README.avb2 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111
  1. Android Verified Boot 2.0
  2. This file contains information about the current support of Android Verified
  3. Boot 2.0 in U-boot
  4. 1. OVERVIEW
  5. ---------------------------------
  6. Verified Boot establishes a chain of trust from the bootloader to system images
  7. * Provides integrity checking for:
  8. - Android Boot image: Linux kernel + ramdisk. RAW hashing of the whole
  9. partition is done and the hash is compared with the one stored in
  10. the VBMeta image
  11. - system/vendor partitions: verifying root hash of dm-verity hashtrees.
  12. * Provides capabilities for rollback protection.
  13. Integrity of the bootloader (U-boot BLOB and environment) is out of scope.
  14. For additional details check:
  15. https://android.googlesource.com/platform/external/avb/+/master/README.md
  16. 1.1. AVB using OP-TEE (optional)
  17. ---------------------------------
  18. If AVB is configured to use OP-TEE (see 4. below) rollback indexes and
  19. device lock state are stored in RPMB. The RPMB partition is managed by
  20. OP-TEE (https://www.op-tee.org/) which is a secure OS leveraging ARM
  21. TrustZone.
  22. 2. AVB 2.0 U-BOOT SHELL COMMANDS
  23. -----------------------------------
  24. Provides CLI interface to invoke AVB 2.0 verification + misc. commands for
  25. different testing purposes:
  26. avb init <dev> - initialize avb 2.0 for <dev>
  27. avb verify - run verification process using hash data from vbmeta structure
  28. avb read_rb <num> - read rollback index at location <num>
  29. avb write_rb <num> <rb> - write rollback index <rb> to <num>
  30. avb is_unlocked - returns unlock status of the device
  31. avb get_uuid <partname> - read and print uuid of partition <partname>
  32. avb read_part <partname> <offset> <num> <addr> - read <num> bytes from
  33. partition <partname> to buffer <addr>
  34. avb write_part <partname> <offset> <num> <addr> - write <num> bytes to
  35. <partname> by <offset> using data from <addr>
  36. 3. PARTITIONS TAMPERING (EXAMPLE)
  37. -----------------------------------
  38. Boot or system/vendor (dm-verity metadata section) is tampered:
  39. => avb init 1
  40. => avb verify
  41. avb_slot_verify.c:175: ERROR: boot: Hash of data does not match digest in
  42. descriptor.
  43. Slot verification result: ERROR_IO
  44. Vbmeta partition is tampered:
  45. => avb init 1
  46. => avb verify
  47. avb_vbmeta_image.c:206: ERROR: Hash does not match!
  48. avb_slot_verify.c:388: ERROR: vbmeta: Error verifying vbmeta image:
  49. HASH_MISMATCH
  50. Slot verification result: ERROR_IO
  51. 4. ENABLE ON YOUR BOARD
  52. -----------------------------------
  53. The following options must be enabled:
  54. CONFIG_LIBAVB=y
  55. CONFIG_AVB_VERIFY=y
  56. CONFIG_CMD_AVB=y
  57. In addtion optionally if storing rollback indexes in RPMB with help of
  58. OP-TEE:
  59. CONFIG_TEE=y
  60. CONFIG_OPTEE=y
  61. CONFIG_OPTEE_TA_AVB=y
  62. CONFIG_SUPPORT_EMMC_RPMB=y
  63. Then add `avb verify` invocation to your android boot sequence of commands,
  64. e.g.:
  65. => avb_verify=avb init $mmcdev; avb verify;
  66. => if run avb_verify; then \
  67. echo AVB verification OK. Continue boot; \
  68. set bootargs $bootargs $avb_bootargs; \
  69. else \
  70. echo AVB verification failed; \
  71. exit; \
  72. fi; \
  73. => emmc_android_boot= \
  74. echo Trying to boot Android from eMMC ...; \
  75. ... \
  76. run avb_verify; \
  77. mmc read ${fdtaddr} ${fdt_start} ${fdt_size}; \
  78. mmc read ${loadaddr} ${boot_start} ${boot_size}; \
  79. bootm $loadaddr $loadaddr $fdtaddr; \
  80. To switch on automatic generation of vbmeta partition in AOSP build, add these
  81. lines to device configuration mk file:
  82. BOARD_AVB_ENABLE := true
  83. BOARD_AVB_ALGORITHM := SHA512_RSA4096
  84. BOARD_BOOTIMAGE_PARTITION_SIZE := <boot partition size>
  85. After flashing U-boot don't forget to update environment and write new
  86. partition table:
  87. => env default -f -a
  88. => setenv partitions $partitions_android
  89. => env save
  90. => gpt write mmc 1 $partitions_android