Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fc14e1a authored by Mika Westerberg's avatar Mika Westerberg
Browse files

thunderbolt: Introduce USB only (SL4) security level 



This new security level works so that it creates one PCIe tunnel to the
connected Thunderbolt dock, removing PCIe links downstream of the dock.
This leaves only the internal USB controller visible.

Display Port tunnels are created normally.

While there make sure security sysfs attribute returns "unknown" for any
future security level.

Signed-off-by: default avatarMika Westerberg <mika.westerberg@linux.intel.com>
Reviewed-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
parent 9aaa3b8b

Documentation/ABI/testing/sysfs-bus-thunderbolt

+3 −0
Original line number Diff line number Diff line
@@ -35,6 +35,9 @@ Description: This attribute holds current Thunderbolt security level 
			minimum. User needs to authorize each device.

		dponly: Automatically tunnel Display port (and USB). No

			PCIe tunnels are created.

		usbonly: Automatically tunnel USB controller of the

			 connected Thunderbolt dock (and Display Port). All

			 PCIe links downstream of the dock are removed.



What: /sys/bus/thunderbolt/devices/.../authorized

Date:		Sep 2017

Documentation/admin-guide/thunderbolt.rst

+10 −5
Original line number Diff line number Diff line
@@ -21,11 +21,11 @@ vulnerable to DMA attacks. 
Security levels and how to use them

-----------------------------------

Starting with Intel Falcon Ridge Thunderbolt controller there are 4

security levels available. The reason for these is the fact that the

connected devices can be DMA masters and thus read contents of the host

memory without CPU and OS knowing about it. There are ways to prevent

this by setting up an IOMMU but it is not always available for various

reasons.

security levels available. Intel Titan Ridge added one more security level

(usbonly). The reason for these is the fact that the connected devices can

be DMA masters and thus read contents of the host memory without CPU and OS

knowing about it. There are ways to prevent this by setting up an IOMMU but

it is not always available for various reasons.



The security levels are as follows:
@@ -52,6 +52,11 @@ The security levels are as follows: 
    USB. No PCIe tunneling is done. In BIOS settings this is

    typically called *Display Port Only*.



  usbonly

    The firmware automatically creates tunnels for the USB controller and

    Display Port in a dock. All PCIe links downstream of the dock are

    removed.



The current security level can be read from

``/sys/bus/thunderbolt/devices/domainX/security`` where ``domainX`` is

the Thunderbolt domain the host controller manages. There is typically

drivers/thunderbolt/domain.c

+6 −1
Original line number Diff line number Diff line
@@ -117,6 +117,7 @@ static const char * const tb_security_names[] = { 
	[TB_SECURITY_USER] = "user",

	[TB_SECURITY_SECURE] = "secure",

	[TB_SECURITY_DPONLY] = "dponly",

	[TB_SECURITY_USBONLY] = "usbonly",

};



static ssize_t boot_acl_show(struct device *dev, struct device_attribute *attr,
@@ -227,8 +228,12 @@ static ssize_t security_show(struct device *dev, struct device_attribute *attr, 
			     char *buf)

{

	struct tb *tb = container_of(dev, struct tb, dev);

	const char *name = "unknown";



	return sprintf(buf, "%s\n", tb_security_names[tb->security_level]);

	if (tb->security_level < ARRAY_SIZE(tb_security_names))

		name = tb_security_names[tb->security_level];



	return sprintf(buf, "%s\n", name);

}

static DEVICE_ATTR_RO(security);

include/linux/thunderbolt.h

+4 −0
Original line number Diff line number Diff line
@@ -45,12 +45,16 @@ enum tb_cfg_pkg_type { 
 * @TB_SECURITY_USER: User approval required at minimum

 * @TB_SECURITY_SECURE: One time saved key required at minimum

 * @TB_SECURITY_DPONLY: Only tunnel Display port (and USB)

 * @TB_SECURITY_USBONLY: Only tunnel USB controller of the connected

 *			 Thunderbolt dock (and Display Port). All PCIe

 *			 links downstream of the dock are removed.

 */

enum tb_security_level {

	TB_SECURITY_NONE,

	TB_SECURITY_USER,

	TB_SECURITY_SECURE,

	TB_SECURITY_DPONLY,

	TB_SECURITY_USBONLY,

};



/**