| Commit message (Collapse) | Author | Files | Lines |
|---|
|
Bug: 78469201
Test: Wipe from recovery menu, check that wipe is logged correctly
and boot works as expected.
Merged-In: I5bc8ef1b83d78de8b5edba6cc17882edcc744356
Change-Id: I5bc8ef1b83d78de8b5edba6cc17882edcc744356
|
|
An interrupted update may stash extra blocks in /cache, leading to a
failure when checking the cache size. We can save the incremented
retry_count in the BCB before installing the update; and distinguish
a fresh update from an interrupted one this way.
Bug: 68679601
Test: An interrupted update reapplies successfully.
Change-Id: Ic1403e1fd25a937c91ef34c14b92a0f6c8f1c0f4
|
|
Test: call is_battery_ok in graphics test, and test manually
Bug: 69268160
Bug: 63702641
Change-Id: Ifcf4d2e2cb459689c11fc5d1b880bb053aaae8ae
|
|
The only one left is libedify. Will handle that in a separate CL.
Test: mmma bootable/recovery
Change-Id: I732a5f85229da90fd767bee2e46c5c95f529c396
|
|
This reverts commit 26436d6d6010d5323349af7e119ff8f34f85c40c to re-land
"Move error_code.h into otautil.".
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES
(uncrypt and edify). Soong doesn't accept non-local ".." in
"local_include_dirs".
This CL needs to land with device-specific module changes (e.g. adding
the dependency on libotautil).
Test: lunch aosp_{angler,bullhead,dragon,fugu,sailfish}-userdebug;
mmma bootable/recovery
Change-Id: If193241801af2dae73eccd31ce57cd2b81c9fd96
|
|
This reverts commit 623fe7e701d5d0fb17082d1ced14498af1b44e5b.
Reason for revert: Need to address device-specific modules.
Change-Id: Ib7a4191e7f193dfff49b02d3de76dda856800251
|
|
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES
(uncrypt and edify). Soong doesn't accept non-local ".." in
"local_include_dirs".
Test: mmma bootable/recovery
Change-Id: Ia4649789cef2aaeb2785483660e9ea5a8b389c62
|
|
The earlier commit in 2dfc1a38982c4052bb32bc7fc06edeadf3908fb9
unintentionally changed the behavior. It gives a different result when
looking up non-existent mount points (e.g. /cache on marlin).
The logic behind volume_for_path("/xyz") is unclear:
- It's fine to return non-null value if it's called by
ensure_path_mounted() before accessing that file "/xyz". (Just based
on the function name, we're not actually having this case.)
- It should return nullptr if the caller is interested in the existence
of that particular mount point "/xyz".
This CL renames the function to volume_for_mount_point(), which does an
exact match by querying the given mount point from libfs_mgr. The former
volume_for_path() has been moved down to function scope for serving
ensure_path_mounted() only.
Test: Build and boot into recovery on bullhead and marlin respectively.
'View recovery logs'.
Test: 'Mount /system'
Test: 'Apply update from ADB'
Change-Id: I1a16390f57540cae08a2b8f3d439d17886975217
|
|
Add a new option "Run locale test" to check the background text
images (i.e. texts for "erasing", "error", "no_command" and "installing"
with different locales.)
Use volume up/down button to cycle through all the locales embedded in
the png file, and power button to go back to recovery main menu.
Test: Run locale test with bullhead.
Change-Id: Ib16e119f372110cdb5e611ef497b0f9b9b418f51
|
|
This reverts commit 8be0f39fec7f26164fd0791ff6d15bde65fc849c to reland
the change that removes EXPAND/STRINGIFY macros.
It's error-prone by putting anything into a string (e.g.
EXPAND(RECOVERY_API_VERSION) would become "RECOVER_API_VERSION" if we
forgot to pass -DRECOVERY_API_VERSION=3).
The initial attempt put RECOVERY_API_VERSION into common.h, which might
be included by device-specific codes but without defining that when
compiling the module. This CL avoids the issue by using a constant
in the header, with a static_assert in recovery.cpp that guards the
consistency.
Test: recovery_component_test
Test: Sideload OTAs on bullhead and sailfish respectively.
Change-Id: I12af3f73392a85554ba703f04970ec9d984ccbaa
|
|
This CL adds ScreenRecoveryUI::DrawWrappedTextLines() to better handle
long menu header texts. It does a word wrap at spaces, if available.
This avoids fixed-length menu headers being truncated on small screens.
Bug: 64293520
Test: On bullhead, boot into recovery with --prompt_and_wipe_data, and
check the prompt texts.
Change-Id: Ia22746583516dd230567a267584aca558429395e
(cherry picked from commit 2bbc6d642d1fbfb007905d95b629fe5f833b2a1b)
|
|
This CL adds ScreenRecoveryUI::DrawWrappedTextLines() to better handle
long menu header texts. It does a word wrap at spaces, if available.
This avoids fixed-length menu headers being truncated on small screens.
Bug: 64293520
Test: On bullhead, boot into recovery with --prompt_and_wipe_data, and
check the prompt texts.
Change-Id: Ia22746583516dd230567a267584aca558429395e
|
|
- Changed to std::string based implementation (mostly moved from the
former make_parents() in updater/install.cpp);
- Removed the timestamp parameter, which is only neeed by file-based OTA;
- Changed the type of mode from int to mode_t;
- Renamed dirCreateHierarchy() to mkdir_recursively().
Test: recovery_unit_test passes.
Test: No external user of dirCreateHierarchy() in code search.
Change-Id: I71f8c4b29bab625513bbc3af6d0d1ecdc3a2719a
|
|
When there's no command specified when booting into debuggable builds
(such as using `adb reboot recovery`), we turn on the text mode (i.e.
recovery menu) directly. This CL fixes the issue to avoid showing the
background image in a flash while turning on the text mode.
Bug: 63985334
Test: `fastboot boot $OUT/recovery.img` and it shows the recovery menu
directly without the no command image in a flash.
Change-Id: Id86bbe346ab76c8defc95e2b423e695a86774b09
(cherry picked from commit 7022f33ec8531c742f8f4701552d687233901495)
|
|
When there's no command specified when booting into debuggable builds
(such as using `adb reboot recovery`), we turn on the text mode (i.e.
recovery menu) directly. This CL fixes the issue to avoid showing the
background image in a flash while turning on the text mode.
Bug: 63985334
Test: `fastboot boot $OUT/recovery.img` and it shows the recovery menu
directly without the no command image in a flash.
Change-Id: Id86bbe346ab76c8defc95e2b423e695a86774b09
|
|
When /cache is unwritable, recovery hits a crash loop. Because it
passes nullptr to fileno(3) when writing back the locale file. This
prevents user from recovering a device - it cannot boot far enough to
recovery menu which allows wiping /cache.
Bug: 63927337
Test: Corrupt /cache and boot into recovery on bullhead:
1. m -j recoveryimage
2. fastboot erase cache
3. fastboot boot $OUT/recovery.img
4. recovery menu shows up.
Change-Id: I1407743f802049eb48add56a36298b665cb86139
(cherry picked from commit ec57903a7ec0bfe3c2f39dd6ee9cfc3de4ed20e6)
|
|
When /cache is unwritable, recovery hits a crash loop. Because it
passes nullptr to fileno(3) when writing back the locale file. This
prevents user from recovering a device - it cannot boot far enough to
recovery menu which allows wiping /cache.
Bug: 63927337
Test: Corrupt /cache and boot into recovery on bullhead:
1. m -j recoveryimage
2. fastboot erase cache
3. fastboot boot $OUT/recovery.img
4. recovery menu shows up.
Change-Id: I1407743f802049eb48add56a36298b665cb86139
|
|
Add the O_CLOEXEC or 'e' accordingly.
Bug: 63510015
Test: recovery tests pass
Change-Id: I7094bcc6af22c9687eb535116b2ca6a59178b303
|
|
Fixed by Loading the file_contexts specified in libselinux, whereas
previously recovery loaded /file_contexts which no longer exists.
Bug: 62587423
Test: build and flash recovery on Angler. Warning is gone.
Test: Wipe data and cache.
Test: sideload OTA
Change-Id: I11581c878b860ac5f412e6e8e7acde811f37870f
(cherry picked from commit 2330dd8733ce0b207058e3003a3b1efebc022394)
|
|
Fixed by Loading the file_contexts specified in libselinux, whereas
previously recovery loaded /file_contexts which no longer exists.
Bug: 62587423
Test: build and flash recovery on Angler. Warning is gone.
Test: Wipe data and cache.
Test: sideload OTA
Change-Id: I11581c878b860ac5f412e6e8e7acde811f37870f
|
|
We have seen one case when bspatch failed likely due to patch
corruption. Since the package has passed verification before, we want
to reboot and retry the patch command again since there's no
alternative for users.
We won't delete the stash before reboot, and the src has passed SHA1
check. If there's an error on the patch, it will fail the package
verification during retry.
Bug: 37855643
Test: angler reboots and retries the update when bspatch fails.
Change-Id: I2ebac9621bd1f0649bb301b9a28a0dd079ed4e1d
|
|
We're not updating argc & argv during get_args(), so some boot
arguments missed when we set the boot message for retry.
Bug: 38383406
Test: boot command sets correctly during retry attempt.
