Bring back file-based OTA edify functions

Author: Tom Marshall <tdm.code@gmail.com>
Date:   Wed Oct 25 20:27:08 2017 +0200

    Revert "kill package_extract_dir"

    changes for P:
     - bring back the mkdir_recursively variant which takes a timestamp.
     - add libziparchive dependency
     - fix otautil header paths

    changes for Q:
     - change ziputil naming convention to lowercase

    This reverts commit 53c38b15381ace565227e49104a6fd64c4c28dcc.

    Change-Id: I71c488e96a1f23aace3c38fc283aae0165129a12

Author: Tom Marshall <tdm.code@gmail.com>
Date:   Thu Dec 14 22:37:17 2017 +0100

    Revert "Remove the obsolete package_extract_dir() test"

    This reverts commit bb7e005a7906b02857ba328c5dfb11f1f3cb938e.

    Change-Id: I643235d6605d7da2a189eca10ec999b25c23e1f9

Author: Tom Marshall <tdm.code@gmail.com>
Date:   Wed Aug 23 18:14:00 2017 +0000

    Revert "updater: Remove some obsoleted functions for file-based OTA."

    This reverts commit 63d786cf22cb44fe32e8b9c1f18b32da3c9d2e1b.

    These functions will be used for third party OTA zips, so keep them.

    Change-Id: I24b67ba4c86f8f86d0a41429a395fece1a383efd

Author: Stricted <info@stricted.net>
Date:   Mon Mar 12 18:11:56 2018 +0100

    recovery: updater: Fix SymlinkFn args

    Change-Id: If2ba1b7a8b5ac471a2db84f352273fd0ea7c81a2

Author: Simon Shields <simon@lineageos.org>
Date:   Thu Aug 9 01:17:21 2018 +1000

    Revert "updater: Remove dead make_parents()."

    This reverts commit 5902691764e041bfed8edbc66a72e0854d18dfda.

    Change-Id: I69eadf1a091f6ecd45531789dedf72a178a055ba

Author: Simon Shields <simon@lineageos.org>
Date:   Thu Aug 9 01:20:40 2018 +1000

    Revert "otautil: Delete dirUnlinkHierarchy()."

    changes for P:
     - Fix missing PATH_MAX macro from limits.h

    This reverts commit 7934985e0cac4a3849418af3b8c9671f4d61078a.

    Change-Id: I67ce71a1644b58a393dce45a6c3dee97830b9ee4

Author: XiNGRZ <chenxingyu92@gmail.com>
Date:   Tue Dec 3 14:31:56 2019 +0800

    updater: Fix lost capabilities of set_metadata

    This was broken since Android O. During a file-based incremental OTA,
    capability flags were cleared but not being set again properly, leading
    some critical processes (e.g. surfaceflinger and pm-service) fails.

    For more details, see: https://android.googlesource.com/platform/system/core/+/65b8d749f71d7962831e87600dd6137566c3c281

    Change-Id: I20e616cd83ec1cd1b79717a6703919316ad77938

[mikeioannina]: Squash for Q and run through clang-format

[Chippa_a]: Adapt for Android R updater and libziparchive API

Change-Id: I91973bc9e9f8d100688c0112fda9043fd45eb86a
12 files changed
tree: 694c379e1e9619ac8849d97ad99bd3cff221d926
  1. applypatch/
  2. bootloader_message/
  3. edify/
  4. etc/
  5. fastboot/
  6. fonts/
  7. fuse_sideload/
  8. install/
  9. minadbd/
  10. minui/
  11. otautil/
  12. recovery_ui/
  13. recovery_utils/
  14. res-hdpi/
  15. res-mdpi/
  16. res-xhdpi/
  17. res-xxhdpi/
  18. res-xxxhdpi/
  19. tests/
  20. tools/
  21. uncrypt/
  22. update_verifier/
  23. updater/
  24. updater_sample/
  25. .clang-format
  26. Android.bp
  27. Android.mk
  28. bootloader.h
  29. CleanSpec.mk
  30. interlace-frames.py
  31. METADATA
  32. NOTICE
  33. OWNERS
  34. PREUPLOAD.cfg
  35. README.md
  36. recovery-persist.cpp
  37. recovery-persist.rc
  38. recovery-refresh.cpp
  39. recovery-refresh.rc
  40. recovery.cpp
  41. recovery.h
  42. recovery_main.cpp
  43. TEST_MAPPING
README.md

The Recovery Image

Quick turn-around testing

  • Devices using recovery-as-boot (e.g. Pixels, which set BOARD_USES_RECOVERY_AS_BOOT)

    # After setting up environment and lunch.
    m -j bootimage
    adb reboot bootloader
    
    # Pixel devices don't support booting into recovery mode with `fastboot boot`.
    fastboot flash boot
    
    # Manually choose `Recovery mode` from bootloader menu.
    
  • Devices with a separate recovery image (e.g. Nexus)

