TrustZone

Reading List

• http://arxiv.org/pdf/1410.7747.pdf
• http://bunniefoo.com/novena/IMX6DQ6SDLSRM_security.pdf
• http://cs.ucsb.edu/~sherwood/cs290/papers/trustzone.pdf
• http://genode.org/documentation/articles/trustzone
• http://infocenter.arm.com/help/topic/com.arm.doc.prd29-genc-009492c/PRD29-GENC-009492C_trustzone_security_whitepaper.pdf
• http://leveldown.de/bh_eu_2013.pdf
• http://leveldown.de/hip_2013.pdf
• http://os.inf.tu-dresden.de/papers_ps/rtlws2010_armtrustzone.pdf
• http://paper.ijcsns.org/07_book/201310/20131006.pdf
• http://stackoverflow.com/questions/22321183/arm-trustzone-hypervisor-hypervisor-functionality-without-virtualization-exten
• http://www.cs.helsinki.fi/group/secures/CCS-tutorial/tutorial-slides.pdf
• http://www.diva-portal.org/smash/get/diva2:679953/FULLTEXT01.pdf
• http://www.linaro.org/blog/core-dump/arm-trustzone-qemu/
• http://www.linuxplumbersconf.net/2014/ocw//system/presentations/1977/original/tz_plumbers.pdf
• http://www.opentrustzone.org/OpenTrustZone.pdf
• http://www.openvirtualization.org/open-source-arm-trustzone.html
• http://www.sierraware.com/sierraware_tee_hypervisor_overview.pdf
• https://eprint.iacr.org/2014/464.pdf
• https://freescale.hosted.jivesoftware.com/thread/260817
• https://github.com/ARM-software/arm-trusted-firmware
• https://github.com/genodelabs/genode/search?q=trustzone
• https://www.blackhat.com/docs/us-14/materials/us-14-Rosenberg-Reflections-on-Trusting-TrustZone.pdf

Compile a kernel

$ wget https://www.kernel.org/pub/linux/kernel/v3.x/testing/linux-3.19-rc2.tar.xz
$ tar xf linux-3.19-rc2.tar.xz
$ make vexpress_defconfig
$ export ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf-
$ make vexpress_defconfig
$ make menuconfig  # edit default kernel args to include "console=ttyAMA0,115200 panic=5"
$ make -j4 zImage uImage LOADADDR=0x04080000 dtbs modules
$ mkdir -p /tmp/linux-trustzone/boot
$ cp arch/arm/boot/{,z,u}Image arch/arm/boot/dts/vexpress-v2*dtb /tmp/linux-trustzone/boot/
$ make modules_install INSTALL_MOD_PATH=/tmp/linux-trustzone

Compile qemu-trustzone

$ git clone git://git.linaro.org/people/greg.bellows/qemu.git --branch qemutz qemutz-git
$ cd qemutz-git
$ ./configure --target-list=arm-softmmu --enable-seccomp --extra-ldflags="-fPIC" --extra-cflags="-fPIC"
$ make -j4
$ cp arm-softmmu/qemu-system-arm ~/bin/qemu-system-arm-trustzone

Test qemu without trustzone

$ ~/bin/qemu-system-arm-trustzone -kernel $PATH_TO_KERNEL/zImage -M vexpress-a15 -cpu cortex-a15 -dtb PATH_TO_DTB/vexpress-v2p-ca15-tc1.dtb -m 1024 -append 'console=ttyAMA0,38400n8' -serial stdio -initrd $PATH_TO_INITRD/initrd.img

Test qemu with trustzone

$ ~/bin/qemu-system-arm-trustzone -bios $PATH_TO_IMAGE/image -M vexpress-a15 -cpu cortex-a15 -m 1024 -append 'console=ttyAMA0,38400n8' -serial stdio