Boot Flow

The recommended boot flow for a device is as follows:

Verified boot flow
Figure 1. Verified boot flow

Flow for A/B devices

If the device is using A/B, the boot flow is slightly different. The slot to boot must first be marked as SUCCESSFUL using the Boot Control HAL before updating the Rollback Protection metadata.

If there's a platform update that fails (is not marked SUCCESSFUL), the A/B stack falls back to the other slot, which still has the previous version of Android in it. However, if the Rollback Protection-metadata had been set, the previous version can't boot because of Rollback Protection.

Communicating Verified Boot state to users

After determining the boot state of a device, you need to communicate that state to the user. If the device doesn't have any issues, then proceed without displaying anything. Verified Boot issues fall into these categories:

  • YELLOW: Warning screen for LOCKED devices with custom root of trust set
  • ORANGE: Warning screen for UNLOCKED devices
  • RED (eio): Warning screen for dm-verity corruption
  • RED (no os found): No valid OS found

LOCKED devices with custom root of trust

Show a YELLOW screen on every boot if the device is LOCKED, a custom root of trust has been set, and the image was signed with this custom root of trust. The YELLOW screen is dismissed after ten seconds and the device continues booting. If the user presses the power button, "Press power button to pause" text changes to "Press power button to continue" and the screen is never dismissed, though the device may dim or turn off the screen to protect against burn-in). If pressed again, the screen is dismissed and the phone continues booting.

For the hex-number, use the first 8 digits of the sha256 of the libavb representation of the public key used for verification, for example f7a24de1.

Suggested text:

Your device has loaded a different operating system.

Visit this link on another device to learn more:

g.co/ABH

ID: hex-number

power_settings_new Press power button to pause

 

Example YELLOW screen:

Yellow device warning screen

UNLOCKED devices

Show an ORANGE screen on every boot if the device is UNLOCKED. The ORANGE screen is dismissed after ten seconds and the device continues booting. If the user presses the power button, "Press power button to pause" text changes to "Press power button to continue" and the screen is never dismissed (the device may dim and/or turn off the screen if needed to protect against burn-in or similar). If pressed again, the screen is dismissed and the phone continues booting.

For the hex-number, use the first 8 digits of the sha256 of the libavb representation of the public key used for verification, for example f7a24de1.

Suggested text:

The boot loader is unlocked and software integrity cannot be guaranteed. Any data stored on the device may be available to attackers. Do not store any sensitive data on the device.

Visit this link on another device to learn more:

g.co/ABH

ID: hex-number

power_settings_new Press power button to pause.

 

Example ORANGE screen:

Orange device warning screen

dm-verity corruption

Show a RED eio screen if a valid version of Android is found and the device is currently in the eio dm-verity mode. The user needs to click the power button to continue. If the user hasn't acknowledged the warning screen within 30 seconds, the device powers off (to protect the screen against burn-in and save power).

Suggested text:

Your device is corrupt. It can't be trusted and may not work properly.

Visit this link on another device to learn more:

g.co/ABH

power_settings_new Press power button to continue.

 

Example RED eio screen:

Red eio device warning screen

No valid OS found

Show a RED screen is shown if no valid version of Android can be found. The device cannot continue booting. If the user hasn't acknowledged the warning screen within 30 seconds, the device powers off to protect the screen against burn-in and save power).

For the hex-number, use the first 8 digits of the sha256 of the libavb representation of the public key used for verification, for example f7a24de1.

Suggested text:

No valid operating system could be found. The device will not boot.

Visit this link on another device to learn more:

g.co/ABH

ID: hex-number

power_settings_new Press power button to power off.

 

Example RED screen:

Red corrupt device warning screen

Unlock confirmation

Show an unlock confirmation screen in response to the fastboot flashing unlock command being executed via the fastboot interface. Focus is initially on Don't unlock. If the user hasn't interacted with the warning screen within 30 seconds, the screen disappears and the command fails.

Suggested text:

If you unlock the bootloader, you will be able to install custom operating system software on this phone. A custom OS is not subject to the same level of testing as the original OS, and can cause your phone and installed applications to stop working properly. Software integrity cannot be guaranteed with a custom OS so any data stored on the phone while the bootloader is unlocked may be at risk.

To prevent unauthorized access to your personal data, unlocking the bootloader will also delete all personal data on your phone.

Press the Volume Up/Volume Down to select whether to unlock the bootloader, then the power button to continue.

Unlock

Unlock bootloader.

Don't unlock

Do not unlock bootloader and restart phone.

 

Example screen:

UNLOCK device warning screen

Lock confirmation

Show a lock confirmation screen in response to the fastboot flashing lock command being executed via the fastboot interface. Focus is initially on Don't lock. If the user hasn't interacted with the warning screen within 30 seconds, the screen disappears and the command fails.

Text:

If you lock the bootloader, you will not be able to install custom operating system software on this phone. To prevent unauthorized access to your personal data, locking the bootloader will also delete all personal data on your phone.

Press the Volume Up/Volume Down to select whether to lock the bootloader, then the power button to continue.

Lock

Lock bootloader.

Don't lock

Do not lock bootloader and restart phone.

 

Example screen:

LOCK confirmation device warning screen

Communicating Verified Boot state to Android

The bootloader communicates Verified Boot state to Android through kernel-command options. It sets the androidboot.verifiedstate option to one of the following values:

  • green: if device is LOCKED and user-settable root of trust is not used
  • yellow: if device is LOCKED and user-settable root of trust is used
  • orange: if device is UNLOCKED

The androidboot.veritymode option is set to eio or restart depending on which state the boot loader is in with respect to handling dm-verity errors. For more details, see Handling verification errors.