Google Silently Removed Mentions of an “HTC Cerberus” from Pixel XL Source Code [Update: More Evidence]

Google's relationship with HTC may have been cozier than they let on

We may earn a commission for purchases made using our links.

Update 5:00PM CST: It has been brought to our attention that there is more evidence regarding HTC’s involvement in the software development of the Pixel devices, see the addendum at the end of the article.

The “Made by Google” motto represents a dramatic shift in Google’s attitude towards Android. Rather than cycle through its various OEM partners to co-produce a Nexus device, Google decided to take tighter control over the entire process of designing and developing their smartphones.

These efforts have resulted in the Google Pixel and Pixel XL which have been heavily marketed as the first pair of ‘true’ Google phones.

But what isn’t mentioned in any Pixel marketing material is the fact that the phones are actually manufactured by HTC. Google is rather adamant that they retained control over both the hardware and software for the new Pixel devices, even going so far as to plaster a large Google logo on the back of the two smartphones. HTC has been relegated to the role of an Original Design Manufacturer (ODM) rather than co-engineering the device with Google. Indeed, it would seem that the working relationship between Google and HTC is akin to that of Apple and Foxconn. What many in the industry have dubbed the ‘iPhone’ of the Android world is thus similar in more ways than just the price.

While Google has contracted HTC to assemble the Pixel phones, Osterloh says the approach is no different than Apple’s partnership with iPhone builder Foxconn. Flip the Pixel over and you’ll see “Made by Google,” another tip of the hat to Apple, which has long made much of the fact that its phones are “Designed by Apple in California.” Osterloh says Google will never say the Pixel is co-engineered with anyone else. He proudly proclaims, “It’s ours.” – Rick Osterloh, chief of Google’s hardware vision, speaking to Bloomberg

This working relationship is not foreign to either party in this mix. Google’s Pixel C was the first “made by Google” device – and you will find absolutely no mention of any OEM partner in any press release, nor will you find any commits from OEM engineers in its source code. On the other hand, HTC has apt experience as an ODM while previously working for the likes of Sony Ericsson among others. Yet, there is some lingering doubt about how involved HTC truly was in the development of the two Pixel phones. The existence of a previously-unnoticed commit by an HTC engineer removing all mentions of an unknown “htc_cerberus” code name (coupled with Senior Recognized Developer Jcase‘s observations on the Pixels’ bootchain) suggests that HTC contributed in some way to the software development of the two Google Pixels.

Laying the Seeds of Doubt

The seeds of doubt about Google’s level of control over the Pixel range has existed since before the phone’s release. The first semi-decent leaked photos of the Pixel lead some Android journalists to speculate that the Pixel’s seemingly large bezels were due to borrowing the HTC One A9’s design. However, Google’s statement that the Pixels’ design are not based on any current HTC device are backed up by the iFixit teardown which revealed no evidence of the phone’s manufacturing origin. Therefore, there’s really no evidence to deny that Google created an original design for the Pixel devices.

But back in early September, David Ruddock of AndroidPolice speculated that the relationship between HTC and Google would be more close-knit than their future marketing would let on. Jean Baptiste Su of Forbes corroborated this claim after the Pixel launch by stating that the only truly fundamental difference between the previous Nexus devices and the current crop of Pixel phones is the lack of any OEM branding. If we were to reconcile the idea that Google was solely responsible for designing the hardware with the claim from the Forbes contributor that HTC’s involvement is similar to that of previous Google-OEM arrangements, then we would have to conclude that HTC would have been involved in the early software development process for the Pixel devices.

‘Cerberus’

If you’ve ever flashed a factory image for one of Google’s Nexus devices, then you’ve probably seen the code name for your Nexus device. Google has given each Nexus device a code name based on a marine animal which serves as an internal moniker for the development team until the company finalizes a name. For the Pixel devices, though, it’s unclear what the naming convention will be given that the sample size is so small. The Pixel C is code named ‘Dragon’ in AOSP (or ‘Ryu’ if you look on the factory image page), for instance, while the Google Pixel and Pixel XL, are code named ‘sailfish‘ and ‘marlin‘ respectively.

