Encryption
Creating and executing encrypted images involves various steps:
Create a bif file. In bif file authentication mode(SHA3 or SHA2), Primary secret key, Secondary secret key, boot loaders and application
Run the bootgen tool to generate binary file.
Create the boot image file for the corresponding boot device.
To execute the boot image files:
Open 3 terminals and set the environment
Execute
Creation of AES-Red key Encrypted SD image using eFuse as key source
1. Create a BIF file with the following contents
$ cat encrpt.bif
the_ROM_image:
[aeskeyfile] efuse_red_key_a530.nky
[keysrc_encryption] efuse_red_key}}
[fsbl_config] a5x_x64
[bootloader,encryption=aes] fsbl_a530.elf
[destination_cpu=a5x-0] A53_core0_hello_world.elf
2. Run the bootgen tool to generate the bin file and key file
$ bootgen -r -w -image encrpt.bif -o BOOT.BIN -p xc9r1234567abc
3. The key generated is as follows
$ cat efuse_red_key_a530.nky
Device xc9r1234567abc;
Key 0 70D15B80A2621F1DA308C416F26FE1E1161A857B8731AC5673E0D5322A292284;
IV 90D2BFC7EFF101DF467B61AB;
4. Copy this key to a temp file
$ echo "70D15B80A2621F1DA308C416F26FE1E1161A857B8731AC5673E0D5322A292284" >tmp_key
5. Burn the key into eFuse
$ qemu-efuse-creator -efusekey tmp_key
Xilinx Utility for qemu efuse file generation Rev 2.0
..Created qemuefusehash.bin
6. Create the SD Boot image and format the SD memory space
$ dd if=/dev/zero of=qemu_sd_efuse_redky_app_a530.img bs=128M count=1
1+0 records in
1+0 records out
134217728 bytes (134 MB) copied, 1.05148 s, 128 MB/s
$ mkfs.vfat -F 32 qemu_sd_efuse_redky_app_a530.img
mkfs.fat 3.0.26 (2014-03-07)
$ mcopy -i qemu_sd_efuse_redky_app_a530.img BOOT.BIN ::/
$ mkdir qemu-tmp
7. Open a new terminal and change directory to the path where the secure boot image is located. Run the CSU ROM code
$ qemu-system-microblazeel -M microblaze-fdt -hw-dtb zynqmp-csu.dtb -kernel csu_rom.elf -nographic -machine-path ./qemu-tmp
------------------------------------------------------------------------------------
Xilinx Restricted QEMU Feb 13 2015 16:19:45.
This QEMU binary and its source are restricted to Xilinx internal
use only. Do not delete this message in source. Contact the Xilinx
QEMU Maintainer (qemu-dev@xilinx.com) for details on publishing QEMU
contributions to customers.
------------------------------------------------------------------------------------
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
QEMU 2.2.50 monitor - type 'help' for more information
(qemu) QEMU 2.2.50 monitor - type 'help' for more information
(qemu)
8. Open a new terminal and change directory to the path where the secure boot image is located. Run the PMU ROM code
$ qemu-system-microblazeel -M microblaze-fdt -hw-dtb zynqmp-pmu.dtb -kernel pmu_rom.elf -nographic -machine-path ./qemu-tmp
----
Xilinx Restricted QEMU Feb 13 2015 16:19:45.
This QEMU binary and its source are restricted to Xilinx internal
use only. Do not delete this message in source. Contact the Xilinx
QEMU Maintainer (qemu-dev@xilinx.com) for details on publishing QEMU
contributions to customers.
----
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@00000000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_pmu_ram@ffdc0000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_ipibuf@ff990000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@0xFF960000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x20000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x20000
QEMU 2.2.50 monitor - type 'help' for more information
(qemu) QEMU 2.2.50 monitor - type 'help' for more information
(qemu)
9. Execute the SD Boot image on QEMU.
$ qemu-system-aarch64 -nographic -M arm-generic-fdt -hw-dtb zynqmp-qemu-arm.dtb -machine-path ./qemu-tmp -sd qemu_sd_efuse_redky_app_a530.img -boot mode=3 -pflash /dev/null -pflash /dev/null -pflash qemuefusehash.bin
----
Xilinx Restricted QEMU Feb 13 2015 16:19:45.
This QEMU binary and its source are restricted to Xilinx internal
use only. Do not delete this message in source. Contact the Xilinx
QEMU Maintainer (qemu-dev@xilinx.com) for details on publishing QEMU
contributions to customers.
