2012 Embedded Linux Conference | Schedule | Linux Foundation Events.

Setup to use Arduino as JTAG adapter

The complete project should include:

• Arduino sketch
• OpenOCD integration
• Python API
• Arduino shield with common connectors etc.

In particular the shield should have:

• Level shifters between the 5V of Arduino and the voltage of the target chip
• Some standard connectors (at least the 20 pin and the 10 pin)
• Power supply and ground lines
• Some jumpers for configuration (for example to bypass level shifters or to choose connector)

If the target chip that I want to debug works at 5V like the Arduino then the shield could actually be optional, but some wires must be used in place of the JTAG connectors.

I have started a project on GitHub called JTAGduino, that up to now contains the Arduino sketch and a Python API to access basic functionality. It should already be possible to use it to send some JTAG sequences to a 5V target chip.

I decided that inside the Arduino I should keep just some basic code to manage and drive the pins, and let the host PC do the “JTAG” logic of knowing the TAP state and fill Instruction Register and Data Register. By looking at OpenOCD source code it seems like it’s a common design choice.

The default mapping of Arduino pins to JTAG pins is that pins 2, 3, 4, 5 and 6 are used for TCK, TMS, TDI, TDO and TRST. The default speed is the maximum one, with TCK moving at 1MHz.

The next step would be to fork the OpenOCD repository and add the “JTAGduino” driver.

The usage scenario is having a PC/laptop available, inserting my USB key, turn on the PC booting from USB, insert password and access my Linux OS. The PC can be my own laptop, or even a PC that I don’t own, provided that it can boot from USB.

From a security point of view it is possible that if I insert my USB key in a PC that I don’t trust, it can do a tamper/keylog/dump attack. However, unless I am carrying military-grade secrets (and I’m not), it is unreasonable to be afraid that someone tampered the BIOS/hardware of any computer available in my travels.

I also wanted to give my USB key the traditional functionality of working as a drive in Windows. There are a couple of things to consider:

• Windows can read FAT and NTFS partitions.
• Windows can read only the first partition of an USB flash drive (quite the WTF here).

It is possible that when you insert the USB key in a running Windows environment a malicious software can dump an image of the flash drive encrypted data, tamper the bootloader and insert a keylogger that sends your password to the same entity that can access the dumped image. Again, I don’t think this specific attack is realistic when you are just carrying your personal data around.
While the Windows partition is unencrypted, some portable software can be used to save encrypted data, for example FreeOTFE, TrueCrypt or even 7zip.

With this in mind, my solution is to use an unencrypted bootloader+kernel and a LUKS-encrypted filesystem (containing Debian testing) on an USB key that is at least 8GiB. The “stack” of the partitioning and file system is shown below.

Partitioning of encrypted Linux system on 8GB USB flash

The green part of the partitioning are the “secure” filesystems, where you need a password to decrypt it. The red parts are unencrypted zones where I should not put sensitive data (without some precautions). The swap region must be kept in the encrypted side of the partitioning, because you can’t know what is saved inside; even passwords can remain written unencrypted after shutdown. Since the LUKS volume must contain two partitions, LVM must be used to create them.

To create my USB key I have some options, for example:

• using debootstrap or using Debian CD installer
• using the USB key itself during installation or using an image file that I can copy to USB flash once it’s ready
• using QEMU or using a real PC

For simplicity, and taking into account the tools that I’m familiar with, my choice is to use QEMU to install Debian from a CD image into a raw hard disk image file which I then can copy (with dd) on the USB key.

To create a raw hard disk image I must know the exact size of data that can be put inside the USB key, and create a file with the same size (or less). For this step, I use “blockdev” to get the size, and use dd to create a sparse file with the desired size.

As root, knowing that “sdc” is the block device corresponding to the USB key:

# blockdev --getsize64 /dev/sdc
8027897856

As normal user, I run dd using the found value minus one.

