Allow "adb remount" on deduplicated filesystems to reboot into recovery
and run e2fsck to undo deduplication. The e2fsck binary is copied from
the system partition into tmpfs, and the system partition is unmounted
so e2fsck can run safely.
Bug: 64109868
Test: recovery with --fsck_unshare_blocks; adb remount
Change-Id: I7558749b018b58f3c4339e51a95831dbd5be1ae3
Add the ability to change the contents of
the title lines, displayed at the top of
the screen. Once set, the same lines are
displayed for all menus until changed again.
Test: Recovery works
Bug: 78793464
Change-Id: I7ef5594b0d76dbbd2e01ad7508863af1270b2a2a
The getopt library exposes optind which is the
next index to be processed. When scanning is
restarted, optind has to be reset to 1.
Test: Recovery works
Bug: 78793464
Change-Id: I1efca3fb985ffbdfe91e43767469733cda6e7d5b
Move more common setup into the main function.
Main() handles all 1 time setup, such as ui,
logging, and secontext. Recovery_main()
takes in command line arguments, does any
necessary recovery work, and can be called
multiple times from main().
Test: Recovery works
Bug: 78793464
Change-Id: I2d2595fc342b4ddfa80f4e06b30e44263132acd9
Merged-In: I2d2595fc342b4ddfa80f4e06b30e44263132acd9
Move more common setup into the main function.
Main() handles all 1 time setup, such as ui,
logging, and secontext. Recovery_main()
takes in command line arguments, does any
necessary recovery work, and can be called
multiple times from main().
Test: Recovery works
Bug: 78793464
Change-Id: I2d2595fc342b4ddfa80f4e06b30e44263132acd9
Drop the dependency on build time flag of AB_OTA_UPDATER when compiling
device.cpp. Note that AB_OTA_UPDATER still guards the package install
behavior (install.cpp).
This can be extended to cover the entry of "Apply update from SD card".
Test: Build and boot into recovery on angler and walleye respectively.
Check the recovery menu.
Change-Id: I36a6a6b4101ba61d4d374e32353c36cc5716f9ce
ScreenRecoveryUI already has the info in locale_.
Also when showing "Current locale: X/Y" on screen, use 1-based index for
X, so that we have 1 <= X <= Y.
Test: Build anf flash recovery image on aosp_bullhead-userdebug. Choose
`Run locale test` from UI.
Change-Id: I5dd4de82e63890ddf755f4e23cd2290ad5d50ece
This removes some reliance on the global
locale and ui variables.
Test: Recovery works
Bug: 78793464
Change-Id: I78f1a2b321f5d50aa58b10735a73ae137283353a
Move common logging related functions to
rotate_logs.cpp, and rename that to logging.cpp.
Test: Recovery works
Bug: 78793464
Merged-In: I00f20a79a296680122b8437d54a87897c5cb2fc7
Change-Id: I00f20a79a296680122b8437d54a87897c5cb2fc7
Move common logging related functions to
rotate_logs.cpp, and rename that to logging.cpp.
Test: Recovery works
Bug: 78793464
Change-Id: I00f20a79a296680122b8437d54a87897c5cb2fc7
(cherry picked from commit 3c3f211d1e)
This breaks the dependency on common.h (which belongs to
recovery/librecovery) from librecovery_ui. reboot() is now owned by
libotautil, which is expected to be a leaf node to be depended on.
With the change, recovery and updater also share the same reboot() code
now.
Test: mmma -j bootable/recovery
Change-Id: I1cc5d702cfe49302048db33d31c9c87ddc97ac71
Test: mmma -j bootable/recovery
Test: Run recovery_unit_test on marlin.
Test: Build and boot into recovery image on angler. Check the UI that
shows menu ('View recovery log', 'Wipe data', 'Run locale test').
Test: Start recovery with '--prompt_and_wipe_data'. Check the UI.
