Android OTA 升级之四：进入根文件系统

init.rc

1

2oninit

3exportPATH/sbin

4exportANDROID_ROOT/system

5exportANDROID_DATA/data

6exportEXTERNAL_STORAGE/sdcard

7

8symlink/system/etc/etc

9

10mkdir/sdcard

11mkdir/system

12mkdir/data

13mkdir/cache

14mount/tmp/tmptmpfs

15

16onboot

17

18ifuplo

19hostnamelocalhost

20domainnamelocaldomain

21

22class_startdefault

23

24

25servicerecovery/sbin/recovery

26

27serviceadbd/sbin/adbdrecovery

28disabled

29

30onproperty:persist.service.adb.enable=1

31startadbd

32

33onproperty:persist.service.adb.enable=0

34stopadbd

先看一段注释

89/*

90*Therecoverytoolcommunicateswiththemainsystemthrough/cachefiles.

91*/cache/recovery/command-INPUT-commandlinefortool,oneargperline

92*/cache/recovery/log-OUTPUT-combinedlogfilefromrecoveryrun(s)

93*/cache/recovery/intent-OUTPUT-intentthatwaspassedin

94*

95*Theargumentswhichmaybesuppliedintherecovery.commandfile:

96*--send_intent=anystring-writethetextouttorecovery.intent

97*--update_package=root:path-verifyinstallanOTApackagefile

98*--wipe_data-eraseuserdata(andcache),thenreboot

99*--wipe_cache-wipecache(butnotuserdata),thenreboot

100*--set_encrypted_filesystem=on|off-enables/diasablesencryptedfs

101*

102*Aftercompleting,weremove/cache/recovery/commandandreboot.

103*Argumentsmayalsobesuppliedinthebootloadercontrolblock(BCB).

104*Theseimportantscenariosmustbesafelyrestartableatanypoint:

105*

106*FACTORYRESET

107*1.userselects"factoryreset"

108*2.mainsystemwrites"--wipe_data"to/cache/recovery/command

109*3.mainsystemrebootsintorecovery

110*4.get_args()writesBCBwith"boot-recovery"and"--wipe_data"

111*--afterthis,rebootingwillrestarttheerase--

112*5.erase_root()reformats/data

113*6.erase_root()reformats/cache

114*7.finish_recovery()erasesBCB

115*--afterthis,rebootingwillrestartthemainsystem--

116*8.main()callsreboot()tobootmainsystem

117*

118*OTAINSTALL

119*1.mainsystemdownloadsOTApackageto/cache/some-filename.zip

120*2.mainsystemwrites"--update_package=CACHE:some-filename.zip"

121*3.mainsystemrebootsintorecovery

122*4.get_args()writesBCBwith"boot-recovery"and"--update_package=..."

123*--afterthis,rebootingwillattempttoreinstalltheupdate--

124*5.install_package()attemptstoinstalltheupdate

125*NOTE:thepackageinstallmustitselfberestartablefromanypoint

126*6.finish_recovery()erasesBCB

127*--afterthis,rebootingwill(tryto)restartthemainsystem--

128*7.**ifinstallfailed**

129*7a.prompt_and_wait()showsanerroriconandwaitsfortheuser

130*7b;theuserreboots(pullingthebattery,etc)intothemainsystem

131*8.main()callsmaybe_install_firmware_update()

132***iftheupdatecontainedradio/hbootfirmware**:

133*8a.m_i_f_u()writesBCBwith"boot-recovery"and"--wipe_cache"

134*--afterthis,rebootingwillreformatcache&restartmainsystem--

135*8b.m_i_f_u()writesfirmwareimageintorawcachepartition

136*8c.m_i_f_u()writesBCBwith"update-radio/hboot"and"--wipe_cache"

137*--afterthis,rebootingwillattempttoreinstallfirmware--

138*8d.bootloadertriestoflashfirmware

139*8e.bootloaderwritesBCBwith"boot-recovery"(keeping"--wipe_cache")

140*--afterthis,rebootingwillreformatcache&restartmainsystem--

141*8f.erase_root()reformats/cache

142*8g.finish_recovery()erasesBCB

143*--afterthis,rebootingwill(tryto)restartthemainsystem--

144*9.main()callsreboot()tobootmainsystem

145*

146*ENCRYPTEDFILESYSTEMSENABLE/DISABLE

147*1.userselects"enableencryptedfilesystems"