$ dd if=/dev/zero of=usbkey.img bs=1 count=1 seek=8027897855

I then get the latest Debian testing ISO CD image, and run QEMU to install Linux on the raw hard disk image that I just created:

$ wget http://cdimage.debian.org/cdimage/daily-builds/daily/arch-latest/i386/iso-cd/debian-testing-i386-netinst.iso
$ qemu -m 512 -enable-kvm -hda usbkey.img -cdrom debian-testing-i386-netinst.iso

I start the installation of LXDE desktop environment, because it’s lightweight enough for many PCs and it doesn’t seem to write much on the hard drive, and then get to the manual partitioning, which is the “hard” part of the installation. First, I create the physical partitioning with the “windows” partition, the boot partition and the crypto partition as shown in the screenshot (all are primary partitions).

Debian installation - Physical partitioning of USB key

The “boot” partition has the boot flag enabled, and I set the ext2 filesystem to be mounted with noatime to reduce the number of writes. You can also enable the “mount as read-only” setting, but then it becomes difficult to upgrade the Linux kernel, the bootloader and the RAM disk.
Then I create the LUKS encrypted volume on the “crypto” partition, by providing a password to unlock it.

Debian installation - adding LUKS encrypted volume

Then I setup LVM on top of it, with space for swap and root partitions.

Debian installation - adding logical volumes with LVM

Then I assign the swap and root, setting ext2(noatime) as the filesystem for the root partition. The final result is shown in the following screenshot.

Debian installation - completing filesystem setup

Note that I used ext2 because writing to flash is very time consuming, and journaling file systems such as ext3 and ext4 do a lot of writing on the disk, impacting performance and life of the USB key.

The installation goes on, installing a full Debian OS. At one point, it asks what kernel I want to install, and I choose the “486″ version over the “686-pae” version, because it is more likely to be compatible with a generic PC.

Debian installation - choosing kernel version

When the installation is complete, I shut down the virtual PC and close QEMU. Then I can copy the content of the raw image to the USB key, by running as root:

# dd if=usbkey.img of=/dev/sdc

At the end of the process (it took my PC an hour to copy it), I have a working USB key that contains an encrypted Debian OS that I can use almost everywhere. I tested it on some PCs, an HP laptop, an IBM Thinkpad, and it worked the same on all of them. Some considerations:

• add a line with “vm.swappiness=10” in file  “/etc/sysctl.conf” to avoid using the slow swap partition.
• the execution is pretty fast because Linux does a lot of disk caching.
• sometimes on single-core PCs the CPU crunches at 100% and you can’t do anything, probably because it’s writing back the encrypted data on flash.
• on shutdown, Linux must write all the pending changes to flash, thus shutdown is not immediate.
• I must be very careful not to remove the USB key while it’s working. It can result in a corrupted filesystem or corrupted LUKS volume. The fact that ext2 is a non-journaling filesystem makes it worse.
• this solution is in some ways better than having an encrypted laptop with you: it’s resilient to “evil maid” attacks, an USB key is easier to take with you, and a laptop is “juicier” to steal.

Here’s an excerpt:

The Louvre Museum has 8.5 million visitors per year. This blog was viewed about 170,000 times in 2011. If it were an exhibit at the Louvre Museum, it would take about 7 days for that many people to see it.

Click here to see the complete report.

I noticed that most advices on the Internet seems to rely on using “/etc/modprobe.d/blacklist” file, but the modprobe.d man page explicitly states that the configurations must be put in files ending in “.conf” that must be put in the “/etc/modprobe.d/” directory. Which means that a working and future-proof way to disable beep is something like (run as root):

# echo blacklist pcspkr > /etc/modprobe.d/disable-beep.conf

Embedded Linux Conference Europe 2011 videos

Here is a personal selection of videos that I find most interesting:

Linus Torvalds, Alan Cox, Thomas Gleixner, Paul McKenney
moderated by Lennart Poettering
Kernel Developer Panel
Video (55 minutes):
full HD (622M), 450×800 (191M)

Grant Likely
Secret Lab
Device Tree Status Report
Video (51 minutes):
full HD (775M), 450×800 (178M)

Marc Titinger
ST Microelectronics
Efficient JTAG-Based Linux Kernel Debugging
Slides
Video (57 minutes):
full HD (382M), 450×800 (141M)

Pawel Moll
ARM Ltd.
Linux on Non-Existing SoCs
Video (52 minutes):
full HD (483M), 450×800 (143M)

If you have time though, I suggest watching them all!

