Android restore to factory & recovery

Setting里面我们可以选择恢复出厂设置，recovery
Power.reboot("recovery");
./frameworks/base/core/java/android/os/Power.java

./frameworks/base/core/jni/android_os_Power.cpp
参数表示reboot的原因
然后会到JNI
static void android_os_Power_reboot(JNIEnv *env, jobject clazz, jstring reason)
{
    sync();
#ifdef HAVE_ANDROID_OS
    if (reason == NULL) {
        reboot(RB_AUTOBOOT);
    } else {
        const char *chars = env->GetStringUTFChars(reason, NULL);
        __reboot(LINUX_REBOOT_MAGIC1, LINUX_REBOOT_MAGIC2,
                 LINUX_REBOOT_CMD_RESTART2, (char*) chars);
        env->ReleaseStringUTFChars(reason, chars);  // In case it fails.
    }
    jniThrowIOException(env, errno);
#endif
}
这里会调用到c库里面的函数
__reboot:
    .save   {r4, r7}
    stmfd   sp!, {r4, r7}
    ldr     r7, =__NR_reboot
    swi     #0
    ldmfd   sp!, {r4, r7}
    movs    r0, r0
    bxpl    lr
    b       __set_syscall_errno
    .fnend
c库实际上到最底下就是系统调用的封装了，
一般都是sys_reboot的实现了

bionic/libc/arch-sh/syscalls/__reboot.S

bootable/bootloader/uboot-imx/board/freescale/common/recovery.c

/* export to lib_arm/board.c */
void check_recovery_mode(void)
{
    if (check_key_pressing())
        setup_recovery_env();
    else if (check_recovery_cmd_file()) {
        puts("Recovery command file founded!\n");
        setup_recovery_env();
    }
}
所以从这里可以看出recovery模式实际上有2种方式 一种是按键 一种是去读取recovery文件 按键一般是厂家定义的 也是一般人升级时经常用到的 读取recovery文件 实际上就是读取/cache/recovery文件夹底下的东西 但是不管是哪个模式 实际上都是去设置一下环境变量 所以我们继续看

void setup_recovery_env(void)
{
    char *env, *boot_args, *boot_cmd;
    int bootdev = get_boot_device();

    boot_cmd = supported_reco_envs[bootdev].cmd;
    boot_args = supported_reco_envs[bootdev].args;

    if (boot_cmd == NULL) {
        printf("Unsupported bootup device for recovery\n");
        return;
    }

    printf("setup env for recovery..\n");

    env = getenv("bootargs_android_recovery");
    /* Set env to recovery mode */
    /* Only set recovery env when these env not exist, give user a
     * chance to change their recovery env */
    if (!env)
        setenv("bootargs_android_recovery", boot_args);

    env = getenv("bootcmd_android_recovery");
    if (!env)
        setenv("bootcmd_android_recovery", boot_cmd);
    setenv("bootcmd", "run bootcmd_android_recovery");
}
所以最后其实是设置了一系列的环境变量 比如bootargs_android_recovery， bootcmd_android_recovery和bootcmd