148*2.mainsystemwrites"--set_encrypted_filesystem=on|off"to

149*/cache/recovery/command

150*3.mainsystemrebootsintorecovery

151*4.get_args()writesBCBwith"boot-recovery"and

152*"--set_encrypted_filesystems=on|off"

153*--afterthis,rebootingwillrestartthetransition--

154*5.read_encrypted_fs_info()retrievesencryptedfilesystemssettingsfrom/data

155*Settingsinclude:propertytospecifytheEncryptedFSistatusand

156*FSencryptionkeyifenabled(notyetimplemented)

157*6.erase_root()reformats/data

158*7.erase_root()reformats/cache

159*8.restore_encrypted_fs_info()writesrequiredencryptedfilesystemssettingsto/data

160*Settingsinclude:propertytospecifytheEncryptedFSstatusand

161*FSencryptionkeyifenabled(notyetimplemented)

162*9.finish_recovery()erasesBCB

163*--afterthis,rebootingwillrestartthemainsystem--

164*10.main()callsreboot()tobootmainsystem

165*/

recovery主程序

559int

560main(intargc,char**argv)

561{

562time_tstart=time(NULL);

563

564//Ifthesefail,there'snotreallyanywheretocomplain...

565freopen(TEMPORARY_LOG_FILE,"a",stdout);setbuf(stdout,NULL);

566freopen(TEMPORARY_LOG_FILE,"a",stderr);setbuf(stderr,NULL);

567fprintf(stderr,"Startingrecoveryon%s",ctime(&start));

568

569ui_init();

Recovery使用了一个简单的基于framebuffer的ui系统，叫miniui,这里，进行了简单的初始化（主要是图形部分以及事件部分），并启动了一个event线程用于响应用户按键。

570get_args(&argc,&argv);

572intprevious_runs=0;

573constchar*send_intent=NULL;

574constchar*update_package=NULL;

575intwipe_data=0,wipe_cache=0;

576

577intarg;

578while((arg=getopt_long(argc,argv,"",OPTIONS,NULL))!=-1){

579switch(arg){

580case'p':previous_runs=atoi(optarg);break;

581case's':send_intent=optarg;break;

582case'u':update_package=optarg;break;

583case'w':wipe_data=wipe_cache=1;break;

584case'c':wipe_cache=1;break;

585case'?':

586LOGE("Invalidcommandargument/n");

587continue;

588}

589}

590

解析参数，p:previous_runs没有用到，其它含义见前面注释。

591device_recovery_start();

这个函数没干什么。看名字，它給设备制造商提供了一个调用机会，可写入设备相关初始化代码。

592

593fprintf(stderr,"Command:");

594for(arg=0;arg<argc;arg++){

595fprintf(stderr,"/"%s/"",argv[arg]);

596}

597fprintf(stderr,"/n/n");

598

打印出命令，比如，正常启动进入recovery模式，会打印：Command:"/sbin/recovery"

599property_list(print_property,NULL);

600fprintf(stderr,"/n");

601

打印出所有的系统属性（fromdefault.prop）到log文件。

602intstatus=INSTALL_SUCCESS;

603

604if(update_package!=NULL){

605status=install_package(update_package);

606if(status!=INSTALL_SUCCESS)ui_print("Installationaborted./n");

607}elseif(wipe_data){

608if(device_wipe_data())status=INSTALL_ERROR;

609if(erase_root("DATA:"))status=INSTALL_ERROR;

610if(wipe_cache&&erase_root("CACHE:"))status=INSTALL_ERROR;

611if(status!=INSTALL_SUCCESS)ui_print("Datawipefailed./n");

612}elseif(wipe_cache){

613if(wipe_cache&&erase_root("CACHE:"))status=INSTALL_ERROR;

614if(status!=INSTALL_SUCCESS)ui_print("Cachewipefailed./n");

615}else{

616status=INSTALL_ERROR;//Nocommandspecified

617}

根据用户提供参数，调用各项功能，比如，安装一个升级包，擦除cache分区,擦除userdata分区，install_package比较复杂，后面专门分析，其它都很简单。忽略。

618

619if(status!=INSTALL_SUCCESS)ui_set_background(BACKGROUND_ICON_ERROR);

622if(status!=INSTALL_SUCCESS)prompt_and_wait();

如果前面已经做了某项操作并且成功，则进入重启流程。否则，等待用户选择具体操作。

而用户可选操作为：reboot,安装update.zip，除cache分区,擦除userdata分区,如前所述，只有安装package比较复杂，其它简单。

623

624//Otherwise,getreadytobootthemainsystem...

