Secure boot for PIC32MZ using prplSecureBoot™

This page describes how to build a secure boot loader that verifies a signed firmware.

Building prplSecureBoot tools

Obtaining the prplSecureBoot source code

git clone https://github.com/prplfoundation/prpl-secure-boot

The prpl-secure-boot directory should be created. Then, checkout the master branch.

cd prpl-secure-boot
git checkout master

Building and testing tools

make && make test

Make sure to add prpl-secure-boot/bin to user PATH.

Generating the pair of keys:

First, generate the keys. For example:

gen_keypair 
Generating RSA private key ...
.....................+++
................................+++
Extracting RSA public key ...
writing RSA key
Changing file permission ...
RSA keypair sucessfully generated:
-rw------- 1 veiga veiga 1704 Mar  9 03:54 private_key.pem
-rw-rw-r-- 1 veiga veiga  451 Mar  9 03:54 public_key.pem

Then, export the public key to be used as root key within the bootloader.

gen_rootkey public_key.pem > rootkey.h

Building prplSecureBoot bootloader

Copy rootkey.h file to the bootloader directory:

cp rootkey.h prpl-secure-boot/bootloaders/

Build the bootloader (for now, we only support Microchip PIC32MZ Starter Kit):

cd prpl-secure-boot/bootloaders/platform/pic32mz_starter_kit
make
ls Microchip_Eth_Starter_Kit_SecureBoot.hex

The resulting bootloader image will be at Microchip_Eth_Starter_Kit_SecureBoot.hex Use the MPLAB IPE tool to flash it to the board.

Starting the board at this time will produce the following output:

===========================================================
prplSecureBoot v0.1.0 [Mar 29 2017, 00:15:34]
Copyright (c) 2017, prpl Foundation
===========================================================
No firmware image found.
Invalid firmware.

Generating a signed firmware image for prplHypervisor

Obtaining the prplHypervisor source code

git clone https://github.com/prplfoundation/prpl-hypervisor

The prpl-hypervisor directory should be created. Then, checkout the secure-boot branch.

cd prpl-hypervisor
git checkout secure-boot

Building a bare-metal application with a signed image

Obs: edit the Makefile PRIV_KEY variable to point to private_key.pem generated before.

cd platform/pic32mz_starter_kit
make
...
../../scripts/genhex.sh -k /home/veiga/prpl-secure-boot/tests/sample/private_key.pem blink 
0x9d008000
32768
0+1 records in
1+0 records out
32768 bytes (33 kB) copied, 0,000118795 s, 276 MB/s

prplSecureBoot Firmware Header:
Header version:          0x01
Flash start address:     0x9d000000
Execution address:       0x9d001000
Firmware start address:  0x9d0001f0
Firmware length:         0x7e10 (32272)
Firmware hash:           92fed6cdf29b7d118e659dbd84c85d4867d3b895a747a3ba221e42a26c4f346c (32)
Firmware signature:      051b5d841dfa70db2c358d62920e3f827e46cb07a7ace51aadde8b46629bfa6142d55f303caf8f8c4f67b24d5951b1b2e4f909fa6db445cb4bf687a38c727a9e3ec09fb5a60dccd957a323fe27e1b7a72d846d77f1a4655ec12f1ea3d84593ba7d78054e84b80da03b65fe59fb706aef646ea9ee556e548533e0f7a371445e29638c6766d02d8c6909339fa495112d98ca2d026c545e55b2acb8e9aa9ad0b484e25ae622e3c3851ff3d398922213b339c980c069314227c6a61e2c5f45b75d03d675d1f28259af7ea2d32bf77746aaaab4355543422d0c6b5dbba67b181ec4548553f0a8d7ad8abab1cb992763da31f4f441847393829b5fa65821f1ebfece9e (256)
Header size: 306
Firmware written to /tmp/prplHypervisor.bin.signed
0+1 records in
1+0 records out
32768 bytes (33 kB) copied, 9,5623e-05 s, 343 MB/s

The resulting firmware image will be at firmware.hex. Use the MPLAB IPE tool to flash it to the board.

The booloader will calculate the firmware hash and verify the signature:

===========================================================
prplSecureBoot v0.1.0 [Mar 23 2017, 09:37:11]
Copyright (c) 2017, prpl Foundation
===========================================================
prplSecureBoot Firmware Header:
Header version:          0x01
Flash start address:     0x9d000000
Execution address:       0x9d001000
Firmware start address:  0x9d0001f0
Firmware length:         0x7e10 (32272)
Firmware hash:           b4d7a9f202f74450e872918801142504c02409f33fa51968453c309d21535508 (32)
Firmware signature:      4447c0fbae615785232670ff59d73f64d1b182d8b0a7d17e7e876e46b06bc1da73927f8005d1d26fca67fab3e910d7f0b303362f8515b6601263c5a0e883ca6135c0a38453b2c236808d4cff95c7e3c75dcdae5bbffd8b374ad16759acb568b68ed81917cceff621855acc83c9d52b2460f8fe084c10c36ec14777ed84bc1ebd2e1cb9cb7ce7565dc4f141caa57b94d735cf840f8990b12f1ed2be5217692d3bd8d0d3c7175e1187b61a04a2eb74e9490f55f69f3c05dfe600d4b9ce3a5f5a5689bd051be524a7748876d161c7fa1e297c6c6afe3c34dde9f10dbc5dd827d6cd855a23456697658bf702c3e23d74e505b9995c30678a01da8ff9363b5e82b4a5 (256)
Verifying hash integrity... OK.
Verifying signature authenticity... OK.
Starting firmware...

===========================================================
prplHypervsior v0.12.88 (gdbeb481) [Mar 22 2017, 00:10:11]
Copyright (c) 2016, prpl Foundation
===========================================================
CPU Core:      M5150
Board:         Microchip Starter Kit
System Clock:  200MHz
Heap Size:     29Kbytes
Scheduler:     10ms
Guest Tick:    1ms
VMs:           1

Initializing Virtual Machines.
Configuring blink VM starting at 0x80008000 RAM address.
PIC32mz in Vectored Interrupt Mode.
Inter-VM communication hypercalls registered.
Ethernet PHY at 0
Ethernet interface en0: interrupt 153, MAC address d8:80:39:75:a6:1a
Ethernet device is a SMSC LAN8740A
Interrupt redirect driver registered.
Initializing USB device in Host mode.
USB interrupt vector at 0x220
Software reset interrupt (SW1) registered at offset 0x240.
UART driver enabled. Interrupt vector 0x260
Device mapping hypercalls registered.
CP0 Timer interrupt registered at 0x280.
Starting hypervisor execution.

Blink green LED! Total of 0 timer ticks.
Blink green LED! Total of 900 timer ticks.
Blink green LED! Total of 1800 timer ticks.
...

The hypervisor will only start if successfully verified. Otherwise, the board will remain in halt state and a red LED (LED1) will be turned on, as showed in image bellow.