philips-tv-speicher-voll/patches/phase7/AVB-TOPOLOGY.md

Phase 7H – AVB topology

Verified boot state

• ro.boot.avb_version=1.2; vbmeta header reports AVB 1.0.
• ro.boot.vbmeta.device_state=locked
• ro.boot.verifiedbootstate=green
• dm-verity mode: enforcing
• active slot: _a
• vbmeta device 179:8 = /dev/mmcblk0p8 (vbmeta_a)
• vbmeta digest: 66eae984496730f2339e5e5531f513645ce32263ac24b95cd80d4f787d701dc6
• digest algorithm SHA-256; reported vbmeta size 17,280 bytes

Proven topology

locked boot ROM / bootloader trust root (key identity unread)
  -> vbmeta_a (p8, active; exact descriptors unread)
      -> system_a p15 -> dm-0 -> `/` system-as-root ext4, ro
      -> vendor_a p35 -> dm-1 -> `/vendor` ext4, ro
      -> linux_rootfs_a p17 -> dm-2 -> SquashFS
      -> 3rd_a p19 -> dm-3 -> SquashFS
      -> factory_a p39 -> AVB SquashFS when mounted
      -> boot/dtbo and other OTA partitions: boot-chain protection likely,
         but exact vbmeta descriptors/chains not readable

The fstab marks system, vendor, linux_rootfs, 3rd and factory with avb,slotselect. The exact active system dm table is a SHA-1 4-KiB hashtree with 602,165 data blocks, root hash 3f16afd..., salt d468..., FEC and restart_on_corruption. Vendor's dm-verity mapping is confirmed, but its full descriptor/table was not captured.

Partition status

Logical role	Active physical partition	AVB evidence	Exact descriptor/key/rollback index
vbmeta	p8 vbmeta_a	locked green root metadata	raw content inaccessible
system/root	p15 system_a, dm-0	fstab AVB + live dm-verity	partial dm table known
vendor	p35 vendor_a, dm-1	fstab AVB + live dm-verity	unknown
linux_rootfs	p17, dm-2	fstab AVB + live mapping	unknown
3rd	p19, dm-3	fstab AVB + live mapping	unknown
factory	p39 (B: p16)	fstab AVB/slotselect	not mounted; unknown
boot / dtbo	A/B raw partitions	locked green boot strongly implies authentication	descriptor/chaining unknown
odm	p36/p57, not mounted in normal inventory	no AVB fstab proof	unknown
product/system_ext	directories within system image	protected as system content	no separate partition
recovery/super	absent	n/a	n/a

There are no named chained-vbmeta partitions and no dynamic super partition. That is not proof that vbmeta_a contains no chain descriptor. Without reading and parsing raw vbmeta, public-key digest, descriptor algorithms, chained vbmeta and rollback indexes remain unknown.

Consequence for patches

Changing /system content invalidates the hashtree. A bootable image would need a coherent new filesystem, hashtree/FEC/footer and vbmeta accepted by the locked boot chain. Disabling verification is forbidden and unnecessary for the legitimate goal. A correctly platform-signed /data/app update leaves AVB untouched.

References: Android Verified Boot https://source.android.com/docs/security/features/verifiedboot and AVB source https://android.googlesource.com/platform/external/avb/.