The fields of the ZipArchive on the stack are not initialized before we
call libminzip to parse the zip file. As a result, some random memory
location is freed unintentionally when we close the ZipArchive upon
parsing failures.
Bug: 35385357
Test: recompile and run the poc with asan.
Change-Id: I7e7f8ab4816c84a158af7389e1a889f8fc65f079
'group_range_count' doesn't properly consider the pair-wise range
structure. It may split the ranges into wrong pairs if it evaluates to
an odd number.
For example, for an input range string of "6,0,2,10,12,20,22" with 4
threads, group_range_count becomes 1. It would then try to verify (0,2),
(2,10), (10,12) and (12,20). Note that (2,10) and (12,20) are not valid
ranges to be verified, and with (20,22) uncovered.
Bug: 68343761
Test: Trigger update_verifier verification. Check the number of verified
blocks against the one in care_map.txt.
Change-Id: I7c5769325d9866be06c45e7dbcc0c8ea266de714
(cherry picked from commit 62caeb5f48c9d7b1a8ed97c4a021195b8499b804)
Prior to this CL, menu_ is allocated with a fixed length of text_rows_.
However, because we support scrollable menu in wear_ui, there might be
more menu entries than text_rows_, which would lead to out-of-bounds
array access. This CL addresses the issue by switching to std::vector.
Bug: 65416558
Test: Run 'View recovery logs' on angler.
Test: Set large margin height that leaves text_rows less than 21. Then
run 'View recovery logs' with 21 menu entries.
Change-Id: I5d4e3a0a097039e1104eda7d494c6269053dc894
(cherry picked from commit e15d7a5104)
ScreenRecoveryUI::DrawWrappedTextLines() should be called with
kMarginWidth only. Because it's using a line limit of text_cols_,
which is unaware of kMenuIdent.
Bug: 64293520
Test: No missing char with long header text.
Change-Id: Ib4d08de2c56473a483ff9964eb6cec31f8a74c9a
(cherry picked from commit 13aa4a902b)
This CL adds ScreenRecoveryUI::DrawWrappedTextLines() to better handle
long menu header texts. It does a word wrap at spaces, if available.
This avoids fixed-length menu headers being truncated on small screens.
Bug: 64293520
Test: On bullhead, boot into recovery with --prompt_and_wipe_data, and
check the prompt texts.
Change-Id: Ia22746583516dd230567a267584aca558429395e
(cherry picked from commit 2bbc6d642d)
This variable is useful on small screens (e.g. on watches) to handle
long menus. We should have better way to handle this value smartly.
Prior to that, expose the value to be overridable by using the generic
wearable UI module (librecovery_ui_wear).
Bug: 64307776
Test: Define the variable, build and boot into recovery image and check
the UI menu.
Change-Id: I5d7a6baa8bb4cc852bfcc2a7b3cc9686c1c8817e
(cherry picked from commit eea3af3f91)
With the following Makefile variables, we can reduce the work of writing
(copy/pasting) device-specific WearRecoveryUI classes.
The list of Makefile variables (the ones useful for Wear devices):
- TARGET_RECOVERY_UI_MARGIN_HEIGHT (default: 0)
- TARGET_RECOVERY_UI_MARGIN_WIDTH (default: 0)
Specify the margin space that we don't want to display texts. They
replace the former outer_width and outer_height.
- TARGET_RECOVERY_UI_TOUCH_LOW_THRESHOLD (default: 50)
- TARGET_RECOVERY_UI_TOUCH_HIGH_THRESHOLD (default: 90)
Specify the sensitivity of recognizing a swipe. Devices give absolute
positions, so for some devices we need to adjust the thresholds.
- TARGET_RECOVERY_UI_PROGRESS_BAR_BASELINE
Specify the progress bar vertical position, which should be adjusted
to the actual height of a device. It replaces the former
progress_bar_y.
- TARGET_RECOVERY_UI_ANIMATION_FPS (default: 30)
Specify the animation FPS if using device-specific animation images.
It replaces the former animation_fps.
Devices can specify "TARGET_RECOVERY_UI_LIB := librecovery_ui_wear",
with optionally defined Makefile vars above, in BoardConfig.mk to
customize their WearRecoveryUI.
Also remove the obsolete wear_touch.{cpp,h}, which has been merged into
ui.cpp in commit 5f8dd9951d.