这些设置完了 就系统重启 重启后会根据设置的uboot环境变量进入不同的模式 从而实现升级 还原等一系列操作

Recovery涉及到的其他系统及文件
CACHE分区文件
Recovery 工具通过NAND cache分区上的三个文件和主系统打交道。主系统（包括恢复出厂设置和OTA升级）可以写入recovery所需的命令，读出recovery过程中的LOG和intent。
/cache/recovery/command： recovery命令，由主系统写入。所有命令如下：
--send_intent=anystring - write the text out to recovery.intent
--update_package=root:path - verify install an OTA package file
--wipe_data - erase user data (and cache), then reboot
--wipe_cache - wipe cache (but not user data), then reboot
/cache/recovery/log：recovery过程日志，由主系统读出
/cache/recovery/intent：recovery输出的intent
MISC分区内容Bootloader Control Block (BCB) 存放recovery bootloader message。结构如下：
struct bootloader_message {
char command[32];
char status[32]; // 未知用途
char recovery[1024];
};
command可以有以下两个值
“boot-recovery”：标示recovery正在进行，或指示bootloader应该进入recovery mode
“update-hboot/radio”：指示bootloader更新firmware
recovery内容
“recovery\n
<recovery command>\n
<recovery command>”
其中recovery command为CACHE:/recovery/command命令
两种Recovery Case
FACTORY RESET（恢复出厂设置）
用户选择“恢复出厂设置”
设置系统将"--wipe_data"命令写入/cache/recovery/command
系统重启，并进入recover模式（/sbin/recovery）
get_args() 将 "boot-recovery"和"--wipe_data"写入BCB
erase_root() 格式化（擦除）DATA分区
erase_root() 格式化（擦除）CACHE分区
finish_recovery() 擦除BCB
重启系统
OTA INSTALL（OTA升级）
升级系统下载 OTA包到/cache/some-filename.zip
升级系统写入recovery命令"--update_package=CACHE:some-filename.zip"
重启，并进入recovery模式
get_args() 将"boot-recovery" 和 "--update_package=..." 写入BCB
install_package() 作升级
finish_recovery() 擦除 BCB
** 如果安装包失败 ** prompt_and_wait() 等待用户操作，选择ALT+S或ALT+W 升级或恢复出厂设置
main() 调用 maybe_install_firmware_update()
如果包里有hboot/radio的firmware则继续，否则返回
将 "boot-recovery" 和 "--wipe_cache" 写入BCB
将 firmware image写入cache分区
将 "update-radio/hboot" 和 "--wipe_cache" 写入BCB
重启系统
bootloader自身更新firmware
bootloader 将 "boot-recovery" 写入BCB
erase_root() 擦除CACHE分区
清除 BCB
main() 调用 reboot() 重启系统
Recovery模式流程
/init → init.rc → /sbin/recovery →
main():recovery.c
ui_init():ui.c 〔UI initialize〕
gr_init():minui/graphics.c 〔set tty0 to graphic mode, open fb0]
ev_init():minui/events.c [open /dev/input/event*]
res_create_surface:minui/resource.c [create surfaces for all bitmaps used later, include icons, bmps]
create 2 threads: progress/input_thread [create progress show and input event handler thread]
get_args():recovery.c
get_bootloader_message():bootloader.c [read mtdblock0(misc partition) 2nd page for commandline]
check if nand misc partition has boot message. If yes, fill argc/argv.
If no, get arguments from /cache/recovery/command, and fill argc/argv.
set_bootloader_message():bootloader.c [set bootloader message back to mtdblock0]
Parser argv[] filled above
register_update_commands():commands.c [ register all commands with name and hook function ]
registerCommand():commands.c
Register command with name, hook, type, cookie.
Commands, e.g: assert, delete, copy_dir, symlink, write_raw_image.
registerFunction():commands.c
Register function with name, hook, cookie.
Function, e.g: get_mark, matches, getprop, file_contains
install_package():
translate_root_path():roots.c [ "SYSTEM:lib" and turns it into a string like "/system/lib", translate the updater.zip path ]
mzOpenZipArchive():zip.c [ open updater.zip file (uncompass) ]
handle_update_package():install.c
verify_jar_signature():verifier.c [ verify signature with keys.inc key; verify manifest and zip package archive ]
verifySignature() [ verify the signature file: CERT.sf/rsa. ]
digestEntry():verifier.c [ get SHA-1 digest of CERT.sf file ]
RSA_verify(public key:keys.inc, signature:CERT.rsa, CERT.sf's digest):libc/rsa.c [ Verify a 2048 bit RSA PKCS1.5 signature against an expected SHA-1 hash. Use public key to decrypt the CERT.rsa to get original SHA digest, then compare to digest of CERT.sf ]
verifyManifest() [ Get manifest SHA1-Digest from CERT.sf. Then do digest to MANIFEST.MF. Compare them ]
verifyArchive() [ verify all the files in update.zip with digest listed in MANIFEST.MF ]
find_update_script():install.c [ find META-INF/com/google/android/update-script updater script ]
handle_update_script():install.c [ read cmds from script file, and do parser, exec ]
parseAmendScript():amend.c [ call yyparse() to parse to command ]
exeCommandList():install.c
exeCommand():execute.c [ call command hook function ]
erase DATA/CACHE partition
prompt_and_wait():recovery.c [ wait for user input: 1) reboot 2) update.zip 3) wipe data ]
ui_key_xxx get ALT+x keys
1) do nothing
2) install_package('SDCARD:update.zip')
3) erase_root() → format_root_device() DATA/CACHE
may_install_firmware_update():firmware.c [ remember_firmware_update() is called by write_hboot/radio_image command, it stores the bootloader image to CACHE partition, and write update-hboot/radio command to MISC partition for bootloader message to let bootloader update itself after reboot ]
set_bootloader_message()
write_update_for_bootloader():bootloader.c [ write firmware image into CACHE partition with update_header, busyimage and failimage ]
finish_recovery():recovery.c [ clear the recovery command and prepare to boot a (hopefully working) system, copy our log file to cache as well (for the system to read), and record any intent we were asked to communicate back to the system. ]
reboot()