Enable multi-boot for imx6ul soc

* Add bootctl HAL
* Add symlink for system partition as imx6ul not support GPT
* Store slot meta in bootloader_message of misc partition
* Modify sepolicy, set misc patiton as misc_device

Change-Id: Ibda177e68015eab9a0230cc2d032f6655dd44a4c
Signed-off-by: Guoyin Chen <guoyin.chen@freescale.com>

15 files changed, 818 insertions, 16 deletions

diff --git a/peripheral/bootctl/Android.mk b/peripheral/bootctl/Android.mk
new file mode 100755
index 0000000..468d0b0
--- /dev/null
+++ b/peripheral/bootctl/Android.mk
@@ -0,0 +1,40 @@
+#
+# Copyright 2015 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+ifeq ($(findstring imx, $(soc_name)), imx)
+
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_C_INCLUDES += ./
+LOCAL_CFLAGS += -Wno-unused-parameter
+LOCAL_CPPFLAGS += -DLOG_TAG=\"hal_bootctl\"
+LOCAL_SHARED_LIBRARIES := libcutils libz
+LOCAL_SRC_FILES := bootctl.cpp
+LOCAL_MODULE := bootctrl.$(soc_name)
+LOCAL_MODULE_RELATIVE_PATH := hw
+LOCAL_MODULE_TAGS := optional
+include $(BUILD_SHARED_LIBRARY)
+
+include $(CLEAR_VARS)
+LOCAL_C_INCLUDES += ./
+LOCAL_SRC_FILES := tool/metagen.c
+LOCAL_MODULE := metagen
+LOCAL_SHARED_LIBRARIES := libz
+LOCAL_CFLAGS := -Wno-unused-parameter
+include $(BUILD_EXECUTABLE)
+
+endif
diff --git a/peripheral/bootctl/bootctl.cpp b/peripheral/bootctl/bootctl.cpp
new file mode 100755
index 0000000..4ca916f
--- /dev/null
+++ b/peripheral/bootctl/bootctl.cpp
@@ -0,0 +1,358 @@
+/*
+ * Copyright 2015 The Android Open Source Project
+ * Copyright (C) 2015 Freescale Semiconductor, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <string.h>
+#include <assert.h>
+
+#include <hardware/hardware.h>
+#include <hardware/boot_control.h>
+#include <cutils/log.h>
+#include <cutils/properties.h>
+#include <external/zlib/zlib.h>
+#include "bootctl.h"
+
+static uint32_t g_dwCurSlot;
+static bool g_bInited;
+static const char *g_aSlotSuffix[SLOT_NUM] = { "_a", "_b" };
+
+#define INIT_CHECK do{ if(!g_bInited) {ALOGE("%s, module not inited", __FUNCTION__); return -EINVAL;} }while(0)
+#define SLOT_CHECK(slot, retval) do { if(slot >= SLOT_NUM) {ALOGE("%s, slot %d too large", __FUNCTION__, slot); return retval;} }while(0)
+#define RET_CHECK(ret, func) do { if(ret < 0){ ALOGE("%s, %s failed", __FUNCTION__, #func); return ret;} }while(0)
+#define TRACE ALOGI("enter %s", __FUNCTION__)
+
+void bootctl_init(struct boot_control_module *module);
+unsigned bootctl_getNumberSlots(struct boot_control_module *module);
+unsigned bootctl_getCurrentSlot(struct boot_control_module *module);
+int bootctl_markBootSuccessful(struct boot_control_module *module);
+int bootctl_setActiveBootSlot(struct boot_control_module *module, unsigned slot);
+int bootctl_setSlotAsUnbootable(struct boot_control_module *module, unsigned slot);
+int bootctl_isSlotBootable(struct boot_control_module *module, unsigned slot);
+const char* bootctl_getSuffix(struct boot_control_module *module, unsigned slot);
+
+static struct hw_module_methods_t bootctl_module_methods = {
+        open: NULL
+};
+
+boot_control_module_t HAL_MODULE_INFO_SYM = {
+        common: {
+                tag: HARDWARE_MODULE_TAG,
+                module_api_version: BOOT_CONTROL_MODULE_API_VERSION_0_1,
+                hal_api_version: 0,
+                id: BOOT_CONTROL_HARDWARE_MODULE_ID,
