detachables: Test ALL the units!

This patch adds a bunch of new unit tests for the detachable UI and
enhances some of the existing ones to more explicitly check more things.

BRANCH=None
BUG=b:65025540
TEST=make runtests. I actually found a real bug in my previous patch, so
that's nice... and COV=1 make gives me 96.9% of lines covered in
vboot_ui_menu.c, with 28 out of 28 functions touched.

Change-Id: I7737a7e62d4b7e01ea98e6a0f1dd098716582794
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/894292

1 files changed, 1705 insertions, 397 deletions

diff --git a/tests/vboot_detach_menu_tests.c b/tests/vboot_detach_menu_tests.c
index 5917e9cd..6ba879ec 100644
--- a/tests/vboot_detach_menu_tests.c
+++ b/tests/vboot_detach_menu_tests.c
@@ -36,21 +36,25 @@ static struct vb2_shared_data *sd;
 
 static int shutdown_request_calls_left;
 static int audio_looping_calls_left;
-static uint32_t vbtlk_retval;
+static VbError_t vbtlk_retval[5];
+static VbError_t vbtlk_last_retval;
+static int vbtlk_retval_count;
+static const VbError_t vbtlk_retval_fixed = 1002;
 static int vbexlegacy_called;
+static int debug_info_displayed;
 static int trust_ec;
 static int virtdev_set;
 static uint32_t virtdev_retval;
-static uint32_t mock_keypress[32];
-static uint32_t mock_keyflags[32];
+static uint32_t mock_keypress[64];
+static uint32_t mock_keyflags[64];
 static uint32_t mock_keypress_count;
 static uint32_t mock_switches[8];
 static uint32_t mock_switches_count;
 static int mock_switches_are_stuck;
-static uint32_t screens_displayed[32];
+static uint32_t screens_displayed[64];
 static uint32_t screens_count = 0;
-static uint32_t mock_num_disks[8];
-static uint32_t mock_num_disks_count;
+static uint32_t beeps_played[64];
+static uint32_t beeps_count = 0;
 
 extern enum VbEcBootMode_t VbGetMode(void);
 extern struct RollbackSpaceFwmp *VbApiKernelGetFwmp(void);
@@ -62,6 +66,8 @@ static void ResetMocks(void)
 
 	memset(&shared_data, 0, sizeof(shared_data));
 	VbSharedDataInit(shared, sizeof(shared_data));
+	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH |
+			VBSD_BOOT_FIRMWARE_VBOOT2;
 
 	memset(&lkp, 0, sizeof(lkp));
 
@@ -74,16 +80,23 @@ static void ResetMocks(void)
 	sd = vb2_get_sd(&ctx);
 	sd->vbsd = shared;
 
-	shutdown_request_calls_left = -1;
-	audio_looping_calls_left = 30;
-	vbtlk_retval = 1000;
+	/* In recovery we have 50 keyscans per disk scan, this must be high. */
+	shutdown_request_calls_left = 301;
+	audio_looping_calls_left = 60;
 	vbexlegacy_called = 0;
+	debug_info_displayed = 0;
 	trust_ec = 0;
 	virtdev_set = 0;
 	virtdev_retval = 0;
 
+	vbtlk_last_retval = vbtlk_retval_fixed - VB_DISK_FLAG_FIXED;
+	memset(vbtlk_retval, 0, sizeof(vbtlk_retval));
+	vbtlk_retval_count = 0;
+
 	memset(screens_displayed, 0, sizeof(screens_displayed));
 	screens_count = 0;
+	memset(beeps_played, 0, sizeof(beeps_played));
+	beeps_count = 0;
 
 	memset(mock_keypress, 0, sizeof(mock_keypress));
 	memset(mock_keyflags, 0, sizeof(mock_keyflags));
@@ -92,9 +105,22 @@ static void ResetMocks(void)
 	memset(mock_switches, 0, sizeof(mock_switches));
 	mock_switches_count = 0;
 	mock_switches_are_stuck = 0;
+}
 
-	memset(mock_num_disks, 0, sizeof(mock_num_disks));
-	mock_num_disks_count = 0;
+static void ResetMocksForDeveloper(void)
+{
+	ResetMocks();
+	shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
+	VbExEcEnteringMode(0, VB_EC_DEVELOPER);
+	shutdown_request_calls_left = -1;
+}
+
+static void ResetMocksForManualRecovery(void)
+{
+	ResetMocks();
+	shared->flags |= VBSD_BOOT_REC_SWITCH_ON;
+	trust_ec = 1;
+	VbExEcEnteringMode(0, VB_EC_RECOVERY);
 }
 
 /* Mock functions */
@@ -140,26 +166,6 @@ int VbExLegacy(void)
 	return 0;
 }
 
-VbError_t VbExDiskGetInfo(VbDiskInfo **infos_ptr, uint32_t *count,
-                          uint32_t disk_flags)
-{
-	if (mock_num_disks_count < ARRAY_SIZE(mock_num_disks)) {
-		if (mock_num_disks[mock_num_disks_count] == -1)
-			return VBERROR_SIMULATED;
-		else
-			*count = mock_num_disks[mock_num_disks_count++];
-	} else {
-		*count = 0;
-	}
-	return VBERROR_SUCCESS;
-}
-
-VbError_t VbExDiskFreeInfo(VbDiskInfo *infos,
-                           VbExDiskHandle_t preserve_handle)
-{
-	return VBERROR_SUCCESS;
-}
-
 int VbExTrustEC(int devidx)
 {
 	return trust_ec;
@@ -175,9 +181,12 @@ int vb2_audio_looping(void)
 	return 1;
 }
 
-uint32_t VbTryLoadKernel(struct vb2_context *ctx, uint32_t get_info_flags)
+VbError_t VbTryLoadKernel(struct vb2_context *ctx, uint32_t get_info_flags)
 {
-	return vbtlk_retval + get_info_flags;
+	if (vbtlk_retval_count < ARRAY_SIZE(vbtlk_retval) &&
+	    vbtlk_retval[vbtlk_retval_count] != 0)
+		vbtlk_last_retval = vbtlk_retval[vbtlk_retval_count++];
+	return vbtlk_last_retval + get_info_flags;
 }
 