Change-Id: If8a4209e0bb4ca64f719f9f9465d3b3589a69cdc
Remove the use of fopen_path() in screen_ui.cpp, as this is the only
place that requires the dependency on common.h. The mounting work should
be done by the caller.
Also change the parameter in RecoveryUI::ShowFile() from const char* to
const std::string&.
Test: mmma -j bootable/recovery
Test: Build and boot into recovery image on angler. Choose 'View
recovery logs'.
Change-Id: I8e63f14a8e2b12b856e5a92476e4226cd6ea39fb
From caller's PoV, RecoveryUI::{Start,Select,End}Menu should always be
used together, i.e. to show a menu and get user's selection. This CL
provides ShowMenu() as one-stop service (which is based on
get_menu_selection() from recovery.cpp).
Also move RecoveryUI::{Start,Select,End}Menu into ScreenRecoveryUI, with
a dropped access level from public to protected.
Due to the dependency on recovery / librecovery refactoring, will add
testcases in follow-up CLs.
Test: Build and boot into recovery image. Check the menus (main menu,
'View recovery logs', 'Wipe data/factory reset').
Change-Id: Ie17aa78144871a12affd6f9075e045f76608a0ba
This prepares for moving more codes from recovery into librecovery, so
that they will become more easily testable. recovery_main.cpp will be
the source code for recovery module, with the rest moved into
librecovery. recovery_main.cpp mainly does the initializations, such as
setting up the logger.
Test: mmma -j bootable/recovery
Test: recovery_component_test
Test: Build and boot into recovery image on marlin.
Change-Id: I8e846524546b6f3f0e32ed869e851f62261eef23
Merged-In: I8e846524546b6f3f0e32ed869e851f62261eef23
This prepares for moving more codes from recovery into librecovery, so
that they will become more easily testable. recovery_main.cpp will be
the source code for recovery module, with the rest moved into
librecovery. recovery_main.cpp mainly does the initializations, such as
setting up the logger.
Test: mmma -j bootable/recovery
Test: recovery_component_test
Test: Build and boot into recovery image on marlin.
Change-Id: I8e846524546b6f3f0e32ed869e851f62261eef23
(cherry picked from commit c241cb662440551eb0d2f42345f7ee08cf60a7dd)
Test: Build and flash aosp_angler-userdebug. Choose 'Convert to file
encryption' from Developer Options. Converting to FBE still works.
Change-Id: I75ac0e266af2d00bfaff0664f8bcee74a5f16b41
`recovery` is not a command line tool, and these short options don't
have the common meanings that are used elsewhere.
In the platform code, we're not actively using the short forms.
- bootable/recovery/uncrypt/uncrypt.cpp
- bootable/recovery/updater/install.cpp
- frameworks/base/core/java/android/os/RecoverySystem.java
- system/core/adb/services.cpp
- system/core/init/builtins.cpp
- system/update_engine/hardware_android.cc
- system/vold/cryptfs.cpp
(Callers must have used libbootloader_message.)
'--show_text' and '--just_exit' are not that obvious from the initial
commit messages. They appear to be used by vendor code (e.g.
'--show_text' is optionally used by bootloader, as in the noted bug). So
this CL keeps them as is for now.
Test: `mmma -j bootable/recovery`
Test: Check the code search for possible callers to recovery.
Change-Id: I8a87f5fb50131d647dfc8290381ca47a60f543fa
It should be one of BATTERY_OK_PERCENTAGE (20) and
BATTERY_WITH_CHARGER_OK_PERCENTAGE (15), depending on the charger state.
Also move the battery level related constants next to their users.
Test: mmma -j bootable/recovery
Test: Build and boot into recovery with a pending OTA. Check the log.
Change-Id: I7513f59c4718ec8e2db16c5266928470c2308648
(cherry picked from commit f2ea6d7999)
It should be one of BATTERY_OK_PERCENTAGE (20) and
BATTERY_WITH_CHARGER_OK_PERCENTAGE (15), depending on the charger state.
