03.06.21
Posted in BSD, GNU/Linux, Hardware, Kernel at 7:59 pm by Guest Editorial Team
By Gavin L. Rebeiro
Contents
Cover
Copyright
1 Acknowledgements
2 Introduction
2.1 Prerequisite Knowledge
2.2 Apparatus
3 Fundamentals
3.1 Communication
3.2 Kernel Ring Buffer
3.3 Drivers
3.4 Operating Systems
3.5 Special Files
4 YOU ARE HERE ☞ Doing The Task
4.1 Preparing The Boot Media
4.2 Connecting Physical Components
4.3 Using Picocom
4.4 OS Installation
5 Thanks
6 OpenPGP Key
A Malicious Hardware
B Linux Kernel Source Tree Analysis
C Digital Multimeter Tests
Summary: We now spell out the steps taken to actually replace the Raspberry Pi OS with something more trustworthy (for background see Part I, Part II, and Part III)
We’ve now covered enough ground to make the installation of
NetBSD on our Raspberry Spy (over our UTUB) a relatively painless matter.
Let’s go through the process in little steps.
4.1 Preparing The Boot Media
I’m going to grab the appropriate NetBSD image by taking hints from the following:
• NetBSD/evbarm on Raspberry Pi tells us everything we need to know to pick the right image. All the sections here related to booting are worth reading at least once. Also read sections about consoles and serial consoles at least once.
• Raspberry Pi boot modes is useful if you want to dig deeper into the booting mechanisms of the Raspberry Spy. USB mass storage boot is particularly useful for booting off USB. Trust me, you don’t want to muck around with SD cards; they’re a nightmare.
• NetBSD/evbarm can be referenced for general information about NetBSD on ARM boards.
The above links should give you a good idea of what’s going on and what needs to be done with regards to putting a NetBSD on a boot media that goes into a Raspberry Spy.
Let’s go through a concrete example.
My Raspberry Spy is of the model “3 B+” variety so I’m dealing with an ARM64 CPU architecture. We’ll follow along the instructions outlined in Installation procedure for NetBSD/evbarm; pay close attention to the section “NetBSD/evbarm subdirectory structure”; I follow these instructions as I explore Index of pub/NetBSD/NetBSD-9.1/evbarm-aarch64/.
I grab the appropriate image like so:
$ mkdir ~/Downloads/netbsd
$ cd ~/Downloads/minted
$ wget https://cdn.netbsd.org/pub/NetBSD/NetBSD-9.1/evb c
→ arm-aarch64/binary/gzimg/arm64.img.gz
Now that we’ve got the image, we can write it to our boot media. I’m going to assume you have an appropriate reader already plugged into your GNU/Linux box. I’ve got my USB thumb drive as “/dev/sdg” on my system. Use the right block device file on your system1. We base our procedure along the lines of “Installation for ARMv7 and AArch64 devices with U-Boot” section from Installation procedure for NetBSD/evbarm:
$ gzip --decompress --keep arm64.img.gz
# dd if=arm64.img of=/dev/sdg bs=1M conv=sync
→ status=progress
$ lsblk -f | grep sdg
We’re going to ignore the minutiae of writing to block devices, bootloaders, and other adjacent topics related to the utilities we just used; that’s left for another time. We care about learning how to use a serial console in this project so we must stay focused on our primary target.
We’re going to have a look at how to make a serial install possible via some editing of the “cmdline.txt” file that now resides in the boot media (on the boot partition which is of type “vfat”):
# mkdir /media/netbsd_image
# mount /dev/sdg1 /media/netbsd_image
# grep "console" < cmdline.txt
# root=ld0a console=fb
# grep "enable_uart" < config.txt
# enable_uart=1
The “console=fb” part is to get out OS image to use the HDMI output. We will get rid of that string from the file “cmdline.txt”. Who needs that anyway? One way to do it2:
# ed cmdline.txt
21
,p
root=ld0a console=fb
1
root=ld0a console=fb
s/console=fb//
,p
root=ld0a
wq
11
# echo ",p" | ed cmdline.txt
11
root=ld0a
Remember to check your edits!
