Francis Rowe (info(a)gluglug.org.uk) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/7058
-gerrit
commit 89d926afe0533d3bba5e693ba3a0eb5f42adab96
Author: Francis Rowe <info(a)gluglug.org.uk>
Date: Mon Oct 13 00:14:53 2014 +0100
NOTFORMERGE: ec/lenovo/h8: permanently enable wifi/trackpoint/touchpad, disable bluetooth/wwan
Wifi is enabled by default: most users will want wifi.
Intel wifi chipsets might be a security risk due to non-free firmware (these chipsets have DMA access)
and could leak data over a side-channel. Switching to a non-intel wifi chipset (without firmware, or with free firmware) is recommended.
Disable wwan. These chipsets have non-free firmware in them and direct memory access.
Disable bluetooth (potential security risk).
Enable trackpoint and touchpad. There is no reason to disable these.
Change-Id: Ic76ab9ab9c865f30312378e18af58bece6c3260a
Signed-off-by: Francis Rowe <info(a)gluglug.org.uk>
---
src/ec/lenovo/h8/h8.c | 22 ++++++++++++----------
src/ec/lenovo/pmh7/pmh7.c | 10 ++++------
2 files changed, 16 insertions(+), 16 deletions(-)
diff --git a/src/ec/lenovo/h8/h8.c b/src/ec/lenovo/h8/h8.c
index 79ef3cd..dd6f73c 100644
--- a/src/ec/lenovo/h8/h8.c
+++ b/src/ec/lenovo/h8/h8.c
@@ -245,9 +245,11 @@ static void h8_enable(device_t dev)
ec_write(H8_FAN_CONTROL, H8_FAN_CONTROL_AUTO);
- if (get_option(&val, "wlan") != CB_SUCCESS)
- val = 1;
- h8_wlan_enable(val);
+ // Permanently enable wifi
+ // Intel wifi could be a security risk because it uses firmware. Wlan chip has DMA
+ // and could leak data over a side-channel. Using another manufacturer is recommended.
+ // see http://libreboot.org/docs/index.html#recommended_wifi
+ h8_wlan_enable(1);
h8_trackpoint_enable(1);
h8_usb_power_enable(1);
@@ -255,14 +257,14 @@ static void h8_enable(device_t dev)
if (get_option(&val, "volume") == CB_SUCCESS)
ec_write(H8_VOLUME_CONTROL, val);
- if (get_option(&val, "bluetooth") != CB_SUCCESS)
- val = 1;
- h8_bluetooth_enable(val);
-
- if (get_option(&val, "wwan") != CB_SUCCESS)
- val = 1;
+ // Permanently disable bluetooth (potential remote security risk)
+ h8_bluetooth_enable(0);
- h8_wwan_enable(val);
+ // Permanently disable wwan
+ // These wwan chips have firmware in them - they have to. It's a small OS that handles communication
+ // with a telecoms provider. The issue is that this could allow remote access to the machine,
+ // and the cards have direct memory access. It could potentially leak data.
+ h8_wwan_enable(0);
if (conf->has_uwb) {
if (get_option(&val, "uwb") != CB_SUCCESS)
diff --git a/src/ec/lenovo/pmh7/pmh7.c b/src/ec/lenovo/pmh7/pmh7.c
index cb0e27b..f6d1a6b 100644
--- a/src/ec/lenovo/pmh7/pmh7.c
+++ b/src/ec/lenovo/pmh7/pmh7.c
@@ -118,13 +118,11 @@ static void enable_dev(device_t dev)
pmh7_backlight_enable(conf->backlight_enable);
pmh7_dock_event_enable(conf->dock_event_enable);
- if (get_option(&val, "touchpad") != CB_SUCCESS)
- val = 1;
- pmh7_touchpad_enable(val);
+ // Permanently enable touchpad
+ pmh7_touchpad_enable(1);
- if (get_option(&val, "trackpoint") != CB_SUCCESS)
- val = 1;
- pmh7_trackpoint_enable(val);
+ // Permanently enable trackpoint
+ pmh7_trackpoint_enable(1);
}
struct chip_operations ec_lenovo_pmh7_ops = {