I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process.

From what I gathered so far I get that in Android devices the verified boot process is supported using dm-verity, which checks signed hashes of the memory blocks in which the OS to be loaded is located. Also, most (if not all) of current ARM processors based devices has the TrustZone feature which is used to create the so called "Secure World" and "Unsecure World".

What I'm trying to understand is how all this is wrapped up:

  1. When in the Android boot process does dm-verity run?
  2. Does the dm-verity run from within the "Secure World"? If so how the "Secure World" OS loading is verified?
  3. When in the boot process is the first time that the TrustZone "worlds" feature is accessed/activated?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.