More on the Hizpo Android car radio/headunit

After a few months of ownership I thought it was about time to write an update, to give you an idea what I thought, where I was with it and how I've solved a few problems, also some interesting bits I've discovered along the way.
Firstly, my thoughts on it, to me it's a great unit, yes it requires some tweaks that the average user won't be able/willing to do so would I recommend it to end-users, probably not, but for the more seasoned Android/Linux tweaker, I'd say yes definitely worth it. I've found after making a few tweaks the unit performs excellently, plays music from SD without effort, Radio, navigation and I'm starting to increase the functionality I'm using.

So my current position with the the Hizpo Android (MTCD_XRC sofia3gr) is:

• Radio functioning
• Startup and shutdown almost instantly as the unit sleeps/wakes at ignition
• Very little idle draw due to sleep working well
• Music from SD-card working
• Navigation using Google Maps working without crashes and navigation audio mutes radio during navigation events, maps notifications, travel times, traffic, etc
• Navigation using Waze - slightly slow, GPS seems to drift and audio doesn't mute radio, this appears to be issues with Waze not the head unit
• Automatic bluetooth tethering to phone to provide internet access to headunit working
• Bluetooth connection to phone working reliably
• Reverse camera - switches when in reverse and mutes car radio.
• Calls work, however small issue when radio/music is playing and you answer a call, the remote end doesn't hear you, seems the phone doesn't switch to the right bluetooth profile (Not sure if this is phone or head unit problem)
• adb over wifi with root working
• SU/root access working
• Ability to have apps/services run after wake (Newly tested!)

And the problems

• Occasional hang (I think this is related to my car battery going low and working hard at starting the big diesel engine, so it dips power too low and the unit crashes) - It normally automatically reboots after a minute or so and recovers itself
• At full/hard reboot (not wake after sleep) needing to set the Kernel OOM settings each time, need to find the right hook to script this
• No steering wheel control - This is due to not having the ODB connection, and probably not being able to interface with Chryslers' proprietary protocols.
• Small plastic dimple on volume knob - from mould manufacture, just needs slight sandpapering to solve.
• Phonecall quality - Several people have mentioned my audio quality isn't great on phone calls, need to check as I've plugged in an external mic and not sure if it's this or the bluetooth stream to the phone

So now onto how I achieved some of my goals!

Apps terminating/closing:

The first being apps terminating themselves. Tracking this down it was due to the Kernel OOM killer, there are various settings you set (by echo'ing them to the /proc filesystem) that control how light/heavy this operates. By default this unit only has 1Gb of RAM so manufacturer has set this to be a bit too protective, killing foreground apps too often. Google maps is a good example, it uses a lot of resources so even when it's the only app running it will get killed. I found using the app "Kernel Adiutor" by Grarak is excellent, lets you tweak the settings easily and the presets are ideal for this. So load it up, grant it root access and then from the menu choose "Low Memory Killer" and for me I choose the preset very_light. Apply on boot doesn't appear to work (I believe it tries to hook into rc.local or similar init.rc but these don't work on this platform), so for now whenever I have a cold/full boot I have to re-apply. This should be easily solved.

ADB over wifi:
This one is a simple one to get right, firstly get your wifi working, I joined the car headunit to

Automatic bluetooth tethering:

This one I had working manually but I wanted it automatic. So firstly, get it working manually. On your phone go into Settings, bluetooth and firstly make sure you have the devices paired. Once paired go into MORE on your phone and go into "Mobile network sharing", and into "Bluetooth tethering", follow the prompts to set it up and let it enable. With the car head unit, go into bluetooth and you'll see your paired device. Click the gear icon and you can then tick the "Internet" access box. It should tick and stay ticked (If it unticks then it means that your phone isn't accepting the link so go back and check the sharing). If it stays ticked click OK and test, you should be able to access the internet. Now you've got manual working, it's time for automatic! I found the "blueballs.apk" app on xda-developers did the job, this keeps the connection running when your specified bluetooth device is connected. (https://forum.xda-developers.com/android-auto/mtcd-software-development/bluetooth-settings-launcher-t3504526) Install this on your phone first and set it up, tick the box for your car unit. Then to install it on the head unit follow the guide:

