[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間:2025-07-27 (世界標準時間)。"],[],[],null,["# Boot flow\n\nThe recommended boot flow for a device is as follows:\n\n**Figure 1.** Verified boot flow.\n\nFlow for A/B devices\n--------------------\n\n\nIf the device is using A/B, the boot flow is slightly different. The slot to\nboot must first be marked as `SUCCESSFUL` using the [Boot Control HAL](https://android.googlesource.com/platform/hardware/interfaces/+/android16-release/boot/1.0/IBootControl.hal) **before** updating the\nRollback Protection metadata.\n\n\nIf there's a platform update that fails (isn't marked\n`SUCCESSFUL`), the A/B stack falls back to the other slot,\nwhich still has the previous version of Android in it. However, if\nthe Rollback Protection-metadata had been set, the previous version can't\nboot because of Rollback Protection.\n\nCommunicate Verified Boot state to users\n----------------------------------------\n\n\nAfter determining the boot state of a device, you need to communicate that\nstate to the user. If the device doesn't have any issues, then proceed without\ndisplaying anything. Verified Boot issues fall into these categories:\n\n- YELLOW: Warning screen for LOCKED devices with custom root of trust set\n- ORANGE: Warning screen for UNLOCKED devices\n- RED (eio): Warning screen for dm-verity corruption\n- RED (no os found): No valid OS found\n\n### LOCKED devices with custom root of trust\n\n**Figure 2**: Example of a Yellow screen\n\n\nShow a YELLOW screen on every boot if the device is LOCKED, a custom root of\ntrust has been set, and the image was signed with this custom root of trust.\nThe YELLOW screen is dismissed after ten seconds and the device continues\nbooting. If the user presses the power button, the \"Press power button to pause\"\ntext changes to \"Press power button to continue\" and the screen is never\ndismissed (though the device may dim or turn off the screen to protect against\nburn-in). If pressed again, the screen is dismissed and the phone continues\nbooting.\n\n\nFor the \u003cvar translate=\"no\"\u003ehex-number\u003c/var\u003e, use the first 8 digits of the sha256 of\nthe libavb representation of the public key used for verification, for example\n`d14a028c`.\n\n\n**Suggested text:**\n\n\nYour device has loaded a different operating system.\n\n\nVisit this link on another device to learn more:\n\n\ng.co/ABH\n\n\nID: \u003cvar translate=\"no\"\u003ehex-number\u003c/var\u003e\n\n\npower_settings_new Press power button to pause \n\n### UNLOCKED devices\n\n**Figure 3**: Example of an Orange screen\n\n\nShow an ORANGE screen on every boot if the device is UNLOCKED. The ORANGE screen\nis dismissed after ten seconds and the device continues booting. If the user\npresses the power button, \"Press power button to pause\" text changes to \"Press\npower button to continue\" and the screen is never dismissed (the device may dim\nand/or turn off the screen if needed to protect against burn-in or similar). If\npressed again, the screen is dismissed and the phone continues booting.\n\n\nFor the \u003cvar translate=\"no\"\u003ehex-number\u003c/var\u003e, use the first 8 digits of the sha256 of the libavb\nrepresentation of the public key used for verification, for example\n`d14a028c`.\n\n\n**Suggested text:**\n\n\nThe boot loader is unlocked and software integrity can't be guaranteed. Any\ndata stored on the device may be available to attackers. Don't store any\nsensitive data on the device.\n\n\nVisit this link on another device to learn more:\n\n\ng.co/ABH\n\n\nID: \u003cvar translate=\"no\"\u003ehex-number\u003c/var\u003e\n\n\npower_settings_new Press power button to pause. \n\n### dm-verity corruption\n\n**Figure 4**: Example of a Red eio screen\n\n\nShow a RED `eio` screen if a valid version of Android is found and\nthe device is currently in the `eio` dm-verity mode. The user needs\nto click the power button to continue. If the user hasn't acknowledged the\nwarning screen within 30 seconds, the device powers off (to protect the screen\nagainst burn-in and save power).