update_engine简介
update_engine是A/B升级的核心逻辑。理解了update_engine就理解了在Android系统中A/B升级是如何运行的。它的代码放在源码目录下system/update_engine/下。那么接下来对update_engine进行分析，首先会分析它的结构，之后分析它的核心操作。
update_engine结构分析
Android.mk分析
一个源码工程中包含的源文件会有很多，但是不代表所有的文件都和我们的目标相关。而通过Android.mk文件可以找到和分析目标update_engine相关的源文件。我们只需要关注这些文件便可。Android.mk中直接和update_engine相关的内容
1 include $(CLEAR_VARS)
2 LOCAL_MODULE := update_engine
3 LOCAL_MODULE_CLASS := EXECUTABLES
4 LOCAL_REQUIRED_MODULES := \
5 cacerts_google
6 LOCAL_CPP_EXTENSION := .cc
7 LOCAL_CLANG := true
8 LOCAL_CFLAGS := $(ue_common_cflags)
9 LOCAL_CPPFLAGS := $(ue_common_cppflags)
10 LOCAL_LDFLAGS := $(ue_common_ldflags)
11 LOCAL_C_INCLUDES := \
12 $(ue_common_c_includes)
13 LOCAL_SHARED_LIBRARIES := \
14 $(ue_common_shared_libraries)
15 LOCAL_STATIC_LIBRARIES := \
16 $(ue_common_static_libraries)
17 LOCAL_SRC_FILES := \
18 main.cc
19
20 ifeq ($(local_use_omaha),1)
21 LOCAL_C_INCLUDES += \
22 $(ue_libupdate_engine_exported_c_includes)
23 LOCAL_STATIC_LIBRARIES += \
24 libupdate_engine \
25 $(ue_libupdate_engine_exported_static_libraries:-host=)
26 LOCAL_SHARED_LIBRARIES += \
27 $(ue_libupdate_engine_exported_shared_libraries:-host=)
28 else # local_use_omaha == 1
29 LOCAL_STATIC_LIBRARIES += \
30 libupdate_engine_android \
31 $(ue_libupdate_engine_android_exported_static_libraries:-host=)
32 LOCAL_SHARED_LIBRARIES += \
33 $(ue_libupdate_engine_android_exported_shared_libraries:-host=)
34 endif # local_use_omaha == 1
35
36 LOCAL_INIT_RC := update_engine.rc
37 include $(BUILD_EXECUTABLE)
从中首先可以获取到的信息就是该模块是个可执行的模块，并且入口函数在main.cc中。接下来再看它一定依赖的文件。
1 ue_common_c_includes := \ #依赖的c文件
2 $(LOCAL_PATH)/client_library/include \
3 system
4
5 ue_common_shared_libraries := \ #依赖的动态库
6 libbrillo-stream \
7 libbrillo \ #在源码下的external中
8 libchrome #在源码下的external中
9
10 ue_common_static_libraries := \ #依赖的静态库
11 libgtest_prod \
由于local_use_omaha := $(if $(filter true,$(PRODUCT_IOT)),1,0) 意思为该设备是否是IOT设备，如果是则值为1否则为0，在这里我们分析的状况是非IOT设备。所以local_use_omaha := 0。所以该模块还依赖如下
1 LOCAL_STATIC_LIBRARIES += \ #静态依赖
2 libupdate_engine_android \
3 $(ue_libupdate_engine_android_exported_static_libraries:-host=)
4 -------------------------------------------------------------------------
5 ue_libupdate_engine_android_exported_static_libraries := \
6 libpayload_consumer \
7 libfs_mgr \
8 libbase \
9 liblog \
10 $(ue_libpayload_consumer_exported_static_libraries) \
11 libupdate_engine_boot_control \
12 $(ue_libupdate_engine_boot_control_exported_static_libraries)
13 ue_libupdate_engine_android_exported_shared_libraries := \
14 $(ue_libpayload_consumer_exported_shared_libraries) \
15 $(ue_libupdate_engine_boot_control_exported_shared_libraries) \
16 libandroid_net \
17 libbinder \
18 libbinderwrapper \
19 libbrillo-binder \
20 libcutils \
21 libcurl \
22 libssl \
23 libutils
24
25 LOCAL_SHARED_LIBRARIES += \ #动态依赖
26 $(ue_libupdate_engine_android_exported_shared_libraries:-host=)
27 -------------------------------------------------------------------------
28 ue_libupdate_engine_android_exported_shared_libraries := \
29 $(ue_libpayload_consumer_exported_shared_libraries) \
30 $(ue_libupdate_engine_boot_control_exported_shared_libraries) \
31 libandroid_net \
32 libbinder \
33 libbinderwrapper \
34 libbrillo-binder \
35 libcutils \
36 libcurl \
37 libssl \
38 libutils