Change-Id: Ie8583a22fad5e0084245e3431d4018518d508dfd
(cherry picked from commit 72449c9f995649b1427b2116985ed9826a141d46)
|
|
We're not updating argc & argv during get_args(), so some boot
arguments missed when we set the boot message for retry.
Bug: 38383406
Test: boot command sets correctly during retry attempt.
Change-Id: Ie8583a22fad5e0084245e3431d4018518d508dfd
|
|
This reverts commit ec9706738f35a859f66fd0758b73381055804f63.
Reason for revert: It's not a good idea to put RECOVERY_API_VERSION in
common.h, which might be included by device-specific codes (but with
RECOVERY_API_VERSION undefined).
Change-Id: I9feb9c64a5af3e9165164622a59b043aa28a8b8c
|
|
They are error-prone by putting anything into a string (e.g.
EXPAND(RECOVERY_API_VERSION) would become "RECOVER_API_VERSION" if we
forgot to pass -DRECOVERY_API_VERSION=3).
RECOVERY_API_VERSION is the only user (in bootable/recovery) that gets
stringified. Assign it to a typed var and sanity check the value.
Don't see other reference to the macros from device-specific recovery
directories (they can still define that locally if really needed).
Test: recovery_component_test
Test: Sideload an OTA on angler and marlin respectively.
Change-Id: I358bbdf8f0a99db5ce4c7bc2fdcafe8013501b64
|
|
It's already a global declared in common.h which is included by
adb_install.cpp.
Remove '#include "minadbd/fuse_adb_provider.h"' that's not needed by
adb_install.cpp (minadbd takes care of that).
Test: mmma bootable/recovery
Change-Id: I6d08b7abc706b4b05de2ef46a57ced2204ad297e
|
|
Bug: 37401320
Test: build and push OTA and hit adb reboot recovery,quiescent. The screen should remain off throughout the upgrade process.
(cherry picked from commit 8706a98aa635236a95795f0a0c122bb3e591a50d)
Change-Id: I79789a151f6faafda8ecc6198c2182cc2a91da70
|
|
recovery.cpp doesn't have a direct dependency on adb.h (only minadbd
does). 'adb.h' was once needed for DEFAULT_ADB_PORT, until being killed
by commit acb2a2fa4c415944a27539461ba3757f3edbb128.
Test: mmma bootable/recovery
Change-Id: I84f87988d01c3f0c3d1383cc3cffde2e7d5e7aea
|
|
Users can't do much after the install fails with the device showing
"error" under recovery. So our best choice is to reboot the device
since sometimes the system image is still bootable (i.e. on package
verification failure). At worst the device would stuck in a boot loop
where the users need the same professional knowledge to recover as
before.
Behaviors after installation failure (including data wipe):
If recovery text is visible:
No change.
If recovery text is not visible:
Old behavior: Wait under "error" screen. Reboot after UI timeout (120s)
if not connected to usb charger.
New behavior: Wait for 5s (shortens from the 120s timeout) under "error"
screen and reboot (w or w/o charger).
sideload-auto-reboot (only available for userdebug):
Old behavior: Reboot immediately after installation failure.
New behavior: Wait for 5s under "error" screen and reboot.
Bug: 35386985
Test: On angler user, device auto reboots 5s after a failing OTA.
Change-Id: I3ff0ead86e2ccec9445d6a2865bc2c463855f23c
|
|
Bug: 37401320
Test: build and push OTA and hit adb reboot recovery,quiescent. The screen should remain off throughout the upgrade process.
Change-Id: Ibed3795c09e26c4fa73684d40b94e40c78394d3f
|
|
am: 5ec12126f0
Change-Id: Ia6b861c91958d3be23a4a7456d6d5d8e4a1607c8
(cherry picked from commit 9166f66eee883d6d6cc280a6c355e5528bb4a3f0)
|
|
Switch the locale header in the png files from Locale.toString() to
Locale.toLanguageTag(). For example, en_US --> en-us and sr__#Latn
--> sr-Latn. Also clean up recovery a bit to expect the new locale
format.
Bug: 35215015
Test: sr-Latn shows correctly under graphic tests && recovery tests pass
Change-Id: Ic62bab7756cdc6e5f98f26076f7c2dd046f811db
|
|
The call to read_metadata_from_package() is broken due to being passed
an invalid pointer (ZipArchiveHandle vs ZipArchiveHandle*). It's
introduced when switching from minzip to libziparchive. Compiler didn't
complain, because ZipArchiveHandle is typedef'd as void*, which legitly
accepts a void**.
Also clean up secure_wipe_partition() logs a bit by using android-base
logging.
Bug: 36427762
Test: Send a wipe package.
Change-Id: I791a0f09a066f1c257dae890e7ae13d02a02e78b
|
|
Test: My device was crashing anyway, so observed message on crash.
Bug: 34669779
Change-Id: Ib85d1d137139f5e14f735c972c2312acce2caf5f
|
|
Test: mmma bootable/recovery
Change-Id: Icea5bd91a976957e8b6ab46e367345ff69a53ca4
|
|
It used to return a REBOOT action on timeout, until the CL in commit
daefc1d442fb421606680feb9aeb59c133f4c427 that redefined the return value
of get_menu_selection() (changing from action to a menu index).
Prior to this CL, it was returning 0 (i.e. the value of Device::REBOOT)
to trigger the reboot. This CL specifies a return value of -1 to
indicate the timeout.
Test: Boot into a user build recovery; it reboots automatically on
timeout (120 sec).
Change-Id: I4aedb7a4628bf258017078fe73eb8b48a21d0ea8
|
|
Most of the changes are trivial.
Also update a dead reference to device_handle_key() in device.h comment,
and add some comments to get_menu_selection() function.
Test: `mmma bootable/recovery`
Change-Id: I59ef9213ec88ab35c0e7b8a7813ccf9c56dbd5c5
|
|
Test: 'View recovery logs' on bullhead and sailfish.
Change-Id: I53272b121e3e55e6fe4c77b71e3c2e819e72cb64
|
|
This was introduced in commit c87bab101893e8322b49d7c8600e3367b20ab50a.
But the stage info should be passed through BCB only (there's a
dedicated field in struct bootloader_message).
This CL removes it from recovery arguments, and also moves 'stage'
variable to std::string.
Test: 'stage' variable is not used by any device-specific recovery code.
Test: Code search shows no hit of '--stages' use.
Change-Id: Iccbde578a13255f2b55dd4a928e9ecf487f16b97
|
|
This allows a quicker test for stage UI.
Bug: 27804510
Test: 'Run graphices test' with the new recovery image.
Change-Id: I47689ae8e4cac6d7e5d1f6a10b9e393d50d713f3
|
|
After reading one log entry, it should stay at the same menu position.
Test: 'View recovery logs' -> Read -> Exit
Change-Id: I4b579be4c2fe1e3a1dcc4873e128fd0b2d619ba3
|
|
People have been confused by the message and thought that's an error.
Test: Boot recovery on sailfish; choose 'View recovery logs'.
Change-Id: I2c540f18d6493c1a129233d10ecbc96823dd3601
|
|
Get rid of the malloc/realloc/free'd menus.
browse_directory() will only be called on devices with SD card. Tested
the CL by temporarily setting SDCARD_ROOT to a different location.
Test: See above.
Change-Id: I935e1bf4bad0273e3dff87fa2536924f1219adb5
|
|
-1 is not a valid exit status.
Also replace a few exit(1) with exit(EXIT_FAILURE).
Test: mmma bootable/recovery
Change-Id: I4596c8328b770bf95acccc06a4401bd5cabd4bfd
|
|
Test: Apply two A/B incremental OTAs with the new recovery image. The
one with incorrect pre-build should be blocked, while the other
works fine.
Change-Id: I94d97eb8798599da1630f66343fb603e87464187
|
|
Commit f0ed159f488c57c4ede0503443eb62fadfe0a831 unintentionally changed
the behavior when parsing the arguments from BCB and command file. It
should only parse the command file for arguments if BCB doesn't supply
any.
As a result, it shows the following from the log:
I:Got 2 arguments from boot message
I:Got 3 arguments from /cache/recovery/command
Test: Set arguments in BCB and command file both. It should only use the
arguments from BCB.
Change-Id: Idf371137aa9177f1b2dfdfecf0c9f46959d2ee76
|
|
UI text is broken (doesn't show any text during FDR) due to commit
d530449e54bd327e9c26209ffa0490c6508afe6c, which reordered the calls to
RecoveryUI::SetLocale() and RecoveryUI::Init().
Because Init() uses the locale info to load the localized texts (from
images), the locale must be set prior to that via SetLocale(). This CL
refactors Init() to take the locale parameter, and removes the odd
SetLocale() API.
Bug: 34029338
Test: 'Run graphics test' under recovery.
Change-Id: I620394a3d4e3705e9af5a1f6299285d143ae1b01
|
|
In the event of a catastrophic data error which should never happen,
ask the user before wiping the device.
Test: Cause an init builtin to fail and generate this error, observe.
Bug: 28693324
Change-Id: I38a2b815157d816cba1f30ad37eb4cdcc01db582
|
|
This is a retry of commit 7e31f421a514da09b90e46dbd642a5e9b16e0003.
