broadcom-wl: enable WiFi/Bluetooth driver as discussed in PR #1580

apple/imac/14-2/default.nix

@@ -11,27 +11,30 @@
     ../../../common/gpu/nvidia
     ../../../common/gpu/nvidia/kepler
     ../../../common/hidpi.nix
+    ../../../common/broadcom-wifi.nix
   ];
 
-  boot = {
-    initrd.kernelModules = [
-      "applesmc"
-      "applespi"
-      "intel_lpss_pci"
-      "spi_pxa2xx_platform"
-      "kvm-intel"
-    ];
-    blacklistedKernelModules = [
-      "b43"
-      "ssb"
-      "brcmfmac"
-      "brcmsmac"
-      "bcma"
-    ];
-    kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
-  };
+  config = {
+    boot = {
+      initrd.kernelModules = [
+        "applesmc"
+        "applespi"
+        "intel_lpss_pci"
+        "spi_pxa2xx_platform"
+        "kvm-intel"
+      ];
+      blacklistedKernelModules = [
+        "b43"
+        "ssb"
+        "brcmfmac"
+        "brcmsmac"
+        "bcma"
+      ];
+      kernelPackages = lib.mkIf (lib.versionOlder pkgs.linux.version "6.0") pkgs.linuxPackages_latest;
+    };
 
-  hardware = {
-    bluetooth.enable = lib.mkDefault true;
+    hardware = {
+      bluetooth.enable = lib.mkDefault true;
+    };
   };
 }

apple/macbook-air/6/default.nix

@@ -1,16 +1,21 @@
 { config, lib, ... }:
 
 {
-  imports = [ ../. ];
+  imports = [
+    ../.
+    ../../../common/broadcom-wifi.nix
+  ];
 
-  boot.blacklistedKernelModules = [ "bcma" ];
+  config = {
+    boot = {
+      # Divides power consumption by two.
+      kernelParams = [ "acpi_osi=" ];
 
-  boot = {
-    # Divides power consumption by two.
-    kernelParams = [ "acpi_osi=" ];
-  };
+      blacklistedKernelModules = [ "bcma" ];
+    };
 
-  services.xserver.deviceSection = lib.mkDefault ''
-    Option "TearFree" "true"
-  '';
+    services.xserver.deviceSection = lib.mkDefault ''
+      Option "TearFree" "true"
+    '';
+  };
 }

apple/macbook-pro/11-1/default.nix

@@ -4,7 +4,10 @@
     ../.
     ../../../common/pc/ssd
     ../../../common/cpu/intel/haswell
+    ../../../common/broadcom-wifi.nix
   ];
 
-  hardware.enableRedistributableFirmware = lib.mkDefault true;
+  config = {
+    hardware.enableRedistributableFirmware = lib.mkDefault true; # broadcom-wl
+  };
 }

common/broadcom-wifi.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  options = {
+    hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable the legacy Broadcom WiFi driver (wl) with known security vulnerabilities.
+
+        This driver is vulnerable to heap buffer overflows:
+        - CVE-2019-9501 (https://github.com/advisories/GHSA-vjw8-c937-7hwp)
+        - CVE-2019-9502 (https://github.com/advisories/GHSA-4rfg-8q34-prmp)
+
+        Attackers within WiFi range can exploit this vulnerability by sending crafted
+        WiFi packets, even without being connected to the same network. Simply having
+        WiFi enabled makes the system vulnerable to arbitrary code execution or denial-of-service.
+        Only enable if no alternative WiFi solution is available.
+      '';
+    };
+  };
+
+  config = lib.mkIf config.hardware.broadcom.wifi.enableLegacyDriverWithKnownVulnerabilities {
+    boot.kernelModules = [ "wl" ];
+    boot.extraModulePackages = [
+      (config.boot.kernelPackages.broadcom_sta.overrideAttrs (oldAttrs: {
+        meta = oldAttrs.meta // {
+          knownVulnerabilities = [ ];
+        };
+      }))
+    ];
+  };
+}

dell/inspiron/3442/default.nix

@@ -4,10 +4,13 @@
   imports = [
     ../../../common/cpu/intel/haswell
     ../../../common/pc/laptop
+    ../../../common/broadcom-wifi.nix
   ];
 
-  services = {
-    fwupd.enable = lib.mkDefault true;
-    thermald.enable = lib.mkDefault true;
+  config = {
+    services = {
+      fwupd.enable = lib.mkDefault true;
+      thermald.enable = lib.mkDefault true;
+    };
   };
 }

dell/xps/13-9343/default.nix

@@ -5,16 +5,17 @@
     ../../../common/cpu/intel
     ../../../common/pc/laptop
     ../../../common/pc/ssd
+    ../../../common/broadcom-wifi.nix
   ];
 
-  services = {
-    fwupd.enable = lib.mkDefault true;
-    thermald.enable = lib.mkDefault true;
-  };
-
-  boot = {
-    kernelModules = [
+  config = {
+    boot.kernelModules = [
       "kvm-intel"
     ];
+
+    services = {
+      fwupd.enable = lib.mkDefault true;
+      thermald.enable = lib.mkDefault true;
+    };
   };
 }