1.2.1. Running Keystone with QEMU¶
QEMU is an open source machine emulator. The latest QEMU supports RISC-V ISA.
Keystone is tested in the latest RISC-V QEMU (GitHub). The upstream QEMU might not work because it has a bug in the PMP module (See GitHub issue <>. The fix will be upstreamed in the future.
1.2.1.1. Installing Dependencies¶
We tested Keystone with QEMU on CentOS and Ubuntu 16.04/18.04
1.2.1.1.1. Cent OS¶
sudo yum install autoconf automake autotools-dev bc bison build-essential \
curl expat expat-devel flex gawk gcc gcc-c++ git gperf libgmp-dev libmpc-dev \
libmpfr-dev libtool mpfr-devel texinfo tmux patchutils zlib1g-dev zlib-devel \
wget bzip2-devel lbzip2 patch
1.2.1.1.2. Ubuntu¶
sudo apt update
sudo apt install autoconf automake autotools-dev bc bison build-essential curl \
expat libexpat1-dev flex gawk gcc git gperf libgmp-dev libmpc-dev libmpfr-dev \
libtool texinfo tmux patchutils zlib1g-dev wget bzip2 patch vim-common lbzip2 \
python pkg-config libglib2.0-dev libpixman-1-dev
1.2.1.2. Compile Sources¶
1.2.1.2.1. Clone the repository¶
git clone https://github.com/keystone-enclave/keystone
cd keystone
git submodule update --init --recursive
1.2.1.2.2. Install RISC-V GNU Toolchain¶
mkdir riscv
export RISCV=$(pwd)/riscv
export PATH=$PATH:$RISCV/bin
cd riscv-gnu-toolchain
./configure --prefix=$RISCV
make && make linux
cd ..
This step installs RISC-V GNU toolchain in the keystone/riscv
directory.
To keep environment variables, add export PATH=$PATH:<path/to/keystone>/riscv/bin
to your .bashrc
.
You can also manually run source source.sh
to set the environment variables.
1.2.1.2.3. Create Disk Image using Busybear¶
See Busybear repo for more information.
cd busybear-linux
make
cd ..
1.2.1.2.4. Build RISC-V QEMU¶
You should apply patches before building the QEMU.
./scripts/apply-patch.sh
cd riscv-qemu
./configure --target-list=riscv64-softmmu,riscv32-softmmu
make
cd ..
1.2.1.2.5. Build Linux Kernel with Built-in Keystone Driver¶
cd riscv-linux
cp ../busybear-linux/conf/linux.config .config
make ARCH=riscv olddefconfig
make ARCH=riscv vmlinux
cd ..
1.2.1.2.6. Build Berkeley Bootloader (BBL) with Keystone Security Monitor¶
Make sure to add --enable-sm
when you run configure
so that the security monitor is included in the bbl.
cd riscv-pk
mkdir build
cd build
../configure \
--enable-logo \
--host=riscv64-unknown-elf \
--with-payload=../../riscv-linux/vmlinux \
--enable-sm
make
cd ../..
1.2.1.2.7. Build Root-of-Trust Boot ROM¶
cd bootrom
make
cd ..
1.2.1.2.8. Build Keystone SDK¶
Keystone SDK includes sample enclave programs and some useful libraries. To run sample programs, you should compile SDK library and apps, and copy all of them into the disk image. Following commands will compile the sdk, and copy sample binaries into the busybear.bin
disk image.
cd sdk
make
make copy-tests
cd ..
1.2.1.3. Launch QEMU¶
Now, you’re ready to run Keystone.
The following script will run QEMU, start executing from the emulated silicon root of trust. The root of trust then jumps to the SM, and the SM boots Linux!
sudo chmod og+w busybear-linux/busybear.bin
./scripts/run-qemu.sh
Login as root
with the password busybear
.
You can exit QEMU by ctrl-a``+``x
1.2.1.4. Run Tests¶
You can run Keystone enclaves by using an untrusted host application. We already implemented a simple host test-runner.riscv
for running tests.
Following command will create and execute the enclave.
./test-runner.riscv <user elf> <runtime elf>
To run all tests, you could simply run
./test