Fastboot Protocol and Fastbootd Process on Android Devices

Fastboot is a flashing protocol for Android devices that enables developers to quickly flash system images. Starting with Android Q, Google introduced the dynamic super partition, allowing flexible sizing of system, vendor, and product partitions, and a fastboot mode implemented in the recovery system (fastbootd).

Source code and compilation

The fastbootd source for the device side is located at system/core/fastboot/device , while the host‑side fastboot source resides at system/core/fastboot . Running mm in the system/core/fastboot directory builds both fastbootd and the host fastboot tool.

Fastboot mode startup process

1. adb reboot-fastboot or bootloader reboot-fastboot triggers the fastboot mode.

2. The command reboot-fastboot is added to adb (since r28.0.2) and to fastboot (since r28.0.1).

3. The property sys.powerctl=fastboot is set, causing the init process to write a bootloader_message and reboot.

4. After reboot, the recovery system reads the bootloader_message , switches the USB configuration from none to fastboot , and creates the Fastboot FunctionFS endpoints.

5. The fastbootd process runs inside recovery, handling all fastboot commands, while the recovery UI remains separate.

Key source files

system/core/adb/daemon/services.cpp – adds support for reboot-fastboot .

system/core/reboot/reboot.c – implements setting sys.powerctl=fastboot .

init.rc and init.rc1 – configure USB FunctionFS for fastboot.

recovery_main.cpp – reads the bootloader message and starts fastbootd.

Fastboot communication

The fastboot protocol uses commands such as reboot , flash:boot , erase:boot , oem:unlock , getvar:product , download:size , etc., transmitted over USB or network.

Dynamic super partition

The super partition contains a metadata structure that records the location and size of logical partitions (system, vendor, product). Fastbootd supports commands create-logical-partition , delete-logical-partition , and resize-logical-partition to manage these partitions.

Example commands:

fastboot delete-logical-partition system fastboot

fastboot create-logical-partition system 1073741824

fastboot resize-logical-partition system 4294967296

fastboot flash system system.img

After flashing, the init process in the first_stage phase creates Device Mapper devices based on the super partition metadata, mounts them according to fstab , and makes the logical partitions available to the Android system.

Conclusion

Fastbootd, running in user space within recovery, implements all native fastboot commands and shares the kernel and libraries with recovery. It uses USB Gadget and block drivers for communication and flash operations. OEM‑specific commands are handled via the [email protected] HAL. Because of its high portability, fastbootd may eventually replace bootloader‑based fastboot implementations, leaving the bootloader only for low‑level flashing.