Is dm-verity table still used in android verified boot 2.0?

206 views
Skip to first unread message

Coapprentice

unread,
Feb 22, 2021, 7:04:18 PM2/22/21
to android-platform

It seems instead of using dm-verity table, Android Verified Boot 2.0 only uses hashtree whose root hash is stored in vbmeta partition and vbmeta is signed by the OEM.

Android Verified Boot 2.png

Hashtree also doesn't have to be appended with each partition because integrity can be verified by reconstructing the hashtree in memory at boot time and comparing its root hash with the one stored in vbmeta.

Does it need dm-verity table or only hashtree in the footer of each partition?

Coapprentice

unread,
Feb 26, 2021, 12:02:23 PM2/26/21
to android-platform
So I was right. Both dm-verity table and hashtree are optional to include in footer. To verify a partition, storing its hash and hashtree descriptor in vbmeta is enough because hash and hashtree are reconstructed in memory at boot time for integrity checking anyway. The only requirement is vbmeta should be signed.

Reply all
Reply to author
Forward
0 new messages