+                name: "Freescale Boot Control",
+                author: "Freescale Semiconductor Inc.",
+                methods: &bootctl_module_methods,
+                dso: NULL,
+                reserved: {0}
+        },
+        init: bootctl_init,
+        getNumberSlots: bootctl_getNumberSlots,
+        getCurrentSlot: bootctl_getCurrentSlot,
+        markBootSuccessful: bootctl_markBootSuccessful,
+        setActiveBootSlot: bootctl_setActiveBootSlot,
+        setSlotAsUnbootable: bootctl_setSlotAsUnbootable,
+        isSlotBootable: bootctl_isSlotBootable,
+        getSuffix: bootctl_getSuffix,
+        reserved: {0}
+};
+
+static int crcCheck(TBootCtl *ptBootCtl) {
+    uint32_t crc = 0;
+    uint8_t *pData = NULL;
+    uint32_t len = 0;
+
+    if(ptBootCtl == NULL)
+        return -EINVAL;
+
+    pData = (uint8_t *)ptBootCtl + CRC_DATA_OFFSET;
+    len = sizeof(TBootCtl) - CRC_DATA_OFFSET;
+
+    crc = crc32(0, pData, len);
+    if(crc != ptBootCtl->m_crc) {
+        ALOGE("crcCheck failed, calcuated %d, read %d\n", crc, ptBootCtl->m_crc);
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int crcSet(TBootCtl *ptBootCtl) {
+    uint32_t crc = 0;
+    uint8_t *pData = NULL;
+    uint32_t len = 0;
+
+    if(ptBootCtl == NULL)
+        return -EINVAL;
+
+    pData = (uint8_t *)ptBootCtl + CRC_DATA_OFFSET;
+    len = sizeof(TBootCtl) - CRC_DATA_OFFSET;
+
+    crc = crc32(0, pData, len);
+    ptBootCtl->m_crc = crc;
+
+    return 0;
+}
+
+void bootctl_init(struct boot_control_module *module) {
+    int i;
+
+    TRACE;
+
+    if(g_bInited) {
+        ALOGI("bootctl_init already called\n");
+        return;
+    }
+
+    char propbuf[PROPERTY_VALUE_MAX];
+
+    // Get the suffix from the kernel commandline
+    property_get("ro.boot.slot_suffix", propbuf, "");
+    if (propbuf[0] == '\0') {
+        ALOGE("property_get ro.boot.slot_suffix failed\n");
+        return;
+    }
+
+    ALOGI("slot suffix is %s\n", propbuf);
+
+    for(i = 0; i < SLOT_NUM; i++) {
+        if(strcmp(propbuf, g_aSlotSuffix[i]) == 0)
+            break;
+    }
+
+    if(i >= SLOT_NUM) {
+        ALOGE("slot suffix %s not valid\n", propbuf);
+        return;
+    }
+
+    g_dwCurSlot = i;
+    g_bInited = true;
+
+    return;
+}
+
+unsigned bootctl_getNumberSlots(struct boot_control_module *module)
+{
+    TRACE;
+    return  SLOT_NUM;
+}
+
+unsigned bootctl_getCurrentSlot(struct boot_control_module *module)
+{
+    TRACE;
+
+    INIT_CHECK;
+    return  g_dwCurSlot;
+}
+
+//return fd
+static int bootctl_load(TBootCtl *ptBootCtl, bool read_only) {
+    int fd = -1;
+    int ret = 0;
+    char *pMagic = NULL;
+
+    if(ptBootCtl == NULL)
+        return -EINVAL;
+
+    fd = open(MISC_PARTITION, read_only ? O_RDONLY : O_RDWR);
+    if(fd < 0) {
+        ALOGE("%s, open %s failed, fd %d, errno %d", __FUNCTION__, MISC_PARTITION, fd, errno);
+        return -errno;
+    }
+
+    lseek(fd, BOOTCTRL_OFFSET, SEEK_SET);
+
+    do {
+        ret = read(fd, ptBootCtl, sizeof(TBootCtl));
+    } while (ret == -1 && errno == EAGAIN);
+
+    if (ret == -1) {
+        close(fd);
+        ALOGE("%s, read failed, errno %d", __FUNCTION__, errno);
+        return -errno;
+    }
+
+    // Read on block devices on Linux are never partial so fine to assert everything was read.