adb connect <ip address of head unit>
adb push BluetoothTethering.apk /sdcard/
adb shell
$ su
# mount -o remount,rw /system
# mkdir /system/priv-app/BluetoothTethering
# cp /sdcard/BluetoothTethering.apk /system/priv-app/BluetoothTethering/
# chmod 755 /system/priv-app/BluetoothTethering
# chmod 644 /system/priv-app/BluetoothTethering/BluetoothTethering.apk
# sync
# reboot

Then the app will autostart and show a bluetooth icon along the top status bar. This worked great for me, and bluetooth tethering worked straight away, after sleep, etc.

Apps being killed by sleep:
This one is a tricky one, when the device goes into sleep (When ignition is turned off) it will terminate most services and apps, sync filesystems so the system can sleep correctly. Unfortunately this causes a problem, as the method it uses to terminate the services will not resume them (The app receives an ondestroy which terminates and doesn't re-spawn). This is a problem for bluetooth background apps, etc, so the solution appears to be with the bluetoothtethering method above, install the app using root privileges to the /system/priv-app/ as these will be restarted automatically. I've not fully tested other applications with this other than the above bluetoothtethering though.

Discovering how it's all working:
Underneath the head unit is a fairly typical android build, so using adb over wifi I poked about and found how it's basic file structure, boot process, etc, works. It is pretty standard Android with very little changed. It's running "toybox" which is a busybox like clone for file and system functions that you can hook into.

Some additional debugging, shows how the unit functions, watching adb and logging we can see the suspend and wakeup calls:

[ 6145.758644] suspend step=12
[ 6145.758723] PM: suspend exit 2018-02-06 19:59:09.947279628 UTC
[ 6145.758787] suspend step=13
[ 6195.758443] PM: suspend entry 2018-02-06 19:59:59.946989170 UTC
[ 6195.758557] suspend step=1
[ 6195.758607] PM: Syncing filesystems ... done.
[ 6195.777951] PM: Preparing system for mem sleep
[ 6195.783221] Freezing user space processes ... (elapsed 0.010 seconds) done.
[ 6195.793560] Freezing remaining freezable tasks ... (elapsed 0.006 seconds) done.
[ 6195.800118] suspend step=2
[ 6195.800173] PM: Entering mem sleep
[ 6195.800225] Suspending console(s) (use no_console_suspend to debug)
[ 6195.805419] rpmb_rpc: rpmb partition suspended
[ 6195.868220] xgold-sdhci e2800000.emmc: Set tap values to mode 0, val = 0x080400f5
[ 6195.870533] PM: Wakeup pending, aborting suspend
[ 6195.870590] active wakeup source: alarm
[ 6195.870663] PM: Some devices failed to suspend, or early wake event detected
[ 6195.993203] xgold-sdhci e2800000.emmc: Set tap values to mode 1, val = 0x08040004
[ 6195.995946] xgold-sdhci e2800000.emmc: Set tap values to mode 5, val = 0x000400b5
[ 6195.996857] rpmb_rpc: rpmb partition resumed
[ 6195.997746] PM: resume of devices complete after 127.017 msecs

And the normal process listing (With the unit at idle):

