USB Gadgets

On the USB Armory

#!/bin/bash

# assumes a disk image exists here...
FILE=/home/usbarmory/usbdisk.img
mkdir -p ${FILE/img/d}
mount -o loop,ro,offset=1048576 -t ext4 $FILE ${FILE/img/d}
cd /sys/kernel/config/usb_gadget/

mkdir -p usbarmory
cd usbarmory
#echo '' > UDC

echo 0x1d6b > idVendor # Linux Foundation
echo 0x0104 > idProduct # Multifunction Composite Gadget
echo 0x0090 > bcdDevice # v0.9.0

mkdir -p strings/0x409
echo "fedcba9876543210" > strings/0x409/serialnumber
echo "Inverse Path" > strings/0x409/manufacturer 
echo "USB Armory" > strings/0x409/product 

N="usb0"
mkdir -p functions/acm.$N
mkdir -p functions/ecm.$N
mkdir -p functions/eem.$N
mkdir -p functions/mass_storage.$N

# first byte of address must be even
HOST="48:6f:73:74:50:43" # "HostPC"
SELF="42:61:64:55:53:42" # "BadUSB"
echo $HOST > functions/ecm.$N/host_addr
echo $SELF > functions/ecm.$N/dev_addr
echo $HOST > functions/eem.$N/host_addr
echo $SELF > functions/eem.$N/dev_addr

echo 1 > functions/mass_storage.$N/stall
echo 0 > functions/mass_storage.$N/lun.0/cdrom
echo 0 > functions/mass_storage.$N/lun.0/ro
echo 0 > functions/mass_storage.$N/lun.0/nofua

echo $FILE > functions/mass_storage.$N/lun.0/file

C=1
mkdir -p configs/c.$C/strings/0x409
echo "Config $C: ECM network" > configs/c.$C/strings/0x409/configuration 
echo 250 > configs/c.$C/MaxPower 
ln -s functions/acm.$N configs/c.$C/
ln -s functions/ecm.$N configs/c.$C/
ln -s functions/mass_storage.$N configs/c.$C/

C=2
mkdir -p configs/c.$C/strings/0x409
echo "Config $C: EEM network" > configs/c.$C/strings/0x409/configuration 
echo 250 > configs/c.$C/MaxPower 
ln -s functions/acm.$N configs/c.$C/
ln -s functions/eem.$N configs/c.$C/
ln -s functions/mass_storage.$N configs/c.$C/

# it took a little while to find out that the i.MX53 uses
# a ChipIdea core and thus "ci_hdrc.0" is the right driver 
#echo ci_hdrc.0 > UDC

# this lists available UDC drivers
ls /sys/class/udc > UDC

ifconfig $N 6.0.0.1 netmask 255.255.255.252 up
route add -net default gw 6.0.0.2

On the Host

rmmod cdc_subset
ifconfig usb0 10.0.0.2 netmask 255.255.255.252 up
/sbin/iptables -t nat -A POSTROUTING -s 10.0.0.1/32 -o wlan0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

Future Plan

• insert blank microsd
• use imx_usb_loader inject custom u-boot that defaults to usb-SerialConsole, and export up to the first 1GB of mmc0 as mass storage
• partition, format, install over usb
• use serial console to configure uBoot
• reboot

Approaches to Multifunction Devices

• gadgetfs?
• hid-gadgetfs
• configfs?
• functionfs?
• monolithic composite module?
• how to route some functions to kernel (eem, acm) and some to userland (smartcard)
• how to dynamically reconfigure; add remove function without disturbing others? emulate hub?

Links

• http://www.linux-usb.org/gadget/
• https://www.kernel.org/doc/Documentation/usb/gadget_configfs.txt
• https://www.kernel.org/doc/Documentation/usb/gadget_serial.txt
• https://www.kernel.org/doc/Documentation/ABI/testing/configfs-usb-gadget