Commit bd56f1590c967205dc45eb2ec298aa8d2aacb740 switches to calling
write_bootloader_message(<options>) in get_args(), which
unintentionally resets the stage field thus breaks two-step OTAs.
This CL adds update_bootloader_message(<options>), which only sets
the command field (to "boot-recovery") and the recovery field (with
the specified options).
Bug: 33534933
Test: Apply a two-step package.
Test: recovery_component_test passes.
Change-Id: Ie0b1ed4053d2d3c97d9cb84310d616b28fcfc72e
|
|
The corresponding code was removed in commit
e08991e02a7d678f2574e85289a34b2a9a537c82 in 2010 (Froyo).
Test: N/A
Change-Id: I2b296e1b07d54232bade79fda7501387d65a4c37
|
|
This allows recovery to work on devices without screen.
The stub recovery UI does nothing except print to stdout.
Test: write 'recovery\n--wipe_data\n--reason=wipe_data_from_ota\n'
to misc and boot to recovery on a device without screen.
Bug: 33175036
Change-Id: Icde698aa2e2e29f4b3d0532dfd3c6a939ac2bc63
|
|
Test: Wipe /cache and check the logs.
Wipe /data and check the logs.
Change-Id: I1968e3a0a9ed80134811a91508c4473f1dcdf953
|
|
The passing of "--update_package=CACHE:foo" format has been removed
in Gingerbread, with commit 4baf641e7d96375eba3f9a3aff5400b9e3d28cd6
in frameworks/base (core/java/android/os/RecoverySystem.java).
Test: Recovery image with --update_package still works.
Change-Id: I37b56ccf98f62cadf2a3975bbc38b16fea6fe9a1
|
|
Commit f0ed159f488c57c4ede0503443eb62fadfe0a831 didn't ensure mounting
COMMAND_FILE (i.e. /cache) prior to reading. Also the first argument in
COMMAND_FILE should not be dropped (unlike the first "recovery" argument
in BCB message).
Bug: 33431888
Test: Push /cache/recovery/command and recovery imag parses the
arguments successfully.
Change-Id: Ica3157a0bb03a2355315123354617eaf3fff15a4
|
|
Test: Boot into new recovery image, verify the parsed parameters.
Change-Id: Ieefafb26cc4147ce4cb9ced4297cdb3b5d1d3789
|
|
Bug: 32067516
Test: Logs rotated successfully on angler, recovery-refresh/persist tests
passed on an a/b device.
Change-Id: Ie80adf0fa958ad3d7869d2d17f49489666b86c29
|
|
This reverts commit 8584fcf677dd45b30121bd0490b06297e6be1871.
This CL re-lands commit c0319b60f56d445c2d1c74f551e01f069b028fe6.
The "stage" and "reason" variables are now declared as global by
dropping the static qualifier, because they may be used by vendor
recovery libraries.
Test: lunch aosp_angler-userdebug; mmma bootable/recovery
Test: lunch aosp_dragon-userdebug; mmma bootable/recovery
Change-Id: I252c346f450079478cff22bbff01590b8ab2e2b3
|
|
This reverts commit c0319b60f56d445c2d1c74f551e01f069b028fe6.
Reason for revert: Broke builds.
Change-Id: I82aa880b83de5ae6c36fd7567cb001920559a972
|
|
- Remove the duplicate gCurrentUI variable in recovery.cpp;
- Refactor the load/save of locale functions;
- Clean up ui_print() to get rid of 256-byte buffer limit;
- Declare ui in common.h;
- Move the typedef of Volume into roots.h.
Test: Build and boot into recovery image.
Change-Id: Ia28c116858ca754133127a5ff9c722af67ad55b7
|
|
Skip the OTA installation when bootreason is 'kernel_panic',
'Panic' etc.
Change-Id: Ic1202492bffefa1a9d8d0e691b5af979285e552c
Test: On angler, ota installation skips for one bootreason in the blacklist.
Bug: 29978689
(cherry picked from commit 27b9fc8a36757235ac3386d66db7d35820c2eb04)
|
|
To increase the security of wiping A/B devices, let uncrypt write
wipe package in misc partition. Then recovery verifies the wipe
package before wiping the device.
Based on the original cherrypick, this CL also has additional changes to
address the LOG statements and libziparchive changes.
Bug: 29159185
Test: Build and boot into recovery.
Change-Id: I186691bab1928d3dc036bc5542abd64a81bc2168
(cherry picked from commit 6faf0265c9b58db2c15b53f6d29025629d52f882)
|
|
Switch to using vector and string.
Test: bootloader message writes correctly on angler.
Change-Id: I95d5a1e584630db326bb4400f3a149b59ad30a9e
|
|
bootloader_messages merges bootloader_message_writer
and bootloader.cpp, so we can use the same library to
manage bootloader_message in normal boot and recovery mode.
Bug: 29582118
Change-Id: I9efdf776ef8f02b53911ff43a518e035e0c29618
(cherry picked from commit 2f272c0551f984e83bc5abaf240e0dddb38a3326)
|
|
Clean up the duplicated codes that handle the zip files in
bootable/recovery; and rename the library of the remaining
utility functions to libotautil.
Test: Update package installed successfully on angler.
Bug: 19472796
Change-Id: Iea8962fcf3004473cb0322b6bb3a9ea3ca7f679e
|
|
Test: compile
Bug: 31992412
Change-Id: I5156590bfc94e46e9d282c197c3dd8c4bbd9e855
|
|
Also remove the 0xff comparison when validating the bootloader
message fields. As the fields won't be erased to 0xff after we
remove the MTD support.
Bug: 28202046
Test: The recovery folder compiles for aosp_x86-eng
Change-Id: Ibb30ea1b2b28676fb08c7e92a1e5f7b6ef3247ab
(cherry picked from commit 7aa88748f6ec4e53333d1a15747bc44826ccc410)
|
|
Also remove the 0xff comparison when validating the bootloader
message fields. As the fields won't be erased to 0xff after we
remove the MTD support.
Bug: 28202046
Test: The recovery folder compiles for aosp_x86-eng
Change-Id: Ibb30ea1b2b28676fb08c7e92a1e5f7b6ef3247ab
|
|
Currently we save the OTA metrics in last_install, which keeps the data
for the _last_ install only. This CL logs the same content into last_log
so that we keep the metrics for every install.
Bug: 31607469
Test: Apply an update (via OTA and sideload) and check last_log and last_install.
Change-Id: Id8f174d79534fddc9f06d72a4e69b2b1d8ab186c
(cherry picked from commit f4885adc189f246ac3c651aa5cb2e74a240f3f1e)
|
|
Currently we save the OTA metrics in last_install, which keeps the data
for the _last_ install only. This CL logs the same content into last_log
so that we keep the metrics for every install.
Bug: 31607469
Test: Apply an update (via OTA and sideload) and check last_log and last_install.
Change-Id: Id8f174d79534fddc9f06d72a4e69b2b1d8ab186c
(cherry picked from commit f4885adc189f246ac3c651aa5cb2e74a240f3f1e)
|
|
Currently we save the OTA metrics in last_install, which keeps the data
for the _last_ install only. This CL logs the same content into last_log
so that we keep the metrics for every install.
Bug: 31607469
Test: Apply an update (via OTA and sideload) and check last_log and last_install.
Change-Id: Id8f174d79534fddc9f06d72a4e69b2b1d8ab186c
|
|
Bug: http://b/23102347
Test: boot into recovery.
Change-Id: Ib2ca560f1312961c21fbaa294bb068de19cb883e
Merged-In: Ib2ca560f1312961c21fbaa294bb068de19cb883e
|
|
Bug: http://b/23102347
Test: boot into recovery.
Change-Id: Ib2ca560f1312961c21fbaa294bb068de19cb883e
|
|
Clean up the recovery image and switch to libbase logging.
Bug: 28191554
Change-Id: Icd999c3cc832f0639f204b5c36cea8afe303ad35
(cherry picked from commit 747781433fb01f745529c7e9dd97c5599070ad0d)
|
|
Clean up the recovery image and switch to libbase logging.
Bug: 28191554
Change-Id: Icd999c3cc832f0639f204b5c36cea8afe303ad35
Merged-In: Icd999c3cc832f0639f204b5c36cea8afe303ad35
|
|
Clean up the recovery image and switch to libbase logging.
Bug: 28191554
Change-Id: Icd999c3cc832f0639f204b5c36cea8afe303ad35
|
|
adb_server_main in adb refers to the adb server on the host, not adbd.
Since there doesn't seem to be a good reason to reuse the declaration
from adb's headers, give minadbd a main function of its own.
Change-Id: I748f1a6822dc14c726cb73ef3b533c57a6615608
|
|
For A/B devices, "view recovery logs" doesn't work due to the lack
of cache partition. To help debugging, we'll show /tmp/recovery.log
instead if /cache is not found.
Change-Id: Idb77c3a4c30388148a210b38d732a7b27e757bba
Test: Tested on an A/B device and /tmp/recovery.log showed up.
Bug: 30905700
(cherry picked from commit a54f75ede8f5404c2c55b4f928e73fe9c908298e)
|
|
For A/B devices, "view recovery logs" doesn't work due to the lack
of cache partition. To help debugging, we'll show /tmp/recovery.log
instead if /cache is not found.
Change-Id: Idb77c3a4c30388148a210b38d732a7b27e757bba
Test: Tested on an A/B device and /tmp/recovery.log showed up.