625finish_recovery(send_intent);

它的功能如下：

1）将前面定义的intent字符串写入（如果有的话）：CACHE:recovery/command

2）将/tmp/recovery.log复制到"CACHE:recovery/log";

3）清空misc分区，这样重启就不会进入recovery模式

4)删除command文件：CACHE:recovery/command;

626ui_print("Rebooting.../n");

627sync();

628reboot(RB_AUTOBOOT);

629returnEXIT_SUCCESS;

630}

289int

290install_package(constchar*root_path)

291{

292ui_set_background(BACKGROUND_ICON_INSTALLING);

294ui_print("Findingupdatepackage.../n");

295LOGI("Findingupdatepackage.../n");

296ui_show_indeterminate_progress();

297LOGI("Updatelocation:%s/n",root_path);

298

更新UI显示

299if(ensure_root_path_mounted(root_path)!=0){

300LOGE("Can'tmount%s/n",root_path);

301reset_mark_block();

302returnINSTALL_CORRUPT;

303}

304

确保升级包所在分区已经mount,通常为cache分区或者SD分区

305charpath[PATH_MAX]="";

306if(translate_root_path(root_path,path,sizeof(path))==NULL){

307LOGE("Badpath%s/n",root_path);

308reset_mark_block();

309returnINSTALL_CORRUPT;

310}

将根分区转化为具体分区信息.这些信息来自：全局数组：g_roots

313ui_print("Openingupdatepackage.../n");

314LOGI("Openingupdatepackage.../n");

315LOGI("Updatefilepath:%s/n",path);

316

317intnumKeys;

318RSAPublicKey*loadedKeys=load_keys(PUBLIC_KEYS_FILE,&numKeys);

319if(loadedKeys==NULL){

320LOGE("Failedtoloadkeys/n");

321reset_mark_block();

322returnINSTALL_CORRUPT;

323}

324LOGI("%dkey(s)loadedfrom%s/n",numKeys,PUBLIC_KEYS_FILE);

从/res/keys中装载公钥。

326//Giveverificationhalftheprogressbar...

328ui_print("Verifyingupdatepackage.../n");

329LOGI("Verifyingupdatepackage.../n");

330ui_show_progress(

331VERIFICATION_PROGRESS_FRACTION,

332VERIFICATION_PROGRESS_TIME);

333

334interr;

335err=verify_file(path,loadedKeys,numKeys);

336free(loadedKeys);

337LOGI("verify_filereturned%d/n",err);

338if(err!=VERIFY_SUCCESS){

339LOGE("signatureverificationfailed/n");

340reset_mark_block();

341returnINSTALL_CORRUPT;

342}

根据公钥验证升级包verify_file的注释说的很明白：

//LookforanRSAsignatureembeddedinthe.ZIPfilecommentgiven

//thepathtothezip.Verifyitmatchesoneofthegivenpublic

//keys.

344/*Trytoopenthepackage.

345*/

346ZipArchivezip;

347err=mzOpenZipArchive(path,&zip);

348if(err!=0){

349LOGE("Can'topen%s/n(%s)/n",path,err!=-1?strerror(err):"bad");

350reset_mark_block();

351returnINSTALL_CORRUPT;

352}

打开升级包，将相关信息存到ZuoArchive数据机构中，便于后面处理。

354/*Verifyandinstallthecontentsofthepackage.

355*/

356intstatus=handle_update_package(path,&zip);

处理函数，我们后面继续分析。

357mzCloseZipArchive(&zip);

358returnstatus;

359}

关闭zip包，结束处理。

204staticint

205handle_update_package(constchar*path,ZipArchive*zip)

206{

207//Updateshouldtaketherestoftheprogressbar.

208ui_print("Installingupdate.../n");

209

210intresult=try_update_binary(path,zip);

211register_package_root(NULL,NULL);//Unregisterpackageroot

212returnresult;

213}

将升级包内文件META-INF/com/google/android/update-binary复制为/tmp/update_binary