Secure boot for PIC32MZ using an external open source bootloader (PIC32 avrdude bootloader)

This page describes how to build a secure boot loader that verifies a signed firmware.

Building prplSecureBoot tools

Installing dependencies

apt-get install git
apt-get install make
apt-get install gcc
apt-get install libssl-dev

Obtaining the prplSecureBoot source code

git clone https://github.com/prplfoundation/prpl-secure-boot

The prpl-secure-boot directory should be created. Then, checkout the master branch.

cd prpl-secure-boot
git checkout master

Building and testing tools

make && make test

Make sure to add prpl-secure-boot/bin to user PATH.

Generating the pair of keys:

First, generate the keys. For example:

gen_keypair 
Generating RSA private key ...
.....................+++
................................+++
Extracting RSA public key ...
writing RSA key
Changing file permission ...
RSA keypair sucessfully generated:
-rw------- 1 veiga veiga 1704 Mar  9 03:54 private_key.pem
-rw-rw-r-- 1 veiga veiga  451 Mar  9 03:54 public_key.pem

Then, export the public key to be used as root key within the bootloader.

gen_rootkey public_key.pem > rootkey.h

Building the secure bootloader

Obtaining the PIC32-avrdude-bootloader source code

git clone https://github.com/mvneves/PIC32-avrdude-bootloader

The PIC32-avrdude-bootloader directory should be created. Then, checkout the secure-boot branch.

cd PIC32-avrdude-bootloader
git checkout secure-boot

Building the secure bootloader image

Copy rootkey.h file to the bootloader directory:

cp rootkey.h PIC32-avrdude-bootloader/bootloaders/secureboot/

Build the bootloader (for now, we only support Microchip PIC32MZ Starter Kit):

cd PIC32-avrdude-bootloader/bootloaders
make  microchip-eth-sk-uart-secureboot
ls Microchip_Eth_Starter_Kit_UART_SecureBoot.hex

The resulting bootloader image will be at Microchip_Eth_Starter_Kit_UART_SecureBoot.hex Use the MPLAB IPE tool to flash it to the board.

Generating a signed firmware image for prplHypervisor

Obtaining the prplHypervisor source code

git clone https://github.com/prplfoundation/prpl-hypervisor

The prpl-hypervisor directory should be created. Then, checkout the secure-boot branch.

cd prpl-hypervisor
git checkout secure-boot

Building a bare-metal application with a signed image

Obs: edit the Makefile PRIV_KEY variable to point to private_key.pem generated before.

cd platform/pic32mz_starter_kit
make
...
../../scripts/genhex.sh -k /home/veiga/prpl-secure-boot/tests/sample/private_key.pem blink 
0x9d008000
32768
0+1 records in
1+0 records out
32768 bytes (33 kB) copied, 0,000118795 s, 276 MB/s

prplSecureBoot Firmware Header:
Header version:          0x01
Flash start address:     0x9d000000
Execution address:       0x9d001000
Firmware start address:  0x9d0001f0
Firmware length:         0x7e10 (32272)
Firmware hash:           92fed6cdf29b7d118e659dbd84c85d4867d3b895a747a3ba221e42a26c4f346c (32)
Firmware signature:      051b5d841dfa70db2c358d62920e3f827e46cb07a7ace51aadde8b46629bfa6142d55f303caf8f8c4f67b24d5951b1b2e4f909fa6db445cb4bf687a38c727a9e3ec09fb5a60dccd957a323fe27e1b7a72d846d77f1a4655ec12f1ea3d84593ba7d78054e84b80da03b65fe59fb706aef646ea9ee556e548533e0f7a371445e29638c6766d02d8c6909339fa495112d98ca2d026c545e55b2acb8e9aa9ad0b484e25ae622e3c3851ff3d398922213b339c980c069314227c6a61e2c5f45b75d03d675d1f28259af7ea2d32bf77746aaaab4355543422d0c6b5dbba67b181ec4548553f0a8d7ad8abab1cb992763da31f4f441847393829b5fa65821f1ebfece9e (256)
Header size: 306
Firmware written to /tmp/prplHypervisor.bin.signed
0+1 records in
1+0 records out
32768 bytes (33 kB) copied, 9,5623e-05 s, 343 MB/s

The resulting firmware image will be at firmware.hex. Use the "make load" command to flash it to the board.

The hypervisor will only start if successfully verified. Otherwise, the board will remain in halt state and a red LED (LED1) will be turned on, as showed in image bellow.