+    assert(ret == sizeof(TBootCtl));
+
+    pMagic = ptBootCtl->m_magic;
+    if(!((pMagic[0] == '\0') && (pMagic[1] == 'F') && (pMagic[2] == 'S') && (pMagic[3] == 'L')))
+    {
+        close(fd);
+        ALOGE("%s, magic error, 0x%02x 0x%02x 0x%02x 0x%02x",
+            __FUNCTION__, pMagic[0], pMagic[1], pMagic[2], pMagic[3]);
+        return -EINVAL;
+    }
+
+    ret = crcCheck(ptBootCtl);
+    if(ret) {
+        close(fd);
+        ALOGE("%s, crcCheck failed", __FUNCTION__);
+        return ret;
+    }
+
+    return fd;
+}
+
+static int bootctl_store(int fd, TBootCtl *ptBootCtl) {
+    int ret = 0;
+
+    if((fd < 0) || (ptBootCtl == NULL))
+        return -EINVAL;
+
+    crcSet(ptBootCtl);
+
+    lseek(fd, BOOTCTRL_OFFSET, SEEK_SET);
+
+    do {
+        ret = write(fd, ptBootCtl, sizeof(TBootCtl));
+    } while (ret == -1 && errno == EAGAIN);
+
+    if (ret == -1) {
+        close(fd);
+        ALOGE("%s, write failed, errno %d", __FUNCTION__, errno);
+        return -errno;
+    }
+
+    // Writes on block devices on Linux are never partial so fine to assert everything was written.
+    assert(ret == sizeof(TBootCtl));
+
+    ret = fsync(fd);
+    if (ret == -1) {
+       close(fd);
+       ALOGE("%s, fsync failed, errno %d", __FUNCTION__, errno);
+       return -errno;
+    }
+
+    close(fd);
+
+    return 0;
+}
+
+int bootctl_markBootSuccessful(struct boot_control_module *module)
+{
+    int ret = 0;
+    int fd = 0;
+    TBootCtl tBootCtl;
+
+    TRACE;
+    INIT_CHECK;
+
+    ALOGI("bootctl_markBootSuccessful curSlot %d", g_dwCurSlot);
+
+    fd = bootctl_load(&tBootCtl, false);
+    RET_CHECK(fd, bootctl_load);
+
+    tBootCtl.m_aSlotMeta[g_dwCurSlot].m_BootSuc = 1;
+
+    ret = bootctl_store(fd, &tBootCtl);
+    return ret;
+}
+
+int bootctl_setActiveBootSlot(struct boot_control_module *module, unsigned slot)
+{
+    int ret = 0;
+    int fd = 0;
+    TBootCtl tBootCtl;
+
+    TRACE;
+    INIT_CHECK;
+    SLOT_CHECK(slot, -EINVAL);
+
+    if(slot == g_dwCurSlot) {
+        ALOGI("%s, !!! warning, active slot is same as curSlot %d", __FUNCTION__, slot);
+    }
+
+    fd = bootctl_load(&tBootCtl, false);
+    RET_CHECK(fd, bootctl_load);
+
+    tBootCtl.m_aSlotMeta[slot].m_BootSuc = 0;
+    tBootCtl.m_aSlotMeta[slot].m_Priority = 15;
+    tBootCtl.m_aSlotMeta[slot].m_TryRemain = 7;
+
+    // lower other slot priority
+    for(uint32_t i = 0; i < SLOT_NUM; i++) {
+        if(i == slot)
+            continue;
+
+        if(tBootCtl.m_aSlotMeta[i].m_Priority >= 15)
+            tBootCtl.m_aSlotMeta[i].m_Priority = 14;
+    }
+
+    ret = bootctl_store(fd, &tBootCtl);
+    return ret;
+}
+
+int bootctl_setSlotAsUnbootable(struct boot_control_module *module, unsigned slot)
+{
+    int retVal = 0;
+    int ret = 0;
+    int fd = 0;
+    TBootCtl tBootCtl;
+
+    TRACE;
+    INIT_CHECK;
+    SLOT_CHECK(slot, -EINVAL);
+
+    if(slot == g_dwCurSlot) {
+        ALOGI("%s, !!! warning, set current slot %d unbootable", __FUNCTION__, slot);
+    }
