Skip to content

fwupdater and SWUpdate components

Components

Component Role
fwupdater Cloud check, download, session authentication, slot writer orchestration
swupdate Signed .swu parser/installer
swupdate.sh Manual wrapper selecting the inactive slot and boot flags
libswupdate.so.0.1 SWUpdate library
/etc/swupdate-public.pem Image verification public key
self-check.sh Post-boot acceptance and rollback

fwupdater is a stripped AArch64 PIE using the same event loop, HTTP, device-identity, and telemetry support as other VK services.

CLI modes

Observed flags and strings:

  • --check: check only; self-check accepts exit status 0 or 1 as proof that the API transaction worked.
  • --session_file /data/voice-agent/session.json: supplies Marusya credentials.
  • Download-only mode is available.
  • A force/download-anyway option exists for development.

Normal statuses include Firmware is up to date, Update succeeded, and Update failed.

Response schema

fwupdater:0x14fe0 parses HTTP 200 JSON from result with:

  • version: candidate firmware version;
  • platform: target platform;
  • label: firmware label;
  • url: signed/download image URL;
  • need_update: boolean.

The check-only output includes CUR_VERSION, NEW_VERSION, PLATFORM, LABEL, NEED_UPDATE, and FW_URL. Update state also records OLD_VERSION and NEW_VERSION in /tmp/reboot_required; voice-agent persists /data/update_successful for S98. An absent marker does not prove that no update ran; marker creation is a separate step from download/install.

Download and writer paths

The file writer names /tmp/update.img; SwupdateWriter instead starts swupdate with -k /etc/swupdate-public.pem and the opposite slot. It tracks stdout/stderr closure and child exit status. The active slot is read from /proc/cmdline (slot_suffix).

/tmp is tmpfs, so a downloaded image disappears on reboot. Do not treat it as a persistent OTA backup. The full NAND acquisition in this repository is independent of /tmp/update.img.

Identity and configuration

The updater reads serial/device metadata through devinfo, uses /data/fwlabel, and honors /data/permanent/api_url. It also computes device identifiers from hardware/network data when required by the shared request builder. Narrative documentation omits actual account/session values.

Operational caveats

  • Return code 1 after --check can mean “update available,” not necessarily failure; self-check deliberately accepts both 0 and 1.
  • A successful download is not a successful update. Acceptance requires the 300-second post-boot gate.
  • A/B does not automatically back up data; both slots share the same mutable data volume and overlay.
  • Restoring an old data capture can reintroduce an older session or update marker into a newer rootfs. Check markers before interpreting boot slot behavior.