Deprecate libavb_ab and bootctrl.avb code.

This code was already marked as experimental in anticipation of being
removed in the future. Officially deprecate it and set Jun 1 2018 as
the date it will be removed. This should give users of the code ample
time to fork/migrate.

To keep using the code AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED
must be defined.

The reason for deprecating this code is twofold:

 - Its policy was optimized for devices without a display with
   e.g. automatic fallback to the other slot if a slot fails to
   boot. Since most A/B stacks in Android devices don't work this
   way this code is confusing.

 - There are no known active users, no good test coverage for the
   bootctrl.avb code, and no plans to use it.

When the code is removed we'll provide an easy transition path by
keeping (but renaming) the |ab_ops| member in AvbOps.

Bug: 64140612
Test: All unit tests pass.
Test: UEFI-based boot loader compiles.
Change-Id: Id5e090a2048076d36ccca2e1c4cb55e226b8b43d

Android.bp

@@ -110,6 +110,9 @@ cc_library_static {
     export_include_dirs: ["."],
     shared_libs: ["libbase"],
     static_libs: ["libfs_mgr"],
+    cflags: [
+        "-DAVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED",
+    ],
     srcs: [
         "libavb/avb_sysdeps_posix.c",
         "libavb_ab/avb_ab_flow.c",
@@ -136,6 +139,7 @@ cc_library_host_static {
     export_include_dirs: ["."],
     cflags: [
         "-fno-stack-protector",
+        "-DAVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED",
     ],
     srcs: ["libavb_ab/avb_ab_flow.c"],
 }
@@ -178,6 +182,7 @@ cc_test_host {
     ],
     cflags: [
             "-Wno-missing-prototypes",
+            "-DAVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED",
     ],
     srcs: [
         "test/avb_ab_flow_unittest.cc",
@@ -196,6 +201,9 @@ cc_test_host {
 cc_library_host_static {
     name: "libavb_host_user_code_test",
     defaults: ["avb_defaults"],
+    cflags: [
+        "-DAVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED",
+    ],
     srcs: ["test/user_code_test.cc"],
 }
 
@@ -211,5 +219,8 @@ cc_library {
         "libbase",
         "libcutils",
     ],
+    cflags: [
+        "-DAVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED",
+    ],
     srcs: ["boot_control/boot_control_avb.c"],
 }

README.md

@@ -174,17 +174,21 @@ validation operation (see `avb_validate_vbmeta_public_key()` in
       expected to be provided by the platform is defined in
       `avb_sysdeps.h`. If the platform provides the standard C runtime
       `avb_sysdeps_posix.c` can be used.
-* `libavb_ab/`
-    + An experimental A/B implementation for use in boot loaders
-      and AVB examples.
 * `libavb_atx/`
     + An Android Things Extension for validating public key metadata.
 * `libavb_user/`
     + Contains an `AvbOps` implementation suitable for use in Android
       userspace. This is used in `boot_control.avb` and `avbctl`.
+* `libavb_ab/`
+    + An experimental A/B implementation for use in boot loaders and
+      AVB examples. **NOTE**: This code is *DEPRECATED* and you must
+      define `AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED` to use
+      it. The code will be removed Jun 1 2018.
 * `boot_control/`
     + An implementation of the Android `boot_control` HAL for use with
       boot loaders using the experimental `libavb_ab` A/B stack.
+      **NOTE**: This code is *DEPRECATED* and will be removed Jun 1
+      2018.
 * `contrib/`
     + Contains patches needed in other projects for interoperability with AVB.
       For example, `contrib/linux/4.4` has the patches for Linux kernel 4.4,
@@ -697,9 +701,9 @@ if (is_slot_is_marked_as_successful(slot->ab_suffix)) {
 For an HLOS where it's possible to roll back to a previous version,
 `stored_rollback_index[n]` should be set to the largest possible value
 allowing all bootable slots to boot. This approach is implemented in
-AVB's experimental A/B stack `libavb_ab`, see the `avb_ab_flow()`
-implementation. Note that this requires verifying *all* bootable slots
-at every boot and this may impact boot time.
+AVB's experimental (and now deprecated) A/B stack `libavb_ab`, see the
+`avb_ab_flow()` implementation. Note that this requires verifying
+*all* bootable slots at every boot and this may impact boot time.
 
 ## Recommended Bootflow
 

boot_control/boot_control_avb.c

@@ -29,6 +29,7 @@
 #include <hardware/boot_control.h>
 #include <hardware/hardware.h>
 
+#include <libavb_ab/libavb_ab.h>
 #include <libavb_user/libavb_user.h>
 
 static AvbOps* ops = NULL;

examples/uefi/Makefile

@@ -62,7 +62,9 @@ EFI_TARGET      = avb_bootloader.efi
 EFI_SHARED_OBJ  = $(patsubst %.efi,%.so,$(EFI_TARGET))
 
 EFI_CFLAGS = \
-    -DAVB_COMPILATION -DAVB_ENABLE_DEBUG -std=gnu99 \
+    -DAVB_COMPILATION -DAVB_ENABLE_DEBUG \
+    -DAVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED \
+    -std=gnu99 \
 	-I$(ANDROID_BUILD_TOP)/system/core/mkbootimg/ \
     -I$(AVB) \
     -I$(GNUEFI) \

libavb_ab/libavb_ab.h

@@ -27,6 +27,17 @@
 
 #include <libavb/libavb.h>
 
+/* The libavb_ab/ and boot_control/ code has been marked for some time
+ * as experimental in anticipation of being removed in the future. It
+ * is now deprecated and to continue using it you must define
+ * AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED. It will be removed Jun
+ * 1 2018.
+ */
+#ifndef AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED
+#error \
+    "You must define AVB_AB_I_UNDERSTAND_LIBAVB_AB_IS_DEPRECATED to use this library."
+#endif
+
 /* The AVB_INSIDE_LIBAVB_AB_H preprocessor symbol is used to enforce
  * library users to include only this file. All public interfaces, and
  * only public interfaces, must be included here.

libavb_user/libavb_user.h

@@ -25,7 +25,7 @@
 #ifndef LIBAVB_USER_H_
 #define LIBAVB_USER_H_
 
-#include <libavb_ab/libavb_ab.h>
+#include <libavb/libavb.h>
 
 /* The AVB_INSIDE_LIBAVB_USER_H preprocessor symbol is used to enforce
  * library users to include only this file. All public interfaces, and