Build libinstall as a shared library. Also drop the dependency on the
global variables in common.h.
Test: unit tests pass, sideload an OTA
Change-Id: I30a20047768ce00689fc0e7851c1c5d712a365a0
If we use the default parameter we'll get O_CLOEXEC, which will close the fd
that we pass to the child process, which will cause it to fail. Passing zero
avoids the problem.
Bug: 122813742
Test: Verify that non-A/B OTA update is successful.
Change-Id: Ia61bc7260f17d9209715583e6ded69e1196ed3f6
This helps to expose librecovery_ui for device specific RecoveryUi.
Bug: 76436783
Test: mma, unit tests pass
Change-Id: Ic6c3d301d5833e4a592e6ea9d9d059bc4e4919be
(cherry picked from commit b5108c372c)
android::vintf::VintfObjectRecovery::CheckCompatibility() may try to
mount partitions in order to read the needed files, which may not be
feasible when resuming an interrupted update. This CL changes the logic
to enforce compatibility check on fresh install only.
Fix: 122864541
Test: Sideloading on taimen keeps working.
Test: Sideload a package by setting the retry bit. Check that
compatibility check is skipped.
Change-Id: I018a0c802c85a0e84a6f2aac50630a677d64382a
Creates a new class handle the package in memory and package read from fd.
Define the new interface functions, and make approximate changes to the
verify and install functions.
Bug: 127071893
Test: unit tests pass, sideload a package
Change-Id: I66ab00654df92471184536fd147b237a86e9c5b5
Also clean up the comments regarding updater/recovery protocol.
Test: Sideload a package on taimen. Check that /tmp/recovery.log
contains the log from update_engine_sideload.
Test: Factory reset on taimen. Check that log file has the info from
mke2fs.
Change-Id: If560269ce7007769fc85a63bd228813bdd75bebd
Test: Build and boot into recovery on marlin. Factory reset.
Test: Build and install a non-A/B OTA that calls format.
Change-Id: I72416e775e237fc15ca5eff1036175a9eef43b76
Convert code to use C++ Fstab struct and C++ std::strings.
Bug: 62292478
Bug: 118634720
Test: boots
Change-Id: Ibdc1df5831bc885d7c1574419f41af026e49a137
WEXITSTATUS only gives meaningful value if WIFEXITED is true. So we may
see a slightly confusing message of "E:Error in /path/to/package (Status
0)" for a killed updater process (e.g. updater calling abort(3)). This
CL dumps the signal number for such a case.
Test: abort() in child process. Check the output.
Change-Id: I72e6654a6499d65155085de658062efb9f1e36ac
The two functions check_wipe_package() and check_newer_ab_build() were
using the same flow; and checked the same device properties against the
metadata file in the package. These properties include: ota_type,
pre-device, and serial number.
Therefore, we can consolidate the checks to a single function; and
continue to check the fingerprint and timestamp only for AB updates.
This change also addresses the need to accept multiple serial number in
the wipe package.
Bug: 118401208
Test: unit tests pass
Change-Id: Ia6bc48fb6effcae059a2ff2cf71764b4136b4c00
This is in line with the build system change which copies the recovery ota
install keys to a zipfile. And now recovery will parses and loads the public
keys from /res/otacerts.zip. The legacy load_keys functions will be
removed in later cls.
Bug: 116655889
Test: sideload an ota package
Change-Id: I95e91736ca9964df06d74aa292d672e2f9e442e8
Bug: 112494634
Test: Build and boot into recovery image on taimen. Verify that
`Apply updates from ADB` keeps working.
Test: Run recovery_component_test on marlin.
Change-Id: I9ee8834053fda79a4fd77bfa83eab3cc51a90dff
This shortens the gap between A/B and non-A/B builds, by replacing the
dependency on build-time flag with runtime detection instead. It also
allows building and testing both paths regardless of the target OTA
type.
The size increase to /sbin/recovery looks negligible (< 0.01%).
- marlin: increased from 2084928 to 2085024;
- angler: increased from 2084776 to 2084896.
Test: Run recovery_component_test on angler and marlin.
Test: Sideload an A/B OTA package on marlin.
Test: Sideload a non-A/B OTA package on angler.
Change-Id: I1d927d1ede9713fb42f73b4fe324aa5705ee6f99
We have a general need for overriding more paths (e.g. "/tmp"), mostly
for testing purpose. Rename CacheLocation to Paths, and use that to
manage TEMPORARY_{INSTALL,LOG}_FILE.
Test: mmma -j bootable/recovery
Test: recovery_component_test
Change-Id: Ia8ce8e5695df37ca434f13ac4d3206de1e8e9396
This reverts commit 26436d6d60 to re-land
"Move error_code.h into otautil.".
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES
(uncrypt and edify). Soong doesn't accept non-local ".." in
"local_include_dirs".