Also move the battery level related constants next to their users.
Test: mmma -j bootable/recovery
Test: Build and boot into recovery with a pending OTA. Check the log.
Change-Id: I7513f59c4718ec8e2db16c5266928470c2308648
Merged-In: I7513f59c4718ec8e2db16c5266928470c2308648
And fix an issue as a result of the change.
Test: mmma -j bootable/recovery
Change-Id: I94e6384a1f39e9c37a8ed029d235142738d6e5d3
Merged-In: I94e6384a1f39e9c37a8ed029d235142738d6e5d3
We have a general need for overriding more paths (e.g. "/tmp"), mostly
for testing purpose. Rename CacheLocation to Paths, and use that to
manage TEMPORARY_{INSTALL,LOG}_FILE.
Test: mmma -j bootable/recovery
Test: recovery_component_test
Change-Id: Ia8ce8e5695df37ca434f13ac4d3206de1e8e9396
Bug: 78469201
Test: Wipe from recovery menu, check that wipe is logged correctly
and boot works as expected.
Change-Id: I5bc8ef1b83d78de8b5edba6cc17882edcc744356
We used to skip the update installation if the battery doesn't reach the
threshold or the boot reason is in blacklist. Afterwards, we just cleared
the BCB and reboot/shutdown the device. However, this leaves the device
in a brick state if the update is a retry; because a subsequent reboot
won't resume the update after the BCB gets cleared.
This CL skips the battery and bootreason check on retries. An alternative
solution is to conduct the check and shutdown the device without clearing the
BCB on INSTALL_SKIPPED; but users who don't have context may reboot the
device manually anyway.
Bug: 65288661
Test: Trigger the INSTALL_SKIPPED with insufficient battery, and check
the behavior with retry_count.
Change-Id: I0bd8ae9cee0e35aeeec3df469a78cec9ee1b8db8
An interrupted update may stash extra blocks in /cache, leading to a
failure when checking the cache size. We can save the incremented
retry_count in the BCB before installing the update; and distinguish
a fresh update from an interrupted one this way.
Bug: 68679601
Test: An interrupted update reapplies successfully.
Change-Id: Ic1403e1fd25a937c91ef34c14b92a0f6c8f1c0f4
This reverts commit 26436d6d60 to re-land
"Move error_code.h into otautil.".
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES
(uncrypt and edify). Soong doesn't accept non-local ".." in
"local_include_dirs".
This CL needs to land with device-specific module changes (e.g. adding
the dependency on libotautil).
Test: lunch aosp_{angler,bullhead,dragon,fugu,sailfish}-userdebug;
mmma bootable/recovery
Change-Id: If193241801af2dae73eccd31ce57cd2b81c9fd96
This way it stops requiring relative path ".." in LOCAL_C_INCLUDES
(uncrypt and edify). Soong doesn't accept non-local ".." in
"local_include_dirs".
Test: mmma bootable/recovery
Change-Id: Ia4649789cef2aaeb2785483660e9ea5a8b389c62
The earlier commit in 2dfc1a3898
unintentionally changed the behavior. It gives a different result when
looking up non-existent mount points (e.g. /cache on marlin).
The logic behind volume_for_path("/xyz") is unclear:
- It's fine to return non-null value if it's called by
ensure_path_mounted() before accessing that file "/xyz". (Just based
on the function name, we're not actually having this case.)
- It should return nullptr if the caller is interested in the existence
of that particular mount point "/xyz".
This CL renames the function to volume_for_mount_point(), which does an
exact match by querying the given mount point from libfs_mgr. The former
volume_for_path() has been moved down to function scope for serving
ensure_path_mounted() only.
Test: Build and boot into recovery on bullhead and marlin respectively.
'View recovery logs'.