Bug: 30905700
|
|
The fopen_path will fail here e.g. if /cache is corrupt and could
not be mounted. Not properly handling an error code from
fopen_path() results in a boot loop into recovery as fwrite() on
a NULL FILE object will crash the recovery app.
Change-Id: I1ccff5a8cb620a32f32adfe97a3fae8e5e908f39
|
|
* Use const reference parameter type to avoid unnecessary copy.
* Use more efficient overloaded string methods.
Bug: 30407689
Bug: 30411878
Change-Id: Iefab05c077367f272abf545036b853e8a295c8cd
Test: build with WITH_TIDY=1
|
|
Skip the OTA installation when bootreason is 'kernel_panic',
'Panic' etc.
Change-Id: Ic1202492bffefa1a9d8d0e691b5af979285e552c
Test: On angler, ota installation skips for one bootreason in the blacklist.
Bug: 29978689
|
|
bootloader_messages merges bootloader_message_writer
and bootloader.cpp, so we can use the same library to
manage bootloader_message in normal boot and recovery mode.
Bug: 29582118
Change-Id: I9efdf776ef8f02b53911ff43a518e035e0c29618
|
|
Increase the number of attempts of an OTA update from 3 to 5 in case
an I/O error happened. This should increase the success rate of the
update.
Bug: 29619468
Change-Id: I88a067d9debd55a07be22ed981f395f6e47ec28f
|
|
To increase the security of wiping A/B devices, let uncrypt write
wipe package in misc partition. Then recovery verifies the wipe
package before wiping the device.
Bug: 29159185
Change-Id: I186691bab1928d3dc036bc5542abd64a81bc2168
|
|
Bug: 27253717
Change-Id: I6e63b2a80b7b2948c16e1b57dedc856d52456ac9
|
|
When recovery starts with --brick, it tries to brick the device by
securely wiping all the partitions as listed in /etc/recovery.brick.
This is designed to support bricking lost devices.
Bug: 27253717
Change-Id: Ib0bd4f0a3bdaca4febc91fce6b682e3ec74354e2
(cherry picked from commit 862a4c11190d72851a72a2b97375ec2698078358)
|
|
When recovery starts with --brick, it tries to brick the device by
securely wiping all the partitions as listed in /etc/recovery.brick.
This is designed to support bricking lost devices.
Bug: 27253717
Change-Id: Ib0bd4f0a3bdaca4febc91fce6b682e3ec74354e2
|
|
Write error code, cause code, and retry count into last_install. So we
can have more information about the reason of a failed OTA.
Example of new last_install:
@/cache/recovery/block.map package name
0 install result
retry: 1 retry count (new)
error: 30 error code (new)
cause: 12 error cause (new)
Details in:
go/android-ota-errorcode
Bug: 28471955
Change-Id: I00e7153c821e7355c1be81a86c7f228108f3dc37
|
|
An OTA may be skipped due to low battery. But we should always log it to
understand why an update _fails_ to apply.
Bug: 27893175
Change-Id: I50a3fbbb3e51035e0ac5f1cca150e283852825c3
(cherry picked from commit 568700189528c69a6cdd7a246127ce01463e033d)
|
|
An OTA may be skipped due to low battery. But we should always log it to
understand why an update _fails_ to apply.
Bug: 27893175
Change-Id: I50a3fbbb3e51035e0ac5f1cca150e283852825c3
|
|
Add a new command "--security" to boot commands. If this command is
observed as part of BCB, choose a different background text picture
for installing stage in recovery UI. As a result, users will see
"installing security update" instead of "installing system update"
when applying a security update package.
Bug: 27837319
Change-Id: I2e2253a124993ecc24804fa1ee0b918ac96837c5
|
|
Bug: 28220065
Change-Id: Ida199c66692a1638be6990d583d2ed42583fb592
|
|
Switch to a Wear-like intro/loop system. We don't have an intro yet,
but hopefully this will let Wear delete more code when they move to N.
Unlike them, we don't hard-code the number of frames: we just look to
see what we have available. We do hard-code the fps though.
Also add a graphics test mode so you can see a demo of the UI components
without having to actually apply an OTA.
Also fix a bug where default locale is null rather than en-US: it's
more useful to show _some_ text if we don't have a locale (which should
only be during development anyway).
Bug: http://b/26548285
Change-Id: I63422e3fef3c41109f924d96fb5ded0b3ae7815d
|
|
Bug: http://b/27764900
Change-Id: Ib62a59edcb13054f40f514c404d32b87b14ed5f1
|
|
(cherry-pick from commit a4f701af93a5a739f34823cde0c493dfbc63537a)
- Add call to __android_log_pmsg_file_write for recovery logging.
- Add call to refresh pmsg if we reboot back into recovery and then
allow overwrite of those logs.
- Add a new one-time executable recovery-refresh that refreshes pmsg
in post-fs phase of init. We rely on pmsg eventually scrolling off
to age the content after recovery-persist has done its job.
- Add a new one-time executable recovery-persist that transfers from
pmsg to /data/misc/recovery/ directory if /cache is not mounted
in post-fs-data phase of init.
- Build and appropriately trigger the above two as required if
BOARD_CACHEIMAGE_PARTITION_SIZE is undefined.
- Add some simple unit tests
NB: Test failure is expected on systems that do not deliver either
the recovery-persist or recovery-refresh executables, e.g. systems
with /cache. Tests also require a timely reboot sequence of test
to truly verify, tests provide guidance on stderr to direct.
Bug: 27176738
Change-Id: I17bb95980234984f6b2087fd5941b0a3126b706b
|
|
- Add call to __android_log_pmsg_file_write for recovery logging.
- Add call to refresh pmsg if we reboot back into recovery and then
allow overwrite of those logs.
- Add a new one-time executable recovery-refresh that refreshes pmsg
in post-fs phase of init. We rely on pmsg eventually scrolling off
to age the content after recovery-persist has done its job.
- Add a new one-time executable recovery-persist that transfers from
pmsg to /data/misc/recovery/ directory if /cache is not mounted
in post-fs-data phase of init.
- Build and appropriately trigger the above two as required if
BOARD_CACHEIMAGE_PARTITION_SIZE is undefined.
- Add some simple unit tests
NB: Test failure is expected on systems that do not deliver either
the recovery-persist or recovery-refresh executables, e.g. systems
with /cache. Tests also require a timely reboot sequence of test
to truly verify, tests provide guidance on stderr to direct.
Bug: 27176738
Change-Id: I17bb95980234984f6b2087fd5941b0a3126b706b
|
|
No one in recovery or framework is utilizing intent file. Clean
up the code.
Bug:27725880
Change-Id: I78b37ff94261793e0d6a86a0fa6d27dcfe3f4783
|
|
When I/O error happens, reboot and retry installation two times
before we abort this OTA update.
Bug: 25633753
Change-Id: Iba6d4203a343a725aa625a41d237606980d62f69
(cherry picked from commit 3c62b67faf8a25f1dd1c44dc19759c3997fdfd36)
|
|
Since we may not have /cache partition on A/B devices, let recovery
handle /cache related operations gracefully if /cache doesn't exist.
(1) Disable the wipe for /cache partition.
(2) Skip wiping /cache while wiping /data (i.e. factory reset).
(3) Disable logging-related features, until we figure out better
ways / places to store recovery logs (mainly for factory resets on A/B
devices).
Bug: 27176738
Change-Id: I7b14e53ce18960fe801ddfc15380dac6ceef1198
(cherry picked from commit 26112e587084e8b066c28a696533328adde406a9)
|
|
When I/O error happens, reboot and retry installation two times
before we abort this OTA update.
Bug: 25633753
Change-Id: Iba6d4203a343a725aa625a41d237606980d62f69
|
|
Since we may not have /cache partition on A/B devices, let recovery
handle /cache related operations gracefully if /cache doesn't exist.
(1) Disable the wipe for /cache partition.
(2) Skip wiping /cache while wiping /data (i.e. factory reset).
(3) Disable logging-related features, until we figure out better
ways / places to store recovery logs (mainly for factory resets on A/B
devices).
Bug: 27176738
Change-Id: I7b14e53ce18960fe801ddfc15380dac6ceef1198
|
|
The cache folder is no longer available at this time
Bug: 27355824
Change-Id: I74e33266c1ff407364981b186613f81319dd22dc
|
|
The cache folder is no longer available at this time
Bug: 27355824
Change-Id: I74e33266c1ff407364981b186613f81319dd22dc
|
|
Bug: 26879394
Change-Id: I63dce5bc50c2e104129f1bcab7d3cad5682bf45d
(cherry picked from commit 53e7a0628f4acc95481f556ba51800df4a1de37d)
|
|
Bug: 26879394
Change-Id: I63dce5bc50c2e104129f1bcab7d3cad5682bf45d
|
|
For applying update from SD card, we used to use a thread to serve the
file with fuse. Since accessing through fuse involves going from kernel
to userspace to kernel, it may run into deadlock (e.g. for mmap_sem)
when a page fault occurs. Switch to using a process instead.