This CL needs to land with device-specific module changes (e.g. adding
the dependency on libotautil).
Test: lunch aosp_{angler,bullhead,dragon,fugu,sailfish}-userdebug;
mmma bootable/recovery
Change-Id: If193241801af2dae73eccd31ce57cd2b81c9fd96
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES
(uncrypt and edify). Soong doesn't accept non-local ".." in
"local_include_dirs".
Test: mmma bootable/recovery
Change-Id: Ia4649789cef2aaeb2785483660e9ea5a8b389c62
The earlier commit in 2dfc1a3898
unintentionally changed the behavior. It gives a different result when
looking up non-existent mount points (e.g. /cache on marlin).
The logic behind volume_for_path("/xyz") is unclear:
- It's fine to return non-null value if it's called by
ensure_path_mounted() before accessing that file "/xyz". (Just based
on the function name, we're not actually having this case.)
- It should return nullptr if the caller is interested in the existence
of that particular mount point "/xyz".
This CL renames the function to volume_for_mount_point(), which does an
exact match by querying the given mount point from libfs_mgr. The former
volume_for_path() has been moved down to function scope for serving
ensure_path_mounted() only.
Test: Build and boot into recovery on bullhead and marlin respectively.
'View recovery logs'.
Test: 'Mount /system'
Test: 'Apply update from ADB'
Change-Id: I1a16390f57540cae08a2b8f3d439d17886975217
This reverts commit 8be0f39fec to reland
the change that removes EXPAND/STRINGIFY macros.
It's error-prone by putting anything into a string (e.g.
EXPAND(RECOVERY_API_VERSION) would become "RECOVER_API_VERSION" if we
forgot to pass -DRECOVERY_API_VERSION=3).
The initial attempt put RECOVERY_API_VERSION into common.h, which might
be included by device-specific codes but without defining that when
compiling the module. This CL avoids the issue by using a constant
in the header, with a static_assert in recovery.cpp that guards the
consistency.
Test: recovery_component_test
Test: Sideload OTAs on bullhead and sailfish respectively.
Change-Id: I12af3f73392a85554ba703f04970ec9d984ccbaa
Add report of kMapFileFailure, kForkUpdateBinaryFailure and
kUpdateBinaryCommandFailure.
Test: unit test pass; kMapFileFailure reports correctly.
Change-Id: I858c81b6c750b5e300b1b12760b1f0fa8e23b47d
The metadata file now can have multiple serial numbers in the format:
serialno=serialno1|serialno2|serialno3 ...
Verifier will pass the check if the device serial number matches any of
these numbers.
Bug: 64802465
Test: Create a metadata file with 1000 numbers and sideload in sailfish.
The checker detects both match and mismatch cases.
Change-Id: I3f12b75e15f4179df260778e37f4563d65db0fa8
The install logging currently assumes that the build number is a 32-bit
integer and prints an error when that doesn't hold true. However, that's
only a convention used by Google builds.
From build/core/version_defaults.mk:
ifeq "" "$(BUILD_NUMBER)"
# BUILD_NUMBER should be set to the source control value that
# represents the current state of the source code. E.g., a
# perforce changelist number or a git hash. Can be an arbitrary string
# (to allow for source control that uses something other than numbers),
# but must be a single word and a valid file name.
#
# If no BUILD_NUMBER is set, create a useful "I am an engineering build
# from this date/time" value. Make it start with a non-digit so that
# anyone trying to parse it as an integer will probably get "0".
BUILD_NUMBER := eng.$(shell echo $${USER:0:6}).$(shell $(DATE) +%Y%m%d.%H%M%S)
endif
Change-Id: I8e7cec0618783f69545ba76d0dce2bbc1681784c
It's a rare deadlock that happens on fugu when the updater exits too
fast due to a format error.
Bug: 62379170
Test: fake-ota fails gracefully without hanging.
Change-Id: Icbd6cff4f6b44ca20f4d75f8039332111f696cc5
This allows writing native tests for non-A/B update_binary_command().
Prior to this CL, it was extracting the updater to a hard-coded
location (/tmp/update_binary) that's not available under the test
environment.
Test: recovery_component_test on angler and marlin respectively.
Test: Sideload OTA packages on angler and marlin respectively.
Change-Id: I78b9cc211d90c0a16a84e94e339b65759300e2a8
This reverts commit ec9706738f.
Reason for revert: It's not a good idea to put RECOVERY_API_VERSION in
common.h, which might be included by device-specific codes (but with
RECOVERY_API_VERSION undefined).
Change-Id: I9feb9c64a5af3e9165164622a59b043aa28a8b8c
They are error-prone by putting anything into a string (e.g.
EXPAND(RECOVERY_API_VERSION) would become "RECOVER_API_VERSION" if we
forgot to pass -DRECOVERY_API_VERSION=3).
RECOVERY_API_VERSION is the only user (in bootable/recovery) that gets
stringified. Assign it to a typed var and sanity check the value.