Test: 'Mount /system'
Test: 'Apply update from ADB'
Change-Id: I1a16390f57540cae08a2b8f3d439d17886975217
Add a new option "Run locale test" to check the background text
images (i.e. texts for "erasing", "error", "no_command" and "installing"
with different locales.)
Use volume up/down button to cycle through all the locales embedded in
the png file, and power button to go back to recovery main menu.
Test: Run locale test with bullhead.
Change-Id: Ib16e119f372110cdb5e611ef497b0f9b9b418f51
This reverts commit 8be0f39fec to reland
the change that removes EXPAND/STRINGIFY macros.
It's error-prone by putting anything into a string (e.g.
EXPAND(RECOVERY_API_VERSION) would become "RECOVER_API_VERSION" if we
forgot to pass -DRECOVERY_API_VERSION=3).
The initial attempt put RECOVERY_API_VERSION into common.h, which might
be included by device-specific codes but without defining that when
compiling the module. This CL avoids the issue by using a constant
in the header, with a static_assert in recovery.cpp that guards the
consistency.
Test: recovery_component_test
Test: Sideload OTAs on bullhead and sailfish respectively.
Change-Id: I12af3f73392a85554ba703f04970ec9d984ccbaa
This CL adds ScreenRecoveryUI::DrawWrappedTextLines() to better handle
long menu header texts. It does a word wrap at spaces, if available.
This avoids fixed-length menu headers being truncated on small screens.
Bug: 64293520
Test: On bullhead, boot into recovery with --prompt_and_wipe_data, and
check the prompt texts.
Change-Id: Ia22746583516dd230567a267584aca558429395e
- Changed to std::string based implementation (mostly moved from the
former make_parents() in updater/install.cpp);
- Removed the timestamp parameter, which is only neeed by file-based OTA;
- Changed the type of mode from int to mode_t;
- Renamed dirCreateHierarchy() to mkdir_recursively().
Test: recovery_unit_test passes.
Test: No external user of dirCreateHierarchy() in code search.
Change-Id: I71f8c4b29bab625513bbc3af6d0d1ecdc3a2719a
When there's no command specified when booting into debuggable builds
(such as using `adb reboot recovery`), we turn on the text mode (i.e.
recovery menu) directly. This CL fixes the issue to avoid showing the
background image in a flash while turning on the text mode.
Bug: 63985334
Test: `fastboot boot $OUT/recovery.img` and it shows the recovery menu
directly without the no command image in a flash.
Change-Id: Id86bbe346ab76c8defc95e2b423e695a86774b09
When /cache is unwritable, recovery hits a crash loop. Because it
passes nullptr to fileno(3) when writing back the locale file. This
prevents user from recovering a device - it cannot boot far enough to
recovery menu which allows wiping /cache.
Bug: 63927337
Test: Corrupt /cache and boot into recovery on bullhead:
1. m -j recoveryimage
2. fastboot erase cache
3. fastboot boot $OUT/recovery.img
4. recovery menu shows up.
Change-Id: I1407743f802049eb48add56a36298b665cb86139
Fixed by Loading the file_contexts specified in libselinux, whereas
previously recovery loaded /file_contexts which no longer exists.
Bug: 62587423
Test: build and flash recovery on Angler. Warning is gone.
Test: Wipe data and cache.
Test: sideload OTA
Change-Id: I11581c878b860ac5f412e6e8e7acde811f37870f
(cherry picked from commit 2330dd8733)
We have seen one case when bspatch failed likely due to patch
corruption. Since the package has passed verification before, we want
to reboot and retry the patch command again since there's no
alternative for users.
We won't delete the stash before reboot, and the src has passed SHA1
check. If there's an error on the patch, it will fail the package
verification during retry.
Bug: 37855643
Test: angler reboots and retries the update when bspatch fails.
Change-Id: I2ebac9621bd1f0649bb301b9a28a0dd079ed4e1d
We're not updating argc & argv during get_args(), so some boot
arguments missed when we set the boot message for retry.
