[Ouya Android Development] Trooper_Max:
After some more playing with my Adam, I noticed that when I reboot into "recovery" which I have booting a CyanogenMod rom and then I reboot and from the reboot menu select "Reboot", it reboots into CyanogenMod again (even though I didn't expect it to). From the reboot menu I tell it to reboot into "recovery" and it boots into CM again, which that part makes sense, since I have the CM boot image stored in the recovery partition. So I got to thinking that maybe when you tell it to reboot into recovery it sets an SOS signal (the recovery partition is sometimes refered to as SOS) and when you boot a normal rom from recovery, it never clears that signal because it isn't normally booting that way. Whereas a true recovery rom knows it needs to clear that signal so you don't get stuck booting into the recovery rom all the time.

I was close - I scanned the recovery source on CM's github and found this bit:

So there seems to be a "bootloader message" that tells it whether to boot from the boot or recovery partition. I was going to say we need to be careful how we reboot the device and probably modify the custom rom to be able to reset the boot message, but I just realized we can do better and use this to our advantage. We could set our custom rom to always clear the boot message so that you have to go through the recovery rom each time to boot the system normally, but we could also have the option of selectively resetting the bootloader message - purposefully get ourselves stuck rebooting into "recovery" all the time because that is our normal rom, then from our normal rom have the option of resetting the bootloader message when we want to go into our recovery image stored on the boot partition.

Something to think about - I don't like getting stuck out of my recovery image either, so we gotta be sure we can reset the bootloader message when we need to... I'm going to play with this some more tomorrow, but not sure how far I will get.

EDIT: More info on the bootloader message - seems it is stored on the misc partition. The more I think about this too, the more I'm not sure swapping the boot/recovery is much safer - if we had them swapped, but then the rom gets stuck in a boot loop before it can reset the bootloader message, we'd be stuck always booting into "recovery" and into the boot loop, so we'd be in just as much trouble as if we'd gotten our boot partition to cause boot loops. So whereas normally flashing the boot partition is potentially dangerous, in this scenario flashing the recovery partition would be potentially dangerous - you gotta be sure it's going to be able to reset the bootloader message. We could try to mitigate this by modifying the boot process to reset the bootloader message very early in the boot process (ie before the potential bootloop) so that if we get stuck, the next time we reboot, we'll reboot normally into the recovery rom.

But then we could also do just the opposite of that without swapping the boot/recovery partitions - very early in the boot process, modify the bootloader message to tell the bootloader to boot into recovery - that way if we get stuck the next time we boot up will be into recovery. Then later when the system successfully boots, we could reset the bootloader message so that after a successful boot the next boot will be another normal one instead of into recovery. If we get this right a failed boot would automatically take us to recovery on the next boot, while a successful boot would boot normally on the next boot. So this would be a way to build in some "brick-protection" into the boot.img to make it safer to flash. It'd probably be safest to not reset the bootloader message until the user actually selects the shutdown option - that way any abnormal reboot would cause it to come up into recovery mode.

So I'm not sure swapping boot/recovery partitions really buys us anything anymore, since it also swaps which partition is potentially dangerous to flash. The solution in either case is going to be to cleverly manipulate the bootloader message as described above. So we might just want to not swap them to minimize confusion and focus instead on building "brick-protection" like this into our boot images.

Sounds nice - I'm tempted to get a nice big new thumb drive myself... I don't have any that big >_>

~Troop