get_prop(domain, vendor_default_prop) expands to allow rules that AOSP's
neverallow at public/property.te:353 blocks for all system/app domains.
Switch to dontaudit to suppress the log spam without an allow rule.
- Allow system_server, mediaswcodec, platform_app, system_app,
untrusted_app_all, priv_app to read vendor_default_prop; eliminates
RenderThread SELinux spam that was causing render lag
- Label android.hardware.media.c2.IComponentStore/v4l2 as
hal_codec2_service in service_contexts so system_server can find it
- Add /dev/media* and /dev/video* as video_device in file_contexts
- Allow hal_camera_default to access video_device:chr_file and dir
Adds four fstab.zram.{25p,50p,75p,none} variants copied to vendor/etc.
init.rpi5.rc activates swap at boot_complete using persist.vendor.zram.size.
Adds vm.min_free_kbytes/lowmem_reserve_ratio memory tuning on init.
SELinux: declares vendor_zram_config_prop for persist.vendor.zram.size.
Remove vendor_default_prop and bluetooth_lea_prop get_prop rules — both violate
AOSP neverallow rules (vendor_default_prop is banned for all app domains;
bluetooth_lea_prop is a platform type not exported to the vendor policy interface).
Remove generic sysfs:file allow for init and system_server — both violate
neverallow rules in init.te and coredomain.te; proper labeled sysfs types are
needed when specific paths are identified from avc: denied logs.
Rename ro.pawlet.ota. -> ro.vendor.pawlet.ota. to satisfy VTS vendor property
namespace enforcement.
- priv_app.te: get vendor_default_prop + bluetooth_lea_prop (Settings, priv apps)
- system_app.te: get vendor_default_prop
- device.mk: persist.adb.tcp.port=5555 for userdebug builds only
Now that the prebuilt defines a separate LawnchairQuickStep module,
include it alongside Lawnchair so Launcher3QuickStep (recents/overview)
is also replaced by the Lawnchair APK.
mkbootimg: use stamp file for rpiboot, uppercase FAT label
fstab: USB drives don't support TRIM — requesting discard stalls jbd2
journal commits and causes Watchdog kills. Add fstab.rpi5.discard for
devices that do support TRIM (SD card, SSD); select via
BOARD_STORAGE_SUPPORTS_DISCARD := true in BoardConfig.mk.
mkbootimg: stamp file fixes ninja 'outputs should be files' warning.
Uppercase BOOT label suppresses mkfs.fat lowercase label warning.
Writing the fixed-size disk image to a larger device leaves userdata at its
image size (128M) and strands the backup GPT header mid-disk. wipe_userdata now
relocates the backup GPT to the true end of the device (fixing the 'Alternate
GPT header not at the end of the disk' kernel warning) and recreates partition 9
spanning all remaining free space before formatting it.
Mirror of the rpi4 fix. First-stage init only creates /dev/block/by-name/*
symlinks for partitions on a declared boot device, and our fstab mounts
by-name. RPi5 USB is on the RP1 chip behind the internal PCIe and RP1's xHCI
is a platform device, so init matches at the .usb node (deeper than RPi4's
VL805). List NVMe (external PCIe) and the RP1 USB controllers; exact-match set
makes extra entries harmless. To be verified/trimmed against an RPi5 serial log.
* Decompressing APEX can take couple of minutes on the very first boot.
For some reason this is significantly slower on AOSP16 than it was
on AOSP15.
* This takes ~170 MB more space on the system partition which we can
afford.
* Labeling vendor allocator libraries became necessary for some reason
after moving minigbm gralloc to APEX.
* Address remaining drm_hwcomposer denials.
oxmc
oxmc
Konsta