Bug: 38383406
Test: boot command sets correctly during retry attempt.
Change-Id: Ie8583a22fad5e0084245e3431d4018518d508dfd
(cherry picked from commit 72449c9f99)
We're not updating argc & argv during get_args(), so some boot
arguments missed when we set the boot message for retry.
Bug: 38383406
Test: boot command sets correctly during retry attempt.
Change-Id: Ie8583a22fad5e0084245e3431d4018518d508dfd
This reverts commit ec9706738f.
Reason for revert: It's not a good idea to put RECOVERY_API_VERSION in
common.h, which might be included by device-specific codes (but with
RECOVERY_API_VERSION undefined).
Change-Id: I9feb9c64a5af3e9165164622a59b043aa28a8b8c
They are error-prone by putting anything into a string (e.g.
EXPAND(RECOVERY_API_VERSION) would become "RECOVER_API_VERSION" if we
forgot to pass -DRECOVERY_API_VERSION=3).
RECOVERY_API_VERSION is the only user (in bootable/recovery) that gets
stringified. Assign it to a typed var and sanity check the value.
Don't see other reference to the macros from device-specific recovery
directories (they can still define that locally if really needed).
Test: recovery_component_test
Test: Sideload an OTA on angler and marlin respectively.
Change-Id: I358bbdf8f0a99db5ce4c7bc2fdcafe8013501b64
It's already a global declared in common.h which is included by
adb_install.cpp.
Remove '#include "minadbd/fuse_adb_provider.h"' that's not needed by
adb_install.cpp (minadbd takes care of that).
Test: mmma bootable/recovery
Change-Id: I6d08b7abc706b4b05de2ef46a57ced2204ad297e
Bug: 37401320
Test: build and push OTA and hit adb reboot recovery,quiescent. The screen should remain off throughout the upgrade process.
(cherry picked from commit 8706a98aa6)
Change-Id: I79789a151f6faafda8ecc6198c2182cc2a91da70
recovery.cpp doesn't have a direct dependency on adb.h (only minadbd
does). 'adb.h' was once needed for DEFAULT_ADB_PORT, until being killed
by commit acb2a2fa4c.
Test: mmma bootable/recovery
Change-Id: I84f87988d01c3f0c3d1383cc3cffde2e7d5e7aea
Users can't do much after the install fails with the device showing
"error" under recovery. So our best choice is to reboot the device
since sometimes the system image is still bootable (i.e. on package
verification failure). At worst the device would stuck in a boot loop
where the users need the same professional knowledge to recover as
before.
Behaviors after installation failure (including data wipe):
If recovery text is visible:
No change.
If recovery text is not visible:
Old behavior: Wait under "error" screen. Reboot after UI timeout (120s)
if not connected to usb charger.
New behavior: Wait for 5s (shortens from the 120s timeout) under "error"
screen and reboot (w or w/o charger).
sideload-auto-reboot (only available for userdebug):
Old behavior: Reboot immediately after installation failure.
New behavior: Wait for 5s under "error" screen and reboot.
Bug: 35386985
Test: On angler user, device auto reboots 5s after a failing OTA.
Change-Id: I3ff0ead86e2ccec9445d6a2865bc2c463855f23c
Bug: 37401320
Test: build and push OTA and hit adb reboot recovery,quiescent. The screen should remain off throughout the upgrade process.
Change-Id: Ibed3795c09e26c4fa73684d40b94e40c78394d3f
Switch the locale header in the png files from Locale.toString() to
Locale.toLanguageTag(). For example, en_US --> en-us and sr__#Latn
--> sr-Latn. Also clean up recovery a bit to expect the new locale
format.
Bug: 35215015
Test: sr-Latn shows correctly under graphic tests && recovery tests pass
Change-Id: Ic62bab7756cdc6e5f98f26076f7c2dd046f811db
The call to read_metadata_from_package() is broken due to being passed
an invalid pointer (ZipArchiveHandle vs ZipArchiveHandle*). It's
introduced when switching from minzip to libziparchive. Compiler didn't
complain, because ZipArchiveHandle is typedef'd as void*, which legitly
accepts a void**.
