The RPi firmware can't read the BCB in misc, so 'adb reboot recovery' /
factory reset never reached recovery: init writes boot-recovery and
reboots, the firmware ignores the reboot arg, and Android just boots
normally again.
pawlet-recoveryboot is a vendor oneshot (post-fs-data) that reads the
BCB command field (misc offset 0 — the HAL's PawletBootControl lives at
4096, no overlap) and, on boot-recovery, reboots with arg '3': the
firmware's PM_RSTS partition mechanism (same driver path as the
updater's tryboot) boots GPT partition 3 = recovery once. Stock
recovery reads its args from the untouched BCB, clears it when done,
and the next reboot is normal. A /metadata attempt counter clears the
BCB after 2 failed tries so an unbootable recovery can't wedge the
device.
oxmc
1e4b73a66c