Repository navigation
+ Android boot image and vbmeta (AVB 2.0), read/write - #494
Merged
Merged
Conversation
AndroidBootImage reads and writes boot/recovery images with header v0-v4 and vendor_boot v3/v4. The components are named as unpack_bootimg names them, and the header goes to metadata.ini. Writes reproduce mkbootimg's layout byte for byte. Edits refuse signed images (a v4 boot signature or an AVB footer) and any layout mkbootimg could not have produced. AndroidVbmeta reads vbmeta images and verifies the hash and the RSA signature. Each descriptor becomes a member. Only unsigned (NONE) images are written or edited: re-signing would need the private key, so a signed image stays read-only. FirmwareCommon holds the list/extract plumbing, a CRC-32 helper and the embedded-payload helper that the firmware containers share. Oracles: mkbootimg/unpack_bootimg give byte-identical output in both directions. avbtool info_image reads what we write, and our unsigned images match avbtool's byte for byte. Signatures are checked against signed vectors made with avbtool, see Compression.Tests/Firmware/ReferenceVectors/README.md. CI's Linux leg installs mkbootimg and fetches avbtool at a pinned AOSP revision. Sourcing: rung 1. The structures are converted from AOSP mkbootimg (bootimg.h BSD-3-Clause, mkbootimg.py/unpack_bootimg.py Apache-2.0) and AOSP avb (MIT); notices are next to the code.
…res its member names Symptom: CI failed CreateRoundTrip, ModifyRoundTrip and Purge for both formats. The generic suites create a probe image from one arbitrarily named file, and both writers threw ArgumentException for any name outside their member vocabulary. The suites accept two outcomes: the format folds the input into its own entry set, or it declares the input inadmissible. Neither descriptor did either. AndroidBootImage: a single input under a name that is not a component becomes the kernel, which is how UImage treats its one payload and how mkbootimg --kernel takes it. The result is byte-identical to creating with "kernel". Two such inputs, a kernel plus one, or FULL.img alone are still refused. AndroidVbmeta: there is no payload slot, because the members are structured AVB descriptors, so folding a blob in would be wrong. Instead it implements IArchiveWriteConstraints with the check Create already makes, which turns the purge probe into an honest skip. A KnownGaps entry records why the generic create/modify probe cannot apply.
…ance records Bring the merged prerequisites into the Android boot/vbmeta branch, record the pinned AOSP mkbootimg and AVB conversions with their existing notices, and regenerate the filesystem API reference and registry snapshot. Validation: Release solution build; 235 focused Android, firmware, documentation and provenance checks passed, 50 unsupported or tool-gated cases skipped. Fresh Linux and Windows CI, including mkbootimg and avbtool oracles, gates the merge.
Retain the main provenance entries and add both Android format notice rows; update the summary count to match all seventeen rows. Verified: Release solution build, 317 focused tests passed with 50 tool-dependent skips, generated FileSystems documentation check.
Preserve the completed screenshot refresh history and restore main artwork so the Android formats merge independently of other pending formats.
…nges Retain Firmware and FreeArc fixtures, preserve the merged VMDK capability findings, recount all eighteen compatible-source rows, and regenerate FileSystems documentation. Verified: Release solution build, 329 focused tests passed with 53 tool-dependent skips, documentation generation completed without errors.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
AndroidBootImage: R/W for boot/recovery header v0–v4 and vendor_boot v3/v4. Components are named the wayunpack_bootimgnames them and the header is exposed asmetadata.ini. Writes reproducemkbootimg's layout byte for byte. Edits refuse signed images (v4 boot signature, AVB footer) and any layoutmkbootimgcannot produce.AndroidVbmeta(AVB 2.0): reading verifies the hash and the RSA signature. Each descriptor is a member. Only unsigned (NONE) images are written or edited; a signed image stays read-only, because re-signing needs the private key.FirmwareCommon: list/extract plumbing, CRC-32 and embedded-payload helpers shared by the firmware containers. The two stacked PRs build on it.mkbootimgand fetchesavbtoolat a pinned AOSP revision.THIRD-PARTY-NOTICEfiles sit next to the converted code.Sourcing
Rung 1, converted: AOSP mkbootimg (
bootimg.hBSD-3-Clause,mkbootimg.py/unpack_bootimg.pyApache-2.0) and AOSP avb (MIT).Verification
mkbootimg/unpack_bootimgoracle tests: byte-identical in both directions for v0–v4 and vendor_boot v3/v4. These run on CI's Linux leg.avbtool: our unsigned images match its output byte for byte, andinfo_imagereads ours. Signature checks use avbtool-signed vectors (Compression.Tests/Firmware/ReferenceVectors/README.md).CatalogueConsistencyTestsandFilesystemReadmeIsCurrentTestsfilters on the full stack: 136 passed, 0 failed. The 17 skipped are oracle tests whose tools are not installed locally. CI runs the broad suites.Stacked PRs on top of this one: TRX/SEAMA/CHK, then the Linux kernel image.