Use kernel cmdline option 'usbcore.authorized_default=2' to lock all
external/user-visible USB ports by default.
The kernel distinguishes internal vs external USB ports using ACPI
methods (_UPC and _PLD) on x86/x86_64 systems. On ACPI systems, ports
marked as non-visible but connectable are considered internal (e.g.,
hard-wired USB-to-Ethernet adapters) and are automatically authorized,
while user-visible external ports require manual authorization.
However, on device tree systems the kernel lacks a standard mechanism
for identifying internal ports. The 'authorized_default=2' setting falls
back to requiring authorization for all devices on these platforms,
We list user-accessible USB ports in the device tree ('usb-ports' and
'usb-port-names'), with unlisted ports being implicitly internal and
managed separately.
Fixes#1065
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is the layout expected by the "distro boot" effort in U-Boot.
As far as I understand, the contract is:
- U-Boot built for `fooboard` by `vendor`, will set the `fdtfile`
variable to `vendor/fooboard.dtb` - or more precisely: matching
whatever path the dtb is built at in the kernel tree.
- A distro (e.g. Infix) then just needs to specify the `fdtdir` in its
syslinux config (/boot in our case), and U-Boot will be able to find
the correct dtb.
Store FIT headers separately on aux, and place the raw SquashFS images
on primary/secondary. This removes the need to muck about with the
device mapper to setup the rootfs, and it allows us to boot using
syslinux files.
Joachim Wiberg