QEMU Virtual Armory

Introduction

It is often useful to have a test environment independent of hardware. This environment is based on a Versatile Express board with a Cortex-A9 cpu; this hardware was chosen for Trustzone support in QEMU-tz which requires either and A9 or A15, and Versatile Express with A9 support in uBoot. This should provide a low risk way to test Secure Boot, for example. (Trustzone might not actually work according to this...)

Compile Kernel

$ wget https://www.kernel.org/pub/linux/kernel/v3.x/testing/linux-3.19-rc2.tar.xz
$ tar xf linux-3.19-rc2.tar.xz
$ export ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf-
$ make vexpress_defconfig
# add "console=ttyAMA0,115200 panic=5" to kernel args, Block Layer > Large Files
$ make menuconfig
$ make -j4 zImage dtbs modules
$ mkdir -p /tmp/linux-trustzone/boot
$ cp arch/arm/boot/{,z}Image arch/arm/boot/dts/vexpress*ca9*dtb /tmp/linux-trustzone/boot/
$ make modules_install INSTALL_MOD_PATH=/tmp/linux-trustzone

Compile uBoot

$ make vexpress_ca9x4_config
$ vi include/configs/vexpress_common.h
    # add CONFIG_RSA, CONFIG_FIT_SIGNATURE, CONFIG_CMD_EXT2
    # change the environment config to point to MMC 
$ make oldconfig  # or menuconfig
$ env CROSS_COMPILE=arm-linux-gnueabihf- make -j4
$ D=/tmp/linux-trustzone/boot
$ mkdir -p $D
$ cp u-boot* $D
$ mv $D/u-boot $D/u-boot.elf
$ env CROSS_COMPILE=arm-linux-gnueabihf- make env

Prepare Disk Images

Disabling huge file support on the file system is necessary unless the kernel has been built with CONFIG_LBDAF, which is not the default for the Versatile Express.

$ truncate --size 1G Q_sbarmory.img
$ L=$(losetup --find --show Q_sbarmory.img) # assuming this returns "/dev/loop0"
$ parted $L --script mklabel msdos
$ parted $L --script mkpart primary ext4 4M 100%
$ mkfs.ext4 -O ^huge_file -L usbarmory ${L}p1
$ mount ${L}p1 /mnt
$ qemu-debootstrap --arch=armhf wheezy /mnt https://mirrors.kernel.org/debian/
$ rsync -rv /tmp/linux-trustzone/ /mnt
$ cp $UBOOTDIR/tools/env/fw_printenv /mnt/sbin
$ ln -fs fw_printenv /mnt/sbin/fw_setenv
$ chroot /mnt # do stuff like configuring software sources, setting hostname and root password
$ umount /mnt

Compile QEMU-Trustzone

QEMU as of 4902192432 now has TrustZone support, contributed by Linaro

$ git clone https://github.com/qemu/qemu.git
$ cd qemu
$ ./configure --target-list=arm-softmmu --enable-seccomp --extra-ldflags="-fPIC" --extra-cflags="-fPIC"
$ make -j4
$ cp arm-softmmu/qemu-system-arm ~/bin/qemu-system-arm-trustzone

To test the new qemu binary without using trustzone

$ ~/bin/qemu-system-arm-trustzone -machine vexpress-a9 -nographic -kernel /tmp/linux-trustzone/boot/zImage -dtb /tmp/linux-trustzone/boot/vexpress-v2p-ca9.dtb -append 'console=ttyAMA0 panic=5'

To test the new qemu with trustzone (not sure how to tell if this works yet, maybe there exists a Genode build for vexpress?)

$ ~/bin/qemu-system-arm-trustzone -machine vexpress-a9,secure=on -nographic -bios $PATH_TO_IMAGE/image

Run it!

Once the storage has been prepared, it can be booted with the command below. The vexpress model will not boot from a disk image.

$ qemu-system-arm-trustzone -machine vexpress-a9,secure=on -sandbox enable=on -no-reboot -net user -net nic,model=lan9118 -nographic -drive format=raw,media=disk,if=sd,file=usbarmory_rootfs.img,index=0 -kernel linux-trustzone/boot/u-boot

Once in uBoot commands are required for QEMU to be able to load and boot the kernel

setenv loadaddr 0x60008000
setenv fdt_addr 0x67f00000
setenv bootargs "root=/dev/mmcblk0p1 rw verbose console=ttyAMA0 panic=5 vmalloc=256M"
setenv bootdisk "ext2load mmc 0:1 ${fdt_addr} /boot/vexpress-v2p-ca9.dtb; ext2load mmc 0:1 ${loadaddr} /boot/zImage ; bootz ${loadaddr} - ${fdt_addr};"
env save

run bootdisk

uBoot has trouble interacting with the flash device presented by QEMU, but it can be patched to use the sdcard for storage. Once Linux has booted, the fw_setenv tool can be used to manipulate the NVRAM. The following configuration is required:

#device      offset   envsize  sectorsize
/dev/mmcblk0 0xfc000  0x4000   0x4000