----
WARNING: Image format was not specified for 'qemu_sd_efuse_redky_app_a530.img' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
WARNING: Image format was not specified for '/dev/null' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
WARNING: Image format was not specified for '/dev/null' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
WARNING: Image format was not specified for 'qemuefusehash.bin' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
qemu-system-aarch64: Failed to connect socket: No such file or directory
QEMU waiting for connection on: disconnected:unix:./qemu-tmp/qemu-rport-_csu@0,server
qemu-system-aarch64: Failed to connect socket: No such file or directory
QEMU waiting for connection on: disconnected:unix:./qemu-tmp/qemu-rport-_pmu@0,server
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@00000000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_pmu_ram@ffdc0000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_ipibuf@ff990000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@0xFF960000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x20000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x20000
Warning: Orphaned drive without device: id=pflash2,file=qemuefusehash.bin,if=pflash,bus=0,unit=2
DDR test pass
Xilinx First Stage Boot Loader
Release SW Beta1 Feb 11 2015-18:14:27
Platform: QEMU, RTL Version: 400
Cluster ID 0x80000000
Running on A53-0 Processor
Processor Initialization Done
In Stage 2
SD Boot Mode
SD: rc= 0
File name is BOOT.BIN
Multiboot Reg : 0x0
Image Header Table Offset 0x8C0
*Image Header Table Details*
Boot Gen Ver: 0x1020000
No of Partitions: 0x5
Partition Header Address: 0x260
Partition Present Device: 0x0
Initialization Success
In Stage 3, Partition No:1
UnEncrypted data Length: 0x6CE
Data word offset: 0x6CE
Total Data word length: 0x6CE
Destination Load Address: 0x0
Execution Address: 0x0
Data word offset: 0x7EF2
Partition Attributes: 0x100
Partition 1 Load Success
In Stage 3, Partition No:2
UnEncrypted data Length: 0x23A
Data word offset: 0x23A
Total Data word length: 0x23A
Destination Load Address: 0x1B40
Execution Address: 0x0
Data word offset: 0x85C0
Partition Attributes: 0x100
Partition 2 Load Success
In Stage 3, Partition No:3
UnEncrypted data Length: 0x1F02
Data word offset: 0x1F02
Total Data word length: 0x1F02
Destination Load Address: 0x2440
Execution Address: 0x0
Data word offset: 0x8800
Partition Attributes: 0x100
Partition 3 Load Success
In Stage 3, Partition No:4
UnEncrypted data Length: 0x9
Data word offset: 0x9
Total Data word length: 0x9
Destination Load Address: 0x1AB4
Execution Address: 0x0
Data word offset: 0xA710
Partition Attributes: 0x100
Partition 4 Load Success
All Partitions Loaded
In Stage 4
Running Cpu Handoff address: 0x0, Exec State: 0
Exit from FSBL
Hello World running on A53 core 0
Creation of AES - Red key Encrypted NAND image using BBRAM as key source
1. Create a BIF file with the following contents
$ cat encrpt.bif
the_ROM_image:
{
[aeskeyfile] bbram_red_key_a530.nky
[keysrc_encryption] bbram_red_key
[fsbl_config] a5x_x64
[bootloader,encryption=aes] fsbl_a530.elf
[destination_cpu=a5x-0] A53_core0_hello_world.elf
}
2. Run the bootgen tool to generate the bin file and key file
$ bootgen -r -w -image encrpt.bif -o BOOT.BIN -p xc9r1234567abc
3. The key generated is as follows
$ cat bbram_red_key_a530.nky
Device xc9r1234567abc;
Key 0 72F5EA8F6D30D4F7D84E0DFEC1C828D5BB2F787031D54F1207923332CFD8493E;
IV 0B8EA23BD01FE51F0CF0D26D;
4. Copy this key to a temp file
$ echo "72F5EA8F6D30D4F7D84E0DFEC1C828D5BB2F787031D54F1207923332CFD8493E" >tmp_key
5. Write the key in BBRAM
$ qemu-efuse-creator –bbramkey tmp_key
Xilinx Utility for qemu efuse file generation Rev 2.0
..Created qemubbram.bin
6. Create the NAND Boot image.
$ dd if=/dev/zero of=nand.bin bs=1G count=4
4+0 records in
4+0 records out
4294967296 bytes (4.3 GB) copied, 51.5284 s, 83.4 MB/s
$ dd if=BOOT.BIN of=nand.bin bs=1 seek=0 conv=notrunc
171108+0 records in
171108+0 records out
171108 bytes (171 kB) copied, 0.181082 s, 945 kB/s
$ qemu-nand-creator 16384 < nand.bin > qemu_nand.bin
$ mkdir qemu-tmp
7. Open a new terminal and change directory to the path where the secure boot image is located. Run the CSU ROM code.
$ qemu-system-microblazeel -M microblaze-fdt -hw-dtb zynqmp-csu.dtb -kernel csu_rom.elf -nographic -machine-path ./qemu-tmp
----
Xilinx Restricted QEMU Feb 13 2015 16:19:45.
This QEMU binary and its source are restricted to Xilinx internal
use only. Do not delete this message in source. Contact the Xilinx
QEMU Maintainer (qemu-dev@xilinx.com) for details on publishing QEMU
contributions to customers.
