Linux 5.1 Picking Up Option To Lockdown All But Internal USB Devices

[BNieuwenhuizen]

I wonder how it discriminates between an internal vs external device? After all, a motherboard USB header can be connected to an internal device (dvd drive for example) or to a panel of external USB ports on the front or rear of the chassis. How does it know?

Looks like it looks at ACPI to make that decision: https://github.com/torvalds/linux/bl...sb-acpi.c#L111

[ssokolow]

There's no way to identify that though. To the computer, it doesn't matter if the component is soldered down or plugged in through a port, it all looks the same.

As BNieuwenhuizen pointed out, it looks like it's getting the information from the ACPI tables. (Which makes sense. The motherboard would know which USB lines run to soldered-on components, so store that information in the firmware.)

[starshipeleven]

There's no way to identify that though. To the computer, it doesn't matter if the component is soldered down or plugged in through a port, it all looks the same.

internal devices on USB bus are defined as such in ACPI tables, just like any other device soldered down on other interfaces.

Of course desktops aren't using this because you can pipe the header to external ports or internal ports, as you said

EDIT: damn I got ninja'd

[StefanBruens]

I wonder how it discriminates between an internal vs external device? After all, a motherboard USB header can be connected to an internal device (dvd drive for example) or to a panel of external USB ports on the front or rear of the chassis. How does it know?

Any USB device exposed on a header would likely default to external, although this is not too relevant when you target Laptop form factors.

USB hubs have port capability bits which tell if the port is internal or external, and the hub chipsets I am aware of have bootstrap pins which can set this capability bits, e.g. when you have an onboard hub which is connected to a camera (internal), fingerprint reader (internal) and a USB-A port (external). This is a manufacturing option.

There is also the possibility to provide this information via Device Tree or ACPI. Google just has to provide the correct Firmware for its devices.