可以看到其中还有很多依赖的源文件是以变量赋值的形式出现的。这里就不一一列出了，但是方法已经知道了，那就是当遇到一个方法存在于两个文件中时就可以通过Android.mk来确定我们所需要的文件。
从main.cc开始分析
src/system/update_engine/main.cc
1 int main(int argc, char** argv) {
2 DEFINE_bool(logtostderr, false,
3 "Write logs to stderr instead of to a file in log_dir.");
4 DEFINE_bool(foreground, false,
5 "Don't daemon()ize; run in foreground.");
6
7 chromeos_update_engine::Terminator::Init();
8 brillo::FlagHelper::Init(argc, argv, "Chromium OS Update Engine");
9 chromeos_update_engine::SetupLogging(FLAGS_logtostderr);
10 if (!FLAGS_foreground)
11 PLOG_IF(FATAL, daemon(0, 0) == 1) << "daemon() failed";
12
13 LOG(INFO) << "Chrome OS Update Engine starting";
14
15 // xz-embedded requires to initialize its CRC-32 table once on startup.
16 xz_crc32_init();
17
18 // Ensure that all written files have safe permissions.
19 // This is a mask, so we _block_ all permissions for the group owner and other
20 // users but allow all permissions for the user owner. We allow execution
21 // for the owner so we can create directories.
22 // Done _after_ log file creation.
23 umask(S_IRWXG | S_IRWXO);
24
25 chromeos_update_engine::UpdateEngineDaemon update_engine_daemon;
26 int exit_code = update_engine_daemon.Run();
27
28 LOG(INFO) << "Chrome OS Update Engine terminating with exit code "
29 << exit_code;
30 return exit_code;
31 }
可以看到首先进行了初始化工作，这些初始化并不影响对程序主干的分析，所以可以暂时略过。直接看最重要的UpdateEngineDaemon以及其Run()方法。UpdateEngineDaemon继承了brillo::Daemon，UpdateEngineDaemon的内容为
src/system/update_engine/daemon.h
1 namespace chromeos_update_engine {
2
3 class UpdateEngineDaemon : public brillo::Daemon {
4 public:
5 UpdateEngineDaemon() = default;
6
7 protected:
8 int OnInit() override;
9
10 private:
11 #if USE_DBUS
12 // Run from the main loop when the |dbus_adaptor_| object is registered. At
13 // this point we can request ownership of the DBus service name and continue
14 // initialization.
15 void OnDBusRegistered(bool succeeded);
16
17 // Main D-Bus service adaptor.
18 std::unique_ptr<UpdateEngineAdaptor> dbus_adaptor_;
19 #endif // USE_DBUS
20
21 // The Subprocess singleton class requires a brillo::MessageLoop in the
22 // current thread, so we need to initialize it from this class instead of
23 // the main() function.
24 Subprocess subprocess_;
25
26 #if USE_BINDER
27 brillo::BinderWatcher binder_watcher_;
28 #endif // USE_BINDER
29
30 #if USE_BINDER
31 #if USE_OMAHA
32 android::sp<BinderUpdateEngineBrilloService> binder_service_;
33 #else // !USE_OMAHA
34 android::sp<BinderUpdateEngineAndroidService> binder_service_;
35 #endif // USE_OMAHA
36 #endif // USE_BINDER
37
38 // The daemon state with all the required daemon classes for the configured
39 // platform.
40 std::unique_ptr<DaemonStateInterface> daemon_state_;
41
42 DISALLOW_COPY_AND_ASSIGN(UpdateEngineDaemon);
43 };
44
45 } // namespace chromeos_update_engine
46
47 #endif // UPDATE_ENGINE_DAEMON_H_
从中可以看到它并没有对Run()进行重写，所以必须要看看daemon类的内容了:
src/external/librillo/brillo/daemons/daemon.cc
1 namespace brillo {
2 ........
3 int Daemon::Run() {
4 int exit_code = OnInit(); //会调用子类的OnInit()方法
5 if (exit_code != EX_OK)
6 return exit_code;
7
8 message_loop_.Run();
9
10 OnShutdown(&exit_code_);
11
12 // base::RunLoop::QuitClosure() causes the message loop to quit
13 // immediately, even if pending tasks are still queued.