A small girl approached the stage, and started talking about her adventure. She was involved with some friends in a humanitarian project, called “Nomads Marocco“, and one of their objectives was to teach Italian language to people of a small Moroccan village by going there and teach them by person with very limited resources.

They quickly realized that for an efficient course and for a lasting effect that could continue inside the village after they returned to Italy, an interesting approach would be to use computers. This means the Italian language course would then integrate an informatics course. The low-cost requirement of the project imposed the usage of old and recycled computers, and in order for old computers to be as efficient as possible, they decided to install Linux on them, specifically Xubuntu.

An important drawback of the plan was that in Morocco there’s little to no way to sustainably dispose of electronics. In order for the course to be environmentally sensible, they decided to offer support and maintenance every year, so that the failing components could be replaced and the electronic trash could be taken back to Europe where they can be recycled better,also thanks to associations such as RaccattaRAEE. Also, in order to throw away the least possible amount of components, the villagers must be taught about hardware maintenance, particularly about diagnosing a problem, removing and replacing bad parts, without throwing away the whole computer.

The girl told us about their travels, and the villages they reached. They mainly taught to women and children, because men were elsewhere (even abroad) to work and earn money to send back to the family. Sometimes they were amazed by what they found. Smart people eager to learn, internet connections in the middle of nowhere, they also found a boy who had already a PC with Linux installed. One of the benefits that the Moroccan villagers got with this project was the ability to use the Internet for commerce. Some of their products were sold on European market for much more than they could sell themselves, but by connecting with the rest of the world they now have the opportunity to reach new markets where they can be competitive and make a fair profit.

I was quite moved by the story, because it shows the results of technology, enthusiasm, planning, improvisation and curiosity playing together to improve the world. I really appreciate what these volunteers are doing, and I hope they will be of example to anyone with a desire to contribute.

The things we take for granted today are the revolutions of yesterday.

Since I own an Android phone I also activated the ability to use Google Authenticator, which adds a security token functionality to your smartphone. To setup the Authenticator you need to access Google on your PC, then activate the “Android” option for verification codes; the browser shows a QR code that can be scanned by Authenticator (with the help of a QR-scanning app such as QR Droid) and the Authenticator will show a code that can be used for a bunch of seconds. The QR code exchange is only done once: I assume it sets up a “seed” for the generation of random codes, which is known only by Google and your phone.

For other applications that access Google it is possible to generate specific passwords which can be revoked at any time, and Google can give you information about when the password was last used, to check if someone stole it.

There are also ten one-time-only verification codes that can be used when you don’t have your phone available.

I don’t know how this new authentication plays with the password recovery options, which are:

• Recovery through secondary e-mail address
• Recovery through SMS
• Recovery through personal security question

I suspect that these recovery options are able to give you a new password, but if you have 2-step authentication enabled then you will still need to have some sort of verification code.

I only see a potential problem about password recovery through SMS that can lead to a “shortcut” if someone steals your phone: in that case the thief will have both a way to recover your password and a way to get a verification code. For this reason I suggest keeping separate:

1. The phone for SMS password recovery
2. The phone for Android verification code
3. The phone for SMS verification code

That said, everything fails if your security question is “What is my favorite food? (hint: TMNT)” and the answer is “pizza”. I hope this isn’t news to you.

• Convergence: fixing SSL security
• New Convergence notaries emerge

The main list of Convergence notaries is on this Wiki page:

Notary list : share and find notaries!

Notaries

I suggest to add every notary on that list and immediately disable it in the Firefox add-on options, then take your time to understand who is running the notary, why is running it, and if you think it can be trusted enable the notary, otherwise remove it.

If you want to run a notary, don’t forget to add it on that list afterward.

[Edit: changed list URL]