+
+    fd = bootctl_load(&tBootCtl, false);
+    RET_CHECK(fd, bootctl_load);
+
+    tBootCtl.m_aSlotMeta[slot].m_BootSuc = 0;
+    tBootCtl.m_aSlotMeta[slot].m_Priority = 0;
+    tBootCtl.m_aSlotMeta[slot].m_TryRemain = 0;
+
+    ret = bootctl_store(fd, &tBootCtl);
+    return ret;
+}
+
+int bootctl_isSlotBootable(struct boot_control_module *module, unsigned slot)
+{
+    int ret = 0;
+    int fd = 0;
+    TBootCtl tBootCtl;
+
+    TRACE;
+    INIT_CHECK;
+    SLOT_CHECK(slot, -EINVAL);
+
+    fd = bootctl_load(&tBootCtl, true);
+    RET_CHECK(fd, bootctl_load);
+
+    if((tBootCtl.m_aSlotMeta[slot].m_BootSuc > 0) || (tBootCtl.m_aSlotMeta[slot].m_TryRemain > 0))
+        ret = 1;
+
+    close(fd);
+
+    return ret;
+}
+
+const char* bootctl_getSuffix(struct boot_control_module *module, unsigned slot)
+{
+    TRACE;
+    SLOT_CHECK(slot, NULL);
+
+    return g_aSlotSuffix[slot];
+}
diff --git a/peripheral/bootctl/bootctl.h b/peripheral/bootctl/bootctl.h
new file mode 100755
index 0000000..2d89074
--- /dev/null
+++ b/peripheral/bootctl/bootctl.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2015 The Android Open Source Project
+ * Copyright (C) 2015 Freescale Semiconductor, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BOOTCTLH
+#define BOOTCTLH
+
+#include <stdint.h>
+#include <bootable/recovery/bootloader.h>
+
+#define SLOT_NUM 2
+
+#define BOOTCTRL_IDX                0 //start from bootloader_message.slot_suffix[BOOTCTRL_IDX]
+#define MISC_PARTITION              "/dev/block/by-name/misc"
+#define BOOTCTRL_OFFSET             (uint32_t)(&(((struct bootloader_message *)0)->slot_suffix[BOOTCTRL_IDX]))
+#define CRC_DATA_OFFSET             (uint32_t)(&(((TBootCtl *)0)->m_aSlotMeta[0]))
+
+typedef struct tagSlotMeta {
+    uint8_t m_BootSuc:1;
+    uint8_t m_TryRemain:3;
+    uint8_t m_Priority:4;
+}TSlotMeta;
+
+typedef struct tagBootCtl {
+    char m_magic[4];  //"\0FSL", to assure \0 in the lowest byte, just use char array, not use fourcc.
+    uint32_t m_crc;
+    TSlotMeta m_aSlotMeta[SLOT_NUM];
+    uint8_t m_RecoveryTryRemain;
+}TBootCtl;
+
+
+#endif //BOOTCTLH
diff --git a/peripheral/bootctl/tool/Makefile b/peripheral/bootctl/tool/Makefile
new file mode 100644
index 0000000..b8a5705
--- /dev/null
+++ b/peripheral/bootctl/tool/Makefile
@@ -0,0 +1,8 @@
+metagen_host : metagen.o
+	gcc -o metagen_host metagen.o -lz
+
+metagen.o : metagen.c
+	gcc -c metagen.c -I../ -I../../../../../../
+
+clean :
+	rm metagen.o metagen_host
diff --git a/peripheral/bootctl/tool/make_miscimg.sh b/peripheral/bootctl/tool/make_miscimg.sh
new file mode 100755
index 0000000..0b820d3
--- /dev/null
+++ b/peripheral/bootctl/tool/make_miscimg.sh
@@ -0,0 +1,2 @@
+rm -f misc.img
+./metagen_host set 8 7 0 6 7 0 misc.img
\ No newline at end of file
diff --git a/peripheral/bootctl/tool/metagen.c b/peripheral/bootctl/tool/metagen.c
new file mode 100755
index 0000000..a86ab5e
--- /dev/null
+++ b/peripheral/bootctl/tool/metagen.c
@@ -0,0 +1,172 @@
+/*
