Startup sequence
Reset vector and early userspace
Observed: the live kernel is 4.9.113 on AArch64. /proc/cmdline selects slot _a, rootfstype=ubifs, SELinux enforcing, and androidboot.firstboot=1. U-Boot 2015.01 supplies the device ID and boot slot.
etc/inittab mounts proc, devtmpfs, devpts, tmpfs (/dev/shm, /run, /tmp), sets the hostname, raises lo, and then runs /etc/init.d/rcS.
rcS iterates /etc/init.d/S??* in lexical order. Files ending in .sh are sourced in a subshell; other files are executed with start.
Ordered boot stages
| Stage | File | Purpose |
|---|---|---|
| S01 | S01syslogd |
Starts logging. |
| S02 | S02datamount.sh |
Attaches and mounts data as UBIFS. |
| S03 | S03factory-reset.sh |
Removes data contents when do_factory_reset exists. |
| S04 | S04overlaymount.sh |
Creates upper/work and pivots into overlayfs. |
| S20–S60 | network, Bluetooth, audio | Brings up basic services. |
| S89 | S89usbgadget.sh |
Creates RNDIS + FunctionFS ADB gadget. |
| S95 | S95telemetry.sh |
Starts telemetry unless replaced/disabled. |
| S97 | S97voice-agent.sh, S97okcall.sh |
Starts VK voice/call agents. |
| S98 | S98selfcheck.sh |
Starts post-update self-check. |
| S99 | S99btctl.sh, S99sysmon.sh |
Starts Bluetooth control and system monitor. |
The overlay is mounted before S89, so files under /data/overlay/upper/etc/init.d can override S89 and later scripts. They cannot alter S02–S04: those run before the upper layer exists.
Boot windows
Observed in U-Boot environment: try_auto_burn=update 700 450. At every cold boot, the burning gadget appears as 1b8e:c003 for roughly 450 ms. The burning protocol is available only in the TPL (U-Boot) stage, not as a persistent ADB service.
boot-control reports slot 0 active, both slots bootable, slot 1 offline. This matches the _a command line and the A/B update flow.
Source files
firmware/live/etc/inittabfirmware/live/etc/init.d/rcSfirmware/live/etc/init.d/S02datamount.shfirmware/live/etc/init.d/S04overlaymount.shfirmware/live/etc/init.d/S89usbgadget.sh