Bug: 23783099
Bug: 26313124
Change-Id: Iac0f55b1bdb078cadb520cfe1133e70fbb26eadd
|
|
Change-Id: I354a8c424d340a9abe21fd716a4ee0d3b177d86f
|
|
Change-Id: I835805348a9817c81639ad8471e3b49cae93c107
|
|
When system images contain the root directory, there is no entry of
"/system" in the fstab. Change it to look for "/" instead if
ro.build.system_root_image is true. We actually mount the partition
to /system_root instead, and create a symlink to /system_root/system
for /system. This allows "adb shell" to work properly.
Bug: 22855115
Change-Id: I91864444950dc3229fda3cc133ddbadeb8817fb8
(cherry picked from commit abb8f7785ee24eac42f6d28dbfef37872a06c7e9)
|
|
And a few trival fixes to suppress warnings.
Change-Id: Id28e3581aaca4bda59826afa80c0c1cdfb0442fc
(cherry picked from commit 80e46e08de5f65702fa7f7cd3ef83f905d919bbc)
|
|
Change-Id: I38b29e1e34ea793e4b87cd27a1d39fa905fddf7a
|
|
Fork a logger process and send over the log lines through a pipe.
Prepend a timestamp to each line for debugging purpose. Timestamps are
relative to the start of the logger.
Example lines with the change in this CL:
[ 445.948393] Verifying update package...
[ 446.279139] I:comment is 1738 bytes; signature 1720 bytes from end
[ 449.463652] I:whole-file signature verified against RSA key 0
[ 449.463704] I:verify_file returned 0
Change-Id: I139d02ed8f2e944c1618c91d5cc43282efd50b99
|
|
When calling ScreenRecoveryUI::ShowFile(), the only thing that gets
inadequately logged is the progress bar. Replace the call to
ScreenRecoveryUI::Print() with ScreenRecoveryUI::PrintOnScreenOnly() for
the progress bar, so we can avoid calling redirect_stdio().
Change-Id: I4d7c5d5b39bebe0d5880a99d7a72cee4f0b8f325
|
|
A recent adb cleanup changed the signature of adb_main.
Change-Id: I98d084f999966f1a7aa94c63e9ed996b3375096d
|
|
Malloc might fail when replacing package path. In this case, print a
clear error message in the logs and let the OTA fails.
Change-Id: I7209d95edc025e3ee1b4478f5e04f6e852d97205
Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
Signed-off-by: Gaelle Nassiet <gaellex.nassiet@intel.com>
|
|
When system images contain the root directory, there is no entry of
"/system" in the fstab. Change it to look for "/" instead if
ro.build.system_root_image is true. We actually mount the partition
to /system_root instead, and create a symlink to /system_root/system
for /system. This allows "adb shell" to work properly.
Bug: 22855115
Change-Id: Ibac493a5a9320c98ee3b60bd2cc635b925f5454a
|
|
Bug: http://b/21760064
Change-Id: Idde268fe4d7e27586ca4469de16783f1ffdc5069
(cherry picked from commit 945548ef7b3eee5dbfb46f6291465d4b0b6d02e1)
|
|
Bug: http://b/21760064
Change-Id: Idde268fe4d7e27586ca4469de16783f1ffdc5069
|
|
Change-Id: I12b4f880802135a98dbc11a19e74172a3a5ef921
|
|
And a few trival fixes to suppress warnings.
Change-Id: I38734b5f4434643e85feab25f4807b46a45d8d65
|
|
Change-Id: I77564fe5c59e604f1377b278681b7d1bff53a77a
|
|
This makes it easier to go back and forth without losing current output.
Also make the display more like regular more(1).
Bug: http://b/20834540
Change-Id: Icc5703e9c8a378cc7072d8ebb79e34451267ee1b
(cherry picked from commit c049163234003ef463bca018920622bc8269c69b)
|
|
This makes it easier to go back and forth without losing current output.
Also make the display more like regular more(1).
Bug: http://b/20834540
Change-Id: Icc5703e9c8a378cc7072d8ebb79e34451267ee1b
|
|
Currently we are keeping one copy of the kernel log (LAST_KMSG_FILE).
This CL changes to keep up to KEEP_LOG_COUNT copies for kernel logs.
Bug: http://b/18092237
Change-Id: Ied862b5b70cbbae7775f59c78c32ec62aeeca655
(cherry picked from commit bef39710ff50cedf6a4de8eb6c7802f66930aab4)
|
|
Currently we are keeping one copy of the kernel log (LAST_KMSG_FILE).
This CL changes to keep up to KEEP_LOG_COUNT copies for kernel logs.
Bug: http://b/18092237
Change-Id: I1bf5e230de3efd6a48a5b2ae5a34241cb4d9ca90
|
|
For userdebug and eng builds, turn on the text display automatically
if no command is specified.
(cherry-pick of 785d22c88cda46972331c04ebc9df97371a696da.)
Bug: http://b/17489952
Change-Id: I38377c45f2a8e45ca788e5506695aa88c769cbcf
|
|
For userdebug and eng builds, turn on the text display automatically
if no command is specified.
Bug: http://b/17489952
Change-Id: I3d42ba2848b968da12164ddfda915ca69dcecba1
|
|
This makes it easier for us to deal with arbitrary information at the
top, and means that headers added by specific commands don't overwrite
the default ones.
Add the fingerprint back, but broken up so it fits even on sprout's
display.
Change-Id: Id71da79ab1aa455a611d72756a3100a97ceb4c1c
|
|
Change-Id: I280a478526f033f5c0041d7e8a818fce6177d732
|
|
This reverts commit 2ec803f4350f7b72f5dd65c5f27656c6807e2966.
Change-Id: I419025a772ef99db4c0a78bfa7ef66767f3fa062
|
|
Currently we are keeping one copy of the kernel log (LAST_KMSG_FILE).
This CL changes to append it to the recovery log.
Bug: 18092237
Change-Id: I06ad5629016846927153064f1663753a90296f79
|
|
Change-Id: I5afaf70caa590525627c676c88b445d3162de33e
|
|
Currently fugu has a custom subclass to handle this. The default code
supports devices with trackballs but not all shipping Nexus devices?
That's just silly.
Change-Id: Id2779c91284899a26b4bb1af41e7033aa889df10
|
|
Everyone's adding secret key combinations for this anyway, and it's
very useful when debugging.
Change-Id: Iad549452b872a7af963dd649f283ebcd3ea24234
|
|
Rather than add code to wrap menu items, let's just put output the
recovery version to the log. It'll be visible at the bottom of the
screen and automatically wrap.
Change-Id: I158fe2d85bc56b195e00619fba455321743923bd
|
|
This fixes the N9 performance problem.
Change-Id: I00c10d4162ff266a6243285e5a5e768217f6f799
|
|
The original attempt missed the fact that Print is a member function,
so the first argument is the implicit 'this'.
Change-Id: I963b668c5432804c767f0a2e3ef7dea5978a1218
|
|
Currently it rotates the log files every time it boots into the recovery
mode. We lose useful logs after ten times. This CL changes the rotation
condition so that it will rotate only if it performs some actual
operations that modify the flash (installs, wipes, sideloads and etc).
Bug: 19695622
Change-Id: Ie708ad955ef31aa500b6590c65faa72391705940
|
|
This now gets done at the framework level. Doing it here breaks the signature on the partition.
This reverts commit ee19387905650cab5da7dd97ada5502cd17ac93d.
Bug: 19967123
Change-Id: I447b926b733ca145f11a916d9569ce39889db627
|
|
It also changes the return type of wipe_data/wipe_cache to bool, so the
caller can get the status accordingly.
Change-Id: I3022dcdadd6504dac757a52c2932d1176ffd1918
|
|
This now gets done at the framework level.
Doing it here breaks the signature on the partition.
This reverts commit ee19387905650cab5da7dd97ada5502cd17ac93d.
Bug: 19967123
Change-Id: I2a977cb0f0ba94defa1bf9091219398ddc1d3528
(cherry picked from commit 037444642bc32d8fed3bb996823b6a62faa57195)
|
|
When the command file contains "--sideload" (as a result of 'adb reboot
sideload'), it goes into sideload mode directly. Text display will be
turned on by default. It waits for user interaction upon finishing.
When the command file contains "--sideload_auto_reboot", it enters
sideload mode silently. And it will reboot after the installation
regardless of its result, which is designed for automated testing purpose.
Change-Id: Ifdf173351221c7bbf635cfd32463b48e1fff5740
|
|
This now gets done at the framework level.
Doing it here breaks the signature on the partition.
This reverts commit ee19387905650cab5da7dd97ada5502cd17ac93d.
Bug: 19967123
Change-Id: I447b926b733ca145f11a916d9569ce39889db627
|
|
It's surprising that only one of the wipe options asks for confirmation.
This change makes it easier to add confirmation to any action.
I've also removed the version information from all but the main menu,
because I find I'm not really reading the red text because there's
so much of it all the time.
(Given that fingerprints are long and menu items aren't wrapped, we
might want to go with an actual "About" menu item instead.)
Change-Id: I7d809fdd53f9af32efc78bee618f98a69883fffe
|
|
Change-Id: Ia897aa43e44d115bde6de91789b35723826ace22
|
|
Add support for the wipe command when using sideload within the
recovery. All the support for this command is in place, only the
execution of the actual wipe command itself was missing.