 VbError_t VbDisplayScreen(struct vb2_context *ctx, uint32_t screen, int force)
@@ -185,7 +194,7 @@ VbError_t VbDisplayScreen(struct vb2_context *ctx, uint32_t screen, int force)
 	if (screens_count < ARRAY_SIZE(screens_displayed))
 		screens_displayed[screens_count++] = screen;
 	printf("VbDisplayScreen: screens_displayed[%d] = 0x%x\n",
-	       screens_count, screen);
+	       screens_count - 1, screen);
 	return VBERROR_SUCCESS;
 }
 
@@ -198,12 +207,27 @@ VbError_t VbDisplayMenu(struct vb2_context *ctx, uint32_t screen, int force,
 		printf("Ran out of screens_displayed entries!\n");
 	printf("VbDisplayMenu: screens_displayed[%d] = 0x%x,"
 	       " selected_index = %u, disabled_idx_mask = 0x%x\n",
-	       screens_count, screen,
+	       screens_count - 1, screen,
 	       selected_index, disabled_idx_mask);
 
 	return VBERROR_SUCCESS;
 }
 
+VbError_t VbDisplayDebugInfo(struct vb2_context *ctx)
+{
+	debug_info_displayed = 1;
+	return VBERROR_SUCCESS;
+}
+
+VbError_t VbExBeep(uint32_t msec, uint32_t frequency)
+{
+	if (beeps_count < ARRAY_SIZE(beeps_played))
+		beeps_played[beeps_count++] = frequency;
+	printf("VbExBeep: beeps_played[%d] = %dHz for %dms\n",
+	       beeps_count - 1, frequency, msec);
+	return VBERROR_SUCCESS;
+}
+
 uint32_t SetVirtualDevMode(int val)
 {
 	virtdev_set = val;
@@ -216,109 +240,252 @@ static void VbBootTest(void)
 {
 	ResetMocks();
 	VbExEcEnteringMode(0, VB_EC_NORMAL);
-	TEST_EQ(VbBootNormal(&ctx), 1002, "VbBootNormal()");
+	TEST_EQ(VbBootNormal(&ctx), vbtlk_retval_fixed, "VbBootNormal()");
 	TEST_EQ(VbGetMode(), VB_EC_NORMAL, "vboot_mode normal");
 }
 
 static void VbBootDevTest(void)
 {
+	int i;
+
 	printf("Testing VbBootDeveloperMenu()...\n");
 
 	/* Proceed after timeout */
-	ResetMocks();
-	VbExEcEnteringMode(0, VB_EC_DEVELOPER);
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Timeout");
+	ResetMocksForDeveloper();
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed, "Timeout");
 	TEST_EQ(VbGetMode(), VB_EC_DEVELOPER, "vboot_mode developer");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
 	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0,
 		"  recovery reason");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 0, "  no beeps on normal boot");
 
 	/* Proceed to legacy after timeout if GBB flag set */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	sd->gbb_flags |= GBB_FLAG_DEFAULT_DEV_BOOT_LEGACY |
 		     GBB_FLAG_FORCE_DEV_BOOT_LEGACY;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Timeout");
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"default legacy GBB");
 	TEST_EQ(vbexlegacy_called, 1, "  try legacy");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 1, "  error beep: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
 	/* Proceed to legacy after timeout if boot legacy and default boot
 	 * legacy are set */
-	ResetMocks();
-	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT,
-		   VB2_DEV_DEFAULT_BOOT_LEGACY);
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_LEGACY);
 	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_LEGACY, 1);
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Timeout");
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"default legacy NV");
 	TEST_EQ(vbexlegacy_called, 1, "  try legacy");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 1, "  error beep: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
 	/* Proceed to legacy boot mode only if enabled */
-	ResetMocks();
-	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT,
-		   VB2_DEV_DEFAULT_BOOT_LEGACY);
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Timeout");
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_LEGACY);
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"default legacy not enabled");
 	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 2, "  error beeps: legacy boot not enabled");
+	TEST_EQ(beeps_played[0], 400, "    first error beep");
+	TEST_EQ(beeps_played[1], 400, "    second error beep");
 
 	/* Proceed to usb after timeout if boot usb and default boot
 	 * usb are set */
-	ResetMocks();
-	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT,
-		   VB2_DEV_DEFAULT_BOOT_USB);
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
 	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
-	vbtlk_retval = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
 	TEST_EQ(VbBootDeveloperMenu(&ctx), 0, "Ctrl+U USB");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
 
 	/* Proceed to usb boot mode only if enabled */
-	ResetMocks();
-	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT,
-		   VB2_DEV_DEFAULT_BOOT_USB);
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Timeout");
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"default USB not enabled");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 2, "  error beeps: USB boot not enabled");
+	TEST_EQ(beeps_played[0], 400, "    first error beep");
+	TEST_EQ(beeps_played[1], 400, "    second error beep");
 