USER      PID   PPID  VSIZE  RSS   WCHAN            PC  NAME
root      1     0     3060   628   SyS_epoll_ 00000000 S /init
root      2     0     0      0       kthreadd 00000000 S kthreadd
root      3     2     0      0     smpboot_th 00000000 S ksoftirqd/0
root      5     2     0      0     worker_thr 00000000 S kworker/0:0H
root      7     2     0      0     rcu_gp_kth 00000000 S rcu_preempt
root      8     2     0      0     rcu_gp_kth 00000000 S rcu_sched
root      9     2     0      0     rcu_gp_kth 00000000 S rcu_bh
root      10    2     0      0     smpboot_th 00000000 S migration/0
root      12    2     0      0     smpboot_th 00000000 S watchdog/0
root      13    2     0      0     smpboot_th 00000000 S watchdog/1
root      14    2     0      0     smpboot_th 00000000 S migration/1
root      15    2     0      0     smpboot_th 00000000 S ksoftirqd/1
root      17    2     0      0     worker_thr 00000000 S kworker/1:0H
root      19    2     0      0     smpboot_th 00000000 S watchdog/2
root      20    2     0      0     smpboot_th 00000000 S migration/2
root      21    2     0      0     smpboot_th 00000000 S ksoftirqd/2
root      23    2     0      0     worker_thr 00000000 S kworker/2:0H
root      25    2     0      0     smpboot_th 00000000 S watchdog/3
root      26    2     0      0     smpboot_th 00000000 S migration/3
root      27    2     0      0     smpboot_th 00000000 S ksoftirqd/3
root      29    2     0      0     worker_thr 00000000 S kworker/3:0H
root      31    2     0      0     rescuer_th 00000000 S khelper
root      32    2     0      0     vdump_thre 00000000 S vdump Thread
root      33    2     0      0     console_th 00000000 S kconsole
root      34    2     0      0     rescuer_th 00000000 S writeback
root      35    2     0      0     ksm_scan_t 00000000 S ksmd
root      36    2     0      0     rescuer_th 00000000 S bioset
root      37    2     0      0     rescuer_th 00000000 S kblockd
root      38    2     0      0     hub_thread 00000000 S khubd
root      54    2     0      0     fmdev_fifo 00000000 S iui_fm
root      55    2     0      0     ion_heap_d 00000000 S system-heap
root      56    2     0      0     mvpipe_dev 00000000 S ion_secvm_handl
root      57    2     0      0     irq_thread 00000000 S irq/303-rk818
root      58    2     0      0     rescuer_th 00000000 S rk81x_otg_work
root      59    2     0      0     rev_thread 00000000 D rev_thread
root      60    2     0      0     rockchip_f 00000000 S fb-vsync
root      61    2     0      0     kthread_wo 00000000 S rockchip-fb
root      62    2     0      0     cpufreq_in 00000000 S cfinteractive
root      63    2     0      0     irq_thread 00000000 S irq/320-car-rev
root      64    2     0      0     irq_thread 00000000 S irq/321-car-acc
root      65    2     0      0     rescuer_th 00000000 S rk81x-battery-w
root      66    2     0      0     rescuer_th 00000000 S car_wq
root      67    2     0      0     rescuer_th 00000000 S goodix_wq
root      89    2     0      0         kswapd 00000000 S kswapd0
root      90    2     0      0     fsnotify_m 00000000 S fsnotify_mark
root      91    2     0      0     rescuer_th 00000000 S crypto
root      105   2     0      0     rescuer_th 00000000 S bl_wq
root      106   2     0      0     irq_thread 00000000 S irq/40-rga
root      107   2     0      0     vnvm_serve 00000000 S vnvm
root      108   2     0      0     mvpipe_dev 00000000 S VUSB_SE_FE_MEX_
root      110   2     0      0     down_inter 00000000 S vsec