Bug: 64307776
Test: Change the device BoardConfig.mk and test recovery image.
Change-Id: Id0fb2d4e3977ab5ddd31e71f9535470cab70e41b
(cherry picked from commit 0470ceea38)
It fails to build recovery_component_test with the following errors:
out/soong/.intermediates/hardware/interfaces/boot/1.0/android.hardware.boot@1.0_genc++_headers/gen/android/hardware/boot/1.0/types.h:14:
error: undefined reference to 'android::hardware::hidl_string::hidl_string(android::hardware::hidl_string const&)'
out/soong/.intermediates/hardware/interfaces/boot/1.0/android.hardware.boot@1.0_genc++_headers/gen/android/hardware/boot/1.0/types.h:14:
error: undefined reference to 'android::hardware::hidl_string::operator=(android::hardware::hidl_string
const&)'
out/soong/.intermediates/hardware/interfaces/boot/1.0/android.hardware.boot@1.0_genc++_headers/gen/android/hardware/boot/1.0/types.h:14:
error: undefined reference to 'android::hardware::hidl_string::~hidl_string()'
libupdate_verifier includes <android/hardware/boot/1.0/IBootControl.h>,
which includes the 'types.h' above. In 'types.h', it defines struct
CommandResult that's using android::hardware::hidl_string.
Since libhidlbase doesn't have a static library target, remove
'LOCAL_FORCE_STATIC_EXECUTABLE := true', which isn't required for
running tests.
Test: mmma -j bootable/recovery
Bug: 64538692
Change-Id: Iaa7c08adc241128d787274fcaea9b363e7ff93f4
This CL is to change update_verifier to verify blocks in parallel to
maximize storage bandwidth, it also preallocate the buffer to avoid
vector allocation within reading loop.
Test:
care_map.txt:
system
16,0,517,556,32770,33084,98306,98620,163842,164156,229378,229692,294914,295228,483544,524288,524296
vendor
8,0,119,135,32770,32831,96150,98304,98306
With CL:
init: Service 'update_verifier_nonencrypted' (pid 711) exited with status 0 waiting took 2.978424 seconds
Without CL:
init: Service 'update_verifier_nonencrypted' (pid 695) exited with status 0 waiting took 4.466320 seconds
Bug: 63686531
Test: reboot with manual insert care_map.txt
Change-Id: Idf791865f15f6ff6cad89bf7ff230ee46c6adccc
Bootloaders using libavb will set androidboot.veritymode=disabled if
the "disable dm-verity" flag has been set. Additionally if the
"disable verification" flag is set androidboot.veritymode will not be
set at all. Handle both cases.
Without this fix we'll end up in a bootloop.
Test: Manually tested on a device using AVB.
(cherry-picked from commit 1a0929cc8a)
Bug: 64404283
Change-Id: I3adf93f8dfd528fe9b869a63afa775f5730a3f69
Some wear bootloaders are passing bootreason=recovery_ui when booting
into recovery from fastboot, or via 'adb reboot recovery'. Allow turning
on text mode with a swipe for such a bootreason. Since we will turn on
text mode automatically for debuggable builds, this bootreason mainly
handles the case for user builds.
Note this change only applies to devices that allow touch screen inputs.
Bug: 36169090
Bug: 64307776
Test: Build and boot into user build recovery image. Toggle on text mode
with a swipe.
Change-Id: I55f19aed7b210352f8370de19935b4772cc12095
(cherry picked from commit 046aae29d9)
- Added detection for EV_ABS events in minui/events.cpp, if it's
allowed;
- Added listening and processing touch inputs in ui.cpp;
- Fixed an issue in recognizing swipe with multi-touch protocol A;
- Changed the logic in RecoveryUI::ProcessKey() to be swipe-aware. It
now allows turning on text mode with <power> + <swipe-up>.
The last change also fixed an issue on devices with protocol A: prior
to this CL, user may accidentally toggle the text mode during an OTA.
Because it was considered as a single-button device, a long tap that
sent BTN_TOUCH event would turn on text mode.
Test: Allow detecting touch inputs. Swiping (up, down, enter) works on
angler, angelfish, dorado respectively.
Bug: 36169090
Bug: 64307776
Change-Id: I4bc882b99114ce4ab414f8bdb8f4f7a525b8a8fd
(cherry picked from commit 5f8dd9951d)
When there's no command specified when booting into debuggable builds
(such as using `adb reboot recovery`), we turn on the text mode (i.e.
recovery menu) directly. This CL fixes the issue to avoid showing the
background image in a flash while turning on the text mode.
