1Android Verified Boot 2.0 2 3This file contains information about the current support of Android Verified 4Boot 2.0 in U-boot 5 61. OVERVIEW 7--------------------------------- 8Verified Boot establishes a chain of trust from the bootloader to system images 9* Provides integrity checking for: 10 - Android Boot image: Linux kernel + ramdisk. RAW hashing of the whole 11 partition is done and the hash is compared with the one stored in 12 the VBMeta image 13 - system/vendor partitions: verifying root hash of dm-verity hashtrees. 14* Provides capabilities for rollback protection. 15 16Integrity of the bootloader (U-boot BLOB and environment) is out of scope. 17 18For additional details check: 19https://android.googlesource.com/platform/external/avb/+/master/README.md 20 211.1. AVB using OP-TEE (optional) 22--------------------------------- 23If AVB is configured to use OP-TEE (see 4. below) rollback indexes and 24device lock state are stored in RPMB. The RPMB partition is managed by 25OP-TEE (https://www.op-tee.org/) which is a secure OS leveraging ARM 26TrustZone. 27 28 292. AVB 2.0 U-BOOT SHELL COMMANDS 30----------------------------------- 31Provides CLI interface to invoke AVB 2.0 verification + misc. commands for 32different testing purposes: 33 34avb init <dev> - initialize avb 2.0 for <dev> 35avb verify - run verification process using hash data from vbmeta structure 36avb read_rb <num> - read rollback index at location <num> 37avb write_rb <num> <rb> - write rollback index <rb> to <num> 38avb is_unlocked - returns unlock status of the device 39avb get_uuid <partname> - read and print uuid of partition <partname> 40avb read_part <partname> <offset> <num> <addr> - read <num> bytes from 41partition <partname> to buffer <addr> 42avb write_part <partname> <offset> <num> <addr> - write <num> bytes to 43<partname> by <offset> using data from <addr> 44 45 463. PARTITIONS TAMPERING (EXAMPLE) 47----------------------------------- 48Boot or system/vendor (dm-verity metadata section) is tampered: 49=> avb init 1 50=> avb verify 51avb_slot_verify.c:175: ERROR: boot: Hash of data does not match digest in 52descriptor. 53Slot verification result: ERROR_IO 54 55Vbmeta partition is tampered: 56=> avb init 1 57=> avb verify 58avb_vbmeta_image.c:206: ERROR: Hash does not match! 59avb_slot_verify.c:388: ERROR: vbmeta: Error verifying vbmeta image: 60HASH_MISMATCH 61Slot verification result: ERROR_IO 62 63 644. ENABLE ON YOUR BOARD 65----------------------------------- 66The following options must be enabled: 67CONFIG_LIBAVB=y 68CONFIG_AVB_VERIFY=y 69CONFIG_CMD_AVB=y 70 71In addtion optionally if storing rollback indexes in RPMB with help of 72OP-TEE: 73CONFIG_TEE=y 74CONFIG_OPTEE=y 75CONFIG_OPTEE_TA_AVB=y 76CONFIG_SUPPORT_EMMC_RPMB=y 77 78Then add `avb verify` invocation to your android boot sequence of commands, 79e.g.: 80 81=> avb_verify=avb init $mmcdev; avb verify; 82=> if run avb_verify; then \ 83 echo AVB verification OK. Continue boot; \ 84 set bootargs $bootargs $avb_bootargs; \ 85 else \ 86 echo AVB verification failed; \ 87 exit; \ 88 fi; \ 89 90=> emmc_android_boot= \ 91 echo Trying to boot Android from eMMC ...; \ 92 ... \ 93 run avb_verify; \ 94 mmc read ${fdtaddr} ${fdt_start} ${fdt_size}; \ 95 mmc read ${loadaddr} ${boot_start} ${boot_size}; \ 96 bootm $loadaddr $loadaddr $fdtaddr; \ 97 98 99To switch on automatic generation of vbmeta partition in AOSP build, add these 100lines to device configuration mk file: 101 102BOARD_AVB_ENABLE := true 103BOARD_AVB_ALGORITHM := SHA512_RSA4096 104BOARD_BOOTIMAGE_PARTITION_SIZE := <boot partition size> 105 106After flashing U-boot don't forget to update environment and write new 107partition table: 108=> env default -f -a 109=> setenv partitions $partitions_android 110=> env save 111=> gpt write mmc 1 $partitions_android 112