the Chromium logo

The Chromium Projects

File System/Autoupdate


This document describes the Chromium OS file system and the autoupdate system.


The autoupdate system has the following goals:


A drive currently contains at least these partitions:

Root file system

Only one of the two partitions designated for the root file system will be in use at a given time. The other will be used for autoupdating and for a fallback if the current partition fails to boot. While a partition is in use as the boot partition, it's read-only until the next boot. Not even the autoupdater will edit the currently-booted root file system. We will mount the stateful partition read-write and use that for all state that needs to be stored locally.

During autoupdate, we will write to the other system partition. Only the updater (and apps running as root) will have access to that partition.

The update process

Successful boot

The update process relies partly on the concept of a "successful boot." At any given point, we will be able to say one of the following things:

We consider a boot successful if the updater process can successfully launch. Once a system has booted successfully, we consider the other root partition to be available for overwriting with an autoupdate.

Limiting the number of boot attempts

An updated partition can attempt to boot only a limited number of times; if it doesn't boot successfully after a couple of attempts, then the system goes back to booting from the other partition. The number of attempts is limited as follows: When a partition has successfully been updated, it's assigned a remaining_attempts value, currently 6. This value will be stored in the partition table next to the bootable flag (there are unused bits in the GPT that the boot loader can use for its own purposes). The boot loader will examine all partitions in the system; if it finds any partition that has a remaining_attempts value > 0, it will decrement remaining_attempts and then attempt to boot from that partition. If the boot fails, then this process repeats. If no partitions have a remaining_attempts value > 0, the boot loader will boot from a partition marked bootable, as a traditional boot loader would.


Here's a diagram of the boot process:



For a detailed design into how delta updates are generated and applied, see: Autoupdate Details. For supplementary information about related material, see the Filesystem/Autoupdate supplements document.

Other notes