docs/dev/adb_tradeinmode.md

# Architecture of *ADB Trade-In Mode*

ADB can run in a specialized "trade-in mode" (TIM). This is a highly restricted ADB designed to
faciliate automated diagnostics. It is only activated during the SetUp Wizard (SUW) on user builds.

## Activation flow

The DeviceDiagnostics apk has a `BOOT_COMPLETE` broadcast receiver, which it uses to call into the
tradeinmode service (`ITradeInMode.start`). The service activates trade-in mode if the following
conditions are true:

1. ADB is disabled.
2. `ro.debuggable` is 0 (to avoid breaking userdebug testing).
3. The `USER_SETUP_COMPLETE` setting is 0.
4. The `DEVICE_PROVISIONED` setting is 0.
5. There is no active wifi connection.

If all of these conditions hold, `persist.adb.tradeinmode` is set to `1` and the `ADB_ENABLED`
setting is set to `1`.

When adbd subsequentily starts, it sees `persist.adb.tradeinmode` is set and lowers its SELinux
context to a highly restricted policy (`adb_tradeinmode`).  This policy restricts adbd to
effectively one command: `adb shell tradeinmode`. It also disables authorization.

`ITradeInMode` monitors conditions 3, 4, and 5 above and turns off ADB as soon as any become true.

If the device is rebooted, the persist property ensures that ADB will stay in trade-in mode.

## userdebug testing

On userdebug builds, TIM is not enabled by default since adb is already available. This means the
authorization dialog is still present. However, TIM can still be manually tested with the following
command sequence:
1. `adb root`
2. `adb shell setprop service.adb.tradeinmode 1`
3. `adb unroot`

Unlike user builds, if entering TIM fails, then userdebug adbd will simply restart without TIM
enabled.

## Trade-In Mode commands

When ADB is in trade-in mode (the default in SUW when ro.debuggable is 0), the only allowed command
is `adb shell tradeinmode` plus arguments. On userdebug or eng builds, `adb root` is also allowed.

The tradeinmode shell command has two arguments:
 - `getstatus [-challenge CHALLENGE]`: Returns diagnostic information about the device, optionally
   with an attestation challenge.
 - `evaluate`: Bypasses setup and enters Android in an evaluation mode. A factory reset is forced
   on next boot.

## Evaluation mode

Evaluation mode is entered via `adb shell tradeinmode evaluate`. This changes
`persist.adb.tradeinmode` to `2` and restarts adbd. adbd then starts normally, without trade-in
mode restrictions. However, authorization is disabled. The device is factory reset on next boot.
This mode allows further diagnostics via normal adb commands (such as adb install).

## Factory reset

The factory reset is guaranteed by `ITradeInModeService.enterEvaluationMode` which writes a marker
to `/metadata/tradeinmode/wipe`. If first-stage init sees this file, it immediately reboots into
recovery to issue an unprompted wipe.

## persist.adb.tradeinmode values
 - `-1`: Failed to start TIM.
 - `0`: TIM is not enabled.
 - `1`: TIM is enabled.
 - `2`: "adb shell tradeinmode evaluate" was used, which enables adbd past SUW but
        also guarantees a factory reset on reboot.