[Sony Cross-Device General] Tungstwenty:
[MENTION=4904057][NUT][/MENTION],

I'm not sure if you or others have noticed, but support for automatic execution of recovery commands after reboot is broken.

Some apps (e.g. SuperSU) allow installation through the creation of the /cache/recovery/command file, containing the set of commands to run upon startup (in addition to entering recovery mode).

This doesn't bug me particularly, but it left me curious enough to search for the reason :)

Here are my findings:

Rebooting into recovery is properly detected by XZDualRecovery, since [MENTION=2784807]DooMLoRD[/MENTION]'s recovery reboot wrapper touches the /cache/recovery/boot file and DR picks that up.

The problem I was facing was the fact that "command" is always missing after reboot, and therefore CWM / TWRP merely start in interactive mode instead of proceeding with the commands staged before reboot.

Turns out that the cause for this is the /system/bin/mr command which is triggered on init.target.rc ("on fs" section).

The binary checks if /cache/recovery/command file exists, if the command is one of --wipe_cache, --wipe_data or --wipe_data_keep_media, writes a value to the TA unit 0x9F6 depending on which one was used, and finally deletes the command file even if the commands had nothing to do with this process.

chargemon runs later in the boot process, and from the *.rc scripts on my device (check my signature) mr looks like the very first command on the boot sequence that does come from /system, instead of /sbin. Talk about bad luck :p

Again, this isn't something that bothers me, as an educated Android user :)

But in case anyone was wondering, this was the reason for the recovery commands to be ignored. This doesn't happen on custom kernels (on DooMKernel at least) because in its ramfs the test for recovery happens before the original *.rc's are handled, instead of needing to be hijacked as it is on XZDR in order to work on locked bootloader.

If this were to be solved, I see 3 possible approaches

1 - hijack /system/bin/mr, instead of chargemon (this might not be a very good idea if this is not common to all the Xperia devices currently supported)

2 - keep the recovery logic at chargemon, but create a wrapper for mr that creates a backup of command before running the original mr and restores it afterward, just to persist to the normal recovery that will start later on. Whether to block the original mr execution with the file in place or not is a matter of understanding under which conditions would it be desirable to have it write the TA with those values, but I'd say it should be executed normally since it's only relevant for wipe scenarios (fota perhaps?)

3 - before rebooting (perhaps also handled by the reboot wrapper?) rename the command file to a different name that mr won't pick up and at the beginning of DR's logic restore that file if it exists with the special name. This is probably the worse way to handle this, as the reboot might not be ran by the replaced reboot binary in all situations. And coordination would be needed between the reboot wrapper and the DR logic.

Personally, if I ever feel the need for this to work properly, I will likely go for option 2 so that everything else is untouched and doesn't produce any side effects.

Hope the info is useful for anyone ;)