oxmc
1e4b73a66c
The RPi firmware can't read the BCB in misc, so 'adb reboot recovery' / factory reset never reached recovery: init writes boot-recovery and reboots, the firmware ignores the reboot arg, and Android just boots normally again. pawlet-recoveryboot is a vendor oneshot (post-fs-data) that reads the BCB command field (misc offset 0 — the HAL's PawletBootControl lives at 4096, no overlap) and, on boot-recovery, reboots with arg '3': the firmware's PM_RSTS partition mechanism (same driver path as the updater's tryboot) boots GPT partition 3 = recovery once. Stock recovery reads its args from the untouched BCB, clears it when done, and the next reboot is normal. A /metadata attempt counter clears the BCB after 2 failed tries so an unbootable recovery can't wedge the device.