We also ensure that “enable_uart=1” is set in the file “config.txt”:
# echo ",p" | ed config.txt
82
arm_64bit=1
kernel=netbsd.img
kernel_address=0x200000
enable_uart=1
force_turbo=0
Everything looks good! Additional useful information on the Raspberry Spy UART can be found in UART configuration. Pretty self-explanatory. That wasn’t so hard. Was it? Note that the following links document the files we’ve been messing around with:
• The Kernel Command Line
• config.txt
It’s a good idea to back up the state of your image, at this point3. We can now safely unmount our boot media and get on with the project:
# cd ~
# umount /media/netbsd_image
We change directory, before we unmount, so that we don’t get any “device busy” errors.
We’ve now got our boot media ready. Onwards!
4.2 Connecting Physical Components
Before you power up your UTUB, you should really check that the pins are working properly. The very basic test you should do is to check that the right voltage is being supplied. Check out Appendix C.
The pins on our UTUB and Raspberry Spy that we’re interested are the following:
• Raspberry Spy: Pin6 (Ground), Pin8 (GPIO14, TXD), Pin10 (GPIO15, RXD). You can find the layout in the official GPIO page.
• UTUB: I’ve got a CP2104 UTUB so I’ve got to only worry about the pins marked TX, RX, and GND. I have other pins on the module but they’re not relevant for this task.
We won’t be using any of the voltage pins on the boards because it’s more prone to errors. Just use the USB power supply that comes with your Raspberry Spy.
Don’t plug anything into power for the following sequence. Connect the jump-wires like so:
• Ground on UTUB to Ground (Pin6) on Raspberry Spy.
• TX on UTUB to RX (Pin10) on Raspbery Spy.
• RX on UTUB to TX on (Pin8) Raspberry Spy.
“We won’t be using any of the voltage pins on the boards because it’s more prone to errors.”Don’t make the rookie mistake of matching TX with TX and RX with RX; TX always goes to RX and RX always goes to TX. Keep this in mind, always, when working with UARTs. Colour-coding your jump-wires helps.
We’ll just go over the order of attaching the stuff to do with power on our devices:
• Attach the USB power adapter to the Raspberry Pi without plugging the adapter into the power outlet.
• Attach the UTUB to your GNU/Linux box.
• Attach your USB power adapter to your power outlet.
The logic for the above procedure is that you can ensure that your serial interface is up and running before you start getting input from your Raspberry Spy.
4.3 Using Picocom
Using picocom(1) is simple. All we need to do is select the correct baud rate and give the right device file as a parameter to picocom(1).
I’ll give you an extract from the manual page to enlighten you:
In effect, picocom is not an "emulator" per-se. It is a
simple program that opens, configures, manages a serial
port (tty device) and its settings, and connects to it
the terminal emulator you are, most likely, already
→ using
(the terminal window application, xterm, rxvt, system
console, etc).
When picocom starts it opens the tty (serial port)
given as its non-option argument. Unless the
--noinit option is given, it configures the port to
the settings specified by the option-arguments (or
to some default settings), and sets it to "raw"
mode. If --noinit is given, the initialization and
configuration is skipped; the port is just opened.
Following this, if standard input is a tty, picocom
sets the tty to raw mode. Then it goes in a loop
where it listens for input from stdin, or from the
serial port. Input from the serial port is copied
to the standard output while input from the standard
input is copied to the serial port. Picocom also
scans its input stream for a user-specified control
character, called the escape character (being by
default C-a). If the escape character is seen, then
instead of sending it to the serial-device, the
program enters "command mode" and waits for the next
character (which is called the "function
character"). Depending on the value of the function
character, picocom performs one of the operations
described in the COMMANDS section below.
We use “C-a C-x” (Ctrl+a followed by Ctrl+x)4 to tell picocom(1) to exit; for more, RTFM; in particular, pay close attention to the “COMMANDS” section.
Make sure you’ve set up all the physical connections, as advised. It’s time to attach our UTUB to our GNU/Linux box and then make sure we invoke picocom(1) correctly:
# picocom --baud 115200 /dev/ttyUSB0
picocom v3.1
port is : /dev/ttyUSB0
flowcontrol : none
baudrate is : 115200
parity is : none
databits are : 8
stopbits are : 1
escape is : C-a
local echo is : no
noinit is : no
noreset is : no
hangup is : no
nolock is : no
send_cmd is : sz -vv
receive_cmd is : rz -vv -E
imap is :
omap is :
emap is : crcrlf,delbs
logfile is : none
initstring : none
exit_after is : not set
exit is : no
Type [C-a] [C-h] to see available commands
Terminal ready
It really is that simple. You’ve now got a serial terminal ready and listening.
