blob: 08377a84a18823377430fbe4a36891e283f0c2ca (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
{ pkgs, lib, ... }:
{
name = "optee";
meta = {
maintainers = with lib.maintainers; [ jmbaur ];
};
nodes.machine =
{ config, pkgs, ... }:
let
inherit (pkgs) armTrustedFirmwareQemu opteeQemuAarch64 ubootQemuAarch64;
# Default environment for qemu-arm64 uboot does not work well with
# large nixos kernel/initrds.
uboot = ubootQemuAarch64.overrideAttrs (old: {
postPatch = (old.postPatch or "") + ''
substituteInPlace board/emulation/qemu-arm/qemu-arm.env \
--replace-fail "kernel_addr_r=0x40400000" "kernel_addr_r=0x50000000" \
--replace-fail "ramdisk_addr_r=0x44000000" "ramdisk_addr_r=0x58000000"
'';
});
bios = armTrustedFirmwareQemu.override {
extraMakeFlags = [
"SPD=opteed"
"BL32=${opteeQemuAarch64}/tee-header_v2.bin"
"BL32_EXTRA1=${opteeQemuAarch64}/tee-pager_v2.bin"
"BL32_EXTRA2=${opteeQemuAarch64}/tee-pageable_v2.bin"
"BL33=${uboot}/u-boot.bin"
"all"
"fip"
];
filesToInstall = [
"build/qemu/release/bl1.bin"
"build/qemu/release/fip.bin"
];
postInstall = ''
dd if=$out/bl1.bin of=$out/bios.bin bs=4096 conv=notrunc
dd if=$out/fip.bin of=$out/bios.bin seek=64 bs=4096 conv=notrunc
'';
};
in
{
virtualisation = {
inherit bios;
cores = 2;
qemu.options = [
"-machine virt,secure=on,accel=tcg,gic-version=2"
"-cpu cortex-a57"
];
};
# VM boots up via qfw
boot.loader.grub.enable = false;
boot.kernelModules = [ "optee" ];
services.tee-supplicant = {
enable = true;
# pkcs11 trusted application
trustedApplications = [ "${opteeQemuAarch64.devkit}/ta/fd02c9da-306c-48c7-a49c-bbd827ae86ee.ta" ];
};
};
testScript = ''
machine.wait_for_unit("tee-supplicant.service")
out = machine.succeed("${pkgs.opensc}/bin/pkcs11-tool --module ${lib.getLib pkgs.optee-client}/lib/libckteec.so --list-token-slots")
if out.find("OP-TEE PKCS11 TA") < 0:
raise Exception("optee pkcs11 token not found")
'';
}
|