 	/* If no USB tries fixed disk */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
-	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT,
-		   VB2_DEV_DEFAULT_BOOT_USB);
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Ctrl+U enabled");
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"default USB with no disk");
 	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 1, "  error beep: USB not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
 	/* Shutdown requested in loop */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	shutdown_request_calls_left = 2;
-	TEST_EQ(VbBootDeveloperMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
 		"Shutdown requested");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
 	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
-#if 0
-	/* Space goes straight to recovery if no virtual dev switch */
-	ResetMocks();
-	mock_keypress[0] = ' ';
-	TEST_EQ(VbBootDeveloperMenu(&ctx),
-		VBERROR_LOAD_KERNEL_RECOVERY,
-		"Space = recovery");
-	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST),
-		VB2_RECOVERY_RW_DEV_SCREEN, "  recovery reason");
-#endif
 	/*
 	 * Pushing power should shut down the DUT because default
 	 * selection is power off
 	 */
-	ResetMocks();
-	mock_keypress[0] = 0x90; // power button
-	TEST_EQ(VbBootDeveloperMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
+	ResetMocksForDeveloper();
+	mock_keypress[0] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
 		"dev warning menu: default to power off");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* Selecting Power Off in developer options. */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Power Off
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Power Off in DEVELOPER");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
+
+	/* Pressing ENTER is equivalent to power button. */
+	ResetMocksForDeveloper();
+	mock_keypress[0] = '\r';
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"dev warning menu: ENTER is power button");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* ENTER functionality is unaffected by GBB flag in detachable UI. */
+	ResetMocksForDeveloper();
+	sd->gbb_flags |= GBB_FLAG_ENTER_TRIGGERS_TONORM;
+	mock_keypress[0] = '\r';
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"dev warning menu: ENTER unaffected by GBB");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* Pressing SPACE or VolUp+Down combo has no effect in dev mode */
+	ResetMocksForDeveloper();
+	mock_keypress[0] = ' ';
+	mock_keypress[1] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS;
+	mock_keypress[2] = VB_BUTTON_POWER_SHORT_PRESS;	// select Power Off
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"SPACE or VolUp+Down have no effect");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
 	/* Disable developer mode */
-	ResetMocks();
-	shared->flags = VBSD_BOOT_DEV_SWITCH_ON;
-	mock_keypress[0] = 0x62; // volume up
-	mock_keypress[1] = 0x90; // power button
-	mock_keypress[2] = 0x90; // power button
+	ResetMocksForDeveloper();
+	shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS;
+	mock_keypress[1] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[2] = VB_BUTTON_POWER_SHORT_PRESS;
 	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_REBOOT_REQUIRED,
 		"disable developer mode");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  warning screen");
 	TEST_EQ(screens_displayed[1], VB_SCREEN_DEVELOPER_WARNING_MENU,
@@ -327,207 +494,744 @@ static void VbBootDevTest(void)
 		"  tonorm screen");
 	TEST_EQ(screens_displayed[3], VB_SCREEN_TO_NORM_CONFIRMED,
 		"  confirm screen");
+	TEST_EQ(screens_displayed[4], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 5, "  no extra screens");
 	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_DISABLE_DEV_REQUEST), 1,
 		"  disable dev request");
-
-#if 0
-	/* Space-space doesn't disable it */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_DEV_SWITCH_ON;
-	mock_keypress[0] = ' ';
-	mock_keypress[1] = ' ';
-	mock_keypress[2] = 0x1b;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Space-space");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
-		"  warning screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
-		"  tonorm screen");
-	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
-		"  warning screen");
-
-	/* Enter doesn't by default */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_DEV_SWITCH_ON;
-	mock_keypress[0] = '\r';
-	mock_keypress[1] = '\r';
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Enter ignored");
-
-	/* Enter does if GBB flag set */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_DEV_SWITCH_ON;
-	sd->gbb_flags |= GBB_FLAG_ENTER_TRIGGERS_TONORM;
-	mock_keypress[0] = '\r';
-	mock_keypress[1] = '\r';
-	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_REBOOT_REQUIRED,
-		"Enter = tonorm");
-#endif
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on reboot");
 
 	/* Tonorm ignored if GBB forces dev switch on */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_DEV_SWITCH_ON;
+	ResetMocksForDeveloper();
+	shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
 	sd->gbb_flags |= GBB_FLAG_FORCE_DEV_SWITCH_ON;
-	mock_keypress[0] = 0x62; // volume up
-	mock_keypress[1] = 0x90; // power
-	mock_keypress[2] = 0x90; // power
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002,
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS;
+	mock_keypress[1] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[2] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
 		"Can't tonorm gbb-dev");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  warning screen: power off");
 	TEST_EQ(screens_displayed[1], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  wanring screen: enable verification");
 	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
 		"  tonorm screen: confirm");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK,
+		"  blank (error flash)");
+	TEST_EQ(screens_displayed[4], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen: confirm");
+	TEST_EQ(screens_displayed[5], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 6, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timeout");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
 
 	/* Shutdown requested at tonorm screen */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_DEV_SWITCH_ON;
-	mock_keypress[0] = 0x62; // volume up
-	mock_keypress[1] = 0x90; // power
+	ResetMocksForDeveloper();
+	shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS;
+	mock_keypress[1] = VB_BUTTON_POWER_SHORT_PRESS;
 	shutdown_request_calls_left = 2;
-	TEST_EQ(VbBootDeveloperMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
 		"Shutdown requested at tonorm");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		" developer warning screen: power off");
 	TEST_EQ(screens_displayed[1], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  developer warning screen: enable root verification");
 	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
 		"  developer warning screen: power off");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on shutdown");
 
 	/* Ctrl+D dismisses warning */
-	ResetMocks();
-	mock_keypress[0] = 0x04;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Ctrl+D");
+	ResetMocksForDeveloper();
+	mock_keypress[0] = 'D' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed, "Ctrl+D");
 	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0,
 		"  recovery reason");
 	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
 	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on normal boot");
 
 	/* Ctrl+D doesn't boot legacy even if GBB flag is set */
-	ResetMocks();
-	mock_keypress[0] = 0x04;
+	ResetMocksForDeveloper();
+	mock_keypress[0] = 'D' & 0x1f;
 	sd->gbb_flags |= GBB_FLAG_DEFAULT_DEV_BOOT_LEGACY;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Ctrl+D");
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed, "Ctrl+D");
 	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
 
-	/* Ctrl+L tries legacy boot mode only if enabled */
-	ResetMocks();
-	mock_keypress[0] = 0x0c;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Ctrl+L normal");
+	/* Volume-down long press shortcut acts like Ctrl+D */
+	ResetMocksForDeveloper();
+	mock_keypress[0] = VB_BUTTON_VOL_DOWN_LONG_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"VolDown long press");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0,
+		"  recovery reason");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
 	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on normal boot");
 