4.4 OS Installation
Now that you’ve got a serial terminal operational, all we have to do to install NetBSD on the Raspberry Spy is to plug the USB power adapter into the power outlet. Keep a close eye on what goes on in the output of your serial terminal:
...
[ 7.4246937] root device:
[ 11.6252523] use one of: mue0 sd0[a-p] ddb halt reboot
[ 11.6252523] root device: sd0
[ 13.9755661] dump device (default sd0b):
[ 15.7257992] file system (default generic):
...
You should be promoted to pick a root device. I pick “sd0” as it’s the first ’disk’ offered by NetBSD (which can only be my boot media)5. I go for the suggested defaults, for everything else. No need to overcomplicate things, at this point.
You will probably see your Raspberry Spy reboot once or twice during the OS install process. Just pass the same parameters for the boot device, and you should be good to go.
Eventually, you should be met with the following:
...
NetBSD/evbarm (arm64) (constty)
...
login:
If you login as “root”, you should have a nice login shell presented to you.
And we are done! You’ve successfully done some tinkering over a serial terminal. That wasn’t so hard. Was it? You can shutdown your device (halt the OS) like so:
# shutdown -p now
...
[ 910.5814809] The operating system has halted.
[ 910.5814809] Please press any key to reboot.
You can now disconnect the power supply from your Raspberry Spy. Then just send “C-a C-x” to picocom(1); after which, you should see:
...
Terminating...
Thanks for using picocom
#
Welcome to the world of serial terminals; hack your heart out! █
____
1 The command lsblk -f should help you out here. Don’t wipe the wrong device by accident.
2 If you use another text editor, that’s fine. You really should learn ed(1) at some point though, especially if you want to get into embedded systems.
3 At least keep track of the files that you tweaked. If you use some sort of version-control-system, you get bonus points.
4 I don’t know why the manual doesn’t bother to explicitly mention that these are GNU-Emacs-style key sequences.
5 See the NetBSD sd(4) manpage for details.
Permalink
Send this to a friend
Posted in BSD, Free/Libre Software, GNU/Linux at 6:12 am by Guest Editorial Team
By Gavin L. Rebeiro
Contents
Cover
Copyright
1 Acknowledgements
2 Introduction
2.1 Prerequisite Knowledge
2.2 Apparatus
3 YOU ARE HERE ☞ Fundamentals
3.1 Communication
3.2 Kernel Ring Buffer
3.3 Drivers
3.4 Operating Systems
3.5 Special Files
4 Doing The Task
4.1 Preparing The Boot Media
4.2 Connecting Physical Components
4.3 Using Picocom
4.4 OS Installation
5 Thanks
6 OpenPGP Key
A Malicious Hardware
B Linux Kernel Source Tree Analysis
C Digital Multimeter Tests
Summary: Following the introductory and preliminary parts (Part I and Part II) we dive deeper into the steps taken to replace the Raspberry Pi’s GNU- and Linux-based OS with something like NetBSD
Now that you know what you need to get started, let’s gently walk through an overview of the fundamental ideas and topics that we’ll be engaging and experimenting with.
The order of topics may seem strange at first but things should make sense as you move on.
3.1 Communication
If we want two computers to communicate, there needs to be some protocol that they both speak.
If we want two computers to communicate, there needs to be a physical medium over which they can communicate.
Almost all computers and their peripherals communicate over USB these days. But when it comes to getting into the nitty-gritty details, you will often find UART humbly serving the same purpose it has for decades of computing. Fortunately for us, almost every embedded system these days supports UART; this includes the Raspberry Spy.
“Why bother with this anachronistic technology? Glad you asked!”We’ll be using our UTUB to install a new OS on our Raspberry Spy over a serial interface (UART). The program that we’ll be using to do this serial communication is picocom(1).
Why bother with this anachronistic technology? Glad you asked! Once you know how to operate something like a UTUB and a program like picocom(1), you can “break into” several devices and modify them how you wish. Routers, motherboards,
embedded systems, etc. all tend to have some sort of serial interface on them. Once you learn the basics, you are equipped to liberate yourself and gain more computing freedom.