root      111   2     0      0     rescuer_th 00000000 S idi_error_work_
root      112   2     0      0     irq_thread 00000000 S irq/110-vpu.177
root      113   2     0      0     irq_thread 00000000 S irq/111-vpu.177
root      114   2     0      0     irq_thread 00000000 S irq/38-hevc.178
root      115   2     0      0     rescuer_th 00000000 S dwc2
root      116   2     0      0     rescuer_th 00000000 S uether
root      117   2     0      0     rescuer_th 00000000 S adv_wq
root      119   2     0      0     rescuer_th 00000000 S dm_bufio_cache
root      121   2     0      0     mmc_queue_ 00000000 S mmcqd/0
root      122   2     0      0     mmc_queue_ 00000000 S mmcqd/0boot0
root      123   2     0      0     mmc_queue_ 00000000 S mmcqd/0boot1
root      124   2     0      0     mmc_queue_ 00000000 S mmcqd/0rpmb
root      125   2     0      0     rescuer_th 00000000 S binder
root      126   2     0      0     intel_adc_ 00000000 S adc-thread
root      128   2     0      0     oct_thread 00000000 S OCT Thread
root      129   2     0      0     rescuer_th 00000000 S dvd_wq
root      130   2     0      0     irq_thread 00000000 S irq/108-dsp_int
root      131   2     0      0     irq_thread 00000000 S irq/107-dsp_int
root      132   2     0      0     irq_thread 00000000 S irq/99-dsp_int3
root      133   2     0      0     rescuer_th 00000000 S ipv6_addrconf
root      134   2     0      0     rescuer_th 00000000 S fuel_gauge.187
root      136   2     0      0     rescuer_th 00000000 S deferwq
root      139   2     0      0     irq_thread 00000000 S irq/283-jack_ir
root      140   2     0      0     irq_thread 00000000 S irq/284-button_
root      141   2     0      0     rescuer_th 00000000 S f_mtp
root      142   2     0      0     rescuer_th 00000000 S setExposure_que
root      143   2     0      0     rescuer_th 00000000 S measurement_que
root      144   2     0      0     rescuer_th 00000000 S bat_hal-0
root      147   1     2540   288   poll_sched 00000000 S /sbin/ueventd
root      150   2     0      0     worker_thr 00000000 S kworker/1:1H
root      151   2     0      0     kjournald2 00000000 S jbd2/mmcblk0p14
root      152   2     0      0     rescuer_th 00000000 S ext4-rsv-conver
root      153   2     0      0     worker_thr 00000000 S kworker/0:1H
root      154   2     0      0     worker_thr 00000000 S kworker/2:1H
root      158   2     0      0     worker_thr 00000000 S kworker/3:1H
root      159   2     0      0     kjournald2 00000000 S jbd2/mmcblk0p15
root      160   2     0      0     rescuer_th 00000000 S ext4-rsv-conver
root      164   2     0      0     kjournald2 00000000 S jbd2/mmcblk0p13
root      165   2     0      0     rescuer_th 00000000 S ext4-rsv-conver
logd      166   1     15360  3644  sigsuspend 00000000 S /system/bin/logd
root      167   1     12664  1416  hrtimer_na 00000000 S /system/bin/vold
root      173   2     0      0     kauditd_th 00000000 S kauditd
root      182   1     2932   268   SyS_epoll_ 00000000 S /sbin/healthd
root      183   1     4308   612   SyS_epoll_ 00000000 S /system/bin/lmkd
system    184   1     4116   572   binder_thr 00000000 S /system/bin/servicemanager
system    185   1     59340  3680  SyS_epoll_ 00000000 S /system/bin/surfaceflinger
root      186   1     2284   8     hrtimer_na 00000000 S /sbin/watchdogd
radio     187   1     5648   560   SyS_epoll_ 00000000 S /system/bin/rpcServer
root      193   2     0      0     rescuer_th 00000000 S cfg80211
root      194   2     0      0     worker_thr 00000000 S kworker/u9:1