-#if 0
-	ResetMocks();
+	/* Ctrl+L tries legacy boot mode only if enabled */
+	ResetMocksForDeveloper();
+	mock_keypress[0] = 'L' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed, "Ctrl+L normal");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timed out");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
+
+	/* Ctrl+L boots legacy if enabled by GBB flag */
+	ResetMocksForDeveloper();
 	sd->gbb_flags |= GBB_FLAG_FORCE_DEV_BOOT_LEGACY;
-	mock_keypress[0] = 0x0c;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002,
+	mock_keypress[0] = 'L' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
 		"Ctrl+L force legacy");
 	TEST_EQ(vbexlegacy_called, 1, "  try legacy");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
-	ResetMocks();
+	/* Ctrl+L boots legacy if enabled by NVRAM */
+	ResetMocksForDeveloper();
 	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_LEGACY, 1);
-	mock_keypress[0] = 0x0c;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002,
+	mock_keypress[0] = 'L' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
 		"Ctrl+L nv legacy");
 	TEST_EQ(vbexlegacy_called, 1, "  try legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
-	ResetMocks();
+	/* Ctrl+L boots legacy if enabled by FWMP */
+	ResetMocksForDeveloper();
 	VbApiKernelGetFwmp()->flags |= FWMP_DEV_ENABLE_LEGACY;
-	mock_keypress[0] = 0x0c;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002,
+	mock_keypress[0] = 'L' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
 		"Ctrl+L fwmp legacy");
 	TEST_EQ(vbexlegacy_called, 1, "  fwmp legacy");
-#endif
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
 	/* Ctrl+U boots USB only if enabled */
-	ResetMocks();
-	mock_keypress[0] = 0x15;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Ctrl+U normal");
+	ResetMocksForDeveloper();
+	mock_keypress[0] = 'U' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Ctrl+U not enabled");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timed out");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
 
 	/* Ctrl+U enabled, with good USB boot */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
-	mock_keypress[0] = 0x15;
-	vbtlk_retval = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 0, "Ctrl+U USB");
+	mock_keypress[0] = 'U' & 0x1f;
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS, "Ctrl+U USB");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
+
+	/* Ctrl+U enabled, without valid USB */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	mock_keypress[0] = 'U' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Ctrl+U without valid USB");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 1, "  error beep: USB not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
 
 	/* Ctrl+U enabled via GBB */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	sd->gbb_flags |= GBB_FLAG_FORCE_DEV_BOOT_USB;
 	mock_keypress[0] = 0x15;
-	vbtlk_retval = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 0, "Ctrl+U force USB");
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS, "Ctrl+U force USB");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
 
 	/* Ctrl+U enabled via FWMP */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	VbApiKernelGetFwmp()->flags |= FWMP_DEV_ENABLE_USB;
 	mock_keypress[0] = 0x15;
-	vbtlk_retval = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 0, "Ctrl+U force USB");
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS, "Ctrl+U force USB");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
 
-	/* Now go to USB boot through menus */
-	ResetMocks();
-	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT,
-		   VB2_DEV_DEFAULT_BOOT_USB);
-	mock_keypress[1] = 0x62; // volume up: Enable Root Verification
-	mock_keypress[2] = 0x62; // volume up: Show Debug Info
-	mock_keypress[3] = 0x62; // volume up: Developer Options
-	mock_keypress[4] = 0x90; // power button
-	mock_keypress[5] = 0x90; // power button: default to USB boot
-	// NOTE: need to check the return value of this....
-	VbBootDeveloperMenu(&ctx);
-	/* TEST_EQ(VbBootDeveloperMenu(&ctx), */
-	/* 	VBERROR_SHUTDOWN_REQUESTED, */
-	/* 	"go through menu to USB boot"); */
+	/* If no valid USB, eventually times out and tries fixed disk */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	mock_keypress[0] = 'U' & 0x1f;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Ctrl+U failed - no USB");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: USB not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
+
+	/* Now go to USB boot through menus */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS,
+		"Menu selected USB boot");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  dev warning menu: enable root verification");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_DEVELOPER_WARNING_MENU,
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  dev warning menu: show debug info");
-	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  dev warning menu: developer options");
-	TEST_EQ(screens_displayed[3], VB_SCREEN_DEVELOPER_WARNING_MENU,
-		"  power button");
-	TEST_EQ(screens_displayed[4], VB_SCREEN_DEVELOPER_MENU,
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
 		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
 
-	/* If no USB, eventually times out and tries fixed disk */
-	ResetMocks();
+	/* If default USB, the option is preselected */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_USB);
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
 	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
-	mock_keypress[0] = 0x15;
-	TEST_EQ(VbBootDeveloperMenu(&ctx), 1002, "Ctrl+U enabled");
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS,
+		"Menu selected USB default boot");
 	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
-	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0,
-		"  recovery reason");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
+
+	/* If invalid USB, we still timeout after selecting it in menu */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Menu selected invalid USB boot");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: USB not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
+
+	/* If USB is disabled, we error flash/beep from the menu option */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Menu selected disabled USB boot");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
+
+	/* Boot Legacy via menu and default */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_LEGACY, 1);
+	vb2_nv_set(&ctx, VB2_NV_DEV_DEFAULT_BOOT, VB2_DEV_DEFAULT_BOOT_LEGACY);
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Menu selected legacy boot");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vbexlegacy_called, 2, "  tried legacy boot twice");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timeout");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  two error beeps: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
+	TEST_EQ(beeps_played[1], 200, "    low-frequency error beep");
+
+	/* Refuse to boot legacy via menu if not enabled */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot Legacy BIOS
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Menu selected legacy boot when not enabled");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vbexlegacy_called, 0, "  did not attempt legacy boot");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timeout");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
+
+	/* Use volume-up long press shortcut to boot USB */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	mock_keypress[0] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS, "VolUp USB");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
+
+	/* Can boot a valid USB image after failing to boot invalid image */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	mock_keypress[0] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	mock_keypress[1] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	vbtlk_retval[0] = VBERROR_SIMULATED - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS,
+		"VolUp USB valid after invalid");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: first USB invalid");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
+
+	/* Volume-up long press only works if USB is enabled */
+	ResetMocksForDeveloper();
+	mock_keypress[0] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"VolUp not enabled");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timed out");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
+
+	/* Volume-up long press without valid USB will still time out */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	mock_keypress[0] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"VolUp without valid USB");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  blank (error flash)");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  warning screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
 	TEST_EQ(audio_looping_calls_left, 0, "  used up audio");
+	TEST_EQ(beeps_count, 1, "  error beep: USB not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
+
+	/* Volume-up long press works from other menus, like LANGUAGE */
+	ResetMocksForDeveloper();
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_USB, 1);
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Power Off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SUCCESS,
+		"VolUp USB from LANGUAGE");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_LANGUAGES_MENU,
+		"  language menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on USB boot");
+
+	/* Can disable developer mode through TONORM screen */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enable os verification
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // confirm is the default
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_REBOOT_REQUIRED,
+		"TONORM via menu");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_DISABLE_DEV_REQUEST), 1,
+		"  disable dev request");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning: enable os verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm: confirm");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_TO_NORM_CONFIRMED,
+		"  confirm screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps on reboot");
 