+ * Copyright 2015 The Android Open Source Project
+ * Copyright (C) 2015 Freescale Semiconductor, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <external/zlib/zlib.h>
+#include "bootctl.h"
+
+static TBootCtl g_tBootCtl;
+static char *g_MiscFile = MISC_PARTITION;
+
+static void dumpMeta()
+{
+    int i;
+    int fd = -1;
+    int ret = 0;
+    uint32_t crc;
+
+    fd = open(g_MiscFile, O_RDONLY);
+    if(fd < 0) {
+        printf("%s, open %s failed, fd %d, errno %d\n", __FUNCTION__, g_MiscFile, fd, errno);
+        return;
+    }
+
+    lseek(fd, BOOTCTRL_OFFSET, SEEK_SET);
+
+    ret = read(fd, &g_tBootCtl, sizeof(TBootCtl));
+    if(ret != sizeof(TBootCtl)) {
+        close(fd);
+        printf("%s, read failed, expect %d, actual %d\n", __FUNCTION__, sizeof(TBootCtl), ret);
+        return;
+    }
+
+    printf("m_RecoveryTryRemain %d, crc %u, CRC_DATA_OFFSET %d, magic %c %c %c %c\n",
+        g_tBootCtl.m_RecoveryTryRemain, g_tBootCtl.m_crc, CRC_DATA_OFFSET,
+        g_tBootCtl.m_magic[0], g_tBootCtl.m_magic[1],
+        g_tBootCtl.m_magic[2], g_tBootCtl.m_magic[3]);
+
+    crc = crc32(0, (uint8_t *)&g_tBootCtl + CRC_DATA_OFFSET, sizeof(g_tBootCtl) - CRC_DATA_OFFSET);
+    if(crc != g_tBootCtl.m_crc) {
+        printf("!!! warning, calculated crc %d, read crc %u\n", crc, g_tBootCtl.m_crc);
+        close(fd);
+        return;
+    }
+
+    for(i = 0; i < SLOT_NUM; i++) {
+        printf("slot %d: pri %d, try %d, suc %d\n", i,
+            g_tBootCtl.m_aSlotMeta[i].m_Priority,
+            g_tBootCtl.m_aSlotMeta[i].m_TryRemain,
+            g_tBootCtl.m_aSlotMeta[i].m_BootSuc);
+    }
+
+    close(fd);
+    return;
+}
+
+static void writeMeta() {
+    int ret = 0;
+    int fd;
+    uint32_t crc;
+    int flag = O_WRONLY;
+
+    if(strcmp(g_MiscFile, MISC_PARTITION))
+        fd = open(g_MiscFile, O_WRONLY|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
+    else
+        fd = open(g_MiscFile, O_WRONLY);
+
+    if(fd < 0) {
+        printf("%s, open %s failed, fd %d, errno %d\n", __FUNCTION__, g_MiscFile, fd, errno);
+        return;
+    }
+
+    if(strcmp(g_MiscFile, MISC_PARTITION)) {
+        struct bootloader_message btm;
+        memset(&btm, 0, sizeof(btm));
+        write(fd, &btm, sizeof(btm));
+    }
+
+    crc = crc32(0, (uint8_t *)&g_tBootCtl + CRC_DATA_OFFSET, sizeof(g_tBootCtl) - CRC_DATA_OFFSET);
+    g_tBootCtl.m_crc = crc;
+
+    lseek(fd, BOOTCTRL_OFFSET, SEEK_SET);
+    ret = write(fd, &g_tBootCtl, sizeof(TBootCtl));
+    if(ret != sizeof(TBootCtl)) {
+        close(fd);
+        printf("%s, write failed, expect %d, actual %d\n", __FUNCTION__, sizeof(TBootCtl), ret);
+        return;
+    }
+
+    fsync(fd);
+    close(fd);
+
+    return;
+}
+
+int main(int argc, char *argv[])
+{
+    int i;
+    int fd;
+    int ret;
+    int count = 0;
+    char *pMetaFile = g_MiscFile;
+
+    if(argc < 2){
+        printf("usage: %s set aPri, aTry, aSuc, bPri, bTry, bSuc\n", argv[0]);
+        printf("usage: %s get\n", argv[0]);
+        return 1;
+    }