But wait. Isn’t all this embedded stuff way too difficult and only for “experts”? HOGWASH! You can do it too. Don’t
fall for the propaganda. You are perfectly capable of doing a bit of serial hacking to liberate your devices. You paid for them, after all. You should be able to do whatever you want with them (and you will). Onwards!
3.2 Kernel Ring Buffer
What on earth is a “kernel ring buffer” (KRB)? Ever heard of dmesg(1)? dmesg(1) is what you use to read the KRB. Not so scary now. Is it?
Why is the KRB important? Well: when you plug in (or out) a device, you can see the messages show up in the KRB. If you learn how to pay attention to the KRB, when you are working with hardware, you will become a lot better at trouble-shooting your own problems. Take strings you don’t understand and plop them into your favourite search engine; try the apropos(1) command as well.
As we progress with our project, we’ll see how to leverage dmesg(1) to our advantage. Learning proper use of dmesg(1)
is an essential skill if you want to improve and maintain your computing freedom; dmesg(1) allows you to demystify the inner workings of your computer and get clues on how to fix problems yourself.
3.3 Drivers
Say you plug in your mouse or keyboard into your computer; or even plug them out. The software responsible for translating the physical signals from the mouse or keyboard, to the intermediary physical devices, to the more abstract layers of your operating system (like stuff you see on the screen) is called the kernel; this is the “Linux” part of GNU/Linux.
The kernel is the layer of software that sits between the physical hardware and the more abstract levels of software that gives you an “operating system”. When you plug in or out your keyboard or mouse, the Kernel has programs which recognise those types of devices and then loads the appropriate software required to use those physical devices; such software are called “device drivers”.
All of the above is a bit vague. Let’s take a look at what this looks like in practice; I’m going to plug out and plug back in my mouse while staring at dmesg(1):
1 # dmesg --human --follow
2 ...
3 [Feb19 17:26] usb 7-4: USB disconnect, device number 2
4 [ +25.036175] usb 7-4: new low-speed USB device number
→ 4 using ohci-pci
5 [ +0.193047] usb 7-4: New USB device found,
→ idVendor=0461, idProduct=4d81, bcdDevice= 2.00
6 [ +0.000006] usb 7-4: New USB device strings: Mfr=0,
→ Product=2, SerialNumber=0
7 [ +0.000004] usb 7-4: Product: USB Optical Mouse
8 [ +0.007570] input: USB Optical Mouse as
→ /devices/pci0000:00/0000:00:16.0/usb7/7-4/7-4:1.0/0 c
→ 003:0461:4D81.0005/input/input18
9 [ +0.000303] hid-generic 0003:0461:4D81.0005:
→ input,hidraw3: USB HID v1.11 Mouse [USB Optical
→ Mouse] on usb-0000:00:16.0-4/input0
We’ll briefly analyse this output and introduce a few important tools in the process.
The first thing to note is this string “using ohci-pci”. It’s time to bring in the Linux-specific tool modinfo(8); let’s take a look at what we’re dealing with:
1 $ modinfo ohci_pci
2 name: ohci_pci
3 filename: (builtin)
4 softdep: pre: ehci_pci
5 license: GPL
6 file: drivers/usb/host/ohci-pci
7 description: OHCI PCI platform driver
That output is quite self-explanatory. We see the name of the kernel module; we see that its a builtin kernel module (which means it’s compiled into the kernel). “softdep” stands for soft dependency. We see that the license is GPL. We see the location in the kernel source tree this kernel module resides. And, finally, we see a short description of the kernel module.
I hope, at the point, you’ve realised that “kernel module” is synonymous with “driver”. See? Not that complicated.
So what does this have to do with our USB mouse? Well: when it comes to interfaces, there’s usually a few things that sit between your device and the userspace of your operating system. I’ll leave it as a research project for you to figure out what “HCI”, “OHCI”, “EHCI”, “PCI”, etc. mean.
The next crucial bit of driver information here is the “hid-generic” part; find out what this kernel module does with modinfo(8).