14 // Run a secondary loop to make sure all those are processed.
15 // This becomes important when working with D-Bus since dbus::Bus does
16 // a bunch of clean-up tasks asynchronously when shutting down.
17 while (message_loop_.RunOnce(false /* may_block */)) {}
18
19 return exit_code_;
20 }
21
22 int Daemon::OnInit() {
23 async_signal_handler_.Init();
24 for (int signal : {SIGTERM, SIGINT}) {
25 async_signal_handler_.RegisterHandler(
26 signal, base::Bind(&Daemon::Shutdown, base::Unretained(this)));
27 }
28 async_signal_handler_.RegisterHandler(
29 SIGHUP, base::Bind(&Daemon::Restart, base::Unretained(this)));
30 return EX_OK;
31 }
32 ........
33 }
可以看到在Run()方法中主要就是调用了OnInit()方法，子类一旦对其进行了重写那么就会调用子类的OnInit()方法.UpdateEngineDaemon的Oninit()方法体如下:
src/system/update_engine/daemon.cc
1 namespace chromeos_update_engine {
2
3 int UpdateEngineDaemon::OnInit() {
4 // Register the |subprocess_| singleton with this Daemon as the signal
5 // handler.
6 subprocess_.Init(this); //初始化子进程，用来处理信号
7
8 int exit_code = Daemon::OnInit(); //调用父类的OnInit()方法
9 if (exit_code != EX_OK)
10 return exit_code;
11
12 #if USE_BINDER //USE_BINDER=1
13 android::BinderWrapper::Create(); //创建BinderWrapper
14 binder_watcher_.Init();
15 #endif // USE_BINDER
16
17 #if USE_OMAHA //USE_OMAHA=0
18 // Initialize update engine global state but continue if something fails.
19 // TODO(deymo): Move the daemon_state_ initialization to a factory method
20 // avoiding the explicit re-usage of the |bus| instance, shared between
21 // D-Bus service and D-Bus client calls.
22 RealSystemState* real_system_state = new RealSystemState();
23 daemon_state_.reset(real_system_state);
24 LOG_IF(ERROR, !real_system_state->Initialize())
25 << "Failed to initialize system state.";
26 #else // !USE_OMAHA
27 DaemonStateAndroid* daemon_state_android = new DaemonStateAndroid();
28 daemon_state_.reset(daemon_state_android);
29 LOG_IF(ERROR, !daemon_state_android->Initialize())
30 << "Failed to initialize system state.";
31 #endif // USE_OMAHA
32
33 #if USE_BINDER
34 // Create the Binder Service.
35 #if USE_OMAHA
36 binder_service_ = new BinderUpdateEngineBrilloService{real_system_state};
37 #else // !USE_OMAHA
38 binder_service_ = new BinderUpdateEngineAndroidService{
39 daemon_state_android->service_delegate()}; //创建binder_service
40 #endif // USE_OMAHA
41 auto binder_wrapper = android::BinderWrapper::Get();
42 if (!binder_wrapper->RegisterService(binder_service_->ServiceName(), //向ServiceManager注册binder_service
43 binder_service_)) {
44 LOG(ERROR) << "Failed to register binder service.";
45 }
46
47 daemon_state_->AddObserver(binder_service_.get()); //将binder_service添加到观察者队列中
48 #endif // USE_BINDER
49
50 #if USE_DBUS //USE_DBUS=0
51 // Create the DBus service.
52 dbus_adaptor_.reset(new UpdateEngineAdaptor(real_system_state));
53 daemon_state_->AddObserver(dbus_adaptor_.get());
54
55 dbus_adaptor_->RegisterAsync(base::Bind(&UpdateEngineDaemon::OnDBusRegistered,
56 base::Unretained(this)));
57 LOG(INFO) << "Waiting for DBus object to be registered.";
58 #else // !USE_DBUS
59 daemon_state_->StartUpdater(); //开始服务的核心流程
60 #endif // USE_DBUS
61 return EX_OK;
62 }
在Oninit（）中其实主要就是做了两件事，首先是对Binder进行了初始化，包括创建，注册，添加到观察者队列中。其次就是创建了DaemonStateAndroid，并将其赋给daemon_state_,最后调用daemon_state_->StartUpdater()。
