From 3694d8feac129ebe50514f8acf4a852ecbf7e530 Mon Sep 17 00:00:00 2001
From: Ulises Mendez Martinez <umendez@google.com>
Date: Thu, 21 Nov 2024 12:26:40 +0000
Subject: [PATCH] ANDROID: Add protected modules list

Note: These are not yet plugged into the kernels, hence not enforced.

* This cherry-pick was manually edited to remove out of context
  comments.

Bug: 287199267
Change-Id: I3d7a3716dfb36222bb0a47546c6107468ed2f559
Signed-off-by: Ulises Mendez Martinez <umendez@google.com>
(cherry picked from commit 315ff4820206c578044c135b554b0c9a562f289f)
---
 BUILD.bazel | 23 ++++++++++++++++++++++-
 modules.bzl |  9 +++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/BUILD.bazel b/BUILD.bazel
index e8845a6397f5..2403cbc8869f 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -28,7 +28,12 @@ load(
     "merged_kernel_uapi_headers",
 )
 load(":abi.bzl", "cc_binary_with_abi")
-load(":modules.bzl", "get_gki_modules_list", "get_kunit_modules_list")
+load(
+    ":modules.bzl",
+    "get_gki_modules_list",
+    "get_gki_protected_modules_list",
+    "get_kunit_modules_list",
+)
 
 package(
     default_visibility = [
@@ -92,6 +97,14 @@ write_file(
     ],
 )
 
+write_file(
+    name = "gki_aarch64_protected_modules",
+    out = "gki/aarch64/protected_modules",
+    content = get_gki_protected_modules_list("arm64") + [
+        "",  # Ensure new line at the end.
+    ],
+)
+
 write_file(
     name = "gki_system_dlkm_modules_x86_64",
     out = "gki/x86_64/system_dlkm_modules",
@@ -102,6 +115,14 @@ write_file(
     ],
 )
 
+write_file(
+    name = "gki_x86_64_protected_modules",
+    out = "gki/x86_64/protected_modules",
+    content = get_gki_protected_modules_list("x86_64") + [
+        "",  # Ensure new line at the end.
+    ],
+)
+
 _SET_KERNEL_DIR_CMD = "KERNEL_DIR=\"{kernel_dir}\"".format(
     kernel_dir = paths.join(
         package_relative_label(":x").workspace_root,
diff --git a/modules.bzl b/modules.bzl
index f4ad0485bd17..333768822609 100644
--- a/modules.bzl
+++ b/modules.bzl
@@ -198,3 +198,12 @@ def get_kunit_modules_list(arch = None):
         ))
 
     return kunit_modules_list
+
+_COMMON_UNPROTECTED_MODULES_LIST = []
+
+# buildifier: disable=unnamed-macro
+def get_gki_protected_modules_list(arch = None):
+    all_gki_modules = get_gki_modules_list(arch) + get_kunit_modules_list(arch)
+    unprotected_modules = _COMMON_UNPROTECTED_MODULES_LIST
+    protected_modules = [mod for mod in all_gki_modules if mod not in unprotected_modules]
+    return protected_modules