1 <html devsite><head> 2 <title></title> 3 <meta name="project_path" value="/_project.yaml"/> 4 <meta name="book_path" value="/_book.yaml"/> 5 </head> 6 <body> 7 <!-- 8 Copyright 2017 The Android Open Source Project 9 10 Licensed under the Apache License, Version 2.0 (the "License"); 11 you may not use this file except in compliance with the License. 12 You may obtain a copy of the License at 13 14 http://www.apache.org/licenses/LICENSE-2.0 15 16 Unless required by applicable law or agreed to in writing, software 17 distributed under the License is distributed on an "AS IS" BASIS, 18 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 19 See the License for the specific language governing permissions and 20 limitations under the License. 21 --> 22 23 <p></p> 24 25 <p> (TEE) </p> 26 27 <p></p> 28 29 <h2 id="glossary"></h2> 30 31 <table> 32 <colgroup><col width="15%" /> 33 <col width="85%" /> 34 </colgroup><tbody><tr> 35 <th></th> 36 <th></th> 37 </tr> 38 <tr> 39 <td></td> 40 <td></td> 41 </tr> 42 <tr> 43 <td></td> 44 <td></td> 45 </tr> 46 <tr> 47 <td>dm-verity</td> 48 <td>Linux </td> 49 </tr> 50 <tr> 51 <td> (OEM) </td> 52 <td> (OEM) </td> 53 </tr> 54 </tbody></table> 55 56 <h2 id="overview"></h2> 57 58 <p></p> 59 60 <h3 id="classes"></h3> 61 62 <p></p> 63 64 <p><strong>A </strong></p> 65 66 <p><strong>B </strong> A </p> 67 68 <h3 id="verification_keys"></h3> 69 70 <p> (OEM) (OEM) </p> 71 72 <p> B (OEM) (OEM) </p> 73 74 <h3 id="boot_state"></h3> 75 76 <p> 4 </p> 77 78 <ul> 79 <li> 80 81 </li><li> 82 83 </li><li> 84 85 </li><li> 86 </li></ul> 87 88 <p></p> 89 90 <h3 id="device_state"></h3> 91 92 <p> 4 </p> 93 <ol> 94 <li> 95 96 </li><li> 97 </li></ol> 98 99 <img src="../images/verified_boot.png" alt="" id="figure1"/> 100 <p class="img-caption"><strong> 1.</strong> </p> 101 102 <h2 id="detailed_design"></h2> 103 104 <p></p> 105 106 <h3 id="bootloader_requirements"></h3> 107 108 <p> TEE </p> 109 110 <p>/<a href="#boot_state"></a></p> 111 112 <h4 id="changing_device_state"></h4> 113 114 <p> <code>fastboot flashing [unlock | 115 lock]</code> <strong></strong></p> 116 117 <ol> 118 <li> 119 120 </li><li> 121 </li></ol> 122 123 <p> <code>fastboot</code> </p> 124 125 <table> 126 <colgroup><col width="25%" /> 127 <col width="75%" /> 128 </colgroup><tbody><tr> 129 <th><code>fastboot</code> </th> 130 <th></th> 131 </tr> 132 <tr> 133 <td><code>flashing lock</code></td> 134 <td> 135 <ul> 136 <li></li><li></li></ul> 137 </td> 138 </tr> 139 <tr> 140 <td><code>flashing unlock</code></td> 141 <td> 142 <ul> 143 <li></li><li></li><li></li></ul> 144 </td> 145 </tr> 146 </tbody></table> 147 148 <p></p> 149 150 <table> 151 <colgroup><col width="25%" /> 152 <col width="75%" /> 153 </colgroup><tbody><tr> 154 <th><code>fastboot</code> </th> 155 <th></th> 156 </tr> 157 <tr> 158 <td><code>flash <partition></code></td> 159 <td> <code>flashing unlock</code> 160 </td> 161 </tr> 162 </tbody></table> 163 164 <p> <code>fastboot</code> </p> 165 166 <p class="note"><strong></strong>B </p> 167 168 <h4 id="binding_tee_root_of_trust"> TEE </h4> 169 170 <p> TEE / TEE TEE Keymaster </p> 171 172 <ol> 173 <li></li><li></li></ol> 174 175 <p> TEE </p> 176 177 <p class="note"><strong></strong> TEE </p> 178 179 <h4 id="initializing-attestation"></h4> 180 <p> TEE TEE</p> 181 <ol> 182 <li></li><li></li><li></li></ol> 183 <h4 id="booting_into_recovery"></h4> 184 185 <p></p> 186 187 <h4 id="comm_boot_state"></h4> 188 189 <p> <code>firmware/android/verifiedbootstate</code> </p> 190 191 <table> 192 <tbody><tr> 193 <th></th> 194 <th></th> 195 </tr> 196 <tr> 197 <td><code>androidboot.verifiedbootstate=green</code></td> 198 <td><br /> (OEM) </td> 199 </tr> 200 <tr> 201 <td><code>androidboot.verifiedbootstate=yellow</code></td> 202 <td><br /></td> 203 </tr> 204 <tr> 205 <td><code>androidboot.verifiedbootstate=orange</code></td> 206 <td><br /></td> 207 </tr> 208 </tbody></table> 209 <p