The next thing I want you to do is have a look at the output of the Linux-specific tool lsmod(8); Note the column headers. grep(1) through the lsmod(8) output for the following strings:
• usbhid
• hid_generic
• hid
The “USB HID v1.11 Mouse” from our dmesg(1) output should give us a good idea of what’s going on here. Don’t know what
“USB HID” means? Look it up. Find out what the above kernel modules do, from the stuff you’ve already learned so far.
Let’s take a look at some sample lsmod(8) output:
1 $ cat <(lsmod | head -n 1) <(lsmod | grep hid)
2 Module Size Used by
3 mac_hid 16384 0
4 hid_generic 16384 0
5 usbhid 57344 0
6 hid 135168 2 usbhid,hid_generic
You’ve now got a bit of background knowledge to make sense of what’s going on when you plug things in and out of your GNU/Linux unit.
3.4 Operating Systems
We’re going to be a bit adventurous with our choice of OS to put on the Raspberry Spy. We’re going to go with NetBSD; this is a great OS for embedded systems and one you should be familiar with if you plan on doing any embedded work.
NetBSD is an OS with its own kernel and userspace. Thus, NetBSD runs the NetBSD kernel and NetBSD userspace utilities; this is in contrast to the Linux kernel and GNU userspace (GNU/Linux)1.
NetBSD is quite a beginner-friendly BSD because it has ample documentation; the fact that NetBSD has the primary focus of portability also means you can learn a great deal about portability from several perspectives.
A side note here. Avoid usage of package managers. They are bad for your freedom; to most people, package managers are entirely opaque systems that turn the computer operator into a mere consumer. Learn how to build your software from source code. This way you see all the dependencies2.
The opaque package manager is exactly how the Raspberry Spy Foundation smuggled in spyware into the Raspberry Spy. If you build all your programs from source code, you would be less vulnerable to these espionage tactics3.
You should be the operator of your computer, not a “user”. A “user” is effectively being “used” because they are treated like stupid consumers that get dictated to by other people. Don’t fall for this “user” trap. Be the operator of your computer; take back control; education is the true path to computing freedom.
Note that a lot of these operating systems we’re talking about follow some version of the POSIX specification (with varying degrees of compliance).
3.5 Special Files
It’s important to understand how special files relate to device drivers. What’s a special file? Glad you asked.
Let’s take a look at our friend dmesg(1) as we plug in our UTUB:
1 [Feb22 12:13] usb 7-1: new full-speed USB device number
→ 3 using ohci-pci
2 [ +0.202882] usb 7-1: New USB device found,
→ idVendor=10c4, idProduct=ea60, bcdDevice= 1.00
3 [ +0.000006] usb 7-1: New USB device strings: Mfr=1,
→ Product=2, SerialNumber=3
4 [ +0.000003] usb 7-1: Product: CP2104 USB to UART
→ Bridge Controller
5 [ +0.000003] usb 7-1: Manufacturer: Silicon Labs
6 [ +0.000003] usb 7-1: SerialNumber: 010C48B4
7 [ +0.024088] usbcore: registered new interface driver
→ usbserial_generic
8 [ +0.000010] usbserial: USB Serial support registered
→ for generic
9 [ +0.003272] usbcore: registered new interface driver
→ cp210x
10 [ +0.000025] usbserial: USB Serial support registered
→ for cp210x
11 [ +0.000081] cp210x 7-1:1.0: cp210x converter detected
12 [ +0.010528] usb 7-1: cp210x converter now attached to
→ ttyUSB0
Bit of a mouthful. Let’s break it down into pieces that we can actually digest:
• Take a look at the Linux kernel modules usbcore, usbserial, and cp210x with modinfo(8). Not so scary now. Is it?
• Next, have a look at the line “usb 7-1: cp210x converter now attached to ttyUSB0”. You should understand all the lines leading up to this one; however, we need to do a bit of digging to find out what this whole “ttyUSB0” business is about. We’ll look into some other helpful things in the process.