The two Pixel smartphones follow the internal naming convention for Google Nexus devices, which makes sense given the timeline of reports that the Nexus program was dead. Though we do not know when exactly Google decided to re-brand the HTC Nexus devices as Google Pixel devices, there is strong support to the notion that Pixel phones began their life as Nexus phones given the reliability of the leaks this cycle and the Pixel code names fitting the Nexus naming convention. Thus, we are assuming that, perhaps for quite a bit of time in the Pixel phones’ development cycle, HTC was involved much like any other OEM was involved with the development of the Nexus devices. There is not much in the way of direct evidence left behind in the software, but circumstantial evidence from two well-known developers backs up our claim.

First up, XDA Recognized Developer Bumble-Bee discovered an interesting commit in Marlin’s source code from the beginning of August. The commit was submitted by an HTC software engineer and it made a single, seemingly inconsequential change – removing the “htc_cerberus” label from the file_contexts file under sepolicy. file_contexts is used to bind a label to a file/directory and can be used by user-space apps. In Marlin’s file_contexts file, we can see that “HTC Cerberus” was a label for one of the A/B partitions on the device. Omitting the label doesn’t seem to affect anything on the device, as the first public release of the Marlin’s source code shows file_contexts without the label. This is speculation on our part, but perhaps this reference to “Cerberus” is related to some internal HTC code name that we are not yet aware of, perhaps a component of the device that was planned to be used or even an unknown device. At the very least, the existence of the commit by an HTC engineer suggests some level of involvement in the software between HTC and Google.

When we first received this information, we were unsure what it could potentially represent. But looking back at a tweet by @jcase (one of the developers behind Sunshine S-Off/Unlock), we started to feel more confident about our argument.

Pixel bootchains appear to be signed by HTC, much HTC code in it. Just like the Nexus devices. — Jon Sawyer (@jcase) October 6, 2016

@jcase was able to look at the bootchain, the process your smartphone uses to boot up, and determined that it was fairly similar to the bootchain from an HTC device. To be more precise, he states that “it’s a standard HTC bootchain with some hardening/changes.” While this claim is mostly conjecture, @jcase’s experience with the bootloaders on HTC devices gives some credence to his case. Plus, the fact that the bootchain seems to be an HTC creation lines up with the idea presented earlier that the Pixel devices were originally being developed as Nexus phones.

“Made by Google”

Google aimed to capture the smartphone market by competing directly with the likes of Samsung and Apple. They’ve picked a perfect time to pick up the mantle of the Android smartphone representative while Samsung is recovering from its Note 7 fiasco. But we’ll have to wait and see whether or not their plan to tackle the iPhone will succeed. Depending on the success of the Pixel and Pixel XL, will Google go all in on the top-down approach they only recently committed to? Or will their partners still play a more closer-role than the company is letting on?

Cerberus image source

Addendum #1: More Evidence Emerges

After publishing this article, we were notified of the existence of 363 additional commits to the Marlin and Sailfish kernels by HTC engineers. Linux kernel developer Scott Bauer, who is well known for discovering and cataloging zero-day exploits on his blog plsdonthack.me, searched the source code for the two devices and discovered the numerous commits made from e-mail addresses belonging to HTC engineers.

[email protected]:~/android/ kernels/git_msm/msm$ git branch * (HEAD detached at origin/android-msm-marlin-3. 18-nougat-dr1) [email protected]:~/android/ kernels/git_msm/msm$ git log | grep "htc" | grep Author | wc -l 363

If Google was indeed solely responsible for the software development of the Pixel devices, then the existence of these commits is perplexing. But if Google was initially developing these devices as Nexus devices, then it shouldn’t be at all surprising to see so many commits by HTC engineers. Of course, none of these revelations have any bearing on the quality of the Pixel devices themselves, but it’s interesting to hear conflicting reports about the development process of the two Pixel phones.