+
+    //get meta
+    if((strcmp(argv[1], "get") == 0)) {
+        dumpMeta();
+        return 0;
+    }
+
+    //set meta
+    if(argc < 8) {
+        printf("usage: %s set aPri, aTry, aSuc, bPri, bTry, bSuc\n", argv[0]);
+        return 1;
+    }
+
+    if(argc >= 9)
+        g_MiscFile = argv[8];
+
+    //set meta
+    g_tBootCtl.m_RecoveryTryRemain = 7;
+    g_tBootCtl.m_aSlotMeta[0].m_Priority = atoi(argv[2]);
+    g_tBootCtl.m_aSlotMeta[0].m_TryRemain = atoi(argv[3]);
+    g_tBootCtl.m_aSlotMeta[0].m_BootSuc = atoi(argv[4]);
+    g_tBootCtl.m_aSlotMeta[1].m_Priority = atoi(argv[5]);
+    g_tBootCtl.m_aSlotMeta[1].m_TryRemain = atoi(argv[6]);
+    g_tBootCtl.m_aSlotMeta[1].m_BootSuc = atoi(argv[7]);
+
+    g_tBootCtl.m_magic[0] = '\0';
+    g_tBootCtl.m_magic[1] = 'F';
+    g_tBootCtl.m_magic[2] = 'S';
+    g_tBootCtl.m_magic[3] = 'L';
+
+    g_tBootCtl.m_crc = crc32(0, (uint8_t *)&g_tBootCtl + CRC_DATA_OFFSET, sizeof(g_tBootCtl) - CRC_DATA_OFFSET);
+
+    printf("crc %d\n", g_tBootCtl.m_crc);
+    for(i = 0; i < SLOT_NUM; i++) {
+        printf("slot %d: pri %d, try %d, suc %d\n", i,
+            g_tBootCtl.m_aSlotMeta[i].m_Priority,
+            g_tBootCtl.m_aSlotMeta[i].m_TryRemain,
+            g_tBootCtl.m_aSlotMeta[i].m_BootSuc);
+    }
+
+    writeMeta();
+
+    return 0;
+}
diff --git a/peripheral/bootctl/tool/metagen_host b/peripheral/bootctl/tool/metagen_host
new file mode 100755
index 0000000..67c1447
--- /dev/null
+++ b/peripheral/bootctl/tool/metagen_host
diff --git a/peripheral/bootctl/tool/misc.img b/peripheral/bootctl/tool/misc.img
new file mode 100644
index 0000000..cc6e54d
--- /dev/null
+++ b/peripheral/bootctl/tool/misc.img
diff --git a/peripheral/bootctl/tool/mksdcard-brillo.sh b/peripheral/bootctl/tool/mksdcard-brillo.sh
new file mode 100755
index 0000000..d5de4f6
--- /dev/null
+++ b/peripheral/bootctl/tool/mksdcard-brillo.sh
@@ -0,0 +1,175 @@
+#!/bin/bash
+
+# partition size in MB
+BOOTLOAD_RESERVE=8
+BOOT_ROM_SIZE=16
+SYSTEM_ROM_SIZE=512
+CACHE_SIZE=512
+RECOVERY_ROM_SIZE=16
+BOOT_ROM_B_SIZE=16
+SYSTEM_ROM_B_SIZE=512
+MISC_SIZE=8
+
+help() {
+
+bn=`basename $0`
+cat << EOF
+usage $bn <option> device_node
+
+options:
+  -h				displays this help message
+  -s				only get partition size
+  -np 				not partition.
+  -f   				flash android image.
+EOF
+
+}
+
+# parse command line
+moreoptions=1
+node="na"
+soc_name=""
+cal_only=0
+flash_images=0
+not_partition=0
+not_format_fs=0
+bootloader_file="u-boot.imx"
+bootimage_file="boot.img"
+systemimage_file="system.img"
+recoveryimage_file="recovery.img"
+miscimg_file="misc.img"
+
+while [ "$moreoptions" = 1 -a $# -gt 0 ]; do
+	case $1 in
+	    -h) help; exit ;;
+	    -s) cal_only=1 ;;
+	    -f) flash_images=1 ;;
+	    -np) not_partition=1 ;;
+	    -nf) not_format_fs=1 ;;
+	    *)  moreoptions=0; node=$1 ;;
+	esac
+	[ "$moreoptions" = 0 ] && [ $# -gt 1 ] && help && exit
+	[ "$moreoptions" = 1 ] && shift
+done
+
+if [ "${node}" = "/dev/sda" ]; then
+        echo "====== dangous!"
