ + "/bus/scsi",
diff --git a/init/devices.h b/init/devices.h
index 67a3d00..b8f8e54 100644
--- a/init/devices.h
+++ b/init/devices.h
@@ -151,6 +151,7 @@
                              const std::set<std::string>& subsystem_paths) const;
     bool FindPlatformDevice(const std::string& path, std::string* platform_device_path) const;
     bool FindMmcDevice(const std::string& path, std::string* mmc_device_path) const;
+    bool FindNvmeDevice(const std::string& path, std::string* nvme_device_path) const;
     bool FindScsiDevice(const std::string& path, std::string* scsi_device_path) const;
     std::tuple<mode_t, uid_t, gid_t> GetDevicePermissions(
         const std::string& path, const std::vector<std::string>& links) const;
diff --git a/trusty/keymint/android.hardware.security.keymint-service.rust.trusty.system.nonsecure.rc b/trusty/keymint/android.hardware.security.keymint-service.rust.trusty.system.nonsecure.rc
index ca6132e..410e10a 100644
--- a/trusty/keymint/android.hardware.security.keymint-service.rust.trusty.system.nonsecure.rc
+++ b/trusty/keymint/android.hardware.security.keymint-service.rust.trusty.system.nonsecure.rc
@@ -11,7 +11,7 @@
 # Only starts the non-secure KeyMint HALs when the KeyMint VM feature is enabled
 # TODO(b/357821690): Start the KeyMint HALs when the KeyMint VM is ready once the Trusty VM
 # has a mechanism to notify the host.
-on late-fs && property:ro.hardware.security.keymint.trusty.system=1 && \
+on late-fs && property:ro.hardware.trusty.security_vm.keymint.enabled=1 && \
    property:trusty.security_vm.vm_cid=*
     setprop system.keymint.trusty_ipc_dev VSOCK:${trusty.security_vm.vm_cid}:1
     start system.keymint.rust-trusty.nonsecure