class="note"><strong></strong> <code>androidboot.verifiedbootstate=red</code></p> 210 211 <h3 id="boot_partition"></h3> 212 213 <p> dm-verity </p> 214 215 <p> dm-verity Verity dm-verity</p> 216 217 <h4 id="managing_dm-verity"> dm-verity</h4> 218 219 <p>dm-verity dm-verity </p> 220 221 <p> fstab <code>verify</code> fs_mgr fs_mgr dm-verityVerity <code>/verity_key</code> </p> 222 223 <h4 id="recovering_from_dm-verity_errors"> dm-verity </h4> 224 225 <p> dm-verity </p> 226 227 <p>dm-verity dm-verity 228 </p> 229 230 <p>dm-verity I/O (EIO) EIO dm-verity I/O dm-verity fs_mgr </p> 231 232 <ol> 233 <li> fs_mgr dm-verity <code>verify</code> fs_mgr dm-verity <code>verify=/path/to/metadata</code> 234 <p class="note"><strong></strong>fs_mgr dm-verity EIO </p> 235 </li> 236 <li> dm-verity <code>androidboot.veritymode</code> <table> 237 <tbody><tr> 238 <th></th> 239 <th></th> 240 </tr> 241 <tr> 242 <td><code>androidboot.veritymode=enforcing</code></td> 243 <td> dm-verity </td> 244 </tr> 245 <tr> 246 <td><code>androidboot.veritymode=eio</code></td> 247 <td> dm-verity EIO </td> 248 </tr> 249 </tbody></table> 250 251 <p class="note"> 252 <strong></strong> dm-verity </p> 253 </li> 254 </ol> 255 256 <p> dm-verity Verity EIO 30 257 </p> 258 259 <p class="note"> 260 <strong></strong>dm-verity 261 </p> 262 263 <h3 id="verified_partition"></h3> 264 265 <p> (OEM) </p> 266 267 <p> Verity Verity Verity dm-verity </p> 268 269 <h2 id="implementation_details"></h2> 270 271 <h3 id="key_types_and_sizes"></h3> 272 273 <p>AOSP (OEM) 2048 65537 (F4) RSA CDD </p> 274 275 <p> (OEM) (HSM) </p> 276 277 <h3 id="signature_format"></h3> 278 279 <p>Android ASN.1 DER <a href="https://android.googlesource.com/platform/bootable/recovery/+/f4a6ab27b335b69fbc419a9c1ef263004b561265/asn1_decoder.cpp">platform/bootable/recovery/asn1_decoder.cpp</a> <br /></p> 280 281 <pre> 282 AndroidVerifiedBootSignature DEFINITIONS ::= 283 BEGIN 284 FormatVersion ::= INTEGER 285 Certificate ::= Certificate 286 AlgorithmIdentifier ::= SEQUENCE { 287 algorithm OBJECT IDENTIFIER, 288 parameters ANY DEFINED BY algorithm OPTIONAL 289 } 290 AuthenticatedAttributes ::= SEQUENCE { 291 target CHARACTER STRING, 292 length INTEGER 293 } 294 295 Signature ::= OCTET STRING 296 END 297 </pre> 298 299 <p><code>Certificate</code> X.509 <a href="http://tools.ietf.org/html/rfc5280#section-4.1.1.2">RFC5280</a> 4.1 (OEM) </p> 300 301 <p> <code>AuthenticatedAttributes</code> <a href="http://tools.ietf.org/html/rfc5280#section-4.1.1.2">RFC5280</a> 4.1.1.2 4.1.1.3 </p> 302 303 <h3 id="signing_and_verifying_an_image"></h3> 304 305 <p><strong></strong></p> 306 <ol> 307 <li> 308 </li><li> 0 309 </li><li> <code>AuthenticatedAttributes</code> 310 </li><li> <code>AuthenticatedAttributes</code> 311 </li><li> 312 </li></ol> 313 314 <p><strong></strong></p> 315 <ol> 316 <li> 317 </li><li> 318 </li><li> <code>AuthenticatedAttributes</code> 319 </li><li> <code>AuthenticatedAttributes</code> 320 </li></ol> 321 322 <h3 id="user_experience"></h3> 323 324 <p> 5 30 30 </p> 325 326 <p></p> 327 328 <table> 329 <tbody><tr> 330 <th></th> 331 <th></th> 332 <th> </th> 333 </tr> 334 <tr> 335 <td></td> 336 <td><img src="../images/boot_yellow1.png" alt=" 1" id="figure2"/> 337 <p class="img-caption"><strong> 2.</strong> </p> 338 </td> 339 <td><img src="../images/boot_yellow2.png" alt=" 2" id="figure3"/> 340 <p class="img-caption"><strong> 3.</strong> </p> 341 </td> 342 </tr> 343 <tr> 344 <td></td> 345 <td><img src="../images/boot_orange.png" alt="" id="figure4"/> 346 <p class="img-caption"><strong> 4.</strong> </p> 347 </td> 348 <td> </td> 349 </tr> 350 <tr> 351 <td></td> 352 <td><img src="../images/boot_red1.png" alt="" id="figure5"/> 353 <p class="img-caption"><strong> 5.</strong> </p> 354 </td> 355 <td><img src="../images/boot_red2.png" alt="" id="figure6"/> 356 <p class="img-caption"><strong> 6.</strong> EIO </p> 357 </td> 358 </tr> 359 </tbody></table> 360 361 </body></html>