+        exit
+fi
+
+if [ ! -e ${node} ]; then
+	echo "no such node ${node}"
+	help
+	exit
+fi
+# call sfdisk to create partition table
+# get total card size
+seprate=40
+total_size=`sfdisk -s ${node}`
+total_size=`expr ${total_size} / 1024`
+boot_rom_sizeb=`expr ${BOOT_ROM_SIZE} + ${BOOTLOAD_RESERVE}`
+extend_size=`expr ${SYSTEM_ROM_SIZE} + ${CACHE_SIZE} + ${BOOT_ROM_B_SIZE} + ${SYSTEM_ROM_B_SIZE} + ${MISC_SIZE} + ${seprate}`
+data_size=`expr ${total_size} - ${boot_rom_sizeb} - ${RECOVERY_ROM_SIZE} - ${extend_size} + ${seprate}`
+
+echo "total_size $total_size"
+echo "boot_rom_sizeb $boot_rom_sizeb"
+echo "extend_size $extend_size"
+echo "data_size $data_size"
+
+# create partitions
+if [ "${cal_only}" -eq "1" ]; then
+cat << EOF
+BOOT   : ${boot_rom_sizeb}MB
+RECOVERY: ${RECOVERY_ROM_SIZE}MB
+SYSTEM : ${SYSTEM_ROM_SIZE}MB
+CACHE  : ${CACHE_SIZE}MB
+DATA   : ${data_size}MB
+BOOT_B : ${BOOT_ROM_B_SIZE}MB
+SYSTEM_B : ${SYSTEM_ROM_B_SIZE}MB
+MISC : ${MISC_SIZE}MB
+EOF
+exit
+fi
+
+function format_android
+{
+    echo "formating android images"
+    mkfs.ext4 ${node}${part}4 -Ldata
+    mkfs.ext4 ${node}${part}5 -Lsystem_a
+    mkfs.ext4 ${node}${part}6 -Lcache
+    mkfs.ext4 ${node}${part}8 -Lsystem_b
+}
+
+#SIMG2IMGTOOL=~/maddev_brillo/out/host/linux-x86/bin/simg2img
+function flash_android
+{
+#   bootloader_file="u-boot-${soc_name}.imx"
+#   bootimage_file="boot-${soc_name}.img"
+#   recoveryimage_file="recovery-${soc_name}.img"
+
+if [ "${flash_images}" -eq "1" ]; then
+    echo "flashing android images..."
+    echo "bootloader: ${bootloader_file}"
+    echo "boot image: ${bootimage_file}"
+    echo "recovery image: ${recoveryimage_file}"
+    echo "system image: ${systemimage_file}"
+    echo "misc image: ${miscimg_file}"
+
+    dd if=/dev/zero of=${node} bs=1k seek=384 count=129
+    dd if=${bootloader_file} of=${node} bs=1k seek=1
+    dd if=${bootimage_file} of=${node}${part}1
+    dd if=${recoveryimage_file} of=${node}${part}2
+    simg2img ${systemimage_file} ${node}${part}5
+    dd if=${bootimage_file} of=${node}${part}7
+    simg2img ${systemimage_file} ${node}${part}8
+    dd if=${miscimg_file} of=${node}${part}9
+    sync
+fi
+}
+
+if [[ "${not_partition}" -eq "1" && "${flash_images}" -eq "1" ]] ; then
+    flash_android
+    exit
+fi
+
+
+sfdisk --force -uM ${node} << EOF
+,${boot_rom_sizeb},83
+,${RECOVERY_ROM_SIZE},83
+,${extend_size},5
+,${data_size},83
+,${SYSTEM_ROM_SIZE},83
+,${CACHE_SIZE},83
+,${BOOT_ROM_B_SIZE},83
+,${SYSTEM_ROM_B_SIZE},83
+,${MISC_SIZE},83
+EOF
+
+# adjust the partition reserve for bootloader.
+# if you don't put the uboot on same device, you can remove the BOOTLOADER_ERSERVE
+# to have 8M space.
+# the minimal sylinder for some card is 4M, maybe some was 8M
+# just 8M for some big eMMC 's sylinder
+sfdisk --force -uM ${node} -N1 << EOF
+${BOOTLOAD_RESERVE},${BOOT_ROM_SIZE},83
+EOF
+
+# format the SDCARD/DATA/CACHE partition
+part=""
+echo ${node} | grep mmcblk > /dev/null
+if [ "$?" -eq "0" ]; then
+	part="p"
+fi
+
+format_android
+flash_android
+
+
+# For MFGTool Notes:
+# MFGTool use mksdcard-android.tar store this script
+# if you want change it.
