QEMU Virtual Armory

Introduction

It is often useful to have a test environment independent of hardware. This environment is based on a Versatile Express board with a Cortex-A9 cpu; this hardware was chosen for Trustzone support in QEMU-tz which requires either and A9 or A15, and Versatile Express with A9 support in uBoot. This should provide a low risk way to test Secure Boot, for example.

Compile Kernel

$ wget https://www.kernel.org/pub/linux/kernel/v3.x/testing/linux-3.19-rc2.tar.xz
$ tar xf linux-3.19-rc2.tar.xz
$ export ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf-
$ make vexpress_defconfig
# add "console=ttyAMA0,115200 panic=5" to kernel args, Block Layer > Large Files
$ make menuconfig
$ make -j4 zImage uImage LOADADDR=0x60008000 dtbs modules
$ mkdir -p /tmp/linux-trustzone/boot
$ cp arch/arm/boot/{,z,u}Image arch/arm/boot/dts/vexpress*ca9*dtb /tmp/linux-trustzone/boot/
$ make modules_install INSTALL_MOD_PATH=/tmp/linux-trustzone

Compile uBoot

$ make vexpress_ca9x4_config
$ vi include/configs/vexpress_common.h  # add CONFIG_RSA, CONFIG_FIT_SIGNATURE, CONFIG_CMD_EXT2 
$ make oldconfig  # or menuconfig
$ env CROSS_COMPILE=arm-linux-gnueabihf- make -j4
$ D=/tmp/linux-trustzone/boot
$ mkdir -p $D
$ cp u-boot* $D
$ mv $D/u-boot $D/u-boot.elf

Prepare Disk Images

Disabling huge file support on the file system is necessary unless the kernel has been built with CONFIG_LBDAF, which is not the default for the Versatile Express.

Also have a look at Debian Package Management and consider installing mtd-utils uboot-envtools dosfstools into the image.

$ cp /tmp/linux-trustzone/boot/uboot.bin pflash.img
$ truncate --size 128M pflash.img
$ truncate --size 1G Q_sbarmory.img
$ L=$(losetup --find --show Q_sbarmory.img) # assuming this returns "/dev/loop0"
$ parted $L --script mklabel msdos
$ parted $L --script mkpart primary ext4 4M 100%
$ mkfs.ext4 -O ^huge_file -L usbarmory /dev/loop0p1
$ mount /dev/loop0p1 /mnt
$ qemu-debootstrap --arch=armhf wheezy /mnt https://mirrors.kernel.org/debian/
$ rsync -rv /tmp/linux-trustzone/ /mnt
$ chroot /mnt # do stuff like configuring software sources, setting hostname and root password
$ umount /mnt

Compile QEMU-Trustzone

QEMU-Trustzone is Linaro's patch of QEMU with TrustZone support.

$ git clone git://git.linaro.org/people/greg.bellows/qemu.git --branch qemutz qemutz-git
$ cd qemutz-git
$ ./configure --target-list=arm-softmmu --enable-seccomp --extra-ldflags="-fPIC" --extra-cflags="-fPIC"
$ make -j4
$ cp arm-softmmu/qemu-system-arm ~/bin/qemu-system-arm-trustzone

To test the new qemu binary without using trustzone

$ ~/bin/qemu-system-arm-trustzone -M vexpress-a9 -m 1024M -serial stdio -kernel /tmp/linux-trustzone/boot/zImage -dtb /tmp/linux-trustzone/boot/vexpress-v2p-ca9.dtb -append 'console=ttyAMA0,38400n8 panic=5'

To test the new qemu with trustzone (not sure how to tell if this works yet, maybe there exists a Genode build for vexpress?)

$ ~/bin/qemu-system-arm-trustzone -M vexpress-a9 -m 1024M -serial stdio -bios $PATH_TO_IMAGE/image -append 'console=ttyAMA0,38400n8'

Run it!

Once the storage has been prepared, it can be booted with the command below. There is still some work to be done to get the emulator to boot from SD like a real usbarmory, and for uboot to interact with sdcard for environment storage.

$ qemu-system-arm-trustzone -M vexpress-a9 -m 1024M -no-reboot -net user -net nic,model=lan9118 -nographic -drive format=raw,media=disk,if=sd,file=usbarmory_rootfs.img,index=0 # -kernel linux-trustzone/boot/u-boot

Once in uBoot commands are required for QEMU to be able to load and boot the kernel

setenv loadaddr 0x60008000
setenv fdt_addr 0x67f00000
setenv bootargs "root=/dev/mmcblk0p1 rw verbose console=ttyAMA0 mem=1024M panic=5 vmalloc=256M"
ext2load mmc 0:1 ${fdt_addr} /boot/vexpress-v2p-ca9.dtb
ext2load mmc 0:1 ${loadaddr} /boot/zImage
bootz ${loadaddr} - ${fdt_addr}