diff --git a/target/board/generic/BoardConfig.mk b/target/board/generic/BoardConfig.mk index 79aea5631..1748ee261 100644 --- a/target/board/generic/BoardConfig.mk +++ b/target/board/generic/BoardConfig.mk @@ -59,6 +59,16 @@ DEVICE_MATRIX_FILE := device/generic/goldfish/compatibility_matrix.xml BOARD_SEPOLICY_DIRS += build/target/board/generic/sepolicy BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true +# Android Verified Boot (AVB): +# Builds a special vbmeta.img that disables AVB verification. +# Otherwise, AVB will prevent the device from booting the generic system.img. +# Also checks that BOARD_AVB_ENABLE is not set, to prevent adding verity +# metadata into system.img. +ifeq ($(BOARD_AVB_ENABLE),true) +$(error BOARD_AVB_ENABLE cannot be set for GSI) +endif +BOARD_BUILD_DISABLED_VBMETAIMAGE := true + ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) # GSI is always userdebug and needs a couple of properties taking precedence # over those set by the vendor. diff --git a/target/board/generic_arm64/BoardConfig.mk b/target/board/generic_arm64/BoardConfig.mk index 86e3d381f..4cf230d4f 100644 --- a/target/board/generic_arm64/BoardConfig.mk +++ b/target/board/generic_arm64/BoardConfig.mk @@ -88,6 +88,16 @@ DEVICE_MATRIX_FILE := device/generic/goldfish/compatibility_matrix.xml BOARD_PROPERTY_OVERRIDES_SPLIT_ENABLED := true BOARD_SEPOLICY_DIRS += build/target/board/generic/sepolicy +# Android Verified Boot (AVB): +# Builds a special vbmeta.img that disables AVB verification. +# Otherwise, AVB will prevent the device from booting the generic system.img. +# Also checks that BOARD_AVB_ENABLE is not set, to prevent adding verity +# metadata into system.img. +ifeq ($(BOARD_AVB_ENABLE),true) +$(error BOARD_AVB_ENABLE cannot be set for GSI) +endif +BOARD_BUILD_DISABLED_VBMETAIMAGE := true + ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) # GSI is always userdebug and needs a couple of properties taking precedence # over those set by the vendor. diff --git a/target/board/generic_x86/BoardConfig.mk b/target/board/generic_x86/BoardConfig.mk index ae65eb15c..9c84bb50a 100644 --- a/target/board/generic_x86/BoardConfig.mk +++ b/target/board/generic_x86/BoardConfig.mk @@ -62,6 +62,16 @@ BOARD_SEPOLICY_DIRS += \ build/target/board/generic/sepolicy \ build/target/board/generic_x86/sepolicy +# Android Verified Boot (AVB): +# Builds a special vbmeta.img that disables AVB verification. +# Otherwise, AVB will prevent the device from booting the generic system.img. +# Also checks that BOARD_AVB_ENABLE is not set, to prevent adding verity +# metadata into system.img. +ifeq ($(BOARD_AVB_ENABLE),true) +$(error BOARD_AVB_ENABLE cannot be set for GSI) +endif +BOARD_BUILD_DISABLED_VBMETAIMAGE := true + ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) # GSI is always userdebug and needs a couple of properties taking precedence # over those set by the vendor. diff --git a/target/board/generic_x86_64/BoardConfig.mk b/target/board/generic_x86_64/BoardConfig.mk index f69933928..1b03e9363 100755 --- a/target/board/generic_x86_64/BoardConfig.mk +++ b/target/board/generic_x86_64/BoardConfig.mk @@ -60,6 +60,16 @@ BOARD_SEPOLICY_DIRS += \ build/target/board/generic/sepolicy \ build/target/board/generic_x86/sepolicy +# Android Verified Boot (AVB): +# Builds a special vbmeta.img that disables AVB verification. +# Otherwise, AVB will prevent the device from booting the generic system.img. +# Also checks that BOARD_AVB_ENABLE is not set, to prevent adding verity +# metadata into system.img. +ifeq ($(BOARD_AVB_ENABLE),true) +$(error BOARD_AVB_ENABLE cannot be set for GSI) +endif +BOARD_BUILD_DISABLED_VBMETAIMAGE := true + ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT))) # GSI is always userdebug and needs a couple of properties taking precedence # over those set by the vendor.