 	/* If dev mode is disabled, goes to TONORM screen repeatedly */
-	ResetMocks();
+	ResetMocksForDeveloper();
 	VbApiKernelGetFwmp()->flags |= FWMP_DEV_DISABLE_BOOT;
-	mock_keypress[0] = 0x04;  /* Just stays on TONORM and flashes screen */
-	mock_keypress[1] = '\r';
+	audio_looping_calls_left = 1;	/* Confirm audio doesn't tick down. */
+	i = 0;
+	mock_keypress[i++] = 'D' & 0x1f;  /* Just stays on TONORM and flashes */
+	mock_keypress[i++] = 'U' & 0x1f;  /* same */
+	mock_keypress[i++] = 'L' & 0x1f;  /* same */
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_LONG_PRESS;	/* same */
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_LONG_PRESS;	/* same */
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS;	/* noop */
+	mock_keypress[i++] = '\r';
 	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_REBOOT_REQUIRED,
 		"FWMP dev disabled");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_DISABLE_DEV_REQUEST), 1,
+		"  disable dev request");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
 		"  tonorm screen");
-	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK,
-		"  screen flash");
-	TEST_EQ(screens_displayed[2], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
 		"  tonorm screen");
-	TEST_EQ(screens_displayed[3], VB_SCREEN_TO_NORM_CONFIRMED,
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_TO_NORM_CONFIRMED,
 		"  confirm screen");
-	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_DISABLE_DEV_REQUEST), 1,
-		"  disable dev request");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 10, "  5 * 2 error beeps: booting not allowed");
+	TEST_EQ(beeps_played[0], 400, "    first error beep");
+	TEST_EQ(beeps_played[1], 400, "    second error beep");
+	TEST_EQ(beeps_played[2], 400, "    first error beep");
+	TEST_EQ(beeps_played[3], 400, "    second error beep");
+	TEST_EQ(beeps_played[4], 400, "    first error beep");
+	TEST_EQ(beeps_played[5], 400, "    second error beep");
+	TEST_EQ(beeps_played[6], 400, "    first error beep");
+	TEST_EQ(beeps_played[7], 400, "    second error beep");
+	TEST_EQ(beeps_played[8], 400, "    first error beep");
+	TEST_EQ(beeps_played[9], 400, "    second error beep");
 
 	/* Shutdown requested when dev disabled */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_DEV_SWITCH_ON;
+	ResetMocksForDeveloper();
 	VbApiKernelGetFwmp()->flags |= FWMP_DEV_DISABLE_BOOT;
 	shutdown_request_calls_left = 1;
-	TEST_EQ(VbBootDeveloperMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
 		"Shutdown requested when dev disabled");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_DISABLE_DEV_REQUEST), 0,
+		"  did not exit dev mode");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
 		"  tonorm screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* Explicit Power Off when dev disabled */
+	ResetMocksForDeveloper();
+	VbApiKernelGetFwmp()->flags |= FWMP_DEV_DISABLE_BOOT;
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS;	// Power Off
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Power Off when dev disabled");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_DISABLE_DEV_REQUEST), 0,
+		"  did not exit dev mode");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(audio_looping_calls_left, 0, "  aborts audio");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen: confirm enabling OS verification");
+	/* Cancel option is removed with dev_disable_boot! */
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  tonorm screen: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps for power off");
+
+	/* Show Debug Info displays debug info, then times out to boot */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS Verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"Show Debug Info");
+	TEST_EQ(debug_info_displayed, 1, "  debug info displayed");
+	TEST_EQ(vbexlegacy_called, 0, "  not legacy");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timed out");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps for debug info");
 
 	printf("...done.\n");
 }
@@ -538,169 +1242,292 @@ static void VbBootRecTest(void)
 
 	printf("Testing VbBootRecoveryMenu()...\n");
 
-	/* Shutdown requested in loop */
+	/* Shutdown requested in BROKEN */
 	ResetMocks();
-	shutdown_request_calls_left = 10;
 	VbExEcEnteringMode(0, VB_EC_RECOVERY);
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Shutdown requested");
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shutdown requested in BROKEN");
 	TEST_EQ(VbGetMode(), VB_EC_RECOVERY, "vboot_mode recovery");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
-	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0,
-		"  recovery reason");
+	/* BROKEN screen with disks inserted */
+	ResetMocks();
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[2] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[3] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shutdown requested in BROKEN with disks");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
 		"  broken screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
-	/* Remove disks */
+	/* BROKEN screen with disks on second attempt */
 	ResetMocks();
-	shutdown_request_calls_left = 100;
-	mock_num_disks[0] = 1;
-	mock_num_disks[1] = 1;
-	mock_num_disks[2] = 1;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Remove");
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shutdown requested in BROKEN with later disk");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
 		"  broken screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
-	/* No removal if dev switch is on */
+	/* go to INSERT if dev switch is on */
 	ResetMocks();
-	shutdown_request_calls_left = 100;
-	mock_num_disks[0] = 1;
-	mock_num_disks[1] = 1;
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
 	shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"No remove in dev");
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shutdown requested in INSERT with dev switch");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
 		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
-	/* No removal if recovery button physically pressed */
-	ResetMocks();
-	shutdown_request_calls_left = 100;
-	mock_num_disks[0] = 1;
-	mock_num_disks[1] = 1;
-	shared->flags |= VBSD_BOOT_REC_SWITCH_ON;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"No remove in rec");
-	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
-		"  broken screen");
-
-	/* Removal if no disk initially found, but found on second attempt */
-	ResetMocks();
-	shutdown_request_calls_left = 100;
-	mock_num_disks[0] = 0;
-	mock_num_disks[1] = 1;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Remove");
+	/* go to INSERT if recovery button physically pressed and EC trusted */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shutdown requested in INSERT with manual rec");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* Stay at BROKEN if recovery button not physically pressed */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	shared->flags &= ~VBSD_BOOT_REC_SWITCH_ON;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Go to BROKEN if recovery not manually requested");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
 		"  broken screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
-	/* Bad disk count doesn't require removal */
-	ResetMocks();
-	shutdown_request_calls_left = 100;
-	mock_num_disks[0] = -1;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	shutdown_request_calls_left = 10;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Bad disk count");
+	/* Stay at BROKEN if EC is untrusted */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	trust_ec = 0;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Go to BROKEN if EC is not trusted");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
 		"  broken screen");
-
-#if 0
-	/* Ctrl+D ignored for many reasons.  Should always be ignored
-	   in recovery for detachables. */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_REC_SWITCH_ON;
-	shutdown_request_calls_left = 100;
-	mock_keypress[0] = 0x04;
-	trust_ec = 0;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Ctrl+D ignored if EC not trusted");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* INSERT boots without screens if we have a valid image on first try */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_SIMULATED - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SUCCESS,
+		"INSERT boots without screens if valid on first try");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
-	TEST_NEQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
-		 "  todev screen");
-
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_REC_SWITCH_ON |
-		VBSD_BOOT_DEV_SWITCH_ON;
-	trust_ec = 1;
-	shutdown_request_calls_left = 100;
-	mock_keypress[0] = 0x04;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Ctrl+D ignored if already in dev mode");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 1, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* INSERT boots eventually if we get a valid image later */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[2] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[3] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[4] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SUCCESS,
+		"INSERT boots after valid image appears");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
-	TEST_NEQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
-		 "  todev screen");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
+
+	/* invalid image, then remove, then valid image */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_SIMULATED - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[2] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[3] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[4] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SUCCESS,
+		"INSERT boots after valid image appears");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 3, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep on shutdown");
 