Bug: 63985334
Test: `fastboot boot $OUT/recovery.img` and it shows the recovery menu
directly without the no command image in a flash.
Change-Id: Id86bbe346ab76c8defc95e2b423e695a86774b09
(cherry picked from commit 7022f33ec8)
This is to cover the code added by commit
5a1dee01df, where an O update_verifier
should not reject N care_map.txt.
Bug: 63544345
Test: recovery_component_test passes on marlin.
Change-Id: Ia944e16cba3cc635098b3ffd92842d725b570fec
(cherry picked from commit c319613e06)
update_verifier should be backward compatible to not reject legacy
care_map.txt from old releases, which could otherwise fail to boot into
the new release.
For example, we've changed the care_map format between N and O. An O
update_verifier would fail to work with an N care_map.txt - a) we have
switched update_verifier to read from device mapper in O; b) the last
few blocks that contain metadata can't be read via device mapper. This
could be a result of sideloading an O OTA while the device having a
pending N update.
Bug: 63544345
Test: As follows on sailfish:
1. Flash the device with this CL;
2. Put a copy of N care_map.txt at /data/ota_package/. Restore the
permissions properly ('cache' group);
3. `adb reboot bootloader`;
4. `fastboot set_active <current_slot>`
5. Device boots up into home screen, with a warning in logcat that says
it has skipped legacy care_map.txt.
Change-Id: I6acc88c9e655a9245e6531f176fef7953953935f
(cherry picked from commit 5a1dee01df)
When /cache is unwritable, recovery hits a crash loop. Because it
passes nullptr to fileno(3) when writing back the locale file. This
prevents user from recovering a device - it cannot boot far enough to
recovery menu which allows wiping /cache.
Bug: 63927337
Test: Corrupt /cache and boot into recovery on bullhead:
1. m -j recoveryimage
2. fastboot erase cache
3. fastboot boot $OUT/recovery.img
4. recovery menu shows up.
Change-Id: I1407743f802049eb48add56a36298b665cb86139
(cherry picked from commit ec57903a7e)
receive_new_data may exit too early if the zip processor has sent all
the raw data. As a result, the last few 'new' commands will fail even
though the brotli decoder has more output in its buffer.
Restruct the code so that 'NewThreadInfo' owns the decoder state solely;
and receive_brotli_new_data is responsible for the decompression.
Also reduce the test data size to 100 blocks to avoid the test timeout.
Bug: 63802629
Test: recovery_component_test. on bullhead, apply full updates with and
w/o brotli compressed entries, apply an incremental update.
Change-Id: Id429b2c2f31951897961525609fa12c3657216b7
(cherry picked from commit 6ed175d541)
Use libdrm_platform which is a platform variant of libdrm.
Bug: 63741047
Bug: 37342627
Test: BOARD_VNDK_VERSION=current m -j libminui
Test: ryu recovery graphics test shows various graphics
Change-Id: Ifd2c1432781a96538585cdf818aa728d628a2f5a
Merged-In: Ifd2c1432781a96538585cdf818aa728d628a2f5a
(cherry picked from commit a48c494f13)
This file no longer exists:
- /file_contexts has been split into plat_file_contexts and
nonplat_file_contexts since commit
b236eb6ca204cefcb926e19bd5682f9dcad4021d (system/sepolicy).
- It was named /file_contexts.bin prior to the split.
'-S file_contexts' is also no longer required by e2fsdroid, since commit
2fff6fb036cbbb6dedd7da3d208b312a9038a5ce (external/e2fsprogs). It will
load the file contexts via libselinux.
Test: Trigger the path by performing a data wipe for converting to FBE.
Change-Id: I179939da409e5c0415ae0ea0bf5ddb23f9e6331e
This is a regression when adding support for margin space in commit
171b4c4c.
We're losing one char when showing long log lines. Because text_ is
aware of kMarginWidth, but not the the added indent (TEXT_INDENT).
Test: 'View recovery logs' on angler, with no missing character.
Change-Id: I284d54681d603e85e69d8e9c25173b1437a704df
Tianjie Xu
Android Build Merger (Role)
Tao Bao
Bill Yi
David Zeuthen
Wei Wang
Jin Qian
TreeHugger Robot
Jiyong Park