\n| **Note:** Other warning screens may follow this screen. For example, if the device is `UNLOCKED` the ORANGE screen shows after.\n\n\n**Suggested text:**\n\n\nYour device is corrupt. It can't be trusted and might not work properly.\n\n\nVisit this link on another device to learn more:\n\n\ng.co/ABH\n\n\npower_settings_new Press power button to continue. \n\n### No valid OS found\n\n**Figure 5**: Example of a Red screen\n\n\nShow a RED screen is shown if no valid version of Android can be found. The\ndevice can't continue booting. If the user hasn't acknowledged the warning\nscreen within 30 seconds, the device powers off to protect the screen against\nburn-in and save power.\n\n\nFor the \u003cvar translate=\"no\"\u003ehex-number\u003c/var\u003e, use the first 8 digits of the sha256 of\nthe libavb representation of the public key used for verification, for example\n`d14a028c`.\n\n\n**Suggested text:**\n\n\nNo valid operating system could be found. The device won't boot.\n\n\nVisit this link on another device to learn more:\n\n\ng.co/ABH\n\n\nID: \u003cvar translate=\"no\"\u003ehex-number\u003c/var\u003e\n\n\npower_settings_new Press power button to power off. \n\n### Unlock confirmation\n\n**Figure 6**: Example of an unlock confirmation screen\n\n\nShow an unlock confirmation screen in response to the\n`fastboot flashing unlock` command being executed through the fastboot\ninterface. Focus is initially on *Don't unlock*. If the user hasn't\ninteracted with the warning screen within 30 seconds, the screen disappears and\nthe command fails.\n\n\n**Suggested text:**\n\n\nIf you unlock the bootloader, you can install custom operating\nsystem software on this phone. A custom OS isn't subject to the same level of\ntesting as the original OS, and can cause your phone and installed apps\nto stop working properly. Software integrity can't be guaranteed with a custom\nOS so any data stored on the phone while the bootloader is unlocked may be at\nrisk.\n\n\nTo prevent unauthorized access to your personal data, unlocking the bootloader\nalso deletes all personal data on your phone.\n\n\nPress the Volume Up/Volume Down to select whether to unlock the bootloader, then\nthe power button to continue.\n\n\nUnlock\n\n\nUnlock bootloader.\n\n\nDon't unlock\n\n\nDon't unlock bootloader and restart phone.\n\n### Lock confirmation\n\n\nShow a lock confirmation screen in response to the `fastboot flashing\nlock` command being executed through the fastboot interface. Focus is\ninitially on *Don't lock*. If the user hasn't interacted with the\nwarning screen within 30 seconds, the screen disappears and the command fails.\n\n\n**Text:**\n\n\nIf you lock the bootloader, you can't install custom operating\nsystem software on this phone. To prevent unauthorized access to your personal\ndata, locking the bootloader also deletes all personal data on your phone.\n\n\nPress the Volume Up/Volume Down to select whether to lock the bootloader, then\nthe power button to continue.\n\n\nLock\n\n\nLock bootloader.\n\n\nDon't lock\n\n\nDon't lock bootloader and restart phone.\n\nCommunicate Verified Boot state to Android\n------------------------------------------\n\n**Figure 7**: Lock confirmation device warning screen\n\n\nThe bootloader communicates Verified Boot state to Android through\nkernel-command parameters, or through bootconfig starting with Android 12.\nIt sets the `androidboot.verifiedbootstate` option to one of the following values:\n\n- `green`: if device is `LOCKED` and user-settable root of trust isn't used\n- `yellow`: if device is `LOCKED` and user-settable root of trust is used\n- `orange`: if device is `UNLOCKED`\n\n\nThe `androidboot.veritymode` option is set to `eio` or\n`restart` depending on which state the boot loader is in with respect\nto handling dm-verity errors. For more details, see [Handling\nverification errors](/docs/security/features/verifiedboot/verified-boot#handling-verification-errors)."]]