+	/* Shortcuts that are always ignored in BROKEN for detachables. */
 	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH;
-	trust_ec = 1;
-	shutdown_request_calls_left = 100;
-	mock_keypress[0] = 0x04;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Ctrl+D ignored if recovery not manually triggered");
+	i = 0;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = 'D' & 0x1f;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = 'U' & 0x1f;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = 'L' & 0x1f;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_LONG_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shortcuts ignored in BROKEN");
 	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
-	TEST_NEQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
-		 "  todev screen");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep from invalid keys");
 
-	ResetMocks();
-	shared->flags = VBSD_BOOT_REC_SWITCH_ON;
-	trust_ec = 1;
-	shutdown_request_calls_left = 100;
-	mock_keypress[0] = 0x04;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Ctrl+D ignored if no virtual dev switch");
+	/* Shortcuts that are always ignored in INSERT for detachables. */
+	ResetMocksForManualRecovery();
+	i = 0;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = 'D' & 0x1f;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = 'U' & 0x1f;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = 'L' & 0x1f;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_LONG_PRESS;
+	mock_keypress[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_LONG_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Shortcuts ignored in INSERT");
 	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
-	TEST_NEQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
-		 "  todev screen");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 2, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep from invalid keys");
 
-	/* Ctrl+D ignored because the physical recovery switch is still pressed
-	 * and we don't like that.
-	 */
+	/* Power Off BROKEN through OPTIONS menu */
 	ResetMocks();
-	shared->flags = VBSD_BOOT_REC_SWITCH_ON;
-	trust_ec = 1;
-	shutdown_request_calls_left = 100;
-	mock_keypress[0] = 0x04;
-	mock_switches[0] = VB_INIT_FLAG_REC_BUTTON_PRESSED;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
-		"Ctrl+D ignored if phys rec button is still pressed");
-	TEST_NEQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
-		 "  todev screen");
-#endif
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter options
+	mock_keypress[1] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[2] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Power Off BROKEN through OPTIONS");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_OPTIONS_MENU,
+		"  options: cancel");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_OPTIONS_MENU,
+		"  options: power off");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep from power off");
+
+	/* Power Off NOGOOD through OPTIONS menu */
+	ResetMocksForManualRecovery();
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter options
+	mock_keypress[1] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[2] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Power Off NOGOOD through OPTIONS");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_OPTIONS_MENU,
+		"  options: cancel");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_OPTIONS_MENU,
+		"  options: power off");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep from power off");
+
+	/* Power Off INSERT through TO_DEV menu */
+	ResetMocksForManualRecovery();
+	mock_keyflags[0] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[0] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter to_dev
+	mock_keyflags[1] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[1] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[2] = VB_BUTTON_POWER_SHORT_PRESS;
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Power Off INSERT through TO_DEV");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  to_dev: cancel");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  to_dev: power off");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 4, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beep from power off");
 
 	/* Navigate to confirm dev mode selection and then cancel */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_REC_SWITCH_ON;
-	shutdown_request_calls_left = 100;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	trust_ec = 1;
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
 	i = 0;
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x93; // volume up/down combo to enter TO_DEV
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter TO_DEV
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x62; // volume up: confirm disabling
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // confirm disabling
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x63; // volume down: cancel
-	mock_keypress[i++] = 0x90; // power button
-	mock_keypress[i++] = 0x90; // power button
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_SHUTDOWN_REQUESTED,
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // power off
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
 		"go to TO_DEV screen and cancel");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
 	i = 0;
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_INSERT,
 		"  insert screen");
@@ -712,22 +1539,24 @@ static void VbBootRecTest(void)
 		"  recovery to_dev menu: cancel");
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_INSERT,
 		"  back to insert screen");
-	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
 
 	/* Navigate to confirm dev mode selection and then confirm */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_REC_SWITCH_ON;
-	shutdown_request_calls_left = 100;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	trust_ec = 1;
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
 	i = 0;
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x93; // volume up/down to enter to_dev
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter to_dev
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x62; // volume up
-	mock_keypress[i++] = 0x90; // power button
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
 	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_REBOOT_REQUIRED,
 		"go to TO_DEV screen and confirm");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(virtdev_set, 1, "  virtual dev mode on");
 	i = 0;
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_INSERT,
 		"  insert screen");
@@ -735,23 +1564,189 @@ static void VbBootRecTest(void)
 		"  recovery to_dev menu: cancel");
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
 		"  recovery to_dev menu: confirm disabling os verification");
-	TEST_EQ(virtdev_set, 1, "  virtual dev mode on");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* Untrusted keyboard cannot enter TO_DEV (must be malicious anyway) */
+	ResetMocksForManualRecovery();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // try to_dev
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // try confirm
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Untrusted keyboard cannot enter TO_DEV");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(shutdown_request_calls_left, 0, "  timed out");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* Untrusted keyboard cannot navigate in TO_DEV menu if already there */
+	ResetMocksForManualRecovery();
+	i = 0;
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter to_dev
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // try to confirm...
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Untrusted keyboard cannot navigate in TO_DEV");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(shutdown_request_calls_left, 0, "  timed out");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
 