----
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
Warning: path not on HugeTLBFS: ././qemu-tmp
QEMU 2.2.50 monitor - type 'help' for more information
(qemu) QEMU 2.2.50 monitor - type 'help' for more information
(qemu)
8. Open a new terminal and change directory to the path where the secure boot image is located. Run the PMU ROM code.
$ qemu-system-microblazeel -M microblaze-fdt -hw-dtb zynqmp-pmu.dtb -kernel pmu_rom.elf -nographic -machine-path ./qemu-tmp
----
Xilinx Restricted QEMU Feb 13 2015 16:19:45.
This QEMU binary and its source are restricted to Xilinx internal
use only. Do not delete this message in source. Contact the Xilinx
QEMU Maintainer (qemu-dev@xilinx.com) for details on publishing QEMU
contributions to customers.
----
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@00000000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_pmu_ram@ffdc0000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_ipibuf@ff990000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@0xFF960000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x20000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x20000
QEMU 2.2.50 monitor - type 'help' for more information
(qemu) QEMU 2.2.50 monitor - type 'help' for more information
(qemu)
9. Execute the NAND Boot image on QEMU.
$ qemu-system-aarch64 -nographic -M arm-generic-fdt -hw-dtb zynqmp-qemu-arm.dtb -machine-path ./qemu-tmp -drive file=qemu_nand.bin,if=pflash,index=0 -drive file=qemubbram.bin,if=pflash,index=3 -boot mode=4
----
Xilinx Restricted QEMU Feb 13 2015 16:19:45.
This QEMU binary and its source are restricted to Xilinx internal
use only. Do not delete this message in source. Contact the Xilinx
QEMU Maintainer (qemu-dev@xilinx.com) for details on publishing QEMU
contributions to customers.
----
WARNING: Image format was not specified for 'qemu_nand.bin' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
WARNING: Image format was not specified for 'qemubbram.bin' and probing guessed raw.
Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
Specify the 'raw' format explicitly to remove the restrictions.
qemu-system-aarch64: Failed to connect socket: No such file or directory
QEMU waiting for connection on: disconnected:unix:./qemu-tmp/qemu-rport-_csu@0,server
qemu-system-aarch64: Failed to connect socket: No such file or directory
QEMU waiting for connection on: disconnected:unix:./qemu-tmp/qemu-rport-_pmu@0,server
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@00000000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_pmu_ram@ffdc0000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_ipibuf@ff990000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory@0xFF960000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory0@0x20000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x00000
Warning: path not on HugeTLBFS: ./qemu-tmp/qemu-memory-_memory1@0x20000
Warning: Orphaned drive without device: id=pflash3,file=qemubbram.bin,if=pflash,bus=0,unit=3
DDR test pass
Xilinx First Stage Boot Loader
Release SW Beta1 Feb 11 2015-18:14:27
Platform: QEMU, RTL Version: 400
Cluster ID 0x80000000
Running on A53-0 Processor
Processor Initialization Done
In Stage 2
NAND Boot Mode
Manufacturer: MICRON MT29F32G08ABCDBJ4 ,
Device Model: MT29F32G08ABCDBJ4 ,
Jedec ID: 0x2C
Bytes Per Page: 0x4000
Spare Bytes Per Page: 0x4C0
Pages Per Block: 0x100
Blocks Per LUN: 0x418
Number of LUNs: 0x1
Number of bits per cell: 0x1
Number of ECC bits: 0x1
Block Size: 0x400000
Number of Target Blocks: 0x418
Number of Target Pages: 0x41800
Nand Init Success
Multiboot Reg : 0x0
Image Header Table Offset 0x8C0
*Image Header Table Details*
Boot Gen Ver: 0x1020000
No of Partitions: 0x5
Partition Header Address: 0x260
Partition Present Device: 0x0
Initialization Success
In Stage 3, Partition No:1
UnEncrypted data Length: 0x6CE
Data word offset: 0x6CE
Total Data word length: 0x6CE
Destination Load Address: 0x0
Execution Address: 0x0
Data word offset: 0x7EF2
Partition Attributes: 0x100
Partition 1 Load Succes
In Stage 3, Partition No:2
UnEncrypted data Length: 0x23A
Data word offset: 0x23A
Total Data word length: 0x23A
Destination Load Address: 0x1B40
Execution Address: 0x0
Data word offset: 0x85C0
Partition Attributes: 0x100
Partition 2 Load Success
In Stage 3, Partition No:3
UnEncrypted data Length: 0x1F02
Data word offset: 0x1F02
Total Data word length: 0x1F02
Destination Load Address: 0x2440
Execution Address: 0x0
Data word offset: 0x8800
Partition Attributes: 0x100
Partition 3 Load Success
In Stage 3, Partition No:4
UnEncrypted data Length: 0x9
Data word offset: 0x9
Total Data word length: 0x9
Destination Load Address: 0x1AB4
Execution Address: 0x0
Data word offset: 0xA710
Partition Attributes: 0x100
Partition 4 Load Success
All Partitions Loaded
In Stage 4
Running Cpu Handoff address: 0x0, Exec State: 0
Exit from FSBL
Hello World running on A53 core 0
Related Links
MPSoC Secure Boot