shell     196   1     4328   584   n_tty_read f7672b80 S /system/bin/sh
radio     197   1     16668  1080  hrtimer_na 00000000 S /system/bin/rild
radio     198   1     16156  704   hrtimer_na 00000000 S /system/bin/rild
root      199   1     17372  1476  hrtimer_na 00000000 S /system/bin/netd
root      200   1     4936   832   __skb_recv 00000000 S /system/bin/debuggerd
drm       201   1     25160  1192  binder_thr 00000000 S /system/bin/drmserver
media     202   1     138240 10172 binder_thr 00000000 S /system/bin/mediaserver
root      203   1     4216   672   unix_strea 00000000 S /system/bin/installd
keystore  205   1     7692   936   binder_thr 00000000 S /system/bin/keystore
system    206   1     7960   680   binder_thr 00000000 S /system/bin/pluginservice
system    207   1     4276   572   atdev_ioct 00000000 S /system/bin/startIpcsd
radio     208   1     6536   532   fmdev_fifo 00000000 S /system/bin/fmd
gps       209   1     4328   632   sigsuspend 00000000 S /system/bin/sh
root      210   1     827376 28380 poll_sched 00000000 S zygote
system    211   1     7364   844   binder_thr 00000000 S /system/bin/gatekeeperd
root      212   1     4240   716   hrtimer_na 00000000 S /system/xbin/perfprofd
root      214   1     8612   1080  poll_sched 00000000 S /system/vendor/bin/crashlogd
root      216   1     6560   812   devkmsg_re 00000000 S /vendor/bin/log-watch
root      238   1     3876   180   __skb_recv 00000000 S daemonsu:mount:master
gps       253   209   21528  2160  futex_wait 00000000 S /system/bin/lbsd
root      258   1     6196   368   __skb_recv 00000000 S daemonsu:master
radio     279   1     15060  764   hrtimer_na 00000000 S /system/bin/rpc-daemon
root      284   2     0      0     kjournald2 00000000 S jbd2/mmcblk0p5-
root      285   2     0      0     rescuer_th 00000000 S ext4-rsv-conver
radio     286   1     8300   740   nvmdev_ioc 00000000 S /system/bin/nvm_useragent
shell     294   1     9360   184   poll_sched f7703b80 S /sbin/adbd
root      338   2     0      0     irq_thread 00000000 S irq/289-gnss_wa
root      340   2     0      0     irq_thread 00000000 S irq/291-gnss_er
root      342   1     4328   632   sigsuspend 00000000 S /system/bin/sh
root      363   342   5572   940   __skb_recv 00000000 S /system/vendor/bin/logcatext
root      422   2     0      0     irq_thread 00000000 S irq/293-wlan_ir
system    558   210   879544 85412 SyS_epoll_ 00000000 S system_server
root      707   2     0      0     mvpipe_dev 00000000 S VUSB_SE_FE_LINK
root      708   2     0      0     n_tty_read 00000000 S VUSB_SE_FE_LINK
root      709   2     0      0         msleep 00000000 D VUSB_SE_FE_MODE
root      742   2     0      0     rescuer_th 00000000 S vs-2
media_rw  799   167   7900   600   inotify_re 00000000 S /system/bin/sdcard
radio     802   210   697124 33080 SyS_epoll_ 00000000 S com.android.phone
u0_a21    818   210   746476 54508 SyS_epoll_ 00000000 S com.android.systemui
u0_a9     1088  210   669656 22552 SyS_epoll_ 00000000 S com.android.externalstorage
u0_a22    1374  210   958284 23208 SyS_epoll_ 00000000 S com.google.android.googlequicksearchbox:interactor
u0_a43    1393  210   707868 41320 SyS_epoll_ 00000000 S com.android.inputmethod.latin
u0_a10    1437  210   859896 77880 SyS_epoll_ 00000000 S com.google.android.gms.persistent
root      1456  1     4328   476   sigsuspend 00000000 S /system/bin/sh
system    1467  210   672660 23476 SyS_epoll_ 00000000 S android.microntek.canbus
root      1504  2     0      0     rescuer_th 00000000 S vs-0
root      1514  1456  86168  1972  poll_sched 00000000 S /system/bin/adb-ec