-#if 0
 	/* Handle TPM error in enabling dev mode */
-	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_REC_SWITCH_ON;
-	shutdown_request_calls_left = 100;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	trust_ec = 1;
-	mock_keypress[0] = 0x04;
-	mock_keypress[1] = '\r';
-	mock_keyflags[1] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	ResetMocksForManualRecovery();
+	i = 0;
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter to_dev
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // confirm enabling
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
 	virtdev_retval = VBERROR_SIMULATED;
-	TEST_EQ(VbBootRecoveryMenu(&ctx),
-		VBERROR_TPM_SET_BOOT_MODE_STATE,
-		"Ctrl+D todev failure");
-#endif
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_TPM_SET_BOOT_MODE_STATE,
+		"todev TPM failure");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  aborted explicitly");
+	TEST_EQ(virtdev_set, 1, "  virtual dev mode on");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  recovery to_dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  recovery to_dev menu: confirm disabling os verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* Cannot enable dev mode if already enabled. */
+	ResetMocksForManualRecovery();
+	shared->flags |= VBSD_BOOT_DEV_SWITCH_ON;
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	i = 0;
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter to_dev
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Ctrl+D ignored if already in dev mode");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(shutdown_request_calls_left, 0, "  timed out");
+	TEST_EQ(virtdev_set, 0, "  virtual dev mode wasn't enabled again");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 2, "  played error beeps");
+	TEST_EQ(beeps_played[0], 400, "    first beep");
+	TEST_EQ(beeps_played[1], 400, "    second beep");
+
+	/* Removing invalid USB drops back to INSERT from TO_DEV menu. */
+	ResetMocksForManualRecovery();
+	mock_keyflags[0] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[0] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter TO_DEV
+	/* asynchronous transition to INSERT before keypress[50] */
+	mock_keypress[55] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	mock_keypress[56] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[57] = VB_BUTTON_POWER_SHORT_PRESS;
+	vbtlk_retval[0] = VBERROR_SIMULATED - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Drop back to INSERT from TO_DEV when removing invalid USB");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev menu");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: cancel");
+	TEST_EQ(screens_displayed[4], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: power off");
+	TEST_EQ(screens_displayed[5], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 6, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* Plugging in invalid USB drops back to NOGOOD from LANGUAGE. */
+	ResetMocksForManualRecovery();
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	mock_keypress[1] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[2] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[3] = VB_BUTTON_POWER_SHORT_PRESS;
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_SIMULATED - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"Drop back to NOGOOD from LANGUAGE when inserting invalid USB");
+	TEST_EQ(shutdown_request_calls_left, 0, "  timed out");
+	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: cancel");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: power off");
+	TEST_EQ(screens_displayed[3], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: language");
+	TEST_EQ(screens_displayed[4], VB_SCREEN_LANGUAGES_MENU,
+		"  languages menu");
+	TEST_EQ(screens_displayed[5], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[6], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 7, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* Plugging in valid USB boots straight from OPTIONS menu. */
+	ResetMocksForManualRecovery();
+	mock_keypress[0] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	vbtlk_retval[1] = VBERROR_SUCCESS - VB_DISK_FLAG_REMOVABLE;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SUCCESS,
+		"Boot by plugging in USB straight from OPTIONS menu");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  booted explicitly");
+	TEST_EQ(virtdev_set, 0, "  virtual dev mode off");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_EQ(screens_displayed[0], VB_SCREEN_RECOVERY_INSERT,
+		"  insert screen");
+	TEST_EQ(screens_displayed[1], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: cancel");
+	TEST_EQ(screens_displayed[2], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, 3, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
 
 	printf("...done.\n");
 }
@@ -762,35 +1757,67 @@ static void VbTestLanguageMenu(void)
 
 	printf("Testing VbTestLanguageMenu()...\n");
 
-	/* Navigate to all language menus from recovery */
+	/* Navigate to language menu from BROKEN */
 	ResetMocks();
-	shared->flags = VBSD_HONOR_VIRT_DEV_SWITCH | VBSD_BOOT_REC_SWITCH_ON;
-	shutdown_request_calls_left = 100;
-	vbtlk_retval = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
-	trust_ec = 1;
 	i = 0;
-	mock_keypress[i++] = 0x62; // volume up to enter OPTIONS
-	mock_keypress[i++] = 0x63; // volume down: power off
-	mock_keypress[i++] = 0x63; // volume down: languages
-	mock_keypress[i++] = 0x90; // power button
-	mock_keypress[i++] = 0x90; // power button: select current language
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // languages
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // enter languages
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // cancel -> BROKEN
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // power off
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"go to language menu from BROKEN");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_LANGUAGES_MENU,
+		"  language menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OS_BROKEN,
+		"  broken screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* Navigate to all language menus from recovery */
+	ResetMocksForManualRecovery();
+	vbtlk_retval[0] = VBERROR_NO_DISK_FOUND - VB_DISK_FLAG_REMOVABLE;
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // languages
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x93; // volume up/down combo to enter TO_DEV
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter TO_DEV
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x62; // volume up: confirm disabling os verification
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // confirm disabling
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x63; // volume down: cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x63; // volume down: power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x63; // volume down: language
-	mock_keypress[i++] = 0x90; // power button: select language
-	mock_keypress[i++] = 0x90; // power button: select current language to go back
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
 	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
-	mock_keypress[i++] = 0x63; // volume down: power off
-	mock_keypress[i++] = 0x90; // power button: select power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
 	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
-		"go to language menu");
+		"go to language menus from INSERT");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
 	i = 0;
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_INSERT,
 		"  insert screen");
@@ -820,38 +1847,42 @@ static void VbTestLanguageMenu(void)
 		"  to dev menu: cancel");
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
 		"  to dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
 