Here we have a special file called ttyUSB0; So uh where is this file? Let’s see:
1 $ find / -name "ttyUSB0" 2> /dev/null
2 /dev/ttyUSB0
3 /sys/class/tty/ttyUSB0
4 /sys/devices/pci0000:00/0000:00:16.0/usb7/7-1/7-1:1.0/t c
→ tyUSB0
5 /sys/devices/pci0000:00/0000:00:16.0/usb7/7-1/7-1:1.0/t c
→ tyUSB0/tty/ttyUSB0
6 /sys/bus/usb-serial/devices/ttyUSB0
7 /sys/bus/usb-serial/drivers/cp210x/ttyUSB0
The path we really want here is “/dev/ttyUSB0”4. Time to do a quick check:
1 $ ls -al /dev/ttyUSB0
2 crw-rw---- 1 root dialout 188, 0 Feb 22 12:13
→ /dev/ttyUSB0
The “c” in “crw-rw–” tells us that this is a character file. The “188, 0” tells us that the “major” and “minor” number, respectively, of this special “character file”. These files are created with mknod(1). The following can be a useful pointer, when you are lost:
1 $ file --mime /dev/ttyUSB0
2 /dev/ttyUSB0: inode/chardevice; charset=binary
Good stuff. We’re getting somewhere. To find a full list of what these major and minor numbers refer to, we can have a look in the Linux kernel source tree:
1 $ less linux/Documentation/admin-guide/devices.txt
2 ...
3 188 char USB serial converters
4 0 = /dev/ttyUSB0 First USB
→ serial converter
5 1 = /dev/ttyUSB1 Second USB
→ serial converter
6 ...
7 ...
That’s that part demystified. Isn’t learning great? Now you know where to get the right numbers if you want to use mknod(1) manually on GNU/Linux systems5.
Now what does all of this mean? We essentially have “cp210x” which is a discrete Linux kernel module; this Linux kernel module is then “attached” to the special file ttyUSB0; it’s this special file ttyUSB0 that the program picocom(1) will be attached to, in order to perform serial communications.
You can also see where the different parameters like “idVendor” and “idProduct” come from by taking a look at the appropriate path in the Linux kernel source tree:
1 find ./ -regex ".*cp210x.*"
2 ./drivers/usb/serial/cp210x.c
3 $ less drivers/usb/serial/cp210x.c
4 ...
5 { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs
→ factory default */
6 ...
On GNU/Linux systems, you should also take a look at the path /usr/share/misc/usd.ids:
1 $ less /usr/share/misc/usb.ids
2 ...
3 10c4 Silicon Labs
4 ...
5 ea60 CP210x UART Bridge
6 ...
Now let’s have a look at what it looks like when we pull out our UTUB:
1 $ dmesg --human --follow
2 ...
3 [Feb22 15:45] usb 7-1: USB disconnect, device number 3
4 [ +0.000384] cp210x ttyUSB0: cp210x converter now
→ disconnected from ttyUSB0
5 [ +0.000164] cp210x 7-1:1.0: device disconnected
There you have it! You should understand what’s going on in that output, with your new knowledge of Linux kernel internals. Remember, tools like lsmod(8), modinfo(8), and dmesg(1) are the first things you should look at when you plug things in and out of your GNU/Linux box. This stuff is incredibly simple, if you know where to look; now you know where to look! No need to be afraid.
Finally, we have the commands:
$ lscpi -k
and
$ lsusb -t
You now know enough to figure out yourself what you get from lspci -k and lsusb -t6.
You now have a healthy dose of knowledge injected into your grey matter to enable you to handle special files on GNU/Linux systems7. █
_____
1 Technically, there’s also different bootloaders to worry about but we’re going to ignore bootloaders for now as we have enough to deal with. It’s also very unfair to GNU to just call it “userspace”; GNU gave the world things like the GNU Compiler Collection and GNU Autotools – things without which much of software today wouldn’t exist; there seems to be mass amnesia in the computing world around this, whether it be deliberate or not. And guess what? GNU was about freedom, first and foremost.
2 i.e., how much junk the software you want to use depends on. It’s a great way to filter out bloatware. You will also be able to learn to spot “common denominator” programs software of a certain type depends on. Often, this will enable you to refine your criteria for a program in order to find exactly what you need – opposed to what you think you need (or what others make you think you need).
3 However, don’t think you’re entirely immune, if you compile everything from source. Much has been infiltrated at the source code level.
4 The other paths are just as interesting. See Appendix B for details on the specifics.
5 A skill every GNU/Linux operator should have.
6 Don’t know what the options mean? RTFM.
7 Some of this special file handling knowledge applies to other POSIX-like operating systems as well, with minor details changed.
Permalink
Send this to a friend