Don't see other reference to the macros from device-specific recovery
directories (they can still define that locally if really needed).
Test: recovery_component_test
Test: Sideload an OTA on angler and marlin respectively.
Change-Id: I358bbdf8f0a99db5ce4c7bc2fdcafe8013501b64
Also change the parameter type for log_buffer from reference to pointer,
so the styles for parameters look consistent.
Test: mmma bootable/recovery
Test: sideload a package with the new recovery image
Change-Id: I8f25580ccf22977624648b3e2181cca44dd67c1b
The libvintf API has landed. Hook up to do the actual verification.
Bug: 36597505
Test: recovery_component_test
Test: m recoveryimage; adb sideload on angler and sailfish, with
packages that contain dummy compatibility entries.
Test: m recoveryimage; adb sideload on angler and sailfish, with
packages that don't contain any compatibility entries.
Change-Id: Idbd6f5aaef605ca51b20e667505d686de5ac781f
(cherry picked from commit da320ac6ab)
Expose update_binary_command() through private/install.h for testing
purpose.
Also make minor clean-ups to install.cpp: a) adding more verbose logging
on ExtractToMemory failures; b) update_binary_command() taking
std::string instead of const char*; c) moving a few macro and global
constants into update_binary_command().
Bug: 37300957
Test: recovery_component_test on marlin
Test: Build new recovery and adb sideload on angler and sailfish.
Change-Id: Ib2d9068af3fee038f01c90940ccaeb0a7da374fc
verify_package_compatibility() is added to parse the compatibility entry
(compatibility.zip) in a given OTA package. If entry is present, the
information is sent to libvintf to check the compatibility.
This CL doesn't actually call libvintf, since the API there is not
available yet.
Bug: 36597505
Test: Doesn't break the install with existing packages (i.e. w/o the
compatibility entry).
Test: recovery_component_test
Change-Id: I3903ffa5f6ba33a5c0d761602ade6290c6752596
(cherry picked from commit 62e0bc7586)
Log the maximum temperature as well as the start/end temperature of an
update to last_install. Check the temperature at the end of each
block_image_update(verify). To get the maximum temp, we iterate through
/sys/class/thermal/thermal_zone*/temp and find the maximum value
present.
Bug: 32518487
Test: temperature logs in last_install
Change-Id: Iaf22a9fbc5b18611bbc5320ffea995417872e514
This warning may cause confusion for users.
Bug: 36590598
Test: Warning line no longer shows for sailfish.
Change-Id: I277c87a50a72fdb499be790ee25b97f815d980be
Merged-In: I277c87a50a72fdb499be790ee25b97f815d980be
We should not touch any data while verifying packages (or parsing the
in-memory ASN.1 structures).
Test: mmma bootable/recovery
Test: recovery_component_test passes.
Test: recovery_unit_test passes.
Change-Id: Ie990662c6451ec066a1807b3081c9296afbdb0bf
verify_file() has a dependency on the global variable of 'ui' for
posting the verification progress, which requires the users of
libverifier to provide a UI instance.
This CL adds an optional argument to verify_file() so that it can
post the progress through the provided callback function. As a result,
we can drop the MockUI class in verifier_test.cpp.
Test: recovery_component_test passes.
Test: verify_file() posts progress update when installing an OTA.
Change-Id: I8b87d0f0d99777ea755d33d6dbbe2b6d44243bf1
-1 is not a valid exit status.
Also replace a few exit(1) with exit(EXIT_FAILURE).
Test: mmma bootable/recovery
Change-Id: I4596c8328b770bf95acccc06a4401bd5cabd4bfd
ui_print uses a mutex to protect the critical section. And a forked
child process may intialize the mutex inappropriatly, which leads to a
hanging child process. So we shall avoid to call the UI functions in
child process.
Bug: 34769056
Test: fake ota on fugu failed as expected due to updater format mismatch.
Change-Id: I81bc942a796878fac19cf712512092c2b0d807c9
Currently the ui_print command between the recovery and updater doesn't
append newline. Updater has to send an extra "ui_print" command without
any argument to get the line break. This looks unnecessary. And not all
the callers (including the ones in bootable/recovery) are following this
protocol when sending the ui_print command.
This CL simplifies the protocol to always print with a newline for
ui_print command. When updating from an old recovery with the new
updater, all the ui_print'd strings would appear in one line as a side
effect. But a) it would only affect the text-mode UI, which won't be
shown to users; b) log files won't be affected.
Bug: 32305035
Test: Apply an update with the new updater on top of an old and new
recovery image respectively.
Change-Id: I305a0ffc6f180daf60919cf99d24d1495d68749b
Test: Apply two A/B incremental OTAs with the new recovery image. The
one with incorrect pre-build should be blocked, while the other
works fine.
Change-Id: I94d97eb8798599da1630f66343fb603e87464187
