Is dm-verity table still used with android verified boot 2.0?

[fletcher]

Google's AVB 2.0 documentation describes that hashtree is stored with the partitions and their root hash is stored in vbmeta.

However, Android's documentation on implementing dm-verity describes that dm-verity table is constructed over hashtree and it is then stored with the partition together with its signature.

Another blog describes android verified 2.0 together with verification of dm-verity table.

Is hashtree stored with the partititon or is dm-verity table constructed over hashtree which is then stored with the partition?

[joanxie]

you can refer to my another topic about this

https://community.nxp.com/t5/i-MX-Processors/Enabling-DM-Verity-singing-failed-on-i-MX8MQ/m-p/109007...

[fletcher]

Your post explains that hashtree is appended to the partitions image. Does that mean that dm-verity table is no longer used? In AVB 1.0 dm-verity table used to be generated over hashtree which was then appended to the partitions and verified by /boot/verity_key.

[joanxie]

The Android Verified Boot 2.0

Relies in a hash tree which is verified at Kernel level in a continuous process. As file system partitions may no fit into memory the integrity is verified as data is loaded into memory.

Reference and more details:

https://android.googlesource.com/platform/external/avb/+/master/README.md