Also clean up secure_wipe_partition() logs a bit by using android-base
logging.
Bug: 36427762
Test: Send a wipe package.
Change-Id: I791a0f09a066f1c257dae890e7ae13d02a02e78b
It used to return a REBOOT action on timeout, until the CL in commit
daefc1d442 that redefined the return value
of get_menu_selection() (changing from action to a menu index).
Prior to this CL, it was returning 0 (i.e. the value of Device::REBOOT)
to trigger the reboot. This CL specifies a return value of -1 to
indicate the timeout.
Test: Boot into a user build recovery; it reboots automatically on
timeout (120 sec).
Change-Id: I4aedb7a4628bf258017078fe73eb8b48a21d0ea8
Most of the changes are trivial.
Also update a dead reference to device_handle_key() in device.h comment,
and add some comments to get_menu_selection() function.
Test: `mmma bootable/recovery`
Change-Id: I59ef9213ec88ab35c0e7b8a7813ccf9c56dbd5c5
This was introduced in commit c87bab1018.
But the stage info should be passed through BCB only (there's a
dedicated field in struct bootloader_message).
This CL removes it from recovery arguments, and also moves 'stage'
variable to std::string.
Test: 'stage' variable is not used by any device-specific recovery code.
Test: Code search shows no hit of '--stages' use.
Change-Id: Iccbde578a13255f2b55dd4a928e9ecf487f16b97
This allows a quicker test for stage UI.
Bug: 27804510
Test: 'Run graphices test' with the new recovery image.
Change-Id: I47689ae8e4cac6d7e5d1f6a10b9e393d50d713f3
After reading one log entry, it should stay at the same menu position.
Test: 'View recovery logs' -> Read -> Exit
Change-Id: I4b579be4c2fe1e3a1dcc4873e128fd0b2d619ba3
People have been confused by the message and thought that's an error.
Test: Boot recovery on sailfish; choose 'View recovery logs'.
Change-Id: I2c540f18d6493c1a129233d10ecbc96823dd3601
Get rid of the malloc/realloc/free'd menus.
browse_directory() will only be called on devices with SD card. Tested
the CL by temporarily setting SDCARD_ROOT to a different location.
Test: See above.
Change-Id: I935e1bf4bad0273e3dff87fa2536924f1219adb5
-1 is not a valid exit status.
Also replace a few exit(1) with exit(EXIT_FAILURE).
Test: mmma bootable/recovery
Change-Id: I4596c8328b770bf95acccc06a4401bd5cabd4bfd
Test: Apply two A/B incremental OTAs with the new recovery image. The
one with incorrect pre-build should be blocked, while the other
works fine.
Change-Id: I94d97eb8798599da1630f66343fb603e87464187
Commit f0ed159f48 unintentionally changed
the behavior when parsing the arguments from BCB and command file. It
should only parse the command file for arguments if BCB doesn't supply
any.
As a result, it shows the following from the log:
I:Got 2 arguments from boot message
I:Got 3 arguments from /cache/recovery/command
Test: Set arguments in BCB and command file both. It should only use the
arguments from BCB.
Change-Id: Idf371137aa9177f1b2dfdfecf0c9f46959d2ee76
UI text is broken (doesn't show any text during FDR) due to commit
d530449e54, which reordered the calls to
RecoveryUI::SetLocale() and RecoveryUI::Init().
Because Init() uses the locale info to load the localized texts (from
images), the locale must be set prior to that via SetLocale(). This CL
refactors Init() to take the locale parameter, and removes the odd
SetLocale() API.
Bug: 34029338
Test: 'Run graphics test' under recovery.
Change-Id: I620394a3d4e3705e9af5a1f6299285d143ae1b01