Change-Id: Ia9cdfc912bfb9f558fa89b9f0ed54e843ede41f2
Signed-off-by: Christian Poetzsch <christian.potzsch@imgtec.com>
|
|
At the moment, this is the only difference in the sprout recovery
image. That's silly. Let's just improve the error handling slightly
and always have this option present.
Also make the obscure "<3e>" less unclear.
Also use "power button" as the default text rather than "enter button",
because it's been years since anyone had one of those. (Longer term we
should let subclassers tell us the keycode and we translate it to the
correct string.)
Also move the two "Reboot" options together, put "Power off" at the
bottom (and use that terminology, like the real UI, rather than
"Power down"), and use capitals throughout.
Finally, add a README.md with some useful instructions.
Change-Id: I94fb19f73d79c54fed2dda30cefb884426641b5c
|
|
Return NULL to abort the update process. Note that returning ""
won't stop the script.
Change-Id: Ifd108c1356f7c92a905c8776247a8842c6445319
|
|
I think everything left now is here to stay (services.c might get
massaged in to libadbd if it gets refactored).
Bug: 17626262
Change-Id: I01faf8b277a601a40e3a0f4c3b8206c97f1d2ce6
|
|
The recovery system behaves a little bit differently on userdebug or
eng builds by presenting error reports to the user in the ui.
This is controlled by checking the build fingerprint for the string
:userdebug/ or :eng/. But with AOSP version numbers most AOSP
builds blows the 92 char limit of ro.build.fingerprint and therefore
the property is not set, so this condition will always be evaluated
to false, for most builds.
Instead of depending on the flaky ro.build.fingerprint this change
uses ro.debuggable.
Change-Id: I74bc00c655ac596aaf4b488ecea58f0a8de9c26b
|
|
Bug: 18642766
Change-Id: I95a6c8edf83513d421a041e79c15111b5c991dde
Signed-off-by: Patrick Tjin <pattjin@google.com>
|
|
Bug: 18642766
Change-Id: I6c8b7d8f9ffb688d3afdfe0d47c4142e711e421d
Signed-off-by: Patrick Tjin <pattjin@google.com>
|
|
Create a new recovery UI option to allow the user to view
/cache/recovery/last_log for their device. This gives enhanced
debugging information which may be necessary when a failed
OTA occurs.
Bug: 18094012
Change-Id: Ic3228de96e9bfc2a0141c7aab4ce392a38140cf3
|
|
Create a new recovery UI option to allow the user to view
/cache/recovery/last_log for their device. This gives enhanced
debugging information which may be necessary when a failed
OTA occurs.
Bug: 18094012
Change-Id: Ic3228de96e9bfc2a0141c7aab4ce392a38140cf3
|
|
This will help us track down who requested a data wipe.
Bug: 17412160
Change-Id: I1c439fbd29f96b9851810baca9101f683a0f18d8
|
|
We need to wipe the challenges on this partition
if OEM unlock is enabled, as this is a signal that
the user has opted out of factory reset protection.
go/factory-reset
Bug: 16633064
Change-Id: Icb8f1433bf99ca57813f5b72d5a3dd15fa94a263
|
|
Some roms need the recovery-from-boot.p for auto update
of recovery. Typically the use install-[romname]-recovery.sh.
So only disable if install-recovery.sh is present.
Change-Id: I01f89afc87b9d375d67b44b8b5e9228868a47d69
|
|
Make a fuse filesystem that sits on top of the selected package file
on the sdcard, so we can verify that the file contents don't change
while being read and avoid copying the file to /tmp (that is, RAM)
before verifying and installing it.
Change-Id: Ifd982aa68bfe469eda5f839042648654bf7386a1
|
|
Drop support for sideloading OTA packages of the cache partition (a
half-solution that's long since been deprecated by "adb sideload").
Refactor the code to sideload OTA packages from SD cards: remove the
installation code from the file browser.
Change-Id: Id0dff6b27c4a5837546f174f50e2e1d0379c43db
|
|
Implement a new method of sideloading over ADB that does not require
the entire package to be held in RAM (useful for low-RAM devices and
devices using block OTA where we'd rather have more RAM available for
binary patching).
We communicate with the host using a new adb service called
"sideload-host", which makes the host act as a server, sending us
different parts of the package file on request.
We create a FUSE filesystem that creates a virtual file
"/sideload/package.zip" that is backed by the ADB connection -- users
see a normal file, but when they read from the file we're actually
fetching the data from the adb host. This file is then passed to the
verification and installation systems like any other.
To prevent a malicious adb host implementation from serving different
data to the verification and installation phases of sideloading, the
FUSE filesystem verifies that the contents of the file don't change
between reads -- every time we fetch a block from the host we compare
its hash to the previous hash for that block (if it was read before)
and cause the read to fail if it changes.
One necessary change is that the minadbd started by recovery in
sideload mode no longer drops its root privileges (they're needed to
mount the FUSE filesystem). We rely on SELinux enforcement to
restrict the set of things that can be accessed.
Change-Id: Ida7dbd3b04c1d4e27a2779d88c1da0c7c81fb114
|
|
Useful when debugging or developing for recovery.
Change-Id: Ic3ab42d5e848ad3488f1c575339b55e45c8a024b
|
|
The "--shutdown_after" option causes recovery to power down the device
on completion rather than rebooting.
Removes the last vestiges of the "--previous_runs" argument, which
doesn't seem to be used for anything.
Change-Id: I465eda2ef59d367e2b1c79a8dc69831263c69a4d
Conflicts:
recovery.cpp
|
|
The "--shutdown_after" option causes recovery to power down the device
on completion rather than rebooting.
Removes the last vestiges of the "--previous_runs" argument, which
doesn't seem to be used for anything.
Change-Id: I465eda2ef59d367e2b1c79a8dc69831263c69a4d
|
|
Reduce the number of copies of libpng boilerplate. Rename
res_create_* functions to be more clear. Make explicit the use of the
framebuffer pixel format for images, and handle more combinations of
input and output (eg, loading a grayscale image for display rather
than use as a text alpha channel).
Change-Id: I3d41c800a8f4c22b2f0167967ce6ee4d6b2b8846
|
|
Change-Id: I92d5abd1a628feab3b0246924fab7f97ba3b9d34
|
|
Change-Id: I1541534ee6978ddf8d548433986679ce9507d508
|
|
Make recovery log its PID, and when we use a block map file, log how
many ranges it contains.
Change-Id: I1b4299f8163af68a770b48c029ae25e6cb45d26b
|
|
In order to support multi-stage recovery packages, we add the
set_stage() and get_stage() functions, which store a short string
somewhere it can be accessed across invocations of recovery. We also
add reboot_now() which updater can invoke to immediately reboot the
device, without doing normal recovery cleanup. (It can also choose
whether to boot off the boot or recovery partition.)
If the stage string is of the form "#/#", recovery's UI will be
augmented with a simple indicator of what stage you're in, so it
doesn't look like a reboot loop.
Change-Id: I62f7ff0bc802b549c9bcf3cc154a6bad99f94603
|
|
Signed-off-by: Vojtech Bocek <vbocek@gmail.com>
Change-Id: Id8acff1ac9b3c7e4b562c80562a8ff42a1d132b9
|
|
We need to set the system property to "reboot,", not an empty string.
Bug: 10605007
Change-Id: I776e0d273764cf254651ab2b25c2743395b990e0
|
|
We need to set the system property to "reboot,", not an empty string.
Bug: 10605007
Change-Id: I776e0d273764cf254651ab2b25c2743395b990e0
|
|
Change I84c0513acb549720cb0e8c9fcbda0050f5c396f5 moved reboot
functionality into init but did not update the recovery partition; so
"adb reboot" and /system/bin/reboot in recovery are both broken.
Change-Id: Ie2d14627a686ffb5064256b6c399723636dff116
|
|
When installing a package, we should have /tmp and /cache mounted and
nothing else. Ensure this is true by explicitly mounting them and
unmounting everything else as the first step of every install.
Also fix an error in the progress bar that crops up when you do
multiple package installs in one instance of recovery.
Change-Id: I4837ed707cb419ddd3d9f6188b6355ba1bcfe2b2
|
|
Recovery changes:
- add a method to the UI class that is called when a key is held down
long enough to be a "long press" (but before it is released).
Device-specific subclasses can override this to indicate a long
press.
- do color selection for ScreenRecoveryUI's menu-and-log drawing
function. Subclasses can override this to customize the colors they
use for various elements.
- Include the value of ro.build.display.id in the menu headers, so you
can see on the screen what version of recovery you are running.
Change-Id: I426a6daf892b9011638e2035aebfa2831d4f596d
|
|
When doing a cache wipe or a factory reset (which includes a cache
wipe), save any last* log files in the /cache/recovery directory and
write them back after reformatting the partition, so that wiping data
doesn't lose useful log information.
Change-Id: I1f52ae9131760b5e752e136645c19f71b7b166ee
|
|
Recovery currently has a random mix of messages printed to stdout and
messages printed to stderr, which can make logs hard to read. Move
everything to stdout.
Change-Id: Ie33bd4a9e1272e731302569cdec918e0534c48a6
|
|
Copy logs to /cache immediately upon a package installation failure;
don't wait for recovery to finish. (If the user reboots without
exiting recovery the "right" way, the logs never get copied at all.)
