Android OTA系统降级

此方案基于6.0版本降级到5.1版本实现，其他版本降级仅供参考。

客户本身5.1版本ota整包升级到了6.0版本，因为升级后测试出bug，但fota已经发布，取消发布后已有很多终端机器升级到了6.0版本，并且收到客诉。因为无法短期内解决这个bug，要采取降级方式回退到5.1系统，以免用户继续投诉。

Tip:大版本升级或者降级都需要整包升级，并且需要重新签名。低系统版本升级到高系统版本，需要将高版本整包使用低系统签名文件签名。降级反之。

要明确，Android机制是不允许系统降级的。

方案：

1. 首先编译出6.0, 5.1版本的ota整包。（这一部分应该是之前5.1升级到6.0时编译完ota保留的）
2. 在6.0整包中修改：

• full_K5-ota-android6.0-1691675028.zip\META-INF\com\android\metadata

-    post-build=alps/full_K5/K5:6.0/MRA58K/1691673617:userdebug/test-keys
-    post-timestamp=1691673782
pre-device=K5

• full_K5-ota-android6.0-1691675028.zip\META-INF\com\google\android\updater-script

-    ui_print("Target: alps/full_K5/K5:6.0/MRA58K/1691673617:userdebug/test-keys");
show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
-    ui_print("Verifying the updated system image...");
-    if range_sha1("/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/system", "42,0,32767,32768,32770,32865,32867,33379,65535,65536,65538,98304,98306,98401,98403,98915,131071,131072,131074,163840,163842,163937,163939,164451,190059,196608,196610,229376,229378,229473,229475,229987,262143,262144,262146,294912,294914,295009,295011,327680,327682,360448,360450") == "2b9cfad16feb4d4635e11f9fd286f8a6bce63fc4" then
-    if range_sha1("/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/system", "56,32767,32768,32770,32865,32867,33379,65535,65536,65538,66050,97792,98304,98306,98401,98403,98915,131071,131072,131074,131586,163328,163840,163842,163937,163939,164451,190059,190571,196096,196608,196610,197122,228864,229376,229378,229473,229475,229987,262143,262144,262146,262658,294400,294912,294914,295009,295011,295523,327168,327680,327682,328194,359936,360448,360450,360962") == "0d1d76135a43547c983799e39a0cda54c89ebfff" then
-    ui_print("Verified the updated system image.");
-    else
-    abort("system partition has unexpected non-zero contents after OTA update");
-    endif;
-    else
-    abort("system partition has unexpected contents after OTA update");
-    endif;
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/boot");
show_progress(0.200000, 10);
apply_sig(package_extract_file("sig/boot.sig"), "/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/boot");
show_mtupdate_stage("/cache/recovery/last_mtupdate_stage");
delete("/cache/recovery/last_mtupdate_stage");

• 取5.1整包中的system.transfer.list boot.img system.new.dat三个文件替换到6.0整包中。

此时使用修改后的整包签名后降级应该能够成功，但是开机后可能会反复重启。这是因为userdata/emmc分区中保留了6.0的数据，此时需要格式化emmc分区，操作如下

• ota升级时格式化data分区
  full_5_NEW-format.zip\META-INF\com\google\android\updater-script

show_progress(0.750000, 0);
ui_print("Patching system image unconditionally...");
block_image_update("/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat");
show_progress(0.050000, 5);
package_extract_file("boot.img", "/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/boot");
show_progress(0.200000, 10);
apply_sig(package_extract_file("sig/boot.sig"), "/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/boot");
show_mtupdate_stage("/cache/recovery/last_mtupdate_stage");
+    ui_print("Erasing user data...");
+    format("ext4", "EMMC", "/dev/block/platform/mtk-msdc.0/11120000.msdc0/by-name/userdata", "0", "/data");
delete("/cache/recovery/last_mtupdate_stage");

3. 重新签名
   Tip:因为是6.0降级到5.1所以使用6.0签名文件签名。

• 取6.0版本编译完ota后的target-files-package.zip 解压。
• 将制作完成后的降级包放到解压后的目录下。
• 运行命令

java -jar out/host/linux-x86/framework/signapk.jar -w build/target/product/security/testkey.x509.pem  build/target/product/security/testkey.pk8  fullxx.zip fullxx_sign.zip

• 最后使用签名后的ota包本地升级测试。