From 937d4c38c79079f50e897ef18a6a8a8e570407b2 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Sat, 18 Oct 2025 13:16:00 +0200 Subject: [PATCH] board: make usb subsystem a built-in Use kernel cmdline option 'usbcore.authorized_default=2' to lock all external/user-visible USB ports by default. The kernel distinguishes internal vs external USB ports using ACPI methods (_UPC and _PLD) on x86/x86_64 systems. On ACPI systems, ports marked as non-visible but connectable are considered internal (e.g., hard-wired USB-to-Ethernet adapters) and are automatically authorized, while user-visible external ports require manual authorization. However, on device tree systems the kernel lacks a standard mechanism for identifying internal ports. The 'authorized_default=2' setting falls back to requiring authorization for all devices on these platforms, We list user-accessible USB ports in the device tree ('usb-ports' and 'usb-port-names'), with unlisted ports being implicitly internal and managed separately. Fixes #1065 Signed-off-by: Joachim Wiberg --- board/aarch64/linux_defconfig | 2 +- board/aarch64/rootfs/boot/syslinux/syslinux.conf | 2 +- board/common/rootfs/etc/modprobe.d/usbcore.conf | 3 --- board/riscv64/rootfs/boot/syslinux/syslinux.conf | 2 +- board/x86_64/grub.cfg | 6 +++--- board/x86_64/linux_defconfig | 2 +- 6 files changed, 7 insertions(+), 10 deletions(-) delete mode 100644 board/common/rootfs/etc/modprobe.d/usbcore.conf diff --git a/board/aarch64/linux_defconfig b/board/aarch64/linux_defconfig index 803010f8..12921f27 100644 --- a/board/aarch64/linux_defconfig +++ b/board/aarch64/linux_defconfig @@ -433,7 +433,7 @@ CONFIG_REGULATOR_S2MPS11=y # CONFIG_HID_MICROSOFT is not set # CONFIG_HID_MONTEREY is not set CONFIG_USB_ULPI_BUS=y -CONFIG_USB=m +CONFIG_USB=y CONFIG_USB_OTG=y CONFIG_USB_XHCI_HCD=m CONFIG_USB_XHCI_MVEBU=m diff --git a/board/aarch64/rootfs/boot/syslinux/syslinux.conf b/board/aarch64/rootfs/boot/syslinux/syslinux.conf index f6aafd54..c7e58ab1 100644 --- a/board/aarch64/rootfs/boot/syslinux/syslinux.conf +++ b/board/aarch64/rootfs/boot/syslinux/syslinux.conf @@ -1,4 +1,4 @@ label Infix (aarch64) kernel /boot/Image fdtdir /boot - append ${bootargs_root} ${bootargs_log} -- ${bootargs_user} + append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user} diff --git a/board/common/rootfs/etc/modprobe.d/usbcore.conf b/board/common/rootfs/etc/modprobe.d/usbcore.conf deleted file mode 100644 index c2100e52..00000000 --- a/board/common/rootfs/etc/modprobe.d/usbcore.conf +++ /dev/null @@ -1,3 +0,0 @@ -# Do not authorize usb ports before they have been checked in in the device-tree -options usbcore authorized_default=0 - diff --git a/board/riscv64/rootfs/boot/syslinux/syslinux.conf b/board/riscv64/rootfs/boot/syslinux/syslinux.conf index 6ea9f034..4e0dedb5 100644 --- a/board/riscv64/rootfs/boot/syslinux/syslinux.conf +++ b/board/riscv64/rootfs/boot/syslinux/syslinux.conf @@ -1,4 +1,4 @@ label Infix (riscv64) kernel /boot/Image fdtdir /boot - append ${bootargs_root} ${bootargs_log} -- ${bootargs_user} + append ${bootargs_root} ${bootargs_log} usbcore.authorized_default=2 -- ${bootargs_user} diff --git a/board/x86_64/grub.cfg b/board/x86_64/grub.cfg index 3df925a8..c62114e1 100644 --- a/board/x86_64/grub.cfg +++ b/board/x86_64/grub.cfg @@ -42,14 +42,14 @@ export secondary submenu "primary" "$log" { set slot="$1" - set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2" + set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2" set root="($primary)" source /boot/grub/grub.cfg } submenu "secondary" "$log" { set slot="$1" - set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2" + set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 root=PARTLABEL=$slot $2" set root="($secondary)" source /boot/grub/grub.cfg } @@ -63,7 +63,7 @@ submenu "net" "$log" { set root=(initrd) set slot="$1" - set append="console=ttyS0 console=hvc0 qroot=/dev/ram0 ramdisk_size=65536 $2" + set append="console=ttyS0 console=hvc0 usbcore.authorized_default=2 qroot=/dev/ram0 ramdisk_size=65536 $2" source /boot/grub/grub.cfg else if [ -z "$net_efinet0_dhcp_next_server" ]; then diff --git a/board/x86_64/linux_defconfig b/board/x86_64/linux_defconfig index 21787f09..957e9f7b 100644 --- a/board/x86_64/linux_defconfig +++ b/board/x86_64/linux_defconfig @@ -219,7 +219,7 @@ CONFIG_WATCHDOG=y CONFIG_WATCHDOG_SYSFS=y CONFIG_SOFT_WATCHDOG=y CONFIG_I6300ESB_WDT=y -CONFIG_USB=m +CONFIG_USB=y CONFIG_USB_XHCI_HCD=m CONFIG_USB_EHCI_HCD=m CONFIG_USB_UHCI_HCD=m