u0_a10    1521  210   691816 29600 SyS_epoll_ 00000000 S com.google.process.gapps
root      1551  1     4328   632   poll_sched 00000000 S /system/bin/sh
u0_a22    1577  210   973232 35336 SyS_epoll_ 00000000 S com.google.android.googlequicksearchbox:search
u0_a13    1645  210   702792 44380 SyS_epoll_ 00000000 S com.android.launcher
u0_a10    1674  210   1059600 81412 SyS_epoll_ 00000000 S com.google.android.gms
root      1818  258   6196   176   __skb_recv 00000000 S daemonsu:10087
u0_a60    1858  210   696304 41280 SyS_epoll_ 00000000 S com.microntek.radio
system    1911  210   668872 23420 SyS_epoll_ 00000000 S com.intel.soundprofile
u0_a40    2013  210   670856 21412 SyS_epoll_ 00000000 S android.rockchip.update.service
u0_a10    2252  210   788532 24856 SyS_epoll_ 00000000 S com.google.android.gms.ui
u0_a37    2455  210   694508 41236 SyS_epoll_ 00000000 S com.microntek.bluetooth
root      2670  258   7228   176   __skb_recv 00000000 S daemonsu:10092
u0_a10    4729  210   805684 42848 SyS_epoll_ 00000000 S com.google.android.gms:snet
root      6102  2     0      0     worker_thr 00000000 S kworker/3:0
root      6439  2     0      0     worker_thr 00000000 S kworker/3:1
root      6576  2     0      0     worker_thr 00000000 S kworker/u8:3
root      7158  2     0      0     worker_thr 00000000 S kworker/2:0
root      7235  2     0      0     worker_thr 00000000 S kworker/1:2
root      7289  2     0      0     worker_thr 00000000 S kworker/u8:1
root      7298  2     0      0     worker_thr 00000000 S kworker/u9:0
u0_a10    7359  210   801780 51212 SyS_epoll_ 00000000 S com.google.android.gms.unstable
root      8029  2     0      0     worker_thr 00000000 S kworker/0:2
root      8059  2     0      0     worker_thr 00000000 S kworker/u8:2
root      8100  2     0      0     worker_thr 00000000 S kworker/2:2
root      8101  2     0      0     worker_thr 00000000 S kworker/1:0
root      8149  2     0      0     worker_thr 00000000 S kworker/0:0
root      8155  2     0      0     worker_thr 00000000 S kworker/2:1
root      8158  2     0      0     worker_thr 00000000 S kworker/1:1
root      8177  2     0      0     worker_thr 00000000 S kworker/u9:2
root      8188  2     0      0     worker_thr 00000000 S kworker/3:2
u0_a8     8294  210   684960 33392 SyS_epoll_ 00000000 S android.process.media
root      8341  2     0      0     worker_thr 00000000 S kworker/u8:0
root      8342  2     0      0     worker_thr 00000000 S kworker/u8:4
root      8343  2     0      0     worker_thr 00000000 S kworker/u8:5
root      8345  2     0      0     worker_thr 00000000 S kworker/u8:6
root      8377  2     0      0     mmc_queue_ 00000000 S mmcqd/1
bluetooth 8379  210   719896 40080 SyS_epoll_ 00000000 S com.android.bluetooth
wifi      8386  1     8788   3228  poll_sched 00000000 S /system/bin/wpa_supplicant
media_rw  8415  167   8148   2156  inotify_re 00000000 S /system/bin/sdcard
root      8437  2     0      0     irq_thread 00000000 S irq/286-btif_mu
root      8438  2     0      0     irq_thread 00000000 S irq/288-btip_wa
u0_a93    8585  210   701280 38720 SyS_epoll_ 00000000 S za.co.henry.hsu.adbwirelessbyhenry
root      8626  2     0      0     worker_thr 00000000 S kworker/0:1
u0_a1     8765  210   672964 29124 SyS_epoll_ 00000000 S com.android.providers.calendar
root      8793  2     0      0     worker_thr 00000000 S kworker/1:3
shell     8798  294   4328   1468  sigsuspend f7734b80 S /system/bin/sh
shell     8802  8798  4224   1136           0 f7744b80 R ps