Change-Id: Iee342944e7ded63da5a4af33d11ebc876f6c0835
|
|
Extral newline can trigger recovery segmentation fault
Test case:
host$ adb shell 'echo -en "--update_package=ota_update.zip\n--show_text\n\n" > /cache/recovery/command'
host$ adb reboot recovery
Change-Id: If1781c1f5ad94a273f1cb122b67cedd9fb562433
Signed-off-by: Jin Feng <jin88.feng@gmail.com>
|
|
Extends the last_log mechanism to save logs from the last six
invocations of recovery, so that we're more likely to have useful logs
even if the device has repeatedly booted into recovery.
Change-Id: I08ae7a09553ada45f9e0733fe1e55e5a22efd9f9
|
|
Hopefully this will reduce the number of OTA "bugs" reported that are
really just someone having changed their system partition,
invalidating future incremental OTAs.
Also fixes a longstanding TODO about putting LOGE() output in the
on-screen display.
Change-Id: I44e5be65b2dee7ebce2cce28ccd920dc3d6e522e
|
|
Extends the last_log mechanism to save logs from the last six
invocations of recovery, so that we're more likely to have useful logs
even if the device has repeatedly booted into recovery.
Change-Id: I08ae7a09553ada45f9e0733fe1e55e5a22efd9f9
|
|
Hopefully this will reduce the number of OTA "bugs" reported that are
really just someone having changed their system partition,
invalidating future incremental OTAs.
Also fixes a longstanding TODO about putting LOGE() output in the
on-screen display.
Change-Id: I44e5be65b2dee7ebce2cce28ccd920dc3d6e522e
|
|
Get rid of the notion of a font's "ascent"; the reference point for
drawing is the top-left corner of the character box rather than the
baseline. Add some more space between the menu entries and make the
highlight bar around the text.
Replace the default font.png with two images; the build system will
include one or the other based on the resolutions of the device.
Restore the original compiled-in bitmap font, to fall back on when
font.png can't be found (eg, in the charger binary).
Add support for bold text (when a font.png image is used).
Change-Id: I6d211a486a3636f20208502b1cd2aeae8b9f5b02
|
|
For some reason fakeflash doesn't like to have superuser/su
in /res, move it to its own subdir in /supersu. This allows
a fakeflash zip built with 'make recoveryzip' to work correctly.
Change-Id: I32e2e0f6dba55281d5c917e931c3ef0034964bcb
|
|
we can now use libblkid to detect exfat
|
|
|
|
Also fix sort order for file selector by date and file sizes
Change-Id: Idff9fe4232c19d4ed1082e78fabe6f921aa0a114
|
|
|
|
Change-Id: I6a76a51cd9efd7db67d7abeeb26f9bdd0eebf5a9
|
|
|
|
Add proper mkdosfs tool
Add fuse to TWRP
Add experimental exfat-fuse to TWRP
Convert all system() functions to use new Exec_Cmd function
|
|
Change-Id: Ia96201f20f7838d7d9e8926208977d3f8318ced4
|
|
|
|
|
|
At load_locale_from_cache() function, LOCALE_FILE must get closed
after it is opened and used. Otherwise it causes a failure to
unmount "/cache" after load_locale_from_cache() function is called.
Change-Id: I9cec0f29a8ec4452c8a6a52e2f3c8ce9930d5372
Signed-off-by: Iliyan Malchev <malchev@google.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Converted bootloader.cpp to TWRP and removed AOSP fstab parsing
from startup
|
|
We need prompt_with_wait() to show either the ERROR or NO_COMMAND
state as appropriate.
Bug: 7221068
Change-Id: I191526cf12630d08b7a8250a2a81e724a4a5d972
|
|
Improve zip finding in ORS engine
Add support for restoring with just a backup name
|
|
|
|
Also copy zip from /tmp to storage and remove from /tmp to
prevent running out of RAM.
|
|
Add images of text for all locales we support. Make the progress bar
fill the correct way for RTL languages. (Flip the direction the
spinner turns, too, just for good measure.)
Bug: 7064142
Change-Id: I5dddb26e02ee5275c57c4dc4a03c6d68432ac7ba
|
|
|
|
Add images of text for all locales we support. Make the progress bar
fill the correct way for RTL languages. (Flip the direction the
spinner turns, too, just for good measure.)
Bug: 7064142
Change-Id: I5dddb26e02ee5275c57c4dc4a03c6d68432ac7ba
|
|
Zip install works, had to move mincrypt code into TWRP to prevent
a crash when checking the zip signature.
Added wipe functions
Made it compile in CM7
Made text show up in console and logging
|
|
Move TW zip install code to C++ so that it can use the
ui->functions.
Bring in mincrypt code to fix a crash during signature
checking.
|
|
Add flag parsing from recovery.fstab
|
|
|
|
|
|
- change locale filename to "last_locale" so the main system doesn't
delete it
- clean up some chatty logging
- update images with real German (other languages TBD)
Change-Id: I2ebb4ed4e054bd1808a3042d9efbb2c18f3a044d
|
|
Also make writing the locale a bit more robust.
Change-Id: I803dd0aa0b9d6661fad74ea13fb085682402323c
|
|
- recovery takes a --locale argument, which will be passed by the main
system
- the locale is saved in cache, in case the --locale argument is
missing (eg, when recovery is started from fastboot)
- we include images that have prerendered text for many locales
- we split the background states into four (installing update,
erasing, no command, error) so that appropriate text can be shown.
Change-Id: I731b8108e83d5ccc09a4aacfc1dbf7e86b397aaf
|
|
- add the --just_exit option to make recovery exit normally without doing anything
- make it possible to build updater extensions in C++
- add the clear_display command so that the updater binary can request
recovery switch to the NONE background UI
These are all used to support the notion of using OTA as a factory
reflash mechanism.
Change-Id: Ib00d1cbf540feff38f52a61a2cf198915b48488c
|
|
The contribution of SELinux things to AOSP had a call to the old
ui_print that merged cleanly. This changes that call into the newer
call so it will actually compile when enabled.
Change-Id: I8368e937219b01d0bef06007fa46302415256d07
|
|
Rather than depending on the existence of some place to store a file
that is accessible to users on an an unbootable device (eg, a physical
sdcard, external USB drive, etc.), add support for sideloading
packages sent to the device with adb.
This change adds a "minimal adbd" which supports nothing but receiving
a package over adb (with the "adb sideload" command) and storing it to
a fixed filename in the /tmp ramdisk, from where it can be verified
and sideloaded in the usual way. This should be leave available even
on locked user-build devices.
The user can select "apply package from ADB" from the recovery menu,
which starts minimal-adb mode (shutting down any real adbd that may be
running). Once minimal-adb has received a package it exits
(restarting real adbd if appropriate) and then verification and
installation of the received package proceeds.
always initialize usb product, vendor, etc. for adb in recovery
Set these values even on non-debuggable builds, so that the mini-adb
now in recovery can work.
|
|
Rather than depending on the existence of some place to store a file
that is accessible to users on an an unbootable device (eg, a physical
sdcard, external USB drive, etc.), add support for sideloading
packages sent to the device with adb.
This change adds a "minimal adbd" which supports nothing but receiving
a package over adb (with the "adb sideload" command) and storing it to
a fixed filename in the /tmp ramdisk, from where it can be verified
and sideloaded in the usual way. This should be leave available even
on locked user-build devices.
The user can select "apply package from ADB" from the recovery menu,
which starts minimal-adb mode (shutting down any real adbd that may be
running). Once minimal-adb has received a package it exits
(restarting real adbd if appropriate) and then verification and
installation of the received package proceeds.
Change-Id: I6fe13161ca064a98d06fa32104e1f432826582f5
|
|
Some packages expect to find cache mounted, since it always is for
"real" OTAs.
Bug: 5739915
Change-Id: I7a7cdd88a60c61e4bc7dc3e1f99956f6487c42e1
|
|
Move the key for handling keys from ScreenRecoveryUI to RecoveryUI, so
it can be used by devices without screens. Remove the UIParameters
struct and replace it with some new member variables in
ScreenRecoveryUI.
Change-Id: I70094ecbc4acbf76ce44d5b5ec2036c36bdc3414
|
|
Move the key for handling keys from ScreenRecoveryUI to RecoveryUI, so
it can be used by devices without screens. Remove the UIParameters
struct and replace it with some new member variables in
ScreenRecoveryUI.
Change-Id: I4c0e659edcbedc0b9e86ed261ae4dbb3c6097414
|
|
Replace the device-specific functions with a class. Move some of the
key handling (for log visibility toggling and rebooting) into the UI
class. Fix up the key handling so there is less crosstalk between the
immediate keys and the queued keys (an increasing annoyance on
button-limited devices).
Change-Id: I698f6fd21c67a1e55429312a0484b6c393cad46f
|
|
Move all the functions in ui.c to be members of a ScreenRecoveryUI
class, which is a subclass of an abstract RecoveryUI class. Recovery
then creates a global singleton instance of this class and then invoke
the methods to drive the UI. We use this to allow substitution of a
different RecoveryUI implementation for devices with radically
different form factors (eg, that don't have a screen).
Change-Id: I76bdd34eca506149f4cc07685df6a4890473f3d9
|
|
Replace the device-specific functions with a class. Move some of the
key handling (for log visibility toggling and rebooting) into the UI
class. Fix up the key handling so there is less crosstalk between the
immediate keys and the queued keys (an increasing annoyance on
button-limited devices).