    # After setting up environment and lunch.
    mm -j && m ramdisk-nodeps && m recoveryimage-nodeps
    adb reboot bootloader
    
    # To boot into the new recovery image without flashing the recovery partition:
    fastboot boot $ANDROID_PRODUCT_OUT/recovery.img
    

Running the tests

# After setting up environment and lunch.
mmma -j bootable/recovery

# Running the tests on device (under normal boot).
adb root
adb sync data

# 32-bit device
adb shell /data/nativetest/recovery_unit_test/recovery_unit_test

# Or 64-bit device
adb shell /data/nativetest64/recovery_unit_test/recovery_unit_test

Running the manual tests

recovery-refresh and recovery-persist executables exist only on systems without /cache partition. And we need to follow special steps to run tests for them.

  • Execute the test on an A/B device first. The test should fail but it will log some contents to pmsg.

  • Reboot the device immediately and run the test again. The test should save the contents of pmsg buffer into /data/misc/recovery/inject.txt. Test will pass if this file has expected contents.

Using adb under recovery

When running recovery image from debuggable builds (i.e. -eng or -userdebug build variants, or ro.debuggable=1 in /prop.default), adbd service is enabled and started by default, which allows adb communication. A device should be listed under adb devices, either in recovery or sideload state.

$ adb devices
List of devices attached
1234567890abcdef    recovery

Although /system/bin/adbd is built from the same code base as the one in the normal boot, only a subset of adb commands are meaningful under recovery, such as adb root, adb shell, adb push, adb pull etc. Since Android Q, adb shell no longer requires manually mounting /system from recovery menu.

Troubleshooting

adb devices doesn't show the device.

$ adb devices
List of devices attached
  • Ensure adbd is built and running.

By default, adbd is always included into recovery image, as /system/bin/adbd. init starts adbd service automatically only in debuggable builds. This behavior is controlled by the recovery specific /init.rc, whose source code is at bootable/recovery/etc/init.rc.

The best way to confirm a running adbd is by checking the serial output, which shows a service start log as below.

[   18.961986] c1      1 init: starting service 'adbd'...
  • Ensure USB gadget has been enabled.

If adbd service has been started but device not shown under adb devices, use lsusb(8) (on host) to check if the device is visible to the host.

bootable/recovery/etc/init.rc disables Android USB gadget (via sysfs) as part of the fs action trigger, and will only re-enable it in debuggable builds (the on property rule will always run after on fs).

on fs
    write /sys/class/android_usb/android0/enable 0

# Always start adbd on userdebug and eng builds
on property:ro.debuggable=1
    write /sys/class/android_usb/android0/enable 1
    start adbd

If device is using configfs, check if configfs has been properly set up in init rc scripts. See the example configuration for Pixel 2 devices. Note that the flag set via sysfs (i.e. the one above) is no-op when using configfs.

adb devices shows the device, but in unauthorized state.

$ adb devices
List of devices attached
1234567890abcdef    unauthorized

recovery image doesn't honor the USB debugging toggle and the authorizations added under normal boot (because such authorization data stays in /data, which recovery doesn't mount), nor does it support authorizing a host device under recovery. We can use one of the following options instead.

  • Option 1 (Recommended): Authorize a host device with adb vendor keys.

For debuggable builds, an RSA keypair can be used to authorize a host device that has the private key. The public key, defined via PRODUCT_ADB_KEYS, will be copied to /adb_keys. When starting the host-side adbd, make sure the filename (or the directory) of the matching private key has been added to $ADB_VENDOR_KEYS.

$ export ADB_VENDOR_KEYS=/path/to/adb/private/key
$ adb kill-server
$ adb devices

-user builds filter out PRODUCT_ADB_KEYS, so no /adb_keys will be included there.

Note that this mechanism applies to both of normal boot and recovery modes.

  • Option 2: Allow adbd to connect without authentication.
    • bootloader is unlocked (ro.boot.verifiedbootstate is orange) or debuggable build.
    • ro.adb.secure has a value of 0.

Both of the two conditions need to be satisfied. Although ro.adb.secure is a runtime property, its value is set at build time (written into /prop.default). It defaults to 1 on -user builds, and 0 for other build variants. The value is overridable via PRODUCT_DEFAULT_PROPERTY_OVERRIDES.

Localization of the background texts

The recovery image supports localization of several background texts, e.g. installing, error, factory reset warnings, etc. For devices using xxhdpi and xxxhdpi, the build system generates these localization images dynamically since android-10 when building the recovery image. While the static images under res-*dpi/images/ is used for other display resolutions and as a backup.

Check the invocation of the image_generator tool in the makefile. And the detailed usage of the image_generator is documented here.