The next task is to identify what is called at boot time. Looking at the root filesystem we can see:

-rw-r--r--  1 browna browna    1144 Feb  6 20:18 default.prop
-rw-r--r--  1 browna browna 1477328 Feb  6 20:17 init
-rw-r--r--  1 browna browna     369 Feb  6 20:17 init.bluetooth.rc
-rw-r--r--  1 browna browna     346 Feb  6 20:17 init.coredump.rc
-rw-r--r--  1 browna browna     554 Feb  6 20:17 init.crashlogd.rc
-rw-r--r--  1 browna browna     686 Feb  6 20:17 init.debug-charging.rc
-rw-r--r--  1 browna browna     178 Feb  6 20:17 init.debug.rc
-rw-r--r--  1 browna browna     891 Feb  6 20:17 init.environ.rc
-rw-r--r--  1 browna browna     300 Feb  6 20:17 init.gnss.normal.rc
-rw-r--r--  1 browna browna     323 Feb  6 20:17 init.gnss.ptest.rc
-rw-r--r--  1 browna browna    1790 Feb  6 20:17 init.hct.rc
-rw-r--r--  1 browna browna     198 Feb  6 20:17 init.kernel.rc
-rw-r--r--  1 browna browna     207 Feb  6 20:17 init.ksm.rc
-rw-r--r--  1 browna browna    1477 Feb  6 20:17 init.logs.rc
-rw-r--r--  1 browna browna      95 Feb  6 20:17 init.log-watch.rc
-rw-r--r--  1 browna browna   22934 Feb  6 20:17 init.ptest.rc
-rw-r--r--  1 browna browna   26697 Feb  6 20:17 init.rc
-rw-r--r--  1 browna browna    1089 Feb  6 20:17 init.recovery.sofiaboard.rc
-rw-r--r--  1 browna browna     334 Feb  6 20:17 init.sofia3gr_car.rc
-rw-r--r--  1 browna browna   22899 Feb  6 20:17 init.sofiaboard.rc
-rw-r--r--  1 browna browna    9977 Feb  6 20:17 init.sofiaboard.usb.rc
-rw-r--r--  1 browna browna     249 Feb  6 20:17 init.stt_trace.rc
-rw-r--r--  1 browna browna    1921 Feb  6 20:17 init.trace.rc
-rw-r--r--  1 browna browna    9283 Feb  6 20:17 init.usb.configfs.rc
-rw-r--r--  1 browna browna    5339 Feb  6 20:17 init.usb.rc
-rw-r--r--  1 browna browna    1601 Feb  6 20:17 init.wifi.normal.rc
-rw-r--r--  1 browna browna     537 Feb  6 20:17 init.wifi.ptest.rc
-rw-r--r--  1 browna browna     322 Feb  6 20:17 init.zram.rc
-rw-r--r--  1 browna browna     342 Feb  6 20:17 init.zygote32.rc

(Ignore the user/group there, that's because I transferred these to sdcard and onto my laptop to review). The files of note here:
init - ELF 32-bit LSB executable - This is the main init process
init.rc - This looks like the main setup for the environment, it imports the other rc files first, environments, usb, hardware and then runs through various "on init" and other tasks.
In the init.rc there are stanzas that contain different functions, near the bottom are "service" tasks that appear to call daemons and set their user, group and restart/pid functions. Above that are on property settings which I'm unsure what these function as. There in also an "on boot" stanza, which looks the most useful, this seems to bring up loopback interface, set memory permissions, file and system ownership, etc. In several other sections there are "trigger boot" and similar commands which refer to the different stanzas, so based around this, the last one to be called is the "boot" section.
From Android documentation you can add backgrounded exec calls, so the suggestion is using

exec_background [ <seclabel> [ <user> [ <group>\* ] ] ] -- <command> [ <argument>\* ]

Which when added to the boot stanza this should allow you to call your own scripts and commands. My suggestion is to use it like this:

on boot
[other on boot entries]
  exec_background root root -- /etc/rc.local

NOTE: This is currently untested!

Good luck, and I'd love to hear your experiences in the comments.