Change-Id: I8bdea6505da7974631bf3d9ac3ee308f8c0f76e1
|
|
Change-Id: I423a23581048d451d53eef46e5f5eac485b77555
|
|
Change-Id: I68a67a4c8edec9a74463b3d4766005ce27b51316
|
|
updater now has a function "wipe_cache();" which causes recovery to
wipe the cache partition after the successful installation of the
package. Move log copying around a bit so logs and the last_install
flag file are copied to cache after it's wiped.
Bug: 5314244
Change-Id: Id35a9eb6dcd626c8f3a3a0076074f462ed3d44bd
|
|
Change-Id: I8f78377555c658a992ca95cadf11b67ddc93fed8
|
|
When installing a package, create /cache/recovery/last_install, which
contains the filename of the package and a 1 or 0 for success or
failure.
Also, don't mount ext4 and vfat filesystems as read-only (on devices
where /cache is ext4, we need it to be read-write).
Change-Id: I0cf2a1921bbd65e06343aa74e2006577fac77c2c
|
|
The new android_reboot() function is a nicer way to reboot the
system. I can optionally sync() and remount read-only writable
filesystems. This fixes bug 3350709.
Change-Id: Ic4c8676debd642e57bce3107b99dd810d90b6f82
|
|
Change some of the UI parameters (# of indeterminate progress bar
frames, fps, etc.) from #defined constants to variables that can be
set by the device-specific recovery_ui code (via a new function).
Support overlaying different images on top of the base installation
icon to animate it. Make the FPS control more accurate.
Change-Id: I9268b389b7ea6b3ed9e0c7eae37baf4272e60edd
|
|
If recovery sits for 2 minutes in prompt_and_wait(), and you've never
turned the screen on via the magic keypress, go ahead and reboot. (We
used to assume that the user could pull the battery to get out of this
state, but on devices with nonremovable batteries...)
If you've ever enabled display of the log/menu since recovery started,
we assume you know what you're doing and will stay in recovery until
you choose to reboot.
Bug: 3387873
Bug: 3387274
Change-Id: I041621e5db132df9a925e6808845a7c45e1b427a
|
|
This was never used; encrypted filesystems are being done a different
way now.
Change-Id: I519c57b9be44d001f0b81516af7bfc252069892b
|
|
Make ui_init() clear the framebuffer memory it maps in so the user
isn't treated to a visible flash of random bits on recovery startup.
Call ui_set_background() (to show the installing icon) right after
ui_init() to display something while device_recovery_start() is
working (which can take a second or two on some devices).
Bug: 3145331
Change-Id: I11e7859fab5847370ea4f4932c3fb1558af26c5d
|
|
Also, don't lose the start of the log whenever a wipe cache is
performed.
Change-Id: I29999762854eb36d1ff2bc20b4183c9077b19777
|
|
Change-Id: I7bf52b56770c207ba1c8329243991b07ebb65779
|
|
Bug: 3009493
Change-Id: I1a7f99fc41a6a7012742e82f8c06a0c75584890a
|
|
Remove the wacky notion of "roots" and "root paths" (those things that
look like "FOO:some/path" instead of just "/foo/some/path"). Let each
device specify its own table of available partitions and how to mount
them (needed for devices that use both MTD/yaffs2 and EMMC/ext4
partitions).
(Cherrypicked from gingerbread w/slight edits.)
Change-Id: I2479ce76b13e73f1d12035c89386c3a82b3edf51
|
|
Remove the wacky notion of "roots" and "root paths" (those things that
look like "FOO:some/path" instead of just "/foo/some/path"). Let each
device specify its own table of available partitions and how to mount
them (needed for devices that use both MTD/yaffs2 and EMMC/ext4
partitions).
Change-Id: I18b0a572a71c5e087e0b7ae11b1774388339bfd1
|
|
Make the mount and format functions take extra parameters describing
the filesystem type and add support for mounting and formatting ext4
filesystems on EMMC.
Change recovery to consistently use stdout for status messages instead
of mixing stdout and stderr.
|
|
Replaces the "install sdcard:update zip" menu option with one that
displays a menu of zip files (and subdirs) on the sdcard and lets you
pick which one to install.
Change-Id: Icff541525f2fdfc8939a91af626ecc386ac9dd07
|
|
Change-Id: Ie6c6c920260dfa759fbb15b1f352d6bb0fa7146c
|
|
Change-Id: I46e4d7fe76e4219207e46f19e50188e38bb932b7
|
|
Change-Id: I008510bf614606a46a630c7adc39464ce1143ec3
|
|
Change-Id: If0efeddc28e1dbb52d9e52abf53323e2cc97c8f0
|
|
Allow sideloading of OTA packages from USB drives that appear as
/dev/block/sda1.
Change-Id: I1908576c24547cd0088475d8c8917699cd906868
|
|
Copy a sideloaded package into /tmp, then verify and install the copy,
to prevent malicious users from overwriting the package between
verification and install.
Bug: 2826890 package can be replaced during verification
Bug: 2058160 Recovery should copy sideloaded (sd card) update ...
Change-Id: I3de148b0f1a671f1974782b6855527caeaefda23
|
|
Make the mount and format functions take extra parameters describing
the filesystem type and add support for mounting and formatting ext4
filesystems on EMMC.
Change recovery to consistently use stdout for status messages instead
of mixing stdout and stderr.
|
|
Replaces the "install sdcard:update zip" menu option with one that
displays a menu of zip files (and subdirs) on the sdcard and lets you
pick which one to install.
Change-Id: I85c94c0e9bc8e05ca52031fc29ca2624c2695ced
|
|
Encrypted File Systems integration. Recovery changes.
Change-Id: I932f73a6f937aac061128e1134eab08c30f0471d
|
|
Removing unused recovey options.
Please refer to Bug#2502219 for more info.
Change-Id: I2fe3cdb0c8b93ed7e1cc4093824fbe181f5f0aea
|
|
Change-Id: I932f73a6f937aac061128e1134eab08c30f0471d
|
|
Remove support for the HTC-specific "firmware" update command and the
corresponding edify function write_firmware_update(). This
functionality is now done by an edify extension library that lives in
vendor/htc.
Change-Id: I80858951ff10ed8dfff98aefb796bef009e05efb
|
|
Remove (or at least stop calling) the HTC-specific mechanism for
preserving the recovery log from before a radio or hboot update.
Replace it with a generic device_recovery_start() function which each
device's code can implement to do whatever it wants on recovery
startup.
Change-Id: If3cca4b498c0b1cf0565236404ecf56a1fc46123
|
|
When doing a firmware (radio or hboot) update on HTC devices, save the
recovery log in block 1 of the cache partition, before the firmware
image and the UI bitmaps. When we boot back into recovery after the
firmware update to reformat the cache partition, copy that log out of
cache before reformatting it and dump it into the current invocation's
log.
The practical upshot of all this is that we can see the log output
from radio and hboot updates.
Change-Id: Ie0e89566754c88f4bed6a90d8a0aa04047b01a27
|
|
This change enables/disables the Encrypted file systems feature. It reads some properties form the data partition, wipes the partition out, and then rewrites the proper properties again into the data partition to signal that encrypted FS are enabled.
|
|
|
|
http://b/2170691 - recovery argument parsing is broken
|
|
When using the hidden menu to wipe data in recovery, confirm before
starting the wipe. (This does not affect booting with the --wipe_data
flag, or using Alt+W on dream with the menu hidden -- those still wipe
data immediately.)
|
|
Example: E:Can't open /cache/recovery/command.
|
|
|
|
after a power loss
Submitted on behalf of Hong-Bin Wang <hong-binwang@motorola.com>
Signed-off-by: Jared Suttles <jared.suttles@motorola.com>
|
|
Yank all the code to install OTA packages out of the recovery binary
itself. Now packages are installed by a binary included in the
package (run as a child of recovery), so we can make improvements in
the installation process without waiting for a new release to use
them.
|
|
Some devices want to do special things when recovery wipes data (eg,
wipe data in their baseband processor as well). Add a hook in the
device-specific recovery library that gets called when data is wiped.
Also add an amend root for the "mbm" partition.
|
|
To do a firmware-install-on-reboot, the update binary tells recovery
what file to install before rebooting. Let this file be specified as
"PACKAGE:<foo>" to indicate taking the file out of the OTA package,
avoiding an extra copy to /tmp. Bump the API version number to
reflect this change.
|
|
Take some device-specific details of the recovery UI (eg, what keys to
press to bring up the interface and perform actions, exact text of the
menu, etc.) and split them out into separate C functions. Arrange to
take implementations of those functions from the appropriate vendor
directory at build time. Provide a default implementation in case no
vendor-specific one is available.
|
|
Amend (aka the recovery command language) had a half-implemented
scheme of limiting which commands OTA packages were allowed to
execute. It's not clear what this was ever supposed to be good for.
Remove it.
|
|
Change the recovery UI so that when there is a hboot or radio update
pending (which the user most do a home+back reboot to actually
install), the UI tells them so, instead of saying "Install from sdcard
complete."
|
|
Original author: dougz
Merged from: //branches/donutburger/...
Automated import of CL 144101
|
|
Automated import of CL 144070
|
|
|
|
|
|
|
|
|