 	/* Navigate to all language menus from developer menu */
-	ResetMocks();
-	i = 0;
-	shared->flags = VBSD_BOOT_DEV_SWITCH_ON;
-	mock_keypress[i++] = 0x63; // volume down: language
-	mock_keypress[i++] = 0x90; // power button: select language
-	mock_keypress[i++] = 0x90; // power button: select current language
-	mock_keypress[i++] = 0x62; // volume up: enable root verification
-	mock_keypress[i++] = 0x90; // power button: select enable root verification
-	mock_keypress[i++] = 0x63; // volume down: cancel
-	mock_keypress[i++] = 0x63; // volume down: power off
-	mock_keypress[i++] = 0x63; // volume down: language
-	mock_keypress[i++] = 0x90; // power button: select language
-	mock_keypress[i++] = 0x90; // power button: select current language
-	mock_keypress[i++] = 0x63; // volume down: cancel
-	mock_keypress[i++] = 0x90; // power button: return to dev warning screen
-	mock_keypress[i++] = 0x62; // volume up: enable root verification
-	mock_keypress[i++] = 0x62; // volume up: show debug info
-	mock_keypress[i++] = 0x62; // volume up: developer options
-	mock_keypress[i++] = 0x90; // power button: select developer options
-	mock_keypress[i++] = 0x63; // volume down: cancel
-	mock_keypress[i++] = 0x63; // volume down: power off
-	mock_keypress[i++] = 0x63; // volume down: language
-	mock_keypress[i++] = 0x90; // power button: select language
-	mock_keypress[i++] = 0x90; // power button: select current language
-	mock_keypress[i++] = 0x63; // volume down: cancel
-	mock_keypress[i++] = 0x63; // volume down: power off
-	mock_keypress[i++] = 0x90; // power button: select power off
+	ResetMocksForDeveloper();
 	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enable OS verif
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // return to dev_warn
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enable OS verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // show debug info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // developer options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
 	TEST_EQ(VbBootDeveloperMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
 		" scroll through all language menus in developer options");
+	TEST_EQ(debug_info_displayed, 0, "  no debug info");
+	TEST_NEQ(shutdown_request_calls_left, 0, "  powered down explicitly");
+	i = 0;
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
 		"  warning screen: power off");
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
@@ -900,16 +1931,293 @@ static void VbTestLanguageMenu(void)
 		"  developer menu: cancel");
 	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
 		"  developer menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
 
   	printf("...done.\n");
 }
 
+static void VbNavigationTest(void)
+{
+	int i;
+
+	printf("Testing long navigation sequences...");
+
+	/*
+	 * NOGOOD, OPTIONS, LANGUAGE, TODEV, LANGUAGE, TODEV,
+	 * LANGUAGE, select, Cancel, OPTIONS, LANGUAGE
+	 */
+	ResetMocksForManualRecovery();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter TO_DEV
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // confirm enabling
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // (end of menu)
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_DOWN_COMBO_PRESS; // enter TO_DEV
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS; // select current lang
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // (end of menu)
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // (end of menu)
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // power off
+	mock_keyflags[i] = VB_KEY_FLAG_TRUSTED_KEYBOARD;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // enter OPTIONS
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // show debug info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // power off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // language
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	TEST_EQ(VbBootRecoveryMenu(&ctx), VBERROR_SHUTDOWN_REQUESTED,
+		"recovery mode long navigation");
+	TEST_EQ(debug_info_displayed, 1, "  showed debug info");
+	TEST_EQ(shutdown_request_calls_left, 0, "  timed out");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_LANGUAGES_MENU,
+		"  languages menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: confirm enabling");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: confirm enabling");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_LANGUAGES_MENU,
+		"  languages menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_LANGUAGES_MENU,
+		"  languages menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_TO_DEV_MENU,
+		"  todev: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_RECOVERY_NO_GOOD,
+		"  nogood screen");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_OPTIONS_MENU,
+		"  options: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_LANGUAGES_MENU,
+		"  languages menu");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 0, "  no beeps");
+
+	/* DEVELOPER, Cancel, Show Debug, TO_NORM, Cancel, Boot Legacy */
+	ResetMocksForDeveloper();
+	i = 0;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot Legacy
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Boot From Disk
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Enable OS verif
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Power Off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Language
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Power Off
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Enable OS verif
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Show Debug Info
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Developer Options
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Power Off
+	mock_keypress[i++] = VB_BUTTON_VOL_DOWN_SHORT_PRESS; // Language
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Power Off
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Cancel
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From Disk
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot From USB
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // Boot Legacy
+	mock_keypress[i++] = VB_BUTTON_VOL_UP_SHORT_PRESS; // (end of menu)
+	mock_keypress[i++] = VB_BUTTON_POWER_SHORT_PRESS;
+	vb2_nv_set(&ctx, VB2_NV_DEV_BOOT_LEGACY, 1);
+	TEST_EQ(VbBootDeveloperMenu(&ctx), vbtlk_retval_fixed,
+		"developer mode long navigation");
+	TEST_EQ(debug_info_displayed, 1, "  showed debug info");
+	TEST_EQ(vbexlegacy_called, 1, "  tried legacy");
+	TEST_EQ(audio_looping_calls_left, 0, "  audio timeout");
+	TEST_EQ(vb2_nv_get(&ctx, VB2_NV_RECOVERY_REQUEST), 0, "  no recovery");
+	i = 0;
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: Legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: Legacy boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: USB boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: disk boot");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: confirm enabling");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_TO_NORM_MENU,
+		"  to dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: enable root verification");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: show debug info");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_WARNING_MENU,
+		"  dev warning menu: developer options");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: boot from disk");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: language");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: power off");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: cancel");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: boot from disk");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: boot from USB");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: boot legacy");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: boot legacy");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK, "  blank (flash)");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_DEVELOPER_MENU,
+		"  dev menu: boot legacy");
+	TEST_EQ(screens_displayed[i++], VB_SCREEN_BLANK,"  final blank screen");
+	TEST_EQ(screens_count, i, "  no extra screens");
+	TEST_EQ(beeps_count, 1, "  error beep: legacy BIOS not found");
+	TEST_EQ(beeps_played[0], 200, "    low-frequency error beep");
+}
+
 int main(void)
 {
-	VbTestLanguageMenu();
 	VbBootTest();
 	VbBootDevTest();
 	VbBootRecTest();
+	VbTestLanguageMenu();
+	VbNavigationTest();
 
 	return gTestSuccess ? 0 : 255;
 }