+# do following:
+#   tar xf mksdcard-android.sh.tar
+#   vi mksdcard-android.sh
+#   [ edit want you want to change ]
+#   rm mksdcard-android.sh.tar; tar cf mksdcard-android.sh.tar mksdcard-android.sh
diff --git a/soc/imx6ul/init.freescale.rc b/soc/imx6ul/init.freescale.rc
index 926b0ca..b4644c6 100755
--- a/soc/imx6ul/init.freescale.rc
+++ b/soc/imx6ul/init.freescale.rc
@@ -17,14 +17,20 @@
 import init.freescale.usb.rc
 
 on init
-   symlink /dev/block/mmcblk1p5 /dev/block/system_a
-   symlink /dev/block/mmcblk1p8 /dev/block/system_b
+   mkdir /dev/block/by-name
+   symlink /dev/block/mmcblk1p1 /dev/block/by-name/boot_a
+   symlink /dev/block/mmcblk1p7 /dev/block/by-name/boot_b
+   symlink /dev/block/mmcblk1p5 /dev/block/by-name/system_a
+   symlink /dev/block/mmcblk1p8 /dev/block/by-name/system_b
+   symlink /dev/block/mmcblk1p9 /dev/block/by-name/misc
 
 on fs
    mount_all /fstab.device
    setprop ro.board.platform imx6ul
 
 on post-fs
-   restorecon /slotmeta
-   restorecon /slotmeta/slotmeta.data
-   restorecon /slotmeta/.slotmeta.data.bak
+   restorecon /dev/block/mmcblk1p9
+   restorecon /dev/block/by-name/boot_a
+   restorecon /dev/block/by-name/boot_b
+   restorecon /dev/block/by-name/system_a
+   restorecon /dev/block/by-name/system_b
diff --git a/soc/imx6ul/sepolicy/file_contexts b/soc/imx6ul/sepolicy/file_contexts
index 02ef075..d6d36c6 100755
--- a/soc/imx6ul/sepolicy/file_contexts
+++ b/soc/imx6ul/sepolicy/file_contexts
@@ -1,9 +1,10 @@
 /dev/ttymxc[0-9]*               u:object_r:tty_device:s0
 /system/bin/fsl_sensor_fusion   u:object_r:sensors_exec:s0
-/system/bin/metagen             u:object_r:metagen_exec:s0
 /dev/FreescaleAccelerometer     u:object_r:sensors_device:s0
 /dev/FreescaleMagnetometer      u:object_r:sensors_device:s0
 /dev/FreescaleGyroscope         u:object_r:sensors_device:s0
-/slotmeta                       u:object_r:slotmeta:s0
-/slotmeta/slotmeta.data         u:object_r:slotmeta:s0
-/slotmeta/.slotmeta.data.bak    u:object_r:slotmeta:s0
+/dev/block/mmcblk1p9            u:object_r:misc_device:s0
+/dev/block/mmcblk1p1            u:object_r:boot_block_device:s0
+/dev/block/mmcblk1p7            u:object_r:boot_block_device:s0
+/dev/block/mmcblk1p5            u:object_r:system_block_device:s0
+/dev/block/mmcblk1p8            u:object_r:system_block_device:s0
diff --git a/soc/imx6ul/sepolicy/metagen.te b/soc/imx6ul/sepolicy/metagen.te
deleted file mode 100755
index cc50ac7..0000000
--- a/soc/imx6ul/sepolicy/metagen.te
+++ /dev/null
@@ -1,4 +0,0 @@
-type metagen, domain;
-type metagen_exec, exec_type, file_type;
-allow metagen slotmeta:dir { getattr search relabelfrom rw_dir_perms rmdir };
-allow metagen slotmeta:file rw_file_perms;
diff --git a/soc/imx6ul/sepolicy/misc.te b/soc/imx6ul/sepolicy/misc.te
new file mode 100755
index 0000000..6fa24ba
--- /dev/null
+++ b/soc/imx6ul/sepolicy/misc.te
@@ -0,0 +1 @@
+type misc_device, dev_type;
diff --git a/soc/imx6ul/sepolicy/slotmeta.te b/soc/imx6ul/sepolicy/slotmeta.te
deleted file mode 100755
index 1ee9c13..0000000
--- a/soc/imx6ul/sepolicy/slotmeta.te
+++ /dev/null
@@ -1 +0,0 @@
-type slotmeta, file_type;
diff --git a/soc/imx6ul/sepolicy/update_engine.te b/soc/imx6ul/sepolicy/update_engine.te
index 6567e76..470e0d6 100755
--- a/soc/imx6ul/sepolicy/update_engine.te
+++ b/soc/imx6ul/sepolicy/update_engine.te
@@ -1,2 +1 @@
-allow update_engine slotmeta:dir { getattr search relabelfrom rw_dir_perms rmdir };
-allow update_engine slotmeta:file rw_file_perms;
+allow update_engine misc_device:blk_file { open read write };